Open questions¶
Every question this site leaves open, grouped by section, with what is already known, how it could be
settled and what that takes. The ids (OQ.H, OQ.C, OQ.P, OQ.F, OQ.S) are stable, so pages link
straight to a row; answered questions move to Closed questions with their answer.
The one thing to know first: several checks below write to a keyboard, and a few can wipe or wedge one,
so read the "Needs" column before you start.
Writes can brick or wedge a board
Items marked donor write to a keyboard or take it apart. Try them only on a board you can afford to lose, with a full snapshot taken first. Read Recovery and the never-send list before any write.
At a glance
- 123 open questions: product and hardware 46, connectivity 17, wire protocol 26, firmware and storage 20, host software 14.
- 26 closed questions, with their answers, at the end of the page.
- 30 of the open questions can be settled with read-only checks on a retail keyboard.
- Results are most useful with the firmware of both halves (
fe/1002), the host OS, the date and the raw bytes.
How to use this page¶
Each row gives the question and what is known (with its evidence tag), how it could be settled, what that needs, and the page the question belongs to. "Needs" uses four kinds:
| Needs | Meaning |
|---|---|
| keyboard (read-only) | a retail keyboard, modules or dongle, with reads, observation or normal use only; nothing stored changes |
| donor | a board that may be written to, wedged or opened: writes, risky probes, teardown or chip reads |
| running NayaFlow | the vendor app running (with or without a keyboard), to watch its interface, logs or USB traffic |
| documents | installers, registers, archives or other public records; no hardware |
A keyboard check that needs a second computer (a Linux machine, a Mac, a Bluetooth sniffer) says so.
Report a result with the firmware of both halves (fe/1002), the module firmware if it matters
(de/1008), the host OS, the date, and the raw bytes sent and received. Byte strings follow the
byte convention.
Product and hardware¶
| Id | Question and what is known | How to settle | Needs | Page |
|---|---|---|---|---|
| OQ.H01 | Do retail boards carry the revisions the FCC samples show (mainboard V13, wing V11, dock V09, pogo V10)? Batch 0 and 1 boards were built before the FCC samples and may be older DOC INFERRED | photograph the silkscreen of an opened retail half and module | donor | Board inventory |
| OQ.H02 | The QSPI flash chip's part number and capacity: only the Winbond wordmark is legible. Does flash generation B use another part? DOC | macro photo of the chip; a JEDEC id read with the nRF held in reset; a generation-B unit | donor | The keyboard half, Flash layout |
| OQ.H03 | The half's power tree (charger, DC-DC parts, load switches, a potted part) and its rail voltages DOC | low-angle photos; a multimeter on the named rails | donor | The keyboard half, Power |
| OQ.H04 | The half cell's connector pin count, and which wire is the thermistor DOC | photo and continuity test | donor | The keyboard half |
| OQ.H05 | The nRF52840 silicon revision behind build code D0 (Revision 2 by the pattern), and whether shipped halves lock the debug port DOC INFERRED |
Nordic's IC revision document; a read-only debug-lock status check with an SWD probe | documents; donor | The keyboard half, ZMK |
| OQ.H06 | Is a 32.768 kHz crystal fitted and used (Y2 on the half and on the dongle)? DOC |
the lid marking; an oscilloscope on its pins while running | donor | The keyboard half, Dongle |
| OQ.H07 | The key LEDs' part number and data protocol (WS2812 or SK6812 timing) DOC | macro photo; a logic analyzer on an LED data line | donor | The keyboard half |
| OQ.H08 | LED map geometry: which physical side bar is indices 74-80 (our note says right; NayaFlow draws it on the left outer edge); how many bay indices a Tune on module 2.3.3 follows (6 of 24 on 2.1.2, about 9 in a band test); whether a Track follows one index or a band; the physical LED chain order MEASURED (conflicting) | paint one LED index at a time with each module docked, then restore the saved map | donor (low risk, LED map writes) | Layout, LEDs |
| OQ.H09 | The dock's pin-to-signal map, voltages and UART settings, and how the half puts a module into its bootloader. Only net names are known: 8 contacts (UART, boot, battery, 5 V, enable, ground; no USB data) DOC | continuity from each spring pin; a logic analyzer on TX, RX and BOOT during docking and a module update | donor | Module dock |
| OQ.H10 | Does the Tune's internal J5 have 8 or 10 contacts (two pads are paler)? DOC |
angled photo; continuity to RX and TX | donor | Tune |
| OQ.H11 | Why a Touch base shows only 4 contacts when its pogo board has 8 DOC | look at a retail Touch's underside | keyboard (read-only) | Touch |
| OQ.H12 | The spring-pin block's maker, pitch and stroke DOC | caliper; catalog comparison | donor | Module dock |
| OQ.H13 | Are the 6 metal blocks in each module base magnets or steel? The half side is settled: 6 magnets per bay (closed) MEASURED | a paper-clip test on each module base | keyboard (read-only) | Module dock |
| OQ.H14 | The Tune dial's actuator, its driver U11, and the HAPTICAL I2C device (marketed as "Naya Pulse") DOC |
teardown photos; a logic analyzer for the I2C address | donor | Tune |
| OQ.H15 | The Tune's T-shaped sub-board, its housed round part, and U9 DOC |
teardown photos | donor | Tune |
| OQ.H16 | The Tune touch controller's exact part (CST3 plus a digit) DOC |
angled-light photo or an I2C chip-id read | donor | Tune |
| OQ.H17 | The Track's optical sensor part DOC | read the sensor's product-id register on an opened spare Track | donor | Track |
