docs: M3 demo README provenance (branch moved) + README #174 is fixed

README.md

@@ -450,10 +450,14 @@ object and the PRG before make builds its file database.
 
 Two things to know anyway:
 
-- The compare runs at parse time, so on master `make -n` (and `-q`, and `-t`)
-  with different flags is **not** side-effect-free — it deletes the objects
-  without rebuilding them. That is issue #174, and a fix is in flight; check
-  whether it has landed before relying on either behaviour.
+- The compare runs at parse time. `make -n`, `-q` and `-t` still run it and
+  `$(warning)` what a real build would delete; they are exempt only from
+  writing the stamp and deleting objects (issue #174, fixed). With changed
+  flags `make -n` lists only what timestamps make stale (on an otherwise
+  fresh tree, "Nothing to be done") and `make -q` answers as if the flags
+  had not changed: both describe the old tree, so that stderr warning is
+  the only signal.
+  A command-line `MAKEFLAGS=` or `MFLAGS=` is a parse-time error.
 - `make clean` is still the right move if you want to be certain of a tree
   for any other reason, and it costs about a second.
 

tools/package/build_m3_demo.sh

@@ -49,25 +49,32 @@ MAKE_ARGS=(BACKEND=uci-m3 "HTTPS_HOST=$DEMO_HOST" "HTTPS_PATH=$DEMO_PATH")
 
 # What the firmware side published; quoted in the README, checked nowhere
 # here (the device is not involved in a build).
-# FIRMWARE is the firmware side's own one-line description (agreed with
-# them); the source branch, the prebuilt image and its sha256 follow. The
+# FIRMWARE is the firmware side's one-line description, with the image
+# provenance phrased as they suggested on 2026-10-15 ("the
+# tls-preview-f3df8261 prerelease is built from f3df8261"); the image's
+# source, the prebuilt image and its sha256 follow. The
 # image line is printed only when FIRMWARE_IMAGE_SHA is set. These and
 # UPSTREAM_PRS are plain constants, not env knobs, so the README is a
 # function of the commit: a later commit swaps them.
 FIRMWARE="TLS client sockets for the Ultimate 64 / U64 Elite, from
-      JC-000/1541ultimate branch pr/3-tls-r1 (f3df8261), prebuilt image in
-      prerelease tls-preview-f3df8261. Not upstream; proposed on
-      GideonZ/1541ultimate#952."
-FIRMWARE_SOURCE="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/JC-000/1541ultimate/tree/pr/3-tls-r1"
+      JC-000/1541ultimate; the prebuilt image, in prerelease
+      tls-preview-f3df8261, is built from f3df8261. Development continues
+      on branch pr/3-tls-r1, the head of draft PR GideonZ/1541ultimate#997.
+      Not upstream; proposed on GideonZ/1541ultimate#952."
+# The image's own source. The branch pr/3-tls-r1 has moved on since.
+FIRMWARE_SOURCE="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/JC-000/1541ultimate/tree/f3df8261b59ea5883cc5b6d9bb1eb4c79f8f0fd4"
 FIRMWARE_PRERELEASE="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/JC-000/1541ultimate/releases/tag/tls-preview-f3df8261"
 FIRMWARE_IMAGE_SHA="15e9ff7cd8a11daf1f4698d574480381d475db7754e1d276d9aa95e8013ded3c"
 # The build the "Measured" figures were taken on (the image above).
 MEASURED_FW="firmware 3.15 git f3df8261 (the image above, ESP module 1.8)"
-# Change it once an upstream PR implements $21-$25.
+# Change it when any of GideonZ/1541ultimate #994-#997 changes state
+# (merged, out of draft, closed, replaced).
 UPSTREAM_PRS="not upstream yet. GideonZ/1541ultimate#952 is the proposal issue;
       this demo follows its proposed command numbering (\$21 OPEN_TLS,
-      \$23 TLS_INFO, \$25 TLS_RELEASE). No upstream PR implements these
-      commands yet (GideonZ/1541ultimate#953 adds GET_RANDOM only)."
+      \$23 TLS_INFO, \$25 TLS_RELEASE). The commands are open upstream as
+      GideonZ/1541ultimate issue #995 and draft PR #997, which builds on
+      draft PR #996 (ESP-IDF 6.0.3, issue #994); none is merged.
+      GideonZ/1541ultimate#953 adds GET_RANDOM only."
 # Earlier demo images (this script's history, JC-000/c64-https 82a549a to
 # 9eabd50) were validated on these builds; neither is public.
 EARLIER_RUNS="esp-tls/m3 f2e46946 and esp-tls/m3-master 3a1ff9ff"