major library upgrades, new protocol support, database refreshes, and…

… enhancements to both the display/UI stack and developer workflows (#589)

* feat: Phase 1 signal database refresh (IRDB d126fb1b, UberGuidoZ 29117c73)

- Import 12 new .ir files from Flipper-IRDB across 6 categories:
  TV: DuraBrand DU-1301, ContinentalEdison CELD55SQLDV24B6, Vizio VX32L
  Audio: Philips HTL2060 (Receivers), Ultimea Poseidon M20 (SoundBars)
  Fan: Generic_Fan_HS95104SK, Generic_Floor_Fan, Klarstein Sommwerwind
  Projector: NEC RU-M124, Sony RM-PJ30 (4 ID variants)
  LED: BoomTone DJ_LEDPAR 7x10W 5in1
- Update IRDB commit SHA to d126fb1b, total IRDB files now 1,308
- Pin Sub-GHz DB to UberGuidoZ commit 29117c73 (no new .sub files)
- Update subghz_playlist SOURCES.md commit reference

* feat: Phase 3+4 u8g2 v2.36.19 and FatFs R0.16 updates

Phase 3 (u8g2 v2.36.19):
- Replace all csrc/cppsrc files with v2.36.19 (no local modifications)
- Add 5 new display driver files to CMakeLists.txt:
  u8x8_d_ssd1315_128x64_noname, u8x8_d_ssd1362z, u8x8_d_st7305,
  u8x8_d_st7586s_pe24064, u8x8_d_uc1698
- ST7567 display API used by M1 is unchanged

Phase 4 (FatFs R0.16):
- Replace ff.c, ff.h, ffunicode.c with R0.16 versions
- Preserve all M1-specific files: diskio.c/h, ffconf.h, ffsystem_baremetal.c,
  ffsystem_cmsis_os.c, ff_gen_drv.c
- Update ffconf.h: FFCONF_DEF 80286→80386, add FF_PATH_DEPTH=10, FF_FS_CRTIME=0

All 104 host tests pass.

* feat: Phase 7 FreeRTOS V10.5.1→V11.3.0 kernel update

- Replace all core kernel files (tasks, queue, event_groups, etc.)
- Replace ARM_CM33_NTZ non_secure port files (port.c, portasm.c, portmacro.h, portmacrocommon.h)
- Replace heap_4.c and all include headers
- Add 3 new V11 includes: mpu_syscall_numbers.h, newlib-freertos.h, picolibc-freertos.h
- Add mpu_wrappers_v2_asm.c (MPU-only, not in CMakeLists since configENABLE_MPU=0)
- Add V11 config: configNUMBER_OF_CORES=1, configENABLE_ACCESS_CONTROL_LIST=0
- Preserve CMSIS_RTOS_V2 abstraction layer (ST-specific, not part of kernel)
- All 104 host tests pass

Note: Hardware soak test required before production release (watchdog timing,
WiFi SPI scheduling, IWDG verification)

* fix: restore pvPortRealloc lost during FreeRTOS V11.3.0 upgrade

The FreeRTOS V11.3.0 upgrade dropped pvPortRealloc from heap_4.c and
portable.h. memmgr.c wraps libc realloc/__realloc_r through pvPortRealloc,
so the firmware link failed with "undefined reference to pvPortRealloc".

Restore pvPortRealloc to heap_4.c (after pvPortCalloc, accessing the
BlockLink_t header to determine the original allocation size) and add the
corresponding declaration to portable.h. Implementation is identical to
the pre-upgrade version. All 104 host tests pass.

* feat: Phase 2 — add Nord ICE Sub-GHz protocol (Momentum Firmware)

Audit of Flipper Zero (dev) and Momentum Firmware (dev) Sub-GHz protocol
directories against M1's 96-decoder inventory identified one genuinely new
protocol not yet in M1: Nord ICE (33-bit OOK PWM gate/garage remote,
433.92 MHz, @xMasterX 2026-03).

