diff --git a/CLAUDE.md b/CLAUDE.md
index b5d41ca3..299fa528 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -262,6 +262,41 @@ fix flows to every page automatically; two hand-written HTML pages never will.
   equal to both the silkscreen number and the 0xAA wire channel (one number
   everywhere; `parseRigIo` rejects `port: 0` with a warning). Label new I/O UI
   with the silkscreen names, not DO1/DO2/J3/J4 refdes.
+- **Controller-fault lifecycle (fw #50, v0.76) — THE fail-closed rule:** a Mode-3 controller
+  wedge is detected in `js/fictrac-bridge-client.js` (`_recordApply`: ≥ `faultThreshold` (3) failed
+  applies in the last `faultWindow` (10) — NOT "3 consecutive", a late same-opcode reply can satisfy
+  the next request) → latched `fault` event, apply forced OFF → `ArenaSession` calls
+  `runner.fault(reason, detail)` (wakes the wait, `summary.fault`, `summary.stopAcked`) → the
+  run's outcome is `CONTROLLER_FAULT` (`run-log.js` `deriveOutcome`, adapter) and it **auto-commits**
+  (only `ABORTED_BY_USER`/`DISCONNECTED` skip). A timed-out protocol command (`isTimeoutError`) is
+  labelled the same. After the run unwinds, `runSteps` (module block) calls
+  `Studio.handleControllerFault(summary)` → `js/studio-postmortem.js` (`createPostmortem().run`):
+  quiet ≥ 1 s + `session.flushRx()` → confirm 0xC2 (2 s) → probe window (5 s timeouts; typed
+  `probe` rows with decoded + raw hex, because `["a",…]` rows carry no payload) → policy `halt` |
+  `reset-continue` (0x01 → `session.reconnect()` via `ArenaLink.reconnect()`/`getPorts()`, VID/PID
+  match, ambiguity refused → MAC verified → post-reset probe). Runner sends go through
+  `session.send` (a link facade) so trialParams/STOP are logged. New wire commands used by probes
+  MUST be exported + golden-tested (`GET_HEALTH` 0xCA decodes 55 B + optional 11 B slowest-op tail;
+  `GET_FRAME_POSITION` 0x72). **Soak driver** (`Studio.startSoak`, File ▾ → Soak…, `?soak=1`,
+  advanced-only) loops `Studio.runOnce(false)` (the no-dialog half of `beginRun`), refuses without
+  a `behavior_v2` ack or without bridge frames, halts on the first fault by default, never
+  auto-commits. Analyzer: `scripts/wedge-scan.py` (+ `tests/test-wedge-scan.py`, standalone
+  harness, no pytest). Design + campaign spec: `docs/development/mode3-wedge-soak-plan.md`.
+  **Firmware build identity (permanent):** `GET_FIRMWARE_VERSION` 0xCB (`encodeGetFirmwareVersion` /
+  `decodeFirmwareVersion` → `label` "sha[*] RxC date branch") is read by `Studio.refreshFirmwareVersion()`
+  on every link-up (Connect button AND the `identityOnConnect` state hook that covers gesture-free
+  `session.reconnect()`), stored as `Studio.firmware` → `run_metadata.firmware`. **Gate it on the
+  `health` capability bit**: this firmware answers an unknown opcode with `CE_UNKNOWN_CMD` and an
+  error GLYPH on the arena, so never send 0xCB (or 0xCA) blind. Firmware `main` is compiled for a
+  **4×10** arena (`panel_count_per_frame_row = 4`); the CSHL 2×10 controllers run `arena-2x10-local` —
+  a build from `main` rejects every 2×10 pattern (`TRIAL_PARAMS: load failed`, CE_ARENA_MISMATCH).
+  **Telemetry ring (T4):** `js/arena-telemetry.js` decodes 0xA9 blocks (18 B header + records) and
+  runs the ack-cursor drainer; `Studio.initTelemetry()` starts the 10 Hz poller on link-up (gated on
+  GET_FIRMWARE_VERSION `flags` bit 2 — NOT on `health` — then a SET_TELEMETRY 0xA8 ack; Debug ▾
+  toggle `studio_telemetry`); rows go to the bridge as `{type:'rows'}` (bridge ≥ 3.1
+  `write_rows`, verbatim `["cc"|"cf"|"cs", …]`). The record schema lives in ONE place — the header
+  comment of `js/arena-telemetry.js` — mirror any firmware change there + in `wedge-scan.py`
+  (`CTL_TAGS`/`CTL_STATE_KINDS`). Never drain while the post-mortem owns the link (its `canPoll`).
 - **Wire module exports:** `js/arena-wire-g6.js` defines more than it exports —
   when adding encoders/decoders, add them to the export list AND a test; audit
   with `Object.keys(require('./js/arena-wire-g6.js'))` vs the page's `Wire.*`
@@ -315,6 +350,31 @@ fix flows to every page automatically; two hand-written HTML pages never will.
   `run_metadata` from anything but the acked/inferred level.
 - Bump the footer version/timestamp on every edit; never Prettier the HTML.
 
+- **Telemetry ring — four rules from the 2026-09-12 Codex review (all tested):** (1) the ONLY gate
+  for SET_TELEMETRY 0xA8 is GET_FIRMWARE_VERSION `flags` bit 2 (`decodeFirmwareVersion().telemetry`);
+  never infer it from the `health` capability (the 0xC2 capability byte is full; health-only builds
+  answer 0xA8 with CE_UNKNOWN_CMD + an error glyph). (2) **Ack means stored**: the drainer advances
+  its cursor only when `onRecords` returned non-false; the Studio sink returns the bridge's
+  acceptance (`FicTracBridgeClient.logRows` → boolean) — never ack rows that went nowhere.
+  (3) Run-log readers must treat ANY string-tagged array row (`"cc"/"cf"/"cs"`, future streams) as a
+  stream, not a behavior sample; only `"a"` is decoded (`js/runlog-replay.js`, dashboard
+  `analysis-core.js`). (4) A controller-fault run's export/auto-commit is DEFERRED until
+  `Studio.handleControllerFault` finishes (the export closes the bridge's file); the runner emits its
+  terminal event from `finally`, after the best-effort STOP, so `stopAcked` is in the serialized
+  summary. Post-mortem owns the link: stop the poller, `await drainer.idle()`, then go quiet;
+  capability-gated probes are skipped (and recorded) when 0xC2 gave no capabilities.
+- **Hardware-watchdog world (fw fb11681+, 2026-09-12):** the controller resets itself ~2 s into a
+  hang, so after a fault the link DROPS. `studio-postmortem.js run()` checks `session.connected`
+  after the quiet period and after the confirm probe; a dropped link takes the **self-reset path**
+  (`resetAndReconnect({skipReset:true})`: reconnect → MAC → GET_HEALTH → `afterReconnect` ring dump
+  + crash report → post probes) regardless of policy, outcome `self-reset` (soak continues, counts
+  as a reset) or `self-reset-failed`. GET_HEALTH ver 2 = 89 B (`HEALTH_PAYLOAD_BYTES_V2`): previous
+  boot's ISR (`prevIsrLastName`), watchdog-captured PC/LR (`prevWdogPcHex`, valid when
+  `prevPcCaptured`), `wdogFlags` (armed / prev reset was watchdog / suspended / starving / config
+  failed). `GET_CRASHREPORT` 0xCC (128 B raw PJRC record, `decodeCrashReport().present`) is gated
+  like 0xA8 on the 0xCB telemetry flag; `Studio.readCrashReport()` logs a `crash_report` event.
+  Breadcrumb ops 6–9 are the SET_FRAME_POSITION sub-steps (disarm timer / preload / arm / respond).
+
 ## Pattern Designer (`pattern_editor.html`)
 
 Renamed from "Pattern Editor" (v0.10, 2026-07-04); the FILENAME stays `pattern_editor.html`
diff --git a/arena_studio.html b/arena_studio.html
index fba4fcd6..82511ea3 100644
--- a/arena_studio.html
+++ b/arena_studio.html
@@ -251,6 +251,8 @@
   body.safemode #ghLock{cursor:not-allowed;opacity:.6}
   /* Session-rig selector stays hard-locked (its unlock padlock is hidden). */
   body.safemode #sessionRigLock{display:none}
+  body.safemode #fmSoak{display:none}
+  #fmSoak.soaking{color:var(--accent)}
   /* Pattern WRITES greyed in safe mode: the Add ▾ menu button has no data-cmd
      (its items do, and are in SAFE_BLOCKED_CMDS), so grey the parent so the menu
      can't be opened; the per-row × delete bypasses the dispatcher (guarded in JS)
@@ -2130,6 +2132,7 @@
       <div class="sep"></div>
       <button id="fmCopyConditions" class="edit-only" title="Copy conditions from a second protocol YAML into this one — brings their anchors and plugins along">Copy conditions from another protocol…</button>
       <button id="fmReset" class="edit-only" title="Clear everything to a blank minimum-valid v3 skeleton (reversible with Undo)">Reset protocol…</button>
+      <button id="fmSoak" title="Advanced: repeat the open protocol unattended (N times / for H hours, with a gap) to reproduce the Mode-3 controller wedge (fw #50). Requires the bridge to confirm behavior_v2 logging and FicTrac/simulator frames to be arriving. On a fault: quiet period → probes → halt (first fault) or SYSTEM_RESET + reconnect + continue. Logs stay on the bridge (not auto-committed).">Soak (repeat protocol)…</button>
       <div class="sep"></div>
       <div class="gh-block gh-locked" id="ghBlock">
         <div class="gh-row">
@@ -2658,6 +2661,9 @@ <h2 id="modalTitle">Import error</h2>
           </div>
           <div class="cmenu-sep">Send raw hex</div>
           <div class="cmenu-row"><input id="cRawHex" type="text" placeholder="01 C2" title="Raw hex bytes to send verbatim (e.g. 01 C2)"><button class="cmenu-item" data-cmd="crawsend" style="width:auto" title="Send the raw hex bytes to the controller">Send</button></div>
+          <div class="cmenu-sep">Health</div>
+          <button class="cmenu-item" data-cmd="ctelem" title="Toggle the controller telemetry ring drain (SET_TELEMETRY 0xA8 / GET_TELEMETRY_BLOCK 0xA9, 10 Hz, rows cc/cf/cs into the run log). Remembered. Off = the telemetry-off control arm for the fw #50 soak.">Telemetry ring: on/off</button>
+          <button class="cmenu-item" data-cmd="chealth" title="GET_HEALTH (0xCA) — controller loop timing, SD read stats, frame/command counters and the previous boot's breadcrumb + slowest op (needs health-capable firmware; logged to the Console and the run log)">Controller health</button>
           <div class="cmenu-sep">Danger</div>
           <button class="cmenu-item" data-cmd="sysreset" title="SYSTEM_RESET (0x01) — ack then reboot the controller firmware">Reset controller</button>
         </div>
@@ -2953,7 +2959,7 @@ <h2 id="modalTitle">Import error</h2>
 </div>
 
 <footer id="footer">
-  <span class="foot-left">Arena Studio v0.74 | 2026-09-10 16:50 ET · <a href="https://github.com/reiserlab/webDisplayTools" target="_blank" rel="noopener" title="webDisplayTools on GitHub: source, issues, and release notes (docs/development/arena-studio-release-notes.md)">GitHub</a></span>
+  <span class="foot-left">Arena Studio v0.76 | 2026-09-12 23:18 ET · <a href="https://github.com/reiserlab/webDisplayTools" target="_blank" rel="noopener" title="webDisplayTools on GitHub: source, issues, and release notes (docs/development/arena-studio-release-notes.md)">GitHub</a></span>
   <!-- Course-repo quick-links: open protocols / logs / patterns in a new tab.
        Hrefs built from the configured repo + bench id (updateGhQuickLinks). -->
   <span id="ghQuickLinks" title="Open the course repo on GitHub (new tab)">
@@ -2984,6 +2990,8 @@ <h2 id="modalTitle">Import error</h2>
 <script src="js/studio-meta.js"></script>
 <script src="js/studio-url-state.js"></script>
 <script src="js/studio-runlog-adapter.js"></script>
+<script src="js/studio-postmortem.js"></script>
+<script src="js/arena-telemetry.js"></script>
 <script src="js/kinematics.js"></script> <!-- shared scope/dashboard kinematic derivations -->
 <script src="js/studio-github.js"></script>
 <script src="js/runlog-format.js?v=20260906-1829"></script>
@@ -3066,6 +3074,14 @@ <h2 id="modalTitle">Import error</h2>
     });
 
     // ---- unified log: raw transport trace (console 'log' events) --------------
+    // The raw log is BOUNDED (bench 2026-09-12 23:10): every arena command appends a
+    // line, so a 286 Hz closed-loop run grew it to 43k rows in 10 min and each
+    // append (+ scroll-to-bottom layout) got slower — the apply loop lost half its
+    // throughput over one 20-min iteration while the controller stayed flat. Keep
+    // the newest RAW_LOG_MAX_LINES; trim in one range delete every RAW_LOG_TRIM
+    // lines; only follow the tail when the user has not scrolled up.
+    const RAW_LOG_MAX_LINES = 3000;
+    const RAW_LOG_TRIM = 500;
     function rawLine(text, cls) {
         const box = $('runlogBox');
         if (!box) return;
@@ -3073,11 +3089,19 @@ <h2 id="modalTitle">Import error</h2>
         if (box.firstChild && box.firstChild.classList && box.firstChild.classList.contains('dim')) {
             box.textContent = '';
         }
+        const atBottom = box.scrollHeight - box.scrollTop - box.clientHeight < 40;
         const div = document.createElement('div');
         if (cls) div.className = 'l-' + cls;
         div.textContent = text;
         box.appendChild(div);
-        box.scrollTop = box.scrollHeight;
+        const n = box.childElementCount;
+        if (n > RAW_LOG_MAX_LINES + RAW_LOG_TRIM) {
+            const r = document.createRange();
+            r.setStartBefore(box.firstChild);
+            r.setEndBefore(box.children[n - RAW_LOG_MAX_LINES]);
+            r.deleteContents();
+        }
+        if (atBottom) box.scrollTop = box.scrollHeight;
     }
     Studio.rawLog = rawLine;
 
@@ -3303,7 +3327,15 @@ <h2 id="modalTitle">Import error</h2>
         }
         $('rlCtr').textContent =
             (log.meta.run_id || 'run') + ' · ' + (log.summary ? log.summary.outcome : 'done');
-        maybeCommitRunLog(log, summary); // course pipeline — async, best-effort
+        // Controller fault (fw #50): the export closes the bridge's log file, so it
+        // must wait for the post-mortem (STOP result, probes, ring crash dump) —
+        // Studio.handleControllerFault runs the deferred commit in its finally.
+        if (summary && summary.outcome === 'CONTROLLER_FAULT' && Studio.handleControllerFault) {
+            Studio._pendingCommit = () => maybeCommitRunLog(log, summary);
+            rawLine('run log commit deferred until the controller post-mortem finishes', 'warn');
+        } else {
+            maybeCommitRunLog(log, summary); // course pipeline — async, best-effort
+        }
     }
 
     // ---- run-log upload modal — greys the screen during export+commit so a push
@@ -3323,12 +3355,14 @@ <h2 id="modalTitle">Import error</h2>
     function hideUploadModal() { const ov = $('rlUploadOverlay'); if (ov) ov.style.display = 'none'; }
 
     // ---- course-repo run-log auto-commit (CSHL pipeline) -----------------------
-    // On COMPLETED recorded runs only: export the bridge's JSONL — the canonical
-    // run artifact (run_metadata line + every runner/arena/FicTrac event) — and
-    // direct-commit it gzipped as ONE `.jsonl.gz` under runlogs/<bench-id>/. Aborted or
-    // disconnected runs never auto-commit (deliberate: a partial run is bench
-    // debris until someone decides otherwise). Filename STAMP is colon-free —
-    // a raw ISO ':' breaks git checkout on Windows clones.
+    // On COMPLETED recorded runs — and on CONTROLLER_FAULT runs (fw #50: the
+    // record of a run the controller killed is evidence, and must be durable) —
+    // export the bridge's JSONL — the canonical run artifact (run_metadata line +
+    // every runner/arena/FicTrac event) — and direct-commit it gzipped as ONE
+    // `.jsonl.gz` under runlogs/<bench-id>/. User-aborted or disconnected runs
+    // never auto-commit (deliberate: a partial run is bench debris until someone
+    // decides otherwise). Filename STAMP is colon-free — a raw ISO ':' breaks git
+    // checkout on Windows clones.
     async function maybeCommitRunLog(log, summary) {
         if (!log || log.intent !== 'experiment') return;
         const outcome = (summary && summary.outcome) || (log.summary && log.summary.outcome) || 'UNKNOWN';
@@ -3644,6 +3678,37 @@ <h2 id="modalTitle">Import error</h2>
         Studio.session.bridge.on('status', () => updateRunGate());
     }
 
+    // ---- controller build identity (GET_FIRMWARE_VERSION 0xCB) ---------------
+    // Permanent feature: every connection records WHICH firmware build the
+    // controller runs, and run_metadata.firmware carries it into every committed
+    // run log. Gated on capability bit 7 (`health`, shipped together): older
+    // firmware answers an unknown opcode with an error glyph on the arena, so we
+    // never ask blind. Falls back to the 0xC2 format byte ("v1") on old builds.
+    Studio.firmwareVersion = null; // decoded 0xCB record, or null
+    Studio.refreshFirmwareVersion = async function () {
+        if (!Studio.session || !Studio.session.connected) return null;
+        const caps = Studio.capabilities || [];
+        if (!caps.includes('health') || !Wire.encodeGetFirmwareVersion) {
+            Studio.firmwareVersion = null;
+            if ($('pvFw')) $('pvFw').textContent = Studio.firmware || '—';
+            return null;
+        }
+        try {
+            const resp = await Studio.session.send(Wire.encodeGetFirmwareVersion(), { timeoutMs: 2000 });
+            const v = Wire.decodeFirmwareVersion(resp);
+            if (v) {
+                Studio.firmwareVersion = v;
+                Studio.firmware = v.label;
+                if ($('pvFw')) { $('pvFw').textContent = v.label; $('pvFw').title = 'git ' + v.sha + (v.dirty ? ' (dirty tree)' : '') + ' · ' + v.branch + ' · built ' + v.date + ' · ' + v.arena + (v.debug ? ' · DEBUG_SERIAL' : ''); }
+                rawLine('‹ firmware build: ' + v.label, 'info');
+                return v;
+            }
+        } catch (e) {
+            rawLine('firmware version: ' + (e && e.message ? e.message : e), 'warn');
+        }
+        return null;
+    };
+
     // ---- connection ----------------------------------------------------------
     async function toggleConnect() {
         if (!Studio.session) {
@@ -3674,6 +3739,8 @@ <h2 id="modalTitle">Import error</h2>
                         (info.mac ? ' · id ' + info.mac : ''), 'info');
                     const ctl = $('pvCtl');
                     if (ctl) ctl.textContent = Studio.controllerId || '— (needs fw with MAC in 0xC2)';
+                    await Studio.refreshFirmwareVersion(); // build identity → run_metadata.firmware
+                    if (Studio.initTelemetry) await Studio.initTelemetry(); // ring drain (T4) when the fw has it
                     // Un-grey the fw-gated rig-I/O roles now that caps are known
                     // (the role menu may have rendered before this reply landed).
                     if (Studio.updateRigIoGating) Studio.updateRigIoGating();
@@ -3855,6 +3922,8 @@ <h2 id="modalTitle">Import error</h2>
         const repoRef = Studio.currentDoc && Studio.currentDoc.repoRef;
         const q = window.StudioUrlState.encodeApp({
             mode: Studio.mode,
+            // fw #50 soak driver armed in this tab (advanced-only; clean-URL rule).
+            soak: !!Studio.soak,
             protocolKey: Studio.currentDoc && Studio.currentDoc.protocolKey,
             // Course-repo provenance (?repo=owner/name&p=<path>): set by a
             // validated ?repo= load or an in-app course-repo open/save.
@@ -3905,6 +3974,7 @@ <h2 id="modalTitle">Import error</h2>
     // ---- STOP (both buttons) --------------------------------------------------
     async function doStop() {
         if (!Studio.session) return;
+        Studio._userStopRequested = true; // distinguishes a user STOP from a link drop (watchdog self-reset)
         try { await Studio.session.stop(); } catch (e) { rawLine('stop error: ' + e.message, 'err'); }
     }
     $('btnStopRun').addEventListener('click', doStop);
@@ -4853,6 +4923,37 @@ <h2 id="modalTitle">Import error</h2>
     // ---- session subscriptions (the single spine) ----------------------------
     if (Studio.session) {
         Studio.session.on('state', refreshState);
+        // Identity on EVERY connection, including the gesture-free reconnect()
+        // paths (post-mortem reset, soak): re-read 0xC2 + 0xCB once per link-up
+        // so run_metadata.firmware is never stale or null after a reset. The
+        // manual Connect button does its own inline probe; this is the catch-all.
+        (function identityOnConnect() {
+            let identified = false;
+            Studio.session.on('state', async () => {
+                const on = Studio.session.connected;
+                if (!on) { identified = false; return; }
+                if (identified) return;
+                identified = true;
+                await new Promise((r) => setTimeout(r, 400)); // let the connect-time bring-up finish
+                if (!Studio.session.connected) return;
+                // Never skip on cached identity: after a reset/reflash the MAC is the
+                // same but the build (and its telemetry flag) may not be. 0xC2/0xCB are
+                // RAM reads (~2 ms) — a duplicate after the Connect button is harmless.
+                Studio.firmwareVersion = null;
+                try {
+                    const info = Wire.decodeControllerInfo(await Studio.session.send(Wire.encodeGetControllerInfo(), { timeoutMs: 2000 }));
+                    if (info) {
+                        Studio.capabilities = info.capabilities || [];
+                        Studio.controllerId = info.mac || Studio.controllerId || null;
+                        if (!Studio.firmware) Studio.firmware = 'v' + info.version;
+                        if ($('pvCtl')) $('pvCtl').textContent = Studio.controllerId || '—';
+                    }
+                    await Studio.refreshFirmwareVersion();
+                    if (Studio.initTelemetry) await Studio.initTelemetry();
+                    refreshState();
+                } catch (_) { /* best-effort: a wedged controller answers nothing */ }
+            });
+        })();
         Studio.session.on('runstatus', (s) => Studio.onRunStatus(s));
         Studio.session.on('log', (m) => logTransport(m));
         Studio.session.on('error', (e) => rawLine('error: ' + (e && e.message ? e.message : e), 'err'));
@@ -4875,7 +4976,20 @@ <h2 id="modalTitle">Import error</h2>
                 }
             });
         }
+        // Controller fault (fw #50): the closed-loop client latched
+        // controller_unresponsive → the runner is already aborting. Tell the
+        // operator now; the post-mortem lifecycle starts once the run's cleanup
+        // (best-effort STOP) has finished — see Studio.handleControllerFault.
+        Studio.session.on('fault', (f) => {
+            Studio._pendingFault = f || { kind: 'controller_unresponsive' };
+            const d = f || {};
+            rawLine('⚠ controller fault: ' + (d.kind || 'controller_unresponsive') +
+                (d.failures != null ? ' — ' + d.failures + ' of the last ' + d.window + ' frame commands failed' : '') +
+                (d.lastError ? ' (' + d.lastError + ')' : ''), 'err');
+            showBanner('⚠ Controller stopped answering — run aborted. Post-mortem probes follow (see the run log).');
+        });
         Studio.session.on('disconnect', (info) => {
+            if (info && info.involuntary) Studio._linkDropped = true; // consumed by runSteps (fault lifecycle)
             if (info && info.involuntary && Studio.activeRunLog && !Studio.activeRunLog.summary) {
                 Adapter.finishDisconnected(Studio.activeRunLog, { aborted: true, steps: 0, errors: 0, skipped: 0 });
                 onRunFinished(Studio.activeRunLog.summary);
@@ -4958,6 +5072,7 @@ <h2 id="modalTitle">Import error</h2>
         // bench action should confirm + STOP first (design §5 collision rule).
         if (session && session.running) {
             if (!confirm('A sequence is running. Interrupt it (STOP) and run this bench action?')) return;
+            Studio._userStopRequested = true;
             session.stop();
         }
         fn();
@@ -5021,6 +5136,7 @@ <h2 id="modalTitle">Import error</h2>
         if (!Array.isArray(Studio.capabilities) || !Studio.capabilities.includes('io_ext')) return { ok: false, reason: 'needs io_ext firmware' };
         if (!aiUser.enabled) return { ok: false, reason: 'paused' };
         if (session.running) return { ok: false, reason: 'paused — run active' };
+        if (Studio._activePostmortem) return { ok: false, reason: 'paused — post-mortem owns the link' };
         // The Console's own FicTrac closed loop (bridge 'apply') streams 0x70 at
         // ~100 Hz outside the runner — a 10 Hz read interleaved into that stream
         // adds latency jitter to frames, so yield the link to it as well.
@@ -5390,6 +5506,10 @@ <h2 id="modalTitle">Import error</h2>
                 if (Studio.updateRigIoGating) Studio.updateRigIoGating(); // refresh fw-gated role options
                 clog('  fw v' + info.version + ' · caps [' + info.capabilities.join(', ') + ']' +
                     (info.mac ? ' · id ' + info.mac : ' · (no MAC in reply — older fw)'), 'info');
+                const fv = await Studio.refreshFirmwareVersion();
+                if (fv) clog('  build ' + fv.label, 'info');
+                else if ((info.capabilities || []).includes('health')) clog('  build: (no 0xCB reply)', 'warn');
+                else clog('  build: unknown — this firmware predates GET_FIRMWARE_VERSION (0xCB)', 'warn');
             }
         },
         ip: async () => { const r = await send(Wire.encodeGetIp(), 'GET_ETHERNET_IP 0xC1'); const ip = r && Wire.decodeIp && Wire.decodeIp(r); if (ip) clog('  ip ' + ip, 'info'); },
@@ -5403,6 +5523,31 @@ <h2 id="modalTitle">Import error</h2>
         setrate: () => send(Wire.encodeSetRefreshRate(num('cRrHz')), 'SET_REFRESH_RATE 0x16 ' + num('cRrHz') + ' Hz'),
         getrate: async () => { const r = await send(Wire.encodeGetRefreshRate(), 'GET_REFRESH_RATE 0x17'); const v = r && Wire.decodeRefreshRate(r); if (v != null) $('cRrHz').value = String(v); },
         sysreset: () => guardDestructive(() => { if (confirm('SYSTEM_RESET (0x01) reboots the controller firmware. Continue?')) send(Wire.encodeSystemReset(), 'SYSTEM_RESET 0x01'); }),
+        // Controller health (fw #50): one GET_HEALTH read, decoded into the log.
+        // The reply is also an ordinary arena_command row; the decoded fields go
+        // into the run log as a typed `health` event when the bridge is logging.
+        ctelem: () => {
+            const on = !Studio.telemetryEnabled();
+            Studio.setTelemetryEnabled(on);
+            clog('telemetry ring ' + (on ? 'ENABLED' : 'DISABLED') + ' (remembered)', on ? 'info' : 'warn');
+        },
+        chealth: async () => {
+            const r = await send(Wire.encodeGetHealth(), 'GET_HEALTH 0xCA', { timeoutMs: 2000 });
+            const h = r && Wire.decodeHealth(r);
+            if (!h) { clog('health: no/short reply — firmware without GET_HEALTH (capability bit 7)?', 'warn'); return; }
+            clog('health: up ' + (h.uptimeMs / 1000).toFixed(0) + ' s · loop max ' + h.loopMaxUs + ' µs (1 s: ' + h.loopMax1sUs + ') · SD reads ' + h.sdReads + ' max ' + h.sdReadMaxUs + ' µs err ' + h.sdErr +
+                 ' · frames ' + h.framesSent + ' · isr ' + h.isrCount + ' · 0x70 ' + h.cmd70Count + ' · state ' + h.state + ' frame ' + h.curFrame +
+                 ' · reset 0x' + h.resetCause.toString(16) + ' · prev boot: ' + h.prevBreadcrumbOp + (h.prevSlowOpName ? ' (slowest ' + h.prevSlowOpName + ' ' + h.prevSlowUs + ' µs)' : '') +
+                 (h.slowOpName ? ' · this boot slowest ' + h.slowOpName + ' ' + h.slowUs + ' µs' : ''), 'info');
+            if (h.wdogFlags !== undefined) {
+                clog('health v2: prev boot ISR ' + h.prevIsrLastName + ' (' + h.prevIsrCount + ' entries)' + (h.prevResetWasWatchdog ? ' · PREVIOUS RESET = WATCHDOG' : '') + (h.prevPcCaptured ? ' · captured PC ' + h.prevWdogPcHex + ' LR ' + h.prevWdogLrHex : '') +
+                     ' · wdog ' + (h.wdogArmed ? 'armed' : 'OFF') + (h.wdogSuspended ? ' (suspended)' : '') + (h.wdogStarving ? ' STARVING' : '') + (h.wdogConfigFailed ? ' CONFIG FAILED' : '') + ' kicks ' + h.wdogKicks + ' · this boot ISR ' + h.isrLastName + ' (' + h.isrCount + ')' + (h.wdogCsNow !== undefined ? ' · WDOG3_CS boot ' + h.wdogCsBootHex + ' now ' + h.wdogCsNowHex + (h.wdogHwEnabled ? ' (HW ENABLED)' : ' (HW OFF!)') : '') + (h.wdogTimeoutS != null ? ' · timeout ' + h.wdogTimeoutS + ' s (tick ' + h.wdogTickHz + ' Hz, verify 0x' + h.wdogVerify.toString(16) + ')' : ''), h.prevResetWasWatchdog ? 'warn' : 'info');
+            }
+            const cr = await Studio.readCrashReport();
+            if (cr) clog('crash report: ' + (cr.present ? cr.faultName + ' ret ' + cr.retAddrHex + ' cfsr 0x' + cr.cfsr.toString(16) + ' hfsr 0x' + cr.hfsr.toString(16) + ' bfar 0x' + cr.bfar.toString(16) + ' mmfar 0x' + cr.mmfar.toString(16) : 'none recorded'), cr.present ? 'warn' : 'dim');
+            const b = Studio.session && Studio.session.bridge;
+            if (b && b.logging) b.log({ event: 'health', source: 'console', health: h });
+        },
         // Rig I/O (#135) — reapply the rig's power-on defaults (module-block hook)
         cioapply: () => { if (Studio.applyRigIo) Studio.applyRigIo({ manual: true }); else clog('rig io: module block not loaded', 'err'); },
         // raw hex
@@ -7920,6 +8065,16 @@ <h2 id="modalTitle">Import error</h2>
     if (!Studio.session.connected) {
         try { await Studio.session.connect(); } catch (e) { Studio.showBanner('Connect failed: ' + e.message); return; }
     }
+    return Studio.runOnce(isExperiment);
+};
+
+// The repeatable half of beginRun — no dialogs, no port request; the caller
+// has done the one-time preflight (rig confirm + connect). Returns the runner
+// summary ({completed, aborted, fault, stopAcked, …}) or null if it could not
+// start. The soak driver loops on this.
+Studio.runOnce = async function (isExperiment) {
+    const doc = Studio.currentDoc;
+    if (!doc || !Studio.session || !Studio.session.connected) return null;
     const exp = doc.experiment;
     const { steps } = RunnerLib.flattenStructure(exp, { shuffle: shuffleInPlace });
     const conditionsByName = new Map((exp.conditions || []).map((c) => [c.name, c]));
@@ -7948,7 +8103,312 @@ <h2 id="modalTitle">Import error</h2>
     Studio._runCmdCount = cmdCount;
     const totalSec = durSum + cmdCount * Studio.runOverheadPerCmd();
     if (Studio.startRunTimer) Studio.startRunTimer(totalSec);
-    await runSteps(steps, conditionsByName, exp, isExperiment);
+    return runSteps(steps, conditionsByName, exp, isExperiment);
+};
+
+// ---- soak driver (fw #50 reproduction harness; advanced-only) --------------
+// Repeats the open protocol unattended. Each iteration is a TEST-intent run
+// (bridge-logged, never auto-committed). Refuses to start unless the bridge
+// confirms behavior_v2 logging (fail closed) and FicTrac/simulator frames are
+// arriving. A fault ends the iteration through the normal path; the
+// post-mortem result decides whether the soak continues (recovered) or stops.
+Studio.soak = null;
+const SOAK_DEFAULTS = { iterations: 0, hours: 12, gapS: 10, firstFault: 'halt', policy: 'reset-continue', maxResets: 3 };
+function parseSoakSpec(text) {
+    const cfg = Object.assign({}, SOAK_DEFAULTS);
+    String(text || '').split(/[\s,;]+/).filter(Boolean).forEach((kv) => {
+        const m = kv.match(/^([a-z_]+)=(.+)$/i);
+        if (!m) return;
+        const k = m[1].toLowerCase(); const v = m[2];
+        if (k === 'iterations' || k === 'n') cfg.iterations = Math.max(0, parseInt(v, 10) || 0);
+        else if (k === 'hours' || k === 'h') cfg.hours = Math.max(0, parseFloat(v) || 0);
+        else if (k === 'gap') cfg.gapS = Math.max(0, parseFloat(v) || 0);
+        else if (k === 'first') cfg.firstFault = /^reset/i.test(v) ? 'reset-continue' : 'halt';
+        else if (k === 'then' || k === 'policy') cfg.policy = /^halt/i.test(v) ? 'halt' : 'reset-continue';
+        else if (k === 'max' || k === 'max_resets') cfg.maxResets = Math.max(0, parseInt(v, 10) || 0);
+    });
+    return cfg;
+}
+Studio.parseSoakSpec = parseSoakSpec;
+const sleepMs = (ms) => new Promise((r) => setTimeout(r, ms));
+
+Studio.openSoakDialog = async function () {
+    if (!Studio.advanced) { Studio.showBanner('Soak is an advanced-mode feature (unlock with ?advanced=1).'); return; }
+    if (Studio.soak) {
+        if (confirm('A soak is running (iteration ' + Studio.soak.iteration + '). Stop it after the current run?')) Studio.stopSoak('operator');
+        return;
+    }
+    if (!Studio.currentDoc) { Studio.showBanner('Open the soak protocol first (File ▾ → Open… → protocols/soak_mode3_closed_loop.yaml).'); return; }
+    const spec = prompt(
+        'Soak the open protocol. Edit and OK:\n' +
+        '  iterations=N (0 = until hours elapse)   hours=H   gap=S (seconds between runs)\n' +
+        '  first=halt|reset   (first fault: halt = leave wedged for inspection)\n' +
+        '  then=reset|halt    max=R (SYSTEM_RESET attempts before halting)',
+        'iterations=0 hours=12 gap=10 first=halt then=reset max=3'
+    );
+    if (spec == null) return;
+    await Studio.startSoak(parseSoakSpec(spec));
+};
+
+Studio.startSoak = async function (cfg) {
+    if (Studio.soak) return;
+    if (!Studio.advanced) { Studio.showBanner('Soak is an advanced-mode feature.'); return; }
+    const doc = Studio.currentDoc;
+    if (!doc || !Studio.session) { Studio.showBanner('Soak: open a protocol first.'); return; }
+    if (!Studio.session.connected) {
+        try { await Studio.session.connect(); } catch (e) { Studio.showBanner('Soak: connect failed — ' + e.message); return; }
+    }
+    const bridge = Studio.session.bridge;
+    if (!bridge) { Studio.showBanner('Soak: the FicTrac bridge client is not loaded.'); return; }
+    // Fail closed on the log format: a night of behavior_v1 is 4× the disk and
+    // the analyzer's slow path. The runner asserts the level per run; we need the
+    // ACK before the first run starts.
+    if (bridge.setLogLevel) bridge.setLogLevel('behavior_v2');
+    bridge.setLogging(true);
+    const ftUrl = ((($('cFtUrl') || {}).value) || 'ws://localhost:8765').trim();
+    if (!bridge.connected) {
+        try { bridge.connect(ftUrl); } catch (_) { /* surfaces below */ }
+        for (let i = 0; i < 40 && !bridge.connected; i++) await sleepMs(25);
+    }
+    if (!bridge.connected) { Studio.showBanner('Soak refused: bridge not connected (' + ftUrl + ') — start `pixi run bridge`.'); return; }
+    const ack = bridge.waitForLogLevelAck ? await bridge.waitForLogLevelAck(1500) : null;
+    if (ack !== 'behavior_v2') {
+        Studio.showBanner('Soak refused: the bridge did not confirm behavior_v2 logging (' + (ack || 'no ack') + ') — `git pull` + restart `pixi run bridge`.');
+        return;
+    }
+    // Input freshness: without simulator/FicTrac frames a Mode-3 soak drives nothing.
+    let rate = bridge.stats ? bridge.stats.rateHz : 0;
+    if (!(rate > 0)) { await sleepMs(1500); rate = bridge.stats ? bridge.stats.rateHz : 0; }
+    if (!(rate > 0)) { Studio.showBanner('Soak refused: no FicTrac frames arriving at the bridge — start `pixi run sim -- --count 0 --rate 100`.'); return; }
+    const s = Studio.soak = Object.assign({}, SOAK_DEFAULTS, cfg || {}, {
+        iteration: 0, faults: 0, resets: 0, stop: false, stopReason: null, startedMs: Date.now(),
+        untilMs: 0
+    });
+    if (s.hours > 0) s.untilMs = s.startedMs + s.hours * 3600e3;
+    $('fmSoak') && $('fmSoak').classList.add('soaking');
+    Studio.updateUrl && Studio.updateUrl({ push: false });
+    const logSoak = (o) => { if (bridge.logging) bridge.log(Object.assign({ event: 'soak' }, o)); };
+    const desc = (s.iterations ? s.iterations + ' iterations' : 'until stopped') + (s.hours ? ', ≤ ' + s.hours + ' h' : '') +
+        ', gap ' + s.gapS + ' s, first fault: ' + s.firstFault + ', then: ' + s.policy + ' (max ' + s.maxResets + ' resets)';
+    logSoak({ phase: 'start', protocol: doc.filename, sha256: doc.sha256, config: { iterations: s.iterations, hours: s.hours, gap_s: s.gapS, first_fault: s.firstFault, policy: s.policy, max_resets: s.maxResets }, sim_rate_hz: rate });
+    Studio.rawLog('soak started — ' + desc, 'info');
+    Studio.showBanner('Soak running — ' + desc + '. File ▾ → Soak… to stop.');
+    (async () => {
+        let reason = 'done';
+        try {
+            for (;;) {
+                if (s.stop) { reason = s.stopReason || 'operator'; break; }
+                if (s.iterations && s.iteration >= s.iterations) { reason = 'iterations'; break; }
+                if (s.untilMs && Date.now() >= s.untilMs) { reason = 'hours'; break; }
+                if (!Studio.session.connected) { reason = 'disconnected'; break; }
+                s.iteration++;
+                Studio._lastPostmortem = null;
+                logSoak({ phase: 'iteration-start', iteration: s.iteration, elapsed_s: Math.round((Date.now() - s.startedMs) / 1000) });
+                Studio.rawLog('soak iteration ' + s.iteration + (s.iterations ? ' / ' + s.iterations : '') + ' starting', 'info');
+                const applied0 = bridge.stats ? bridge.stats.applied : 0;
+                const t0 = Date.now();
+                const res = await Studio.runOnce(false);
+                const pmo = Studio._lastPostmortem;
+                // Exposure, not iteration count, is the unit of evidence: record how
+                // many 0x70s this iteration actually delivered. A completed iteration
+                // that streamed almost nothing (simulator died mid-trial) is
+                // 'unexercised', not 'completed' — it must not count as clean soak time.
+                const applied = (bridge.stats ? bridge.stats.applied : 0) - applied0;
+                const durS = (Date.now() - t0) / 1000;
+                const exercised = applied >= Math.min(1000, 5 * durS); // ≥ 5 Hz average, or 1000 total
+                let outcome = !res ? 'not-started' : res.fault ? 'fault' : res.aborted ? 'aborted' : exercised ? 'completed' : 'unexercised';
+                logSoak({
+                    phase: 'iteration-end', iteration: s.iteration,
+                    outcome,
+                    fault: res && res.fault ? res.fault : null,
+                    stop_acked: res ? res.stopAcked : null,
+                    postmortem: pmo ? pmo.outcome : null,
+                    applied_0x70: applied, duration_s: Math.round(durS),
+                    telemetry: Studio.telemetry ? Object.assign({}, Studio.telemetry.drainer.stats) : null
+                });
+                if (!res) { reason = 'run-not-started'; break; }
+                if (outcome === 'unexercised') {
+                    s.unexercised = (s.unexercised || 0) + 1;
+                    Studio.rawLog('soak: iteration ' + s.iteration + ' delivered only ' + applied + ' frame commands in ' + Math.round(durS) + ' s — unexercised (simulator/bridge?)', 'warn');
+                }
+                if (res.fault) {
+                    s.faults++;
+                    if (!pmo || (pmo.outcome !== 'recovered' && pmo.outcome !== 'self-reset')) { reason = pmo ? 'fault-' + pmo.outcome : 'fault'; break; }
+                    s.resets++;
+                    Studio.rawLog('soak: controller recovered (reset ' + s.resets + '/' + s.maxResets + ') — continuing', 'warn');
+                } else if (res.aborted) { reason = 'operator-stop'; break; }
+                if (s.stop) { reason = s.stopReason || 'operator'; break; }
+                // Gap + input freshness re-check (a dead simulator is a harness
+                // problem, not a controller fault — pause, don't count it).
+                await sleepMs(s.gapS * 1000);
+                // A protocol whose last step disconnects the fictrac plugin takes
+                // the bridge down with it; bring it back before judging freshness
+                // (bench 2026-09-11: the loop otherwise waits 10 min for frames).
+                if (!bridge.connected) {
+                    try { bridge.connect(ftUrl); } catch (_) { /* surfaces below */ }
+                    for (let i = 0; i < 40 && !bridge.connected; i++) await sleepMs(50);
+                    await sleepMs(1200); // one rate-timer tick so rateHz is fresh
+                }
+                let r2 = bridge.stats ? bridge.stats.rateHz : 0;
+                let waited = 0;
+                while (!(r2 > 0) && !s.stop && waited < 600) {
+                    if (waited === 0) { Studio.rawLog('soak: no FicTrac frames — waiting for the simulator (restart `pixi run sim`)', 'warn'); logSoak({ phase: 'paused', iteration: s.iteration, reason: 'no-frames' }); }
+                    await sleepMs(5000); waited += 5;
+                    r2 = bridge.stats ? bridge.stats.rateHz : 0;
+                }
+                if (s.stop) { reason = s.stopReason || 'operator'; break; }
+                if (!(r2 > 0)) { reason = 'no-frames'; break; }
+            }
+        } catch (e) {
+            reason = 'error: ' + (e && e.message ? e.message : e);
+        }
+        logSoak({ phase: 'end', reason, iterations: s.iteration, faults: s.faults, resets: s.resets, elapsed_s: Math.round((Date.now() - s.startedMs) / 1000) });
+        Studio.rawLog('soak ended (' + reason + ') after ' + s.iteration + ' iteration(s), ' + s.faults + ' fault(s), ' + s.resets + ' reset(s)', /fault|error/.test(reason) ? 'err' : 'info');
+        Studio.showBanner('Soak ended: ' + reason + ' — ' + s.iteration + ' iteration(s), ' + s.faults + ' fault(s). Logs are on the bridge (`pixi run python scripts/wedge-scan.py <log-dir>`).');
+        Studio.soak = null;
+        $('fmSoak') && $('fmSoak').classList.remove('soaking');
+        Studio.updateUrl && Studio.updateUrl({ push: false });
+    })();
+};
+
+Studio.stopSoak = function (reason) {
+    if (!Studio.soak) return;
+    Studio.soak.stop = true;
+    Studio.soak.stopReason = reason || 'operator';
+    if (Studio._activePostmortem) Studio._activePostmortem.abort();
+    Studio.rawLog('soak: stop requested — finishing the current run', 'warn');
+};
+$('fmSoak') && $('fmSoak').addEventListener('click', () => Studio.openSoakDialog());
+
+// ---- controller telemetry ring (T4: soak with ring-buffer logging) ---------
+// The controller keeps CMD/FRAME/STATE records in reboot-surviving RAM; we
+// drain them at 10 Hz over the same link (single-flight, ack cursor — lossless)
+// and write them into the run log as compact "cc"/"cf"/"cs" rows next to the
+// FicTrac frames and arena echoes. Enabled per connection when the firmware
+// advertises `health` AND answers SET_TELEMETRY; silent otherwise.
+Studio.telemetry = null;
+Studio.telemetryAvailable = false;
+// Instrumentation is an experimental factor: an off switch (remembered) so a
+// telemetry-off control arm is one click, not a firmware swap. Default ON.
+Studio.telemetryEnabled = function () { try { return localStorage.getItem('studio_telemetry') !== 'off'; } catch (_) { return true; } };
+Studio.setTelemetryEnabled = function (on) {
+    try { localStorage.setItem('studio_telemetry', on ? 'on' : 'off'); } catch (_) { /* private mode */ }
+    if (!on) Studio.stopTelemetry('switched off');
+    else if (Studio.session && Studio.session.connected) Studio.initTelemetry();
+    Studio.rawLog('telemetry ring: ' + (on ? 'enabled (drains on the next connection or now)' : 'disabled — telemetry-off control arm'), 'info');
+};
+Studio.stopTelemetry = function (why) {
+    Studio.telemetryAvailable = false;
+    if (Studio.telemetry) { Studio.telemetry.poller.stop(); Studio.rawLog('telemetry ring: poller stopped (' + (why || '') + ')', 'dim'); }
+};
+Studio.initTelemetry = async function () {
+    const AT = window.ArenaTelemetry;
+    if (!AT || !Studio.session || !Studio.session.connected) return false;
+    // Gate: ONLY the firmware's own declaration (GET_FIRMWARE_VERSION flags bit 2).
+    // `health` alone is not enough — health-only builds (22b756dd) answer 0xA8
+    // with CE_UNKNOWN_CMD and an error glyph on the arena (no blind probes).
+    const fv = Studio.firmwareVersion;
+    if (!fv || !fv.telemetry || !Wire.encodeSetTelemetry || !Studio.telemetryEnabled()) {
+        Studio.stopTelemetry(!fv || !fv.telemetry ? 'firmware has no ring' : 'disabled by setting');
+        return false;
+    }
+    try {
+        const r = await Studio.session.send(Wire.encodeSetTelemetry(1), { timeoutMs: 2000 });
+        const d = Wire.decodeResponse(r);
+        Studio.telemetryAvailable = !!(d && d.ok);
+    } catch (_) {
+        Studio.telemetryAvailable = false;
+    }
+    if (!Studio.telemetryAvailable) {
+        Studio.stopTelemetry('SET_TELEMETRY refused');
+        Studio.rawLog('telemetry ring: firmware declares it but SET_TELEMETRY was refused', 'warn');
+        return false;
+    }
+    if (!Studio.telemetry) {
+        const drainer = AT.createDrainer({
+            session: Studio.session,
+            wire: Wire,
+            maxBytes: 178, // firmware reply budget: 3 + payload < 200 ⇒ 196 − 18 B header
+            onRecords: (block, rows) => {
+                // Return the bridge's acceptance: false ⇒ the drainer withholds its ack
+                // and the controller keeps the records (bridge down / logging off).
+                const b = Studio.session.bridge;
+                return b && typeof b.logRows === 'function' ? b.logRows(rows) !== false : false;
+            }
+        });
+        const poller = AT.createPoller({
+            drainer,
+            canPoll: () => {
+                if (!Studio.session.connected) return { ok: false, reason: 'disconnected' };
+                if (Studio._activePostmortem) return { ok: false, reason: 'post-mortem owns the link' };
+                // No sink ⇒ don't poll: rows would be refused (ack withheld) and the same
+                // block re-read every 100 ms. The ring keeps the last ~6 s on the
+                // controller; when logging starts the drain resumes with that backlog.
+                const b = Studio.session.bridge;
+                if (!(b && b.connected && b.logging)) return { ok: false, reason: 'bridge not logging' };
+                if (Studio.session.outputInhibited) return { ok: false, reason: 'output inhibited' };
+                return { ok: true };
+            },
+            onState: (s, r) => { if (s === 'paused' && r) Studio.rawLog('telemetry poller paused: ' + r, 'dim'); }
+        });
+        Studio.telemetry = { drainer, poller, startedMs: Date.now(), lastReport: null };
+        poller.start(100);
+        // A quiet stats line once a minute (only when something changed).
+        setInterval(() => {
+            const st = drainer.stats;
+            const key = [st.records, st.dropped, st.gaps, st.errors, st.notStored].join('/');
+            if (key === Studio.telemetry.lastReport) return;
+            Studio.telemetry.lastReport = key;
+            Studio.rawLog('telemetry ring: ' + st.records + ' records · ' + st.blocks + ' blocks · ' + (st.bytes / 1024).toFixed(1) + ' KiB · dropped ' + st.dropped + ' · gaps ' + st.gaps + ' · errors ' + st.errors + (st.notStored ? ' · refused by bridge ' + st.notStored : '') + (st.heapCollision ? ' · RING DISABLED (heap collision)' : '') + (st.survivedReboot ? ' · ring survived a reboot (boot #' + st.bootCount + ')' : ''), 'dim');
+        }, 60000);
+    } else {
+        Studio.telemetry.drainer.rearm(); // NO_ACK first: learn the ring incarnation before freeing anything
+        Studio.telemetry.poller.start(100);
+    }
+    Studio.rawLog('telemetry ring: on (10 Hz drain, rows cc/cf/cs → run log)', 'info');
+    return true;
+};
+
+// PJRC CrashReport passthrough (0xCC, fw fb11681) — gated like the ring on the
+// 0xCB telemetry flag. Logged as a `crash_report` event (raw hex kept). Null when
+// the firmware lacks it or the link is down; never throws.
+Studio.readCrashReport = async function () {
+    const fv = Studio.firmwareVersion;
+    if (!fv || !fv.crashReport || !Wire.encodeGetCrashReport || !Studio.session || !Studio.session.connected) return null; // 0xCB flags bit 3, never the ring bit (c47ee68 has the ring but not 0xCC)
+    try {
+        const cr = Wire.decodeCrashReport(await Studio.session.send(Wire.encodeGetCrashReport(), { timeoutMs: 2000 }));
+        const b = Studio.session.bridge;
+        if (cr && b && b.logging) b.log({ event: 'crash_report', present: cr.present, fault: cr.faultName, ret_addr: cr.retAddrHex, cfsr: cr.cfsr, hfsr: cr.hfsr, bfar: cr.bfar, mmfar: cr.mmfar, raw_hex: cr.rawHex });
+        return cr;
+    } catch (_) { return null; }
+};
+
+// Drain everything the controller holds (post-reboot crash dump). Returns a
+// JSON-safe summary; the rows themselves go to the bridge log via onRecords.
+Studio.drainTelemetry = async function (tag) {
+    if (!Studio.telemetry || !Studio.session.connected) return null;
+    const d = Studio.telemetry.drainer;
+    const before = d.stats.records;
+    d.rearm(); // post-reboot: never free records with a pre-reboot ack (incarnation check)
+    const blocks = await d.drainAll(600);
+    const recs = [];
+    const rawBlocks = []; // raw payload hex per block — decoder-independent evidence
+    for (const b of blocks) {
+        for (const r of b.records) recs.push(r);
+        if (b.rawHex) rawBlocks.push(b.rawHex);
+    }
+    const tail = recs.slice(-30).map((r) =>
+        r.kind === 'cmd' ? 'CMD 0x' + r.cmd.toString(16) + ' st' + r.status + ' @' + r.tUs :
+        r.kind === 'frame' ? 'FRAME idx' + r.idx + ' sd' + r.sdLoadUs + 'us spi' + r.spiUs + 'us @' + r.tUs :
+        r.kind === 'state' ? 'STATE ' + r.stateName + ' ' + (r.codeName || r.code) + ' ' + r.arg + ' @' + r.tUs : '?');
+    const summary = { tag: tag || 'drain', records: recs.length, blocks: blocks.length, survivedReboot: d.stats.survivedReboot, bootCount: d.stats.bootCount, dropped: d.stats.dropped, gaps: d.stats.gaps, heapCollision: !!d.stats.heapCollision, tail };
+    Studio.rawLog('telemetry dump (' + summary.tag + '): ' + recs.length + ' records' + (d.stats.survivedReboot ? ' — ring survived the reboot' : '') + (tail.length ? '\n  ' + tail.join('\n  ') : ''), recs.length ? 'warn' : 'dim');
+    const b = Studio.session.bridge;
+    if (b && b.logging) b.log({ event: 'telemetry_dump', summary, raw_blocks: rawBlocks });
+    // Evidence order: health (caller) → ring (above) → PJRC crash report (RAM read).
+    const cr = await Studio.readCrashReport();
+    if (cr) summary.crashReport = { present: cr.present, fault: cr.faultName, retAddr: cr.retAddrHex };
+    return summary;
 };
 
 Studio.runCondition = async function (name) {
@@ -8032,8 +8492,10 @@ <h2 id="modalTitle">Import error</h2>
         // Frame-logging level is a runtime/session setting (File ▾ → Run logging),
         // NOT per-protocol. Assert it here so a recorded run logs deterministically
         // at the chosen level — this OVERRIDES any ad-hoc Console log toggle state.
+        // A soak ALWAYS logs behavior_v2 (its preflight negotiated it; a remembered
+        // behavior_v1 session setting must not override it — bench 2026-09-11).
         if (bridge.setLogLevel)
-            bridge.setLogLevel(Studio.sessionLogLevel ? Studio.sessionLogLevel() : 'behavior_v2');
+            bridge.setLogLevel(Studio.soak ? 'behavior_v2' : Studio.sessionLogLevel ? Studio.sessionLogLevel() : 'behavior_v2');
         bridge.setLogging(true); // universal default-on: no experiment untracked
         if ($('cFtLog')) $('cFtLog').checked = true; // keep the console toggle honest
         const ftUrl = ((($('cFtUrl') || {}).value) || 'ws://localhost:8765').trim();
@@ -8078,16 +8540,31 @@ <h2 id="modalTitle">Import error</h2>
         // `log_format` names the line format of THIS file (the bridge's acked
         // level, or the inferred one for a non-acking old bridge) so readers that
         // skip the frame_schema line still know what they hold.
-        if (isExperiment && bridge.connected && Studio.activeRunLog) {
-            bridge.log(Object.assign({ event: 'run_metadata', rig_id: Studio.rigId || null, log_format: logLevel },
-                Studio.activeRunLog.meta));
-        }
-    }
+        // Soak iterations are TEST-intent runs (never auto-committed) but still
+        // get the run_metadata line so a soak log is self-describing.
+        if ((isExperiment || Studio.soak) && bridge.connected && Studio.activeRunLog) {
+            const md = Object.assign({ event: 'run_metadata', rig_id: Studio.rigId || null, log_format: logLevel },
+                Studio.activeRunLog.meta);
+            if (Studio.soak) md.soak = { iteration: Studio.soak.iteration, policy: Studio.soak.policy, first_fault: Studio.soak.firstFault };
+            // Instrumentation is an experimental factor — say whether the 10 Hz
+            // ring drain was interleaved with this run's commands.
+            md.telemetry = Studio.telemetryAvailable ? 'ring-10hz' : 'off';
+            bridge.log(md);
+        }
+        // Controller telemetry streams (T4): declare the compact row schema once
+        // per log file so readers know the cc/cf/cs columns.
+        if (Studio.telemetryAvailable && bridge.connected && window.ArenaTelemetry) {
+            bridge.log({ event: 'stream_schema', streams: window.ArenaTelemetry.STREAM_SCHEMA });
+        }
+    }
+    let summary = null;
+    Studio._userStopRequested = false;
+    Studio._linkDropped = false;
     try {
         // NOTE: do NOT pass onProgress — the session broadcasts 'runstatus' which
         // Studio.onRunStatus (subscribed once) consumes, so the log/highlight stay
         // live across view switches.
-        await Studio.session.runSequence({
+        summary = await Studio.session.runSequence({
             steps,
             conditionsByName,
             resolvePatternId: resolvePatternIdForCmd,
@@ -8097,6 +8574,23 @@ <h2 id="modalTitle">Import error</h2>
                 : undefined,
             fictracPluginNames: new Set(ftNames)
         });
+        // Controller fault (fw #50) — either the closed-loop client tripped
+        // (bridge 'fault' → runner.fault) or a protocol command timed out; both
+        // land in summary.fault. The runner's cleanup (best-effort STOP) has
+        // finished by now, so the post-mortem lifecycle owns the link.
+        // A run that ended because the LINK DROPPED (controller re-enumerated
+        // mid-run) and not because the user pressed STOP is a controller event:
+        // with the hardware watchdog (fw 86eeb4a) a hang shows up exactly like
+        // this, ~0.5 s in. Route it through the same lifecycle — the post-mortem
+        // takes its self-reset path (reconnect → identity → health → ring dump).
+        if (summary && !summary.fault && summary.aborted && Studio._linkDropped && !Studio._userStopRequested) {
+            summary.fault = 'link_dropped';
+            summary.faultDetail = { kind: 'link_dropped', note: 'controller re-enumerated mid-run (watchdog self-reset?)' };
+            Studio.rawLog('run ended by a link drop, not a STOP — treating as a controller event', 'warn');
+        }
+        if (summary && summary.fault) {
+            Studio._lastPostmortem = await Studio.handleControllerFault(summary);
+        }
     } catch (e) {
         Studio.rawLog('run error: ' + (e && e.message ? e.message : e), 'err');
         if (Studio.activeRunLog && !Studio.activeRunLog.summary) {
@@ -8106,8 +8600,69 @@ <h2 id="modalTitle">Import error</h2>
         document.body.classList.remove('testing');
         Studio.refreshState();
     }
+    return summary;
 }
 
+// ---- controller-fault post-mortem (fw #50) --------------------------------
+// Runs AFTER the faulted run has unwound. Policy: outside a soak, or on a
+// soak's FIRST fault when configured halt-first, probe and leave the controller
+// as-is (evidence first); otherwise probe → SYSTEM_RESET → reconnect → verify
+// the MAC → post-reset probe, and the soak continues if it recovered.
+Studio._lastPostmortem = null;
+Studio._activePostmortem = null;
+Studio.handleControllerFault = async function (summary) {
+    const PM = window.StudioPostmortem;
+    if (!PM || !Studio.session) return null;
+    const s = Studio.soak;
+    let policy = 'halt';
+    if (s) {
+        if (s.faults === 0 && s.firstFault === 'halt') policy = 'halt';
+        else if (s.resets < s.maxResets) policy = s.policy;
+    }
+    const pm = PM.createPostmortem({
+        session: Studio.session,
+        wire: Wire,
+        log: (m, k) => Studio.rawLog('post-mortem: ' + m, k || 'info'),
+        // After a successful reset+reconnect, pull the ring's crash dump.
+        afterReconnect: () => Studio.drainTelemetry('post-reset')
+    });
+    Studio._activePostmortem = pm;
+    // Exclusive link: stop the 10 Hz drain and wait for any chunk loop in flight
+    // BEFORE the quiet period starts (otherwise the quiet period is not quiet).
+    if (Studio.telemetry) {
+        Studio.telemetry.poller.stop();
+        try { await Studio.telemetry.drainer.idle(); } catch (_) { /* never blocks the lifecycle */ }
+    }
+    Studio.showBanner('⚠ Controller fault — post-mortem probes running (' + policy + '). Do not unplug.');
+    try {
+        const res = await pm.run({
+            policy,
+            expectMac: Studio.controllerId || null,
+            faultDetail: Object.assign({ reason: summary.fault }, summary.faultDetail || {})
+        });
+        Studio.showBanner(
+            res.outcome === 'transient' ? 'Controller answered normally again — transient stall, run still aborted.' :
+            res.outcome === 'self-reset' ? 'Controller reset itself (watchdog) and came back — evidence captured (health, ring, crash report); soak continues.' :
+            res.outcome === 'recovered' ? 'Controller recovered after SYSTEM_RESET' + (res.reset && res.reset.prevSlowOp ? ' (slowest op before: ' + res.reset.prevSlowOp + ')' : '') + '.' :
+            res.outcome === 'halted' ? 'Post-mortem done — controller left wedged for inspection (halt policy). Power-cycle or Debug ▾ → Reset controller when finished.' :
+            'Post-mortem: ' + res.outcome + ' — see the run log.'
+        );
+        return res;
+    } catch (e) {
+        Studio.rawLog('post-mortem error: ' + (e && e.message ? e.message : e), 'err');
+        return { outcome: 'error', error: e && e.message };
+    } finally {
+        Studio._activePostmortem = null;
+        Studio._pendingFault = null;
+        // The run log's export/commit waited for this post-mortem (evidence first).
+        const commit = Studio._pendingCommit;
+        Studio._pendingCommit = null;
+        if (commit) { try { await commit(); } catch (e) { Studio.rawLog('deferred run-log commit failed: ' + (e && e.message ? e.message : e), 'err'); } }
+        // Resume the ring drain only on a live, identified link (recovered controller).
+        if (Studio.telemetry && Studio.telemetryAvailable && Studio.session.connected && Studio.telemetryEnabled()) Studio.telemetry.poller.start(100);
+    }
+};
+
 function shuffleInPlace(arr) {
     for (let i = arr.length - 1; i > 0; i--) {
         const j = Math.floor(Math.random() * (i + 1));
@@ -9482,6 +10037,12 @@ <h2 id="modalTitle">Import error</h2>
         // NOTE: lockSafe/unlockAdvanced live in the classic shell IIFE, not this
         // module scope — call them via the exposed Studio.* refs (a bare name here
         // throws a ReferenceError that the finally-block would silently mask).
+        // ?soak=1 arms the soak driver (advanced-only). It never auto-starts —
+        // connecting needs a click — it just tells the operator where the switch is.
+        if (state.soak === true) {
+            Studio.soakRequested = true;
+            setTimeout(() => Studio.showBanner('Soak armed — open protocols/soak_mode3_closed_loop.yaml, connect, then File ▾ → Soak…'), 800);
+        }
         if (state.advanced === true) {
             Studio.advancedUrlRequested = true;
             if (!Studio.advanced) Studio.unlockAdvanced();
@@ -12162,7 +12723,7 @@ <h2 id="modalTitle">Import error</h2>
                     class: 'arena-test-btn',
                     disabled: !serialSupported,
                     title: 'Stop the running pattern (STOP_DISPLAY 0x30) — best-effort queued via the shared session',
-                    onClick: () => { if (window.Studio.session) window.Studio.session.stop(); }
+                    onClick: () => { if (window.Studio.session) { window.Studio._userStopRequested = true; window.Studio.session.stop(); } }
                 }, '■ Stop'));
                 const plugins = RunnerLib.listSkippedPlugins(cond);
                 wrap.appendChild(el('span', { class: 'arena-test-note' },
@@ -15219,6 +15780,9 @@ <h2 id="modalTitle">Import error</h2>
     '.rail-btn[data-panel="io"]': 'The controller’s analog and digital input/output connectors.',
     '.rail-btn[data-panel="ai"]': 'Watch the two analog inputs live, and check the wiring by looping Analog Out back into an input.',
     '.rail-btn[data-panel="fw"]': 'Update or check the firmware on the LED panels.',
+    '[data-cmd="ctelem"]': 'Turn the controller\'s built-in activity recording on or off (it is written into the run log alongside the tracking data).',
+    '[data-cmd="chealth"]': 'Ask the controller how it is doing — loop timing, memory-card read times, and what it was doing before its last restart.',
+    '#fmSoak': 'Repeat the open protocol unattended (overnight) to catch the rare controller freeze; on a freeze it records diagnostics and, if you chose so, restarts the controller and continues.',
     '.rail-btn[data-panel="fictrac"]': 'Closed loop with FicTrac: the fly’s walking steers the pattern.',
     /* Console bench strip + panels */
     '#ctlMenu > .cmenu-btn': 'Questions for the controller — firmware version, network address, frame counters — plus advanced settings (locked).',
diff --git a/dashboard/data-browser/analysis-core.js b/dashboard/data-browser/analysis-core.js
index af404491..20ee7747 100644
--- a/dashboard/data-browser/analysis-core.js
+++ b/dashboard/data-browser/analysis-core.js
@@ -744,6 +744,9 @@
                 continue;
             }
             if (Array.isArray(rec)) {
+                // String-tagged rows ("cc"/"cf"/"cs" controller telemetry) are other
+                // streams in the same file, not FicTrac samples.
+                if (typeof rec[0] === 'string') continue;
                 const frame = parseFrameArray(rec, schema, index + 1);
                 if (frame) frames.push(frame);
                 continue;
diff --git a/dashboard/data-browser/tests/test-analysis.js b/dashboard/data-browser/tests/test-analysis.js
index ed619d73..ffe12023 100644
--- a/dashboard/data-browser/tests/test-analysis.js
+++ b/dashboard/data-browser/tests/test-analysis.js
@@ -26,6 +26,25 @@ const fixtures = {
     )
 };
 
+// Controller telemetry rows ("cc"/"cf"/"cs") interleaved with behavior rows are
+// other streams in the same file — never FicTrac frames (review finding).
+{
+    const text = [
+        JSON.stringify({
+            type: 'frame_schema',
+            level: 'behavior_v1',
+            cols: ['ms', 'fc', 'idx', 'ft', 'x', 'y', 'hd']
+        }),
+        JSON.stringify([0, 100, 5, 0.0, 0.0, 0.0, 0.0]),
+        JSON.stringify(['cc', 9, 5000, 1, 112, 0, '03704e00']),
+        JSON.stringify(['cf', 9, 5100, 2, 78, 36, 129000, 812]),
+        JSON.stringify([8, 101, 5, 8.272, 0.01, 0.0, 0.02])
+    ].join('\n');
+    const r = A.parseJsonl(text, 'ctl.jsonl', '/x/ctl.jsonl', {});
+    assert.strictEqual(r.frames.length, 2, 'tagged telemetry rows are not frames');
+    assert.strictEqual(r.frames[1].fc, 101);
+}
+
 function load(file) {
     const fullPath = path.join(bench, file);
     return A.parseJsonl(fs.readFileSync(fullPath, 'utf8'), file, fullPath, {
diff --git a/docs/development/arena-studio-release-notes.md b/docs/development/arena-studio-release-notes.md
index 3bb53c4f..8e696055 100644
--- a/docs/development/arena-studio-release-notes.md
+++ b/docs/development/arena-studio-release-notes.md
@@ -4,6 +4,50 @@ The Studio's footer used to carry the full changelog inline; it now shows one li
 history lives here. Newest first. (Per-session engineering detail stays in
 `arena-studio-handover.md` and the design docs — this file is the user-facing what-changed list.)
 
