feat(profiles): lever and power step primitives, with a capability refusal gate

[ChampionDesigns]

Summary

Adds three additive profile step primitives that the DE1's stock JSON format does not carry, plus a
capability gate so a machine that cannot run them refuses the upload cleanly instead of failing
opaquely.

Base: main. Independent of the other port PRs.

• ProfileStepPower (pump: "power") — constant hydraulic power in watts with a mandatory
  pressure limiter. fromJson throws FormatException (mapped to a REST 400) when the limiter is
  absent or zero, rather than silently running an unbounded power step.
• ProfileStepLever (pump: "lever") — a spring-lever step reusing pressure as the starting
  pressure P0, plus leverSpring (k_V) and leverGive (R_s), with an optional flow-cap limiter.
• TransitionType.hold — a HOLD step carries no authored target; the firmware latches the value
  achieved at the exit of the previous step and holds it.
• Power exit conditions — hydraulic power (W = 0.1 * pressure * flow) becomes a third
  cross-variable exit comparand alongside pressure and flow.

All three parse and round-trip on every machine, DE1 included, so stored profiles stay
machine-independent.

Design notes worth reviewing

The capability gate is fail-closed. onConnect reads the read-only ProfileModeCaps bitmask
(Bengle MMR reg 62: bit0 Power, bit1 Lever, bit2 HOLD) and surfaces it at /api/v1/machine/info as
extra.profileModeCaps. Any timeout, short buffer, or word with bits outside 0x7 yields 0, and a
bounded outer timeout keeps a machine without the register from stalling the connect flow. The 0x7
mask must track the highest capability bit — a 0x3 mask would zero a legitimate 0x7 and hide the
modes entirely.

_assertProfileModeSupported throws ProfileModeUnsupportedException before any BLE write, so an
unrunnable profile is a documented 400 rather than the opaque 500 the withDe1 catch-all would
otherwise produce.

Encoding keeps the base frame stock. Mode and shaper parameters live in the per-step extended
frame; CtrlF and interpolate are unchanged, so the mode is invisible to firmware that does not
implement it. Power/Lever always emit an ext frame (the limiter-null skip does not apply):
data[3] = mode, data[4] = ModeMaxP, data[5]/[6] = leverSpring/leverGive as U8D1. HOLD always
emits its own Mode byte (3 pressure, 4 flow, 5 power) with base SetVal pinned to 0 and interpolate
never set, so firmware without the feature holds a harmless zero target rather than misreading the
frame.

Power exit is an enum value, not an additive key. An old client's byName('power') therefore
throws and surfaces a visible REST 400, instead of silently degrading to a pressure or flow exit. The
encoder emits the independent FrameFlags bit comparePower (0x80) and deliberately does not set
doCompare (0x02) or dcCompF, so apps predating the feature skip the compare rather than
misinterpreting it.

Brought current with upstream, 5 Sep 2026

upstream/main was merged into this lane rather than rebased onto it, so the three-dot diff
GitHub shows is still exactly the lane's own work while the merge base moves forward. The merge
resolutions were checked individually — git rerere is enabled in the working repo and replayed
two of them wrongly elsewhere in this round, so none was taken on trust.

Linked Issue

N/A

Verification

Update, 6 Sep 2026 — CI's slow-suite gate. The first CI run failed on
Gate slow test suites, not on format, analyze or the tests. de1handler_profile_modes_test.dart
was taking 38.9 s of active time against a 20 s limit — the slowest file in the suite. The cause
was a missing queued response rather than slow work: 42 s of wall time against 4 s of CPU.
Bengle.onConnect hydrates the LED palette, FakeBleTransport had no answer queued, and each of
the three tests waited out the fail-closed read timeout. Adding
queuePaletteHydrationResponses() — which the existing Bengle tests already call for this reason —
takes connectedBengle from 12,646 ms to 36 ms. No assertion changed. Re-checked with CI's own
gate: --max-active-ms 20000 exits 0, and the full suite is 3978 passed / 1 skipped / 0 failed.

• flutter analyze — clean.
• flutter test — full suite 3978 passed / 1 skipped, run against current main on 5 Sep 2026.
• dart format — clean on every changed file.
• Host tests cover the encode path and the refusal path for every mode, including the lever-step
  power exit: profile_modes_test.dart, unified_de1_profile_modes_test.dart,
  unified_de1_hold_profile_test.dart, unified_de1_power_exit_test.dart,
  de1handler_profile_modes_test.dart, profile_handler_pump_modes_test.dart.
• No hardware run is required for the parse, encode and refusal paths.
• Verified against real firmware. The ProfileModeCaps read and the encode path run against
  the machine in the Decaid-Canary build, which is what Ben uses day to day.

Impact

• API: assets/api/rest_v1.yml gains the power and lever pump modes, the hold transition,
  the power exit comparand, and extra.profileModeCaps on /api/v1/machine/info. doc/Api.md
  documents all of them.
• Compatibility: additive. A stored profile using the new types round-trips on a plain DE1. Only
  arming one on a machine without the capability changes behaviour, and that is a new 400.
• User-visible: a profile that a machine cannot run is now refused with a clear error instead of
  being uploaded and behaving unpredictably.
• Security: none.

Update — rebased onto main 28 Aug 2026

The lane was rebased from 94873593 onto 82f941d7. Two files conflicted and both resolutions are
unions, not choices:

• unified_de1.dart — upstream renamed the field _refillKit to _refillKitDetected
  (4b6bc11c, "separate refill-kit detection from override"). This lane keeps upstream's name and
  adds its own _readProfileModeCaps() read and the profileModeCaps entry in extra.
• assets/api/rest_v1.yml — upstream replaced the free-text extra description with a
  structured schema carrying additionalProperties: true and typed refillKit and voltage
  properties. This lane no longer edits that description. It adds profileModeCaps as a third
  typed property instead, which documents the same bitmask in upstream's own shape.

dart format and flutter analyze are clean on the rebased lane.

Contributor Responsibility

AI-assisted development is allowed. The submitter remains responsible for the submitted work.

• I have reviewed and understand all changes in this PR and take responsibility for their correctness, security, behavior, licensing, and provenance, including any AI-assisted or AI-generated work.

[ChampionDesigns]

The Gate slow test suites failure is fixed. de1handler_profile_modes_test.dart was taking
38.9 s against the 20 s limit, but 42 s of wall time against 4 s of CPU — idle waiting, not work.
Bengle.onConnect hydrates the LED palette and FakeBleTransport had no answer queued, so each
of the three tests waited out the fail-closed read timeout: 12.6 s each.

queuePaletteHydrationResponses() — which the existing Bengle tests already call for this
reason — takes connectedBengle from 12,646 ms to 36 ms. No assertion changed. Verified with
CI's own gate: --max-active-ms 20000 exits 0, and the full suite is 3978 passed / 1 skipped.