Flash the .img.xz exactly as downloaded. Every imager below reads it compressed — do not extract it first. Extracting gives you a 2 GB .img whose checksum is not the one on this page.
Windows
Rufus, or balenaEtcher. Rufus writes a disk image in DD Image mode; take that when it asks.
macOS · Linux
balenaEtcher, or Raspberry Pi Imager — despite the name it writes any image to any card, under Choose OS → Use custom.
Verify the download before writing. A truncated file and a good one are indistinguishable to the imager, and only tell you apart when the board refuses to boot. Check it against the sha256 · image on the card you downloaded from — the two boards' images are different files with different checksums, and neither one verifies the other.
macOS · Linux
shasum -a 256 -c SHA256SUMS
Windows
certutil -hashfile avifi-<board>-<version>.img.xz SHA256
The filesystem is shrunk to fit the download and grows to fill the card on first boot. Expect one early reboot while it resizes.
Two downloads, and they now have separate version numbers. The firmware is no longer built into the flasher: the same .exe writes whatever signed firmware you put beside it, so a new image is a file to copy rather than a program to reinstall.
Unplug the coin acceptor and the relay before the module goes into USB. With the 12 V load attached the CH340 never enumerates and the board looks plainly dead — that has cost a debugging trip once already.
The exe is unsigned, and a tool that bundles a serial driver and writes to hardware is a well-known false positive. More info → Run anyway. That is the missing signature, not a broken download.
Unzip the flasher, and put the .vendofw in the same folder as SubVendoFlasher.exe. The driver and esptool are inside the exe; the firmware is the separate download, and the flasher writes the one signed file it finds beside it. It resolves no hostname and needs no account — it works in a shop with no signal. Pick the port and flash. Nothing is held down.
It refuses anything the update key did not sign, so a stray .bin cannot be written by mistake. Two .vendofw files in the folder is also a refusal — leave one, so “which image did you flash?” has an answer.
Write the station MAC it shows on the enclosure. That is the address the operator console enrols, and it is not always the one printed on the module.
The unit then comes up as an open access point, avifi-setup- plus the last three octets of that MAC. Every unit derives its own, so look for the prefix rather than a particular name.
The flasher is Windows only. Elsewhere, take the image out of the signed file and write it with esptool — a .vendofw is a gzip tar, so tar opens it with nothing installed. The board is a WCH CH340 (0x1A86:0x7523), not a CP2102 — macOS enumerates it unaided, Windows needs CH341SER.EXE from WCH or there is no port at all.
Note what you give up doing this: the signature is what proves the image was released, and esptool does not check it. Verify the download against SHA256SUMS first, and prefer the flasher where you have Windows.
shasum -a 256 -c SHA256SUMS tar -xzOf sub-vendo-firmware-0.3.0.vendofw firmware.bin > firmware.bin python3 -m pip install esptool==4.8.1 python3 -m esptool --chip esp8266 --port /dev/cu.usbserial-XXX --baud 115200 \ write_flash --flash_mode dio --flash_size 4MB --flash_freq 40m 0x0 firmware.bin
Writing at 0x0 leaves LittleFS alone, so a unit keeps the pairing already on it. Add --erase-all to move one to a different main vendo.