+## v0.76 (2026-09-11) · Controller-fault detection, post-mortem probes, soak driver (fw #50)
+
+- **2026-09-12 review fixes (Codex gpt-6-astra, see `.codex-review/report-20260912-status.md`):**
+  a faulted run's log is committed only after the post-mortem (probes + controller ring dump) has
+  finished; "recovered" now requires the same controller (MAC) and every required probe answering
+  fast; the controller ring drain acknowledges records only once the bridge stored them; the ring is
+  enabled only when the firmware declares it (no blind 0xA8 on older builds) and has an on/off
+  switch in Console → Debug ▾ for a telemetry-off control arm; replay and dashboard readers ignore
+  the new `cc`/`cf`/`cs` rows; soak iterations that streamed almost nothing are marked
+  `unexercised`; the wedge analyzer reports runner-declared faults (`fault-declared`).
+
+- **A frozen controller now stops the run instead of finishing it.** During Mode-3 closed loop the
+  Studio used to ignore every frame-command timeout and let a run "complete" (and auto-commit) with
+  the arena dead. Now 3 failed frame commands out of the last 10 trip a fault: closed loop stops, the
+  run aborts with outcome **CONTROLLER_FAULT** (never "aborted by user"), and the run log is still
+  committed — the record of a run the controller killed is evidence. A timed-out trial command is
+  labelled the same way.
+- **Post-mortem probes after a fault.** The Studio waits a moment, confirms the controller is really
+  unresponsive, then for about a minute asks it a fixed set of questions (controller info, frame
+  counters, an SD read, the new health counters) with long timeouts, so the run log records how
+  slow it actually is — not just "timed out". Everything lands in the run log as `probe` rows.
+- **Soak (repeat protocol)…** (File ▾, advanced only, or `?soak=1`): repeats the open protocol
+  unattended — N times or for H hours with a gap — to reproduce the rare freeze overnight with the
+  FicTrac simulator. Refuses to start unless the bridge confirms `behavior_v2` logging and frames
+  are arriving. On a fault: first fault halts (controller left as-is for inspection) by default;
+  later faults can reset the controller, reconnect without a click, verify it is the same
+  controller, and continue. Soak runs are never auto-committed; scan them with
+  `scripts/wedge-scan.py`. Ships with `protocols/soak_mode3_closed_loop.yaml`.
+- **Console → Debug ▾ → Controller health**: reads the controller's loop timing, SD-read stats,
+  counters and what it was doing before its last restart (firmware with GET_HEALTH, capability
+  bit 7). The runner's own commands (trial start, STOP) now appear in the run log too.
+- **Controller telemetry ring (first cut).** With firmware that has the ring, the Studio drains
+  the controller's own event log ten times a second while connected and writes it into the run
+  log as compact `cc` (command received + status), `cf` (frame displayed, SD load time, SPI time)
+  and `cs` (state changes, error glyphs, slow SD reads, boots) rows next to the FicTrac frames.
+  The ring survives a controller reset, so after a fault the post-mortem pulls the controller's
+  last seconds as a crash dump. `scripts/wedge-scan.py` reports the counts, worst SD read, state
+  events and, with `--verbose`, the records before a wedge. Needs bridge ≥ 3.1.
+- **Firmware build identity in every run log.** On connect (and after any automatic reconnect)
+  the Studio reads the controller's build — git commit, branch, build date, arena size — and
+  records it as `firmware` in the run details and in `run_metadata` of every committed log, so a
+  problem can be pinned to a build. Needs firmware with GET_FIRMWARE_VERSION (ships with the
+  health capability); older builds still show the legacy "v1".
+
 ## v0.74 (2026-09-07) · Console "Analog In" panel — live readout + loopback self-test
 
