Record that persistence is now implemented and hardware-verified, and correct
the crash-recovery rule everywhere it appeared as "just promote the tmp": a
crash during the tmp write leaves a partial tmp, so recovery keeps the
committed target when both files are present and only promotes the tmp when
the target was already unlinked. Also fix the stale README heading that still
said the SD was on shared SPI2.
Document the shared-bus arbitration decision: rather than rework the
proven EPD SPI layer and add a cross-thread mutex on the save path, the
SD moves to a dedicated SPI3. Update the boot sequence, risk table,
Spike 3 postmortem follow-up, hardware overview, and firmware README.
The v0.1 technical doc still described the gitoxide/gix plan with an
undecided transport and a 32 KB git_task stack. Bring it in line with
what spike 7 proved:
- gix → libgit2 via the git2 crate (ADR-004 kill-switch fired: no gix push)
- transport settled: HTTPS + PAT over esp-idf mbedTLS, no custom transport
or reqwest/rustls layer needed
- fail-closed cert verification (embedded GitHub roots + PASSTHROUGH)
- git_task stack 32 KB → 96 KB (measured ~67 KB depth); dedicated thread
- persistent-clone + fast-forward is the product flow (spike used a fresh
per-boot throwaway branch); add --all stages deletions
- PAT via libgit2 credential callback, never logged/persisted
Also mark the Spike 7 entry done in the spikes list.
Postmortem + ADR-004 outcome note + risk-table update: gitoxide has no
HTTP(S) push, so v0.1 falls back to libgit2; the on-device libgit2 <->
mbedtls cross-compile is the next gate.
Spikes 8-14 are a cross-release display/UX bench batch, not part of the
v0.1 integration gate — only 8 and 9 feed v0.1. Move them out of the v0.1
technical doc into their own log (with a feeds-table and dependency notes),
leaving a pointer behind; link it from the README layout map.
Replace the header/status-bar layout with a full-height writing column
plus an always-visible side panel holding all metadata. Canonicalize the
new region vocabulary in CONTEXT.md (Writing column, Side panel) and retire
header / status line / edit area as terms-to-avoid.
Consequent sweeps: rewrite the Error UX section in side-panel terms and
give keyboard-disconnect a home (⌨ ✗, disconnect-only); drop the "line N"
readout; reconcile the render module ops and region shadow; sweep the
status-line/edit-area wording across the technical, roadmap, qfd, notes,
README, and ADR-003 docs (incl. the ~11→~13 line-count figure).
Always-on station mode burns ~410 mAh/day on the radio alone; on-demand
drops that to ~25 mAh/day at 10 Publishes/day. Radio comes up on Ctrl-G
with a 10 s association timeout, holds for a ~90 s grace window after
each Publish, then tears down. SNTP cached up to 24 h to avoid
re-querying every Publish.
Also removes stale SoftAP provisioning bullets that contradicted the
"v0.1 has no provisioning module" stance later in the same doc.
Two coupled changes that emerged from one /deep-design session, both touching
the same v0.1 paragraphs:
(1) Align Ctrl-G with the user's existing gct shell alias: git add . ->
short-circuit if nothing staged -> commit with an ISO-8601 timestamp (no
wip prefix) -> push -> on push failure, git pull --no-edit then retry.
Atomic from the user's view. Recorded as ADR-010. The previously-planned
v0.7 commit-message-prompt item is removed; it contradicts the
gct/timestamp model.
(2) Replace the v0.1 captive-portal first-run with build-time env-var
config: build.rs reads TW_* env vars and embeds them as constants. No
NVS read, no LittleFS mount, no AP mode, no HTTP server. The v0.1
target user is the dev themselves; the first release usable by non-dev
users is v0.9, and the v0.9 settings entry is reframed accordingly.
ADR-005 updated to describe the build-time path and the v0.9 migration.
The two changes share files because the v0.1 spec is one interlocked
document; splitting further would require line-level surgery without
improving auditability.
Adds a companion-docs header and inline ADR jumps on every load-bearing
choice (ADR-001 runtime, ADR-002 UI, ADR-004 git kill-switch, ADR-006
concurrency, ADR-007 storage, ADR-009 USB-host gate). Render module
also points at qfd §3 to anchor "why these functions rank top."
Strip-aspect 5.79" panel (792×272) replaces the page-shaped 7.5" choice.
Reflows the v0.1 screen layout, framebuffer memory budget, and spike 2
acceptance to validate the SSD1683-class controller path or fall back to
a ~300 LoC custom embedded-hal driver.
