One firmware: the Debug Console in every build, off until switched on, with the device's own token

There is no Debug Build any more (ADR 0010, issue #68, Q188 to Q195). The
console and the test commands are compiled into every firmware. It listens
only while Settings > Debug Console is on, which isn't the default; off,
neither its task nor its 4 KB ring exists. The token is made by the device
and shown on that page; a client proves it knows it by answering a challenge
with an HMAC, so it never crosses the network, and five wrong answers close
the console for a minute. DBG in the Status Bar while it listens.

Over USB serial only: debug on, debug token <value>, debug token new.
scripts/flash.sh --debug uses them to set a device up with the developer's
token. scripts/rdbg.py takes the token from -t, $RORO_DEBUG_TOKEN or the
file, answers the challenge, and fetches a release's ELF to decode a crash.

Gone: the cardputer-adv-debug environment, RORO_DEBUG, the +debug version,
scripts/debug_flags.py, update install ... force, and the rule that a Debug
Build doesn't install releases. Old clients and old firmwares don't talk to
each other.

Against the builds it replaces: 30 KB more flash and 88 bytes more static
RAM than the release, 4 KB less RAM than the Debug Build. 468 host tests.
Checked on the device: off by default, login, the pause after wrong tokens,
Safe Mode with the console, the setting surviving an update, debug off.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT

site/content/dev/build/how-an-update-works/index.md

@@ -24,7 +24,7 @@ scripts/ota_keygen.sh                                  # once: creates the key p
 scripts/make_ota.py firmware.bin v0.12.0 out.ota       # wraps and signs an image (the key: $RORO_OTA_KEY or the default path)
 scripts/ota_verify.py out.ota                          # checks a file the way a device does, on the PC
 scripts/ota_push.py out.ota 10.39.39.12                # pushes it to the Update Service, TCP 3232
-scripts/flash.sh --ota 10.39.39.12                     # builds, signs and pushes in one go (add --debug for a Debug Build)
+scripts/flash.sh --ota 10.39.39.12                     # builds, signs and pushes in one go
 ```
 
 `ota_push.py` prints the device's answer (`OK …`), or says the device **refused the update and hung up**, with the reason on the device's screen: the header is checked first, so a refused file stops mid-transfer.

site/content/dev/build/how-an-update-works/ways-in.svg

@@ -10,7 +10,7 @@
     <text x="30" y="75" font-size="11" class="wi-dim">builds, signs, pushes</text>
     <rect class="wi-box" x="16" y="112" width="220" height="56" rx="6"/>
     <text x="30" y="135" font-size="12" font-weight="600">rdbg.py put</text>
-    <text x="30" y="155" font-size="11" class="wi-dim">Debug Build, Wi-Fi 2323</text>
+    <text x="30" y="155" font-size="11" class="wi-dim">Debug Console, Wi-Fi 2323</text>
     <rect class="wi-box" x="16" y="192" width="220" height="56" rx="6"/>
     <text x="30" y="215" font-size="12" font-weight="600">sd_put.sh</text>
     <text x="30" y="235" font-size="11" class="wi-dim">USB serial, card stays in</text>