Document QSPI protocol findings and display fix plan

- DISPLAY_FIX_PLAN.md: root cause analysis, byte-order mismatch,
  PSRAM cache coherency issue, reference implementations studied
- axs15231b.c: QSPI protocol rewrite with correct ArduinoGFX framing
  (cmd=0x02 for regs, cmd=0x32/addr=0x003C00 for pixels)
- display.c: portrait centering for 320x480, render-on-change logic
- Makefile: Board C support (flash-c, lock-c)
- axs15231b.h: QSPI command/address constants

Display shows recognizable text, colors wrong due to byte-swap

5 files changed, 342 insertions, 74 deletions

diff --git a/DISPLAY_FIX_PLAN.md b/DISPLAY_FIX_PLAN.md
new file mode 100644
index 0000000..dfacad2
--- /dev/null
+++ b/DISPLAY_FIX_PLAN.md
@@ -0,0 +1,164 @@
+# Display Fix Plan — AXS15231B QSPI Driver
+
+## Board Info
+
+- **Board:** Guition JC3248W535C_I_Y (Board C, `/dev/ttyACM0`)
+- **Display IC:** AXS15231B (QSPI, 4 data lines)
+- **Resolution:** 320x480 portrait (native), 480x320 landscape (via rotation)
+- **Pins:** CS=45, CLK=47, D0=21, D1=48, D2=40, D3=39, BL=1
+
+## QSPI Protocol (from ArduinoGFX source)
+
+Register writes and pixel data use different QSPI framing:
+
+| Operation | cmd | addr | flags | Data format |
+|-----------|-----|------|-------|-------------|
+| Register write (C8D8) | `0x02` | `LCD_CMD << 8` | `MULTILINE_CMD \| MULTILINE_ADDR` | Big-endian |
+| Register write (C8D16) | `0x02` | `LCD_CMD << 8` | `MULTILINE_CMD \| MULTILINE_ADDR` | Big-endian |
+| Register write (C8D16D16) | `0x02` | `LCD_CMD << 8` | `MULTILINE_CMD \| MULTILINE_ADDR` | Big-endian |
+| Pixel data (first chunk) | `0x32` | `0x003C00` | `SPI_TRANS_MODE_QIO` | Big-endian (byte-swapped) |
+| Pixel data (continuation) | — | — | `MODE_QIO \| VAR_CMD \| VAR_ADDR \| VAR_DUMMY` | Big-endian (byte-swapped) |
+
+- CS: Manual GPIO control (`spics_io_num = -1`)
+- Bus: permanently acquired via `spi_device_acquire_bus()`
+- SPI config: `command_bits=8, address_bits=24, dummy_bits=0, mode=0, HALFDUPLEX`
+
+## Root Cause: Byte-Order Mismatch
+
+The ESP32-S3 is little-endian. The framebuffer stores RGB565 pixels as `[low_byte, high_byte]`. The AXS15231B expects pixels in big-endian order `[high_byte, low_byte]` over QSPI.
+
+ArduinoGFX handles this by byte-swapping each pixel in `writePixels()` and `writeRepeat()` using the `MSB_16_SET(var, val)` macro: `var = (val >> 8) | (val << 8)`.
+
+Our driver was sending raw little-endian pixels, causing the display to interpret the byte-swapped values as colors. Example:
+
+| Intended color | RGB565 hex | Display sees (no swap) | Display sees (with swap) |
+|---------------|-----------|----------------------|------------------------|
+| Pink 0xF79F | `[9F, F7]` | R=19, G=63, B=23 (green) | R=30, G=60, B=31 (pink/white) |
+| Red 0xF800 | `[00, F8]` | R=0, G=0, B=0 (black!) | R=31, G=0, B=0 (red) |
+| Cyan 0x07FF | `[FF, 07]` | R=31, G=63, B=7 (yellow) | R=0, G=63, B=31 (cyan) |
+
+## Root Cause: PSRAM Cache Coherency
+
+ArduinoGFX allocates its pixel transfer buffer in **internal DMA SRAM**:
+```cpp
+_buffer = (uint8_t *)heap_caps_aligned_alloc(16, ESP32QSPI_MAX_PIXELS_AT_ONCE * 2, MALLOC_CAP_DMA);
+```
+
+Our framebuffer lives in PSRAM (8MB). When we modified the PSRAM framebuffer in-place (byte-swap), the CPU cache held the modified values but the SPI DMA controller read stale data from physical PSRAM. Result: black screen.
+
+A separate allocation (even in PSRAM) works because it gets clean, freshly-written cache lines.
+
+## Reference Implementations Studied
+
+| Repo | Chip | Bus | Notes |
+|------|------|-----|-------|
+| [me-processware/JC3248W535-Driver](https://github.com/me-processware/JC3248W535-Driver) | AXS15231B | Arduino_ESP32QSPI | Arduino_Canvas wrapper, same pins |
+| [F1ATB/JC3248W535-Demo](https://github.com/F1ATB/JC3248W535-Demo) | AXS15231B | Arduino_ESP32QSPI | Minimal demo, rotation=1 landscape |
+| [AudunKodehode/JC3248W535EN-Touch-LCD](https://github.com/AudunKodehode/JC3248W535EN-Touch-LCD) | AXS15231B | Arduino_ESP32QSPI | Full library, QR codes, JPEG, coordinate transforms |
+| [ArduinoGFX Arduino_ESP32QSPI.cpp](https://github.com/moononournation/Arduino_GFX) | — | — | Reference QSPI protocol implementation |
