Remote firmware transaction, full operational telemetry and PU850 route acceptance

Remote updater / telemetry / PU850 route acceptance

Scope: version 0.2.7 integrated ESP + AVR maintenance, client/cloud telemetry and route adaptations. This is not a claim that all older whole-project requirements are complete.

Pinned manifest download, selected-board staging, SHA-256/profile/size checks and exact job/boot identity.
Durable recovery/Prog gates, EESAVE-independent EEPROM restoration, full flash readback, no automatic mutation replay.
Post-reboot ESP hash/version/CRC and actual AVR version/profile gate before one Prog release.
Integrated native Firmware settings, Web, JSON API, local WebSocket, cloud command, CLI/TUI and Telnet paths.
Full operational board telemetry, eight-client bounded reports, Windows host metrics and checksummed MQTT snapshot fragments.
All 50 donor route registrations classified with current hashes, anchors and exact omission reasons.
Locked busy-wire/polling builds, Rust tests, actual ISP emulator, Web/publisher/CLI/reassembly tests.
Actual RemoteFirmware state-machine host tests: complete pair, stage-only, boot ownership, tampered staging/postboot, interrupted prepare/program/release journals, lost release ACK, storage/HTTP/callback/OTA failures, cancellation and cross-origin bearer isolation. Network/FS/updater doubles, not physical/TLS proof.
Visual sign-off: candidate settings window launched against a labelled simulated peer; screenshot helper failed twice with service timeout 0x8007041D. Existing production app/Preferences preserved.
Physical HTTPS download and wrong hash/size/profile/clock/CA rejection against the actual publisher.
Eight-client heap/TLS/telemetry stress on ESP8266 and real cloud MQTT/WebSocket reception.
Actual both-board update, EEPROM/Urboot/postboot/Prog/peripheral acceptance and controlled power-loss recovery.
ASUS deployment/visual check on the remote laptop, currently SSH localhost:1022 refuses connections; ledboard.local unresolved locally.

Retain draft PR status and open production acceptance until hardware checks pass. See docs/REMOTE-MAINTENANCE.md and docs/PU850-ROUTE-PARITY.json. Broader donor/UI/mobile parity remains tracked by existing issues, not closed by this feature.

Implementation checkpoint: 01a898e (0.2.7), in draft PR #1. Added checksum-pinned remote two-board transactions, EEPROM-safe ISP, full operational telemetry/client reports, integrated native/Web/CLI/TUI/Telnet/cloud surfaces, and 50 exact PU850 route mappings. 77 Rust tests and actual RemoteFirmware state-machine/ISP host tests passed. Firmware final builds and CI evidence will follow. No physical board/EEPROM/fuse write occurred; localhost:1022 refuses connections and curl cannot resolve ledboard.local. Windows visual capture failed twice; existing running app/Preferences preserved. Production acceptance remains open.

Final local candidate evidence: 0.2.7 / `01a898e`

Source: 01a898e. Working tree clean after push. Candidate packages prepared locally with SHA-256 receipt, both link modes, full 32768-byte AVR + Urboot images, native executable, publisher helpers, telemetry reassembly helper, guide and exact route ledger. Example publisher URLs are placeholders, not deployed endpoints.

Native package SHA-256: c14f395a15d3a4b1df143f4a29f77210c6f73240e1b936130577a3cbfe7aef57.
Busy-wire ESP SHA-256: 06e3c5bba4ed62794b63e588702ca92166fec05234a05a90b0c66c2efcabce5e; full AVR: bf08d2a38e8ba2b04fd13b0fb72be81cfb00e159b1a401f3eff654e943be2b93.
Polling ESP SHA-256: 2a557d9b1a89487515f68331b4de659060804de6e15dc9209bd8d27593b4f7e8; full AVR: a27ac2d8f20e02087d0509072ac4f6d89e317638c00ebf3f144a68e6a2c54cab.

Production gates, draft PR and broader donor/UI/mobile parity issues stay open. See docs/REMOTE-MAINTENANCE.md and docs/PU850-ROUTE-PARITY.json at this commit.

Checkpoint: 5f00df3, pushed/remote identity verified. PR #1 remains draft production work; no CI wait or hardware write.

Actual mobile remote manifest staging (apply=false), exact fresh job/boot/hash/targets before apply/cancel, strict phase/ACK checks, no redirect/replay and bounded total HTTP deadline.
Individual live ISP/OTA ACK controls, destroyed-view navigation lock release and stale late-response rejection.
Real full AVR/Urboot/EEPROM backup import/export, ISP probe (mutating GET sent once), explicit shared-image programming and manual ESP OTA with honest limitations.
Fully read actual Pealayer ServerFilePicker.tsx + preferenceFiles.ts; actual extension helper imported and selection/owner/cancel adapted to Android SAF, one-use new-document export, no broad storage permission/arbitrary path write. Required mobile-firmware gate added to the existing ledger/index.
Clean Flutter analyzer, all 73 tests, actual inspected phone/tablet renderer images with zero mutations, Kotlin bridge compiled in warm APK. Source-quality suite passes. Code/HTTP/MethodChannel/package evidence, not physical acceptance.
Actual Android providers, rotation/process death, real publisher TLS/board flashing, EEPROM/Urboot/Prog/power-loss/peripherals and production signing.
Full mobile locale/preferences/back-draft protection and all remaining donor files/consumers. Manual shared AVR staging has no advertised hash/CAS; pinned remote job is preferred. Direct OTA acceptance does not prove postboot version.

Exact mappings, omissions, sources, screenshots and safety: https://github.com/atomicdeploy/PakarController/blob/5f00df3252f28f143d5db9033d3215868f424c1a/docs/MOBILE-FIRMWARE.md
APK preview SHA256 16d5c7d421d60cbc737dbd947cee56fb9219c8e1181ef47447934f1934c09432, 53971590 bytes, 0.2.7 debug identity (not production). Existing published settings/earlier rollback previews retained. One 1.029 GiB canonical cache, no new SDK/cache/clean, donor or unrelated native/firmware build. ASUS SSH localhost:1022 refused; old production desktop/boards preserved.

Integrated S3 checkpoint 456fd20 is pushed; actual ASUS hostname-first HTTP and read-only WebSocket telemetry now work with expected board/boot identity. See the latest issue #2 checkpoint and docs/ESP32-S3-COMMISSIONING.md for exact hashes and acceptance boundaries. Actual DNS-SD PTR/SRV/TXT, multicast SSDP, firmware transactions, cloud round trips and concurrent maintenance remain open. AVR sound still repeats even with UART disabled; physical tests are held for silence/diagnosis. No AVR erase/flash/EEPROM/fuse operation occurred. This does not close route, recovery or physical acceptance.

Integrated Async/WS/OTA worktree candidate — physical handoff still blocked

Based on main 2dc319fb8add1516a0f2caa4306bee1bcb1284ab; this is a preserved dirty-worktree/source+SDK checkpoint, not a new pushed commit or installed release.