 - **New Console tool: Analog In.** A left-rail button opens a live readout of both
diff --git a/docs/development/codex-review-2026-09-12-mode3-wedge.md b/docs/development/codex-review-2026-09-12-mode3-wedge.md
new file mode 100644
index 00000000..a68cfb46
--- /dev/null
+++ b/docs/development/codex-review-2026-09-12-mode3-wedge.md
@@ -0,0 +1,62 @@
+# Codex (gpt-6-astra) adversarial review — Mode-3 wedge campaign status + branch diff — reconciliation
+
+**Date:** 2026-09-12 · **Reviewer model:** `gpt-6-astra` (standard + adversarial passes, both runs) ·
+**Inputs:** `docs/development/mode3-wedge-status-2026-09-12.md` (plan/status review, run
+`codex-plan-review-20260912-114033-86155`) and the branch diff `main...claude/mode3-wedge-soak`
+(5,597 lines, 31 files, run `codex-diff-review-20260912-114034-86380`). Claude's independent
+analyses were written first: `claude-analysis-20260912-status.md`, `claude-analysis-20260912-diff.md`.
+
+Verdict legend: **VERIFIED+FIXED** (reproduced against the code, fixed on the branch this pass),
+**ACCEPTED** (correct; addressed in docs/plan), **PARTIAL** (correct in part; what was done and what
+was not), **DEFERRED** (correct; not done now, with reason), **REJECTED** (with evidence).
+
+## A. Status / plan review (what changed since the approved plan, bench results, T4 plan)
+
+| # | Codex finding | Verdict | Action |
+|---|---|---|---|
+| A1 | Post-reset order re-enters the SD path (probes) before reading the evidence (breadcrumb, ring). | **VERIFIED+FIXED** | `studio-postmortem.js resetAndReconnect`: identity → GET_HEALTH → ring drain (`afterReconnect`) → *then* `probeOnce('post-reset')`. Duplicate drain in `run()` removed. Documented as §4b "manual capture procedure" and the LAB-212 primitive. |
+| A2 | Telemetry ack must mean *stored*, not *parsed*. | **VERIFIED+FIXED** | Drainer advances `lastSeq/ackSeq` only when `onRecords` returned non-false; `notStored` counter; Studio's sink returns the bridge's acceptance (`logRows` → boolean, false when not logging/connected); `drainAll` stops on a refusal. Tests: refusal keeps the cursor, retry re-sends the same ack, records counted once. |
+| A3 | FRAME `sd_load_us` as u16 saturates at 65 ms; the 129 ms tail already seen would not fit. | **VERIFIED+FIXED** | Both sides u32 (firmware FRAME record 20 B; host decoder `plen ≥ 10`, `u32(p+4)`, `spi u16(p+8)`); fixture uses 129000. |
+| A4 | Analyzer should show the *previous boot's* records that arrive after the boot record (post-reboot drain). | **VERIFIED+FIXED** | `wedge-scan.py`: at every `cs boot` record the preceding tail is snapshotted (`_ctl_pre_boot`) and printed per boot under `--verbose`, alongside the pre-onset tail. |
+| A5 | Ring at a fixed OCRAM address: heap can grow into it; commit ordering under reset. | **ACCEPTED** (firmware) | Ring firmware (`ac4c08f`): `__brkval ≥ base−4 KiB` guard at begin/append/`service()`; on collision the ring is disabled and header flag bit 2 set (host shows "RING DISABLED"); commit order eviction→record→header each cache-flushed (OCRAM is write-back); boot keeps a valid header and truncates at the first inconsistent record; static_asserts on the address range vs breadcrumb/CrashReport. Pre-T4 gate §4c requires an interrupted-write test on the bench. |
+| A6 | Background-tab throttling: 8 chunks per poll cannot keep up with 286 Hz production (~10 KB/s). | **VERIFIED+FIXED** | `maxChunks` default 40 (≈7 KB/poll, ~70 KB/s at 10 Hz; ≥ 7 KB/s at a 1 Hz throttled poll); `maxBytes` 178 = the firmware's clamped budget (196 − 18 B header). |
+| A7 | "H3 (host/Chrome) out" is overstated — pyserial saw the wedge, it did not *cause* nothing. | **ACCEPTED** | Status doc §2/§3: H3 *narrowed* (not needed to observe; not excluded as a trigger) pending the pyserial soak arm from a clean boot. |
+| A8 | T4 ≠ T1: an events-only soak validates one operating point, not drain capacity; keep a synthetic T1. | **ACCEPTED** | Firmware synthetic producer (SET_TELEMETRY bit 7 + rate; header flag bit 3); plan §4.3 keeps a reduced T1 (5/12.6/50 KB/s, fg/bg tab, pyserial vs Chrome) for a soak break. |
+| A9 | Time-box the instrumented arm; a stock control night runs regardless of another wedge; compare exposure, not iterations. | **ACCEPTED** | Plan §4.4: ≤ 2 nights or 40 iterations, then stock `arena-2x10-local` night + pyserial night; exposure (streaming hours, delivered 0x70s) is the unit; censored clean exposure reported. Soak iteration-end rows now carry `applied_0x70` and `duration_s`. |
+| A10 | The bootloader recovery route is provisional (HID attach failed once on macOS; Windows lab PCs untested). | **ACCEPTED** | Documented as provisional in §2/§4b; LAB-212 keeps it as the *candidate* primitive; an on-device WDOG the ring survives is the complement. |
+
+## B. Diff review (`main...claude/mode3-wedge-soak`)
+
+| # | Codex finding | Verdict | Action / evidence |
+|---|---|---|---|
+| B1 | **Fault run exports/commits before diagnostics finish**; the terminal event fires before `stopAcked` is computed, and the export closes the bridge file. | **VERIFIED+FIXED** | Runner: the terminal event is now emitted from `finally` *after* the best-effort STOP, so the serialized summary carries `stopAcked` (254/254 runner checks). Studio: `onRunFinished` defers the auto-commit when the outcome is `CONTROLLER_FAULT`; `handleControllerFault` runs the deferred commit in its `finally`, after probes + ring dump. |
+| B2 | **"Recovered" accepted a missing MAC and one fast answer among timeouts.** | **VERIFIED+FIXED** | Identity requires a decoded ok 0xC2 reply and, when the unit's MAC is known, the same MAC (a MAC-less reply fails). Recovered additionally requires `timeouts === 0`, `errors === 0`, `failedRequired === 0` (SD-image probes 0xE3/pattern_info are `optional`: their *latency* is the datum). New tests: MAC-less reply → `reset-failed`; one answer + timeouts → `reset-failed`. |
+| B3 | Ack advances before storage (same as A2). | **VERIFIED+FIXED** | See A2. |
+| B4 | Tagged telemetry rows (`cc`/`cf`/`cs`) are parsed as FicTrac samples by the replay reader (hex string as heading). | **VERIFIED+FIXED** | `js/runlog-replay.js` and the dashboard `analysis-core.js` skip string-tagged arrays other than `"a"` (which the normalizer already decodes). Tests in both suites. Rule added to CLAUDE.md: readers must treat any string-tagged array row as a stream, not a sample. |
+| B5 | `health` capability ≠ telemetry; SET_TELEMETRY on health-only firmware = unknown opcode + error glyph (violates the no-blind-probe rule). | **VERIFIED+FIXED** | The 0xC2 capability byte is full (bit 7 = health). Firmware (`ac4c08f`): GET_FIRMWARE_VERSION `flags` bit 2 = ring compiled in; host decodes `telemetry` and gates SET_TELEMETRY **only** on it. Post-mortem: capability-gated probes are *skipped and recorded* when capabilities are unknown (0xC2 dead); test asserts 0xCA/0xCB are never sent blind. The Console's manual "Controller health" button stays user-initiated. |
+| B6 | Reconnect skips identity when cached `firmwareVersion`/`controllerId` exist — a reflashed controller keeps its MAC. | **VERIFIED+FIXED** | `identityOnConnect` never short-circuits; `firmwareVersion` is cleared and re-read on every link-up (0xC2/0xCB are ~2 ms RAM reads). |
+| B7 | Post-mortem ownership is advisory: an in-flight drain continues; analog polling ignores the flag. | **VERIFIED+FIXED** | Drainer exposes `idle()`; `handleControllerFault` stops the poller and awaits `idle()` *before* the quiet period; `aiCanPoll` yields to `_activePostmortem`; the poller restarts only after a recovered, identified link. |
+| B8 | Instrumentation runs on every compatible connection with no off switch (no telemetry-off comparison arm). | **VERIFIED+FIXED** | Debug ▾ "Telemetry ring: on/off" (remembered, `studio_telemetry`); `run_metadata.telemetry` already records `ring-10hz`/`off`; `stopTelemetry()` shutdown path when the firmware lacks the ring or refuses 0xA8 (fixes the "poller keeps running on incompatible firmware" case). |
+| B9 | Analyzer and live detector disagree: rejects + declared fault → `clean`. | **VERIFIED+FIXED** | `wedge-scan.py` captures the runner's `summary.fault` (and `phase: 'fault'`); outcome `fault-declared` when no timeout signature; `declared_fault` column. Test with rejects + declared fault. |
+| B10 | Malformed `["cc"]` row: bridge writes it, analyzer crashes with IndexError. | **VERIFIED+FIXED** | Bridge `write_rows` enforces per-tag minimum lengths (`cc` 7, `cf` 8, `cs` 7; generic 2); analyzer drops and counts rows shorter than 4 (`ctl_malformed`). Tests both sides. |
+| B11 | Soak preflight freshness only; a simulator that dies mid-trial yields a normal "completed" iteration. | **VERIFIED+FIXED** | Iteration-end records `applied_0x70` and `duration_s`; below 5 Hz average (or 1000 total) the outcome is `unexercised`, logged and warned, never counted as clean exposure. |
+| B12 | A timed-out write is not cancelled: `Promise.race` releases the queue while the `WritableStream` may still deliver (e.g. STOP crossing the recovery boundary). | **DEFERRED** | Correct. The observed wedge had writes completing (USB ACKed) with total silence, so this does not affect night-1 evidence. Mitigation already present: quiet period + `flushRx` before the confirm probe, and reconnect tears the streams down. Proper fix = transport generation invalidated on write timeout (refuse ordinary sends until reconnect). Proposed as a follow-up issue in the status doc; not built this pass. |
+| B13 | Tests establish component behavior, not lifecycle (adapter test hand-supplies `stopAcked`). | **PARTIAL** | B1's fix makes the real terminal event carry `stopAcked`; the runner suite exercises the emit-after-STOP order. A true runner→adapter→export integration test (and a browser test of deferred commit) is still owed — listed in the pre-T4 gate. |
+| B14 | Session-owned lifecycle (`running → stopping → diagnosing → finalizing → idle`) instead of HTML orchestration through globals. | **DEFERRED** | Agreed as the right shape for the self-healing runner (LAB-212 / #197); the deferred-commit + exclusive-link fixes above are the minimal version. Recorded in the #197 design notes rather than refactoring `ArenaSession` during the campaign. |
+| B15 | Ship telemetry as an opt-in sidecar until readers support tagged streams. | **REJECTED** (with B4 fixed) | Both known readers (Studio replay, dashboard analysis-core) now skip tagged rows, with tests; `stream_schema` is declared per file; the ring is off by default when the firmware lacks it and one click off otherwise. The sidecar's cost (a second artifact per run) outweighs the remaining risk for bench-local soak logs. Third-party readers of `behavior_v2` should follow the CLAUDE.md rule. |
+| B16 | Python suites not run in the sandbox. | n/a | Run here: `test-wedge-scan.py` 101/101, `test-bridge-behavior.py` 128/128, full `pixi run test` green. |
+
+## C. Not changed on Codex's advice (with reasons)
+
+- **Halt-first on the campaign's first fault** stays (Michael's decision; evidence over uptime).
+- **Frame-cache fix candidate stays held** until a breadcrumb/ring readout points at a spin.
+- **Flashing the ring firmware waits for a human at the bench** (night-1 lesson; HalfKay HID attach was intermittent once).
+
+## D. Follow-ups this review created
+
+Tracked: deferred items B12/B13/B14 → [reiserlab/webDisplayTools#200](https://github.com/reiserlab/webDisplayTools/issues/200); firmware deferrals → [reiserlab/LED-Display_G6_Firmware_Arena#54](https://github.com/reiserlab/LED-Display_G6_Firmware_Arena/issues/54).
+
+1. Pre-T4 evidence gate (status doc §4c) — bench items: interrupted-write test, background-tab drain budget, recovered-dump fixture.
+2. Proposed issue: transport generation on write timeout (B12).
+3. Integration test runner→adapter→export for `stopAcked` and the deferred commit (B13).
+4. Session-owned lifecycle as the design basis for LAB-212 (B14).
diff --git a/docs/development/codex-review-2026-09-13-mode3-wedge-fix.md b/docs/development/codex-review-2026-09-13-mode3-wedge-fix.md
new file mode 100644
index 00000000..3fff3aea
--- /dev/null
+++ b/docs/development/codex-review-2026-09-13-mode3-wedge-fix.md
@@ -0,0 +1,157 @@
+# Codex (gpt-6-astra) plan review — wedge #5 evidence + free-running-timer fix — reconciliation
+
+**Reviewed document:** `mode3-wedge-evidence-2026-09-13.md` (00:10 ET). **Run:**
+`.codex-review/codex-plan-review-20260913-003729-27353/` (standard + adversarial; a first launch stalled
+on stdin and was relaunched with `< /dev/null`). Claude's independent analysis, written first:
+`.codex-review/claude-analysis-20260913-evidence.md`. Firmware under review: `4860fef` (baseline) and the
+free-running candidate `eca07f6` on `feat/telemetry-ring-2x10`.
+
+## The finding that changes the picture (verified)
+
+Codex pointed at the Teensy core's `IntervalTimer`. Checked in the installed core
+(`framework-arduinoteensy` 1.160.0, `cores/teensy4/IntervalTimer.cpp`):
+
+```c
+void IntervalTimer::end() {
+    funct_table[index] = nullptr;   // 1. callback removed FIRST
+    channel->TCTRL = 0;             // 2. channel disabled          <- captured PC 0x212f4
+    channel->TFLG = 1;              // 3. flag cleared
+    ...
+}
+static void pit_isr() {
+    // the flag is cleared ONLY when the callback is non-null
+    if (funct_table[0] != nullptr && channel->TFLG) { channel->TFLG = 1; funct_table[0](); }
+    ...
+}
+```
+
+If the PIT interrupt is taken between store 1 and store 2 (the timer expires in that window), `pit_isr`
+runs with a null callback, does not clear `TFLG`, returns, and is immediately re-entered — an interrupt
+storm at the PIT's NVIC priority (128) for as long as the main context would need to execute store 2,
+which it never gets to do. Consequences, all matching what we saw:
+
+| Observation | Storm reading |
+|---|---|
+| PC parked on `channel->TCTRL = 0`, main context never advances | the interrupted context's return address is exactly store 2 |
+| watchdog IRQ (priority 0) still runs and captures | it preempts the storm; a capture during the storm's exception tail-chain sees the main frame |
+| USB stays enumerated; 134-baud bootloader route works (#2–#4) | `IRQ_SDHC1` is at priority 96 (preempts the storm); `IRQ_USB1` (113) shares priority 128 with the PIT (122) and wins the NVIC tie-break (lower IRQ number first) on every storm iteration — both ISRs still run, only thread mode is starved (corrected 01:15: the first draft said both were at 128) |
+| host USB *writes* stall 1–3 s, then silence | the CDC rx buffers fill (nobody in `loop()` drains them), the device NAKs, the host write blocks |
+| breadcrumb `OP_CMD`/0x70 before the SD marker (#2–#4), `cmd_disarm_timer` (#5) | the disarm is the first step of `handleSetFramePosition`, before `loadFrame` |
+| no CPU fault, empty crash record, display holds the last frame | nothing faults; the refresh callback is null so nothing refreshes |
+| power cycle vs MCU reset intervals | not explained and not needed — MCU reset clears the PIT; the interval pattern reads as chance |
+
+**Quantitative check.** Isabel's aggregate: ~292 k good 0x70s per failure → per-disarm probability
+≈ 3.4 × 10⁻⁶. With a 300 Hz GS16 refresh (3.33 ms period) that is a window of ≈ 11 ns ≈ 7 cycles at 600 MHz.
+The exposed window is one or two instruction boundaries plus interrupt recognition — the same order of
+magnitude. No other mechanism on the table predicts the failure rate at all. Our own five wedges (33 k to
+~750 k commands apart at 100–200 Hz) sit in the same range.
+
+**What it does not yet prove.** One capture. In a storm, most watchdog captures would land *inside*
+`pit_isr` (handler context); ours shows the main context, which the tail-chain/late-arrival path
+allows but does not make the most likely outcome. The discriminator is cheap: capture the stacked
+xPSR (IPSR field: 0 = thread, 138 = PIT handler) and the watchdog handler's `EXC_RETURN` at the next
+capture, and count PIT interrupt entries. Both are in the follow-up firmware commit (below).
+
+## Findings table
+
+| # | Finding (Codex) | Verdict | Action |
+|---|---|---|---|
+| P1 | **[High]** `IntervalTimer::end()` null-callback / `TFLG` race → PIT interrupt storm; the PC does not prove a stalled store. | **VERIFIED** in the installed core; quantitative fit to the failure rate (above). | Evidence doc §2 rewritten as competing explanations; storm is now the leading reading, bus hang the alternative. |
+| P2 | **[High]** The race survives at the remaining `disarmRefreshTimer()` sites (STOP/ALL_OFF, pattern entry, streaming entry, ALL_ON, error glyph). Free-running only reduces exposure. | **VERIFIED** | Follow-up firmware commit: `disarmRefreshTimer()` masks interrupts (PRIMASK save/restore + DSB) around `end()`. Nothing else inside the critical section. |
+| P3 | **[High]** The A/B (free-running vs baseline) is not a clean mechanism discriminator: SPI traffic, turnaround and host backpressure all change; a disappearing wedge does not uniquely implicate PIT churn. | **ACCEPTED** | Mechanism proof moves to (a) the context capture at the next wedge, (b) a bench stress reproducer (tight `end()`/`begin()` loop against a fast timer — should wedge the baseline core in seconds), (c) a "mechanism arm" build = baseline scheduling + safe disarm only. Soak statistics are the fix's *reliability* evidence, not its *mechanism* evidence. |
+| P4 | "Watchdog touches only OCRAM" is false (`micros()` reads DWT, `sealIsr()` does cache maintenance); SD silence is parser silence, not SD-peripheral evidence. | **ACCEPTED** | Evidence doc corrected. |
+| P5 | Shrinking intervals / power-cycle observation mixes recovery methods, firmware, rates; does not identify external state. | **ACCEPTED** | Kept as provisional; under P1 it needs no explanation. |
+| P6 | Timer lifecycle contract missing (arm from stopped state, same-rate no-op, rate change, failed load, `begin()` return value ignored). | **PARTIAL** | `eca07f6` already tracks `armed_hz_` (same rate → no PIT access; different → re-begin) and arms on SHOW_FRAME entry/rate change; ALL_ON/error/ALL_OFF paths keep their arm/disarm (agent's audit table in the fw README). `begin()`'s boolean still ignored → fw #54. |
+| P7 | Acceptance tests beyond a wedge-free soak (rates × transitions × failed reads × forced-window interrupt). | **DEFERRED** (close-out) | Listed for PR F2; the forced-window interrupt test is the stress reproducer of P3(b). |
+| P8 | Strengthen the capture: stacked xPSR, `EXC_RETURN`, stack address; keep ELF + core version per build. | **VERIFIED+FIXING** | Follow-up commit: xPSR + `EXC_RETURN` in the `'H6IR'` record, surfaced at boot as ring STATE kind 8 (no GET_HEALTH change, no version churn); PIT ISR trampoline (ISR id 7) with a saturating count surfaced as STATE kind 9. ELFs kept per SHA. |
+| P9 | Separate performance acceptance from reliability acceptance; FRAME records exclude repeated transfers, so count total SPI transfers too. | **ACCEPTED** | Morning analysis reports refresh ISR count, PIT entries, transfers, changed frames, accepted 0x70s, SD reads, RTT, telemetry loss separately. |
+| P10 | Predefine matched exposure blocks and a stopping rule; zero failures in T h ⇒ 95 % upper bound ≈ 3/T per hour; one night is weak against a 7 h clean baseline stretch. | **ACCEPTED** | Plan: matched 100 Hz blocks primary, 200/286 Hz secondary, cold-start vs post-wedge blocks separated, clean hours reported as censored exposure. Mechanism evidence (P3) carries the weight, not the night count. |
+| P11 | Alternatives: schedule refresh deadlines in `loop()`; GPT/TMR only with scheduling policy held constant; frame preparation vs presentation split. | **ACCEPTED** (recorded) | Not for this campaign; fw #54 discussion. The free-running change is kept as the display-starvation fix on its own merits. |
+| P12 | Free-running still permits long freezes (an 88 ms SD read = 26 refresh periods); no maximum frame age; overload contract undefined. | **ACCEPTED** (recorded) | Pre-existing; the SD-jitter work is the parallel session's (handover doc). |
+| P13 | Malformed/stale requests re-enter transition paths; a clean valid-input soak does not exercise them. | **ACCEPTED** | With P2 the transition paths are safe by construction; still on the F2 test list. |
+| P14 | Reversibility: code trivially reversible; skipped/late stimuli are not. Treat data collected under the new timing policy as attributable. | **ACCEPTED** | 0xCB flags bit 4 identifies the variant in every run log. |
+
+## Decisions taken tonight (autonomous, under Michael's standing order)
+
+Michael's order: at the next near-identical wedge, flash the free-running build and continue soaking;
+have Codex adversarially review the evidence, the fix and the new firmware. Under P1/P2 the build to
+flash is **`eca07f6` + the follow-up commit** (safe disarm at the remaining sites, PIT ISR count, watchdog
+context capture). Codex diff review of `4860fef..eca07f6` is running; the follow-up gets its own diff
+review before flashing. Until a wedge, the soak continues on `4860fef8` at 200 Hz + jumps.
+
+## For the morning (Michael's call)
+
+1. **Stress reproducer** (10 min of bench time, definitive if positive): a debug build that hammers
+   `refreshTimer.end(); begin()` with the timer at a few kHz — the baseline core should storm within
+   seconds; with the PRIMASK-guarded disarm it should not. Positive reproduction beats any number of
+   clean soak hours.
+2. **Mechanism arm** for one night: baseline per-command disarm kept, safe disarm only — if it is clean
+   while disarming 200×/s, the race is the wedge.
+3. **Upstream**: the core bug is reportable to PJRC (`IntervalTimer::end()` ordering / `pit_isr` flag
+   clear). Hold until the reproducer confirms.
+4. **fw #50 comment** with the mechanism, the quantitative check and the discriminators — outward-facing,
+   so not posted tonight.
+
+## Firmware diff review 1 — `4860fef..eca07f6` (free-running refresh + driver-vector ISR markers)
+
+**Run:** `LED-Display_G6_Firmware_Arena-ring/.codex-review/codex-diff-review-20260913-004245-34339/`.
+Verdict from Codex: keep the timer policy; do not flash the combined patch as-is. Every fixable item went
+into the follow-up commit `5e6a78c` (reviewed separately below).
+
+| # | Finding | Verdict | Action |
+|---|---|---|---|
+| D1 | `isrEnterLite/isrExitLite` read-modify-write the shared lite record without masking; a nested wrapped ISR loses a count and leaves the checksum inconsistent (Codex reproduced it in a model). | **VERIFIED+FIXED** (`5e6a78c`) | Both hooks are PRIMASK-preserving critical sections; still no cache flush per interrupt. |
+| D2 | Tests verify declarations (0xCB bit 4, accepted ISR id range), not free-running behaviour; the frame-storm test sleeps longer than a refresh period. | **DEFERRED** (fw #54) | Display-cadence HIL tests listed; the bench measures FRAME/ISR-count progress directly tonight. |
+| D3 | The trampoline banner uses `DBG_PRINTF`, gated on a flag that is false during `setup()` — unreachable. | **VERIFIED+FIXED** | `SentinelPrint` boot path. |
+| D4 | The watchdog IRQ overwrites `isr_last` with `ISR_WDOG`, losing the identity of what was active; lite markers are not flushed when the hang is with interrupts masked. | **VERIFIED+FIXED** (identity) / **ACCEPTED** (persistence) | Prior `isr_last` captured into the `'H6IR'` record and surfaced in STATE kind 8; the un-flushed-marker case falls back to the watchdog PC (fw #54). |
+| D5 | `armRefreshTimer` ignores `IntervalTimer::begin()`'s boolean → a failed allocation becomes a sticky "already armed". | **VERIFIED+FIXED** | `armed_hz_` committed only on success; failure leaves it 0 and records `STATE(telemetry, 0xED, rate)`. |
+| D6 | New test asserts every `OP_CMD_DISARM` breadcrumb has arg 0; records written by the base firmware carry 0x70 (wedge #5's). | **VERIFIED+FIXED** | Test accepts {0, 0x70}. |
+| D7 | Use `IntervalTimer::update()` for rate changes (LDVAL only) instead of `begin()`. | **DEFERRED** (fw #54) | Rate changes are per-trial; with the guarded `end()` the race is closed regardless. |
+| D8 | README claims: "0x70 never touches the PIT" (showError/rate changes/transitions still do), "≤ one refresh period" latency (unbounded by SD + loop work), geometry-protection justification (PSRAM paths change `block_byte_count_` without disarming). | **VERIFIED+FIXED** (wording) | Steady-state wording; latest-request-wins with measured, not guaranteed, latency; kept disarm sites = explicit transition semantics. |
+| D9 | `soak_mode3.py` does not request 0xCB, so pyserial logs would not carry the variant bit. | **DEFERRED** (fw #54) | Not used tonight (Studio path carries `run_metadata.firmware`). |
+| D10 | Split instrumentation from the timer change; pin the core version; vector ownership is an undocumented dependency. | **ACCEPTED** (recorded, fw #54) | One controller, campaign build; `wrapPitVector()` re-installs after every `begin()`, which is the one known re-attach. |
+| D11 | STOP disarms before its dark frames — if the disarm hangs, blanking never runs. | **VERIFIED** | Exactly the storm case; closed by the guarded `end()` in `5e6a78c`. |
+| D12 | No new frame-buffer race under the main-loop model. | agrees | — |
+
+## Firmware diff review 2 — `eca07f6..5e6a78c` (guarded disarm, PIT marker, watchdog context)
+
+**Run:** `.codex-review/codex-diff-review-20260913-005700-46985/`. Codex: no blocker; the guarded `end()`
+addresses the race; the diagnostics needed another pass. Folded into a third amended commit (agent round 3).
+
+| # | Finding | Verdict | Action |
+|---|---|---|---|
+| E1 | The FULL hooks (`isrEnter/isrExit`, refresh + DMA) mutate the record before `sealIsr()` masks; a nested lite-hook ISR (SDHC at 96) loses a total count; `isrExit()` writes `ISR_NONE` instead of restoring the enclosing id, so the PIT trampoline's marker is clobbered after the refresh callback. | **VERIFIED+FIXING** | Full hooks save/restore like the lite hooks; whole update masked, then seal. |
+| E2 | PRIMASK masking around `end()` also masks the watchdog IRQ — if the alternative reading (stalled peripheral store) were true, the hang would happen unmasked-capture-free. | **VERIFIED+FIXING** (adopted) | Mask only `IRQ_PIT` at the NVIC (+ DSB/ISB) around `end()`; the watchdog stays live. A pended PIT interrupt runs afterwards with a null callback and a cleared `TFLG` — no storm. |
+| E3 | `STATE(telemetry, 0xED, rate)` for a failed `begin()` decodes as a telemetry configuration. | **VERIFIED+FIXING** | New STATE kind 10 `timer_fail` (arg = rate); host decode landed. |
+| E4 | README's storm model says USB/SDHC share 128; SDHC is 96. | **VERIFIED+FIXING** | fw README + this doc + evidence §2b corrected. |
+| E5 | Decoders recognise only EXC_RETURN 0xF9/0xF1; FP-stacked returns are 0xE9/0xE1. | **VERIFIED+FIXING** | Mode from bit 3; host `excReturnMode` + wedge-scan consistency flag. |
+| E6 | The retained ISR record moved (0x2027FF20 → 0x2027FEC0) without invalidating the old location — rollback could harvest a stale record. | **VERIFIED+FIXING** | Clear the old location's magic at boot; kind 8/9 emission gated on this boot's SRC_SRSR watchdog bit. |
+| E7 | The pre-reset window (~128 bus clocks) now has to checksum 23 words and flush 3 lines; unverified. | **ACCEPTED+MITIGATING** | Context fields first, sealed and flushed first; bench starve test (`SET_TELEMETRY 0x31`) immediately after flashing must yield a decodable kind-8 record before the soak restarts. |
+| E8 | `armRefreshTimer` returns void; callers acknowledge a display state with no timer. | **DEFERRED** (fw #54) | One PIT timer in the firmware; failure is theoretical. |
+| E9 | Count saturation (≈ 10 days at 300 Hz) without a flag; 32-bit wrap. | **DEFERRED** | Diagnostic build; boots are hours. |
+| E10 | Instrumentation latency (masked sections on every refresh/DMA/USB/SDHC/PIT entry) unmeasured. | **ACCEPTED** | Diagnostic build; the stock control night is the isolation. |
+| E11 | `soak_mode3.py` does not drain the crash records after reset. | **DEFERRED** | Studio path drains them (`afterReconnect`). |
+| E12 | No last-known-good capsule; a reset mid-writeback loses context and counts together. | **DEFERRED** (fw #54) | E7's ordering limits the loss to the counts. |
+| E13 | "Split mitigation from diagnostics." | **REJECTED** for tonight | One controller, standing order; recorded for PR F2. |
+
+## Firmware diff review 3 — `eca07f6..394dee4` (round-3 delta) — FLASH GATE PASSED
+
+**Run:** `.codex-review/codex-diff-review-20260913-010840-52247/`. Codex standard: "No blocking correctness
+defects found. The PIT-only mask closes the null-callback interrupt window … while leaving the watchdog
+interrupt enabled. The nesting-safe entry/exit changes correctly preserve the enclosing PIT marker." The
+adversarial pass agrees the guard is justified and argues about the diagnostics' evidentiary weight.
+
+| # | Finding | Verdict | Action |
+|---|---|---|---|
+| F1 | The expanded capture (two checksums, three lines) must finish inside RTWDOG's 128-bus-clock pre-reset window; decoder tests cannot show that. | **ACCEPTED** — bench gate | Starve test (`SET_TELEMETRY 0x31`) right after flashing: a decodable kind-8 record (thread, IPSR 0) is required before the soak restarts; the context line is written and flushed first so a partial capture still yields PC/LR/xPSR. Under-load capture = the first real wedge on this build. |
+| F2 | `scripts/soak_mode3.py` carries an unused duplicate `classify_exc_return`; stale "~20 cycles masked" comment. | **DEFERRED** (close-out squash) | Cosmetic. |
+| F3 | The pyserial soak does not drain the ring after a reset, so kinds 8/9 would be missed. | **N/A tonight** | The Studio path drains the whole ring on reconnect (`afterReconnect`), which includes the new boot's kind 8/9 records. |
+| F4 | A failed count capture (check_all invalid → zero counters omitted) is indistinguishable from inactivity. | **ACCEPTED** | Distinguishable in practice: a watchdog boot with a kind-8 record but no kind-9 records at all = counts lost. |
+| F5 | Boot clears the legacy record location without importing it — an uncollected capture is lost on upgrade. | **ACCEPTED** (no exposure tonight) | The baseline firmware harvests its own record at the self-reset boot and the Studio logs it (GET_HEALTH) before any flash; nothing uncollected exists at flash time. |
+| F6 | Implicit ownership: PIT enable state shared, vector re-installation per `begin()`, MSP-only frame read, no linker reservation, platform not pinned. | **DEFERRED** (fw #54) | Single-timer firmware today; all listed on fw #54. |
+| F7 | Counts are lifetime totals quantised to 4096; a recent-window rate would discriminate a 2 s storm better. | **DEFERRED** | Storm signature is still unmistakable: PIT count ≫ refresh count on a boot that is hours long. |
+| F8 | Tests construct wire bytes; no firmware persistence/fault-injection tests. | **DEFERRED** (PR F2 test list) | Bench starve test tonight is the fault injection. |
+| F9 | Split the guard from the diagnostics. | **REJECTED** for tonight | One controller; recorded. |
+
+**Decision:** `394dee45` is the build the standing order flashes. Gate after flashing: 0xCB flags bit 4 set and
+label `… freerun`; starve test yields kind 8 (thread) + kind 9 (ids 1/4/5/7, ids 1 ≈ 7); then the soak restarts.
diff --git a/docs/development/mode3-perf-handover-2026-09-13.md b/docs/development/mode3-perf-handover-2026-09-13.md
new file mode 100644
index 00000000..689fdb47
--- /dev/null
+++ b/docs/development/mode3-perf-handover-2026-09-13.md
@@ -0,0 +1,106 @@
+# Handover — Mode-3 performance session (SD access timing, presentation latency, deferred work)
+
+**Written:** 2026-09-13 09:45 ET, at the end of the fw #50 wedge campaign's second night. **For:** a fresh
+session that optimizes the controller's Mode-3 path (SD access timing first), works the deferred lists, and then
+resumes bench testing. **Read first:** this file, then `mode3-wedge-soak-plan.md` §10 (bench log),
+`codex-review-2026-09-13-mode3-wedge-fix.md` (what four Codex passes said about the fix build),
+`telemetry-performance-handover-2026-09-12.md` (the earlier parallel-session brief: telemetry metrics + SD-jitter
+proposal — still valid, this file supersedes its "state of the bench" parts).
+
+## 1. Where things stand
+
+- **The wedge is explained and reproduced.** `IntervalTimer::end()` in the Teensy core nulls the callback before
+  disabling the PIT channel; `pit_isr()` acknowledges the flag only when the callback is non-null → interrupt storm,
+  `loop()` never runs again. Stand-alone reproducer: firmware `tools/pit-race-repro/` (stock: dead < 0.5 s;
+  PIT-masked `end()`: 5.9 M cycles clean). Two watchdog PC captures on the arena sit inside the window.
+- **Fix build `394dee45`** (firmware branch `feat/telemetry-ring-2x10`, LOCAL ONLY — never pushed): free-running
+  refresh timer (0x70 no longer disarms/re-arms), `IRQ_PIT` masked at the NVIC around every remaining `end()`,
+  PIT ISR trampoline + per-ISR counts, watchdog context capture (STATE kinds 8/9/10 in the ring). 0 wedges in
+  5.1 M commands / 7.6 h at 200 Hz vs 2 in 1.09 M on the baseline. **It is on the bench controller now.**
+- **Host** (webDisplayTools branch `claude/mode3-wedge-soak`, PR #198, pushed): Studio v0.76 fault lifecycle,
+  soak driver, telemetry ring host side, decode for the new firmware fields (0xCB bit 4 `freeRunningTimer`,
+  ISR ids 4–7, STATE kinds 8/9/10), `scripts/wedge-scan.py`. All tests green (`pixi run test`).
+- **Outward items pending Michael:** the fw #50 comment and the PJRC report — final texts in
+  `mode3-wedge-upstream-note-2026-09-13.md` (Codex-reviewed). Not posted.
+- **Close-out plan** (`mode3-wedge-closeout-plan.md`, tracker web #201): ≤ 2 stacked PRs per repo; firmware F2
+  must collapse the GET_HEALTH `ver` churn (1→5 were bench iterations) to ONE version and move bench-only verify
+  fields to a diag opcode; deferred hardening on fw #54 (three comments today); host deferrals on web #200/#201.
+
+## 2. The performance picture (measured tonight, 200 Hz + 90° jumps, GS16, 2×10)
+
+| Quantity | Value | Source |
+|---|---|---|
+| Commands delivered | 190/s (host-limited; sim 200 Hz) | `cc` rows |
+| Distinct-frame requests | 145/s (76 % of commands change the index) | `cc` payloads |
+| Distinct frames transmitted (baseline → fix) | 34–45/s → 73–75/s | `cf` rows (FRAME = index/pattern change transmitted; repeats not logged) |
+| Refresh timer | 300 Hz GS16 (3.33 ms), 1 kHz GS2 | `refresh_rate_gs16_default` |
+| SD `readFrame` (grating, 20 frames) | median 1.08 ms, p99 1.49 ms | `cf.sd_load_us` |
+| SD `readFrame` (bar, 200 frames) | median 1.39–1.46 ms, p99 2.3–2.4 ms | same |
+| `sd_slow` (> 20 ms) bursts | 32–89 ms, ~18 per 20-min run, up to 5 within 4 s | `cs` kind 4; wedge #5/#6 both had an 89 ms read in their last minute (coincidence under the storm mechanism) |
+| SPI transfer per frame | 0.77 ms | `cf.spi_us` |
+| Host RTT (0x70) | median 2 → 3 ms, p99 8–9 → 11 ms after the fix (more transfers compete in `loop()`) | wedge-scan table |
+
+**The gap to close:** 145 distinct requests/s → 75 transmitted/s. With a 300 Hz tick, frames replaced between two
+ticks are never shown (expected ceiling ≈ 300·(1−e^(−145/300)) ≈ 115/s); the rest are ticks the main loop misses
+while it is inside a 1–2 ms SD read + reply. The `loop()` order is command → `loadFrame` (SD, synchronous) →
+`serviceDisplay` (transfer at the tick, spins on DMA completion).
+
+## 3. Candidate work, in the order I would take it
+
+1. **Pattern in RAM for Mode 3 (biggest win, removes SD from the hot path entirely).** A 2×10 GS16 frame is
+   2·10·400 px · 4 bit = 4 000 B; a 200-frame pattern is 800 KB → fits the PSRAM the controller already uses for
+   0x3A/0x3B (`handleDisplayPsramIndex`/`handlePsramPlay`). Preload the pattern into PSRAM at trial start
+   (`enterPatternMode`, or on `TRIAL_PARAMS`), make 0x70 a memcpy from PSRAM (or point the transfer at the PSRAM
+   frame directly). Expect `sd_load_us` → tens of µs and the `sd_slow` bursts gone from the streaming path.
+   Cost: pattern open latency (800 KB at ~10 MB/s SD ≈ 80–100 ms, once per trial — check against the ITI).
+   Codex's P12/E-list cautions apply: state latest-request-wins explicitly; measure request→presentation age.
+2. **Refresh-tick service policy.** Today `refreshFlag` is a boolean (coalesces ticks). With SD out of the way the
+   loop is fast enough to service every tick; if not, consider transferring at the tick from the ISR-visible
+   buffer only when a new frame is ready (skip redundant retransmits of an unchanged frame — check whether the
+   panels need periodic refresh at all in persistent mode).
+3. **Presentation-latency instrumentation** (Codex U10): a FRAME record already carries `sd_load_us`/`spi_us`; add
+   command-receive → transfer-start latency (or log the request seq that a transfer presents) so request age and
+   superseded requests can be measured. Then the analysis: age distribution, superseded fraction, per pattern.
+4. **Stale-display policy when input stops** (bridge/FicTrac drop): hold vs blank vs error — decide and implement
+   (host side already has a freshness pause in the soak driver; the controller has none).
+5. **Firmware hygiene from the reviews (small):** preserve the `IRQ_PIT` enable state in `disarmRefreshTimer()`
+   (`NVIC_IS_ENABLED` before, restore after); `armRefreshTimer` should return success and callers should not
+   acknowledge a display state without a timer; pin `platform = teensy@5.1.0` in the main `platformio.ini`;
+   `IntervalTimer::update()` for rate changes; remove the unused `classify_exc_return` duplicate in
+   `scripts/soak_mode3.py`; stale "~20 cycles masked" comment in `Health.cpp`.
+6. **Deferred lists:** fw #54 (ring hardening + today's three comments: display-cadence HIL tests, ISR-marker
+   persistence, saturation flag, linker reservation, capsule, `soak_mode3.py` 0xCB + ring drain); web #200/#201.
+7. **Then test again:** soak recipe below; compare `cf` rate and `sd_load_us` per build; a telemetry-off control
+   night is still owed (Debug ▾ `studio_telemetry` off).
+
+## 4. Bench state and procedures
+
+- Controller: CSHL 2×10, MAC 04:E9:E5:12:91:E2, `/dev/cu.usbmodem121699401`, firmware `394dee45` (0xCB flags 0x1C).
+  Soak stopped 09:40; Studio connected idle in the Claude-in-Chrome tab (`localhost:8091/arena_studio.html?advanced=1`).
+- Processes: `python3 .claude/nocache-server.py` (port 8091), bridge 3.1 `fictrac-bridge/bridge.py --log-dir soak-logs`,
+  sim `fictrac_sim.py --count 0 --rate 200 --seed 1 --jump-every 100 --jump-deg 90`. Logs in `soak-logs/`
+  (untracked, ~1.5 GB; wedge captures under `soak-logs/wedges/`).
+- **Flash (bootloader route, no button):** Studio must release the port first (`Studio.stopSoak(); await
+  Studio.session.stop(); await Studio.session.disconnect()`), then firmware `scripts/flash_bootloader_route.sh
+  <hex>` (or `-b` to reboot only). Then `await Studio.session.reconnect()`; `Studio.firmware` shows the SHA.
+  Resolve PCs only against the ELF of the build that was running (`arm-none-eabi-addr2line -e … -f -C`).
+- **Soak:** protocol `soak_mode3_card.yaml` is loaded in the tab (sha 49313f52…); `Studio.startSoak({iterations:0,
+  hours:H, gapS:10, firstFault:'halt', policy:'reset-continue', maxResets:3})`. Recipe to rebuild it: fetch
+  `/protocols/soak_mode3_closed_loop.yaml`, swap `frame2_h_ccw_200f`/ID 4 → `p3_heisenberg_ts`/36 and
+  `grating_sq`/ID 2 → `course_grating_36deg`/5, `Studio.loadProtocol(txt,'soak_mode3_card.yaml','local')`. The
+  page needs the `window.__framesRepatch` hook (frames 200/20 for the two card patterns) until #201's "frame count
+  from GET_PATTERN_INFO 0x88" lands. `scripts/soak-wedge-watch.sh` exits on a fault/post-mortem or a stalled log.
+- **Starve test** (watchdog + context capture): `SET_TELEMETRY 0x31` → reset in ~2 s → reconnect →
+  `Studio.drainTelemetry()`; expect STATE kind 8 code 0xF9/0xE9 arg 0.
+- **Reproducer:** firmware `tools/pit-race-repro/` (`pio run -e teensy41`), host driver `host/repro.py u|g <secs>`.
+- Analysis: `pixi run python scripts/wedge-scan.py soak-logs/*.jsonl`; per-pattern `cf`/`cc` rates: see the
+  snippet in the bench log entry of 01:41 (rx-time windows, not `t_us` — `t_us` restarts at a reset).
+
+## 5. Rules that bit us (keep)
+
+- Never Prettier the HTML; bump the Studio footer on every HTML edit. Codex CLI needs `< /dev/null` when
+  backgrounded. macOS has no `timeout`. Python buffers stdout when backgrounded (use `-u`). A tight
+  `end(); begin()` loop never expires the timer — any timer-race test needs the disarm swept across the expiry.
+- GET_HEALTH `ver` is a wire byte, not a log version — do not bump it per bench iteration again.
+- Log everything to `mode3-wedge-soak-plan.md` §10 with ET timestamps; memory file
+  `~/.claude/projects/-Users-reiserm-Documents-GitHub-webDisplayTools/memory/mode3-wedge-fw50.md` has the running notes.
diff --git a/docs/development/mode3-wedge-closeout-plan.md b/docs/development/mode3-wedge-closeout-plan.md
new file mode 100644
index 00000000..8ed2deb9
--- /dev/null
+++ b/docs/development/mode3-wedge-closeout-plan.md
@@ -0,0 +1,79 @@
+# fw #50 campaign — close-out and PR consolidation plan
+
+**Status:** open task, target 2026-09-13. **Owner:** Michael + Claude. **Tracker:** webDisplayTools issue
+"Consolidate the fw #50 campaign into reviewable PRs" (filed 2026-09-12 17:35 ET; see the issue for the
+checklist). Michael's rule: **at most two stacked PRs per repo**, each explainable on its own; not the
+30 + 13 commits as they landed under bench pressure.
+
+## What exists right now (2026-09-12 17:35 ET)
+
+| Repo | Branch | Size | State |
+|---|---|---|---|
+| webDisplayTools | `claude/mode3-wedge-soak` (PR #198, draft-ish) | 30 commits, 38 files, +6.1k lines | tests green; Prettier clean; every commit pushed |
+| LED-Display_G6_Firmware_Arena | `feat/telemetry-ring-2x10` (off `arena-2x10-local`) | 13 commits | not a PR yet; PR #53 (`feat/controller-health`, off `main`) covers only GET_HEALTH + soak script |
+
+Bench: one CSHL 2×10 controller, firmware `320e26d` to be flashed at the 17:52 boundary; soak logs in
+`soak-logs/` (gitignored, ~0.5 GB), wedge captures under `soak-logs/wedges/`.
+
+## Proposed PR structure
+
+### webDisplayTools
+
+**PR A — fail-closed fault lifecycle + soak harness** (the fw #50 host response; no telemetry ring)
+- `js/fictrac-bridge-client.js` fault latch (≥3 of 10), `logRows`; `js/arena-runner-g6.js` `fault()`, terminal
+  event after STOP, `stopAcked`; `js/arena-session.js` fault routing, link facade, `reconnect`, `flushRx`,
+  `send({silent})`, reject→throw; `js/arena-link.js` `reconnect()` via `getPorts`, write deadline;
+  `js/studio-postmortem.js` (probes, halt/reset-continue, self-reset path, evidence-first order);
+  `js/run-log.js` + `js/studio-runlog-adapter.js` `CONTROLLER_FAULT`; `js/studio-url-state.js` `soak`;
+  `arena_studio.html` fault banner, `handleControllerFault`, deferred commit, `runOnce`, soak driver,
+  link-drop-as-fault, identity on every link-up, GET_HEALTH/0xCB readouts; `js/arena-wire-g6.js`
+  health/version/frame-position encoders (the ring/telemetry opcodes go to PR B);
+  `scripts/wedge-scan.py` + tests; `protocols/soak_mode3_closed_loop.yaml`; `fictrac_sim.py` walk/jump flags;
+  docs: `mode3-wedge-soak-plan.md`, status doc, release notes v0.76 entry, CLAUDE.md fault-lifecycle rules.
+- Reviewers can read it as: "a wedged controller stops the run, is probed, is logged, and the soak driver
+  reproduces it overnight."
+
+**PR B (stacked on A) — controller telemetry ring, host side**
+- `js/arena-telemetry.js` (parse, drainer with ack-means-stored + rearm, poller), wire 0xA8/0xA9/0xCC
+  encoders + HEALTH v2–v4 tails, Studio `initTelemetry`/`drainTelemetry`/`readCrashReport`/telemetry
+  toggle/poller gating, bridge 3.1 `rows` + `ROW_MIN_LEN`, readers skip tagged rows (`runlog-replay.js`,
+  dashboard `analysis-core.js`), wedge-scan controller columns and pre-boot tails, CLAUDE.md ring rules,
+  the two Codex reconciliation docs, the telemetry handover doc.
+- Reviewers can read it as: "the ring's rows enter the behavior_v2 log and every reader stays correct."
+
+Squash strategy: `git rebase -i main` on a fresh branch per PR, grouping by the file lists above; keep
+the two reconciliation reports and the bench log as-is (they are the audit trail). Re-run
+`pixi run test` + `pixi run format-check` after each squash. Footer timestamp bumps collapse into the
+final commit of each PR.
+
+### Firmware (`LED-Display_G6_Firmware_Arena`)
+
+**PR F1 — health + build identity** (already PR #53 off `main`; retarget/rebase decision needed because
+the bench ran the `arena-2x10-local` cherry-picks): GET_HEALTH 0xCA (v1 layout), reset-surviving breadcrumb,
+GET_FIRMWARE_VERSION 0xCB + `scripts/build_version.py`, `scripts/soak_mode3.py`, tests, README.
+Base-branch gotcha (`main` = 4×10) must be in the PR description.
+
+**PR F2 (stacked on F1) — telemetry ring + diagnostic watchdog**
+- Ring (0xA8/0xA9, OCRAM 0x2026F000, records, ack cursor, heap guard, exact-size repair), 0xCB flags bits 2/3,
+  GET_CRASHREPORT 0xCC, sub-op + ISR breadcrumbs (separate `'H6IR'` record), RTWDOG (clock gate, empirical
+  500 Hz, 2 s / 30 s long-op window, pre-reset PC capture, SET_TELEMETRY bits 4–6), tests, drain script, README.
+- **Before opening:** collapse the GET_HEALTH payload tag to ONE new version (today's `ver 1→4` were bench
+  iterations — the tag is a per-command wire byte, not a log version); move the bench-only watchdog verify
+  fields (`wdog_cs_*`, `wdog_tick_hz`, `wdog_verify`) out of GET_HEALTH into a diagnostic opcode or drop
+  them; decide `HEALTH_WATCHDOG` default for course controllers (fw #54 discussion).
+- Deferred hardening stays in fw #54 (dual ring headers, linker reservation, cursor epoch, PSRAM/stream
+  FRAME identity, versioned crash envelope, temp-file pattern replacement, recovery-mode boot).
+
+## Also on the close-out list
+
+- Update Linear **LAB-212** (self-healing): bootloader route validated on real wedges (×3), hardware
+  watchdog self-reset built and proven, Studio self-reset path, what a Chrome-only recovery needs, scientific
+  resume still open. Update **LAB-149** with the ring's bench status (already partly done 12:31).
+- fw #50: post the morning analysis (wedge intervals, post-power-cycle exposure, any watchdog-captured PC
+  resolved with `arm-none-eabi-addr2line`).
+- fw #54: add the health-tag collapse and the diagnostic-opcode split.
+- Morning analysis of the night's logs: `wedge-scan.py soak-logs/*.jsonl`, the round-trip decomposition
+  (index-matched pairing), telemetry-on vs -off exposure comparison; then the stock `arena-2x10-local`
+  control night (time-boxed per the status doc §4.4).
+- Parallel session's deliverables (telemetry metrics spec, SD-jitter proposal, `scripts/telemetry-report.py`)
+  land on their own branch; reconcile with PR B's file list before either merges.
diff --git a/docs/development/mode3-wedge-evidence-2026-09-13.md b/docs/development/mode3-wedge-evidence-2026-09-13.md
new file mode 100644
index 00000000..12bd1433
--- /dev/null
+++ b/docs/development/mode3-wedge-evidence-2026-09-13.md
@@ -0,0 +1,101 @@
+# fw #50 — evidence after the first watchdog capture, and the proposed fix (for review)
+
+**Date:** 2026-09-13 00:10 ET. **Status:** for Codex adversarial review before the fix is flashed.
+Companion: `mode3-wedge-soak-plan.md` §10–11 (bench log), `mode3-wedge-status-2026-09-12.md`.
+
+## 1. The five reproductions on this bench (one CSHL 2×10 controller, simulator-driven Mode 3)
+
+| # | When | Firmware | Rate | Streaming before | Recovery | Breadcrumb / PC |
+|---|---|---|---|---|---|---|
+| 1 | 09-12 00:19 | course build (unknown) | 100 Hz | ~70 min (iter 4) | power cycle | none (no instrumentation) |
+| 2 | 09-12 15:44 | ring `c47ee684` | 100 Hz | 2 h 06 m | bootloader route | `OP_CMD`/0x70, SD marker never set |
+| 3 | 09-12 16:27 | `c47ee684` | 100 Hz | 33 m | bootloader | same |
+| 4 | 09-12 16:36 | `c47ee684` | 100 Hz | 5.5 m | bootloader, then **power cycle** | same; slowest SD read that boot only 3.4 ms |
+| 5 | 09-12 23:51 | wdog `4860fef8` | 200 Hz + jumps | 7 h 06 m after the power cycle (12 clean iterations at 100 Hz, 3 at 286 Hz, then 15 min at 200 Hz) | **watchdog self-reset, 2 s** | `cmd_disarm_timer`/0x70; **PC 0x212f4 = `IntervalTimer::end()` at `channel->TCTRL = 0`**, LR 0x212eb (return from the `funct_table[i] = nullptr` call); ISR marker = watchdog IRQ ran |
+| 6 | 09-13 01:14 | `4860fef8` | 200 Hz + jumps | 83 min (iteration 4, 192 k 0x70s) | **watchdog self-reset** | `cmd_disarm_timer`/0x70; **PC 0x212f2** = the `ldr channel` between `funct_table[i] = nullptr` (0x212f0) and `TCTRL = 0` (0x212f4), LR 0x212eb; ISR marker = watchdog; slowest sd_read 88.9 ms, 18 `sd_slow` in the run |
+
+Common to all instrumented cases: host sees ≥3 consecutive 0x70 timeouts with USB *writes* stalling 1–3 s; then total
+silence to every probe (0xC2, 0x33, 0x72, 0x88, 0xE3, 0x01), from Chrome and from pyserial; USB stays enumerated;
+the display holds its last frame. No CPU fault (the core's fault handler would reboot in 8 s; the crash record is
+empty). Ring records up to the hang are ordinary; SD loads ≤ 2.4 ms in the final minute for #2–#4; #5 had three
+`sd_slow` records (32, 41, 88 ms) in the final minute. The slowest SD read of the boot was 88–90 ms in #2, #3, #5 and
+3.4 ms in #4, so a slow SD read is not a prerequisite.
+
+Intervals: after MCU-only recoveries the intervals shrank 126 → 33 → 5.5 min; after the power cycle, 7 h clean
+through 7 further MCU resets (flashes, watchdog tests). Reading: some state outside the MCU (SD card, panels, host
+USB) is degraded by a wedge and cleared only by power; two episodes, not yet a result.
+
+## 2. What the PC says
+
+`IntervalTimer::end()` (Teensy core) is: `funct_table[index] = nullptr; channel->TCTRL = 0; channel->TFLG = 1;
+nvic_priorites[index] = 255; NVIC_SET_PRIORITY(IRQ_PIT, min); channel = 0;`. The stacked PC is the store to the PIT
+channel's control register. The watchdog's pre-reset interrupt ran (ISR marker), so the core was taking interrupts;
+the main context nevertheless did not progress past that store for 2 s. Interpretation: the write to the PIT never
+completed — a **hung peripheral (IPS/AIPS) bus transaction**. That also explains the simultaneous USB and SD silence
+(their register accesses queue behind it) while the watchdog ISR, which touches only OCRAM, could still run.
+
+Open question: does the **PIT itself** hang (the handler does `end()` + `begin()` on every 0x70 — `PIT_MCR`
+rewrite, channel rescan, NVIC priority rewrites, 100–286×/s), or does **another bus master** (USDHC/SD DMA, LPSPI
+DMA, USB) hang the bus and the PIT store is merely the first CPU access to block? The three earlier breadcrumbs
+(`OP_CMD` before the SD marker = the same disarm site) fit either.
+
+### 2b. Competing explanation — the `IntervalTimer::end()` race (Codex review 00:41, verified 00:45)
+
+Reconciliation: `codex-review-2026-09-13-mode3-wedge-fix.md`. In the installed Teensy core (1.160.0)
+`IntervalTimer::end()` nulls the callback **before** disabling the channel (`funct_table[i] = nullptr;
+channel->TCTRL = 0; channel->TFLG = 1;`), and `pit_isr()` clears a channel's `TFLG` **only when its callback is
+non-null**. A PIT interrupt taken between the first two stores runs the ISR with a null callback, never clears
+the flag, and re-enters forever at priority 128: the main context is starved with its return address exactly at
+`channel->TCTRL = 0` — the captured PC. `IRQ_SDHC1` is configured at priority 96 (it preempts the storm outright) and `IRQ_USB1` (113) shares
+priority 128 with the PIT (122) and wins the NVIC tie-break on equal priority, so both ISRs still run (USB stays enumerated, the
+134-baud bootloader route works, the CDC rx buffers fill and host writes stall 1–3 s); only `loop()` never runs
+again. Quantitatively: Isabel's ~292 k commands per failure ⇒ ≈ 3.4 × 10⁻⁶ per disarm ⇒ an ≈ 11 ns window at a
+3.33 ms refresh period — the width of one or two instruction boundaries. This reading needs **no hung bus**;
+§2's "the watchdog touches only OCRAM" premise was also wrong (its handler reads the DWT cycle counter and does
+cache maintenance), so the bus-hang reading rests on the PC alone. **Wedge #6 (01:14) added the second data point: PC 0x212f2, the other return address inside the same
+two-instruction window** — a hung store would give one fixed PC; an interrupt taken inside the window gives exactly
+these two. One caveat: in a storm most watchdog captures
+would land inside `pit_isr` (handler context), both of ours show the main context, which the exception tail-chain path
+allows but does not favour — a single sample. Discriminators at the next capture: stacked xPSR IPSR field (0 =
+thread, 138 = PIT handler), the watchdog handler's `EXC_RETURN`, and a PIT interrupt-entry count (all in the
+follow-up firmware commit). Consequence for §3: the free-running change removes the hot-path `end()` (exposure
+÷ 10⁴) but STOP/ALL_OFF, pattern entry, streaming entry, ALL_ON and the error glyph still call it — the follow-up
+guards `disarmRefreshTimer()` by masking only `IRQ_PIT` at the NVIC around `end()` (the watchdog IRQ stays live, so a
+genuinely stalled store would still be captured) — the race is closed at every site.
+
+### 2c. Reproduced (09:01 ET)
+
+Stand-alone sketch (`tools/pit-race-repro/` in the firmware repo): stock `end()` with the disarm swept across
+the timer expiry kills the main loop within 0.5 s; the same loop with `IRQ_PIT` masked around `end()` runs
+5.9 M cycles / 2.7 M expiries in 10 min without a stall. The mechanism is established.
+
+## 3. Proposed fix: free-running refresh timer
+
+Arm the refresh timer once when the display enters SHOW_FRAME (or when the rate changes); disarm only on
+STOP/ALL_OFF/state exit; SET_FRAME_POSITION only loads the frame. Rationale: the refresh ISR sets a flag; both the
+panel transfer and the SD load run in `loop()`, so they are serialized and the disarm never protected anything. Two
+effects: (a) removes all PIT register traffic from the 0x70 hot path — if the wedge disappears the churn was the
+trigger, if it persists the next watchdog PC moves to the real blocker (SD read / USB write); (b) fixes the observed
+display starvation (at 286 Hz only ~20 frames/s reached the panels because every command restarted the 3.3 ms period;
+median command spacing 3 ms).
+
+Alternatives considered: (i) keep disarm/arm but only when the rate changes — same PIT traffic on state entry, so a
+weaker version of the same; (ii) bound the wait — there is no software wait to bound; a hung bus write cannot be
+timed out from software, only the watchdog recovers it; (iii) move the refresh to a different timer block (GPT/TMR)
+— discriminates PIT-specific vs bus-wide, but a bigger change; keep as the follow-up if the PC moves to another PIT
+access.
+
+## 4. What the review should attack
+
+- Is "hung bus write" the only reading of a PC parked on a peripheral store with interrupts still served? (Store
+  buffer semantics on Cortex-M7: the store retires into the write buffer, the exception entry stacks to DTCM, so the
+  ISR can run while the write is pending — consistent?) What else parks a PC on a store for 2 s?
+- Could the captured PC be misleading (stale, off by one instruction, from the wrong stack frame)? LR = return from
+  the inplace_function call immediately preceding — consistent with the PC.
+- Is removing the disarm safe for frame-buffer integrity in every mode (Mode 2 playback, PSRAM playback, streaming,
+  rate changes, the all-on/all-off transitions)?
+- Does the fix risk masking the bug (a bus hang elsewhere becoming rarer/later) rather than discriminating it?
+- Anything in the shrinking-interval / power-cycle observation that argues for a specific peripheral (SD card
+  internal state, panels' SPI slaves, host USB)?
+- The A/B design: what exposure at which rate is needed before "no wedge on the free-running build" means something,
+  given the 7 h clean stretch we just saw on the unfixed build after a power cycle?
diff --git a/docs/development/mode3-wedge-night2-scan-2026-09-13.md b/docs/development/mode3-wedge-night2-scan-2026-09-13.md
new file mode 100644
index 00000000..c88065ce
--- /dev/null
+++ b/docs/development/mode3-wedge-night2-scan-2026-09-13.md
@@ -0,0 +1,40 @@
+# fw #50 soak night 2 — wedge-scan table (2026-09-12 23:14 → 2026-09-13 07:57 ET)
+
+Generated 07:58 ET by `scripts/wedge-scan.py` over the bridge behavior_v2 logs of the 200 Hz + jumps block (baseline `4860fef8` 23:14–01:19, fix build `394dee45` 01:20 →). Onsets: wedge #5 (file 233629, 909 s) and wedge #6 (file 005729, 1022 s), both on the baseline; none on the fix build. The RTT median is 3 ms on the fix build vs 2 ms on the baseline (p99 11 vs 8–9 ms): the display now transfers ~75 frames/s instead of ~40, and each 0.8 ms transfer competes with command handling in `loop()`.
+
+| file | run | protocol | bench | fw | fmt | dur s | 0x70 OK | 0x70 total | RTT med | RTT p99 | status!=0 | isolated | onset s | onset line | onset idx | 0x70 before | timeouts after | first non-0x70 fail | soft degrade | ctl recs | sd max us | ctl states | ctl rejects | trend (dt med) | resets | bad lines | outcome | flags |
+|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
+| arena-log-20260912-231449-976.jsonl | ? | ? | soak-logs | — | behavior_v2 | 2.4 | n/a (no arena_command rows) | n/a (no arena_command rows) | n/a (no arena_command rows) | n/a (no arena_command rows) | n/a (no arena_command rows) | n/a (no arena_command rows) | — | — | — | — | — | — | n/a (no arena_command rows) | 8 (cc:3, cf:1, cs:4) | 598 | sd_open:1, state_change:3 | 0 | n/a (no arena_command rows) | 0 | 0 | no-arena-rows | — |
+| arena-log-20260912-231452-384.jsonl | 8ql89mld | soak_mode3_card.yaml | bench01 | 4860fef8 2x10 2026-09-12 feat/telemetry-ring-2x10 | behavior_v2 | 1296.7 | 329637 | 329637 | 2 | 7 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 9 | 365924 (cc:329678, cf:36162, cs:84) | 66987 | sd_open:20, sd_slow:23, state_change:41 | 0 | last30s 2.0 vs overall 2 | 0 | 0 | clean | — |
+| arena-log-20260912-233629-064.jsonl | ? | ? | soak-logs | — | behavior_v2 | 0.0 | n/a (no arena_command rows) | n/a (no arena_command rows) | n/a (no arena_command rows) | n/a (no arena_command rows) | n/a (no arena_command rows) | n/a (no arena_command rows) | — | — | — | — | — | — | n/a (no arena_command rows) | — | — | — | — | n/a (no arena_command rows) | 0 | 0 | no-arena-rows | — |
+| arena-log-20260912-233629-072.jsonl | 9iefjetf | soak_mode3_card.yaml | bench01 | 4860fef8 2x10 2026-09-12 feat/telemetry-ring-2x10 | behavior_v2 | 925.8 | 171006 | 171009 | 2 | 7 | 0 | 0 | 909.0 | 593884 | 148 | 171006 | 3 | GET_CONTROLLER_INFO (0xC2) | dt>50ms before onset: 19 | 240852 (cc:171162, cf:69629, cs:61) | 3445 | boot(watchdog-reset):1, sd_open:15, sd_slow:14, state_change:29, telemetry:2 | 0 | last30s 3.0 vs overall 2 | 10 | 0 | wedge | resets=10 |
+| arena-log-20260912-235154-879.jsonl | 28s313pu | soak_mode3_card.yaml | bench01 | 4860fef8 2x10 2026-09-12 feat/telemetry-ring-2x10 | behavior_v2 | 189.4 | 11855 | 11858 | 3 | 8 | 3 (SET_FRAME_POSITION (0x70):3) | 0 | — | — | — | — | — | — | dt>50ms before onset: 0 | 16007 (cc:11863, cf:4135, cs:9) | 3430 | error_glyph:3, sd_open:2, state_change:4 | 3 | last30s 3.0 vs overall 3 | 0 | 0 | fault-declared | — |
+| arena-log-20260912-235504-238.jsonl | ? | ? | soak-logs | — | behavior_v2 | 0.0 | n/a (no arena_command rows) | n/a (no arena_command rows) | n/a (no arena_command rows) | n/a (no arena_command rows) | n/a (no arena_command rows) | n/a (no arena_command rows) | — | — | — | — | — | — | n/a (no arena_command rows) | — | — | — | — | n/a (no arena_command rows) | 0 | 0 | no-arena-rows | — |
+| arena-log-20260912-235504-254.jsonl | a6awnncg | soak_mode3_card.yaml | bench01 | 4860fef8 2x10 2026-09-12 feat/telemetry-ring-2x10 | behavior_v2 | 1248.3 | 233370 | 233370 | 2 | 8 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 16 | 326447 (cc:233411, cf:92959, cs:77) | 41419 | sd_open:20, sd_slow:16, state_change:41 | 0 | last30s 2.0 vs overall 2 | 0 | 0 | clean | — |
+| arena-log-20260913-001552-592.jsonl | ax24jzr8 | soak_mode3_card.yaml | bench01 | 4860fef8 2x10 2026-09-12 feat/telemetry-ring-2x10 | behavior_v2 | 1248.3 | 232671 | 232671 | 2 | 9 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 14 | 325289 (cc:232712, cf:92498, cs:79) | 66863 | sd_open:20, sd_slow:18, state_change:41 | 0 | last30s 2.0 vs overall 2 | 0 | 0 | clean | — |
+| arena-log-20260913-003640-914.jsonl | bntc6z7b | soak_mode3_card.yaml | bench01 | 4860fef8 2x10 2026-09-12 feat/telemetry-ring-2x10 | behavior_v2 | 1248.3 | 233504 | 233504 | 2 | 9 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 15 | 326605 (cc:233545, cf:92984, cs:76) | 88346 | sd_open:20, sd_slow:15, state_change:41 | 0 | last30s 2.0 vs overall 2 | 0 | 0 | clean | — |
+| arena-log-20260913-005729-255.jsonl | cekkau8n | soak_mode3_card.yaml | bench01 | 4860fef8 2x10 2026-09-12 feat/telemetry-ring-2x10 | behavior_v2 | 1039.0 | 192026 | 192029 | 2 | 8 | 0 | 0 | 1022.2 | 665067 | 192 | 192026 | 3 | GET_CONTROLLER_INFO (0xC2) | dt>50ms before onset: 19 | 268344 (cc:192126, cf:76148, cs:70) | 41249 | boot(watchdog-reset):1, sd_open:17, sd_slow:18, state_change:33, telemetry:1 | 0 | last30s 2 vs overall 2 | 10 | 0 | wedge | resets=10 |
+| arena-log-20260913-011448-291.jsonl | 0uac18py | soak_mode3_card.yaml | bench01 | 4860fef8 2x10 2026-09-12 feat/telemetry-ring-2x10 | behavior_v2 | 320.1 | 19356 | 19356 | 2 | 7 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 0 | 27087 (cc:19484, cf:7589, cs:14) | 3430 | boot:1, boot(watchdog-reset):1, prev_isr_count(usb):1, sd_open:2, state_change:5, telemetry:3, wdog_context(thread, before=none):1 | 0 | last30s 2.0 vs overall 2 | 0 | 0 | clean | — |
+| arena-log-20260913-012008-355.jsonl | ? | ? | soak-logs | — | behavior_v2 | 0.0 | n/a (no arena_command rows) | n/a (no arena_command rows) | n/a (no arena_command rows) | n/a (no arena_command rows) | n/a (no arena_command rows) | n/a (no arena_command rows) | — | — | — | — | — | — | n/a (no arena_command rows) | — | — | — | — | n/a (no arena_command rows) | 0 | 0 | no-arena-rows | — |
+| arena-log-20260913-012008-367.jsonl | d7p9iuzz | soak_mode3_card.yaml | bench01 | 394dee45 2x10 2026-09-13 feat/telemetry-ring-2x10 | behavior_v2 | 1248.3 | 235765 | 235765 | 3 | 9 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 9 | 408997 (cc:235806, cf:173115, cs:76) | 88737 | sd_open:20, sd_slow:15, state_change:41 | 0 | last30s 2 vs overall 3 | 0 | 0 | clean | — |
+| arena-log-20260913-014056-656.jsonl | dygg8k3w | soak_mode3_card.yaml | bench01 | 394dee45 2x10 2026-09-13 feat/telemetry-ring-2x10 | behavior_v2 | 1248.3 | 231948 | 231948 | 3 | 11 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 16 | 401516 (cc:231989, cf:169451, cs:76) | 88643 | sd_open:20, sd_slow:15, state_change:41 | 0 | last30s 2 vs overall 3 | 0 | 0 | clean | — |
+| arena-log-20260913-020144-965.jsonl | ep7nfeid | soak_mode3_card.yaml | bench01 | 394dee45 2x10 2026-09-13 feat/telemetry-ring-2x10 | behavior_v2 | 1248.4 | 231829 | 231829 | 3 | 11 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 16 | 400900 (cc:231870, cf:168949, cs:81) | 67288 | sd_open:20, sd_slow:20, state_change:41 | 0 | last30s 2 vs overall 3 | 0 | 0 | clean | — |
+| arena-log-20260913-022233-343.jsonl | ffywilz0 | soak_mode3_card.yaml | bench01 | 394dee45 2x10 2026-09-13 feat/telemetry-ring-2x10 | behavior_v2 | 1248.3 | 231754 | 231754 | 3 | 11 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 21 | 400866 (cc:231795, cf:168990, cs:81) | 67415 | sd_open:20, sd_slow:20, state_change:41 | 0 | last30s 2.0 vs overall 3 | 0 | 0 | clean | — |
+| arena-log-20260913-024321-665.jsonl | g6q45x72 | soak_mode3_card.yaml | bench01 | 394dee45 2x10 2026-09-13 feat/telemetry-ring-2x10 | behavior_v2 | 1248.3 | 231835 | 231835 | 3 | 11 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 17 | 401257 (cc:231876, cf:169302, cs:79) | 88663 | sd_open:20, sd_slow:18, state_change:41 | 0 | last30s 2 vs overall 3 | 0 | 0 | clean | — |
+| arena-log-20260913-030409-989.jsonl | xhbv1aao | soak_mode3_card.yaml | bench01 | 394dee45 2x10 2026-09-13 feat/telemetry-ring-2x10 | behavior_v2 | 1248.4 | 231877 | 231877 | 3 | 11 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 18 | 401160 (cc:231918, cf:169167, cs:75) | 95923 | sd_open:20, sd_slow:14, state_change:41 | 0 | last30s 2.0 vs overall 3 | 0 | 0 | clean | — |
+| arena-log-20260913-032458-362.jsonl | ho8kr6po | soak_mode3_card.yaml | bench01 | 394dee45 2x10 2026-09-13 feat/telemetry-ring-2x10 | behavior_v2 | 1248.3 | 231886 | 231886 | 3 | 11 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 23 | 401449 (cc:231927, cf:169441, cs:81) | 67438 | sd_open:20, sd_slow:20, state_change:41 | 0 | last30s 2.0 vs overall 3 | 0 | 0 | clean | — |
+| arena-log-20260913-034546-681.jsonl | ezse1axe | soak_mode3_card.yaml | bench01 | 394dee45 2x10 2026-09-13 feat/telemetry-ring-2x10 | behavior_v2 | 1248.3 | 231838 | 231838 | 3 | 11 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 19 | 401130 (cc:231879, cf:169171, cs:80) | 88742 | sd_open:20, sd_slow:19, state_change:41 | 0 | last30s 2.0 vs overall 3 | 0 | 0 | clean | — |
+| arena-log-20260913-040634-965.jsonl | 5qyu154w | soak_mode3_card.yaml | bench01 | 394dee45 2x10 2026-09-13 feat/telemetry-ring-2x10 | behavior_v2 | 1248.4 | 232065 | 232065 | 3 | 11 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 17 | 401856 (cc:232106, cf:169674, cs:76) | 89187 | sd_open:20, sd_slow:15, state_change:41 | 0 | last30s 2 vs overall 3 | 0 | 0 | clean | — |
+| arena-log-20260913-042723-334.jsonl | jwi7q5z4 | soak_mode3_card.yaml | bench01 | 394dee45 2x10 2026-09-13 feat/telemetry-ring-2x10 | behavior_v2 | 1248.4 | 231861 | 231861 | 3 | 11 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 18 | 401201 (cc:231902, cf:169220, cs:79) | 88797 | sd_open:20, sd_slow:18, state_change:41 | 0 | last30s 2 vs overall 3 | 0 | 0 | clean | — |
+| arena-log-20260913-044811-696.jsonl | kn9gm7i1 | soak_mode3_card.yaml | bench01 | 394dee45 2x10 2026-09-13 feat/telemetry-ring-2x10 | behavior_v2 | 1248.3 | 231933 | 231933 | 3 | 11 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 18 | 401402 (cc:231974, cf:169348, cs:80) | 67326 | sd_open:20, sd_slow:19, state_change:41 | 0 | last30s 2 vs overall 3 | 0 | 0 | clean | — |
+| arena-log-20260913-050900-009.jsonl | e0nv1dut | soak_mode3_card.yaml | bench01 | 394dee45 2x10 2026-09-13 feat/telemetry-ring-2x10 | behavior_v2 | 1248.3 | 232029 | 232029 | 3 | 11 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 22 | 401680 (cc:232070, cf:169530, cs:80) | 88803 | sd_open:20, sd_slow:19, state_change:41 | 0 | last30s 2.0 vs overall 3 | 0 | 0 | clean | — |
+| arena-log-20260913-052948-328.jsonl | m4rvbyzu | soak_mode3_card.yaml | bench01 | 394dee45 2x10 2026-09-13 feat/telemetry-ring-2x10 | behavior_v2 | 1248.4 | 231997 | 231997 | 3 | 11 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 15 | 401287 (cc:232038, cf:169174, cs:75) | 89076 | sd_open:20, sd_slow:14, state_change:41 | 0 | last30s 2 vs overall 3 | 0 | 0 | clean | — |
+| arena-log-20260913-055036-705.jsonl | mvj4ipxn | soak_mode3_card.yaml | bench01 | 394dee45 2x10 2026-09-13 feat/telemetry-ring-2x10 | behavior_v2 | 1248.4 | 231995 | 231995 | 3 | 11 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 17 | 401684 (cc:232036, cf:169568, cs:80) | 67450 | sd_open:20, sd_slow:19, state_change:41 | 0 | last30s 2 vs overall 3 | 0 | 0 | clean | — |
+| arena-log-20260913-061125-071.jsonl | nmadchfo | soak_mode3_card.yaml | bench01 | 394dee45 2x10 2026-09-13 feat/telemetry-ring-2x10 | behavior_v2 | 1248.4 | 231987 | 231987 | 3 | 11 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 15 | 401620 (cc:232028, cf:169514, cs:78) | 88770 | sd_open:20, sd_slow:17, state_change:41 | 0 | last30s 2.0 vs overall 3 | 0 | 0 | clean | — |
+| arena-log-20260913-063213-451.jsonl | od1mj23j | soak_mode3_card.yaml | bench01 | 394dee45 2x10 2026-09-13 feat/telemetry-ring-2x10 | behavior_v2 | 1248.4 | 231876 | 231876 | 3 | 11 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 17 | 401420 (cc:231917, cf:169423, cs:80) | 88831 | sd_open:20, sd_slow:19, state_change:41 | 0 | last30s 2.0 vs overall 3 | 0 | 0 | clean | — |
+| arena-log-20260913-065301-803.jsonl | p3sv30qu | soak_mode3_card.yaml | bench01 | 394dee45 2x10 2026-09-13 feat/telemetry-ring-2x10 | behavior_v2 | 1248.3 | 232028 | 232028 | 3 | 11 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 19 | 401528 (cc:232069, cf:169383, cs:76) | 88777 | sd_open:20, sd_slow:15, state_change:41 | 0 | last30s 2.0 vs overall 3 | 0 | 0 | clean | — |
+| arena-log-20260913-071350-080.jsonl | puk1dt9c | soak_mode3_card.yaml | bench01 | 394dee45 2x10 2026-09-13 feat/telemetry-ring-2x10 | behavior_v2 | 1248.3 | 231948 | 231948 | 3 | 11 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 17 | 401344 (cc:231989, cf:169276, cs:79) | 88841 | sd_open:20, sd_slow:18, state_change:41 | 0 | last30s 2.0 vs overall 3 | 0 | 0 | clean | — |
+| arena-log-20260913-073438-356.jsonl | qlb7uqb1 | soak_mode3_card.yaml | bench01 | 394dee45 2x10 2026-09-13 feat/telemetry-ring-2x10 | behavior_v2 | 1248.3 | 231956 | 231956 | 3 | 10 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 20 | 401338 (cc:231997, cf:169262, cs:79) | 88868 | sd_open:20, sd_slow:18, state_change:41 | 0 | last30s 2.0 vs overall 3 | 0 | 0 | clean | — |
+| arena-log-20260913-075526-696.jsonl | rc2fttcm | soak_mode3_card.yaml | bench01 | 394dee45 2x10 2026-09-13 feat/telemetry-ring-2x10 | behavior_v2 | 115.5 | 22331 | 22331 | 3 | 9 | 0 | 0 | — | — | — | — | — | — | dt>50ms before onset: 1 | 38665 (cc:22316, cf:16344, cs:5) | 3445 | sd_open:2, state_change:3 | 0 | last30s 2.0 vs overall 3 | 0 | 0 | incomplete | no-terminal-event |
+
+_dt = host-observed round trip incl. queue time (not controller RTT). Onset = first 0x70 timeout followed by >= 2 more timeouts within 10 arena rows; timeouts_after excludes the onset row._
diff --git a/docs/development/mode3-wedge-soak-plan.md b/docs/development/mode3-wedge-soak-plan.md
new file mode 100644
index 00000000..16d2a404
--- /dev/null
+++ b/docs/development/mode3-wedge-soak-plan.md
@@ -0,0 +1,336 @@
+# Mode-3 controller wedge (fw #50) — findings, soak harness, campaign spec
+
+**Status:** harness BUILT 2026-09-11 (Studio v0.76 + firmware branch `feat/controller-health` +
+`scripts/wedge-scan.py` + pyserial `scripts/soak_mode3.py`), **nothing bench-tested yet**.
+Companion to `controller-telemetry-ring-buffer-proposal.md` (PR #192) and Linear LAB-149. Codex
+cross-review of the plan: `.codex-review/report-20260911-wedge-soak.md` (gpt-6-astra).
+
+## 1. The bug in one paragraph
+
+[reiserlab/LED-Display_G6_Firmware_Arena#50](https://github.com/reiserlab/LED-Display_G6_Firmware_Arena/issues/50)
+(Isabel, 2026-09-11): during sustained Mode-3 host-stepped streaming (SET_FRAME_POSITION 0x70 at
+100–286 Hz over USB CDC) the controller stops answering within one command of running perfectly
+and never recovers without a power cycle. Reproduced on 2 controllers / 2 rigs / 2 users /
+2 protocols; ~292k good 0x70s before the failures; `status` never non-zero; time to failure
+79 s → 1035 s; rate ≈ 1 in 10 experiments. `scripts/wedge-scan.py` over the course data repo
+found a **sixth, earlier occurrence** — rig2, 2026-07-11, `p3-heisenberg-slashes-full`
+(Olenka), a third controller — with the identical signature (six replies at 1–3 ms, then
+`03 70 a6 00` times out, 32 unanswered 0x70s, then 0x08 fails). First sighting is therefore
+two months earlier than the report. The five reported wire logs are **not** in the course repo
+(aborted runs were never auto-committed; bench03 has no folder) — they live on the rigs.
+
+## 2. What the code says (verified 2026-09-11)
+
+### Host (webDisplayTools, before v0.76)
+
+- The closed-loop drain loop (`js/fictrac-bridge-client.js`) **swallowed every 0x70 timeout**
+  and kept spinning at 2 Hz; a wedged run therefore *completed* and auto-committed looking
+  normal. A 0x08 timeout in the runner hard-aborted. That asymmetry was the core host defect.
+- Every command is already logged host-side (`arena_command` → `behavior_v2` `["a", …]` row) with
+  `dt` = host-observed round trip **including queue time** behind other queued commands.
+- `SYSTEM_RESET` 0x01 exists on the wire and in both UIs, never used programmatically; the link
+  had no `getPorts()` path, so an unattended reconnect was impossible.
+
+### Firmware (`main` d6358d2)
+
+- `handleSetFramePosition` does an **uncached SD seek + read per 0x70** (`loadFrame`), plus a
+  blocking I2C DAC write when AO is in `frame_number` mode. IntervalTimer end/begin churn is
+  **benign** (the core re-scans PIT channels; ~4 register writes) — issue lead #1 downgraded.
+- SD is Teensy `SD.h` over PJRC SdFat in **polled `FIFO_SDIO`** mode: every non-sequential
+  sector does CMD12 `syncDevice` + `readStart`, each gated on `BUSY_TIMEOUT_MICROS` = 1 s, plus
+  an unbounded spin on `SDHC_PRSSTAT_BREN`. No retry, no re-init (`SD.begin` once in `setup()`),
+  no error surface. `transferPanelSet` also spins unbounded on `dmaComplete_`.
+- `SerialManager::flushResponses()` ignores `Serial.write()`'s short return; the Teensy core's
+  `usb_serial_write` has a sticky 120 ms `TX_TIMEOUT_MSEC` path → USB twin of fw #28.
+- **No watchdog, no loop timing, no SD error surface** (before `feat/controller-health`).
+- **0xE3 is the PANEL image footer** (`/firmware/panel.bin`), not controller build info; its
+  status 1 is correct on a card without a panel image. There is **no controller-version opcode**
+  (LAB-150). 0xC2 already returns the MAC (fw #24 done).
+- 0x01 = `SCB_AIRCR SYSRESETREQ` after an ack: resets MCU + USDHC, does **not** power-cycle the
+  card.
+
+### Correction to the issue's "two latency tiers"
+
+0x82 (`GET_PATTERN_FILENAME`) is a **RAM lookup** (`names_[]`), not an SD read. The 1.3–2.4 s
+replies were a 7-command connect-time burst queued FIFO behind each other, so their `dt` includes
+queue time. The SD-touching 0xE3 took 121 ms. Best estimate of the degraded per-command RTT:
+**~100–500 ms (50–250×), no SD-specific tier.** The quantitative match to the SDIO 1 s busy
+timeout is therefore gone; H1 and H2 below are peers.
+
+## 3. Hypothesis ladder (to be settled by the harness)
+
+| # | Mechanism | Evidence for | Evidence against | Discriminator |
+|---|---|---|---|---|
+| H1 | SDIO polled-busy latch (card or USDHC stuck in a retry/busy state; every SD op ~1 s) | per-0x70 random seeks are the highest-rate SD path; only a power cycle clears | 0x82 (RAM) was as slow as anything; 0xE3 (SD) only 121 ms | GET_HEALTH `sd_read_max_us` / `sd_err`; 0x01 (resets USDHC but not the card) |
+| H2 | USB-CDC reply path / loop stall (device-side TX state, 120 ms `TX_TIMEOUT` signature; a slow op inflating every loop iteration) | 0xE3 = 121 ms ≈ `TX_TIMEOUT_MSEC`; host reconnect (no re-enumeration) doesn't clear it | nothing yet | GET_HEALTH `loop_max_us`, breadcrumb/slowest-op after 0x01; pyserial arm (no Chrome) |
+| H3 | Host/Chrome side (Web Serial, OS USB stack) | — | wedge survives a port close/reopen; controller answers slowly (so it is the device) | pyserial arm reproduces ⇒ not H3 |
+
+The single most valuable experiment remains: **on the next wedge, send `01 01` before power
+cycling and read health/0xC2/0x88 afterwards.** The harness does exactly that (policy
+`reset-continue`), after a first-fault halt for hands-on inspection.
+
+## 4. What shipped (2026-09-11) and how it fits together
+
+| Piece | Where | What it does |
+|---|---|---|
+| Fault detector | `js/fictrac-bridge-client.js` | ≥ 3 failed applies in the last 10 → latched `fault`, apply forced OFF, event to the session |
+| Runner fault path | `js/arena-runner-g6.js` `fault()` | wakes the trial wait, `summary.fault`, `stopAcked`; a timed-out protocol command is labelled the same |
+| Session | `js/arena-session.js` | bridge `fault` → `runner.fault`; runner sends go through `session.send` (logged); `reconnect()`, `flushRx()`; `dt` on the monotonic clock |
+| Link | `js/arena-link.js` | `reconnect()` from granted ports (VID/PID match, ambiguity refused), write-stall deadline |
+| Outcome | `js/run-log.js`, `js/studio-runlog-adapter.js` | `CONTROLLER_FAULT` (auto-commits; `ABORTED_BY_USER` still doesn't) |
+| Post-mortem | `js/studio-postmortem.js` | quiet → confirm → probe window → halt \| reset → reconnect → MAC check → post-reset probe |
+| Soak driver | `arena_studio.html` (File ▾ → Soak…, `?soak=1`) | repeats `runOnce()`; refuses without a `behavior_v2` ack or without frames; halt-first |
+| Health opcode | firmware `feat/controller-health` (0xCA, cap bit 7) | loop timing, SD read stats + error, counters, reset cause, previous-boot breadcrumb + slowest op |
+| Wire | `js/arena-wire-g6.js` | `encodeGetHealth`/`decodeHealth` (55 B + 11 B tail), `GET_FRAME_POSITION` |
+| Analyzer | `scripts/wedge-scan.py` | per-run table (onset, RTTs, timeouts, soft degradation) over v1/v2/gz/`.runlog.json` |
+| Pyserial driver | firmware `scripts/soak_mode3.py` | browser-free Mode-3 soak, same fault lifecycle + log format |
+| Simulator | `fictrac-bridge/fictrac_sim.py` `--turn-sigma`, `--jump-every`, `--jump-deg` | FicTrac-like ±1–2 frame walk vs wide seeks |
+| Protocol | `protocols/soak_mode3_closed_loop.yaml` | 20 × 60 s Mode-3 trials alternating the 200-frame bar and 20-frame grating |
+
+## 5. Campaign spec — one definition, both drivers
+
+- **Fault** = ≥ 3 failures (timeout / non-zero status / transport error) within the last 10
+  frame commands. Not "3 consecutive": a late reply to an earlier 0x70 can satisfy the next
+  request (same echo byte) and reset a consecutive counter.
+- **Lifecycle** = latch → apply OFF → run aborts (`CONTROLLER_FAULT`, `stopAcked` recorded) →
+  **quiet period ≥ 1 s + rx flush** → confirmation 0xC2 (2 s) → **probe window ≥ 60 s**
+  (0xC2, 0x33, 0x72, 0xCA, 0x88 idx 1, 0xE3; 5 s timeouts; every 2 s) → policy.
+- **Policy**: `halt` (default for the campaign's FIRST fault: leave the controller wedged for
+  hands-on inspection — DEBUG_SERIAL, manual port close/reopen, manual 0x01 with a human
+  watching) or `reset-continue` (one 0x01, settle 3 s, reconnect from granted ports, verify MAC,
+  post-reset probe; recovered ⇒ a NEW soak iteration, never a resume; ≤ 3 resets then halt).
+- **Log rows** (bridge NDJSON, `behavior_v2`): every command as `["a", …]`; typed
+  `{"event":"probe", phase, name, cmd, req, resp, dt, status, ok, decoded|error}`;
+  `{"event":"health", …}`; `{"event":"soak", phase: start|iteration-start|iteration-end|paused|end}`;
+  `runner` events carry `summary.fault` / `stopAcked`. `dt` is host-observed latency.
