Shared P4 beta 2 — accepted M3/FLX4 and JC4880 updates

One canonical P4 core; board-specific signed packages for JC4880, JC1060 and M3.

This is a contributor beta / GitHub prerelease. Stable M2.5, prior
beta1 assets and public OTA channels remain unchanged. No device is updated by
publishing this release; M3/JC4880 acceptance below predates publication and
belongs to the exact, unchanged supplied bytes.

Changes since beta 1

• Restore FLX4 headphone cue level: remove unintended12.041-dB transport
  attenuation while retaining the legacy USB MAIN mirror behavior. Both M3 and
  JC4880 bench listening/control checks are operator-confirmed. Start LEVEL low
  after updating and raise gradually; this is not a new club-volume/electrical gate.
• Re-anchor Master Tempo after ordinary-resampler fallback, fixing a reproduced
  stale consumer-clock rewind (224 production-callback regression cases).
• Apply the existing1-KiB task-context cache-maintenance bound to ordinary P4
  builds. Range/alignment/error, ISR/critical delegation and full DMA ownership
  semantics remain intact; bytes are bounded, not execution time guaranteed.
• Remove unbounded largest-block heap walks from ordinary diagnostic snapshots.
  Free/minimum counters remain measured; unavailable fragmentation/walk fields
  are explicit null, not zero. Avoid resource walks and large logs during playback.
• Include reviewed shared controller/lifecycle and JC1060 integration repairs,
  plus DDJ-400 loop halve/double mappings. JC1060 physical gates remain open.

Downloads and exact identities

The distribution tag is a delivery record, not a common firmware build version.
Each retained image has its own source SHA; production/test/tool/profile trees
are identical. We deliberately avoid rebuilding accepted firmware just to make
the version strings match.

Board	Embedded version / source	Image bytes	Download
JC4880	M2.5-249-g0a33ec1f / 0a33ec1fb16c0136dccaa85ca63a6fbc00a4d527	2,609,952	jc4880-beta-kit.zip or main-deck-p4.ddjota
JC1060	M2.5-246-g2f2b0555 / 2f2b05558ccb68238d7228f59e52cd6c7d06e12f	2,668,480	jc1060-beta-kit.zip or main-deck-jc1060.ddjota
M3	M3-dev-g1556e8d7dfcb / 1556e8d7dfcb4f016c52ab1a372dd2e076dcaa1f	2,603,312	m3-beta-kit.zip or main-deck-m3.ddjota

Matching *-debug.zip files contain exact ELF/MAP/configuration. Kits include
signed OTA/manifest, raw application, board/configuration/lock identity, recovery
bootloader/partition/otadata/flash metadata, module-specific notices and compiled
profiles. controller-profiles.zip provides the same six compiled fixtures;
profile availability does not imply hardware acceptance on every board.

Verify SHA256SUMS and its detached signature, the signed release manifest and
each kit inventory. Trusted public DER fingerprint:
125ef6eb776729e3018ecc564317254febec4a9a2bf34892e99d57f10bc02e43.
The included public key alone does not establish trust. No private signing
material is included.

Stop both decks, keep power stable, and upload only the matching board's
signed .ddjota. Cross-board projects are not interchangeable. Raw BIN and
the kit's recovery/ contents are verified wired provisioning/recovery material,
not web OTA; check the actual layout and never erase the chip indiscriminately.

• Ordinary M3: FLX4 USB2 FS/root1; storage USB3 HS/root0; PCM5102A MAIN48 kHz.
  These assets do not use the experimental Hercules/S2 controller/storage
  swap. Historical M3 main-deck-p4 identity requires the preserving wired
  migration before main-deck-m3 OTA. M3-dev has no automatic pull discovery.
• JC4880: controller root1/storage root0, PCM5102A MAIN with board-selected
  rate (44.1 kHz with FLX4 in the accepted smoke).
• JC1060: controller root0/storage root1, controller MAIN/cue and Ethernet;
  no Wi-Fi or PCM5102A pin sharing. The kit identity supersedes historical
  version numbers in its contributor handoff. First hardware tests are Kayrosen's
  separate gate; this publication does not send him a message.

