hardware-smoke-checklist.md

Manual hardware smoke checklist

Record the firmware version/commit, tester, date, power source, SD card, and detected panel. Repeat this checklist on the original ILI9881C/GT911 hardware and the ST7123/ST7121 family before a release.

Use current-limited power and 3.3 V signals. Disconnect external loads before boot; never assume a Grove device is 3.3 V-safe.

Cold boot and touch

• Cold boot reaches the launcher without a reset loop, display corruption, or backlight flicker.
• Tap and drag at all four corners and the center; coordinates and orientation are correct.
• Cycle 100/75/50/25% brightness, reboot at each value, and confirm the saved value returns without affecting Servo PWM.
  • ST7121, 2026-08-09: all four values returned in the UI and boot backlight log after reboot; physical brightness and Servo interaction remain open.
• Let the UI dim at two minutes and turn off at 5/10/30 minutes; tap the center time, weather, every forecast-card area, and edges. The first tap only wakes, and the configured brightness returns.
  • ST7121, 2026-08-09: the five-minute path logged 100% -> 20% -> 0% -> 100%, and a first tap over Settings returned to the launcher without opening it. Other hit areas, 10/30/Never, and the second panel family remain open.
• Select Never and confirm the display remains dimmed rather than turning fully off.

Missing and present peripherals

• Boot without an SD card; Notes, logs, and Ebooks report the missing card without hanging or claiming success.
• Boot with a writable SD card and unavailable Wi-Fi; verify the default-book worker ends its initial wait after the 30-second budget and releases the OTA admission guard. Repeat with connection near the deadline and known SD/Wi-Fi loss between book attempts; verify completed books remain readable. Record PSRAM/internal heap before and after worker cleanup and repeat with a ready network after reboot. Native 42-case clock/task checks and an unflashed SDK build pass; physical scheduling, caps-task cleanup and transport timing remain unchecked.
• Insert a writable SD card, save/read/delete a disposable file, reboot, and confirm it remains readable.
• Fill a disposable card, then try Notes, a ride, an ebook download, and ring logging; each reports failure and no partial file appears as complete.
• On a disposable card, occupy each default-book filename with a directory and retain a distinct TMP. Confirm it is not treated as installed, download rejection preserves both paths without opening a writer/client, and a normal download succeeds after the owner resolves the conflict. Reboot and confirm the completed regular file avoids a redundant download. The 79 native download cases include twenty-one path-kind controls and 25 recovery pairs per profile; physical FAT/SD, transport and both panels remain unchecked.
• Remove the card during a ride and during heart-rate logging; the writer stops, System reports removed/unresponsive, and no auto-unmount/remount race occurs. Reinsert and reboot before writing again.
• Interrupt power during note replacement, ride recording/stop, summary replacement, and heart-rate append; recover .BAK, retain useful .TMP, and discard an incomplete CSV tail as documented.
• Erase only the storage partition, boot once, and confirm blank internal storage initializes and mounts.
• Write non-0xFF invalid data to storage, boot, and confirm it stays unformatted until the two-step System action is confirmed.
• Start offline with the configured Wi-Fi unavailable; wired tools and the launcher remain usable.
• Connect Wi-Fi, sync time/weather, use one relay request, disconnect, and reconnect.
• With a disposable saved network, tap Forget once and let the five-second warning expire without erasing it; then confirm that two taps within five seconds erase it. With no saved profile, Forget remains disabled.
• In Settings, verify channel/RSSI survey rows and Network Diagnostics link addressing; resolve a hostname, ping LAN/Internet targets, discover mDNS service types, leave during a run, and re-enter without a reset. Repeat with an invalid name, packet loss, disconnected Wi-Fi, an empty mDNS network, and both panel families.
  • The bounded ping loop and Diagnostics lifecycle have 120 native packet/deadline/cancellation checks and 68 worker/resolver/UI checks. On hardware, verify ten-second DNS timeout, Cancel/Home during DNS and ping, old DNS replies during a new lookup, resolver-table recovery after repeated cancellation, and busy ownership through mDNS query/result cleanup. Measure silent/unrelated-traffic ping runs, confirm noise cannot prolong four probes, check IPv4 options/scoped IPv6, and record heap recovery. Its six-second ping budget follows the asynchronous DNS wait. The prepared image remains unflashed; these cases do not establish a device pass.
  • ST7121, 2026-08-10: the survey showed channel/RSSI, link details matched 192.168.0.122, example.com resolved, four of four ICMP replies averaged 20 ms, and mDNS found _airplay, _spotify-connect, _display, _zwift-protocol, and _wahoo-fitness-tnp. Off-screen operations rendered after re-entry; System reported Reset: USB and 55 KB free/53 KB minimum internal heap after mDNS startup.
• Send an HTTPS GET with HTTP Console, enable the opt-in SD log, verify the capped body preview and redacted metadata row, then leave during a request and re-enter after it completes.
  • ST7121, 2026-08-10: two https://example.com/ requests returned HTTP 200 with 559-byte bodies in 885-922 ms; /HTTP/HTTPLOG.CSV contained metadata only, off-screen completion rendered after re-entry, and System reported USB reset with 48 KB free/35 KB minimum internal heap after TLS use.
• Exercise POST/PUT/DELETE, four valid custom headers and every rejection case, a disposable authorization value, query/fragment redaction, redirect visibility, a response over 4 KiB, DNS/TLS/timeout failures, SD full/removal, and both panel families. Verify that plain HTTP requires the same unchanged request to be confirmed within five seconds and that expiry sends nothing.
• On the guarded HTTP transport, verify HTTPS certificate/name failures, Cancel/Home during silent/trickled-header/streaming-body/trailer peers, the cooperative 15-second request budget, asynchronous DNS cancellation/timeout latency and hostname/SNI preservation, malformed/8-KiB header/trailer bounds, final response after informational replies, bodyless 204/304, normal EOF versus timeout, partial previews and redacted outcome rows. Repeat 25 requests/cancellations, including completed trailers, while recording internal/PSRAM heap and reset reason. Native tests exercise the pinned SDK but do not close this hardware gate; see HTTP Console.
  • The controlled DNS fixture supplies real UDP answers/delays/drops/NXDOMAIN/SERVFAIL on an isolated test LAN, with a late-reply/next-request procedure. Its fourteen host checks validate the fixture; tablet resolver timing and cleanup remain unchecked.
• With HTTP Console and Diagnostics, measure DNS dispatch under permitted concurrent work. A queued lookup already past its captured deadline must start no DNS query, while a different live lookup retains its budget. Check stale callbacks after timeout/slot reuse and successful fresh retries, recording query/timing/heap evidence on both panels. Sixteen controlled source-level cases pass, including ten preceding-source failures and 25 retry pairs per capacity; actual TCP/IP task scheduling, DNS traffic and physical timing remain unchecked.
• With HTTP metadata logging enabled, verify full/removed/read-only SD failures retain the network result and preview, report that saving was not confirmed, and turn SD LOG off. Re-enter with writable storage and opt in again; confirm unfinished final-row repair preserves earlier rows. Change SD LOG during a request and check its captured choice in the result. Check CLEAR just after completion and a stale WORKING tap: the cleared response stays cleared, pending storage errors remain reported, and another send requires the normal confirmation. CLEAR must dismiss plain-HTTP confirmation. CLEAR, Home and OTA must respect busy ownership until file cleanup finishes. Native real-file checks pass; physical FAT/SD faults remain open.
• Connect MQTT Console to a TLS broker, publish before subscribing with retain enabled on a device-specific loopback topic, receive the retained value, inspect the payload-free metadata log, and return Home during an active connection without blocking the UI.
  • ST7121, 2026-08-10: mqtts://test.mosquitto.org:8886 accepted an 18-byte QoS 1 retained publish and returned the same topic/payload after subscribe. /MQTT/MQTTLOG.CSV contained TX/RX topic and size metadata without payload or credentials; Home returned within 0.82 seconds while cleanup continued. System showed 64 KB free/62 KB minimum heap after the exchange, and a fresh boot of the same image reported USB reset.