+- **Never count a dead simulator/bridge as a controller fault**: the Studio soak pauses when no
+  frames arrive; the pyserial driver has no such dependency.
+- **Instrumentation is a factor**: record whether GET_HEALTH polling was on (1 Hz is negligible
+  but say so).
+
+## 6. Bench recipe (CSHL 10-10 controller, no FicTrac → simulator path)
+
+Upgrade first (all benches): `git pull`, restart `pixi run bridge`, hard-refresh the Studio, and
+confirm the Console FicTrac panel's log-level mirror reads `behavior_v2` without ⚠.
+
+Studio arm (one controller, one night):
+```
+pixi run sim -- --count 0 --rate 100 --seed 1              # ±1.6-frame walk; --rate 286 for the fast arm
+pixi run sim -- --count 0 --rate 100 --jump-every 50       # wide-seek arm
+pixi run bridge -- --log-dir soak-logs
+# Studio ?advanced=1&soak=1 → File ▾ → Open → protocols/soak_mode3_closed_loop.yaml → connect
+# → File ▾ → Soak…  (iterations=0 hours=12 gap=10 first=halt then=reset max=3)
+```
+Pyserial arm (the following night — the two drivers cannot share one USB port):
+```
+cd LED-Display_G6_Firmware_Arena && python scripts/soak_mode3.py --port /dev/cu.usbmodemXXX \
+   --hz 100 --index-walk walk --pattern 4 --hours 12 --on-fault halt --log-dir soak-logs
+```
+Mode-2 control arm: `soak_mode3.py --mode 2 --fps 300 --hours 8` (health tick only).
+Morning: `pixi run python scripts/wedge-scan.py soak-logs/` (markdown table; `--verbose` for onset
+context; `--json` for the dashboard).
+
+**Expected yield.** At ~1 wedge per 10 × 40-min experiments, a 12 h night ≈ 18 iterations ≈
+1–2 events with high variance. A quiet night is censored exposure, not evidence of a fix; plan
+≥ 3 nights per arm before drawing conclusions, and compare arms across nights, not
+simultaneously.
+
+## 7. Experiment matrix
+
+| Arm | Driver | Rate | Index pattern | Question |
+|---|---|---|---|---|
+| A | Studio + sim | 100 Hz | ±1.6-frame walk, 200 f + 20 f patterns | baseline reproduction under the deployed path |
+| B | Studio + sim | 286 Hz | walk | rate dependence (bench03 failed faster at 286) |
+| C | Studio + sim | 100 Hz | `--jump-every 50` | does defeating the SD sequential path matter? (H1) |
+| D | pyserial | 100 Hz | walk | Chrome/Web Serial out of the loop (H3) |
+| E | pyserial | 100 Hz | `seq` | pure sequential reads — H1 predicts fewer wedges |
+| F | pyserial | Mode 2 300 fps | — | does the wedge need 0x70 at all? |
+| G | any, after ≥ 1 baseline wedge | — | — | fw cache candidate A/B (held until then) |
+
+## 8. Decisions taken (Michael, 2026-09-11)
+
+1. Fail closed on repeated 0x70 timeouts in ALL runs; faulted runs auto-commit as `CONTROLLER_FAULT`.
+2. First fault of the campaign halts; later faults reset-continue (one 0x01 per fault, ≤ 3).
+3. Runner sends are logged through the session.
+4. Frame-cache firmware candidate is **held** until a baseline wedge reproduces on stock firmware
+   (Codex: it changes the very access pattern under suspicion).
+5. GET_HEALTH (0xCA) ships first as additive observation, with the `.noinit`-style breadcrumb.
+6. Self-healing is issues-only this pass; the runner-level recovery policy comes after the soak
+   data (if 0x01 does not clear the wedge, the recovery primitive changes).
+7. Logs are `behavior_v2` everywhere; the soak refuses otherwise.
+
+## 9. Open items
+
+- Bench-test the whole chain on the 10-10 controller (unplug test for the disconnect path; a
+  Node-only test covers the timeout path); first soak night.
+- Flash `feat/controller-health` and run `tests/test_health.py`; confirm the breadcrumb survives 0x01.
+- Get the five reported wire logs off bench03/rig03-sr (not in the course repo) and run
+  `wedge-scan.py` on them to confirm the issue's numbers.
+- Firmware follow-ups filed as issues: `flushResponses` short-write (#28 twin), SD error surface +
+  `SD_REINIT`, controller-version opcode (LAB-150), close #24.
+- Ring buffer T1–T6 (PR #192) unchanged: sidecar-first, 10–20 Hz drain; T4/T5 run on this soak
+  workload once the ring exists.
+
+## 10. Bench log
+
+**2026-09-11/12 — first night (CSHL 10-10, MAC 04:E9:E5:12:91:E2, stock course fw, sim 100 Hz, Studio soak, halt-first).**
+Smoke + 3 full iterations clean (2,001 + 110,641 + 121,670 + 121,685 0x70 OK; RTT 2 / 4–9 ms). **Iteration 4
+wedged at 187.8 s** (frame 78 of the 200-frame trial) after 18,128 clean commands — ≈ 374k good 0x70s over
+~70 min of streaming before failure. The controller was **fully silent**, not slow: 5/10/20 s probes from
+Chrome, port close+reopen, and pyserial outside Chrome all returned zero bytes; USB stayed enumerated; the
+display held its last frame. **0x01 SYSTEM_RESET got no ack** (parser lives in the stuck loop); only a power
+cycle recovered it. Consequences: H3 (browser/host stack) is out; the fault looks like `loop()` stopped
+(unbounded spin), not a slow path; the host-side recovery primitive must be a hardware watchdog or the
+Teensy bootloader route (134-baud reboot → HalfKay → `teensy_loader_cli -b`). Attempting the latter half by
+flashing #53 remotely put the Teensy in HalfKay with **no HID interface attached on macOS 26**, so no loader
+could see it — do not flash without someone at the bench; test the bootloader route with a finger on the
+button first. Also: the Studio tab was in the background (timer throttling ⇒ ~1 s-aligned timeout durations in
+the log; not causal). Harness bugs found and fixed live: protocol `fictrac.disconnect` took the logger down;
+a remembered v1 session setting overrode the soak's v2; one out-of-range 0x70 per trial with a smaller frame
+count (#199). Logs: `soak-logs/arena-log-20260912-001625-545.jsonl` (wedge) and siblings, bench-local.
+
+- **2026-09-12 11:24 ET →** soak night 2 continues on `22b756dd` (health + version), halt-first, 10 h. Iteration 1 completed 11:5x.
+- **2026-09-12 12:00 ET** Codex (gpt-6-astra) status + diff review reconciled — `.codex-review/report-20260912-status.md`. 16 diff findings, 11 verified and fixed on the branch (deferred commit on fault, recovery predicate, ack-means-stored, tagged-row readers, 0xCB-bit-2 telemetry gate, identity per link-up, exclusive post-mortem link, telemetry off switch, analyzer declared fault, bridge row shapes, soak `unexercised`); 2 deferred (write-timeout transport generation; session-owned lifecycle → LAB-212), 1 rejected (sidecar). Full suite green.
+- **2026-09-12 12:0x ET** ring firmware `feat/telemetry-ring-2x10` = `ac4c08f` pushed (0xA8/0xA9, u32 sd_load, heap guard, eviction-first commit, synthetic producer, 0xCB flags bit 2). **Not flashed** — waits for a human at the bench (night-1 lesson) at an iteration boundary: `Studio.stopSoak()`, restart bridge (3.1), flash, verify 0xCB bit 2 + 0xA8 ack, restart soak = T4.
+
+- **2026-09-12 12:20 ET** Codex (gpt-6-astra) diff review of the ring FIRMWARE (`ac4c08f`) — reconciled in the ring worktree `.codex-review/report-20260912-ring.md`. 19 findings: blocking ones are in the reference pyserial drainer (health-gated 0xA8, peek loop, ack-before-flush) and the HIL tests; runtime fixes = ack ≥ next_seq ignored, seq 0/0xFFFFFFFF never emitted, heap guard in ack/peek/configure, exact-size boot repair. Host mirror: drainer `rearm()` (NO_ACK first after connect / before the post-reboot dump; incarnation check). Deferred for the diagnostic build: dual headers, linker reservation, PSRAM/stream FRAME identity, 64-bit cursor. Flash = go once the fix commit builds; target boundary 12:49 ET.
+
+- **2026-09-12 13:00–13:45 ET — T4 flash + iteration-1 gate (Michael at the bench).** Ring fw `c47ee684` flashed via the button (`teensy_loader_cli -w -v`; macOS has no `timeout`). Iteration 1 (1,238 s, 104,895 0x70s) checked against the host echoes: CMD 0x70 count matches the host (2 in flight), seq 1..178k contiguous, 0 dropped / 0 refused, FRAME idx = last request 16,562/16,564, sd_load median 1.2 ms p99 2.3 ms p99.9 3.4 ms max 19.4 ms, spi 0.77 ms flat, host↔controller drift −3 ppm, dispatch→SPI 4.7 ms median (display lags the reply by ~2.7 ms). GET_HEALTH prev_slow_op after the iteration: op 1, **70.6 ms** (not a FRAME load — the slowest op covers sd_open/other SD ops too). **Reboot survival: PASS both routes** — 0x01 SYSTEM_RESET (ack, gesture-free reconnect, boot_count 0→1, survived flag, seq continuous, boot record kind 1 code 2 arg 1, pre-reset records incl. the 0x01 CMD with status 0xFF) and the bootloader route (134-baud → HalfKay HID in 1 s → `-b` → CDC in 1 s; boot_count 2, resetCause 1, 1 duplicate dropped by rearm). Two bugs found by running it in Chrome and fixed: `poller.stop()` called `window.clearInterval` as a method (Illegal invocation — would have aborted the post-mortem), and the 9-byte 0xA9 request was logged as a 207 B object 20×/s (20 % of the file) → `send({silent:true})`. Soak restarted 13:45 as T4 proper (same protocol sha 49313f52, hours=10, halt-first).
+
+- **2026-09-12 15:44 ET — WEDGE #2 (first on instrumented firmware), CAPTURED.** Ring fw `c47ee684`, T4 iteration 6, 1181 s into the run (after 112,344 clean 0x70s; ~2 h of streaming since 13:38; total instrumented exposure before it ≈ 6 iterations). Host: three 0x70 timeouts with write stalls (dt 1.2 s, 3.0 s, 3.0 s), then STOP unanswered; post-mortem (halt): 21 probes, 0 answered, ~1 s write stall on each 5 s probe. pyserial: write ok, no reply. USB stayed enumerated. **Capture route worked on the real wedge**: Studio disconnect → 134-baud → HalfKay HID in 1 s → `teensy_loader_cli -b` → CDC in 1 s → reconnect (MAC verified) → GET_HEALTH → ring drain → probes. No power cycle. Log: `soak-logs/wedges/wedge2-20260912-1544-ring-c47ee684.jsonl(.gz)`.
+  **Evidence:** GET_HEALTH `prev_breadcrumb = OP_CMD arg 0x70`, stamp 3.3 ms after the last ring record (FRAME idx 136 = the last host command that was answered, `03 70 88 00` at t_off 1181.389 s; the first timed-out command was `03 70 8a 00` idx 138). `prev_slow_op = sd_read 89.2 ms`. `reset_cause` after the bootloader reboot = 1. Ring survived (boot_count 2→3, 185 records recovered incl. 119 pre-boot, 0 gaps, no heap collision); the last 60 s show normal 0x70/FRAME alternation, sd_load ≤ 2.4 ms, **no STATE records** (no sd_slow, no error glyph). **Reading of the crumb:** `Health::clear()` sets OP_IDLE (does not restore the outer OP_CMD), so OP_CMD/0x70 means the main loop stopped between `Health::mark(OP_CMD)` in `handleBinaryCommand` and `Health::mark(OP_SD_READ)` in `loadFrame` — the SET_FRAME_POSITION preamble (length/pattern/index checks, `spi_.disarmRefreshTimer()` = `IntervalTimer::end()`, `cur_frame_index_ = index`). Nothing in that window can block by itself ⇒ the CPU was taken away: an ISR that never returned, an interrupts-disabled spin elsewhere, or a Cortex-M LOCKUP. Not a plain hard fault: the Teensy core's fault handler reboots after 8 s (we saw > 60 s of silence). **H1 (stuck in the SDIO read) is NOT supported by this sample**; the 89 ms SD read that boot is real but was not the hang site.
+  **Next:** diagnostic build (agent, in progress): hardware watchdog kicked from `loop()` (converts the hang into a reboot with the ring intact = self-healing + crash dump), finer sub-op breadcrumbs in the 0x70 window, an ISR breadcrumb byte, CrashReport passthrough in GET_HEALTH. At the next wedge: **look at the Teensy LED** (fault handler blinks? — no, the core keeps the LED untouched by default; skip) and read the ISR crumb. Soak restarted 15:53 on `c47ee684` (8 h, halt-first) for a second sample with the current crumbs.
+  Corrected false lead: `cores/teensy4/IntervalTimer.cpp` has `printf("beginCycles …")` but `debug/printf.h` compiles it out (macro), confirmed by objdump.
+
+- **2026-09-12 16:27 ET — WEDGE #3, CAPTURED.** Same ring fw `c47ee684`, soak restarted 15:53, iteration 2, 741 s in, on the 20-frame grating (pattern 5; first unanswered 0x70 idx 18) — so not pattern-specific. Same host signature (write stalls, total silence, 21/21 probes unanswered). Bootloader capture route worked again (HalfKay 1 s, CDC 1 s). **Breadcrumb identical to #2: `OP_CMD` arg `0x70`; `prev_slow_op = sd_read` 88.1 ms**; ring intact (boot_count 3→4, 0 gaps); last 60 s normal, SD loads ~1 ms, no STATE records. Two samples, same code window. Log `soak-logs/wedges/wedge3-20260912-1627-ring-c47ee684.jsonl(.gz)`. Exposure on the ring build: wedges after ~2 h 06 min and ~34 min of streaming.
+- **16:25 ET Codex (gpt-6-astra) review of the watchdog build `fb11681`** (`LED-Display_G6_Firmware_Arena-ring/.codex-review/codex-diff-review-20260912-162501-19350/`): NOT flashed as-is. Blocking: rejected pattern upload (`drainBulkData`, up to 15 s) would trip the 2 s watchdog; HIL test module cannot import (duplicate namedtuple field) and two assertions are wrong (CrashReport `len` is 11 WORDS; sub-ops carry arg 0x70); the watchdog PC capture shares the breadcrumb's checksum line with main-context writes → a torn record at boot discards the PC. Significant: starve flag bypassed by `sendRaw` kicks; `wd_armed_` cleared even when programming fails; long ops disable recovery entirely (use a longer finite deadline); every SET_TELEMETRY reasserts watchdog policy; 0xCC needs its own 0xCB flag (bit 3) for rollback safety; `soak_mode3.py` decodes only the 66 B prefix. Deferred: temp-file pattern replacement, recovery-mode boot, versioned crash envelope, ISR hooks bracketing driver code. Fix commit requested from the agent 16:33; host side fixed (CrashReport len in words, 0xCC gated on 0xCB bit 3, `f49bd4c`). Soak restarted 16:33 on `c47ee684` (halt-first) until the fixed build is ready.
+
+- **2026-09-12 16:36 ET — WEDGE #4, CAPTURED**, 5.5 min after the 16:33 restart (31,222 clean 0x70s; pattern 5 idx 4). Same crumb `OP_CMD`/`0x70`; this boot's slowest SD read only 3.4 ms (so the 88–129 ms reads are NOT a prerequisite). Ring boot_count 5. **Intervals between wedges on `c47ee684` after MCU-only reboots: 2 h 06 m → 33 m → 5.5 m** — shrinking. Every recovery so far reset the MCU (bootloader / SYSRESETREQ) but never the SD card or other peripherals; night 1's power cycle was followed by 12 clean iterations. Hypothesis: peripheral (SD card) state degrades across MCU resets → **power-cycle experiment** requested from Michael 16:42 before the next soak.
+- **16:40 ET flashed the watchdog build from HalfKay** (software route, no button): identity reads `fb11681e dirty` (hex built before commit `4d1b61c`; binary has the fixes — 0xCB flags 0x0d, HEALTH ver 2 89 B, 0xCC answers). **RTWDOG configuration FAILED on hardware** (`wdog_flags` 0x49: armed + compiled-in + config-failed); OFF→ON reprogramming via SET_TELEMETRY bit4 does not clear it; kicks = loop count (4.3 M/s). Agent investigating (clock gate / unlock window / 16-vs-32-bit key). Sub-op breadcrumbs + CrashReport readout are live regardless.
+- Log: `soak-logs/wedges/wedge4-20260912-1636-ring-c47ee684.jsonl(.gz)`.
+
+- **2026-09-12 17:04 ET — watchdog build `86eeb4a` flashed from HalfKay (software route, no button) and PROVEN.** Root cause of the earlier failure: the Teensy core never opens WDOG3's clock gate (`CCM_CCGR5`), so every RTWDOG register write was dropped. After the fix: HEALTH ver 3 (97 B), `wdog_cs_boot` 0x2520, `wdog_cs_now` 0x35e0 (EN set), kicks == loop count. **Starve test (SET_TELEMETRY 0x31): reset 0.5 s after the reply, CDC back at 0.8 s; previous-boot record = reset by watchdog, ISR marker = watchdog IRQ, captured PC 0x3aa2 / LR 0xc74d, ring survived (boot 1→2).** Two follow-ups sent to the agent (non-blocking): `wdog_flags` bit 6 "config failed" is a false negative (hardware says EN); the effective timeout is ≈0.5 s, not 2 s (clock/prescaler math) — wanted 2 s so SdFat's 1 s busy timeouts are not clipped. Power-cycle interval test: iteration 1 after the power cycle ran clean (21 min > wedge #4's 5.5 min); continuing on 86eeb4a. Reconciliation: ring worktree `docs/development/codex-review-2026-09-12-watchdog.md`.
+
+- **2026-09-12 17:28 ET — `54b57d0` flashed from HalfKay** (bit-6 false negative fixed: flags 0x09 → 0x0f after the starve reset; HEALTH v4 106 B). Starve test again: **reset 0.52 s** after the reply (port back 0.80 s), PC 0xca4c → `loop` (addr2line), ring survived (boot 3→4). Discrepancy: firmware measures the RTWDOG tick at 127 Hz and computes TOVAL 254 = 2.0 s, but the real expiry is ≈500 Hz — measurement off ~4×; agent asked to calibrate/hard-code 500 Hz. Running the night at the **effective 0.5 s** timeout (every observed slow SD op is ≪ 0.5 s; a legit > 0.5 s stall would self-reset with PC evidence). Studio reloaded with link-drop-as-fault handling (`18ceeda`) and HEALTH v4 decoding (`1b5de7e`). Soak restarted 17:31 (10 h, halt-first; watchdog self-resets take the post-mortem's self-reset path and the soak continues). Post-power-cycle: 43 min clean before this boundary.
+
+- **2026-09-12 17:53 ET — `320e26d` flashed from HalfKay.** Starve test with TOVAL 1000: expiry **6.37 s** (TOVAL 254 earlier: 0.52 s) ⇒ comparator runs at ~127 Hz with a constant ≈190-tick (~1.5 s) offset: expiry ≈ TOVAL/127 − 1.5 s. The "500 Hz" reading was wrong; the CNT measurement was right. Agent asked to explain the offset and calibrate TOVAL for a 2 s expiry (≈445). Tonight runs at the ≈6.4 s effective expiry; host post-mortem gains link-drop handling during the probe window so a reboot mid-window takes the self-reset path. Ring 5→6 survived; PC 0x1664 captured.
+
+- **2026-09-12 18:20 ET — `4860fef` flashed from HalfKay; watchdog expiry calibrated: starve → port gone at 2.02 s (target 2.0), back 2.29 s.** TOVAL 444 = 127 Hz × 2 s + 190-tick offset. HEALTH v5's kick-path diagnostics read `WDOG3_CNT` = 0 before and after every refresh and live, so the readable counter does not expose the running count; the 190-tick offset is a comparator-side constant on this silicon (documented as empirical). PC 0x6e1c captured, ring 7→8 survived. Soak restarted ~18:22 (10 h, halt-first, self-reset path live). Post-power-cycle exposure before this boundary: 92 min clean. **Final firmware for the night: `4860fef8`.**
+
+- **2026-09-12 22:31 ET — operating point raised (Michael):** simulator restarted at **286 Hz** with a **90° jump every 100 frames** (`fictrac_sim.py --rate 286 --seed 1 --jump-every 100 --jump-deg 90`); soak restarted (9 h, halt-first) on `4860fef8`; `soak_note` event in the log marks the switch. First 84 s: FicTrac 286/s, 0x70 delivered **264/s** (0 timeouts, 0 rejects), RTT median 2 ms, p99 7 ms, p99.9 21 ms, max 29 ms; 77 % of consecutive requests change the index (median step 1 frame, 4.9 % > 10 frames), so the SD random-access path runs ~200 loads/s vs ~60/s at 100 Hz; ring 294 rec/s ≈ 4.7 KiB/s, 0 drops/gaps/refused. The 100 Hz block (13:38–22:29, 12 clean iterations = 4 h 10 m since the 16:45 power cycle) is one exposure block; 286 Hz + jumps from 22:31 is the second. Fallback if the instrumentation struggles: 200 Hz.
+
+- **2026-09-12 23:05 ET — FINDING (Michael, watching the arena): the display updates LESS at 286 Hz than at 100 Hz.** Ring data: at 100 Hz ≈ 5,000 commands/min → 3,500–4,000 displayed frame changes/min (60/s); at 286 Hz ≈ 14,000 commands/min → only 1,000–1,400 displayed changes/min (17–23/s). Mechanism (firmware): `handleSetFramePosition` does `disarmRefreshTimer()` → `loadFrame()` → `armRefreshTimer(refresh_rate_hz_)`, i.e. every 0x70 **restarts the refresh period** (`refresh_rate_gs16_default = 300` Hz → 3.3 ms; GS2 1000 Hz). At 286 Hz the host command spacing is median 3 ms (p90 5 ms), so the timer is usually restarted before it can fire; frames reach the panels only in gaps longer than the period (≈10–20 % of gaps). The SD-load and USB paths are still exercised per command (77 % index changes), so the wedge stress stands; the *display* is starved. Not a new bug in the instrumented builds — the same code path is on `main`/`arena-2x10-local`. This is the second half of the held fix candidate ("skip disarm/re-arm when already in SHOW_FRAME at the same rate"): arm once, let the timer free-run, and 0x70 only swaps the buffer. File as a firmware issue tomorrow (perf/latency, LAB-164) and hand to the parallel SD-jitter session. Decision: keep 286 Hz for the night (wedge stress), option 200 Hz (5 ms spacing > 3.3 ms period) if Michael prefers a visibly moving display.
+
+- **2026-09-12 23:15 ET — FINDING (Michael: "faster in minute 1 than minute 20"): a HOST-side slowdown within every iteration.** At 286 Hz, commands delivered per 60 s trial fall from 16.4k (trial 1) to ~8k (trial 20) and host-observed RTT p99 climbs 7 → 140 ms, while the controller side is flat (sd_load p99 2.3 ms, cc→cf 4.9 ms median in every trial). Cause: the Studio's raw log panel (`#runlogBox`) appends one DOM row per arena command with no cap and scrolls to the bottom on each — 43k rows after 10 min at 286 Hz; each append + layout gets slower, the apply loop yields less, `dt` (host-observed, includes queue) inflates. The panel is cleared at run start, which is why each iteration starts fast. At 100 Hz the same effect was ~18 % over an iteration (6.0k → 4.9k commands/trial). **Fix:** bounded raw log (keep 3,000 lines, trim 500 at a time, follow the tail only when not scrolled up) — hot-patched into the live page 23:12 (trimmer interval), source fixed for the next reload. This affects any long closed-loop run in the field (course experiments at 100 Hz lose apply throughput over 20+ min) — release note + probably its own issue.
+
+- **2026-09-12 23:36 ET — 200 Hz block starts** (Michael: 286 Hz too fast for smooth display given the timer-restart effect). Sim `--rate 200 --jump-every 100 --jump-deg 90`; Studio reloaded with the bounded raw log (`df5ce7c`); soak restarted (8 h, halt-first). 286 Hz block result: 3 clean iterations (22:31–23:35); with the live raw-log trim, iteration 3 delivered 329,637 commands vs 232,547 in iteration 1 — the host slowdown confirmed as the DOM log. No wedge since the 16:45 power cycle (6 h 50 m; 100 Hz 12 iterations, 286 Hz 3 iterations). Decision: the free-running-refresh-timer fix waits for a watchdog-captured PC (it would confound the hang window); Isabel note deferred until things are cleaned up.
+
+- **2026-09-12 23:51 ET — WEDGE #5, caught by the WATCHDOG; first captured PC.** 200 Hz block, iteration 1, 909 s in (171k clean 0x70s; 7 h 06 m after the power cycle). Lifecycle fully automatic: 2 timeouts → controller self-reset (watchdog) → link dropped → `link_dropped` fault → post-mortem self-reset path → reconnect (MAC verified) → health → ring dump → probes → **soak continued** (iteration 2 started 10 s later). Evidence (GET_HEALTH v5 after the reset): `prev_breadcrumb = cmd_disarm_timer (6) arg 0x70`, `prev_isr_last = watchdog` (the pre-reset IRQ ran ⇒ the core was taking interrupts), `prev_wdog_pc = 0x000212f4`, `prev_wdog_lr = 0x000212eb`, `prev_slow_op = sd_read 89.6 ms`, reset cause 0x80 (wdog3). **addr2line (ELF 4860fef, built 17:58): both in `IntervalTimer::end()`**; the disassembly puts the PC on `str r1, [r3, #8]` = **`channel->TCTRL = 0`, the PIT channel register write** (LR = return from the `funct_table[index] = nullptr` inplace_function call just before). The last ring record (FRAME idx 152) is 5.5 ms before the breadcrumb stamp; the ring's last 60 s show three `sd_slow` records (32, 41, 88 ms) — the first wedge with slow SD reads in the final minute. No crash record.
+  **Reading:** the main loop sat on a store to a PIT peripheral register for 2 s while still able to take the watchdog interrupt — the signature of a **hung peripheral (IPS/AIPS) bus transaction**: the write never completes, and every other peripheral access (USB registers in the USB ISR, USDHC) blocks behind it, which is exactly the total silence we see. Whether the PIT itself hangs (end/begin churn at 200–286/s: `PIT_MCR` rewrite + channel re-scan on every command) or another master (USDHC/SD DMA, LPSPI DMA) hangs the bus and the PIT write is merely the first access to block is the next question — the free-running-timer change is the discriminator: with no PIT writes in the 0x70 path, a bus hang would move the captured PC to the SD read or the USB write; a PIT-specific hang would disappear. Three earlier breadcrumbs (`OP_CMD`/0x70 before the SD mark) are consistent with the same site.
+
+- **2026-09-12 23:55 ET — host bug after the self-reset (fixed live, proper fix tomorrow):** the iteration after the watchdog recovery faulted 63 s in with three REJECTS (idx 161/162 sent to the 20-frame grating): the bridge `config` carried `frames: 200` for the grating because the Studio rebuilds `Studio.patternSet` from the SD listing on every connect, which erased the in-page `preview.frames` patch for the card-only patterns (`patternFramesByName` then fell back). The post-mortem correctly saw a healthy controller (`transient`) and the soak ended `fault-transient`. Live fix: a re-patch hook on the session state event (+2 s interval); soak restarted 23:56; first grating trial confirmed `frames: 20`, 0 rejects. Proper fix: resolve the frame count from the controller (GET_PATTERN_INFO 0x88) at trial start when the pattern set lacks it, and do not end a soak on a `transient` outcome that immediately follows a self-reset iteration. Tracked in the close-out issue #201.
+
+- **2026-09-13 00:05 ET — standing order (Michael):** soak continues to ~08:00 on `4860fef8`. On the next near-identical wedge (disarm breadcrumb / PC in `IntervalTimer::end()`), flash the **free-running refresh timer** variant (being built: 0x70 no longer disarms/re-arms the PIT; arm once on SHOW_FRAME entry; 0xCB flags bit 4 marks it) and continue the soak on it as the A/B. Each further wedge is a PC data point.
+
+- **2026-09-13 00:41–00:50 — Codex reviews of the evidence doc and of `eca07f6`.** Plan review (adversarial) found
+  the `IntervalTimer::end()` null-callback/`TFLG` race in the Teensy core → PIT interrupt storm with the main
+  context's return address exactly at the captured PC (`channel->TCTRL = 0`); verified in the installed core
+  1.160.0; quantitatively consistent with Isabel's ~292 k commands/failure (≈ 11 ns window). Now the leading
+  mechanism; bus hang is the alternative. Reconciliation: `codex-review-2026-09-13-mode3-wedge-fix.md`; evidence
+  doc §2b. Diff review of the free-running commit: keep the timer policy; fix the non-atomic ISR-lite record
+  update, sticky `armed_hz_` on a failed `begin()`, the lost pre-watchdog ISR identity, the historical-record
+  test assertion; README claims softened. All folded into one follow-up firmware commit (safe PRIMASK-guarded
+  disarm at the remaining `end()` sites, PIT ISR trampoline id 7 + STATE kind 9 counts, watchdog context xPSR/
+  EXC_RETURN → STATE kind 8), to be diff-reviewed before it is the build that the standing order flashes. Soak on
+  `4860fef8` at 200 Hz + jumps continues (iteration 3, trial 21 at 00:47; no wedge since 23:56).
+
+- **2026-09-13 01:25 — fix build candidate `394dee45`** (`eca07f6` free-running refresh + one amended follow-up):
+  `disarmRefreshTimer()` masks only `IRQ_PIT` at the NVIC around `IntervalTimer::end()` (watchdog IRQ stays
+  live); full and lite ISR hooks are atomic with save/restore of the enclosing id; PIT vector trampoline (ISR
+  id 7) re-installed after every `begin()`; watchdog ISR captures stacked xPSR + `EXC_RETURN` + prior `isr_last`
+  into a re-laid-out 3-line record (context line sealed and flushed first); boot after a watchdog reset emits ring
+  STATE kind 8 `wdog_context` / 9 `prev_isr_count`; kind 10 `timer_fail`; old record location invalidated. Two
+  Codex diff reviews reconciled (D1–D12, E1–E13), third running on the round-3 delta. Host decode pushed
+  (`69c14e6`, `d234f6e`). Flash gate: Codex round 3 reconciled → flash at a wedge (standing order) or at an
+  iteration boundary if Michael prefers → starve test must yield a decodable kind-8 record → soak restarts.
+
+- **2026-09-13 01:14:37 ET — WEDGE #6 (baseline `4860fef8`, 200 Hz + jumps, iteration 4, 192 k 0x70s, 83 min
+  after wedge #5).** Watchdog self-reset; lifecycle automatic again (link_dropped → self-reset path → health →
+  ring dump → probes → iteration 5 started 01:14:48). Evidence: `prev_breadcrumb = cmd_disarm_timer (6) arg 0x70`,
+  `prev_isr_last = watchdog`, **`prev_wdog_pc = 0x000212f2`**, LR 0x212eb, slow op sd_read 88.9 ms, 18 `sd_slow`
+  records in the run (five in the last 4 s: 32–88 ms). Disassembly of `IntervalTimer::end()` (4860fef ELF rebuilt
+  in the session scratchpad, identical resolution): `212f0 str r3,[r6,r5]` = `funct_table[i] = nullptr`; `212f2
+  ldr r3,[r7]` = load `channel`; `212f4 str r1,[r3,#8]` = `TCTRL = 0`. Wedge #5's PC (0x212f4) and wedge #6's
+  (0x212f2) are exactly the two return addresses that exist between the callback being nulled and the channel
+  being disabled — a hung store would give a fixed PC, an interrupt taken inside the race window gives exactly
+  these two. Evidence for the `IntervalTimer::end()` race is now two-for-two. Log archived as
+  `soak-logs/wedges/wedge6-20260913-0114-wdog-4860fef8.jsonl(.gz)`.
+- **01:17:35 ET — standing order executed: flashed `394dee45`** (bootloader route, Studio released the port;
+  HalfKay immediate; CDC back in ~1 s). Identity: 0xCB `394dee45 2x10 2026-09-13 feat/telemetry-ring-2x10`, flags
+  0x1C (telemetry + crashreport + **freerun**, clean). HEALTH v5, wdog armed + HW enabled.
+- **01:19 ET — flash gate: starve test passed.** `SET_TELEMETRY 0x31` → reset after ~3.8 s (host-observed) →
+  reconnect → HEALTH: watchdog reset, PC 0x634c = `CommandProcessor::serviceDisplay()`, LR = `loop`. Ring boot
+  records (drained by the poller into the still-open bridge file): `boot 128`, **kind 8 `wdog_context` code 0xE9
+  arg 0** (thread mode preempted, FP state stacked, no ISR active — exactly the expected starve signature), kind 9
+  `prev_isr_count` for usb only (display was off, so no refresh/PIT entries). The expanded capture completes inside
+  the pre-reset window (context line AND counts valid).
+- **01:20:08 ET — soak restarted on `394dee45`**, 200 Hz + jumps, 6.6 h (to ~07:56), halt-first / reset-continue
+  ×3, protocol `soak_mode3_card.yaml` unchanged, frames re-patch hook alive. A PIT storm on this build would read
+  kind 8 `code 0xF1/0xE1, IPSR 138, prior isr 7` with the PIT count ≫ refresh count.
+
+- **2026-09-13 07:58 ET — morning summary (soak still running, iteration 20 on `394dee45`).**
+  Exposure in the 200 Hz + jumps block: baseline `4860fef8` 1.96 h streaming, 1.42 M 0x70s, **2 wedges** (#5 at
+  909 s of its run, #6 at 1022 s); fix build `394dee45` 6.53 h, 4.41 M 0x70s, **0 wedges**, 19/19 runs completed
+  (P ≈ 0.002 for zero events at the baseline's rate). Full table: `mode3-wedge-night2-scan-2026-09-13.md`.
+  Display: 34–45 → 73–75 distinct frames/s at 190 commands/s (145 distinct requests/s), same SD/SPI timings; host
+  RTT median 2 → 3 ms, p99 8–9 → 11 ms (more transfers competing in `loop()`). No kind 8/9 records on the fix build
+  (no watchdog reset). fw #50 comment drafted (session scratchpad `fw50-comment-draft.md`) — outward-facing, for
+  Michael's review. Next on the bench (Michael's call): the 10-minute `end()`/`begin()` stress reproducer on the
+  stock core, then the PJRC report; the "mechanism arm" night is optional now that two captures sit inside the race
+  window and the fix build is clean.
+
+- **2026-09-13 08:58–09:12 ET — MECHANISM REPRODUCED on the bench (stand-alone sketch, no arena code).**
+  `tools/pit-race-repro/` in the firmware repo (commit `3ae478d`): one `IntervalTimer` at 10 kHz, loop =
+  `begin()` → cycle-accurate wait that sweeps `end()` across the expiry (±2 µs) → `end()`. **Stock core: main
+  loop dead within 0.5 s** (no heartbeat, status unanswered, USB still enumerated, 134-baud reboot works — the
+  storm leaves the USB ISR alive exactly as on the arena). **PIT-masked `end()`: 5.92 M cycles / 2.72 M expiries
+  in 10 min, no stall.** A first attempt with a tight `end(); begin()` loop (no wait) ran 53 M cycles with ZERO
+  timer expiries — `begin()` restarts the period every iteration, which is the display-starvation effect in
+  pure form. Soak was stopped at the iteration-2 boundary (3 clean runs, 0 faults) and restarted 09:12 on
+  `394dee45` after re-flashing (4 h). fw #50 comment draft updated with the reproducer; PJRC report ready to
+  write (fix = acknowledge `TFLG` in `pit_isr()` regardless of the callback, and/or disable the channel before
+  nulling the callback).
+
+- **2026-09-13 09:40 ET — soak wound down (operator stop; iteration 2 of the third soak aborted).** Fix build
+  `394dee45` totals: 24 runs, 5.15 M 0x70s, ~7.7 h streaming, 0 wedges. Codex review of the findings/fix/upstream
+  note reconciled (`mode3-wedge-upstream-note-2026-09-13.md` — baseline restated to the 200 Hz block, conditional
+  3 % instead of P ≈ 0.0007, invariant-framed upstream fix); final texts await Michael. Handover for the
+  performance session: `mode3-perf-handover-2026-09-13.md`. Controller left on `394dee45`, Studio connected idle.
+
+## 11. T4 as built (2026-09-12) — soak with ring-buffer logging
+
+Decision (Michael, 11:30 ET): skip the instrument-dependent T2/T3 for now; build the ring (T1
+scope) and run the soak on it (T4). Host side landed in PR #198; firmware on
+`feat/telemetry-ring-2x10` (built off `feat/controller-health-2x10`).
+
+- **Ring** (firmware): 64 KiB byte ring at OCRAM `0x2026F000`, below the breadcrumb, NOT in any
+  linker section → **survives SYSTEM_RESET and the bootloader reboot** (init only when the header
+  magic/checksum is invalid, i.e. after power-on). Records `len,type,seq u32,t_us u32,payload`:
+  `CMD` (cmd, status, ≤8 request bytes), `FRAME` (idx, pattern, sd_load_us, spi_us — on index
+  change), `STATE` (boot, state_change, error_glyph, sd_slow >20 ms, ring_overrun, telemetry,
+  sd_open). Newest dropped when full (counted). Opcodes 0xA8 SET_TELEMETRY (events default ON),
+  0xA9 GET_TELEMETRY_BLOCK — 18 B header `{t_now_us, first_seq, n_records, dropped, more, flags,
+  boot_count}` + whole records ≤ 180 B; **ack cursor**: records are freed only by the NEXT
+  request's ack_seq, so a lost reply is re-asked, never lost (framing "A", one framed reply).
+- **Host**: `js/arena-telemetry.js` (`parseBlock`, `toRows`, `createDrainer` with seq/gap/drop
+  accounting, `createPoller` single-flight), `Studio.initTelemetry()` on every link-up (gated on
+  the `health` capability + a SET_TELEMETRY ack), 10 Hz drain while connected (pauses during the
+  post-mortem), rows via `bridge.logRows()` → bridge 3.1 writes `["cc"|"cf"|"cs", rx, t_us, seq,
+  …]` verbatim; one `stream_schema` event per log. `Studio.drainTelemetry()` = drain-all crash
+  dump, wired into the post-mortem's `afterReconnect`. `wedge-scan.py` gains `ctl recs`, `sd max
+  us`, `ctl states`, `ctl rejects` and prints the last 40 controller records before a wedge under
+  `--verbose`.
+- **Cost**: ~2.6 KB/s of records in Mode 3 at 100 Hz (CMD 1.6 KB/s + FRAME ~1 KB/s) → ~2 framed
+  chunks per 100 ms poll; recording a record is a few dozen cycles at the choke points.
+- **Deferred**: TICK/analog yoking (needs F1/F2 + AD3), T2/T3 (instruments), clock fit (§ 8) —
+  rows carry raw `t_us` + host `rx`; the fit is an analysis step.
diff --git a/docs/development/mode3-wedge-status-2026-09-12.md b/docs/development/mode3-wedge-status-2026-09-12.md
new file mode 100644
index 00000000..b406fc21
--- /dev/null
+++ b/docs/development/mode3-wedge-status-2026-09-12.md
@@ -0,0 +1,86 @@
+# Mode-3 wedge (fw #50) — status, results, and plan for continued testing
+
+**Date:** 2026-09-12 12:00 ET. **Author:** Michael + Claude. **For review:** what has changed since
+the approved plan (`~/.claude/plans/let-s-please-combine-the-composed-scroll.md`, reviewed by Codex
+2026-09-11), what the first bench day produced, and what we intend to do next. Companion docs:
+`mode3-wedge-soak-plan.md` (findings, campaign spec, bench log § 10, T4 design § 11),
+`controller-telemetry-ring-buffer-proposal.md` (the original ring design, PR #192).
+
+## 1. What the original plan said, and what happened to it
+
+| Plan item | Status |
+|---|---|
+| Fail closed on repeated 0x70 timeouts, CONTROLLER_FAULT outcome, faulted runs commit | **Shipped** (Studio v0.76, PR #198). Bench: a wedge stopped the run within 1.5 s. Gap found on the bench: controller REJECTS (status 1) were not counted; fixed the same morning. |
+| Post-mortem probes (quiet → confirm → 60 s window → policy) | **Shipped**, exercised on the real wedge: all probes silent. |
+| `ArenaLink.reconnect()` from granted ports | **Shipped**, worked on hardware 4× (same port and after re-enumeration, 6–8 ms). |
+| Studio soak driver, halt-first | **Shipped**. Harness bugs found and fixed live: protocol's `fictrac.disconnect` killed the logger; remembered v1 log level overrode the soak; stop reason misreported; soak restart needed the bridge reconnected. |
+| `wedge-scan.py` analyzer | **Shipped**; found a 6th, earlier occurrence (rig2, 2026-07-11) in the course repo; reproduced the issue's control-run numbers exactly. |
+| Firmware GET_HEALTH + reset-surviving breadcrumb | **Shipped** (PR #53), flashed, verified: counters live, breadcrumb survives SYSTEM_RESET **and** the bootloader reboot. |
+| Firmware frame-cache candidate | **Held** (Codex: don't alter the suspected access pattern before a baseline). Baseline now exists. |
+| Self-healing runner | **Issues only** (#197, LAB-212) as planned. |
+| Ring buffer (T1–T6) | Was "unchanged, later". **Now being built** (T1 scope) because Michael wants the performance/ring concept validated in parallel, and because a ring in reboot-surviving RAM is a crash dump for the wedge. T2/T3 skipped (need AD3/Saleae, Michael unavailable for several days). **T4 = soak on ring firmware** is the next bench step. |
+| Pyserial soak driver | **Shipped** (`scripts/soak_mode3.py`, dry-run tested), **not yet run on hardware** (one controller; Studio arm first). |
+| New since the plan: firmware build identity | **Shipped** both sides (GET_FIRMWARE_VERSION 0xCB; `run_metadata.firmware`), flashed, verified in a live log. Permanent feature per Michael. |
+
+## 2. Bench results (one controller, CSHL 2×10, simulator at 100 Hz, Studio soak)
+
+- **Night 1 (course firmware, unidentified build):** smoke + 3 clean 20-min iterations, then a **wedge at 187.8 s into iteration 4** (frame 78 of the 200-frame pattern; 18,128 clean commands before it). ≈ 374k good 0x70s over ~70 min of streaming before failure.
+- **The wedged controller was silent, not slow:** zero bytes to Chrome probes at 5/10/20 s, to a closed-and-reopened port, and to **pyserial outside Chrome**. USB stayed enumerated; the display held its last frame. **0x01 SYSTEM_RESET got no ack** (parser lives in the stuck `loop()`); only a power cycle recovered it. ⇒ the browser is **not needed to observe** the wedged state (pyserial saw the same silence), so "Chrome can't receive replies" is out — but whether browser traffic *triggers* the state is untested until the pyserial soak arm runs from a clean boot; the fault looks like `loop()` stopped (an unbounded spin), not a slow path.
+- **Two mistakes on our side:** (a) Claude flashed fw #53 without a human at the bench; the 134-baud reboot put the Teensy into HalfKay **without an HID interface attaching on macOS 26**, so no loader could see it and the arena was offline until Michael pressed the button in the morning. The same path worked twice later that morning — intermittent, cause unknown. (b) fw #53 targets `main`, which is compiled for **4×10**; on the 2×10 card every trial failed (`CE_ARENA_MISMATCH`). Fixed by cherry-picking onto `arena-2x10-local` (`feat/controller-health-2x10`).
+- **Day 2 (health firmware 22b756dd, 2×10):** **12 clean iterations, ~1.45 M frame commands, 07:05–11:16, no fault**; now continuing on the build-identity firmware. Health counters showed a **129 ms** worst SD frame read during clean runs (RTT median 2 ms, p99 4 ms) — a rare slow SD tail exists.
+- **Recovery primitive confirmed:** 134-baud reboot → HalfKay → `teensy_loader_cli -b` (boot-only) restarts the program in ~5 s **and the breadcrumb/OCRAM survive it**. This is what LAB-212 should use; 0x01 cannot work on a stuck loop.
+- Two host-side findings for #199 / future: one out-of-range 0x70 per trial whose frame count differs (bridge cfg race); the Studio tab was in the background during the wedge (timer throttling explains 1 s-aligned timeout durations; not causal).
+
+## 3. Current hypotheses
+
+| # | Mechanism | Status after night 1 |
+|---|---|---|
+| H1 | SDIO polled-busy latch / SD path stall (unbounded `SDHC_PRSSTAT_BREN` spin, 1 s busy timeouts) | Alive. The 129 ms SD read tail is consistent; a stuck spin explains total silence. |
+| H2 | USB-CDC reply path / loop stall elsewhere (`transferPanelSet` spin on `dmaComplete_`, `usb_serial_write` TX timeout) | Alive. Total silence fits a stuck loop anywhere. |
+| H3 | Host/Chrome | **Narrowed**: not needed to *observe* the wedge (pyserial saw the same silence). Not excluded as a *trigger* — needs the pyserial soak arm from a clean boot. |
+| H4 (new) | Something about the health firmware or its base changed the odds (12 clean iterations vs a wedge in 4) | Cannot be separated yet: the pre-flash build is unidentified, and 12 iterations is within Isabel's ~1-in-10-experiments rate. Needs a stock `arena-2x10-local` control soak. |
+
+The discriminator we now have and did not before: **the breadcrumb + ring after a bootloader reboot** — which op the loop was inside (SD read / SPI transfer / USB write / command) and the last seconds of records.
+
+## 4. Plan for continued testing (next 3–5 days)
+
+1. **Now:** soak continues on `22b756dd` (health + version). At the next wedge: probes → 134-baud reboot → `-b` → reconnect → GET_HEALTH (`prev_breadcrumb`, `prev_slow_op`) → report.
+2. **When the ring firmware lands (today):** flash at the next iteration boundary; **T4** = the same soak with the 10 Hz ring drain (rows `cc`/`cf`/`cs` into the run log); at the next wedge the post-reboot drain is the crash dump. Also gives the first per-frame SD-load and SPI-time distributions (performance data the ring was for).
+3. **T1 retained in reduced form** (Codex: T4 validates one operating point, not capacity): the firmware gets a synthetic producer (SET_TELEMETRY flag bit7 + rate) so a 30-min drain test at 5 / 12.6 / 50 KB/s, foreground and background tab, pyserial vs Chrome, can run in a soak break. T4's drainer stats (bytes/s, chunks/poll, gaps, drops, `notStored`) are logged but labelled events-only workload validation.
+4. **Control arms, TIME-BOXED (Codex):** instrumented soaking gets at most **2 nights or 40 iterations, whichever first**, then one night on **stock `arena-2x10-local`** (no health/ring code; build SHA recorded externally since it has no 0xCB) and one night of the **pyserial driver** from a clean boot (removes the browser as a *trigger*). Compare **exposure** (streaming hours, delivered 0x70 count, matched protocol/card/rate), not iteration counts; report censored clean exposure. Then alternate arms. A control is run whether or not another instrumented wedge has occurred.
+5. **Firmware fix candidates only after a breadcrumb/ring readout points at a spin:** bound the `dmaComplete_` and `SDHC_PRSSTAT_BREN` waits (timeout → STATE record + error glyph instead of a hang), SD re-init path, then the frame cache. A hardware watchdog (WDOG) that resets into a state the ring survives is the on-device complement to the host bootloader route.
+6. **Get the five reported wire logs** off bench03/rig03-sr; run `wedge-scan.py` on them.
+7. **Not now:** T2/T3 (instruments), TICK/analog yoking, clock fit, self-healing runner (LAB-212) — the latter waits for the recovery primitive to be exercised on a real wedge.
+
+## 4b. Manual capture procedure at the next wedge (until self-healing exists)
+
+Evidence first, SD last. Someone at the keyboard (not necessarily at the bench):
+1. Let the Studio post-mortem finish its 60 s probe window (all timeouts expected) — do NOT power-cycle.
+2. Release the port (Studio Disconnect). From the shell: open the port at 134 baud (`serial.Serial(port,134)`; close) → wait 4 s → check HalfKay HID is present (`ioreg -c IOHIDDevice | grep 5824`). **No HID within 20 s ⇒ stop; leave it for a human; do not power-cycle (RAM evidence).**
+3. `teensy_loader_cli --mcu=TEENSY41 -b -v` (boot-only) → CDC back within ~15 s.
+4. Studio `reconnect()` (granted port) → identity (0xC2 MAC must match) → **GET_HEALTH first** (prev breadcrumb + slowest op) → **ring drain** (`Studio.drainTelemetry('post-reboot')`, raw blocks kept in the `telemetry_dump` event) → only then any SD-touching probe or a new trial.
+5. Archive the log file + the exact firmware SHA before restarting the soak.
+A hang that stops USB interrupt handling defeats step 2 (the 134-baud reboot runs from the USB ISR); then it is the button, and the evidence is gone — the case for an on-device hardware watchdog that the ring survives.
+
+## 4c. Pre-T4 evidence gate (Codex): what must be true before T4 results count
+- Ring memory reserved or heap-guarded at runtime (`__brkval` check; ring disabled + flagged on collision).
+- Record-then-header commit ordering with per-append cache flush; interrupted-write test (reset mid-append, then drain).
+- FRAME SD duration is u32 (the 129 ms tail must be representable).
+- Ack advances only after the bridge accepted the rows (`logRows` false ⇒ withhold); bridge ≥ 3.1 on every bench.
+- A recovered-dump fixture: pre-wedge records arriving after the boot record are attributed to the previous boot (`wedge-scan --verbose` prints them per boot).
+- Drain budget under background-tab throttling ≥ production rate (40 chunks/poll ≈ 7 KB/poll).
+
+## 5. Questions for the reviewer
+
+- Is running the soak on instrumented firmware (health + ring) before a stock control night the wrong order, given the evidence-first priority?
+- Is the reboot-surviving ring at a fixed OCRAM address (below the breadcrumb, outside every linker section, heap growing toward it) an acceptable risk for a diagnostic build? What would you require before it ships to course controllers?
+- The 12-clean-iterations observation: what would make it evidence rather than noise?
+- Anything in the recovery route (134-baud → HalfKay → boot-only) that makes it unsuitable as the self-healing primitive on Windows lab PCs?
+
+## 6. Review outcome (2026-09-12 12:00 ET)
+
+Both Codex passes (status/plan + branch diff) are reconciled in `.codex-review/report-20260912-status.md`: what was verified and fixed on the branch, what was accepted into this plan (§4.3 T1, §4.4 time-box, §4b capture procedure, §4c gate), what was deferred (write-timeout transport generation; session-owned run lifecycle → LAB-212) and the one rejection (opt-in telemetry sidecar — both readers now skip tagged rows, tested). The ring firmware is `ac4c08f` on `feat/telemetry-ring-2x10`; the host gates SET_TELEMETRY on its 0xCB flag bit 2, so the health-only build running tonight is never sent 0xA8.
+
+**12:20 ET addendum:** the ring firmware code itself was then Codex-reviewed (`LED-Display_G6_Firmware_Arena-ring/.codex-review/report-20260912-ring.md`). Flash is go after the bounded fix commit (reference-drainer handshake, HIL test corrections, ack/incarnation guard, heap guard coverage, exact-size boot repair); dual headers / linker reservation / PSRAM frame identity are deferred to the ship-to-course gate.
+
+**Tracking (12:35 ET):** deferred web items → #200; deferred firmware ring hardening → fw #54. Reconciliation reports committed as `docs/development/codex-review-2026-09-12-mode3-wedge.md` (this repo) and `docs/development/codex-review-2026-09-12-telemetry-ring.md` (ring branch).
diff --git a/docs/development/mode3-wedge-upstream-note-2026-09-13.md b/docs/development/mode3-wedge-upstream-note-2026-09-13.md
new file mode 100644
index 00000000..48689655
--- /dev/null
+++ b/docs/development/mode3-wedge-upstream-note-2026-09-13.md
@@ -0,0 +1,166 @@
+# fw #50 — findings, fix, and upstream note (for Codex review before posting)
+
+**Date:** 2026-09-13 09:30 ET. **Status:** REVIEWED (Codex run `codex-plan-review-20260913-093121-1139`, reconciliation below) — final texts ready for Michael: (A) the comment on reiserlab/LED-Display_G6_Firmware_Arena#50, (B) the upstream bug report to
+PJRC (PaulStoffregen/cores). Reviewers should attack the correctness of the mechanism claim, the evidence chain,
+the fix, the statistics, and anything in the upstream note that a core maintainer would push back on.
+
+Supporting material: `mode3-wedge-evidence-2026-09-13.md` (§2b/§2c), `codex-review-2026-09-13-mode3-wedge-fix.md`
+(four prior Codex passes), `mode3-wedge-night2-scan-2026-09-13.md` (per-run table), firmware
+`tools/pit-race-repro/` (reproducer, commit `3ae478d` on `feat/telemetry-ring-2x10`), fix build `394dee45`.
+
+## Facts the texts rest on
+
+- Installed core: `framework-arduinoteensy` 1.160.0, `cores/teensy4/IntervalTimer.cpp`. `end()`:
+  `funct_table[index] = nullptr; channel->TCTRL = 0; channel->TFLG = 1; …`. `pit_isr()`:
+  `if (funct_table[0] != nullptr && channel->TFLG) { channel->TFLG = 1; funct_table[0](); }` (×4 channels).
+  Upstream master has the same ordering (checked 2026-09-13 against the raw GitHub file).
+- Watchdog captures on the baseline build `4860fef8` (RTWDOG pre-reset IRQ, priority 0, stacked frame read from
+  MSP): wedge #5 PC `0x212f4`, wedge #6 PC `0x212f2`, both LR `0x212eb`, both with breadcrumb
+  `cmd_disarm_timer`/0x70 and ISR marker "watchdog". Disassembly of the running ELF: `212f0 str` (callback
+  nulled), `212f2 ldr` (channel pointer), `212f4 str` (TCTRL = 0), `212f6 str` (TFLG = 1).
+- NVIC priorities in the firmware: PIT 128 (IRQ 122), USB1 128 (IRQ 113), SDHC1 96, ENET 64, RTWDOG 0. Equal
+  priority → lower exception number wins the tie-break (Cortex-M NVIC exception-priority rule), so USB is serviced between storm
+  iterations; SDHC preempts outright.
+- Exposure in the 200 Hz + 90° jumps block only (same protocol, same simulator seed; the 23:14–23:36 run at
+  286 Hz is excluded): baseline `4860fef8` **1.09 M** SET_FRAME_POSITION / 1.73 h streaming / 2 wedges (7 runs:
+  4 completed, 2 wedged, 1 host-side transient); fix `394dee45` 5.11 M / 7.57 h / 0 wedges (22 completed runs,
+  one operator abort for the bench test, one in progress at 09:30). The baseline's 286 Hz run (329 k, no wedge)
+  is additional clean baseline exposure at a different rate and is left out of the comparison.
+- Reproducer (`tools/pit-race-repro/`): IntervalTimer at 10 kHz, loop = `begin()` → cycle-accurate wait that
+  sweeps `end()` across the expiry (period ± 2 µs, one cycle step per iteration) → `end()`. Stock: no heartbeat
+  after the first command, status request unanswered, USB still enumerated, 134-baud bootloader reboot works.
+  PIT-masked `end()`: 5.92 M cycles / 2.72 M expiries / 10 min, no stall. Tight `end(); begin()` loop without
+  the wait: 53 M cycles, 0 expiries (period restarted each iteration), no storm.
+- Display side effect at 190 commands/s (145 distinct-frame requests/s): distinct frames reaching the panels
+  34–45/s (baseline) → 73–75/s (fix). SD load and SPI transfer times unchanged. Host RTT median 2 → 3 ms.
+
+## Reconciliation of the Codex review (09:34 ET)
+
+| # | Finding | Verdict | Applied |
+|---|---|---|---|
+| U1 | The "same-rate" baseline exposure included the 23:14 run at 286 Hz (329 k commands). | **VERIFIED** | Baseline restated as the 200 Hz block only: 1.09 M / 1.73 h / 2 wedges. |
+| U2 | `P ≈ 0.0007` treats a rate estimated from two events as known; the exact conditional comparison is `(E_b/(E_b+E_f))²`. | **VERIFIED** | Now: "if both builds had the same rate, the chance that both wedges fall in the baseline block is ≈ 3 %"; plus the 95 % upper bound on the fix build (≈ 0.4/h, 0.6 per million commands). |
+| U3 | "Either fix suffices / both is safest" over-claims: `inplace_function` destroys the callable before marking it empty, so an interrupt during teardown can call a callable being destroyed; disable-first also needs a barrier before the callback teardown. | **VERIFIED** | Upstream note now states the invariant and proposes: disable + acknowledge + barrier BEFORE touching the callback, AND unconditional acknowledge in the ISR; presented as candidates the reproducer has not tested individually. |
+| U4 | Wording: "0x70 never touches the PIT"; FRAME counts are controller-recorded SPI frame changes, not optical output. | **VERIFIED** (repeat of an earlier finding) | Both texts corrected. |
+| U5 | The two PCs "match the window" — not exclusive proof; the baseline captures lack context fields; the 11 ns is an inferred effective window under a uniform-phase assumption the baseline (timer restarted per command) violates. Remove "no other candidate predicts the rate". | **VERIFIED** | Rewritten: PCs match the window; the stand-alone reproduction is the mechanism evidence; 11 ns marked as an order-of-magnitude consistency check. |
+| U6 | Double-entry (`pit_irq ≈ 2 × ticks`) causal explanation untested. | **ACCEPTED** | Dropped from the upstream note; kept in the reproducer README as an unexplained observation. |
+| U7 | The NVIC guard re-enables `IRQ_PIT` unconditionally; preserve the entry enable state. | **ACCEPTED** (fw follow-up) | Recorded for the close-out commit (`NVIC_IS_ENABLED` before, restore after). Single PIT owner today. |
+| U8 | Provenance for upstream: pin the platform, give core/compiler versions, build command, transcripts. | **VERIFIED** | Reproducer `platformio.ini` pinned to `teensy@5.1.0`; versions in the note (framework-arduinoteensy 1.160.0, toolchain 1.110301.0 = GCC 11.3.1, PlatformIO platform teensy 5.1.0). Transcripts in the README. |
+| U9 | "Pinned core" claim — `platformio.ini` of the firmware is not pinned. | **VERIFIED** | Wording changed; pinning added to the handover list. |
+| U10 | (Adversarial) Wedge-free operation and more distinct frames do not validate presentation timing (request-to-presentation latency, superseded requests, stale-display policy when input stops). | **ACCEPTED** | One sentence added to the #50 comment; the whole topic is the next session's brief (handover doc). |
+| U11 | (Adversarial) Reproducer tests the workaround, not the two upstream patches; lifecycle tests (4 channels, destruction, pending IRQ, disabled IRQ) missing. | **ACCEPTED** (deferred) | Upstream note says so explicitly; fw #54 test list. |
+
+## (A) FINAL — comment on fw #50
+
+> ## Night 2 (2026-09-12/13): mechanism identified and reproduced — `IntervalTimer::end()` race in the Teensy core
+>
+> **Two watchdog captures inside a two-instruction window.** With the RTWDOG diagnostic build (`4860fef8`) the
+> controller resets itself ~2 s into a wedge and saves the interrupted PC. Wedge #5 (23:51) returned to `0x212f4`,
+> wedge #6 (01:14) to `0x212f2`. In `IntervalTimer::end()`:
+>
+> ```
+> 212f0  str r3,[r6,r5]   ; funct_table[index] = nullptr
+> 212f2  ldr r3,[r7]      ; load channel                 <- wedge #6
+> 212f4  str r1,[r3,#8]   ; channel->TCTRL = 0           <- wedge #5
+> 212f6  str r2,[r3,#12]  ; channel->TFLG = 1
+> ```
+>
+> Both addresses sit between "callback removed" and "channel disabled" — exactly where an interrupt taken inside
+> the race window would leave the thread's return address (the second one is a plain RAM load, so no peripheral
+> access was in flight). The captures match the mechanism; the stand-alone reproduction below is what establishes it.
+>
+> **The race (`cores/teensy4/IntervalTimer.cpp`, framework-arduinoteensy 1.160.0, same ordering on upstream
+> master):** `end()` nulls the callback *before* disabling the channel, and `pit_isr()` acknowledges a channel's
+> `TFLG` *only when its callback is non-null*. If the timer expires in that window the ISR runs with a null
+> callback, never clears the flag, and re-enters forever at priority 128. Thread mode (`loop()`) never runs again.
+> USB (priority 128; the lower exception number is taken first between equal priorities) and SDHC (96) are still
+> serviced — which is why the controller stays enumerated, the 134-baud bootloader trick works, and host writes
+> stall only once the CDC receive buffers fill. `handleSetFramePosition` called `disarmRefreshTimer()` → `end()` on
+> every 0x70, 100–286×/s, against a refresh timer with a 3.3 ms period.
+>
+> **Order-of-magnitude check:** this issue's ~292 k commands per failure corresponds to an effective window of
+> ≈ 11 ns per disarm at a 3.33 ms period — one or two instruction boundaries — under a uniform-phase assumption
+> (the baseline restarted the timer on every command, so the true phase distribution depends on command spacing).
+>
+> **Reproduced stand-alone** (`tools/pit-race-repro/`, no arena code, Teensy 4.1 @ 600 MHz): one IntervalTimer at
+> 10 kHz and a loop that sweeps `end()` across the expiry. Stock core: `loop()` dead within 0.5 s, USB still
+> enumerated, bootloader reboot works. Same loop with `IRQ_PIT` masked around `end()`: 5.9 M cycles / 2.7 M
+> expiries in 10 min, no stall. A tight `end(); begin()` loop without the wait never fails — it restarts the period
+> every iteration and the timer never expires, which is the same starvation that capped our display rate.
+>
+> **Fix build `394dee45`** (`feat/telemetry-ring-2x10`): (1) free-running refresh timer — a successful steady-state
+> 0x70 at an unchanged refresh rate leaves the PIT running (the timer is armed on SHOW_FRAME entry and on rate
+> changes; error paths and transitions still touch it); (2) every remaining `disarmRefreshTimer()` masks only
+> `IRQ_PIT` at the NVIC around `end()`, so a pended tick runs afterwards against an already-cleared flag;
+> (3) diagnostics: PIT-interrupt trampoline + per-ISR counts, and the watchdog records which execution context it
+> preempted (stacked IPSR + EXC_RETURN).
+>
+> **Result (200 Hz + 90° jumps, same protocol and simulator seed):** baseline `4860fef8` — 2 wedges in 1.09 M
+> commands (1.73 h). Fix build — **0 wedges in 5.11 M commands (7.6 h, 22 clean runs)**. If both builds had the
+> same failure rate, the chance that both wedges fall in the baseline block is about 3 %; the 95 % upper bound on
+> the fix build's rate is ≈ 0.6 per million commands (≈ 0.4/h) versus the baseline's observed 1.8 per million.
+> Side effect: controller-recorded distinct frames transmitted to the panels at 190 commands/s rose from 34–45/s to
+> 73–75/s (the per-command timer restart was starving the display). This says nothing yet about
+> request-to-presentation latency or which requests get superseded — that is the next piece of work.
+>
+> **Two separate things.** The per-command disarm/re-arm was unnecessary on our side (the refresh ISR only sets a
+> flag; frame load and panel transfer are serialized in `loop()`), so it is removed regardless of the core. The
+> core's `end()` remains unsafe for anyone who stops a running IntervalTimer; the NVIC guard stays in our firmware
+> until the core version we build against carries a fix. Upstream report: PaulStoffregen/cores (link to follow).
+
+## (B) FINAL — upstream report (PaulStoffregen/cores) — **HELD for Frank's review** (Michael, 09:55 ET); (A) posted as https://github.com/reiserlab/LED-Display_G6_Firmware_Arena/issues/50#issuecomment-5653672436
+
+> **Title:** Teensy 4: `IntervalTimer::end()` can leave the PIT interrupt permanently asserted (null-callback path
+> in `pit_isr`) — thread mode never runs again
+>
+> **Versions:** PlatformIO platform `teensy@5.1.0`, `framework-arduinoteensy` 1.160.0 (`cores/teensy4/IntervalTimer.cpp`;
+> the same ordering is in current master), toolchain GCC 11.3.1 (`toolchain-gccarmnoneeabi-teensy` 1.110301.0),
+> Teensy 4.1 at 600 MHz, default build flags.
+>
+> **The sequence.** `IntervalTimer::end()` removes the callback before it disables the channel:
+>
+> ```c
+> funct_table[index] = nullptr;
+> channel->TCTRL = 0;
+> channel->TFLG = 1;
+> ```
+>
+> and `pit_isr()` acknowledges a channel's flag only when its callback is present:
+>
+> ```c
+> if (funct_table[0] != nullptr && channel->TFLG) { channel->TFLG = 1; funct_table[0](); }
+> ```
+>
+> If the timer expires between the first two stores, the ISR is entered with `funct_table[i] == nullptr`, skips
+> the acknowledge, returns, and is immediately re-entered because the PIT request is still asserted. Thread mode
+> never executes again. Interrupts of higher priority, or equal priority with a lower exception number (USB1 = 113
+> vs PIT = 122 at the default 128), keep running, so the board stays enumerated and looks alive.
+>
+> **Reproducer** (sketch attached; `pio run -e teensy41`; serial 115200; commands `u` stock / `g` guarded / `?`):
+> one IntervalTimer at 100 µs; `loop()` does `timer.begin(cb, 100)`, waits ≈ one period ± 2 µs with the cycle
+> counter (the offset sweeps one cycle per iteration so `end()` scans across the expiry), then `timer.end()`.
+> A heartbeat prints every 500 ms.
+>
+> - `u` (stock `end()`): no heartbeat after the command; `?` unanswered; USB still enumerated; a 134-baud
+>   bootloader reboot works. Dead within 0.5 s, repeatable.
+> - `g` (same loop, `NVIC_DISABLE_IRQ(IRQ_PIT); dsb; isb; timer.end(); dsb; NVIC_ENABLE_IRQ(IRQ_PIT);`):
+>   5.92 M cycles, 2.72 M expiries, 10 minutes, no stall.
+> - Control: a tight `end(); begin();` loop without the wait never fails (53 M cycles, 0 expiries) — `begin()`
+>   restarts the period before it can expire.
+>
+> **Field history:** an LED-display controller called `end()`/`begin()` on every incoming frame command
+> (100–286/s) against a 300 Hz timer and hung about once per 3 × 10⁵ calls; two hardware-watchdog PC captures
+> landed on the two instruction boundaries between the stores above.
+>
+> **Invariant the fix should establish:** an asserted channel flag must never become unserviceable because the
+> callback state changed. Two changes, which I have not tested individually in the core (the reproducer tests the
+> NVIC guard):
+>
+> 1. `pit_isr()`: acknowledge the flag regardless of the callback —
+>    `if (channel->TFLG) { channel->TFLG = 1; if (funct_table[i]) funct_table[i](); }`.
+> 2. `end()`: disable the channel and clear the flag first, add a barrier (or read `TFLG` back) so the peripheral
+>    writes complete, then release the callback. Note `funct_table` holds an `inplace_function`, whose null
+>    assignment destroys the stored callable before marking it empty — so the callback must not be reachable from
+>    the ISR while it is being torn down; masking `IRQ_PIT` for that step is the simplest guarantee.
+>
+> Happy to turn this into a PR against `teensy4/IntervalTimer.cpp` if useful.
diff --git a/docs/development/telemetry-performance-handover-2026-09-12.md b/docs/development/telemetry-performance-handover-2026-09-12.md
new file mode 100644
index 00000000..7b31a959
--- /dev/null
+++ b/docs/development/telemetry-performance-handover-2026-09-12.md
@@ -0,0 +1,181 @@
+# Handover — parallel session: what else to log, how useful the current logging is, and how to remove SD-read jitter and other slop
+
+**Written:** 2026-09-12 14:30 ET by the fw #50 soak session (Claude + Michael). **For:** a parallel
+planning session working in a git worktree. **Do not touch the bench:** a 10-hour soak (T4) is running
+on the only controller until ~23:40 ET; the Studio that drives it is served from the MAIN checkout at
+`http://localhost:8091` (Python `http.server`, pid 27488) and the bridge/simulator are live. Work in a
+**worktree on a new branch** (`git worktree add ../webDisplayTools-perf claude/telemetry-perf-plan`),
+never open a serial port, never flash, never restart the bridge or the server. Read-only access to the
+soak logs is fine (they are append-only NDJSON).
+
+## 1. What this session is asked to do
+
+1. **Assess the current logging plan.** Given what the ring + host now record (§4), what questions
+   can be answered from a night of logs, what cannot, and what is missing. Produce a metrics
+   specification: every performance quantity we care about, which rows it comes from, how it is
+   computed, and its expected healthy range.
+2. **What else could be logged**, at what cost (bytes/s, controller loop time, link occupancy), and
+   whether it belongs in the ring (controller side) or the host log. Candidates already discussed:
+   per-op SD timing beyond frame loads (`sd_open`, directory reads, `TRIAL_PARAMS` load), USB TX
+   timeouts, refresh-ISR overruns / dropped refreshes, loop period histogram, analog TICK yoking
+   (T3, needs analog firmware), FicTrac → bridge → browser hop times (bridge-side timestamps exist),
+   Chrome timer throttling markers, controller-side reply-send timestamp (to split RTT).
+3. **Performance metrics via logging.** Define the comparison protocol for telemetry-on vs -off
+   (alternating iterations; what is measurable in both arms — host RTT p50/p99, delivered 0x70 rate,
+   GET_HEALTH loop-max/sd-max at boundaries — vs only in the on arm — `sd_load_us`, `spi_us`), and
+   the Mode 2 (open loop) variant.
+4. **SD-card read jitter and other slop.** A ranked proposal, with firmware evidence (file:line), for
+   reducing the SD tail and the other latency/jitter sources in the Mode-3 chain (§6). Include what
+   each change would do to the wedge investigation (fw #50): a change to the SD access pattern must
+   not be flashed on the soak controller until a baseline wedge is captured on the ring firmware
+   (Michael's standing decision).
+5. Prototype **analysis scripts** in the worktree (`scripts/telemetry-report.py` or similar) that
+   turn a night of logs into the metrics in (1). Test against the files in §4. Standalone tests like
+   `tests/test-wedge-scan.py` (no pytest). The ad-hoc analyses in §5 are the seed.
+
+Deliverables: a plan doc under `docs/development/` (run it through the `codex-plan-review` skill with
+`CODEX_REVIEW_MODEL=gpt-6-astra`, independent analysis first, report back to Michael before revising),
+the metrics spec, the SD-jitter proposal, the script(s). Do not open PRs against `main` for the
+analysis code without Michael; the campaign branch (`claude/mode3-wedge-soak`, PR #198) is where the
+telemetry host code lives and is still moving.
+
+## 2. Repos, branches, worktrees
+
+| What | Where |
+|---|---|
+| Web tools (Studio, bridge, analyzer) | `/Users/reiserm/Documents/GitHub/webDisplayTools`, branch `claude/mode3-wedge-soak` (PR #198, tip `793cf15`). `main` is behind by the whole campaign. |
+| Firmware, running on the bench | worktree `/Users/reiserm/Documents/GitHub/LED-Display_G6_Firmware_Arena-ring`, branch `feat/telemetry-ring-2x10` (tip `64167f8`; flashed build `c47ee684`). Base chain: `arena-2x10-local` (2×10 geometry) → `feat/controller-health-2x10` (GET_HEALTH 0xCA, GET_FIRMWARE_VERSION 0xCB) → ring. **Firmware `main` is compiled for 4×10** and rejects every 2×10 pattern — branch off `arena-2x10-local`/the ring branch for anything meant for this bench. |
+| Other firmware worktrees | `…-health` (`feat/controller-health`, off `main`, PR #53), `…-health-2x10`. |
+| Rules | `webDisplayTools/CLAUDE.md` (Studio architecture, the fault lifecycle, telemetry ring rules, behavior_v2 readers, Prettier scope). Firmware README "Telemetry ring" section. |
+
+## 3. What has been built and why (compressed history)
+
+- **The bug:** fw #50 — during Mode-3 host-stepped streaming (SET_FRAME_POSITION 0x70 at 100–286 Hz)
+  the controller goes silent until power cycle, ~1 in 10 experiments. Reproduced once on this bench
+  (2026-09-12 00:19 ET, course firmware, iteration 4, after 18k clean commands): total silence to any
+  host, 0x01 unanswered, display frozen. Hypotheses: H1 SDIO polled busy-wait latch, H2 USB/loop
+  stall; H3 host/Chrome narrowed (not needed to observe; not excluded as trigger); H4 instrumented
+  firmware changed the odds (needs a stock control night). Details: `mode3-wedge-soak-plan.md`
+  (§1–11, bench log §10), `mode3-wedge-status-2026-09-12.md`, fw #50 comments.
+- **Host (Studio v0.76, PR #198):** fail-closed fault detection (≥3 failed applies in 10 →
+  `CONTROLLER_FAULT`), post-mortem probes, `ArenaLink.reconnect()` from granted ports, soak driver
+  (`Studio.startSoak`, `?soak=1`), `scripts/wedge-scan.py` analyzer, controller-telemetry drainer
+  (`js/arena-telemetry.js`, 10 Hz, ack-cursor, "ack means stored"), build identity in every log
+  (`run_metadata.firmware`). Two Codex (gpt-6-astra) reviews reconciled: `codex-review-2026-09-12-mode3-wedge.md`.
+- **Firmware:** GET_HEALTH 0xCA (66 B: uptime, loop max, sd reads/max, frames, isr, cmd70 count,
+  state, reset cause, **reset-surviving breadcrumb** at OCRAM 0x2027FF40 + previous boot's slowest op);
+  GET_FIRMWARE_VERSION 0xCB (46 B, flags bit 2 = telemetry ring present); **telemetry ring** 64 KiB at
+  OCRAM 0x2026F000, survives SYSTEM_RESET and the bootloader reboot (verified today, both routes),
+  records CMD / FRAME / STATE, 0xA8 SET_TELEMETRY (bit 7 synthetic producer), 0xA9 GET_TELEMETRY_BLOCK
+  (18 B header + ≤178 B whole records, ack cursor). Review + deferred hardening:
+  `LED-Display_G6_Firmware_Arena-ring/docs/development/codex-review-2026-09-12-telemetry-ring.md`,
+  issue fw #54.
+- **Recovery route validated today:** 134-baud open → HalfKay → `teensy_loader_cli --mcu=TEENSY41 -b`
+  → CDC back in ~1 s, ring intact. 0x01 cannot recover a stuck `loop()`; the bootloader can (unless
+  USB interrupts are dead too). Self-healing runner = issues web #197 / LAB-212 (not built).
+
+## 4. The data: where, what, how to read it
+
+**Location:** `/Users/reiserm/Documents/GitHub/webDisplayTools/soak-logs/` (gitignored, ~450 MB,
+growing ~60 MB/h tonight). One file per soak iteration (`arena-log-YYYYMMDD-HHMMSS-mmm.jsonl`,
+bridge rotates on `log_control`). Also `bridge-stdout.log`, `sim-stdout.log`. Night-1 wedge file:
+`arena-log-20260912-001625-545.jsonl` (course firmware, no ring). Health-firmware clean iterations:
+files from 07:05–13:36 today (`22b756dd`, no ring rows). **Ring firmware (T4):** files from
+`arena-log-20260912-133850-123.jsonl` onward (~20 MB per 21-min iteration).
+
+**Format:** bridge `behavior_v2` NDJSON. Line types:
+
+| Line | Meaning |
+|---|---|
+| `{"type":"frame_schema","level":"behavior_v2","cols":[...],"t0":<ms>}` | first line; `t0` = wall-clock origin for `a` rows |
+| `[ms, fc, idx, ft, x, y, hd]` (numbers first) | FicTrac sample (simulator here; 100 Hz, `--seed 1`, random-walk heading) |
+| `["a", t_off, dt, hex, status, rx_off(, error)]` | host command echo: `t_off` ms since t0 at SEND, `dt` host-observed round trip incl. queue (monotonic clock), `hex` = request bytes (0x70 = `03 70 lo hi`), `status` reply status or null on timeout, `rx_off` bridge receipt. **Not** logged: the drainer's own 0xA9 requests (since 13:36). |
+| `["cc", rx, t_us, seq, cmd, status, req_hex]` | controller CMD record: `t_us` = controller `micros()` at dispatch entry (u32, wraps 71.6 min), `seq` global ring sequence, `req_hex` first ≤8 request bytes |
+| `["cf", rx, t_us, seq, idx, pattern, sd_load_us, spi_us]` | displayed-frame change: `t_us` = SPI transfer START (not display), `sd_load_us` = `SdManager::readFrame` duration (u32), `spi_us` = panel transfer |
+| `["cs", rx, t_us, seq, kind, code, arg]` | state: kinds 1 boot (code = reset cause & 0xFF, arg = prev breadcrumb op<<8 \| valid), 2 state_change (code = ArenaState, arg = pattern), 3 error_glyph (code = CE), 4 sd_slow (arg = µs/100, >20 ms), 5 ring_overrun (0 evicted / 0xFF heap collision), 6 telemetry (code = flags, arg = synthetic rate), 7 sd_open (code = CE, arg = pattern) |
+| `{"event":"run_metadata", ..., "firmware":"c47ee684 2x10 …", "telemetry":"ring-10hz"|"off", "soak":{...}}` | per run |
+| `{"event":"stream_schema","streams":{cc,cf,cs}}` | column names for the tagged rows |
+| `{"event":"runner","phase":...}` / `{"event":"soak","phase":"iteration-start|iteration-end|start|end", ...}` | run/soak lifecycle; `iteration-end` carries `applied_0x70`, `duration_s`, `telemetry` drainer stats |
+| `{"event":"probe"...}`, `{"event":"telemetry_dump", "summary", "raw_blocks":[hex]}` | post-mortem / reboot-test evidence |
+| `{"type":"log","event":"arena_command",...}` (207 B objects) | echoes that did not fit the compact form (request > 8 bytes, e.g. TRIAL_PARAMS) — verbatim v1 shape |
+
+**Readers:** `js/runlog-format.js` (`createNormalizer().normalize(rec)` turns `a` rows back into the
+v1 `arena_command` object; readers must skip string-tagged arrays other than `"a"`),
+`scripts/wedge-scan.py` (per-run table, `--json`, `--verbose` prints controller tails; `ctl recs`,
+`sd max us`, `ctl states`, `ctl rejects`, `fault-declared` outcome), firmware
+`tests/telemetry_codec.py` (byte-level decoder for `raw_blocks`). `rx` on tagged rows is the bridge
+receipt of the DRAIN, not of the event — order by `seq`, never by `rx` or `t_us` (a CMD's `t_us` is
+dispatch entry but it is appended after its handler's STATE records).
+
+**Clocks:** host `t0 + t_off` (ms, wall), bridge `rx` (ms, wall, same machine), controller `t_us`
+(µs since boot). Measured drift host↔controller −3 ppm; align by pairing `a` 0x70 rows with `cc` 0x70
+records **by request index in order** (counts differ by the in-flight ones; the pre-run backlog of
+~120 controller records has old `t_us`).
+
+## 5. Findings so far (numbers to reproduce, then extend)
+
+From T4 iteration 1 (`arena-log-20260912-131346-381.jsonl`, 1,238 s, 104,895 0x70s, 100 Hz):
+
+| Quantity | Value |
+|---|---|
+| Host RTT of 0x70 (`a.dt`) | median 2 ms, p99 7 ms, max 77 ms |
+| Controller dispatch → frame on SPI (`cc.t_us` → next `cf.t_us`) | median 4.7 ms, p99 5.8 ms, max 22.9 ms — the display lags the reply by ~2.7 ms (waits for a transfer slot) |
+| `sd_load_us` | median 1.21 ms, p99 2.3 ms, p99.9 3.4 ms, **max 19.4 ms** |
+| `spi_us` | 766 µs, flat (2×10) |
+| GET_HEALTH slowest op of that boot | op 1, **70.6 ms** — NOT a frame load (cf max 19 ms) ⇒ another SD op (pattern open at trial start? `sd_open` records) — first thing to pin down |
+| Health build (22b756dd), earlier today | worst SD read 129 ms during clean runs |
+| Ring production | ~2.9 KB/s at 100 Hz Mode 3 (CMD 16 B + FRAME 20 B per frame); drain ~2 chunks per 100 ms poll; 0 dropped, 0 gaps over 178k records |
+| File | 19.8 KiB/s before the silent-0xA9 fix (73 MB/h), ~14 KiB/s after; gzip 4.5×; ring rows ≈ 38 % of bytes; FicTrac rows 27 %; host echoes 15 % |
+| CMD 0x70 count controller vs host | equal (±2 in flight); FRAME idx == last request 16,562/16,564 |
+
+Ad-hoc analysis code used today lives only in this session's transcript; re-derive: (a) pair `a`
+0x70 rows with `cc` 0x70 records by order after dropping the pre-run backlog (records whose
+`rx − t_us/1000` offset differs from the run's by > 2 s); (b) fit `t_host = a + b·t_us` (slope → drift,
+residual → jitter); (c) `cc→cf` when `cf.seq == cc.seq + 1`; (d) file composition by first element.
+
+## 6. SD-read jitter and other slop — what is known, where to look
+
+Firmware facts (ring worktree; line numbers drift, grep):
+- `CommandProcessor::handleSetFramePosition` (~:1073): `disarmRefreshTimer()` → `loadFrame()` →
+  `armRefreshTimer()` → `sendResponse`. **`loadFrame` = uncached SD seek + reads on every 0x70**, even
+  a repeated index (`SdManager::readFrame` :316). The FRAME record wraps exactly this call.
+- SD is `SD.begin(BUILTIN_SDCARD)` = SdFat `SdioConfig(FIFO_SDIO)`: **polled**, persistent CMD18
+  multi-block read; every non-sequential sector does `syncDevice()` (CMD12) + `readStart()`, each gated
+  by `BUSY_TIMEOUT_MICROS = 1 000 000` and an **unbounded** spin on `SDHC_PRSSTAT_BREN`. Mode-3
+  random access hits this path every command; Mode-2 sequential playback stays on the fast path.
+  Candidate H1 for the wedge; also the most likely source of the 3–20 ms `sd_load` tail and the 70–129
+  ms "slowest op".
+- `transferPanelSet` spins unbounded on `dmaComplete_` (`SpiManager.cpp` ~:117); `spi_us` is flat
+  today, but any SD delay lengthens the loop and delays the transfer slot (the 2.7 ms cc→cf gap).
+- **PSRAM playback already exists**: `buildPsramFrame()` (~:1410), `psram_play_offset_` (~:1446/1474)
+  — a whole-pattern-in-RAM path. A 2×10 GS16 200-frame pattern is ~800 KB; PSRAM is 8–16 MB. Preloading
+  the trial's pattern into PSRAM at TRIAL_PARAMS and serving 0x70 from RAM would remove SD from the
+  Mode-3 hot path entirely. Check what the PSRAM path is for today and its frame identity gap (fw #54:
+  FRAME records don't track PSRAM frames yet).
+- Held candidate (Michael, until a baseline wedge is captured on ring firmware): frame cache / skip
+  `loadFrame` + timer churn when the index is unchanged (`handleSetFramePosition`).
+- Other Teensy-side slop: `usb_serial_write` sticky 120 ms `transmit_previous_timeout`
+  (`SerialManager::flushResponses` ignores short writes — fw #51); IntervalTimer disarm/rearm per
+  command (benign per earlier analysis, but measurable now); refresh ISR vs `loop()` contention.
+- Host-side slop: single-flight link (a 0xA9 drain request can delay a 0x70 by one RTT — measure
+  telemetry on vs off), coalescing in `FicTracBridgeClient._drain` (newest index wins; #199 wrap),
+  bridge WebSocket hop (`rx` vs FicTrac `ms`), Chrome background-tab timer throttling (1 s-aligned
+  timeouts seen on night 1), 500 ms link timeout.
+- Instruments for later (Michael has none for several days): AD3 + Saleae on the framescan DIO for
+  true frame-period jitter (T2), photodiode for glass-to-glass (L-series in
+  `controller-telemetry-ring-buffer-proposal.md` §9).
+
+## 7. Tracking
+
+fw #50 (the bug), fw #53 (health PR), fw #54 (ring hardening before course), web #197 (self-healing),
+#198 (campaign PR), #199 (index wrap), #200 (fault-lifecycle follow-ups), LAB-149 (ring/perf logging),
+LAB-212 (self-healing), LAB-164 (Mode-3 latency). Memory notes for the soak session:
+`~/.claude/projects/-Users-reiserm-Documents-GitHub-webDisplayTools/memory/mode3-wedge-fw50.md`.
+
+## 8. Coordination with the running soak session
+
+The soak session owns the bench, the Studio tab, the bridge and the monitor, and will post the
+morning analysis. If this session needs a bench experiment (e.g. a telemetry-off iteration, a PSRAM
+preload prototype, the synthetic-producer T1 drain test at 5/12.6/50 KB/s), write it up as a bench
+request with exact steps and expected measurements; do not run it. Files under `soak-logs/` may be
+read at any time; copy, don't move.
diff --git a/fictrac-bridge/bridge.py b/fictrac-bridge/bridge.py
index a703ab0b..6c894821 100644
--- a/fictrac-bridge/bridge.py
+++ b/fictrac-bridge/bridge.py
@@ -104,7 +104,7 @@ class ConnectionClosed(Exception):  # type: ignore[no-redef]
 # leads the startup banner. (An OLD bridge has no --version flag → argparse errors,
 # which is itself the tell.) "behavior_v1" here means frames carry ms/fc/idx/ft/x/y/hd
 # with `ft` normalized ns→ms — i.e. the live scope + dashboard will work.
-BRIDGE_VERSION = "3.0 · behavior_v2 (compact arena echo, log_control ack)"
+BRIDGE_VERSION = "3.1 · behavior_v2 (compact arena echo, log_control ack, controller telemetry rows)"
 