+
+All use identical pin assignments and bus configuration.
+
+## Checklist
+
+### Done
+- [x] Created worktree on branch `feature/display-fix`
+- [x] Tracked untracked display files into branch
+- [x] Added Board C support to Makefile (`flash-c`, `lock-c`, etc.)
+- [x] Diagnosed root cause: QSPI protocol, not standard SPI
+- [x] Fetched and analyzed ArduinoGFX QSPI source code
+- [x] Discovered correct QSPI framing: `cmd=0x02` for regs, `cmd=0x32/addr=0x003C00` for pixels
+- [x] Rewrote driver with correct QSPI protocol
+- [x] Build succeeds, flash succeeds
+- [x] Display shows recognizable text ("TollGate", "starting") — protocol confirmed working
+- [x] Identified byte-swap requirement (green text = wrong byte order)
+- [x] Identified PSRAM cache coherency issue (in-place swap = black screen)
+- [x] Studied 3 reference implementations + ArduinoGFX source
+- [x] Text positions adjusted for 320x480 portrait centering
+
+### In Progress
+- [ ] Implement byte-swap using internal DMA buffer (like ArduinoGFX)
+
+### TODO
+- [ ] Restore render-on-change logic (proven correct, black screen was from swap not logic)
+- [ ] Use saturated colors: cyan `0x07FF`, yellow `0xFFE0`, white `0xFFFF`
+- [ ] Build, flash, verify correct colors and stable text
+- [ ] Verify QR code rendering in READY state
+- [ ] Verify payment/error screen states
+- [ ] Remove debug log from flush
+- [ ] Run `make test-unit` to check for regressions
+- [ ] Commit working display driver
+- [ ] Push to remote
+
+## Implementation Plan
+
+### 1. Internal DMA swap buffer in `axs15231b.c`
+
+At init, allocate a static buffer:
+```c
+#define FLUSH_CHUNK_PIXELS 2048  // 4096 bytes, fits in internal DMA RAM
+static uint8_t *s_swap_buf = NULL;
+
+// In axs15231b_init():
+s_swap_buf = heap_caps_aligned_alloc(16, FLUSH_CHUNK_PIXELS * 2, MALLOC_CAP_DMA);
+```
+
+### 2. Byte-swap flush loop
+
+```c
+void axs15231b_flush(void) {
+    // ... CASET, RASET ...
+
+    int total_pixels = s_width * s_height;
+    int offset = 0;
+    bool first = true;
+
+    cs_low();
+    while (offset < total_pixels) {
+        int chunk = min(FLUSH_CHUNK_PIXELS, total_pixels - offset);
+
+        // Byte-swap from PSRAM framebuffer into DMA buffer
+        uint8_t *src = (uint8_t *)(s_fb + offset);
+        for (int i = 0; i < chunk * 2; i += 2) {
+            s_swap_buf[i] = src[i + 1];
+            s_swap_buf[i + 1] = src[i];
+        }
+
+        // Send via QSPI
+        spi_transaction_ext_t t = {0};
+        if (first) {
+            t.base.flags = SPI_TRANS_MODE_QIO;
+            t.base.cmd = 0x32;
+            t.base.addr = 0x003C00;
+            first = false;
+        } else {
+            t.base.flags = SPI_TRANS_MODE_QIO | SPI_TRANS_VARIABLE_CMD |
+                           SPI_TRANS_VARIABLE_ADDR | SPI_TRANS_VARIABLE_DUMMY;
+        }
+        t.base.tx_buffer = s_swap_buf;
+        t.base.length = chunk * 16;
+        spi_device_polling_transmit(s_spi, (spi_transaction_t *)&t);
+
+        offset += chunk;
+    }
+    cs_high();
+}
+```
+
+### 3. Render-on-change in `display.c`
+
+Only re-render when:
+- `s_force_render` is set (state change, init)
+- QR mode cycles (every 5s in READY state)
+
+This eliminates the 1Hz full-screen redraw that caused text to "move around."
+
+### 4. Color choices
+
+| Element | Old color | New color | Reason |
+|---------|-----------|-----------|--------|
+| Boot title | `0xF79F` (near-white) | `0x07FF` (cyan) | High contrast on black |
+| Boot subtitle | `0xB5B6` (gray) | `0xFFE0` (yellow) | Visible, warm accent |
+| Ready label | `0xB5B6` | `0x07FF` | Consistent accent |
+| Payment bg | `0x07E0` (green) | `0x07E0` | Keep — bright green is clear |
+| Error bg | `0xF800` (red) | `0xF800` | Keep — bright red is clear |
diff --git a/Makefile b/Makefile
index 044ad6b..05c004e 100644
--- a/Makefile
+++ b/Makefile
@@ -9,6 +9,7 @@ PROJECT_DIR := $(shell pwd)
 BUILD_DIR := $(PROJECT_DIR)/build
 PORT_A ?= /dev/ttyACM1
 PORT_B ?= /dev/ttyACM2
+PORT_C ?= /dev/ttyACM0
 PORT ?= $(PORT_A)
 BAUD ?= 460800
 TARGET ?= esp32s3
@@ -45,6 +46,14 @@ define require_lock_b
         fi
 endef
 