| OQ.H18 | The Track's motor (ERM or LRA) and several small unmarked parts DOC | macro photos; the drive waveform | donor | Track |
| OQ.H19 | The module part numbers on the base labels (Tune NAYA-700-3?, Track NAYA-?00-2) DOC |
read the labels on retail modules (keep serial numbers private) | keyboard (read-only) | Tune, Track, Regulatory |
| OQ.H20 | The Touch: one or two 700 mAh cells; the sensor board and cover size; the round black part beside its contact block DOC | caliper; teardown | donor | Touch |
| OQ.H21 | Retail module capacities: the website and 2023 campaign say 1500 / 800 / 800 mAh, the v1.1.0 manuals 1500 / 1500 / 700, the FCC photos 1000 / 700 / 600 (Tune / Touch / Track); the cell makers DOC | read the labels on retail packs | donor | Power |
| OQ.H22 | The wing slide switch's part number (the v1.1.0 manual draws slide up = ON; the v1.0.6 drawings disagree), and the hot-swap socket part DOC | caliper and photos; catalog comparison | donor | The keyboard half |
| OQ.H23 | The USB-C receptacle's pin class DOC | photo of the leg row | donor | The keyboard half |
| OQ.H24 | The dongle's ESD3 and CG4 parts DOC |
macro photo of an opened dongle | donor | Dongle |
| OQ.H26 | Who issues the N-in-ellipse energy mark on the labels (Nemko is a shape-only candidate), and which Japanese certification body 219 is DOC |
registry lists | documents | Regulatory |
| OQ.H27 | The Y-cable's AWM style number, and the retail 1 m versus the lab's 0.8 m cable DOC | read the jacket print; measure | keyboard (read-only) | Parts list |
| OQ.H28 | Are "212 x 118 x 18 mm" and "1.4 kg" per half or per pair? The size fits one half's label outline DOC INFERRED | weigh and measure a retail half | keyboard (read-only) | Overview |
| OQ.H29 | Do retail keycaps have shine-through legends? Do the printed legends of the corner keys (LA5, RA5, LH4, RH4) describe their stock layer holds? Which manual's default keymap matches boards shipped before manual v1.1.0? DOC |
look at retail units; read a factory-fresh board | keyboard (read-only) | Manuals, Layout |
| OQ.H30 | Did Float, Query, Type, Multipad or the standalone Dock ever ship, and what was Query? Both Float and Query ship as module firmware apps DOC STATIC | vendor material, if any surfaces | documents | Overview |
| OQ.H32 | What a module's red-red-red-green blink means (module 2.3.3 disabled the battery blink) MEASURED (seen) | check the module's battery when it blinks, and after charging | keyboard (read-only) | Power, LEDs |
| OQ.H33 | Do Track Left and Track Right differ physically? NayaFlow ships separate stock profiles for them STATIC INFERRED | inspect two Tracks side by side | keyboard (read-only) | Track |
| OQ.H34 | The key matrix's row and column for each position, and the physical key pitch and plate geometry MEASURED (keyscan events exist) | keyscan events per key (the keyscan mode is a runtime toggle); caliper | keyboard (read-only) for the geometry; donor for keyscan | Layout |
| OQ.H35 | The right pogo board's name (the left one is known) DOC | silkscreen photo | donor | Board inventory |
| OQ.H36 | Do Naya Connect's modules carry a radio? Press coverage mentions "the antenna"; Create modules have none, and Naya Connect has no FCC filing (closed) DOC | vendor material | documents | Overview |
| OQ.H37 | What the Bluetooth SIG listing's "2.4G" mode refers to (the "2.4G SRD" mode certified in the halves' and the dongle's FCC filings is one candidate), and why its core-spec field says 5.1 while the manual says 5.4 DOC INFERRED | the listing's details (a login is needed for its layers) | documents | Regulatory |
| OQ.H38 | How steady the half's own cell reading is on battery, and whether a docked module keeps that cell up overnight. The nayactl maintainer saw a full keyboard cell swing between about 90 and 100 % REPORTED; on USB, reads every 20 s for 30 minutes spread 8-15 mV per half, under 2 points at 9 mV per point MEASURED (owner's boards, 3.28.7 and 3.41.0, 2026-09-26); the manual says a docked module can power the keyboard DOC. The module percentage formula is settled (closed) | fe/1006 read 20 times at rest on battery on each half; the same read in the evening and the morning, with modules docked and then undocked |
keyboard (read-only) | Power |
| OQ.H39 | Does a Touch docked on the left present a mirror image of its right-side orientation? An owner's observation, not measured INFERRED | dock one Touch on each side and log the pointer deltas for the same finger motion | keyboard (read-only) | Touch |
| OQ.H40 | Marketing claimed Track "axis locking": does any configuration field map to it? DOC | compare NayaFlow's Track settings with the module fields | documents; keyboard (read-only) | Track, Module fields |
| OQ.H41 | At what charge does a flat module boot on a powered dock, and what does the dock report until then? The nayactl maintainer reports 0xF0 / 0xF1, firmware 0.0.0 and no battery reading until about 1 % REPORTED; 0xF0 is the no-answer value on our boards MEASURED |
dock a spare module drained to about 0 % and poll de/1001 and de/1008 every 10 s; read de/1009 when the address changes |
donor (draining can trip the pack's protection) | Power, Module dock |
| OQ.H42 | The half cell's real size and the space around it: thickness, width and length with and without the folded protection board; where the cell sits in the half, how it is held, and how much free length and depth the space has. By its code FH301217 is 3.0 x 12 x 17 mm; on the FCC millimeter rule it measures about 12.5 x 18.5 mm with the fold DOC INFERRED |
caliper the cell and the space it sits in; photograph it in place | donor | Battery replacement |
