diff --git a/docs/release-notes/v1.0.7.md b/docs/release-notes/v1.0.7.md
new file mode 100644
index 0000000..fa8e596
--- /dev/null
+++ b/docs/release-notes/v1.0.7.md
@@ -0,0 +1,65 @@
+# v1.0.7 — Management-link ping test, and the fans start where you set them
+
+## ✨ New features
+
+**10G / 1G management port ping test**
+* New `mgmt_ping_monitor.sh` exercises both management NICs in one loop: it brings each up with iproute2, waits for the link to settle, then pings that NIC's own target — `eth0` → `192.168.1.30`, `eth1` → `192.168.1.31`.
+* Runs detached like the other monitors: `start` / `stop` / `status` / `fg` / `summary`. `start` clears the previous log, so one run means one log.
+* Every leg writes a single greppable line — `RESULT 10G eth0 -> 192.168.1.30 tx=10 rx=10 loss=0% rtt_avg=1.743ms nic_tx=10 nic_rx=10 PASS` — so a whole soak can be read with `summary` instead of scrolling.
+* `nic_tx` / `nic_rx` are that interface's own counter delta across the burst. If a ping passes but they stay near zero, the traffic left on the *other* NIC and the number does not belong to this one.
+* Script A runs one round as a baseline; Script B leaves it running through the soak.
+
+**Fan speed is set at the start of every run**
+* `FAN_SPEED` in `config.ttl` (default 30) is applied by Script A, so a run no longer inherits whatever the previous test left the fans doing.
+* Both MAX31790 controllers are rebound first, which clears a controller left in an odd state.
+
+**Stress load moved onto the platform's own job runner**
+* CPU, DDR, SSD and USB stress now go through `bgctl`, replacing the `~/hammer/tools/stress_*.py` scripts. `bgctl list` shows what is running; Script C stops everything with `bgctl stop --all`.
+* BMC DDR stress runs through `bmc-manager`, and a new BMC USB test discovers the `cdc_ncm` interface and pings across it for four hours under `systemd-run`.
+
+**More of the DUT on record**
+* Script A now captures the boot image, `show version`, firmware status, system EEPROM, SSD health, TPM version and NVMe SMART data before the test starts.
+* PCIe AER now sits next to `ras-mc-ctl --summary`, and Script C closes with NVMe health so a disk that degraded during the soak is visible.
+* `dmesg` capture uses human-readable timestamps and one combined error pattern, then clears the ring buffer — so Script C's dmesg shows only what the soak produced, not everything since boot.
+* Each run opens with `hw-test-session start` and closes with `finish`; Script C copies the job logs to `/mnt/usb/jobs-<date>_<time>` so they leave the DUT with the run they belong to.
+
+## 🐛 Bug fixes
+
+**Script A no longer hangs waiting for ports that are already up**
+* The readiness gate required *more than* 216 ports up, but a fully cabled unit reports exactly 216 — 108 loopback pairs times two. Script A sat in the poll loop forever on the very state it was waiting for. It now proceeds at 216.
+* The comments in `wait_init.ttl` still described the old "more than" rule; they now match the code, so the off-by-one cannot be reintroduced by reading the wrong line.
+
+**The macro no longer runs ahead of the DUT during the soak**
+* Script B set a 15-second wait cap for the `cdc_ncm` probe and never restored it. In Tera Term that cap is global, so it stayed in force for everything after — including the traffic setup, which walks 108 VLANs per switch unit and takes far longer. A timed-out wait returns without the prompt, leaving every later command issued a step early.
+
+**Fan controller is no longer bound twice**
+* One of the two MAX31790 controllers received a second `bind` immediately after the first, which could only fail because the driver was already attached.
+
+## 📦 Downloads
+
+| File | Contents |
+|---|---|
+| `Script_ABC_Blanton_V1.0.7.zip` | The full Tera Term working directory, including `Blanton_Script/` to copy onto the DUT |
+
+**After copying to the DUT:**
+
+```bash
+chmod +x ~/Blanton_Script/*.sh      # required -- see below
+grep -rlU $'\r' ~/Blanton_Script    # expect no output
+```
+
+The `chmod +x` is not optional. `mgmt_ping_monitor.sh` is executed rather than sourced and re-execs its own path to daemonise, and neither git (mode 100644) nor a Windows/USB copy carries the execute bit. Without it `start` fails with `Permission denied` and the later `cat` finds nothing — **the section ends up empty and nothing reports an error**.
+
+## ⚠️ Before you run
+
+* **Declare the switch population.** `SWB_UNIT0` / `SWB_UNIT1` in `config.ttl` say which switch units this DUT has. Traffic and the readiness gate both follow them: a single unit gets `-u 0` or `-u 1`, and with neither set the traffic stage is skipped instead of failing against hardware that is not there.
+* **Both management NICs stay up.** If they share a subnet, keep `ARP_STRICT=1` — otherwise the target's ARP can be answered by either NIC and a reply may arrive on the one that did not send.
+* **Management connectivity is exercised, not preserved.** Drive the run from the serial console.
+* **Two settings persist to `config_db.json`** and survive a reboot: LLDP is left disabled, and the 100G uplinks are left configured. Restore them before the DUT moves on.
+
+## 🔗 Links
+
+* [ARCHITECTURE.md](https://etgit.et-wen.com/etwen/Blanton_TTL_Script/src/branch/main/ARCHITECTURE.md) — test flow, data models, constraints
+* [CLAUDE.md](https://etgit.et-wen.com/etwen/Blanton_TTL_Script/src/branch/main/CLAUDE.md) — commands and the bench gotchas
+
+**Full changelog:** [V1.0.5...V1.0.7](https://etgit.et-wen.com/etwen/Blanton_TTL_Script/compare/V1.0.5...V1.0.7)
diff --git a/src/Script_ABC_Blanton/1_Blanton_Script_A.ttl b/src/Script_ABC_Blanton/1_Blanton_Script_A.ttl
index 404e2b6..4e9d887 100644
--- a/src/Script_ABC_Blanton/1_Blanton_Script_A.ttl
+++ b/src/Script_ABC_Blanton/1_Blanton_Script_A.ttl
@@ -1,7 +1,7 @@
 ; =============================================================================
 ; Script A for Blanton
-; Version : V1.0.6
-; Date    : 2026-08-24
+; Version : V1.0.7
+; Date    : 2026-08-25
 ; Author  : ETWen
 ; =============================================================================
 ; Version History:
@@ -41,6 +41,8 @@
 ;                       ScriptA                                         Add Fan Ctrl (max31790 rebind + fan-speed-control.sh)
 ;                       ScriptA                                         Clear /host/hw-eval/current/jobs before the run
 ;                       ScriptC                                         Copy stress jobs log to USB, timestamped
+;                       utils/wait_init.ttl                             WT_INTERVAL 10 -> 60, fix WT_MIN comments
+;                       ScriptC                                         Disable BMC USB journalctl dump
 ; =============================================================================
 include "config.ttl"
 
