System Improvement Candidate and Acceptance Status

2026-10-06 09:58 status: r13 ordinary three-board independent software admission has passed, covering ESP32-C3-F4R0, ESP32-F4R0, and the ordinary ESP32-S3-F16R8; source summary 6bea55ccdcdbc173cecdfc48f77948df2bb587a34a3b549552218142678351eb. All 21 ordinary stages are PASS/COVERED; both the main evidence and the real external web/wizard evidence preservations are INTEGRITY_PASS. The original four-device outer and ordinary reports remain INCOMPLETE; the ordinary three boards separately achieved a scoped PASS as ordinary-three-device-admission-20261005-r13-r1, which must not be written as all four devices, nine environments, or RGB passing.

For COM4 in this r13 round, the application and filesystem written, verified, and applicationWritten are all true, six config readbacks show zero diff, and 9 non-web files plus 2 directories are preserved. Two rounds of business APIs obtained 4 unique DHT/OLED operation success records, but the wall-clock interval between the two request starts was 64.987586 seconds, which does not prove the tool's declared 65 seconds; the original report and this limitation are independently preserved. This is not complete business or physical acceptance.

This round, all 7 menus are reachable on both desktop and mobile, but one /api/system/info request hit net::ERR_ABORTED, so the menu set remains FAIL overall. Current evidence cannot determine whether it was an active cancel, timeout, or another cause; the failure is preserved, and performance checks and other device deployments are paused. This round's deployment and applicable acceptance for COM16, COM15, and the touch RGB are not done, and the two S3 artifacts and configs are not interchangeable.

The r13 necessary boot fix makes the lightweight system status provide both screen compile support and user enable intent; the web only skips the first-screen full feature-catalog request when both fields are explicit booleans. Old firmware with missing or abnormal fields still takes the compatible fallback; performance, memory, and readiness thresholds are not lowered. The r12 original performance and resource FAILs stay kept: 20 cold loads over 5 seconds, plus two-page 503/connection resets, current heap below the threshold, and protection-suspension evidence; new-version compilation, writing, or partial success does not change these failures.

C6's current source capacity, the remaining formal environments, the same-source RGB-specific candidate, actual resources/task-stack and the peripheral physical matrix, independent-user V14, and each device's real 2h-to-24h-to-7d windows are still unfinished. Existing independent RGB software results are bound only to the old r5 source and cannot be merged into the r13 same-source results. There is currently no complete release or long-term-stability pass conclusion.

The historical candidates and their states are kept below; historical wording such as "current" or "pending" does not represent this round's progress.

Historical record (2026-10-05 18:05): the four-device candidate four-device-candidate-20261005-r5 is still RUNNING, executing ordinary-board verification; the RGB-specific candidate must also obtain this round's result. It must not be treated as release or deployment complete. The previous round r4 ended FAIL at 17:43 with 19 of 21 ordinary-board stages passing and the host-unit and contract stages failing; the r4 original results and the recovery test's nested evidence are separately preserved and obtained INTEGRITY_PASS, which only proves evidence integrity — the original candidate remains FAIL.

The report-publish failure was reproduced centrally and attributed to a Windows atomic-replacement access/share conflict. After bounded retries with accumulated errors kept, four-device-soak-focused-20261005-r2 passed all 35 device soak items, 66 touchscreen soak items, and 24 candidate observations locally, with stable inputs and no device access; passing virtual 24h/7d fixtures does not mean the device actually ran that long. This targeted result does not replace the complete r5 candidate result and does not rewrite the r4 failure.

The current priority scope is COM15 ESP32-S3-F16R8, COM4 ESP32-C3-F4R0, COM16 ESP32-F4R0, and the same ESP32-S3-F16R8 touch panel behind COM8/9. This round's config-preservation deployment, real-web verification, physical feedback, and continuous long-term acceptance for the four devices are still pending; C6 capacity and the remaining environments stay as separate todos, and the four-device scope must not be treated as the full nine-environment/RGB passing. The dates, candidates, and tables below keep their historical context and do not accumulate into the current release conclusion.