| OQ.H43 | The battery plugs' series and pitch. The half, Touch and Track plugs look like 3-way JST SH-class housings (1.0 mm) with side protrusions, and the Touch's board header J3 measures about 1.0 mm; the Tune's plug measures about 1.5 mm and 6 mm wide (JST ZH class). No housing or header carries a marking DOC INFERRED |
caliper across each housing and between contact centers; compare with JST's SH, GH and ZH drawings; test-fit a known housing | donor | Battery replacement |
| OQ.H44 | Each battery's wire order and thermistor: which plug pin is positive, negative and NTC on each of the four leads and board headers, and the resistance from the third wire to the negative wire at room temperature (about 10 kΩ at 25 °C for the 103AT type the modules' charger datasheet recommends); whether the half's third wire is a thermistor at all. The photos suggest the white (half) and yellow (Track) wires sit in the middle DOC INFERRED | multimeter on an unplugged battery: DC volts for polarity, resistance for the NTC, room temperature noted | donor | Battery replacement |
| OQ.H45 | Protection boards: does every pack carry one (seen folded under tape on the half and Touch cells; hidden inside the wrap on the Tune and Track packs), which protection IC and switch it uses, and its over-discharge cut-off, which bears on "Battery Zero" DOC INFERRED | lift the tape on a spare or dead pack and photograph the markings | donor | Battery replacement |
| OQ.H46 | The Tune pack's thickness and build. The label face measures about 34 x 20 mm; the code 202030 reads as 20 x 20 x 30 mm, which fits two 10 mm cells in parallel under one wrap, but one thick cell is possible; a retail pack may differ (1500 mAh was advertised) DOC INFERRED |
caliper a retail pack and read its label; note the free depth in the Tune | donor | Battery replacement |
| OQ.H47 | The Touch's battery recess and the Track's cell pockets: the largest cell each holds (length, width, depth), and the Track pack's bend angle and lead length. The Touch cell sits in a molded recess only slightly larger than itself; the Track's two cells lie along the ring, joined at a corner DOC INFERRED | caliper on opened modules | donor | Battery replacement |
| OQ.H48 | Charge settings, which decide whether a smaller replacement cell is charged beyond its rating: each module's SGM41523 charge voltage (4.2 V when its CV pin is grounded or open) and charge current (10 300 V divided by the resistor on its CC pin, per the datasheet, so 20 kΩ gives about 0.52 A); the half's charger part, voltage and current DOC INFERRED | with the battery unplugged and the module unpowered, measure the CC-pin and CV-pin resistors to ground; macro photo of the half's charger | donor | Battery replacement, Power |
Connectivity¶
| Id | Question and what is known | How to settle | Needs | Page |
|---|---|---|---|---|
| OQ.C01 | The third-mode PIDs (0x007A left, 0x00DE right) and every generation-B PID are in NayaCore's table but have never been seen; what puts a half into the third mode (ee/10be DFU_RESET?) STATIC |
observe on a donor board; a generation-B half | donor | USB, Bootloader |
| OQ.C02 | The USB interfaces of a right half alone on USB, and the interfaces per half on 3.35.4 (one or two CDC); measured on 3.41.0 and 3.28.7 only MEASURED | enumerate | keyboard (read-only) | USB |
| OQ.C03 | Which firmware first lacks a USB serial number (tools fall back to side and product id) STATIC | enumerate a half on 3.28.7 or older | keyboard (read-only) | USB, Differences by firmware |
| OQ.C04 | What the stock dongle speaks: it ignores the halves' opener at dst 0x50 and streams ASCII dots MEASURED; whether any address answers, whether it answers only while bridging a keyboard on battery, and whether the keyboard's stored dongle address is this dongle's |
fe/1002 (a read) to every dst from 00 to ff on the dongle's port, logging any byte that is not 2e; a battery-powered bridging test that avoids the wireless-output freeze |
keyboard (read-only) | Dongle, USB |
| OQ.C05 | Does the keyboard's USB HID interface offer the boot protocol? Over Bluetooth it is report protocol only REPORTED | read the USB descriptors | keyboard (read-only) | USB |
| OQ.C06 | What wire profile slot 0 is for, and how it relates to the vendor's "slot 5 reserved for the dongle"; only BT_SELECT_SL reaches slot 0 STATIC MEASURED | bond a host on slot 0 through a tool; read be/100c |
donor | Bluetooth |
| OQ.C07 | Does BT_CLEAR clear the selected slot's bond on press? Does the right half ever advertise to or bond with a host by itself? Hosts see one keyboard, the left half MEASURED STATIC | a passive Bluetooth scan with only the right half on; BT_CLEAR pressed with a bonded host on a free slot | keyboard (read-only) for the scan; donor for BT_CLEAR | Bluetooth, Overview |
| OQ.C08 | Over Bluetooth: the full GATT service list (reported: HID, one battery level, Device Information and the vendor 0x1234 service; no DFU, SMP or UART service), the Device Information strings, whether the keyboard uses the host's lock-key LED report, what notifies during use, and whether any characteristic accepts configuration REPORTED |
service discovery and reads from a host that is already bonded; writes to the vendor characteristic only on a donor | keyboard (read-only); donor for writes | Bluetooth |
| OQ.C09 | be/100c details: header bytes 7-8 (always 02 01), split-link block bytes 0-3 and 16-38, profile flag bits beyond connected and active, whether revision is a counter, and why the right half does not answer it MEASURED (partial) |
captures with a bonded but disconnected host; a read from the right half | keyboard (read-only) | Split link, Bluetooth |
| OQ.C10 | SELECT_BLE_PROFILE and CLEAR_BLE_PROFILE (be/1009, be/100a) on hardware; only their read side is verified STATIC |
use a slots interface on a donor board | donor | Bluetooth |
