fix: reject CSV viewer close failures

Author: DevanMetz

.github/workflows/release.yml

@@ -288,6 +288,25 @@ jobs:
       - name: Test Notes with real LVGL
         shell: pwsh
         run: python tools/test_notes_io.py --compiler clang --lvgl-library build/offline-ui/out/lvgl_host.lib --output build/notes-ui
+      - name: Test CSV viewers with real LVGL
+        shell: pwsh
+        run: python tools/test_csv_viewer.py --compiler clang --lvgl-library build/offline-ui/out/lvgl_host.lib --output build/csv-viewer-ci
+      - name: Retain CSV viewer UI evidence
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: csv-viewer-logs
+          path: |
+            build/csv-viewer-ci/compile.log
+            build/csv-viewer-ci/result.log
+            build/csv-viewer-ci/source.json
+            build/csv-viewer-ci/capture_viewer.c
+            build/csv-viewer-ci/capture_data.c
+            build/csv-viewer-ci/serial_log_viewer.c
+            build/csv-viewer-ci/serial_log_data.c
+            build/csv-viewer-ci/payload_clipboard.c
+          if-no-files-found: warn
+          retention-days: 14
       - name: Retain Notes UI test evidence
         uses: actions/upload-artifact@v4
         if: always()

ROADMAP.md

@@ -66,6 +66,7 @@ Phase 1 software progress is also underway:
 - [x] Ride history reports recovery/open/read/close errors as unavailable instead of showing zero or partial totals. Summary appends check SD availability and preparation errors, reject failed read chunks before copying, and retain the first error through cleanup. All 50 native file/fault cases pass; the preceding callbacks fail 24 controls. Exact final/backup/temporary bytes and 25 reopens are checked with closed modeled handles. Linux CI retains source hashes and logs, and the unflashed firmware builds with unchanged configuration. Physical SD/panel and power cuts remain open.
 - [x] Ring logging commits its saved timestamp only after tail recovery and a complete, successfully closed read. Failed loads retain queued samples and defer history requests until a successful retry; known SD unavailability also blocks a cached checkpoint. Appends check directory errors and preserve the first seek/tell/header/row error through close and repair. All 59 native file/queue/fault cases pass; the preceding callbacks fail 32 controls. Checks verify exact bytes, retry/deduplication, timeout handling while blocked and 25 checkpoint reopens with closed modeled handles. Linux CI retains source hashes and logs. Physical SD, BLE, panel and power cuts remain open.
 - [x] Ebook page reads publish their text and byte positions only after read/close success. Failed navigation retains the previous page for retry, including zero-byte and full-count read errors. Initial navigation is disabled until a page loads; callbacks reject disabled/offscreen actions and invalid positions. All 44 native file/state/fault checks pass, including 25 navigation cycles with one reused buffer and closed handles. Thirty-one preceding-callback controls fail; three new unsafe-boundary guards are tested only with the new callbacks. Linux CI retains source hashes, initialization source and logs. Physical SD/panel and power behavior remain open.
+- [x] Recognized Scope/I2C and saved serial CSV loads require a successful close before showing a graph or row-copy controls. Failed or empty capture loads release their row buffer immediately. All 36 real LVGL/native-file checks pass; the preceding viewers fail 15 controls. Checks cover both row limits, I2C gaps, read/seek/close and allocation faults, unchanged file/clipboard bytes and 25 success/error/reopen cycles per viewer with stable memory in the unchanged 96 KiB pool. Existing serial-copy/inspector checks pass. Windows CI retains complete viewer/parser sources and logs; physical SD/panel behavior remains open.
 - [x] Shared CSV tail recovery now scans backwards in 512-byte blocks. Eight previous-source controls exceed stdio seek budgets; a 64 KiB partial tail drops from 65,538 seeks to 130 with the same retained prefix. All 32 native byte/boundary/fault cases, original storage checks and five MQTT/HTTP logging cases pass with closed modeled handles. The unflashed firmware builds with unchanged configuration. Linux CI retains source hashes and compilation/result logs; physical SD timing and power cuts remain open.
 - [x] Built-in SD paths, timestamps, units, 8.3-safe collision names, `.TMP`, and `.BAK` behavior are documented.
 - [x] Persisted brightness choices, a dimmed two-minute screen, and configurable 5/10/30-minute or Never screen-off behavior are implemented.

