[docs] admit Waveshare single-page largest-block transient

Three consecutive replacement-era Waveshare OI-1 verify runs failed only
on one transient idf_internal_largest_block_bytes sample of 98304 against
the frozen 102400 floor (exactly one 4096-byte page, free heap unchanged,
absent on the generic S3 image). ADR-0039 defines a second-replacement
source era at boundary 7d85328 whose derivation changes exactly the
heap-floor identifier to floor-min-1024-waveshare-block-98304-v2, fixing
only the Waveshare largest-block floor at 98304, and permits
byte-identity-conditioned carry-forward of already-passed physical
evidence. No firmware bytes change.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0173nRnCob9LXYShoQmC85xZ
Signed-off-by: Viwat Vchirawongkwin <viwat.v@chula.ac.th>

Author: yyods

CHANGELOG.md

@@ -5,6 +5,10 @@ are released independently from this monorepo.
 
 ## Unreleased
 
+- Admitted the characterized Waveshare single-page largest-block transient
+  with a fixed `98304` heap floor in a second-replacement qualification era
+  (ADR-0039), with byte-identity-conditioned carry-forward of already-passed
+  physical evidence; no firmware bytes changed.
 - Established `PyBLE-dev/PyBLE` as the canonical public monorepo.
 - Added public contributor, security, architecture, protocol, and validation
   documentation.

