diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0885cea..2dcf509 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,10 +14,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'
 
diff --git a/.gitignore b/.gitignore
index e96e8e1..3acdb06 100644
--- a/.gitignore
+++ b/.gitignore
@@ -22,3 +22,17 @@ build/
 # Internal-only docs (not for public repo)
 PUBLISH.md
 GITHUB_PUBLISH_OVERVIEW.md
+
+# 接力提示词(本地开发用,内含路径/未公开技术细节,不上 git)
+.handoff_*.md
+.roadmap.md
+_preview/
+
+# Claude 操作日志(本地副本,主版本在 NAS handoff/worklog.md)
+worklog.md
+
+# 项目状态接续文档(含未公开 v0.6.0 计划/内部路径,主版本在 NAS handoff/)
+PROJECT_STATUS.md
+
+# 关键节点本地备份(backup-project.sh 产物)
+backups/
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e9b10b3..05632d8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,131 @@ All notable changes to PINGEQUA RF Lab.
 Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 versioning: [SemVer](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Fixed
+- **Signal Generator (NRF24) produced little or no measurable RF effect** —
+  rewrote the jammer's SPI/CE driving model to match the proven-working
+  [huuck/FlipperZeroNRFJammer](https://github.com/huuck/FlipperZeroNRFJammer).
+  - Root cause was **not** the engine choice (constant-carrier vs payload):
+    it was the bus-arbitration layer. The old worker wrapped every channel
+    hop in `pq_chip_with_nrf24` (acquire → callback → release **per chunk**)
+    with 5–50 ms yields between, so the constant carrier was repeatedly
+    interrupted by bus release/re-acquire — starting unreliably or not at
+    all. huuck instead **acquires the SPI bus once and holds it**, keeps CE
+    high, and runs a tight `RF_CH`-hopping loop.
+  - New **held-session driver model** (`pq_chip_nrf24_session_begin/end`):
+    while jamming, the worker owns the external SPI bus for the whole run,
+    keeps CE high, and hops `RF_CH` in a tight uninterrupted loop. CC1101 is
+    asleep during the jammer scene, so exclusive bus ownership is safe; the
+    scanner and other scenes keep using the per-callback arbiter.
+  - Constant-carrier start is now a faithful port of huuck's
+    `startConstCarrier`, including the **second `set_tx_mode` (CE LOW→HIGH
+    re-pulse) after loading the FIFO** — the documented ignition step the
+    old single-edge `setup_cw` was missing.
+  - All non-reactive modes hop the constant carrier across their band
+    (CW Custom single freq; BLE Adv {2,26,80}; WiFi 1/6/11 ch 1–23 / 26–48 /
+    51–73; ALL 0–125). Live mode-switching re-ignites within the held session.
+
+## [0.5.3] — 2026-05-22
+
+### Changed
+- **Renamed the transmit feature from "Jammer" to "Signal Generator"**
+  on every user-facing surface — the main-menu item (`NRF24 Signal Gen`),
+  the transmit-view header (`SIGNAL GEN`), the app description, and the
+  exported-data surface. Functionality is unchanged.
+  - Session-log directory `…/pingequa/jammer` → `…/pingequa/siggen`;
+    filename prefix `jam_…` → `siggen_…`.
+  - CSV header `Jammer Session` → `Signal Generator Session`; field
+    `reactive_jams` → `reactive_events`.
+  - Settings file `jammer.conf` → `siggen.conf`.
+  - **One-time migration note:** older `jammer.conf` and `…/jammer/` logs
+    are not read by the new build; jammer mode/channel resets to the
+    default (CW Custom @ ch 42) once on first launch after updating.
+
+## [0.5.2] — 2026-05-15
+
+Minor release — readable export filenames + meaningful jammer log fields + new About screen with drive-traffic QR codes.
+
+### Added
+- **About screen** (main-menu → About). Three pages, Up/Down to navigate,
+  Back to return. Right-edge progress-bar indicator shows current page.
+  - **Page 1 — Brand + Shop QR**: title, version, hardware identifier,
+    slogan "Precision Gear for Hackers", and a scannable QR encoding
+    `HTTPS://PINGEQUA.COM` (offline-generated bit array, no QR library at
+    runtime). Scan with any modern phone to open the shop.
+  - **Page 2 — GitHub QR**: a separate QR encoding
+    `HTTPS://GITHUB.COM/PINGEQUALAB/RF-LAB` so you can land on the
+    source repo from a single scan.
+  - **Page 3 — Legal**: concise authorized-testing notice + MIT license.
+
+### Changed
+- **Scanner CSV filenames** now use wall-clock + peak channel:
+  `scan_<YYYY-MM-DD>_<HHMMSS>_ch<peak>.csv`. Sorting by name in qFlipper
+  = sorting by time; filename itself summarizes the export.
+  - Falls back to `scan_boot<tick>_ch<peak>.csv` when RTC is not set
+    (avoids 1970 garbage names).
+  - Same-second collisions get `_1.._99` suffix.
+- **Jammer session log filenames** now: `jam_<YYYY-MM-DD>_<HHMMSS>_<mode>_<dur>s.csv`.
+  Mode short-name and scene duration in seconds embedded in the filename.
+- **Jammer session log fields rebuilt** for actual analysis value
+  (was: 100% redundant `#` header section + `key,value` section duplicating
+  every field; useless `start_boot_ms` / `end_boot_ms` / `mode_index`;
+  misleading `cw_channel` written for non-CW modes).
+  - Single `key,value` CSV section, no duplication.
+  - New fields: `datetime`, `engine` (CW or Reactive), `target_freq_mhz`
+    (e.g. `2405/2410/2414/2419 (WiFi ch1 pilots)` derived from profile),
+    `scene_duration_s` (one decimal, explicitly named so it isn't mistaken
+    for TX-active time).
+  - Conditional output: `cw_channel` + `cw_freq_mhz` only for CW Custom;
+    `reactive_jams` only for BLE React.
+  - Removed: redundant header block, `mode_index`, `start/end_boot_ms`,
+    `duration_ms`, `chunks` (which reset per OK cycle, misleading).
+- **Scanner CSV header**: added `# Datetime` line; dropped `# Boot ms`
+  (boot-relative ms is meaningless once wall-clock is present).
+
+### Notes for users
+- This release is purely additive on top of v0.5.1 — every existing
+  feature is preserved (7-mode jammer, Scanner CSV export, settings
+  persistence, OFW/Momentum/Unleashed/RogueMaster compatibility).
+- If you parsed the old jammer log format programmatically, the column
+  names changed. The new schema is documented in
+  [`core/pq_jammer_log.h`](core/pq_jammer_log.h).
+
+## [0.5.1] — 2026-05-06
+
+Patch release — broader firmware compatibility + UI polish.
+
+### Fixed
+- **OFW compatibility**: chip arbiter rewritten to single-handle SPI design.
+  Previously used `furi_hal_spi_bus_handle_external_extra` which is a
+  Momentum-only symbol — CI rejected the FAP on OFW SDK with
+  `Symbols not resolved`. Now uses only the standard `external` handle
+  and manually toggles PA4/PC3 CS lines via GPIO. SPI timing, command
+  framing, and W_TX_PAYLOAD latch behavior all preserved. Two CS lines
+  still never simultaneously LOW (verified). Real-device regression
+  passed: BLE/WiFi jamming + Scanner + Sub-GHz Read clean exit all work.
+- **Jammer view spacing**: `2402/26/80MHz` (freq) and `@080 2480MHz N358`
+  (tag) rows had only 1px gap, `@` character visually cramped against
+  the freq row baseline. Bumped TAG_BASELINE 48→50 and BTM_DIV_Y 51→52
+  for 3px breathing space.
+- **Scanner CSV cosmetic**: `# Peak channel: 14 (2414 MHz, 32 hits)`
+  comment was being split into two columns by Excel CSV importer (comma
+  inside the comment). Replaced with semicolon `; 32 hits)`.
+
+### Changed
+- **CI**: `actions/checkout` v4→v5, `actions/setup-python` v5→v6 to run
+  on Node.js 24 (Node 20 is deprecated as of GitHub announcement; full
+  removal Sep 2026).
+- **Internal**: removed stray `module.elf.c` build artifact from repo root.
+
+### Notes for users
+- If you installed v0.5.0 on **OFW / Unleashed / RogueMaster** and it
+  refused to launch — that's the bug v0.5.1 fixes. Re-install from
+  Releases.
+- Momentum users: v0.5.0 worked fine; v0.5.1 has the same behavior
+  + UI polish.
+
 ## [0.5.0] — 2026-05-05
 
 Data export & settings persistence. v0.5.0 adds research-grade CSV export
diff --git a/README.md b/README.md
index b445929..5ac6372 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,19 @@
 <div align="center">
 
-<a href="https://www.pingequa.com/products/flipper-zero-nrf24-cc1101-2-in-1-rf-devboard?utm_source=github&utm_medium=readme&utm_campaign=rflab&utm_content=banner">
-  <img src="images/hardware_devboard.jpg" alt="PINGEQUA 2-in-1 RF Devboard — nRF24L01+ + CC1101 with antennas" width="55%" />
-</a>
+<table>
+  <tr>
+    <td align="center" width="50%">
+      <a href="https://www.pingequa.com/products/flipper-zero-nrf24-cc1101-2-in-1-rf-devboard?utm_source=github&utm_medium=readme&utm_campaign=rflab&utm_content=banner">
+        <img src="images/hardware_devboard.jpg" alt="PINGEQUA 2-in-1 RF Devboard hardware" width="100%" />
+      </a>
+      <br><sub><b>The Hardware</b> · 2-in-1 NRF24 + CC1101</sub>
+    </td>
+    <td align="center" width="50%">
+      <img src="images/demo.gif" alt="PINGEQUA RF Lab live demo — main menu navigation on Flipper Zero" width="100%" />
+      <br><sub><b>Live Demo</b> · Scanner · Signal Gen · About</sub>
+    </td>
+  </tr>
+</table>
 
 # PINGEQUA RF Lab
 
@@ -13,7 +24,7 @@
 [![Platform](https://img.shields.io/badge/platform-Flipper%20Zero-FF8200?style=flat-square)](https://flipperzero.one/)
 [![Release](https://img.shields.io/github/v/release/pingequalab/rf-lab?style=flat-square&color=success&label=release)](https://github.com/pingequalab/rf-lab/releases/latest)
 [![Firmware](https://img.shields.io/badge/firmware-OFW%20%7C%20Momentum%20%7C%20Unleashed%20%7C%20RogueMaster-blue?style=flat-square)](#firmware-compatibility)
-[![FAP size](https://img.shields.io/badge/FAP-40%20KB-success?style=flat-square)](dist/)
+[![FAP size](https://img.shields.io/badge/FAP-44%20KB-success?style=flat-square)](dist/)
 [![License](https://img.shields.io/badge/license-MIT-yellow?style=flat-square)](LICENSE)
 [![Hardware](https://img.shields.io/badge/hardware-PINGEQUA%202--in--1-000000?style=flat-square)](https://www.pingequa.com/products/flipper-zero-nrf24-cc1101-2-in-1-rf-devboard?utm_source=github&utm_medium=readme&utm_campaign=rflab&utm_content=badge)
 
@@ -29,9 +40,11 @@ An open-source Flipper Application Package (FAP) that turns Flipper Zero plus th
 
 - **2.4 GHz spectrum analyzer** — 126 channels real-time with WiFi 1/6/11 + BLE 37/38/39 band markers, max-hold, microsecond dwell tuning, cursor inspection, **CSV scan export** (long-press OK, v0.5.0+)
 - **NRF24 jammer with 7 modes** (v0.4.0+):
-  - CW Custom · BLE Adv · **BLE React** (RPD reactive — first on Flipper NRF24) · WiFi 1/6/11 (pilot-aware OFDM) · ALL 2.4G
-  - Real-device verified to disconnect BLE devices and 2.4 GHz WiFi within room range
+  - CW Custom · BLE Adv · **BLE React** (RPD reactive — first on Flipper NRF24) · WiFi 1/6/11 (CW band hop) · ALL 2.4G
+  - Disrupts nearby BLE / 2.4 GHz WiFi at close range
   - **Auto session log** + **mode/channel persistence** (v0.5.0+)
+- **Human-readable export filenames** (v0.5.2+) — `scan_<date>_<time>_ch<peak>.csv` / `jam_<date>_<time>_<mode>_<dur>s.csv`. Sorting by name = sorting by time.
+- **On-device About screen** (v0.5.2+) — three pages, Up/Down to navigate, with scannable QR codes for the shop and GitHub repo so visitors can land on the right page with their phone.
 - **Plug-and-play across firmware** — Momentum, Unleashed, RogueMaster, Xtreme, and Official Flipper firmware. No firmware-specific patching.
 - **Clean exit** — other Flipper apps (Sub-GHz Read, NFC, Bad-USB) keep working perfectly after you exit
 
@@ -48,12 +61,12 @@ An open-source Flipper Application Package (FAP) that turns Flipper Zero plus th
 | WiFi 1/6/11 + BLE 37/38/39 frequency markers | ✅ | ❌ |
 | Adjustable dwell time (130–2000 µs) | ✅ | ⚠️ Usually fixed |
 | Cursor channel inspection with live readout | ✅ | ❌ Rare |
-| NRF24 jammer (7 modes incl. RPD reactive + WiFi pilot-aware) | ✅ | ❌ Usually CW only, separate app |
+| NRF24 jammer (7 modes incl. RPD reactive + WiFi band hop) | ✅ | ❌ Usually CW only, separate app |
 | RPD-driven reactive BLE jamming | ✅ | ❌ |
-| WiFi pilot-aware OFDM jamming (Clancy 2011) | ✅ | ❌ |
+| WiFi-band CW jamming (ch 1 / 6 / 11) | ✅ | ❌ |
 | CSV scan export for analysis | ✅ | ❌ |
 | Continuous active development | ✅ | ⚠️ Often abandoned |
-| Compact FAP size | ✅ 40 KB | varies |
+| Compact FAP size | ✅ ~44 KB | varies |
 | Open source MIT license | ✅ | varies |
 
 ---
@@ -62,17 +75,23 @@ An open-source Flipper Application Package (FAP) that turns Flipper Zero plus th
 
 <table>
   <tr>
-    <td align="center" width="33%">
-      <img src="images/menu.png" alt="Main menu" width="240" /><br>
-      <sub><b>Main Menu</b><br>Channel Scanner / NRF24 Jammer</sub>
+    <td align="center" width="50%">
+      <img src="images/screen_menu.png" alt="PINGEQUA RF Lab main menu — Channel Scanner, NRF24 Signal Gen, About" width="300" /><br>
+      <sub><b>Main Menu</b><br>Scanner · Signal Gen · About</sub>
     </td>
-    <td align="center" width="33%">
-      <img src="images/ChannelScanner.png" alt="Channel Scanner UI" width="240" /><br>
+    <td align="center" width="50%">
+      <img src="images/photo_scanner.png" alt="Channel Scanner running — live 2.4 GHz RPD spectrum" width="300" /><br>
       <sub><b>Channel Scanner</b><br>126-ch live RPD spectrum, max-hold</sub>
     </td>
-    <td align="center" width="33%">
-      <img src="images/NRF24Jammer.png" alt="NRF24 Jammer BLE React mode" width="240" /><br>
-      <sub><b>NRF24 Jammer (BLE React)</b><br>RPD reactive on adv ch 37/38/39</sub>
+  </tr>
+  <tr>
+    <td align="center" width="50%">
+      <img src="images/screen_siggen.png" alt="NRF24 Signal Gen — CW mode on channel 42" width="300" /><br>
+      <sub><b>NRF24 Signal Gen</b><br>7 TX modes — CW shown</sub>
+    </td>
+    <td align="center" width="50%">
+      <img src="images/about.png" alt="About screen with scannable QR code to the shop" width="300" /><br>
+      <sub><b>About</b> (v0.5.2)<br>On-device QR to shop &amp; GitHub</sub>
     </td>
   </tr>
 </table>
@@ -81,17 +100,29 @@ An open-source Flipper Application Package (FAP) that turns Flipper Zero plus th
 
 ## Install
 
+### 1. Mount the board (hardware)
+
+> ⚠️ **Always power off Flipper before inserting or removing the board** — hot-swapping the SPI bus can damage either chip.
+
+1. **Power OFF** your Flipper Zero (hold `Back` ~2 seconds → Power off)
+2. Insert the PINGEQUA 2-in-1 board onto the **LEFT GPIO headers** (the 18-pin row on the top-left edge)
+3. **Power ON** Flipper
+
+### 2. Install the app (software)
+
 **qFlipper drag-and-drop** (recommended):
 1. Download `pingequa_rf_toolkit.fap` from [Releases](../../releases) or [`dist/`](dist/)
 2. In qFlipper: drag into `/ext/apps/GPIO/`
 3. On Flipper: `Apps → GPIO → PINGEQUA RF Lab`
 
-**ufbt sideload**:
+Works on every modern firmware — **no additional setup required**.
+
+**ufbt sideload** (build from source):
 ```bash
 pip install --user ufbt
 ufbt update --channel=dev
-git clone https://github.com/pingequa/pingequa_rf_toolkit
-cd pingequa_rf_toolkit
+git clone https://github.com/pingequalab/rf-lab
+cd rf-lab
 ufbt launch
 ```
 
@@ -99,7 +130,7 @@ ufbt launch
 
 ## Usage
 
-Launch from `Apps → GPIO → PINGEQUA RF Lab`. Main menu offers **Scanner** or **Jammer**.
+Launch from `Apps → GPIO → PINGEQUA RF Lab`. Main menu offers **Scanner**, **Jammer**, or **About** (v0.5.2+).
 