2026-10-05 00:18: the C6 image with new capabilities including ADS multi-channel scan, radar filtering, and action 21 actually compiled; the BIN is 3,364,320 bytes, exceeding the original partition by 21,984 bytes, so the current candidate cannot be deployed. Full host/native/web and S3/C6 checks continue to collect results; fixture failures found are kept with their original evidence before fixing. Parallel shared-code optimizations have not yet measured capacity gains; the full nine-environment/RGB, actual resource memory, devices, and long-term acceptance remain pending. Time-stamped results below apply only to their historical candidates.

2026-10-04 23:44: the ADS outer-timeout diagnosis is fixed and re-verified in r60; all 45 driver/cache scenarios and 50 dual-viewport form items passed; on outer interruption, stale data is cleared instead of treating the previous round's channels as this round's diagnosis. The merged increment's C6 image capacity is now being measured, followed by full software/nine-environment/RGB verification; not yet deployed. The time segments below are kept as history; the current physical and long-term acceptance boundaries are unchanged.

2026-10-04 23:39: ADS1115 same-address 1-4 channel scanning has entered the development candidate; 43 real driver/cache scenarios and 50 combined desktop/mobile form checks passed. Single-channel legacy configs keep their original channels; multi-channel is named by the selected MUX and publishes data only on a successful whole round. Digital-OUT radar debounce/hold, action 21 loop prevention, and single-shot conditional reporting completed targeted re-verification; byte/type/failure-recovery diffs for MQTT and health-state serialization passed. The ADS outer-timeout diagnostics clear is being finalized, still pending the current complete candidate and actual capacity verification; original test failures are kept and do not accumulate into a release pass. The latest C6 measurement still exceeds the original partition by 15,952 B; the device is not deployed; actual resources/memory, RTC retention, physical, and long-term acceptance remain pending.

2026-10-04 23:11: the current development candidate adds action 21 single-shot conditional reporting, fixed-event loop prevention and legacy dynamic-target rejection, plus digital-OUT radar managed inputs, dual-edge debounce, and inactive hold. The release 404 group and radar 28 scenarios x 4 chips passed local regression; the related graph OOM injection and old GPIO assertions await re-verification and cannot be merged into a complete candidate pass. ADS1115 multi-MUX scanning is still in integration preparation. The latest C6 actual image exceeds the original partition by 15,952 B; duplicate code is being reduced while keeping features and the original budget; the device is not deployed. Field resources/memory, RTC retention, physical matrix, and 2h/24h/7d/V14 remain to be accepted.

Verification date: 2026-10-04. This page describes a development candidate under verification; whether field devices have a capability is governed by the device firmware version and capability endpoints. New code that is not deployed cannot be treated as proof the field is updated.

22:44 update: equivalent serialization and original-path 34 items for Device/Batch, network config, and scan passed; JSON nested constant arrays 41 items passed. Real-browser regression found and fixed a 4G-mode static-IP group selector bug; the 11 release/modal/form tests after the fix passed; original failures are kept. The C6 image capacity is being re-measured, and action 21 explicit event loops and duplicate-report fixes are being finalized. Against the original plan, ADS1115 same-address multi-channel/conversion queue and digital-OUT radar managed read/debounce/hold still need software completion and must not be lumped as "only physical acceptance remains". Time points below are kept as history; the latest candidate has not completed unified testing, deployment, or long-term acceptance.

22:10 update: the development candidate adds RTC startup initialization that is off by default and requires an explicit UTC offset; the time used for display is the RTC unauthenticated source, which cannot replace network time sync required by HTTPS and does not write back to the RTC on its own. Specific rules add loop rejection for completed events; daily HH:mm adds an in-boot date watermark so clock rollbacks do not re-consume admitted dates; boundaries for large wrongly-set future dates, schedule changes, or restarts are documented separately. These paths and history-record persistence obtained local regression evidence; original failures are kept. The latest C6 capacity check still exceeds the original partition by 15,472 bytes and does not yet count successor additions; full firmware/nine-environment/RGB, deployment, physical, and long-term acceptance are unfinished.

21:22 update: SD auto-logging, UART receive-fault isolation, and DS18B20 per-ROM selection with wait-outside-lock conversion entered the development candidate and completed their targeted regressions; SD adds exclusive creation to prevent history files from being wrongly truncated. Release minification passed real module-load and edit-behavior regression. The above does not mean the whole firmware passes or is deployed; full software/nine-environment/RGB verification is still required. RTC startup initialization is being completed as default-off with an explicit unauthenticated time source; physical, actual memory, and long-term acceptance have not been performed. The time points below keep their original candidate history and cannot be accumulated into the current release conclusion.

