firestarter 3.2.0b1__tar.gz → 3.2.1__tar.gz

{firestarter-3.2.0b1/firestarter.egg-info → firestarter-3.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: firestarter
-Version: 3.2.0b1
+Version: 3.2.1
 Summary: EPROM programmer software for the Relatively Universal ROM Programmer
 Author-email: Henrik Olsson <henols@gmail.com>
 Project-URL: Homepage, https://github.com/henols/firestarter_app
@@ -37,6 +37,7 @@ Requires-Dist: syrupy<7,>=5.0; extra == "test"
 Requires-Dist: ruff>=0.15.14; extra == "test"
 Requires-Dist: mypy<3,>=2.1.0; extra == "test"
 Requires-Dist: pytest-cov>=7.1.0; extra == "test"
+Requires-Dist: pytest-xdist>=3.6; extra == "test"
 Requires-Dist: types-pyserial>=3.5.0.20260519; extra == "test"
 Dynamic: license-file
 

{firestarter-3.2.0b1 → firestarter-3.2.1}/firestarter/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '3.2.0b1'
-__version_tuple__ = version_tuple = (3, 2, 0, 'b1')
+__version__ = version = '3.2.1'
+__version_tuple__ = version_tuple = (3, 2, 1)
 
-__commit_id__ = commit_id = 'gf7d80f3'
+__commit_id__ = commit_id = 'g4526a89'

{firestarter-3.2.0b1 → firestarter-3.2.1}/firestarter/chip_resolver.py

@@ -12,6 +12,8 @@ from typing import Any
 from firestarter.database import EpromDatabase
 from firestarter.exceptions import ChipNotFoundError, ChipNotImplementedError
 
+_NON_ZERO_WIRE_FIELDS = ("memory-size", "pin-count", "vpp_mv")
+
 
 def resolve_chip(name: str, db: EpromDatabase | None = None) -> dict[str, Any]:
     """Resolve a chip name to its programmer-config dict.
@@ -74,4 +76,14 @@ def resolve_chip(name: str, db: EpromDatabase | None = None) -> dict[str, Any]:
     data = db.convert_to_programmer(full) if full else None
     if not data:
         raise ChipNotFoundError(name)
+
+    # The firmware refuses a memory command whose memory-size, pin-count or
+    # vpp_mv is 0, with the same 'Bad JSON' answer that old firmware gives.
+    # No shipped row has a 0 here; a user database override can.
+    zero_fields = [key for key in _NON_ZERO_WIRE_FIELDS if not data.get(key)]
+    if zero_fields:
+        raise ChipNotImplementedError(
+            f"{name}: the chip entry gives 0 for {', '.join(zero_fields)}. "
+            "The programmer cannot use a value of 0 there."
+        )
     return data

{firestarter-3.2.0b1 → firestarter-3.2.1}/firestarter/cli_handlers.py

@@ -4,7 +4,6 @@ This module is the production CLI surface; main.py re-exports `cli` as `main`
 for the console-script entry point.
 """
 
-import datetime
 import functools
 import hashlib
 import json
@@ -60,6 +59,10 @@ from firestarter.chip_test import (
 )
 from firestarter.config import ConfigManager, get_config_dir
 from firestarter.constants import (
+    CONFIG_R1_MAX,
+    CONFIG_R1_MIN,
+    CONFIG_R2_MAX,
+    CONFIG_R2_MIN,
     FIRESTARTER_RELEASES_URL,
     FLAG_CHIP_ENABLE,
     FLAG_OUTPUT_ENABLE,
@@ -102,6 +105,7 @@ from firestarter.protection_readability import (
     protection_gate_for_entry,
 )
 from firestarter.sdp_capability import SDP_PROTOCOL_ID, sdp_capability
+from firestarter.timestamps import iso_cet
 
 logger = logging.getLogger("Firestarter")
 
@@ -564,6 +568,9 @@ def read(
 ) -> None:
     """Reads the content from an EPROM."""
     eprom_data = resolve_chip(eprom, db=app.db)
+    refusal = _address_size_refusal_exit_code(eprom=eprom, address=address, size=size)
+    if refusal is not None:
+        sys.exit(refusal)
     ok = app.eprom_operator.read_eprom(
         eprom,
         eprom_data,
@@ -999,6 +1006,41 @@ def write(
     sys.exit(1)
 