Validation and limits

• M3 supplied bytes: installed VALID ota_1;100.264-s three-loop-exit replay,
  30.145-s controls,60.133-s combined semantic checks, then3600.286 s /5301
  samples of mixed-rate dual MT/loops. All22 strict deltas remain0. The operator
  confirms clean MAIN/FLX4 headphones, fluid waveforms and stable display for
  the full hour. Output-late24/max12,988 us includes a sample-observed3/60-s
  cluster: investigation retained, not zero-late or unrestricted reliability PASS.
• JC4880 supplied bytes: installed VALID ota_0;60.234 s /93 samples /1902
  MIDI packets, all22 strict deltas0 and output-late0. Both loop/CUE transitions
  and operator controls/PFL/MIX/LEVEL/audio/display confirmed. Long soak is
  explicitly waived / NOT RUN, not PASS. The earlier0.076-s attempt was a
  monitor-rate mismatch and remains archived as incomplete, not a firmware failure.
• JC1060 supplied bytes: local IDF6.0.2 incremental build/board checks pass.
  Physical installation/acceptance is NOT RUN, deferred to Kayrosen. Required
  Ethernet/HTTP readiness/rollback, SD warm-reset, USB MAIN reconnect and listening
  still require this exact image on real hardware.
• Full host Qualification passed on identical production/test sources. Retained
  IDF6.0.2 builds, unchanged dependency locks, single-BSP/project/source checks,
  0x380000 budgets, signatures, matching ELF hashes, compiled fixtures and every
  ZIP inventory verify. These are retained incremental builds, not new clean
  release builds. Hosted CI is NOT RUN (operator quota waiver).
• Controls are exercised during playback, but observed input precedes automatic
  loop exits. Sustained input pressure specifically through exit is not qualified.
  Exact historical139-ms masking-call attribution and the late cluster stay open.
• S2 remains operator-closed with explicit waivers; no further tests scheduled.
  Historical S2/Hercules acceptance keeps its own image/topology scope and does
  not qualify these ordinary M3 downloads. Wider controller LED/pad/FX, real
  export/library, physical Campaign A and experimental feature gates stay partial
  or NOT RUN. Recorder/alternate DJ UI and M3 Ethernet/Pro DJ Link stay experimental
  or disabled in ordinary defaults. The entire shared-core acceptance is not closed.

Distribution source: d259a71ae716217a6448c374bf52c2c798d67ce8. Per-board source commits are listed above and in the signed manifest.

OTA instructions · Board policies · Beta2 delivery record · M3 hour evidence · JC4880 smoke evidence

Shared P4 beta 1 — JC4880, JC1060 and M3

One canonical ESP32-P4 core now serves JC4880, JC1060 and M3, with isolated
board providers and shared audio/deck/library/controller/UI/web/signed OTA code.

This is a contributor beta / GitHub prerelease, not unrestricted production
acceptance. Stable M2.5, its existing assets and public OTA channels remain
unchanged. No device was updated as part of this publication.

Changes

• Shared startup/components/BSP contracts, board/project/source identity and
  signed OTA health/rollback boundaries.
• Unified Rekordbox metadata, playlist/artwork, memory/source/local cues,
  persistent media identity and explicit legacy-cue migration.
• Common LOAD LOCK, seek/preroll/CUE/loop transport with M3 PCM/FIR/cache fixes
  and board-specific waveform scheduling.
• Controller profile v2/v3/v4 runtime, MIDI/LED epochs and USB audio lifecycle;
  corrected physical-root FIFO admission for Hercules on JC and M3 policies.
• English README reconciled; all 20 original image/embed references preserved.