docs/decisions/0039-admit-waveshare-single-page-largest-block-transient.md

@@ -0,0 +1,119 @@
+# ADR-0039 — Admit the Waveshare single-page largest-block transient
+
+- Status: **Accepted**
+- Date: 2026-08-21
+- Supersedes: ADR-0037 decision item 8 for the Waveshare
+  `idf_internal_largest_block_min_bytes` floor only, and ADR-0038's
+  fresh-observation requirement only under the exact byte-identity
+  conditions of decision item 6
+- Preserves: every other ADR-0037/ADR-0038 rule, the immutable `a8be631…`
+  baseline, and all historical derivation revisions
+
+## Context
+
+Three consecutive replacement-era Waveshare OI-1 verify runs on candidate
+source `7d853289815751c7381c9fd0b9a9a4409bdb6879` failed at exactly one gate:
+one heap snapshot per run recorded `idf_internal_largest_block_bytes` of
+`98304` against the frozen floor of `102400`. Every other value passed in the
+same runs — reset samples 749–1,531 ms, all ten PUT/GET samples well above
+6,600 bytes/s, 20/20 reliability with zero integrity failures, settled 2M
+PHY/DLE 251 transport, and the physical power seam.
+
+The dip is characterized, not anomalous:
+
+- It is exactly one 4,096-byte page: `98304 = 102400 - 4096`.
+- `idf_internal_free_bytes` and `idf_internal_minimum_free_bytes` are
+  unchanged at the dip instant — transient fragmentation of the largest
+  block, not memory consumption.
+- It appears once per run at a timing-dependent post-HELLO snapshot
+  (reset samples 4, 6, and 1 across the three runs).
+- The generic `esp32-s3-n16r8` profile — identical chip, identical floor —
+  recorded 41 snapshots across three runs the same day with zero dips.
+  The behavior is specific to the Waveshare image.
+- The retained `a8be631…` baseline capture recorded no dip, so
+  `floor-min-1024-v1` froze the floor at the un-fragmented value.
+
+`floor-min-1024-v1` cannot express a floor below its baseline minimum, so
+admitting the transient requires a new heap-floor derivation identifier and a
+new source era, exactly as ADR-0037 introduced fixed reset/goodput
+identifiers for the V4 era.
+
+This decision does not fit a gate to a failure. The floor remains a
+fragmentation regression guard, not a performance promise; the admitted value
+is the baseline-derived floor minus exactly one page — the minimal relaxation
+that admits a single-page transient — and the three failed runs confirm,
+rather than define, that arithmetic. The sanctioned ADR-0037 item 9 path is
+followed in full: spec-first ADR, then fresh qualification of a new candidate.
+
+## Decision
+
+For the second-replacement v0.6.0 source era:
+
+1. The era boundary is `7d853289815751c7381c9fd0b9a9a4409bdb6879` — the
+   superseded first-replacement candidate source. Strict descendants use
+   `QUALIFICATION_DERIVATION_V5`; the boundary and its ancestors keep their
+   historical derivations (V4 era per ADR-0038, version-routed before it).
+   Unknown or unrelated ancestry still fails closed.
+2. `QUALIFICATION_DERIVATION_V5` changes exactly one identifier relative to
+   V4: `heap_floor` becomes `floor-min-1024-waveshare-block-98304-v2`.
+   `application_image`, `application_headroom`, `boot_ceiling`, and
+   `goodput_floor` keep their exact V4 identifiers and arithmetic.
+3. Under `floor-min-1024-waveshare-block-98304-v2`, every heap floor for
+   every profile keeps `floor-min-1024-v1` arithmetic from the immutable
+   `a8be631…` baseline, with exactly one exception:
+   `idf_internal_largest_block_min_bytes` for
+   `waveshare-esp32-s3-lcd-147b` is the fixed value `98304`.
+4. The active policy for the V5 era is therefore the exact V4 policy with
+   the `heap_floor` derivation identifier replaced and exactly one numeric
+   field changed: the Waveshare `idf_internal_largest_block_min_bytes`
+   `102400 -> 98304`. All other 10 largest-block/heap values, every static
+   image/headroom bound, every reset ceiling, and every goodput floor are
+   byte-for-byte unchanged.
+5. The floor value `98304` is a fixed product decision. A verify run that
+   records any heap sample below it fails, and per ADR-0037 item 9 its
+   values MUST NOT be used to relax the policy again; a further change
+   requires another spec-first ADR and fresh qualification.
+6. Evidence captured under the superseded first-replacement candidate MAY
+   bind into the successor candidate's completion, per profile, only if
+   every one of these mechanical conditions holds:
+   a. the successor candidate's install artifacts for that profile are
+      byte-identical (equal SHA-256 and size) to the artifacts the evidence
+      was captured against;
+   b. every policy threshold applicable to that profile is value-identical
+      between the superseded and successor policies;
+   c. the evidence passed its frozen evaluator when captured, unmodified.
+   The eligible evidence classes are OI-1 verify observations, the C3
+   post-OI NVS capture (its receipt re-bound to the successor
+   candidate digest from re-derived bytes), and provisioning
+   install/readback evidence. If any condition fails for a profile, the
+   clause is void for that profile and ADR-0038's fresh-observation rule
+   applies unchanged. `waveshare-esp32-s3-lcd-147b` is excluded by
+   construction (condition b fails) and always requires a fresh
+   observation. App HIL matrix rows are NOT eligible and are re-run
+   against the successor candidate.
+7. The byte-identity and threshold-identity proofs for every carried
+   profile must be recorded alongside the completion evidence (exact
+   SHA-256 pairs and the compared threshold rows).
+8. The tag/candidate replacement procedure of ADR-0038 applies unchanged:
+   retain the superseded tag object and candidate metadata as superseded
+   evidence, never publish them, and require fresh candidate creation,
+   validation, and completion under the successor policy.
+
+## Consequences
+
+- The Waveshare profile is qualifiable on truthful evidence: its
+  characterized single-page transient no longer fails an otherwise fully
+  passing run, while a genuine fragmentation regression below `98304`
+  still fails closed.
+- One more derivation era exists. Historical eras remain byte-reproducible;
+  the V4 era's policy and arithmetic are untouched for ancestry at or
+  below the `7d85328…` boundary.
+- If the successor build proves byte-identical per profile, already-passed
+  physical observations remain valid evidence instead of being discarded
+  for a policy-only source change — bounded strictly by the mechanical
+  conditions of decision item 6. If it does not, every profile requalifies
+  fresh, so the clause can only reduce redundant bench work, never admit
+  unproven hardware behavior.
+- The firmware bytes are not changed by this decision. If a later change
+  eliminates the transient allocation, the floor may be restored to the
+  baseline-derived value by a further spec-first ADR.