docs/architecture.md

@@ -91,6 +91,8 @@ Ring's saved heart-rate timestamp becomes loaded only after incomplete-tail repa
 
 Ebooks reads up to 8 KiB into its existing cached PSRAM buffer. Page text, current/next byte positions, navigation state and scroll position change only after successful seek, read and close. Failure preserves the confirmed page and positions, reports the first error and allows retry when storage is available. Reader initialization clears both offsets and disables navigation until loading succeeds. Callbacks recheck disabled state and screen pointers; negative positions and additions beyond the platform's `long` range are rejected. Native files and controlled UI/heap/SD boundaries verify the transitions; physical SD and panel behavior remain open.
 
+The Scope/I2C capture and saved serial CSV viewers require a successful close before constructing their graph or row-copy controls. A read or close failure after format recognition shows an error and releases the viewer buffers immediately. Empty recognized captures also release their row buffer. Real LVGL checks cover error/reopen transitions and stable memory in the unchanged 96 KiB pool; filesystem faults and PSRAM allocation are controlled host boundaries, with physical SD and panel checks still open.
+
 See [Storage and compatibility contract](compatibility.md) and [Data formats](data-formats.md).
 
 ## Network and radio

docs/data-formats.md

@@ -29,6 +29,8 @@ Files opens published Scope and I2C `.CSV` captures as graphs when their headers
 
 Files also opens published UART and RS-485 `.CSV` logs as a timestamped RX/TX timeline. The viewer loads up to the first 512 well-formed rows, shows eight rows per page, and lets you filter by direction or switch between hex and escaped ASCII without changing the file. Unpublished `.TMP` files retain the text preview.
 
+After a supported capture or serial header is recognized, seek/read/close failures show an error instead of a graph or copyable timeline. The viewers release their row/text buffers immediately on failed or empty loads. The original file remains unchanged; a successful reopen can display it again. These boundaries are checked with real LVGL and native files under controlled I/O failures; physical SD behavior remains open.
+
 Choose a record from the current page and tap **COPY ROW** to put its original 1-128 bytes on the shared RAM clipboard. The selector and timeline use the same record numbers: positions among loaded valid rows, not physical CSV line numbers. Page/filter changes select the first matching record on the new page; changing Hex/ASCII preserves the selection. Rows of 129-256 bytes remain viewable but cannot be partially copied. Empty filters and failed copies preserve the clipboard. Record bytes can then be pasted into Byte Lab or RTU Frames; a logged RX/TX chunk may split or combine protocol frames, so a record is not a guarantee of a complete message. Copy changes neither the CSV nor the displayed byte values.
 
 ## CSV conventions

docs/testing.md

@@ -15,6 +15,7 @@ Python 3 and Node.js are needed for the quick checks. The configuration checks a
 | Ride history loading or summary appends | [Ride history storage](#ride-history-storage) and a firmware build. |
 | Ring heart-rate logging, saved timestamps or queue processing | [Ring history storage](#ring-history-storage) and a firmware build. |
 | Ebook page loading or navigation | [Ebook pages](#ebook-pages) and a firmware build. |
+| Scope/I2C capture or saved serial CSV viewers | [CSV viewer storage and UI](#csv-viewer-storage-and-ui), existing serial-copy checks and a firmware build. |
 | Offline apps, SPI or I2C editor/result flows | [Offline and peripheral UI](#offline-and-peripheral-ui). |
 | Serial, saved serial logs or RTU Frames | [Serial and RTU UI](#serial-and-rtu-ui). |
 | Modbus TCP, NTP, Wake-on-LAN, UDP or HTTP fixtures | [Network fixtures and UI](#network-fixtures-and-ui). |
@@ -150,6 +151,18 @@ Retry cases use the actual navigation callbacks after storage availability is re
 
 Reader initialization is retained and checked as source, including zero offsets and initially disabled controls; it is not compiled into the native fixture. The firmware build checks its real UI declarations. Full main/function/initialization/test hashes, generated callback/config/initialization source and compile/result logs stay under `build/ebook-pages/`. Linux CI retains these files as `ebook-pages-logs`, including compiler/test failures. These 44 cases are separate from the Windows native total.
 
