Peripheral Capability and Acceptance Boundaries
2026-10-05 18:05 status: the four-device candidate four-device-candidate-20261005-r5 is under verification; there is no complete PASS for this round yet. r4 stays FAIL; the main evidence and the nested recovery-test evidence are both independently preserved (INTEGRITY_PASS does not mean the candidate passed). The Windows report atomic-replacement-conflict fix only achieved a local targeted PASS for four-device-soak-focused-20261005-r2 with 35 device soak items, 66 touchscreen soak items, and 24 candidate observations, with stable inputs and no device access; no physical or long-term acceptance items were added based on it.
This round prioritizes COM15 (ESP32-S3-F16R8), COM4 (ESP32-C3-F4R0), COM16 (ESP32-F4R0), and COM8/9 (the same ESP32-S3-F16R8 touchscreen). Config-preservation deployment, actual web access, resources/memory, physical feedback, and 24h/7d evidence are still pending per device; C6 capacity, the remaining environments, and the full nine-environment/RGB stay as separate todos. Dated records with P8/P7/r3 and capacity numbers below are historical and do not carry over as current candidate passes; current progress is governed by this section and the top of System Improvement Status.
Verification date: 2026-10-04. The following describes the system-improvement development candidate; before use, re-verify the device's current firmware version, capability endpoints, board revision, and actual wiring. New code existing does not prove field devices have been updated.
The code lists 44 peripheral types, of which 35 have conditional implementations and 9 are unconfigured, unimplemented, debug, or reserved types. 35 is also not the number of models that have passed physical acceptance; one type can map to multiple modules, and compile switches, chip, pins, bus, and instance counts still have limits. Modbus devices are managed by protocol configuration and are not created through the ordinary peripheral form.
Current Implementation and Software Verification
2026-10-04 23:44 increment: the P8 and r3 type tables below are kept as history; the latest candidate awaits full verification, and the current state is governed by System Improvement Status.
| Newly added or completed capability | Local evidence obtained | Not yet accepted |
|---|---|---|
| ADS1115 same-address 1-4 channel scan | r60 passed 45 real driver/cache scenarios and 50 dual-viewport form scenarios; waiting outside the lock, generation cancel, per-channel timing, whole-round publish, and outer-timeout stale-diagnostics clearing are all covered. Single-MUX compatible by default; see the scan notes. | Full firmware/capacity, per-channel electrical range and calibration, channel skew, field combinations, and memory |
| Digital-OUT radar 49 | Managed GPIO, dual-edge debounce, hold-after-confirmed-inactive, and reject reads on pause/retirement/foreign owner are implemented; r56 passed 28 scenarios x 4 chip branches. | Module OUT polarity, self-hold/noise, wiring and actual state; UART radar protocol not included |
| RTC/SD/UART/DS18B20 | RTC boot seed with default-off and unauthenticated-source display; SD auto-logging/bounded queue/rotation and history-file protection; UART hardware-error generation isolation; DS18 ROM binding and wait-outside-lock are all implemented with targeted regressions. | Battery retention, trusted-time field changes, card-full/power-loss/recovery, serial noise, real collection, and resource usage |
| Action 21 and daily execution | Fixed-target event loop prevention, dynamic-target rejection, single-shot conditional reporting, and in-boot date watermark are implemented; real execution/graph/negative regressions passed. | Current complete candidate, real MQTT reception, and field fault recovery |
The shared JSON write for Health/MQTT completed real full-method/per-allocation-failure/recovery-diff verification; they do not prove MCU memory gains. 2026-10-05 00:18 check: the C6-capacity r14 with all additions has an actual BIN of 3,364,320 B, exceeding the original partition by 21,984 B; both the r13 compile failure and the r14 capacity failure are independently preserved. Offline reading of the target ELF shows the sensor cache object grew from 1304 to 1552 B; this is a static ABI size, not a runtime memory measurement. Full host/native/web/S3+C6 checks are running; there is no complete candidate PASS yet; nine-environment/RGB, all physical, resource-memory, RTC retention, and 2h/24h/7d/V14 remain unpassed. Original failure records are kept; successor re-verification does not rewrite the original conclusions.
P8 Historical Evidence
The P8 evidence below supersedes the "not run / fixture blocked" states in the old P7/r3 descriptions; the original P7 failures and the later type-range table are kept as history. Implemented, designated host modules passing, complete candidate passing, and physical acceptance are still four different things.
