[eirabie]

Summary

Controlled Quran failures need repeatable fixtures before attended hardware qualification. Add a private HTTPS fixture server and an isolated Waveshare maintainer profile that routes validated provider URLs through those fixtures while preserving the redirect policy and hostname verification.

Normal recordings now use 4 KiB writes with a five-second timeout per write, allowing a progressing slow reader to finish recordings that take longer than five seconds. Handshake/request limits, the eight-worker bound and intentional truncation/stall behavior remain intact. The fixtures also cover HTTP 503, malformed/oversized metadata, MIME/decode failures, forbidden redirects, redirect loops and untrusted/wrong-host certificates.

Qualification snapshots expose metadata stack and heap/PSRAM observations. Build/profile checks require isolated storage and disabled updates; release packaging rejects the qualification marker. The runbook describes device preflight, explicit recovery and application-only restoration.

Hardware impact

• No new required hardware
• Adds optional hardware
• Changes the required reference BOM

Uses the existing Waveshare Box V2 for later attended qualification.

Standalone impact

Production Quran, scheduling and offline controls retain their behavior. The transport/observation hooks compile only into the maintainer profile; normal builds retain the public certificate bundle and provider paths. The rebase preserves main's audio health and volume-transition handling.

Testing

Automated/local: all 135 pinned Python tests without skips, 20 UBSan CTests and 14 ESPHome configuration schemas passed after rebasing onto main at f12c15ecaa546edaae7267a74051e4b06598827f. The production Quran worker, Atom volume/Quran integration and qualification-routing UBSan executables also passed. The final diff was re-reviewed and whitespace checks passed.

Real loopback TLS regressions use a generated, valid 4,802,394-byte host-only MP3 outside Git, normal FFmpeg validation and requested 16 KiB socket buffers. Eight seconds of slow reading followed by draining returns the declared length, identical payload and matching hash. The original whole-body writer fails under the same conditions. A stopped reader releases its worker within seven seconds; disconnect cleanup and concurrent/subsequent metadata requests pass. Existing TLS rejection, redirect, media-immutability, truncation and stall cases remain covered.

The host fixture correction adds no firmware code or dependency changes. Seven earlier matched pinned builds remain documented against their original 2cea368 baseline; main's subsequently merged audio changes have separate measurements. Those results are historical comparisons, not new measurements of the rebased firmware. See the dated validation report.

All 13 checks passed for the updated head 2607fe3ad1c3e298d514191eb8a08ee41294ad4e in the Linux CI workflow, including all 135 Python tests, browser tests and every firmware/capacity variant. The rebuilt qualification OTA image is 1,377,472 bytes, leaving 195,392 bytes of the 1.5 MiB application budget and 719,680 bytes in its 2 MiB slot; static RAM is 116,847 bytes. These are current CI measurements, separate from the earlier matched comparisons.

Hardware: none accessed during this correction. The new profile, device TLS/decoder acceptance, fault recovery, runtime headroom and continuous real-provider soak remain physically unqualified. Generated host MP3s and compile-only CI images must never be installed or played on a device.

Licensing/media

• No new third-party media or dependency licensing concerns
• Licensing/attribution details are documented in this PR

No recording is bundled or downloaded. Actual device fixtures require an approved real MP3 outside Git and complete FFmpeg validation; fixture keys, logs and recovery evidence remain outside the repository.