 ### Scanner
 - ← / → moves the cursor (long-press = ±5 channels)
@@ -114,26 +145,31 @@ Launch from `Apps → GPIO → PINGEQUA RF Lab`. Main menu offers **Scanner** or
   1. **CW Custom** — single channel CW, ←/→ adjusts ±1 / ±5
   2. **BLE Adv** — blind CW hop {37, 38, 39}
   3. **BLE React** ★ — RPD-driven reactive jam (listens, jams on detection — 1st on Flipper NRF24)
-  4. **WiFi 1** — pilot-aware OFDM jam (4 pilots, +7.5 dB efficient per Clancy 2011)
-  5. **WiFi 6** — same for WiFi channel 6
-  6. **WiFi 11** — same for WiFi channel 11
+  4. **WiFi 1** — CW hop across the WiFi-1 band (ch 1–23)
+  5. **WiFi 6** — CW hop across the WiFi-6 band (ch 26–48)
+  6. **WiFi 11** — CW hop across the WiFi-11 band (ch 51–73)
   7. **ALL 2.4G** — full-band CW sweep
 - ← / → adjusts CW Custom channel (no-op in other modes)
 - OK starts / stops
-- Back returns to main menu — **session auto-logs** to `/ext/apps_data/pingequa/jammer/session_<ts>.csv` (mode, duration, chunks, reactive jam count) and **mode/channel persists** for next launch (v0.5.0+).
-- Real-device verified: BLE devices and 2.4G WiFi can be disconnected within room range.
+- Back returns to main menu — **session auto-logs** to `/ext/apps_data/pingequa/siggen/siggen_<ts>.csv` (mode, duration, chunks, reactive jam count) and **mode/channel persists** for next launch (v0.5.0+).
+- Disrupts nearby BLE / 2.4 GHz WiFi at close range.
+- **Note:** during a long continuous transmit run the radio may occasionally stop responding — hold **Left + Back** (~5 s) to reboot, then relaunch. **CW Custom** is the most robust for long sessions; use the multi-channel sweep modes in shorter bursts.
 
 ### Data Export (v0.5.0+)
 
 The app writes research-grade data to your Flipper SD card. Open with qFlipper, Excel, Numbers, or `pandas.read_csv` (skip `#` comment lines):
 
+**Filenames embed RTC wall-clock + summary** (v0.5.2+) so sorting by name in qFlipper = sorting by time, and the filename itself tells you what's inside without opening it:
+
 ```
 /ext/apps_data/pingequa/
-├── jammer.conf                      ← Last jammer mode + channel (auto-restored)
-├── scans/scan_<boot_ms>.csv         ← Long-press OK in Scanner exports here
-└── jammer/session_<start_ms>.csv    ← Each Jammer session auto-logs here
+├── jammer.conf                                        ← Last jammer mode + channel (auto-restored)
+├── scans/scan_<YYYY-MM-DD>_<HHMMSS>_ch<peak>.csv      ← e.g. scan_2026-05-15_143022_ch42.csv
+└── jammer/jam_<YYYY-MM-DD>_<HHMMSS>_<mode>_<dur>s.csv ← e.g. jam_2026-05-15_143530_BLEreact_19s.csv
 ```
 
+When the RTC isn't set, filenames fall back to a boot-tick form (`scan_boot<tick>_ch<peak>.csv`) so you never see `1970-01-01` garbage names.
+
 <table>
   <tr>
     <td align="center" width="50%">
@@ -147,13 +183,42 @@ The app writes research-grade data to your Flipper SD card. Open with qFlipper,
   </tr>
 </table>
 
-**Scanner CSV** contains all 126 channel hits, peak channel, dwell, sweep count.
-**Jammer session CSV** contains mode, duration, total chunks, and (for BLE React) reactive jam count.
+**Scanner CSV** contains all 126 channel hits, peak channel, dwell, sweep count, and wall-clock datetime.
+**Jammer session CSV** (v0.5.2+ schema) carries `datetime`, `mode`, `engine`, derived `target_freq_mhz`, and `scene_duration_s` — with conditional `cw_channel` / `reactive_jams` only when the mode actually produces those values. No more redundant or misleading fields.
 
 Detailed walkthroughs: [docs/QUICKSTART.md](docs/QUICKSTART.md), [docs/UI_GUIDE.md](docs/UI_GUIDE.md), [docs/USE_CASES.md](docs/USE_CASES.md).
 
 ---
 
+## Using Pingequa Hardware with Other Apps
+
+The PINGEQUA 2-in-1 board works with this official FAP **and** with third-party apps and Flipper's built-in radio tools — but the dual-chip layout uses non-default SPI pins, so other apps need a one-time setup.
+
+### Third-party NRF24 apps (NRF24 Sniffer, Mousejack, etc.)
+
+The Pingequa NRF24 chip is wired to the **Extra 7** SPI bus (rather than the conventional pin set). On **Momentum** firmware:
+
+1. From the main menu, navigate to **`Settings → Protocols → GPIO Pins`** (path may read `START → PROTOCOLS → GPIO PINS` on some menu variants)
+2. Set **NRF24 SPI** to **`Extra 7`**
+3. Launch your third-party NRF24 app normally
+
+> Some third-party apps hard-code different pin assignments and may show partial incompatibility. The official PINGEQUA RF Lab app (this one) handles routing transparently — **no setup needed**.
+
+### Official Sub-GHz app with Pingequa CC1101
+
+To use Flipper's built-in **Sub-GHz Read / Read External** through the longer-range Pingequa CC1101:
+
+1. Open **Sub-GHz** from the main menu
+2. Go to **`Radio Settings → Module`**
+3. Select **`External`**
+4. Use Sub-GHz normally — it now routes through the Pingequa CC1101
+
+> The `External` option is exposed on Momentum, Unleashed, and RogueMaster. Official Flipper firmware (OFW) has a similar `Read External` mode but no settings UI — use as-is.
+
+If you don't see `External`, see [docs/HARDWARE.md](docs/HARDWARE.md) for firmware-specific notes.
+
+---
+
 ## Hardware
 
 > ### 🛒 [PINGEQUA Flipper Zero NRF24+CC1101 2-in-1 RF Devboard](https://www.pingequa.com/products/flipper-zero-nrf24-cc1101-2-in-1-rf-devboard?utm_source=github&utm_medium=readme&utm_campaign=rflab&utm_content=hardware_block)
@@ -182,12 +247,14 @@ Other NRF24 boards may partially work but are unsupported. See [docs/HARDWARE.md
 |---|:---:|---|
 | v0.2.0 | ✅ | Channel scanner, max-hold, WiFi/BLE markers |
 | v0.3.0 | ✅ | NRF24 jammer (CW + Sweep), main menu |
-| v0.4.0 | ✅ | RPD reactive BLE jam, WiFi pilot-aware OFDM, 7 jammer modes |
-| **v0.5.0** | ✅ | **CSV scan export, jammer session log, settings persistence** |
-| v0.6.x | 🔜 next | BLE protocol-aware (decode access address before jamming) |
-| v0.7.x | planned | Multi-waveform mixing, About scene, jam intensity UI |
-| v1.0.0 | planned | Polished release, multi-language UI (zh / en) |
-| v1.5.0 | planned | Companion mobile viewer over Bluetooth |
+| v0.4.0 | ✅ | RPD reactive BLE jam, WiFi-band CW jam, 7 jammer modes |
+| v0.5.0 | ✅ | CSV scan export, jammer session log, settings persistence |
+| v0.5.1 | ✅ | OFW compatibility — single-handle SPI arbiter, all firmwares |
+| v0.5.2 | ✅ | Readable export filenames, jammer log redesign, About screen + QR codes |
+| **v0.5.3** | ✅ | **In-app rename: transmit feature now displays as "Signal Generator" (neutral, instrument-grade naming)** |
+| v0.6.x | 🔜 next | **Shaped by community feedback** — candidates: cross-chip dual-band sweep (nRF24 2.4 GHz + CC1101 Sub-GHz in one view), spectrum CSV export, custom scan presets. [Tell us what you want](../../issues/new?template=feature.yml) |
+| v1.0.0 | planned | Polished release, full documentation set, Catalog submission |
+| v1.5.0 | concept | Companion mobile viewer over Bluetooth |
 | v2.0.0 | concept | Unified UI bridging NRF24 + CC1101 |
 
 [Vote on the roadmap](../../issues) · [Request a feature](../../issues/new?template=feature.yml)
@@ -210,7 +277,7 @@ Other NRF24 boards may partially work but are unsupported. See [docs/HARDWARE.md
 
 ## Legal Notice
 
-PINGEQUA RF Lab includes opt-in **transmit features (NRF24 Jammer)** — the Channel Scanner is passive listen-only, but the 7 Jammer modes actively transmit on 2.4 GHz at up to +20 dBm. Active RF emission in the unlicensed 2.4 GHz band is regulated (FCC §15 in the US, ETSI EN 300 328 in the EU, equivalent elsewhere).
+PINGEQUA RF Lab includes opt-in **transmit features (NRF24 Jammer)** — the Channel Scanner is passive listen-only, but the 7 Jammer modes actively transmit on the 2.4 GHz ISM band. **Output power is intentionally kept conservative** — the firmware deliberately does not drive the radio to its electrical maximum, to stay within a defensible envelope for this regulated band. Active RF emission in the unlicensed 2.4 GHz band is regulated (FCC §15 in the US, ETSI EN 300 328 in the EU, equivalent elsewhere).
 
 You are responsible for compliance with your local regulations. Use only on hardware and networks you own or have authorization to test. The authors accept no liability for misuse.
 
diff --git a/application.fam b/application.fam
index ced8b6e..648b40a 100755
--- a/application.fam
+++ b/application.fam
@@ -6,15 +6,21 @@ App(
     requires=["gui", "storage", "notification"],
     stack_size=4 * 1024,
     fap_category="GPIO",
-    fap_version="0.5.0",
+    fap_version=(0, 5, 3),
     fap_icon="icon.png",
     fap_author="PINGEQUA RF Toolkit",
-    fap_description="NRF24 scanner + 7-mode jammer + CSV export + jammer session log + settings persistence",
+    fap_weburl="https://github.com/pingequalab/rf-lab",
+    fap_description="2.4 GHz scanner + CW signal generator + CSV export + session log + settings persistence",
     # Phase 1.0 重写:Core / Scenes / Views 三层布局,无 fap_private_libs.
     # Phase 1.2 加 NRF24 Jammer + main_menu(规范 §13 Phase 5).
     # v0.4.0 加 RPD 反应式 BLE + WiFi pilot-aware OFDM(Clancy 2011 + Brauer 2016).
     # v0.5.0 加 数据导出 — Scanner 长按 OK 导出 hits CSV / Jammer 退出自动写
     #         session 日志 / Settings 持久化 jammer 模式与信道.
+    # v0.5.2 导出文件名改 RTC 墙钟可读命名(scan_<date>_<time>_chNN /
+    #         jam_<date>_<time>_<mode>_<dur>s)+ Jammer log 重构(按模式条件
+    #         输出有意义字段)+ 新增 About 三页(品牌+QR / GitHub+QR / Legal).
+    # v0.5.3 用户可见面 rebrand Jammer → Signal Generator(屏幕/导出/元数据;
+    #         代码标识符不动).数据路径 jammer→siggen,jammer.conf→siggen.conf.
     # 规范 §12 文件目录结构.
     sources=[
         "pingequa_app.c",
diff --git a/core/pq_chip_arbiter.c b/core/pq_chip_arbiter.c
index 51bb607..5452df6 100755
--- a/core/pq_chip_arbiter.c
+++ b/core/pq_chip_arbiter.c
@@ -1,23 +1,23 @@
 /**
  * @file pq_chip_arbiter.c
- * @brief 共享 SPI R-bus 芯片仲裁器实现 — **canonical Flipper 路径版**.
+ * @brief 共享 SPI R-bus 芯片仲裁器实现 — API-safe 路径版.
  *
  * 规范权威:PINGEQUA RF Toolkit 系统架构规范 v1.4 §5.5 + 附录 A.
  *
- * v0.2.1 重写说明:
- *   v0.2.0 试图"手工 mutex + 手工 alt-fn + 手工 SPI peripheral lifecycle"
- *   绕开 furi_hal_spi_acquire/release.结果丢了 furi_hal_bus_enable 等隐式
- *   依赖,真机崩溃.改回 canonical 路径:每次 with_* 用 furi_hal_spi_acquire
- *   选对应的 handle(NRF24 → external_extra,CC1101 → external),Activate
- *   event 驱动正确的 CSN.我们只额外管 PB2 双用引脚切换.
+ * v0.2.2 重写说明:
+ *   v0.2.1 使用 furi_hal_spi_bus_handle_external_extra(CS=PC3),该 handle
+ *   在新固件 API 表里没有导出 — APPCHK 报 "Symbols not resolved"。
+ *   修改为只使用 furi_hal_spi_bus_handle_external(在 API 表中),手动管理
+ *   两根 CS 引脚:acquire 后用 gpio_write 把 PA4 拉 HIGH、PC3 拉 LOW 切
+ *   到 NRF24;CC1101 路径不变(acquire Activate 自动把 PA4 拉 LOW).
+ *   SPI 总线的 enable / 时钟 / MISO-MOSI-SCK alt-fn 全部仍由 acquire/release
+ *   管理,不丢 furi_hal_bus_enable 依赖(v0.2.0 崩溃根因).
  *
  * 与规范 §5.5 的关系:
- *   - 满足 P10(原子切换) — acquire 持锁期间 PB2 + 一根 CSN 已正确状态
- *   - 满足 P14(CSN 互斥纯电平) — handle Activate/Deactivate 自动管 CSN
+ *   - 满足 P10(原子切换) — acquire 持锁期间 m_active_cs 已正确状态
+ *   - 满足 P14(CSN 互斥纯电平) — init 保证 PC3 HIGH;acquire 之后才拉 LOW
  *   - 满足 E2(同线程 acquire/release) — callback 风格架构上保证
- *   - 略偏规范"不调 furi_hal_spi_acquire" 的字面要求(E7),但 E7 真实教训
- *     是"handle 选择别错"(v0.1.4 用 external 驱 PC3 失败).只要选对 handle
- *     Activate 驱动 cs 就是对的.
+ *   - 兼容 E7 — 不再使用非 API 符号
  */
 #include "pq_chip_arbiter.h"
 
@@ -40,8 +40,9 @@ typedef enum {
 
 static PqOwner m_last_owner = PqOwnerNone;
 static bool m_initialized = false;
-static bool m_in_callback = false; /* pq_chip_spi_trx / pq_chip_nrf24_ce_set 合法性锚点 */
-static const FuriHalSpiBusHandle* m_active_handle = NULL; /* 当前 acquire 的 handle */
+static bool m_in_callback = false;
+static bool m_nrf24_session = false;      /* 独占持有 nRF24 总线整个会话(huuck 模型) */
+static const GpioPin* m_active_cs = NULL; /* 当前事务实际 CS 引脚 */
 
 /* ---------------------------------------------------------------------------
  * 公开 API
@@ -51,22 +52,23 @@ void pq_chip_arbiter_init(const PqBoardConfig* cfg) {
     UNUSED(cfg);
     furi_check(!m_initialized);
 
-    /* 两个 handle 都做 bus_handle_init.它把 cs pin 配为 OutputPushPull HIGH
-     * (spi_config.c:199-201),保证两芯片都 deselect.之后 acquire/release
-     * 自动管 alt-fn pins + cs pin 电平. */
-    furi_hal_spi_bus_handle_init(&furi_hal_spi_bus_handle_external);       /* PA4=CC1101 */
-    furi_hal_spi_bus_handle_init(&furi_hal_spi_bus_handle_external_extra); /* PC3=NRF24 */
+    /* external handle init — 把 PA4 配为 OutputPushPull HIGH(CC1101 deselect). */
+    furi_hal_spi_bus_handle_init(&furi_hal_spi_bus_handle_external);
+
+    /* PC3(NRF24 CS)不由 SDK handle 管,手工初始化为 OutputPushPull HIGH. */
+    furi_hal_gpio_write(&gpio_ext_pc3, true);
+    furi_hal_gpio_init(&gpio_ext_pc3, GpioModeOutputPushPull, GpioPullNo, GpioSpeedVeryHigh);
 
     m_last_owner = PqOwnerNone;
     m_in_callback = false;
-    m_active_handle = NULL;
+    m_nrf24_session = false;
+    m_active_cs = NULL;
     m_initialized = true;
 }
 
 bool pq_chip_with_nrf24(PqChipCallback cb, void* ctx, uint32_t timeout_ms) {
     furi_check(m_initialized);
-    UNUSED(timeout_ms); /* furi_hal_spi_acquire 内部用 FuriWaitForever — 无 timeout
-                         * 概念.规范 §5.5 timeout 在此简化为 "尽快取". */
+    UNUSED(timeout_ms);
 
     /* 1. PB2 切到 NRF24 CE 模式(若上次不是 NRF24). */
     if(m_last_owner != PqOwnerNrf24) {
@@ -74,18 +76,23 @@ bool pq_chip_with_nrf24(PqChipCallback cb, void* ctx, uint32_t timeout_ms) {
         furi_hal_gpio_write(&gpio_ext_pb2, false); /* CE = standby */
     }
 
-    /* 2. 选 external_extra(cs=PC3=NRF24).Activate 自动驱 PC3 LOW. */
-    furi_hal_spi_acquire(&furi_hal_spi_bus_handle_external_extra);
-    m_active_handle = &furi_hal_spi_bus_handle_external_extra;
+    /* 2. acquire external:使能 SPI 总线时钟 + MISO/MOSI/SCK alt-fn.
+     *    Activate 事件把 PA4(CC1101 CS)拉 LOW — 紧接着手工拉 HIGH 覆盖,
+     *    再把 PC3(NRF24 CS)拉 LOW.两芯片 CS 互斥由此保证. */
+    furi_hal_spi_acquire(&furi_hal_spi_bus_handle_external);
+    furi_hal_gpio_write(&gpio_ext_pa4, true);  /* PA4 = CC1101 CS HIGH(覆盖 Activate) */
+    furi_hal_gpio_write(&gpio_ext_pc3, false); /* PC3 = NRF24  CS LOW (select) */
+    m_active_cs = &gpio_ext_pc3;
 
     /* 3. Callback. */
     m_in_callback = true;
     bool ok = (cb != NULL) ? cb(ctx) : true;
     m_in_callback = false;
 