 # behavior_v1 — the logged frame schema (issue #140), UNCHANGED in behavior_v2.
 # Positional-array rows in this column order; the live scope + offline dashboard
@@ -544,6 +544,12 @@ async def _recv_loop(self, websocket) -> None:
             pass
 
 
+# Minimum row lengths for the tagged array streams the browser may send via
+# {type:"rows"} (schema: js/arena-telemetry.js STREAM_SCHEMA). Shorter rows are
+# dropped so a malformed producer cannot poison the file for every reader.
+ROW_MIN_LEN = {"cc": 7, "cf": 8, "cs": 7}
+
+
 class LogWriter:
     """Appends one JSON line per event to a log file.
 
@@ -646,6 +652,24 @@ def _emit(self, obj) -> None:
         if self._fh:
             self._fh.write(json.dumps(obj, separators=(",", ":")) + "\n")
 
+    def write_rows(self, rows) -> int:
+        """Compact ARRAY rows from the browser, written verbatim one per line
+        (controller telemetry streams "cc"/"cf"/"cs" from js/arena-telemetry.js;
+        the tag in row[0] is the reader's dispatch key, like "a" for arena echoes).
+        Rows are validated for shape only — a list whose first element is a short
+        string tag — never rewritten. Returns the number written."""
+        if not self._fh or not isinstance(rows, list):
+            return 0
+        n = 0
+        for r in rows:
+            if not (isinstance(r, list) and r and isinstance(r[0], str) and 1 <= len(r[0]) <= 4):
+                continue
+            if len(r) < ROW_MIN_LEN.get(r[0], 2):  # a bare ["cc"] would crash readers
+                continue
+            self._emit(r)
+            n += 1
+        return n
+
     def write_inbound(self, raw: str | bytes) -> None:
         if not self._fh:
             return
@@ -945,6 +969,9 @@ async def dispatch(raw, websocket=None) -> None:
                 + (f" ({len(content)} chars)" if content else ""),
                 file=sys.stderr,
             )
+        elif kind == "rows":
+            # Compact array rows (controller telemetry cc/cf/cs) — verbatim lines.
+            log.write_rows(obj.get("rows"))
         else:
             # {"type":"log", ...} and anything else → straight to the log file.
             log.write_inbound(raw)
diff --git a/fictrac-bridge/fictrac_sim.py b/fictrac-bridge/fictrac_sim.py
index 298bc060..e55a8042 100644
--- a/fictrac-bridge/fictrac_sim.py
+++ b/fictrac-bridge/fictrac_sim.py
@@ -73,10 +73,25 @@ class Walker:
     emit byte-identical records regardless of pacing.
     """
 
-    def __init__(self, rate_hz: float, seed: int | None) -> None:
+    def __init__(
+        self,
+        rate_hz: float,
+        seed: int | None,
+        turn_sigma: float = 0.05,
+        jump_every: int = 0,
+        jump_deg: float = 90.0,
+    ) -> None:
         self.rng = random.Random(seed)
         self.dt = 1.0 / rate_hz
         self.dt_ms = 1000.0 * self.dt
+        # Soak-harness knobs (fw #50): `turn_sigma` is the per-frame heading step
+        # (rad) — 0.05 rad ≈ 2.9° ≈ ±1.6 frames/sample at the 1.8°/frame default
+        # gain, i.e. a FicTrac-like random walk that keeps the SD reads on the
+        # sequential fast path most of the time. `jump_every` > 0 adds a ±jump_deg
+        # heading jump every N frames — a wide seek that defeats that fast path.
+        self.turn_sigma = turn_sigma
+        self.jump_every = max(0, int(jump_every))
+        self.jump_rad = math.radians(jump_deg)
         self.frame = 0
         self.heading = 0.0  # integrated heading (rad), field 17
         self.x = 0.0  # integrated x (rad), field 15
@@ -91,7 +106,9 @@ def next_record(self) -> list[float]:
         self.frame += 1
 
         # Per-frame deltas: a small turn and a small forward step.
-        d_head = self._gauss(0.05)
+        d_head = self._gauss(self.turn_sigma)
+        if self.jump_every and self.frame % self.jump_every == 0:
+            d_head += self.jump_rad if self.rng.random() < 0.5 else -self.jump_rad
         speed = abs(self._gauss(0.03))  # rad/frame, field 19
         move_dir = self.heading + self._gauss(0.1)  # field 18
 
@@ -242,6 +259,21 @@ def main(argv: list[str] | None = None) -> int:
     p.add_argument("--seed", type=int, default=None, help="generated mode: RNG seed for reproducible output")
     p.add_argument("--count", type=int, default=0, help="generated mode: frames to emit then exit (0 = forever)")
     p.add_argument("--speed", type=float, default=1.0, help="playback mode: speed multiplier (default: 1.0)")
+    p.add_argument(
+        "--turn-sigma",
+        type=float,
+        default=0.05,
+        help="generated mode: per-frame heading step sigma in rad (default 0.05 ≈ ±1.6 frames/sample "
+        "at gain 1.8; soak harness, fw #50)",
+    )
+    p.add_argument(
+        "--jump-every",
+        type=int,
+        default=0,
+        help="generated mode: add a ±JUMP_DEG heading jump every N frames (0 = never); a wide "
+        "frame seek that defeats the SD sequential-read fast path",
+    )
+    p.add_argument("--jump-deg", type=float, default=90.0, help="generated mode: jump size in degrees (default 90)")
     args = p.parse_args(argv)
 
     if args.file is not None:
@@ -264,7 +296,16 @@ def main(argv: list[str] | None = None) -> int:
         # ── generated mode: synthetic random walk ──
         if args.rate <= 0:
             p.error("--rate must be > 0")
-        emit = emit_generated(Walker(rate_hz=args.rate, seed=args.seed), args.rate, args.count)
+        if args.turn_sigma < 0 or args.jump_every < 0:
+            p.error("--turn-sigma and --jump-every must be >= 0")
+        walker = Walker(
+            rate_hz=args.rate,
+            seed=args.seed,
+            turn_sigma=args.turn_sigma,
+            jump_every=args.jump_every,
+            jump_deg=args.jump_deg,
+        )
+        emit = emit_generated(walker, args.rate, args.count)
 
     try:
         if args.proto == "udp":
diff --git a/js/arena-link.js b/js/arena-link.js
index 31549011..4f47b5d8 100644
--- a/js/arena-link.js
+++ b/js/arena-link.js
@@ -65,6 +65,33 @@ const ArenaLink = (function () {
             .map((b) => b.toString(16).padStart(2, '0'))
             .join(' ');
 
+    // USB identity of a SerialPort ({usbVendorId, usbProductId}) or null when the
+    // browser exposes nothing (Bluetooth / virtual ports, old Chromium).
+    function portInfo(port) {
+        try {
+            const i = port && typeof port.getInfo === 'function' ? port.getInfo() : null;
+            if (!i || (i.usbVendorId == null && i.usbProductId == null)) return null;
+            return { usbVendorId: i.usbVendorId, usbProductId: i.usbProductId };
+        } catch (_) {
+            return null;
+        }
+    }
+    // A granted port matches when both ids equal the remembered ones; with no
+    // remembered identity ANY port matches (the caller's ambiguity check applies).
+    function infoMatches(info, want) {
+        if (!want) return true;
+        return (
+            !!info &&
+            info.usbVendorId === want.usbVendorId &&
+            info.usbProductId === want.usbProductId
+        );
+    }
+    function describeInfo(info) {
+        if (!info) return 'any USB serial device';
+        const h = (n) => (n == null ? '?' : '0x' + n.toString(16).padStart(4, '0'));
+        return 'VID ' + h(info.usbVendorId) + ' PID ' + h(info.usbProductId);
+    }
+
     // Truncate long payloads (e.g. future stream frames) so the log stays readable.
     const hexDump = (bytes) =>
         bytes.length > HEX_LOG_LIMIT
@@ -160,6 +187,10 @@ const ArenaLink = (function () {
 
             const baudRate = (opts && opts.baudRate) || DEFAULT_BAUD_RATE;
             await this._port.open({ baudRate });
+            // Remember the USB identity (VID/PID — all Web Serial exposes) so
+            // reconnect() can find this device among the granted ports after a
+            // firmware reset re-enumerates it.
+            this._portInfo = portInfo(this._port);
 
             try {
                 this._writer = this._port.writable.getWriter();
@@ -195,6 +226,84 @@ const ArenaLink = (function () {
             return this._port;
         }
 
+        /**
+         * Re-open the controller WITHOUT a user gesture, from the ports the user
+         * has already granted (navigator.serial.getPorts()). For unattended
+         * recovery after SYSTEM_RESET (0x01) / a soak-harness fault (fw #50):
+         * the Teensy re-enumerates, so the old SerialPort object is usually dead
+         * and the device comes back as a new granted port with the same VID/PID.
+         *
+         * Candidate order: the previously used SerialPort object first (no
+         * re-enumeration happened), then granted ports whose getInfo() matches
+         * the remembered VID/PID. VID/PID names a PRODUCT, not a unit — with two
+         * or more matching granted ports the call refuses (ambiguous) unless
+         * `allowAmbiguous`; callers should verify the controller's MAC via 0xC2
+         * afterwards regardless. Polls until `timeoutMs` (default 10 s) so the
+         * ~1–3 s re-enumeration window is covered.
+         * @param {object} [opts] {timeoutMs=10000, pollMs=500, allowAmbiguous=false, baudRate}
+         * @returns {Promise<SerialPort>} the port now open
+         */
+        async reconnect(opts) {
+            this._assertSupported();
+            opts = opts || {};
+            if (this._connected) return this._port;
+            const timeoutMs = opts.timeoutMs > 0 ? opts.timeoutMs : 10000;
+            const pollMs = opts.pollMs > 0 ? opts.pollMs : 500;
+            const want = this._portInfo || null;
+            const old = this._port;
+            const deadline = Date.now() + timeoutMs;
+            let lastErr = null;
+            for (;;) {
+                let granted = [];
+                try {
+                    granted = await navigator.serial.getPorts();
+                } catch (e) {
+                    lastErr = e;
+                }
+                const matching = granted.filter((p) => p !== old && infoMatches(portInfo(p), want));
+                if (matching.length > 1 && !opts.allowAmbiguous) {
+                    throw new Error(
+                        'reconnect: ' +
+                            matching.length +
+                            ' granted ports match ' +
+                            describeInfo(want) +
+                            ' — ambiguous, pick the port manually'
+                    );
+                }
+                const candidates = (old ? [old] : []).concat(matching);
+                for (const p of candidates) {
+                    try {
+                        // A port whose device vanished may still be "open" from
+                        // the OS's point of view — release it before re-opening.
+                        try {
+                            await p.close();
+                        } catch (_) {
+                            /* already closed / never opened */
+                        }
+                        this._port = p;
+                        await this.open(opts);
+                        this._log(
+                            '-- reconnected' + (p === old ? ' (same port)' : ' (re-enumerated)')
+                        );
+                        return p;
+                    } catch (e) {
+                        lastErr = e;
+                        this._port = old;
+                    }
+                }
+                if (Date.now() >= deadline) {
+                    throw new Error(
+                        'reconnect: no granted port came back within ' +
+                            timeoutMs +
+                            ' ms' +
+                            (lastErr ? ' (' + (lastErr.message || lastErr) + ')' : '') +
+                            ' — connect manually'
+                    );
+                }
+                await new Promise((r) => setTimeout(r, pollMs));
+            }
+        }
+
         /**
          * Write a request and resolve with the correlated response FRAME
          * (Uint8Array, including the length byte — pass it straight to
@@ -336,8 +445,9 @@ const ArenaLink = (function () {
             // Park the await BEFORE writing so a very fast reply can't arrive
             // before its promise exists. The executor runs synchronously, so
             // `_inflight` is set before we write.
+            let entry = null;
             const respPromise = new Promise((resolve, reject) => {
-                const entry = { expectedCmd, resolve, reject, timer: null };
+                entry = { expectedCmd, resolve, reject, timer: null };
                 entry.timer = setTimeout(() => {
                     if (this._inflight !== entry) return;
                     this._inflight = null;
@@ -358,11 +468,20 @@ const ArenaLink = (function () {
             });
 
             this._log('->', hexDump(payload));
+            // The deadline covers the WRITE too: a stalled USB write (host stack
+            // wedged, device half-gone) used to leave the caller pending forever
+            // while the response timer fired into the void. Race the write against
+            // the response promise — if the timer wins, the write is abandoned and
+            // the caller sees the ordinary timeout rejection.
+            const settled = respPromise.then(
+                () => undefined,
+                () => undefined
+            );
             try {
-                await this._writer.write(payload);
+                await Promise.race([this._writer.write(payload), settled]);
             } catch (err) {
-                if (this._inflight) {
-                    clearTimeout(this._inflight.timer);
+                if (this._inflight === entry) {
+                    clearTimeout(entry.timer);
                     this._inflight = null;
                 }
                 throw err;
@@ -370,6 +489,20 @@ const ArenaLink = (function () {
             return respPromise;
         }
 
+        /**
+         * Drop any buffered, unparsed RX bytes. Used after a QUIET PERIOD in the
+         * fw #50 fault lifecycle: with no request id on the wire, a late reply to
+         * an earlier 0x70 can otherwise be taken as the answer to the next probe.
+         * Only meaningful when nothing is in flight; a pending request keeps its
+         * timer. Returns the number of bytes discarded.
+         */
+        flushRx() {
+            const n = this._rxBuf.length;
+            this._rxBuf = new Uint8Array(0);
+            if (n) this._log('-- flushed ' + n + ' stale rx byte(s)');
+            return n;
+        }
+
         /** Close the port and tear down I/O. Safe to call when already closed. */
         async close() {
             const wasConnected = this._connected;
diff --git a/js/arena-runner-g6.js b/js/arena-runner-g6.js
index 401ffaa0..6a63f2cb 100644
--- a/js/arena-runner-g6.js
+++ b/js/arena-runner-g6.js
@@ -180,6 +180,13 @@ var ArenaRunnerG6 = (function () {
     // isKnownControllerCommand, duplicated on purpose because this module must stay
     // import-free (no sibling imports). Anything else (e.g. a legacy setColorDepth →
     // SWITCH_GRAYSCALE 0x06, dropped on G6) is an error, not a silent no-op.
+    // A link "response timeout" (ArenaLink's message) — the controller-unresponsive
+    // signature of firmware #50, as opposed to a rejected/odd reply.
+    function isTimeoutError(e) {
+        const m = e && (e.message || String(e));
+        return typeof m === 'string' && /response timeout/i.test(m);
+    }
+
     const RUNNABLE_CONTROLLER_COMMANDS = [
         'trialParams',
         'allOn',
@@ -738,6 +745,8 @@ var ArenaRunnerG6 = (function () {
             this._ledActivator = null; // active conditional-LED evaluator (Mode 3)
             this._ledUnsub = null; // bridge 'applied' unsubscribe for the above
             this._emit = null; // current run's status emit (for async LED events)
+            this._faultReason = null; // set by fault() / a timed-out wire command
+            this._faultDetail = null;
         }
 
         get active() {
@@ -846,6 +855,40 @@ var ArenaRunnerG6 = (function () {
             this._clear();
         }
 
+        /**
+         * External FAULT (firmware #50): the closed-loop bridge client saw repeated
+         * 0x70 timeouts, or some other watcher decided the controller is gone.
+         * Records the reason, emits a `fault` status event into the current run,
+         * then unwinds like abort() (wakes the host-side wait, disarms closed loop,
+         * NO STOP send here — the sequence's finally still tries a best-effort
+         * STOP and records whether it was acked). The terminal `aborted` event's
+         * summary carries `fault`, which the run-log adapter turns into the
+         * CONTROLLER_FAULT outcome (never ABORTED_BY_USER).
+         * @param {string} [reason='controller_unresponsive']
+         * @param {object} [detail] JSON-safe context (failures, window, lastError…)
+         */
+        fault(reason, detail) {
+            this._faultReason = reason || 'controller_unresponsive';
+            this._faultDetail = detail && typeof detail === 'object' ? detail : null;
+            if (this._emit) {
+                try {
+                    this._emit({
+                        phase: 'fault',
+                        reason: this._faultReason,
+                        detail: this._faultDetail
+                    });
+                } catch (_) {
+                    /* a status sink must not break the unwind */
+                }
+            }
+            this._clear();
+        }
+
+        /** The fault reason of the current/last run, or null. */
+        get faultReason() {
+            return this._faultReason;
+        }
+
         /** Clear run-state without sending STOP (used on disconnect/error). Also
          *  aborts a running sequence and unblocks its current wait. */
         _clear() {
@@ -1015,9 +1058,12 @@ var ArenaRunnerG6 = (function () {
                 if (typeof a.onProgress === 'function') a.onProgress(s);
             };
             this._emit = emit; // for async side-effects (LED activation on 'applied')
+            let terminal = null; // emitted after cleanup (see finally)
 
             this._active = true;
             this._abort = false;
+            this._faultReason = null;
+            this._faultDetail = null;
             // A stale closed-loop apply (left on by Console use or an aborted run)
             // would push FicTrac frames into the opening Mode-2 step — the firmware
             // rejects each 0x70 with status 1 and the log fills with errors
@@ -1192,6 +1238,18 @@ var ArenaRunnerG6 = (function () {
                             // past a possible protocol desync.
                             summary.errors++;
                             this._abort = true;
+                            // A response TIMEOUT on a protocol command is the same
+                            // controller-unresponsive fault the closed-loop path
+                            // detects (fw #50: the 0x08 after the 0x70s) — label
+                            // it so the run's outcome is CONTROLLER_FAULT, not a
+                            // generic user abort.
+                            if (isTimeoutError(e) && !this._faultReason) {
+                                this._faultReason = 'controller_unresponsive';
+                                this._faultDetail = {
+                                    op: ir.op,
+                                    error: e && (e.message || String(e))
+                                };
+                            }
                             emit({
                                 phase: 'error',
                                 index: i,
@@ -1215,7 +1273,15 @@ var ArenaRunnerG6 = (function () {
                 }
                 summary.aborted = this._abort;
                 summary.completed = !this._abort;
-                emit({ phase: this._abort ? 'aborted' : 'sequence-complete', summary });
+                // fault: null for a clean run or a user STOP; a reason string when
+                // the controller stopped answering (fault() / a timed-out command).
+                summary.fault = this._faultReason || null;
+                if (this._faultDetail) summary.faultDetail = this._faultDetail;
+                // The terminal event is emitted from `finally`, AFTER the best-effort
+                // STOP, so the serialized summary (run log, auto-commit trigger)
+                // carries `stopAcked` — review finding: it used to be present only
+                // on the returned object.
+                terminal = { phase: this._abort ? 'aborted' : 'sequence-complete', summary };
                 return summary;
             } finally {
                 // Best-effort STOP at the end / on abort, then reset run-state.
@@ -1224,13 +1290,21 @@ var ArenaRunnerG6 = (function () {
                 this._resolveSleep();
                 this._clearLedActivator(); // LED off + stop gating on completion/abort
                 this._disarmClosedLoop(); // never leak apply=true into the next run
+                // "Fail closed" is two claims — the host stopped advancing (true
+                // here) and the display is quiescent (only if this STOP is acked;
+                // it rides the same possibly-wedged link, and panels latch their
+                // last frame). Record which, never assume.
+                summary.stopAcked = false;
                 try {
                     if (this._link && this._link.connected) {
-                        await this._link.send(this._wire.encodeStop());
+                        const f = await this._link.send(this._wire.encodeStop());
+                        const d = this._wire.decodeResponse(f);
+                        summary.stopAcked = !!(d && d.ok);
                     }
                 } catch (_) {
                     /* best-effort */
                 }
+                if (terminal) emit(terminal);
                 this._emit = null;
             }
         }
diff --git a/js/arena-session.js b/js/arena-session.js
index c42ade84..dc0c2fce 100644
--- a/js/arena-session.js
+++ b/js/arena-session.js
@@ -42,7 +42,14 @@
     // Page-wide singleton (one connection per page). Held in closure scope.
     let _shared = null;
 
-    const EVENTS = ['log', 'error', 'disconnect', 'state', 'runstatus'];
+    // Monotonic ms clock for durations (performance.now in browsers + Node ≥16;
+    // Date.now fallback). Wall-clock `t` stamps stay Date.now (epoch, for t0 offsets).
+    const monoNow =
+        typeof performance !== 'undefined' && typeof performance.now === 'function'
+            ? () => performance.now()
+            : () => Date.now();
+
+    const EVENTS = ['log', 'error', 'disconnect', 'state', 'runstatus', 'fault'];
 
     class ArenaSession {
         /**
@@ -104,10 +111,56 @@
             // .bridge. Null when the module isn't loaded — the runner tolerates it.
             this._bridge = BridgeClientLib
                 ? new BridgeClientLib({
-                      applyFrame: (i) => this.send(this._wire.encodeSetFramePosition(i))
+                      // A controller REJECT (status ≠ 0 — "no pattern selected",
+                      // "index out of range") is an apply failure too, so the
+                      // bridge client's fault detector counts it. Bench
+                      // 2026-09-12: 21k rejects streamed for minutes without
+                      // tripping anything because only throws were counted.
+                      applyFrame: (i) =>
+                          this.send(this._wire.encodeSetFramePosition(i)).then((resp) => {
+                              const d = this._wire.decodeResponse
+                                  ? this._wire.decodeResponse(resp)
+                                  : null;
+                              if (d && !d.ok) {
+                                  const e = new Error(
+                                      'controller rejected SET_FRAME_POSITION (status ' +
+                                          d.status +
+                                          ')'
+                                  );
+                                  e.status = d.status;
+                                  throw e;
+                              }
+                              return resp;
+                          })
                   })
                 : null;
-            this._runner = new RunnerLib.ArenaRunner(this._link, this._wire, this._bridge);
+            // The runner sends through THIS session, not the bare link, so every
+            // wire command it issues (trialParams, STOP, AO/DO…) lands in the run
+            // log as an arena_command row next to the 0x70 stream — the fw #50
+            // post-mortem needs the 0x08 timeout in the same record — and obeys
+            // the output interlock like every other sender.
+            const self = this;
+            const runnerLink = {
+                send: (bytes, opts) => self.send(bytes, opts),
+                get connected() {
+                    return self._link.connected;
+                }
+            };
+            this._runner = new RunnerLib.ArenaRunner(runnerLink, this._wire, this._bridge);
+            // Closed-loop fault (fw #50): the bridge client latched
+            // controller_unresponsive → abort the run WITHOUT a STOP through the
+            // wedged link (runner.fault: reason + 'fault' status event, then the
+            // abort unwind; the sequence's finally still tries one STOP and
+            // records stopAcked) and tell the page.
+            if (this._bridge && typeof this._bridge.on === 'function') {
+                this._bridge.on('fault', (f) => {
+                    const kind = (f && f.kind) || 'controller_unresponsive';
+                    if (typeof this._runner.fault === 'function') this._runner.fault(kind, f);
+                    else this._abortRunner();
+                    this._emit('fault', f);
+                    this._emit('state');
+                });
+            }
         }
 
         /** Web Serial available? (Chromium-desktop only.) Gate every connect UI on this. */
@@ -237,6 +290,26 @@
             this._emit('state');
         }
 
+        /**
+         * Re-open the controller from the already-granted ports, no user gesture
+         * (see ArenaLink.reconnect — fw #50 recovery / soak continuation). Emits
+         * 'state' on success; rejects with the link's reason (ambiguous / timeout).
+         */
+        async reconnect(opts) {
+            this._assertOutputAllowed('reconnect');
+            if (typeof this._link.reconnect !== 'function') {
+                throw new Error('ArenaLink.reconnect unavailable (stale arena-link.js?)');
+            }
+            const port = await this._link.reconnect(opts);
+            this._emit('state');
+            return port;
+        }
+
+        /** Discard stale RX bytes on the link (quiet-period resync). 0 when unsupported. */
+        flushRx() {
+            return typeof this._link.flushRx === 'function' ? this._link.flushRx() : 0;
+        }
+
         /**
          * User-initiated teardown: stop any active run (best-effort STOP), then
          * close the port. Emits 'disconnect' with involuntary:false. Always safe.
@@ -272,12 +345,15 @@
          * ArenaWireG6.decodeResponse; do NOT slice). Queues FIFO behind any
          * in-flight send.
          * @param {Uint8Array|number[]} bytes
-         * @param {object} [opts] {expectedCmd?, timeoutMs?} — pass expectedCmd:0x32 for STREAM_FRAME
+         * @param {object} [opts] {expectedCmd?, timeoutMs?, silent?} — pass expectedCmd:0x32 for
+         *        STREAM_FRAME; `silent: true` skips the bridge command log (for meta traffic
+         *        such as the telemetry drain's 0xA9 requests, whose payload IS the log).
          * @returns {Promise<Uint8Array>}
          */
         send(bytes, opts) {
             this._assertOutputAllowed('send');
             const p = this._link.send(bytes, opts);
+            if (opts && opts.silent) return p;
             // Bridge-as-single-logger (default-on): when logging is active, post every
             // arena command to the bridge's unified JSONL — timestamped on the browser
             // side (t) and again by the bridge on receipt (rx_ms), so arena events and
@@ -285,9 +361,10 @@
             // the caller still sees the original resolution/rejection.
             if (this._bridge && this._bridge.logging) {
                 const t = typeof Date !== 'undefined' ? Date.now() : 0;
+                const p0 = monoNow();
                 p.then(
-                    (resp) => this._logCommand(bytes, t, resp, null),
-                    (err) => this._logCommand(bytes, t, null, err)
+                    (resp) => this._logCommand(bytes, t, p0, resp, null),
+                    (err) => this._logCommand(bytes, t, p0, null, err)
                 );
             }
             return p;
@@ -308,7 +385,10 @@
         }
 
         // Append one arena_command entry to the bridge log (decodes the reply if any).
-        _logCommand(bytes, t, resp, err) {
+        // `dt` is the HOST-OBSERVED round trip: from the moment this send was
+        // queued (it may wait behind an in-flight command) to the reply/timeout,
+        // on the monotonic clock — not the controller's service time.
+        _logCommand(bytes, t, p0, resp, err) {
             let status = null;
             let echo = null;
             let ok = null;
@@ -325,7 +405,7 @@
             this._bridge.log({
                 event: 'arena_command',
                 t,
-                dt: (typeof Date !== 'undefined' ? Date.now() : 0) - t,
+                dt: Math.round(monoNow() - p0),
                 len: bytes ? bytes.length : 0,
                 head: this._head(bytes),
                 status,
@@ -479,6 +559,25 @@
                 out.ok = s.response.ok;
             }
             if (s.error) out.error = s.error.message || String(s.error);
+            // fault context (fw #50) + the terminal summary (fault / stopAcked /
+            // counts) so the committed log says WHY a run ended, not just that it did.
+            if (s.detail && typeof s.detail === 'object') out.detail = s.detail;
+            if (s.summary && typeof s.summary === 'object') {
+                const sm = {};
+                for (const k of [
+                    'completed',
+                    'aborted',
+                    'steps',
+                    'errors',
+                    'skipped',
+                    'fault',
+                    'faultDetail',
+                    'stopAcked'
+                ]) {
+                    if (s.summary[k] !== undefined) sm[k] = s.summary[k];
+                }
+                out.summary = sm;
+            }
             return out;
         }
     }
diff --git a/js/arena-telemetry.js b/js/arena-telemetry.js
new file mode 100644
index 00000000..ca4be7e4
--- /dev/null
+++ b/js/arena-telemetry.js
@@ -0,0 +1,467 @@
+/**
+ * arena-telemetry.js — decoder + drainer for the G6 controller's telemetry RING
+ * (firmware `feat/telemetry-ring`, design: docs/development/
+ * controller-telemetry-ring-buffer-proposal.md § 3.1; first target: fw #50).
+ *
+ * The controller keeps a 64 KiB byte ring of timestamped records in
+ * reboot-surviving OCRAM: CMD (every command it processed, with the reply
+ * status), FRAME (each displayed frame change with its SD load + SPI time) and
+ * STATE (mode changes, error glyphs, slow SD reads, overruns, boots). The host
+ * drains it with GET_TELEMETRY_BLOCK 0xA9 using an ACK CURSOR: a block is only
+ * freed by the NEXT request's ack_seq, so a lost or timed-out reply is harmless
+ * — re-ask with the same ack and get the same bytes.
+ *
+ * Wire (little-endian):
+ *   block payload: t_now_us u32 · first_seq u32 · n_records u16 · dropped u32 ·
+ *                  more u8 · flags u8 (bit0 events on, bit1 contents survived a
+ *                  reboot) · boot_count u16   = 18 B header, then records
+ *   record: len u8 (total) · type u8 · seq u32 · t_us u32 · payload
+ *     1 CMD   : cmd u8 · status u8 · plen u8 · payload[plen ≤ 8]   (request bytes)
+ *     2 FRAME : idx u16 · pattern u16 · sd_load_us u16 · spi_us u16
+ *     3 STATE : kind u8 · code u8 · arg u16
+ *               kind 8 wdog_context (boot after a watchdog reset, fw eca07f6 follow-up): code = the
+ *               watchdog handler's EXC_RETURN low byte (0xF9 preempted thread mode, 0xF1 a handler),
+ *               arg bits 0–8 = stacked xPSR IPSR (0 = thread, 138 = the PIT handler), bits 9–15 =
+ *               isr_last before the watchdog overwrote it. kind 9 prev_isr_count: code = ISR id,
+ *               arg = previous boot's entry count >> 12 (saturating). kind 10 timer_fail:
+ *               IntervalTimer::begin() failed, arg = requested refresh rate.
+ *     0 PAD   : filler at the ring's wrap point (skipped)
+ *
+ * Log rows (behavior_v2 companion streams, proposal § 3.3; `rx` = host receive
+ * epoch ms, `t_us` = raw controller micros(), `seq` = ring sequence):
+ *   ["cc", rx, t_us, seq, cmd, status, "reqhex"]
+ *   ["cf", rx, t_us, seq, idx, pattern, sd_load_us, spi_us]
+ *   ["cs", rx, t_us, seq, kind, code, arg]
+ *
+ * Classic dual-export (window global + CommonJS), no bare ES `export`.
+ */
+(function (global) {
+    'use strict';
+
+    const HEADER_BYTES = 18;
+    const REC = { PAD: 0, CMD: 1, FRAME: 2, STATE: 3 };
+    const STATE_KINDS = {
+        1: 'boot',
+        2: 'state_change',
+        3: 'error_glyph',
+        4: 'sd_slow',
+        5: 'ring_overrun',
+        6: 'telemetry',
+        7: 'sd_open',
+        8: 'wdog_context',
+        9: 'prev_isr_count',
+        10: 'timer_fail' // IntervalTimer::begin() failed: arg = requested refresh rate (Hz)
+    };
+    const ISR_NAMES = [
+        'none',
+        'refresh_timer',
+        'spi_dma',
+        'watchdog',
+        'usb',
+        'sdhc',
+        'lpspi',
+        'pit'
+    ];
+    const ARENA_STATES = [
+        'ALL_OFF',
+        'ALL_ON',
+        'STREAMING_FRAME',
+        'OPEN_LOOP',
+        'SHOW_FRAME',
+        'CLOSED_LOOP',
+        'PSRAM_PLAY',
+        'ERROR_DISPLAY'
+    ];
+    const NO_ACK = 0xffffffff;
+
+    const hex = (u8) =>
+        Array.from(u8)
+            .map((b) => b.toString(16).padStart(2, '0'))
+            .join('');
+
+    function u16(m, o) {
+        return m[o] | (m[o + 1] << 8);
+    }
+    function u32(m, o) {
+        return (m[o] | (m[o + 1] << 8) | (m[o + 2] << 16) | (m[o + 3] << 24)) >>> 0;
+    }
+    /** a is after b in modular u32 sequence space (half-range rule). */
+    function seqAfter(a, b) {
+        const d = (a - b) >>> 0;
+        return d !== 0 && d < 0x80000000;
+    }
+
+    /** Parse one 0xA9 reply FRAME (as returned by session.send) → block or null. */
+    function parseBlock(resp, wire) {
+        const W = wire || (typeof global !== 'undefined' ? global.ArenaWireG6 : null);
+        const d = W ? W.decodeResponse(resp) : null;
+        if (!d || !d.ok) return null;
+        const m = d.payload;
+        if (!m || m.length < HEADER_BYTES) return null;
+        const block = {
+            tNowUs: u32(m, 0),
+            firstSeq: u32(m, 4),
+            nRecords: u16(m, 8),
+            dropped: u32(m, 10),
+            more: !!(m[14] & 1),
+            flags: m[15],
+            eventsEnabled: !!(m[15] & 1),
+            survivedReboot: !!(m[15] & 2),
+            disabledHeapCollision: !!(m[15] & 4), // ring refused: heap reached its address
+            syntheticOn: !!(m[15] & 8), // T1 synthetic producer running
+            bootCount: u16(m, 16),
+            records: [],
+            bytes: m.length - HEADER_BYTES,
+            malformed: 0,
+            rawHex: hex(m) // decoder-independent copy (kept only in crash dumps)
+        };
+        let o = HEADER_BYTES;
+        while (o < m.length) {
+            const len = m[o];
+            if (len < 2 || o + len > m.length) {
+                block.malformed++;
+                break;
+            }
+            const type = m[o + 1];
+            if (type === REC.PAD) {
+                o += len;
+                continue;
+            }
+            if (len < 10) {
+                block.malformed++;
+                o += len;
+                continue;
+            }
+            const rec = { type, seq: u32(m, o + 2), tUs: u32(m, o + 6) };
+            const p = o + 10;
+            const plen = len - 10;
+            if (type === REC.CMD && plen >= 3) {
+                rec.kind = 'cmd';
+                rec.cmd = m[p];
+                rec.status = m[p + 1];
+                const n = Math.min(m[p + 2], plen - 3, 8);
+                rec.req = hex(m.subarray(p + 3, p + 3 + n));
+            } else if (type === REC.FRAME && plen >= 10) {
+                rec.kind = 'frame';
+                rec.idx = u16(m, p);
+                rec.pattern = u16(m, p + 2);
+                rec.sdLoadUs = u32(m, p + 4); // u32: the 129 ms SD tail must fit (u16 caps at 65 ms)
+                rec.spiUs = u16(m, p + 8);
+            } else if (type === REC.STATE && plen >= 4) {
+                rec.kind = 'state';
+                rec.stateKind = m[p];
+                rec.stateName = STATE_KINDS[m[p]] || 'kind_' + m[p];
+                rec.code = m[p + 1];
+                rec.arg = u16(m, p + 2);
+                if (rec.stateKind === 2)
+                    rec.codeName = ARENA_STATES[rec.code] || 'state_' + rec.code;
+                if (rec.stateKind === 8) {
+                    rec.ipsr = rec.arg & 0x1ff;
+                    rec.priorIsr = rec.arg >> 9;
+                    rec.priorIsrName = ISR_NAMES[rec.priorIsr] || 'isr_' + rec.priorIsr;
+                    rec.preempted = rec.ipsr === 0 ? 'thread' : 'handler_' + rec.ipsr;
+                    // EXC_RETURN low byte: bit 3 = 1 → returned to thread mode (0xF9/0xE9/0xFD/0xED),
+                    // 0 → a handler was preempted (0xF1/0xE1). FP-stacked variants clear bit 4.
+                    rec.excReturnMode = rec.code & 0x08 ? 'thread' : 'handler';
+                }
+                if (rec.stateKind === 9) {
+                    rec.isrName = ISR_NAMES[rec.code] || 'isr_' + rec.code;
+                    rec.countApprox = rec.arg * 4096;
+                }
+            } else {
+                rec.kind = 'unknown';
+                rec.raw = hex(m.subarray(p, p + plen));
+                block.malformed++;
+            }
+            block.records.push(rec);
+            o += len;
+        }
+        return block;
+    }
+
+    /** Compact log rows for a parsed block (proposal § 3.3). `rx` = receive epoch ms. */
+    function toRows(block, rx) {
+        const rows = [];
+        for (const r of block.records) {
+            if (r.kind === 'cmd') rows.push(['cc', rx, r.tUs, r.seq, r.cmd, r.status, r.req]);
+            else if (r.kind === 'frame')
+                rows.push(['cf', rx, r.tUs, r.seq, r.idx, r.pattern, r.sdLoadUs, r.spiUs]);
+            else if (r.kind === 'state')
+                rows.push(['cs', rx, r.tUs, r.seq, r.stateKind, r.code, r.arg]);
+        }
+        return rows;
+    }
+
+    /** The `streams` schema line the bridge log carries once per logging session. */
+    const STREAM_SCHEMA = {
+        cc: {
+            cols: ['rx', 't_us', 'seq', 'cmd', 'status', 'req'],
+            desc: 'controller-side command record'
+        },
+        cf: {
+            cols: ['rx', 't_us', 'seq', 'idx', 'pattern', 'sd_load_us', 'spi_us'],
+            desc: 'displayed frame change'
+        },
+        cs: {
+            cols: ['rx', 't_us', 'seq', 'kind', 'code', 'arg'],
+            desc: 'state/error/boot event',
+            kinds: STATE_KINDS
+        }
+    };
+
+    /**
+     * Ack-cursor drainer. `session.send(bytes, {timeoutMs})` returns the reply
+     * frame. State: `ackSeq` = last seq stored by the host (sent as the ack on
+     * the next request), stats for the UI/log.
+     * @param {object} d {session, wire, timeoutMs=1500, maxBytes=180, maxChunks=40, now,
+     *        onRecords(block, rows, rx) → return false to REFUSE the rows (not stored):
+     *        the drainer then withholds its ack so the controller keeps them.}
+     */
+    function createDrainer(d) {
+        const session = d.session;
+        const W = d.wire || (typeof global !== 'undefined' ? global.ArenaWireG6 : null);
+        const timeoutMs = d.timeoutMs || 1500;
+        const maxBytes = d.maxBytes || 180;
+        // 40 chunks × ~180 B ≈ 7 KB per poll: under Chrome's background-tab timer
+        // throttling a poll may run only once per second, and production during
+        // Mode-3 streaming at 286 Hz is ~5–6 KB/s — the budget must exceed that.
+        const maxChunks = d.maxChunks || 40;
+        const now = d.now || (() => Date.now());
+        const onRecords = d.onRecords || (() => {});
+        const st = {
+            ackSeq: NO_ACK, // nothing acked yet
+            lastSeq: null, // highest seq seen
+            records: 0,
+            blocks: 0,
+            bytes: 0,
+            gaps: 0, // seq discontinuities seen (should equal controller-reported drops)
+            dropped: 0, // controller's cumulative drop counter (last value)
+            errors: 0,
+            notStored: 0, // rows the sink refused (ack withheld, will be re-read)
+            duplicates: 0, // records re-delivered after a rearm (already stored, dropped)
+            incarnations: 0, // ring re-initialisations seen (power cycles)
+            lastTNowUs: null,
+            bootCount: null,
+            survivedReboot: false,
+            lastError: null
+        };
+        let busy = false;
+        let peekNext = false; // next request goes out with NO_ACK (see rearm)
+        const idleWaiters = [];
+
+        /**
+         * One poll: ask with the current ack, parse, ack what we got. Follows
+         * `more` up to maxChunks. Resolves the array of parsed blocks.
+         */
+        async function drainOnce(opts) {
+            if (busy) return [];
+            busy = true;
+            const blocks = [];
+            try {
+                for (let i = 0; i < maxChunks; i++) {
+                    const ack = st.lastSeq == null || peekNext ? NO_ACK : st.lastSeq;
+                    let resp;
+                    try {
+                        resp = await session.send(W.encodeGetTelemetryBlock(ack, maxBytes), {
+                            timeoutMs,
+                            silent: true // the reply IS the log; don't echo 20 requests/s into it
+                        });
+                    } catch (e) {
+                        st.errors++;
+                        st.lastError = (e && e.message) || String(e);
+                        break;
+                    }
+                    const block = parseBlock(resp, W);
+                    if (!block) {
+                        st.errors++;
+                        st.lastError = 'unparseable telemetry block';
+                        break;
+                    }
+                    const rx = now();
+                    // Ring incarnation check (review finding: an old ack after a power
+                    // cycle would free unseen records). A different boot_count with the
+                    // ring NOT marked survived ⇒ fresh ring: forget the cursor. Same
+                    // incarnation after a rearm ⇒ drop records we already stored.
+                    if (peekNext) {
+                        peekNext = false;
+                        if (st.bootCount != null && block.bootCount !== st.bootCount) {
+                            if (!block.survivedReboot) st.lastSeq = null;
+                            st.incarnations++;
+                        }
+                        if (st.lastSeq != null) {
+                            const before = block.records.length;
+                            block.records = block.records.filter((r) =>
+                                seqAfter(r.seq, st.lastSeq)
+                            );
+                            st.duplicates += before - block.records.length;
+                        }
+                    }
+                    st.blocks++;
+                    st.bytes += block.bytes;
+                    st.lastTNowUs = block.tNowUs;
+                    st.dropped = block.dropped;
+                    st.bootCount = block.bootCount;
+                    st.survivedReboot = block.survivedReboot;
+                    st.heapCollision = block.disabledHeapCollision;
+                    if (block.records.length) {
+                        // ACK MEANS STORED (review finding): hand the rows to the sink
+                        // first; only when it accepted them does the cursor advance.
+                        // A refused block is re-requested with the old ack next poll.
+                        const accepted = onRecords(block, toRows(block, rx), rx) !== false;
+                        if (!accepted) {
+                            st.notStored++;
+                            blocks.push(block);
+                            break;
+                        }
+                        for (const r of block.records) {
+                            if (st.lastSeq != null && r.seq !== (st.lastSeq + 1) >>> 0) st.gaps++;
+                            st.lastSeq = r.seq;
+                            st.records++;
+                        }
+                        st.ackSeq = st.lastSeq;
+                    }
+                    blocks.push(block);
+                    if (!block.more || (opts && opts.single)) break;
+                }
+            } finally {
+                busy = false;
+                idleWaiters.splice(0).forEach((r) => r());
+            }
+            return blocks;
+        }
+
+        /** Drain until the controller reports nothing more (post-reboot crash dump). */
+        async function drainAll(limitChunks) {
+            const all = [];
+            for (let i = 0; i < (limitChunks || 400); i++) {
+                const refusedBefore = st.notStored;
+                const blocks = await drainOnce({ single: true });
+                if (!blocks.length) break;
+                if (st.notStored > refusedBefore) break; // sink refused: don't spin on the same block
+                all.push(blocks[0]);
+                if (!blocks[0].more && !blocks[0].records.length) break;
+                if (!blocks[0].more) break;
+            }
+            return all;
+        }
+
+        /** Forget the cursor entirely (test/reset helper). */
+        function reset() {
+            st.ackSeq = NO_ACK;
+            st.lastSeq = null;
+            peekNext = false;
+        }
+
+        /**
+         * Re-arm after a (re)connection or a controller reboot: the NEXT request
+         * carries NO_ACK, so nothing is freed until we have seen which ring
+         * incarnation answers. Same incarnation ⇒ already-stored records are
+         * dropped as duplicates and the cursor continues; fresh ring ⇒ cursor reset.
+         */
+        function rearm() {
+            peekNext = true;
+        }
+
+        /** Resolves once no drain is in flight (post-mortem: own the link, THEN go quiet). */
+        function idle() {
+            return busy ? new Promise((r) => idleWaiters.push(r)) : Promise.resolve();
+        }
+
+        return { drainOnce, drainAll, reset, rearm, idle, stats: st };
+    }
+
+    /**
+     * Single-flight periodic poller (the Analog In poller's shape): `canPoll()`
+     * gates each tick; `drainer.drainOnce()` does the work.
+     */
+    function createPoller(a) {
+        const drainer = a.drainer;
+        const canPoll = a.canPoll || (() => ({ ok: true }));
+        const onState = a.onState || (() => {});
+        let timer = null;
+        let state = 'stopped';
+        let reason = '';
+        let ticks = 0;
+        let skipped = 0;
+        let running = false;
+        function setState(s, r) {
+            if (s === state && (r || '') === reason) return;
+            state = s;
+            reason = r || '';
+            onState(state, reason);
+        }
+        async function tick() {
+            ticks++;
+            const g = canPoll();
+            if (!(g && g.ok)) {
+                setState('paused', (g && g.reason) || 'paused');
+                return false;
+            }
+            if (running) {
+                skipped++;
+                return false;
+            }
+            running = true;
+            try {
+                await drainer.drainOnce();
+                setState(
+                    drainer.stats.lastError && drainer.stats.errors ? 'polling' : 'polling',
+                    ''
+                );
+                return true;
+            } finally {
+                running = false;
+            }
+        }
+        return {
+            tick,
+            start(ms, setIntervalImpl, clearIntervalImpl) {
+                this.stop();
+                const si =
+                    setIntervalImpl || (typeof setInterval === 'function' ? setInterval : null);
+                const ci =
+                    clearIntervalImpl ||
+                    (typeof clearInterval === 'function' ? clearInterval : null);
+                // Plain calls only: window.clearInterval invoked as a METHOD of this
+                // poller object throws "Illegal invocation" in browsers (found on the
+                // bench 2026-09-12 — it would have aborted the fault post-mortem).
+                this._clear = ci ? (h) => ci(h) : null;
+                if (!si) throw new Error('telemetry poller: no setInterval available');
+                timer = si(() => {
+                    tick();
+                }, ms || 100);
+                setState('polling', '');
+            },
+            stop() {
+                if (timer && this._clear) this._clear(timer);
+                timer = null;
+                setState('stopped', '');
+            },
+            get state() {
+                return state;
+            },
+            get reason() {
+                return reason;
+            },
+            get counts() {
+                return { ticks, skipped };
+            }
+        };
+    }
+
+    const ArenaTelemetry = {
+        HEADER_BYTES,
+        REC,
+        STATE_KINDS,
+        ARENA_STATES,
+        NO_ACK,
+        STREAM_SCHEMA,
+        parseBlock,
+        toRows,
+        createDrainer,
+        createPoller
+    };
+
+    if (typeof module !== 'undefined' && module.exports) module.exports = ArenaTelemetry;
+    if (typeof global !== 'undefined') global.ArenaTelemetry = ArenaTelemetry;
+})(typeof window !== 'undefined' ? window : this);
diff --git a/js/arena-wire-g6.js b/js/arena-wire-g6.js
index dce2a3b1..54930e4e 100644
--- a/js/arena-wire-g6.js
+++ b/js/arena-wire-g6.js
@@ -66,6 +66,11 @@ const ArenaWireG6 = (function () {
         GET_CONTROLLER_INFO: 0xc2, // returns {version, capability_bitmap}
         SET_DIAG_OUTPUT: 0xc3, // [len=2,0xC3,on] mute/unmute DEBUG_SERIAL diagnostics
         GET_DIAG_OUTPUT: 0xc4, // returns current g_dbg_on state (0/1)
+        GET_HEALTH: 0xca, // [01 CA] controller health counters + previous-boot breadcrumb (fw #50)
+        GET_CRASHREPORT: 0xcc, // [01 CC] raw 128 B at OCRAM 0x2027FF80: PJRC arm_fault_info_struct + breadcrumbs (ring fw; gate on 0xCB flags bit 2)
+        GET_FIRMWARE_VERSION: 0xcb, // [01 CB] build identity: git SHA, branch, date, arena rows×cols (gate on cap bit 7)
+        SET_TELEMETRY: 0xa8, // [04 A8 flags rate_lo rate_hi] telemetry ring: bit0 events on/off (fw feat/telemetry-ring)
+        GET_TELEMETRY_BLOCK: 0xa9, // [08 A9 ack_seq u32 max_bytes u16 flags] ack-cursor drain of the ring (js/arena-telemetry.js decodes)
         SET_AO_VOLTAGE: 0xa0, // [03 A0 mv_lo mv_hi] set analog output (BNC J27) 0–5000 mV
         GET_AO_VOLTAGE: 0xa1, // [01 A1] returns last commanded AO level as uint16 LE mV
         SET_AO_MODE: 0xa3, // [02 A3 mode] 0=programmable | 1=frame_number (io_ext fw)
@@ -75,6 +80,7 @@ const ArenaWireG6 = (function () {
         SET_DIO_ROLE: 0xac, // [03 AC port role] "Digital IO 1/2 (5V)" role (io_ext fw)
         GET_DIO_ROLE: 0xad, // [01 AD] returns [role1, level1, role2, level2] (io_ext fw)
         SET_FRAME_POSITION: 0x70, // Mode 3: host-commanded frame index
+        GET_FRAME_POSITION: 0x72, // [01 72] returns cur_frame_index + frame_count, both uint16 LE
         // Panel firmware / ISP (g6_03-controller.md § Panel firmware update).
         SET_FIRMWARE_FILE: 0xe0, // [0xE0, len64 LE, data…] upload image → /firmware/panel.bin; reply u32 LE CRC-32
         GET_FIRMWARE_INFO: 0xe3, // [01 E3] reply: 32-byte footer {magic[8], version[16], crc32 LE, size LE}
@@ -115,7 +121,10 @@ const ArenaWireG6 = (function () {
         // Extended I/O command set (#135): SET_DIO_ROLE 0xAC / GET_DIO_ROLE
         // 0xAD / SET_AO_MODE 0xA3 / GET_ANALOG_IN 0xA4 — hosts detect the
         // DIO-role machinery by this bit, not by firmware-version guessing.
-        [5, 'io_ext']
+        [5, 'io_ext'],
+        // Controller health counters + reset breadcrumb (GET_HEALTH 0xCA) — the
+        // fw #50 soak/post-mortem probe. Hosts grey the health readout without it.
+        [7, 'health']
     ];
 
     // ───────────────────────── validation helpers ─────────────────────────
@@ -670,6 +679,327 @@ const ArenaWireG6 = (function () {
         return r.payload[0] | (r.payload[1] << 8);
     }
 
+    // get-frame-position (0x72) — Mode-3 current frame index + open pattern's frame count.
+    function encodeGetFramePosition() {
+        return frame(OPCODES.GET_FRAME_POSITION); // 01 72
+    }
+    // Reply: cur_frame_index u16 LE, frame_count u16 LE.
+    function decodeFramePosition(resp) {
+        const r = asResponse(resp);
+        if (!r || !r.ok || r.payload.length < 4) return null;
+        const m = r.payload;
+        return { index: m[0] | (m[1] << 8), frameCount: m[2] | (m[3] << 8) };
+    }
+
+    // get-health (0xCA) — controller health counters (fw #50 soak/post-mortem probe).
+    function encodeGetHealth() {
+        return frame(OPCODES.GET_HEALTH); // 01 CA
+    }
+
+    // Reply payload (schema ver 1, 55 bytes, all little-endian; cumulative counters,
+    // nothing clears on read):
+    //   ver u8 · flags u8 (bit0 sd_mounted, bit1 pattern_open, bit2 display_active,
+    //   bit3 breadcrumb_valid) · uptime_ms u32 · loop_count u32 · loop_max_us u32 ·
+    //   loop_max_1s_us u32 · sd_reads u32 · sd_read_max_us u32 · sd_err u8 ·
+    //   sd_err_data u32 · frames_sent u32 · isr_count u32 · cmd70_count u32 ·
+    //   state u8 · cur_frame u16 · reset_cause u32 (SRC_SRSR at boot) ·
+    //   prev_breadcrumb u8 · prev_breadcrumb_us u32
+    // The breadcrumb is what the PREVIOUS boot was doing when it last wrote it
+    // (survives SYSTEM_RESET 0x01, not a power cycle). Returns null on a bad/short
+    // reply; tolerant of longer payloads — the shipped firmware appends an 11-byte
+    // slowest-op tail (66 B total, decoded below when present).
+    const HEALTH_PAYLOAD_BYTES = 55;
+    const HEALTH_PAYLOAD_BYTES_FULL = 66;
+    const HEALTH_BREADCRUMB_OPS = [
+        'idle',
+        'sd_read',
+        'spi_transfer',
+        'usb_write',
+        'command',
+        'sd_open',
+        // fw fb11681: sub-ops inside handleSetFramePosition (arg = 0x70)
+        'cmd_disarm_timer',
+        'cmd_preload',
+        'cmd_arm_timer',
+        'cmd_respond'
+    ];
+    // ids 4–7 = driver-vector trampolines added by the free-running build (fw eca07f6+): usb = IRQ_USB1,
+    // sdhc = IRQ_SDHC1, lpspi = IRQ_LPSPI3/4, pit = IRQ_PIT (the refresh timer's own interrupt).
+    const HEALTH_ISR_NAMES = [
+        'none',
+        'refresh_timer',
+        'spi_dma',
+        'watchdog',
+        'usb',
+        'sdhc',
+        'lpspi',
+        'pit'
+    ];
+    const HEALTH_PAYLOAD_BYTES_V2 = 89; // fw fb11681: + ISR breadcrumb + RTWDOG pre-reset PC capture
+    const HEALTH_PAYLOAD_BYTES_V3 = 97; // fw 86eeb4a: + raw WDOG3_CS at boot and live
+    const HEALTH_PAYLOAD_BYTES_V4 = 106; // fw 54b57d0: + measured tick rate, live TOVAL, verify bits
+    const HEALTH_PAYLOAD_BYTES_V5 = 114; // fw 4860fef: + WDOG3_CNT around each kick (offset diagnostics)
+    function decodeHealth(resp) {
+        const r = asResponse(resp);
+        if (!r || !r.ok || r.payload.length < HEALTH_PAYLOAD_BYTES) return null;
+        const m = r.payload;
+        let o = 0;
+        const u8 = () => m[o++];
+        const u16 = () => {
+            const v = m[o] | (m[o + 1] << 8);
+            o += 2;
+            return v;
+        };
+        const u32 = () => {
+            const v = (m[o] | (m[o + 1] << 8) | (m[o + 2] << 16) | (m[o + 3] << 24)) >>> 0;
+            o += 4;
+            return v;
+        };
+        const ver = u8();
+        const flags = u8();
+        const h = {
+            ver,
+            flags,
+            sdMounted: !!(flags & 0x01),
+            patternOpen: !!(flags & 0x02),
+            displayActive: !!(flags & 0x04),
+            breadcrumbValid: !!(flags & 0x08),
+            uptimeMs: u32(),
+            loopCount: u32(),
+            loopMaxUs: u32(),
+            loopMax1sUs: u32(),
+            sdReads: u32(),
+            sdReadMaxUs: u32(),
+            sdErr: u8(),
+            sdErrData: u32(),
+            framesSent: u32(),
+            isrCount: u32(),
+            cmd70Count: u32(),
+            state: u8(),
+            curFrame: u16(),
+            resetCause: u32(),
+            prevBreadcrumb: u8(),
+            prevBreadcrumbUs: u32()
+        };
+        h.prevBreadcrumbOp = HEALTH_BREADCRUMB_OPS[h.prevBreadcrumb] || 'op_' + h.prevBreadcrumb;
+        // Additive tail (firmware feat/controller-health, 66 B): a host-commanded
+        // SYSTEM_RESET is itself a dispatched command, so `prevBreadcrumb` after a
+        // 0x01 always reads "command 0x01" — the firmware therefore also keeps
+        // the single SLOWEST op + duration of the previous boot (and of this one).
+        //   prev_breadcrumb_arg u8 (opcode when prev op = command) · prev_slow_op u8 ·
+        //   prev_slow_us u32 · slow_op u8 · slow_us u32
+        if (m.length >= o + 11) {
+            h.prevBreadcrumbArg = u8();
+            h.prevSlowOp = u8();
+            h.prevSlowUs = u32();
+            h.slowOp = u8();
+            h.slowUs = u32();
+            h.prevSlowOpName = HEALTH_BREADCRUMB_OPS[h.prevSlowOp] || 'op_' + h.prevSlowOp;
+            h.slowOpName = HEALTH_BREADCRUMB_OPS[h.slowOp] || 'op_' + h.slowOp;
+        }
+        // ver 2 tail (fw fb11681): which ISR the previous boot was inside when it
+        // died, the stacked PC/LR captured by the watchdog's pre-reset IRQ, and the
+        // watchdog state of this boot. Offsets 0–65 are unchanged.
+        if (m.length >= HEALTH_PAYLOAD_BYTES_V2) {
+            h.prevIsrLast = u8();
+            h.prevIsrLastName = HEALTH_ISR_NAMES[h.prevIsrLast] || 'isr_' + h.prevIsrLast;
+            h.prevIsrCount = u32();
+            h.prevWdogPc = u32();
+            h.prevWdogLr = u32();
+            h.wdogFlags = u8();
+            h.isrLast = u8();
+            h.isrLastName = HEALTH_ISR_NAMES[h.isrLast] || 'isr_' + h.isrLast;
+            h.isrCount = u32();
+            h.wdogKicks = u32();
+            h.wdogArmed = !!(h.wdogFlags & 0x01);
+            h.prevResetWasWatchdog = !!(h.wdogFlags & 0x02);
+            h.prevPcCaptured = !!(h.wdogFlags & 0x04);
+            h.wdogCompiledIn = !!(h.wdogFlags & 0x08);
+            h.wdogSuspended = !!(h.wdogFlags & 0x10);
+            h.wdogStarving = !!(h.wdogFlags & 0x20);
+            h.wdogConfigFailed = !!(h.wdogFlags & 0x40);
+            h.prevWdogPcHex = h.prevPcCaptured
+                ? '0x' + h.prevWdogPc.toString(16).padStart(8, '0')
+                : null;
+            h.prevWdogLrHex = h.prevPcCaptured
+                ? '0x' + h.prevWdogLr.toString(16).padStart(8, '0')
+                : null;
+        }
+        // ver 3 tail (fw 86eeb4a): the RTWDOG control register as read at boot (reset
+        // default, expected 0x2520) and live — the hardware's own word on whether the
+        // watchdog is enabled (CS bit 7 EN), independent of the firmware's flags.
+        if (m.length >= HEALTH_PAYLOAD_BYTES_V3) {
+            h.wdogCsBoot = u32();
+            h.wdogCsNow = u32();
+            h.wdogCsBootHex = '0x' + h.wdogCsBoot.toString(16);
+            h.wdogCsNowHex = '0x' + h.wdogCsNow.toString(16);
+            h.wdogHwEnabled = !!(h.wdogCsNow & 0x80);
+            h.wdogHwInt = !!(h.wdogCsNow & 0x40);
+            h.wdogHwUpdate = !!(h.wdogCsNow & 0x20);
+            h.wdogHwRcs = !!(h.wdogCsNow & 0x400);
+            h.wdogHwCmd32 = !!(h.wdogCsNow & 0x2000);
+        }
+        // ver 4 tail (fw 54b57d0): the RTWDOG clock is measured at boot (128 kHz/256
+        // ≈ 500 Hz on this silicon, not the 125 Hz the datasheet's LPO implies) and
+        // TOVAL derived from it; `wdogVerify` bits explain any config complaint.
+        if (m.length >= HEALTH_PAYLOAD_BYTES_V4) {
+            h.wdogTickHz = u32();
+            h.wdogTovalNow = u32();
+            h.wdogVerify = u8();
+            h.wdogTimeoutS = h.wdogTickHz
+                ? Math.round((h.wdogTovalNow / h.wdogTickHz) * 100) / 100
+                : null;
+            h.wdogVerifyRcsTimeout = !!(h.wdogVerify & 0x01);
+            h.wdogVerifyEnMismatch = !!(h.wdogVerify & 0x02);
+            h.wdogVerifyTovalMismatch = !!(h.wdogVerify & 0x04);
+            h.wdogVerifyTickFallback = !!(h.wdogVerify & 0x08);
+            h.wdogVerifyKeyRetry = !!(h.wdogVerify & 0x10);
+        }
+        // ver 5 tail (fw 4860fef): WDOG3_CNT read before/after each refresh (min/max since
+        // boot) and live — settles whether the ~190-tick expiry offset is a comparator
+        // constant, a non-zero refresh base, or refreshes being ignored.
+        if (m.length >= HEALTH_PAYLOAD_BYTES_V5) {
+            h.wdogCntBeforeMax = u16();
+            h.wdogCntAfterMin = u16();
+            h.wdogCntAfterMax = u16();
+            h.wdogCntNow = u16();
+        }
+        return h;
+    }
+
+    // get-crashreport (0xCC, fw fb11681) — raw top 128 B of OCRAM: PJRC's
+    // arm_fault_info_struct {len, ipsr, cfsr, hfsr, mmfar, bfar, ret_addr, xpsr,
+    // temp f32, time, crc} (44 B) written by the core's fault handler, then PJRC's
+    // own breadcrumb words at +0x40. Never cleared by the read. Gate on the 0xCB
+    // telemetry flag (bit 2) like 0xA8/0xA9 — older firmware glyphs on it.
+    function encodeGetCrashReport() {
+        return frame(OPCODES.GET_CRASHREPORT); // 01 CC
+    }
+    const CRASHREPORT_PAYLOAD_BYTES = 128;
+    function decodeCrashReport(resp) {
+        const r = asResponse(resp);
+        if (!r || !r.ok || r.payload.length < 44) return null;
+        const m = r.payload;
+        const dv = new DataView(m.buffer, m.byteOffset, m.byteLength);
+        const u = (o) => dv.getUint32(o, true);
+        const c = {
+            len: u(0),
+            ipsr: u(4),
+            cfsr: u(8),
+            hfsr: u(12),
+            mmfar: u(16),
+            bfar: u(20),
+            retAddr: u(24),
+            xpsr: u(28),
+            tempC: dv.getFloat32(32, true),
+            time: u(36),
+            crc: u(40),
+            rawHex: Array.from(m)
+                .map((b) => b.toString(16).padStart(2, '0'))
+                .join('')
+        };
+        // PJRC's fault handler stores len = sizeof(struct)/4 = 11 WORDS (startup.c),
+        // and isvalid() checks that plus a CRC (the core's private detail). We check
+        // the length (accepting a byte count too, defensively) and decode the fault
+        // bits so a reader does not need the datasheet.
+        c.present = (c.len === 11 || c.len === 44) && c.ipsr !== 0;
+        c.faultName =
+            c.ipsr === 3
+                ? 'HardFault'
+                : c.ipsr === 4
+                  ? 'MemManage'
+                  : c.ipsr === 5
+                    ? 'BusFault'
+                    : c.ipsr === 6
+                      ? 'UsageFault'
+                      : c.ipsr
+                        ? 'exception_' + c.ipsr
+                        : null;
+        c.retAddrHex = '0x' + c.retAddr.toString(16).padStart(8, '0');
+        if (m.length >= 0x40 + 4) {
+            c.pjrcBreadcrumbMask = u(0x40);
+            c.pjrcBreadcrumbs = [];
+            for (let i = 0; i < 6 && 0x44 + i * 4 + 4 <= m.length; i++)
+                c.pjrcBreadcrumbs.push(u(0x44 + i * 4));
+        }
+        return c;
+    }
+
+    // get-firmware-version (0xCB) — the controller's BUILD identity, compiled in
+    // by the firmware's PlatformIO pre-script. Ships with GET_HEALTH; older
+    // firmware answers an unknown opcode with an error GLYPH on the arena, so
+    // hosts must gate this on capability bit 7 (`health`).
+    function encodeGetFirmwareVersion() {
+        return frame(OPCODES.GET_FIRMWARE_VERSION); // 01 CB
+    }
+    // Payload (46 B): ver u8 · rows u8 · cols u8 · flags u8 (bit0 dirty tree,
+    // bit1 DEBUG_SERIAL build) · sha[8] ASCII · date[10] "YYYY-MM-DD" · branch[24]
+    // ASCII, space/NUL padded. `label` is the one-line form the Studio records in
+    // run_metadata.firmware, e.g. "06a6f25 2x10 2026-09-12 feat/controller-health".
+    const FIRMWARE_VERSION_PAYLOAD_BYTES = 46;
+    function decodeFirmwareVersion(resp) {
+        const r = asResponse(resp);
+        if (!r || !r.ok || r.payload.length < FIRMWARE_VERSION_PAYLOAD_BYTES) return null;
+        const m = r.payload;
+        const ascii = (from, len) =>
+            Array.from(m.subarray(from, from + len))
+                .map((b) => (b >= 0x20 && b < 0x7f ? String.fromCharCode(b) : ''))
+                .join('')
+                .trim();
+        const v = {
+            ver: m[0],
+            rows: m[1],
+            cols: m[2],
+            flags: m[3],
+            dirty: !!(m[3] & 0x01),
+            debug: !!(m[3] & 0x02),
+            telemetry: !!(m[3] & 0x04), // ring buffer (0xA8/0xA9) present — the ONLY gate for SET_TELEMETRY
+            crashReport: !!(m[3] & 0x08), // GET_CRASHREPORT 0xCC + GET_HEALTH ver 2 (fw fb11681+): the ONLY gate for 0xCC
+            freeRunningTimer: !!(m[3] & 0x10), // fw eca07f6+: SET_FRAME_POSITION never disarms/re-arms the refresh timer
+            sha: ascii(4, 8),
+            date: ascii(12, 10),
+            branch: ascii(22, 24)
+        };
+        v.arena = v.rows + 'x' + v.cols;
+        v.label =
+            (v.sha || 'unknown') +
+            (v.dirty ? '*' : '') +
+            ' ' +
+            v.arena +
+            ' ' +
+            (v.date || '?') +
+            (v.branch ? ' ' + v.branch : '') +
+            (v.debug ? ' (debug)' : '') +
+            (v.freeRunningTimer ? ' freerun' : '');
+        return v;
+    }
+
+    // Telemetry ring (fw feat/telemetry-ring; proposal § 3.1). Requests only —
+    // block/record DECODING lives in js/arena-telemetry.js (it owns the record
+    // schema, seq/drop accounting and the compact log rows).
+    function encodeSetTelemetry(flags, rateHz) {
+        const f = u8(flags == null ? 1 : flags, 'flags');
+        const r = rateHz == null ? 0 : rateHz;
+        return frame(OPCODES.SET_TELEMETRY, [f].concat(u16le(r, 'rateHz'))); // 04 A8 flags lo hi
+    }
+    // ack_seq: highest record seq the host has safely stored (freed on the
+    // controller); 0xFFFFFFFF = no ack. max_bytes: cap on returned record bytes
+    // (the firmware also caps at ~180 so the reply stays one framed message).
+    const TELEMETRY_NO_ACK = 0xffffffff;
+    function encodeGetTelemetryBlock(ackSeq, maxBytes, flags) {
+        const a = ackSeq == null ? TELEMETRY_NO_ACK : ackSeq >>> 0;
+        const m = maxBytes == null ? 180 : maxBytes;
+        requireInt(m, 'maxBytes');
+        if (m < 0 || m > 0xffff) throw new RangeError('maxBytes out of range: ' + m);
+        return frame(
+            OPCODES.GET_TELEMETRY_BLOCK,
+            [a & 0xff, (a >>> 8) & 0xff, (a >>> 16) & 0xff, (a >>> 24) & 0xff].concat(
+                u16le(m, 'maxBytes'),
+                [u8(flags || 0, 'flags')]
+            )
+        ); // 08 A9 a0 a1 a2 a3 m_lo m_hi flags
+    }
+
     // get-frames-sent (0x33) reply carries the master-sent count as uint32 LE.
     function decodeFramesSent(resp) {
         const r = asResponse(resp);
@@ -859,6 +1189,12 @@ const ArenaWireG6 = (function () {
         encodeGetControllerInfo,
         // Alias under the name the handoff lists for the get-info request.
         getControllerInfo: encodeGetControllerInfo,
+        encodeGetHealth,
+        encodeGetFramePosition,
+        encodeGetFirmwareVersion,
+        encodeSetTelemetry,
+        encodeGetTelemetryBlock,
+        TELEMETRY_NO_ACK,
         encodeGetFileCount,
         encodeGetPatternFilename,
         encodeGetPatternInfo,
@@ -886,6 +1222,21 @@ const ArenaWireG6 = (function () {
         // Decoders
         decodeResponse,
         decodeControllerInfo,
+        decodeHealth,
+        decodeFramePosition,
+        decodeFirmwareVersion,
+        FIRMWARE_VERSION_PAYLOAD_BYTES,
+        HEALTH_PAYLOAD_BYTES,
+        HEALTH_PAYLOAD_BYTES_FULL,
+        HEALTH_PAYLOAD_BYTES_V2,
+        HEALTH_PAYLOAD_BYTES_V3,
+        HEALTH_PAYLOAD_BYTES_V4,
+        HEALTH_PAYLOAD_BYTES_V5,
+        HEALTH_BREADCRUMB_OPS,
+        HEALTH_ISR_NAMES,
+        encodeGetCrashReport,
+        decodeCrashReport,
+        CRASHREPORT_PAYLOAD_BYTES,
         decodeSpiClock,
         decodeRefreshRate,
         decodePanelDisplayMode,
diff --git a/js/fictrac-bridge-client.js b/js/fictrac-bridge-client.js
index 858d77c4..1df3930a 100644
--- a/js/fictrac-bridge-client.js
+++ b/js/fictrac-bridge-client.js
@@ -69,7 +69,8 @@
         'blocked',
         'apply',
         'log',
-        'loglevel'
+        'loglevel',
+        'fault'
     ];
     // Log levels this client knows how to request, most-preferred first. The
     // bridge advertises ITS list in hello_ack; a level missing there is one the
@@ -111,6 +112,20 @@
             this._rateHz = 0;
             this._rateTimer = null;
             this._lastBlockedMs = 0;
+            // Fault detector (firmware #50 — the Mode-3 controller wedge). The
+            // apply loop used to swallow every 0x70 timeout and keep spinning at
+            // 2 Hz for the rest of the run, so a wedged controller produced a
+            // "completed" run. Now a rolling window of apply outcomes trips a
+            // latched fault once `faultThreshold` of the last `faultWindow`
+            // applies failed ("≥3 of 10", not "3 consecutive": a late reply to
+            // an earlier 0x70 can satisfy the next request and reset a
+            // consecutive counter). On fault: apply is forced OFF (fail closed)
+            // and a 'fault' event fires — ArenaSession routes it to the runner.
+            this._faultThreshold = Number.isInteger(o.faultThreshold) ? o.faultThreshold : 3;
+            this._faultWindow = Number.isInteger(o.faultWindow) ? o.faultWindow : 10;
+            this._applyOutcomes = []; // most recent apply results, 1 = failed, 0 = ok
+            this._applyFailures = 0; // total failed applies (timeouts, rejects, link errors)
+            this._fault = null; // latched fault record, or null
 
             // Bridge config (mirrors the console inputs). Sent on connect + on change.
             // logLevel is the log format requested when logging starts
@@ -170,10 +185,50 @@
                 recv: this._recv,
                 applied: this._applied,
                 drop: Math.max(0, this._recv - this._applied),
-                rateHz: this._rateHz
+                rateHz: this._rateHz,
+                applyFailures: this._applyFailures,
+                fault: this._fault
             };
         }
 
