[green] fix Waveshare largest-block floor at 98304 in the V5 era

Adds QUALIFICATION_DERIVATION_V5 (heap_floor
floor-min-1024-waveshare-block-98304-v2), the ADR-0039 second boundary
7d85328 with strict-descendant routing that falls through to ADR-0038
routing when the boundary object is absent, the fixed Waveshare
largest-block floor in both the release tool and the HIL bench
derivations, V5 admission in the unbound-era policy shapes, and the
regenerated 5036-byte c3167853 policy. Also restores the
test_repeatability tail block accidentally displaced by the red commit's
insertion (pre-existing test code moved back verbatim, no new authorship).
All twelve affected host suites pass; the policy revalidates through
_load_qualification_policy under the checkout-bound V5 era.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0173nRnCob9LXYShoQmC85xZ
Signed-off-by: Viwat Vchirawongkwin <viwat.v@chula.ac.th>

Author: yyods

firmware/qualification/oi1-gates.json

@@ -8,7 +8,7 @@
     "application_image": "exact-byte-identical-two-root-v1",
     "boot_ceiling": "fixed-profile-product-slo-esp3000-pico7000-v4",
     "goodput_floor": "fixed-product-slo-64k-under-10s-6600-v3",
-    "heap_floor": "floor-min-1024-v1"
+    "heap_floor": "floor-min-1024-waveshare-block-98304-v2"
   },
   "profile_order": [
     "esp32-4mb",
@@ -72,7 +72,7 @@
         "gc_free_min_bytes": 8316928,
         "get_verified_goodput_min_bytes_per_second": 6600,
         "idf_internal_free_min_bytes": 177152,
-        "idf_internal_largest_block_min_bytes": 102400,
+        "idf_internal_largest_block_min_bytes": 98304,
         "idf_internal_minimum_free_min_bytes": 177152,
         "put_committed_goodput_min_bytes_per_second": 6600,
         "reset_to_service_advertisement_max_ms": 3000