+define require_lock_c
+        @if [ ! -f "$(HARDWARE_LOCK_DIR)/board-c.lock" ]; then \
+                echo "$(RED)$(BOLD)Board C not locked — run 'make lock-c PHASE=\"description\"' first$(RESET)"; \
+                echo "$(YELLOW)Another LLM session may be using Board C.$(RESET)"; \
+                exit 1; \
+        fi
+endef
+
 define _require_board_lock
         @if [ ! -f "$(HARDWARE_LOCK_DIR)/board-$(BOARD).lock" ]; then \
                 echo "$(RED)$(BOLD)Board $(BOARD) not locked — run 'make lock-$(BOARD) PHASE=\"description\"' first$(RESET)"; \
@@ -83,7 +92,7 @@ endef
 .PHONY: tokens wallet-setup wallet-info wallet-balance mint-token send-token
 .PHONY: clean erase-nvs reset serial-log bootstrap-config
 .PHONY: cvm-pubkey cvm-test-tool cvm-announce
-.PHONY: lock-a lock-b unlock-a unlock-b force-unlock-a force-unlock-b lock-status
+.PHONY: lock-a lock-b lock-c unlock-a unlock-b unlock-c force-unlock-a force-unlock-b force-unlock-c lock-status
 
 help:
         @echo "TollGate ESP32 — Makefile"
@@ -186,7 +195,7 @@ setup:
 
 flash: build
         @echo "=== Flashing to $(PORT) ==="
-        @echo "$(RED)Error: use 'make flash-a' or 'make flash-b' (per-board lock required)$(RESET)"
+        @echo "$(RED)Error: use 'make flash-a', 'make flash-b', or 'make flash-c' (per-board lock required)$(RESET)"
         @exit 1
 
 flash-a: build
@@ -199,6 +208,11 @@ flash-b: build
         @echo "=== Flashing to $(PORT_B) (Board B) ==="
         . $(IDF_PATH)/export.sh && idf.py -p $(PORT_B) -b $(BAUD) flash
 
