The Ignored zconf.h Incident Was a Release-Provenance Failure
The V133A isolated workspace contained synchronized feature files, but Git staging stopped because a required managed-component zconf.h was intentionally ignored.
firmware release engineering
A Known-Good Binary Is a Release Asset, Not a Temporary Build
The clearest audio build could have disappeared under the next firmware experiment if it remained only a file in a working build directory.
I Validate an ESP32-S3 Image Before I Let It Touch the Phone
A successful linker exit does not prove the produced file is the intended target image or that its metadata/checksum are sane.
Firmware Acceptance Should End in an Observable ACTIVE State
Download success and reboot success are intermediate states; the fleet needs to know what image is actually running and whether it passed the device acceptance path.
Dual OTA Slots Need a First-Boot Acceptance State
Writing a new image into an inactive slot proves only that bytes were stored; it does not prove the application is safe to keep.
Partition Table, Bootloader and Security Epoch Are Different Release Classes
Not every firmware-related change is safe to distribute through the same application OTA endpoint.
OTA Installation Must Lose to an Active Voice Call
A voice device can be idle from the server perspective while a user is in an active SIP conversation that must not be interrupted by an update.
A Sticky Heartbeat Result Can Rewrite the Wrong OTA Story
A device heartbeat may carry the last OTA result after the server has already assigned a newer release, so an unscoped success/failure flag can be applied to the wrong release.
Why I Chose Detached ECDSA P-256 Signatures for Production OTA
Production needed a release artifact that the server and device could verify without embedding a private signing secret into either runtime.
SHA-256 Proves Integrity, Not Who Authorized the Firmware
A manifest checksum can detect corruption but cannot distinguish an authorized release from a malicious artifact if an attacker can replace both file and checksum.
STABLE Should Mean a Device Actually Ran the Release
A release can pass CI, upload and signature verification yet still fail on the real device path that matters.
A Delivery ZIP Is Not Reproducible Until I Rebuild It After Extraction
A package can look complete on the creator machine while omitting an ignored source, generated dependency or build instruction that the recipient needs.
Why I Preserve ELF, MAP, Binaries and Failed Build Logs
Build artifacts that looked obsolete became the only evidence for reconstructing which toolchain, sections and symbols belonged to an earlier working or failing state.
App-Only Flashing at 0x20000 Protected the State I Was Not Trying to Change
Audio iteration needed to replace application code without repeatedly erasing NVS, bootloader, partition metadata or other persistent device state.
V132A Taught Me That Binary Truth and Source Truth Are Different
The device had a proven clear-audio application image before the repository had been proven to rebuild the same product behavior from a clean checkout.
Rollback Safety Ends Where NVS Compatibility Ends
An older application image is not a safe rollback target if the newer image has already migrated persistent configuration into a format the old code cannot understand.
Firmware Compatibility Is More Than a Version String
A numerically newer release can still be unsafe for a device with a different hardware revision, partition generation, bootloader generation or configuration schema.
A Factory-Only Partition Layout Cannot Magically Become Dual-Slot OTA
The earlier firmware context used a factory application partition and had no otadata, ota_0 or ota_1, yet production OTA required dual application slots.
Canary and Stable Are Different Release States
A release that is available to one test device has not earned the same operational meaning as a release intended for the fleet.
Version Names Are Labels; Hashes and Commits Are Identity
Names such as V132A and V133A were convenient in conversation but too weak to prove which bytes or source tree were actually under test.
The Firmware Signing Private Key Does Not Belong on the OTA Server
If the same runtime host that stores and serves firmware also holds the signing private key, compromise of that host can become compromise of release authority.
Hidden ../.. Source Paths Can Make a Broken Repository Look Healthy
A repository can appear self-contained when relative include or source paths escape into an old workstation tree that happens to contain missing files.
A Clean Checkout Is the Build Test That Matters
A firmware tree can build for months on one workstation while quietly depending on files that are not in the repository.
V133A Was Safe Because the Power Feature Could Not Rewrite Golden Main
A physical power-toggle feature needed to move forward without allowing an unrelated control change to destabilize the proven clear-audio baseline.
Secure Boot and Flash Encryption Should Not Be Burned into Prototype eFuses Casually
Prototype recovery work still depended on flexible flashing and rollback, while production security eventually needs stronger hardware enforcement.