firmware/scripts/release_bundle.py

@@ -160,7 +160,17 @@ class ReleaseError(RuntimeError):
     "boot_ceiling": "fixed-profile-product-slo-esp3000-pico7000-v4",
     "goodput_floor": "fixed-product-slo-64k-under-10s-6600-v3",
 }
-QUALIFICATION_DERIVATION = QUALIFICATION_DERIVATION_V4
+# ADR-0039: the second-replacement v0.6.0 derivation changes exactly the
+# heap-floor identifier.  Every heap floor keeps floor-min-1024-v1
+# arithmetic except the fixed Waveshare largest-block floor.
+QUALIFICATION_DERIVATION_V5 = {
+    "application_image": "exact-byte-identical-two-root-v1",
+    "application_headroom": "factory-minus-application-v1",
+    "heap_floor": "floor-min-1024-waveshare-block-98304-v2",
+    "boot_ceiling": "fixed-profile-product-slo-esp3000-pico7000-v4",
+    "goodput_floor": "fixed-product-slo-64k-under-10s-6600-v3",
+}
+QUALIFICATION_DERIVATION = QUALIFICATION_DERIVATION_V5
 # ADR-0038: the superseded unpublished v0.6.0 source era ends at and
 # includes this commit.  Only strict descendants belong to the replacement
 # v0.6.0 era and use QUALIFICATION_DERIVATION_V4; the boundary and its
@@ -174,10 +184,20 @@ class ReleaseError(RuntimeError):
 V060_ABANDONED_CANDIDATE_SOURCE = (
     "719b211345028e49aee9df9b11c4b5fd110913de"
 )
+# ADR-0039: the first-replacement candidate source is the second era
+# boundary.  Only strict descendants use QUALIFICATION_DERIVATION_V5; the
+# boundary itself and its ancestors keep the ADR-0038 routing above.
+V060_FIRST_REPLACEMENT_SOURCE_BOUNDARY = (
+    "7d853289815751c7381c9fd0b9a9a4409bdb6879"
+)
 # ADR-0037 fixed product SLOs for the replacement v0.6.0 era.
 V4_FIXED_RESET_SLO_MS_ESP = 3000
 V4_FIXED_RESET_SLO_MS_RP2 = 7000
 V4_FIXED_GOODPUT_FLOOR_BPS = 6600
+# ADR-0039: the fixed Waveshare largest-block floor — the baseline-derived
+# 102400 minus exactly one 4096-byte page.
+V5_FIXED_WAVESHARE_LARGEST_BLOCK_MIN_BYTES = 98304
+V5_WAVESHARE_PROFILE_ID = "waveshare-esp32-s3-lcd-147b"
 QUALIFICATION_THRESHOLD_KEYS = (
     "application_image_max_bytes",
     "application_headroom_min_bytes",
@@ -20991,6 +21011,26 @@ def _qualification_derivation_for_source(
         and COMMIT_RE.fullmatch(source_commit) is not None,
         "qualification source commit must be full lowercase 40-hex",
     )
+    # ADR-0039: a strict descendant of the first-replacement boundary is
+    # the second-replacement era.  When this stage cannot be proven (for
+    # example a historical checkout that predates the boundary object),
+    # fall through to the ADR-0038 routing below, which itself fails
+    # closed on any ancestry it cannot prove.
+    try:
+        second_merge_base = _git_output(
+            Path(checkout),
+            "PyBLE",
+            "merge-base",
+            V060_FIRST_REPLACEMENT_SOURCE_BOUNDARY,
+            source_commit,
+        )
+    except ReleaseError:
+        second_merge_base = None
+    if (
+        second_merge_base == V060_FIRST_REPLACEMENT_SOURCE_BOUNDARY
+        and source_commit != V060_FIRST_REPLACEMENT_SOURCE_BOUNDARY
+    ):
+        return QUALIFICATION_DERIVATION_V5
     try:
         merge_base = _git_output(
             Path(checkout),
@@ -21163,12 +21203,16 @@ def _validate_qualification_policy(
             firmware_version,
             "firmware source version",
         )
-        # ADR-0038: SemVer alone cannot separate the two v0.6.0 source
-        # eras.  Without a bound source checkout both era derivations are
-        # shape-admissible; identity-binding flows narrow to the exact era
-        # through the source checkout's ancestry.
+        # ADR-0038/ADR-0039: SemVer alone cannot separate the v0.6.0
+        # source eras.  Without a bound source checkout every era
+        # derivation is shape-admissible; identity-binding flows narrow to
+        # the exact era through the source checkout's ancestry.
         allowed_derivations = (
-            (QUALIFICATION_DERIVATION_V3, QUALIFICATION_DERIVATION_V4)
+            (
+                QUALIFICATION_DERIVATION_V3,
+                QUALIFICATION_DERIVATION_V4,
+                QUALIFICATION_DERIVATION_V5,
+            )
             if selected == QUALIFICATION_DERIVATION_V3
             and source_core >= (0, 6, 0)
             else (selected,)
@@ -21179,6 +21223,7 @@ def _validate_qualification_policy(
             QUALIFICATION_DERIVATION_V2,
             QUALIFICATION_DERIVATION_V3,
             QUALIFICATION_DERIVATION_V4,
+            QUALIFICATION_DERIVATION_V5,
         )
     _require(
         all(type(value) is str for value in derivation.values())
@@ -22123,7 +22168,10 @@ def floor_min(metric: str, quantum: int) -> int:
     ):
         put_min = (put_min * 95) // 100
         get_min = (get_min * 95) // 100
-    if derivation == QUALIFICATION_DERIVATION_V4:
+    if derivation in (
+        QUALIFICATION_DERIVATION_V4,
+        QUALIFICATION_DERIVATION_V5,
+    ):
         # ADR-0037: fixed product SLOs, never functions of baseline extrema.
         reset_threshold = (
             V4_FIXED_RESET_SLO_MS_RP2
@@ -22179,6 +22227,15 @@ def floor_min(metric: str, quantum: int) -> int:
                 ),
             }
         )
+        if (
+            derivation == QUALIFICATION_DERIVATION_V5
+            and profile_id == V5_WAVESHARE_PROFILE_ID
+        ):
+            # ADR-0039: the single fixed heap-floor exception — never a
+            # function of the observed samples.
+            derived["idf_internal_largest_block_min_bytes"] = (
+                V5_FIXED_WAVESHARE_LARGEST_BLOCK_MIN_BYTES
+            )
     for key, value in derived.items():
         _qualification_integer(
             value,
@@ -24375,7 +24432,10 @@ def _profile_thresholds(
         observation: dict[str, Any],
         profile_id: str,
     ) -> dict[str, int]:
-        if qualification_derivation == QUALIFICATION_DERIVATION_V4:
+        if qualification_derivation in (
+            QUALIFICATION_DERIVATION_V4,
+            QUALIFICATION_DERIVATION_V5,
+        ):
             return _derived_qualification_thresholds(
                 build,
                 observation,

tests/firmware_tests/hil/_pble_bench.py

@@ -90,7 +90,7 @@
 DERIVATION = {
     "application_image": "exact-byte-identical-two-root-v1",
     "application_headroom": "factory-minus-application-v1",
-    "heap_floor": "floor-min-1024-v1",
+    "heap_floor": "floor-min-1024-waveshare-block-98304-v2",
     "boot_ceiling": "fixed-profile-product-slo-esp3000-pico7000-v4",
     "goodput_floor": "fixed-product-slo-64k-under-10s-6600-v3",
 }
@@ -114,6 +114,13 @@
 FIXED_RESET_SLO_MS_RP2 = 7000
 FIXED_GOODPUT_FLOOR_BPS = 6600
 