 
+_SIZE_TOO_SMALL_REFUSAL = "{eprom}: refused -- the size {size!r} is less than 1 byte."
+_EMPTY_INPUT_FILE_REFUSAL = "{eprom}: refused -- the input file is empty."
+_NEGATIVE_SECTOR_ADDRESS_REFUSAL = (
+    "{eprom}: refused -- the sector address {address!r} is negative."
+)
+
+
+def _address_size_refusal_exit_code(
+    *, eprom: str, address: str | None, size: str | None
+) -> int | None:
+    """Refuse a negative start address or a size below 1 byte before the
+    serial port opens.
+
+    The firmware refuses both at setup, with the same 'Bad JSON' answer that
+    firmware too old for this CLI gives, so without this check the operator
+    sees only "no programmer found". Returns 2 to refuse with, or `None`.
+    A malformed string is not refused here: `_setup_operation`'s own parse
+    handling still owns that error.
+    """
+    try:
+        write_blank_guard.require_non_negative_address(eprom, address)
+    except NegativeStartAddressError as e:
+        click.echo(str(e))
+        return 2
+    if size is not None:
+        try:
+            parsed_size = parse_size(size)
+        except ValueError:
+            return None
+        if parsed_size is not None and parsed_size < 1:
+            click.echo(_SIZE_TOO_SMALL_REFUSAL.format(eprom=eprom.upper(), size=size))
+            return 2
+    return None
+
+
 def _region_refusal_exit_code(
     *,
     eprom: str,
@@ -1040,7 +1082,14 @@ def _region_refusal_exit_code(
     also exit 2, via the existing setup-failure path. Returning `None` here
     lets that path run rather than parsing the string a second time with
     different error handling.
+
+    A negative start address, a size below 1 byte and an empty input file
+    are refused here too: the firmware refuses a zero-length region at
+    setup.
     """
+    refusal = _address_size_refusal_exit_code(eprom=eprom, address=address, size=size)
+    if refusal is not None:
+        return refusal
     try:
         start = parse_address(address) if address is not None else 0
     except ValueError:
@@ -1098,6 +1147,10 @@ def _region_refusal_exit_code(
     else:
         length = None
 
+    if explicit_size is None and input_file is not None and length == 0:
+        click.echo(_EMPTY_INPUT_FILE_REFUSAL.format(eprom=eprom.upper()))
+        return 2
+
     if length is not None and mem_size is not None and start + length > mem_size:
         click.echo(
             f"{eprom.upper()}: refused -- the region 0x{start:X}-"
@@ -1193,8 +1246,9 @@ def verify(
     Exits 0 on a match, 1 on a mismatch, 2 on a transport, hardware, setup,
     or region failure. The three are distinct: a transport failure is not
     reported as a mismatch, and a region refusal -- an explicit --size
-    longer than the input file, or a region running past the chip's end --
-    is reported before the serial port ever opens.
+    longer than the input file, a region running past the chip's end, a
+    negative address, or an empty region -- is reported before the serial
+    port ever opens.
 
     Without --size, the compared region is the input file's own length;
     with it, --size wins.
@@ -1255,8 +1309,9 @@ def blank(
     Exits 0 when blank, 1 when at least one byte is not blank, 2 on a
     transport, hardware, setup, or region failure. The three are distinct:
     a transport failure is not reported as a not-blank verdict, and a
-    region refusal -- a region running past the chip's end -- is reported
-    before the serial port ever opens.
+    region refusal -- a region running past the chip's end, a negative
+    address, or a size of 0 -- is reported before the serial port ever
+    opens.
 
     Without --size, the checked region is the whole chip; with it, --size
     wins.
@@ -1352,6 +1407,18 @@ def erase(
     if sector_blank_refusal is not None:
         sys.exit(sector_blank_refusal)
 
+    try:
+        negative_sector = (parse_address(sector_address) or 0) < 0
+    except ValueError:
+        negative_sector = False
+    if negative_sector:
+        click.echo(
+            _NEGATIVE_SECTOR_ADDRESS_REFUSAL.format(
+                eprom=eprom.upper(), address=sector_address
+            )
+        )
+        sys.exit(2)
+
     eprom_data = resolve_chip(eprom, db=app.db)
 
     if flash4_erase_gate.is_flash4(eprom_data):
@@ -1492,13 +1559,12 @@ def hw(app: AppContext) -> None:
 