Added coherent measured local-OTA progress with optional exact raw-image size/MD5 headers; reject declared overrun/short file before boot commit. /update/info uses boot-captured metadata, avoiding whole-image hashing on each poll. Read-only status/WS status+ping remain available during local OTA; mutators remain inhibited.
Main-loop-only, finite/coalesced existing AVR scheduled TM1637 progress frames and optional S3 LCD progress. Requires fresh TM1637 ACK, no Prog/AVR-upload owner; no new AVR firmware or extra sound. The AVR cannot drive its own display while ISP holds it in RESET; ESP LCD/network covers that stage. UART enqueue is not display proof.
Guarded tools/update-firmware.ps1: default auto, plan without device contact unless -Run, hostname-first/no factory credentials, local Async HTTP preferred before write, pinned Internet stage/separate apply supported. Auth must read explicitly disabled before/after; no auth is enabled. Unknown writes have no fallback/replay. Verify same board/new boot, selected/running VALID slot, MD5/size/integrity, full running-image SHA256 and same-peer WebSocket status. Transfer and total verification time are separate.
Focused actual progress/unchanged AVR consumer, concurrency/rollover, HTTP/WS loopback multipart/fragmentation, auth/no-replay/reboot/SHA fixtures pass. Existing actual async HTTP ownership, WebAccess auth/origin/epoch/persistence, S3 remote staging/tamper/abort and ESP-only maintenance guards pass. These are host/SDK doubles, not physical acceptance.
Guarded S3 SDK build passes: buffered UART,16MB/OPI PSRAM,RMT-DMA,W5500,ISP electrical build acknowledgement. Version0.2.7; sketch1994971/3342336, globals99408/327680. Raw image1995120bytes, SHA256 c5c4b39067e33d37bd65f6726d5f22310414fa5bf04b9c701b00bf49dafaf047, MD5 4b565333ed0f6538d44cc47591af2005. Native/mobile version remains0.2.7; not rebuilt/deployed by this slice.
Actual PU AsyncOTA/FirmwareTransfer reread; PCController UPDATE-PROGRESS.md complete read and original-byte hash matched. Existing ledger updated with exact target/test hashes and explicit remaining omissions. Generation/Check:4673 inventoried,159 comparisons,4514 pending,119 parity gaps. Not donor-wide parity.
Live candidate install, current auth-off persisted readback, LAN/Internet speed comparison, aborted/concurrent OTA, power/AP recovery, physical seven-segment and matrix acceptance.
Current ASUS SSH localhost:8022 refuses, ledboard.local unresolved, local only COM1. No board contact, flash/ISP/reset, auth mutation or audible/PBX call this turn. USB removal is not cleared. Restore ASUS tunnel/device access for actual verification. Previous successful Internet jobs in the guide are historical, not current-candidate proof.

Compiler initially caught my new remote-progress accessor outside its class; it was corrected before the passing actual updater fixture/SDK build. A stale literal ledger anchor was also corrected by rereview, not bypassed. The obsolete task-level fixed-IP/factory-password uploader now delegates to the guarded checkout wrapper. No SDK install, clean, duplicate cache or unrelated app rebuild. Master issue #2 and hardware gates remain open.

Firmware subscriptions, manual files and externally initiated progress — `c864967`

Source checkpoint · living inbox contract · runtime/package receipts.

Native Firmware & storage and Android context-menu Firmware now support explicit remote WebSocket/Socket.IO subscriptions, manual local images and SHA-256-verified direct HTTP(S) firmware files. Genuine Engine.IO open/namespace CONNECT/heartbeat/event tuple, not a JSON-only Socket.IO imitation. Explicit endpoint/event/namespace/trusted HTTPS origin; optional memory-only credentials.
Finite peer/boot/session/deadline/hash-bound offers with duplicate suppression; review before delivery by default. Explicit arming permits fresh ESP binary delivery. AVR binaries/manifests stage only; programming/paired Apply stays explicit. Recheck ownership/offer expiry after download before upload. Source credentials never inherit board authentication or pin headers; no redirects or extra disk artifact cache. No silent USB-to-Wi-Fi fallback.
Download/upload stage counters plus actual board update and remote_firmware observations across native, Flutter, embedded Web and native TUI. Existing selected status/WS stream is reused; no redundant polling while fresh. Verification/reboot/programming without a measured denominator is indeterminate. Accepted or 100% transferred is not marked verified completion. Same-board reboot retains firmware-page controls without replay.
Actual ASUS owner PID22736/session1 EXE28425728bytes SHA256 bd9318d4c01128abd83908f104342c5069be5352b7d5534297744f3cf34892fe. Draft/pending IPC clear; prior owner gracefully quit, settings/rollback preserved, atomic replacement via existing Limited/Interactive production task. Actual owner remains USB COM22 selected/online, no pending USB command.
Actual external MQTT-requested HTTPS stage job16. ASUS USB observed727868/1908480bytes(38.1%) then1543868/1908480bytes(80.9%); these are native owner IPC observations, not fixtures. Exact manifest/image verification reached ready. MQTT Apply had no correlated ACK and was NOT replayed; fresh full telemetry plus hostname native read confirmed unchanged boot/exact ready job before a new explicit native CLI Apply. That returned prepare/busy, not success-by-assumption.
ESP actual new boot a42b1105aba6938b525c416e0d63956c, completed postboot running-image verification, expected1908480bytes SHA256 e35d11c57de89ff99a86a66fd5ecdf0af908e1f755753ce0db1c55fbe3aee083, MD5 d8cd149da1c85eed34e2c405fa99e609, integrity verified and app0 selected/running VALID. MQTT reconnected; same native USB owner shows Board update#16 complete/verified. Static/16MB/OPI/BGR/GPIO4 profile unchanged. AVR online0.2.7, Prog clear; no AVR program/reset/fuse/EEPROM or audio test.
Nine focused native firmware cases, six Flutter delivery/progress/actual socket/HTTP cases, six firmware-page phone/tablet/cancel/uncertain/reboot cases, analyzer, actual Web decoder tests,50 PU routes,23 PC mappings, versions and hash-ledger gates pass. Canonical warm native/APK/S3 builds pass. Simulated real Flutter renderer capture inspected, not phone proof. All source versions0.2.7/Android+7. New CI runs asynchronously; no full-CI wait or green claim.
Five actual complete-file PC donor reviews: hostbridge manager, hostui progress and test, artifacts downloader, mobile firmware. Same authoritative ledger now207 comparisons/4466 pending/165 known gaps. Explicit omitted generic RPC, OS notifications, resumable disk artifacts and background services remain pending; not donor-wide parity.
Actual configured external WSS/Socket.IO service interoperability: no operator endpoint supplied; none guessed or contacted. Loopback protocol fixtures are not remote-service acceptance. Reconnect is explicit, Android subscription foreground-only.
Android installation/runtime/human acceptance: final APK56362977bytes SHA256 484dbcbdf3c54758376b0cb0bfb4cef42d62677121c9b36c676998cfdff1050c built; ASUS has no authorized attached ADB device. No installation claimed.
USB-only firmware forwarding; current firmware delivery requires the selected network route, while USB observes externally initiated updates. Existing power-loss/concurrency/soak/HTTP and MQTT delivery-reliability issues remain open, including the missing Apply ACK above.
Physical LED/display/audio and full donor parity, existing dependency-security issue Resolve blocked glib security update without dropping Linux tray features #17 and remaining production checklist remain open. No production-wide completion claimed.

No open PRs at checkpoint. Issues #2 and #7 remain open.

Android self-distribution and board automation — `af6c309`

Pushed af6c3096831d9a7cf2e292f312fbdcf63362031a. Operator/feed contract and UI captures, exact donor/target/proof hashes and omissions, verification receipt.