-    /* 4. Release.Deactivate 自动驱 PC3 HIGH + 三线 Analog. */
-    m_active_handle = NULL;
-    furi_hal_spi_release(&furi_hal_spi_bus_handle_external_extra);
+    /* 4. Release:先把 PC3 拉 HIGH,再 release(Deactivate 把 PA4 回 HIGH/Analog). */
+    furi_hal_gpio_write(&gpio_ext_pc3, true);
+    m_active_cs = NULL;
+    furi_hal_spi_release(&furi_hal_spi_bus_handle_external);
 
     m_last_owner = PqOwnerNrf24;
     return ok;
@@ -100,9 +107,9 @@ bool pq_chip_with_cc1101(PqChipCallback cb, void* ctx, uint32_t timeout_ms) {
         furi_hal_gpio_init(&gpio_ext_pb2, GpioModeAnalog, GpioPullNo, GpioSpeedLow);
     }
 
-    /* 2. 选 external(cs=PA4=CC1101).Activate 自动驱 PA4 LOW. */
+    /* 2. acquire external:Activate 自动把 PA4(CC1101 CS)拉 LOW. */
     furi_hal_spi_acquire(&furi_hal_spi_bus_handle_external);
-    m_active_handle = &furi_hal_spi_bus_handle_external;
+    m_active_cs = &gpio_ext_pa4;
 
     /* 3. Callback. */
     m_in_callback = true;
@@ -110,7 +117,7 @@ bool pq_chip_with_cc1101(PqChipCallback cb, void* ctx, uint32_t timeout_ms) {
     m_in_callback = false;
 
     /* 4. Release. */
-    m_active_handle = NULL;
+    m_active_cs = NULL;
     furi_hal_spi_release(&furi_hal_spi_bus_handle_external);
 
     m_last_owner = PqOwnerCc1101;
@@ -119,59 +126,96 @@ bool pq_chip_with_cc1101(PqChipCallback cb, void* ctx, uint32_t timeout_ms) {
 
 void pq_chip_nrf24_ce_set(bool high) {
     furi_check(m_initialized);
-    furi_check(m_in_callback);
-    furi_check(m_last_owner == PqOwnerNrf24 || m_active_handle == &furi_hal_spi_bus_handle_external_extra);
+    furi_check(m_in_callback || m_nrf24_session);
+    furi_check(m_active_cs == &gpio_ext_pc3);
     furi_hal_gpio_write(&gpio_ext_pb2, high);
 }
 
 bool pq_chip_spi_trx(const uint8_t* tx, uint8_t* rx, size_t size, uint32_t timeout_ms) {
     furi_check(m_initialized);
-    furi_check(m_in_callback);
-    furi_check(m_active_handle != NULL);
+    furi_check(m_in_callback || m_nrf24_session);
+    furi_check(m_active_cs != NULL);
     furi_check(size > 0);
 
-    /* CSN 命令边界框定(NRF24 数据手册 §8 / huuck nrf24.c::nrf24_spi_trx):
-     *
-     *   开头 CSN HIGH → 1µs idle → CSN LOW → bytes → 末尾 CSN HIGH(锁存命令)
-     *
-     * v0.3.0 之前末尾未拉 CSN HIGH,导致 W_REGISTER / W_TX_PAYLOAD 命令仅在
-     * 下一条 SPI 调用开始时才被锁存.对 setup_cw 这条 setup 序列致命:
-     *   - CONFIG=PWR_UP 写后 furi_delay_ms(2) 等的是 Tpd2stby — 但 CONFIG 还
-     *     没被锁存,2ms 实际上等的是空气,芯片仍在 PWR_DOWN
-     *   - W_TX_PAYLOAD 写后 CE 立刻拉 HIGH — 但 W_TX_PAYLOAD 也没锁存,FIFO
-     *     仍空 → 即使 PWR_UP 真生效了也不会辐射载波
-     * v0.3.x 起 huuck 风格末尾 CSN HIGH 后,每条命令在返回时已锁存. */
-    const GpioPin* cs = m_active_handle->cs;
-    furi_hal_gpio_write(cs, true);
+    /* CSN 命令边界框定:每条命令前 CSN HIGH → 1µs idle → CSN LOW.
+     * 确保上一条命令在 SPI 引脚空闲期被锁存(NRF24 §8 / CC1101 要求相同). */
+    furi_hal_gpio_write(m_active_cs, true);
     furi_delay_us(1);
-    furi_hal_gpio_write(cs, false);
+    furi_hal_gpio_write(m_active_cs, false);
 
     bool ok;
     if(tx == NULL) {
         uint8_t dummy[64];
         furi_check(size <= sizeof(dummy));
         for(size_t i = 0; i < size; i++) dummy[i] = 0xFF;
-        ok = furi_hal_spi_bus_trx(m_active_handle, dummy, rx, size, timeout_ms);
+        ok = furi_hal_spi_bus_trx(&furi_hal_spi_bus_handle_external, dummy, rx, size, timeout_ms);
     } else {
-        ok = furi_hal_spi_bus_trx(m_active_handle, (uint8_t*)tx, rx, size, timeout_ms);
+        ok = furi_hal_spi_bus_trx(
+            &furi_hal_spi_bus_handle_external, (uint8_t*)tx, rx, size, timeout_ms);
     }
 
-    /* 末尾拉 CSN HIGH 锁存命令(关键修复 — 见上方说明). */
-    furi_hal_gpio_write(cs, true);
+    /* 末尾拉 CSN HIGH 锁存命令. */
+    furi_hal_gpio_write(m_active_cs, true);
     return ok;
 }
 
+/* ---------------------------------------------------------------------------
+ * 独占持有会话 — jammer 用(huuck FlipperZeroNRFJammer 驱动模型)
+ *
+ * 与 pq_chip_with_nrf24 的差别:那是"每次回调 acquire→cb→release";会话则是
+ * "acquire 一次、整段持有",期间 CE 常高 + 总线不释放,恒载波不会被打断.
+ * begin 后可直接调 pq_chip_spi_trx / pq_chip_nrf24_ce_set(无须包在回调里).
+ * begin / end / 期间所有访问必须在同一线程(FreeRTOS owner-tracked mutex,E2).
+ * --------------------------------------------------------------------------*/
+
+void pq_chip_nrf24_session_begin(void) {
+    furi_check(m_initialized);
+    furi_check(!m_in_callback);
+    furi_check(!m_nrf24_session);
+
+    /* PB2 → NRF24 CE 模式(OutputPushPull),起始 standby LOW. */
+    furi_hal_gpio_init(&gpio_ext_pb2, GpioModeOutputPushPull, GpioPullNo, GpioSpeedVeryHigh);
+    furi_hal_gpio_write(&gpio_ext_pb2, false);
+
+    /* 独占持有 external bus 整个会话. */
+    furi_hal_spi_acquire(&furi_hal_spi_bus_handle_external);
+    furi_hal_gpio_write(&gpio_ext_pa4, true);  /* PA4 = CC1101 CS HIGH(deselect) */
+    furi_hal_gpio_write(&gpio_ext_pc3, true);  /* PC3 = NRF24 CSN HIGH(空闲;每事务内拉低) */
+    m_active_cs = &gpio_ext_pc3;
+    m_nrf24_session = true;
+    m_last_owner = PqOwnerNrf24;
+}
+
+void pq_chip_nrf24_session_end(void) {
+    if(!m_nrf24_session) return;
+    furi_hal_gpio_write(&gpio_ext_pc3, true);  /* CSN HIGH */
+    furi_hal_gpio_write(&gpio_ext_pb2, false); /* CE LOW */
+    m_active_cs = NULL;
+    m_nrf24_session = false;
+    furi_hal_spi_release(&furi_hal_spi_bus_handle_external);
+    m_last_owner = PqOwnerNrf24;
+}
+
 void pq_chip_arbiter_force_release(void) {
     if(!m_initialized) return;
 
-    /* 若当前持有 handle,正常 release(Deactivate 会驱 cs HIGH + 清三线). */
-    if(m_active_handle) {
-        furi_hal_spi_release(m_active_handle);
-        m_active_handle = NULL;
+    /* 独占会话兜底(正常路径下 worker 已 session_end,此处极少触发). */
+    if(m_nrf24_session) {
+        furi_hal_gpio_write(&gpio_ext_pc3, true);
+        furi_hal_gpio_write(&gpio_ext_pb2, false);
+        m_active_cs = NULL;
+        m_nrf24_session = false;
+        furi_hal_spi_release(&furi_hal_spi_bus_handle_external);
+    }
+
+    /* 若当前持有 handle,release(Deactivate 驱 PA4 HIGH + 清三线).
+     * 同时确保 PC3(NRF24 CS)回 HIGH. */
+    if(m_active_cs != NULL) {
+        furi_hal_gpio_write(&gpio_ext_pc3, true);
+        m_active_cs = NULL;
+        furi_hal_spi_release(&furi_hal_spi_bus_handle_external);
     }
 
-    /* PB2 → Analog(规范 v1.4 §2.4 退出配置).两根 CSN 由 bus_handle_deinit
-     * 在 deinit 阶段统一回 Analog. */
     furi_hal_gpio_init(&gpio_ext_pb2, GpioModeAnalog, GpioPullNo, GpioSpeedLow);
 
     m_in_callback = false;
@@ -183,9 +227,12 @@ void pq_chip_arbiter_deinit(void) {
 
     pq_chip_arbiter_force_release();
 
-    /* bus_handle_deinit 把 cs pin 回 Analog(spi_config.c:202-204). */
+    /* bus_handle_deinit 把 PA4 回 Analog. */
     furi_hal_spi_bus_handle_deinit(&furi_hal_spi_bus_handle_external);
-    furi_hal_spi_bus_handle_deinit(&furi_hal_spi_bus_handle_external_extra);
+
+    /* PC3 手工回 Analog. */
+    furi_hal_gpio_write(&gpio_ext_pc3, true);
+    furi_hal_gpio_init(&gpio_ext_pc3, GpioModeAnalog, GpioPullNo, GpioSpeedLow);
 
     m_initialized = false;
 }
diff --git a/core/pq_chip_arbiter.h b/core/pq_chip_arbiter.h
index 61c90ec..787bc15 100755
--- a/core/pq_chip_arbiter.h
+++ b/core/pq_chip_arbiter.h
@@ -73,6 +73,22 @@ bool pq_chip_with_cc1101(PqChipCallback cb, void* ctx, uint32_t timeout_ms);
  */
 void pq_chip_nrf24_ce_set(bool high);
 
+/**
+ * 独占持有 nRF24 总线的会话(huuck FlipperZeroNRFJammer 驱动模型).
+ *
+ * pq_chip_with_nrf24 是"每次回调 acquire→cb→release";会话是"acquire 一次、
+ * 整段持有",期间 CE 可持续 HIGH、总线不释放 —— 用于 jammer 恒载波/连续发射,
+ * 避免每 chunk 释放总线打断载波(实测对 nRF24L01+ 恒载波起振/维持至关重要).
+ *
+ * begin 之后,可直接调用 pq_chip_spi_trx() / pq_chip_nrf24_ce_set()(无须再包在
+ * with_nrf24 回调里).begin / end / 期间的所有访问必须在同一线程(规范 E2,
+ * FreeRTOS owner-tracked mutex).end 释放总线、CSN/CE 复位.
+ *
+ * 约束:不可与 pq_chip_with_* 嵌套;会话期间其它芯片不可访问总线.
+ */
+void pq_chip_nrf24_session_begin(void);
+void pq_chip_nrf24_session_end(void);
+
 #include <stddef.h>
 
 /**
diff --git a/core/pq_jammer_config.c b/core/pq_jammer_config.c
index 4749072..2b82d4a 100644
--- a/core/pq_jammer_config.c
+++ b/core/pq_jammer_config.c
@@ -14,7 +14,7 @@
 
 #define TAG "PqJammerCfg"
 
-#define PQ_JAMMER_FILETYPE  "PINGEQUA Jammer State"
+#define PQ_JAMMER_FILETYPE  "PINGEQUA Signal Gen State"
 #define KEY_MODE            "Mode"
 #define KEY_CW_CHANNEL      "CW Channel"
 
diff --git a/core/pq_jammer_config.h b/core/pq_jammer_config.h
index 55263a6..c91a296 100644
--- a/core/pq_jammer_config.h
+++ b/core/pq_jammer_config.h
@@ -2,8 +2,8 @@
  * @file pq_jammer_config.h
  * @brief Jammer 偏好持久化(规范 §8.2 数据目录).
  *
- * 文件路径:/ext/apps_data/pingequa/jammer.conf
- * 文件类型:PINGEQUA Jammer State (FlipperFormat 文本格式).
+ * 文件路径:/ext/apps_data/pingequa/siggen.conf
+ * 文件类型:PINGEQUA Signal Gen State (FlipperFormat 文本格式).
  *
  * v0.5.0 起记录用户上次进 jammer 的 mode + CW Custom 信道,下次进 jammer
  * 直接落到上次的状态(避免每次重选).加载失败回 default(JammerModeCwCustom @ 42).
@@ -18,7 +18,7 @@
  * 在 .c 文件里 cast (JammerMode). */
 
 #define PQ_JAMMER_CONFIG_VERSION 1
-#define PQ_JAMMER_CONFIG_PATH    "/ext/apps_data/pingequa/jammer.conf"
+#define PQ_JAMMER_CONFIG_PATH    "/ext/apps_data/pingequa/siggen.conf"
 
 typedef struct {
     uint8_t mode;       /* JammerMode 枚举值,持久化为整数 */
diff --git a/core/pq_jammer_log.c b/core/pq_jammer_log.c
index 752c082..f3bc509 100644
--- a/core/pq_jammer_log.c
+++ b/core/pq_jammer_log.c
@@ -1,12 +1,22 @@
 /**
  * @file pq_jammer_log.c
- * @brief Jammer 会话日志实现.直接 storage_file_write 写 CSV.
+ * @brief Jammer 会话日志实现.单 key,value CSV 段(无重复 # 段).
+ *
+ * v0.5.2 重构:剔除原 # 注释段 + key,value 段的 100% 数据重复(每个字段写两遍).
+ * 同时砍掉对用户无意义的字段(mode_index 内部值 / start_boot_ms / end_boot_ms),
+ * 加上真正有分析价值的字段(engine 类型 / target_freq_mhz / 按模式条件输出
+ * 的 cw_channel/cw_freq_mhz/reactive_jams).
+ *
+ * 注:scene_duration_s 是用户停留 jammer scene 的时长(含暂停空闲),**不是**
+ * 真实 TX 发射时长.真实 TX 时长需 worker 累计 active-态时间,v0.5.2 暂未做
+ * (避免动 worker 影响稳定性).
  */
 #include "pq_jammer_log.h"
 
 #include "../views/jammer_view.h" /* JammerMode 枚举与名字 */
 
 #include <furi.h>
+#include <furi_hal_rtc.h>
 #include <stdio.h>
 #include <storage/storage.h>
 
@@ -14,14 +24,53 @@
 
 static const char* mode_name_of(uint8_t idx) {
     switch(idx) {
-    case 0: return "CW Custom";
-    case 1: return "BLE Adv";
-    case 2: return "BLE React";
-    case 3: return "WiFi 1";
-    case 4: return "WiFi 6";
-    case 5: return "WiFi 11";
-    case 6: return "ALL 2.4G";
-    default: return "Unknown";
+    case JammerModeCwCustom:    return "CW Custom";
+    case JammerModeBleAdv:      return "BLE Adv";
+    case JammerModeReactiveBle: return "BLE React";
+    case JammerModeWifi1:       return "WiFi 1";
+    case JammerModeWifi6:       return "WiFi 6";
+    case JammerModeWifi11:      return "WiFi 11";
+    case JammerModeAllBand:     return "ALL 2.4G";
+    default:                    return "Unknown";
+    }
+}
+
+/* 文件名专用模式短名 — 无空格,可直接进文件名. */
+static const char* mode_shortname_of(uint8_t idx) {
+    switch(idx) {
+    case JammerModeCwCustom:    return "CWcustom";
+    case JammerModeBleAdv:      return "BLEadv";
+    case JammerModeReactiveBle: return "BLEreact";
+    case JammerModeWifi1:       return "WiFi1";
+    case JammerModeWifi6:       return "WiFi6";
+    case JammerModeWifi11:      return "WiFi11";
+    case JammerModeAllBand:     return "ALL2G4";
+    default:                    return "Unknown";
+    }
+}
+
+/* Engine 类型 —— 描述 worker 怎么干扰的(jammer_scene.c profile 表 JamEngine):
+ *   CwCustom    → CW       (单频恒载波)
+ *   ReactiveBle → Reactive (RPD 反应式)
+ *   其余        → Spam     (PayloadSpam 全段发包洪泛,v0.5.x 起) */
+static const char* mode_engine_of(uint8_t idx) {
+    if(idx == JammerModeReactiveBle) return "Reactive";
+    if(idx == JammerModeCwCustom) return "CW";
+    return "Spam";
+}
+
+/* 目标频率描述 —— 从 profile 表硬编码(jammer_scene.c:82-100 channel 集).
+ * CwCustom 返回 NULL,调用方从 app->jammer_cw_channel 推导.
+ * !! 改 profile 频率需同步更新此函数 !! */
+static const char* mode_target_freq_of(uint8_t idx) {
+    switch(idx) {
+    case JammerModeBleAdv:      return "2402/2426/2480 (BLE adv)";
+    case JammerModeReactiveBle: return "2402/2426/2480 (BLE adv)";
+    case JammerModeWifi1:       return "2401-2423 (WiFi ch1 flood)";
+    case JammerModeWifi6:       return "2426-2448 (WiFi ch6 flood)";
+    case JammerModeWifi11:      return "2451-2473 (WiFi ch11 flood)";
+    case JammerModeAllBand:     return "2400-2525 flood";
+    default:                    return NULL; /* CwCustom — 调用方推导 */
     }
 }
 
@@ -30,29 +79,61 @@ static bool write_line(File* f, const char* s) {
     return storage_file_write(f, s, (uint16_t)len) == len;
 }
 
