[CBU/BK7231N] Restoring K601 Smart Circuit Breaker Firmware After Failed UART Flash on BK7231N

Hello there!
I just received a circuit breaker a couple of days ago. I did a backup with hid-download's uartprogram, but in the meanwhile it turned out there was some connection issue, probably with the ground. The backup stopped with a wrong CRC a couple of times, and I didn't realize it hadn't saved the whole flash area.
After that, I had a couple of other write attempts. The first few were also unsuccessful with CRC errors, but after some I managed to fix the connection issue and the flash write was done.
The device was not booting at all, so I decided to flash the area with 0xFF padding and try to rewrite the UART binary later. After many attempts, I was not able to restore the original firmware, and it was pretty much dead when I flashed the UART binary.
What could I do? I assume the bootloader is not dead completely; however, according to my assumptions it should be in the first part of the flash memory area, which was 0xFF-ed a couple of times.
So I was able to start the flashing with uartprogram, bktools and ltchiptool, but I couldn't make the device alive. I also tried to flash other whole binaries from BK7231N devices, but it's still dead. I know the MAC address; some RF-related configs might not be optional for another chip. That was just an idea to try to unbrick the device.


What options do I have now?

It should be easy to revive this device. BK7231N (unlike BK7231T) can be still flashed, even if you fill whole 2MB memory with 0xFF.

Try to flash it with some full 2MB binary from our flash dumps repository and then take TX2 log output for diagnosis at 115200 baud.

Actually, it looks like I was kind a misled by the LEDs. Both remain slightly lighting, doen't matter what FW I've flash onto.
It looks like, the full dump from the other device was working before. So:
* I reflashed the whole binary
* click on the "Restore (recreate) RF config" on the flash tab at the webapp.


However I feel like something is wrong with the relay or the way of controlling the relay. When I've found that first on the GPIO finder, there was a relay close sound, which was very weird compared to the small plugs with 16 or 20 Amps relays.
Since that, the relay remains closed and even if I toggle that, I can hear a really small ticking sound. I opened it up, and it's closed permanently. According the label, it has 5 V operating voltage and I can measure 4,5 Volts on the relay's connector. What could be wrong?
It seems like, the relay is not controlled with ground and 5V, seems like it need inverse voltage to disconnect.
At the back side of the PCB, there are two diodes are connected in serial in D3.

I'm adding some more pictures:

That's a bridge relay, it requires two pins. Please extract Tuya config.
https://www.elektroda.com/rtvforum/topic4098397.html

I don't have the first 924 KB of flash content. Where is that 72 KB for the Tuya config stays at if we look at the 2 MB binary?

Added after 1 [hours] 39 [minutes]:

I figured out the pinout with a multimeter. The config has been updated.
Thanks for guiding me!