[atomicdeploy]

Consolidated changes

Preserves the existing main history and incorporates the normally merged PRs #38 and #39. Tracks #32, #33, #7, #20 and #3 without closing hardware/product acceptance.

• Keycontroller boot policy, PuzzleBoard-derived TM1637 ready animation and idle-only countdown audio; richer contextual game configuration across Flutter, Rust and the one canonical Web application.
• Game feedback/palettes, Press-to-win cue fencing, Color Pattern timing, Simon 3/5/7 defaults, Mine Field, and configurable presentation defaults without overwriting saved instance settings.
• Firmware-progress and numbered/icon/two-line game-picker improvements; authenticated SSH one-line commands and direct PTY TUI using the existing dispatcher.
• Strict TLS diagnostics and project-local PSRAM record-buffer allocation, bounded cloud telemetry/reassembly and scoped MQTT commissioning tooling. No certificate/authentication downgrade.
• Persisted one-shot peer AP commissioning with exact identity checks, pre-write receipts, no uncertain mutation replay and restoration of unchanged saved source networking.
• Combined contextual terminal retains SSH command-only behavior. Integration fixes the workspace fixture's missing session fields and a BLE negative-test mutation that stopped matching after commissioning service insertion; LF/CRLF negatives remain enforced.
• Donor source history, omission lists, review inventory, private backups and concurrent worktree preserved. Only reviewed changed hashes are rebound; comparison projections regenerated.

Verification and boundaries

Combined shell, SSH, BLE, audit, cloud, TLS-allocation and peer-commissioning fixtures pass locally. Full exact-head Build/CodeQL results must be checked before merging; no failing check is waived. ESP32-S3 and AVR are release targets; unfinished ESP8266 support stays in source.

Prior device deployments and the blocked recovery remain documented separately. The latest peer-recovery image is a build candidate, not a confirmed installed image. This integration does not flash, reboot, reset or actuate a board or replace an installed client. Physical game/audio/display/OTA/peer acceptance and Linux glib issue #17 remain open. No completed Copilot review is claimed.

[atomicdeploy]

Checkpoint 5b0d1b1 pushed. Fixes stale generic result cues preempting Press-to-win winner override: delayed feedback is fenced by exact game/input epoch. Color Pattern reveal cap500ms, separated default7 colors, per-box exact color/match diagnostics; all511 masks and palettes2–9 pass. No independent matching algorithm defect reproduced; actual6/6 optical acceptance remains open.

Tablet base.apk SHA256 ed7dba272ad67409479562db98897e5e4752810087ff706ee42fe48f7330c65e verified after install via wireless ADB. Professional firmware progress and exact Urboot backup export pass47 focused Flutter tests/analyzer. Canonical S3 candidate b5252660a9487bb209987bc0a9afa45d70c16b76c57f2ab3a92ed3ed63405206 (2424000bytes) built, not yet deployed. Previous actual tablet ESP upload b73c65... subsequently passed complete independent running-image hash/newboot. Current AVRjob0, no AVRwritecompleted; tablet left maintenance before a job started while game changed externally. No uncertain write repeated. Receipts and remaining live/audio/display gates in docs/KEY-MINIGAMES.md. Acceptance stays open. Connected GitHub comment integration returned403; publishing this exact checkpoint through authenticated gh fallback.

[atomicdeploy]

Checkpoint f395348 pushed, workspace clean. Completed the requested-feedback source audit and recorded every item/proof/remaining device gate in docs/KEY-MINIGAMES.md. Existing numbered/icon/two-line pickers, configurable10s target, ordered opt-in ColorPattern reveal, default-on MatchingPairs reveal/tones, Simon per-entry feedback, WS-first box controls, arpeggios and configured full winner cue beside success rainbow are implemented. Fixed repeatedwrong-pair samephase melody loss, friendly settings/hold failure text (realcause/draft retained), and Web rejection of exposedboot/timerfields. No claim allnetworkfailures are eliminated or physicalcolormatchingverified.

Latest user overrides: ColorPatternintro defaultOFF (savedinstance changepending); Simon defaults3rounds with3→5→7steps,300mslit/120msgap,240msfeedback. Added bounded optional sequence_growth0..31 toboardpersistenceandFlutter/Rust/Web, preservingexplicitoldsettings/noautomaticflashwrites.

Evidence: core/full/subset+persistence pass, compiledproductionaudiointegration7/7, Fluttergame19/19+unchangedWStransport6/6/analyzerclean, nativefocused10/10, WebtransportandisolatedDOM tests pass, canonicalS3/APK/full+onboardWeb builds pass. FinalESP SHA2566679ecb3a65032ef4ce49274a4cb5fe2bcc2e0b560741dd1d1a3c557225b06cc(2424240bytes); APK72a41b4db3ad3a514efaffd89a1084bb52e1d7a8902dd4326b9956da22d01c29. NativeproductionEXEnotpackagedthisaudit; AVRsourceunchanged/latestpairedcandidatepending. No board/tablet changes thisaudit: userconfirmedusingtablet and askedretrylater; ASUS accessalsofailed. Currentinstanceintro/Simonsettingsandactual3roundhardware/audiofeedbackremainpending. Leavephysicalacceptanceopen.