• Exercise authenticated TLS and WSS, QoS 0/2, wildcard subscriptions, fragmented messages, ring overflow, failed auth/DNS/TLS/timeout, SD full/removal, both panel families, and the two-tap cleartext confirmation/expiry path. Confirm that logging and retain both default off on every entry.
• On both panels, save a disposable authenticated TLS/WSS MQTT profile, cold reboot, and confirm exact URI/username/password/topic reload, a masked password, explicit Connect and logging/retain off. Overwrite it once, verify cleartext Save is refused, let Delete expire without loss, then delete with two taps and confirm the profile stays absent after reboot. Exercise Clear/focus/invalid Save/Connect/Disconnect handoffs and stale profile taps after cleanup; each destructive/cleartext action must require its current warning. With a backed-up disposable NVS partition, test malformed/wrong-type profiles, read errors, flash exhaustion and interrupted set/erase operations. Confirm explicit recovery stays available when presence is uncertain, no unrelated settings are erased, and failure status does not promise unchanged storage. The 109 native scenarios include 24 profile cases and seven previous-source regressions, using RAM retained only across app entries; physical NVS recovery, power-loss effects, flash erasure and device latency remain unchecked.
• Verify MQTT Home/Disconnect with SDK shutdown and pending SD metadata under slow or failing network/storage conditions. Re-enter while stopping, confirm Connect/Subscribe/Publish stay unavailable, and check OTA remains blocked through file close and error reporting. Confirm a failed metadata write reports unconfirmed persistence once and stops further old-session writes. Repeat on both panels. The 154 native app/codec scenarios and 31 console cases with the real SDK client pass; nine console cases exercise controlled file waits/failures, metadata overflow and reconnect recovery. These native boundaries do not verify physical SD/FAT or device scheduling. The production changes are built but unflashed. See MQTT lifecycle.
• Exercise background MQTT Subscribe/Publish against a stalled or unreachable broker, edit draft topic/payload/QoS/retain while an action waits, then Disconnect or Home and re-enter. Measure UI response and ensure OTA stays blocked until action/client/storage cleanup finishes. Check QoS 0, 1 and 2 delivery and original TX metadata, oversized ASCII/UTF-8 rejection, repeated sessions and both panels. The expanded 43 modeled SDK/app/LVGL/storage scenarios cover these software boundaries, including the previous UI-thread action regression; real SDK protocol, Wi-Fi timing and card behavior remain unverified for this change.
• With MQTT metadata enabled, exercise slow/full/removed SD storage during active receive/publish traffic. Measure UI, Clear, log-off, Home/Disconnect and re-entry while a write or error callback waits. Confirm already accepted rows survive log-off, history loss does not erase metadata, storage-queue overflow reports omitted rows, and the first file error closes the stream and disables logging until a new connection. Check immediate reconnect after cleanup and repeated logged sessions on both panels. The 57 modeled scenarios cover worker/file routing, bounded queues, callbacks and native CSV/memory checks; real Wi-Fi/card behavior remains unverified for these changes.
• Receive empty and fragmented MQTT payloads from a controlled broker, including a packet whose topic fills the SDK input buffer and leaves an empty first payload fragment. Verify one complete history/log entry with the original topic, QoS, retain flag and full byte count; unfinished/interrupted payloads must not appear complete. Check binary payloads, the 512/513-byte preview boundary, long/UTF-8/control-byte topic previews and quoted topics in the CSV. Leave during an unfinished payload and repeat 50 receives while recording heap on both panels. The 69 modeled scenarios validate application assembly and file output; actual SDK packet parsing, network timing and SD behavior remain unchecked.
• Verify MQTT status for all four transports, URI host/port/path/query/IPv6 validation, 255/256-byte endpoints and exact 64-byte UTF-8 credentials after saved-profile reload. Confirm Clear/expiry/changed settings require a fresh cleartext confirmation. Force broker authentication refusal, transport/TLS faults and rejected subscriptions; retain the connection diagnosis through disconnect/late acknowledgments and alongside SD/history warnings, with new actions disabled after a fatal error. Disconnect and start a new session to recover. The 85 native scenarios pass against the SDK URI parser and modeled MQTT events; real brokers, certificate verification, stored-profile reboot and both panels remain unchecked for this change.
• On both panels, arm cleartext MQTT/WS confirmation, edit each broker/username/password field and restore its original value, then verify the next CONNECT tap shows a fresh warning without broker traffic. Repeat keyboard insertion, backspace, forward delete, field focus and five-second expiry. Confirm only the following unchanged tap connects with the current settings. Four new native cases reproduce fingerprint-collision and edit/restore failures in the preceding source and pass with LVGL change-event invalidation; physical touch/keyboard and broker behavior remain unchecked.
• On both panels, force MQTT socket reset and TLS/certificate failures against a controlled broker. Compare every supplied ESP, signed TLS-stack, certificate-bitmask and socket code with the SDK logs, confirm failures never display ESP_OK, and retain the complete diagnosis through disconnect, late acknowledgments and Clear. Check wrapped status readability and explicit cleanup/new-session recovery. Six new native regressions and the expanded 119-case suite pass, and the pinned firmware builds; actual socket/TLS errors and physical layouts remain unchecked for this change.
• Against a controlled broker on both panels, compare captured Subscribe/Publish packet contents and receive previews/CSV for all QoS modes, retain, empty/binary/UTF-8 payloads, long topics, fragmented bodies and Home completion/abandonment. Record the SDK's real first/continuation events and QoS exchanges. Thirteen native app cases run the pinned SDK codec with independent bytes and reproduce the archived empty-first-fragment bug. A separate 16-case native client/broker suite runs the actual SDK receive/dispatch loop, outbox and transport dispatch over loopback sockets, checks both directions of QoS acknowledgments, malformed/incomplete packets and 25 stable sessions. Complete-client app integration, ESP-IDF task/event timing, physical Wi-Fi/TLS/card behavior and both panels remain open.
• On both panels, complete Byte Lab Copy -> MQTT PASTE BYTES -> explicit Publish -> COPY RX -> Byte Lab Paste with empty and 128-byte binary bodies at all QoS modes. Verify paste/mode changes produce no traffic, Text retains excess/UTF-8 input within the screen, later clipboard changes do not replace prepared bytes, and queued requests retain original body/topic/QoS/retain. Check Home retention, stale cleanup clicks, confirmation/error display and payload-free profile/metadata output. Ten native cases and four complete SDK/broker round trips pass; current firmware is built but unflashed, and physical broker/panel behavior remains unchecked.
• Start BLE GATT scanning explicitly, select a known target, connect explicitly, discover its bounded GATT database, read a standard characteristic, subscribe/unsubscribe a notification, save the evidence snapshot, then leave while connected and confirm teardown completes without reconnecting.
  • ST7121, 2026-08-10: the eight-result scan found KICKR CORE 4816; discovery reported 12 services and the disclosed 32-characteristic cap. Manufacturer Name 0x2A29 returned WahooFitness; Indoor Bike Data 0x2AD2 delivered 44 00 00 00 00 00 00 00 and unsubscribed. The atomically published CSV contained eight advertisement rows, 32 characteristic rows, and the labeled notification row. Home released the live connection, immediate re-entry was idle, and System reported USB reset with 62 KB free/60 KB minimum internal heap.
• Repeat with no targets, more than eight advertisers, connection cancel/failure, a device requiring pairing, indications, fragmented/over-64-byte values, a disposable raw-write target and five-second expiry, SD full/removal, each optional product profile, and both panel families.