| OQ.C11 | What USB output does after a Bluetooth profile was selected with no host: it looked like a shut-off, and a power cycle cleared it MEASURED | a scripted re-test with every VID 37d1 interface monitored |
donor (low risk) | Bluetooth |
| OQ.C12 | Which sender byte a reply to dst 0x51 carries when it comes back through the left port. The route works for the version read (the left port read the right half's 3.35.4 on 2026-09-20) MEASURED, but the reply's sender byte was not recorded |
on the left port, aa 00 51 00 fe 03 10 02 00 12 04 once, raw reply logged |
keyboard (read-only) | Transport |
| OQ.C14 | Does any shipping firmware use the "2.4G SRD" radio mode, on the halves or the dongle, and is it BLE at 2 Mbps or a vendor link? Both halves' FCC filings carry a separate "2.4G SRD" 2 Mbps test report besides BLE, and the dongle's SAR report names only "2.4G SRD"; the manual says "Speedlink Connection: Using Bluetooth v5.4" DOC | a 2.4 GHz sniffer on the split link and on the dongle while it transmits; or a vendor source | keyboard (read-only) with a sniffer; documents | Regulatory, Dongle, Bluetooth |
| OQ.C15 | Does any shipped setup have a wired data path between the halves, and at what rate does the dock link run? Kickstarter update 10 (2024) described a 10 Mb/s wired chain; every measurement on shipped halves fits a radio link DOC INFERRED | a logic analyzer on the dock and USB lines during use | donor | Split link, Overview |
| OQ.C16 | Does a power-switch reset on USB (OFF, then ON) show the half's bootloader pass? The reset itself is measured MEASURED | watch the USB PIDs while switching one half off and on | keyboard (read-only) | USB |
| OQ.C17 | Does the reset command alone complete the pairing repair? The sequence ends with ee/10ce (sent to the left half on 2026-09-20), and a power cycle was also done that night MEASURED |
run the repair on a donor board and check the pair addresses and typing after ee/10ce alone, before any power cycle |
donor | Split link, Recovery |
| OQ.C18 | Can a mismatched peripheral be written, or read beyond its version, through the central at dst 0x51? Only the version read is recorded (closed) MEASURED |
reads and a harmless write during a planned firmware mismatch | donor | Split link, Transport |
Wire protocol¶
| Id | Question and what is known | How to settle | Needs | Page |
|---|---|---|---|---|
| OQ.P01 | Which status bytes carry NayaCore's names Busy, Memory Full, Invalid Format, Save Failed, Load Failed, NVS, No Data and Invalid ID (12-15 and 17 unassigned; 19 is measured for a missing index MEASURED), and what ea is: it answers a refused value, with nothing stored MEASURED, but matches none of those names |
provoke each error on a donor board | donor | Transport, Command map |
| OQ.P02 | Is one 30/1001 needed after power-up? Per connection it is not: fresh connections answered 30/1003, 30/1009, 30/100d and 30/1005 after the session opener alone MEASURED (closed). Our recipes skip it, while NayaCore reads 30/1001 before its other REMAP reads; right after power-up it is untested |
switch the left half off and on, open its port, send only fe/1001 and fe/1002, then aa 00 50 00 30 04 10 03 00 00 13 04 |
keyboard (read-only) | Transport, Python recipes |
| OQ.P03 | A request-shaped dst 0x51 frame seen in our right-half reply stream (2026-09-01): an unsolicited relay from the left, or a decoder artifact? The captures that held it are gone; a third-party instance is a log-interleaving artifact INFERRED |
re-capture a NayaFlow session with both pipes decoded | keyboard (read-only) | Transport |
| OQ.P04 | What NayaCore's "hard limit 257" applies to, given a one-byte length field STATIC | read the NayaCore code path | documents | Transport |
| OQ.P06 | Payloads never captured or never sent: de/1004; be/100b, be/100e; ed/1009-100c; what ed/10d1 and ed/10d2 (FORCE LEDs ON and OFF) do; the ed/1050 clear value; ff/1003; everything in categories ca and f1; fe/1003 (NayaCore's check accepts only 00 OFF and 01 ON), de/1006, be/1004, be/1010 and fa/1002 as NayaCore sends them STATIC. de/1005 is captured: one byte for the module type, acknowledged at once with an empty reply MEASURED (NayaFlow's module updates, 3.41.0, 2026-09-23) |
captures of NayaFlow's Danger Zone and Battery Recovery; careful probes on a donor board | donor; running NayaFlow | Command map |
| OQ.P07 | Keyscan: which two values fe/1008 accepts (nayactl assumes 1 and 0), and the meaning and polarity of the three fe/1009 bytes (00 = press is assumed, not measured) STATIC |
stream events and press known keys | donor (low risk, a runtime mode) | Command map |
| OQ.P08 | The de/1008 flag byte (the third reply byte; seen 00, and 01 with an all-zero version while a module had not reported); de/1009 byte b0; the transient invalid de/100b reading MEASURED |
more reads around docking and waking | keyboard (read-only) | Modules |
| OQ.P09 | What hold-tap flavor value 3 does, and which bytes NayaFlow's Hold-Preferred and Tap-Unless-Interrupted write (its Balanced writes 00, its Tap-Preferred 02). The other values are measured: in a home-row typing test 00 behaved as hold-preferred and 01 as balanced (ZMK's order), 02 is tap-preferred, and 4 stops every key until the board is unplugged MEASURED (3.41.0, 2026-09-01 to 2026-09-25). The 03 inside a type-10 record is the record type of the two-behavior 03 pair it wraps STATIC (NayaCore's key serializer) |
the same typing test at flavor 03; one captured NayaFlow flash per Interrupt Flavor setting |
donor; running NayaFlow | Keymap, Settings |
| OQ.P10 | Does a per-key or per-bank tapping term behave differently from the global one? It is stored per record MEASURED | set different terms and time the keys | donor | Keymap |