Downloads and installation

Board	Embedded version	Image bytes	Download
JC4880	M2.5-215-g40e72fcb	2,607,712	jc4880-beta-kit.zip or signed main-deck-p4.ddjota
JC1060	M2.5-215-g40e72fcb	2,666,368	jc1060-beta-kit.zip or signed main-deck-jc1060.ddjota
M3	M3-dev-g40e72fcbf403	2,600,960	m3-beta-kit.zip or signed main-deck-m3.ddjota

Exact source/tag commit: 40e72fcbf403a1650185a4c64509dd11bba9f73f
(merged PR #46).
Verify SHA256SUMS.txt, the signed release manifest and kit inventories.
Each kit includes its signed OTA, raw recovery BIN, board/source/configuration,
bootloader/partition/initial OTA data, flashing arguments and controller profiles.
Separate debug ZIPs retain matching ELF/MAP. No private signing material is included.

Stop both decks, keep power stable and upload only the matching board's
.ddjota through its signed local OTA UI. Raw BIN and partition/bootloader
artifacts are for verified wired provisioning/recovery, not web OTA. Cross-board
packages are not interchangeable. The M3 development version disables automatic
pull discovery and ordinary M3 uses FLX4 USB2 FS / storage USB3 HS. These
assets do not retain the experimental Hercules/S2 USB3-controller port swap.
Historical M3 main-deck-p4 requires the preserving wired identity migration.

OTA instructions ·
JC1060 handoff for Kayrosen ·
Board policies.

Validation and limits

All three fresh ESP-IDF 6.0.2 builds, board/project/source/component isolation,
unchanged lock and 0x380000 image-budget checks pass on the exact beta source.
All three bundle/manifest ECDSA-P256 signatures, embedded identities/ELF hashes
and ZIP inventories verify. Production and test source is unchanged from the
fully qualified 722bb976 baseline (required fixtures, no host SKIP, eight root
policies and captured JC/M3-HS stream regressions). UI simulator scope and source
equivalence are documented; no new beta physical UI claim is made. The auxiliary
USB spike's historical missing-dependency CI build defect is locally repaired.
Current hosted CI remains operator-skipped under the earlier quota decision.

• These exact beta assets are not installed or physically accepted.
• JC4880's earlier named short control/audio/MT/loop/seek/CUE/PFL blocks passed
  on e22ff334. Its long soak is explicitly waived / NOT RUN, not PASS.
• JC1060 physical testing is NOT RUN, deferred to contributor Kayrosen.
• Historical M3/Hercules/S2 hours retain their exact image/configuration/rate
  scope; they do not qualify these packages. S2 remains operator-closed.
• Output-late findings remain monitoring observations; no zero-late claim.
  Wider real-media, transport and individual pad/FX/LED gates remain partial/unrun.
• Recorder, alternate DJ UI and M3 Ethernet/Pro DJ Link remain experimental or
  disabled in ordinary builds.

Validation matrix ·
Delivery record.

M2.5 — JC4880 / DDJ-FLX4

M2.5 is released for JC4880 / Pioneer DDJ-FLX4 / PCM5102A MAIN / FLX4 headphone cue.

• Retains the previous product UI and adds the supplied Pajoniiir logo when track artwork is missing, in Library and Overview.
• Consolidates the shared-core library/transport work already published in v91: richer metadata, playlists/artwork, memory cues, persistent cue edits, title/downbeat corrections and improved seek/loop handling.
• Keeps S3CP v2/v3 compatibility and v4 profiles, signed board-specific OTA and bounded startup readiness.

Thanks to collaborator kayrozen for modules, fixes and ideas adapted from his Pajoniiir fork, including metadata, seek/cue/loop, JC1060/DDJ-400 and Pro DJ Link work. Provenance and licensing remain in the integration ledger.

The artwork candidate passed signed OTA, normal USB/media return, cover/logo/page transitions, allocation/resource checks and operator-confirmed MAIN/D1/D2 cue listening with zero new strict faults. Final tagged-image results and artifact hashes are recorded in the release evidence.

Explicit release exception: the operator waived a new 180-minute soak for this final M2.5 image because audio/deck/DSP code is unchanged. The final image receives short OTA/startup/USB/UI/audio checks; v91's older soak remains evidence for v91, and no M2.5 long-soak PASS is claimed.