[atomicdeploy]

Washed-color checkpoint d3d450c pushed on PR #37. Optional Pink is now #FF0080 (no gray floor); shared normal/diagnostic rainbow explicitly requests HSV saturation/value 255/255 instead of FastLED convenience saturation 240. Saved custom colors, brightness, channel calibration and correction rules remain unchanged. Audited game compositor/published frame/S3 wire encoder; tests cover all nine game colors, six brightness levels and zero-channel preservation under scalar effects. Canonical minigame core/settings, both baked-role profiles, full LED pipeline and S3 first-wins build PASS. Candidate application 2,424,192 bytes, SHA256 bfc86d3e0408f58975186760b7a5e12e440d2782f09349fad0e25174c010449d. The initially locked test process cleared and the same canonical wrapper passed; no cleanup-policy workaround. NOT deployed: David deferred tablet/board maintenance while using controls. Last observed running firmware predates the vivid palette. Physical color feedback and current-instance settings/deployment remain open; source tests do not prove optical or electrical health.

[atomicdeploy]

Mine Field implemented in 42d2106 (PR #37), optional/default-on within keycontroller builds; existing mode IDs preserved and Toggle remains last. Both groups of each enabled box start as a playable mix of cyan/yellow. Cyan pulses high/low; yellow remains solid. Each Down toggles one box (duplicates ignored). All cyan OR all yellow wins; elapsed time freezes and Flutter/Rust display a precise Winning time result. Default 60 s limit and 1000 ms pulse period are configurable/persisted through existing limit_ms/show_ms; timeout flashes all participating groups red. At least two boxes; no current instance settings modified. Existing WS-first USB/HTTP/MQTT command owners, TM1637 countdown, shared effects/audio/output rules retained. PASS: all 502 enabled-box masks with >=2 boxes and both solutions, press-only exclusion, settings persistence, role profiles, production dispatch fixtures, Web typed WS + isolated browser, Flutter analyzer/22 tests, native13 tests, full/onboard Web and S3/APK builds. ESP application SHA256 32f1a454eced20fa1efaf9916e17a72ef843aab52f98206c2e84466a78476122; APK 8c8e150a8903d494c6e0bf8e8fb1062f4896954b2333e69190c8206b8b09c771. NOT DEPLOYED: prior tablet-in-use deferral remains; physical play/display/audio and installation acceptance stay open. Native evidence is compiled tests, not a newly packaged production exe.

[atomicdeploy]

Rust keycontroller Game settings checkpoint 41956c8 (PR #37). Fixes incomplete known-mode default resets (Color Pattern intro Off, Illuminated10s, Simon3/5/7, Color Order9 colors, Mine Field pulse1s), only for explicit selection and already-advertised fields. Preserves same-mode edits, relay wiring/device policies/unknown data; future board modes retain their own values. Contextual Countdown/Challenge/Presentation fields hide ignored controls; reveal timing follows intro toggle; numeric IDs stay field-bound. Mode menu is numbered with existing icons/details. Toggle and output mapping use readable shared dropdowns; painting output rows no longer reconstructs/drops optional JSON. Warning validation uses the selected new mode defaults; Apply remains narrow, peer-bound and readback-verified. PASS17 minigame tests (110 different-mode transitions,11 layouts at280/740px, visibility, validation, readback and zero-send/unchanged-draft checks), plus5 shared-dropdown keyboard/hover/focus tests and comparison generation/check. Native-only; no firmware/APK build, board commands, app replacement or installed-ASUS acceptance claimed. Existing production/deployment holds and unrelated shell work preserved.

[atomicdeploy]

SSH exec / direct TUI checkpoint: 2e5c9da on the existing PR #37 branch.

• Ordinary authenticated ssh USER@BOARD status and ssh USER@BOARD 'get hostname' requests use the same loop-owned DeviceShellSession/command dispatcher as interactive SSH, Telnet and framed USB.
• ssh -t USER@BOARD tui (or edit) launches the actual contextual TUI directly. Missing PTY produces an actionable failure; resize/navigation/exit use existing owners. Exiting closes the exec channel, not an unexpected second prompt.
• Bounded printable command, no banner/prompt/editor echo for exec, nonzero command failures, no command replay/chaining/OS shell, stdin-EOF-safe output draining before exit status, and no late watch/resize redraw after closure starts.
• Existing authentication/security-revision, maintenance, SCP/SFTP/public-file and default-off inclusion/runtime opt-in policies retained. /api/ssh advertises exec and bounds truthfully.
• tools/test-ssh.ps1, tools/test-shell.ps1, living-contract guard and hash-bound reuse/comparison checks passed. New fixtures compile actual transport/dispatcher/SSH/TUI functions for both roles. Queue/socket/FS/peripheral doubles and OpenSSH-over-stdio are explicitly not encrypted ESP login evidence.
• Canonical ESP32-S3 keycontroller build with all four optional services, existing 16 MiB/OPI/buffered-UART/W5500/both-LED-backend/acknowledged-ISP profile and BLE initialization excluded passed. Raw image 2,734,096 / 3,342,336 bytes (81.80%); static RAM 136,436 bytes, not runtime free heap. SHA-256 6715191bb505fcc587673e0c37c102619ff35d719d79f1e96507882dc0b02ed1.
• Live encrypted SSH one-line commands/exit codes, direct TUI navigation/resize/reconnect, host-key stability and resource/LED coexistence on a separately deployed board remain unverified. No production board/client deployment or actuation occurred in this checkpoint. Issue ESP32-S3 native SSH transport for the shared device shell #33 remains open.

Documentation and exact source/test hashes are in docs/SSH.md and the existing donor evidence/receipt. No concurrent PortableShell integration checkout or vendored component was replaced. This is an SSH-enabled build candidate, not permission to alter a production instance's enabled services or scene.