20:21 re-check against the original plan: three software items are still being completed: SD auto-collection logging with rotation recovery, frame isolation after UART hardware receive errors, and DS18B20 ROM binding with conversion wait. The current SD read-only state does not mean auto-logging is available, and old serial/temperature sampling tests do not cover these two new gaps. The build-directory verification fix regression passed; web minification and native assertion fixes are merged; unified re-verification awaits this batch's implementation, tests, and documentation. All devices, runtime memory, RTC retention, and long-term acceptance remain pending.

19:48 the full check ended without the candidate passing: 4202 host tests with no failures and 1 permission skip, 186 page and 121 config interactions passed. The S3 and C6 application images met the capacity limits that round, but three failures remain: native assertions, a shared-web overage of 11 bytes, and artifact verification wrongly using the build directory; the original code and failure evidence are preserved, and later code must not inherit that round's capacity margin. The records below keep each historical candidate's results and cannot be accumulated into a current release pass.

18:52 latest result: the C6 capacity check passed with an image of 3,341,728 bytes and 608 bytes left in the partition; the full host static gate passed. The three response omissions of time-source/credibility fields in device time reads, offline sync, and online sync were then fixed; the real route and related 38 local regression items passed and are preserved. The candidate with this fix is being re-verified uniformly across host/native/web and S3/C6 builds; nine-environment/RGB is pending, with no deployment or physical/long-term acceptance.

18:28 the latest capacity result is preserved: the C6 image is 3,343,360 bytes, 6,464 bytes smaller than the previous round but still 1,024 bytes over the original partition. Minimal-scope fixes continue, followed by unified full software and firmware gates. Features, fonts, exception handling, and partition requirements are unchanged; no device operations this round; field and long-term acceptance remain pending.

18:20 this batch's three targeted test sets of 175, 44, and 98 items all passed and are independently preserved, covering Modbus state/response, the complete board capability table, JSON string ownership and nested config, OTA/memory/task-stack, and network-related paths. Sensor actions and the thermostat description are synced on string categories, real channel/Thing Model fields, and the 4-20mA engineering mapping requirement. The new C6 image is being measured; this local evidence does not yet represent a complete unified candidate, deployment, or physical pass.

17:40 the latest C6 capacity check ended and is preserved: the image is 3,349,824 bytes, 4,848 bytes smaller than the previous round but still 7,488 bytes over the partition. Features, fonts, exception handling, and partition limits are kept while duplicate code is fixed; the complete candidate, nine-environment/RGB, and field acceptance have not passed. This round only checked the C6 application and does not mean S3 or other targets were re-verified.

17:36 latest targeted results: the MCP combination preview and the delayed-response string fixes for screen, sensor, and PCA9685 configs passed full-content, object-destruction, and allocation-failure regressions; 125 related tests passed. The thermostat test-fixture assembly issue was preserved and fixed; 14 runtime tests passed, including humidity mislabeled as Celsius, physical-channel alias conflicts, MPU mode, and wrong calibration-parameter rejection. They cannot yet replace the full host/native/web and firmware candidate gates. The C6 image is being re-measured; nine-environment/RGB and field acceptance remain pending.

17:22 the development candidate adds two fixes awaiting centralized re-verification: MCP combination-preview partial strings are now owned by the response to avoid garbled text after return; the local thermostat identifies temperature by the real driver and sampling channel, rejecting inputs that merely relabel units such as humidity, and the DHT form syncs temperature/humidity units. The latest full-host result is 4147 passed, 1 failed, 1 permission skip; the failure is diagnosed and preserved; do not write this batch's unverified fixes or old partial passes as a release completion.

16:29 the seventh capacity check ended and is preserved: the C6 image is 3,354,672 bytes, still 12,336 bytes over; the S3 image is 3,648,816 bytes, 21,200 bytes left. The 16:04 targeted regression of 165 items all passed and is preserved, covering three actual custom readers, config save/readback, existing RF/Modbus paths, and byte/string-ownership/allocation-failure behavior of feature and network state outputs. Successor development versions must be retested and do not inherit this round's partial passes.

