RF TX Source and Guarded Output Boundaries

2026-10-04: integrated in the development candidate. RF passed 34 groups of local fault regression including operation deadlines; the full candidate still awaits unified verification and build and is not deployed. Command success only means the local GPIO operation got an SDK acknowledgment; it does not prove a wireless receiver or a remote load executed.

RF TX control reuses the generic output source ownership. HTTP uses the authenticated session identity; rules, MQTT, and the screen keep their real sources. Ownership conflicts must return an explicit review and then be confirmed for the same target; the program does not retransmit automatically. The legacy generic sourceless binary writeData interface is no longer used for RF transmission.

Code values use uint32 strings, supporting decimal, 0x hex, bare A-F hex, and 0b binary. Signs, whitespace, underscores, overflow, and embedded NULs are forbidden. When the specified bits cannot hold the code value, the request is rejected instead of truncating high bits. bits range 1-32, pulseWidth 100-2000us, repeat 1-20; a parameter of 0/omitted means using the existing default, and binary defaults to the number of text digits.

Rule action example: {"action":"send","code":"0x123","bits":12,"pulseWidth":350,"repeat":3}. Only one of code and value may appear; only one of bits and bitLength may appear; the code value must be a string, and $value may only serve as the complete code-value field, not be expanded into new JSON fields. Parameters must not use floats, booleans, or negatives.

HTTP uses one of code, data, value as the code-value field, optionally with bits/pulseWidth/repeat. Do not submit self-made actor/source/operation fields or mixed aliases. HTTP 503 / source invalidation means the result is unconfirmed and may have been partially transmitted; verify field feedback first — never retry automatically.

The source is re-verified between frames; frames stop after the source expires. Transmission is still synchronous OOK; the nominal delay totals 6.42 seconds at maximum parameters, and scheduling, Wi-Fi preemption, and SDK time add more — this is not the actual delay bound. Transmission holds the shared peripheral management lock, so other output updates, expiring stops, and device queries may be delayed or return busy. Real pulse widths, RF reception success rate, concurrent response, and worst-case stop time still await physical measurement; do not consider a combination usable just because commands pass.

The rule queue keeps the operation deadline established at enqueue time and does not restart it per RF transmission. The candidate checks this deadline before each frame and before the final return; if it expires before anything is sent, no output is attempted, and if it expires mid-way, the result is unconfirmed while the partially transmitted fact is kept and subsequent frames stop. An in-progress frame completes the inactive boundary; hardware write or cleanup failures keep the error and ownership and are not retransmitted automatically. This increment has passed local timing/wraparound/fault regression and does not promise hard real-time. Manual ownership expiry does not automatically send an "off" code.

For activeHigh=false, TX is inactive at HIGH. Initialization, failure cleanup, and release all use this configured level; if the SDK cannot confirm cleanup, the ownership and error are kept. A switched input is not evidence of electrical shutdown; external pull-ups/pull-downs and wiring must maintain a confirmed safe state.

The local RF peripheral ID only identifies the local transmit pin; it cannot identify, exclusively own, or prove a remote wireless load. Before physical testing, re-confirm a stable candidate, configuration preservation, device identity, wiring, and authorization scope; unknown dangerous outputs remain NOT_RUN.

TX mode provides no GPIO input / remote load readback; readRfLevel/readPin are explicitly rejected, preventing transmit statistics from being treated as logic levels. RX sampling stays independent and is not remote load confirmation.