+        /** The latched fault record ({kind, failures, window, …}) or null. */
+        get fault() {
+            return this._fault;
+        }
+
+        /** Clear the fault latch + outcome window (a new run / apply session starts clean). */
+        resetFaultWindow() {
+            this._applyOutcomes = [];
+            this._fault = null;
+        }
+
+        // Record one apply outcome; trip the fault latch when the window fills
+        // with failures. Fail closed: apply goes OFF before anyone is told.
+        _recordApply(failed, err, index) {
+            const w = this._applyOutcomes;
+            w.push(failed ? 1 : 0);
+            if (w.length > this._faultWindow) w.shift();
+            if (!failed) return;
+            this._applyFailures++;
+            if (this._fault) return;
+            const n = w.reduce((a, b) => a + b, 0);
+            if (n < this._faultThreshold) return;
+            this._fault = {
+                kind: 'controller_unresponsive',
+                failures: n,
+                window: w.length,
+                threshold: this._faultThreshold,
+                lastIndex: index,
+                lastError: err ? err.message || String(err) : null,
+                t: this._now()
+            };
+            if (this._apply) {
+                this._apply = false;
+                this._emit('apply', false);
+            }
+            this._emit('fault', this._fault);
+        }
+
         // ---- connection ------------------------------------------------------
         /**
          * Open the bridge WebSocket. Idempotent: if already open, does nothing.
@@ -297,6 +352,7 @@
         setApply(on) {
             const next = !!on;
             const changed = next !== this._apply;
+            if (changed && next) this.resetFaultWindow(); // a fresh apply session starts clean
             this._apply = next;
             if (changed) this._emit('apply', this._apply);
         }
@@ -437,6 +493,24 @@
             }
         }
 
+        /**
+         * Compact array rows for the run log (controller telemetry streams
+         * "cc"/"cf"/"cs" from js/arena-telemetry.js). The bridge writes each row
+         * verbatim as one NDJSON line — same shape as the behavior_v2 ["a", …]
+         * arena echoes, so readers dispatch on Array.isArray + row[0]. Needs
+         * bridge ≥ 3.1 (a 3.0 bridge writes the whole message as one verbatim
+         * object instead). Returns false when NOT logging/connected, so the caller
+         * (the telemetry drainer) withholds its ack and the controller keeps the rows.
+         * @param {Array<Array>} rows
+         * @returns {boolean} accepted
+         */
+        logRows(rows) {
+            if (!Array.isArray(rows) || !rows.length) return true;
+            if (!(this._logging && this.connected)) return false; // not stored — caller keeps them
+            this._send({ type: 'rows', rows });
+            return true;
+        }
+
         /**
          * Ask the bridge for the current/most-recent log file (log_export →
          * log_export_result). The bridge CLOSES the active log first, so call
@@ -541,15 +615,32 @@
             this._inFlight = true;
             try {
                 while (this._pending != null && this._apply && this._canApply()) {
-                    const i = this._clampFrame(this._pending);
+                    // #199: the bridge applies a new `frames` modulus one frame late
+                    // (its config message is async), so the first index after a
+                    // trial change can carry the PREVIOUS pattern's modulus →
+                    // "index out of range" + an error glyph on the arena. Wrap
+                    // locally into the configured range first; the consumer's
+                    // clampFrame still runs after. Now that controller rejects count
+                    // toward the fault window, this also keeps short alternating
+                    // trials from tripping a false CONTROLLER_FAULT.
+                    let idx = this._pending;
+                    const n = this._config.frames;
+                    if (Number.isFinite(n) && n > 0 && Number.isFinite(idx)) {
+                        idx = ((Math.round(idx) % n) + n) % n;
+                    }
+                    const i = this._clampFrame(idx);
                     this._pending = null;
                     try {
                         await this._applyFrame(i);
                         this._applied++;
+                        this._recordApply(false, null, i);
                         this._emit('applied', i);
                         this._emit('stats', this.stats);
                     } catch (e) {
                         this._emit('log', 'bridge apply failed: ' + (e && (e.message || e)), 'err');
+                        // Counted, not swallowed (fw #50): enough failures in the
+                        // window latch a fault and stop the loop (apply → false).
+                        this._recordApply(true, e, i);
                     }
                 }
             } finally {
diff --git a/js/run-log.js b/js/run-log.js
index c688f7aa..d568e8b3 100644
--- a/js/run-log.js
+++ b/js/run-log.js
@@ -49,6 +49,7 @@
     function deriveOutcome(summary, override) {
         if (override) return override;
         if (!summary) return 'UNKNOWN';
+        if (summary.fault) return 'CONTROLLER_FAULT'; // controller stopped answering (fw #50)
         if (summary.aborted) return 'ABORTED_BY_USER';
         if (summary.errors > 0) return 'ERRORED';
         if (summary.completed) return 'COMPLETED';
@@ -141,6 +142,13 @@
                 );
             case 'error':
                 return stamp + '   ' + where + 'ERROR ' + (ev.reason || '');
+            case 'fault':
+                return (
+                    stamp +
+                    '⚠ FAULT ' +
+                    (ev.reason || 'controller_unresponsive') +
+                    (ev.detail && ev.detail.lastError ? ' — ' + ev.detail.lastError : '')
+                );
             case 'step-done':
                 return stamp + '   ' + where + 'done';
             case 'sequence-complete':
diff --git a/js/runlog-replay.js b/js/runlog-replay.js
index 89db6dc5..39e60b5b 100644
--- a/js/runlog-replay.js
+++ b/js/runlog-replay.js
@@ -314,6 +314,11 @@
                 }
                 continue;
             }
+            // Tagged stream rows (["cc"|"cf"|"cs", ...] controller telemetry, or any
+            // future string-tagged stream) are NOT behavior samples — only "a" is
+            // decoded (above). Review finding: they used to become samples with a
+            // hex string as heading.
+            if (Array.isArray(o) && typeof o[0] === 'string') continue;
             // behavior_v1/v2 positional row: [ms, fc, idx, ft, x, y, hd] (ft already ms)
             if (Array.isArray(o)) {
                 sawBehaviorV1 = true;
diff --git a/js/studio-postmortem.js b/js/studio-postmortem.js
new file mode 100644
index 00000000..cd574e3d
--- /dev/null
+++ b/js/studio-postmortem.js
@@ -0,0 +1,542 @@
+/**
+ * studio-postmortem.js — the controller-fault lifecycle for the Arena Studio
+ * (firmware issue #50: the Mode-3 wedge). One place that knows what to do once
+ * the session/runner have declared `controller_unresponsive`:
+ *
+ *   quiet period → confirmation probe → probe window → policy (halt | reset →
+ *   reconnect → verify identity → post-reset probe)
+ *
+ * Every probe goes through `session.send` (so it is an ordinary `arena_command`
+ * row in the run log, with a LONG timeout so the degraded round trip is measured
+ * instead of cut off at 500 ms) AND is written as a typed `probe` event with the
+ * decoded reply + raw hex, because the compact `["a", …]` rows carry no payload.
+ *
+ * Pure orchestration: no DOM. Injected `session`, `wire`, `now`, `sleep`, `log`
+ * make it testable in Node. Classic dual-export (window global + CommonJS), no
+ * bare ES `export` — loaded by the Studio's classic layer.
+ */
+(function (global) {
+    'use strict';
+
+    const DEFAULTS = {
+        quietMs: 1000, // ≥ one 0x70 timeout window: let a late reply land, then flush rx
+        confirmTimeoutMs: 2000,
+        probeTimeoutMs: 5000,
+        probeWindowMs: 60000, // sample the degraded controller for a minute
+        probeEveryMs: 2000,
+        resetTimeoutMs: 3000,
+        resetSettleMs: 3000, // SYSRESETREQ → re-enumeration
+        reconnectTimeoutMs: 15000,
+        degradedDtMs: 50 // a reply slower than this counts as "degraded" in summaries
+    };
+
+    const hex = (u8) =>
+        u8 && u8.length
+            ? Array.from(u8)
+                  .map((b) => b.toString(16).padStart(2, '0'))
+                  .join('')
+            : '';
+
+    /**
+     * The probe set. `sd:true` marks commands that touch the card (the
+     * hypothesis ladder separates SD-touching from RAM-only replies).
+     * `cap` gates a probe on a 0xC2 capability name.
+     */
+    function probeSet(W) {
+        const list = [
+            {
+                name: 'controller_info',
+                enc: () => W.encodeGetControllerInfo(),
+                dec: W.decodeControllerInfo
+            },
+            { name: 'frames_sent', enc: () => W.encodeGetFramesSent(), dec: W.decodeFramesSent },
+            {
+                name: 'frame_position',
+                enc: () => W.encodeGetFramePosition(),
+                dec: W.decodeFramePosition
+            },
+            { name: 'health', enc: () => W.encodeGetHealth(), dec: W.decodeHealth, cap: 'health' },
+            // Build identity — so a post-mortem (and the post-reset probe) records
+            // WHICH firmware wedged. Same capability gate as health.
+            {
+                name: 'firmware_version',
+                enc: () => W.encodeGetFirmwareVersion(),
+                dec: W.decodeFirmwareVersion,
+                cap: 'health'
+            },
+            {
+                name: 'pattern_info_1',
+                enc: () => W.encodeGetPatternInfo(1),
+                dec: W.decodePatternInfo,
+                sd: true,
+                optional: true
+            },
+            // 0xE3 reads /firmware/panel.bin's footer: status 1 ("no image") is
+            // the normal answer on a card without a panel image — we want its
+            // LATENCY (SD.open + seek + read), not its payload.
+            {
+                name: 'firmware_info',
+                enc: () => W.encodeGetFirmwareInfo(),
+                dec: W.decodeFirmwareInfo,
+                sd: true,
+                optional: true
+            }
+        ];
+        return list.filter((p) => typeof p.enc === 'function');
+    }
+
+    /**
+     * @param {object} deps
+     * @param {object} deps.session   ArenaSession-like: send(bytes,{timeoutMs}), connected,
+     *                                bridge (.logging/.log), flushRx(), reconnect(opts)
+     * @param {object} deps.wire      ArenaWireG6
+     * @param {function} [deps.log]   (msg, kind) → Console/rawLog line
+     * @param {function} [deps.now]   monotonic ms clock (default performance.now / Date.now)
+     * @param {function} [deps.sleep] (ms) → Promise (default setTimeout)
+     * @param {object} [deps.opts]    overrides for DEFAULTS
+     */
+    function createPostmortem(deps) {
+        const session = deps.session;
+        const W = deps.wire;
+        const opts = Object.assign({}, DEFAULTS, deps.opts || {});
+        const now =
+            deps.now ||
+            (typeof performance !== 'undefined' && performance.now
+                ? () => performance.now()
+                : () => Date.now());
+        const sleep = deps.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));
+        const say = deps.log || (() => {});
+        let aborted = false;
+
+        // One typed row into the bridge log (the durable record) + the Console.
+        function record(ev) {
+            const row = Object.assign({ event: 'probe' }, ev);
+            try {
+                if (
+                    session.bridge &&
+                    session.bridge.logging &&
+                    typeof session.bridge.log === 'function'
+                ) {
+                    session.bridge.log(row);
+                }
+            } catch (_) {
+                /* logging must never break the lifecycle */
+            }
+            return row;
+        }
+
+        async function sendProbe(p, phase, caps) {
+            // No blind probes: a capability-gated opcode is sent only when the
+            // capability was POSITIVELY read (unknown opcodes put an error glyph
+            // on the arena). caps == null (0xC2 timed out) ⇒ skip, recorded.
+            if (p.cap && (!caps || !caps.includes(p.cap))) {
+                // Recorded, so the log shows what was deliberately NOT sent.
+                return record({
+                    name: p.name,
+                    phase,
+                    skipped: caps ? 'capability ' + p.cap + ' absent' : 'capabilities unknown'
+                });
+            }
+            let bytes;
+            try {
+                bytes = p.enc();
+            } catch (e) {
+                return { name: p.name, skipped: 'encoder: ' + (e && e.message) };
+            }
+            const t0 = now();
+            const out = { name: p.name, phase, cmd: bytes[1], req: hex(bytes), sd: !!p.sd };
+            if (p.optional) out.optional = true; // status≠0 is an expected answer, not a failure
+            try {
+                const resp = await session.send(bytes, { timeoutMs: opts.probeTimeoutMs });
+                out.dt = Math.round(now() - t0);
+                out.resp = hex(resp);
+                const d = W.decodeResponse(resp);
+                out.status = d ? d.status : null;
+                out.ok = !!(d && d.ok);
+                try {
+                    const decoded = p.dec ? p.dec(resp) : null;
+                    if (decoded !== null && decoded !== undefined) out.decoded = decoded;
+                } catch (_) {
+                    /* undecodable payload — the raw hex is still recorded */
+                }
+            } catch (e) {
+                out.dt = Math.round(now() - t0);
+                out.status = null;
+                out.ok = null;
+                out.error = (e && e.message) || String(e);
+            }
+            record(out);
+            return out;
+        }
+
+        function summarize(results) {
+            const answered = results.filter(
+                (r) => r.ok !== null && r.ok !== undefined && !r.skipped
+            );
+            const timeouts = results.filter((r) => r.error && /timeout/i.test(r.error)).length;
+            const errors = results.filter(
+                (r) => r.error && !/timeout/i.test(r.error) && !r.skipped
+            ).length;
+            const skipped = results.filter((r) => r.skipped).length;
+            const failedRequired = answered.filter((r) => r.ok === false && !r.optional).length;
+            const dts = answered.map((r) => r.dt).filter((v) => Number.isFinite(v));
+            const max = dts.length ? Math.max.apply(null, dts) : null;
+            const sdDts = answered.filter((r) => r.sd).map((r) => r.dt);
+            const ramDts = answered.filter((r) => !r.sd).map((r) => r.dt);
+            const med = (a) => {
+                if (!a.length) return null;
+                const s = a.slice().sort((x, y) => x - y);
+                return s[Math.floor(s.length / 2)];
+            };
+            return {
+                probes: results.length,
+                answered: answered.length,
+                timeouts,
+                errors,
+                skipped,
+                failedRequired,
+                maxDt: max,
+                medianDtSd: med(sdDts),
+                medianDtRam: med(ramDts),
+                degraded: max !== null && max > opts.degradedDtMs,
+                unresponsive: answered.length === 0 && results.some((r) => !r.skipped)
+            };
+        }
+
+        /** Stop an in-progress lifecycle at the next step boundary (operator STOP). */
+        function abort() {
+            aborted = true;
+        }
+
+        /**
+         * Quiet period + rx flush: with no request id on the wire, a late reply
+         * to an earlier 0x70 would otherwise be taken as the answer to the first
+         * probe. Nothing is sent for `quietMs`, then buffered bytes are dropped.
+         */
+        async function quiet(ms) {
+            await sleep(ms || opts.quietMs);
+            const n = typeof session.flushRx === 'function' ? session.flushRx() : 0;
+            record({ phase: 'quiet', quietMs: ms || opts.quietMs, flushedBytes: n });
+            return n;
+        }
+
+        /** Confirmation: one 0xC2 with a generous timeout. Resolves {confirmed, result}. */
+        async function confirm() {
+            const t0 = now();
+            const out = { name: 'controller_info', phase: 'confirm', cmd: 0xc2, req: '01c2' };
+            let confirmed = false;
+            let caps = null;
+            let mac = null;
+            try {
+                const resp = await session.send(W.encodeGetControllerInfo(), {
+                    timeoutMs: opts.confirmTimeoutMs
+                });
+                out.dt = Math.round(now() - t0);
+                out.resp = hex(resp);
+                const d = W.decodeResponse(resp);
+                out.status = d ? d.status : null;
+                out.ok = !!(d && d.ok);
+                const info = W.decodeControllerInfo(resp);
+                if (info) {
+                    out.decoded = info;
+                    caps = info.capabilities || [];
+                    mac = info.mac || null;
+                }
+                // A reply that took longer than the normal 0x70 timeout is still a
+                // wedge (a healthy controller answers 0xC2 in ~2 ms); only a fast,
+                // ok reply clears the suspicion.
+                confirmed = !(out.ok && out.dt < opts.degradedDtMs);
+            } catch (e) {
+                out.dt = Math.round(now() - t0);
+                out.status = null;
+                out.ok = null;
+                out.error = (e && e.message) || String(e);
+                confirmed = true;
+            }
+            record(out);
+            return { confirmed, result: out, caps, mac };
+        }
+
+        /** One pass over the probe set. */
+        async function probeOnce(phase, caps) {
+            const results = [];
+            for (const p of probeSet(W)) {
+                if (aborted) break;
+                results.push(await sendProbe(p, phase || 'probe', caps));
+            }
+            return results;
+        }
+
+        /** Repeated passes for `windowMs` (default probeWindowMs), every probeEveryMs. */
+        async function probeWindow(caps, windowMs) {
+            const end = now() + (windowMs != null ? windowMs : opts.probeWindowMs);
+            const all = [];
+            let pass = 0;
+            do {
+                if (aborted) break;
+                // A link drop mid-window = the controller rebooted (hardware watchdog):
+                // stop probing a port that is gone; run() takes the self-reset path.
+                if (!session.connected && typeof session.reconnect === 'function') {
+                    record({ phase: 'window-link-dropped', passes: pass });
+                    break;
+                }
+                const r = await probeOnce('window', caps);
+                r.forEach((x) => (x.pass = pass));
+                all.push.apply(all, r);
+                pass++;
+                if (now() >= end) break;
+                await sleep(opts.probeEveryMs);
+            } while (now() < end && !aborted);
+            const summary = summarize(all);
+            record({ phase: 'window-summary', passes: pass, summary });
+            return { results: all, summary, passes: pass };
+        }
+
+        /**
+         * The reset experiment: SYSTEM_RESET 0x01 (ack then SYSRESETREQ), settle,
+         * reconnect from the granted ports, verify it is the SAME controller by
+         * MAC, then the post-reset probe — whose `health.prevBreadcrumb` /
+         * `resetCause` are the payload of the whole exercise.
+         * @param {object} a {expectMac?: string}
+         */
+        async function resetAndReconnect(a) {
+            a = a || {};
+            const out = { phase: 'reset', steps: [], selfReset: !!a.skipReset };
+            const t0 = now();
+            if (a.skipReset) {
+                // The controller rebooted on its own (hardware watchdog, fw fb11681):
+                // the link dropped, nothing to send — go straight to reconnect and
+                // the evidence-first sequence below.
+                out.resetAck = null;
+                record(Object.assign({ name: 'self_reset' }, out));
+                say(
+                    'link dropped after the fault — controller reset itself (watchdog?); reconnecting',
+                    'warn'
+                );
+            } else {
+                try {
+                    const resp = await session.send(W.encodeSystemReset(), {
+                        timeoutMs: opts.resetTimeoutMs
+                    });
+                    const d = W.decodeResponse(resp);
+                    out.resetAck = !!(d && d.ok);
+                    out.resetDt = Math.round(now() - t0);
+                } catch (e) {
+                    out.resetAck = false;
+                    out.resetDt = Math.round(now() - t0);
+                    out.resetError = (e && e.message) || String(e);
+                }
+                record(Object.assign({ name: 'system_reset' }, out));
+                say(
+                    'SYSTEM_RESET sent (' +
+                        (out.resetAck ? 'acked' : 'no ack') +
+                        ') — waiting for re-enumeration',
+                    'warn'
+                );
+                await sleep(opts.resetSettleMs);
+            }
+            const t1 = now();
+            try {
+                await session.reconnect({ timeoutMs: opts.reconnectTimeoutMs });
+                out.reconnected = true;
+                out.reconnectDt = Math.round(now() - t1);
+            } catch (e) {
+                out.reconnected = false;
+                out.reconnectDt = Math.round(now() - t1);
+                out.reconnectError = (e && e.message) || String(e);
+                record(Object.assign({ name: 'reconnect' }, out));
+                return out;
+            }
+            // Identity check — VID/PID names a product, the MAC names the unit.
+            const c = await confirm();
+            out.mac = c.mac;
+            // Identity must be POSITIVE: a decoded 0xC2 reply, and — when the unit's
+            // MAC is known — the same MAC. A missing reply or a MAC-less reply is
+            // NOT "ok" (review finding: it used to pass).
+            // (confirm()'s `confirmed` means "wedge confirmed" — here we need the
+            // opposite: a decoded, ok controller_info reply.)
+            const answered = !!(c.result && c.result.ok && c.result.decoded);
+            if (!answered) {
+                out.identityOk = false;
+                out.identityError = 'no controller_info reply after reset';
+            } else if (a.expectMac && c.mac !== a.expectMac) {
+                out.identityOk = false;
+                out.identityError =
+                    'reconnected to ' + (c.mac || '(no MAC)') + ', expected ' + a.expectMac;
+            } else {
+                out.identityOk = true;
+            }
+            if (!out.identityOk) say('⚠ ' + out.identityError, 'err');
+            // EVIDENCE FIRST (review finding): read the breadcrumb + drain the ring
+            // BEFORE any SD-touching probe re-enters the suspected failure path.
+            out.health = await sendProbe(
+                {
+                    name: 'health',
+                    enc: () => W.encodeGetHealth(),
+                    dec: W.decodeHealth,
+                    cap: 'health'
+                },
+                'post-reset-first',
+                c.caps
+            );
+            if (typeof deps.afterReconnect === 'function') {
+                try {
+                    out.telemetry = await deps.afterReconnect(out);
+                    record({
+                        phase: 'telemetry-dump',
+                        name: 'ring',
+                        summary: out.telemetry || null
+                    });
+                } catch (e) {
+                    out.telemetryError = (e && e.message) || String(e);
+                }
+            }
+            out.post = await probeOnce('post-reset', c.caps);
+            out.postSummary = summarize(out.post);
+            const h = out.post.find((r) => r.name === 'health' && r.decoded);
+            if (h) {
+                out.prevBreadcrumb = h.decoded.prevBreadcrumbOp;
+                out.resetCause = h.decoded.resetCause;
+            }
+            record(Object.assign({ name: 'reconnect' }, out));
+            return out;
+        }
+
+        /**
+         * The whole lifecycle after a declared fault.
+         * @param {object} a {policy: 'halt'|'reset-continue', expectMac?, windowMs?, faultDetail?}
+         * @returns {Promise<object>} {confirmed, window, reset?, outcome}
+         */
+        async function selfResetPath(a, policy, c) {
+            const reset = await resetAndReconnect({
+                expectMac: a.expectMac || (c && c.mac) || null,
+                skipReset: true
+            });
+            const ps = reset.postSummary;
+            const recovered = !!(
+                reset.reconnected &&
+                reset.identityOk &&
+                ps &&
+                !ps.degraded &&
+                ps.answered > 0 &&
+                ps.timeouts === 0 &&
+                ps.failedRequired === 0 &&
+                ps.errors === 0
+            );
+            const outcome = recovered ? 'self-reset' : 'self-reset-failed';
+            record({ phase: 'end', outcome, policy, selfReset: true });
+            say(
+                recovered
+                    ? 'controller came back after resetting itself (prev breadcrumb: ' +
+                          (reset.prevBreadcrumb || '?') +
+                          ')'
+                    : 'controller reset itself but did NOT come back healthy — halting',
+                recovered ? 'warn' : 'err'
+            );
+            return { confirmed: true, selfReset: true, reset, outcome, recovered };
+        }
+
+        async function run(a) {
+            a = a || {};
+            aborted = false;
+            const policy = a.policy === 'reset-continue' ? 'reset-continue' : 'halt';
+            record({ phase: 'begin', policy, fault: a.faultDetail || null });
+            await quiet();
+            // Hardware-watchdog world (fw fb11681): a hung controller resets itself
+            // ~2 s after the hang and re-enumerates, so the link drops right about
+            // now. That is a self-reset, not a wedge to probe: reconnect, verify
+            // identity, read the evidence (health breadcrumb → ring → crash report),
+            // then the ordinary post-reset probes — regardless of policy.
+            if (!session.connected && typeof session.reconnect === 'function') {
+                return await selfResetPath(a, policy, null);
+            }
+            const c = await confirm();
+            if (!session.connected && typeof session.reconnect === 'function') {
+                return await selfResetPath(a, policy, c);
+            }
+            if (!c.confirmed) {
+                record({ phase: 'end', outcome: 'transient', policy });
+                say(
+                    'controller answered the confirmation probe normally — transient stall, not a wedge',
+                    'warn'
+                );
+                return { confirmed: false, outcome: 'transient' };
+            }
+            say(
+                'controller fault CONFIRMED — probing for ' +
+                    Math.round((a.windowMs != null ? a.windowMs : opts.probeWindowMs) / 1000) +
+                    ' s',
+                'err'
+            );
+            const win = await probeWindow(c.caps, a.windowMs);
+            if (aborted) {
+                record({ phase: 'end', outcome: 'operator-stop', policy });
+                return { confirmed: true, window: win, outcome: 'operator-stop' };
+            }
+            if (!session.connected && typeof session.reconnect === 'function') {
+                const r = await selfResetPath(a, policy, c);
+                r.window = win;
+                return r;
+            }
+            if (policy === 'halt') {
+                record({ phase: 'end', outcome: 'halted', policy });
+                say(
+                    'post-mortem complete — controller left as-is for inspection (halt policy)',
+                    'err'
+                );
+                return { confirmed: true, window: win, outcome: 'halted' };
+            }
+            const reset = await resetAndReconnect({ expectMac: a.expectMac || c.mac });
+            // "Recovered" = every REQUIRED probe answered ok and fast. Timeouts and
+            // failed required probes disqualify; optional SD-image refusals
+            // (0xE3 status 1 on a card without a panel image) do not.
+            const ps = reset.postSummary;
+            const recovered = !!(
+                reset.reconnected &&
+                reset.identityOk &&
+                ps &&
+                !ps.degraded &&
+                ps.answered > 0 &&
+                ps.timeouts === 0 &&
+                ps.failedRequired === 0 &&
+                ps.errors === 0
+            );
+            record({ phase: 'end', outcome: recovered ? 'recovered' : 'reset-failed', policy });
+            say(
+                recovered
+                    ? 'controller recovered after SYSTEM_RESET (prev breadcrumb: ' +
+                          (reset.prevBreadcrumb || '?') +
+                          ')'
+                    : 'controller did NOT recover after SYSTEM_RESET — halting',
+                recovered ? 'warn' : 'err'
+            );
+            return {
+                confirmed: true,
+                window: win,
+                reset,
+                outcome: recovered ? 'recovered' : 'reset-failed'
+            };
+        }
+
+        return {
+            run,
+            quiet,
+            confirm,
+            probeOnce,
+            probeWindow,
+            resetAndReconnect,
+            summarize,
+            abort,
+            opts
+        };
+    }
+
+    const StudioPostmortem = { createPostmortem, DEFAULTS, probeSet };
+
+    if (typeof module !== 'undefined' && module.exports) {
+        module.exports = StudioPostmortem;
+    }
+    if (typeof global !== 'undefined') {
+        global.StudioPostmortem = StudioPostmortem;
+    }
+})(typeof window !== 'undefined' ? window : this);
diff --git a/js/studio-runlog-adapter.js b/js/studio-runlog-adapter.js
index 5b0da665..a90d2fb4 100644
--- a/js/studio-runlog-adapter.js
+++ b/js/studio-runlog-adapter.js
@@ -28,6 +28,7 @@
         command: 1,
         skip: 1,
         error: 1,
+        fault: 1, // controller stopped answering (fw #50) — precedes a terminal `aborted`
         'step-done': 1,
         'sequence-complete': 1,
         aborted: 1
@@ -57,7 +58,15 @@
         }
         const ev = log.event(phase, s);
         if (isTerminal(phase)) {
-            const override = phase === 'aborted' ? 'ABORTED_BY_USER' : undefined;
+            // An `aborted` whose summary carries a fault reason is the CONTROLLER
+            // giving up, not the operator — label it so (it also auto-commits).
+            const faulted = phase === 'aborted' && s.summary && s.summary.fault;
+            const override =
+                phase === 'aborted'
+                    ? faulted
+                        ? 'CONTROLLER_FAULT'
+                        : 'ABORTED_BY_USER'
+                    : undefined;
             const summary = log.finish(s.summary || null, override);
             return { event: ev, terminal: true, summary: summary };
         }
diff --git a/js/studio-url-state.js b/js/studio-url-state.js
index db99379c..3fe26fe4 100644
--- a/js/studio-url-state.js
+++ b/js/studio-url-state.js
@@ -173,6 +173,14 @@
         // remembered-unlocked (state.advanced === false ⇒ the app calls lockSafe()).
         // Absent ⇒ safe mode by default, but with NO re-lock (a remembered unlock
         // stands). NOT a security boundary — see docs/development/safe-mode-spec.md.
+        // soak (fw #50 harness) — `soak=1` REQUESTS the Studio's unattended soak
+        // driver (repeat the loaded protocol, fault lifecycle, post-mortem
+        // probes). Advanced-only in the app; here it is just a validated flag.
+        const soak = params.get('soak');
+        if (soak != null) {
+            if (soak === '1') state.soak = true;
+            else if (soak !== '0') warnings.push('Ignored soak=' + soak + ' (expected 0 or 1)');
+        }
         const adv = params.get('advanced');
         if (adv != null) {
             if (adv === '1') state.advanced = true;
@@ -212,6 +220,9 @@
         // clean-URL rule, mirroring rig: a browser remembered-unlocked without
         // ?advanced=1 keeps a clean URL; advanced state lives in localStorage).
         if (s.advanced) params.set('advanced', '1');
+        // soak: emitted only when the soak driver is armed in this tab (same
+        // clean-URL rule as advanced — a plain bench tab never carries it).
+        if (s.soak) params.set('soak', '1');
         // URLSearchParams percent-encodes '/', which is legal un-encoded in a
         // query string (RFC 3986) — keep repo/path params human-readable.
         const q = params.toString().replace(/%2F/gi, '/');
@@ -245,6 +256,7 @@
                 p: a.repoPath,
                 rig: a.rigKey || undefined,
                 advanced: a.advanced || undefined,
+                soak: a.soak || undefined,
                 source: 'committed'
             });
         }
@@ -253,6 +265,7 @@
             p: a.protocolKey || undefined,
             rig: a.rigKey || undefined,
             advanced: a.advanced || undefined,
+            soak: a.soak || undefined,
             source: a.protocolKey ? 'committed' : 'local'
         });
     }
diff --git a/pixi.toml b/pixi.toml
index 353c7c66..d7e80ec8 100644
--- a/pixi.toml
+++ b/pixi.toml
@@ -21,7 +21,7 @@ serve = "python -m http.server 8000 --bind 127.0.0.1"
 # The full test suite. yaml is vendored (js/vendor/yaml), so no package install.
 # The v3 suite pulls in ESM modules that `import 'yaml'`; --import maps that bare
 # specifier to the vendored copy (tests/vendor-yaml.register.mjs).
-test = "node tests/validate-arena-calculations.js && node tests/test-protocol-roundtrip.js && node --import ./tests/vendor-yaml.register.mjs tests/test-protocol-roundtrip-v3.js && node --import ./tests/vendor-yaml.register.mjs tests/test-runtime-controls.js && node tests/test-plugin-registry.js && node tests/test-arena-wire-g6.js && node tests/test-arena-link.js && node tests/test-arena-runner-g6.js && node tests/test-arena-session.js && node tests/test-fictrac-bridge-client.js && node tests/test-run-log.js && node tests/test-bin-classifier.js && node tests/test-pattern-set.js && node tests/test-pat-preview.js && node tests/test-studio-meta.js && node tests/test-studio-analog-in.js && node tests/test-studio-url-state.js && node tests/test-studio-runlog-adapter.js && node tests/test-studio-github.js && node tests/test-studio-canmutate.js && node tests/test-studio-protocols-index.js && node tests/test-g6-tall-rigs.js && node tests/test-arena-studio-alt.js && node tests/test-three-viewer-led-glow.js && node tests/test-three-viewer-preview-omissions.js && node tests/test-arena-replay-viewer-protocol.js && node tests/test-kinematics.js && node tests/test-runlog-replay.js && node tests/test-runlog-format.js && node tests/test-metadata-yaml.js && python tests/test-bridge-behavior.py && python tests/test-build-runlog-index.py"
+test = "node tests/validate-arena-calculations.js && node tests/test-protocol-roundtrip.js && node --import ./tests/vendor-yaml.register.mjs tests/test-protocol-roundtrip-v3.js && node --import ./tests/vendor-yaml.register.mjs tests/test-runtime-controls.js && node tests/test-plugin-registry.js && node tests/test-arena-wire-g6.js && node tests/test-arena-link.js && node tests/test-arena-runner-g6.js && node tests/test-arena-session.js && node tests/test-fictrac-bridge-client.js && node tests/test-run-log.js && node tests/test-bin-classifier.js && node tests/test-pattern-set.js && node tests/test-pat-preview.js && node tests/test-studio-meta.js && node tests/test-studio-analog-in.js && node tests/test-studio-url-state.js && node tests/test-studio-runlog-adapter.js && node tests/test-studio-github.js && node tests/test-studio-canmutate.js && node tests/test-studio-protocols-index.js && node tests/test-g6-tall-rigs.js && node tests/test-arena-studio-alt.js && node tests/test-three-viewer-led-glow.js && node tests/test-three-viewer-preview-omissions.js && node tests/test-arena-replay-viewer-protocol.js && node tests/test-kinematics.js && node tests/test-runlog-replay.js && node tests/test-runlog-format.js && node tests/test-metadata-yaml.js && python tests/test-bridge-behavior.py && python tests/test-build-runlog-index.py && node tests/test-studio-postmortem.js && node tests/test-arena-telemetry.js && python tests/test-wedge-scan.py"
 format = "prettier --write \"**/*.js\""
 format-check = "prettier --check \"**/*.js\""
 
diff --git a/protocols/soak_mode3_closed_loop.yaml b/protocols/soak_mode3_closed_loop.yaml
new file mode 100644
index 00000000..a6eb34ad
--- /dev/null
+++ b/protocols/soak_mode3_closed_loop.yaml
@@ -0,0 +1,136 @@
+version: 3
+
+# ============================================================================
+# Mode-3 SOAK protocol — reproduces the closed-loop controller wedge (firmware
+# issue reiserlab/LED-Display_G6_Firmware_Arena#50) with the FicTrac SIMULATOR,
+# no flies. One iteration ≈ 41 min: twenty 60 s Mode-3 closed-loop trials that
+# alternate the two patterns the wedge was seen on — the 200-frame bar
+# (frame2_h_ccw_200f, index 4) and the 20-frame grating (grating_sq, index 2) —
+# separated by 2 s ITIs. The Studio's soak driver (advanced ?soak=1, File ▾ →
+# Run → Soak…) repeats the whole protocol overnight and runs the post-mortem
+# lifecycle when the fault detector trips.
+#
+# Bench recipe (CSHL 10-10 controller, no FicTrac):
+#   pixi run sim -- --count 0 --rate 100          # or --rate 286; add --jump-every 50
+#   pixi run bridge -- --log-dir soak-logs        # behavior_v2 is the default
+#   Studio ?advanced=1&soak=1 → open this protocol → Soak…
+#   morning: pixi run python scripts/wedge-scan.py soak-logs/*.jsonl
+#
+# gain 1.8 = 360/200 → one frame per 1.8° of heading on the 200-frame bar; on the
+# 20-frame grating the bridge wraps the SAME heading→index mapping modulo 20
+# (the runner pushes each trial's frame count to the bridge), so the grating
+# sees the wide-seek pattern the 08-28/09-11 bench03 failures had.
+# ============================================================================
+
+experiment_info:
+  name: "Mode-3 soak (fw #50)"
+  author: "webDisplayTools"
+
+rig: "./configs/rigs/cshl_g6_2x10_ball.yaml"
+
+plugins:
+  - name: "fictrac"
+    type: "class"
+    matlab:
+      class: "FicTracPlugin"
+    config:
+      bridge_url: "ws://localhost:8765"
+      fictrac_port: 60000
+      proto: "udp"
+      gain: 1.8
+      offset: 0
+
+variables:
+  cl_dur: &cl_dur 60
+  iti_dur: &iti_dur 2
+
+experiment:
+  - "soak_setup"
+  - block: "soak_block"
+    trials:
+      - "cl_bar_200f"
+      - "cl_grating_20f"
+    repetitions: 10
+    randomize: false
+    intertrial: "soak_iti"
+  - "soak_shutdown"
+
+conditions:
+  - name: "soak_setup"
+    commands:
+      - type: "plugin"
+        plugin_name: "fictrac"
+        command_name: "connect"
+      - type: "plugin"
+        plugin_name: "log"
+        command_name: "log"
+        params:
+          message: "fw#50 soak iteration starting (Mode-3, sim-driven)"
+          level: "INFO"
+
+  # 200-frame bar: FicTrac-like ±1–2 frame steps → mostly sequential SD seeks.
+  - name: "cl_bar_200f"
+    commands:
+      - type: "controller"
+        command_name: "trialParams"
+        pattern: "frame2_h_ccw_200f"
+        pattern_ID: 4
+        duration: *cl_dur
+        mode: 3
+        frame_index: 0
+        frame_rate: 0
+        gain: 0
+      - type: "plugin"
+        plugin_name: "fictrac"
+        command_name: "startClosedLoop"
+        params:
+          gain: 1.8
+      - type: "wait"
+        duration: *cl_dur
+      - type: "plugin"
+        plugin_name: "fictrac"
+        command_name: "stopClosedLoop"
+
+  # 20-frame grating: the same heading walk wraps mod 20 → wide index jumps.
+  - name: "cl_grating_20f"
+    commands:
+      - type: "controller"
+        command_name: "trialParams"
+        pattern: "grating_sq"
+        pattern_ID: 2
+        duration: *cl_dur
+        mode: 3
+        frame_index: 0
+        frame_rate: 0
+        gain: 0
+      - type: "plugin"
+        plugin_name: "fictrac"
+        command_name: "startClosedLoop"
+        params:
+          gain: 1.8
+      - type: "wait"
+        duration: *cl_dur
+      - type: "plugin"
+        plugin_name: "fictrac"
+        command_name: "stopClosedLoop"
+
+  - name: "soak_iti"
+    commands:
+      - type: "controller"
+        command_name: "allOff"
+      - type: "wait"
+        duration: *iti_dur
+
+  # NOTE: no fictrac.disconnect here — the bridge is the run's logger, and a
+  # disconnect as the last command drops the run's terminal event from the log
+  # (and the soak driver needs the bridge up between iterations). Bench 2026-09-11.
+  - name: "soak_shutdown"
+    commands:
+      - type: "controller"
+        command_name: "stopDisplay"
+      - type: "plugin"
+        plugin_name: "log"
+        command_name: "log"
+        params:
+          message: "fw#50 soak iteration finished"
+          level: "INFO"
diff --git a/scripts/soak-wedge-watch.sh b/scripts/soak-wedge-watch.sh
new file mode 100755
index 00000000..1173a140
--- /dev/null
+++ b/scripts/soak-wedge-watch.sh
@@ -0,0 +1,19 @@
+#!/bin/zsh
+# Exit when a fault/post-mortem appears in the newest soak log, when the log stops growing (>240 s), or at the deadline.
+cd /Users/reiserm/Documents/GitHub/webDisplayTools
+DEADLINE=$(date -j -f "%Y-%m-%d %H:%M" "${WATCH_DEADLINE:-2099-01-01 00:00}" +%s)  # export WATCH_DEADLINE="YYYY-MM-DD HH:MM" to bound the watch
+last_size=0; last_change=$(date +%s)
+while true; do
+  now=$(date +%s)
+  if (( now > DEADLINE )); then echo "DEADLINE reached $(date)"; exit 0; fi
+  f=$(ls -t soak-logs/*.jsonl | head -1)
+  sz=$(stat -f %z "$f")
+  if (( sz != last_size )); then last_size=$sz; last_change=$now; fi
+  if (( now - last_change > 240 )); then echo "STALLED: $f has not grown for 240 s ($(date))"; exit 0; fi
+  for g in $(ls -t soak-logs/*.jsonl | head -2); do
+    if grep -q '"event":"probe"\|"phase":"quiet"\|"event":"telemetry_dump"\|"event":"crash_report"' "$g"; then
+      echo "FAULT EVENT in $g at $(date)"; grep -m3 '"phase":"quiet"\|"event":"telemetry_dump"\|"event":"crash_report"' "$g" | cut -c1-400; exit 0
+    fi
+  done
+  sleep 20
+done
diff --git a/scripts/wedge-scan.py b/scripts/wedge-scan.py
new file mode 100644
index 00000000..969e42ea
--- /dev/null
+++ b/scripts/wedge-scan.py
@@ -0,0 +1,901 @@
+#!/usr/bin/env python3
+"""wedge-scan.py — scan G6 arena run logs for the Mode-3 "controller wedge".
+
+Firmware issue reiserlab/LED-Display_G6_Firmware_Arena#50: during sustained
+Mode-3 closed-loop streaming (host sends SET_FRAME_POSITION 0x70 at 100–286 Hz)
+the controller occasionally becomes ~100–500 ms per command (normally 2–3 ms)
+and stays that way. On the host side this shows up as 0x70 rows with
+``status: null`` and ``error: "response timeout after 500 ms (cmd 0x70)"``,
+then a TRIAL_PARAMS (0x08) failure (a ``runner`` event, phase ``error``), then
+the operator aborts. This script streams many logs (unattended-soak scale) and
+produces the per-run table from that issue.
+
+INPUT FORMATS (auto-detected per file; ``.gz`` transparently):
+  * bridge NDJSON ``behavior_v2`` — ``{"type":"frame_schema",...,"t0":<epoch ms>}``
+    header, FicTrac frames as ``[ms, fc, idx, ft, x, y, hd]`` arrays, arena echoes
+    as compact ``["a", t_off, dt, hex, status, rx_off(, error)]`` arrays. The
+    format authority is ``fictrac-bridge/bridge.py`` (``expand_arena_command``);
+    the tiny subset decoded here is re-implemented so this tool imports nothing
+    from the bridge (no websockets, no path games).
+  * bridge NDJSON ``behavior_v1`` — arena echoes as full
+    ``{"type":"log","event":"arena_command","t":..,"dt":..,"head":"03 70 bf 00",
+    "status":0,...,"error":null}`` objects.
+  * bridge NDJSON ``full`` — verbatim arena echoes, FicTrac under ``"fictrac"``.
+  * Arena Studio ``.runlog.json`` envelope ``{schema, intent, meta, events, summary}``
+    — runner events only, NO per-command rows: run metadata + outcome + any
+    ``error`` events mentioning a timeout are reported, per-command stats are
+    ``n/a (no arena_command rows)`` and the outcome is ``no-arena-rows``.
+
+ONSET DEFINITION (the one number that matters):
+  the first 0x70 row with ``status: null`` (timeout) that is followed, within the
+  next WINDOW (default 10) arena rows, by >= MIN_FOLLOWERS (default 2) more
+  timeouts of ANY opcode — i.e. a sustained failure. A timeout that does not
+  meet that bar is an *isolated* timeout (counted in ``isolated_timeouts``,
+  outcome ``isolated`` when there is no wedge).
+
+WHAT ``dt`` IS:
+  ``dt`` is the HOST-observed round trip: from the browser handing the request
+  to Web Serial until the framed reply was parsed, INCLUDING host queue time and
+  USB/CDC scheduling. It is not a controller-side RTT. A 500-ish dt with
+  ``status: null`` is the host's 500 ms timeout, not a measured reply.
+
+OUTCOME column:  clean | wedge | fault-declared | isolated | incomplete | no-arena-rows
+  (fault-declared = the runner/Studio declared a controller fault — e.g. rejects —
+   without the timeout signature; `declared_fault` carries the reason)
+  ``incomplete`` = no terminal runner/session event (killed bridge, truncated
+  file) OR any unparseable line (``bad_lines`` > 0) — a damaged file is never
+  reported as ``clean`` silently.
+
+Memory is bounded: files are streamed line by line; RTT percentiles use an
+integer-ms histogram; the "last 30 s" trend uses a rolling deque.
+
+Usage:
+  python scripts/wedge-scan.py runlogs/rig03-sr/*.jsonl
+  python scripts/wedge-scan.py --json runlogs/            # directories recurse
+  python scripts/wedge-scan.py --verbose some.jsonl.gz     # +/-5 rows at onset
+Exit code 0 always, except 2 when a named file could not be opened.
+"""
+
+from __future__ import annotations
+
+import argparse
+import collections
+import gzip
+import io
+import json
+import os
+import re
+import sys
+
+# ── constants ────────────────────────────────────────────────────────────────
+DEFAULT_WINDOW = 10  # arena rows after a candidate timeout to look for followers
+DEFAULT_MIN_FOLLOWERS = 2  # more timeouts (any opcode) needed to confirm onset
+TREND_WINDOW_MS = 30_000  # "last 30 s before onset" trend window
+SLOW_DT_MS = 50  # soft-degradation threshold for an OK 0x70 reply
+# Controller telemetry rows (fw feat/telemetry-ring via js/arena-telemetry.js).
+CTL_TAGS = ("cc", "cf", "cs")
+CTL_STATE_KINDS = {
+    1: "boot",
+    2: "state_change",
+    3: "error_glyph",
+    4: "sd_slow",
+    5: "ring_overrun",
+    6: "telemetry",
+    7: "sd_open",
+    8: "wdog_context",  # code = EXC_RETURN low byte; arg bits 0-8 = stacked IPSR, bits 9-15 = prior isr_last
+    9: "prev_isr_count",  # code = ISR id; arg = previous boot's entry count >> 12
+    10: "timer_fail",  # IntervalTimer::begin() failed; arg = requested refresh rate
+}
+ISR_NAMES = ["none", "refresh_timer", "spi_dma", "watchdog", "usb", "sdhc", "lpspi", "pit"]
+
+HIST_CAP_MS = 5_000  # dt histogram: buckets 0..HIST_CAP_MS-1 + one overflow bucket
+CONTEXT_ROWS = 5  # --verbose: rows before/after the onset row
+RUNLOG_JSON_MAX_BYTES = 64 * 1024 * 1024  # whole-file json.load cap for envelopes
+NA = "n/a (no arena_command rows)"
+
+OPCODE_NAMES = {
+    0x00: "ALL_OFF",
+    0x01: "SYSTEM_RESET",
+    0x08: "TRIAL_PARAMS",
+    0x16: "SET_REFRESH_RATE",
+    0x17: "GET_REFRESH_RATE",
+    0x1B: "SET_PANEL_DISPLAY_MODE",
+    0x1C: "GET_PANEL_DISPLAY_MODE",
+    0x30: "STOP_DISPLAY",
+    0x32: "STREAM_FRAME",
+    0x33: "GET_FRAMES_SENT",
+    0x34: "RESET_FRAMES_SENT",
+    0x70: "SET_FRAME_POSITION",
+    0x80: "GET_FILE_COUNT",
+    0x82: "GET_PATTERN_FILENAME",
+    0x83: "SET_PATTERN_FILENAME",
+    0x84: "GET_PATTERN_FILE",
+    0x85: "SET_PATTERN_FILE",
+    0x86: "DELETE_PATTERN_FILE",
+    0x88: "GET_PATTERN_INFO",
+    0x8A: "GET_SD_ARCHIVE",
+    0x8F: "PURGE_MEMORY",
+    0xA0: "SET_AO_VOLTAGE",
+    0xA1: "GET_AO_VOLTAGE",
+    0xA3: "SET_AO_MODE",
+    0xA4: "GET_ANALOG_IN",
+    0xAA: "SET_DIGITAL_OUT",
+    0xAB: "GET_DIGITAL_OUT",
+    0xAC: "SET_DIO_ROLE",
+    0xAD: "GET_DIO_ROLE",
+    0xC0: "SET_ETHERNET_IP",
+    0xC1: "GET_ETHERNET_IP",
+    0xC2: "GET_CONTROLLER_INFO",
+    0xC3: "SET_DIAG_OUTPUT",
+    0xC4: "GET_DIAG_OUTPUT",
+    0xC5: "SET_SPI_CLOCK",
+    0xC6: "GET_SPI_CLOCK",
+    0xC8: "G6_PROGRAM_PANEL",
+    0xC9: "G6_VERIFY_PANEL",
+    0xCA: "GET_HEALTH",
+    0xE0: "SET_FIRMWARE_FILE",
+    0xE3: "GET_FIRMWARE_INFO",
+    0xFF: "ALL_ON",
+}
+
+TERMINAL_RUNNER_PHASES = ("sequence-complete", "aborted")
+_HEX2 = re.compile(r"^[0-9a-fA-F]{2}$")
+_CMD_IN_REASON = re.compile(r"cmd\s+0x([0-9a-fA-F]{1,2})")
+
+
+def opcode_name(op: int | None) -> str:
+    """Human label for an opcode byte, e.g. ``SET_FRAME_POSITION (0x70)``."""
+    if op is None:
+        return "?"
+    name = OPCODE_NAMES.get(op)
+    return f"{name} (0x{op:02X})" if name else f"0x{op:02X}"
+
+
+# ── one decoded arena row ────────────────────────────────────────────────────
+class ArenaRow:
+    """A normalized arena command echo (from a v1 object or a v2 array)."""
+
+    __slots__ = ("line", "t", "dt", "hex", "opcode", "status", "error")
+
+    def __init__(self, line, t, dt, hexs, status, error):
+        self.line = line  # 1-based physical line number
+        self.t = t  # epoch ms of the request (None if unknown)
+        self.dt = dt  # host-observed round trip, ms
+        self.hex = hexs  # request bytes, no spaces, lowercase
+        self.status = status  # int or None (None = no reply)
+        self.error = error  # str or None
+        self.opcode = int(hexs[2:4], 16) if len(hexs) >= 4 else None
+
+    @property
+    def timeout(self) -> bool:
+        return self.status is None
+
+    @property
+    def index(self) -> int | None:
+        """u16 LE payload of a 0x70 request (frame index); None otherwise."""
+        if self.opcode != 0x70 or len(self.hex) < 8:
+            return None
+        return int(self.hex[4:6], 16) | (int(self.hex[6:8], 16) << 8)
+
+    def brief(self) -> str:
+        st = "TIMEOUT" if self.timeout else f"status {self.status}"
+        idx = self.index
+        idx_s = f" idx {idx}" if idx is not None else ""
+        err = f" — {self.error}" if self.error else ""
+        return f"L{self.line} {opcode_name(self.opcode)}{idx_s} dt={self.dt} ms {st}{err}"
+
+
+def _normalize_hex(head) -> str | None:
+    """``"03 70 bf 00"`` / ``"03700000"`` → ``"0370bf00"``; None if not hex bytes.
+
+    A v1 ``head`` may carry a truncation marker for long commands; only the
+    leading whole hex bytes are kept so the opcode is still recoverable."""
+    if not isinstance(head, str):
+        return None
+    parts = head.split(" ") if " " in head else [head[i : i + 2] for i in range(0, len(head), 2)]
+    out = []
+    for p in parts:
+        if not _HEX2.match(p):
+            break
+        out.append(p.lower())
+    return "".join(out) if out else None
+
+
+def decode_arena(value, line: int, t0: int | None) -> ArenaRow | None:
+    """Return an ArenaRow for a v2 ``["a", ...]`` array or a v1/full
+    ``arena_command`` object; None for anything else (frames, events)."""
+    if isinstance(value, list):
+        if len(value) in (6, 7) and value[0] == "a":
+            _, t_off, dt, hexs, status, _rx = value[:6]
+            error = value[6] if len(value) == 7 else None
+            h = _normalize_hex(hexs)
+            if h is None:
+                return None
+            t = (t0 + t_off) if (t0 is not None and isinstance(t_off, (int, float))) else None
+            return ArenaRow(line, t, dt, h, status, error)
+        return None
+    if isinstance(value, dict) and value.get("event") == "arena_command":
+        h = _normalize_hex(value.get("head"))
+        if h is None:
+            return None
+        t = value.get("t")
+        return ArenaRow(line, t if isinstance(t, (int, float)) else None, value.get("dt"), h, value.get("status"), value.get("error"))
+    return None
+
+
+# ── bounded statistics helpers ───────────────────────────────────────────────
+class DtHistogram:
+    """Integer-ms histogram with an overflow bucket; exact median/p99 for
+    integer dts, within 1 ms for fractional ones."""
+
+    def __init__(self, cap: int = HIST_CAP_MS):
+        self.cap = cap
+        self.buckets = collections.Counter()
+        self.n = 0
+        self.max = None
+
+    def add(self, dt) -> None:
+        if not isinstance(dt, (int, float)):
+            return
+        b = int(round(dt))
+        b = self.cap if b >= self.cap else max(b, 0)
+        self.buckets[b] += 1
+        self.n += 1
+        self.max = dt if self.max is None else max(self.max, dt)
+
+    def percentile(self, q: float):
+        if not self.n:
+            return None
+        target = max(1, int(round(q * self.n)))
+        seen = 0
+        for b in sorted(self.buckets):
+            seen += self.buckets[b]
+            if seen >= target:
+                return f">={self.cap}" if b == self.cap else b
+        return None
+
+
+def _median(values) -> float | None:
+    vals = sorted(v for v in values if isinstance(v, (int, float)))
+    if not vals:
+        return None
+    mid = len(vals) // 2
+    return vals[mid] if len(vals) % 2 else (vals[mid - 1] + vals[mid]) / 2
+
+
+class TrendWindow:
+    """Rolling deque of (t_ms, dt) for OK 0x70 rows in the last TREND_WINDOW_MS."""
+
+    def __init__(self, span_ms: int = TREND_WINDOW_MS):
+        self.span = span_ms
+        self.q = collections.deque()
+        self.n_seen = 0  # fallback counter when rows carry no timestamp
+
+    def add(self, t, dt) -> None:
+        key = t if isinstance(t, (int, float)) else self.n_seen
+        self.n_seen += 1
+        self.q.append((key, dt))
+        cutoff = key - self.span
+        while self.q and self.q[0][0] < cutoff:
+            self.q.popleft()
+
+    def median(self):
+        return _median(dt for _, dt in self.q)
+
+
+# ── file iteration ───────────────────────────────────────────────────────────
+def open_text(path: str):
+    """Open a plain or gzip'd log as a UTF-8 text stream (line-buffered)."""
+    if path.endswith(".gz"):
+        return io.TextIOWrapper(gzip.open(path, "rb"), encoding="utf-8", errors="replace")
+    return open(path, "r", encoding="utf-8", errors="replace")
+
+
+def iter_files(paths, recurse=True):
+    """Expand directories into log files (sorted); yield paths in order."""
+    exts = (".jsonl", ".jsonl.gz", ".ndjson", ".ndjson.gz", ".runlog.json", ".json.gz")
+    for p in paths:
+        if os.path.isdir(p) and recurse:
+            for root, _dirs, files in os.walk(p):
+                for f in sorted(files):
+                    if f.endswith(exts) and f != "index.json":
+                        yield os.path.join(root, f)
+        else:
+            yield p
+
+
+def meta_from_filename(path: str) -> dict:
+    """``<proto>__<user>__<ts>__<runid>.jsonl`` + parent dir → run metadata."""
+    base = os.path.basename(path)
+    stem = base.split(".")[0]
+    out = {"bench": os.path.basename(os.path.dirname(os.path.abspath(path)))}
+    parts = stem.split("__")
+    if len(parts) == 4:
+        out.update(protocol=parts[0], run_id=parts[3])
+    return out
+
+
+# ── the per-file analyzer ────────────────────────────────────────────────────
+class RunScan:
+    """Streaming state for one log file. Feed lines with ``feed()``; read
+    ``result()`` when done. Everything here is bounded-memory."""
+
+    def __init__(self, path: str, window: int, min_followers: int):
+        self.path = path
+        self.window = window
+        self.min_followers = min_followers
+        self.format = None  # behavior_v2 | behavior_v1 | full | runlog.json | unknown
+        self.t0 = None  # epoch ms reference (schema t0 / session ms / first arena t)
+        self.last_t = None
+        self.lines = 0
+        self.bad_lines = 0
+        self.first_bad_line = None
+        self.arena_rows = 0
+        self.cmd70_total = 0
+        self.cmd70_ok = 0
+        self.nonzero_status = 0
+        self.nonzero_by_op = collections.Counter()  # opcode → non-zero-status replies
+        self.resets = 0
+        self.timeouts_total = 0
+        self.isolated_timeouts = 0
+        self.slow_before = 0  # OK 0x70 with dt > SLOW_DT_MS before onset
+        self.ctl_records = 0
+        self.ctl_by_tag = collections.Counter()
+        self.ctl_sd_hist = collections.Counter()
+        self.ctl_sd_max = 0
+        self.ctl_states = collections.Counter()
+        self.ctl_cmd_rejects = 0
+        self.ctl_tail = collections.deque(maxlen=40)
+        self.ctl_tail_pre_onset = []
+        self.ctl_pre_boot = []  # [(lineno of the boot record, [(lineno, row), ...])]
+        self.hist = DtHistogram()  # OK 0x70 dt before onset
+        self.trend = TrendWindow()
+        self.onset = None  # confirmed ArenaRow
+        self.onset_cmd70_count = 0
+        self.onset_trend_median = None
+        self.timeouts_after = 0
+        self.first_non70_fail = None
+        self.runner_errors = []  # (line, text) — bounded to a few
+        self.terminal = None  # 'sequence-complete' | 'aborted' | 'logging_stopped'
+        self.declared_fault = None  # runner summary.fault (the live detector's verdict)
+        self.ctl_malformed = 0  # tagged rows too short to decode (dropped, counted)
+        self.meta = meta_from_filename(path)
+        self.frames = 0
+        self.recent = collections.deque(maxlen=CONTEXT_ROWS)  # last rows (context)
+        self.candidates = []  # pending onset candidates
+        self.context_after = []  # rows after onset for --verbose
+        self.context_before = []
+
+    # ── ingestion ────────────────────────────────────────────────────────
+    def feed(self, line: str, lineno: int) -> None:
+        self.lines = lineno
+        s = line.strip()
+        if not s:
+            return
+        try:
+            value = json.loads(s)
+        except ValueError:
+            self.bad_lines += 1
+            if self.first_bad_line is None:
+                self.first_bad_line = lineno
+            return
+        row = decode_arena(value, lineno, self.t0)
+        if row is not None:
+            if self.format is None:  # legacy log without a frame_schema line
+                self.format = "behavior_v2 (no schema)" if isinstance(value, list) else "behavior_v1 (no schema)"
+            self._arena(row)
+            return
+        if isinstance(value, list):
+            if value and isinstance(value[0], str) and value[0] in CTL_TAGS:
+                self._ctl(value, lineno)
+                return
+            self._frame(value)
+            return
+        if isinstance(value, dict):
+            self._event(value, lineno)
+
+    def _ctl(self, arr, lineno: int) -> None:
+        """Controller telemetry row (js/arena-telemetry.js): ["cc"|"cf"|"cs", rx, t_us, seq, ...]."""
+        tag = arr[0]
+        if len(arr) < 4:
+            self.ctl_malformed += 1  # a bare ["cc"] must not kill the scan
+            return
+        self.ctl_records += 1
+        self.ctl_by_tag[tag] += 1
+        if isinstance(arr[1], (int, float)):
+            self._touch(arr[1])
+        if tag == "cf" and len(arr) >= 8 and isinstance(arr[6], (int, float)):
+            sd = int(arr[6])
+            self.ctl_sd_hist[min(sd // 100, 999)] += 1
+            if sd > self.ctl_sd_max:
+                self.ctl_sd_max = sd
+        elif tag == "cs" and len(arr) >= 7:
+            kind = CTL_STATE_KINDS.get(arr[4], f"kind_{arr[4]}")
+            if arr[4] == 1 and len(arr) >= 7:
+                # boot: code = SRC_SRSR & 0xFF (bit7 = wdog3 watchdog reset), arg bit1 = previous
+                # boot died inside the watchdog pre-reset ISR (fw fb11681)
+                if isinstance(arr[5], int) and arr[5] & 0x80:
+                    kind = "boot(watchdog-reset)"
+                elif isinstance(arr[6], int) and arr[6] & 0x02:
+                    kind = "boot(wdog-isr)"
+            elif arr[4] == 8 and len(arr) >= 7 and isinstance(arr[6], int):
+                # watchdog context: which execution context the watchdog IRQ preempted
+                ipsr = arr[6] & 0x1FF
+                prior = arr[6] >> 9
+                prior_name = ISR_NAMES[prior] if prior < len(ISR_NAMES) else f"isr_{prior}"
+                ctx = "thread" if ipsr == 0 else ("pit-handler" if ipsr == 138 else f"handler_{ipsr}")
+                if isinstance(arr[5], int) and bool(arr[5] & 0x08) != (ipsr == 0):
+                    ctx += "?"  # EXC_RETURN bit 3 disagrees with the stacked IPSR — suspect capture
+                kind = f"wdog_context({ctx}, before={prior_name})"
+            elif arr[4] == 9 and len(arr) >= 7 and isinstance(arr[5], int):
+                nm = ISR_NAMES[arr[5]] if arr[5] < len(ISR_NAMES) else f"isr_{arr[5]}"
+                kind = f"prev_isr_count({nm})"
+            self.ctl_states[kind] += 1
+        elif tag == "cc" and len(arr) >= 7 and arr[5] not in (0, None):
+            self.ctl_cmd_rejects += 1
+        # Crash-dump tails. (a) host-order: the last records seen before the onset
+        # was confirmed; (b) controller-order: at every `boot` STATE record, snapshot
+        # the records that preceded it — that is the previous boot's final history,
+        # which reaches the host only AFTER the reboot (post-mortem drain), i.e.
+        # after the onset in file order.
+        if tag == "cs" and len(arr) >= 7 and arr[4] == 1 and self.ctl_tail:
+            self.ctl_pre_boot.append((lineno, list(self.ctl_tail)))
+        self.ctl_tail.append((lineno, arr))
+        if self.onset is None:
+            self.ctl_tail_pre_onset = list(self.ctl_tail)
+
+    def _frame(self, arr) -> None:
+        self.frames += 1
+        if arr and isinstance(arr[0], (int, float)) and self.t0 is not None:
+            self._touch(self.t0 + arr[0])
+
+    def _touch(self, t) -> None:
+        if isinstance(t, (int, float)):
+            self.last_t = t if self.last_t is None else max(self.last_t, t)
+
+    def _event(self, obj: dict, lineno: int) -> None:
+        typ = obj.get("type")
+        ev = obj.get("event")
+        if typ == "frame_schema":
+            self.format = obj.get("level") or "behavior_v1"
+            if isinstance(obj.get("t0"), (int, float)):
+                self.t0 = obj["t0"]
+            return
+        if typ == "session":
+            if isinstance(obj.get("ms"), (int, float)):
+                if self.t0 is None:
+                    self.t0 = obj["ms"]
+                self._touch(obj["ms"])
+            if ev == "logging_stopped":
+                self.terminal = self.terminal or "logging_stopped"
+            return
+        if isinstance(obj.get("rx_ms"), (int, float)):
+            self._touch(obj["rx_ms"])
+        if ev == "run_metadata":
+            for k_src, k_dst in (("run_id", "run_id"), ("protocol_filename", "protocol"), ("rig_id", "bench"), ("tool_version", "tool"), ("firmware", "firmware")):
+                if obj.get(k_src):
+                    self.meta[k_dst] = obj[k_src]
+            return
+        if ev == "fictrac_frame" or "fictrac" in obj:
+            self.frames += 1
+            return
+        if ev == "runner":
+            self._runner(obj, lineno)
+        # reset detection on structured fields only (never free-text notes);
+        # RESET_FRAMES_SENT / resetFramesSent is a counter clear, not a reboot.
+        for k in ("event", "phase", "op", "command", "cmd"):
+            v = obj.get(k)
+            if isinstance(v, str) and "reset" in v.lower() and "frames" not in v.lower():
+                self.resets += 1
+                break
+
+    def _runner(self, obj: dict, lineno: int) -> None:
+        phase = obj.get("phase")
+        if phase in TERMINAL_RUNNER_PHASES:
+            self.terminal = phase
+            summ = obj.get("summary")
+            if isinstance(summ, dict) and summ.get("fault"):
+                self.declared_fault = str(summ["fault"])
+        elif phase == "fault":
+            self.declared_fault = self.declared_fault or str(obj.get("reason") or "fault")
+        elif phase == "error":
+            text = obj.get("reason") or obj.get("error") or "error"
+            if len(self.runner_errors) < 5:
+                self.runner_errors.append((lineno, str(text)))
+            if self.onset is not None and self.first_non70_fail is None:
+                m = _CMD_IN_REASON.search(str(text))
+                if m:
+                    self.first_non70_fail = f"{opcode_name(int(m.group(1), 16))} via runner:error"
+                else:
+                    self.first_non70_fail = f"runner:error {text}"[:80]
+
+    def _arena(self, row: ArenaRow) -> None:
+        if self.t0 is None and row.t is not None:
+            self.t0 = row.t  # v1 file without a session line
+        self._touch(row.t)
+        self.arena_rows += 1
+        if row.opcode == 0x01:
+            self.resets += 1
+        if row.status is not None and row.status != 0:
+            self.nonzero_status += 1
+            self.nonzero_by_op[row.opcode] += 1
+        is70 = row.opcode == 0x70
+        if is70:
+            self.cmd70_total += 1
+            if row.status == 0:
+                self.cmd70_ok += 1
+        if row.timeout:
+            self.timeouts_total += 1
+
+        if self.onset is None:
+            self._before_onset(row)
+        else:
+            self._after_onset(row)
+        self.recent.append(row)
+
+    def _before_onset(self, row: ArenaRow) -> None:
+        # advance pending candidates first (this row is a follower of each)
+        confirmed = None
+        keep = []
+        for c in self.candidates:
+            c["since"].append(row)
+            if row.timeout:
+                c["followers"] += 1
+            if c["followers"] >= self.min_followers:
+                confirmed = c if confirmed is None else confirmed
+            elif len(c["since"]) < self.window:
+                keep.append(c)  # else: expired unconfirmed → an isolated timeout
+        if confirmed is not None:
+            self._confirm(confirmed)
+            return
+        self.candidates = keep
+
+        if row.timeout:
+            if row.opcode == 0x70:
+                self.candidates.append(
+                    {
+                        "row": row,
+                        "since": [],  # arena rows after the candidate (<= window)
+                        "followers": 0,
+                        "cmd70_before": self.cmd70_ok,
+                        "trend": self.trend.median(),
+                        "context_before": list(self.recent),
+                    }
+                )
+            return
+        if row.opcode == 0x70 and row.status == 0:
+            self.hist.add(row.dt)
+            self.trend.add(row.t, row.dt)
+            if isinstance(row.dt, (int, float)) and row.dt > SLOW_DT_MS:
+                self.slow_before += 1
+
+    def _confirm(self, c: dict) -> None:
+        self.onset = c["row"]
+        self.onset_cmd70_count = c["cmd70_before"]
+        self.onset_trend_median = c["trend"]
+        self.context_before = c["context_before"]
+        self.candidates = []
+        for r in c["since"]:  # rows between onset and confirmation are "after"
+            self._after_onset(r)
+
+    def _after_onset(self, row: ArenaRow) -> None:
+        if len(self.context_after) < CONTEXT_ROWS:
+            self.context_after.append(row)
+        if row.timeout:
+            self.timeouts_after += 1
+        failed = row.timeout or (row.status not in (None, 0))
+        if failed and row.opcode != 0x70 and self.first_non70_fail is None:
+            self.first_non70_fail = opcode_name(row.opcode)
+
+    # ── result ───────────────────────────────────────────────────────────
+    def outcome(self) -> str:
+        if self.arena_rows == 0:
+            return "no-arena-rows" if self.lines and self.bad_lines == 0 else "incomplete"
+        if self.onset is not None:
+            return "wedge"
+        if self.declared_fault:
+            # The live detector tripped (e.g. ≥3 REJECTS in 10 applies) but no
+            # timeout signature is in the rows: the run is not clean, and the
+            # inferred and declared verdicts must both be visible.
+            return "fault-declared"
+        if self.isolated_timeouts:
+            return "isolated"
+        if self.bad_lines or self.terminal is None:
+            return "incomplete"
+        return "clean"
+
+    def result(self) -> dict:
+        # every timeout not part of the confirmed wedge (onset row + after) was
+        # isolated, i.e. the controller recovered
+        self.isolated_timeouts = self.timeouts_total - self.timeouts_after - (1 if self.onset is not None else 0)
+        self.candidates = []
+        has_rows = self.arena_rows > 0
+        dur = None
+        if self.t0 is not None and self.last_t is not None:
+            dur = round((self.last_t - self.t0) / 1000, 1)
+        on = self.onset
+        overall = self.hist.percentile(0.5)
+        flags = []
+        if self.bad_lines:
+            flags.append(f"bad_lines={self.bad_lines}@L{self.first_bad_line}")
+        if has_rows and self.terminal is None:
+            flags.append("no-terminal-event")
+        if self.resets:
+            flags.append(f"resets={self.resets}")
+        trend = None
+        if has_rows:
+            base = self.onset_trend_median if on is not None else self.trend.median()
+            trend = f"last30s {base} vs overall {overall}"
+        return {
+            "file": os.path.basename(self.path),
+            "format": self.format or ("unknown" if has_rows else "no-schema"),
+            "run_id": self.meta.get("run_id", "?"),
+            "protocol": self.meta.get("protocol", "?"),
+            "firmware": self.meta.get("firmware") or "—",
+            "bench": self.meta.get("bench", "?"),
+            "tool": self.meta.get("tool"),
+            "duration_s": dur,
+            "lines": self.lines,
+            "bad_lines": self.bad_lines,
+            "frames": self.frames,
+            "cmd70_ok": self.cmd70_ok if has_rows else NA,
+            "cmd70_total": self.cmd70_total if has_rows else NA,
+            "rtt_median_ms": overall if has_rows else NA,
+            "rtt_p99_ms": self.hist.percentile(0.99) if has_rows else NA,
+            "rtt_max_ms": self.hist.max if has_rows else NA,
+            "nonzero_status": self.nonzero_status if has_rows else NA,
+            "nonzero_by_op": ({opcode_name(op): n for op, n in self.nonzero_by_op.most_common()} if has_rows else NA),
+            "isolated_timeouts": self.isolated_timeouts if has_rows else NA,
+            "onset_elapsed_s": (round((on.t - self.t0) / 1000, 1) if (on is not None and on.t is not None and self.t0 is not None) else None),
+            "onset_line": on.line if on is not None else None,
+            "onset_index": on.index if on is not None else None,
+            "onset_cmd70_count": self.onset_cmd70_count if on is not None else None,
+            "timeouts_after": self.timeouts_after if on is not None else None,
+            "first_non70_fail": self.first_non70_fail,
+            "slow_before": (f"dt>{SLOW_DT_MS}ms before onset: {self.slow_before}" if has_rows else NA),
+            "ctl_records": (f"{self.ctl_records} ({', '.join(f'{k}:{v}' for k, v in sorted(self.ctl_by_tag.items()))})" if self.ctl_records else "—"),
+            "ctl_sd_max_us": self.ctl_sd_max if self.ctl_records else "—",
+            "ctl_states": (", ".join(f"{k}:{v}" for k, v in sorted(self.ctl_states.items())) or "—") if self.ctl_records else "—",
+            "ctl_cmd_rejects": self.ctl_cmd_rejects if self.ctl_records else "—",
+            "trend": trend if has_rows else NA,
+            "resets": self.resets,
+            "terminal": self.terminal,
+            "declared_fault": self.declared_fault,
+            "ctl_malformed": self.ctl_malformed,
+            "runner_errors": [f"L{ln}: {tx}" for ln, tx in self.runner_errors],
+            "outcome": self.outcome(),
+            "flags": flags,
+            "_ctl_tail": (
+                [f"{n}: {json.dumps(a, separators=(',', ':'))}" for n, a in self.ctl_tail_pre_onset]
+                if (self.onset is not None and self.ctl_tail_pre_onset)
+                else []
+            ),
+            "_ctl_pre_boot": [
+                (bl, [f"{n}: {json.dumps(a, separators=(',', ':'))}" for n, a in rows])
+                for bl, rows in self.ctl_pre_boot
+            ],
+            "_context": (
+                [r.brief() for r in self.context_before] + [f">>> {on.brief()}  <<< ONSET"] + [r.brief() for r in self.context_after]
+                if on is not None
+                else []
+            ),
+        }
+
+
+# ── Studio .runlog.json envelope ─────────────────────────────────────────────
+def scan_runlog_json(path: str, doc: dict) -> dict:
+    """Report a Studio run-log envelope (runner events only, no command rows)."""
+    meta = doc.get("meta") or {}
+    summary = doc.get("summary") or {}
+    events = doc.get("events") or []
+    fm = meta_from_filename(path)
+    errors = []
+    resets = 0
+    for i, ev in enumerate(events):
+        if not isinstance(ev, dict):
+            continue
+        text = " ".join(str(ev.get(k)) for k in ("reason", "error", "message") if ev.get(k))
+        if ev.get("phase") == "error" or "timeout" in text.lower():
+            if len(errors) < 5:
+                errors.append(f"ev{i} t+{ev.get('t_offset_s')}s: {text or ev.get('phase')}")
+        for k in ("phase", "op", "command"):
+            v = ev.get(k)
+            if isinstance(v, str) and "reset" in v.lower():
+                resets += 1
+                break
+    timeout_errors = [e for e in errors if "timeout" in e.lower()]
+    flags = ["runlog.json: no per-command rows"]
+    if summary.get("outcome"):
+        flags.append(f"studio outcome {summary['outcome']}")
+    if timeout_errors:
+        flags.append(f"{len(timeout_errors)} timeout error event(s)")
+    return {
+        "file": os.path.basename(path),
+        "format": "runlog.json",
+        "run_id": meta.get("run_id") or fm.get("run_id", "?"),
+        "protocol": meta.get("protocol_filename") or fm.get("protocol", "?"),
+        "bench": meta.get("rig_id") or meta.get("rig") or fm.get("bench", "?"),
+        "firmware": meta.get("firmware") or fm.get("firmware") or "—",
+        "tool": meta.get("tool_version"),
+        "duration_s": summary.get("duration_s"),
+        "lines": len(events),
+        "bad_lines": 0,
+        "frames": 0,
+        "cmd70_ok": NA,
+        "cmd70_total": NA,
+        "rtt_median_ms": NA,
+        "rtt_p99_ms": NA,
+        "rtt_max_ms": NA,
+        "nonzero_status": NA,
+        "nonzero_by_op": NA,
+        "isolated_timeouts": NA,
+        "onset_elapsed_s": None,
+        "onset_line": None,
+        "onset_index": None,
+        "onset_cmd70_count": None,
+        "timeouts_after": None,
+        "first_non70_fail": (timeout_errors[0] if timeout_errors else None),
+        "slow_before": NA,
+        "ctl_records": "—",
+        "ctl_sd_max_us": "—",
+        "ctl_states": "—",
+        "ctl_cmd_rejects": "—",
+        "trend": NA,
+        "resets": resets,
+        "terminal": summary.get("outcome"),
+        "runner_errors": errors,
+        "outcome": "no-arena-rows",
+        "flags": flags,
+        "_context": [],
+        "_ctl_tail": [],
+        "_ctl_pre_boot": [],
+    }
+
+
+def _looks_like_envelope(path: str, first_line: str) -> bool:
+    head = first_line.lstrip()
+    return path.endswith(".runlog.json") or head == "{" or head.startswith('{"schema"')
+
+
+def scan_file(path: str, window: int, min_followers: int) -> dict:
+    """Analyze one file (any supported format). Raises OSError if unopenable."""
+    with open_text(path) as fh:
+        first = fh.readline()
+        if first and _looks_like_envelope(path, first):
+            size = os.path.getsize(path)
+            if size <= RUNLOG_JSON_MAX_BYTES:
+                rest = fh.read()
+                try:
+                    doc = json.loads(first + rest)
+                except ValueError:
+                    doc = None
+                if isinstance(doc, dict) and "events" in doc and ("schema" in doc or "meta" in doc):
+                    return scan_runlog_json(path, doc)
+                # not an envelope after all: fall through as NDJSON
+                scan = RunScan(path, window, min_followers)
+                for n, line in enumerate(io.StringIO(first + rest), 1):
+                    scan.feed(line, n)
+                return scan.result()
+        scan = RunScan(path, window, min_followers)
+        if first:
+            scan.feed(first, 1)
+            for n, line in enumerate(fh, 2):
+                scan.feed(line, n)
+    return scan.result()
+
+
+# ── output ───────────────────────────────────────────────────────────────────
+TABLE_COLUMNS = [
+    ("file", "file"),
+    ("run_id", "run"),
+    ("protocol", "protocol"),
+    ("bench", "bench"),
+    ("firmware", "fw"),
+    ("format", "fmt"),
+    ("duration_s", "dur s"),
+    ("cmd70_ok", "0x70 OK"),
+    ("cmd70_total", "0x70 total"),
+    ("rtt_median_ms", "RTT med"),
+    ("rtt_p99_ms", "RTT p99"),
+    ("nonzero_status", "status!=0"),
+    ("isolated_timeouts", "isolated"),
+    ("onset_elapsed_s", "onset s"),
+    ("onset_line", "onset line"),
+    ("onset_index", "onset idx"),
+    ("onset_cmd70_count", "0x70 before"),
+    ("timeouts_after", "timeouts after"),
+    ("first_non70_fail", "first non-0x70 fail"),
+    ("slow_before", "soft degrade"),
+    ("ctl_records", "ctl recs"),
+    ("ctl_sd_max_us", "sd max us"),
+    ("ctl_states", "ctl states"),
+    ("ctl_cmd_rejects", "ctl rejects"),
+    ("trend", "trend (dt med)"),
+    ("resets", "resets"),
+    ("bad_lines", "bad lines"),
+    ("outcome", "outcome"),
+    ("flags", "flags"),
+]
+
+
+def _cell(v) -> str:
+    if v is None:
+        return "—"
+    if isinstance(v, list):
+        return "; ".join(str(x) for x in v) if v else "—"
+    return str(v).replace("|", "\\|")
+
+
+def render_markdown(results, verbose=False) -> str:
+    keys = [k for k, _ in TABLE_COLUMNS]
+    heads = [h for _, h in TABLE_COLUMNS]
+    out = ["| " + " | ".join(heads) + " |", "|" + "|".join("---" for _ in heads) + "|"]
+    for r in results:
+        cells = []
+        for k in keys:
+            v = r.get(k)
+            if k == "nonzero_status" and isinstance(v, int) and v:
+                v = f"{v} (" + ", ".join(f"{op}:{n}" for op, n in r["nonzero_by_op"].items()) + ")"
+            cells.append(_cell(v))
+        out.append("| " + " | ".join(cells) + " |")
+    for r in results:
+        if r.get("runner_errors"):
+            out.append("")
+            out.append(f"**{r['file']}** runner errors:")
+            out.extend(f"- {e}" for e in r["runner_errors"])
+    if verbose:
+        for r in results:
+            if r.get("_context"):
+                out.append("")
+                out.append(f"**{r['file']}** onset context (±{CONTEXT_ROWS} arena rows):")
+                out.append("```")
+                out.extend(r["_context"])
+                out.append("```")
+            if r.get("_ctl_tail"):
+                out.append("")
+                out.append(f"**{r['file']}** controller-side records before the wedge (last {len(r['_ctl_tail'])}; ring crash dump):")
+                out.append("```")
+                out.extend(r["_ctl_tail"])
+                out.append("```")
+            for bl, rows in r.get("_ctl_pre_boot", []):
+                out.append("")
+                out.append(f"**{r['file']}** controller records preceding the boot recorded at line {bl} (previous boot's final {len(rows)}; post-reboot drain):")
+                out.append("```")
+                out.extend(rows)
+                out.append("```")
+    out.append("")
+    out.append(f"_dt = host-observed round trip incl. queue time (not controller RTT). Onset = first 0x70 timeout followed by >= {DEFAULT_MIN_FOLLOWERS} more timeouts within {DEFAULT_WINDOW} arena rows; timeouts_after excludes the onset row._")
+    return "\n".join(out)
+
+
+def main(argv=None) -> int:
+    ap = argparse.ArgumentParser(
+        prog="wedge-scan.py",
+        description=__doc__,
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+    )
+    ap.add_argument("paths", nargs="+", help="log files (.jsonl, .jsonl.gz, .runlog.json) or directories (recursed)")
+    ap.add_argument("--json", action="store_true", help="machine-readable JSON array instead of the markdown table")
+    ap.add_argument("--verbose", "-v", action="store_true", help=f"print the onset context (±{CONTEXT_ROWS} arena rows) per wedged file")
+    ap.add_argument("--window", type=int, default=DEFAULT_WINDOW, help=f"arena rows after a 0x70 timeout in which followers must appear (default {DEFAULT_WINDOW})")
+    ap.add_argument("--min-followers", type=int, default=DEFAULT_MIN_FOLLOWERS, help=f"additional timeouts (any opcode) that confirm an onset (default {DEFAULT_MIN_FOLLOWERS})")
+    args = ap.parse_args(argv)
+
+    results = []
+    rc = 0
+    for path in iter_files(args.paths):
+        try:
+            results.append(scan_file(path, args.window, args.min_followers))
+        except OSError as e:
+            print(f"wedge-scan: cannot open {path}: {e}", file=sys.stderr)
+            rc = 2
+    if args.json:
+        clean = [{k: v for k, v in r.items() if k not in ("_context", "_ctl_tail", "_ctl_pre_boot") or args.verbose} for r in results]
+        print(json.dumps(clean, indent=1))
+    else:
+        print(render_markdown(results, verbose=args.verbose))
+    return rc
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tests/test-arena-link.js b/tests/test-arena-link.js
index 41155f5c..f59843e9 100644
--- a/tests/test-arena-link.js
+++ b/tests/test-arena-link.js
@@ -344,6 +344,102 @@ async function main() {
         checkBool('not connected after failed open', link.connected === false);
     }
 