+/* 文件名:jam_YYYY-MM-DD_HHMMSS_<mode>_<dur>s.csv.日期在前 → qFlipper 列表按名
+ * 排序即按时间排序;文件名自带模式短名 + scene 时长,无需打开即知摘要.时间戳取
+ * RTC-now ≈ 会话结束时刻(无会话起始墙钟可用).RTC 未设(year<2024)回退
+ * jam_boot<tick>_<mode>_<dur>s.csv.同秒重名加 _1.._99 后缀保唯一. */
+static void build_jammer_filename(
+    Storage* storage,
+    const DateTime* dt,
+    uint8_t mode_index,
+    uint32_t duration_ms,
+    char* path,
+    size_t path_sz) {
+    const char* mode = mode_shortname_of(mode_index);
+    unsigned long dur_s = (unsigned long)(duration_ms / 1000);
+    char base[112];
+    if(dt->year < 2024) {
+        snprintf(
+            base, sizeof(base), "%s/siggen_boot%010lu_%s_%lus", PQ_JAMMER_LOG_DIR,
+            (unsigned long)furi_get_tick(), mode, dur_s);
+    } else {
+        snprintf(
+            base, sizeof(base), "%s/siggen_%04u-%02u-%02u_%02u%02u%02u_%s_%lus",
+            PQ_JAMMER_LOG_DIR, dt->year, dt->month, dt->day, dt->hour, dt->minute,
+            dt->second, mode, dur_s);
+    }
+    snprintf(path, path_sz, "%s.csv", base);
+    for(int i = 1; i <= 99 && storage_file_exists(storage, path); i++) {
+        snprintf(path, path_sz, "%s_%d.csv", base, i);
+    }
+}
+
 bool pq_jammer_log_session(
     uint8_t mode_index,
     uint8_t cw_channel,
     uint32_t start_ms,
-    uint32_t chunks,
     uint32_t reactive_jams) {
-    /* Mode 越界保护 — 不报错,记录原始值留给分析 */
     const char* mode_name = mode_name_of(mode_index);
+    const char* engine = mode_engine_of(mode_index);
+    const char* target = mode_target_freq_of(mode_index);
 
     Storage* storage = furi_record_open(RECORD_STORAGE);
     storage_simply_mkdir(storage, "/ext/apps_data");
     storage_simply_mkdir(storage, "/ext/apps_data/pingequa");
     storage_simply_mkdir(storage, PQ_JAMMER_LOG_DIR);
 
-    char path[96];
+    DateTime dt;
+    furi_hal_rtc_get_datetime(&dt);
     uint32_t end_ms = furi_get_tick();
     uint32_t duration_ms = end_ms - start_ms;
-    snprintf(path, sizeof(path), "%s/session_%010lu.csv", PQ_JAMMER_LOG_DIR,
-             (unsigned long)start_ms);
+
+    char path[128];
+    build_jammer_filename(storage, &dt, mode_index, duration_ms, path, sizeof(path));
 
     File* file = storage_file_alloc(storage);
     bool ok = false;
-    char buf[128];
+    char buf[160];
 
     do {
         if(!storage_file_open(file, path, FSAM_WRITE, FSOM_CREATE_ALWAYS)) {
@@ -60,53 +141,64 @@ bool pq_jammer_log_session(
             break;
         }
 
-        /* 注释段 — 易读 */
-        if(!write_line(file, "# PINGEQUA RF Lab Jammer Session\n")) break;
-        snprintf(buf, sizeof(buf), "# Mode: %s\n", mode_name);
-        if(!write_line(file, buf)) break;
-        snprintf(buf, sizeof(buf), "# Mode index: %u\n", mode_index);
-        if(!write_line(file, buf)) break;
-        snprintf(buf, sizeof(buf), "# CW channel: %u (~%d MHz)\n", cw_channel,
-                 2400 + cw_channel);
-        if(!write_line(file, buf)) break;
-        snprintf(buf, sizeof(buf), "# Start boot ms: %lu\n", (unsigned long)start_ms);
-        if(!write_line(file, buf)) break;
-        snprintf(buf, sizeof(buf), "# End boot ms: %lu\n", (unsigned long)end_ms);
-        if(!write_line(file, buf)) break;
-        snprintf(buf, sizeof(buf), "# Duration ms: %lu\n", (unsigned long)duration_ms);
-        if(!write_line(file, buf)) break;
-        snprintf(buf, sizeof(buf), "# Total chunks (last run): %lu\n",
-                 (unsigned long)chunks);
-        if(!write_line(file, buf)) break;
-        if(mode_index == JammerModeReactiveBle) {
-            snprintf(buf, sizeof(buf), "# Total reactive jams: %lu\n",
-                     (unsigned long)reactive_jams);
-            if(!write_line(file, buf)) break;
-        }
+        /* 单 # 标题(便于人识别这是什么文件). */
+        if(!write_line(file, "# PINGEQUA RF Lab Signal Generator Session\n")) break;
 
-        /* CSV key,value 段 — Python pandas 可直接 read_csv */
+        /* 单一 key,value 段 — 无重复.pandas read_csv(comment='#') 直读. */
         if(!write_line(file, "key,value\n")) break;
 
-        snprintf(buf, sizeof(buf), "mode_index,%u\n", mode_index);
-        if(!write_line(file, buf)) break;
-        snprintf(buf, sizeof(buf), "mode_name,%s\n", mode_name);
-        if(!write_line(file, buf)) break;
-        snprintf(buf, sizeof(buf), "cw_channel,%u\n", cw_channel);
-        if(!write_line(file, buf)) break;
-        snprintf(buf, sizeof(buf), "start_boot_ms,%lu\n", (unsigned long)start_ms);
+        if(dt.year >= 2024) {
+            snprintf(
+                buf, sizeof(buf), "datetime,%04u-%02u-%02u %02u:%02u:%02u\n",
+                dt.year, dt.month, dt.day, dt.hour, dt.minute, dt.second);
+        } else {
+            snprintf(buf, sizeof(buf), "datetime,(RTC not set)\n");
+        }
         if(!write_line(file, buf)) break;
-        snprintf(buf, sizeof(buf), "end_boot_ms,%lu\n", (unsigned long)end_ms);
+
+        snprintf(buf, sizeof(buf), "mode,%s\n", mode_name);
         if(!write_line(file, buf)) break;
-        snprintf(buf, sizeof(buf), "duration_ms,%lu\n", (unsigned long)duration_ms);
+
+        snprintf(buf, sizeof(buf), "engine,%s\n", engine);
         if(!write_line(file, buf)) break;
-        snprintf(buf, sizeof(buf), "chunks,%lu\n", (unsigned long)chunks);
+
+        /* target_freq_mhz —— CwCustom 由 cw_channel 推导,其他模式查表. */
+        if(target != NULL) {
+            snprintf(buf, sizeof(buf), "target_freq_mhz,%s\n", target);
+        } else {
+            snprintf(
+                buf, sizeof(buf), "target_freq_mhz,%u (ch%u)\n", 2400 + cw_channel,
+                cw_channel);
+        }
         if(!write_line(file, buf)) break;
-        snprintf(buf, sizeof(buf), "reactive_jams,%lu\n", (unsigned long)reactive_jams);
+
+        /* scene_duration_s —— 一位小数,诚实标注是 scene 停留时长(非 TX 时长). */
+        uint32_t dur_int = duration_ms / 1000;
+        uint32_t dur_frac = (duration_ms % 1000) / 100;
+        snprintf(
+            buf, sizeof(buf), "scene_duration_s,%lu.%lu\n", (unsigned long)dur_int,
+            (unsigned long)dur_frac);
         if(!write_line(file, buf)) break;
 
+        /* cw_channel + cw_freq_mhz —— 仅 CwCustom 模式有意义,其他模式不写
+         * (避免重蹈 v0.5.0 把 cw_channel 对 WiFi 模式也写 "42" 的误导噪音). */
+        if(mode_index == JammerModeCwCustom) {
+            snprintf(buf, sizeof(buf), "cw_channel,%u\n", cw_channel);
+            if(!write_line(file, buf)) break;
+            snprintf(buf, sizeof(buf), "cw_freq_mhz,%u\n", 2400 + cw_channel);
+            if(!write_line(file, buf)) break;
+        }
+
+        /* reactive_jams —— 仅 BLE React 模式有意义. */
+        if(mode_index == JammerModeReactiveBle) {
+            snprintf(
+                buf, sizeof(buf), "reactive_events,%lu\n", (unsigned long)reactive_jams);
+            if(!write_line(file, buf)) break;
+        }
+
         ok = true;
-        FURI_LOG_I(TAG, "logged session: mode=%s dur=%lums chunks=%lu jams=%lu → %s",
-                   mode_name, (unsigned long)duration_ms, (unsigned long)chunks,
+        FURI_LOG_I(TAG, "logged session: mode=%s dur=%lums jams=%lu → %s",
+                   mode_name, (unsigned long)duration_ms,
                    (unsigned long)reactive_jams, path);
     } while(0);
 
diff --git a/core/pq_jammer_log.h b/core/pq_jammer_log.h
index 95d54f5..d212486 100644
--- a/core/pq_jammer_log.h
+++ b/core/pq_jammer_log.h
@@ -2,41 +2,43 @@
  * @file pq_jammer_log.h
  * @brief Jammer 会话日志 — 每次退出 jammer 自动写一条 CSV 摘要,事后分析用.
  *
- * 文件路径:/ext/apps_data/pingequa/jammer/session_<boot_ms>.csv
+ * 文件路径:/ext/apps_data/pingequa/siggen/siggen_<YYYY-MM-DD>_<HHMMSS>_<mode>_<dur>s.csv
+ *   - 日期在前 → qFlipper 文件列表按名排序即按时间排序
+ *   - 文件名带模式短名 + 会话时长(秒),无需打开即知摘要
+ *   - RTC 未设时回退 siggen_boot<tick>_<mode>_<dur>s.csv;同秒重名加 _1.._99 后缀
  *
- * 单文件格式(自描述,Excel/Python pandas 可读):
- *   # PINGEQUA RF Lab Jammer Session
- *   # Mode: BLE React
- *   # Mode index: 2
- *   # CW channel: 42
- *   # Start boot ms: 1234567
- *   # End boot ms: 1253217
- *   # Duration ms: 18650
- *   # Total chunks (last run): 477
- *   # Total reactive jams (BLE React only): 1432
+ * 单文件格式(v0.5.2 重构,无重复段;pandas read_csv(comment='#') 可直读):
+ *   # PINGEQUA RF Lab Signal Generator Session
  *   key,value
- *   mode_index,2
- *   mode_name,BLE React
- *   cw_channel,42
- *   duration_ms,18650
- *   chunks,477
- *   reactive_jams,1432
+ *   datetime,2026-05-15 14:30:22
+ *   mode,BLE React
+ *   engine,Reactive
+ *   target_freq_mhz,2402/2426/2480 (BLE adv)
+ *   scene_duration_s,9.7
+ *   reactive_events,15         ← 仅 BLE React 模式输出
+ * 或(CW Custom 模式):
+ *   ...
+ *   cw_channel,42              ← 仅 CW Custom 模式输出
+ *   cw_freq_mhz,2442           ← 仅 CW Custom 模式输出
+ *
+ * 注:scene_duration_s 是用户停留 jammer scene 的时长(含 OK 暂停期间的空闲),
+ *     **不是**真实 TX 发射时长.真实 TX 时长需 worker 累计 active 态时间,v0.5.2
+ *     暂未做(避免动 worker 影响稳定性).
  */
 #pragma once
 
 #include <stdbool.h>
 #include <stdint.h>
 
-#define PQ_JAMMER_LOG_DIR "/ext/apps_data/pingequa/jammer"
+#define PQ_JAMMER_LOG_DIR "/ext/apps_data/pingequa/siggen"
 
 /**
  * 写一条会话摘要.调用方在 jammer_scene_on_exit 自动调一次.
  *
  * @param mode_index    JammerMode 枚举值(0..6)
- * @param cw_channel    CW Custom 选定 ch(其他模式忽略,但仍记录)
- * @param start_ms      会话开始的 furi_get_tick()
- * @param chunks        worker 运行总 chunk 数
- * @param reactive_jams BLE React 模式下累计 RPD 反应次数(其他模式 = chunks)
+ * @param cw_channel    CW Custom 选定 ch(仅 CwCustom 模式被记录)
+ * @param start_ms      会话开始的 furi_get_tick()(用于计算 scene_duration_s)
+ * @param reactive_jams 仅 BLE React 模式有意义:累计 RPD 反应次数
  *
  * @return  true = 写盘成功
  */
@@ -44,5 +46,4 @@ bool pq_jammer_log_session(
     uint8_t mode_index,
     uint8_t cw_channel,
     uint32_t start_ms,
-    uint32_t chunks,
     uint32_t reactive_jams);
diff --git a/core/pq_nrf24.c b/core/pq_nrf24.c
index b555625..8cd3150 100755
--- a/core/pq_nrf24.c
+++ b/core/pq_nrf24.c
@@ -154,6 +154,12 @@ bool pq_nrf24_setup_cw(PqNrf24* dev, uint8_t ch) {
      * 典 1.5 ms,worst 4.5 ms,我们取整到 NRF24_TPD2STBY_MS = 2 ms). */
     furi_delay_ms(NRF24_TPD2STBY_MS);
 
+    /* 先清 TX FIFO —— CONT_WAVE 模式下 FIFO 里的 dummy 包不会被真正发走,反复
+     * 启停会逐次累积:第 4 次起 FIFO 满(3 包),后续 W_TX_PAYLOAD 被静默丢弃
+     * (TX_FULL),"灌 FIFO 触发辐射"这一脚踢失效 → 同一会话里测着测着就不发了
+     * (间歇性失效根因之一).setup_payload_spam / setup_reactive 同理已 flush. */
+    pq_nrf24_flush_tx(dev);
+
     /* 关键步骤:写 32 字节 dummy 0xFF 进 TX FIFO,触发 nRF24L01+ CW 实际辐射.
      * 缺这一步只配 RF_SETUP 的 CONT_WAVE+PLL_LOCK 不会出射载波(nRF24L01+
      * 变种特有的 quirk;huuck nrf24_startConstCarrier 与 RF24 Arduino 库旧版
@@ -310,10 +316,15 @@ void pq_nrf24_diag_log(PqNrf24* dev, const char* tag) {
     uint8_t fifo = pq_nrf24_read_reg(dev, NRF24_REG_FIFO_STATUS);
     uint8_t en_aa = pq_nrf24_read_reg(dev, NRF24_REG_EN_AA);
 
-    /* 预期 CW: CFG=0x72 (PWR_UP|MASK_ALL_IRQ, EN_CRC=0, PRIM_RX=0)
-     *           RF_SETUP=0x96 (CONT_WAVE|PLL_LOCK|RF_PWR=11)
-     *           EN_AA=0
-     *           FIFO_STATUS bit 5 (TX_FULL) 写 W_TX_PAYLOAD 后置 1 */
+    /* 预期值(tag="const_carrier",即 jammer_start_const_carrier 点火后,真机实测核对过):
+     *   CFG=0x02      PWR_UP=1, PRIM_RX=0(TX), EN_CRC=0(IRQ 未 mask)
+     *   RF_SETUP=0x9E CONT_WAVE|PLL_LOCK|RF_DR_HIGH(2M)|RF_PWR=11
+     *                 注:RMW (setup&0xF8) 保留了 init 的 RF_SETUP=0x0E 里的 RF_DR_HIGH,
+     *                 故是 0x9E 而非 0x96(与 huuck startConstCarrier 一致)
+     *   EN_AA=0x00
+     *   FIFO=0x01     TX_EMPTY=0(32B 0xFF 已灌,载波有源);只灌 1 slot 故 TX_FULL 仍=0
+     *   STATUS=0x0E   无残留 IRQ flag,RX FIFO 空
+     * (tag="reactive_setup" 走 setup_reactive,寄存器另一组,不适用此预期) */
     FURI_LOG_I(TAG,
                "%s diag: CFG=0x%02X RF_SETUP=0x%02X RF_CH=%u "
                "STATUS=0x%02X FIFO=0x%02X EN_AA=0x%02X",
diff --git a/core/pq_scan_export.c b/core/pq_scan_export.c
index 152222c..fa3cb22 100644
--- a/core/pq_scan_export.c
+++ b/core/pq_scan_export.c
@@ -6,6 +6,7 @@
 #include "pq_scan_export.h"
 
 #include <furi.h>
+#include <furi_hal_rtc.h>
 #include <stdio.h>
 #include <storage/storage.h>
 
@@ -18,6 +19,29 @@ static bool write_line(File* f, const char* s) {
     return storage_file_write(f, s, (uint16_t)len) == len;
 }
 
+/* 文件名优先用 RTC 墙钟:scan_YYYY-MM-DD_HHMMSS_chNN.csv.日期在前 → qFlipper
+ * 文件列表按名排序即按时间排序;文件名自带峰值通道,无需打开即知摘要.
+ * RTC 未设(year<2024)时回退 scan_bootNNNNNNNNNN_chNN.csv,避免 1970 垃圾名.
+ * 同秒重名时加 _1.._99 后缀保唯一(furi_hal_rtc_get_datetime 仅秒级精度). */
+static void build_scan_filename(
+    Storage* storage, const DateTime* dt, uint8_t peak_ch, char* path, size_t path_sz) {
+    char base[96];
+    if(dt->year < 2024) {
+        snprintf(
+            base, sizeof(base), "%s/scan_boot%010lu_ch%u", PQ_SCAN_EXPORT_DIR,
+            (unsigned long)furi_get_tick(), peak_ch);
+    } else {
+        snprintf(
+            base, sizeof(base), "%s/scan_%04u-%02u-%02u_%02u%02u%02u_ch%u",
+            PQ_SCAN_EXPORT_DIR, dt->year, dt->month, dt->day, dt->hour, dt->minute,
+            dt->second, peak_ch);
+    }
+    snprintf(path, path_sz, "%s.csv", base);
+    for(int i = 1; i <= 99 && storage_file_exists(storage, path); i++) {
+        snprintf(path, path_sz, "%s_%d.csv", base, i);
+    }
+}
+
 bool pq_scan_export_csv(
     const uint8_t* hits,
     uint8_t hits_len,
@@ -38,11 +62,12 @@ bool pq_scan_export_csv(
     storage_simply_mkdir(storage, "/ext/apps_data/pingequa");
     storage_simply_mkdir(storage, PQ_SCAN_EXPORT_DIR);
 