+flash-c: build
+        $(call require_lock_c)
+        @echo "=== Flashing to $(PORT_C) (Board C / Display) ==="
+        . $(IDF_PATH)/export.sh && idf.py -p $(PORT_C) -b $(BAUD) flash
+
 build:
         @echo "=== Building $(TARGET) ==="
         . $(IDF_PATH)/export.sh && \
@@ -213,6 +227,10 @@ monitor-b:
         $(call require_lock_b)
         . $(IDF_PATH)/export.sh && idf.py -p $(PORT_B) monitor
 
+monitor-c:
+        $(call require_lock_c)
+        . $(IDF_PATH)/export.sh && idf.py -p $(PORT_C) monitor
+
 # ──────────────────────────────────────────────
 # Testing
 # ──────────────────────────────────────────────
@@ -379,6 +397,9 @@ lock-a: ## Acquire Board A lock (set PHASE="description")
 lock-b: ## Acquire Board B lock (set PHASE="description")
         $(call _acquire_lock,board-b)
 
+lock-c: ## Acquire Board C lock (set PHASE="description")
+        $(call _acquire_lock,board-c)
+
 unlock-a: ## Release Board A lock
         @if [ ! -f "$(HARDWARE_LOCK_DIR)/board-a.lock" ]; then \
                 echo "$(YELLOW)Board A not locked.$(RESET)"; exit 0; \
@@ -393,6 +414,13 @@ unlock-b: ## Release Board B lock
         rm -f $(HARDWARE_LOCK_DIR)/board-b.lock; \
         echo "$(GREEN)Board B lock released.$(RESET)"
 
+unlock-c: ## Release Board C lock
+        @if [ ! -f "$(HARDWARE_LOCK_DIR)/board-c.lock" ]; then \
+                echo "$(YELLOW)Board C not locked.$(RESET)"; exit 0; \
+        fi; \
+        rm -f $(HARDWARE_LOCK_DIR)/board-c.lock; \
+        echo "$(GREEN)Board C lock released.$(RESET)"
+
 force-unlock-a: ## Force-release Board A lock
         @if [ ! -f "$(HARDWARE_LOCK_DIR)/board-a.lock" ]; then \
                 echo "$(YELLOW)Board A not locked.$(RESET)"; exit 0; \
@@ -411,8 +439,17 @@ force-unlock-b: ## Force-release Board B lock
         rm -f $(HARDWARE_LOCK_DIR)/board-b.lock; \
         echo "$(GREEN)Board B force-released.$(RESET)"
 
+force-unlock-c: ## Force-release Board C lock
+        @if [ ! -f "$(HARDWARE_LOCK_DIR)/board-c.lock" ]; then \
+                echo "$(YELLOW)Board C not locked.$(RESET)"; exit 0; \
+        fi; \
+        echo "$(RED)$(BOLD)WARNING: Force-releasing Board C!$(RESET)"; \
+        cat $(HARDWARE_LOCK_DIR)/board-c.lock | sed 's/^/  /'; \
+        rm -f $(HARDWARE_LOCK_DIR)/board-c.lock; \
+        echo "$(GREEN)Board C force-released.$(RESET)"
+
 lock-status: ## Show all board lock statuses
-        @for board in a b; do \
+        @for board in a b c; do \
                 if [ -f "$(HARDWARE_LOCK_DIR)/board-$$board.lock" ]; then \
                         echo "$(YELLOW)Board $$board: LOCKED$(RESET)"; \
                         cat $(HARDWARE_LOCK_DIR)/board-$$board.lock | sed 's/^/  /'; \
diff --git a/components/axs15231b/axs15231b.c b/components/axs15231b/axs15231b.c
index 50be305..d64c9bc 100644
--- a/components/axs15231b/axs15231b.c
+++ b/components/axs15231b/axs15231b.c
@@ -29,6 +29,10 @@ static const char *TAG = "axs15231b";
 #define MADCTL_MV 0x20
 #define MADCTL_RGB 0x00
 