The prefix-loss defect in the recent execution-result list is fixed: control results use guarded append, returning 503 on append or allocation failure to avoid returning a partial success list. The 16:35 centralized 101-item regression all passed and is preserved, covering full routes, the old-defect repro, per-string/JSON allocation failures, shared metadata, and screen output/cache. This result is local testing; the unified candidate, nine-environment/RGB, and field acceptance are pending; not deployed to devices.

The records below keep historical results per their time and candidate; they do not accumulate into the current unified candidate pass and are not re-counted as new development items.

15:52 the new 80-item targeted regression all passed and is preserved, including task-stack, SD, and time-state outputs, plus string-ownership and memory-allocation-failure handling for rule candidate/detail/precheck responses; the earlier 95-item save/readback and Modbus state regression also passed. These are per-version local evidence, not deployed to devices; firmware capacity optimization is still being measured; the unified candidate, nine-environment/RGB, and field acceptance remain pending.

15:36 the fourth capacity check: the C6 image is 3,358,704 bytes, still 16,368 bytes over; the S3 image is 3,653,024 bytes, 16,992 bytes left. Results are preserved; centralized behavior verification and capacity fixes continue; the full unified candidate, nine-environment/RGB, and field acceptance are unfinished. The NC operation cards and the resource/SD/long-term acceptance records have been corrected per implementation; 181 device-document relative-link checks passed.

15:23 the third capacity result still failed: the C6 image is 3,366,720 bytes, 24,384 bytes over; the S3 image is 3,658,384 bytes, 11,632 bytes left. That attempt increased size; the result is preserved and the no-gain changes reverted; successor duplicate-field fixes continue to be measured. Features, fonts, exception handling, and partition requirements are kept; the complete candidate and field acceptance are unfinished. The time segments below are historical results and cannot serve as the current new-development list.

15:08 the new 45 targeted items all passed, including JSON assignment, string ownership, out-of-memory, and actual config save/byte readback; results are independently preserved. The third actual-image capacity check continues; no unified candidate, nine-environment/RGB, or device acceptance results yet.

15:00 the second capacity check ended and is preserved: the S3 application image is 3,655,696 bytes, 14,320 bytes left in the partition; the C6 image is 3,362,160 bytes, still 19,824 bytes over — this round's candidate failed. Successor centralized shared-JSON assignment and save/readback tests await execution; the full unified gates, nine-environment/RGB, devices, and long-term acceptance are unfinished. A capacity check does not include filesystem, deployment, or runtime-memory proof.

14:33 the second host batch: 4026 items passed, 1 permission skip; another test-extraction omission was fixed and 61 items passed. Original failures are kept; do not merge partial results into a unified candidate pass; successor changes must be re-verified; not deployed to devices.

Content	Behavior connected	Not yet complete
Boards and capabilities	Board/reserved pins, capacity protection, capability and action admission	Re-verification of the current complete candidate; per-device wiring and load checks
Resource usage	Separately shows config planning and thirteen runtime registrations: I2C/SPI/UART/control outputs, encoder/DHT, peripheral LEDC/screen backlight, guarded ADC/GPIO/DAC, and NeoPixel/stepper; IRQ confirmation separated from pending-cleanup; failures keep the original owner	New unified regression; unmanaged SDK resources and global-arbitration boundaries; real combination recovery
Feature state	Distinguishes user switches, budget, pending-restart; 28 features each record owner, manager lifetime, TLS allocation, active, and static/unimplemented scopes; developer explicit task-stack snapshot	New regression; six-group feature-toggle memory comparison and recovery measurement; an existing object does not mean the service runs
Existing peripherals	RTC source and quality, SD rules/recovery, UART generation protection, data quality; NeoPixel bounded send and failed-pin retention	New unified NeoPixel/SDK-patch verification; RTC retention/accuracy; SD/UART and other peripheral physical matrix
No-code scenarios	Continuous thermostat, collection reporting, read-only SDM120 voltage template, board remapping and cross-file migration	Same-version integrated regression; sensor/load and platform receipt; real meter and board-swap verification; independent trials
New hardware	ADS1115, MCP23017, PCA9685 production config, actions, diagnostics, and examples	Current firmware full set; real calibration/power/disconnect recovery and cross-chip physical verification
Release	Frozen source, failure preservation, per-environment web/image archiving, offline testing and long-term-stability tools	Nine-environment and RGB complete candidate; config-preservation deployment; physical fault tests; 24h/7d; independent user acceptance

The items above cannot be marked complete as a package. Continuous thermostat, transactional migration, and the H1 driver are implemented and should not keep being read per historical records as undeveloped; their device acceptance is still open.