 
 _BANDGAP_NOMINAL_MV = 1100
-_DIVIDER_GAIN = 314000 / 44000
 
 
 @cli.command(name="cal")
 @click.option(
     "--vcc",
-    type=float,
+    type=click.FloatRange(min=0, min_open=True),
     default=None,
     metavar="VOLTS",
     help="Calibrate using a multimeter reading of the 5V pin, e.g. --vcc 5.09",
@@ -1545,7 +1611,9 @@ def cal(app: AppContext, vcc: float | None, reset: bool) -> None:
             click.echo(
                 "Calibration refused. The result was outside 1000-1200 mV, which "
                 "means the reading does not match this board. Check that the "
-                "multimeter is on the 5V pin and that the value is in volts."
+                "multimeter is on the 5V pin and that the value is in volts. "
+                "A py32f071 board has no bandgap calibration and always "
+                "refuses it."
             )
             sys.exit(1)
         after = app.hardware_manager.read_calibration()
@@ -1599,17 +1667,17 @@ def _echo_calibration_effect(bandgap_mv: int) -> None:
     "-r1",
     "--r16",
     "r16",
-    type=int,
+    type=click.IntRange(CONFIG_R1_MIN, CONFIG_R1_MAX),
     default=None,
-    help="Set R16 resistance, resistor connected to VPE",
+    help="Set R16 resistance in ohms, resistor connected to VPE.",
 )
 @click.option(
     "-r2",
     "--r14r15",
     "r14r15",
-    type=int,
+    type=click.IntRange(CONFIG_R2_MIN, CONFIG_R2_MAX),
     default=None,
-    help="Set R14/R15 resistance, resistors connected to GND",
+    help="Set R14/R15 resistance in ohms, resistors connected to GND.",
 )
 @click.pass_obj
 @map_typed_errors
@@ -1623,6 +1691,8 @@ def config(
     # --rev is an IntRange: '--rev 2.2' used to go through float() and int()
     # and silently select code 2 (Rev 2.0). Click now refuses it before any
     # serial byte is sent, and refuses a code the firmware does not define.
+    # -r1 and -r2 are IntRanges for the same reason: the firmware refuses a
+    # value outside its band, so the host refuses it before the port opens.
     ok = app.hardware_manager.set_hardware_config(
         rev, r16, r14r15, flags=_build_op_flags()
     )
@@ -1838,10 +1908,10 @@ def fw(
 
             print(_json.dumps(releases, indent=2))
         else:
-            print(f"{'Version':<12} {'Channel':<14} {'Published':<22} Asset URL")
+            print(f"{'Version':<12} {'Channel':<14} {'Published':<25} Asset URL")
             for r in releases:
                 print(
-                    f"{r['version']:<12} {r['channel']:<14} {r['published']:<22} {r['asset_url']}"  # noqa: E501
+                    f"{r['version']:<12} {r['channel']:<14} {r['published']:<25} {r['asset_url']}"  # noqa: E501
                 )
             if not releases:
                 print(f"No releases found for board {board}.")
@@ -1989,6 +2059,9 @@ def dev_read(
 ) -> None:
     """Reads the content from an EPROM and prints data to console."""
     eprom_data = resolve_chip(eprom, db=app.db)
+    refusal = _address_size_refusal_exit_code(eprom=eprom, address=address, size=size)
+    if refusal is not None:
+        sys.exit(refusal)
     ok = app.eprom_operator.dev_read_eprom(
         eprom,
         eprom_data,
@@ -2565,7 +2638,7 @@ def _write_artifact(
     out_path.mkdir(parents=True, exist_ok=True)
 
     artifact: Dict[str, Any] = {  # noqa: UP006
-        "generated": datetime.datetime.now(datetime.UTC).strftime("%Y-%m-%dT%H:%M:%SZ"),
+        "generated": iso_cet(),
         "harness_version": "71",
         "cells": cells,
     }

{firestarter-3.2.0b1 → firestarter-3.2.1}/firestarter/codec.py

@@ -40,6 +40,12 @@ from firestarter.messages import (
 
 logger = logging.getLogger("Codec")
 