Launcher and shared hardware

• On both panels, use Serial RX capture with split binary replies, UART/RS-485, exact 128-byte and overflowing windows, Freeze/Stop/Home before the next display tick, and setting changes after capture. Confirm stale queued bytes stay outside a new capture, copied data is unchanged by transcript display or TX, errors/overflow preserve the previous clipboard, and CLEAR RX/transcript/clipboard clear only their own data. Run an RTU request -> captured reply -> RTU Frames decode on a configured bench device. Native quick checks and the 2026-09-29 firmware build pass; ST7121 passed an empty capture and retained link identity. Physical timing/FIFO behavior, SD interaction and broader panel checks remain pending.

• Build firmware with RTU Frames, then on both panels verify the example, all four functions, CRC/exception errors, maximum 16-value scrolling, numeric/Hex keyboards, popup teardown, invalid/Unicode retention, and cleared stale results after request edits. Copy 01 03 00 00 00 0A C5 CD, paste in Serial without traffic, and explicitly send only to a configured bench fixture. Compare every wire byte, framing and turnaround with a logic analyzer; enter its complete reply and verify decoded values. Native codec/UI checks and the 2026-09-29 firmware build pass; the ST7121 example and stopped-Serial handoff passed in the development pass below.

• Open NTP Lab on both panel families. Compare four readings from a known LAN time server, confirm offset sign against an independent clock, and exercise the PC fixture with delayed, malformed, unsynchronized, and Kiss-o'-Death replies. Check invalid/unset local time, Wi-Fi loss, Stop/Home while waiting and between samples, immediate re-entry, OTA refusal while busy, and repeated-run heap/task stack high-water.

• In Wake-on-LAN, first capture one packet with the PC fixture and verify the MAC/destination/port and exact 102-byte payload. Confirm no packet on initial entry, invalid input, one tap, expiry, edited fields, or offline action. Then test an explicitly selected wake-capable device and subnet broadcast, distinguish send success from actual wake, exercise Cancel/Home, Wi-Fi loss, re-entry, both keyboards/panels, and repeated-run heap/task stack high-water.