| OQ.P11 | On 3.41.0, why some layers read 82 records and others 156: our board returned 156 for layers with no second-bank record, a third-party capture 82 MEASURED REPORTED | one read of a layer written before and after a second bank existed | keyboard (read-only) | Keymap, Differences by firmware |
| OQ.P13 | What the empty key press 01 04 00000000 does on a key. On a Tune gesture it does nothing: NayaFlow flashes the Tune's single-gesture "LED Brightness" swipes as it (a letter-case slip in NayaCore turns the LED action into a key with no code) STATIC, and those swipes stay dead on the owner's Tune MEASURED (3.41.0, 2026-09-26) |
bind it on a key; watch HID and the LEDs | donor | Keymap, Module fields |
| OQ.P14 | Hold-tap slot kinds other than 01 (key press) and 05 (layer); a type-10 record with a layer hold; a fifth "double tap and hold" behavior MEASURED (census) |
capture more boards; probe on a donor | donor | Keymap |
| OQ.P15 | Size limits: MAX_LAYERS, MAX_CONFIGS and MAX_DATA_SIZE, and how many module config slots the firmware holds (all 80 probed indices answered empty). NayaCore's own module-config limits are read (closed) STATIC MEASURED |
read the constants in the binary; probe on a donor | documents; donor | Keymap, Layers, Modules |
| OQ.P16 | Is a single-entry layer delete fully equivalent to NayaCore's doubled form? MEASURED (once) | delete a layer both ways and compare | donor | Layers |
| OQ.P17 | Does rewriting the layer list disturb a toggled-on layer, and does it clear an ed/1050 color override? The rewrite does restore lighting MEASURED |
test both | donor | Layers, LEDs |
| OQ.P18 | Does writing the saved layer list back first restore hold-to-layer after 30/10ca? The list's write form is measured MEASURED; restoring after a map wipe has not been done |
format a donor board, write the list back, then the layers | donor | Layers, Factory reset |
| OQ.P19 | LEDs: what saturation 150 (no color set) looks like; which NayaFlow row (88 or 89) feeds each bay color; what changed in the LED data between the halves from 3.35.4 to 3.41.0; what ed/1014 value 2 does (0 and 1 are measured) MEASURED (partial) |
targeted writes and captures on a donor board | donor (low risk, LED writes) | LEDs, Differences by firmware |
| OQ.P20 | Settings: what the second and third fe/100a fields do on the device (the third is always 30 s; NayaCore calls it sleep_battery_time_ms); whether 0 is accepted for the third; whether USB power or the output mode gates the LED idle timer; how "Hold layer LED activation delay" reaches the keyboard; who wrote the 90 / 600 / 15 s state seen before NayaFlow's first flash MEASURED (partial) STATIC |
timed tests on battery and on USB; a capture of a settings change | donor; running NayaFlow | Settings, Power |
| OQ.P21 | When NayaCore sends ed/1012, ed/1013 and ed/1014 (never in a flash capture), and what a factory board holds in ed/1013 STATIC MEASURED |
a USB capture of a settings change without a flash | running NayaFlow | Settings |
| OQ.P22 | Module fields: field 04 on every module; Tune 06 and 07 and 1c-21; Touch 09 and 0a; the spare field after each tap; whether keys in the Touch's 05-08 act; whether momentary and sticky layer records work in a field; horizontal and pointer signs per host OS; whether the stock Track axes carry invert = 1; how NayaCore turns NayaFlow's pair strings into selectors MEASURED (partial) |
sparse single-field probes; one captured NayaFlow flash of a split scroll pair | donor; running NayaFlow | Module fields |
| OQ.P23 | Modules: the Float's address, list type and bay behavior (0x80 / 0x81 inferred; no hardware exists); the five bytes of the slot-0 list entry STATIC INFERRED. MODULE_FWUP's type byte is settled: 01 Touch, 02 Tune, 03 Track; 03 sent to a Tune programmed it with the Track's app and left it dark until a forced 02 MEASURED (3.41.0, 2026-09-23) |
a probe on a donor for the slot-0 entry | donor; documents | Modules |
| OQ.P24 | Wire behavior on the beta-only firmware 3.39.4 (its note says 3.39.3), 3.40.0 and 3.40.4 (images archived; no board read), every "not recorded" cell of the firmware table (most of 3.35.4), and which versions besides 3.28.7 fail on three-frame writes DOC STATIC | measure boards on those versions | donor | Differences by firmware |
| OQ.P25 | Do the module LEDs stay lit when the key array's ceiling (ed/1013) is 0? The nayactl PR #6 author reports lit modules beside dark keys as the tell of a zero ceiling REPORTED; we have never sent 0 |
set ed/1013 to 0 (params 00 00 00, never a short payload) with modules docked, watch the keys and the modules across a power cycle, then restore 00 00 64 |
donor (low risk, LED writes) | LEDs, Recovery |
| OQ.P26 | Does the right half answer REMAP reads on its own port? NayaCore never sends REMAP to 0x51 and marks it "Unsupported" there STATIC; nobody has sent it |
on the right half's port, aa 00 51 00 fe 03 10 02 00 12 04, then aa 00 51 00 30 04 10 01 00 00 11 04; expect no frame or an empty payload |
keyboard (read-only) | Overview, Command map |
| OQ.P27 | Does a sleeping half answer nothing until a key press, and is the first frame after waking lost? Our retries were needed on freshly opened ports with both halves awake (23 of 30 connections lost their first fe/1001) MEASURED; a sleeping half has not been captured |
set wireless output so the idle timers run, wait past the sleep timeout, then open the port and send the opener with retries; note whether a key press is needed | keyboard (read-only) | Transport, Overview |
| OQ.P28 | What a docked module does when the current layer's bay record disables it (reported: only its indicator LED lights), and whether NayaFlow shows a re-seated module as disabled until the next flash REPORTED | write the bay to disabled on a donor and restore it; re-seat a module with NayaFlow running, without flashing | donor; running NayaFlow | Module dock, Modules |