Type-specific and wiring limits are in the Capability Evidence Matrix; handling boundaries for bad config, boot failure, OTA, and network/bus faults are in Recovery and Configuration Preservation. An enumeration existing does not mean the hardware is supported, and a documented recovery path does not mean the field has verified it.

The recording methods for the six feature/resource comparison groups, RTC retention/timekeeping, and SD/UART/H1/RGB fault windows are in Resource Measurement and Physical Acceptance Records. That table is for subsequent authorized field testing and adds no completed samples or acceptance conclusions.

Successor rule saving has connected precheck and content-binding confirmation; DAC writes no longer ignore driver failures; named-script HIGH/LOW/PWM write rejection stops subsequent commands. Ordinary rules, manual, MQTT, and screen source policies are connected to native digital outputs, PCF/MCP, NeoPixel, PWM/DAC, PCA, servo/stepper, RF and display, plus Modbus accurate frames, maintenance, delay, and virtual-peripheral entry points. Source, version, override deadline, and stop confirmation each have independent constraints; these implementations have itemized verification, while the complete candidate and physical outputs are not yet accepted.

Current Candidate and Resource Budget

13:34 all 4074 host tests after this batch's duplicate-JSON-code fix completed: 4073 passed, 1 skipped due to Windows symlink permission, no failures or errors; source inputs stable and results independently preserved. Next, actually build C6/S3 and check the new image capacity. This result covers only local host testing; the full firmware, nine-environment/RGB, devices, and long-term acceptance are still unfinished; it is not proof of field device updates.

2026-10-04 focused r11's 385 targeted items all passed and are independently preserved, covering the Modbus core, Protocol, virtual peripherals, boot snapshot, HTTP, and result reports. The successor unified precheck r7 ended FAIL at 11:29 and is independently preserved with 1772 stable inputs; web pages 186 items and config interactions 121 items passed; host 3914 items had 4 failures, 3 assembly-error classes, 1 skip; native 2379 items had 5 failures. Both S3 and C6 failed to compile due to the two Modbus cleanup-guard reference types not matching production fields.

These production references and related test dependencies and old contracts passed re-verification in precheck r8; Protocol added read/write-path regressions rejecting bad CRC, missing CRC, and short frames without relaxing pre-send validation. r8 ended FAIL at 12:05 and was independently preserved at 12:09: 1772 stable inputs, host 4058 items with no failures/1 permission skip, native 2379, offline recovery 61, memory contract, six static checks, new web pages 186/config 121 passed.

The real remaining blocker this round is firmware capacity: after S3-F8R0 links successfully, the program is 3,682,183 bytes, exceeding the original application partition by 12,167 bytes; the C6-F4R0 actual image is 3,395,328 bytes, exceeding the original partition by 52,992 bytes. Program statistics not exceeding the limit cannot replace the image capacity check. Size fixes that keep features unchanged are being analyzed; partitions have not been enlarged and nothing is deployed; nine-environment/RGB, devices, actual resource memory, and long-term acceptance remain pending. Both original r7/r8 failures are kept.

A same-source follow-up optimization-parameter experiment ended at 12:55 with no actual reduction: S3 program over by 12,247 bytes, C6 image over by 53,040 bytes; failure evidence is independently preserved and the parameters were not adopted. Duplicate JSON fields and parsing code are being handled; features, fonts, exception handling, and partitions keep original requirements; whether capacity is met must be re-measured. New diagnostics, nine-environment/RGB, field devices, and long-term acceptance are still unfinished.

Historical candidate results are kept below; phrases like "still merging" or "not run" in historical paragraphs describe only the inputs at the time and do not serve as a list of currently undeveloped features. Current todos: complete the unified re-verification after fixes, handle newly found actual failures, obtain the same-source complete nine-environment/RGB evidence, then complete devices, actual resource-memory measurement, long-term stability, and independent trials separately.