Historical targeted focused r11 passed 385/385 with stable inputs, independently preserved. The actual scope is Modbus source core 157, Protocol42, virtual peripherals 35, boot snapshot 44, HTTP52, matched-result reports 22, identity binding 15, and report payload 18; these 385 items must not be called a full-system or all-H1 pass.
The unified diagnostic P8 (precheck r8) ended FAIL at 12:05:54, 1772 inputs stable and independently preserved. The host actually ran 4058 items: 4057 passed, 0 failed/errored, 1 skipped; the skip was the Windows file-symlink permission scenario (WinError1314) in test_config_staging_journal, which does not count as verified. Native 2379/2379, offline recovery 61, memory contract, six static checks, new web pages 186 items, and config 121 items passed. The three P7 assembly-error classes and four failures were actually fixed and re-verified.
The current blocker is application capacity for two targets: S3-F8R0 program 3,682,183 B exceeds the 3,670,016 B partition by 12,167 B; C6-F4R0 program statistics did not exceed, but the actual BIN of 3,395,328 B exceeds the 3,342,336 B partition by 52,992 B. Neither has a deployable artifact in this batch; partitions are not enlarged and the capacity threshold is not relaxed; successor optimizations must be re-measured.
Evidence is in the firmware repository at artifacts/system-plan-r20-precheck-20261004-r8/host-unit-all.log (SHA256=943a1561e3b38e8a320389ea048fd4ea9aa467b77bd90b8d52f8cae6fc896cc5) and artifacts/system-plan-r20-precheck-r8-independent-verification-20261004/report.json. Independent preservation is INTEGRITY_PASS; the original candidate remains FAIL. Method counts below come from this P8 host log and do not accumulate across candidates.
| Implemented capability | P8 host evidence (no skips in the modules below) | Boundaries not yet accepted |
|---|---|---|
| ADS1115 production driver, conversion session, and sampling chain | test_ads1115_driver 24, test_ads1115_session 14 passed | Range/calibration/real collection and platform receipt |
| MCP23017 provider/session, RESET, and whole-bank startup | test_mcp23017_provider 21, test_mcp23017_session 19, test_mcp23017_device 27, test_io_expander_manager 3 passed | A7/B7, RESET, power/load, and fault-off |
| PCA9685 guarded commands, OE, common frequency, explicit start | config6/device26/provider19/session10/manager18/web12 all passed, module name prefix test_pca9685_ | Real PWM waveform, OE pull-up, and load |
| H1 description-driven forms and parsing | test_h1_parameter_contract 5, test_h1_register_contracts 7 passed | Legacy web field assertions passed in test_p1_peripheral_web_contract 8 items; actual device UI and hardware still pending |
| GPIO/DAC and motion outputs | managed_pin_io25, dac_action28, managed_pin_manager7, encoder_checked_lifecycle15, ordinary_control121, motion_ordinary44, stepper_managed_lifecycle44 passed | Three P7 fixture assembly issues actually fixed and measured; physical voltage/waveform, IRQ, motion, and load not verified |
| TM1637/LCD1602/OLED sources and failure returns | display_ordinary41, lcd1602_driver29, oled_i2c_ownership26, lcd_http7 passed | Actual characters/segments/backlight and bus combinations; ACK does not mean correct display |
| RF TX/RX learning, IR receive | rf_output_control34, rf_receiver_lifecycle30, ir_receiver_lifecycle25 passed | Actual protocol/noise/distance; IR transmit not promised |
| RTC, SD/UART, thermostat, and migration | system_time_quality33, sd_status_action18, uart_action40, thermostat_runtime7, config_migration_storage17 and other existing modules passed | Battery timekeeping, card faults, serial noise, thermostat load, two-board migration, and independent trial |
| RGB/GT911 and resource observation | rgb_display_backend2, gt911_ownership17, runtime_resource_snapshots4, task_stack_snapshot26 passed | RGB full firmware, physical display/touch, DRAM/DMA/PSRAM/stack and recovery measurements |
Shorthand modules in the table live in the firmware repository at test/unit/test_<name>.py; the numbers are unittest method counts and do not double-count chip branches. P8 additionally passed Modbus source core 157, Protocol43, virtual peripherals 35, HTTP52; the original P7 failure modules modbus_panel_observations2, modbus_wait_scheduler2, and modbus_relay_async2 all actually passed. Module passes do not change the boundaries that application capacity failed or that platform receipt and physical feedback are not yet accepted.
The full nine-environment/RGB, device deployment, real resources/memory, RTC retention, and 2h/24h/7d/V14 are not done. The H1 driver, ordinary control, RTC/SD/UART, and migration are implemented; these acceptance gaps do not mean the whole feature set needs re-development, nor that it can be released.
