★ Priority 1 · C5 WEB FLASHER (just deployed)
End-to-end browser flash of a TRIDENT satellite
The flasher at /flash/ is the first time we've had a one-click install path for the ESP32-C5 satellite. esp-web-tools 10.2.1 on jsdelivr (the unpkg edge cache was serving an old bundle with no C5 support — that's now fixed). We need real-board confirmation.
- Open generaldussduss.github.io/poseidon/flash/ in Chrome / Edge / Opera
- Plug the C5 module directly via USB-C (not through the Cardputer)
- Click Install TRIDENT · pick the C5's COM port (NOT the Cardputer-Adv's)
- Confirm the flow: erase → bootloader (0x2000) → partition-table (0x8000) → app (0x10000) all green
- Boot it · pair it to a POSEIDON Cardputer ·
Radio → C5 → Status should show C5 x1 within a few seconds
Known gotcha: If "Failed to initialize" appears, hold the C5's BOOT (GPIO 9), tap RESET, release BOOT — then click Install. Some C5 dev boards lack auto-reset wiring.
★ Priority 2 · LoRa + Meshtastic full sweep
SX1262 stack on the CAP-LoRa1262 hat
LoRa is the band with the most surface area and the most regression risk — nine features touching the SX1262 driver, antenna-switch GPIO sequencing, HSPI-shared-with-SD, GNSS UART, and Meshtastic protobuf encoding. Hit each leaf and confirm none reboot the device.
- Attach the CAP-LoRa1262 hat with sky view (GPS needs it). Verify
System → About reports "Adv" board.
- LoRa → Scan · switch bands with TAB (433 / 868 / 915 / US LongFast) · each retune should be instant, no crash
- LoRa → Beacon · press TX · nearby SDR / Meshtastic device should see the packet
- LoRa → Analyzer · cycle Bar / Waterfall / Oscilloscope renders · "RX N" overlay should tick when real traffic is in range
- LoRa → Mesh Nodes · leave running ~2 min near Meshtastic activity (check meshmap.net) · roster should populate with real names, not garbage
- LoRa → Mesh Chat · press T, type, ENTER · message should appear on a phone Meshtastic app from POSEIDON's
!xxxxxxxx ID
- LoRa → Mesh Page · pick a node, send a DM · destination should receive direct, not broadcast
- LoRa → Mesh Pos · press T to toggle reporting · wait for GPS fix · you should appear as a pin on other apps
- LoRa → GPS Fix · live NMEA, baud auto-detect, sat count + HDOP
- Range test: from your house outward in increments, note last RX confirmed (RSSI/SNR in Analyzer) by band. Report in feet or meters.
Report: any feature that reboots, any band that doesn't retune, RX-works-TX-doesn't-or-vice-versa (encryption / header bug signal), nodes with garbage names (protobuf decode), position at wrong lat/lon (sfixed32 sign bug).
Known caveats: Leaf-only Meshtastic (we don't forward other nodes' packets). No CAD before TX (collides slightly more in dense mesh). NodeInfo broadcasts every 30 min regardless of Mesh Pos toggle.
Priority 3 · IR Samsung Smart Remote rebuild
Active-LOW LED + bit-bang carrier + full ~40-button layout
Every IR feature was silently no-op'ing. Two stacked bugs: GPIO 44 is UART0 RX by default and pinMode(OUTPUT) doesn't fully detach the matrix in Arduino-ESP32 v3 (fix: gpio_reset_pin), AND the Cardputer-Adv's IR LED is active-LOW which LEDC's output_invert can't handle correctly at duty=0 (fix: bit-bang the carrier in CPU). Plus the Samsung protocol byte order was NEC, not Samsung32. Plus TV-B-Gone was stealing the display backlight's LEDC channel.
- IR → LED Test · point a phone camera at the LED · step 2 (GPIO 44 inverted) should light it purple/white. Useful for verifying any board variant.
- IR → Remote against a Samsung TV · press
p for power, then u/d volume, m mute, c/v channels · no modifier keys should be required for any binding
- D-pad: press
; (up), . (down), , (left), / (right) · ENTER for OK · should navigate Samsung menus
- If power toggle (
p) doesn't respond, try o (discrete on) or q (discrete off). Modern Smart TVs sometimes ignore IR power.