Changes:
- Sub_Ghz/protocols/m1_nord_ice_decode.c (new decoder, uses generic PWM)
- Sub_Ghz/m1_sub_ghz_decenc.h: NORD_ICE added to protocol enum
- Sub_Ghz/subghz_protocol_registry.c: extern + registry entry
  (te_short=300, te_long=800, te_delta=150, 33 bits, F_433|AM|Send)
- cmake/m1_01/CMakeLists.txt: source file added
- tests/stubs/subghz_decode_stubs.c: subghz_decode_nord_ice stub added
- tests/test_subghz_registry.c: Nord ICE → 433.92 MHz freq entry added
- documentation/flipper_import_agent.md: inventory updated (96→97 files)
- .changelog/nord-ice-protocol.added.md: fragment created

All 104 host tests pass.

* Changes before error encountered

Agent-Logs-Url: https://github.com/hapaxx11/M1/sessions/3ea9916a-08a4-4d46-aa01-d07f0022bcc7

* feat: Phase 5 — complete IRMP/IRSND v3.6.4 header update

Finish the IRMP v3.6.4 sync started in the previous session.

irmp.h:
- #ifndef → #if !defined() guard style (matches irmpconfig.h)
- Add IRMP_USE_COMPLETE_CALLBACK function declaration
- Add IRMP_32_BIT==0 + MERLIN protocol check
- Add KASEIKYO+MITSU_HEAVY conflict check (after PANASONIC+MITSU_HEAVY)
- Update PENTAX/GREE F_INTERRUPTS threshold: >16000 → >17000 && __SIZEOF_INT__<4

irsndconfig.h:
- Add F_INTERRUPTS default (15000) before #if !defined(ARDUINO) block
- "Program Space" → "program memory" in all three section headers

104/104 host tests pass.

* fix: restore U8G2_REF_MAN_PIC lost during u8g2 v2.36.19 update + add vendored dependency audit rules

* docs: update Sub-GHz menu structure to include Proto Pirate (14th item, PR #579)

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Merge pull request #587 from hapaxx11/copilot/fix-ir-remote-layout

IR quick-remote: fix portrait grid layout — align +/- pairs vertically, prevent label overflow

Merge pull request #582 from hapaxx11/copilot/stock-review

feat(stock): cherry-pick Monstatek v0.8.0.2 improvements

IR quick-remote: restore portrait orientation, disregard southpaw (#583)

* IR quick-remote: force portrait (M1_ORIENT_REMOTE), disregard southpaw

* test: align ir ux polish orientation assertions

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

feat(subghz): add Proto Pirate rolling-code analysis toolkit (#579)

* Initial plan

* feat: add Proto Pirate rolling-code analysis toolkit to Sub-GHz

Phase A: Menu integration
- Add "Proto Pirate" (14th item) to Sub-GHz main menu
  (m1_subghz_scene_menu.c: MENU_ITEM_COUNT 13→14)
- New SubGhzSceneProtoPirateMenu + SubGhzSceneProtoPirateTuner
  added to SubGhzSceneId enum and scene_registry[]
- New m1_subghz_scene_proto_pirate_menu.c: 3-item sub-menu
  (Receiver → SceneRead, Sub Decode → SceneSaved,
   Timing Tuner → SceneProtoPirateTuner)

Phase B: Timing Tuner
- New subghz_proto_pirate_timing.c/h: pure-logic, host-testable
  timing analysis library with 25-entry automotive protocol
  reference table (KeeLoq, StarLine, Princeton, CAME, Nice FLO,
  Chrysler, Subaru, Honda, Kia, PSA, VAG, Ford …)
  Functions: pptime_analyze(), pptime_match(), pptime_match_str()
- New m1_subghz_scene_proto_pirate_tuner.c: async Timing Tuner
  scene driven by SubGhzEventRxData (copies pulse_times[] into
  512-sample ring buffer, runs pptime_analyze) and SubGhzEventTick
  (200 ms, updates RSSI + animation); UP/DOWN cycles protocol refs
- 23 Unity host tests in tests/test_proto_pirate_timing.c;
  tests/CMakeLists.txt updated; 103/103 pass
- cmake/m1_01/CMakeLists.txt: three new source files added
- .changelog/proto-pirate.added.md: feature changelog fragment

All workflows are asynchronous (tick-event driven, no HAL_Delay).