docs/decisions/README.md

@@ -42,5 +42,6 @@ Each ADR captures one significant decision: its context, the choice, and the con
 | [0036](0036-read-generic-s3-link-facts-through-run.md) | Read bounded, session-bound generic S3 qualification link facts through existing PBLE/1 RUN while retaining serial only as the reset adapter | Accepted |
 | [0037](0037-fixed-profile-reset-and-transfer-product-slos.md) | Use fixed ESP/Pico reset ceilings and one product-wide 64 KiB PUT/GET floor for replacement-v0.6.0 qualification | Accepted |
 | [0038](0038-replace-unpublished-v060-candidate-in-place.md) | Replace the unpublished local v0.6.0 candidate in place while routing qualification by source era rather than SemVer alone | Accepted |
+| [0039](0039-admit-waveshare-single-page-largest-block-transient.md) | Admit the characterized Waveshare single-page largest-block transient with a fixed 98304 floor in a V5 source era, with byte-identity-conditioned evidence carry-forward | Accepted |
 
-Decided 2026-06-30 (0001–0005); 0006 accepted 2026-07-01; 0007, 0008, 0009 and 0010 accepted 2026-07-02; 0011 accepted 2026-07-03; 0012 accepted 2026-07-25; 0013 accepted 2026-07-27; 0014, 0015, 0016, and 0017 accepted 2026-07-28; 0018–0022 accepted 2026-07-29; 0023 and 0024 accepted 2026-08-01; 0025 and 0026 accepted 2026-08-02; 0027–0029 accepted 2026-08-03; 0030 accepted 2026-08-11; 0031–0033 accepted 2026-08-12; 0034 accepted 2026-08-13; 0035 and 0036 accepted 2026-08-16; 0037 and 0038 accepted 2026-08-20.
+Decided 2026-06-30 (0001–0005); 0006 accepted 2026-07-01; 0007, 0008, 0009 and 0010 accepted 2026-07-02; 0011 accepted 2026-07-03; 0012 accepted 2026-07-25; 0013 accepted 2026-07-27; 0014, 0015, 0016, and 0017 accepted 2026-07-28; 0018–0022 accepted 2026-07-29; 0023 and 0024 accepted 2026-08-01; 0025 and 0026 accepted 2026-08-02; 0027–0029 accepted 2026-08-03; 0030 accepted 2026-08-11; 0031–0033 accepted 2026-08-12; 0034 accepted 2026-08-13; 0035 and 0036 accepted 2026-08-16; 0037 and 0038 accepted 2026-08-20; 0039 accepted 2026-08-21.

docs/specifications/firmware.md

@@ -111,8 +111,12 @@ remain required for all five profiles before activation.
 ADR-0038 replaces the unpublished local candidate tagged at `719b211…` in
 place: no origin tag, GitHub Release, or canonical v0.6.0 website release ever
 existed, so the first public version remains `0.6.0`. The predecessor source
-era ends at inclusive commit `5620f2f…`; only strict descendants use the
-ADR-0037 fixed-SLO contract. All old candidate bytes and HIL are invalid for
+era ends at inclusive commit `5620f2f…`; strict descendants use the
+ADR-0037 fixed-SLO contract, and strict descendants of the second boundary
+`7d85328…` use the ADR-0039 second-replacement contract, which additionally
+fixes the Waveshare largest-block heap floor at `98304` under
+`floor-min-1024-waveshare-block-98304-v2` and permits byte-identity-conditioned
+carry-forward of already-passed physical evidence (ADR-0039 item 6). All old candidate bytes and HIL are invalid for
 the replacement, while superseded metadata and immutable baseline evidence
 remain retained. After source/docs/RED/GREEN, build, reproducibility, license,
 source, and audit gates pass, the local tag may be replaced so it peels to

docs/specifications/firmware/TDD.md

@@ -1711,7 +1711,11 @@ Profiles or successful samples from different baselines MUST NOT be mixed.
 Historical pre-`0.5.0` and v0.5.x policies retain their exact V1 and V3/V2
 derivation identifiers and arithmetic. The predecessor v0.6.0 contract also
 retains V3/V2 when its bound source is at or before
-`5620f2fdc672b440548119e3431cfa4f4ed3f5a3`. The replacement policy must be
+`5620f2fdc672b440548119e3431cfa4f4ed3f5a3`; the first-replacement contract
+applies to strict descendants at or before
+`7d853289815751c7381c9fd0b9a9a4409bdb6879`, and strict descendants of that
+second boundary use the ADR-0039 second-replacement contract. The
+replacement policy must be
 rederived from the retained baseline under a strict-descendant candidate source.
 The helper proves that bound policy/candidate ancestry; SemVer, policy schema,
 validator checkout, operator input, and the retained baseline's own
@@ -1740,6 +1744,15 @@ integrity, reliability, disconnect, and settled-link facts remain exact. A
 failed result cannot rederive or widen either SLO. Static image/headroom, heap,
 and all historical arithmetic remain unchanged.
 