+## CSV viewer storage and UI
+
+```powershell
+python tools/test_csv_viewer.py --compiler 'C:/path/to/clang.exe' --lvgl-library build/offline-ui/out/lvgl_host.lib
+```
+
+This Windows runner reuses the cached Debug LVGL library and compiles both complete viewer/parser pairs plus the actual shared clipboard. Its 36 real UI/native-file cases check Scope and I2C graph values/gaps, serial copy-control admission, the 2,048/512-row limits, empty captures/logs, unsupported formats, open/allocation/seek failures, parser-header and row read faults, and close failures including missing errno and combined read/close faults. The preceding viewers fail 15 controls: close failures still construct a graph or copyable timeline, and capture buffers remain allocated on empty/failed loads.
+
+Every case checks the original file fingerprint and retained clipboard bytes. Failed loads must release external row/text allocations before teardown. Both viewers also run 25 success/error/success cycles (75 opens/closes each) with unchanged LVGL free bytes and allocation counts in the existing 96 KiB pool. Heap and I/O failures are controlled; widgets, parsers, graph arrays and UI cleanup use real LVGL. Open/probe fallback retains its existing API contract; the new failure rule applies after header recognition. These checks do not establish physical SD, PSRAM, panel, latency or power-loss behavior.
+
+Complete viewer/parser/clipboard snapshots, their source/header hashes, the I/O adapter/test hashes and compiler/runtime logs are retained under `build/csv-viewer/`. Windows CI runs these 36 checks after the original 820 native checks and retains `csv-viewer-logs`; this is separate from the Linux fixtures. Use `tools/test_serial_log_ui.ps1` for the existing row-copy/filter/page/inspector checks.
+
 ## OTA manifests
 
 ```powershell

main/capture_viewer.c

@@ -174,7 +174,7 @@ bool capture_viewer_show(lv_obj_t *parent, const char *path)
 
     rows = heap_caps_malloc(VIEWER_MAX_ROWS * sizeof(*rows), MALLOC_CAP_SPIRAM | MALLOC_CAP_8BIT);
     bool loaded = rows && capture_data_read(file, rows, VIEWER_MAX_ROWS, &data);
-    fclose(file);
+    if (fclose(file) != 0) loaded = false;
 
     const char *name = strrchr(path, '/');
     name = name ? name + 1 : path;
@@ -183,10 +183,12 @@ bool capture_viewer_show(lv_obj_t *parent, const char *path)
     lv_label_set_text_fmt(title, "%s  |  %s", format == CAPTURE_FORMAT_SCOPE ? "Scope" : "I2C watch", name);
     lv_obj_set_style_text_font(title, &lv_font_montserrat_28, 0);
     if (!loaded || !data.count) {
+        const char *error = !rows ? "Not enough memory to open capture" :
+                            !loaded ? "Could not read capture" : "No readable capture rows in this file";
+        capture_viewer_stop();
         lv_obj_t *message = lv_label_create(parent);
         lv_obj_set_width(message, 640);
-        lv_label_set_text(message, !rows ? "Not enough memory to open capture" :
-                          !loaded ? "Could not read capture" : "No readable capture rows in this file");
+        lv_label_set_text(message, error);
         return true;
     }
 

main/serial_log_viewer.c

@@ -292,7 +292,7 @@ bool serial_log_viewer_show(lv_obj_t *parent, const char *path)
                             MALLOC_CAP_SPIRAM | MALLOC_CAP_8BIT);
     page_text = heap_caps_malloc(VIEWER_TEXT_BYTES, MALLOC_CAP_SPIRAM | MALLOC_CAP_8BIT);
     bool loaded = rows && page_text && serial_log_read(file, rows, VIEWER_MAX_ROWS, &data);
-    fclose(file);
+    if (fclose(file) != 0) loaded = false;
 
     const char *name = strrchr(path, '/');
     name = name ? name + 1 : path;

tests/csv_viewer_host/io_faults.h

@@ -0,0 +1,14 @@
+#pragma once
+#include <stdio.h>
+
+FILE *csv_fixture_open(const char *path, const char *mode);
+int csv_fixture_seek(FILE *file, long offset, int origin);
+char *csv_fixture_gets(char *text, int size, FILE *file);
+int csv_fixture_error(FILE *file);
+int csv_fixture_close(FILE *file);
+
+#define fopen csv_fixture_open
+#define fseek csv_fixture_seek
+#define fgets csv_fixture_gets
+#define ferror csv_fixture_error
+#define fclose csv_fixture_close