• In UDP Console, use the PC echo fixture to compare hex/ASCII, empty and 128-byte requests, automatic/fixed source ports, and 0/512/513/2048-byte replies. Confirm one packet only after unchanged confirmation, no packet for invalid/expired/edited/offline requests or a local port conflict, ignored replies from another endpoint, and the three-second timeout. Exercise both keyboards/panels, truncated-preview scrolling, Cancel/Home while waiting, immediate re-entry, Wi-Fi loss, OTA refusal until socket cleanup, and repeated-exchange heap/task stack high-water. Host checks and the ST7121 Wi-Fi cases recorded below pass; the remaining cases and second panel family stay open.

• In Modbus TCP, use the Python fixture on a reachable PC: test TCP, read all four functions and boundary addresses, compare decimal/hex/bit values, and confirm exception/fragmented/timeout responses. Check disconnected Wi-Fi, unreachable/closed port, field changes and confirmation expiry, Stop/Home during each network phase, re-entry during cancellation, and OTA refusal until the worker is idle. Repeat on both panel families and record heap before/after repeated operations.

• In Modbus TCP, compare the 32-bit unsigned/signed/Float32 views against a device's documented register map in each applicable byte order. Verify raw words, pairing from the original address, an odd last register, negative zero, NaN/infinity, keyboard/result visibility, and readable selector popups. Changing the view or editing the next request must preserve the earlier result's identity and send no traffic; Home/re-entry retains the view and closes an open popup. Pure references and host UI/network checks cover these paths; physical panel and device results remain open.

• Measure Modbus accepted-request timing while other permitted work is active. The five-second exchange budget and displayed duration include worker scheduling; an already expired worker must create no socket. Check Stop/Home before the worker runs, re-entry while cancellation is pending and successful fresh retries, retaining OTA ownership through socket cleanup. Native held-thread/clock controls cover these paths; physical ESP-IDF/lwIP timing and both panels remain unverified.

• Measure NTP Lab, Wake-on-LAN and UDP Console accepted-request timing while other permitted work is active. Their ten-, two- and three-second budgets and displayed duration include scheduling; expiry before worker entry must create no socket or packet. Confirm NTP startup delay does not produce a false clock-step result, and a late worker retains only the remaining sampling/reply budget. Check Stop/Home before entry, re-entry while cleanup is pending, OTA ownership and fresh retries on both panels. The 56 native scenarios include seventeen delayed-start cases and 25 timeout/retry pairs per app; ESP-IDF scheduling and physical Wi-Fi timing remain unchecked.

• In NTP Lab, Modbus TCP, Wake-on-LAN, and UDP Console, reject abbreviated/octal/leading-zero IPv4 addresses, signs/suffixes/exponents in numeric fields, and overlong input without any network traffic. Paste line breaks inside addresses, MAC addresses, and numeric fields; ensure they remain invalid through Home/re-entry. Repeat split-line rejection in Electronics, Subnet Lab, and Resistor Lab, verifying that old results clear and fields remain readable on both panels. Native regression tests pass; tablet input paths and lwIP behavior remain open.

• Open every launcher tile, exercise one safe action, and return to the launcher; no stale screen, crash, or unexpected background activity remains.

• Open Subnet Lab offline on both panel families. Verify 192.168.1.42/24 gives network .0, broadcast .255, and 254 host slots; verify 10.20.30.40 with 255.255.240.0 gives 10.20.16.0/20. Exercise peer host/network/broadcast/outside cases, empty peer, invalid/fragmented/leading-zero input, /0, /31, /32, keyboard dot/slash/Done/Cancel, stale-result clearing, Example, Home/re-entry, reboot defaults, and the launcher transition/heap soak. Host reference checks and 100 lifecycle cycles pass; physical UI and device heap remain unverified.

• Open Electronics with Wi-Fi disconnected and no SD card. Verify each calculator, all three Ohm's-law unknowns, numeric keyboard focus/dismissal, and visible errors for zero, incomplete input, and LED forward voltage at or above supply. Check 3.3 V / 330 ohms = 10 mA / 0.033 W; verify inputs survive Home/re-entry and reset on reboot.

• In Electronics RC filter mode, verify 10000 ohms / 0.1 uF gives 1 ms, 159.155 Hz, 2.19722 ms rise, and 4.60517 ms settling. Check units, hidden third input, mode/input retention, and two-row mode selection. Confirm negative, exponent, unit-suffix, and overlong edits report errors without silently dropping characters, including after Home/re-entry.

• Open Byte Lab offline. Verify Hex 01 03 00 00 00 0A gives Modbus CRC CDC5 / wire C5 CD, and ASCII 123456789 gives CRC-32 CBF43926. Exercise malformed hex, empty input, both input modes, keyboard dismissal, 128-byte limit, full-preview scrolling, and Home/re-entry. Repeat both offline apps on each panel family and in the launcher transition/heap soak.

• In Byte Lab, verify 80 gives signed -128, 80 00 00 00 gives signed BE -2147483648 and Float32 BE -0, and 3F 80 00 00 gives Float32 BE 1. Check LE order, subnormal, maximum finite, Infinity, and NaN examples; numeric rows disappear for 3-byte or invalid input. Confirm results and preview remain readable with the keyboard hidden on both panels.

• In Byte Lab Number input, verify all six integer widths/sign choices at their limits, both byte orders, Float32 1.5, 0.1, -0, 1e-45, NaN, and infinities. Reject overflowing/underflowing decimals, invalid line breaks/Unicode and overlong drafts before and after Home/re-entry. Check the numeric keyboard, readable dropdowns, Example/Clear, and USE AS HEX replacing only the Hex draft without traffic. Host exact references and LVGL lifecycle checks pass; target C-library conversion, physical touch, and both panel families remain open.