-    /* 文件名用 furi_get_tick() 作时间戳(boot 起的 ms 数,不是 wall-clock,
-     * 但保证文件名唯一). */
-    char path[96];
-    uint32_t ts = furi_get_tick();
-    snprintf(path, sizeof(path), "%s/scan_%010lu.csv", PQ_SCAN_EXPORT_DIR, (unsigned long)ts);
+    /* 墙钟用于文件名 + header. */
+    DateTime dt;
+    furi_hal_rtc_get_datetime(&dt);
+
+    char path[128];
+    build_scan_filename(storage, &dt, peak_ch, path, sizeof(path));
 
     File* file = storage_file_alloc(storage);
     bool ok = false;
@@ -58,7 +83,13 @@ bool pq_scan_export_csv(
         /* Header 注释行(#) — 兼容 Excel / Python pandas read_csv 的 comment 选项. */
         if(!write_line(file, "# PINGEQUA RF Lab Scanner Export\n")) break;
 
-        snprintf(buf, sizeof(buf), "# Boot ms: %lu\n", (unsigned long)ts);
+        if(dt.year >= 2024) {
+            snprintf(
+                buf, sizeof(buf), "# Datetime: %04u-%02u-%02u %02u:%02u:%02u\n",
+                dt.year, dt.month, dt.day, dt.hour, dt.minute, dt.second);
+        } else {
+            snprintf(buf, sizeof(buf), "# Datetime: (RTC not set)\n");
+        }
         if(!write_line(file, buf)) break;
 
         snprintf(buf, sizeof(buf), "# Sweep count: %u\n", sweep_count);
diff --git a/core/pq_scan_export.h b/core/pq_scan_export.h
index d4e1259..cd43ca5 100644
--- a/core/pq_scan_export.h
+++ b/core/pq_scan_export.h
@@ -3,10 +3,13 @@
  * @brief Scanner 数据 CSV 导出 — Scanner 屏长按 OK 触发,把 126 通道 hit 数 +
  *        元数据写到 SD 卡,事后用电脑/Excel 分析频谱.
  *
- * 文件路径:/ext/apps_data/pingequa/scans/scan_<timestamp_ms>.csv
+ * 文件路径:/ext/apps_data/pingequa/scans/scan_<YYYY-MM-DD>_<HHMMSS>_ch<peak>.csv
+ *   - 日期在前 → qFlipper 文件列表按名排序即按时间排序
+ *   - 文件名带峰值通道,无需打开即知摘要
+ *   - RTC 未设时回退 scan_boot<tick>_ch<peak>.csv;同秒重名加 _1.._99 后缀
  * 文件格式(自描述,不依赖 FlipperFormat,直接 CSV 标准):
  *   # PINGEQUA RF Lab Scanner Export
- *   # Boot ms: 1234567
+ *   # Datetime: 2026-05-15 14:30:22
  *   # Sweep count: 4567
  *   # Dwell us: 150
  *   # Peak channel: 42 (2442 MHz, 32 hits)
diff --git a/dist/pingequa_rf_toolkit.fap b/dist/pingequa_rf_toolkit.fap
index 5e547a2..2d60790 100644
Binary files a/dist/pingequa_rf_toolkit.fap and b/dist/pingequa_rf_toolkit.fap differ
diff --git a/dist/v0.5.1/pingequa_rf_toolkit.fap b/dist/v0.5.1/pingequa_rf_toolkit.fap
new file mode 100644
index 0000000..a80168b
Binary files /dev/null and b/dist/v0.5.1/pingequa_rf_toolkit.fap differ
diff --git a/dist/v0.5.2/pingequa_rf_toolkit.fap b/dist/v0.5.2/pingequa_rf_toolkit.fap
new file mode 100644
index 0000000..d41bf67
Binary files /dev/null and b/dist/v0.5.2/pingequa_rf_toolkit.fap differ
diff --git a/dist/v0.5.3/pingequa_rf_toolkit.fap b/dist/v0.5.3/pingequa_rf_toolkit.fap
new file mode 100644
index 0000000..dc3696d
Binary files /dev/null and b/dist/v0.5.3/pingequa_rf_toolkit.fap differ
diff --git a/docs/FAQ.md b/docs/FAQ.md
index 439c451..4b1b7a9 100644
--- a/docs/FAQ.md
+++ b/docs/FAQ.md
@@ -74,7 +74,7 @@ Not in v0.3.0. CSV export is planned for v0.4.0 — see [Roadmap](../README.md#r
 
 ### Does the Jammer work on every channel?
 
-Yes — CW (constant wave) mode allows targeting any channel 0–125 (2400–2525 MHz). Sweep mode hops through all 126 channels in chunks. Power is fixed at the NRF24L01+'s maximum +20 dBm in v0.3.0; configurable power UI is planned for v0.4.0.
+Yes — CW (constant wave) mode allows targeting any channel 0–125 (2400–2525 MHz). Sweep mode hops through all 126 channels in chunks. Output power is held at a conservative, fixed level: the firmware intentionally does not drive the radio to its electrical maximum, to keep emissions within a defensible envelope for the regulated 2.4 GHz band.
 
 ## Hardware
 
diff --git a/docs/QUICKSTART.md b/docs/QUICKSTART.md
index f65a024..8eb9028 100644
--- a/docs/QUICKSTART.md
+++ b/docs/QUICKSTART.md
@@ -29,8 +29,10 @@ ufbt launch                  # builds and launches automatically
 
 ## 2. Plug in the board
 
+> ⚠️ **Power off first.** Hot-swapping GPIO boards can damage the SPI bus on either chip.
+
 1. Power off your Flipper (hold Back ~2 seconds → Power off)
-2. Plug the PINGEQUA 2-in-1 board onto Flipper's GPIO header (the row of pins on top)
+2. Plug the PINGEQUA 2-in-1 board onto the **LEFT GPIO headers** — the 18-pin row on the top-left edge (not the right side)
 3. Power Flipper back on
 
 ## 3. Launch the app
diff --git a/docs/TROUBLESHOOTING.md b/docs/TROUBLESHOOTING.md
index f22e161..09d0b3b 100644
--- a/docs/TROUBLESHOOTING.md
+++ b/docs/TROUBLESHOOTING.md
@@ -59,6 +59,17 @@ Both chips down → board likely not connected. If only CC1101 fails but NRF24 w
 
 ## App freezes / unresponsive
 
+### Signal Generator stops responding during a long transmit run
+
+During a prolonged, high-duty continuous transmit session the 2.4 GHz radio can occasionally stop responding. Recovery:
+
+1. **Hold `Left` + `Back` together for ~5 seconds** to reboot the Flipper.
+2. Relaunch the app — your last mode/channel is restored automatically.
+
+Tips to avoid it:
+- For long, continuous use, prefer **CW Custom** (single channel) — it is the most robust mode.
+- Use the multi-channel sweep modes (BLE Adv / WiFi / ALL) in **shorter bursts** rather than leaving them running for many minutes.
+
 ### Buttons stop working after several presses
 
 **Should not happen on v0.2.0+** — fixed by worker yield + volatile `dwell_us`. If you see it:
diff --git a/images/ChannelScanner.png b/images/ChannelScanner.png
deleted file mode 100644
index 8a018de..0000000
Binary files a/images/ChannelScanner.png and /dev/null differ
diff --git a/images/NRF24Jammer.png b/images/NRF24Jammer.png
deleted file mode 100644
index 8faec63..0000000
Binary files a/images/NRF24Jammer.png and /dev/null differ
diff --git a/images/about.png b/images/about.png
new file mode 100755
index 0000000..540bac5
Binary files /dev/null and b/images/about.png differ
diff --git a/images/demo.gif b/images/demo.gif
new file mode 100644
index 0000000..3e8e71f
Binary files /dev/null and b/images/demo.gif differ
diff --git a/images/hardware_devboard.jpg b/images/hardware_devboard.jpg
old mode 100755
new mode 100644
index 8cf0f1c..a637551
Binary files a/images/hardware_devboard.jpg and b/images/hardware_devboard.jpg differ
diff --git a/images/menu.png b/images/menu.png
deleted file mode 100644
index 4068782..0000000
Binary files a/images/menu.png and /dev/null differ
diff --git a/images/photo_scanner.png b/images/photo_scanner.png
new file mode 100755
index 0000000..382db0e
Binary files /dev/null and b/images/photo_scanner.png differ
diff --git a/images/quickstart_card.png b/images/quickstart_card.png
new file mode 100644
index 0000000..9c529d0
Binary files /dev/null and b/images/quickstart_card.png differ
diff --git a/images/screen_menu.png b/images/screen_menu.png
new file mode 100644
index 0000000..f4d146c
Binary files /dev/null and b/images/screen_menu.png differ
diff --git a/images/screen_siggen.png b/images/screen_siggen.png
new file mode 100644
index 0000000..251e75f
Binary files /dev/null and b/images/screen_siggen.png differ
diff --git a/images/screenshot_scanner.png b/images/screenshot_scanner.png
deleted file mode 100644
index 842461a..0000000
Binary files a/images/screenshot_scanner.png and /dev/null differ
diff --git a/images/thirdparty_scanner_blackscreen.gif b/images/thirdparty_scanner_blackscreen.gif
new file mode 100755
index 0000000..7508c9b
Binary files /dev/null and b/images/thirdparty_scanner_blackscreen.gif differ
diff --git a/pingequa_app.c b/pingequa_app.c
index 467b2f5..a9108bd 100755
--- a/pingequa_app.c
+++ b/pingequa_app.c
@@ -22,11 +22,13 @@
 #include "core/pq_chip_arbiter.h"
 #include "core/pq_config.h"
 #include "core/pq_scene_lifecycle.h"
+#include "scenes/about_scene.h"
 #include "scenes/error_scene.h"
 #include "scenes/jammer_scene.h"
 #include "scenes/main_menu_scene.h"
 #include "scenes/scanner_scene.h"
 #include "scenes/splash_scene.h"
+#include "views/about_view.h"
 #include "views/jammer_view.h"
 #include "views/scanner_view.h"
 #include "views/splash_view.h"
@@ -48,6 +50,7 @@ static void (*const pq_scene_on_enter_handlers[PqSceneCount])(void*) = {
     [PqSceneMainMenu] = main_menu_scene_on_enter,
     [PqSceneScanner] = scanner_scene_on_enter,
     [PqSceneJammer] = jammer_scene_on_enter,
+    [PqSceneAbout] = about_scene_on_enter,
     [PqSceneError] = error_scene_on_enter,
 };
 
@@ -56,6 +59,7 @@ static bool (*const pq_scene_on_event_handlers[PqSceneCount])(void*, SceneManage
     [PqSceneMainMenu] = main_menu_scene_on_event,
     [PqSceneScanner] = scanner_scene_on_event,
     [PqSceneJammer] = jammer_scene_on_event,
+    [PqSceneAbout] = about_scene_on_event,
     [PqSceneError] = error_scene_on_event,
 };
 
@@ -64,6 +68,7 @@ static void (*const pq_scene_on_exit_handlers[PqSceneCount])(void*) = {
     [PqSceneMainMenu] = main_menu_scene_on_exit,
     [PqSceneScanner] = scanner_scene_on_exit,
     [PqSceneJammer] = jammer_scene_on_exit,
+    [PqSceneAbout] = about_scene_on_exit,
     [PqSceneError] = error_scene_on_exit,
 };
 
@@ -145,6 +150,10 @@ static PqApp* pq_app_alloc(void) {
     view_dispatcher_add_view(
         app->view_dispatcher, PqViewJammer, jammer_view_get_view(app->jammer_view));
 
+    app->about_view = about_view_alloc();
+    view_dispatcher_add_view(
+        app->view_dispatcher, PqViewAbout, about_view_get_view(app->about_view));
+
     app->error_dialog = dialog_ex_alloc();
     view_dispatcher_add_view(
         app->view_dispatcher, PqViewError, dialog_ex_get_view(app->error_dialog));
@@ -203,6 +212,10 @@ static void pq_app_free(PqApp* app) {
     jammer_view_free(app->jammer_view);
     app->jammer_view = NULL;
 
+    view_dispatcher_remove_view(app->view_dispatcher, PqViewAbout);
+    about_view_free(app->about_view);
+    app->about_view = NULL;
+
     view_dispatcher_remove_view(app->view_dispatcher, PqViewError);
     dialog_ex_free(app->error_dialog);
     app->error_dialog = NULL;
diff --git a/pingequa_app.h b/pingequa_app.h
index d794ccf..6b8bba2 100755
--- a/pingequa_app.h
+++ b/pingequa_app.h
@@ -41,6 +41,7 @@ typedef enum {
     PqSceneMainMenu, /* v1.2 起作为 splash 落地后的总入口(规范 §6.2 v1.1+ 扩展点) */
     PqSceneScanner,
     PqSceneJammer,   /* v1.2 NRF24 Jammer */
+    PqSceneAbout,    /* v0.5.2 信息屏 — 品牌 + 引流 QR + 法律声明 */
     PqSceneError,
     PqSceneCount,
 } PqScene;
@@ -51,6 +52,7 @@ typedef enum {
     PqViewMainMenu,
     PqViewScanner,
     PqViewJammer,
+    PqViewAbout,
     PqViewError,
 } PqView;
 
@@ -104,6 +106,7 @@ struct PqApp {
     Submenu* main_menu_submenu;
     struct ScannerView* scanner_view;
     struct JammerView* jammer_view;
+    struct AboutView* about_view;
     DialogEx* error_dialog;
 
     /* Splash:worker 探测线程 + UI 进度 timer. */
diff --git a/scenes/about_scene.c b/scenes/about_scene.c
new file mode 100644
index 0000000..fdacae3
--- /dev/null
+++ b/scenes/about_scene.c
@@ -0,0 +1,64 @@
+/**
+ * @file about_scene.c
+ * @brief About Scene 实现 —— 三页静态信息屏,Up/Down 翻页.
+ *
+ * on_enter 复位到首页(page=0),设 input_callback 处理 Up/Down.无 worker、
+ * 无 timer、无芯片句柄.Back 键:input_callback 不消费 → ViewDispatcher
+ * navigation 接管 → 弹回 main_menu.
+ */
+#include "about_scene.h"
+
+#include "../core/pq_scene_lifecycle.h"
+#include "../pingequa_app.h"
+#include "../views/about_view.h"
+
+#include <furi.h>
+#include <input/input.h>
+
+#define SCENE_NAME "about"
+
+/* Input 回调 — 跑在 GUI 线程.Up/Down clamp 到 [0, ABOUT_PAGE_COUNT-1],
+ * 不 wrap(到边界后按键无反应,行为更可预期).Back 返 false 交给 navigation. */
+static bool about_input_callback(InputEvent* event, void* ctx) {
+    PqApp* app = ctx;
+    if(event->type != InputTypeShort) return false;
+
+    uint8_t p = about_view_get_page(app->about_view);
+
+    if(event->key == InputKeyDown) {
+        if(p + 1 < ABOUT_PAGE_COUNT) about_view_set_page(app->about_view, p + 1);
+        return true;
+    }
+    if(event->key == InputKeyUp) {
+        if(p > 0) about_view_set_page(app->about_view, p - 1);
+        return true;
+    }
+    /* Back / OK / Left / Right 不消费. */
+    return false;
+}
+
+void about_scene_on_enter(void* context) {
+    PqApp* app = context;
+    pq_scene_enter(SCENE_NAME);
+
+    /* 复位到首页 —— 每次进 About 都从品牌+QR 页开始. */
+    about_view_set_page(app->about_view, 0);
+
+    View* v = about_view_get_view(app->about_view);
+    view_set_context(v, app);
+    view_set_input_callback(v, about_input_callback);
+
+    view_dispatcher_switch_to_view(app->view_dispatcher, PqViewAbout);
+}
+
+bool about_scene_on_event(void* context, SceneManagerEvent event) {
+    UNUSED(context);
+    UNUSED(event);
+    /* 无自定义事件;Back 由 navigation callback 处理. */
+    return false;
+}
+
+void about_scene_on_exit(void* context) {
+    UNUSED(context);
+    pq_scene_exit(SCENE_NAME);
+}
diff --git a/scenes/about_scene.h b/scenes/about_scene.h
new file mode 100644
index 0000000..6a288cf
--- /dev/null
+++ b/scenes/about_scene.h
@@ -0,0 +1,16 @@
+/**
+ * @file about_scene.h
+ * @brief About Scene.规范 §6.2(信息屏).
+ *
+ * 纯静态信息屏:品牌 + 引流 QR(pingequa.com)+ 法律声明.
+ * on_enter 只切到 about_view;无 worker、无芯片访问、无可变状态.
+ * 输入:Back 退回 main_menu —— 交给 ViewDispatcher navigation callback
+ * 自动处理,本 scene 不设 input callback、on_event 不处理任何事件.
+ */
+#pragma once
+
+#include <gui/scene_manager.h>
+
+void about_scene_on_enter(void* context);
+bool about_scene_on_event(void* context, SceneManagerEvent event);
+void about_scene_on_exit(void* context);
diff --git a/scenes/jammer_scene.c b/scenes/jammer_scene.c
index f93e1fb..680520c 100644
--- a/scenes/jammer_scene.c
+++ b/scenes/jammer_scene.c
@@ -2,25 +2,28 @@
  * @file jammer_scene.c
  * @brief NRF24 Jammer 实现.规范 §13 Phase 5 + §16.1/§16.2 + §17 反模式.
  *
- * 6 种预设(views/jammer_view.h JammerMode):
- *   CwCustom : CW @ 用户自选 ch          (CW 引擎,单 ch 静态)
- *   BleAdv   : CW hop {2, 26, 80}        (CW 引擎,3 ch 循环)
- *   Wifi1    : Spam @ NRF ch 1..23       (PayloadSpam 引擎,23 ch ±11 MHz 扫)
- *   Wifi6    : Spam @ NRF ch 26..48      (同上,中心 2437 MHz)
- *   Wifi11   : Spam @ NRF ch 51..73      (同上,中心 2462 MHz)
- *   AllBand  : CW sweep 0..125           (CW 引擎,全频)
+ * 7 种预设(views/jammer_view.h JammerMode):
+ *   CwCustom    : 恒载波 @ 用户自选 ch   (单频,信号发生器用途)
+ *   BleAdv      : 恒载波跳 {2, 26, 80}   (BLE adv 37/38/39)
+ *   ReactiveBle : RPD 反应式             (RX 监听 → 检测 → 切 TX 干扰)
+ *   Wifi1       : 恒载波跳 ch 1..23      (2401..2423 MHz)
+ *   Wifi6       : 恒载波跳 ch 26..48     (中心 2437)
+ *   Wifi11      : 恒载波跳 ch 51..73     (中心 2462)
+ *   AllBand     : 恒载波跳 0..125        (全 2.4G)
  *
- * 引擎层差异:
- *   CW          : pq_nrf24_setup_cw(RF_SETUP CONT_WAVE+PLL_LOCK + 32B 0xFF FIFO);
- *                 worker 仅每 chunk 写 RF_CH 即可换频.CE 持续 HIGH.
- *   PayloadSpam : pq_nrf24_setup_payload_spam(RF_SETUP 普通 2 Mbps);worker 每
- *                 chunk 写 RF_CH + W_TX_PAYLOAD_NOACK 32B 0xDEADBEEF×8 刷 FIFO.
+ * 驱动模型(v0.5.x 重写 — 忠实对照 huuck/FlipperZeroNRFJammer):
+ *   旧实现把每个 chunk 包进 pq_chip_with_nrf24(每次 acquire→cb→release),恒载波
+ *   被反复"释放/重夺总线"打断 → 实测真机上起振不稳定甚至完全不发.
+ *   新实现改用"独占持有总线会话"(pq_chip_nrf24_session_begin/end):OK 启动后
+ *   acquire 一次、整段持有,CE 常高;worker 在紧贴循环里只连写 RF_CH 跳频,全程
+ *   不释放总线 —— 与 huuck 的 while{for(ch) write(RF_CH)} 一致.
+ *   恒载波起振用 huuck 的"灌 32B FIFO 后再做一次 set_tx_mode(CE LOW→HIGH 二次
+ *   脉冲)"点火动作(见 jammer_start_const_carrier),旧实现只有单次 CE 上升沿.
  *
  * 线程模型(§16.1):
- *   主线程 (GUI) : jammer_input_callback 处理按键,直接写 app 字段 + 调 view setter.
- *   worker 线程  : 本地状态机 Idle ↔ Active;Active 时按 profile.engine 分支.
- *   芯片访问     : 全部经 pq_chip_with_nrf24 callback(M3/M11);CE 经
- *                  pq_chip_nrf24_ce_set(M15);单 callback ≤ 50 ms(§11.2 / M10).
+ *   主线程 (GUI) : jammer_input_callback 处理按键,只写 app 字段 + 调 view setter.
+ *   worker 线程  : 持有总线会话 + 状态机 Idle↔Active;Active 紧贴跳频/反应循环.
+ *   芯片访问     : 会话期间直接 pq_chip_spi_trx / pq_chip_nrf24_ce_set(同一线程).
  */
 #include "jammer_scene.h"
 
