Commit Graph
11 Commits
Author SHA1 Message Date
Oleksandr ShyshatskyiandClaude Opus 5 d05565284d Sections E, F, G: wrong values, stale claims, overclaims
E -- values and counts. The START_PRINT prologue has no M400 and an idle
timeout of 864000, not 1800000. The nozzle-clean temperature comes from the
material table FIRST, so NOZZLE=240 with no per-tool temp cleans at 220 --
documented backwards before. TOOLS is the paired 0:220,2:240 form. The wipe Z
is the raw eddy frame, not the homed one. The runout M117 strings are
"T<n> clog" / "T<n> out of filament", not E-codes. Grab-verify raises
E0051+tool, not E0143. Docks are at X~297; 250/280 are staging waypoints. The
grab sequence is documented in the order _grab actually emits it. ff_print
exposes seven status fields, not nine, and never emits TOOLS=. Package sizes
reconciled against the real artifacts (62MB built, ~93MB stock, ~370MB of CI
assets, ~60s not 90s). testing.md's sample output block matched no header the
code prints, so it is replaced with the real ones; its pytest row listed two
of six suites.

F -- stale claims. _FF_PREFLIGHT is not "missing". SDCARD_SET_CHANNEL is not
still issued (764af2a). The app and Moonraker do not coexist; the app is gone.
TOOLCHANGE_STATUS has nothing to compare against since the JSON reader was
removed. The JSON is re-imported every boot until a nozzle is saved, not once.
The 23-check render harness was deleted in 91604c2. PURGE now wipes by
default. 50-print-lifecycle.md gained the section on how the sequences are
actually entered now -- [ff_print], not the slicer. The dead "profiles"
concept is gone from three files, one of which printed it on every replica run.

G -- overclaims. The README no longer says a stock reflash puts the printer
back "exactly as it was": it says what is restored and what survives inert,
which is what test-recovery actually asserts. The random ssh password is
conditional on ROOT_PW_HASH being unset. verify.sh no longer warns "ssh will
not start" on every build for a dropbear we deliberately do not ship -- the
check now reads the way round it means. case-install.sh's read-only block says
it asserts nothing. An uncalibrated tool contributes z_adjust, not zero, in
three operator-facing places. offset_base does not cancel out in X/Y. The
safe-moves file's Z50 promise is scoped to its own lines, with the implicit
prepare's G1 Z10 spelled out.

48 passed, 5 skipped.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-24 19:48:43 +03:00
Oleksandr ShyshatskyiandClaude Opus 5 e5bd171cf8 Correct the docs the code had drifted away from
Applies the audit's sections B, C and D, plus two decisions.

Behaviour (A1): fm_ex1..3 carried stock's `extruder: extruder`, so a clog on
T1..T3 was measured against T0's filament movement. Each motion sensor now
watches its own extruder.

Gate count (A6): "four gates" was the number of make test-* targets, not of
gates run -- run-tests.py emits twelve. The number is dropped rather than
restated, in docs/testing.md and the Makefile help.

B, install instructions that failed as written: STOCK_TGZ_CREATOR5 missing its
.tgz; a pointer to a ./build.sh that does not exist; klippy-extras/ paths that
moved to payload/klipper/extras/ in 0ef9d6b; a calibration recipe both
commands refuse without PLATE_REMOVED=1; a storage table that put dock_x/dock_y
in an include, which SAVE_CONFIG refuses; four files telling the user to add
includes printer.base.cfg already ships; ./pack.sh style paths that do not
resolve from where the scripts leave you.

The MAINSAIL_ZIP / HELIX_TGZ override was documented in three places as "used
as-is, never checksummed". It is checksummed, and fetch-assets.sh overwrites
the user's file with the pinned release -- SKIP re-downloads too. Corrected,
with the way that actually works (match the hash in versions.env).

C, files that contradicted themselves: the -5/-3 ESTOP target, the
t<n>_offset_* storage names, the chamber heater's model split, the LED
premise, the include order comment in test_includes.py, gear_stepper as a
"feed hub" when it is the tool lock, an object list ff-toolchange.cfg says
does not exist, the eddy probe vs the under-bed cylinder, "installs them
without clobbering" against a gate that enforces the clobber, "keeps two
versions" when the installer keeps one, "two changes from stock" when there
are three, and ff_legacy's "nothing here runs during normal operation" when
auto_import runs on every ready.