Separate advanced App updates/replication and Automatic firmware pages using actual shared Studio widgets/theme/fonts/icons; app updates work without a board connection.
Android SAF APK import/export, bounded ordered peer push/pull, direct HTTP(S) APK downloads, native package/signer/newer-version/SDK/ABI/hash checks and PackageInstaller consent/receipts. Same preview signing identity retained; no remote installer method or silent installation.
Opt-in package sharing and verified DNS-SD/mDNS, SSDP, MNDP discovery, package manifests and same-instance route deduplication. Incoming push needs receiver approval and an expiring exact-transfer capability.
Configurable HTTP catalogs and WSS/real Socket.IO app/firmware offer feeds, namespace/event/origin/session/deadline bounds, durable write-ahead digest receipts, read-only reconnect and late-socket cleanup.
App-lifetime foreground-only policies. Automatic newer-APK download is opt-in and still awaits local/Android install consent. Board automation is independently opt-in and assigned to exact board/application, never a discovered replacement.
Local/HTTP firmware import and ESP/AVR backup exports retained. Automatic ESP/AVR/both upgrades use the existing pinned manifest transaction. Raw AVR stage-only; raw ESP has explicit confirmed immediate Upload. Manual/automatic mobile maintenance excluded.
Actual hash-bound ISP/Urboot maintenance request/board-clock/deadline/job/boot receipt replaces unpinned shared-image Program UI. Queued/transferred is not verified completion.
Clean analyzer and final 257 Flutter tests pass, 2 opt-in captures skipped; separately rendered/inspected actual phone and tablet fixtures with zero board writes. Existing PowerShell tooling, reuse-preflight, ledger/report, living-API and version guards pass.
Warm preview APK 0.2.7+8 compiled actual Kotlin channels/receiver; 57,346,153 bytes, SHA256 a60d7f968276d81ca3bd792ba9ad8911d6463ab635491f27d41846e7ff06b6fe. apksigner verification passes; debug signer matches existing preview. All software source semvers remain 0.2.7; Android build counter 7→8.
Same hash/size staged locally and on actual DAVID-ASUS at C:\Users\David\Documents\PakarController\staging\PakarController.apk, pending-copy integrity checked before promotion; existing rollback/settings/native owner preserved. One 1.116GiB/4392-file warm mobile cache; no SDK install/clean/new cache or unrelated native/board builds.
Actual phone installation and two-installed-version self-upgrade/OS-consent acceptance. Fresh ASUS ADB list is empty; staged is not installed.
Actual multi-Android multicast/replication and operator-configured remote WSS/Socket.IO/TLS interoperability; no external endpoint was guessed/contacted.
Physical ESP/AVR/Urboot/EEPROM/Prog/power-loss/update acceptance; no board reset/flash/fuse/EEPROM/audio/PBX action in this slice.
Android background foreground-service uptime, split APKs/key rotation, direct USB-host firmware programming and remaining generic donor RPC parity.

Seven new full PCController file comparisons: 223/4673 compared, 4450 pending, 181 known parity-gap files. Exact useful omissions stay pending; not donor-wide or production acceptance. CI runs asynchronously; no all-green assertion or master issue closure.

Graceful upgrade lifecycle — `11e4ca1`

Source checkpoint · procedure and actual board receipt · donor/failure receipt.

Loop-owned, peer/boot/operation/revision-bound lifecycle on JSON, local WS and cloud; measured stage bytes, nullable unknown percent, coalesced progress and no duplicate stage notices. Transfer100% is never installation success.
Full480-pixel maintenance overlay preserves scene/mapping/mode/output preference; per-pixel shutdown/startup fade and final complete black frame. Raw Urboot quiesces output before reset/UART acquisition and defers cloud writes; no framed parser or cosmetic delay in bootloader ownership.
Existing finite AVR Timer1 descending450ms update-start cue reused; no new AVR flash needed. Fresh capability/Prog/raw-owner guards; postboot success requires durable computed-size/MD5/integrity receipt. Notice persisted consumed before one enqueue, never replayed.
Actual board sound unmuted using full-preservation GET/SET/GET with persistent readback. Final AVR online, silent=false persisted, Prog clear, buzzer idle.
Production16MB/OPI/buffered/static/BGR/GPIO4 SDK build and two hostname-first ASUS Async HTTP OTA passes. Image1958288bytes, SHA256490876452384ef9bacf411df767e1b5ab4cf689f7476e2c4b8e7e210c8b88696. First transfer18.205s/full verification49.405s. Controlled lifecycle transfer19.414s;59 real WS events, zero duplicate/reordered revisions, measured receiving→indeterminate verifying→shutdown.
Actual boot d1170ed71821eda19075c19d70bad8c0, expected/observed size+MD5 equal, running integrity/VALID selected slot, durable complete receipt and notice_consumed=true/completion_sound=enqueued, saved scene, LED driver failed=0. Second updater later timed out on an image read; read-only recovery verified all30 ranges/full SHA with zero retries, no third flash. The original read failure is retained.
Canonical protocol/renderer/scene/worker/audio/ISP/Urboot/update/S3 fixtures,8 native progress tests, Flutter analyzer+5 focused progress/real-loopback transport tests pass. Native/Flutter incremental progress does not renew stale hardware authority or reset panels/selections.
Human optical fade/black/scene-return and audible sequence feedback. Enqueue and buffer/driver receipts are not physical output proof.
Actual AVR programming lifecycle/EEPROM/Urboot, power-loss and concurrency/soak acceptance.
Updated native/phone installed runtime acceptance. Client source is tested, not newly installed for this board-focused checkpoint.

No open PRs at checkpoint. Prior main CI succeeded; new CI runs asynchronously without waiting. Existing dependency alert/issue17 and production issues2/7 remain open. Ledger223/4673 compared,4450 pending,181 known gaps—not donor-wide completion.

Managed client updates and temporary office service — `cc8bfbd`

Source checkpoint · operator/client/API guide and exact package receipts · donor/failure receipt.

Dedicated native Preferences → App updates and Android advanced App updates: configurable HTTPS endpoint, automatic checks/download policy, guarded native graceful apply, opt-in Android install requests through normal OS consent, owned obsolete-package cleanup and separate secure enrollment.
Actual temporary HTTPS service at https://office.digitalogic.ir/pakar/ deployed under a dedicated unprivileged systemd user/loopback18743 with scoped Apache proxy, private SQLite/content store and root-only operator secret. Existing Apache/PBX/MQTT services remain active; PBX/MQTT configuration untouched.
Public immutable Windows/Android releases, short-lived session-bound Android HTTP/WSS offers, bounded verified publication/range downloads, server retention and interrupted-upload cleanup. Enrolled private telemetry, expiring single-use allowlisted commands, revocation, at-most-once client write-ahead receipts; no arbitrary shell/filesystem execution.
Actual full external HTTPS downloads of both packages hash-match; actual external WSS offer matches Android session/hash/build. Unauthenticated private inventory returns401. No numbered API namespaces.
Actual DAVID-ASUS interactive/session1 guarded replacement: PID22880 gracefully exited, PID20244 ready/build9. New EXE28,985,344bytes SHA256 d366a33ba19f39235f04c8d6a398f7cc8089366691cbeee8ad23427528981271. Settings and old EXE72270d79867da8fd50baecac8b8c3b659f2dc6c75a63dba5464d0d96edddb6fc preserved. Current-user managed marker/profile initialized, one-use enrollment consumed into Windows Credential Manager.
Office received actual periodic DAVID-ASUS build9 telemetry. Real remote check-update and cleanup each show durable claimed=1/completed. Cleanup found no obsolete pending package: no material deletion claimed.
Android0.2.7+9 APK57,542,761bytes SHA256 acce672d7fac7a40c67216ce1e4fe55f5638c85041938a2816cc73a605ddebd7; package/version and existing preview signer verified. Exact APK staged on ASUS; no ADB device. Native staged locally; host policy rejected local initialization/launch before execution, no workaround attempted.
Service9/native7/Flutter13 focused cases + analyzer + actual Kotlin/APK/native release builds pass. Quality commands pass across the initial run and serialized bounded tail recovery after my report-generation/reader collision. Existing stale PU route target bindings refreshed via actual audit generator;50 reviewed registrations pass. Six new full donor comparisons,229/4673 compared,4444 pending,187 known gaps—not donor-wide parity.
Android installation/runtime/two-installed-version installer-consent and human acceptance; Android automation remains foreground-only.
Actual future two-new-version native automatic-helper exchange; initial approved deployment wrapper is not evidence of that path.
Local GUI launch/enrollment pending user/manual approved action after host-policy denial.
Current-app remote self-uninstall disabled pending user's removal-scope choice/approved inventory. Android local self-uninstall still requires explicit local + OS confirmation. Automatic obsolete-package cleanup is implemented separately.
Existing production/hardware/physical/power-loss/soak/signing/dependency issue17 acceptance remains open.