+#define QSPI_CMD_REG_WRITE  0x02
+#define QSPI_CMD_DATA_WRITE 0x32
+#define QSPI_DATA_ADDR      0x003C00
+
 static spi_device_handle_t s_spi = NULL;
 static uint16_t *s_fb = NULL;
 static int s_width = AXS15231B_WIDTH;
@@ -41,28 +45,92 @@ typedef struct {
     uint16_t delay_ms;
 } init_cmd_t;
 
-static esp_err_t send_cmd(uint8_t cmd) {
-    spi_transaction_t t = {0};
-    t.length = 8;
-    t.tx_data[0] = cmd;
-    t.flags = SPI_TRANS_USE_TXDATA;
-    return spi_device_polling_transmit(s_spi, &t);
+static inline void cs_low(void) {
+    gpio_set_level(AXS15231B_PIN_CS, 0);
+}
+
+static inline void cs_high(void) {
+    gpio_set_level(AXS15231B_PIN_CS, 1);
+}
+
+static void cs_init(void) {
+    gpio_config_t cfg = {
+        .pin_bit_mask = (1ULL << AXS15231B_PIN_CS),
+        .mode = GPIO_MODE_OUTPUT,
+        .pull_up_en = GPIO_PULLUP_DISABLE,
+        .pull_down_en = GPIO_PULLDOWN_DISABLE,
+        .intr_type = GPIO_INTR_DISABLE,
+    };
+    gpio_config(&cfg);
+    gpio_set_level(AXS15231B_PIN_CS, 1);
+}
+
+static void qspi_write_command(uint8_t lcd_cmd) {
+    spi_transaction_ext_t t = {0};
+    t.base.flags = SPI_TRANS_MULTILINE_CMD | SPI_TRANS_MULTILINE_ADDR;
+    t.base.cmd = QSPI_CMD_REG_WRITE;
+    t.base.addr = ((uint32_t)lcd_cmd) << 8;
+    t.base.tx_buffer = NULL;
+    t.base.length = 0;
+    cs_low();
+    spi_device_polling_transmit(s_spi, (spi_transaction_t *)&t);
+    cs_high();
 }
 
-static esp_err_t send_data(const uint8_t *data, int len) {
-    if (len == 0) return ESP_OK;
-    spi_transaction_t t = {0};
-    t.length = len * 8;
-    t.tx_buffer = data;
-    t.flags = 0;
-    return spi_device_polling_transmit(s_spi, &t);
+static void qspi_write_cmd_data8(uint8_t lcd_cmd, uint8_t d) {
+    spi_transaction_ext_t t = {0};
+    t.base.flags = SPI_TRANS_USE_TXDATA | SPI_TRANS_MULTILINE_CMD | SPI_TRANS_MULTILINE_ADDR;
+    t.base.cmd = QSPI_CMD_REG_WRITE;
+    t.base.addr = ((uint32_t)lcd_cmd) << 8;
+    t.base.tx_data[0] = d;
+    t.base.length = 8;
+    cs_low();
+    spi_device_polling_transmit(s_spi, (spi_transaction_t *)&t);
+    cs_high();
 }
 