D, dangling references: OKF/* and firmwareExe-decompiled/* repointed at
docs/notes/*, plus case-boot.sh, sim-image.sh, printer-exec.sh, the
test/printer build context, wait_for_banner, ff_toolchanger_compat and a
nonexistent orca snippet.

Not touched, pending a decision: sections E-H, and the printer.base.cfg
"verbatim" claim (A7), which depends on how the unpack drift check is fixed.

48 passed, 5 skipped.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-24 19:48:42 +03:00
Oleksandr ShyshatskyiandClaude Opus 5 a40bc861dd Ship our own Moonraker: the stock 2022 build hides the camera
Mainsail has shown no webcam panel on this printer no matter how the
stream is configured, and the stream was never the problem: nginx serves
/webcam/ correctly and mjpg-streamer answers it.

FlashForge's Moonraker is a 2022 build (API 1.0.5). Moonraker only grew
the webcam "enabled" flag in April 2023, and Mainsail filters its webcam
list on exactly that field -- so every [webcam] entry is discarded and
the panel is removed from the dashboard entirely. Nothing on either side
of that can be configured around; the server has to be newer.

So the mod now ships Moonraker the way it ships Mainsail: pinned in
versions.env, fetched to vendor/ against a sha256, installed over the
stock tree. v0.9.3 is the newest release that runs on the printer's
existing python environment untouched -- v0.10.0 wants dbus-fast, a
compiled module that is not there and would have to be cross-compiled
for mipsel. Only the python package is replaced; the interpreter, the
moonraker-env beside it and moonrakerDaemon stay FlashForge's.

It rides in the mod payload rather than the software component because
the stock run.sh does not extract that component over /usr/prog -- it
copies a hand-written list of paths out of it, and a moonraker/ dropped
in beside them would never be looked at. run-append.sh installs it,
moving the old tree aside and putting it back if the copy fails: this is
the one thing the mod writes to /usr/prog that the stock installer does
not, and a printer whose Moonraker did not survive has no web UI at all.

The database migrates itself -- v0.9.x moved from lmdb to sqlite, lmdb
1.3.0 is installed, so Mainsail's settings survive the upgrade.

Covered end to end on the printer replica: that the swap happened, that
the installed webcam.py has the enabled field, and that the shipped tree
really runs on the printer's own python3.8 under qemu-mipsel. With
BUILD_MOONRAKER=0 those skip and the stock server is left alone.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-24 17:42:34 +03:00
Oleksandr ShyshatskyiandClaude Opus 5 607e6595fb Start the camera ourselves: mjpg-streamer was on the disk all along
Correcting the previous commit, which said the :8080 stream could not be
restored without cross-compiling a streamer. Both halves are actually true:

  * firmwareExe really did serve the stream itself -- its own accept loop,
    `GET /?action=stream`, boundarydonotcross, even announcing
    `Server: MJPG-Streamer/0.2` -- so killing it does take the camera down.
  * ...but /usr/prog/mjpg-streamer/ ships the genuine article: mjpg_streamer,
    input_uvc.so, output_http.so, its own libjpeg.so.9 and www/.
    app_startup.sh:159 exports LD_LIBRARY_PATH for it and then never launches
    it. Nothing needs building; the binary just needs starting.

S65camera does that, on the S50wifi pattern -- the wait for /dev/video0 and the
respawn loop run in a background subshell, so a printer with no camera plugged
in never holds up Klipper or the UI. stop() kills the supervisor before the
streamer, or it would come back three seconds later.

Two details are load-bearing and easy to lose: libjpeg.so.9 lives in the
mjpg-streamer directory, so without LD_LIBRARY_PATH the binary dies on a
missing shared object (the same trap moonrakerDaemon has in S60web); and the
plugin .so names resolve against the working directory, hence the cd.

nginx proxies it at /webcam/ with buffering off and no read timeout, since
MJPEG is one endless response, and moonraker.conf's [webcam] entry uses
relative URLs through that proxy -- so one forwarded port carries the stream,
tunnels included. MOD_CAM=0 turns it off; MOD_CAM_RES/FPS/PORT tune it.

The earlier claim is corrected in docs/notes/25 and in the README, which no
longer lists the camera as something you give up.

