@@ -462,7 +462,7 @@ jobs:
   native-ui:
     needs: firmware
     runs-on: windows-2025
-    timeout-minutes: 20
+    timeout-minutes: 25
     steps:
       - uses: actions/checkout@v4
       - uses: actions/download-artifact@v4
@@ -487,6 +487,22 @@ jobs:
       - name: Test Modbus TCP with loopback peers
         shell: pwsh
         run: ./tools/test_modbus_network.ps1
+      - name: Test UDP tools with loopback peers
+        shell: pwsh
+        run: ./tools/test_device_network.ps1
+      - name: Retain UDP tool evidence
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: device-network-logs
+          path: |
+            build/device-network/compile.log
+            build/device-network/result.log
+            build/device-network/source.json
+            build/device-network/*-wire.json
+            build/device-network/sources/
+          if-no-files-found: warn
+          retention-days: 14
       - name: Retain Modbus TCP evidence
         uses: actions/upload-artifact@v4
         if: always()
 
@@ -129,6 +129,7 @@ Phase 3 software progress has begun:
 - [x] Modbus TCP captures its five-second deadline at request acceptance, includes scheduling time in the displayed duration and rejects already expired workers before socket creation. All 24 actual app/LVGL/loopback scenarios pass, including seven delayed-start controls that fail against the preceding source and 25 timeout/retry pairs with stable handles and LVGL memory. Delayed reads/probes, remaining budgets, stale admission and Stop/Home ownership are checked with controlled native startup/clock boundaries. CI retains exact compiled sources, hashes, logs and peer request bytes. Physical ESP-IDF scheduling, lwIP/Wi-Fi timing and both panels remain open.
 - [x] Subnet Lab and the new device/network apps share strict decimal IPv4 parsing. Address/numeric fields retain invalid characters, line breaks, and excess length for rejection through Home/re-entry, with host tests proving no worker or traffic for invalid network input. Physical input paths remain unverified.
 - [x] UDP Console sends one confirmed 0-128-byte hex/ASCII datagram to a selected IPv4 endpoint, filters replies to that peer, and displays an explicitly bounded 512-byte preview. A three-second deadline, cancellation, source-port controls, immutable request/result identity, and OTA blocking cover its lifecycle. Native checks, firmware build and ST7121 Wi-Fi tests pass for 25 repeated echoes, reply copy, timeout, cancellation and 0/512/513-byte replies after fixing SDK task cleanup; broader network faults and the second panel family remain open.
+- [x] NTP Lab, Wake-on-LAN and UDP Console count worker scheduling inside their ten-, two- and three-second request budgets and displayed duration. Expired requests create no socket; NTP clock-step checks retain their measurement reference. All 56 actual-app/LVGL/loopback scenarios pass, including seventeen preceding-source regression controls and 25 timeout/retry pairs per app with stable allocation/handle counts. CI retains the source and peer evidence. Physical scheduler/Wi-Fi timing and both panels remain unchecked for this change.
 - [x] Subnet Lab calculates IPv4 networks, netmasks, broadcast and host ranges, and optional peer membership entirely offline, including /0 counts, /31 point-to-point links, and /32 host routes. All 33 prefixes match independent host reference checks; real LVGL input/lifecycle checks and the firmware build pass. Physical touch and both panel families remain open.
 - [x] Settings scans report Wi-Fi channel and RSSI; Network Diagnostics reports link addressing, performs DNS lookup and four bounded ICMP echo probes, and enumerates up to eight standard DNS-SD mDNS service types without blocking LVGL or OTA restart safety.
 - [x] Network Diagnostics ping uses nonblocking I/O, absolute one-second probe waits and a six-second cooperative budget after DNS; unrelated traffic cannot restart a timeout. Complete replies must match the target, valid framing/checksums and a fresh echoed payload. The 120 deterministic cases across IPv4-only/IPv6 builds check filtering, deadlines, cancellation, faults and socket closure. See [Network Diagnostics](docs/network-diagnostics.md); physical IPv6/traffic validation remains open.
 
@@ -54,9 +54,9 @@ Modbus TCP uses a single bounded network worker for a connection test or one rea
 
 Network Diagnostics creates one task per accepted operation and releases it after cleanup. It shares `network_resolver.c` with HTTP: two locked lookup slots attach worker-owned state, while queued dispatch and late DNS replies carry IDs instead of caller pointers. The core copies each name before calling lwIP; cached-answer buffers match the SDK's configured capacity and callers receive at most four addresses. Diagnostics includes task scheduling in its ten-second DNS wait and requests cancellation on Cancel/Home. Its four raw echo probes use `network_ping.c`, which owns one nonblocking socket, checks cancellation around I/O and gaps, applies absolute probe waits and a six-second budget after DNS, and validates replies against the selected source and fresh payload. mDNS retains busy ownership through its existing three-second query and result cleanup. Native worker/LVGL and socket/clock checks cover these paths; physical latency and routing remain open. See [Network Diagnostics](network-diagnostics.md).
 