Shared client build identity0.2.7/build9; firmware untouched. No firmware build/flash, board programming/fuse/EEPROM, LED/buzzer or PBX operation in this slice. No open PRs at checkpoint. New CI is asynchronous; no all-green/new-CI or full production-completion claim.

Production finding during BLE delivery: running image /firmware/download has a short-read-to-EOF defect. S3 readFlashRange maps a failed guarded esp_partition_read to0; ESPAsyncWebServer treats0 as EOF despite outstanding Content-Length. A transient LED flash-pause timeout is a plausible trigger, not yet measured. The route also lacks the reader lease used by other artifact exports. First whole GET hit its30s client deadline after968760/1958288bytes; resumed Range returned only5224more before premature close. No bad export was accepted.

A matching known compiled rollback (1958288bytes, MD5 57a6455e72f651368234bdd529bec7e8, SHA256 490876452384ef9bacf411df767e1b5ab4cf689f7476e2c4b8e7e210c8b88696) was independently matched against live HEAD metadata, preserved and hash-verified on ASUS. The incomplete owned prefix was removed only after matching it byte-for-byte against that full backup.

Fix bounded RESPONSE_TRY_AGAIN without offset advance for transient reads; retain exact length/hash/Range tests and persistent-error bound
Add reader-lease maintenance exclusion to running-image export
Verify LAN OTA under LED/network contention; current inbound upload aborted cleanly at19484bytes with old boot intact, no blind write retry

Remote HTTPS staging of the exact new candidate succeeded and job18 is ready. A transient read-only status reset ended the host helper before apply; explicit owner/hash-bound resume and bounded GET-only retry are being added instead of replaying a fetch/upload or falsely declaring update success.

Safe explicit remote ready-job resume is implemented/tested/deployed in bb55eab. Actual job18 received one apply, boot changed and USB/BLE advertisements confirm the new BLE application is running. Postboot LAN verification timed out while ASUS Wi-Fi was software-off; no repeat fetch/upload/apply was attempted. Full running-image SHA readback and the prior export read-failure-to-EOF/reader-lease defects remain OPEN. Detailed partial receipt: docs/BLUETOOTH.md and issue20; these changes do not claim those export defects repaired.

Source checkpoint8a3827a48aec5265adb6dde699c8c2a101d35fd4: corrected running-image export ownership and bounded same-offset transient read retries (five consecutive/two seconds; fatal failure aborts instead of false EOF); async response owns reader lease and boot identity is cached. Actual response/backpressure/failure fixtures pass. Updater WS readiness sends exactly one read-only status after a validated pinned upgrade; compact RGB/update events never substitute for a complete status or renew its deadline. Both actual Wi-Fi attempts stopped pre-upload; current-candidate Wi-Fi apply/readback remains pending.

Native and Flutter now accept actual2220352-byte S3 images using one selected-board application-slot/header/chip policy across local/HTTP/inbox/SAF paths, retaining AVR/ESP8266 bounds and post-ACK verification. Final native299/mobile287 tests pass (two opt-in captures skipped). Native13 is running on ASUS; Android13 is staged/published but not installed (no authorized ADB device). Both version0.2.7/build13 public HTTPS release metadata and complete artifact hashes independently verified after exactly one publication per platform; Android remains debug-signed preview. No source/package evidence closes optical/audio/phone/long-soak gates. The current S3 memory-recovery SDK build is still running and USB remains required until live OTA verification succeeds.

Actual new-candidate local Wi-Fi OTA PASSED after the deliberate Wi-Fi-first configuration change: boot67ebb82317aecf582b6ecd0bdcb33115->79db5ecd43872d3e64e5dbd5dea65997, image2221280bytes SHAfa1a7a9aca7427517485d1729393666c3599b2ad88078e0b19f8fc89bdc8831a. Canonical updater read the ENTIRE running image in bounded ranges and matched SHA, running/selected0x340000 VALID, authoff, same-board WS before/after. Preflight+upload35185ms/total63244ms vs USBflash123.1s. No automatic upload retry: preceding BLE-on upload was inspected and explicitly observed aborted at135800bytes/no bootchange, then BLE was configured off/readback/rebooted before a new attempt. Native observed verifiedcomplete/0activeincidents. Current AP API, persisted80white/static/RGB and NTP+MQTT connected also observed. External power/optical/full cloud round-trip/BLE coexistence remain open; see updated master#2 and commissioning receipt. Full implementation8a3827a CI is successful; later receipt/toolwording changes do not require rebuilding hardware.

Recovery attempt inspected before any fallback: canonical local OTA upload lost transport at5898ms; native USB and independent HTTP status both confirm operation3 ABORTED at206164/2222176 bytes, unchanged79db5e boot and preserved old image. Actual partial status response also reproduced: HTTP200 but4194/10160 bytes before timeout. No blind retry. c75edea candidate is built but NOT installed yet; diagnosing response backpressure and preparing guarded USB recovery. ASUS app remains operational over exclusive USB with80 mappings/white cells/AVR online. DNS separately contributes~2s per uncached lookup; cached-address diagnostic requests preserve hostname and exact peer identity.

Service recovery deployed from802512c:2036080bytes/SHAf81237f48d51cff5dd94c34257134c3d243dfece824a05640736cdfff0205b16, newboot35bed89db160d5b4c9028808df5929e4. Guarded USB selected-app write hashverified, then full live running-image SHA/VALIDslot/authOff/same-peerWS verified. All12 completeHTTPrequests including223213-byteUI; native actualUSB thenWiFi80mappedwhite/AVRonline/0activeincidents/settingsunchanged. BLE excluded bybuild forrecovery, awakeWiFi observed; alternate configurableBLE source retained. No secondOTAupload attempted, so OTAingress/concurrentBLE/TLS/OTA acceptance staysopen. Cloud reconnect3.122s/occasionalTCPdelay remain explicit. Exact receipts/CI evidenceguard correction: main100877b commissioning. No physical success inferred.