Firmware, storage and recovery¶
| Id | Question and what is known | How to settle | Needs | Page |
|---|---|---|---|---|
| OQ.F04 | Does the dongle's MCUboot have a serial-recovery window, and which key does it check? That it runs MCUboot is settled (closed); a third party reports a vendor key and no window REPORTED, while its application appears about 6 s after the boot identity MEASURED | poll the USB PIDs and open the brief 0x0137 ports passively; one SMP image state read during 0x0137 |
keyboard (read-only; the dongle may park until replugged) | Bootloader, Dongle |
| OQ.F05 | Why identifying the running image takes so long after entering the bootloader: 4 to 69 s when the port is reopened for each request (about 25 s right, 65 s left in our flash runs), and still about 20 to 26 s with both of the half's ports held open and the log port read, as NayaCore does (left half, 3.41.0, 2026-09-23); and NayaCore's own upload timing MEASURED | instrument the read loop; time a NayaFlow update | donor | Bootloader, Flashing |
| OQ.F06 | What physically distinguishes flash generation B, which units shipped as B, and how a B half behaves (slots, PIDs, hashes) STATIC | a generation-B half | donor | Images, Flashing |
| OQ.F07 | What a power loss does in each flashing window: during the chunked upload (expected harmless) and during the silent swap (the one unverified brick risk) INFERRED | deliberate tests | donor | Flashing |
| OQ.F08 | Is d_fw.bin (NayaFlow 0.1.0-1.6.10, MCUboot, the keyboard signing key) dial or dongle firmware? STATIC INFERRED |
compare with the dongle's boot behavior | documents; keyboard (read-only, the dongle) | Images, Versions |
| OQ.F09 | The module microcontroller's bootloader, and whether any key signs the .sfb apps (NayaCore names an M_MCUBOOT_RESTART module mode) STATIC |
module-side analysis, or a capture of a module update | donor | Module firmware |
| OQ.F10 | Would the bootloader accept a signed but unencrypted image? Untestable without Naya's key INFERRED | none without the key | documents | Images |
| OQ.F12 | The keyboard firmware versions in NayaFlow 0.0.1-1.11.11 (the headers carry the placeholder 1.2.3+4); the module version of the 1.11.x bundle; the NayaCore versions of 1.14.3, 1.15.1, 1.21.0 and 1.25.1; where 3.30.1 came from (a factory build?) STATIC DOC |
flash old images to a donor and read fe/1002; NayaCore strings |
donor; documents | Versions |
| OQ.F13 | What made one Track update hang the keyboard, and does every half need a cable replug to come back after a module update's restarts? The module-bundle flash (image: 4, then de/1005) has been run by us: NayaFlow updated a Touch from 2.1.2 to 2.3.3, captured end to end, and OpenFlow's own module update then flashed a Touch up and down and downgraded a Track, which read back as a correct Track. After both self-restarts of the captured update the half showed its bootloader for about 25 ms and did not come back on USB until replugged (2 of 2 runs). One later Track update never finished: the keyboard stopped answering until a power cycle, the Track has answered like an empty bay since, and every later update of it hung the keyboard the same way MEASURED (owner's board, left half, 3.41.0, 2026-09-23) |
module updates on other boards and computers, watching whether the half returns by itself; read the silent Track through its SWD pads or its dock UART | donor | Module firmware, Flashing |
| OQ.F14 | Does MCUboot swap onto an already-invalid primary slot, as a half stuck in its bootloader would need? INFERRED | a controlled test on a donor half | donor (high risk) | Recovery |
| OQ.F15 | Which states leave the keys dark while the board types, and what clears each? A runtime lighting state clears with a layer-list rewrite or a power cycle MEASURED; a stored ceiling of 0 should survive both and clear only when the ceiling is re-sent INFERRED, as the nayactl PR #6 author found on a board dark for weeks REPORTED; what relights a right half parked by LED writes to its own port (R7) is unknown | on a donor board: set the ceiling to 0 (params 00 00 00, never a short payload), power cycle, then try the layer-list rewrite, a cold boot and ed/1013 00 00 64 in turn; the same for a right half parked by LED writes |
donor | Recovery |
| OQ.F16 | The bytes NayaFlow's "Clear all keymap data" puts on the wire (that it runs 30/10ca is settled: closed); whether NayaCore's 00 00 and the 01 of the one reported firing behave the same; which stores 30/10ca spares (split-link pairing, bonds, timeouts, the module bundle) STATIC REPORTED |
a USB capture of the button; every store read before and after, on a donor | donor; running NayaFlow | Factory reset, Flash layout |
| OQ.F17 | The vendor's name for status 0x16; how NayaCore acts on a board below a minimum-firmware gate (refusal or warning); why one beta literal, 0.3.35.0, matches no 6.11.0 gate. The gates themselves are read (closed) STATIC |
NayaCore code; NayaFlow connected to a board below a gate | documents; donor | Factory reset, Versions |
| OQ.F18 | The SPI-flash self-test: which partition names map to which index, why the right half's partition 0 is "not detected", the order of the five return codes, header byte 1 MEASURED (healthy board) STATIC | a board with a failing partition; NayaCore code | donor | Flash layout |
| OQ.F19 | Where bonds, settings and timeouts live in flash INFERRED | reads before and after a format; partition reads | donor | Flash layout |
| OQ.F20 | Are the flash contents encrypted at rest? INFERRED | one entropy check of a chip read | donor | Flash layout |