-NTP Lab and Wake-on-LAN each own one bounded UDP worker and publish immutable request/result snapshots for the LVGL timer. Home requests cancellation and detaches screen objects; the worker remains busy through socket cleanup, preventing OTA restart. NTP Lab measures four samples without setting the clock. Wake-on-LAN sends one confirmed magic packet without retrying or claiming that the target woke. Neither app opens a listener, saves settings, or logs traffic. See [Device and network tools](device-network-tools.md).
+NTP Lab and Wake-on-LAN each own one bounded UDP worker and publish immutable request/result snapshots for the LVGL timer. Their ten-second and two-second budgets begin when the UI accepts the request, include worker scheduling, and prohibit socket creation after expiry. Displayed duration includes that wait; NTP's clock reference and clock-step checks begin when the worker measures the clock. Home requests cancellation and detaches screen objects; the worker remains busy through socket cleanup, preventing OTA restart. NTP Lab measures four samples without setting the clock. Wake-on-LAN sends one confirmed magic packet without retrying or claiming that the target woke. Neither app opens a listener, saves settings, or logs traffic. See [Device and network tools](device-network-tools.md).
 
-UDP Console uses the same worker/snapshot lifecycle for one confirmed custom datagram. It reuses Byte Lab's bounded payload parser, transmits at most 128 bytes, and receives a 512-byte preview plus one sentinel byte to distinguish oversized replies. A connected, nonblocking UDP socket filters replies to the selected peer; a three-second deadline and cancellation bound the exchange. The worker alone closes the socket and remains visible to the OTA blocker until cleanup completes. No listener, task, or UI timer remains after an idle exit. See [UDP Console](udp-console.md).
+UDP Console uses the same worker/snapshot lifecycle for one confirmed custom datagram. It reuses Byte Lab's bounded payload parser, transmits at most 128 bytes, and receives a 512-byte preview plus one sentinel byte to distinguish oversized replies. A connected, nonblocking UDP socket filters replies to the selected peer; its three-second budget begins at request acceptance and includes scheduling, socket setup, sending and receiving. An expired worker creates no socket, and displayed duration includes startup delay. The worker alone closes the socket and remains visible to the OTA blocker until cleanup completes. No listener, task, or UI timer remains after an idle exit. See [UDP Console](udp-console.md).
 
 Every resource has one owner at a time:
 
 
@@ -11,12 +11,14 @@ For custom hex/ASCII request-and-reply exchanges, see [UDP Console](udp-console.
 NTP Lab helps diagnose a time server and compare it with the tablet's system clock. It does not set the clock or change the Clock app's synchronization settings.
 
 1. Enter the server's full decimal IPv4 address and UDP port (normally 123). Use Network's DNS lookup first if you only know a hostname.
-2. Tap **SAMPLE 4**. The app takes four samples, spaces requests at least two seconds apart, and waits at most two seconds for each reply. The session has a ten-second deadline.
+2. Tap **SAMPLE 4**. The app takes four samples, spaces requests at least two seconds apart, and waits at most two seconds for each reply. The ten-second session budget starts when SAMPLE 4 is accepted and includes worker scheduling. A delayed start uses only the remaining budget; an already expired worker opens no socket and sends no request.
 3. Inspect each sample's round-trip time, estimated network delay, and clock offset. The summary selects the successful sample with the lowest delay and reports its corresponding offset. Positive offset means the server is ahead of the tablet.
 4. **STOP** or Home cancels the run. Reopening the app displays the completed/cancelled request identity and results; changing the input does not relabel an earlier result.
 
 The tablet needs a plausible system date before measuring. An unset clock is rejected, and a clock step during a request invalidates that sample. The supported date range is 2020 through 2099, including the NTP seconds rollover in 2036. This is a diagnostic estimate: network asymmetry, tablet scheduling, and the local clock affect the result. The selected server and UDP replies are not authenticated.
 
+The elapsed session duration includes scheduling time. The displayed tablet clock reference and clock-step checks start when measurement begins, so a scheduling delay does not become a false clock-step report. Stop/Home keep the operation busy until its worker finishes cleanup; delayed execution or cleanup can delay the final result beyond the exchange budget.
+
 The parser checks the request's echoed transmit timestamp, response length, version, server mode, leap state, stratum, and receive/transmit timestamps. An unsynchronized server is reported as an error. A stratum-zero Kiss-o'-Death response stops the burst, including a server asking the client to reduce its request rate. This version supports the base 48-byte NTP message; extension fields and authentication trailers are rejected rather than silently ignored.
 
 Packet handling and delay/offset calculations follow [RFC 5905](https://www.rfc-editor.org/rfc/rfc5905.html). This app implements a bounded diagnostic exchange, not the RFC's clock-selection and clock-discipline system.
@@ -32,6 +34,8 @@ Wake-on-LAN sends the standard magic packet for a device whose firmware, network
 
 **CANCEL** and Home can stop work that has not yet sent. A transmitted packet cannot be recalled. The app does not discover devices, retry automatically, store profiles, or support SecureOn passwords. Wake traffic is unencrypted.
 