@@ -36,15 +39,17 @@
 
 #include <furi.h>
 #include <input/input.h>
+#include <string.h>
 
 #define TAG                    "PqJammerScene"
 #define SCENE_NAME             "jammer"
 #define WORKER_STACK           2048      /* §11.1 上限 2048 */
-#define ARBITER_TIMEOUT_MS     200       /* start/stop 容忍较长 */
-#define ARBITER_CHUNK_TIMEOUT_MS 100     /* steady-state */
+#define ARBITER_TIMEOUT_MS     200       /* cc1101 sleep / 一次性 init_regs 用 */
 #define WORKER_IDLE_YIELD_MS   50        /* idle 时让 GUI */
-#define WORKER_TICK_YIELD_MS   5         /* sweep chunk 后 yield(留 GUI 时间)  */
-#define CW_TICK_YIELD_MS       50        /* CW 模式 chunk 之间长 yield(硬件已在干扰) */
+#define CW_TICK_YIELD_MS       20        /* 单频恒载波:载波已常发,只需周期 yield 给 GUI */
+#define HOP_BATCH              128       /* 多信道:每跑 128 次 RF_CH 跳频回查停止标志
+                                          * (~5ms 一次;紧贴 huuck 的无延时跳频循环) */
+#define NRF24_CW_LEVEL_MAX     3         /* RF_PWR=11 → 0 dBm at die(PA 模块拉满) */
 
 /* 会话级统计 — Scene 单例,static 安全.
  *   start_tick           : on_enter 设当前 boot ms,on_exit 算 duration
@@ -85,19 +90,12 @@ typedef struct {
  *   BLE 39 = 2480 MHz → ch 80 */
 static const uint8_t k_ble_adv_chs[] = {2, 26, 80};
 
-/* WiFi pilot-aware 信道集(Clancy 2011 IEEE 5962467 + 7.5 dB 等效干扰增益):
- *
- * 802.11g OFDM 64 子载波,pilot 在子载波索引 ±7 和 ±21,间隔 312.5 kHz:
- *   ±7 × 312.5 kHz = ±2.2 MHz 处
- *   ±21 × 312.5 kHz = ±6.6 MHz 处
- * 这 4 个 pilot 是接收机 channel estimation / phase tracking 的锚,损坏后整
- * 个 OFDM 解调失败.NRF24 1 MHz 带宽刚好覆盖 pilot ±0.5 MHz.
- *
- * 比起盲扫整个 22 MHz WiFi 带宽 15 ch,pilot-aware 把所有能量打在 4 个最致命
- * 频点,等效干扰功率 +7.5 dB(实测 BER 0.4 阈值,Clancy 2011 paper). */
-static const uint8_t k_wifi1_pilots[]  = {5, 10, 14, 19};   /* 2405/2410/2414/2419 MHz */
-static const uint8_t k_wifi6_pilots[]  = {30, 35, 39, 44};  /* 2430/2435/2439/2444 MHz */
-static const uint8_t k_wifi11_pilots[] = {55, 60, 64, 69};  /* 2455/2460/2464/2469 MHz */
+/* WiFi 信道范围(NRF24 ch = MHz - 2400),恒载波在整段内快速跳频铺能量:
+ *   WiFi 1  → ch 1..23  (2401..2423,中心 2412 ±11)
+ *   WiFi 6  → ch 26..48 (2426..2448,中心 2437)
+ *   WiFi 11 → ch 51..73 (2451..2473,中心 2462)
+ * 用 ch_first..ch_last 连续区间表达;dwell_us/chunk_size 在恒载波驱动模型下不再
+ * 参与(跳频在持有总线的紧循环里无延时连写 RF_CH,见 jammer_const_carrier_hop_batch). */
 
 static const JammerProfile k_profiles[JammerModeCount] = {
     [JammerModeCwCustom] = {
@@ -110,8 +108,7 @@ static const JammerProfile k_profiles[JammerModeCount] = {
         .engine = JamEngineCw,
         .channels = k_ble_adv_chs, .channel_count = 3,
         .ch_first = 0, .ch_last = 0,
-        .dwell_us = 5000,    /* 5 ms / ch — 3 个 ch × 5 ms = 15ms chunk */
-        .chunk_size = 3,
+        .dwell_us = 0, .chunk_size = 1,
     },
     [JammerModeReactiveBle] = {
         /* v0.4.x:RPD 反应式 BLE — 监听 + 检测 + 反应干扰.
@@ -119,40 +116,32 @@ static const JammerProfile k_profiles[JammerModeCount] = {
         .engine = JamEngineReactive,
         .channels = k_ble_adv_chs, .channel_count = 3,
         .ch_first = 0, .ch_last = 0,
-        .dwell_us = 30000,   /* 30 ms / ch — 监听 + 反应循环上限,然后跳下个 BLE ch */
-        .chunk_size = 1,     /* 一次只在一个 ch 反应,下个 chunk 跳下个 ch */
+        .dwell_us = 30000,   /* 反应循环时间上限,逻辑在 jammer_reactive_chunk_inner 内 */
+        .chunk_size = 1,
     },
     [JammerModeWifi1] = {
-        /* v0.4.x:CW (max +20 dBm 连续) + 单 pilot/chunk + 长 dwell.
-         * 每 chunk 在 1 个 OFDM pilot 频点 sustained CW 25 ms,下个 chunk 跳下个 pilot.
-         * 每 pilot 4 个 chunk 周期内有 25% TX 占空(高于之前 payload spam 4-pilot 滚的 14%),
-         * 且 CW 能量集中在 1 MHz 带宽内,对 OFDM 单子载波损坏率最高. */
         .engine = JamEngineCw,
-        .channels = k_wifi1_pilots, .channel_count = 4,
-        .ch_first = 0, .ch_last = 0,
-        .dwell_us = 25000,               /* 1 pilot × 25 ms / chunk = 25 ms callback (§11.2 上限内) */
-        .chunk_size = 1,                 /* 每 chunk 只打 1 个 pilot,下次跳下个 */
+        .channels = NULL, .channel_count = 0,
+        .ch_first = 1, .ch_last = 23,
+        .dwell_us = 0, .chunk_size = 1,
     },
     [JammerModeWifi6] = {
         .engine = JamEngineCw,
-        .channels = k_wifi6_pilots, .channel_count = 4,
-        .ch_first = 0, .ch_last = 0,
-        .dwell_us = 25000,
-        .chunk_size = 1,
+        .channels = NULL, .channel_count = 0,
+        .ch_first = 26, .ch_last = 48,
+        .dwell_us = 0, .chunk_size = 1,
     },
     [JammerModeWifi11] = {
         .engine = JamEngineCw,
-        .channels = k_wifi11_pilots, .channel_count = 4,
-        .ch_first = 0, .ch_last = 0,
-        .dwell_us = 25000,
-        .chunk_size = 1,
+        .channels = NULL, .channel_count = 0,
+        .ch_first = 51, .ch_last = 73,
+        .dwell_us = 0, .chunk_size = 1,
     },
     [JammerModeAllBand] = {
         .engine = JamEngineCw,
         .channels = NULL, .channel_count = 0,
-        .ch_first = 0, .ch_last = 125,
-        .dwell_us = 2000,                /* 2 ms / ch CW dwell */
-        .chunk_size = 16,                /* 16 × 2ms = 32ms < 50ms 上限 */
+        .ch_first = 0, .ch_last = 125,   /* 全 2.4G ISM */
+        .dwell_us = 0, .chunk_size = 1,
     },
 };
 
@@ -176,15 +165,8 @@ static uint8_t profile_ch_at(const JammerProfile* p, uint8_t cursor) {
     return (uint8_t)(p->ch_first + (cursor % count));
 }
 
-/* 32 字节 0xDEADBEEF × 8 — Payload Spam 引擎喂 FIFO 用. */
-static const uint8_t k_spam_payload[32] = {
-    0xDE, 0xAD, 0xBE, 0xEF, 0xDE, 0xAD, 0xBE, 0xEF, 0xDE, 0xAD, 0xBE,
-    0xEF, 0xDE, 0xAD, 0xBE, 0xEF, 0xDE, 0xAD, 0xBE, 0xEF, 0xDE, 0xAD,
-    0xBE, 0xEF, 0xDE, 0xAD, 0xBE, 0xEF, 0xDE, 0xAD, 0xBE, 0xEF,
-};
-
 /* ---------------------------------------------------------------------------
- * 芯片操作回调(必须在 pq_chip_with_nrf24 内执行)
+ * 一次性回调(经 pq_chip_with_* 执行,on_enter 用)
  * --------------------------------------------------------------------------*/
 
 /* on_enter 一次性:走 baseline init_regs(含 SETUP_AW writeback 校验,确认芯片
@@ -206,61 +188,56 @@ static bool cc1101_sleep_cb(void* ctx) {
     return true;
 }
 
-/* 进入 Active:按 profile.engine 分发 setup,然后 CE high + Tstby2a wait. */
-static bool jammer_start_cb(void* ctx) {
-    PqApp* app = ctx;
-    const JammerProfile* p = profile_of(app->jammer_mode);
+/* ---------------------------------------------------------------------------
+ * 恒载波点火(独占持有会话内调用)— 忠实移植 huuck nrf24.c
+ * --------------------------------------------------------------------------*/
 
-    /* 起始确保 CE LOW(防 setup 期间发射). */
+/* huuck nrf24_set_tx_mode:CE LOW → 清 STATUS → CONFIG(PRIM_RX=0, PWR_UP) → CE HIGH.
+ * 关键是它末尾的 CE 上升沿;startConstCarrier 调两次,第二次在灌完 FIFO 后点火. */
+static void jammer_tx_mode(PqApp* app) {
     pq_chip_nrf24_ce_set(false);
+    pq_nrf24_write_reg(app->nrf, NRF24_REG_STATUS,
+                       NRF24_STATUS_MAX_RT | NRF24_STATUS_TX_DS);
+    uint8_t cfg = pq_nrf24_read_reg(app->nrf, NRF24_REG_CONFIG);
+    cfg &= (uint8_t)~NRF24_CONFIG_PRIM_RX; /* 进 TX */
+    cfg |= NRF24_CONFIG_PWR_UP;
+    pq_nrf24_write_reg(app->nrf, NRF24_REG_CONFIG, cfg);
+    pq_chip_nrf24_ce_set(true);
+}
 
-    /* 起点信道:CwCustom 用用户值,其他用 profile 第一信道. */
-    uint8_t initial_ch = (app->jammer_mode == JammerModeCwCustom)
-                             ? app->jammer_cw_channel
-                             : profile_ch_at(p, 0);
-
-    bool ok;
-    switch(p->engine) {
-    case JamEngineCw:
-        ok = pq_nrf24_setup_cw(app->nrf, initial_ch);
-        break;
-    case JamEnginePayloadSpam:
-        ok = pq_nrf24_setup_payload_spam(app->nrf, initial_ch);
-        break;
-    case JamEngineReactive:
-        ok = pq_nrf24_setup_reactive(app->nrf, initial_ch);
-        break;
-    default:
-        ok = false;
-        break;
-    }
-    if(!ok) {
-        FURI_LOG_E(TAG, "setup failed engine=%d mode=%d", (int)p->engine,
-                   (int)app->jammer_mode);
-        return false;
-    }
+/* huuck nrf24_startConstCarrier 的忠实移植(read-modify-write 配 RF_SETUP/CONFIG,
+ * 灌 32B 0xFF FIFO,再二次 set_tx_mode 点火).level=3 → RF_PWR=11 满功率. */
+static void jammer_start_const_carrier(PqApp* app, uint8_t ch, uint8_t level) {
+    PqNrf24* nrf = app->nrf;
 
-    /* CE HIGH 启动 TX. */
-    pq_chip_nrf24_ce_set(true);
+    jammer_tx_mode(app); /* set_tx_mode #1 */
 
-    /* Tstby2a = 130 µs(datasheet §6.1.7 Table 16):CE 拉高后到 PLL/PA 完全锁定. */
-    furi_delay_us(130);
+    pq_nrf24_write_reg(nrf, NRF24_REG_RF_CH, ch);
 
-    /* 诊断:回读寄存器验证 SPI 写入真生效 — 用 ufbt cli + log 命令看输出. */
-    pq_nrf24_diag_log(app->nrf, "start_cb");
+    uint8_t setup = pq_nrf24_read_reg(nrf, NRF24_REG_RF_SETUP);
+    setup = (uint8_t)((setup & 0xF8) | ((level & 0x3) << 1)); /* 置 RF_PWR */
+    pq_nrf24_write_reg(nrf, NRF24_REG_RF_SETUP, setup);
+    setup |= NRF24_RF_SETUP_CONT_WAVE | NRF24_RF_SETUP_PLL_LOCK;
+    pq_nrf24_write_reg(nrf, NRF24_REG_RF_SETUP, setup);
 
-    /* 重置 sweep 起点 + 清 dirty. */
-    app->jammer_sweep_cursor = 0;
-    app->jammer_cw_dirty = false;
-    return true;
-}
+    pq_nrf24_write_reg(nrf, NRF24_REG_EN_AA, 0x00);
 
-/* 退出 Active:CE low + PWR_DOWN. */
-static bool jammer_stop_cb(void* ctx) {
-    PqApp* app = ctx;
-    pq_chip_nrf24_ce_set(false);
-    pq_nrf24_power_down(app->nrf);
-    return true;
+    uint8_t cfg = pq_nrf24_read_reg(nrf, NRF24_REG_CONFIG);
+    cfg &= (uint8_t)~NRF24_CONFIG_EN_CRC;
+    pq_nrf24_write_reg(nrf, NRF24_REG_CONFIG, cfg);
+
+    /* 灌 FIFO 前先 flush TX:CONT_WAVE 下 dummy 包不会被真正发走,反复点火/运行中切
+     * 模式会逐次累积,第 4 次起 FIFO 满(TX_FULL),后续 W_TX_PAYLOAD 被静默丢弃 →
+     * 点火"踢一脚"失效,同一会话测着测着就不发了(间歇性失效根因;真机实测切几次后
+     * FIFO=0x21 已 TX_FULL.sibling pq_nrf24_setup_cw 早有此 flush,jammer 路径漏了). */
+    pq_nrf24_flush_tx(nrf);
+    uint8_t dummy[32];
+    memset(dummy, 0xFF, sizeof(dummy));
+    pq_nrf24_load_tx_payload(nrf, dummy, sizeof(dummy));
+
+    jammer_tx_mode(app); /* set_tx_mode #2 — 灌完 FIFO 后点火 */
+
+    pq_nrf24_diag_log(nrf, "const_carrier");
 }
 
 /* RPD 反应式 chunk(Reactive engine) — 监听 RPD,检测到载波 sustained jam 当前 ch.
@@ -332,134 +309,119 @@ static bool jammer_reactive_chunk_inner(PqApp* app, const JammerProfile* p) {
     return true;
 }
 
