Repository navigation
Conversation
…ation Suspend only ordinary SHOW health accounting during authorized firmware quiescence; keep heartbeat, OS link monitoring and fresh SV/PTP ACK/readback mandatory. Retire stale deferred reads at maintenance entry, suppress their replay, and apply bounded 40s PTP/45s supervised STOP windows grounded in field traces where STOP ACK followed after 12 seconds. Add S8 regression for premature COM retirement, proof isolation and restored normal health. No forced flash, no silent service restart.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
…ied ROM retry A failed STOP may retire application identity. Do not let Retry on a remembered COM bypass supervised STOP by entering the blank-board ROM path. Bind that exception to the confirmed beginFirmwareInstall entry only, fail closed with re-identification guidance, and lock it with S8 negative regression.
…retirement Maintenance discards pre-existing readback flags before STOP, but STOP-created safety SHOW/PTP SHOW may still be deferred by M4 exclusive retirement. Drain only those proof readbacks once the serial worker acknowledges retirement, never stale PROFILE SHOW, and add a negative S8 regression ensuring no premature verification.
…onsole proof The workspace source-policy gate hardcoded the removed 5 s PTP STOP syntax, causing an early CI failure before compilation. Assert the new bounded maintenance PTP/supervisor deadlines, strict deferred readback behavior and SHOW-health isolation instead; retain all existing QML authority guards.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reproduced on COM15 — real operator trace (2026-11-03 20:03 UTC)
20:03:40Studio transmittedSTOP,PTP STOP.20:03:44normal 2 s SHOW-health watchdog treated the pending maintenance transaction as missing replies, retired the QSerialPort, and aborted firmware provisioning.20:03:52board finally returnedSTOP accepted(after 12 s) and20:03:53–55returned PTPSTOPPEDand SVSVLIFE STOPPED, too late for the original session. No flash occurred. The core issue is premature COM teardown + competing stale telemetry, not permission to bypass safety.Production fix
StudioDeviceControllersuspends only ordinary SHOW health-probe accounting during sole-supervisor firmware quiescence. Clears pre-update pending probe/misses. Existing 700 ms safety HEARTBEAT, USB disconnect checks, QSerialPort errors and absolute firmware transaction deadline remain fully active. Health monitoring resumes afterward and genuine failures still trigger retirement.DeviceControllerdrops facade-owned deferred non-safety SHOW/PROFILE/old PTP readbacks at handoff and stops replaying them until maintenance exits. Reserved priority STOPs and fresh post-ACK SVLIFE/PTP SHOW readbacks still run on the same single worker.No
--force, ROM reset, flash, false READY, or auto SV/PTP restart without verified STOP. Preserves published M3.H.3 stable, M4 PR #350, LAN autonomy PR #330. Physical COM15 retest needed; code/CI alone is not hardware acceptance.Merge gates
Exact-head Windows/Linux S8+Qt, Windows Lifecycle, matched Native Preview Windows ZIP/Inno installer, Linux paired preview, and firmware catalog/installer smoke tests must pass. Avoid pushes unless a genuine CI failure requires correction.
beginFirmwareInstall(true)on a currently isolated/identified blank-board candidate can authorize ROM-only recovery. New S8 negative case verifies no probe/flash on lost identity. This is the distinct operator-consent boundary required by AGENTS.md; normal verified post-STOP handoff remains unchanged.Latest implementation SHA:
2f3b1bd0a8b9648c13055455410be55fded0e550.c5cf218ec9891a5d927ad5f8774e2db5851702ff.