• On both panels, copy encoded Float32 1.5 from Byte Lab, paste into UDP, confirm one echo exchange, copy its reply, and inspect it in Byte Lab. Check separate draft retention, empty/128-byte copies, clear/restart behavior, paste disarming confirmation, and oversized/truncated replies preserving the clipboard. Paste 1/32 bytes into SPI without starting or transferring; empty/33/128-byte copies preserve the draft. With a logic analyzer, reject malformed and 33-byte pasted SPI text without bus activity. Native round-trip and 500 app lifecycle cycles pass; physical touch, network, and electrical validation remain pending.

• Open Resistor Lab from launcher row nine, offline on both panel families. Compare four/five band drawings and named choices, 4.7 kohm +/-5% (4465-4935 ohm), 237 ohm +/-1%, and gold/silver multipliers. Decode 103, 4422, 4R7, R005, 10C, and a zero jumper; verify SMD tolerance remains unspecified. Exercise keyboard Done/Cancel, invalid/overlong input, Example reset, separate mode drafts, Home with a color popup open, reboot defaults, large values, display colors, and the transition/device-heap soak. Pure decoding and 100 native LVGL lifecycle cycles pass; physical validation remains open.

• Run empty-bus and known-device I2C scans on G53/G54; both finish and report the correct result.

• On both panels, open I2C without automatic probing, explicitly SCAN, and READ ONCE with 1/2/4/6/32-byte lengths on a documented auto-increment or FIFO target at both speeds. Verify one register-pointer byte/repeated start, the selected receive count, COPY READ into Byte Lab, and original source identity after edits/Home. READ ONCE must stop Watch and finish its CSV; restarting Watch/CSV must still sample one byte. Test read failures, cleanup retries, disabled copy, independent CLEAR READ, and confirmation cancellation after read/scan/capture/length/copy/clear actions. Under injected cleanup faults, verify no further transaction or GPIO/Scope/Servo/restart/OTA entry while the bus is retained, including G54 during Home. Check scrolling and Home with the length popup open. Native transaction/panel/handoff checks and the 2026-09-29 firmware build pass; initial ST7121 empty-bus/control results are recorded in the development pass below.

• With a 3.3 V BME280 at 0x76/0x77, read register 0xD0 and confirm 0x60; then test an absent address and SDA held low.

• Watch register 0xD0 at 1 Hz at both 100 and 400 kHz; stop/start repeatedly and confirm the bus is released between samples.

• Arm a harmless writable test register, let the five-second confirmation expire without a write, then confirm a deliberate two-tap write on a disposable target.

• Capture at least 15 seconds to SD, confirm the documented header and 1 Hz rows, then repeat with card-full/removal faults and recover the retained .TMP.

• Run the UART internal loopback test while stopped; it passes without routing G47/G48.

  • ST7121, 2026-08-09: the UART1 peripheral returned 55 AA 00 FF; the terminal remained stopped and reported that no external pins were routed.

• Jumper UART1 G47 TX to G48 RX, test 9600/115200/921600 baud plus parity and stop-bit changes, verify ASCII/hex send history, and confirm both pins are high-impedance after Stop and Home.

• On both panels, verify independent Serial transmit/display formats, literal ASCII/newlines, None/LF/CR/CRLF, empty-line sends, exact 256-byte ASCII/Hex requests, suffix-inclusive limits, invalid Unicode/overlong retention through Home, and PREV reproducing the last eight accepted messages without truncation or doubled suffixes. Copy bytes from Byte Lab, PASTE without pin activity, and explicitly send on UART and RS-485. Test keyboard Done without transmission, maximum bulk Hex pastes in Serial and Byte Lab, and repeated transitions. At 9600 baud with parity/two stop bits, stop immediately after a maximum send and measure that its final bytes and RS-485 turnaround complete before release. Host parser/UI/adapter checks pass; physical wire timing, touch, and device heap remain unverified.

• Capture UART RX/TX to SD, confirm the documented hex CSV rows, then repeat with card-full/removal faults and recover the retained .TMP.

• Open a published UART or RS-485 CSV in Files, compare timestamps, direction, byte counts, hex and ASCII views with raw rows, filter RX/TX, page through more than eight rows, and return to the same folder. Confirm .TMP remains text preview.

  • ST7121, 2026-09-22: a verified COM7 flash of the development build opened a newly published UART log with ten one-byte TX rows. The viewer displayed 61 in Hex and a in ASCII, matched the terminal's seconds and TX byte counts, paged from rows 1-8 to 9-10, showed no rows under RX, restored ten rows under TX, and returned to /sdcard/UART/260922. Raw CSV inspection, an RX row, a retained .TMP, RS-485, and the second panel family remain open.

• On both panels, select records in a saved UART/RS-485 log and COPY ROW into Byte Lab and RTU Frames. Compare exact raw bytes from Hex/ASCII views, filter/page identity, 128-byte success and 129/256-byte rejection, empty filters, more than 512 records, scroll/popup behavior, and Back/Home cleanup. Confirm the file stays unchanged and a copied chunk is not assumed to be a complete protocol frame. Native fixture/UI checks and the 2026-09-29 firmware build pass; physical SD/panel behavior for record copying remains pending.

• With RS-485 disconnected, select RS-485, Start, and Stop without transmitting; DIR stays receive-safe and the UI remains responsive.

  • ST7121, 2026-08-09: receive-only Start/Stop passed over USB remote control; no bytes were sent, Stop reported receive-safe, UART internal loopback still passed, and Home returned to the launcher.

• With a second isolated RS-485 transceiver, verify bidirectional ASCII/hex traffic at 9600/115200/921600 baud, automatic direction turnaround, A/B polarity, and no self-echo loss.

• Measure the physical 120-ohm switch open/closed, use it only at a bus end, and capture RS-485 RX/TX plus retained .TMP recovery on SD faults.

• With SPI pins disconnected, cycle modes 0-3 and all clock choices, then Start/Stop and leave/re-enter ten times without transferring; G18/G19/G5/G45 return high-impedance and the UI stays responsive.