-/* Steady-state chunk — 按 profile 分发:
- *   CwCustom         : 仅 dirty 时写 RF_CH(用户改了 ch);callback < 1 ms
- *   其他 CW 模式     : profile.chunk_size 个 ch,每 ch 写 RF_CH + dwell_us
- *   PayloadSpam 模式 : 同上 + 每 ch 额外 W_TX_PAYLOAD_NOACK 32B 0xDEADBEEF×8
- *   Reactive 模式    : 转入 jammer_reactive_chunk_inner */
-static bool jammer_chunk_cb(void* ctx) {
-    PqApp* app = ctx;
-    const JammerProfile* p = profile_of(app->jammer_mode);
-
-    /* Reactive engine:专门走 RPD 监听+反应循环. */
+/* 进入 Active(或运行中切模式)时,按引擎在持有的会话里做一次 setup. */
+static void jammer_engine_setup(PqApp* app, JammerMode mode) {
+    const JammerProfile* p = profile_of(mode);
+    uint8_t ch0 = (mode == JammerModeCwCustom) ? app->jammer_cw_channel
+                                               : profile_ch_at(p, 0);
+    /* 重配寄存器前先 CE LOW(运行中切模式时上一引擎可能 CE 仍高). */
+    pq_chip_nrf24_ce_set(false);
     if(p->engine == JamEngineReactive) {
-        return jammer_reactive_chunk_inner(app, p);
+        pq_nrf24_setup_reactive(app->nrf, ch0);
+        pq_chip_nrf24_ce_set(true);
+        furi_delay_us(130); /* Tstby2a 进 RX */
+        pq_nrf24_diag_log(app->nrf, "reactive_setup");
+    } else {
+        jammer_start_const_carrier(app, ch0, NRF24_CW_LEVEL_MAX);
     }
+    app->jammer_sweep_cursor = 0;
+    app->jammer_cw_dirty = false;
+}
 
-    /* CwCustom 特例:静态 CW,用户调 ch 才需重写 RF_CH. */
-    if(app->jammer_mode == JammerModeCwCustom) {
-        if(app->jammer_cw_dirty) {
-            pq_nrf24_set_channel_fast(app->nrf, app->jammer_cw_channel);
-            app->jammer_cw_dirty = false;
-        }
-        return true;
+/* 恒载波运行 batch — 总线持有、CE 常高全程不打断(huuck 紧贴跳频).
+ *   CwCustom : 停在用户信道(随 ←→ 改频);载波由 CE 常高 + 会话持有维持,
+ *              这里只需周期 yield 给 GUI.
+ *   多信道   : 在信道集内无延时连写 RF_CH 跳 HOP_BATCH 次,把载波铺满整段. */
+static void jammer_const_carrier_hop_batch(PqApp* app, JammerMode mode) {
+    const JammerProfile* p = profile_of(mode);
+
+    if(mode == JammerModeCwCustom) {
+        pq_nrf24_set_channel_fast(app->nrf, app->jammer_cw_channel);
+        app->jammer_cw_dirty = false;
+        app->jammer_chunk_count++;
+        jammer_view_update_tick(app->jammer_view, app->jammer_cw_channel,
+                                app->jammer_chunk_count);
+        furi_delay_ms(CW_TICK_YIELD_MS); /* 总线持有 + CE 高 → 载波持续;仅 yield GUI */
+        return;
     }
 
-    /* 多信道模式:跑 chunk_size 个 ch. */
     uint8_t total = profile_count(p);
-    if(total == 0) return true;
+    if(total == 0) return;
 
     uint8_t cursor = app->jammer_sweep_cursor;
-    for(int i = 0; i < p->chunk_size; i++) {
-        uint8_t ch = profile_ch_at(p, cursor);
-        pq_nrf24_set_channel_fast(app->nrf, ch);
-
-        /* PayloadSpam:每 ch 重新刷 FIFO(huuck WiFi 模式同).
-         * CW 模式:FIFO 在 setup_cw 阶段已填,worker 不重写. */
-        if(p->engine == JamEnginePayloadSpam) {
-            pq_nrf24_load_tx_payload_noack(app->nrf, k_spam_payload, sizeof(k_spam_payload));
-        }
-
-        if(p->dwell_us > 0) furi_delay_us(p->dwell_us);
-
+    for(uint32_t i = 0; i < HOP_BATCH; i++) {
+        pq_nrf24_set_channel_fast(app->nrf, profile_ch_at(p, cursor));
         cursor = (uint8_t)((cursor + 1) % total);
     }
     app->jammer_sweep_cursor = cursor;
-    return true;
+    app->jammer_chunk_count++;
+
+    uint8_t prev = (cursor == 0) ? (uint8_t)(total - 1) : (uint8_t)(cursor - 1);
+    jammer_view_update_tick(app->jammer_view, profile_ch_at(p, prev),
+                            app->jammer_chunk_count);
 }
 
 /* ---------------------------------------------------------------------------
  * Worker 线程 — 本地状态机
  * --------------------------------------------------------------------------*/
 
-typedef enum {
-    JamLocalIdle,   /* CE low,PWR_DOWN — 等待 user 按 OK */
-    JamLocalActive, /* CE high,正在干扰 */
-} JamLocalState;
-
 static int32_t jammer_worker_func(void* ctx) {
     PqApp* app = ctx;
-    JamLocalState local = JamLocalIdle;
-    uint32_t chunk_n = 0;
+    bool active = false;                      /* 独占持有会话是否已开(= 正在干扰) */
+    JammerMode active_mode = JammerModeCount; /* 无效哨兵,迫使首帧 setup */
 
     while(!app->jammer_stop_requested) {
         const bool want_run = app->jammer_running;
 
-        /* 状态转换:Idle → Active. */
-        if(want_run && local == JamLocalIdle) {
-            if(pq_chip_with_nrf24(jammer_start_cb, app, ARBITER_TIMEOUT_MS)) {
-                local = JamLocalActive;
-                chunk_n = 0;
-                FURI_LOG_I(TAG, "jam start mode=%d ch=%u",
-                           (int)app->jammer_mode, app->jammer_cw_channel);
-            } else {
-                /* 启动失败 → 强制回 stopped,提示 GUI. */
-                FURI_LOG_W(TAG, "start_cb timeout/fail");
-                app->jammer_running = false;
-                jammer_view_set_running(app->jammer_view, false);
-                furi_delay_ms(WORKER_IDLE_YIELD_MS);
-            }
+        /* Idle → Active:开独占会话(acquire 一次,整段持有)+ 按模式点火. */
+        if(want_run && !active) {
+            pq_chip_nrf24_session_begin();
+            active_mode = app->jammer_mode;
+            jammer_engine_setup(app, active_mode);
+            active = true;
+            FURI_LOG_I(TAG, "jam start (held session) mode=%d ch=%u",
+                       (int)active_mode, app->jammer_cw_channel);
             continue;
         }
 
-        /* 状态转换:Active → Idle. */
-        if(!want_run && local == JamLocalActive) {
-            pq_chip_with_nrf24(jammer_stop_cb, app, ARBITER_TIMEOUT_MS);
-            local = JamLocalIdle;
-            FURI_LOG_I(TAG, "jam stop chunks=%lu", (unsigned long)chunk_n);
+        /* Active → Idle:停发 + 关会话(release 总线). */
+        if(!want_run && active) {
+            pq_chip_nrf24_ce_set(false);
+            pq_nrf24_power_down(app->nrf);
+            pq_chip_nrf24_session_end();
+            active = false;
+            FURI_LOG_I(TAG, "jam stop chunks=%lu",
+                       (unsigned long)app->jammer_chunk_count);
             continue;
         }
 
         /* Idle 等待. */
-        if(local == JamLocalIdle) {
+        if(!active) {
             furi_delay_ms(WORKER_IDLE_YIELD_MS);
             continue;
         }
 
-        /* Active steady-state:跑一个 chunk. */
-        if(!pq_chip_with_nrf24(jammer_chunk_cb, app, ARBITER_CHUNK_TIMEOUT_MS)) {
-            FURI_LOG_W(TAG, "chunk_cb timeout, retry");
-            furi_delay_ms(WORKER_IDLE_YIELD_MS);
+        /* 运行中实时切模式(↑↓ 改 app->jammer_mode):会话内重新 setup,不必停发. */
+        if(app->jammer_mode != active_mode) {
+            active_mode = app->jammer_mode;
+            jammer_engine_setup(app, active_mode);
             continue;
         }
-        chunk_n++;
-        app->jammer_chunk_count = chunk_n;
-
-        /* 推送 view tick — 多信道模式上报当前 cursor 命中位置;CwCustom 上报 user ch. */
-        const JammerProfile* p = profile_of(app->jammer_mode);
-        uint8_t cur_ch;
-        if(app->jammer_mode == JammerModeCwCustom) {
-            cur_ch = app->jammer_cw_channel;
+
+        /* Active 稳态:跑一个 batch(总线持有,CE 常高全程不打断). */
+        const JammerProfile* p = profile_of(active_mode);
+        if(p->engine == JamEngineReactive) {
+            jammer_reactive_chunk_inner(app, p);
         } else {
-            uint8_t total = profile_count(p);
-            uint8_t prev_cursor =
-                (app->jammer_sweep_cursor == 0)
-                    ? (uint8_t)(total - 1)
-                    : (uint8_t)(app->jammer_sweep_cursor - 1); /* 上一刻 */
-            cur_ch = profile_ch_at(p, prev_cursor);
+            jammer_const_carrier_hop_batch(app, active_mode);
         }
-        jammer_view_update_tick(app->jammer_view, cur_ch, chunk_n);
-
-        /* Yield(R6:每 100 ms 检查停止信号):
-         *   CwCustom : chunk 几乎瞬时 → 长 yield 不影响硬件持续发射
-         *   多信道   : chunk 已含 dwell_us×chunk_size 的 TX 时间 → 短 yield 维持高占空比 */
-        furi_delay_ms((app->jammer_mode == JammerModeCwCustom) ? CW_TICK_YIELD_MS
-                                                               : WORKER_TICK_YIELD_MS);
     }
 
-    /* 退出兜底:若仍 Active,做一次清理. */
-    if(local == JamLocalActive) {
-        pq_chip_with_nrf24(jammer_stop_cb, app, ARBITER_TIMEOUT_MS * 2);
+    /* 退出兜底:若仍持有会话,停发 + 释放. */
+    if(active) {
+        pq_chip_nrf24_ce_set(false);
+        pq_nrf24_power_down(app->nrf);
+        pq_chip_nrf24_session_end();
     }
     return 0;
 }
@@ -572,7 +534,8 @@ void jammer_scene_on_enter(void* context) {
     /* Alloc nrf24 driver(scene 拥有生命期;exit 时 free). */
     app->nrf = pq_nrf24_alloc(&app->cfg);
 
-    /* 一次性 baseline init(SETUP_AW 验证).start_cb 之后再做 CW 专属配置. */
+    /* 一次性 baseline init(SETUP_AW 验证芯片活着).真正的恒载波点火在 worker
+     * 开独占会话后做(jammer_engine_setup → jammer_start_const_carrier). */
     if(!pq_chip_with_nrf24(jammer_init_cb, app, ARBITER_TIMEOUT_MS)) {
         FURI_LOG_E(TAG, "init_regs failed; → error scene");
         scene_manager_next_scene(app->scene_manager, PqSceneError);
@@ -629,12 +592,11 @@ void jammer_scene_on_exit(void* context) {
     };
     pq_jammer_config_save(&st);
 
-    /* 4. 写本次会话日志(/ext/apps_data/pingequa/jammer/session_<ts>.csv). */
+    /* 4. 写本次会话日志(v0.5.2 重构:有意义字段集,按模式条件输出). */
     pq_jammer_log_session(
         (uint8_t)app->jammer_mode,
         app->jammer_cw_channel,
         s_jam_session.start_tick,
-        app->jammer_chunk_count,
         s_jam_session.reactive_jams_total);
 
     /* 5. View 是 app-owned,scene 不释放. */
diff --git a/scenes/main_menu_scene.c b/scenes/main_menu_scene.c
index d59e0f2..fa6d3c2 100644
--- a/scenes/main_menu_scene.c
+++ b/scenes/main_menu_scene.c
@@ -22,6 +22,7 @@
 typedef enum {
     PqMainMenuItemScanner = 0,
     PqMainMenuItemJammer,
+    PqMainMenuItemAbout,
 } PqMainMenuItem;
 
 static void main_menu_select_callback(void* context, uint32_t index) {
@@ -38,7 +39,9 @@ void main_menu_scene_on_enter(void* context) {
     submenu_set_header(sm, "PINGEQUA RF Lab");
     submenu_add_item(sm, "Channel Scanner", PqMainMenuItemScanner,
                      main_menu_select_callback, app);
-    submenu_add_item(sm, "NRF24 Jammer", PqMainMenuItemJammer,
+    submenu_add_item(sm, "NRF24 Signal Gen", PqMainMenuItemJammer,
+                     main_menu_select_callback, app);
+    submenu_add_item(sm, "About", PqMainMenuItemAbout,
                      main_menu_select_callback, app);
 
