diff --git a/firmware/cyd_35r/VERSION.txt b/firmware/cyd_35r/VERSION.txt
index a828605..20a30e9 100644
--- a/firmware/cyd_35r/VERSION.txt
+++ b/firmware/cyd_35r/VERSION.txt
@@ -1,5 +1,5 @@
 name: CYD wifitest (cyd_35r)
-git: d9773a8
+git: 1ca8d32
 date: 2026-10-25
 board: ESP32-3248S035 (ST7796)
 flash_size: 4MB
@@ -11,5 +11,5 @@ offsets:
 sha256:
   bootloader.bin  3D234A7471F67B013686DABD4DEE7C1FA915C9928463616A94BC9297ACF1ABF8
   boot_app0.bin   F94C5D786A7A8FAB06AC5D10E33BF37711A6697636DC037559EA19CC410A17F0
-  firmware.bin    07AE55AB62FE6A53D343B0DDB1E2FE422581F6B02CD1E62E3161AE66C3056897
+  firmware.bin    F11988F98E02076C4AF157B29003663D2A111E0A809C623440DF8314ABAD2927
   partitions.bin  148B959CBFF1C38AA8E1D5C0BA9D612C54997B945E56A63F41223EEF650653A1
diff --git a/firmware/cyd_35r/firmware.bin b/firmware/cyd_35r/firmware.bin
index 9d72ed4..f568129 100644
Binary files a/firmware/cyd_35r/firmware.bin and b/firmware/cyd_35r/firmware.bin differ
diff --git a/include/wifi_prov.h b/include/wifi_prov.h
index 1b33bd3..bf403a9 100644
--- a/include/wifi_prov.h
+++ b/include/wifi_prov.h
@@ -18,7 +18,12 @@
 #endif
 
 #ifndef WIFI_PROV_CONNECT_TIMEOUT_MS
-#define WIFI_PROV_CONNECT_TIMEOUT_MS 20000u
+#define WIFI_PROV_CONNECT_TIMEOUT_MS 30000u
+#endif
+
+/* Ignore transient WL_NO_SSID_AVAIL / CONNECT_FAILED right after WiFi.begin(). */
+#ifndef WIFI_PROV_FAIL_GRACE_MS
+#define WIFI_PROV_FAIL_GRACE_MS 8000u
 #endif
 
 #ifndef WIFI_PROV_RECONNECT_MS
diff --git a/src/wifi_prov.cpp b/src/wifi_prov.cpp
index a388b53..b861a83 100644
--- a/src/wifi_prov.cpp
+++ b/src/wifi_prov.cpp
@@ -58,18 +58,48 @@ static void load_creds() {
   g_has_creds = true;
 }
 
+static const char *wifi_status_str(wl_status_t st) {
+  switch (st) {
+  case WL_IDLE_STATUS:
+    return "IDLE";
+  case WL_NO_SSID_AVAIL:
+    return "NO_SSID";
+  case WL_SCAN_COMPLETED:
+    return "SCAN_DONE";
+  case WL_CONNECTED:
+    return "CONNECTED";
+  case WL_CONNECT_FAILED:
+    return "FAIL";
+  case WL_CONNECTION_LOST:
+    return "LOST";
+  case WL_DISCONNECTED:
+    return "DISC";
+  default:
+    return "?";
+  }
+}
+
 static void begin_sta_connect(const char *ssid, const char *password) {
+  if (g_scan_async) {
+    WiFi.scanDelete();
+    g_scan_async = false;
+  }
+
   WiFi.mode(WIFI_STA);
   WiFi.setAutoReconnect(true);
   WiFi.persistent(false);
-  WiFi.disconnect(false, true);
-  delay(50);
-  WiFi.begin(ssid, password);
+  /* Full disconnect + settle — needed after async scan on ESP32. */
+  WiFi.disconnect(true, true);
+  delay(200);
+
+  const size_t plen = password ? strlen(password) : 0;
+  Serial.printf("[wifi] connecting to \"%s\" pass_len=%u\n", ssid,
+                (unsigned)plen);
+  WiFi.begin(ssid, password ? password : "");
   g_want_connect = true;
   g_connect_started_ms = millis();
   g_last_reconnect_ms = millis();
   set_state(WIFI_PROV_CONNECTING);
-  Serial.printf("[wifi] connecting to \"%s\"...\n", ssid);
 }
 