  • ST7121, 2026-08-09: one mode 1/5 MHz disconnected Start/Stop/Home cycle passed over USB without a transfer. The repeated and electrical checks remain open.

• Jumper SPI MOSI G18 to MISO G19, transfer known 1-byte and 32-byte patterns at 100 kHz/1 MHz/5 MHz/10 MHz, and verify identical RX data. A 33-byte entry is rejected without toggling the bus.

• On both panels, enter SPI drafts with the hex keyboard and use COPY RX to inspect one- and 32-byte transfers in Byte Lab, including a peripheral response that differs from TX. Verify Done/Cancel never sends, all keys fit, invalid/Unicode/excess-length drafts survive Home without becoming valid prefixes, and CLEAR TX preserves the saved result/clipboard. Verify saved TX/RX and original mode/clock survive Stop/Home and new draft/settings edits, copying causes no bus activity, CLEAR RESULT preserves the draft/clipboard, and a driver failure clears the result and disables copying. Native adapter checks, eight reopen cycles and the 2026-09-29 firmware build pass; ST7121 passed keyboard entry/dismissal, disconnected transfer, retained identity and COPY RX -> Byte Lab. Physical peripheral data, electrical behavior and broader panel checks remain pending.

• With a logic analyzer, verify G45 is active only for each transaction, clock polarity/phase matches modes 0-3, and CS returns high between transfers. Repeat Scope -> SPI -> GPIO transitions on G18/G19.

• Feed a protected 3.3 V square wave into each Scope input and compare reported frequency/duty at 1/5/20/80 kS/s across representative rates and duty cycles. Confirm unavailable timing is shown when fewer than two complete rising edges exist.

• Calibrate each Scope input against known low and high DC references, reboot, confirm its bounded offset/scale returns, then reset it to 0 mV/100.0% and reboot again.

• Save a Scope chart, verify the documented 300-row header/data and 8.3-safe name, then repeat with full-card/removal faults and recover or discard the unpublished .TMP honestly.

  • ST7121, 2026-08-10: disconnected G16 showed timing unavailable; +10 mV/102.5% survived Home/re-entry and a hard reset, neutral reset saved, and 00285100.CSV published with calibrated 5 kS/s rows. Known-waveform accuracy and storage faults remain open.

• Open a saved Scope CSV from Files, tap the graph for a value, zoom and pan, and compare the visible min/max/average with the CSV. Repeat with an I2C capture containing a failed read; the failed sample appears as a gap. Back returns to the same folder without losing SD access.

  • ST7121, 2026-09-22: v0.5.1-2-gb900d6d-dirty (ELF SHA-256 prefix 2825df562) passed app-only COM7 flash hash verification and boot self-checks. Files opened the existing 300-row 00285100.CSV, showed 0.000-59.800 ms and 164/180/167 mV visible min/max/average, displayed a 42.600 ms/180 mV cursor, updated zoom/pan, and returned to the same folder. A new 19-row empty-bus I2C capture opened with no successful readings; its cursor marked a failed read. System still showed the SD mounted, USB reset, and 62 KB free/57 KB minimum internal heap. Raw CSV cross-check, a successful I2C reading, and the second panel family remain open.

• With G6 disconnected, open Signal Generator, cycle every frequency/duty/pulse choice, Start/Stop repeatedly without sending a pulse, and return Home; the launcher remains responsive and G6 is high-impedance while stopped.

  • ST7121, 2026-08-10: every frequency, duty, and pulse choice plus repeated Start/Stop and Home/re-entry passed over USB with G6 disconnected. The driver reported each requested frequency exactly; electrical high-impedance remains unmeasured.

• With a logic analyzer on G6, measure 50/100/1000/10000/50000 Hz at 10/25/50/75/90% duty. Record requested versus actual values and confirm the backlight does not change.

• Measure single 10/100/1000/10000 us high pulses, confirm the line starts low and releases afterward, then let PWM reach its five-minute automatic stop.

  • ST7121, 2026-08-10: the verified-active 1 kHz/25% run returned to START PWM, Output: stopped, and Five-minute safety timeout reached; G6 released after five minutes without a reboot or USB loss. Pulse timing and the physical line state remain unmeasured.

• Repeat GPIO G6 -> Signal Generator -> GPIO G6 transitions and verify no stale LEDC routing, pull, or output remains. Use an external buffer before testing any load.

• With USB-A empty, enter Settings -> USB keyboard host, turn it on/off ten times, and leave/re-enter ten times; the UI remains responsive and Type-C flashing/remote desktop still works.

• Connect a low-power wired USB keyboard, type shifted letters, punctuation, Backspace, arrows, Home/End, and Enter; unplug/replug it ten times and continue typing without rebooting.

• Leave the USB keyboard page while connected and verify USB-A 5 V turns off; return, enable it, and verify the keyboard re-enumerates. Repeat on both panel families before starting CDC/VCP work.

• Scope or meter external 5 V through cold boot, soft reset, I2C entry/exit, and Servo entry/exit; it stays off without any pulse.

• Transition I2C -> Servo -> GPIO -> Scope -> I2C, stopping each tool first; the backlight does not change and G0/G53/G54 are not left driven. Verify Servo PWM on G0 and the LED driver signal on G54, including GPIO G0 -> Servo -> GPIO G0 transitions.

  • ST7121, 2026-09-19: v0.5.1-1-ga7ccd42-dirty (ELF SHA-256 prefix 3ae6fc9c0) built and flashed over USB COM7 with a verified flash hash. Reboot loaded the matching image from 0x20000 and passed startup self-checks; USB screen capture showed Servo Toy running with G0: servo signal and G54: LED driver signal. External wiring, waveform measurements, and G0 handoff checks remain unverified.

• In Servo Toy, select Sine and verify each full-cycle frequency (0.05/0.10/0.20/0.25/0.50/0.75/1.00 Hz) and all three ranges. Change frequency during a run without a phase reset, then verify Random mode, mode-change stop, Stop/Home, and the five-minute timeout. Measure the G0 waveform independently; the 50 Hz servo PWM carrier is separate from the selected motion frequency.

