Hardware verification backlog

[CtrlAltcouk]

The architecture/software remediation work from the original InkPanel review has been completed and merged into main. This issue now tracks only the remaining checks that require real hardware rather than CI.

Remaining physical verification

• New-board one-pass provisioning end-to-end — explicitly confirm a blank/recovered board is flashed and provisioned in one browser device selection, boots, joins Wi-Fi and checks into the InkPanel brain without a second COM selection.
• Deep-sleep current measurement — record the real EE04 battery-only sleep current using the procedure in docs/hardware/sleep-current.md.
• Battery ADC calibration — compare reported battery voltage/percentage with a meter across a useful discharge range.
• KEY1 wake-from-deep-sleep — formally verify and record the button wake path.
• Repeated HTTP 200 / ETag 304 wake cycles — verify unchanged content repeatedly returns 304 and does not refresh the physical panel.

Already hardware-verified

• Browser flash erase/recovery path after the WebFlash byte-corruption fix.
• Preserve-Wi-Fi firmware update path: the board retained Wi-Fi/server settings and device identity after an Update existing board flash.
• Production panel boots, enrols/claims and displays server-rendered content.

Software status

The original software backlog is complete in main, including:

• NVS-safe routine WebFlash updates and one-pass provisioning architecture
• device/config-specific source cache and unique atomic temp files
• non-destructive corrupt-config handling and versioned config migration
• HTTPS/WebSerial runtime configuration and certificate SAN handling
• transactional LXC self-update with health check and rollback
• calendar SSRF controls and independent feed fetching
• timezone validation and hardened auto-enrolment
• chunked framebuffer transfer and display-failure backoff
• live National Rail train transport and server-side credential management
• configurable dashboard widgets including Bus, Traffic and Octopus Agile
• production XIAO ESP32-S3 Plus firmware compilation in CI

The detailed implementation history remains available in the merged PRs and Git history. Current operational documentation lives under docs/.

[CtrlAltcouk]

PR #3 (145e26804f11c6a971de698374e9d6b0a432df06) adds the resilient recovery path found necessary during new-board hardware testing. Unconfigured firmware keeps USB provisioning alive while the inkpanel-setup captive portal is running, and the Flash tab has Configure an unconfigured board to send Wi-Fi + the InkPanel brain URL over USB without another flash. 192.168.4.1 remains only a SoftAP recovery address. CI passed both the full application/test/timezone gate and a real esp32:esp32:XIAO_ESP32S3_Plus firmware compile. The later PR #5 one-pass flash-time provisioning path has now also been exercised successfully on physical hardware.

[CtrlAltcouk]

Deployment reliability update: PR #4 (d450499) fixes the stale WebFlash firmware state observed on real hardware (current web UI serving a legacy ESP32 package that immediately entered inkpanel-setup / 192.168.4.1). Successful firmware builds are now fingerprinted against their tracked build inputs; the LXC updater checks the served package fingerprint on every update rather than relying only on the latest git pull diff. Firmware builds are also staged and published only after compile + manifest succeed so a failed build preserves the previous good package. Production XIAO ESP32-S3 Plus firmware compile, full tests and timezone tests passed in CI. Existing LXCs with the older root-owned updater require one explicit administrator repair; fresh installs receive the corrected helper.

[CtrlAltcouk]

New-board onboarding follow-up — PR #5 merged

PR #5 (7a265219967c21c2636a3b9501da91ee0ed72237) replaces the fragile post-flash USB re-enumeration handoff with one-pass flash-time provisioning.

Current design:

• custom 16 MB partition table preserves NVS at 0x9000 and app0 at 0x10000;
• final 4 KiB sector 0xFFF000..0xFFFFFF is a dedicated provision data partition;
• WebFlash derives that address from the compiled partitions.csv via the firmware manifest — the browser does not hardcode it;
• Set up a new board erases, flashes firmware and embeds a CRC-protected INKPV001 Wi-Fi/server record in the same flash operation;
• firmware 0.1.2 validates magic/version/lengths/CRC, saves through the existing NVS path, then erases the temporary record immediately;
• Configure-over-USB remains a physically verified recovery path; 192.168.4.1 remains final fallback only;
• KEY3 clears both NVS and any pending one-time record.

CI passed the full app/typecheck/timezone suite and compiled the real esp32:esp32:XIAO_ESP32S3_Plus production firmware with the corrected partition table.

Hardware follow-up: the one-pass flash-time onboarding path has now been exercised successfully on the physical XIAO after flashing unrelated firmware first: New Board restored InkPanel firmware and the board accepted its Wi-Fi/server configuration. Continue treating broader power/ETag/preserve-update checks as separate hardware-verification items.

[CtrlAltcouk]

PR #9 has been merged into main as 0306b74b8ab740782e88a3fbe1f93a5d81017b7a.

This completes two backlog items:

• Self-update health check / rollback — Proxmox/LXC updates are now transactional: preflight health, exact baseline SHA, staged dependencies, config/firmware snapshots, candidate health probation, exact automatic rollback, and terminal failed status even when rollback succeeds.
• Serialize Chromium startup — renderer cold-starts now share one launch promise; failures clear it for retry. /health now requires both a valid DeviceStore and working local Chromium renderer, without contacting external data sources.

Security hardening included in the same PR: /opt/inkpanel remains root-owned, root/app path boundaries are tightened, status publication is unprivileged and symlink-safe, dependency snapshots are protected in the root-only transaction area and restored with opaque renames, and existing LXCs require an explicit one-time root-helper refresh rather than automatically promoting app-owned checkout code.

CI run #74 passed typecheck, full tests, timezone matrix, shell syntax, and the production esp32:esp32:XIAO_ESP32S3_Plus compile.

[CtrlAltcouk]

PR #13 merged as 445678584c150bdf65038c25e466c2896db05b35: Allow unknown Content-Length safely is implemented. Firmware 0.1.3 keeps the existing exact Content-Length: 48000 fast path, accepts an unknown length only when Transfer-Encoding: chunked, decodes chunk framing through ESP32 HTTPClient::writeToStream(), and bounds decoded output to exactly one framebuffer so short/oversized bodies fail before the panel is touched. CI #84 passed the full test/typecheck/timezone suite and the production esp32:esp32:XIAO_ESP32S3_Plus compile. Hardware deployment can be combined with the pending preserve-Wi-Fi flash verification.

[CtrlAltcouk]

Hardware verification note (2026-08-10): KEY1 wake-from-deep-sleep has been verified on real hardware. Serial output from esp32-f9b974 running firmware 0.1.4 reported wake=button, then connected to Wi-Fi, fetched a frame and returned to deep sleep. The HTTP 200/304 check remains open because the current rendered “last updated” timestamp changes the framebuffer every wake; that behaviour is being intentionally deferred until the later UI/content changes.

[CtrlAltcouk]

Hardware verification update (2026-08-10): KEY1 wake-from-deep-sleep is verified on real hardware. Firmware 0.1.4 reported wake=button after pressing KEY1 while esp32-f9b974 was sleeping, then reconnected and fetched/drew normally. Deep-sleep current measurement and battery ADC calibration are deferred until a battery is available. Repeated 200/304 remains open because the current on-screen volatile update timestamp makes each framebuffer different; this will be revisited during the planned display/UI changes.