Fix dirty session keys.

src/helpers/BaseChatMesh.cpp

@@ -1000,6 +1000,7 @@ bool BaseChatMesh::removeContact(ContactInfo& contact) {
     nonce_at_last_persist[idx] = nonce_at_last_persist[idx + 1];
     idx++;
   }
+  memset(&contacts[num_contacts], 0, sizeof(ContactInfo));
   return true;  // Success
 }
 
@@ -1139,6 +1140,7 @@ SessionKeyEntry* BaseChatMesh::allocateSessionKey(const uint8_t* pub_key) {
 
 void BaseChatMesh::removeSessionKey(const uint8_t* pub_key) {
   session_keys.remove(pub_key);
+  session_keys_dirty = true;
 }
 
 // --- Session key support (Phase 2 — initiator) ---
@@ -1395,6 +1397,8 @@ void BaseChatMesh::checkSessionKeyTimeouts() {
       // All retries exhausted — clean up
       memset(entry->ephemeral_prv, 0, PRV_KEY_SIZE);
       memset(entry->ephemeral_pub, 0, PUB_KEY_SIZE);
+      memset(entry->session_key, 0, SESSION_KEY_SIZE);
+      memset(entry->prev_session_key, 0, SESSION_KEY_SIZE);
       entry->state = SESSION_STATE_NONE;
       entry->timeout_at = 0;
     }

src/helpers/ClientACL.cpp

@@ -223,6 +223,7 @@ bool ClientACL::applyPermissions(const mesh::LocalIdentity& self_id, const uint8
       nonce_at_last_persist[i] = nonce_at_last_persist[i + 1];
       i++;
     }
+    memset(&clients[num_clients], 0, sizeof(ClientInfo));
   } else {
     if (key_len < PUB_KEY_SIZE) return false;   // need complete pubkey when adding/modifying
 
@@ -460,6 +461,7 @@ SessionKeyEntry* ClientACL::allocateSessionKey(const uint8_t* pub_key) {
 
 void ClientACL::removeSessionKey(const uint8_t* pub_key) {
   session_keys.remove(pub_key);
+  _session_keys_dirty = true;
 }
 
 void ClientACL::loadSessionKeys() {