nanoff --deploy without --address writes the app image at 0x1B0000, inside the factory partition, while the real deploy partition on ESP32_CAM_REV3 is 0x1E0000; nanoff reports bytes written, hash verified, OK, and the app never runs. Help text says --address is required but the tool doesn't enforce it, and the hash check only proves the bytes landed, not that they landed somewhere useful.