09:02 the new web config matrix 120 items all passed; S3/C6 firmware still failed to compile due to a missing RF mode declaration, with the original failure preserved — cannot deploy. That declaration, plus motor background results, TM1637 acknowledgments, LCD1602 failure returns, and IR key transactions have entered successor software and are under centralized verification. Motor acceptance/acknowledgment/unknown boundaries are in the Control Results description; physical motion and other Modbus entry points must still be accepted separately.

08:48 the centralized targeted r3 run had 881 items; the 34 RF groups with deadline and the executed motion/stepper/LEDC items passed; the old Modbus boot-snapshot fixture did not compile, so the batch keeps FAIL and that class is unrun. Follow-up re-verifies the config pages and compiles the S3/C6 application and filesystem; these results cannot yet replace the full nine-environment, RGB, device, and long-term acceptance.

2026-10-04 08:43 successor checks passed six static gates, native 2379 items, the new web budget, and 186 offline page tests; the config matrix passed 119 of 120 items, with 1 old-hint assertion unsynced. The actual pages explicitly distinguish "execution submitted" from "output result pending confirmation"; that assertion is fixed and awaits re-verification. The new RF deadline, stepper fault regressions, and Motor/display/IR fixes are integrated and verified separately; no field devices were updated, and nine-environment/RGB, physical, and long-term acceptance are unfinished. Historical candidate records are kept below and cannot be stitched with the current batch into a package pass.

The latest diagnostic r6 ended at 2026-10-04 08:05 and keeps FAIL: 1724 stable inputs; host 3338 items had 4 failures, 1 assembly-error class, 1 skip; native 2379 items had 1 old delay-assertion failure. The peripheral route at 200.7KiB exceeds the 200KiB source limit; the web total of 348.8KiB meets 349KiB, but the peripherals module at 16515B exceeds 16384B, and the browser stage did not run. Both S3/C6 applications compiled successfully with BIN/ELF/map preserved; the subsequent filesystem packaging was rejected by the web gate — still not releasable or deployable.

The main repository has merged servo/stepper, buzzer and PWM/AO waveforms, Modbus relay source arbitration, read-route splitting, and web/legacy-fixture fixes, awaiting this batch's centralized regression; RF, Motor, and full Modbus aliases continue. The device guide is synced to actual endpoints and failure boundaries; untested implementations are not recorded as passes. Historical candidate records follow.

The 2026-10-04 05:57 standalone S3-F8R0 size experiment produced a 3,419,792-byte image, 250,224 bytes left in the original 3,670,016-byte partition; partitions unchanged and no features cut. The experiment still has NeoPixel C/C++ entry-type warnings and cannot be released. The development candidate connects in-project LTO link settings, entry-type and illegal-pin truncation fixes, and requires link failure on type warnings; the same source's nine-environment/RGB and runtime verification must be redone. A size experiment does not mean current devices are updated or that memory/timing are verified.

The latest full diagnostic r5 ended FAIL at 2026-10-04 06:46: 3199 host unit tests had 6 failures, 5 errors, 1 skip; native 2379 items all passed. The two web modules at 16.4/16.2KiB exceed 16KiB, and the total and shared budgets are also over, so the browser did not run. Both S3/C6 failed to compile due to a missing lock header in the ordinary arbitration source file. 1716 inputs are stable; original failures are independently preserved; currently not releasable or deployable.

The lock-header, fixture, and ADS numeric-boundary fixes passed the successor integrated targeted r3's related subsets; that round's 06:57 run actually passed all 284 items, covering ordinary control, IOX, NeoPixel, and Modbus receipts. PCA whole-device arbitration and web dedup were then merged and await testing; PWM/DAC, servo/stepper, and full Modbus/Motor continue to integrate. Targeted tests do not replace the full host/native, current nine-environment/RGB, devices, or long-term stability; the web budget was not increased. The records below keep candidate history.

The r19 on this page refers specifically to system-plan-followup-20261003-r19-gates and is unrelated to same-named revision numbers in other work lines such as the screen track; cross-references must check both the full candidate name and artifact summary.