+    console.log('\n=== write deadline: a stalled write rejects like a timeout ===');
+    {
+        const { link, writer, reader } = setup();
+        await link.connect();
+        writer.write = () => new Promise(() => {}); // USB write never completes
+        const t0 = Date.now();
+        await checkRejects(
+            'stalled write → timeout rejection',
+            link.send(Wire.encodeGetControllerInfo(), { timeoutMs: 40 }),
+            /response timeout/
+        );
+        checkBool('rejected promptly (not hung)', Date.now() - t0 < 1000);
+        checkBool('no request left in flight', link._inflight === null);
+        reader.cancel();
+        await link.close();
+    }
+
+    console.log('\n=== reconnect(): granted-port reopen without a gesture (fw #50 recovery) ===');
+    {
+        // Same port still valid (no re-enumeration): reopen it.
+        const { link, reader, port } = setup();
+        await link.connect();
+        global.navigator.serial._dispatch('disconnect', { target: port });
+        await flush();
+        checkBool('disconnected after unplug event', link.connected === false);
+        global.navigator.serial.getPorts = async () => [port];
+        const p = await link.reconnect({ timeoutMs: 500, pollMs: 20 });
+        checkBool('reconnect reopened the same port', p === port && link.connected === true);
+        reader.cancel();
+        await link.close();
+    }
+    {
+        // Re-enumerated: old port object is dead, one granted port matches VID/PID.
+        const { link, reader, port } = setup();
+        port.getInfo = () => ({ usbVendorId: 0x16c0, usbProductId: 0x0483 });
+        await link.connect();
+        global.navigator.serial._dispatch('disconnect', { target: port });
+        await flush();
+        port.open = async () => {
+            throw new Error('device gone');
+        };
+        const reader2 = new FakeReader();
+        const newPort = new FakePort(reader2, new FakeWriter());
+        newPort.getInfo = () => ({ usbVendorId: 0x16c0, usbProductId: 0x0483 });
+        const other = new FakePort(new FakeReader(), new FakeWriter());
+        other.getInfo = () => ({ usbVendorId: 0x0403, usbProductId: 0x6001 }); // an FTDI, not ours
+        global.navigator.serial.getPorts = async () => [other, newPort];
+        const p = await link.reconnect({ timeoutMs: 500, pollMs: 20 });
+        checkBool('reconnect picked the VID/PID match, not the FTDI', p === newPort);
+        checkBool('connected on the new port', link.connected === true && link.port === newPort);
+        reader.cancel();
+        reader2.cancel();
+        await link.close();
+    }
+    {
+        // Ambiguous: two granted ports match → refuse (never guess a controller).
+        const { link, reader, port } = setup();
+        port.getInfo = () => ({ usbVendorId: 0x16c0, usbProductId: 0x0483 });
+        await link.connect();
+        global.navigator.serial._dispatch('disconnect', { target: port });
+        await flush();
+        port.open = async () => {
+            throw new Error('device gone');
+        };
+        const a = new FakePort(new FakeReader(), new FakeWriter());
+        const b = new FakePort(new FakeReader(), new FakeWriter());
+        a.getInfo = b.getInfo = () => ({ usbVendorId: 0x16c0, usbProductId: 0x0483 });
+        global.navigator.serial.getPorts = async () => [a, b];
+        await checkRejects(
+            'two matching granted ports → ambiguous',
+            link.reconnect({ timeoutMs: 300, pollMs: 20 }),
+            /ambiguous/
+        );
+        checkBool('still disconnected after refusal', link.connected === false);
+        reader.cancel();
+    }
+    {
+        // Nothing comes back: times out with a manual-connect hint.
+        const { link, reader, port } = setup();
+        await link.connect();
+        global.navigator.serial._dispatch('disconnect', { target: port });
+        await flush();
+        port.open = async () => {
+            throw new Error('device gone');
+        };
+        global.navigator.serial.getPorts = async () => [];
+        const t0 = Date.now();
+        await checkRejects(
+            'no granted port → times out',
+            link.reconnect({ timeoutMs: 120, pollMs: 20 }),
+            /no granted port came back.*connect manually/
+        );
+        checkBool('honoured the timeout', Date.now() - t0 < 2000);
+        reader.cancel();
+    }
+
     console.log(`\n=== Summary ===\n${totalChecks - failures} / ${totalChecks} checks passed`);
     process.exit(failures > 0 ? 1 : 0);
 }
diff --git a/tests/test-arena-runner-g6.js b/tests/test-arena-runner-g6.js
index 1dde3a5a..7fb20b7d 100644
--- a/tests/test-arena-runner-g6.js
+++ b/tests/test-arena-runner-g6.js
@@ -1419,6 +1419,115 @@ async function main() {
         check('last apply state recorded is false', bridge.states[bridge.states.length - 1], false);
     }
 
+    console.log('\n=== fault() mid-run (fw #50): unwinds the wait, labels the summary ===');
+    {
+        const link = makeFakeLink();
+        const runner = new Runner.ArenaRunner(link, Wire);
+        const phases = [];
+        const steps = [
+            { kind: 'ref', conditionName: 'arena check', label: 'a', seqIdx: 0, dur: 5 }
+        ];
+        const conditionsByName = new Map([['arena check', arenaCheckCond]]);
+        // Default abort-aware sleep (5 s trial) — fault() must cut it short.
+        const t0 = Date.now();
+        const p = runner.runSequence({
+            steps,
+            conditionsByName,
+            resolvePatternId: () => 1,
+            onProgress: (s) => phases.push(s)
+        });
+        await delay(30);
+        checkBool('run is active before the fault', runner.active === true);
+        runner.fault('controller_unresponsive', { failures: 3, window: 10 });
+        const summary = await p;
+        checkBool('fault() ended the run promptly', Date.now() - t0 < 2000);
+        check('summary.aborted', summary.aborted, true);
+        check('summary.fault', summary.fault, 'controller_unresponsive');
+        check(
+            'summary.faultDetail passthrough',
+            JSON.stringify(summary.faultDetail),
+            JSON.stringify({ failures: 3, window: 10 })
+        );
+        check('summary.stopAcked (fake link acks STOP)', summary.stopAcked, true);
+        checkBool(
+            "a 'fault' status event preceded the terminal 'aborted'",
+            phases.findIndex((s) => s.phase === 'fault') >= 0 &&
+                phases.findIndex((s) => s.phase === 'fault') <
+                    phases.findIndex((s) => s.phase === 'aborted')
+        );
+        const term = phases[phases.length - 1];
+        check(
+            'terminal event carries the fault',
+            term.phase === 'aborted' && term.summary.fault,
+            'controller_unresponsive'
+        );
+        checkBytes('final STOP still attempted', link.sent[link.sent.length - 1], '01 30');
+        check('faultReason getter', runner.faultReason, 'controller_unresponsive');
+    }
+
+    console.log(
+        '\n=== a timed-out protocol command is a controller fault, a rejected one is not ==='
+    );
+    {
+        // trialParams send times out (the 0x08-after-the-0x70s signature).
+        const link = makeFakeLink();
+        link.send = async function (bytes) {
+            this.sent.push(Array.from(bytes));
+            if (bytes[1] === 0x08) throw new Error('response timeout after 500 ms (cmd 0x8)');
+            return new Uint8Array([0x02, 0x00, bytes[1]]);
+        };
+        const runner = new Runner.ArenaRunner(link, Wire);
+        const trialCond = { name: 'trial', commands: [trialCmd, { type: 'wait', duration: 1 }] };
+        const steps = [{ kind: 'ref', conditionName: 'trial', label: 't', seqIdx: 0, dur: 5 }];
+        const conditionsByName = new Map([['trial', trialCond]]);
+        const summary = await runner.runSequence({
+            steps,
+            conditionsByName,
+            resolvePatternId: () => 1,
+            sleep: () => Promise.resolve()
+        });
+        check('timeout → aborted', summary.aborted, true);
+        check('timeout → fault labelled', summary.fault, 'controller_unresponsive');
+        check(
+            'timeout → faultDetail names the op',
+            summary.faultDetail && summary.faultDetail.op,
+            'trialParams'
+        );
+
+        // A plain send failure (not a timeout) still aborts but is NOT a fault.
+        const link2 = makeFakeLink({ failSend: true });
+        const runner2 = new Runner.ArenaRunner(link2, Wire);
+        const s2 = await runner2.runSequence({
+            steps,
+            conditionsByName,
+            resolvePatternId: () => 1,
+            sleep: () => Promise.resolve()
+        });
+        check('non-timeout failure → aborted', s2.aborted, true);
+        check('non-timeout failure → fault null', s2.fault, null);
+        // A controller REJECT (status 1) is neither an abort nor a fault.
+        const link3 = makeFakeLink({ reply: new Uint8Array([0x02, 0x01, 0x08]) });
+        const runner3 = new Runner.ArenaRunner(link3, Wire);
+        const s3 = await runner3.runSequence({
+            steps,
+            conditionsByName,
+            resolvePatternId: () => 1,
+            sleep: () => Promise.resolve()
+        });
+        check('reject → fault null', s3.fault, null);
+        // The fake link answers every command (incl. STOP) with status 1 here.
+        check('stopAcked reflects the STOP reply', s3.stopAcked, false);
+        const link4 = makeFakeLink();
+        const s4 = await new Runner.ArenaRunner(link4, Wire).runSequence({
+            steps,
+            conditionsByName,
+            resolvePatternId: () => 1,
+            sleep: () => Promise.resolve()
+        });
+        check('clean run → fault null', s4.fault, null);
+        check('clean run → stopAcked true', s4.stopAcked, true);
+    }
+
     console.log('\n=== Summary ===');
     console.log(`${totalChecks - failures} / ${totalChecks} checks passed`);
     process.exit(failures === 0 ? 0 : 1);
diff --git a/tests/test-arena-session.js b/tests/test-arena-session.js
index 9b4e6c1d..a8deb8c9 100644
--- a/tests/test-arena-session.js
+++ b/tests/test-arena-session.js
@@ -480,7 +480,195 @@ function newSession(m) {
         check('runConditionName reflects runner', s.runConditionName, 'cond_x');
     }
 
+    // ── fw #50: runner sends are logged through the session; bridge fault → runner.fault
+    console.log('\n=== runner link facade routes through session.send ===');
+    {
+        const m = makeMocks();
+        const s = newSession(m);
+        await s.connect();
+        checkBool('runner got a facade, not the bare link', s._runner.link !== s._link);
+        checkBool('facade reports link connectivity', s._runner.link.connected === true);
+        const before = s._link.sent.length;
+        await s._runner.link.send(new Uint8Array([1, 0x30]), { timeoutMs: 7 });
+        check('runner send reached the link with opts', s._link.sent[before], [
+            [1, 0x30],
+            { timeoutMs: 7 }
+        ]);
+        s.setOutputInhibited('replay');
+        let blocked = null;
+        try {
+            s._runner.link.send(new Uint8Array([1, 0x30]));
+        } catch (e) {
+            blocked = e.code || e.message;
+        }
+        checkBool('runner send obeys the output interlock', blocked !== null, String(blocked));
+        s.setOutputInhibited(null);
+        await s.disconnect();
+    }
+
+    console.log('\n=== bridge fault → runner.fault + session fault event ===');
+    {
+        const m = makeMocks();
+        class MockBridge {
+            constructor(o) {
+                this.o = o;
+                this._h = {};
+                this.logging = false;
+                this.apply = false;
+            }
+            on(ev, fn) {
+                (this._h[ev] = this._h[ev] || []).push(fn);
+                return () => {};
+            }
+            emit(ev, ...a) {
+                (this._h[ev] || []).forEach((fn) => fn(...a));
+            }
+            setApply() {}
+            log() {}
+        }
+        const faults = [];
+        m.RunnerLib.ArenaRunner.prototype.fault = function (reason, detail) {
+            m.calls.push('runner.fault');
+            this.lastFault = { reason, detail };
+        };
+        const s = new ArenaSession({
+            wire: { mark: 1 },
+            LinkClass: m.MockLink,
+            RunnerLib: m.RunnerLib,
+            BridgeClientLib: MockBridge
+        });
+        let states = 0;
+        s.on('fault', (f) => faults.push(f));
+        s.on('state', () => states++);
+        const f = { kind: 'controller_unresponsive', failures: 3, window: 10 };
+        s.bridge.emit('fault', f);
+        checkBool('runner.fault called', m.calls.includes('runner.fault'));
+        check('runner got reason + detail', s._runner.lastFault, {
+            reason: 'controller_unresponsive',
+            detail: f
+        });
+        check("session re-emits 'fault'", faults, [f]);
+        checkBool("'state' emitted after fault", states >= 1);
+        checkBool('runner.abort NOT used when fault() exists', !m.calls.includes('runner.abort'));
+        delete m.RunnerLib.ArenaRunner.prototype.fault;
+    }
+
+    console.log('\n=== bridge applyFrame: a controller REJECT counts as an apply failure ===');
+    {
+        const m = makeMocks();
+        let status = 0;
+        m.MockLink.prototype.send = function (bytes, opts) {
+            this.sent.push([Array.from(bytes), opts]);
+            return Promise.resolve(new Uint8Array([2, status, bytes[1] || 0]));
+        };
+        class MockBridge {
+            constructor(o) {
+                this.applyFrame = o.applyFrame;
+                this.logging = false;
+            }
+            on() {
+                return () => {};
+            }
+            setApply() {}
+        }
+        const wire = {
+            encodeSetFramePosition: (i) => new Uint8Array([3, 0x70, i & 0xff, i >> 8]),
+            decodeResponse: (f) => ({ status: f[1], ok: f[1] === 0, echoCmd: f[2] })
+        };
+        const s = new ArenaSession({
+            wire,
+            LinkClass: m.MockLink,
+            RunnerLib: m.RunnerLib,
+            BridgeClientLib: MockBridge
+        });
+        await s.connect();
+        let okResp = null;
+        await s.bridge.applyFrame(7).then((r) => (okResp = r));
+        checkBool('status 0 → applyFrame resolves', okResp instanceof Uint8Array);
+        status = 1;
+        let rejected = null;
+        await s.bridge.applyFrame(8).catch((e) => (rejected = e));
+        checkBool(
+            'status 1 → applyFrame REJECTS',
+            rejected instanceof Error,
+            rejected && rejected.message
+        );
+        check('reject carries the status', rejected && rejected.status, 1);
+        checkBool(
+            'reject message names the command',
+            /SET_FRAME_POSITION/.test(rejected && rejected.message)
+        );
+    }
+
+    console.log('\n=== runstatus sanitizer keeps fault detail + terminal summary ===');
+    {
+        const m = makeMocks();
+        const s = newSession(m);
+        const out = s._sanitizeRunStatus({
+            phase: 'aborted',
+            summary: {
+                completed: false,
+                aborted: true,
+                steps: 3,
+                errors: 1,
+                skipped: 0,
+                fault: 'controller_unresponsive',
+                stopAcked: false,
+                extra: 'dropped'
+            }
+        });
+        check('summary passthrough (allowlist)', out.summary, {
+            completed: false,
+            aborted: true,
+            steps: 3,
+            errors: 1,
+            skipped: 0,
+            fault: 'controller_unresponsive',
+            stopAcked: false
+        });
+        const out2 = s._sanitizeRunStatus({ phase: 'fault', reason: 'x', detail: { failures: 3 } });
+        check('fault detail passthrough', [out2.reason, out2.detail], ['x', { failures: 3 }]);
+    }
+
     // ── summary ─────────────────────────────────────────────────────────────────
+
+    console.log('\n=== send({silent:true}) skips the bridge command log ===');
+    {
+        const logged = [];
+        const bridge = {
+            logging: true,
+            connected: true,
+            log: (o) => logged.push(o),
+            on: () => () => {}
+        };
+        const link = {
+            connected: true,
+            send: async () => Uint8Array.from([3, 0x00, 0xa9, 0]),
+            setCallbacks() {},
+            on() {
+                return () => {};
+            }
+        };
+        const m = makeMocks();
+        const sess = new ArenaSession({
+            wire: { mark: 1 },
+            LinkClass: m.MockLink,
+            RunnerLib: m.RunnerLib
+        });
+        sess._link = link;
+        sess._bridge = bridge;
+        await sess.send(Uint8Array.from([8, 0xa9, 0xff, 0xff, 0xff, 0xff, 0xb2, 0, 0]), {
+            silent: true
+        });
+        await sess.send(Uint8Array.from([1, 0xc2]));
+        await new Promise((r) => setTimeout(r, 5));
+        check('silent send not logged, normal send logged', logged.length, 1);
+        check(
+            'logged one is the 0xC2',
+            logged[0] && logged[0].head && logged[0].head.slice(0, 5),
+            '01 c2'
+        );
+    }
     console.log('\n=== Summary ===');
     console.log(`${totalChecks - failures} / ${totalChecks} checks passed`);
     process.exit(failures === 0 ? 0 : 1);
diff --git a/tests/test-arena-telemetry.js b/tests/test-arena-telemetry.js
new file mode 100644
index 00000000..644c88cb
--- /dev/null
+++ b/tests/test-arena-telemetry.js
@@ -0,0 +1,402 @@
+#!/usr/bin/env node
+/**
+ * Tests for js/arena-telemetry.js — the controller telemetry ring decoder +
+ * ack-cursor drainer (fw feat/telemetry-ring). Synthetic 0xA9 reply frames,
+ * a fake session that models the controller's ring (records are freed only by
+ * the NEXT request's ack, `more` when records remain), no hardware.
+ */
+'use strict';
+
+const T = require('../js/arena-telemetry.js');
+const Wire = require('../js/arena-wire-g6.js');
+
+let totalChecks = 0;
+let failures = 0;
+function check(name, got, expected) {
+    totalChecks++;
+    const ok = JSON.stringify(got) === JSON.stringify(expected);
+    console.log(
+        `  ${ok ? 'PASS' : 'FAIL'}  ${name}: got ${JSON.stringify(got)}, expected ${JSON.stringify(expected)}`
+    );
+    if (!ok) failures++;
+}
+function checkBool(name, ok, info) {
+    totalChecks++;
+    console.log(`  ${ok ? 'PASS' : 'FAIL'}  ${name}${info ? ' — ' + info : ''}`);
+    if (!ok) failures++;
+}
+
+// ---- byte builders -------------------------------------------------------
+const u16 = (v) => [v & 0xff, (v >> 8) & 0xff];
+const u32 = (v) => [v & 0xff, (v >>> 8) & 0xff, (v >>> 16) & 0xff, (v >>> 24) & 0xff];
+function rec(type, seq, tUs, payload) {
+    const body = [type].concat(u32(seq), u32(tUs), payload);
+    return [body.length + 1].concat(body);
+}
+const cmdRec = (seq, t, cmd, status, req) => rec(1, seq, t, [cmd, status, req.length].concat(req));
+const frameRec = (seq, t, idx, pat, sd, spi) =>
+    rec(2, seq, t, [].concat(u16(idx), u16(pat), u32(sd), u16(spi)));
+const stateRec = (seq, t, kind, code, arg) => rec(3, seq, t, [kind, code].concat(u16(arg)));
+const padRec = (n) => [n, 0].concat(new Array(n - 2).fill(0));
+function block(h, records) {
+    const payload = []
+        .concat(
+            u32(h.tNowUs),
+            u32(h.firstSeq),
+            u16(records.length),
+            u32(h.dropped || 0),
+            [h.more ? 1 : 0],
+            [h.flags == null ? 1 : h.flags],
+            u16(h.bootCount || 0)
+        )
+        .concat(...records);
+    return Uint8Array.from([payload.length + 2, 0x00, 0xa9].concat(payload));
+}
+
+(async () => {
+    console.log('=== encoders ===');
+    check('encodeSetTelemetry(1)', Array.from(Wire.encodeSetTelemetry(1)), [4, 0xa8, 1, 0, 0]);
+    check(
+        'encodeSetTelemetry(0, 500)',
+        Array.from(Wire.encodeSetTelemetry(0, 500)),
+        [4, 0xa8, 0, 0xf4, 0x01]
+    );
+    check(
+        'encodeGetTelemetryBlock(no ack, 180)',
+        Array.from(Wire.encodeGetTelemetryBlock(null, 180)),
+        [8, 0xa9, 0xff, 0xff, 0xff, 0xff, 180, 0, 0]
+    );
+    check(
+        'encodeGetTelemetryBlock(ack 0x01020304, 64, flags 1)',
+        Array.from(Wire.encodeGetTelemetryBlock(0x01020304, 64, 1)),
+        [8, 0xa9, 4, 3, 2, 1, 64, 0, 1]
+    );
+    check('TELEMETRY_NO_ACK', Wire.TELEMETRY_NO_ACK, 0xffffffff);
+
+    console.log('\n=== parseBlock ===');
+    {
+        const b = T.parseBlock(
+            block(
+                { tNowUs: 123456789, firstSeq: 10, dropped: 2, more: true, flags: 3, bootCount: 4 },
+                [
+                    cmdRec(10, 1000, 0x70, 0, [0x03, 0x70, 0x4e, 0x00]),
+                    frameRec(11, 1500, 78, 36, 1961, 812),
+                    padRec(3),
+                    stateRec(12, 2000, 4, 0, 1290),
+                    stateRec(13, 2100, 2, 4, 36)
+                ]
+            ),
+            Wire
+        );
+        checkBool('parses', !!b);
+        check(
+            'header',
+            [
+                b.tNowUs,
+                b.firstSeq,
+                b.nRecords,
+                b.dropped,
+                b.more,
+                b.eventsEnabled,
+                b.survivedReboot,
+                b.bootCount,
+                b.disabledHeapCollision,
+                b.syntheticOn
+            ],
+            [123456789, 10, 5, 2, true, true, true, 4, false, false]
+        );
+        check(
+            'frame sd_load is u32 (129 ms fits)',
+            T.parseBlock(
+                block({ tNowUs: 1, firstSeq: 1, more: false, flags: 0 }, [
+                    frameRec(1, 5, 78, 36, 129000, 812)
+                ]),
+                Wire
+            ).records[0].sdLoadUs,
+            129000
+        );
+        check(
+            'header flag bits 2/3 (heap collision, synthetic)',
+            (({ disabledHeapCollision, syntheticOn }) => [disabledHeapCollision, syntheticOn])(
+                T.parseBlock(block({ tNowUs: 1, firstSeq: 1, more: false, flags: 0x0c }, []), Wire)
+            ),
+            [true, true]
+        );
+        check('record count (pad skipped)', b.records.length, 4);
+        check(
+            'state wdog_context decodes EXC_RETURN / IPSR / prior isr (kind 8)',
+            (({ stateName, code, ipsr, preempted, priorIsrName }) => [
+                stateName,
+                code,
+                ipsr,
+                preempted,
+                priorIsrName
+            ])(
+                T.parseBlock(
+                    block({ tNowUs: 1, firstSeq: 1, more: false, flags: 0 }, [
+                        stateRec(1, 5, 8, 0xf9, 138 | (4 << 9))
+                    ]),
+                    Wire
+                ).records[0]
+            ),
+            ['wdog_context', 0xf9, 138, 'handler_138', 'usb']
+        );
+        check(
+            'wdog_context EXC_RETURN mode from bit 3 (0xE1 = FP-stacked handler)',
+            T.parseBlock(
+                block({ tNowUs: 1, firstSeq: 1, more: false, flags: 0 }, [
+                    stateRec(1, 5, 8, 0xe1, 138)
+                ]),
+                Wire
+            ).records[0].excReturnMode,
+            'handler'
+        );
+        check(
+            'state timer_fail (kind 10)',
+            T.parseBlock(
+                block({ tNowUs: 1, firstSeq: 1, more: false, flags: 0 }, [
+                    stateRec(1, 5, 10, 0, 300)
+                ]),
+                Wire
+            ).records[0].stateName,
+            'timer_fail'
+        );
+        check(
+            'state prev_isr_count names the ISR and scales the count (kind 9)',
+            (({ stateName, isrName, countApprox }) => [stateName, isrName, countApprox])(
+                T.parseBlock(
+                    block({ tNowUs: 1, firstSeq: 1, more: false, flags: 0 }, [
+                        stateRec(1, 5, 9, 7, 3)
+                    ]),
+                    Wire
+                ).records[0]
+            ),
+            ['prev_isr_count', 'pit', 12288]
+        );
+        check(
+            'cmd record',
+            [
+                b.records[0].kind,
+                b.records[0].seq,
+                b.records[0].tUs,
+                b.records[0].cmd,
+                b.records[0].status,
+                b.records[0].req
+            ],
+            ['cmd', 10, 1000, 0x70, 0, '03704e00']
+        );
+        check(
+            'frame record',
+            [
+                b.records[1].kind,
+                b.records[1].idx,
+                b.records[1].pattern,
+                b.records[1].sdLoadUs,
+                b.records[1].spiUs
+            ],
+            ['frame', 78, 36, 1961, 812]
+        );
+        check(
+            'state sd_slow',
+            [b.records[2].kind, b.records[2].stateName, b.records[2].arg],
+            ['state', 'sd_slow', 1290]
+        );
+        check(
+            'state change names the arena state',
+            [b.records[3].stateName, b.records[3].codeName, b.records[3].arg],
+            ['state_change', 'SHOW_FRAME', 36]
+        );
+        check('no malformed', b.malformed, 0);
+        const rows = T.toRows(b, 1789000000000);
+        check('rows', rows, [
+            ['cc', 1789000000000, 1000, 10, 0x70, 0, '03704e00'],
+            ['cf', 1789000000000, 1500, 11, 78, 36, 1961, 812],
+            ['cs', 1789000000000, 2000, 12, 4, 0, 1290],
+            ['cs', 1789000000000, 2100, 13, 2, 4, 36]
+        ]);
+        checkBool(
+            'status!=0 reply → null',
+            T.parseBlock(Uint8Array.from([2, 1, 0xa9]), Wire) === null
+        );
+        checkBool(
+            'short header → null',
+            T.parseBlock(Uint8Array.from([5, 0, 0xa9, 1, 2, 3]), Wire) === null
+        );
+        const bad = T.parseBlock(block({ tNowUs: 1, firstSeq: 1 }, [[40, 1, 0, 0, 0, 0]]), Wire); // len overruns
+        check('truncated record counted as malformed', bad.malformed, 1);
+    }
+
+    console.log('\n=== drainer: ack cursor, lossless re-ask, gaps, drainAll ===');
+    {
+        // Controller model: a queue of records; a request frees seq ≤ ack, then
+        // returns up to `per` records from the head WITHOUT freeing them.
+        const ring = [];
+        let next = 1;
+        const push = (n) => {
+            for (let i = 0; i < n; i++)
+                (ring.push(cmdRec(next, next * 100, 0x70, 0, [3, 0x70, next & 0xff, 0])), next++);
+        };
+        const per = 3;
+        const asked = [];
+        let failNext = false;
+        const session = {
+            async send(bytes) {
+                const ack =
+                    (bytes[2] | (bytes[3] << 8) | (bytes[4] << 16) | (bytes[5] << 24)) >>> 0;
+                asked.push(ack);
+                if (failNext) {
+                    failNext = false;
+                    throw new Error('response timeout after 1500 ms (cmd 0xa9)');
+                }
+                if (ack !== 0xffffffff)
+                    while (
+                        ring.length &&
+                        (ring[0][2] |
+                            (ring[0][3] << 8) |
+                            (ring[0][4] << 16) |
+                            (ring[0][5] << 24)) >>>
+                            0 <=
+                            ack
+                    )
+                        ring.shift();
+                const out = ring.slice(0, per);
+                const firstSeq = out.length
+                    ? (out[0][2] | (out[0][3] << 8) | (out[0][4] << 16) | (out[0][5] << 24)) >>> 0
+                    : 0;
+                return block({ tNowUs: 999, firstSeq, more: ring.length > per, flags: 1 }, out);
+            }
+        };
+        const got = [];
+        const d = T.createDrainer({
+            session,
+            wire: Wire,
+            maxChunks: 10,
+            now: () => 42,
+            onRecords: (b, rows) => got.push(...rows)
+        });
+        push(7);
+        const blocks = await d.drainOnce();
+        check('drained in chunks following `more`', blocks.length, 3);
+        check('all 7 records delivered as rows', got.length, 7);
+        check('seq continuous, no gaps', d.stats.gaps, 0);
+        check('first request carried NO_ACK', asked[0], 0xffffffff);
+        check('second request acked seq 3', asked[1], 3);
+        check('ring drained (acked to 7 on next ask)', d.stats.lastSeq, 7);
+        // Lossless re-ask: a timeout leaves lastSeq unchanged; the next request
+        // repeats the same ack and gets the SAME records.
+        push(2); // seq 8, 9
+        failNext = true;
+        await d.drainOnce();
+        check('timeout counted', d.stats.errors, 1);
+        const before = got.length;
+        await d.drainOnce();
+        check('re-ask got the two records once', got.length - before, 2);
+        check('ring freed up to 9 after the following ask', d.stats.lastSeq, 9);
+        // Gap detection: the controller skips seq 10 (a dropped record)
+        next = 11;
+        push(1);
+        await d.drainOnce();
+        check('gap detected', d.stats.gaps, 1);
+        // ACK MEANS STORED: a sink that refuses the rows (bridge not logging) must
+        // NOT advance the cursor — the same records come back on the next poll.
+        let refuse = true;
+        const d2 = T.createDrainer({
+            session,
+            wire: Wire,
+            maxChunks: 10,
+            now: () => 42,
+            onRecords: () => (refuse ? false : true)
+        });
+        d2.stats.lastSeq = d.stats.lastSeq; // continue from the same cursor
+        const asked2 = asked.length;
+        push(3); // seq 12..14
+        await d2.drainOnce();
+        check('refused rows counted', d2.stats.notStored, 1);
+        check('cursor did not advance on refusal', d2.stats.lastSeq, 11);
+        refuse = false;
+        await d2.drainOnce();
+        check('same ack re-sent after refusal', asked[asked2 + 1], asked[asked2]);
+        check('records stored on the retry', d2.stats.lastSeq, 14);
+        check('records counted once', d2.stats.records, 3);
+        next = 15;
+        d.stats.lastSeq = d2.stats.lastSeq; // one ring, one cursor: hand it back to d
+        // drainAll on a bigger backlog
+        push(20);
+        const all = await d.drainAll();
+        checkBool(
+            'drainAll emptied the backlog',
+            all.length >= 7 && ring.length <= per,
+            'ring=' + ring.length
+        );
+        check('stats.records total', d.stats.records, 7 + 2 + 1 + 20);
+        // rearm(): same incarnation → NO_ACK request, duplicates dropped, cursor continues
+        const seqBefore = d.stats.lastSeq;
+        const recBefore = d.stats.records;
+        d.rearm();
+        push(2);
+        const askedBefore = asked.length;
+        await d.drainOnce();
+        check('rearm sends NO_ACK first', asked[askedBefore], 0xffffffff);
+        checkBool('rearm re-delivered nothing new twice', d.stats.duplicates >= 0);
+        check('cursor continued past the new records', d.stats.lastSeq, seqBefore + 2);
+        check('only the 2 new records counted', d.stats.records - recBefore, 2);
+        d.reset();
+        check('reset forgets the cursor', [d.stats.ackSeq, d.stats.lastSeq], [0xffffffff, null]);
+    }
+
+    console.log('\n=== poller: single-flight, gated ===');
+    {
+        let gate = { ok: false, reason: 'no run' };
+        let drains = 0;
+        const drainer = {
+            drainOnce: async () => {
+                drains++;
+                await new Promise((r) => setTimeout(r, 5));
+                return [];
+            },
+            stats: { errors: 0 }
+        };
+        const states = [];
+        const p = T.createPoller({
+            drainer,
+            canPoll: () => gate,
+            onState: (s, r) => states.push(s + (r ? ':' + r : ''))
+        });
+        await p.tick();
+        check('gated tick does not drain', drains, 0);
+        check('paused with reason', states[states.length - 1], 'paused:no run');
+        gate = { ok: true };
+        const a = p.tick();
+        const b = p.tick(); // overlapping → skipped
+        await Promise.all([a, b]);
+        check('single-flight: one drain for two overlapping ticks', drains, 1);
+        check('skipped counted', p.counts.skipped, 1);
+        check('state polling', p.state, 'polling');
+    }
+
+    console.log('\n=== poller: stop() must not invoke clearInterval as a method (browser) ===');
+    {
+        const d = T.createDrainer({ session: { send: async () => new Uint8Array(0) }, wire: Wire });
+        const p = T.createPoller({ drainer: d, canPoll: () => ({ ok: true }) });
+        const strictClear = function (h) {
+            if (this !== undefined && this !== globalThis)
+                throw new TypeError('Illegal invocation');
+            clearInterval(h);
+        };
+        p.start(1000, setInterval, strictClear);
+        let threw = null;
+        try {
+            p.stop();
+        } catch (e) {
+            threw = e && e.message;
+        }
+        check('stop() with a this-sensitive clearInterval does not throw', threw, null);
+        check('poller stopped', p.state, 'stopped');
+    }
+    console.log('\n=== Summary ===');
+    console.log(`${totalChecks - failures} / ${totalChecks} checks passed`);
+    process.exit(failures === 0 ? 0 : 1);
+})().catch((e) => {
+    console.error('test crashed:', e);
+    process.exit(1);
+});
diff --git a/tests/test-arena-wire-g6.js b/tests/test-arena-wire-g6.js
index 6fe51bbf..f7a50055 100644
--- a/tests/test-arena-wire-g6.js
+++ b/tests/test-arena-wire-g6.js
@@ -573,5 +573,249 @@ checkBool(
     Wire.decodePanelDisplayMode(Uint8Array.from([0x03, 0x01, 0x1c, 0x02])) === null
 );
 
+// ── GET_HEALTH 0xCA (fw #50 soak/post-mortem probe) ─────────────────────────
+console.log('\n=== GET_HEALTH (0xCA) ===');
+checkBytes('encodeGetHealth', Wire.encodeGetHealth(), '01 ca');
+check('OPCODES.GET_HEALTH', Wire.OPCODES.GET_HEALTH, 0xca);
+check('HEALTH_PAYLOAD_BYTES', Wire.HEALTH_PAYLOAD_BYTES, 55);
+{
+    // Build a 55-byte payload field by field (LE).
+    const u8 = (v) => [v & 0xff];
+    const u16 = (v) => [v & 0xff, (v >> 8) & 0xff];
+    const u32 = (v) => [v & 0xff, (v >>> 8) & 0xff, (v >>> 16) & 0xff, (v >>> 24) & 0xff];
+    const payload = [].concat(
+        u8(1), // ver
+        u8(0x0b), // flags: sd_mounted | pattern_open | breadcrumb_valid (not display_active)
+        u32(123456), // uptime_ms
+        u32(9876543), // loop_count
+        u32(4800), // loop_max_us
+        u32(310), // loop_max_1s_us
+        u32(77777), // sd_reads
+        u32(2900), // sd_read_max_us
+        u8(0), // sd_err
+        u32(0), // sd_err_data
+        u32(0x12345678), // frames_sent
+        u32(0xfffffffe), // isr_count (unsigned)
+        u32(70707), // cmd70_count
+        u8(4), // state = SHOW_FRAME
+        u16(199), // cur_frame
+        u32(0x00000800), // reset_cause (bit 11 = ... any u32 survives)
+        u8(1), // prev_breadcrumb = sd_read
+        u32(4000000000) // prev_breadcrumb_us (unsigned)
+    );
+    check('fixture is 55 bytes', payload.length, 55);
+    const frame = Uint8Array.from([payload.length + 2, 0x00, 0xca].concat(payload));
+    const h = Wire.decodeHealth(frame);
+    checkBool('decodeHealth returns an object', !!h);
+    check('ver', h.ver, 1);
+    check(
+        'flags decoded',
+        [h.sdMounted, h.patternOpen, h.displayActive, h.breadcrumbValid].join(','),
+        'true,true,false,true'
+    );
+    check('uptimeMs', h.uptimeMs, 123456);
+    check('loopCount', h.loopCount, 9876543);
+    check('loopMaxUs / loopMax1sUs', [h.loopMaxUs, h.loopMax1sUs].join(','), '4800,310');
+    check('sdReads / sdReadMaxUs', [h.sdReads, h.sdReadMaxUs].join(','), '77777,2900');
+    check('sdErr / sdErrData', [h.sdErr, h.sdErrData].join(','), '0,0');
+    check('framesSent', h.framesSent, 0x12345678);
+    check('isrCount unsigned', h.isrCount, 4294967294);
+    check('cmd70Count', h.cmd70Count, 70707);
+    check('state / curFrame', [h.state, h.curFrame].join(','), '4,199');
+    check('resetCause u32', h.resetCause, 0x800);
+    check('prevBreadcrumb + name', [h.prevBreadcrumb, h.prevBreadcrumbOp].join(','), '1,sd_read');
+    check('prevBreadcrumbUs unsigned', h.prevBreadcrumbUs, 4000000000);
+    checkBool('short payload → null', Wire.decodeHealth(frame.slice(0, 20)) === null);
+    checkBool(
+        'status!=0 → null',
+        Wire.decodeHealth(Uint8Array.from([payload.length + 2, 0x01, 0xca].concat(payload))) ===
+            null
+    );
+    // Longer payload (future fields appended) still decodes.
+    const longer = Uint8Array.from([payload.length + 4, 0x00, 0xca].concat(payload, [9, 9]));
+    checkBool('longer payload tolerated', Wire.decodeHealth(longer) !== null);
+    checkBool(
+        '2-byte tail does not decode as the slow-op tail',
+        Wire.decodeHealth(longer).slowOp === undefined
+    );
+    // The shipped 66-byte layout: 11-byte slowest-op tail.
+    const tail = [].concat(u8(0x01), u8(1), u32(1300000), u8(2), u32(4200));
+    const full = Uint8Array.from(
+        [payload.length + tail.length + 2, 0x00, 0xca].concat(payload, tail)
+    );
+    const hf = Wire.decodeHealth(full);
+    check('HEALTH_PAYLOAD_BYTES_FULL', Wire.HEALTH_PAYLOAD_BYTES_FULL, 66);
+    check('tail: prevBreadcrumbArg (opcode of the reset command)', hf.prevBreadcrumbArg, 0x01);
+    check('tail: prevSlowOp + name', [hf.prevSlowOp, hf.prevSlowOpName].join(','), '1,sd_read');
+    check('tail: prevSlowUs', hf.prevSlowUs, 1300000);
+    check('tail: slowOp + name', [hf.slowOp, hf.slowOpName].join(','), '2,spi_transfer');
+    check('tail: slowUs', hf.slowUs, 4200);
+}
+// GET_FRAME_POSITION 0x72: cur_frame u16 LE + frame_count u16 LE.
+checkBytes('encodeGetFramePosition', Wire.encodeGetFramePosition(), '01 72');
+{
+    const fp = Wire.decodeFramePosition(
+        Uint8Array.from([0x06, 0x00, 0x72, 0xc7, 0x00, 0xc8, 0x00])
+    );
+    check('decodeFramePosition index', fp && fp.index, 199);
+    check('decodeFramePosition frameCount', fp && fp.frameCount, 200);
+    checkBool(
+        'decodeFramePosition rejects status!=0',
+        Wire.decodeFramePosition(Uint8Array.from([0x06, 0x01, 0x72, 0, 0, 0, 0])) === null
+    );
+}
+// GET_FIRMWARE_VERSION 0xCB: build identity (ships with the health capability).
+checkBytes('encodeGetFirmwareVersion', Wire.encodeGetFirmwareVersion(), '01 cb');
+check('FIRMWARE_VERSION_PAYLOAD_BYTES', Wire.FIRMWARE_VERSION_PAYLOAD_BYTES, 46);
+{
+    const pad = (s, n) => (s + ' '.repeat(n)).slice(0, n);
+    const bytes = (s) => Array.from(s).map((c) => c.charCodeAt(0));
+    const payload = [1, 2, 10, 0x01].concat(
+        bytes(pad('06a6f25', 8)),
+        bytes('2026-09-12'),
+        bytes(pad('feat/controller-health-2x10', 24))
+    );
+    check('fixture is 46 bytes', payload.length, 46);
+    const v = Wire.decodeFirmwareVersion(
+        Uint8Array.from([payload.length + 2, 0x00, 0xcb].concat(payload))
+    );
+    check('ver', v.ver, 1);
+    check('arena rows×cols', v.arena, '2x10');
+    check('sha trimmed', v.sha, '06a6f25');
+    check('date', v.date, '2026-09-12');
+    check('flags bit 2 = telemetry ring (absent here)', v.telemetry, false);
+    check('flags bit 3 = crash report / health v2 (absent here)', v.crashReport, false);
+    check('flags bit 4 = free-running refresh timer (absent here)', v.freeRunningTimer, false);
+    check(
+        'ISR names 4–7 (usb/sdhc/lpspi/pit)',
+        Wire.HEALTH_ISR_NAMES.slice(4).join(','),
+        'usb,sdhc,lpspi,pit'
+    );
+    check('branch truncated to 24', v.branch, 'feat/controller-health-2');
+    check('dirty flag', v.dirty, true);
+    check('debug flag', v.debug, false);
+    check('label', v.label, '06a6f25* 2x10 2026-09-12 feat/controller-health-2');
+    checkBool(
+        'status!=0 → null',
+        Wire.decodeFirmwareVersion(
+            Uint8Array.from([payload.length + 2, 0x01, 0xcb].concat(payload))
+        ) === null
+    );
+    checkBool(
+        'short → null',
+        Wire.decodeFirmwareVersion(Uint8Array.from([5, 0x00, 0xcb, 1, 2, 10])) === null
+    );
+}
+// GET_HEALTH ver 2 tail (fw fb11681): 89 B — ISR breadcrumb + watchdog PC capture.
+{
+    const u32 = (v) => [v & 0xff, (v >>> 8) & 0xff, (v >>> 16) & 0xff, (v >>> 24) & 0xff];
+    const base = new Array(66).fill(0);
+    base[0] = 2; // ver
+    base[55] = 0x70; // prev_breadcrumb_arg
+    const tail = [3].concat(
+        u32(123456),
+        u32(0x6000abcd),
+        u32(0x60001235),
+        [0x0f],
+        [0],
+        u32(42),
+        u32(9999)
+    );
+    const payload = base.concat(tail);
+    check('v2 payload is 89 B', payload.length, Wire.HEALTH_PAYLOAD_BYTES_V2);
+    const h = Wire.decodeHealth(Uint8Array.from([payload.length + 2, 0x00, 0xca].concat(payload)));
+    check('prev ISR = watchdog', h.prevIsrLastName, 'watchdog');
+    check('prev ISR count', h.prevIsrCount, 123456);
+    check('captured PC hex', h.prevWdogPcHex, '0x6000abcd');
+    check(
+        'wdog flags decoded',
+        [
+            h.wdogArmed,
+            h.prevResetWasWatchdog,
+            h.prevPcCaptured,
+            h.wdogCompiledIn,
+            h.wdogSuspended
+        ].join(),
+        'true,true,true,true,false'
+    );
+    check('kicks', h.wdogKicks, 9999);
+    check(
+        'sub-op names',
+        [Wire.HEALTH_BREADCRUMB_OPS[6], Wire.HEALTH_BREADCRUMB_OPS[9]].join(),
+        'cmd_disarm_timer,cmd_respond'
+    );
+    const v3 = payload.concat(u32(0x2520), u32(0x36e0));
+    check('v3 payload is 97 B', v3.length, Wire.HEALTH_PAYLOAD_BYTES_V3);
+    const h3 = Wire.decodeHealth(Uint8Array.from([v3.length + 2, 0x00, 0xca].concat(v3)));
+    check('v3 CS at boot', h3.wdogCsBootHex, '0x2520');
+    check(
+        'v3 hardware EN/INT/UPDATE/RCS/CMD32',
+        [h3.wdogHwEnabled, h3.wdogHwInt, h3.wdogHwUpdate, h3.wdogHwRcs, h3.wdogHwCmd32].join(),
+        'true,true,true,true,true'
+    );
+    check('v2 payload has no v3 fields', h.wdogCsNow, undefined);
+    const v4 = v3.concat(u32(500), u32(1000), [0x10]);
+    check('v4 payload is 106 B', v4.length, Wire.HEALTH_PAYLOAD_BYTES_V4);
+    const h4 = Wire.decodeHealth(Uint8Array.from([v4.length + 2, 0x00, 0xca].concat(v4)));
+    check('v4 timeout seconds', h4.wdogTimeoutS, 2);
+    check('v4 verify bits', [h4.wdogVerifyRcsTimeout, h4.wdogVerifyKeyRetry].join(), 'false,true');
+    const u16b = (v) => [v & 0xff, (v >> 8) & 0xff];
+    const v5 = v4.concat(u16b(16), u16b(0), u16b(1), u16b(7));
+    check('v5 payload is 114 B', v5.length, Wire.HEALTH_PAYLOAD_BYTES_V5);
+    const h5 = Wire.decodeHealth(Uint8Array.from([v5.length + 2, 0x00, 0xca].concat(v5)));
+    check(
+        'v5 CNT diagnostics',
+        [h5.wdogCntBeforeMax, h5.wdogCntAfterMin, h5.wdogCntAfterMax, h5.wdogCntNow].join(),
+        '16,0,1,7'
+    );
+    const h66 = Wire.decodeHealth(Uint8Array.from([66 + 2, 0x00, 0xca].concat(base)));
+    check('66 B payload has no v2 fields', h66.wdogFlags, undefined);
+}
+// GET_CRASHREPORT 0xCC: PJRC arm_fault_info_struct passthrough.
+{
+    check('encodeGetCrashReport', Array.from(Wire.encodeGetCrashReport()).join(), '1,204');
+    const u32 = (v) => [v & 0xff, (v >>> 8) & 0xff, (v >>> 16) & 0xff, (v >>> 24) & 0xff];
+    const rec = [].concat(
+        u32(11), // len in WORDS (sizeof(arm_fault_info_struct)/4)
+        u32(3),
+        u32(0x00008200),
+        u32(0x40000000),
+        u32(0),
+        u32(0x2027f000),
+        u32(0x60001234),
+        u32(0x21000000),
+        [0, 0, 0x48, 0x42],
+        u32(1789242267),
+        u32(0xdeadbeef)
+    );
+    const payload = rec.concat(new Array(128 - rec.length).fill(0));
+    payload[0x40] = 1;
+    payload[0x44] = 7;
+    const c = Wire.decodeCrashReport(
+        Uint8Array.from([payload.length + 2, 0x00, 0xcc].concat(payload))
+    );
+    check('fault present', c.present, true);
+    check('fault name', c.faultName, 'HardFault');
+    check('bfar', c.bfar, 0x2027f000);
+    check('return address', c.retAddrHex, '0x60001234');
+    checkBool('temperature decoded (~50 °C)', Math.abs(c.tempC - 50) < 0.01, c.tempC);
+    check(
+        'pjrc breadcrumb mask + first word',
+        [c.pjrcBreadcrumbMask, c.pjrcBreadcrumbs[0]].join(),
+        '1,7'
+    );
+    const empty = Wire.decodeCrashReport(
+        Uint8Array.from([130, 0x00, 0xcc].concat(new Array(128).fill(0)))
+    );
+    check('empty record → present=false', empty.present, false);
+}
+// Capability bit 7 = health.
+{
+    const ci = Uint8Array.from([0x04, 0x00, 0xc2, 0x02, 0xa3]);
+    const d = Wire.decodeControllerInfo(ci);
+    checkBool('capability bit 7 → health', d.capabilities.includes('health'));
+    checkBool('bit 5 io_ext still decoded alongside', d.capabilities.includes('io_ext'));
+}
+
 console.log(`\n=== Summary ===\n${totalChecks - failures} / ${totalChecks} checks passed`);
 process.exit(failures > 0 ? 1 : 0);
diff --git a/tests/test-bridge-behavior.py b/tests/test-bridge-behavior.py
index 27b58df0..32aa40ef 100644
--- a/tests/test-bridge-behavior.py
+++ b/tests/test-bridge-behavior.py
@@ -251,6 +251,24 @@ def write_session(level, inbound, frames=1):
         lw.close()
         return bridge.read_jsonl(os.path.join(d, name))
 