+# Older, shorter forms of fixed-width acks that the host still accepts. The
+# value is the legacy param-region length; the decoder reads only the leading
+# catalog params that fit in it. MSG_OK_CFG gained the trailing u16 bandgap in
+# 3.1.0b4, so the 3.1.0 stable firmware still sends the 9-byte form.
+_LEGACY_PARAM_BYTES = {MSG_OK_CFG: 9}
+
 # REVISION_* byte → silkscreen-string mapping for MSG_OK_REV rendering.
 # Mirrors firmware enum at firestarter/include/rurp_shield.h. Lookup-via-dict.get()
 # so unknown bytes fall back to "Rev{n}" instead of raising.
@@ -71,9 +77,13 @@ def format_message(msg_id: int, params: List[Any], entry: MessageDef) -> str | N
       effective!=0xFF → "Rev{effective}, Override HW: Rev{physical}"
 
     P-03 MSG_OK_CFG  — params[0]=r1 u32, params[1]=r2 u32, params[2]=override u8,
-                       params[3]=bandgap_mv u16 (v1.43)
-      override==0xFF → "R1: {r1}, R2: {r2}"
+                       params[3]=bandgap_mv u16 (absent on firmware before 3.1.0b4)
+      override==0xFF → "R1: {r1}, R2: {r2}, Bandgap: {n} mV"
       override!=0xFF → "R1: {r1}, R2: {r2}, Override HW: {silkscreen_str}, Bandgap: {n} mV"
+      The Bandgap clause is always present when the ack carries the field:
+      HardwareManager.read_calibration keys on it. The 9-byte form from older
+      firmware has no bandgap, so it renders without the Bandgap clause, and
+      read_calibration reports that firmware as too old.
       Override clause now routes through
       _REVISION_SILKSCREEN so the same byte that surfaces as "Rev 2.0-class"
       via MSG_OK_REV no longer surfaces as "Rev2" on the adjacent ack line.
@@ -96,8 +106,8 @@ def format_message(msg_id: int, params: List[Any], entry: MessageDef) -> str | N
         eff_str = _REVISION_SILKSCREEN.get(effective, f"Rev{effective}")
         return f"{eff_str}, Override HW: {phys_str}"
 
-    if msg_id == MSG_OK_CFG and len(params) == 4:
-        r1, r2, override, bandgap_mv = params[0], params[1], params[2], params[3]
+    if msg_id == MSG_OK_CFG and len(params) in (3, 4):
+        r1, r2, override = params[0], params[1], params[2]
         head = f"R1: {r1}, R2: {r2}"
         if override != 0xFF:
             # Route the override byte through
@@ -106,9 +116,12 @@ def format_message(msg_id: int, params: List[Any], entry: MessageDef) -> str | N
             # No-space "Rev{n}" fallback mirrors the MSG_OK_REV branch shape.
             override_str = _REVISION_SILKSCREEN.get(override, f"Rev{override}")
             head += f", Override HW: {override_str}"
+        if len(params) == 3:
+            # Firmware before 3.1.0b4 sends no bandgap field.
+            return head
         # v1.43 appended the calibrated reference. Rendered last so the
         # override clause keeps the position every prior release put it in.
-        return f"{head}, Bandgap: {bandgap_mv} mV"
+        return f"{head}, Bandgap: {params[3]} mV"
 
     # Silkscreen-aware rendering for the two
     # boot-time INFO surfaces that carry the same revision byte as
@@ -230,18 +243,27 @@ def decode_id_frame(frame_len: int, body: bytes) -> LogMessage | None:
     # entries carry param_bytes == -1 in the catalog; for those we
     # cannot pre-validate, but _decode_param will surface any overrun
     # via IndexError below.
-    if entry.param_bytes >= 0 and len(params_bytes) != entry.param_bytes:
+    legacy_len = _LEGACY_PARAM_BYTES.get(msg_id)
+    is_legacy = legacy_len is not None and len(params_bytes) == legacy_len
+    if (
+        entry.param_bytes >= 0
+        and len(params_bytes) != entry.param_bytes
+        and not is_legacy
+    ):
         logger.warning(
             f"Param shape mismatch for ID 0x{msg_id:02x} ({entry.name}): "
             f"expected {entry.param_bytes} bytes, got {len(params_bytes)}"
         )
         return None
 
-    # Decode each param per the catalog grammar.
+    # Decode each param per the catalog grammar. A legacy short form stops
+    # at the end of its shorter param region.
     values: List[Any] = []  # noqa: UP006
     cursor = 0
     try:
         for ptype, _prender in entry.params:
+            if is_legacy and cursor >= len(params_bytes):
+                break
             value, cursor = _decode_param(ptype, params_bytes, cursor)
             values.append(value)
     except (IndexError, struct.error, ValueError) as exc:

