Record that persistence is now implemented and hardware-verified, and correct
the crash-recovery rule everywhere it appeared as "just promote the tmp": a
crash during the tmp write leaves a partial tmp, so recovery keeps the
committed target when both files are present and only promotes the tmp when
the target was already unlinked. Also fix the stale README heading that still
said the SD was on shared SPI2.
Document the shared-bus arbitration decision: rather than rework the
proven EPD SPI layer and add a cross-thread mutex on the save path, the
SD moves to a dedicated SPI3. Update the boot sequence, risk table,
Spike 3 postmortem follow-up, hardware overview, and firmware README.
Mark Spike 3 resolved (genuine 32 GB SDHC mounts, round-trips clean on the
shared SPI2 bus; the 133 GB SDXC's CMD59 rejection was the sole fault).
Capture the FatFS f_rename caveat and the ≤32 GB card-compatibility note in
ADR-007, the resolution in the postmortem, and the verified writeup in the
firmware README.
Bare-folder links (e.g. docs/postmortems/) only resolve on GitHub's
auto-render; retarget them to the folder's README.md so they open a
real file in any markdown viewer.
The PAT-in-flash shortcut (ADR-005 v0.1) is safe for the dev's bench unit
but not for a shipped one: it's plaintext in flash, the same token on every
unit, and rotation needs a reflash. ADR-005 decided the auth model but left
provisioning mechanics open.
Capture that as ADR-011 (Proposed/Open): the options (build-time bake →
on-device paste → eFuse-encrypted NVS, per-device fine-grained PAT, GitHub
App) and the likely shape, deferred beyond v0.1. It gates the first non-dev
distribution. Point the Spike 7 postmortem's shortcut entry at it.
Postmortem + ADR-004 outcome note + risk-table update: gitoxide has no
HTTP(S) push, so v0.1 falls back to libgit2; the on-device libgit2 <->
mbedtls cross-compile is the next gate.
Replace the header/status-bar layout with a full-height writing column
plus an always-visible side panel holding all metadata. Canonicalize the
new region vocabulary in CONTEXT.md (Writing column, Side panel) and retire
header / status line / edit area as terms-to-avoid.
Consequent sweeps: rewrite the Error UX section in side-panel terms and
give keyboard-disconnect a home (⌨ ✗, disconnect-only); drop the "line N"
readout; reconcile the render module ops and region shadow; sweep the
status-line/edit-area wording across the technical, roadmap, qfd, notes,
README, and ADR-003 docs (incl. the ~11→~13 line-count figure).
The old ADR documented the specific panel choice (GDEY0579T93 + DESPI-c579)
as if it were a freshly weighed option, but the hardware was already on
hand — the real architectural decision was choosing the medium (e-ink over
FSTN graphical / Sharp Memory LCD / OLED-TFT). Rewrite the ADR around the
medium with the panel as instantiation, note the Freewrite Alpha (2023)
data point as honest expectation-setting, and propagate the anchor /
narrative changes through qfd.md, v0.1-mvp-product.md, and README.md.
Two coupled changes that emerged from one /deep-design session, both touching
the same v0.1 paragraphs:
(1) Align Ctrl-G with the user's existing gct shell alias: git add . ->
short-circuit if nothing staged -> commit with an ISO-8601 timestamp (no
wip prefix) -> push -> on push failure, git pull --no-edit then retry.
Atomic from the user's view. Recorded as ADR-010. The previously-planned
v0.7 commit-message-prompt item is removed; it contradicts the
gct/timestamp model.
(2) Replace the v0.1 captive-portal first-run with build-time env-var
config: build.rs reads TW_* env vars and embeds them as constants. No
NVS read, no LittleFS mount, no AP mode, no HTTP server. The v0.1
target user is the dev themselves; the first release usable by non-dev
users is v0.9, and the v0.9 settings entry is reframed accordingly.
ADR-005 updated to describe the build-time path and the v0.9 migration.
The two changes share files because the v0.1 spec is one interlocked
document; splitting further would require line-level surgery without
improving auditability.
CONTEXT.md fixes the project's user-facing vocabulary (Tracked, Local,
Save, Publish) and the principles that fall out of those definitions
(the device is a writing tool, not a sync engine; it does no git work
the user did not explicitly request). README's file-scopes section and
repo-layout listing point at the new glossary so a first-time reader
lands on canonical definitions, and the ADR log carries an inbound link
so future ADRs can rely on the same terms.
The original row collapsed C and C++ together, but they trade differently
on the ESP-IDF target (RAII, generics, binary size, exception story). Split
them so the language-and-runtime decision actually reflects what was
considered.
Adds inline pointers from ADR-007 (storage) to the v0.1 technical
persistence + file-layout sections, from ADR-008 (power) to the v0.1
out-of-scope and roadmap v0.8, and from ADR-009 (keyboard) to spike 4
in the v0.1 technical bring-up order.
Adds a "Related docs" header at the top of adr.md and inline "See also"
pointers from ADR-001 (binary/build tradeoffs → qfd §7) and ADR-002
(render module → v0.1 technical, top H1/H2 functions → qfd §3). Makes
the design-doc set walkable instead of a flat list.
Prior text said "~40 KB of stack space"; the v0.1 technical design's
task table sums to 76 KB (usb 8 + wifi 8 + ui 16 + render 12 + git 32).
Also widens the std::thread stack-cost note from a flat 8 KB to 8–32 KB
to match the per-task budget. No design change — 76 KB still fits
comfortably in the ESP32-S3's 512 KB internal SRAM.
