M5SHARK R150 CHAMELEON ULTRA APP - FLASH KIT
=============================================

The firmware is built; the flash needs the physical connect step
(the auto-reset is being flaky):

  1. Hold BOOT, tap RESET, release BOOT after 2 seconds.
  2. Run:

     cd <this folder>
     powershell -ExecutionPolicy Bypass -File ".\flash-full-fast.ps1" -Port COM6

  3. Wait for "WRITE COMPLETED" in green, press RESET once.
     Boot screen should read R150.

WHAT R150 ADDS - CHAMELEON ULTRA REMOTE (Device > Chameleon Ultra)
  A full remote control app for the Chameleon Ultra over Bluetooth:

  - AUTO-CONNECT: opens a BLE central link automatically - it scans
    for the Chameleon's advertisement, connects, subscribes and
    reads device info the moment you open the app. If the link
    drops it auto-reconnects the same way.
  - SPEAKS THE OFFICIAL PROTOCOL: SOF 0x11 frames with LRC checks
    over service 0xC760 (write 0xC762 / notify 0xC761).
  - DASHBOARD:
      VERSION   - Chameleon app version
      MODE      - EMULATOR / READER, tap MODE to toggle
      BATTERY   - percent + millivolts
      SLOT      - active slot 1..8, SLOT- / SLOT+ to switch
  - READ HF: scans ISO14443-A (hold the card on the Chameleon's
    antenna) - shows the UID, ATQA and SAK. Switches the Chameleon
    to reader mode automatically if it was emulating.
  - READ LF: scans EM4100 tags - shows the 5-byte tag ID.
  - Reads that find nothing say NO HF TAG / NO LF TAG with the
    Chameleon's status code.
  - BACK drops the BLE link cleanly; the BT crash guard covers the
    whole app like every other Bluetooth tool.

  NOTE: BLE on the Chameleon Ultra must be enabled (it is off by
  default on some units - enable it once from the Chameleon desktop
  app). Keep the two devices within a few meters.

  Everything earlier is included (R119-R143: splash boot-loop fix,
  BLE crash guard + deinit-free BT tools, BadUSB suite, wardrive
  no-GPS + crash fixes, MAC Monitor dashboard, SSID Generator,
  Scan AP survey, Flock dashboard, GPS themed UI + SIGNALS/BEST dB
  meter, Matrix default theme, 40 MHz display).

AUTHORIZED TESTING ONLY, on equipment you own or are permitted to
test. M5SHARK is a full modification of ESP32Marauder v1.15.0 by
justcallmekoko.

R150 UPDATES
  - NO MORE BLINKING: the screen now paints its layout once and
    updates only the zone that changed (status pill, info values,
    result panel) - no full-screen redraws while scanning or
    connecting.
  - CONNECT DIAGNOSTICS: while scanning, the result panel lists
    nearby BLE device names it can see, so you can tell whether the
    Chameleon is advertising at all. Distinct failure reasons:
      NOT FOUND      - no chameleon advertisement (BLE off on CU?)
      CONNECT FAILED - link refused (pairing enabled in CU app?)
      NO CU SERVICE  - connected but no Chameleon service (old CU
                       firmware - update it from the desktop app)

R150 UPDATES - FOUND IN MOBILE APP BUT NOT THE DEVICE
  The mobile app pairs on the Chameleon SERVICE UUID, and many CU
  firmware builds do not put their name in the Bluetooth
  advertisement - so name-only matching never saw it. The scanner
  now matches EITHER the name OR the advertised service UUID
  0xC760, shows unnamed devices by their address in the nearby
  list, widens the scan window (15 s, duplicate filter off, denser
  duty cycle) and retries continuously.

R150 UPDATES - THE REAL NEVER-CONNECT BUG
  The R145 rewrite accidentally guarded the actual connection
  attempt behind a timer that had just been reset - it could never
  fire, so the app animated SCANNING forever and NEVER tried to
  connect (the Chameleon was never the problem). The attempt now
  runs every cycle: scan -> match (name or service UUID) ->
  connect -> subscribe. USB serial also prints live scan
  diagnostics ([CU] scan: N devices..., [CU] match: ...).

R150 UPDATES - NO CU SERVICE FIXED
  Verified against the ChameleonUltra firmware source: CURRENT CU
  firmware carries the command channel on the Nordic UART Service
  (6E400001/0002-write/0003-notify), not the old 0xC760 UUIDs.
  The app now tries NUS first and falls back to 0xC760 for legacy
  units, and the scanner matches both generations in
  advertisements. This is the fix for NO CU SERVICE after updating
  the Chameleon.

R150 UPDATES - BATTERY/MODE FIXED + EMULATION TOOLS
  1. BATTERY / MODE / VERSION now display. Verified against the CU
     firmware source: STATUS_SUCCESS is 0x68 (not 0x00) - every
     valid reply was being rejected, which is why those fields
     stayed blank. All responses now accept the real status codes.
  2. NEW TOOLS - EMULATION:
       EMU HF - configures the active slot as a MIFARE Classic 1K,
                enables it and switches the Chameleon to emulator
                mode (screen shows EMULATING).
       EMU LF - same for an EM4100 tag on the active slot.
     Pick the slot first with SLOT- / SLOT+ , then tap EMU HF or
     EMU LF. MODE toggles back to reader when you want to read.
  More tools (write block, detection reader, field on/off) can be
  added on request - the command set is now proven end to end.

R150 UPDATE - BACK BUTTON ALWAYS VISIBLE
  The result panel had grown to overlap and paint over the BACK
  key, so after any action the BACK button disappeared. Fixed:
  the result strip is now a single 22px line that can never reach
  the BACK key, and BACK is a full-width 20px strip with a
  generous touch zone at the bottom of the screen.