{firestarter-3.2.0b1 → firestarter-3.2.1}/firestarter/constants.py

@@ -215,3 +215,15 @@ REVISION_2_1 = 0x03  # via EEPROM override only — ADC cannot distinguish
 REVISION_2_2 = 0x04  # via EEPROM override only — ADC cannot distinguish
 REVISION_2_3 = 0x05  # R41=10k physical detect
 REVISION_UNKNOWN = 0xFE  # ADC band-gap or pre-detect-resistor + A2 indeterminate
+
+# Accepted bands for the stored voltage-divider resistors and the calibrated
+# bandgap. Firmware sync: rurp_shield.h VALUE_R1_MIN/MAX and
+# VALUE_R2_MIN/MAX (+/-25 % of 270000 and 44000 ohm), and rurp_voltage_math.h
+# RURP_BANDGAP_MIN_MV/MAX_MV. The firmware refuses a config command with a
+# value outside these bands; the host refuses it first.
+CONFIG_R1_MIN = 202500
+CONFIG_R1_MAX = 337500
+CONFIG_R2_MIN = 33000
+CONFIG_R2_MAX = 55000
+CONFIG_BANDGAP_MIN_MV = 1000
+CONFIG_BANDGAP_MAX_MV = 1200

{firestarter-3.2.0b1 → firestarter-3.2.1}/firestarter/diagnostic_report.py

@@ -23,7 +23,6 @@ human-input field gates it.
 
 from __future__ import annotations
 
-import datetime
 import hashlib
 import json
 from dataclasses import dataclass, field
@@ -45,6 +44,7 @@ from firestarter.chip_test import (
     repeat_policy_tag,
     resolve_error_name,
 )
+from firestarter.timestamps import iso_cet
 
 # ---------------------------------------------------------------------------
 # Module constants -- single sources of truth
@@ -774,8 +774,8 @@ class DiagnosticReport:
     over dataclass fields, so this field's absence from that list is the
     whole exclusion mechanism."""
 
-    def _utc_now(self) -> str:
-        return datetime.datetime.now(datetime.UTC).strftime("%Y-%m-%dT%H:%M:%SZ")
+    def _now(self) -> str:
+        return iso_cet()
 
     def _auto_capture_dict(self) -> dict[str, Any]:
         ac = self.auto_capture
@@ -1065,7 +1065,7 @@ class DiagnosticReport:
         """
         return {
             "schema_version": SCHEMA_VERSION,
-            "generated": self._utc_now(),
+            "generated": self._now(),
             "elapsed": self.elapsed,
             "auto_capture": self._auto_capture_dict(),
             "transport_health": self._transport_dict(),

{firestarter-3.2.0b1 → firestarter-3.2.1}/firestarter/eprom_operations.py

@@ -15,7 +15,6 @@ import shutil
 import statistics
 import time
 from contextlib import contextmanager
-from datetime import datetime
 from pathlib import Path
 from typing import Callable, Dict, Tuple  # noqa: UP035
 