+# ADR-0039: the single fixed heap-floor exception — the Waveshare
+# largest-block floor is the baseline-derived 102400 minus exactly one
+# 4096-byte page, admitting that image's characterized single-page
+# transient.  Never a function of observed samples.
+FIXED_WAVESHARE_LARGEST_BLOCK_MIN_BYTES = 98304
+WAVESHARE_PROFILE_ID = "waveshare-esp32-s3-lcd-147b"
+
 RP2_PROFILE_ID = "rpi-pico2-w"
 
 HEAP_KEYS = (
@@ -748,6 +755,18 @@ def derive_thresholds(oi1_build, observation, profile_id=None):
         heap_keys=HEAP_KEYS,
     )
 
+    largest_block_floor = (
+        # ADR-0039: the fixed Waveshare exception, never sample-derived.
+        FIXED_WAVESHARE_LARGEST_BLOCK_MIN_BYTES
+        if profile_id == WAVESHARE_PROFILE_ID
+        else floor_quantum(
+            min(
+                item["idf_internal_largest_block_bytes"]
+                for item in snapshots
+            ),
+            1024,
+        )
+    )
     return {
         "application_image_max_bytes": application_size,
         "application_headroom_min_bytes": headroom,
@@ -757,13 +776,7 @@ def derive_thresholds(oi1_build, observation, profile_id=None):
         "idf_internal_free_min_bytes": floor_quantum(
             min(item["idf_internal_free_bytes"] for item in snapshots), 1024
         ),
-        "idf_internal_largest_block_min_bytes": floor_quantum(
-            min(
-                item["idf_internal_largest_block_bytes"]
-                for item in snapshots
-            ),
-            1024,
-        ),
+        "idf_internal_largest_block_min_bytes": largest_block_floor,
         "idf_internal_minimum_free_min_bytes": floor_quantum(
             min(item["idf_internal_minimum_free_bytes"] for item in snapshots),
             1024,

tests/firmware_tests/host/test_oi1_profile_bench.py

@@ -1034,6 +1034,34 @@ def test_repeatability_allowances_do_not_change_static_or_heap_gates(self):
             },
         )
 
+        repeat_observation = dict(observation)
+        repeat_observation.update(
+            {
+                "reset_to_service_advertisement_ms": [1170] * 9 + [2378],
+                "put_committed_goodput_bytes_per_second": [7208] * 5,
+                "get_verified_goodput_bytes_per_second": [13238] * 5,
+            }
+        )
+        repeat_derived = bench.evaluate_thresholds(
+            {
+                "application_image_bytes": 1699936,
+                "factory_partition_bytes": 2031616,
+                "application_headroom_bytes": 331680,
+            },
+            repeat_observation,
+            thresholds,
+        )
+        self.assertEqual(
+            repeat_derived["reset_to_service_advertisement_max_ms"],
+            3000,
+        )
+        self.assertEqual(
+            repeat_derived[
+                "put_committed_goodput_min_bytes_per_second"
+            ],
+            6600,
+        )
+
     def test_waveshare_largest_block_floor_is_fixed_one_page_below_baseline(self):
         # ADR-0039: the fixed Waveshare exception never derives from samples,
         # while the identically shaped generic S3 keeps floor-min-1024-v1.
@@ -1131,34 +1159,6 @@ def observation_with_block(block):
             str(caught.exception),
         )
 
-        repeat_observation = dict(observation)
-        repeat_observation.update(
-            {
-                "reset_to_service_advertisement_ms": [1170] * 9 + [2378],
-                "put_committed_goodput_bytes_per_second": [7208] * 5,
-                "get_verified_goodput_bytes_per_second": [13238] * 5,
-            }
-        )
-        repeat_derived = bench.evaluate_thresholds(
-            {
-                "application_image_bytes": 1699936,
-                "factory_partition_bytes": 2031616,
-                "application_headroom_bytes": 331680,
-            },
-            repeat_observation,
-            thresholds,
-        )
-        self.assertEqual(
-            repeat_derived["reset_to_service_advertisement_max_ms"],
-            3000,
-        )
-        self.assertEqual(
-            repeat_derived[
-                "put_committed_goodput_min_bytes_per_second"
-            ],
-            6600,
-        )
-
     def test_fixed_reset_product_slo_accepts_boundary_and_rejects_above_it(self):
         heaps = [_heap() for _ in range(16)]
         observation = {