JC1060/DDJ-400/real Pro DJ Link peers remain development configurations awaiting hardware acceptance. Recorder/SD experiments are disabled; APTA and the public Web Profile Builder v4 deployment are separate. Full real-export/downbeat/PWV4 comparison, nested playlist order, source-cue reimport/restore/cross-media isolation, delayed/corrupt artwork and advanced active-removal/shift/touch variants remain unrun.

App-only OTA preserves the partition layout. Previous immutable releases remain available for signed service rollback.

Read the user manual and release record.

Frozen source: 20f1c3f04a615209ae25e9bbdae649d0f5b44e8d, annotated tag M2.5, ESP-IDF 6.0.2. Exact-source CI.

Artifacts:

• main-deck-p4.bin: 2,576,432 bytes, SHA-256 7aaab31d4a7c00990939cb9ccecb04aba1cba463b1db919d168477c7df3210ba.
• main-deck-p4.ddjota: 2,576,620 bytes, SHA-256 44db191c1785168781e9b2893cac6dda1b92a20a5342c328d7fbfdbbd8707e27.
• manifest.json and manifest.sig: independently verified signed release manifest.

Final tagged M2.5 / ota_1 passed signed OTA and startup readiness, USB storage/FLX4 availability and 62.622211 seconds of measured dual playback with zero new strict PCM, deadline, USB packet/ring/host/queue faults. The operator confirmed normal Overview and clean MAIN/D1/D2 CUE sound. Both decks were stopped at completion. All eight exact-source CI jobs passed.

Pajoniiir JC4880/FLX4 M2.4-91-g75136aef

Release for JC4880 + Pioneer DDJ-FLX4, PCM5102A MAIN and FLX4 headphone cue.

This publishes the existing hardware-tested image M2.4-91-g75136aef from
source 75136aef749a1f03d9089c8b6ff6452b3dba0839. It has not been rebuilt or
re-versioned for publication.

• Preserves the previous UI design and adds richer library metadata,
  playlist/artwork navigation, memory cues and persistent local hot-cue edits.
• Corrects Rekordbox title/downbeat interpretation and improves transport,
  seek, cue and loop handling.
• Fixes reproduced FLAC loop OUT/resize starvation and output deadlines.
• Adds compatible S3CP v4 profiles while retaining v2/v3 support.
• Retains signed board-specific OTA and bounded pending-image startup readiness.

Both firmware targets and all eight exact-source CI jobs passed. Focused real
MP3/WAV/FLAC, MAIN/cue, scratch/MT, loop, local cue, load-lock and stopped USB
reconnect checks passed with operator listening confirmation.

Isolated diagnostic images passed automatic unconfirmed-image bootloader
rollback and startup readiness rejection at 60.253 seconds. Both returned
automatically to the original v91; neither diagnostic is a release artifact.

Accepted test exception: 180m01.37s of recorded dual-deck playback was
accepted in two segments, including a 163m05.48s uninterrupted continuation.
This is not an uninterrupted 180-minute soak. Retained intervals had zero
strict fault deltas; the operator confirmed clean MAIN/D1/D2 cue sound.

JC1060, DDJ-400, other controllers and real Pro DJ Link peers remain development
configurations awaiting physical qualification. Recorder and SD experiments
are disabled. Unrun deck/format, source-cue reimport/cross-media, shifted/touch
load-lock and active removal/cancellation variants remain explicit limitations.

Signed service rollback remains available; normal pull OTA offers only newer
versions. App-only OTA does not migrate the partition table.

Artifacts:

• main-deck-p4.bin: 2,570,752 bytes, SHA-256
  d93de2ce1e788dd167c2a87dffd1908e2202c1bf399a8a6ba5c25f75e0224caa
• main-deck-p4.ddjota: 2,570,940 bytes, SHA-256
  9810b31ece270c7b406be2eb605331ad460e83dc06134519e57498cb6270d069
• manifest.json / manifest.sig: signed outer release manifest.

Detailed acceptance and retained limitations are in the integration branch:
release record.