@@ -75,6 +74,7 @@ from firestarter.serial_comm import (
     WRITE_BUDGET_MAX_S,
     SerialCommunicator,
 )
+from firestarter.timestamps import iso_cet_basic
 from firestarter.utils import extract_hex_to_decimal
 from firestarter.write_blank_guard import (
     incomplete_refusal_text,
@@ -551,6 +551,12 @@ class EpromOperator:
         # `--full` run, which never sets an abort_predicate, can never be
         # mistaken for this host's own doing.
         self._read_abort_intended: bool = False
+        # Whether the ERROR that ended the last `_run_state_machine` call was
+        # this host's own deliberate read stop (see `_is_own_read_abort`).
+        # Decided ONCE, where the error is caught, so the log level there and
+        # `_drive_region_compare`'s verdict can never disagree. Reset per
+        # operation alongside `_read_abort_stopped_at`.
+        self._read_abort_accepted: bool = False
         # SESS-01 (Phase 206): whether this operator is currently holding one
         # validated link open across multiple calls instead of connecting
         # and tearing down per call. Default off -- joins the transient
@@ -716,7 +722,11 @@ class EpromOperator:
                 # A leased setup whose ack was rejected (not a raised
                 # error) is a failed setup, treated identically to a cold
                 # connect failure: the caller's existing not-`command_dict`
-                # guard in `_operation_context` handles it unchanged.
+                # guard in `_operation_context` handles it unchanged. The
+                # firmware may still be mid-reply, so the held link is not
+                # trusted again: drop it, as the SerialError arm above does,
+                # and the next operation cold-connects.
+                self._disconnect_programmer()
                 return None, 0
             buffer_size = self._calculate_buffer_size()
             logger.debug(
@@ -871,6 +881,7 @@ class EpromOperator:
         self.last_firmware_error_code = None
         self.last_firmware_error_message = None
         self._read_abort_stopped_at = None
+        self._read_abort_accepted = False
         try:
             with logging_redirect_tqdm():
                 # --- INIT Phase ---
@@ -897,7 +908,14 @@ class EpromOperator:
             logger.error(f"Communication error during {operation_name}: {e}")
             return False, str(e)
         except EpromOperationError as e:
-            logger.error(f"Programmer error during {operation_name}: {e}")
+            self._read_abort_accepted = self._is_own_read_abort(e.error_code)
+            if self._read_abort_accepted:
+                # The host stopped this read on purpose; the caller reports
+                # the compare result. An ERROR line here would read as a
+                # hardware fault on every non-blank or mismatching chip.
+                logger.debug(f"Read stopped by the host during {operation_name}: {e}")
+            else:
+                logger.error(f"Programmer error during {operation_name}: {e}")
             # Debug session w27c512-devtest-all-bad: record the firmware's
             # own id and text before collapsing this to a bool, so the
             # diagnostic report can state WHY a step failed instead of
@@ -907,6 +925,35 @@ class EpromOperator:
             return False, str(e)
         finally:
             progress.close()
+            # A leased link outlives this call: never carry a read stop's
+            # expected-error mark into the next operation.
+            if self.comm is not None:
+                self.comm.expected_error_id = None
+
+    def _is_own_read_abort(self, error_code: int | None) -> bool:
+        """Whether an ERROR is the consequence of this host's own read stop.
+
+        D-08: the deliberate stop and a genuine timeout both surface as an
+        ERROR carrying MSG_ERR_TIMEOUT -- the two are wire-identical. Accept
+        the error as this host's own doing ONLY when all four hold: the
+        default path actually asked for a stop (`_read_abort_intended`), the
+        read loop actually recorded one (`_read_abort_stopped_at` is not
+        `None`), the firmware's own error id is exactly the timeout id (not
+        some other fault wearing its clothes), and the stop happened
+        recently enough that this error frame could plausibly be its
+        consequence (the bounded window). Any single condition failing
+        means a real fault -- a mismatching chip whose read failed for an
+        unrelated reason must never be reported as a mismatch, and this
+        host's own deliberate abort must never be reported as hardware
+        trouble.
+        """
+        stopped_at = self._read_abort_stopped_at
+        return (
+            self._read_abort_intended
+            and stopped_at is not None
+            and error_code == MSG_ERR_TIMEOUT
+            and (time.monotonic() - stopped_at) <= READ_ABORT_ACCEPTANCE_WINDOW_S
+        )
 
     def _execute_phase(
         self, phase_name: str, progress: ClassProgressHandler
@@ -1210,7 +1257,11 @@ class EpromOperator:
                     if abort_predicate is not None and abort_predicate():
                         stopped = True
                         self._read_abort_stopped_at = time.monotonic()
-                        logger.info(
+                        # The firmware's ack-wait timeout is now the expected
+                        # end of this read: log it at DEBUG, not ERROR.
+                        # `_run_state_machine` clears this on the way out.
+                        self.comm.expected_error_id = MSG_ERR_TIMEOUT
+                        logger.debug(
                             f"Read stopped in flight at 0x{start_addr:06x} "
                             "(abort predicate fired)."
                         )
@@ -1332,7 +1383,7 @@ class EpromOperator:
             # path is to use the actual board name -- but the unit-test
             # surface doesn't have a serial connection, so we fall back).
             if output_dir is None:
-                timestamp = datetime.now().strftime("%Y-%m-%d-%H%M%S")
+                timestamp = iso_cet_basic()
                 output_dir = str(
                     Path(DEFAULT_RUN_OUTPUT_DIR)
                     / f"consistency-check-{eprom_name}-unknown-board-{timestamp}"
@@ -1509,7 +1560,7 @@ class EpromOperator:
         source_sha = hashlib.sha256(Path(source_image_path).read_bytes()).hexdigest()
 