* fix: address review comments on proto pirate tuner and timing module

- start_rx(): add menu_sub_ghz_init() call and extern declaration, matching
  the pattern used by other Sub-GHz RX scenes (e.g. m1_subghz_scene_read.c)
- stop_rx(): add sub_ghz_set_opmode_ext(SUB_GHZ_OPMODE_ISOLATED) after
  deinit to leave the SI4463 in a clean idle state on exit
- pptime_proto_table: remove duplicate "SMC5326" entry
- pptime_proto_table comment: update to reflect that Manchester entries
  (Honda V1, Kia V1, PSA AM) are intentionally included
- Remove unused #include <stdlib.h> from subghz_proto_pirate_timing.c
- pptime_analyze(): remove dead `dur < 0` sign-handling branch (input is
  uint16_t, always non-negative after cast to int32_t)
- pptime_analyze() doc comment: update @param durations to describe the
  actual unsigned input type
- test comment: fix stated default valid range from 50-1250 us to 100-1100 us
  (matching te_short=400, te_long=800, te_delta=150 defaults)

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

IR UX polish: fix screen rotation, replace long-press with popup menu…

…, add category sidebar (#578)

* Initial plan

* IR UX polish: fix screen rotation, replace long-press with popup menu, remove Remote Mode toggle

- Remove forced M1_ORIENT_REMOTE rotation from ir_quick_remote() — grid
  stays in caller's landscape orientation, fixing the broken UX that
  rotated the screen unexpectedly.

- Replace long-press LEFT (brute-force scan) and RIGHT (browse device)
  with a single long-press OK popup menu ("Remote Options") offering
  "Power Scan" and "Change Device" actions. This is more discoverable
  and doesn't require orientation juggling.

- Remove "Toggle Remote Mode" (item 12) from the Universal Remote
  dashboard. The portrait/landscape toggle was a workaround that is
  no longer needed since the quick-remote grid now works in landscape.
  DASHBOARD_ITEM_COUNT reduced from 13 to 12.

- Remove all orientation save/restore boilerplate from dashboard_screen()
  (saved_orient, browse_saved_orient, build_saved_orient).

- Replace vTaskDelay(1500) blocking error screen in brute-force scan
  with async key-press dismiss for consistent non-blocking UX.

- Simplify brute-force progress display to landscape-only (no portrait
  branch needed since we no longer force portrait orientation).

- Update bottom bar hints from "H<:Scan / H>:File" to "OK:Send /
  Hold:Menu" reflecting the new interaction model.

- Add test_ir_ux_polish.c with 6 source-level regression tests
  verifying all structural changes. 103/103 tests pass.

- Add changelog fragment.

* IR grid: replace truncated title bar with Hapax-style category sidebar

The device filename at the top of the quick-remote grid was truncating
(showing e.g. "Same" for "Samsung TV") and the user had no clear context
about which category they were in.

Replace the 13px top title bar with a 14px left sidebar column that
stacks the 2–3 char category abbreviation vertically (TV, AC, AUD, PRJ,
FAN, LED), matching the Hapax remote style.  This gives three benefits:

  1. The category label is always fully visible and unambiguous.
  2. Removing the title bar increases each button cell's height by ~38%
     (13px → 18px at 3×3) with only a small width reduction (42px → 38px).
  3. The device name, which was confusing when truncated, is now accessed
     through Hold:Menu → "Change Device" where it has full context.

Add `short_label` field to `ir_category_layout_t` and populate it for
all six categories.  Add `test_quick_remote_sidebar_layout` regression
test.  103/103 tests pass.

* Fix IR orientation issues and remove unused category parameter

- Use u8g2_GetDisplayWidth() instead of M1_LCD_DISPLAY_WIDTH in
  draw_grid_action_menu() for separator line and selection highlight,
  so the action menu renders correctly in any active orientation.
- Remove unused `category` parameter from ir_grid_action_menu() and
  update the single call site to avoid -Wunused-parameter warnings.
- Add save/force-NORMAL/restore orientation wrapper around
  ir_browse_with_fb() calls in dashboard_screen(), matching the
  pattern already used in ir_universal_run_learned().
- Add save/force-NORMAL/restore orientation wrapper around
  ir_custom_builder_run() call, since the builder UI relies on
  fixed normal-landscape layout constants.