Pajoniiir M2.5 development pre-release (M2.4-7-gb8d9cb7)

Development pre-release for M2.5 controller-profile support, using the exact firmware already installed and tested on the P4: M2.4-7-gb8d9cb7, source commit b8d9cb7bbf73b86d3379e8c8a9eb9c7f4417958a.

Changes

• Add S3CP v3 scaling of 7-bit MIDI CC mixer/tempo values to the P4 14-bit range, preserving endpoints and center.
• Retain S3CP v2 profile compatibility; update both runtime and SD/upload validation for v3.
• Preserve mixer snapshot replay while excluding tempo replay.
• Expand the experimental original Numark DJ2GO2 profile to 27 controls. Other controller mappings remain partial; profile validity is not hardware qualification.

Verified

• ESP-IDF v6.0.2 build and full P4 host suite, including profile installation and FLX4 parity tests.
• Signed opposite-slot OTA, automatic USB0/FLX4 recovery and a 324-track library.
• Dual-deck playback telemetry, subsequent software reboot and persistence of the 512-byte Numark v3 profile.
• Operator confirmed clean MAIN/cue and normal FLX4 controls/LEDs without power cycling or USB removal.

Limits and installation

Additional controllers were unavailable for physical tests. Numark, S2 MK3, FLX10 and REV7 hardware, LED, reconnect and audio acceptance remain open; REV1 still lacks confirmed VID/PID. This is not the final M2.5 release.

Use main-deck-p4.ddjota for local signed P4 OTA, with stable power and playback stopped. The raw .bin is for wired recovery only. Install this firmware before any S3CP v3 profile; M2.4 rejects v3. Existing v2 profiles remain supported. Controller profiles are not installed by the OTA bundle.

The production OTA channel remains on M2.4. This pre-release does not deploy the public Web Profile Builder.

Artifact identity

• Image: 2,505,392 bytes; SHA-256 0e9caf717808adbe2be526a10f59ddf768c1119eb2c914ccfe6b4fae15005d6c.
• Signed OTA bundle: 2,505,580 bytes; SHA-256 425aecff679f9e71e0b86aec80f0c99f555a06a6a1c0ba1aa1fcfb376c4cd44d.
• Signing key ID: rel-001. manifest.json and manifest.sig provide the signed release manifest.

Detailed installation and acceptance record.

Pajoniiir M2.4

Pajoniiir M2.4

M2.4 supersedes M2.3 after the first live production pull check on M2.3 exposed an ESP_ERR_MBEDTLS_SSL_HANDSHAKE_FAILED against the current cross-signed edge certificate chain.

The release enables ESP-IDF certificate-bundle cross-signed-chain verification. CA validation and hostname verification remain mandatory. Playback, controller, UI, DSP and audio code are unchanged from M2.3.

Verified

• exact tagged ESP-IDF v6.0.2 production build;
• full P4 host regression suite and GitHub Actions;
• signed .ddjota bundle and detached manifest signature verified with the firmware trust key;
• installed on physical ESP32-P4 as M2.4 in ota_1, boot epoch 559;
• live HTTPS pull discovery succeeded against the production channel and correctly rejected the older M2.3 offer;
• no new PCM underrun, UAC data-loss, packet/drop/overflow, USB daemon/recovery, log-drop or TWDT fault on the installed image.

Accepted deferred checks

• duplicate raw track-ID exact-image repetition;
• Rekordbox cue/loop comparison.

Pajoniiir M2.3

Pajoniiir M2.3 production maintenance release.

Source and build:

• immutable tag commit: b9d6bf1b5ea4992312669a7679f73a31d011b791
• ESP-IDF: v6.0.2
• firmware size: 2505648 bytes
• firmware SHA-256: 5a0051b3e449db85125f57cbc05b1f507c543097af07d988c469315919222ca2
• signed OTA bundle size: 2505836 bytes
• bundle SHA-256: 31050432dfe2f3ebc5901692081ba54f7ddafd6c35e1286aeca18d427a1a495e
• signing key ID: rel-001

The signed bundle was installed on the production P4 (ota_0, boot 558) and passed cold-boot USB0/FLX4 recovery, playback, strict health counters, and operator-confirmed clean MAIN/headphone cue.