     /* 保留 Submenu 上次选中位置(scene_manager 切回时用户指针仍在原位). */
@@ -62,6 +65,9 @@ bool main_menu_scene_on_event(void* context, SceneManagerEvent event) {
         case PqMainMenuItemJammer:
             scene_manager_next_scene(app->scene_manager, PqSceneJammer);
             return true;
+        case PqMainMenuItemAbout:
+            scene_manager_next_scene(app->scene_manager, PqSceneAbout);
+            return true;
         default:
             return false;
         }
diff --git a/views/about_view.c b/views/about_view.c
new file mode 100644
index 0000000..6faeb5a
--- /dev/null
+++ b/views/about_view.c
@@ -0,0 +1,181 @@
+/**
+ * @file about_view.c
+ * @brief About 屏 View 实现 —— 三页:品牌+QR / GitHub+QR / Legal.
+ *
+ * 两块 QR(都离线生成,大写以塞 QR alphanumeric 模式;RFC 3986 URL 大小写不
+ * 敏感,浏览器扫到自动转小写):
+ *   - PINGEQUA.COM: HTTPS://PINGEQUA.COM (20 字符,version 1, 21x21, ECC-M)
+ *   - GitHub repo:  HTTPS://GITHUB.COM/PINGEQUALAB/RF-LAB (37 字符,version 2, 25x25, ECC-M)
+ * 必须带 HTTPS:// scheme —— 否则手机扫描器当纯文本不当网址跳转(开发早期踩过).
+ *
+ * 模型 page 字段只被 GUI 线程读写 → ViewModelTypeLockFree.
+ * 右边缘 1px 轨道 + 3px thumb 进度条替代原 "N/3" 文字指示(避免与 QR 重叠).
+ */
+#include "about_view.h"
+
+#include <furi.h>
+#include <gui/canvas.h>
+#include <stdlib.h>
+
+/* ---------------------------------------------------------------------------
+ * QR 数据 —— 离线 python qrcode 生成,行优先,每行 bpr 字节,MSB 先.
+ * 改 URL 需重新跑生成器并替换整块.
+ * --------------------------------------------------------------------------*/
+
+typedef struct {
+    uint8_t size; /* 模块数(每边) */
+    uint8_t bpr;  /* 每行字节数 = ceil(size/8) */
+    const uint8_t* data;
+} PqQrCode;
+
+/* HTTPS://PINGEQUA.COM: version 1, 21x21, ECC-M, 63 字节. */
+static const uint8_t pq_qr_pingequa_data[21 * 3] = {
+    0xFE, 0xF3, 0xF8, 0x82, 0x32, 0x08, 0xBA, 0xF2, 0xE8, 0xBA, 0x52, 0xE8,
+    0xBA, 0x5A, 0xE8, 0x82, 0xC2, 0x08, 0xFE, 0xAB, 0xF8, 0x00, 0x00, 0x00,
+    0xA3, 0x21, 0x28, 0x70, 0xF0, 0x28, 0x46, 0xD1, 0x50, 0x99, 0x25, 0xD0,
+    0xD3, 0x34, 0xD8, 0x00, 0x8B, 0xD8, 0xFE, 0xC4, 0xB8, 0x82, 0x4C, 0x48,
+    0xBA, 0x4E, 0xF0, 0xBA, 0x39, 0x40, 0xBA, 0xAC, 0x58, 0x82, 0x03, 0x08,
+    0xFE, 0xB4, 0x18,
+};
+static const PqQrCode pq_qr_pingequa = {21, 3, pq_qr_pingequa_data};
+
+/* HTTPS://GITHUB.COM/PINGEQUALAB/RF-LAB: version 2, 25x25, ECC-M, 100 字节. */
+static const uint8_t pq_qr_github_data[25 * 4] = {
+    0xFE, 0x74, 0xBF, 0x80, 0x82, 0xC9, 0x20, 0x80, 0xBA, 0xB9, 0xAE, 0x80,
+    0xBA, 0xCE, 0x2E, 0x80, 0xBA, 0x2E, 0xAE, 0x80, 0x82, 0x0D, 0x20, 0x80,
+    0xFE, 0xAA, 0xBF, 0x80, 0x00, 0xCD, 0x80, 0x00, 0x82, 0xDF, 0xE7, 0x00,
+    0xF9, 0x0A, 0x3E, 0x00, 0x8A, 0x4F, 0x71, 0x80, 0xD1, 0x02, 0x54, 0x00,
+    0x2A, 0x1B, 0x4F, 0x00, 0xD5, 0xAA, 0xD4, 0x00, 0xBA, 0x2E, 0x76, 0x00,
+    0x99, 0x8C, 0xDB, 0x80, 0x8A, 0x33, 0xFA, 0x80, 0x00, 0xA3, 0x8F, 0x00,
+    0xFE, 0x1D, 0xAB, 0x00, 0x82, 0x33, 0x8E, 0x00, 0xBA, 0x45, 0xF8, 0x80,
+    0xBA, 0x77, 0x63, 0x80, 0xBA, 0x42, 0xAE, 0x80, 0x82, 0x34, 0xEE, 0x00,
+    0xFE, 0xDC, 0x7D, 0x80,
+};
+static const PqQrCode pq_qr_github = {25, 4, pq_qr_github_data};
+
+typedef struct {
+    uint8_t page; /* 0..ABOUT_PAGE_COUNT-1 */
+} AboutViewModel;
+
+struct AboutView {
+    View* view;
+};
+
+/* 通用 QR 绘制 —— 逐模块放大 scale 倍.背景框架已清成白,只画黑模块. */
+static void draw_qr(Canvas* canvas, const PqQrCode* qr, int ox, int oy, int scale) {
+    canvas_set_color(canvas, ColorBlack);
+    for(int r = 0; r < qr->size; r++) {
+        const uint8_t* row = qr->data + r * qr->bpr;
+        for(int c = 0; c < qr->size; c++) {
+            if(row[c >> 3] & (0x80 >> (c & 7))) {
+                canvas_draw_box(canvas, ox + c * scale, oy + r * scale, scale, scale);
+            }
+        }
+    }
+}
+
+/* 右边缘进度条:1px 轨道竖线 + 3px 宽 thumb 表示当前页位置.
+ * 三页时 thumb 高 21px,thumb_y = page*64/3 → 0/21/42(page 2 ends at y62). */
+static void draw_scrollbar(Canvas* canvas, uint8_t page) {
+    canvas_set_color(canvas, ColorBlack);
+    canvas_draw_line(canvas, 127, 0, 127, 63);
+    int h_thumb = 64 / ABOUT_PAGE_COUNT;
+    int y_thumb = (page * 64) / ABOUT_PAGE_COUNT;
+    canvas_draw_box(canvas, 125, y_thumb, 3, h_thumb);
+}
+
+/* Page 0:品牌 + pingequa.com QR.
+ * QR 从 x84 左移到 x80 给右侧 scrollbar 让位,顺带稍微远离左侧 14 字符文本. */
+static void draw_page_brand(Canvas* canvas) {
+    canvas_set_color(canvas, ColorBlack);
+    canvas_set_font(canvas, FontPrimary);
+    canvas_draw_str_aligned(canvas, 64, 2, AlignCenter, AlignTop, "PINGEQUA RF Lab");
+    canvas_draw_line(canvas, 0, 12, 123, 12);
+
+    canvas_set_font(canvas, FontSecondary);
+    canvas_draw_str(canvas, 2, 24, "v0.5.3");
+    canvas_draw_str(canvas, 2, 34, "nRF24 + CC1101");
+    canvas_draw_str(canvas, 2, 44, "Precision Gear");
+    canvas_draw_str(canvas, 2, 53, "for Hackers");
+    canvas_draw_str(canvas, 2, 63, "pingequa.com");
+
+    draw_qr(canvas, &pq_qr_pingequa, 80, 16, 2); /* 21x21 * 2 = 42x42,x80..121 / y16..57 */
+}
+
+/* Page 1:GitHub 链接 + GitHub QR(version 2, 25x25 * 2 = 50x50px). */
+static void draw_page_code(Canvas* canvas) {
+    canvas_set_color(canvas, ColorBlack);
+    canvas_set_font(canvas, FontPrimary);
+    canvas_draw_str_aligned(canvas, 64, 2, AlignCenter, AlignTop, "GitHub");
+    canvas_draw_line(canvas, 0, 12, 123, 12);
+
+    canvas_set_font(canvas, FontSecondary);
+    canvas_draw_str(canvas, 2, 24, "Repo:");
+    canvas_draw_str(canvas, 2, 34, " pingequalab");
+    canvas_draw_str(canvas, 2, 44, " /rf-lab");
+    canvas_draw_str(canvas, 2, 61, "scan to open");
+
+    draw_qr(canvas, &pq_qr_github, 73, 13, 2); /* x73..122 / y13..62,贴近右侧 scrollbar */
+}
+
+/* Page 2:Legal —— 简洁:核心警告 + license,4 行. */
+static void draw_page_legal(Canvas* canvas) {
+    canvas_set_color(canvas, ColorBlack);
+    canvas_set_font(canvas, FontPrimary);
+    canvas_draw_str_aligned(canvas, 64, 2, AlignCenter, AlignTop, "Legal");
+    canvas_draw_line(canvas, 0, 12, 123, 12);
+
+    canvas_set_font(canvas, FontSecondary);
+    canvas_draw_str(canvas, 2, 24, "Authorized testing");
+    canvas_draw_str(canvas, 2, 34, "only. Mind local");
+    canvas_draw_str(canvas, 2, 44, "RF laws.");
+    canvas_draw_str(canvas, 2, 61, "MIT (c) PINGEQUA");
+}
+
+static void about_view_draw_callback(Canvas* canvas, void* model) {
+    AboutViewModel* m = model;
+    switch(m->page) {
+    case 0: draw_page_brand(canvas); break;
+    case 1: draw_page_code(canvas); break;
+    case 2: draw_page_legal(canvas); break;
+    default: draw_page_brand(canvas); break;
+    }
+    /* scrollbar 最后画,确保覆盖在 divider 等元素之上. */
+    draw_scrollbar(canvas, m->page);
+}
+
+AboutView* about_view_alloc(void) {
+    AboutView* av = malloc(sizeof(*av));
+    furi_check(av);
+    av->view = view_alloc();
+    view_allocate_model(av->view, ViewModelTypeLockFree, sizeof(AboutViewModel));
+    view_set_context(av->view, av);
+    view_set_draw_callback(av->view, about_view_draw_callback);
+    return av;
+}
+
+void about_view_free(AboutView* av) {
+    if(av == NULL) return;
+    view_free(av->view);
+    free(av);
+}
+
+View* about_view_get_view(AboutView* av) {
+    furi_check(av);
+    return av->view;
+}
+
+void about_view_set_page(AboutView* av, uint8_t page) {
+    furi_check(av);
+    if(page >= ABOUT_PAGE_COUNT) page = ABOUT_PAGE_COUNT - 1;
+    with_view_model(
+        av->view, AboutViewModel * m, { m->page = page; }, true);
+}
+
+uint8_t about_view_get_page(AboutView* av) {
+    furi_check(av);
+    uint8_t page = 0;
+    with_view_model(
+        av->view, AboutViewModel * m, { page = m->page; }, false);
+    return page;
+}
diff --git a/views/about_view.h b/views/about_view.h
new file mode 100644
index 0000000..e3ce229
--- /dev/null
+++ b/views/about_view.h
@@ -0,0 +1,27 @@
+/**
+ * @file about_view.h
+ * @brief About 屏自定义 View —— 三页:品牌+QR / GitHub+QR / Legal.规范 §6.2 + §12.
+ *
+ * 三页静态信息,Up/Down 翻页(由 about_scene 的 input_callback 驱动),Back 退场.
+ * 无 worker、无芯片访问.右边缘 1px 轨道 + 3px thumb 进度条指示当前页.
+ *
+ * 模型只有一个 uint8_t page,只被 GUI 线程读写 → ViewModelTypeLockFree.
+ */
+#pragma once
+
+#include <gui/view.h>
+#include <stdint.h>
+
+#define ABOUT_PAGE_COUNT 3
+
+typedef struct AboutView AboutView;
+
+AboutView* about_view_alloc(void);
+void about_view_free(AboutView* av);
+View* about_view_get_view(AboutView* av);
+
+/** 设置当前页(0..ABOUT_PAGE_COUNT-1).越界 clamp.scene on_enter 复位 0. */
+void about_view_set_page(AboutView* av, uint8_t page);
+
+/** 查询当前页 —— input_callback 翻页判边界用. */
+uint8_t about_view_get_page(AboutView* av);
diff --git a/views/jammer_view.c b/views/jammer_view.c
index 50b97b3..ea6e97d 100644
--- a/views/jammer_view.c
+++ b/views/jammer_view.c
@@ -5,9 +5,9 @@
  * draw_callback 内只读 model + canvas 调用,无计算/分配/SPI(§17.1 反模式 14).
  *
  * 屏布局(128×64):
- *   y=0..10   Header FontPrimary "JAMMER" + FontSecondary status (baseline=10)
+ *   y=0..10   Header FontPrimary "SIGNAL GEN" + FontSecondary status (baseline=10)
  *   y=12      Divider 1
- *   y=14..22  Mode FontPrimary "CW"/"SWEEP" + power FontSecondary (baseline=22)
+ *   y=14..22  Mode FontPrimary "CW"/"SWEEP" (baseline=22)
  *   y=24..32  Channel FontPrimary "Ch 042"/"0-125" + sweep cursor (baseline=32)
  *   y=34..40  Freq FontSecondary (baseline=40)
  *   y=42..48  Band tag / chunks FontSecondary (baseline=48)
@@ -17,7 +17,6 @@
  */
 #include "jammer_view.h"
 
-#include <assets_icons.h> /* I_ButtonLeft_4x7 / Right_4x7 / Up_7x4 / Down_7x4 */
 #include <furi.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -32,23 +31,62 @@
 #define WIFI_11_NRF      62 /* 2462 MHz */
 
 /* 垂直布局 — 所有 baseline 与 scanner_view 同范式(参考 views/scanner_view.c). */
-#define HDR_BASELINE     10  /* FontPrimary "JAMMER" 顶留 2 px 余量,防字顶剪 */
+#define HDR_BASELINE     10  /* FontPrimary "SIGNAL GEN" 顶留 2 px 余量,防字顶剪 */
 #define HDR_DIV_Y        12
 
 #define MODE_BASELINE    22  /* FontPrimary 大字模式 */
 #define CHAN_BASELINE    32  /* FontPrimary 信道 */
 #define FREQ_BASELINE    40  /* FontSecondary 频率 */
-#define TAG_BASELINE     48  /* FontSecondary 频段标签 / chunk 数 */
+#define TAG_BASELINE     50  /* FontSecondary 频段标签 / chunk 数(原 48,下移 2px 给
+                              * @ 字符上半部留呼吸空间,避免视觉粘连 freq 行) */
 
-#define BTM_DIV_Y        51
+#define BTM_DIV_Y        52
 #define FTR_BASELINE     62
 
-/* 按键图标尺寸常量(SDK 命名规范 _WxH). */
-#define ICON_HARROW_W    4   /* I_ButtonLeft/Right_4x7 */
+/* 按键图标尺寸常量 — 与实际绘制函数尺寸对应. */
+#define ICON_HARROW_W    4   /* draw_arrow_left/right: 4×7 */
 #define ICON_HARROW_H    7
-#define ICON_VARROW_W    7   /* I_ButtonUp/Down_7x4 */
+#define ICON_VARROW_W    7   /* draw_arrow_up/down: 7×4 */
 #define ICON_VARROW_H    4
 
+/* 4×7 左箭头 */
+static void draw_arrow_left(Canvas* canvas, int x, int y) {
+    canvas_draw_dot(canvas, x + 3, y);
+    canvas_draw_line(canvas, x + 2, y + 1, x + 3, y + 1);
+    canvas_draw_line(canvas, x + 1, y + 2, x + 3, y + 2);
+    canvas_draw_line(canvas, x,     y + 3, x + 3, y + 3);
+    canvas_draw_line(canvas, x + 1, y + 4, x + 3, y + 4);
+    canvas_draw_line(canvas, x + 2, y + 5, x + 3, y + 5);
+    canvas_draw_dot(canvas, x + 3, y + 6);
+}
+
+/* 4×7 右箭头 */
+static void draw_arrow_right(Canvas* canvas, int x, int y) {
+    canvas_draw_dot(canvas, x, y);
+    canvas_draw_line(canvas, x, y + 1, x + 1, y + 1);
+    canvas_draw_line(canvas, x, y + 2, x + 2, y + 2);
+    canvas_draw_line(canvas, x, y + 3, x + 3, y + 3);
+    canvas_draw_line(canvas, x, y + 4, x + 2, y + 4);
+    canvas_draw_line(canvas, x, y + 5, x + 1, y + 5);
+    canvas_draw_dot(canvas, x, y + 6);
+}
+
+/* 7×4 上箭头 */
+static void draw_arrow_up(Canvas* canvas, int x, int y) {
+    canvas_draw_dot(canvas,  x + 3, y);
+    canvas_draw_line(canvas, x + 2, y + 1, x + 4, y + 1);
+    canvas_draw_line(canvas, x + 1, y + 2, x + 5, y + 2);
+    canvas_draw_line(canvas, x,     y + 3, x + 6, y + 3);
+}
+
+/* 7×4 下箭头 */
+static void draw_arrow_down(Canvas* canvas, int x, int y) {
+    canvas_draw_line(canvas, x,     y,     x + 6, y);
+    canvas_draw_line(canvas, x + 1, y + 1, x + 5, y + 1);
+    canvas_draw_line(canvas, x + 2, y + 2, x + 4, y + 2);
+    canvas_draw_dot(canvas,  x + 3, y + 3);
+}
+
 /* ---------------------------------------------------------------------------
  * Model
  * --------------------------------------------------------------------------*/
@@ -97,9 +135,9 @@ static const char* mode_chan_label(JammerMode m) {
     switch(m) {
     case JammerModeBleAdv:      return "Adv 37/38/39";
     case JammerModeReactiveBle: return "RPD 37/38/39";
-    case JammerModeWifi1:       return "Pilots ×4";
-    case JammerModeWifi6:       return "Pilots ×4";
-    case JammerModeWifi11:      return "Pilots ×4";
+    case JammerModeWifi1:       return "Flood 1-23";
+    case JammerModeWifi6:       return "Flood 26-48";
+    case JammerModeWifi11:      return "Flood 51-73";
     case JammerModeAllBand:     return "Ch 0-125";
     default:                    return NULL;
     }
@@ -109,10 +147,10 @@ static const char* mode_chan_label(JammerMode m) {
 static const char* mode_freq_label(JammerMode m) {
     switch(m) {
     case JammerModeBleAdv:      return "2402/26/80 MHz";
-    case JammerModeReactiveBle: return "Listen+jam";
-    case JammerModeWifi1:       return "2412 \xb1 OFDM";
-    case JammerModeWifi6:       return "2437 \xb1 OFDM";
-    case JammerModeWifi11:      return "2462 \xb1 OFDM";
+    case JammerModeReactiveBle: return "Listen+TX";
+    case JammerModeWifi1:       return "2412 \xb1 11MHz";
+    case JammerModeWifi6:       return "2437 \xb1 11MHz";
+    case JammerModeWifi11:      return "2462 \xb1 11MHz";
     case JammerModeAllBand:     return "2400-2525 MHz";
     default:                    return NULL;
     }
@@ -130,7 +168,7 @@ static void jammer_view_draw_callback(Canvas* canvas, void* _model) {
 
     /* === Header === */
     canvas_set_font(canvas, FontPrimary);
-    canvas_draw_str(canvas, 0, HDR_BASELINE, "JAMMER");
+    canvas_draw_str(canvas, 0, HDR_BASELINE, "SIGNAL GEN");
 
     canvas_set_font(canvas, FontSecondary);
     const char* status = m->running ? "RUN" : "STOP";
@@ -141,10 +179,7 @@ static void jammer_view_draw_callback(Canvas* canvas, void* _model) {
     /* === Mode (FontPrimary 大字) === */
     canvas_set_font(canvas, FontPrimary);
     canvas_draw_str(canvas, 0, MODE_BASELINE, mode_label(m->mode));
-
-    /* 右侧:+20 dBm 固定标(规范 §3.2 决策表) */
-    canvas_set_font(canvas, FontSecondary);
-    canvas_draw_str_aligned(canvas, 127, MODE_BASELINE, AlignRight, AlignBottom, "+20dBm");
+    /* 不在屏上标功率值(避免 overclaim;输出功率出于合规保守,不声明具体 dBm). */
 
     /* === Channel / Range (FontPrimary)=== */
     canvas_set_font(canvas, FontPrimary);
@@ -193,24 +228,24 @@ static void jammer_view_draw_callback(Canvas* canvas, void* _model) {
     if(m->mode == JammerModeCwCustom) {
         /* CwCustom 才显示左右箭头(只有它能用 ←→ 调信道):
          * [<][>] Ch  [^][v] Mode  OK Run */
-        canvas_draw_icon(canvas, x, hy, &I_ButtonLeft_4x7);
+        draw_arrow_left(canvas, x, hy);
         x += ICON_HARROW_W + 1;
-        canvas_draw_icon(canvas, x, hy, &I_ButtonRight_4x7);
+        draw_arrow_right(canvas, x, hy);
         x += ICON_HARROW_W + 2;
         canvas_draw_str(canvas, x, FTR_BASELINE, "Ch");
         x += canvas_string_width(canvas, "Ch") + 4;
 
-        canvas_draw_icon(canvas, x, vy, &I_ButtonUp_7x4);
+        draw_arrow_up(canvas, x, vy);
         x += ICON_VARROW_W + 1;
-        canvas_draw_icon(canvas, x, vy, &I_ButtonDown_7x4);
+        draw_arrow_down(canvas, x, vy);
         x += ICON_VARROW_W + 2;
         canvas_draw_str(canvas, x, FTR_BASELINE, "Mode");
         x += canvas_string_width(canvas, "Mode") + 4;
     } else {
         /* [^][v] Mode  OK Run */
-        canvas_draw_icon(canvas, x, vy, &I_ButtonUp_7x4);
+        draw_arrow_up(canvas, x, vy);
         x += ICON_VARROW_W + 1;
-        canvas_draw_icon(canvas, x, vy, &I_ButtonDown_7x4);
+        draw_arrow_down(canvas, x, vy);
         x += ICON_VARROW_W + 2;
         canvas_draw_str(canvas, x, FTR_BASELINE, "Mode");
         x += canvas_string_width(canvas, "Mode") + 4;
diff --git a/views/jammer_view.h b/views/jammer_view.h
index 3f2f45b..4a88481 100644
--- a/views/jammer_view.h
+++ b/views/jammer_view.h
@@ -3,7 +3,7 @@
  * @brief NRF24 Jammer 自定义 View(规范 §6.2 v1.2 + §12).
  *
  * 屏布局(128×64):
- *   y=0..7    Header — "JAMMER" + RUN/STOP 状态右对齐
+ *   y=0..7    Header — "SIGNAL GEN" + RUN/STOP 状态右对齐
  *   y=8       Divider 1
  *   y=10..20  Mode 大字:"CW" 或 "SWEEP"
  *   y=22..32  信道/范围:"Ch 042" 或 "0-125"