The editor core runs 2-3 versions ahead of shippable device releases (no
release has shipped; v0.1's hardware gate is still open). Mark done/partial
items across v0.1-v0.7 with [x]/[~], record what landed early (View mode,
d/c operators + text objects, :fmt), and the v0.4 decision to move View off
v/V so Visual can take them.
The 150 MB of images are remanso's image CDN (it reads image bytes straight
out of git as blobs), not offloadable bloat — LFS/filter-repo/git-rm all
break remanso. libgit2 also lacks blobless partial clone. Decision: leave
the repo untouched and pre-seed the SD with a full clone from a computer, so
the device only ever takes the open + incremental fetch/push path. Also
notes the increment-C constraint: stage specific paths (not add_all) so a
media-excluding sparse checkout is safe.
The read-only-attribute theory (and the predicted AM_RDO unlink shim) was
wrong. A diagnostic recursive walk showed every entry writable (ro=false)
and succeeded via path-based deletion, so the real blocker was
std::fs::remove_dir_all's openat/unlinkat/fdopendir usage against esp-idf's
path-based FATFS VFS. Update the increment-A/B checklist accordingly.
Increment A (persistent-clone publish cycle) is hardware-verified: clone +
persistent open + fast-forward push. Mark the follow-up checklist: git module
fold is in progress (A done; B = divergence + AM_RDO unlink shim; C = editor
wiring), tech-doc revision done, PAT-in-flash tracked as open ADR-011. Note
the FAT read-only-delete limitation and the real-notes-repo sizing caveat.
The PAT-in-flash shortcut (ADR-005 v0.1) is safe for the dev's bench unit
but not for a shipped one: it's plaintext in flash, the same token on every
unit, and rotation needs a reflash. ADR-005 decided the auth model but left
provisioning mechanics open.
Capture that as ADR-011 (Proposed/Open): the options (build-time bake →
on-device paste → eFuse-encrypted NVS, per-device fine-grained PAT, GitHub
App) and the likely shape, deferred beyond v0.1. It gates the first non-dev
distribution. Point the Spike 7 postmortem's shortcut entry at it.
The v0.1 technical doc still described the gitoxide/gix plan with an
undecided transport and a 32 KB git_task stack. Bring it in line with
what spike 7 proved:
- gix → libgit2 via the git2 crate (ADR-004 kill-switch fired: no gix push)
- transport settled: HTTPS + PAT over esp-idf mbedTLS, no custom transport
or reqwest/rustls layer needed
- fail-closed cert verification (embedded GitHub roots + PASSTHROUGH)
- git_task stack 32 KB → 96 KB (measured ~67 KB depth); dedicated thread
- persistent-clone + fast-forward is the product flow (spike used a fresh
per-boot throwaway branch); add --all stages deletions
- PAT via libgit2 credential callback, never logged/persisted
Also mark the Spike 7 entry done in the spikes list.
Git now runs on its own 96 KB std::thread and the main-task stack is back
to 12 KB — hardware-verified off-main. Update the follow-up checklist and
the "three bugs" caveat to reflect the completed move.
The certificate_check bypass is retired (real trust-store, hardware-verified
2519ed8) and the product sync transport is decided (HTTPS+PAT, not SSH, since
on-device libgit2 is HTTPS-only). Remaining shortcut is PAT-in-flash.
The full init -> commit -> push over mbedTLS HTTPS now runs on hardware
(verified device-side + via git ls-remote). Documents the three fixes that
got there -- 96 KB main stack, remove-then-rename p_rename, and the utimes
existence-gate that had silently dropped every ODB write -- plus the
shortcuts still standing (cert bypass, PAT-in-flash, SSH-vs-HTTPS remote).
CFLAGS include-injection cascades through the whole esp-idf component
graph (arpa/inet.h -> sys/ioctl.h -> ...), so path 1 is out. Decide
path 2: libgit2 as an esp-idf CMake component with USE_HTTPS=mbedTLS,
which fixes the includes and the TLS backend together.
libgit2 C cross-compiles for xtensa; blocker is missing esp-idf lwIP
headers (arpa/inet.h) because libgit2-sys builds standalone. PSRAM
enabled and hardware-verified.
Postmortem + ADR-004 outcome note + risk-table update: gitoxide has no
HTTP(S) push, so v0.1 falls back to libgit2; the on-device libgit2 <->
mbedtls cross-compile is the next gate.