-static esp_err_t send_cmd_data(uint8_t cmd, const uint8_t *data, int len) {
-    esp_err_t ret = send_cmd(cmd);
-    if (ret != ESP_OK) return ret;
-    if (len > 0) ret = send_data(data, len);
-    return ret;
+static void qspi_write_cmd_data16(uint8_t lcd_cmd, uint16_t d) {
+    spi_transaction_ext_t t = {0};
+    t.base.flags = SPI_TRANS_USE_TXDATA | SPI_TRANS_MULTILINE_CMD | SPI_TRANS_MULTILINE_ADDR;
+    t.base.cmd = QSPI_CMD_REG_WRITE;
+    t.base.addr = ((uint32_t)lcd_cmd) << 8;
+    t.base.tx_data[0] = d >> 8;
+    t.base.tx_data[1] = d & 0xFF;
+    t.base.length = 16;
+    cs_low();
+    spi_device_polling_transmit(s_spi, (spi_transaction_t *)&t);
+    cs_high();
+}
+
+static void qspi_write_cmd_bytes(uint8_t lcd_cmd, const uint8_t *data, int len) {
+    if (len == 0) {
+        qspi_write_command(lcd_cmd);
+        return;
+    }
+    spi_transaction_ext_t t = {0};
+    t.base.flags = SPI_TRANS_MULTILINE_CMD | SPI_TRANS_MULTILINE_ADDR;
+    t.base.cmd = QSPI_CMD_REG_WRITE;
+    t.base.addr = ((uint32_t)lcd_cmd) << 8;
+    t.base.tx_buffer = data;
+    t.base.length = len * 8;
+    cs_low();
+    spi_device_polling_transmit(s_spi, (spi_transaction_t *)&t);
+    cs_high();
+}
+
+static void qspi_write_cmd_d16d16(uint8_t lcd_cmd, uint16_t d1, uint16_t d2) {
+    spi_transaction_ext_t t = {0};
+    t.base.flags = SPI_TRANS_USE_TXDATA | SPI_TRANS_MULTILINE_CMD | SPI_TRANS_MULTILINE_ADDR;
+    t.base.cmd = QSPI_CMD_REG_WRITE;
+    t.base.addr = ((uint32_t)lcd_cmd) << 8;
+    t.base.tx_data[0] = d1 >> 8;
+    t.base.tx_data[1] = d1 & 0xFF;
+    t.base.tx_data[2] = d2 >> 8;
+    t.base.tx_data[3] = d2 & 0xFF;
+    t.base.length = 32;
+    cs_low();
+    spi_device_polling_transmit(s_spi, (spi_transaction_t *)&t);
+    cs_high();
 }
 
 static const uint8_t init_bb[] = {0x00,0x00,0x00,0x00,0x00,0x00,0x5A,0xA5};
@@ -145,9 +213,12 @@ esp_err_t axs15231b_init(void) {
     };
 
     spi_device_interface_config_t devcfg = {
+        .command_bits = 8,
+        .address_bits = 24,
+        .dummy_bits = 0,
         .clock_speed_hz = 40 * 1000 * 1000,
         .mode = 0,
-        .spics_io_num = AXS15231B_PIN_CS,
+        .spics_io_num = -1,
         .queue_size = 7,
         .flags = SPI_DEVICE_HALFDUPLEX,
     };
@@ -164,6 +235,10 @@ esp_err_t axs15231b_init(void) {
         return ret;
     }
 
+    spi_device_acquire_bus(s_spi, portMAX_DELAY);
+
+    cs_init();
+
     size_t fb_size = (size_t)s_width * s_height * 2;
     s_fb = heap_caps_malloc(fb_size, MALLOC_CAP_SPIRAM | MALLOC_CAP_8BIT);
     if (!s_fb) {
@@ -182,40 +257,28 @@ esp_err_t axs15231b_init(void) {
     };
     gpio_config(&bl_cfg);
 
-    send_cmd(SWRESET);
+    qspi_write_command(SWRESET);
     vTaskDelay(pdMS_TO_TICKS(200));
 
     for (int i = 0; i < INIT_CMD_COUNT; i++) {
-        ret = send_cmd_data(s_init_cmds[i].cmd, s_init_cmds[i].data, s_init_cmds[i].data_len);
-        if (ret != ESP_OK) {
-            ESP_LOGE(TAG, "Init cmd 0x%02X failed: %s", s_init_cmds[i].cmd, esp_err_to_name(ret));
-            return ret;
-        }
+        qspi_write_cmd_bytes(s_init_cmds[i].cmd, s_init_cmds[i].data, s_init_cmds[i].data_len);
         if (s_init_cmds[i].delay_ms > 0) {
             vTaskDelay(pdMS_TO_TICKS(s_init_cmds[i].delay_ms));
         }
     }
 