| OQ.F21 | What wedges the CDC parser on a 30/100e write? The nayactl PR #6 author reports writes of 241 and of 41 bytes wedging it until a power cycle (3.41.0) REPORTED; single frames of 251 to 253 bytes were accepted on 3.41.0 MEASURED, so size alone is not the limit INFERRED |
repeat the reported write sizes; send one frame whose data region exceeds 245 bytes, or whose length byte disagrees with its length | donor | Troubleshooting, Command map |
| OQ.F22 | Does module recovery mode (MODULE_FORCE_CHARGING) behave on 3.41.0 and module 2.3.3 as on 3.28.7 and 2.1.2 (per half, LEDs out, times out), and how long before it ends by itself? MEASURED (3.28.7) | press the stock System-layer key with a drained module docked | keyboard (a stock key; no wire write) | Module firmware, Recovery |
| OQ.F23 | What a ZMK port would still need: the split-link payload protocol, the matrix pinout, the LED driver chain, the dock data protocol INFERRED | the hardware items above | donor | ZMK |
| OQ.F27 | Why do some ee/10ce restarts in a row come back on USB only after a cable replug? On Windows 11 the first two in a row came back by themselves; from the third the half passed through its bootloader and then stayed off USB, on two cables and ports (2 of 5 and 2 of 6 restarts came back by themselves) MEASURED (owner's board, left half, 3.41.0, 2026-09-23). A module update's self-restarts did the same (OQ.F13) |
run OpenFlow's naya-restart-probe.py on other computers (macOS, Linux, other Windows PCs) and on a generation-B board |
keyboard (restarts only; nothing written) | Bootloader, Recovery |
Host software and tools¶
| Id | Question and what is known | How to settle | Needs | Page |
|---|---|---|---|---|
| OQ.S01 | How /factory-reset is registered in flow-bg-server and what it answers: the string sits among its route strings and no interface calls it STATIC |
GET and POST on the bg-server's port |
running NayaFlow | NayaFlow and NayaCore |
| OQ.S02 | The value of oldBLELibDeprecatedCreateLeftFWVersion, the BLE v1 to v2 boundary the bg-server checks STATIC |
read the Go binary's data | documents | NayaFlow and NayaCore |
| OQ.S03 | Why NayaFlow's module setting ids skip MS-1, MS-6 and MS-11 STATIC | older installers' settings files | documents | App data |
| OQ.S06 | What NayaCore's bootloader worker sends as its "data port connection test" to tell the SMP port from the log port STATIC | read the function; capture a NayaFlow update | documents; donor | Disassembly |
| OQ.S07 | The naya-integration ids other than 401 (TUNE_MODE_L/R, WINDOWS_OS, MAC_OS, SCROLL_DIRECTION_L/R, MODULE_CHARGING), and what configuration_rude_toggle*, core and core_toggle_hold_morph do STATIC |
write each id on a donor key and watch; capture NayaFlow flashing the palette's macOS key | donor; running NayaFlow | Disassembly |
| OQ.S09 | NayaFlow on Linux: its data path, whether 1.15.0's Linux NayaCore ran at all, and whether 1.19.1 or later shipped a Linux NayaCore STATIC | inspect later installers; run an old Linux build | documents | App data, History |
| OQ.S10 | Linux and macOS with a keyboard attached, never measured by us: /dev/ttyACM* ownership (dialout), ModemManager probing and the udev rule's effect on Linux STATIC REPORTED; "Resource busy" (errno 16) on macOS while NayaFlow holds a port STATIC INFERRED; our tools on both |
on a Linux machine: ls -l /dev/ttyACM*, udevadm info, the ModemManager journal after plug-in; on a Mac: open a port while NayaFlow runs; run the read-only fe/1002 recipe on both |
keyboard (read-only) with a Linux machine and a Mac | Platforms, USB |
| OQ.S11 | Does OpenFlow's "release device" let NayaFlow open the ports while OpenFlow runs? STATIC | try it | keyboard (read-only); running NayaFlow | Tools |
| OQ.S12 | Did the vendor's five component repositories other than NayaFlow-releases ever hold anything public? They answer 404 MEASURED |
archive searches | documents | History |
| OQ.S13 | Did NayaFlow 1.6.10 already use ZeroMQ between the interface and the service? Our per-release table says yes, a summary says "from 1.11.0" STATIC | re-run the scan on 1.6.4-1.11.0 | documents | History |
| OQ.S14 | The Reddit vendor comments this site quotes from archived copies have not been opened live DOC | open each permalink in a browser | documents | ZMK |
| OQ.S16 | Do NayaFlow's Danger Zone buttons act without a confirmation dialog? One observation (2026-09-01) plus strings STATIC MEASURED | look at the live interface without pressing anything | running NayaFlow | NayaFlow and NayaCore |
| OQ.S17 | Which status NayaCore returns for an unknown ZMQ event: the log entry is built with code 0, and the reply sites use codes 4 and 5 STATIC | send an unknown event name to the bg-server's ZMQ route and read NayaCore's "ZMQ Command response" log line | running NayaFlow | NayaFlow and NayaCore |
| OQ.Y01 | The help center's troubleshooting pages (Battery Recovery, Force Flashing, Clearing Keymap Data, "not typing after update") survive as titles and first lines only MEASURED (archive checks) | any archived copy of the page bodies | documents | History, Factory reset |
Read-only checks to start with¶
These open questions can be settled with reads, observation or normal use on a retail keyboard, and make good first contributions: OQ.H11, OQ.H13, OQ.H19, OQ.H27, OQ.H28, OQ.H29, OQ.H32, OQ.H33, OQ.H38, OQ.H39, OQ.H40, OQ.C02, OQ.C03, OQ.C04, OQ.C05, OQ.C09, OQ.C12, OQ.C14, OQ.C16, OQ.P02, OQ.P03, OQ.P08, OQ.P11, OQ.P26, OQ.P27, OQ.F04, OQ.F08, OQ.F22, OQ.S10, OQ.S11. Each still names its exact bytes or steps in the table above; send nothing else, and quit NayaFlow first (one program per port).
Closed questions¶
Answered since the research began, with where the answer now lives, so nobody repeats them.