New docs/postmortems/ folder. The bench card (133 GB SDXC) rejects CMD59
(SPI-mode CRC) as illegal; CMD0/CMD8 succeed, so wiring and firmware are
proven and the fix is a compliant card. Captures the root cause, the
keep-CRC-required decision, and the reusable findings (EPD bus lock, LFN
requirement, R1-byte diagnostic) before the work pauses for hardware.
US-International dead-key accents, slotted after navigation without
renumbering later versions so ADR/qfd/README anchors stay valid. Also
adds a UTF-8-correct buffer groundwork bullet to v0.2.
Spike 14 relies on file deletion, which the roadmap did not list. Add it
explicitly, flagging that a Tracked-file removal must reach the next
Publish's staged set (git rm / add -A, not plain git add .).
Spikes 8-14 are a cross-release display/UX bench batch, not part of the
v0.1 integration gate — only 8 and 9 feed v0.1. Move them out of the v0.1
technical doc into their own log (with a feeds-table and dependency notes),
leaving a pointer behind; link it from the README layout map.
Replace the header/status-bar layout with a full-height writing column
plus an always-visible side panel holding all metadata. Canonicalize the
new region vocabulary in CONTEXT.md (Writing column, Side panel) and retire
header / status line / edit area as terms-to-avoid.
Consequent sweeps: rewrite the Error UX section in side-panel terms and
give keyboard-disconnect a home (⌨ ✗, disconnect-only); drop the "line N"
readout; reconcile the render module ops and region shadow; sweep the
status-line/edit-area wording across the technical, roadmap, qfd, notes,
README, and ADR-003 docs (incl. the ~11→~13 line-count figure).
The product doc opened notes.md from /sd/local, the permanently-private
scope where Publish is unavailable — contradicting the headline Ctrl-G
flow and every other doc. Point it at the Tracked working copy.
Latency is the dominant signal for W1 (sub-second response to typing)
and on a typing-focused device the reMarkable 2 + Type Folio's e-ink
delay disqualifies a 2. Updates the TikZ perception array, the table
row + rationale, and the totals narrative (reMarkable 45 → 44, ranking
unchanged).
Two stale bits in §4's preamble. (a) "15×15 roof matrix" still
referenced H14's pre-retirement column count — corrected to 14×14.
(b) The symbol legend named classical QFD glyphs (◎ ○ × ⊗) but
quality-house.md's roof actually renders ASCII (++ + − −−). Both
listings now lead with the ASCII glyphs that match the source of
truth, with classical equivalents kept in parens.
The H10-H15 mild conflict node still pointed at C-10-15 (H15's
pre-retirement column). H14's removal renumbered H15 to column 14,
so the roof coordinate becomes C-10-14. Missed in the earlier
sweep — comment line already says "H10-H15" so the intent was
unchanged, only the cell coord was stale.
The doc previously conflated functions (transformations the device
performs) with characteristics (measurable attributes). Surfacing
Functions as their own ontology layer makes HOW names — which pack
a function reference plus an attribute — readable without function
definitions staying implicit.
- new GLOSSARY.md at root: 5-layer ontology stack (WHAT / Function /
Characteristic / Metric+Unit / Target), peer to CONTEXT.md
(device-specific vocabulary)
- qfd.md §2 opens with a Functions inventory (Type, Save, Publish,
Recover, Boot, Provision); Render and Reconnect noted as
sub-functions; Provision flagged as build-time-only in v0.1
- H1 "Keypress → glyph latency" → "Type latency (keypress → glyph)"
- H4 "Cold boot → cursor ready" → "Boot latency (cold)"
(the arrow transformation moves to the Functions inventory; the
parenthetical keeps the residual qualifier)
- cascade through §3 priority list, §6 critical-performance-budget
rows for H1/H4, §8 inconsistencies, and quality-house.md TikZ
column labels
Matrix cell strengths held; no Σ recompute.
Module count / public-API surface is a static source-code property,
not a runtime function nor an artifact characteristic like H10 binary
or H15 build time. It was a refactor-leverage proxy for W9 — proxies
of proxies belong in the ADRs and the component matrix, not in the
HoQ. Removed from §2, §5 matrix, §4 conflict list, and the C12
overloaded-list mention; basement Σ total drops 1674 → 1557 so rel%
recomputed in quality-house.md.
The post's job is to land the timing question and the apocalypse
reframe — Wi-Fi rationale, optimisation diversions, and generalising
reflections were overexpansion. Cut.