  • ST7121, 2026-09-19: v0.5.1-1-ga7ccd42-dirty (ELF SHA-256 prefix b8f10098a) passed native and startup sine-math checks and a verified COM7 flash. USB control cycled the frequency/range/random-speed settings; a short Sine run showed changing commanded positions, accepted a live 0.25 -> 0.50 Hz change, and stopped when switched to Random. System retained USB reset, 62 KB free/57 KB minimum internal heap, and 23427 KB free PSRAM before/after. Left stopped in Sine at 0.25 Hz. Boot and screen evidence is in local build/servo-sine-* files. External servo wiring/power, electrical timing, physical tracking, and the five-minute timeout were not measured in this check.

• Repeat mixed launcher enter/exit transitions 100 times and record initial/final free and minimum heap.

  • ST7121, 2026-08-10: after app-entry scroll reset was added, 50 opens and 50 Home returns across Files, Notes, Counter, GPIO, Settings, Chat, Browser, Ebooks, Clock, and System completed in 42 seconds. The launcher returned to row zero, Reset remained USB, internal heap stayed 70 KB free/65 KB minimum, and PSRAM stayed 23516 KB free. Repeat on ILI9881C and complete the eight-hour soak.

USB-only development pass, 2026-09-29

ESP32-P4 rev 1.3, ST7121 720 x 1280, microSD mounted, USB-C connected, USB-A and external pins unwired. Builds used ESP-IDF 5.4.2 with one Ninja job. The installed partition table and active app were backed up before flashing only the existing 4 MiB ota_0 slot at 0x420000; no layout migration or data erase was performed. This session uses USB-injected touch and framebuffer snapshots, not independent physical touch or electrical measurements.

• The initial image reached all 34 apps. Reopening Ender 3 reproduced an abort in usb_host_install because exit had ignored a failed uninstall and deleted the event task. The corrected event-draining shutdown passed 16 Ender/Home cycles on ELF eb69acedc, with 16 matching start/stop log pairs and no reset. System showed 36 KB free internal heap before/after, minimum 30 -> 20 KB, and 23305 KB free PSRAM throughout. ELF 03144f2e3 passed two more cycles and the new BLE startup tests.
• Cycling's idle display now shows 0.0 mph, 0.00 mi, 0.0 kJ and best 0 W. Its old LVGL float-format calls produced literal f text and corrupt adjacent integer output. Launcher labels now show the complete app names in one or two rows; Electronics fits on one line.
• Serial's internal LINE TEST passed. An empty UART capture froze at 0/128 bytes with copy disabled, kept its original 115200/8N1 identity through Home, and RS-485 Start/Stop stayed receive-only. No external serial data was sent.
• SPI accepted AA through the hex keyboard; Done closed the keyboard without sending. An explicit unwired transfer returned 00, retained its original mode 0/1 MHz after setting changes, and COPY RX -> Byte Lab preserved exactly 00. This does not validate a peripheral response or waveform.
• I2C entry did not scan automatically. Explicit empty-bus scan/read failures returned to the UI, copy stayed disabled, the 32-byte length choice survived Home, READ ONCE stopped Watch, and leaving with the selector open was safe. Successful block reads and electrical release remain untested.
• RTU Frames decoded the built-in Float32 1.5 example. COPY REQUEST -> Serial PASTE produced 01 03 00 00 00 02 C4 0B with the port stopped. Byte Lab showed CRC CDC5 / wire C5 CD and encoded decimal 4660 as 12 34. Electronics, Subnet Lab and Resistor Lab displayed their expected default calculations.
• An explicit BLE scan filled its eight-result cap and stopped on request/Home. No nearby device was connected. Enabled firmware assertions passed received-value callback/copy tests for lengths 0-64, 65-byte rejection, chained and short buffers, failed reads, notify/indicate, stale connections and disconnect. Live GATT copy, long attributes, pairing and evidence-export fault checks remain open.
• After the user connected Wi-Fi, ELF a332de5df passed password Show/Hide with disposable text, continued typing and cursor edits, and reopening to a blank masked field. The 640 x 320 keyboard and form fit the screen. Leaving without Connect preserved the user's existing connection; no saved password was read or exported.
• The first UDP echo reached the PC but exposed an ESP-IDF 5.4.2 PSRAM executable-pointer bug during worker TLS cleanup, rebooting ELF a332de5df. ELF 6fc0a39f7 adds the narrowly scoped compatibility wrapper described in Architecture, passed its task/TLS deletion checks on both CPU cores, and completed the same four-byte echo with the socket closed and no reset.
• On ELF 6fc0a39f7, 25 confirmed UDP echo exchanges each matched four transmitted/received bytes in the PC fixture. System remained at 30 KB free internal heap, 21 KB minimum and 23300 KB free PSRAM between exchanges 13 and 25, with reset cause USB throughout. COPY REPLY -> Byte Lab preserved 00 01 02 03. A silent peer produced the three-second timeout; Cancel and Home/re-entry closed their waiting exchanges in about 600 ms. Exact 512-byte and oversized 513-byte replies were distinguished; oversized/uncopyable replies preserved the prior clipboard, while a complete zero-byte reply copied and pasted as empty. These fixtures ran on the local PC; they do not establish behavior against arbitrary devices or the second panel family.
• NTP Lab on the same image completed four 48-byte request/reply samples, selected the minimum-delay sample and displayed stratum 2/reference ID TEST. A RATE Kiss-o'-Death response stopped after one request; mismatched originate timestamps and a silent peer produced four bounded timeouts. Stop and Home/re-entry cancelled after one request in about 550 ms and retained the original endpoint/result. The PC fixture used its own wall clock plus an offset; this verifies exchange and display behavior, not clock accuracy or calibration.
• Modbus TCP on the same image passed a connect-only probe with no application bytes and FC01-04 reads at address 10/count 4, including replies fragmented into single bytes. Registers were 10-13; bits were 0/1/0/1. Saved unsigned, word-swapped and Float32 views kept the original reply and sent no extra request. Home with an open function selector retained the completed result. Exception 0x06, a reply delayed beyond the five-second deadline, Stop and Home cancellation all closed the connection and cleared stale values. With the PC listener stopped, the probe reached the five-second timeout; this path did not produce an immediate connection-refused response.
• Wake-on-LAN sent exactly six valid 102-byte packets to the PC's unicast fixture using the synthetic MAC 02:11:22:33:44:55. The receiver forwarded nothing. Packet count stayed zero after one tap, confirmation expiry, Cancel and Home. The UI kept the requested MAC/endpoint and correctly reported local send success with wake state unverified. System at the end of the network pass showed 14 minutes of uninterrupted uptime, reset cause USB, 29 KB free/20 KB minimum internal heap and 23300 KB free PSRAM. Actual wake-capable hardware and subnet-broadcast delivery remain untested.
• Image 68ec7398c adds accurate System identification: ESP-IDF 5.4.2, the ELF SHA-256 prefix matching the boot log, and ota_0 @ 0x00420000 (4096 KB) matching the backed-up installed table. The 2315760-byte app was flashed and hash-verified in that slot, passed both-core TLS cleanup and BLE received-value boot checks, and reconnected using the saved Wi-Fi profile. The screen layout, SD/internal mounts and Settings connection state passed. Local PC fixtures were stopped after testing.
• A later uninterrupted idle capture on 68ec7398c reproduced a separate SDIO receive-buffer allocation assertion when the two-minute screensaver started its HTTPS weather fetch. Image 802621c10 moves the existing 96 KiB LVGL object pool from internal static RAM into PSRAM using LVGL's supported allocator hook. Its 2315888-byte app was hash-verified in the same slot; boot confirmed the PSRAM pool and passed both-core TLS cleanup/BLE checks. Internal heap increased from 32 KB free to 127 KB free initially. Settings then remained untouched for over five minutes: weather loaded with certificate verification, the backlight dimmed at two minutes and turned off at five minutes, and a USB-injected touch woke it. Frame numbers remained continuous, the console contained no panic/assert/allocation failure, and System retained reset cause USB at six minutes uptime, with 114 KB free/103 KB minimum internal heap and 23171 KB free PSRAM. This fixes the observed idle failure; a longer soak and the second panel remain open.
• Existing Files/Notes were readable without editing. The initial pass was offline; HTTP/MQTT/Modbus/NTP/WoL/UDP rendered their initial screens, with live network exchanges deferred until Wi-Fi was connected. No storage fault, OTA rollback, external load, logic-analyzer or second-panel tests were performed.