P7 Historical Failures (Kept)
The historical unified diagnostic precheck r7 ended FAIL at 11:29:50, 1772 inputs stable and independently preserved; host results: 3914 items, 4 failures, 3 assembly-error classes, 1 skip. Only the partial results from this finished host log are listed below; web pages 186 items and config 121 items passed; native 2379 items had 5 failures, and both S3/C6 failed to compile due to Modbus cleanup-guard type mismatch, so there is no new application artifact in this batch. Evidence is in the firmware repository at artifacts/system-plan-r20-post-r6-focused-20261004-r11/report.json, artifacts/system-plan-r20-post-r6-focused-independent-verification-20261004-r11/verification.json, and artifacts/system-plan-r20-precheck-20261004-r7/host-unit-all.log.
The three assembly-error classes at the time came from RF/display dependencies not being synced; there were also four failures from old source assertions on Modbus observation, retry assembly, relay frame length, and web fields. Fixes were merged at the time and awaited r8; the P8 re-verification results above are now available. The original P7 FAIL and logs keep their original conclusions; successor passes are not written back into the historical candidate.
r3 Historical Verification Status
The centralized diagnostic r20-r3 ended FAIL at 2026-10-04 04:18:14 and was not releasable. 19 phase logs and 1659 inputs were independently verified; the production source and test inputs were stable, one document from another task drifted, and the original failure and input-instability records are kept. Several host subgroups passed, but the GPIO/encoder/stepper test fixtures, the GT911 test fixture, and the firmware compile entry still exposed problems; successor fixes must be centrally re-verified. Fixture fixes do not turn the original failure into a pass.
This batch's full nine environments, RGB-specific candidate, device deployment, and physical acceptance have not passed. Physical acceptance and long-term stability for all types in the table are NOT_RUN for this candidate and will not inherit passes from historical devices. For more candidate information, see System Improvement Status.
Viewing Applicability by Type
"Implemented" means the corresponding code entry point can be located; the full chain still needs item-by-item verification of form, parsing, save, initialization, sampling/action, quality, reporting, release, and restart recovery. Unknown or unbound test evidence does not automatically mean the feature is undeveloped.
| Type ID and function | Existing implementation and applicability boundaries | Acceptance still required |
|---|---|---|
| 1 UART | Generic serial and console; Modbus has different owner and capacity; receive events carry source generations | Actual baud rates, half-frames/noise, contention, reports, and restart recovery |
| 2 I2C, 3 SPI | Shared bus, address or CS leases; does not mean arbitrary I2C/SPI devices have drivers | Multi-device combinations, disconnects, frequency compatibility, and failure release |
| 11/13/14 digital input, 18/19/20 interrupt input | Digital reads, pull-up/down, guarded interrupts, and bounded queues, limited by chip pins | Actual polarity, debounce, frequency, missed pulses, repeated reconfiguration |
| 12 digital output | Local GPIO or expander channels; command/latched state is separate from load feedback; thermostat has an independent fault policy | Safe initial values, inversion, interlocks, actual loads, and fault-off |
| 15/26 ADC | Guarded ADC unit, channel, and calibration; chip capability and ADC2/Wi-Fi limits handled separately | Circuit range, accuracy, real zero, disconnection, concurrency, and recovery |
| 16/17 PWM output | LEDC resources with frequency/resolution constraints; 16 is also PWM analog output | Contention with servo/buzzer/backlight, real waveform, and failure cleanup |
| 27 DAC | Only on chip branches that have DAC; the r3 rule-action-5 bypass issue was fixed in successor code, adding range, run-state, resource, and SDK-result validation, pending centralized re-verification | Full regression of action entry, voltage/load/zero output; does not mean a 0-10V circuit is available |
| 36 LCD/OLED, 52 LCD1602 | Corresponding I2C/SPI displays; LCD1602 uses the PCF8574 character-LCD path | Correct characters, truncation/backlight, NACK/short-write recovery, instance limits |
| 37 SDIO | Currently actually SDSPI single-instance with restricted file operations, not SDMMC | Full card, power loss, recovery, logging load, and bus coexistence |
| 38 generic sensor | Registered drivers including ADS1115, AHT20, BH1750, BMP280, MPU6050, SHT30/SHT31, INA226, etc., plus legacy collection branches | Per-model fields/units, registration and instance capacity, physical collection, calibration, fault recovery |