The user-meaningful moment of a Publish is when the local commit
lands (~0.2 s), not when the push completes (~5–10 s). New principle
in CONTEXT.md, instantiated in v0.1 product doc with staged status
transitions and a corrected on-demand Wi-Fi status example.
Long-form rationale for the "durability before delivery" framing —
why a 10-second network operation in response to a single keystroke
doesn't have to feel slow. Establishes docs/notes/ as the home for
shareable design rationale (not authoritative spec).
Always-on station mode burns ~410 mAh/day on the radio alone; on-demand
drops that to ~25 mAh/day at 10 Publishes/day. Radio comes up on Ctrl-G
with a 10 s association timeout, holds for a ~90 s grace window after
each Publish, then tears down. SNTP cached up to 24 h to avoid
re-querying every Publish.
Also removes stale SoftAP provisioning bullets that contradicted the
"v0.1 has no provisioning module" stance later in the same doc.
The user's mental model of Publish is a Google Doc backed by git, not a
curated commit log. Branches fall out of scope under that framing; the
device tracks one stream of work on whichever branch the remote was
cloned on, and never switches. Drops :Gbranch from v0.7 to match.
Captures "I can carry the device and write away from a desk" as a
distinct WHAT from W11 (multi-day battery), weight 8. Recomputed
basement Σ (1546→1674); H8 climbs #6→#3 in the §3 priority list as
its voter base widens to include W14, and H12 enters the top six at
#4. §6's "(b) narrow voter base" override for H8 is retired and a new
§7 ADR-008 vs W11+W14 unresolved-conflict bullet records that wall
power in v0.1 now disappoints two WHATs, not one.
reMarkable 2 with Type Folio tested less responsive than Freewrite Smart
Typewriter (Sailfish). With Smart at 3, reMarkable drops one notch to 2.
Total: reMarkable 42 → 41, now tied with Smart at 41.
Sailfish ships on Smart Typewriter Gen 3 as well as Traveler, so the
same firmware-driven bumps apply: W1 2→3 (Smart still trails Traveler
by one notch on panel size), W5 3→4, W9 1→2. Smart total 38 → 41.
Project gets a proper name. Replaces "Ours" / "Our product" placeholders
in the QFD perception zone and the working title "typewriter" in
README/CONTEXT headers and the npm name. "Typewriter" the category
noun (the writing-machine concept) stays unchanged — Typoena is the
brand, typewriter is the category. SoftAP SSID typewriter-setup and the
repo directory are deliberately left as-is.
The Sailfish firmware (2025-11-19) rewrote the Freewrite Traveler OS in
Rust, cut keystroke latency 40–100 %, and trimmed power draw -30 %
typing / -50 % idle. Three rows are bumped: W1 3→4, W5 3→4, W9 1→2.
Freewrite now ties reMarkable at 42; Pomera still #2 at 45.
text width={\qfdWhatW - 0.2}cm doesn't parse — the braces don't
evaluate the arithmetic, so TikZ sees "4.6 - 0.2cm" which isn't a
valid dimension. Pre-compute the narrower width with
\pgfmathsetmacro and reference the resulting macro instead.
Text box anchored at qfdLeftEdge + 0.1 with width qfdWhatW overflowed
0.1 cm past the cell's right edge into the Weight column, clipping
trailing words like "the", "lag,", "hob-". Shrink the box by 0.2 cm
so it has 0.1 cm clearance on both sides.
Spell out the Normal-vs-Insert distinction (relative with current line
absolute / absolute everywhere) so it's clear the gutter behaves like
Neovim's number+relativenumber combo, not flat absolute numbering.
Each product now gets a profile line across all WHATs using the same
colour and dash pattern its legend entry already advertises, so the
shape of each competitor's strengths/weaknesses is readable at a glance
instead of having to mentally connect the dots.
Raise the header zone (qfdHdrH 3.2 → 4.2) so rotated HOW labels stop
crossing into the roof diamond grid, and wrap the perception title onto
two lines via text width so it stays inside its zone instead of bleeding
left over the H14/H15 column labels.
Drop the duplicated 13x15 strength matrix and 15x15 roof tables from
qfd.md; the same data already lives in quality-house.md's TikZ source.
qfd.md §3/§4 keep the narrative reading (priority list, conflict list)
and point to quality-house.md for the cells and basement sums. Both
files' regenerate/maintenance notes flipped to reflect the new contract.