Verified: parses under the printer's own busybox ash, lint-danger clean. The
full suite was not re-run to completion -- the working tree is being edited
concurrently and a build lane raced it (tar: file changed as we read it).
bin/patch.sh's MOD_CAM line is deliberately left out of this commit for the
same reason.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-23 22:06:25 +03:00
Oleksandr ShyshatskyiandClaude Opus 5 5bdf78109a Retire firmwareExe: own the web stack, and say what goes with it
The mod replaces FlashForge's application outright, so the reasoning that
still framed the web stack as coexisting with it was wrong on its own terms.

* nginx and moonraker are documented as the only web stack on the printer.
  MOD_WEB=0 is a debugging switch that leaves ssh and the touchscreen, not a
  way back to stock -- that is a stock FlashForge package. The own-prefix rule
  stays, for the reason that is actually true: /usr/prog is the firmware
  partition and every FlashForge package reinstalls it, so a config written
  there is undone by the next stock flash.

* Configs the mod ships now update when you have not edited them. A live file
  still byte-identical to the one the last package wrote is replaced; one you
  changed is kept and the new version lands beside it as .mod-new.
  $MODDIR/config-installed holds that last-written copy. Without this a config
  we own could only ever be written once: it exists on the second flash, so it
  would land as .mod-new forever and updates would never reach the printer.

* Dropped the three dead /server/files/ alias blocks from nginx.conf. The regex
  location above them matches /server/ too and nginx gives regex locations
  precedence, so they never fired -- and had they fired, serving those paths
  from disk would 405 the DELETE and POST that Mainsail sends to the very same
  URLs.

* Recorded what dies with firmwareExe, in docs/notes/25 and in the README: the
  :8898 REST API (FlashPrint, Orca's FlashForge profile, the mobile app) and
  the :8080 camera stream. The camera is the one that looks restorable and is
  not -- the MJPEG server is compiled into firmwareExe (its own accept loop,
  `GET /?action=stream`, boundarydonotcross) rather than being mjpg-streamer,
  so there is no daemon left to point a [webcam] at. assets/moonraker.conf
  carries the block, commented, for when a streamer is built for this board.

Also in this change: the MOD_UI switch and the stock-UI path are gone, the
chamber-heater model gate arrives with ff-model.cfg/ff-chamber.cfg, and the
tests follow.

make test: 32 passed, 1 failed. The failure is the probe end-to-end, which
dies at "mount: failed to setup loop device for /stick.img" -- leaked loop
devices on this build host, not the package. Probe installs nothing, and the
default profile's install -> re-install -> boot passes in the same run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-23 21:50:32 +03:00
Oleksandr ShyshatskyiandClaude Opus 5 a9299397f4 Build the toolchanger from this repo instead of a TOOLCHANGE= path
bin/patch.sh now copies the ff_*.py extras, the ff-*.cfg configs and the
HelixScreen printer-database entry out of payload/, the way it already
handled report.sh and the nginx/moonraker assets.

Both call sites also lose a silent-skip guard. They tested for the files
under $TOOLCHANGE and quietly shipped a package without the toolchanger
if the path was wrong or unset -- worth having when the source was a
checkout that might not be there, wrong now that the files are committed
next to the script. A missing file here is a broken checkout, and cp
should say so.

CI and the test fixture had TOOLCHANGE="" set precisely to trigger that
skip, so drop the line; both build the probe profile, which never
reaches this step anyway.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GgNhSa1Qvwvxb2nQXT6b1Y
2026-08-23 16:50:44 +03:00
Oleksandr ShyshatskyiandClaude Opus 5 22d16f984e Run the printer's own boot script for the update test, and cut the suite to 5m
The install test used to re-implement app_startup.sh: it pulled the glob,
MACHINE and PID out of it with sed, then called the installer itself. A
mistake in our reading of the boot script could never be caught that way.

The package now sits on a real FAT filesystem on a loop device exposed as
/dev/sda1, and app_startup.sh runs verbatim through three boots -- stick in,
stick still in, stick pulled. The last one asserts what actually matters:
nginx and moonraker up, klipper launched, the UI in the foreground where
app_startup.sh's own 5-second ps watchdog can see it.

One substitution, declared in .SIMULATED: the printer's kernel has nls_cp936
and a container kernel does not, so /bin/mount retries without codepage= if
the real options are rejected.