Accepted scope limitations:

• exact-M2.3 duplicate raw track-ID repetition: NOT RUN — OPERATOR ACCEPTED; the same gate passed on M2.2-37-g751d3c6.
• real Rekordbox cue A/C and loop slot/time comparison: NOT RUN — OPERATOR ACCEPTED.

Pajoniiir M2.2-13 OTA review candidate

This prerelease contains the exact signed P4 image validated through the public production OTA path on 2026-09-24.

• Source commit: e0f9add1e1a76bc49eac7e155bf8ac8142737b11
• Installed image: M2.2-13-ge0f9add on ota_1
• Signed bundle verification: PASS with release key rel-001
• Public pull OTA: PASS on controlled retry
• Post-install dual-deck smoke: PASS
• 180-second FLAC/MP3 dual-deck soak: PASS with zero PCM, output-late, UAC, USB daemon and service-log error counters

The first pull-install attempt reset the previous M2.2-12-g626c2d9 image with a retained controller_usb/IDLE0 task-watchdog summary before the candidate slot booted. The clean controlled retry completed successfully. This intermittent watchdog remains an open release-assessment finding.

This is a review candidate and does not replace stable M2.2. The public latest.json production channel remains on M2.2.

Asset hashes:

• main-deck-p4.bin: eb3439702c3c590c1ff8a24df3fb19f47cbbd8671b41d2e7c3b91b3edc6d2624
• main-deck-p4.ddjota: b5b48161fa5cc346b2b55a2e7f4296672b59aa8211bb228bcce859b0825db959

Pajoniiir M2.2

Pajoniiir M2.2 upgrades the embedded Wi-Fi Remote controller while preserving the M2.1 dual-deck firmware baseline.

Highlights:

• redesigned responsive desktop, landscape and portrait web controller
• authoritative deck SYNC state and backend action support
• single-commit waveform seek semantics with safe cancellation
• offline embedded assets and improved accessibility/browser zoom
• seven browser contract tests integrated into the P4 host regression suite

Qualification:

• GitHub Actions run 35792104604 passed host regressions, UI simulator and ESP32-P4 build gates
• exact annotated M2.2 tag built with ESP-IDF v6.0.2
• signed rel-001 OTA installed on hardware and booted from ota_0
• USB0 mounted with 324-track library, zero host errors, PCM underruns, UAC loss, TWDT and output-late events
• live M2.2 HTML and reversible SYNC ON/OFF smoke passed

Use main-deck-p4.ddjota for signed OTA updates. main-deck-p4.bin is for wired recovery only.

Pajoniiir M2.1

Pajoniiir M2.1 production release.

Frozen source: 70824d24dbb1c8d72d19f15797afa2946c5eb909
Toolchain: ESP-IDF v6.0.2
Installed and accepted: M2.1 / ota_1

The exact tagged image passed the clean build, ECDSA P-256 signed-package verification, signed OTA installation, dual-USB/dual-deck strict-counter smoke, and operator-confirmed audio, display and touch smoke.

Assets:

• main-deck-p4.ddjota: signed OTA bundle for normal update
• main-deck-p4.bin: raw application image for wired recovery only
• manifest.json and manifest.sig: release metadata and ECDSA signature

Public OTA channel: https://ota.pajoniiir.eu/latest.json
Validation record: https://github.com/dvucinozd/Pajoniiir/blob/master/docs/validation/M2_1_PRODUCTION_RELEASE_20260920.md

Accepted M2.1 boundaries: shared service credential, no SBOM, and Secure Boot/Flash Encryption/security eFuses deferred on the sole P4 board. Encrypted offline primary and separately stored backup signing-key copies are operator-confirmed; recovery signing from the backup is operator-accepted as deferred maintenance. Multi-key trust overlap is required only before a future planned key rotation.