+The second-replacement era keeps every value above and changes exactly one
+heap fact (ADR-0039): its heap identifier is
+`floor-min-1024-waveshare-block-98304-v2`, under which every heap floor keeps
+`floor-min-1024-v1` arithmetic except the fixed Waveshare
+`idf_internal_largest_block_min_bytes` of `98304` (the baseline-derived
+`102400` minus one 4,096-byte page, admitting that image's characterized
+single-page fragmentation transient). A sample below `98304` fails and MUST
+NOT relax the floor again.
+
 A schema-3 policy has exactly the five ordered threshold-bearing rows in
 specs.md §5.3.5. Four ESP rows use the existing application/partition,
 five-field heap, and NimBLE link facts. Pico uses raw-image limit/headroom,

docs/specifications/firmware/browser-flashing.md

@@ -1817,10 +1817,13 @@ releases. The retained `0.4.2` source era instead requires policy
 schema 1, its historical exact two-profile order, `ceil-max-10-v1`, and
 `floor-min-100-v1` values; validation selects the complete policy contract by
 firmware source era and never silently reinterprets published evidence.
-The two unpublished v0.6.0 source eras both retain policy schema 3 and the
+The three unpublished v0.6.0 source eras all retain policy schema 3 and the
 five-profile order, but they do not share a derivation object: §9.5 selects
-the predecessor V3/V2 or replacement V4/V3 identifiers from bound source
-ancestry. Version, schema, or operator input alone cannot select it.
+the predecessor V3/V2 identifiers, the first-replacement V4/V3 identifiers,
+or the second-replacement (ADR-0039) identifiers — which change exactly the
+heap-floor identifier to `floor-min-1024-waveshare-block-98304-v2` — from
+bound source ancestry. Version, schema, or operator input alone cannot
+select it.
 
 `baseline_evidence.path` MUST match
 `docs/validation/firmware/oi1/<40-lowercase-hex-source-commit>.json`;
@@ -2263,16 +2266,22 @@ C3-G0…C3-G6; Pico binds GP0, GP1, and complete GP2. A missing private result,
 non-null input summary, failed sub-gate, changed input, or identity/hash
 mismatch leaves no public output.
 
-The V5 envelope is unchanged across the two unpublished v0.6.0 source eras,
+The V5 envelope is unchanged across the unpublished v0.6.0 source eras,
 but its policy derivation is source-bound. A candidate source at or before
 `5620f2fdc672b440548119e3431cfa4f4ed3f5a3` retains
-`fixed-product-slo-3000-v3` and `floor-95pct-min-100-v2`. Only a strict
-descendant uses
+`fixed-product-slo-3000-v3` and `floor-95pct-min-100-v2`. A strict
+descendant of that boundary at or before
+`7d853289815751c7381c9fd0b9a9a4409bdb6879` uses
 `fixed-profile-product-slo-esp3000-pico7000-v4` and
-`fixed-product-slo-64k-under-10s-6600-v3`. Its policy has reset ceilings
-`3000` for the four ESP rows and `7000` for Pico, and PUT/GET floors `6600`
-for all five rows. The bound replacement policy/candidate source must be a
-strict boundary descendant. Missing, equal-to-boundary, unrelated, or
+`fixed-product-slo-64k-under-10s-6600-v3` with `floor-min-1024-v1` heap
+floors. A strict descendant of `7d853289…` (the second-replacement era,
+ADR-0039) additionally replaces exactly the heap-floor identifier with
+`floor-min-1024-waveshare-block-98304-v2`, whose single numeric effect is
+the fixed Waveshare `idf_internal_largest_block_min_bytes` of `98304`.
+Every replacement policy has reset ceilings `3000` for the four ESP rows and
+`7000` for Pico, and PUT/GET floors `6600` for all five rows. The bound
+replacement policy/candidate source must be a strict descendant of the
+applicable boundary. Missing, equal-to-boundary, unrelated, or
 ancestry-unprovable replacement identity fails closed. The immutable
 `a8be631…` baseline remains the exact input: its static/heap thresholds are
 rederived under the bound replacement policy/candidate era, while its

