v2.11.1 — the panel's forced PIN change can no longer be skipped, and three more high findings are fixed

Four high-severity defects of the manual's review are fixed: the panel's forced PIN change could be skipped, its account editor granted bits the account at it did not hold, "Adopt the probe" read the wrong GPIO, and the setup access point of the boot gesture lived by leftover memory. A stricter PIN policy no longer locks shorter PINs out of the panel, and the Files page says why a refusal has code 6.

This is the fourth signed release: a device on v2.11.0 checks its signature before installing it. CONFIG_VERSION stays at 26 and the security version at 1: v2.11.0 reads the configuration, and an update goes over the air both ways.

The panel's accounts (#255, #256)

• The forced PIN change can no longer be skipped. An account whose PIN must change is sent to Novo PIN once it identifies. SAIR there opened the Settings menu with the PIN unchanged; it leaves to the dashboard now.
• The panel grants only what the account at it holds. An account with Users gave Limits, Block and Maintenance to any account. It adds only bits it holds now, as the web does; a refusal says "Sem permissão" and logs code 458.
• A stricter PIN minimum no longer locks shorter PINs out of the panel. Identification checks any PIN from 4 characters, and a right one shorter than the policy goes straight to Novo PIN. "PIN too short" says the policy's minimum instead of 4.

Sensors, the setup access point and updates (#255)

• "Adopt the probe wired here" reads the slot's own GPIO, and the sensor reads at once. It read the GPIO whose number is the slot's and left the running sensor in quarantine.
• The access point the boot gesture opens follows the 15-minute limit. With a network configured, it gives way to it after 15 minutes; with none, it stays open.
• The Files page says why a refusal has code 6: the image is for another chip, or damaged, and the page says which .bin each board takes.

Measured on the bench

The release gate of AGENTS.md §2 ran on the candidate the CI signed on main (run 37259233322), on both boards. The images attached here carry the same image bytes; their signature is their own, because every signing run makes a new one.

• Pico 2 W (RP2350 A2), from the published v2.11.0:
  • the candidate over the air went to the other slot on trial and kept itself, 555 configuration values unchanged;
  • refused: the candidate with one byte changed (9) and an image signed by the bench key (12);
  • the candidate over itself, into the other slot;
  • the factory .uf2, dragged onto the BOOTSEL drive, came up from slot A;
  • a week later, back on the bench: 30 minutes without a restart, five sensors reading, with the bench hand's RESET wire on the RUN pin; the probe swapped on GP0 meanwhile was adopted first, and read at once; web suite 67 passed, 0 failed.
• Pico W, from the published v2.11.0, on release, alpha and Air:
  • 2.11.1 over the air with every configuration value unchanged (567 on the release), five sensors reading, the configuration file identical byte for byte, and the .bkp back with 71 of 75 files identical;
  • the candidate over itself, checking its own signature;
  • back to v2.11.0 over the air and up again;
  • refused: unsigned (8), the Air's (7), the Pico 2 W's (6) and the candidate with one byte changed (9);
  • an upload cut at 400 kB, with and without the filesystem filled before the reset: configuration intact;
  • 30 minutes without a restart with the bench hand's RESET wire off the RUN pin. With it on, the board restarted itself four times in six hours, none of them through the watchdog;
  • web suite 67 passed, 0 failed.

Flash

Signed .bin sizes against the published v2.11.0:

Image	v2.11.0	v2.11.1	Slack under the 1,040,384 B ceiling
release	1,032,933 B	1,033,357 B	7,027 B
alpha	990,621 B	990,621 B	49,763 B
Air	1,031,485 B	1,031,485 B	8,899 B
Pico 2 W	997,001 B	997,417 B	in a slot of 1,568,768 B

The ceiling is for updates over the air on the Pico W.

Upgrading

• From v2.11.0, on either board: over the air, from the Files page, with the .bin attached here. The configuration carries over. On the Pico 2 W the update goes to the other slot and boots on trial.
• Back to v2.11.0: over the air with v2.11.0's .bin (both carry security version 1; checked on the bench, on the Pico W), or over USB.
• From an older version, or a Pico 2 W's first install: as in the notes of v2.11.0.
• Language packs: upload the two attached here on the Files page, then reboot. With the v2.11.0 packs everything works: two new web strings read in English, and the panel's "PIN too short" line keeps saying 4.
• simut-rx does not know releasetwo yet, so it offers no update to a Pico 2 W.

Known, and not fixed here

• The build configurator does not build for the Pico 2 W.
• Narrowing the PIN alphabet or lowering the length ceiling still strands an old PIN that the new cards cannot offer or Core 0 cannot check in time. The account needs a new PIN from the panel's Users, the web or the console.
• On a build with a panel, a Core 1 hard fault leaves no program counter in the log, on both chips.
• On the Pico W, a configuration save from the panel during an upload restarts Core 1 inside the stage, by the code. Not seen on the bench.
• A chunked reply occasionally loses its framing (#189): 0.15–0.6 % of /api/status reads in a tight loop, and 4 of the 119 reads of the Pico 2 W's soak.
• On the alpha, the log's messages in pt-BR or es-ES come out empty, by the code.
• Accented lines on the boot screen print ?, by the code.
• The web page does not retry an install refused with 503, by the code.
• configure terminal does not need enable, although the command table says it does.
• With two pressure sensors, the measurement line sends the pressure under the first one's key and with the last one's value, by the code.
• The Telemetry page's token list for the alarm line stops at v22. Chapter 22 of the manual lists every token.
• Adopting a probe, or sensor_wipe, does not start the slot's history anew: the old probe's readings come back under the new probe's id. Seen on the bench.
• After a boot, a probe that is not the slot's can have its first reading recorded, before the ROM check, which runs on every fifth read. Seen on the bench once.

Full notes: CHANGELOG.md.