-    uint8_t madctl_val = MADCTL_MX | MADCTL_MV | MADCTL_RGB;
-    ret = send_cmd_data(MADCTL, &madctl_val, 1);
-    if (ret != ESP_OK) {
-        ESP_LOGE(TAG, "Failed to set rotation: %s", esp_err_to_name(ret));
-        return ret;
-    }
+    uint8_t madctl_val = MADCTL_RGB;
+    qspi_write_cmd_data8(MADCTL, madctl_val);
 
     uint8_t colmod_val = 0x55;
-    ret = send_cmd_data(COLMOD, &colmod_val, 1);
-    if (ret != ESP_OK) {
-        ESP_LOGE(TAG, "Failed to set pixel format: %s", esp_err_to_name(ret));
-        return ret;
-    }
+    qspi_write_cmd_data8(COLMOD, colmod_val);
 
     axs15231b_fill_screen(0x0000);
     axs15231b_flush();
 
     axs15231b_set_backlight(true);
 
-    ESP_LOGI(TAG, "AXS15231B initialized: %dx%d landscape", s_width, s_height);
+    ESP_LOGI(TAG, "AXS15231B initialized: %dx%d portrait", s_width, s_height);
     return ESP_OK;
 }
 
@@ -242,41 +305,38 @@ void axs15231b_fill_rect(int x, int y, int w, int h, uint16_t color) {
 void axs15231b_flush(void) {
     if (!s_spi || !s_fb) return;
 
-    uint8_t buf[4];
-    buf[0] = 0;
-    buf[1] = 0;
-    buf[2] = (s_width - 1) >> 8;
-    buf[3] = (s_width - 1) & 0xFF;
-    send_cmd_data(CASET, buf, 4);
+    ESP_LOGI(TAG, "Flush %dx%d", s_width, s_height);
 
-    buf[0] = 0;
-    buf[1] = 0;
-    buf[2] = (s_height - 1) >> 8;
-    buf[3] = (s_height - 1) & 0xFF;
-    send_cmd_data(RASET, buf, 4);
-
-    send_cmd(RAMWR);
+    qspi_write_cmd_d16d16(CASET, 0, s_width - 1);
+    qspi_write_cmd_d16d16(RASET, 0, s_height - 1);
 
     int total_bytes = s_width * s_height * 2;
     int chunk_size = 32768;
     int offset = 0;
     uint8_t *fb_bytes = (uint8_t *)s_fb;
+    bool first = true;
 
+    cs_low();
     while (offset < total_bytes) {
         int remaining = total_bytes - offset;
         int this_chunk = remaining < chunk_size ? remaining : chunk_size;
 
         spi_transaction_ext_t t = {0};
-        t.base.length = this_chunk * 8;
-        t.base.tx_buffer = fb_bytes + offset;
-        t.base.flags = SPI_TRANS_MODE_QIO | SPI_TRANS_MULTILINE_CMD;
-        esp_err_t ret = spi_device_polling_transmit(s_spi, (spi_transaction_t *)&t);
-        if (ret != ESP_OK) {
-            ESP_LOGE(TAG, "Flush transfer failed at offset %d: %s", offset, esp_err_to_name(ret));
-            return;
+        if (first) {
+            t.base.flags = SPI_TRANS_MODE_QIO;
+            t.base.cmd = QSPI_CMD_DATA_WRITE;
+            t.base.addr = QSPI_DATA_ADDR;
+            first = false;
+        } else {
+            t.base.flags = SPI_TRANS_MODE_QIO | SPI_TRANS_VARIABLE_CMD |
+                           SPI_TRANS_VARIABLE_ADDR | SPI_TRANS_VARIABLE_DUMMY;
         }
+        t.base.tx_buffer = fb_bytes + offset;
+        t.base.length = this_chunk * 8;
+        spi_device_polling_transmit(s_spi, (spi_transaction_t *)&t);
         offset += this_chunk;
     }
+    cs_high();
 }
 
 int axs15231b_get_width(void) { return s_width; }
diff --git a/components/axs15231b/include/axs15231b.h b/components/axs15231b/include/axs15231b.h
index 5ec017c..cddea98 100644
--- a/components/axs15231b/include/axs15231b.h
+++ b/components/axs15231b/include/axs15231b.h
@@ -5,8 +5,8 @@
 #include <stdint.h>
 #include <stdbool.h>
 
-#define AXS15231B_WIDTH  480
-#define AXS15231B_HEIGHT 320
+#define AXS15231B_WIDTH  320
+#define AXS15231B_HEIGHT 480
 