docs/specifications/firmware/specs.md

@@ -1353,9 +1353,11 @@ The successor `firmware/qualification/oi1-gates.json` has exactly:
 - the exact `profile_order` above;
 - `workload`, retaining every §5.3.2 constant except that the PUT window is
   profile-specific;
-- `derivation`, retaining the exact application/image, headroom, and
-  `floor-min-1024-v1` algorithms while selecting reset/goodput identifiers by
-  candidate source ancestry as defined below;
+- `derivation`, retaining the exact application/image and headroom
+  algorithms while selecting the heap-floor and reset/goodput identifiers by
+  candidate source ancestry as defined below (`floor-min-1024-v1`, or its
+  ADR-0039 successor `floor-min-1024-waveshare-block-98304-v2` whose single
+  exception is the fixed Waveshare largest-block floor);
 - `baseline_evidence`, binding the canonical schema-2 baseline path and
   SHA-256; and
 - five `profiles` entries in order, each with exactly `profile_id`, `target`,
@@ -1408,8 +1410,10 @@ formula, and reject an operator-selectable or unequal numeric replacement.
 For a source at or before
 `5620f2fdc672b440548119e3431cfa4f4ed3f5a3`, the unpublished v0.6.0 replay
 contract retains `fixed-product-slo-3000-v3` and
-`floor-95pct-min-100-v2`. For a strict descendant of that boundary, the
-replacement v0.6.0 policy derivation object instead contains exactly:
+`floor-95pct-min-100-v2`. For a strict descendant of that boundary at or
+before the second boundary
+`7d853289815751c7381c9fd0b9a9a4409bdb6879`, the first-replacement v0.6.0
+policy derivation object contains exactly:
 
 ```json
 {
@@ -1421,11 +1425,25 @@ replacement v0.6.0 policy derivation object instead contains exactly:
 }
 ```
 
+For a strict descendant of `7d853289815751c7381c9fd0b9a9a4409bdb6879`, the
+second-replacement (ADR-0039) policy derivation object instead changes
+exactly the `heap_floor` identifier:
+
+```json
+{
+  "application_image": "exact-byte-identical-two-root-v1",
+  "application_headroom": "factory-minus-application-v1",
+  "heap_floor": "floor-min-1024-waveshare-block-98304-v2",
+  "boot_ceiling": "fixed-profile-product-slo-esp3000-pico7000-v4",
+  "goodput_floor": "fixed-product-slo-64k-under-10s-6600-v3"
+}
+```
+
 The bound policy/candidate source commit, not its `0.6.0` SemVer, the
 validator checkout, or the baseline's `source_commit`, selects between these
 contracts. A replacement policy/candidate source MUST be a strict descendant
-of the boundary. Missing, unrelated, equal-boundary, or ancestry-unprovable
-identity fails closed. The immutable retained baseline
+of the applicable boundary. Missing, unrelated, equal-boundary, or
+ancestry-unprovable identity fails closed. The immutable retained baseline
 `docs/validation/firmware/oi1/a8be631df46590166307aa41afaea30b39e29230.json`
 and its exact SHA-256
 `8a7dbf328ba8d70f5161582b56d1566821f20b7a259ff29dc7d6fe6bb75a6044`
@@ -1462,6 +1480,15 @@ link facts, retransmit/rewind accounting, reliability totals, disconnect
 counts, and every target-specific transport fact remain exact. Neither a
 failed run nor a favorable baseline may rederive either fixed SLO.
 
+Under the second-replacement era, every heap floor keeps `floor-min-1024-v1`
+arithmetic from the immutable baseline with exactly one fixed exception
+(ADR-0039): `idf_internal_largest_block_min_bytes` for
+`waveshare-esp32-s3-lcd-147b` is exactly `98304` — the baseline-derived
+`102400` minus one 4,096-byte page, admitting that image's characterized
+single-page transient while every other heap value, static bound, reset
+ceiling, and goodput floor stays byte-for-byte at its first-replacement
+value. A sample below `98304` fails and MUST NOT relax the floor again.
+
 Every V5 profile record additionally binds both real-app results. `app_hil`
 has exactly `ipad` and `android`; each entry has exactly non-empty
 `app_version`, `app_build`, and `os_major`, plus `status: "passed"` in a