docs: the outside review plan, checked again against v2.11.0

[angeloINTJ]

docs/analysis/PLANO_REVISAO_EXTERNA.md is Living, and its state columns were last checked against v2.9.0. This PR checks every open item again on 2026-10-04 against main 8e48cd8 (v2.11.0), in the code and on the bench, and writes down what that found. Only that document changes.

What changed in the state

item	before	now
Finding 12: a PIN policy change from the web restarts the device	open	closed by #230 (2026-10-02), never marked: pinAuth lives in CFG_USERS, which left CFG_REBOOT_CLASSES
Findings remaining	57	56
Finding 33: stale previews on the Telemetry page	open	half closed by #239: the previews are right; the alarm line's token list still stops at v22
High findings that need code: 1, 8, 9, 20, 25, 65	open	still open, each checked in the code. Finding 25 is the access point opened by the boot gesture: that path never calls the network's begin( ), so the 15 min timeout, which needs a network name, never applies
Finding 20: no NET_READY without an NTP answer	open (v2.9.0)	still open in v2.11.0: telemetry and the alarm line gate on isNetworkHealthy( ); only the Air sends before NET_READY (F08)
S1, the bench board	no state	the 4 MB layout with its own staging is done (#245, #246); of the bench suites only the web one ran on the Pico 2 W (67 passed, 0 failed, on the v2.11.0 candidate)
S2, A/B with try-before-you-buy	no state	steps 1 to 7 shipped in v2.11.0, with three criteria to settle: the ~17 s were the ROM's watchdog, which setup( ) turns off, and the design put a healthy minute and a 300 s deadline in its place (every bad image of steps 5 and 6 came back by itself within six minutes of the apply); an interrupted write was measured with a RESET and a cut upload, not a power cut; the 20 cycles were not run
A-04	described	marked merged (#232, v2.10.0)
A-06 / #189	open	still open; 4 of the 720 reads of the v2.11.0 soak lost their framing
Sanitizers	eight suites	CI runs all nine under ASan and UBSan
GitHub description	"Professional-grade"	the same, and it names only the Pico W

How each item was checked

• Findings 1, 8, 9, 20, 25, 65: read in the code of 8e48cd8.
  • WebManager_Calib.cpp and SensorManager.cpp have not changed since the triage.
  • In AppManager_Panel.cpp, the panel's grant moves the three panel bits without comparing them to the caller's own.
  • In DisplayManager_Users.cpp, cancelling the forced PIN entry returns to the Settings menu.
  • In NetworkManager.cpp, the AP's timeout requires strlen(_ssid) > 0, and the boot's forced-AP branch skips begin( ).
• Finding 12: ConfigApply.h maps pinAuth to CFG_USERS, and CFG_REBOOT_CLASSES has not held CFG_USERS since 2026-10-02 (feat: accounts apply without a restart, and a session ends with its account (A-08) #230).
• S1, S2, /api/status: a chunked reply occasionally loses its framing (0.15–0.6 % of reads) #189: the v2.11.0 release gate of docs: the v2.11.0 release gate, on both boards #253 and the steps of OTA_AB_RP2350.md.

Gates run locally

check_angulo.py, check_readme_numbers.py, and scan_secrets.sh.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BniVDEDSHGQgcoqmCRn5um