+The two-second send budget starts when the confirmed request is accepted and includes worker scheduling. An already expired worker reports timeout without creating a socket or sending a packet. The displayed duration includes the wait; cancellation retains worker ownership until cleanup finishes.
+
 See the [AMD magic-packet format](https://docs.amd.com/r/en-US/am011-versal-acap-trm/Magic-Packet-Events) and [Intel remote-wake requirements](https://www.intel.com/content/www/us/en/support/articles/000005793/ethernet-products.html) for protocol and adapter background.
 
 ## PC fixtures
@@ -52,4 +56,6 @@ The NTP fixture uses the PC wall clock plus the configured offset, not an indepe
 
 Pure host tests cover protocol encoding, malformed inputs, timestamp calculations, and packet construction. The optional Windows runner `./tools/test_device_network.ps1` exercises the actual LVGL apps and network workers against loopback peers with native threads and sockets. Invalid-input cases verify preserved drafts and zero workers, sockets, and packets. It needs Python, a native C compiler, CMake, Ninja, and the managed LVGL sources fetched by the firmware build.
 
+The complete suite has 56 scenarios: the original 39 plus 17 delayed-start controls across all three UDP apps. A held native worker and controlled monotonic clock verify expired requests send nothing, remaining budgets are not renewed, duration includes scheduling, NTP keeps its measurement reference separate, and Stop/Home prevent stale admission while cancellation is pending. Each app completes 25 timeout/retry pairs with stable native handles and LVGL memory after closing the UI. All 17 controls fail against the preceding sources. These tests do not establish ESP-IDF scheduling, physical Wi-Fi timing or actual wake behavior. CI retains source snapshots, hashes, logs and independent peer packet bytes as `device-network-logs`.
+
 On 2026-09-29, ST7121 with USB-injected touches and a PC peer passed NTP's four-sample exchange, minimum-delay selection, `RATE` refusal, mismatched-timestamp rejection, timeout, Stop and Home/re-entry. Wake-on-LAN produced exactly six valid 102-byte packets for a synthetic MAC at the unicast PC receiver, with zero packets after one tap, expiry, Cancel or Home. The receiver forwarded nothing. The corrected firmware also passed actual worker TLS cleanup on both CPU cores. These checks do not establish clock accuracy, independent physical touch behavior, actual wake support or the second panel family; the exact tested scope remains in the [hardware smoke checklist](hardware-smoke-checklist.md#usb-only-development-pass-2026-09-29).
@@ -66,6 +66,7 @@ Use current-limited power and 3.3 V signals. Disconnect external loads before bo
 - [ ] In Modbus TCP, use the [Python fixture](modbus-tcp.md) on a reachable PC: test TCP, read all four functions and boundary addresses, compare decimal/hex/bit values, and confirm exception/fragmented/timeout responses. Check disconnected Wi-Fi, unreachable/closed port, field changes and confirmation expiry, Stop/Home during each network phase, re-entry during cancellation, and OTA refusal until the worker is idle. Repeat on both panel families and record heap before/after repeated operations.
 - [ ] In Modbus TCP, compare the 32-bit unsigned/signed/Float32 views against a device's documented register map in each applicable byte order. Verify raw words, pairing from the original address, an odd last register, negative zero, NaN/infinity, keyboard/result visibility, and readable selector popups. Changing the view or editing the next request must preserve the earlier result's identity and send no traffic; Home/re-entry retains the view and closes an open popup. Pure references and host UI/network checks cover these paths; physical panel and device results remain open.
 - [ ] Measure Modbus accepted-request timing while other permitted work is active. The five-second exchange budget and displayed duration include worker scheduling; an already expired worker must create no socket. Check Stop/Home before the worker runs, re-entry while cancellation is pending and successful fresh retries, retaining OTA ownership through socket cleanup. Native held-thread/clock controls cover these paths; physical ESP-IDF/lwIP timing and both panels remain unverified.
+- [ ] Measure NTP Lab, Wake-on-LAN and UDP Console accepted-request timing while other permitted work is active. Their ten-, two- and three-second budgets and displayed duration include scheduling; expiry before worker entry must create no socket or packet. Confirm NTP startup delay does not produce a false clock-step result, and a late worker retains only the remaining sampling/reply budget. Check Stop/Home before entry, re-entry while cleanup is pending, OTA ownership and fresh retries on both panels. The 56 native scenarios include seventeen delayed-start cases and 25 timeout/retry pairs per app; ESP-IDF scheduling and physical Wi-Fi timing remain unchecked.
 
 - [ ] In NTP Lab, Modbus TCP, Wake-on-LAN, and UDP Console, reject abbreviated/octal/leading-zero IPv4 addresses, signs/suffixes/exponents in numeric fields, and overlong input without any network traffic. Paste line breaks inside addresses, MAC addresses, and numeric fields; ensure they remain invalid through Home/re-entry. Repeat split-line rejection in Electronics, Subnet Lab, and Resistor Lab, verifying that old results clear and fields remain readable on both panels. Native regression tests pass; tablet input paths and lwIP behavior remain open.