Local boot/console logs and framebuffer evidence are under build/hardware-20260929/. Private file/network screens stay local. These observations cover only the named cases; the broader checklist above remains open.

On 2026-09-30, the subsequent HTTP Console edit built successfully as ELF 5e5b7bb72 (2316480 app bytes): its 640 x 300 keyboard opens only while editing and replaces the preview, and response framing is checked before reporting success. The seven-mode PC fixture passed independent real-socket framing checks. After the user reconnected USB, this app was flashed and hash-verified in the same ota_0 slot. Boot passed its startup/TLS/BLE checks, but the captured log then recorded two Brownout detector was triggered resets shortly after the backlight reached 100%. The user heard speaker crackling and saw repeated black screens during testing, reported no heat/burning smell, and noted the USB cable was angled at the tablet. The source of the voltage drops is not established. Device operations were stopped; HTTP screen and network checks did not run. 802621c10 remains the last image to pass the idle/wake test and is retained as a local backup; the installed image is 5e5b7bb72.

An offline follow-up built ELF c11c159a0 (2316976 app bytes) with SPK_EN preloaded low before the expander enables its outputs. Alarm playback now initializes/mutes the codec, primes it with silence, and enables the amplifier only after successful setup; it disables the amplifier before closing the codec. This targets uninitialized speaker output during boot, not the unconfirmed cause of the brownouts. It has not been flashed or tested audibly. Keep device testing stopped until the USB connection/power is stable; quiet startup, alarm playback/cleanup, and the remaining HTTP device cases are open.

Update and recovery

• Publish a disposable stable release containing tab5_os.bin, tab5_os.json, and SHA256SUMS; confirm all three describe the same bytes and the embedded application version.
• From a clean Windows ESP-IDF 5.4.2 setup, verify SHA256SUMS, write tab5_os_factory.bin at offset zero, and confirm bootloader, partition table, initial OTA state, launcher, and expected blank NVS/SPIFFS state. Repeat on both panel families.
• Install through the stable manifest and confirm the updater rejects, without changing the boot partition: malformed/oversized JSON, beta channel, wrong hardware, non-newer version, unsupported predecessor, URL outside the tagged release path, wrong Content-Length/byte count, wrong embedded version, and wrong SHA-256.
• A valid OTA image boots, passes its health window, and preserves settings and SD data.
  • ST7121, 2026-09-22: the published v0.5.1 app booted from the tablet's pre-existing factory/4 MiB OTA partition table with Wi-Fi, internal SPIFFS, and SD mounted. Its Install latest button downloaded and booted the published v0.6.0 app in OTA slot 0. The tablet's older bootloader left the image in new state; after backing up and replacing only the bootloader region with the v0.6.0 release bootloader, a reboot and health window reached validated, System recorded Installed v0.6.0-20816206, and Wi-Fi, internal SPIFFS, and SD stayed mounted. A current-layout clean install and the ILI9881C family remain open.
• An intentionally invalid candidate rolls back to the previous working image.
• System records the successful install or rollback result after reboot rather than only the current partition state.
• Complete one documented USB recovery flash and cold boot.

Pass only when every applicable item is checked on both hardware families and failures include logs plus reproduction steps.