 static String html_escape(const String &s) {
@@ -432,21 +462,37 @@ void wifi_prov_loop() {
       return;
     }
 
-    if (now - g_connect_started_ms >= WIFI_PROV_CONNECT_TIMEOUT_MS ||
-        st == WL_CONNECT_FAILED || st == WL_NO_SSID_AVAIL) {
+    const uint32_t elapsed = now - g_connect_started_ms;
+    static uint32_t last_prog = 0;
+    if (now - last_prog >= 2000) {
+      last_prog = now;
+      Serial.printf("[wifi] wait %lus status=%s(%d)\n",
+                    (unsigned long)(elapsed / 1000UL), wifi_status_str(st),
+                    (int)st);
+    }
+
+    /* Do NOT treat NO_SSID / CONNECT_FAILED as instant fail — after scan/
+     * disconnect ESP32 often reports NO_SSID for several seconds. */
+    const bool hard_timeout = elapsed >= WIFI_PROV_CONNECT_TIMEOUT_MS;
+    const bool early_fail =
+        elapsed >= WIFI_PROV_FAIL_GRACE_MS &&
+        (st == WL_CONNECT_FAILED || st == WL_NO_SSID_AVAIL);
+
+    if (hard_timeout || early_fail) {
       g_want_connect = false;
       set_state(WIFI_PROV_FAILED);
-      Serial.println("[wifi] connect failed");
+      Serial.printf("[wifi] connect failed after %lus status=%s\n",
+                    (unsigned long)(elapsed / 1000UL), wifi_status_str(st));
       return;
     }
   }
 
-  // 已配置且非门户：断线后周期性重连
+  /* Dropped while marked connected → actually restart STA. */
   if (g_has_creds && !g_portal && g_state == WIFI_PROV_CONNECTED &&
       st != WL_CONNECTED) {
-    set_state(WIFI_PROV_CONNECTING);
-    g_want_connect = true;
-    g_connect_started_ms = now;
+    Serial.println("[wifi] link lost — reconnect");
+    begin_sta_connect(g_ssid, g_pass);
+    return;
   }
 
   if (g_has_creds && !g_portal && st != WL_CONNECTED &&
diff --git a/src/wifi_ui.cpp b/src/wifi_ui.cpp
index de881b6..f6e6707 100644
--- a/src/wifi_ui.cpp
+++ b/src/wifi_ui.cpp
@@ -367,10 +367,19 @@ static void on_portal(lv_event_t *e) {
 
 static void on_join(lv_event_t *e) {
   LV_UNUSED(e);
-  const char *pass = ta_pass ? lv_textarea_get_text(ta_pass) : "";
+  char pass_buf[WIFI_PROV_PASS_MAX + 1] = {};
+  if (ta_pass) {
+    const char *p = lv_textarea_get_text(ta_pass);
+    if (p) {
+      strncpy(pass_buf, p, WIFI_PROV_PASS_MAX);
+      pass_buf[WIFI_PROV_PASS_MAX] = '\0';
+    }
+  }
+  Serial.printf("[ui] Join \"%s\" pass_len=%u\n", g_pick_ssid,
+                (unsigned)strlen(pass_buf));
   hide_password_dialog();
   set_setup_status("Connecting...");
-  wifi_prov_connect_to(g_pick_ssid, pass);
+  wifi_prov_connect_to(g_pick_ssid, pass_buf);
 }
 
 static void on_dlg_back(lv_event_t *e) {