         if output_dir is None:
-            timestamp = datetime.now().strftime("%Y-%m-%d-%H%M%S")
+            timestamp = iso_cet_basic()
             output_dir = str(
                 Path(DEFAULT_RUN_OUTPUT_DIR)
                 / f"write-cycle-{eprom_name}-unknown-board-{timestamp}"
@@ -1627,7 +1678,7 @@ class EpromOperator:
         from firestarter.serial_comm import FaultInjectingSerialCommunicator
 
         if output_dir is None:
-            timestamp = datetime.now().strftime("%Y-%m-%d-%H%M%S")
+            timestamp = iso_cet_basic()
             output_dir = f"fault-inject-{eprom_name}-{direction}-{timestamp}"
         output_path = Path(output_dir)
         output_path.mkdir(parents=True, exist_ok=True)
@@ -1894,7 +1945,7 @@ class EpromOperator:
             return False
 
         if output_dir is None:
-            timestamp = datetime.now().strftime("%Y-%m-%d-%H%M%S")
+            timestamp = iso_cet_basic()
             output_dir = f"fault-inject-latency-{fault_form}-{timestamp}"
         output_path = Path(output_dir)
         output_path.mkdir(parents=True, exist_ok=True)
@@ -2098,7 +2149,7 @@ class EpromOperator:
             return False
 
         if output_dir is None:
-            timestamp = datetime.now().strftime("%Y-%m-%d-%H%M%S")
+            timestamp = iso_cet_basic()
             output_dir = f"connect-cost-{timestamp}"
         output_path = Path(output_dir)
         output_path.mkdir(parents=True, exist_ok=True)
@@ -2803,28 +2854,11 @@ class EpromOperator:
 
         aborted = False
         if not is_ok:
-            # D-08: the deliberate stop and a genuine timeout both surface
-            # here as `_run_state_machine` returning `(False, ...)` with
-            # `last_firmware_error_code == MSG_ERR_TIMEOUT` -- the two are
-            # wire-identical. Accept the error as this host's own doing ONLY
-            # when all four hold: the default path actually asked for a stop
-            # (`_read_abort_intended`), the read loop actually recorded one
-            # (`stopped_at` is not `None`), the firmware's own error id is
-            # exactly the timeout id (not some other fault wearing its
-            # clothes), and the stop happened recently enough that this
-            # error frame could plausibly be its consequence (the bounded
-            # window). Any single condition failing means a real fault: take
-            # the exit-2 path exactly as before -- a mismatching chip whose
-            # read failed for an unrelated reason must never be reported as
-            # a mismatch, and this host's own deliberate abort must never be
-            # reported as hardware trouble.
-            stopped_at = self._read_abort_stopped_at
-            aborted = (
-                self._read_abort_intended
-                and stopped_at is not None
-                and self.last_firmware_error_code == MSG_ERR_TIMEOUT
-                and (time.monotonic() - stopped_at) <= READ_ABORT_ACCEPTANCE_WINDOW_S
-            )
+            # D-08: `_run_state_machine` already decided, with
+            # `_is_own_read_abort`, whether the error that ended the read was
+            # this host's own stop. Anything else is a real fault: take the
+            # exit-2 path exactly as before.
+            aborted = self._read_abort_accepted
             if not aborted:
                 return 2
 

{firestarter-3.2.0b1 → firestarter-3.2.1}/firestarter/firmware.py

@@ -41,6 +41,7 @@ from firestarter.exceptions import (
 )
 from firestarter.fw_release_gate import require_installable_release
 from firestarter.serial_comm import SerialCommunicator
+from firestarter.timestamps import iso_text_to_cet
 
 logger = logging.getLogger("Firmware")
 
@@ -62,7 +63,7 @@ class ReleaseInfo(TypedDict):
     version: str  # tag_name from GitHub API
     tag: str  # raw tag_name (same as version for firmware releases)
     channel: str  # "stable" or "prerelease"
-    published: str  # ISO-8601 from published_at field
+    published: str  # published_at as ISO 8601 in CET
     asset_url: str  # browser_download_url for the board-matching .hex asset
 
 
@@ -468,7 +469,7 @@ class FirmwareManager:
                     version=tag,
                     tag=tag,
                     channel="prerelease" if is_pre else "stable",
-                    published=r.get("published_at") or "",
+                    published=iso_text_to_cet(r.get("published_at") or ""),
                     asset_url=asset_url,
                 )
             )