Latest guarded delivery is now on the actual S3: source cc8e71112053e227810cc14f154b2db78b8d05c2, image2074112B/SHA256 2909fdb06411d3ea935a29d16889a13cd1b1fa6065061da66741cf965cd49e36, boot 647bbf1e7608295ec5ce6de2e97ba20e. Full source/build/runtime/receipt distinctions.

Actual local Async OTA19515ms, total60022ms including full running SHA256/readback, new boot, VALID selected/running slot, auth-off and same-peer WS. AVR flash/EEPROM/fuses untouched; saved scene/layout/settings retained.
Explicit terminal-failure recovery never clears/cancels/applies old failed job20. Original image, current peer/boot, manifest/error/size are pinned and reobserved before ONE new write; later candidates can supply the original failed raw image. Updater regression/negative fixtures pass.
Original MQTT enabled configuration restored after temporary pause; actual final-boot Internet TLS MQTT telemetry15604B/checksum 42b196159c7d16832964ddce89206ad0757a97828fed953152137c4a82d6af50, correlated accepted reply/no errors. Private final broker receipt SHA256 cfcec6eaedca6464eacbe5a0ee464703578dc47f3120fc078193245b1ff7beaf.
Final raw image/419B manifest published immutably; independent public full hashes verified. Manifest SHA256 228c7cba39527aec134849f6412020057e90d05f910e2690626d8e47356a4ea5.
Actual two concurrent shell queries, HTTP/Web/XML/WS, NTP, AVR link/TM ACK and ASUS native finalboot/mapping80/zero-active-incidents checks passed.
Internet self-fetch coexistence is NOT fixed/accepted: job20 failed before image bytes with TLS-32512 (SDK SSL allocation failure). Pausing MQTT freed internal heap117068B in the final LAN run; no retry of that Internet failure was made. A nonblocking single-owner/cloud-memory admission correction and its real fetch/apply test remain necessary.
Physical all-dark/white/red/mapping, external-power restart, actual Android install/signing, W5500/BLE and broader donor acceptance remain open. Latest APK staged on both PCs, no ADB device available. No full CI/soak acceptance inferred from these short checks.

Master #2 updated with these evidence-backed checkpoints; production remains open, and no open PRs were found. Latest CI is asynchronous and has not been declared green.

ESP0.2.8 installed; Internet panel command path verified

Source/tooling checkpoint: a14c058. The user chose the ESP update; the former version-choice blocker is resolved. Actual prepared SDK image is deployed, not the later PU source imports.

Existing ESP2193760B backup independently verified: SHA256 cb1f18f16c62e369e52120ec0986bd30d1b5d38e71204216c47aded721a6de0f; preserved on ASUS and the local host.
Actual ESP-only HTTPS job22 downloaded/checksummed image2239504B SHA256 23e660ec3dd4d7a89ba6370c7c6eb1075cb0ed26e86a8d77f2b75f119c40e731, manifest SHA256 ff49acbf038a48d9e3be015b198c784a4ac34888abf284cebe9c67a530ad6597, then a separate exact-job Apply booted0.2.8. New boot a193c8d230f0bd24efb97f4c57cb35fb; independent35-range full SHA/MD5 and integrity/selected-running VALID app1/0x340000 verified. No USB write or AVR programming.
Historical TLS allocation issue reconfirmed on job21. Temporarily closing only MQTT freed about43KB and allowed HTTPS stage22; MQTT credentials retained and Enabled/Connected restored BEFORE Apply. This is measured operator recovery, not an automatic coexistence fix.
Requested private panel credential applied without publishing it. Public HTTPS https://ledboard.digitalogic.ir received live0.2.8 state and a same-state cell1/white command from the external Windows client: matching ACK/readback275ms, followed by two actual same-boot public WSS snapshots. Saved80-cell scene/mode/effect/brightness/output unchanged; no optical assertion.
Added explicit exact-board maintenance admission (--recovery-board / -RecoveryBoard), verified backup recovery for missing BOTH response identity headers, exact zero-byte manifest-failure inspection, backpressure and explicit upload pacing. Normal release policy stays on; NEW boot must pass it. Recovery, backup, multipart loopback, download, script/tooling/plan, comparison and reuse gates pass. Exact-head CI asynchronous, not claimed green.
Two local uploads aborted737292/1188264B, each independently confirmed on unchanged old boot before another diagnostic method. Keep those failures and final canonical LAN-WebSocket interruption/exit1; independent full hash and Internet WSS receipts do not rewrite them as successful tool exits.
Job22 phase is complete but its completion_verified field remains false. Reporting fix remains open despite independently verified installed image.
AVR remains untouched0.2.7 and is no longer admitted by0.2.8 policy. AVR-backed peripherals and old0.2.7 applications require their separate coordinated updates; do not claim full two-board/client rollout.
Automatic low-memory TLS coordination, reliable LAN upload/WS, physical all480/RMT acceptance, external-power restart and long soak remain open. Master production issue stays OPEN.

Deployment details and exact limits: docs/ESP32-S3-COMMISSIONING.md and the same hash-bound reuse receipt/ledger. No device/broker/panel passwords are in this comment or committed sources.

Internet staging incident during current release reconciliation:

New ESP2258272B image SHA25645410adaee49f453183aa4e86b5a64d390e1713bd031258d296dcba81c0c6646 was published immutably, manifest SHA2566de46724257aef4e53d10ec496680e92afc1638ec580f9fb5c34877532bac565. Current image was first completely backed up and SHA-verified as23e660ec3dd4d7a89ba6370c7c6eb1075cb0ed26e86a8d77f2b75f119c40e731.

Explicit ESP-only fetch job23/apply:false reset with reason4 (panic) while staging; no apply was sent, job persisted failed/interrupted and was not replayed. The known temporary MQTT memory-release window did NOT establish reliable staging this time. Restored MQTT through acknowledged202 configuration then read back enabled/connected. Old2239504B image/MD53ac8bff19cb935008dcc61dc81c78583 remains running in the same selected VALID slot. Preserve original error/job evidence; do not call it a successful upgrade, automatically retry, or assume TLS exhaustion without the panic trace.

Further desktop WS/status activity coincided with additional resets/timeouts. Explicitly disconnecting the new local native client gave one30s unchanged-boot observation, not proof of causation or a soak. Final observed bootce76fab2b3d7f3cd7136ef5b7c47326d; MQTT connected and all80 cell states, mode/effect, brightness and output settings exactly matched the pre-attempt snapshot. ASUS is reachable but no ESP serial port exists; user was asked to reconnect USB for actual panic capture and recovery deployment.

The canonical remote-panel installer refreshed the live service, and an external client verified authenticated HTTPS/basic and actual same-board status200. This is live command-path infrastructure, not full telemetry/OTA or physical acceptance. Production issue#2 remains open.

App delivery checkpoint: ca50045 (implementation), 5d46e05 (actual publication receipt), main pushed.