| 41 servo, 42 stepper motor | Limited servo PWM; stepper is the existing four-phase GPIO scheme; neither has closed-loop position feedback | Pulse width/coil sequence, current, limit switches, speed, lost steps, and safe stop |
| 43 encoder | Two inputs, fixed slots, software ISR, and generation protection; not a PCNT backend | Maximum frequency, direction, jitter, count boundaries, and restart |
| 44 OneWire | Existing DS18B20 collection; does not extrapolate to arbitrary OneWire devices | ROM binding, conversion wait, disconnects, actual owner release |
| 45 NeoPixel | Bounded LED count, backend transmission, and failure resource retention; r3-related host group 70 items passed | Power, physical color/timing, long strips, and load; does not mean RGB parallel-panel display passes |
| 47 TM1637, 48 RF, 49 digital radar | Display tube, basic RF TX/RX with optional learning, digital-OUT radar; 49 is not the LD2410 multi-field UART driver | Segments/display, actual encoding/repeated frames, polarity/debounce/disconnect, and release |
| 50 DS1302 RTC | Three-wire RTC, time source and quality, UTC/display conversion | Battery retention, time error, invalid time, NTP source, and real display |
| 51 Modbus device | Protocol management, register mapping, word order/scaling and quality; read-only template generation for disabled drafts | Specific meters, CRC/timeouts, word order/units, read/write limits, and platform receipt |
| 53 IR receive, 54 RFID | IR decoding and MFRC522 SPI singleton with restricted block operations; generic IR transmit not promised | Specific protocols/card types, noise/dedup, permissions, timeouts, and release |
| 55 I/O expansion | PCF8574 8-channel, MCP23017 16-channel; MCP23017 whole-bank explicit startup, input sampling vs output latching distinguished | A7/B7, RESET, sub-channel safety, config preservation, and bus faults |
| 56 screen | SPI ST7789/ILI9341 and restricted ST7701 RGB/GT911 configuration; actual backend/buffer/worker have resource registration | RGB-specific firmware, DRAM/PSRAM peaks, touch/sleep/display, and long-term stability |
| 57 PCA9685 | Explicit start after review, exclusive OE, common-frequency constraints, and guarded commands; outputs are not auto-recovered | OE external pull-up, fault-off, real PWM frequency/waveform/load |
| 60 device event | Logical object, no physical GPIO; event identity, rules, and queues | Loops, throttling, offline reports, and restart config |
| 0 unconfigured; 4 CAN, 5 USB, 21 GPIO_TOUCH, 31 JTAG, 32 SWD, 39 CAMERA, 40 ETHERNET, 46 reserved slot | These 9 types are not supported as ordinary peripheral drivers; 40 differs from the standalone W5500 network feature, and 21 differs from GT911 touch | Legacy configs are rejected with an unavailable hint and not counted in available modules |
What Data and Control States Mean
Sensor samples carry source, unit, time, and quality; failed, stale, and unsampled values must not be passed off as valid zeros. ADS1115 already has a driver-to-cache-to-observed-value-to-field-report chain; the chain existing does not mean physical calibration or cloud receipt has passed.
Applicable actions such as GPIO and NeoPixel can report control results per rule; reports capture field identity before execution, verify the source after execution, and use bounded send/cache. Enqueued, handed to the send interface, and actually received by the platform are accepted separately. MCP23017 output latched values are also not physical feedback from relays, pumps, valves, or other loads.
Thermostat actions read controller state and execution records and do not directly drive or clear fault latches through a single action; diagnostics state that physical feedback is unobserved. PCA9685 has state and execution records and, per current policy, does not enter GPIO-style automatic property reporting; its success only means the local session accepted it, and the physical output is still unverified.
Modbus mappings can provide quality and freshness to display/history, depending on the related compiled features; normal display cannot replace meter calibration or MQTT receipt. Configuration migration is accepted by preview, prepare, restart-recovery, and commit stages; a successful prepare does not mean the active config has switched.
Physical Evidence Still to Deliver
- Software regression, nine-environment and RGB artifacts of the same final candidate, with all original failure records kept.
- A physical matrix tied to specific devices, artifacts, configs, and wiring, with real resource/memory peaks and recovery measurements.
- 24h/7d continuous runs, physical fault and recovery records, and the NC01-NC04 independent trials.
The device phase separately confirms authorization, identity, config preservation, and wiring safety; dangerous outputs with unclear conditions stay NOT_RUN. Host tests, code completion, successful flashing, and physical acceptance are different deliverables; see the Release Checklist.