| Id | Question | Answer | Page |
|---|---|---|---|
| CL.01 | (part of OQ.H13) How many magnets does each module bay on the half have, and which features in the photos are they? | 6 per bay: one on either side of the pogo pins and 4 around the circular bay; the 5 blocks on each bay bracket did not attract a paper clip, so they are not magnets MEASURED (owner's paper-clip test, 2026-09-23) INFERRED | The keyboard half, Module dock |
| CL.02 | Can the split link be repaired by hand after a firmware mismatch broke it? | yes: done in NayaCore's order on 3.35.4 (2026-09-20), and reported by the owner on 3.41.0; whether the final reset alone suffices is OQ.C17 MEASURED | Split link |
| CL.03 | Do halves on different firmware recover once matched, and can layers be restored after a firmware flash? | yes to both, on the owner's boards MEASURED | Flashing, Recovery |
| CL.04 | How did NayaFlow 1.11.0-1.15.1 upload firmware? | through Naya's own SMP client, from 1.11.0 STATIC | History |
| CL.05 | Can NayaFlow 1.25.1 create double-tap keys? | yes: a capture shows it writing both binding banks MEASURED | NayaFlow and NayaCore |
| CL.06 | Macros on the wire; per-layer animations from stock software; the USB microcontroller; the right half's color path | the keyboard has no macro table; the animation is layer-list byte 2; the nRF52840 has native USB; the left half's map covers both halves MEASURED STATIC | NayaFlow and NayaCore, LEDs |
| CL.07 | Does the power switch act while USB is plugged in? | yes: switching a half off on USB shuts it off, and switching it on works as a reset MEASURED (owner, 2026-09-23); the v1.1.0 manual says the same DOC | Power, USB |
| CL.08 | Which FCC exhibits exist, what are the ISED numbers, and were later filings made? | 71 public exhibits (the ones not held are administrative or calibration exhibits); ISED 34320-0825CRL, -0825CRR, -0825DG; nothing filed after 2025-09-03 as of 2026-09-23 DOC |
Regulatory |
| CL.09 | What firmware do the beta installers carry? | carved into create-legacy-firmware's beta folder: beta-only 3.39.4 (its note says 3.39.3), 3.40.0 and 3.40.4, generation A only, the stable signing key and the same pre-armed trailer; beta 1.10.0 carries none STATIC | Versions |
| CL.10 | Can the peripheral be read through the central at dst 0x51 while the halves run different firmware? |
yes for the version read (the left port read the right half's 3.35.4 while the right port was hollow); Bluetooth identity reads sent that way answer for the left half MEASURED; writes are OQ.C18 | Transport |
| CL.11 | Is there an FCC filing for Naya Connect? | no: grantee 2BQ4V has nothing after 2025-09-03 as of 2026-09-23 DOC | Regulatory |
| CL.12 | What is the "first byte" of the de/1008 reply that reads 00 or 01? |
the first reply byte is the status; the byte seen as 00 and 01 is the third, the flag byte, whose meaning is OQ.P08 MEASURED |
Modules |
| CL.16 | How many bindings does the stock database hold, and does it hold a macro? | 201 press rows and no macro in every template from 1.15.0 to 1.25.1 and in three stock databases STATIC |
App data |
| CL.17 | (part of OQ.F17) What are NayaCore's minimum-firmware thresholds? | 3.30.0 for REMAP and most operations, 3.32.0 for be/100c-be/100f, 3.34.0 for be/1010, 3.36.0 for fe/100a / fe/100b; module 2.3.0; dongle 0.1.0.2 STATIC |
Differences by firmware |
| CL.18 | (was OQ.P05) What is the layer-list header byte (0x81 observed)? |
the index echo every REMAP read carries: NayaCore's reads (params 00 00) get 00; the 81 came from reads sent with no index, which echo a stale byte MEASURED |
Layers |
| CL.19 | (part of OQ.P15) How many fields does NayaCore allow per module config, and where do behaviors start? | maxSlots Touch 31, Track 15, Tune 36, the slot-0 template 40; behaviourSlotStart 5, 5, 8 and 40 STATIC |
Modules |
| CL.20 | (part of OQ.H38) How does NayaFlow turn millivolts into a module percentage? | (clamp(mV, 3300, 4200) - 3300) * 100 / 900, truncated, then clamped to 1-100 % STATIC; NayaFlow computes no percentage for the half's own cell, which it shows in millivolts STATIC |
Power |
| CL.21 | (part of OQ.F16) Does NayaFlow's "Clear all keymap data" run 30/10ca? |
yes: it sends clear_data, which dispatches to ClearAllData and then 30/10ca STATIC; its bytes on the wire are still OQ.F16 |
Factory reset |
| CL.22 | (part of OQ.F04) Is the dongle's 0x0137 identity an MCUboot pass? |
yes: its configuration descriptor is byte-identical to the halves' MCUboot identities MEASURED, and NayaCore has a dongle bootloader worker STATIC | Dongle |
| CL.23 | (part of OQ.P02) Does 30/10xx need a 30/1001 on the same connection? |
no: fresh connections answered 30/1003, 30/1009, 30/100d and 30/1005 after the opener alone MEASURED (3.41.0, 2026-09-01); the power-up case is OQ.P02 |
Transport |
| CL.24 | (part of OQ.P06) What are the ids of FORCE LEDs ON and OFF? | ed/10d1 and ed/10d2, from NayaCore's own LED command table STATIC; an earlier idea of ours (ed/1001 / 1002) is withdrawn |
Command map |
| CL.25 | (part of OQ.P06) Which params does NayaCore send with 30/10ca? |
00 00 (frame aa 00 50 00 30 04 10 ca 00 00 da 04): _remapClearFlash passes one byte 00 STATIC |
Factory reset |
| CL.26 | (was OQ.F03) Does ee/10ce pass through the bootloader? |
yes: the application port drops at once, the bootloader identity 0x006F shows 0.65 to 0.84 s after the command for about 1.3 s, and the application is back about 3 s after it MEASURED (restart probe, owner's board, left half, 3.41.0, 2026-09-23); why a half then sometimes stays off USB until replugged is OQ.F27 |
Bootloader, Recovery |
| CL.27 | (was OQ.F25) Does the halves' MCUboot ignore a version-0 SMP header? | no: in our capture of NayaFlow updating a module, NayaCore sent its image state reads and upload chunks with version-0 headers and the bootloader answered them MEASURED (left half, 3.41.0, 2026-09-23), as MCUboot of that period, which does not check the version bits, would DOC. Our first version-0 probes got no reply (2026-09-08); a Windows port-open race may explain them INFERRED |
Bootloader |
| CL.28 | (was OQ.P12) Who writes the 10-byte second-bank record of a three-behavior key, and does the firmware act on it? | NayaCore's key serializer: it is the second-bank record of a key with a double tap but no tap and hold, the double tap alone inside the 10 wrapper; a key without a double tap or tap and hold gets no second-bank record at all, so a stale one stays when the key drops back to a plain press STATIC. Keys written in these forms typed as set and read back unchanged (2026-09-26), and the second bank is consulted only behind a hold-tap primary (2026-09-21) MEASURED (3.41.0) |
Keymap |
| CL.29 | (was OQ.F24) Does NayaFlow's forced module update work on 3.41.0? | yes: NayaFlow's Force Update was captured on the wire for a Tune and for a Track, and a forced update with type byte 02 restored a Tune that had been flashed with the Track's app MEASURED (3.41.0, 2026-09-23) |
Module firmware |