One Updates & support workspace: data updates/support first, package/manual/automatic preferences together; no separate normal/automatic menu routes.
Default trusted presentation source and WSS app feed. Presentation hints are exact-session/deadline/source bound; HTTP checks coalesce; validated palette bundles persist/activate atomically without APK or ADB. Only palette data is currently supported—not hot Dart/native patches or arbitrary executable assets.
Fixed server offers missing the app-update-offer type consumed by Flutter. APK-only consumers opt out of new data notices; same/older package announcements are quiet, while wrong-session offers fail closed. APK peer discovery/push/pull, signer/newer-code checks and Android consent are retained.
Authenticated support HTTP/WS now includes read-only board.status, board.mapping and optional assets.check; health/assets.apply/explicit command remain. Token rotation, foreground/15-minute/session/boot/deadline/replay fences and output-command opt-in remain. This is constrained diagnostics/control, not an arbitrary remote shell/debugger.
Analyzer clean; 26 focused mobile cases plus 10 service cases passed. Actual PCController app_upgrade.dart/peer_upgrades.dart reread through EOF; authoritative ledger hashes/proofs updated. Not all donor parity or all bugs certified.
Office management build21 deployed through guarded script, previous unit/environment and old flat source preserved; existing registry/data/token retained. Apache and dedicated service healthy; PBX/MQTT not restarted.
Actual Internet data lane verified: revision1,108bytes,SHA256 af51f425b62330f25b0e83601e418cf7663668c744d0b68af29722c91fb55e45, full HTTPS bytes/hash plus matching session-bound WSS notice.
APK 0.2.8+21 published through the real catalog. 60754697 bytes; SHA256 4aff174e7f5ebfa5d59366b81fb4357ca20787628c9c66c9027f87e8822f22f3. apksigner verified existing debug-preview signer; aapt code21/minSDK24/three ABIs. Canonical BoardProductionHold build. Download.
Independent full public HTTPS APK download/digest and exact WSS catalog offer verified. The installed app can fetch this catalog without ADB when foreground/online with update policy enabled, but that is not evidence it did. Only the byte-compared temporary root upload copy was removed; registered package/local build retained.
Actual tablet install, OS approval, touch/UI, background/radio/long-soak and human acceptance: ASUS localhost8022 repeatedly refuses SSH; local authorized ADB inventory empty; management has no enrolled Android client. Access requested; cannot claim deployment to that tablet. User can use Updates & support → Check now and Android approval without waiting for ADB.
Full background Android operation, compiled-code hot-patching runtime and production signing remain outside the implemented data-only/foreground scope. No production board contact, firmware job, reset or LED/buzzer actuation in this pass.

Current-head CI is asynchronous, not awaited or claimed green. Master acceptance stays OPEN. Useful commands: node tools/verify-client-service.mjs and node tools/verify-presentation-service.mjs (read-only Internet verification). Root-local operator presentation JSON_FILE publishes a validated newer data revision without an APK. Existing source URLs/settings remain configurable and are not silently overwritten.

USB provisioning/maintenance implementation draft (local source; not deployed or production accepted): normal ESP32 mount no longer formats even with the old commissioning flag. Added boot-fenced bounded USB API requests with execute-once/re-readable response, erased-partition-only initialization challenge, explicit reboot, shared command/config dispatch, redacted network/cloud/Ethernet export and typed section import, firmware/user-file ranged reads with chunk SHA-256. Native replay/bounds/expiry/blank-partition tests and PowerShell parsing pass. Full build stops before compilation at the existing donor gate: PCController LocalLib/I2cLcd.h -> firmware/esp/src/WebUi.h changed; no bypass. Still OPEN: single-pass installer/postboot verification, USB staged firmware upload/apply with shared maintenance ownership, file writes/listing/immutable snapshots, atomic complete settings import with secret policy, opt-in cloud sync, client integration/progress, fault-injection and actual hardware acceptance. No board touched; no acceptance checkboxes closed.

Resource-reporting checkpoint pushed in 0bcaf8e (PR27). Build and live data are separate. Added CI artifact/resource summary with actual S3 OTA partition capacity, AVR application/Urboot flash boundary and ELF static SRAM; reviewed absolute and comparable-baseline growth limits live in interfaces/resource-budgets.json. Workflow retrieves the last successful main resource artifact when retained; no matching baseline is explicit. Successful future builds record FQBN/version/public numeric flags bound to artifact hash. Existing artifacts without metadata remain unavailable, not assigned fabricated flags. Added read-only hostname-first /api/telemetry collector using the existing bounded no-redirect request helper; includes board/boot identity, observation time, stale AVR suppression and independent filesystem capture age. CPU utilization and wear remain unmeasured. Tests passed for ELF/partition bounds, artifact/metadata binding, thresholds, baseline mismatch, stale/unknown values, request errors, script tooling, documentation and governance. Existing cached artifacts parsed without rebuilding: S3 OTA69.13%, buffered AVR static SRAM72.66%; these are NOT live readings. ASUS is reachable but ledcontroller.local lookup failed on today's live read, so the historical chat numbers were not reused. No board/cloud configuration or deployment. New CI execution and full client dashboard parity remain open. Guide: docs/RESOURCE-USAGE.md.

Live discovery/peer-access checkpoint — 2026-10-27 19:45 UTC

Read-only follow-up after David confirmed both boards are powered. No firmware upload, reboot, LED command, settings change, or cloud enablement was performed.

Located current ledcontroller through keycontroller's explicit identity-fenced HTTP peer relay despite failed ASUS .local/direct-IP checks.
Verified ledcontroller identity esp32s3-907069eaaf34, version 0.2.8, boot 0c397272c6df22dd091b8295728961fe, station IP 192.168.1.218, station connected, AP started, AVR online. Reported ESP/AVR UART errors both zero.
Verified source keycontroller esp32s3-b81f3fbb0684, boot 3103da324a6fff63b8e1f45c670c06cf, station IP 192.168.1.201. ASUS and tablet are on its AP (192.168.4.20 / .2), not directly on the router LAN. Keycontroller station RSSI was -83 dBm; ledcontroller -65 to -68 dBm.
Read-only relay /api/peer/info bootstrap verified current target identity, 3129 ms observer elapsed. /api/status succeeded at 1308 and 1318 ms; subsequent reads failed at 1849 ms (peer_response_unavailable) and 2000 ms (peer_identity_not_verified). These include admission/result HTTP and 200–250 ms receipt polling: NOT command, firmware, or pure board-to-board latency proof. Failed verification is not evidence that another board answered.
Both boards currently report MQTT and remote WebSocket disabled; left disabled.
Investigate relay reliability before enabling Internet traffic. Ledcontroller reports current internal free heap 81376 bytes, largest block 31732, historical minimum 216; this is a pressure warning, not proof of current allocation failure or its cause.
Full Flutter/Rust discovery trace and UI acceptance remain incomplete. Missing direct discovery must not be presented as board offline when a verified relay path exists.
Current relay read allowlist rejects /api/telemetry, /api/network, /api/cloud; the rejection is explicit, not successful access. Do not relax protected settings routes indiscriminately.
Office relay currently targets old board esp32s3-907069eac800 at ledboard.digitalogic.ir, not this replacement. ledcontroller.digitalogic.ir currently does not resolve from office. Internet command/telemetry acceptance is NOT complete, and old retained messages cannot prove the new board.

Repository remained clean at 0bcaf8e during this read-only checkpoint. No physical LED success inferred.

Peer-relay recovery source checkpoint pushed through cfad951 (initial 2337100) in PR #27.

Implemented: bounded 900ms mDNS for .local and asynchronous IPv4 DNS with safe late callbacks; board/hostname/boot-verified IP cache; operator-observed address hints; four explicit persistent routes with staged/readback/rename and no observation-driven flash writes. Same-boot cached GET needs one HTTP request; commands retain identity preflight and no POST replay. Hostname/UA now use actual SDK-supported interfaces. Worker reuse, SHA256 receipt fingerprints, filtered/linked JSON and actual SDK String buffer release reduce churn/copies. Fragmentation-aware admission prevents normal reads being permanently locked out after stack allocation. Current internal free/largest memory is distinct from the historical minimum; no cause is claimed for the old 216-byte low-water mark.