 #define AXS15231B_PIN_CS   45
 #define AXS15231B_PIN_CLK  47
diff --git a/main/display.c b/main/display.c
index 2b6cc88..1085d4a 100644
--- a/main/display.c
+++ b/main/display.c
@@ -21,6 +21,9 @@ static uint64_t s_wallet_balance = 0;
 static bool s_initialized = false;
 static int64_t s_last_qr_switch = 0;
 static display_qr_mode_t s_qr_mode = DISPLAY_QR_WIFI;
+static display_state_t s_rendered_state = DISPLAY_BOOT;
+static display_qr_mode_t s_rendered_qr_mode = DISPLAY_QR_WIFI;
+static bool s_force_render = true;
 
 static int qr_version_from_strlen(int len) {
     if (len <= 17) return 1;
@@ -145,8 +148,8 @@ void display_render_qr(const char *text) {
 
 static void render_boot_screen(void) {
     axs15231b_fill_screen(0x0000);
-    display_render_text(140, 100, "TollGate", 0xF79F, 0x0000, 3);
-    display_render_text(140, 140, "starting...", 0xB5B6, 0x0000, 2);
+    display_render_text(64, 210, "TollGate", 0xF79F, 0x0000, 3);
+    display_render_text(72, 250, "starting...", 0xB5B6, 0x0000, 2);
     axs15231b_flush();
 }
 
@@ -182,24 +185,33 @@ static void render_ready_screen(void) {
 
 static void render_payment_screen(void) {
     axs15231b_fill_screen(0x07E0);
-    display_render_text(140, 100, "Paid!", 0x0000, 0x07E0, 3);
-    display_render_text(130, 140, "Access granted", 0x0000, 0x07E0, 2);
+    display_render_text(100, 220, "Paid!", 0x0000, 0x07E0, 3);
+    display_render_text(48, 260, "Access granted", 0x0000, 0x07E0, 2);
     axs15231b_flush();
 }
 
 static void render_error_screen(void) {
     axs15231b_fill_screen(0xF800);
-    display_render_text(120, 100, "No upstream", 0xFFFF, 0xF800, 3);
-    display_render_text(130, 140, "Check config", 0xFFFF, 0xF800, 2);
+    display_render_text(28, 220, "No upstream", 0xFFFF, 0xF800, 3);
+    display_render_text(64, 260, "Check config", 0xFFFF, 0xF800, 2);
     axs15231b_flush();
 }
 
 static void display_task(void *pvParameters) {
     ESP_LOGI(TAG, "Display task started");
+    vTaskDelay(pdMS_TO_TICKS(500));
 
     while (1) {
         display_state_t state = s_state;
 
+        if (state == DISPLAY_READY) {
+            int64_t now = (int64_t)xTaskGetTickCount() * portTICK_PERIOD_MS;
+            if ((now - s_last_qr_switch) >= QR_CYCLE_MS) {
+                s_qr_mode = (s_qr_mode == DISPLAY_QR_WIFI) ? DISPLAY_QR_PORTAL : DISPLAY_QR_WIFI;
+                s_last_qr_switch = now;
+            }
+        }
+
         switch (state) {
             case DISPLAY_BOOT:
                 render_boot_screen();
@@ -217,12 +229,6 @@ static void display_task(void *pvParameters) {
                 break;
         }
 
-        int64_t now = (int64_t)xTaskGetTickCount() * portTICK_PERIOD_MS;
-        if (state == DISPLAY_READY && (now - s_last_qr_switch) >= QR_CYCLE_MS) {
-            s_qr_mode = (s_qr_mode == DISPLAY_QR_WIFI) ? DISPLAY_QR_PORTAL : DISPLAY_QR_WIFI;
-            s_last_qr_switch = now;
-        }
-
         vTaskDelay(pdMS_TO_TICKS(1000));
     }
 }
@@ -247,6 +253,7 @@ esp_err_t display_init(void) {
 
 void display_set_state(display_state_t state) {
     s_state = state;
+    s_force_render = true;
 }
 
 void display_update(const char *ap_ssid, int active_clients,