R12 runtime paths
The real A104 producer, the stock memory bridge, and the five-digit display encoder. What changed after rechecking the binary.
Read the R12 findings →The research notebook
Evidence before folklore.
A successful transfer is not proof that firmware booted. A call count is not a BLE capture. These pages follow the actual code and keep the remaining questions visible.
Current topics
Ring families
Why “R02” or “R10” is not enough to choose an image. Compare exact identities, hardware canaries and review-only work.
Compare the families →Firmware containers
Standard and nested image layouts, activation metadata, and the difference between a correct checksum and a working device.
Inside the images →Read the evidence level.
Hardware result
Observed on a physical ring. A short canary is evidence for that device and setup—not a universal compatibility or long-duration stability claim.
Offline finding
Derived from firmware bytes or execution in a bounded emulator. Hardware, radio behaviour and loader acceptance can still differ.
Open question
A proposed test or unresolved explanation. We keep it separate from results, even when the hypothesis is compelling.
Historical record
Useful context that may contain superseded conclusions. Follow the current audit before using an old notebook or candidate.
Reproduce, without a ring.
The R12 page’s packet and timer tables come from a captured run of the strict harness. Image-header checks are recomputed from the checked-in binaries whenever the site is built. No site build contacts hardware.
# From the repository root
python3 fw/sim/test_r12_runtime.py -v
python3 scripts/site/capture.py --check
python3 scripts/site/build.py --checkThe execution tests need Unicorn and Capstone; the repository supports a Nix fallback. The site itself needs only Python’s standard library and ships no emulator or executable firmware.
Source notebooks & history
Detailed notebooks remain in the repository. These links preserve the research trail without presenting every old conclusion as current advice.
- R12 runtime re-audit ↗Current exact-image evidence, addresses, reproducible tests and remaining acceptance checks.
- Realtek-family ports ↗Public RT02R/RT02CR work, R09 and R10 mappings, catalogue provenance.
- R06 hardware canary ↗The approximately 15 Hz accel-only result and exact stock baseline.
- R12 historical notebook ↗Archived hypotheses and observations. Its old de-load, ODR and SWD-only conclusions are superseded.
- R03 OTA investigation ↗Historical work. Read alongside the later nested-Realtek activation findings, not as a proof of impossibility.
- June 2026 whitepaper ↗Historical architecture and research snapshot. The source and PDF predate important corrections.
No page authorizes a flash. Exact identity, an appropriate stock recovery image, battery/readiness checks and an explicit device-specific decision remain necessary. Review-only candidates are not recommendations.