- IR → TV-B-Gone at a busy TV wall · should cycle Sony / Samsung / LG / Panasonic / Philips / Vizio · display backlight should stay on (was blanking before the channel-3/timer-3 fix)
- IR → Clone · Samsung / LG / Sony preset profiles · basic vol+mute should work for each
Report: any button that doesn't fire IR (use the LED Test diag to confirm hardware first), any TV that responds to volume but not power (might be a model-specific Power code), and any other-brand TVs that the Samsung sender unexpectedly controls.
Priority 4 · WiFi Beacon Spam new path
Raw-IDF recipe replaces the Arduino path that crashed
The Arduino WiFi.softAP() crashed in ieee80211_hostap_attach (LoadProhibited, +0x2c null deref) on Bruce's pinned esp32-arduino-libs. New path: esp_bt_controller_mem_release → manual esp_netif + esp_wifi_init with shrunk dynamic bufs (16/16) → STA mode + promiscuous + raw esp_wifi_80211_tx on WIFI_IF_STA. Sustained ~1200 frames/sec.
- WiFi → Beacon spam → Meme · open WiFi scan on a phone · meme SSIDs (FREE WIFI - CLICK HERE, NSA Surveillance Van, etc.) should appear within a few seconds
- The scanner UI should show a KITT-style sweep header, live big SSID, fading 5-line recent feed, fps counter, and a hex stream · channel should rotate 1→11 once per full list pass
- Leave running 30+ seconds · uptime should keep ticking, no reboot
- Press ESC · should exit cleanly back to the menu with heap recovering to >50 KB
- Side effect to verify: after exiting Beacon Spam, BLE features won't work until reboot (BT memory was released to make room for WiFi). Confirm a fresh boot brings BLE back.
Report: phones that see < 5 SSIDs (range / RF environment issue), any feature that's opened AFTER Beacon Spam and fails (state leak), and whether Rickroll + Custom lists also work.
Priority 5 · TRIDENT 5 GHz operations
Once a C5 is flashed (P1), exercise the actual attacks
TRIDENT's job is the RF territory the S3 physically can't touch — 5 GHz WiFi, 802.15.4 Zigbee. The whole point of the C5 satellite. Each command rides ESP-NOW back to the Cardputer over channel 1.
- C5 → Scan · full dual-band scan · APs from both 2.4 + 5 GHz with auth column (WPA3 rows red)
- C5 → Deauth → broadcast on a 5 GHz channel you own · frames counter ticks · target reconnects
- C5 → PMKID · M1 capture against a 5 GHz AP · .22000 hashcat-format file on SD
- C5 → Zigbee sniff · channels 11-26 · pcap dump compatible with Wireshark
- After every C5 attack:
C5 → Status should still show the satellite present and pinned to channel 1 (so POSEIDON keeps hearing HELLOs)
Priority 6 · Regression sweep (broad surface)
Every menu leaf still enters without crashing
150+ features. Hit each one once, even if just to enter and back out. Anything that crashes or reboots since v0.6.0 is a regression we want to know about now. Sub-GHz path verified once the Hydra hat lands tomorrow.
- WiFi (17): Scan / Clients / Deauth / Deauth All / Detector / AP Clone / Evil Portal / Karma / Beacon Spam / Probe Sniff / PMKID / Spectrum / Wardrive / CIW / Connect
- BLE (16): Scan / Spam / Bad-KB / Tracker Detect / Tracker Finder / Sniffer / iBeacon / Clone / GATT / Flood / Karma / Sour Apple / Find My / Toys / Drone RID / WhisperPair
- Defensive (3): Surveillance Hunter, Defensive Monitor, SATCOM Tracker
- Sub-GHz (9): Scan / Spectrum / Brute / Jammer / Broadcast Library / Record / Replay / Finder / Jam Detect
- nRF24 (6): Sniffer / MouseJack / BLE spam / Spectrum / Jammer / Finder
- Network Attacks (18): Port Scan / Ping / DNS / Connect / Responder / SSDP / LAN Recon / UART Shell / Reverse TCP / Telnet HP / Dead Drop / Printer / SSDP Poison / DHCP Starve / Rogue DHCP / Hijack / WPAD / Autodiscover
- IR (4): TV-B-Gone / Remote / Clone / LED Test — covered separately in Priority 3
- Tools + System: Flashlight / Stopwatch / Dice / Morse / MAC Random / Calc / Screen Test / SD Format / Theme Picker / Ambient Preview / Carousel toggle / Screensaver settings