+# tagged array rows ({type:"rows"}, bridge ≥ 3.1): written verbatim, shape-checked per tag
+with tempfile.TemporaryDirectory() as d:
+    lw = bridge.LogWriter(None, "behavior_v2", d)
+    lw.start_new_log()
+    n = lw.write_rows([
+        ["cf", 1, 5000, 1, 7, 36, 129000, 812],   # ok
+        ["cc"],                                    # too short for its tag → dropped
+        ["cs", 1, 5000, 2, 1, 0],                  # cs needs 7 → dropped
+        ["zz", 1],                                 # unknown tag, generic minimum 2 → kept
+        "not a list",                              # dropped
+    ])
+    name = lw.current_name
+    lw.close()
+    got = [r for r in bridge.read_jsonl(os.path.join(d, name)) if isinstance(r, list) and r and r[0] in ("cf", "cc", "cs", "zz")]
+    check("write_rows count (shape-checked)", n, 2)
+    check("kept rows", [r[0] for r in got], ["cf", "zz"])
+    check("cf row verbatim (u32 sd_load)", got[0][6], 129000)
+
 check("default level is behavior_v2", bridge.LogWriter(None).level, "behavior_v2")
 check("legacy log_frames=True → full", bridge.LogWriter(None, True).level, "full")
 check("legacy log_frames=False → default", bridge.LogWriter(None, False).level, "behavior_v2")
@@ -310,6 +328,8 @@ async def drive():
         await dispatch(json.dumps({"type": "log_control", "enabled": True, "level": "behavior_v2"}), ws)
         ack_v2 = ws.sent[-1]
         f_v2 = log.current_name
+        # controller telemetry rows: written verbatim while logging; shape-checked
+        await dispatch(json.dumps({"type": "rows", "rows": [["cc", 1789000000000, 1000, 10, 112, 0, "03704e00"], ["cf", 1789000000000, 1500, 11, 78, 36, 1961, 812], ["bad-tag-too-long", 1], "not-a-row", [1, 2, 3]]}), ws)
         await dispatch(json.dumps({"type": "log_control", "enabled": False}), ws)
         ack_off = ws.sent[-1]
         await dispatch(json.dumps({"type": "log_control", "enabled": True, "level": "behavior_v9"}), ws)
@@ -332,6 +352,9 @@ async def drive():
 check("unknown level: ack reports the level ACTUALLY in force", (ack_bogus["level"], ack_bogus["requested"], ack_bogus["enabled"]), ("behavior_v2", "behavior_v9", True))
 check("behavior_v1 still selectable", ack_v1["level"], "behavior_v1")
 check("the v2 file: hello + log_control logged, schema is v2", (first[0]["type"], first[1]["level"], first[2]["type"]), ("session", "behavior_v2", "log_control"))
+rows = [o for o in first if isinstance(o, list) and o and isinstance(o[0], str) and o[0] in ("cc", "cf")]
+check("telemetry rows written verbatim (2 of 5 candidates)", rows, [["cc", 1789000000000, 1000, 10, 112, 0, "03704e00"], ["cf", 1789000000000, 1500, 11, 78, 36, 1961, 812]])
+check("bad rows dropped, not rewritten", any(isinstance(o, list) and o and o[0] in ("bad-tag-too-long",) for o in first) or any(o == [1, 2, 3] for o in first), False)
 
 print("\n=== Summary ===")
 print(f"{total - failures} / {total} checks passed")
diff --git a/tests/test-fictrac-bridge-client.js b/tests/test-fictrac-bridge-client.js
index b5bb2639..f22cabe9 100644
--- a/tests/test-fictrac-bridge-client.js
+++ b/tests/test-fictrac-bridge-client.js
@@ -442,6 +442,138 @@ async function main() {
         );
     }
 
+    console.log('\n=== #199: indices wrap into the configured frame count before apply ===');
+    {
+        const applied = [];
+        const client = new FicTracBridgeClient({
+            applyFrame: (i) => {
+                applied.push(i);
+                return Promise.resolve();
+            },
+            clampFrame: (i) => i
+        });
+        client.setApply(true);
+        client.setConfig({ frames: 20 });
+        client.handleFrame(156); // computed with the previous 200-frame modulus
+        await tick();
+        client.handleFrame(19);
+        await tick();
+        client.handleFrame(-1); // negative wraps too
+        await tick();
+        check('156 mod 20 → 16, in-range untouched, -1 → 19', applied, [16, 19, 19]);
+        client.setConfig({ frames: 200 });
+        client.handleFrame(156);
+        await tick();
+        check('with the 200-frame modulus 156 passes through', applied[applied.length - 1], 156);
+        const c2 = new FicTracBridgeClient({
+            applyFrame: (i) => {
+                applied.push(i);
+                return Promise.resolve();
+            },
+            clampFrame: (i) => i
+        });
+        c2.setApply(true);
+        c2.handleFrame(999); // no frames configured → no wrap
+        await tick();
+        check('no configured frame count → index untouched', applied[applied.length - 1], 999);
+    }
+
+    console.log('\n=== fault latch (fw #50): repeated apply failures fail closed ===');
+    {
+        // applyFrame fails (link timeout) for the given indices, succeeds otherwise.
+        const failOn = new Set();
+        const mk = (opts) => {
+            const client = new FicTracBridgeClient(
+                Object.assign(
+                    {
+                        applyFrame: (i) =>
+                            failOn.has(i)
+                                ? Promise.reject(
+                                      new Error('response timeout after 500 ms (cmd 0x70)')
+                                  )
+                                : Promise.resolve(),
+                        clampFrame: (i) => i,
+                        now: () => 42
+                    },
+                    opts || {}
+                )
+            );
+            const faults = [];
+            const applyEv = [];
+            client.on('fault', (f) => faults.push(f));
+            client.on('apply', (on) => applyEv.push(on));
+            client.setApply(true);
+            return { client, faults, applyEv };
+        };
+        const drive = async (client, indices) => {
+            for (const i of indices) {
+                client.handleFrame(i);
+                await tick();
+                await tick();
+            }
+        };
+
+        // Three straight timeouts → one fault, apply forced off, loop stops.
+        failOn.clear();
+        [10, 11, 12].forEach((i) => failOn.add(i));
+        let t = mk();
+        await drive(t.client, [1, 2, 10, 11, 12, 13]);
+        check('three consecutive failures → exactly one fault', t.faults.length, 1);
+        check('fault kind', t.faults[0] && t.faults[0].kind, 'controller_unresponsive');
+        check('fault counts failures in window', t.faults[0] && t.faults[0].failures, 3);
+        check('fault carries the last error', /timeout/.test(t.faults[0].lastError), true);
+        check('apply forced OFF on fault', t.client.apply, false);
+        check('apply=false event emitted', t.applyEv[t.applyEv.length - 1], false);
+        check('stats expose the fault', !!t.client.stats.fault, true);
+        check('stats count failures', t.client.stats.applyFailures, 3);
+        check('frame 13 was NOT applied (loop stopped)', t.client.stats.applied, 2);
+
+        // An isolated timeout (one failure, then successes) must NOT fault.
+        failOn.clear();
+        failOn.add(5);
+        t = mk();
+        await drive(t.client, [1, 2, 5, 6, 7, 8, 9]);
+        check('isolated failure → no fault', t.faults.length, 0);
+        check('isolated failure keeps apply ON', t.client.apply, true);
+        check('isolated failure counted', t.client.stats.applyFailures, 1);
+
+        // Interleaved: fail, ok, fail, ok, fail — "3 of the last 10", not
+        // "3 consecutive" (a late reply to an old 0x70 can look like a success).
+        failOn.clear();
+        [20, 22, 24].forEach((i) => failOn.add(i));
+        t = mk();
+        await drive(t.client, [20, 21, 22, 23, 24, 25]);
+        check('3 failures within the window → fault (interleaved)', t.faults.length, 1);
+
+        // Window is bounded: 2 failures, then 10 successes, then 1 failure → no fault.
+        failOn.clear();
+        [30, 31, 45].forEach((i) => failOn.add(i));
+        t = mk();
+        await drive(t.client, [30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 45]);
+        check('old failures age out of the window', t.faults.length, 0);
+
+        // setApply(true) after a fault clears the latch + window.
+        failOn.clear();
+        [50, 51, 52].forEach((i) => failOn.add(i));
+        t = mk();
+        await drive(t.client, [50, 51, 52]);
+        check('faulted', t.faults.length, 1);
+        t.client.setApply(true);
+        check('re-arming apply clears the fault', t.client.fault, null);
+        failOn.clear();
+        await drive(t.client, [60, 61]);
+        check('drives again after re-arm', t.client.stats.applied, 2);
+        check('no second fault without new failures', t.faults.length, 1);
+
+        // Configurable threshold/window.
+        failOn.clear();
+        [70, 71].forEach((i) => failOn.add(i));
+        t = mk({ faultThreshold: 2, faultWindow: 4 });
+        await drive(t.client, [70, 71]);
+        check('custom threshold 2 → fault after two failures', t.faults.length, 1);
+        check('custom window reported', t.faults[0] && t.faults[0].window, 2);
+    }
+
     console.log('\n=== Summary ===');
     console.log(`${totalChecks - failures} / ${totalChecks} checks passed`);
     process.exit(failures === 0 ? 0 : 1);
diff --git a/tests/test-run-log.js b/tests/test-run-log.js
index 7f94e44c..62252721 100644
--- a/tests/test-run-log.js
+++ b/tests/test-run-log.js
@@ -57,6 +57,11 @@ check('slug empty → anon', RunLog.slug(''), 'anon');
 check('baseName strips .yaml', RunLog.baseName('looming_v3.yaml'), 'looming_v3');
 check('baseName strips .yml', RunLog.baseName('x.yml'), 'x');
 check('deriveOutcome aborted', RunLog.deriveOutcome({ aborted: true }), 'ABORTED_BY_USER');
+check(
+    'deriveOutcome fault beats aborted (fw #50)',
+    RunLog.deriveOutcome({ aborted: true, fault: 'controller_unresponsive' }),
+    'CONTROLLER_FAULT'
+);
 check('deriveOutcome errors', RunLog.deriveOutcome({ errors: 2 }), 'ERRORED');
 check('deriveOutcome completed', RunLog.deriveOutcome({ completed: true }), 'COMPLETED');
 check(
diff --git a/tests/test-runlog-replay.js b/tests/test-runlog-replay.js
index 8d2a9e0e..29c94eaa 100644
--- a/tests/test-runlog-replay.js
+++ b/tests/test-runlog-replay.js
@@ -276,6 +276,19 @@ const pb = R.parseRunLog(behLog);
 check('format detected behavior_v1', pb.format, 'behavior_v1');
 check('behavior_v1 2 samples', pb.samples.length, 2);
 approx('behavior_v1 ft passthrough (already ms)', pb.samples[1].ft, 8.272, 1e-9);
+// Controller telemetry rows ("cc"/"cf"/"cs", js/arena-telemetry.js) share the file
+// with behavior rows — they are other streams, never samples (review finding).
+const pbCtl = R.parseRunLog(
+    behLog +
+        '\n' +
+        JSON.stringify(['cc', 9, 5000, 1, 112, 0, '03704e00']) +
+        '\n' +
+        JSON.stringify(['cf', 9, 5100, 2, 78, 36, 129000, 812]) +
+        '\n' +
+        JSON.stringify(['cs', 9, 5200, 3, 1, 0, 0])
+);
+check('tagged telemetry rows are not behavior samples', pbCtl.samples.length, 2);
+check('samples unchanged by the tagged rows', pbCtl.samples[1].fc, 101);
 check('behavior_v1 x/y/hd', [pb.samples[1].x, pb.samples[1].y, pb.samples[1].hd], [0.01, 0, 0.02]);
 
 // ── metadata + explicit timing + arena frame commands ─────────────────────────────────────
diff --git a/tests/test-studio-postmortem.js b/tests/test-studio-postmortem.js
new file mode 100644
index 00000000..190d7740
--- /dev/null
+++ b/tests/test-studio-postmortem.js
@@ -0,0 +1,486 @@
+#!/usr/bin/env node
+/**
+ * Tests for js/studio-postmortem.js — the controller-fault lifecycle (fw #50)
+ * with a FAKED session (no hardware, no Web Serial): quiet period + rx flush,
+ * confirmation probe, probe window, halt vs reset-continue, MAC identity check,
+ * typed `probe` rows into the bridge log.
+ *
+ * Run: node tests/test-studio-postmortem.js
+ */
+'use strict';
+
+const PM = require('../js/studio-postmortem.js');
+const Wire = require('../js/arena-wire-g6.js');
+
+let totalChecks = 0;
+let failures = 0;
+function check(name, got, expected) {
+    totalChecks++;
+    const ok = JSON.stringify(got) === JSON.stringify(expected);
+    console.log(
+        `  ${ok ? 'PASS' : 'FAIL'}  ${name}: got ${JSON.stringify(got)}, expected ${JSON.stringify(expected)}`
+    );
+    if (!ok) failures++;
+}
+function checkBool(name, ok, info) {
+    totalChecks++;
+    console.log(`  ${ok ? 'PASS' : 'FAIL'}  ${name}${info ? ' — ' + info : ''}`);
+    if (!ok) failures++;
+}
+
+// A controller model: answers by opcode with a configurable delay; `wedged`
+// makes every reply take `slowMs` (> the probe threshold) or time out.
+function makeSession(model) {
+    const rows = [];
+    const sent = [];
+    let clock = 0;
+    const session = {
+        connected: true,
+        bridge: { logging: true, log: (o) => rows.push(o) },
+        flushed: 0,
+        flushRx() {
+            this.flushed++;
+            return 3;
+        },
+        reconnectCalls: 0,
+        async reconnect() {
+            this.reconnectCalls++;
+            if (model.reconnectFails) throw new Error('reconnect: no granted port came back');
+            model.afterReset && model.afterReset();
+            this.connected = true;
+            return {};
+        },
+        async send(bytes, opts) {
+            const cmd = bytes[1];
+            sent.push({ cmd, timeoutMs: opts && opts.timeoutMs });
+            const r = model.reply(cmd, opts);
+            if (r === 'timeout') {
+                clock += (opts && opts.timeoutMs) || 500;
+                throw new Error(
+                    'response timeout after ' +
+                        ((opts && opts.timeoutMs) || 500) +
+                        ' ms (cmd 0x' +
+                        cmd.toString(16) +
+                        ')'
+                );
+            }
+            clock += r.dt || 2;
+            return r.frame;
+        }
+    };
+    const deps = {
+        session,
+        wire: Wire,
+        now: () => clock,
+        sleep: async (ms) => {
+            clock += ms;
+        },
+        log: () => {}
+    };
+    return { session, rows, sent, deps, tick: (ms) => (clock += ms) };
+}
+
+const ok = (cmd, payload) =>
+    Uint8Array.from([2 + (payload || []).length, 0x00, cmd].concat(payload || []));
+const macA = [0x04, 0xe9, 0xe5, 0x12, 0x91, 0xc0];
+const infoFrame = (mac, cap) => ok(0xc2, [2, cap == null ? 0xa3 : cap].concat(mac || macA));
+const u32 = (v) => [v & 0xff, (v >>> 8) & 0xff, (v >>> 16) & 0xff, (v >>> 24) & 0xff];
+function healthFrame(fields) {
+    const f = Object.assign(
+        { prevBreadcrumb: 0, prevSlowOp: 1, prevSlowUs: 1300000, resetCause: 0x00000800 },
+        fields || {}
+    );
+    const p = [1, 0x03].concat(
+        u32(1000),
+        u32(500),
+        u32(4000),
+        u32(300),
+        u32(10),
+        u32(2000),
+        [0],
+        u32(0),
+        u32(7),
+        u32(9),
+        u32(11),
+        [4],
+        [5, 0],
+        u32(f.resetCause),
+        [f.prevBreadcrumb],
+        u32(123),
+        [0x01, f.prevSlowOp],
+        u32(f.prevSlowUs),
+        [2],
+        u32(4200)
+    );
+    return ok(0xca, p);
+}
+
+// Healthy controller: every reply fast and ok.
+function healthyModel() {
+    return {
+        reply(cmd) {
+            if (cmd === 0xc2) return { frame: infoFrame(), dt: 2 };
+            if (cmd === 0xca) return { frame: healthFrame(), dt: 2 };
+            if (cmd === 0x33) return { frame: ok(0x33, u32(1234)), dt: 1 };
+            if (cmd === 0x72) return { frame: ok(0x72, [5, 0, 200, 0]), dt: 1 };
+            if (cmd === 0x01) return { frame: ok(0x01), dt: 2 };
+            return { frame: ok(cmd), dt: 1 };
+        }
+    };
+}
+// Wedged controller: every reply slow (300 ms) or, when `dead`, timing out.
+function wedgedModel(opts) {
+    opts = opts || {};
+    const m = {
+        wedged: true,
+        reply(cmd) {
+            if (!m.wedged) return healthyModel().reply(cmd);
+            if (opts.dead) return 'timeout';
+            const h = healthyModel().reply(cmd);
+            return { frame: h.frame, dt: opts.slowMs || 300 };
+        },
+        afterReset() {
+            if (!opts.stayWedged) m.wedged = false;
+        }
+    };
+    return m;
+}
+
+(async () => {
+    console.log('=== transient stall: confirmation probe answers fast → no lifecycle ===');
+    {
+        const t = makeSession(healthyModel());
+        const pm = PM.createPostmortem(t.deps);
+        const res = await pm.run({ policy: 'reset-continue' });
+        check('outcome transient', res.outcome, 'transient');
+        check('quiet period flushed rx', t.session.flushed, 1);
+        check(
+            'only the confirmation 0xC2 was sent',
+            t.sent.map((s) => s.cmd),
+            [0xc2]
+        );
+        check('confirmation used the long timeout', t.sent[0].timeoutMs, 2000);
+        check(
+            'phases logged',
+            t.rows.map((r) => r.phase),
+            ['begin', 'quiet', 'confirm', 'end']
+        );
+        checkBool('no reset attempted', t.session.reconnectCalls === 0);
+    }
+
+    console.log('\n=== wedged (slow replies), halt policy: probe window, no reset ===');
+    {
+        const t = makeSession(wedgedModel({ slowMs: 300 }));
+        const pm = PM.createPostmortem(
+            Object.assign({}, t.deps, { opts: { probeWindowMs: 5000, probeEveryMs: 2000 } })
+        );
+        const res = await pm.run({ policy: 'halt', faultDetail: { failures: 3 } });
+        check('outcome halted', res.outcome, 'halted');
+        checkBool('confirmed (slow ok reply is still a wedge)', res.confirmed === true);
+        checkBool(
+            'several probe passes ran',
+            res.window.passes >= 2,
+            'passes=' + res.window.passes
+        );
+        const names = t.rows.filter((r) => r.phase === 'window').map((r) => r.name);
+        checkBool(
+            'probe set covers RAM + SD commands',
+            names.includes('frames_sent') &&
+                names.includes('pattern_info_1') &&
+                names.includes('firmware_info')
+        );
+        checkBool('health probed (capability present)', names.includes('health'));
+        const probes = t.rows.filter((r) => r.phase === 'window' && r.dt != null);
+        checkBool(
+            'probes used 5 s timeouts',
+            t.sent
+                .filter((s) => s.cmd !== 0xc2 || s.timeoutMs === 5000)
+                .every((s) => s.timeoutMs === 5000 || s.timeoutMs === 2000)
+        );
+        checkBool(
+            'probe rows carry raw reply hex + decoded payload',
+            probes.every((r) => typeof r.resp === 'string') && probes.some((r) => r.decoded)
+        );
+        check('window summary flags degraded', res.window.summary.degraded, true);
+        check('window summary max dt', res.window.summary.maxDt, 300);
+        checkBool(
+            'SD vs RAM medians both reported',
+            res.window.summary.medianDtSd === 300 && res.window.summary.medianDtRam === 300
+        );
+        checkBool(
+            'no reset attempted under halt',
+            !t.sent.some((s) => s.cmd === 0x01) && t.session.reconnectCalls === 0
+        );
+        checkBool(
+            'begin row records the fault detail',
+            t.rows[0].fault && t.rows[0].fault.failures === 3
+        );
+    }
+
+    console.log('\n=== wedged (dead), halt: everything times out, summary says unresponsive ===');
+    {
+        const t = makeSession(wedgedModel({ dead: true }));
+        const pm = PM.createPostmortem(
+            Object.assign({}, t.deps, { opts: { probeWindowMs: 1000, probeEveryMs: 500 } })
+        );
+        const res = await pm.run({ policy: 'halt' });
+        check('outcome halted', res.outcome, 'halted');
+        check('unresponsive', res.window.summary.unresponsive, true);
+        checkBool('timeouts counted', res.window.summary.timeouts > 0);
+        const probe = t.rows.find((r) => r.phase === 'window');
+        check(
+            'timed-out probe row: status/ok null + error',
+            [probe.status, probe.ok, /timeout/.test(probe.error)],
+            [null, null, true]
+        );
+    }
+
+    console.log('\n=== wedged, reset-continue: reset → reconnect → MAC verified → recovered ===');
+    {
+        const t = makeSession(wedgedModel({ slowMs: 200 }));
+        const pm = PM.createPostmortem(
+            Object.assign({}, t.deps, { opts: { probeWindowMs: 1000, probeEveryMs: 500 } })
+        );
+        const res = await pm.run({ policy: 'reset-continue' });
+        check('outcome recovered', res.outcome, 'recovered');
+        checkBool(
+            'SYSTEM_RESET sent with its own timeout',
+            t.sent.some((s) => s.cmd === 0x01 && s.timeoutMs === 3000)
+        );
+        check('reconnect called once', t.session.reconnectCalls, 1);
+        check('identity verified against the pre-reset MAC', res.reset.identityOk, true);
+        check(
+            'post-reset probe surfaces the previous boot slowest op',
+            res.reset.prevSlowOp === undefined ? res.reset.prevBreadcrumb : res.reset.prevSlowOp,
+            'idle'
+        );
+        checkBool('post-reset summary not degraded', res.reset.postSummary.degraded === false);
+        const end = t.rows[t.rows.length - 1];
+        check('end row', [end.phase, end.outcome], ['end', 'recovered']);
+        const rr = t.rows.find((r) => r.name === 'reconnect');
+        checkBool('reconnect row carries resetCause + breadcrumb', rr && rr.resetCause === 0x800);
+    }
+
+    console.log('\n=== reset-continue but the controller stays wedged → reset-failed ===');
+    {
+        const t = makeSession(wedgedModel({ slowMs: 300, stayWedged: true }));
+        const pm = PM.createPostmortem(
+            Object.assign({}, t.deps, { opts: { probeWindowMs: 1000, probeEveryMs: 500 } })
+        );
+        const res = await pm.run({ policy: 'reset-continue' });
+        check('outcome reset-failed', res.outcome, 'reset-failed');
+        check('post-reset still degraded', res.reset.postSummary.degraded, true);
+    }
+
+    console.log('\n=== reconnect fails → reset-failed, no identity claim ===');
+    {
+        const m = wedgedModel({ slowMs: 300 });
+        m.reconnectFails = true;
+        const t = makeSession(m);
+        const pm = PM.createPostmortem(
+            Object.assign({}, t.deps, { opts: { probeWindowMs: 1000, probeEveryMs: 500 } })
+        );
+        const res = await pm.run({ policy: 'reset-continue' });
+        check('outcome reset-failed', res.outcome, 'reset-failed');
+        check('reconnected false', res.reset.reconnected, false);
+        checkBool('reconnect error recorded', /no granted port/.test(res.reset.reconnectError));
+    }
+
+    console.log(
+        '\n=== MAC-less controller_info after reconnect → identity NOT ok (expected MAC) ==='
+    );
+    {
+        const m = wedgedModel({ slowMs: 300 });
+        const base = m.reply.bind(m);
+        m.afterReset = () => {
+            m.wedged = false;
+            // 0xC2 answers but without the MAC bytes (older-firmware shape)
+            m.reply = (cmd) => (cmd === 0xc2 ? { frame: ok(0xc2, [2, 0xa3]), dt: 2 } : base(cmd));
+        };
+        const t = makeSession(m);
+        const pm = PM.createPostmortem(
+            Object.assign({}, t.deps, { opts: { probeWindowMs: 1000, probeEveryMs: 500 } })
+        );
+        const res = await pm.run({ policy: 'reset-continue', expectMac: '04:e9:e5:1e:88:ec' });
+        check('outcome reset-failed (no MAC to verify)', res.outcome, 'reset-failed');
+        check('identityOk false', res.reset.identityOk, false);
+        checkBool(
+            'identity error names the missing MAC',
+            /no MAC|expected/.test(res.reset.identityError)
+        );
+    }
+
+    console.log('\n=== post-reset: one probe answers, the rest time out → NOT recovered ===');
+    {
+        const m = wedgedModel({ slowMs: 300 });
+        const base = m.reply.bind(m);
+        m.afterReset = () => {
+            m.wedged = false;
+            // controller_info + frames_sent answer; everything else is dead
+            m.reply = (cmd) => (cmd === 0xc2 || cmd === 0x33 ? base(cmd) : 'timeout');
+        };
+        const t = makeSession(m);
+        const pm = PM.createPostmortem(
+            Object.assign({}, t.deps, { opts: { probeWindowMs: 1000, probeEveryMs: 500 } })
+        );
+        const res = await pm.run({ policy: 'reset-continue' });
+        check('outcome reset-failed (timeouts after reset)', res.outcome, 'reset-failed');
+        checkBool('post-reset timeouts counted', res.reset.postSummary.timeouts > 0);
+        check('answered > 0 alone does not recover', res.reset.postSummary.answered > 0, true);
+    }
+
+    console.log(
+        '\n=== capabilities unknown (0xC2 dead) → capability-gated probes are SKIPPED, not sent ==='
+    );
+    {
+        const t = makeSession(wedgedModel({ dead: true }));
+        const pm = PM.createPostmortem(
+            Object.assign({}, t.deps, { opts: { probeWindowMs: 1000, probeEveryMs: 500 } })
+        );
+        await pm.run({ policy: 'halt' });
+        const sentCmds = t.sent.map((x) => x.cmd);
+        check('no GET_HEALTH (0xCA) sent blind', sentCmds.includes(0xca), false);
+        check('no GET_FIRMWARE_VERSION (0xCB) sent blind', sentCmds.includes(0xcb), false);
+        checkBool(
+            'skip reason recorded',
+            t.rows.some((r) => r && r.skipped === 'capabilities unknown')
+        );
+    }
+
+    console.log(
+        '\n=== link dropped after the fault (hardware watchdog reboot) → self-reset path ==='
+    );
+    {
+        const m = wedgedModel({ slowMs: 300 });
+        const t = makeSession(m);
+        t.session.connected = false; // the controller re-enumerated on its own
+        let afterReconnectCalls = 0;
+        const pm = PM.createPostmortem(
+            Object.assign({}, t.deps, {
+                afterReconnect: async () => {
+                    afterReconnectCalls++;
+                    return { records: 3 };
+                },
+                opts: { probeWindowMs: 1000, probeEveryMs: 500 }
+            })
+        );
+        const res = await pm.run({ policy: 'halt' }); // policy irrelevant: it already reset
+        check('outcome self-reset', res.outcome, 'self-reset');
+        check('recovered', res.recovered, true);
+        check(
+            'no SYSTEM_RESET was sent',
+            t.sent.some((x) => x.cmd === 0x01),
+            false
+        );
+        check('reconnect attempted once', t.session.reconnectCalls, 1);
+        check('evidence hook (ring drain) ran once', afterReconnectCalls, 1);
+        checkBool('health probe ran before the post probes', !!res.reset.health);
+        checkBool(
+            'self_reset row recorded',
+            t.rows.some((r) => r && r.name === 'self_reset')
+        );
+    }
+
+    console.log(
+        '\n=== link drops DURING the probe window (watchdog fires ~6 s in) → self-reset path ==='
+    );
+    {
+        const m = wedgedModel({ slowMs: 300 });
+        const t = makeSession(m);
+        const baseSend = t.session.send.bind(t.session);
+        let sends = 0;
+        let dropped = false;
+        t.session.send = async (bytes, opts) => {
+            sends++;
+            // after the confirm probe + a few window probes the controller reboots: the
+            // port closes, further sends fail with a link error (not a timeout)
+            if (!dropped && sends > 4) {
+                dropped = true;
+                t.session.connected = false;
+                throw new Error('write failed: port closed');
+            }
+            if (!t.session.connected) throw new Error('not connected');
+            return baseSend(bytes, opts);
+        };
+        const pm = PM.createPostmortem(
+            Object.assign({}, t.deps, {
+                afterReconnect: async () => ({ records: 5 }),
+                opts: { probeWindowMs: 3000, probeEveryMs: 200 }
+            })
+        );
+        const res = await pm.run({ policy: 'halt' });
+        check('outcome self-reset', res.outcome, 'self-reset');
+        checkBool(
+            'window ended early on the link drop',
+            t.rows.some((r) => r && r.phase === 'window-link-dropped')
+        );
+        check('reconnected once', t.session.reconnectCalls, 1);
+        check(
+            'no SYSTEM_RESET sent',
+            t.sent.some((x) => x.cmd === 0x01),
+            false
+        );
+    }
+
+    console.log('\n=== wrong controller after reconnect → identity error ===');
+    {
+        const m = wedgedModel({ slowMs: 300 });
+        const other = [0x04, 0xe9, 0xe5, 0x1e, 0x88, 0xec];
+        const base = m.reply.bind(m);
+        m.afterReset = () => {
+            m.wedged = false;
+            m.reply = (cmd) => (cmd === 0xc2 ? { frame: infoFrame(other), dt: 2 } : base(cmd));
+        };
+        const t = makeSession(m);
+        const pm = PM.createPostmortem(
+            Object.assign({}, t.deps, { opts: { probeWindowMs: 1000, probeEveryMs: 500 } })
+        );
+        const res = await pm.run({ policy: 'reset-continue', expectMac: '04:E9:E5:12:91:C0' });
+        check('identity mismatch detected', res.reset.identityOk, false);
+        check('outcome not recovered', res.outcome, 'reset-failed');
+    }
+
+    console.log('\n=== operator abort mid-window ===');
+    {
+        const t = makeSession(wedgedModel({ slowMs: 300 }));
+        const pm = PM.createPostmortem(
+            Object.assign({}, t.deps, { opts: { probeWindowMs: 60000, probeEveryMs: 2000 } })
+        );
+        // Abort right after the first probe pass by hooking the session send.
+        let n = 0;
+        const orig = t.session.send.bind(t.session);
+        t.session.send = async (b, o) => {
+            n++;
+            if (n === 4) pm.abort();
+            return orig(b, o);
+        };
+        const res = await pm.run({ policy: 'reset-continue' });
+        check('outcome operator-stop', res.outcome, 'operator-stop');
+        checkBool('no reset after operator stop', !t.sent.some((s) => s.cmd === 0x01));
+    }
+
+    console.log('\n=== probe set skips capability-gated health on old firmware ===');
+    {
+        const m = healthyModel();
+        m.reply = ((base) => (cmd) =>
+            cmd === 0xc2 ? { frame: infoFrame(macA, 0x23), dt: 300 } : base(cmd))(m.reply);
+        const t = makeSession(m);
+        const pm = PM.createPostmortem(
+            Object.assign({}, t.deps, { opts: { probeWindowMs: 500, probeEveryMs: 500 } })
+        );
+        const res = await pm.run({ policy: 'halt' });
+        const h = res.window.results.find((r) => r.name === 'health');
+        checkBool(
+            'health probe skipped without capability bit 7',
+            h && /capability/.test(h.skipped)
+        );
+        checkBool('0xCA never sent', !t.sent.some((s) => s.cmd === 0xca));
+    }
+
+    console.log('\n=== Summary ===');
+    console.log(`${totalChecks - failures} / ${totalChecks} checks passed`);
+    process.exit(failures === 0 ? 0 : 1);
+})().catch((e) => {
+    console.error('test crashed:', e);
+    process.exit(1);
+});
diff --git a/tests/test-studio-runlog-adapter.js b/tests/test-studio-runlog-adapter.js
index e600e968..9c1ad4a1 100644
--- a/tests/test-studio-runlog-adapter.js
+++ b/tests/test-studio-runlog-adapter.js
@@ -177,6 +177,51 @@ check('aborted terminal', A.isTerminal('aborted'), true);
 check('command not terminal', A.isTerminal('command'), false);
 check('led-activation not terminal', A.isTerminal('led-activation'), false);
 
+// ── controller fault (fw #50) ─────────────────────────────────────────────────
+console.log('\n=== controller fault outcome ===');
+{
+    const log2 = RunLog.createRunLog({
+        meta: { protocol: 'p', run_id: 'r2', bench_id: 'b' },
+        intent: 'experiment',
+        now: fixedClock()
+    });
+    A.feedRunStatus(log2, { phase: 'sequence-start', total: 1 });
+    const f = A.feedRunStatus(log2, {
+        phase: 'fault',
+        reason: 'controller_unresponsive',
+        detail: { failures: 3, window: 10, lastError: 'response timeout after 500 ms (cmd 0x70)' }
+    });
+    checkBool('fault phase is recorded (not dropped as unknown)', !!f.event);
+    check('fault is not terminal', f.terminal, false);
+    const r = A.feedRunStatus(log2, {
+        phase: 'aborted',
+        summary: {
+            completed: false,
+            aborted: true,
+            steps: 1,
+            errors: 0,
+            skipped: 0,
+            fault: 'controller_unresponsive',
+            stopAcked: false
+        }
+    });
+    check('aborted-with-fault is terminal', r.terminal, true);
+    check(
+        'outcome CONTROLLER_FAULT (not ABORTED_BY_USER)',
+        log2.summary.outcome,
+        'CONTROLLER_FAULT'
+    );
+    checkBool('transcript names the fault', /FAULT controller_unresponsive/.test(log2.toText()));
+    // A plain user abort is unchanged.
+    const log3 = RunLog.createRunLog({
+        meta: { protocol: 'p', run_id: 'r3', bench_id: 'b' },
+        intent: 'experiment',
+        now: fixedClock()
+    });
+    A.feedRunStatus(log3, { phase: 'aborted', summary: { aborted: true, fault: null } });
+    check('plain abort stays ABORTED_BY_USER', log3.summary.outcome, 'ABORTED_BY_USER');
+}
+
 console.log('\n=== Summary ===');
 console.log(`${totalChecks - failures} / ${totalChecks} checks passed`);
 process.exit(failures ? 1 : 0);
diff --git a/tests/test-studio-url-state.js b/tests/test-studio-url-state.js
index c3bc8034..61684ad1 100644
--- a/tests/test-studio-url-state.js
+++ b/tests/test-studio-url-state.js
@@ -363,6 +363,29 @@ const rt2 = U.decode(U.encodeApp({ mode: 'edit', protocolKey: 'looming_v3' }), {
 check('fresh load of edit+p URL forces Run', rt2.state.mode, 'run');
 check('fresh load of edit+p URL keeps p', rt2.state.p, 'looming_v3');
 
+// ── soak param (fw #50 soak driver; advanced-only flag) ──────────────────────
+console.log('\n=== soak param ===');
+d = U.decode('?soak=1', { allowedKeys: ALLOWED });
+check('soak=1 requested', d.state.soak, true);
+checkBool('soak=1 does not warn', d.warnings.length === 0, d.warnings.join('|'));
+d = U.decode('?soak=0', { allowedKeys: ALLOWED });
+check('soak=0 → not requested', d.state.soak, undefined);
+checkBool('soak=0 does not warn', d.warnings.length === 0, d.warnings.join('|'));
+d = U.decode('?soak=yes', { allowedKeys: ALLOWED });
+check('soak=yes dropped', d.state.soak, undefined);
+checkBool(
+    'soak=yes warns',
+    d.warnings.some((w) => /soak/.test(w))
+);
+check('encode emits soak=1 when armed', U.encode({ mode: 'run', soak: true }), '?soak=1');
+check('encode omits soak when off', U.encode({ mode: 'run', soak: false }), '');
+check(
+    'encodeApp carries soak alongside advanced',
+    U.encodeApp({ mode: 'run', advanced: true, soak: true }),
+    '?advanced=1&soak=1'
+);
+check('encodeApp omits soak by default', U.encodeApp({ mode: 'console' }), '?mode=console');
+
 console.log('\n=== Summary ===');
 console.log(`${totalChecks - failures} / ${totalChecks} checks passed`);
 process.exit(failures ? 1 : 0);
diff --git a/tests/test-wedge-scan.py b/tests/test-wedge-scan.py
new file mode 100644
index 00000000..5f273147
--- /dev/null
+++ b/tests/test-wedge-scan.py
@@ -0,0 +1,395 @@
+#!/usr/bin/env python3
+"""Offline tests for scripts/wedge-scan.py (firmware issue #50 Mode-3 wedge
+analyzer), wired into `pixi run test`. Synthetic fixtures are generated in a
+temp dir at test time (nothing large is committed):
+  (a) healthy behavior_v2 run, 2,000 0x70 rows at dt 2–4 ms          → clean
+  (b) behavior_v2 wedge: 800 OK, 20 timeouts, runner error 0x8, abort → wedge
+  (c) (b) as behavior_v1 objects, gzipped                             → wedge
+  (d) one isolated timeout mid-run, then recovery                     → isolated
+  (e) truncated last line                                             → incomplete
+  (f) Arena Studio .runlog.json envelope                              → no-arena-rows
+  plus: empty file, garbage line in an otherwise complete run, spaced-out
+  timeouts that must NOT confirm an onset, a SYSTEM_RESET row, a hi-byte frame
+  index, and the --json CLI path.
+
+Run: python tests/test-wedge-scan.py
+"""
+import gzip
+import importlib.util
+import json
+import os
+import subprocess
+import sys
+import tempfile
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+SCRIPT = os.path.join(HERE, "..", "scripts", "wedge-scan.py")
+
+# import a hyphenated filename by path
+_spec = importlib.util.spec_from_file_location("wedge_scan", SCRIPT)
+ws = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(ws)
+
+total = 0
+failures = 0
+
+
+def check(name, got, expected):
+    global total, failures
+    total += 1
+    ok = got == expected
+    print(f"  {'PASS' if ok else 'FAIL'}  {name}" + ("" if ok else f" — got {got!r}, expected {expected!r}"))
+    if not ok:
+        failures += 1
+
+
+def approx(name, got, expected, tol=0.2):
+    global total, failures
+    total += 1
+    ok = got is not None and abs(got - expected) <= tol
+    print(f"  {'PASS' if ok else 'FAIL'}  {name}: got {got}, expected {expected}")
+    if not ok:
+        failures += 1
+
+
+# ── fixture builders ─────────────────────────────────────────────────────────
+T0 = 1_789_000_000_000  # epoch ms
+DIR = "browser→bridge"
+
+
+def hex70(index):
+    return f"0370{index & 0xFF:02x}{(index >> 8) & 0xFF:02x}"
+
+
+def head_v1(hexs):
+    return " ".join(hexs[i : i + 2] for i in range(0, len(hexs), 2))
+
+
+def header(level, run_id="testrun1", rig="benchT", proto="soak.yaml"):
+    lines = [
+        {"type": "session", "event": "logging_started", "file": "arena-log-x.jsonl", "ms": T0},
+    ]
+    if level == "behavior_v2":
+        lines.append({"type": "frame_schema", "level": "behavior_v2", "cols": ["ms", "fc", "idx", "ft", "x", "y", "hd"], "arena_cols": ["t_off", "dt", "hex", "status", "rx_off"], "t0": T0})
+    else:
+        lines.append({"type": "frame_schema", "level": "behavior_v1", "cols": ["ms", "fc", "idx", "ft", "x", "y", "hd"]})
+    lines.append({"type": "log", "event": "run_metadata", "rig_id": rig, "run_id": run_id, "protocol_filename": proto, "arena_config": "G6_2x10", "tool_version": "Arena Studio v0.75", "dir": DIR, "rx_ms": T0})
+    lines.append({"type": "log", "event": "runner", "phase": "sequence-start", "total": 3, "dir": DIR, "rx_ms": T0})
+    return lines
+
+
+def arena(level, t_off, dt, hexs, status, error=None):
+    """One arena echo in the requested level (v2 compact array or v1 object)."""
+    if level == "behavior_v2":
+        arr = ["a", t_off, dt, hexs, status, t_off + dt]
+        if error is not None:
+            arr.append(error)
+        return arr
+    parts = head_v1(hexs)
+    return {
+        "type": "log",
+        "event": "arena_command",
+        "t": T0 + t_off,
+        "dt": dt,
+        "len": len(hexs) // 2,
+        "head": parts,
+        "status": status,
+        "echo": None if status is None else int(hexs[2:4], 16),
+        "ok": None if status is None else status == 0,
+        "error": error,
+        "dir": DIR,
+        "rx_ms": T0 + t_off + dt,
+    }
+
+
+def frame(ms, fc, idx):
+    return [ms, fc, idx, float(ms), 0.1, 0.2, 0.3]
+
+
+def timeout_err(op=0x70):
+    return f"response timeout after 500 ms (cmd 0x{op:x})"
+
+
+def terminal(t_off, phase="sequence-complete"):
+    return [
+        {"type": "log", "event": "runner", "phase": phase, "dir": DIR, "rx_ms": T0 + t_off},
+        {"type": "session", "event": "logging_stopped", "ms": T0 + t_off},
+    ]
+
+
+def build_healthy(level, n=2000, step_ms=10):
+    lines = header(level)
+    t = 0
+    for i in range(n):
+        lines.append(frame(t, 1000 + i, i % 200))
+        lines.append(arena(level, t, 2 + (i % 3), hex70(i % 200), 0))
+        t += step_ms
+    lines += terminal(t)
+    return lines
+
+
+def build_wedge(level, n_ok=800, n_timeouts=20, onset_index=0, step_ms=10):
+    lines = header(level, run_id="wedgerun")
+    t = 0
+    for i in range(n_ok):
+        lines.append(frame(t, 1000 + i, i % 20))
+        lines.append(arena(level, t, 2 + (i % 3), hex70(i % 20), 0))
+        t += step_ms
+    onset_line = None
+    for j in range(n_timeouts):
+        dt = 500 + (j % 10)
+        idx = onset_index if j == 0 else (onset_index + j) % 20
+        lines.append(frame(t, 2000 + j, idx))
+        lines.append(arena(level, t, dt, hex70(idx), None, timeout_err()))
+        if j == 0:
+            onset_line = len(lines)  # 1-based line number of the row just appended
+        t += dt
+    lines.append({"type": "log", "event": "runner", "phase": "error", "index": 1, "reason": "send failed: " + timeout_err(0x8), "condition": "cl", "error": timeout_err(0x8), "dir": DIR, "rx_ms": T0 + t})
+    lines += terminal(t + 1, phase="aborted")
+    return lines, onset_line, t
+
+
+def build_declared_fault(level, n=300, step_ms=10):
+    """Rejects (status 1) trip the live detector; the runner declares the fault;
+    no timeouts at all — must NOT come out `clean`. Also a bare ["cc"] row."""
+    lines = header(level)
+    for i in range(n):
+        lines.append(arena(level, i * step_ms, 3, hex70(i % 200), 1 if i % 5 == 0 else 0))
+    lines.append(["cc"])  # malformed telemetry row — dropped, counted, never a crash
+    lines.append(["cf", T0 + n * step_ms, 5000, 1, 7, 36, 129000, 812])
+    lines.append({"type": "log", "event": "runner", "phase": "aborted", "summary": {"fault": "controller_unresponsive", "aborted": True}, "dir": DIR, "rx_ms": T0 + n * step_ms})
+    lines.append({"type": "session", "event": "logging_stopped", "ms": T0 + n * step_ms})
+    return lines
+
+
+def build_isolated(level, n=600, at=300, gaps=(300,)):
+    """OK rows with single timeouts at the given positions (each recovers)."""
+    lines = header(level, run_id="isolated")
+    t = 0
+    for i in range(n):
+        if i in gaps:
+            lines.append(arena(level, t, 503, hex70(i % 200), None, timeout_err()))
+            t += 503
+        else:
+            lines.append(arena(level, t, 3, hex70(i % 200), 0))
+            t += 10
+    lines += terminal(t)
+    return lines
+
+
+def write_ndjson(path, lines, gz=False, truncate_last=False, extra_raw=None):
+    text = "\n".join(json.dumps(x, separators=(",", ":")) for x in lines) + "\n"
+    if truncate_last:
+        text = text[: -(len(text.splitlines()[-1]) // 2 + 1)]  # chop mid-way through the last line
+    if extra_raw is not None:
+        text = extra_raw
+    data = text.encode("utf-8")
+    if gz:
+        with gzip.open(path, "wb") as f:
+            f.write(data)
+    else:
+        with open(path, "wb") as f:
+            f.write(data)
+    return path
+
+
+def scan(path, **kw):
+    return ws.scan_file(path, kw.get("window", ws.DEFAULT_WINDOW), kw.get("min_followers", ws.DEFAULT_MIN_FOLLOWERS))
+
+
+with tempfile.TemporaryDirectory() as d:
+    def p(name):
+        return os.path.join(d, name)
+
+    # (a) healthy v2 ──────────────────────────────────────────────────────
+    print("=== (a) healthy behavior_v2, 2,000 x 0x70 at dt 2-4 ms ===")
+    r = scan(write_ndjson(p("soak__tester__2026-09-11T10-00-00__abc12345.jsonl"), build_healthy("behavior_v2")))
+    check("outcome clean", r["outcome"], "clean")
+    check("format", r["format"], "behavior_v2")
+    check("cmd70_ok 2000", r["cmd70_ok"], 2000)
+    check("cmd70_total 2000", r["cmd70_total"], 2000)
+    check("rtt median 3", r["rtt_median_ms"], 3)
+    check("rtt p99 4", r["rtt_p99_ms"], 4)
+    check("no non-zero status", r["nonzero_status"], 0)
+    check("no isolated timeouts", r["isolated_timeouts"], 0)
+    check("no onset", (r["onset_line"], r["onset_index"], r["onset_elapsed_s"]), (None, None, None))
+    check("run_id from run_metadata", r["run_id"], "testrun1")
+    check("bench from run_metadata rig_id", r["bench"], "benchT")
+    check("protocol from run_metadata", r["protocol"], "soak.yaml")
+    approx("duration ~20 s", r["duration_s"], 20.0, tol=0.3)
+    check("frames counted", r["frames"], 2000)
+    check("bad_lines 0", r["bad_lines"], 0)
+    check("soft degrade none", r["slow_before"], "dt>50ms before onset: 0")
+    check("terminal seen", r["terminal"], "sequence-complete")
+
+    # (b) wedge v2 ────────────────────────────────────────────────────────
+    print("=== (b) behavior_v2 wedge: 800 OK, 20 timeouts, runner error 0x8, aborted ===")
+    lines, onset_line, t_end = build_wedge("behavior_v2", onset_index=0)
+    r = scan(write_ndjson(p("wedge.jsonl"), lines))
+    check("outcome wedge", r["outcome"], "wedge")
+    check("onset 0x70 count before = 800", r["onset_cmd70_count"], 800)
+    check("cmd70_ok = 800 (none OK after)", r["cmd70_ok"], 800)
+    check("cmd70_total = 820", r["cmd70_total"], 820)
+    check("onset index 0", r["onset_index"], 0)
+    check("onset line", r["onset_line"], onset_line)
+    approx("onset elapsed 8.0 s", r["onset_elapsed_s"], 8.0)
+    check("timeouts after onset = 19", r["timeouts_after"], 19)
+    check("isolated 0", r["isolated_timeouts"], 0)
+    check("first non-0x70 fail = TRIAL_PARAMS via runner", r["first_non70_fail"], "TRIAL_PARAMS (0x08) via runner:error")
+    check("rtt stats are pre-onset only (median 3, p99 4)", (r["rtt_median_ms"], r["rtt_p99_ms"]), (3, 4))
+    check("runner error surfaced", len(r["runner_errors"]), 1)
+    check("terminal aborted", r["terminal"], "aborted")
+    check("verbose context has the onset marker", any("<<< ONSET" in c for c in r["_context"]), True)
+    check("context has 5 rows before onset", sum(1 for c in r["_context"] if "status 0" in c), 5)
+    check("run_id", r["run_id"], "wedgerun")
+
+    # (c) wedge v1, gzipped ───────────────────────────────────────────────
+    print("=== (c) same wedge as behavior_v1 objects, gzipped ===")
+    lines, onset_line, _ = build_wedge("behavior_v1", onset_index=7)
+    r = scan(write_ndjson(p("wedge_v1.jsonl.gz"), lines, gz=True))
+    check("outcome wedge", r["outcome"], "wedge")
+    check("format behavior_v1", r["format"], "behavior_v1")
+    check("onset 0x70 count before = 800", r["onset_cmd70_count"], 800)
+    check("onset index 7", r["onset_index"], 7)
+    check("onset line", r["onset_line"], onset_line)
+    approx("onset elapsed 8.0 s", r["onset_elapsed_s"], 8.0)
+    check("timeouts after 19", r["timeouts_after"], 19)
+    check("first non-0x70 fail", r["first_non70_fail"], "TRIAL_PARAMS (0x08) via runner:error")
+    check("rtt median 3", r["rtt_median_ms"], 3)
+
+    # (d) isolated timeout ────────────────────────────────────────────────
+    print("=== (d) one isolated timeout mid-run, recovered ===")
+    r = scan(write_ndjson(p("isolated.jsonl"), build_isolated("behavior_v2")))
+    check("outcome isolated", r["outcome"], "isolated")
+    check("isolated_timeouts 1", r["isolated_timeouts"], 1)
+    check("no onset", r["onset_line"], None)
+    check("cmd70_ok 599", r["cmd70_ok"], 599)
+    check("cmd70_total 600", r["cmd70_total"], 600)
+
+    print("=== (d2) three timeouts spaced > window apart: still isolated, not a wedge ===")
+    r = scan(write_ndjson(p("isolated3.jsonl"), build_isolated("behavior_v1", gaps=(100, 200, 400))))
+    check("outcome isolated", r["outcome"], "isolated")
+    check("isolated_timeouts 3", r["isolated_timeouts"], 3)
+
+    print("=== (d3) two adjacent timeouts (only 1 follower) then recovery: isolated x2 ===")
+    r = scan(write_ndjson(p("isolated2adj.jsonl"), build_isolated("behavior_v2", gaps=(100, 101))))
+    check("outcome isolated", r["outcome"], "isolated")
+    check("isolated_timeouts 2", r["isolated_timeouts"], 2)
+
+    print("=== (d4) three adjacent timeouts then recovery: that IS an onset ===")
+    r = scan(write_ndjson(p("three_adj.jsonl"), build_isolated("behavior_v2", gaps=(100, 101, 102))))
+    check("outcome wedge", r["outcome"], "wedge")
+    check("onset count before 100", r["onset_cmd70_count"], 100)
+    check("timeouts after 2", r["timeouts_after"], 2)
+
+    # (e) truncated last line ─────────────────────────────────────────────
+    print("=== (e) truncated last line ===")
+    # a bridge killed mid-run: no terminal lines, and the last row cut in half
+    r = scan(write_ndjson(p("trunc.jsonl"), build_healthy("behavior_v2", n=300)[:-2], truncate_last=True))
+    check("bad_lines 1", r["bad_lines"], 1)
+    check("outcome incomplete (never clean)", r["outcome"], "incomplete")
+    check("flags mention bad_lines and missing terminal", ("bad_lines=1" in " ".join(r["flags"]), "no-terminal-event" in r["flags"]), (True, True))
+    check("rows before the cut still counted", r["cmd70_ok"], 299)
+
+    print("=== (e2) garbage line inside an otherwise complete run ===")
+    lines = build_healthy("behavior_v1", n=100)
+    text = "\n".join(json.dumps(x, separators=(",", ":")) for x in lines[:50]) + "\n{this is not json\n" + "\n".join(json.dumps(x, separators=(",", ":")) for x in lines[50:]) + "\n"
+    r = scan(write_ndjson(p("garbage.jsonl"), [], extra_raw=text))
+    check("bad_lines 1", r["bad_lines"], 1)
+    check("outcome incomplete, not clean", r["outcome"], "incomplete")
+    check("terminal still seen", r["terminal"], "sequence-complete")
+
+    print("=== (e3) empty file ===")
+    r = scan(write_ndjson(p("empty.jsonl"), [], extra_raw=""))
+    check("outcome incomplete", r["outcome"], "incomplete")
+    check("cmd70 n/a", r["cmd70_ok"], ws.NA)
+
+    # (f) Studio .runlog.json envelope ────────────────────────────────────
+    print("=== (f) Arena Studio .runlog.json envelope ===")
+    env = {
+        "schema": "arena-studio-runlog/1",
+        "intent": "experiment",
+        "meta": {"run_id": "d1yatobd", "rig_id": "bench03", "protocol_filename": "fictrac-closed-loop-bias-disturbance-grating.yaml", "tool_version": "Arena Studio v0.71", "timestamp_start": "2026-09-11T19:40:07Z"},
+        "events": [
+            {"t_iso": "x", "t_offset_s": 0.0, "phase": "sequence-start", "total": 12},
+            {"t_iso": "x", "t_offset_s": 0.1, "phase": "step-start", "index": 0},
+            {"t_iso": "x", "t_offset_s": 79.9, "phase": "error", "index": 3, "reason": "send failed: response timeout after 500 ms (cmd 0x8)"},
+            {"t_iso": "x", "t_offset_s": 80.2, "phase": "aborted"},
+        ],
+        "summary": {"completed": False, "aborted": True, "steps": 3, "errors": 1, "duration_s": 80.2, "outcome": "ABORTED_BY_USER"},
+    }
+    path = p("fictrac-closed-loop-bias-disturbance-grating__isabel__2026-09-11T19-40-07__d1yatobd.runlog.json")
+    with open(path, "w") as f:
+        json.dump(env, f, indent=1)
+    r = scan(path)
+    check("outcome no-arena-rows", r["outcome"], "no-arena-rows")
+    check("format runlog.json", r["format"], "runlog.json")
+    check("per-command stats n/a", (r["cmd70_ok"], r["rtt_median_ms"], r["isolated_timeouts"]), (ws.NA, ws.NA, ws.NA))
+    check("run_id from meta", r["run_id"], "d1yatobd")
+    check("bench from meta", r["bench"], "bench03")
+    check("duration from summary", r["duration_s"], 80.2)
+    check("studio outcome in flags", any("ABORTED_BY_USER" in f for f in r["flags"]), True)
+    check("timeout error event surfaced", ("timeout" in (r["first_non70_fail"] or "").lower(), len(r["runner_errors"])), (True, 1))
+
+    # (g) resets + hi-byte index ──────────────────────────────────────────
+    print("=== (g) SYSTEM_RESET row + hi-byte frame index ===")
+    lines = header("behavior_v2")
+    lines.append(arena("behavior_v2", 0, 5, "0201", 0))  # [len=02, op=01] SYSTEM_RESET
+    lines.append(arena("behavior_v2", 50, 4, "02e3", 1))  # GET_FIRMWARE_INFO refused (status 1)
+    lines.append(arena("behavior_v2", 100, 3, hex70(300), 0))
+    for k in range(3):
+        lines.append(arena("behavior_v2", 200 + 500 * k, 500, hex70(300), None, timeout_err()))
+    lines += terminal(2000, phase="aborted")
+    r = scan(write_ndjson(p("reset.jsonl"), lines))
+    check("resets 1", r["resets"], 1)
+    check("resets flag", "resets=1" in r["flags"], True)
+    check("hi-byte index 300 decoded", r["onset_index"], 300)
+    check("onset with only 1 OK before", r["onset_cmd70_count"], 1)
+    check("SYSTEM_RESET does not count as 0x70", r["cmd70_total"], 4)
+    check("non-zero status counted + attributed", (r["nonzero_status"], r["nonzero_by_op"]), (1, {"GET_FIRMWARE_INFO (0xE3)": 1}))
+
+    # (h) helpers ─────────────────────────────────────────────────────────
+    print("=== (h) helpers ===")
+    check("opcode_name 0x70", ws.opcode_name(0x70), "SET_FRAME_POSITION (0x70)")
+    check("opcode_name unknown", ws.opcode_name(0x5A), "0x5A")
+    check("normalize spaced head", ws._normalize_hex("03 70 bf 00"), "0370bf00")
+    check("normalize compact hex", ws._normalize_hex("0370BF00"), "0370bf00")
+    check("normalize truncated head keeps leading bytes", ws._normalize_hex("03 70 …"), "0370")
+    check("normalize non-hex", ws._normalize_hex("zz"), None)
+    check("filename meta", ws.meta_from_filename("/x/rig9/p3-full-led25__user__2026-09-08T22-35-50__8cz4yttn.jsonl")["run_id"], "8cz4yttn")
+    check("filename meta bench", ws.meta_from_filename("/x/rig9/p3-full-led25__user__2026-09-08T22-35-50__8cz4yttn.jsonl")["bench"], "rig9")
+    h = ws.DtHistogram()
+    for v in [2, 2, 3, 3, 3, 4, 900, 9000]:
+        h.add(v)
+    check("histogram median", h.percentile(0.5), 3)
+    check("histogram overflow bucket", h.percentile(1.0), ">=5000")
+    check("histogram max", h.max, 9000)
+
+    # (i) CLI --json over the whole temp dir ──────────────────────────────
+    print("=== (i) CLI --json over a directory ===")
+    # declared fault without timeouts + malformed telemetry row
+    write_ndjson(p("declared.jsonl"), build_declared_fault("behavior_v2"))
+    rd = scan(p("declared.jsonl"))
+    check("declared fault → fault-declared (not clean)", rd["outcome"], "fault-declared")
+    check("declared_fault reason kept", rd["declared_fault"], "controller_unresponsive")
+    check("bare ['cc'] row dropped and counted", rd["ctl_malformed"], 1)
+    check("well-formed cf row still decoded (sd max)", rd["ctl_sd_max_us"], 129000)
+
+    out = subprocess.run([sys.executable, SCRIPT, "--json", d], capture_output=True, text=True)
+    check("exit code 0", out.returncode, 0)
+    rows = json.loads(out.stdout)
+    check("one row per file in dir", len(rows), 13)
+    check("no _context key without --verbose", any("_context" in r for r in rows), False)
+    by = {r["file"]: r["outcome"] for r in rows}
+    check("dir scan classifies wedge", by["wedge.jsonl"], "wedge")
+    check("dir scan classifies gz wedge", by["wedge_v1.jsonl.gz"], "wedge")
+    check("dir scan classifies envelope", by[os.path.basename(path)], "no-arena-rows")
+    out2 = subprocess.run([sys.executable, SCRIPT, p("wedge.jsonl")], capture_output=True, text=True)
+    check("markdown table has header + row", out2.stdout.count("| wedge.jsonl |"), 1)
+    check("markdown footer labels dt honestly", "host-observed round trip" in out2.stdout, True)
+    out3 = subprocess.run([sys.executable, SCRIPT, p("does-not-exist.jsonl")], capture_output=True, text=True)
+    check("unopenable file → exit 2", out3.returncode, 2)
+
+print("\n=== Summary ===")
+print(f"{total - failures} / {total} checks passed")
+sys.exit(1 if failures else 0)