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Subghz: additional cipher support (#574)

* Initial plan

* docs(subghz): record issue #551 attachment investigation and MC plan

* subghz: implement KeeLoq learning types 4 (Magic XOR) and 5 (FAAC SLH)

Add KEELOQ_LEARN_MAGIC_XOR_TYPE1 (4) and KEELOQ_LEARN_FAAC_SLH (5) to
the KeeLoq cipher engine:

- New derivation functions: keeloq_learn_magic_xor_type1() and
  keeloq_learn_faac_slh() in subghz_keeloq.c/h
- Parser validation widened from types 1-3 to 1-5 in
  subghz_keeloq_mfkeys.c (compact, RocketGod, and rg_try_emit paths)
- Encoder/create/signal-settings switch cases added for type 4 (full
  replay support) and type 5 (deferred — seed dependency)
- 10 new host tests covering learning functions and parser acceptance
- 2 existing tests updated for expanded type range
- Documentation and changelog updated

Type 4 (Beninca) is fully replay-capable; type 5 (FAAC SLH) is parsed
and stored but encoder refuses because the seed needed for device-key
derivation is not available from the .sub file.

All 99 host tests pass.

Resolves P2 from issue #551.

* subghz: port Nice FloR-S cipher and promote to SUPPORTED counter-edit (P3)

* subghz: add Nice FloR-S rainbow table build-time injection via NICE_FLOR_S_RAINBOW_TABLE secret

* P4: port CAME Atomo LFSR cipher and Alutech AT-4N TEA cipher; promote both from DEFERRED to SUPPORTED

* test: add Nice FloR-S production table known-answer test from rtl_433 PR #2238

Validate the 32-byte rainbow table derived from the rtl_433
precomputed decode/ki lookup tables against the rtl_433 PR #2238
example vector: OTA {52} 0xd6f703d160ad9 → button=2, serial=0x3AAB665,
counter=2813, repeat=4.

* fix: guard apply_button/apply_counter against non-KeeLoq protocols, remove redundant decode call, fix header comment

* docs: note Alutech AT-4N rainbow table not yet sourced from public sources

* tools: add rainbow_table_solver.c for extracting/validating Sub-GHz cipher tables

* Fix review comments: parse_hex_table newlines, alutech cipher guards, rainbow_table_solver, protocol-specific button/counter save

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

STM32 updater: draw final 100% progress state (#571)

* Initial plan

* Fix STM32 update progress final 100% draw

* Fix fw progress bar: init with full write_size, update only after successful flash

* Add changelog fragment for STM32 firmware update progress bar fix

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Hapax <hapaxx11@gmail.com>

ESP32-style dedicated progress screen for STM32 self-update (#566)

The Hapax STM32 self firmware-update still drew its progress over the menu
via fw_gui_progress_update() (an 'Update progress: NN %' text line + bitmap
slider strip), unlike the ESP32 update which got a clean dedicated screen.

bl_flash_app() now renders a full-screen view that mirrors the ESP32 one:
a cleared screen with a 'Firmware Update' title, a 'Do not power off'
warning, a centered 'Erasing flash...' status during the erase phase, and a
framed percentage bar that redraws only when the integer %% changes.

Progress math is extracted to fw_update_progress_percent() in the new pure
header m1_fw_progress.h (guards total==0, clamps remainder>total) with
regression tests in tests/test_fw_progress.c. fw_gui_progress_update() is
left intact — it is still used by the ESP32 backup-flash path.

Co-authored-by: smgtoxa <anton.polevyk@hakkousa.com>
Co-authored-by: Hapax <hapaxx11@gmail.com>

Fix brace-depth parsing in wifi_draw_message nonblocking test (#568)

* Initial plan

* test: guard nonblocking wifi statuses

* Use brace-depth parsing in wifi nonblocking source test

* Add changelog fragment for wifi nonblocking test fix

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Hapax <hapaxx11@gmail.com>