Passed locally: actual production relay/cache/store/resolver fixtures (DNS outage, DHCP changes, stale identity/boot, malformed and uncertain command receipts/no replay, memory/receipt limits, 18KB response, late DNS callbacks, interrupted saves), async HTTP actor/short-write/ACK, USB request/receipt, scheduling/offline/fencing and script/living-contract guards. Final S3 table candidate: program 2339923/3342336, static RAM139380/327680, raw2340064B SHA256 f18721c3387951fdce2738e1fa166031c3cead60c868ecc5b79298c4b924107c. Source and candidate are NOT deployment.

Still OPEN: automatic discovery, continuous downstream events, fully selectable relayed Flutter/Rust/Web transports, actual bidirectional latency/current heap/stack/soak, firmware/file forwarding. Discovery and event_subscription remain false. ASUS8022 refused two probes; David will restore it after further requests. No board settings, scene/corrections, cloud state, LEDs, audio or firmware changed. Applicable explicit PBX DTMF approval is still required for production deployment.

Existing CI failure remains AVR PcControllerRuntime.h source-mapping certificate (run40714319535); no bypass or all-green claim. Exact donor reads, target/test hashes, build receipt and remaining work are in the existing file-comparison ledger and REUSE-PREFLIGHT-RECEIPT. Production acceptance stays open; unrelated desktop/mobile edits preserved. GitHub connector comment writes returned integration403; publication uses the already-authenticated repository CLI.

Implemented and pushed in 06815b6 and 21c11a0 (PR #27): configurable NTP with DHCP option-42 policy/default pool.ntp.org, verified HTTPS Date checks, public IPv4 lookup, bounded background DNS/ICMP jobs, real UTC/source/age observations, shared local/USB/MQTT/WebSocket configuration/commands and operational telemetry/events. Added real Flutter Advanced destinations; Web/Flutter/Rust consume asynchronous Wi-Fi scans without blocking game/command ownership. Typed configuration export/import includes network_tools. No arbitrary client-supplied observations are accepted as measured values.

Evidence: ESP32-S3 SDK candidate passed, program 2,387,023/3,342,336; static RAM 140,156/327,680. Raw image 2,387,168 bytes SHA256 ed8da2de86931261bfe9de4e922001513bf3155cf4b4bad4c23f05cd9e4a6673. Android production-hold APK built, SHA256 f0a8bc68737a3705e37933bef13e003c68b3f26b636e57157322244d6cb511a3 (preserved mixed mobile workspace). Flutter analyzer + three focused tests; native async Wi-Fi scan test; actual settings/policy/cloud-maintenance/USB/shell metadata/TUI fixtures and Web contracts passed. Exact API/provenance/donor evidence is in docs/API.md and docs/REUSE-PREFLIGHT-RECEIPT.md.

Limits: NTP is not NTS-authenticated. HTTPS Date checks require initialized time and never disable TLS verification; IPv6 public-IP lookup and traceroute are not implemented. No board flash/reboot/actuation, Wi-Fi reconfiguration, cloud enablement or tablet installation was performed. Live NTP/DHCP/Internet/SSID/MQTT/remote WS/device acceptance remains OPEN; ASUS access was deferred by David. Existing CI AVR mapping-certificate failure is not fixed or bypassed. Production checklist remains open; unrelated drafts/edits remain local and preserved.

Termux upgrade checkpoint (2026-10-29; not deployment acceptance)

Actual phone SSH identity was matched to its previously trusted key without replacing the ASUS known-host entry. Termux and rish worked; ledcontroller was identified as esp32s3-907069eaaf34, with AVR online, RMT/DMA active and no programming latch. Keycontroller was not found by hostname or fresh Wi-Fi scan.
Preserved the complete 2,314,752-byte running ledcontroller application independently on this PC. MD5 matches the board; SHA256 is 0dfa850ce696b949177e040e04be2c5f0644c763c2333ab29ee05308ec73fc8b. The canonical Android downloader failed its final hardlink publication (EACCES), so it is not marked successful; its verified partial is retained. Safe no-hardlink exclusive publication remains unfinished.
Actual updater preflight found that the compressed root HTML now expands beyond its old 512KiB probe bound. Narrow source fix increases only root HTML to bounded 1MiB, raw and decompressed; other response limits, peer/auth/hash/ownership checks and no-replay remain unchanged. ethernet_live_tool_test.mjs and update_tool_test.mjs pass, including oversized/decompression-bomb rejection. Donor-first receipt is in the existing REUSE-PREFLIGHT-RECEIPT.md; current changes are not yet committed.
Built and published distinct current ESP candidates under immutable HTTPS directories on the existing office host: ledcontroller image SHA256 34ed92d994618ed5b7c23ae45ddc470929e6f20d34f25920ad37ed2df465430f; keycontroller 6715191bb505fcc587673e0c37c102619ff35d719d79f1e96507882dc0b02ed1. Server image/manifest hashes and direct HTTPS size headers checked. These are staged artifacts, not installed firmware.
Phone localhost:8022 stopped completing SSH handshakes during staging and now refuses connections. Known alternate forwards also did not answer. No firmware upload POST, flash, reboot, scene/config write or AVR programming occurred; no mutation was retried. Shared chisel server was left untouched.
Autonomous Internet control is NOT ready: the existing office panel still pins an older board identity/topic and both inspected ledcontroller cloud paths were disabled. Do not apply the historical installer unchanged or infer independence from a staged download URL.

Next: restore Termux tunnel and locate keycontroller; retrieve all saved corrections/config snapshots; perform canonical peer-bound updates and complete readback; provision/test persistent authenticated Internet paths without portable proxies. Then review all mixed local work and PRs37/38/39, fix actual reviews/CI, publish and merge normally. User requested board upgrades before final consolidation. No clean-workspace or completion claim yet.

Continuation: actual ledcontroller upgrade completed; full remote/both-board acceptance is still open.

Same board esp32s3-907069eaaf34, new boot 664d3dfebef9065a2ae21090a3583fc8. Canonical phone/Termux updater used Async HTTP once: 42.429s upload, 188.531s total including full 2,695,408-byte readback. SHA256 34ed92d994618ed5b7c23ae45ddc470929e6f20d34f25920ad37ed2df465430f; integrity and VALID selected/running slot verified; same-peer WS proof before/after. No AVR programming.
Original firmware and all correction/group/cell/config snapshots are preserved on this PC. Independently compared current correction rules/enabled/revision, group overrides/counts/starts and cell assignments/locks: unchanged. No optical/audio acceptance claimed.
Saved board-scoped TLS MQTT configuration and provisioned separate private ledcontroller credentials/ACLs on the existing broker. Actual office probes authenticate and publish, but board connection fails before MQTT auth and returns state -2. No autonomous Internet upgrade claim. Router permanence is confirmed by David.
Added bounded actual SDK TLS error and pre/post internal-heap diagnostics without changing CA checks, authentication or timeouts. Both actual cloud-service fixture variants pass. Standard production build without optional SSH/file-service inclusion passes: raw 2,388,880 bytes, static RAM 140,156. Candidate SHA256 24dfe517a2c8e0fb646bda5a1078b1ca1bff356ef4ca1a401bba1ed7da66f470, staged at an immutable HTTPS source, NOT installed yet. Retain separately built all-service candidate and source/flags.
Keycontroller AP appeared after David powered it on. Phone had Wi-Fi disabled, later enabled; association still did not stay connected. Commissioning receipt confirms no key network API write; no key firmware job started. Latest explicit phone join dropped Termux SSH again; restore/inspect the actual phone network before another attempt, never replay an unknown mutation.
Checkpoints 684e710 (reviewed Flutter picker) and 0c6be22 (preflight/scoped provisioning/TLS diagnostics/CI fixtures/evidence) are pushed on existing PR37. Fresh Flutter analysis/seven picker tests, scope tests, Ethernet/updater/tooling fixtures and comparison check pass. New full GitHub CI is running, not claimed green.
PR38/39 full executable diffs and all paginated conversations reviewed. Before consolidation, preserve both SSH command-only prompt handling and theme initialization, fix the combined shell fixture session fields, semantically unite ledgers, then run combined checks. User requested both board upgrades before final merge; all three PRs remain open. Source is committed/pushed; one test-generated Python bytecode file remains untracked because host policy denied cleanup. User-assisted removal requested; no cleanup workaround or fake clean-state claim.

