diff --git a/analysis/firmware/fw_tst.img b/analysis/firmware/fw_tst.img
index 95a025c..8e4913d 100644
Binary files a/analysis/firmware/fw_tst.img and b/analysis/firmware/fw_tst.img differ
diff --git a/tools/bridge_server.py b/tools/bridge_server.py
index 89db042..ba85228 100644
--- a/tools/bridge_server.py
+++ b/tools/bridge_server.py
@@ -27,7 +27,7 @@ import platform
 import sys
 
 PROTOCOL_VERSION = 1
-SERVER_BUILD = 5  # 2026-07-28: SUOTA SERV_STATUS 实机校正为 5f78df94（h=38 notify）
+SERVER_BUILD = 6  # 2026-07-29: read 增加 dis_model/dis_fw/spota_mem_info/spota_status_ro（SUOTA 审慎测试基线）
 
 EPD_SERVICE_UUID = "13187b10-eba9-a3ba-044e-83d3217d9a38"
 EPD_CHAR_UUID = "4b646063-6264-f3a7-8941-e65356ea82fe"
@@ -52,7 +52,11 @@ BLOCK_SIZE = 240
 WRITE_CHUNK = 20
 STATUS_OK = 2
 
-CHARS = {"epd": EPD_CHAR_UUID, "rxtx": RXTX_CHAR_UUID, "alt": ALT_NOTIFY_UUID}
+CHARS = {"epd": EPD_CHAR_UUID, "rxtx": RXTX_CHAR_UUID, "alt": ALT_NOTIFY_UUID,
+         "dis_model": "00002a24-0000-1000-8000-00805f9b34fb",
+         "dis_fw": "00002a26-0000-1000-8000-00805f9b34fb",
+         "spota_mem_info": "6c53db25-47a1-45fe-a022-7c92fb334fd4",
+         "spota_status_ro": "64b4e8b5-0de5-401b-a21d-acc8db3b913a"}
 # 实机 GATT（2026-07-28 bridge 诊断）：1f1f(h=53)=仅write 无 notify；
 # 331f(h=57)=notify+write+read，为真交互通道；EPD(h=48)=notify+write