The r19 frozen candidate passed five prechecks, host static/contract gates, native, and RGB host checks; offline pages 186 items and config interactions 119 items passed. The 2788 host unit tests had 1 failure, 2 errors, 1 skip; ended FAIL at 2026-10-04 01:25, with all nine firmware environments failing due to a missing lock-type header in the UART source file. Inputs, original logs, and archives are independently verified and preserved. The main repository has added the test dependencies and headers and awaits successor re-verification; the current candidate is not releasable. RGB uses separate config and build evidence and cannot be replaced by an ordinary S3 environment or host checks. Main-repository development after the freeze is outside r19 verification scope.

The cellular secure-client allocation failure no longer falls back to plaintext; memory protection keeps the user scheme/port/enabled and pauses TLS. The 2026-10-04 successor centralized diagnostic r1 actually ran: offline pages 186 items and config 119 items passed; resource/TLS partial fixtures and old contracts failed; native 2379 items had 4 old-contract failures; the actual S3/C6 firmware compile exposed a NeoPixel patch ABI header-visibility issue. Inputs are stable and original failure logs independently preserved; fixes plus ADC/GPIO completion are in progress before successor verification runs; no complete passing candidate has formed and this batch is not deployed.

The new-feature batch's web measured 345.0KiB, passing within the explicitly revised 349KiB limit. The original 317KiB overage report is preserved; the new 32KiB allowance is not an optimization achievement against the old budget. Home, single-resource, runtime-module, file-count, and DOM thresholds keep their original values; see the Release Checklist. Device response, memory peaks, and long-term stability must be measured separately.

The r20 centralized diagnostic r2 ended FAIL at 03:10:49: host 2959 items had 2 failures/3 errors/1 skip; native 2379 items 2378 passed/1 failed; S3/C6 failed to compile at ADC snapshot-clear syntax; 1644 stable inputs and 15 phase logs independently preserved. The eleven-source JSON/API/OOM/web, guarded ADC/GPIO/DAC, and task-stack 26 items subsets passed; new web pages 186 and config 119 items passed. This batch remains unreleasable.

The r20 centralized diagnostic r3 ended FAIL at 04:18:14. New web pages 186 items, config 119 items, thirteen-source resource JSON/API/OOM/web, and NeoPixel 70 items partially passed; some GPIO/encoder/stepper fixture assemblies failed, and the screen 92 items had 1 failure. Native 2379 items: 2378 passed, 1 old source-boundary check failed; the actual S3/C6 compile exposed a migration-route type-name conflict and a missing declaration header. The 19-phase original logs are independently verified; during the run only one motor document from another work line changed, production/tests did not drift, and the original input-instability mark and FAIL are kept. Currently still unreleasable.

The fixes above are being merged, together with DAC actions using guarded drivers, OTA pending-verify state with bounded confirmation, shared action policy, the unified capability matrix, and the recovery maintenance flow. New changes await centralized r4 and the final nine-environment/RGB; they do not inherit old passes; this batch is not deployed. The stack snapshot covers at most 48 tasks with a 30-second cooldown and copies only SDK scalars, without accessing possibly deleted task names/handles; periodic diagnostics only read the caller itself. Endpoint and unknown-field descriptions are in Health Monitor and API Reference; device overhead and worst-case timing still await measurement.

Usage and Acceptance Boundaries

• An enabled config display does not prove the driver is allocated; an existing driver object does not prove the line or load works. See Feature Configuration and Peripheral Management.
• Memory estimates are not real-time usage or post-disable release; internal DRAM, largest contiguous block, DMA, PSRAM, and stack are recorded separately. See Health Monitor.
• Read-only meter templates generate disabled drafts; verify model, address, and serial parameters before explicitly enabling; unverified write commands do not auto-open. See Modbus RTU.
• RTC trusted source, staleness, and timezone display do not equal battery retention/accuracy passing; a correct software time format cannot replace physical timekeeping.
• 24h/7d is timed by the same candidate's actual valid-sample span and continuous business evidence; an existing run process, device historical uptime, or export duration cannot make up the observation time. Automated testing does not replace independent user acceptance.

The device phase must re-verify the candidate, device MAC/port, config backup, wiring, and output safety. Unverified dangerous outputs stay unrun; this round's software development did not flash devices, did not change field config/RTC, and did not drive actual outputs.