Speed. The image carried the partitions but not the stock install, and
test-env.sh sourced the config files after the environment -- so PRINTER_IMAGE
on the command line was overwritten by the empty value in test.env and the
published image was never used. Measured, per replica case: 22s to unpack the
factory image, 37s to install the stock package, 0.7s with the image. The
stock install is now baked in at image build time (bake.sh -- it needs binfmt
and chroot, so it runs privileged and the result is committed) and recorded in
/usr/prog/.BASELINE; a run asking for a different package reinstalls.

make test: ~20m -> 5m26s. Every section header now carries elapsed seconds.

Dropped four checks that could not fail:

  * test-abi's execution half was `qemu "$f" -h || [ $? -lt 126 ]`, which
    accepts nearly every exit status
  * test-ash's md5sum -s probe printed "inconclusive" on every path
  * run-tests.sh's per-file `sh -n` "POSIX" loop ran bash, and its bashism
    grep flagged `local`, which busybox ash supports
  * CI's shellcheck ended in `|| true`

And one that mattered more: the release workflow's final sim-install loop
ignored every exit status, and sim-install.sh exits 0 on a skip -- so the last
gate before publishing could not fail. It now stops on the first failure and
runs with REQUIRE_PRINTER_SIM=1, which turns skips into failures throughout.

Also: the profile lists in run-tests.sh, RECOVERY_PROFILE and release.yml
still said ssh/web/full/helix and would have failed the release job; work/.sim
was shared, so two suites at once truncated each other's packages; and the
fixture half left a 380KB package in work/out where make test-install picks it
up.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GgNhSa1Qvwvxb2nQXT6b1Y
2026-08-23 16:36:45 +03:00
Oleksandr ShyshatskyiandClaude Opus 5 a5300bde12 Split the repo into ship / build / test lanes, and add the printer replica
Two strands, both landing here because they had grown into each other in the
working tree.

The printer replica: the printer's real rootfs.squashfs chrooted under
qemu-mipsel, with /usr/prog and /usr/data from the factory image, so a package
is installed by FlashForge's own updater running on the printer's own busybox,
tar, md5sum and unTar. There are no stubs -- if the real prog partition is
missing the harness refuses to run rather than test against mocks. A release
workflow is blocked on it.

The lanes: a file's directory now says whether it can ever reach a printer.

  payload/, assets/   ship
  bin/, profiles/     build the package
  test/, docs/        neither, ever

  * the replica's own infrastructure moved out of bin/ and docker/ and in
    beside the harness it belongs to (test/extract-rootfs.sh,
    test/build-printer-image.sh, test/printer/Dockerfile{,.full})
  * the Makefile has two runners: only RUNSIM gets the docker socket and the
    replica's variables, so a build cannot reach the docker daemon at all
  * replica settings moved to test.env, which nothing in a package reads
  * build-time flags renamed BUILD_* (APPLY, REPORT, KLIPPER, TOOLCHANGE,
    MAINSAIL, HELIX). MOD_* now means only the runtime switches written into
    anvil.conf and re-read by the printer at every boot
  * verify.sh fails if any file in a package is byte-identical to one in
    bin/, test/, docker/ or profiles/ -- by content, because a name blacklist
    would trip over whatever Mainsail happens to call common.sh

Fixed while mapping it:

  * BUILD_REPORT was read only inside the BUILD_APPLY=0 branch, so four
    profiles declared it and got nothing. It is honoured on both paths now,
    and off outside probe: report.sh copies /etc, passwd and shadow onto the
    USB stick, which is a diagnostic, not something to hand out.
  * three checks in the brick lint had been quietly dead. Two were guarded on
    a payload/boot.sh replaced by the firmwareExe wrapper long ago; the third
    was the file glob itself, which matched neither firmwareExe nor the
    init.d/S* scripts -- the UI wrapper and every service went unscanned. A
    missing file is now a failure rather than a silent pass.
  * run-tests.sh overwrote config.env and copied it back, leaving the config
    you edited one crashed run away from being a fixture. It uses CONFIG_ENV.
  * bin/make-uninstall.sh does not exist and never did; README, run-pre.sh and
    full.env all pointed at it. Recovery is the stock package, which is what
    test-recovery actually proves.