Existing Linux/glib Dependabot alert1 remains open/tracked separately; no dependency security advisory was suppressed. Restore key access, verify both boards and the independent Internet path, then complete normal integration and main/remote/worktree checks for handoff.

TLS and detached peer commissioning checkpoint

Source checkpoint: a5a4809771e7a3c0b198c33d1864a6ebdeca4367 on existing PR #37.

Actual ledcontroller upgrade to24dfe517 succeeded through Termux/canonical local updater: full2388880-byte SHA256 readback, VALID selected/running slot, new bootc6cd787171b0adef7bffd78e03e6bc40 and same-peer WebSocket. Saved correction rules/group layout/cell assignments compared unchanged. TLS MQTT subsequently connected with certificate validation intact; independent office commands had matching accepted results (53–444ms observed replies). This is not current full-system acceptance.

Measured follow-up blockers: full status exceeds16KiB and prevents telemetry; a concurrent HTTPS firmware manifest connection fails with TLS-32512 before image bytes. Known failed stage jobs1/2 were observed explicitly, never treated as an upload or blindly replayed. Temporarily releasing RMT resources was insufficient; the RMT saved preference received a restore ACK. A temporary station-only/AP-Off experiment retained Dlink station credentials. Its AP restoration is PENDING access, not silently claimed complete.

New SDK-compiled candidate:2405424bytes, SHA2566df01aabc3c1ef3766100aa12e148fcabbbc812cabf83d2486a66aa114ac553d. Manifest SHA25623bf4351fa174cd74f2cf0d5da806406217fbda6ebbf4e4ae7690276fa81b31f, published under https://office.digitalogic.ir/pakarcontroller/firmware/esp32s3/20261029-ledcontroller-peer-recovery/manifest.json with server-side hashes checked.

It includes the SDK-compatible project-local large TLS allocation adapter, compact cloud status + bounded24KiB fragmented aggregate telemetry, restricted cloud peer-relay commands, and explicitly queued detached AP commissioning with persistent no-replay receipts and restoration of untouched source networking. SDK symbols confirm the allocator wrapper and worker are linked. Focused cloud fixtures (both platforms), linked allocator, commissioning/network/relay fixtures, bounded reassembly, S3 source guards and comparison checks passed. Those are build/host tests, not deployed-job or two-TLS hardware acceptance. Build was from the corresponding dirty source before committing the checkpoint; do not label its embedded source as a clean a5a4809 build.

Latest stage-only request mqtt-stage-peer-6df01aab has UNKNOWN outcome: no matching ACK, subsequent read-only status requests unanswered, broker recorded device keepalive expiry. No Apply was sent. Do not replay. Termux8022 now refuses connections, alternate trusted route is unavailable. A local recovery/power-cycle request is outstanding. The new candidate is NOT installed; keycontroller's network commissioning and update are NOT complete. Need regain board access, inspect actual job/boot/image first, restore AP, then install/verify and commission keycontroller. No AVR programming occurred.

Source is pushed. Three PRs are not claimed merged. The only remaining local untracked artifact is the previously policy-blocked generated Python bytecode; user deferred manual cleanup. Do not hide it or bypass the cleanup denial.

Navigation Menu

Repository navigation

Remote firmware transaction, full operational telemetry and PU850 route acceptance #7

Remote updater / telemetry / PU850 route acceptance

Final local candidate evidence: 0.2.7 / `01a898e`

Integrated Async/WS/OTA worktree candidate — physical handoff still blocked

Firmware subscriptions, manual files and externally initiated progress — `c864967`

Android self-distribution and board automation — `af6c309`

Graceful upgrade lifecycle — `11e4ca1`

Managed client updates and temporary office service — `cc8bfbd`

ESP0.2.8 installed; Internet panel command path verified

Live discovery/peer-access checkpoint — 2026-10-27 19:45 UTC

TLS and detached peer commissioning checkpoint

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Remote firmware transaction, full operational telemetry and PU850 route acceptance #7

Description

Remote updater / telemetry / PU850 route acceptance

Activity

atomicdeploy commented on Oct 10, 2026

atomicdeploy commented on Oct 10, 2026

Final local candidate evidence: 0.2.7 / 01a898e

atomicdeploy commented on Oct 10, 2026

atomicdeploy commented on Oct 17, 2026

DRSDavidSoft commented on Oct 18, 2026

Integrated Async/WS/OTA worktree candidate — physical handoff still blocked

atomicdeploy commented on Oct 18, 2026

Firmware subscriptions, manual files and externally initiated progress — c864967

atomicdeploy commented on Oct 18, 2026

Android self-distribution and board automation — af6c309

atomicdeploy commented on Oct 18, 2026

Graceful upgrade lifecycle — 11e4ca1

atomicdeploy commented on Oct 18, 2026

Managed client updates and temporary office service — cc8bfbd

atomicdeploy commented on Oct 18, 2026

atomicdeploy commented on Oct 18, 2026

atomicdeploy commented on Oct 18, 2026

atomicdeploy commented on Oct 18, 2026

atomicdeploy commented on Oct 18, 2026

atomicdeploy commented on Oct 18, 2026

atomicdeploy commented on Oct 19, 2026

atomicdeploy commented on Oct 19, 2026

ESP0.2.8 installed; Internet panel command path verified

atomicdeploy commented on Oct 19, 2026

atomicdeploy commented on Oct 19, 2026

atomicdeploy commented on Oct 25, 2026

atomicdeploy commented on Oct 27, 2026

atomicdeploy commented on Oct 27, 2026

Live discovery/peer-access checkpoint — 2026-10-27 19:45 UTC

atomicdeploy commented on Oct 28, 2026

atomicdeploy commented on Oct 28, 2026

atomicdeploy commented on Oct 29, 2026

atomicdeploy commented on Oct 29, 2026

atomicdeploy commented on Oct 29, 2026

TLS and detached peer commissioning checkpoint

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

Final local candidate evidence: 0.2.7 / `01a898e`

Firmware subscriptions, manual files and externally initiated progress — `c864967`

Android self-distribution and board automation — `af6c309`

Graceful upgrade lifecycle — `11e4ca1`

Managed client updates and temporary office service — `cc8bfbd`