README is now for someone who wants to flash their printer: what it is, which
file, how to flash, what to do when it goes wrong. The rest moved to
docs/how-it-works.md, docs/building.md and docs/testing.md.

make test: 89 passed, 0 failed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-23 14:30:09 +03:00
Oleksandr Shyshatskyi 855bb52573 Build a separate package per model; add the model-gate test
The Creator5Pro stock package turned up, and comparing it with the non-Pro
one settled the question: they are different files carrying DIFFERENT
firmwareExe binaries (f666ff60... vs bf505905...), each with its own
MACHINE=/PID= gate.

That exposed a real bug: pack.sh emitted BOTH filenames from a single build,
copying one file to the other model's name. It was modelled on FlashForge's
factory package, where doing so is legitimate because that package is an
installer-only wrapper with no model-specific binaries. For a full firmware
package it would hand one model the other's firmware.

pack.sh now names the output from the gate inside the package it was built
from, and refuses if that disagrees with TARGET_MACHINE. config.env takes one
stock package per model (STOCK_TGZ_CREATOR5 / STOCK_TGZ_CREATOR5PRO) and
MODEL=/TARGET_MACHINE selects between them. `make release` builds both into
dist/.

test/test-model-gate.sh locks it in: filename prefix matches the gate, the PID
matches the model, and the two packages do not share a firmwareExe.

Also fixed: the CI fixture now carries a real model gate (and is generated
into work/ rather than /tmp, because sibling-container mounts are resolved by
the host daemon, so a build-container /tmp path mounts empty).

77 checks pass. Both models build and verify from the real firmware.
2026-08-22 22:27:55 +03:00
Oleksandr Shyshatskyi 3a70b678f4 Recovery is the stock package; add the model gate check
Drop bin/make-uninstall.sh. Diffing its output against FlashForge's own
software component showed it differed in exactly two files -- run.sh (22
appended lines) and the md5sum.list that changed because of it. Everything
doing the actual reverting was FlashForge's. So recovery is simply "flash the
stock package you already have"; the leftover /usr/data/mod payload is inert
once firmwareExe is the genuine binary again.

test/sim-roundtrip.sh now proves that path instead: install the mod, flash the
stock package, assert firmwareExe matches the stock binary byte-for-byte, the
boot scripts are restored, and no stock script references the payload.

That test immediately surfaced a real problem. Packages carry a model gate --
runFirmwareExe.sh has MACHINE=/PID= baked in and refuses to install when they
do not match what app_startup.sh passes from the installed firmware:

    Creator5    / 0028
    Creator5Pro / 0029

The stock package in use here is the non-Pro build (MACHINE=Creator5), while
the target printer reports "Creator 5 Pro" in general.json. Anything built
from it would be refused by the printer, and it is not a valid recovery image
for a Pro either.

unpack.sh now reports the gate, verify.sh fails on a mismatch against
TARGET_MACHINE in config.env, and the ladder doc leads with checking it.
2026-08-22 22:11:53 +03:00
Oleksandr Shyshatskyi 4415905fb3 Initial commit: USB-installable custom firmware builder for Creator 5
Builds a modified FlashForge update package that the printer installs by
itself from a USB stick, reusing FlashForge's own updater rather than a
parallel one.

Integration is a single file: /usr/prog/PROGRAM/software/firmwareExe is
replaced with a shell script. Everything funnels through that binary, so
app_startup.sh, rcS and the init chain stay completely stock. The genuine
binary is kept as firmwareExe.stock and remains the default UI.

Key findings from the stock firmware, each enforced by a test:
- components named *.tar.xz are PLAIN tar; the installer runs bare `tar -xvf`
- the .tgz is DES3-encrypted plain tar, not gzip
- nothing in init starts Klipper -- firmwareExe runs start.sh, so replacing
  the UI without S70klipper leaves a printer that cannot move
- the installer wipes the software dir before run.sh, so an uninstall package
  must ship the genuine firmwareExe rather than back one up
- ssh already works: stock ships dropbear + an enabled S50dropbear, only the
  root password is missing

Brick-safety is designed in, not bolted on: a five-rung profile ladder
starting with a probe that changes nothing, a container-based simulation that
actually runs the installer and asserts the printer would still boot, an
uninstall round-trip test, and a SAFE-MODE latch for UI crash loops.

75 checks pass. Not yet run on hardware.
2026-08-22 21:48:56 +03:00