diff --git a/src/Script_ABC_Blanton/3_Blanton_Script_C.ttl b/src/Script_ABC_Blanton/3_Blanton_Script_C.ttl
index 305ca3a..077f33c 100644
--- a/src/Script_ABC_Blanton/3_Blanton_Script_C.ttl
+++ b/src/Script_ABC_Blanton/3_Blanton_Script_C.ttl
@@ -54,8 +54,8 @@ sendln "/usr/sbin/ras-mc-ctl --summary"
 ;sendln "cat ./Blanton_Script/log/bmc_ddr.log"
 
 ; ========== BMC USB Test result ==========
-wait prompt_sonic_root
-sendln "journalctl -u qfx5252-bmc-usb-net-test.service --no-pager"
+;wait prompt_sonic_root
+;sendln "journalctl -u qfx5252-bmc-usb-net-test.service --no-pager"
 
 ; ========== 10G/1G MGMT Test result ==========
 wait prompt_sonic_root
diff --git a/src/Script_ABC_Blanton/utils/wait_init.ttl b/src/Script_ABC_Blanton/utils/wait_init.ttl
index 30215e0..fe78033 100644
--- a/src/Script_ABC_Blanton/utils/wait_init.ttl
+++ b/src/Script_ABC_Blanton/utils/wait_init.ttl
@@ -4,7 +4,7 @@
 ; Date    : 2026-08-21
 ; Author  : ETWen
 ; =============================================================================
-; Wait until every switch unit ENABLED below reports more than WT_MIN ports up:
+; Wait until every switch unit ENABLED below reports at least WT_MIN ports up:
 ;     bcmcmd -n <u> -c ps | grep -w up | wc -l
 ;
 ; The DUT is not always fully populated. Which units exist is declared ONCE in
@@ -34,10 +34,15 @@
 ;   V3.1.0  2026-08-21  Take the population from SWB_UNIT0 / SWB_UNIT1 in
 ;                       config.ttl instead of local copies, so this wait and the
 ;                       traffic blocks cannot drift apart.
+;   V3.1.1  2026-08-25  WT_INTERVAL 10 -> 60. Fix the WT_MIN comments: the test
+;                       has been `< WT_MIN` (at least) since the threshold was
+;                       corrected, but the text still said "more than", which is
+;                       the off-by-one that once hung Script A.
 ; =============================================================================
 ; ---- which units to wait for: SWB_UNIT0 / SWB_UNIT1, set in config.ttl ------
-WT_MIN      = 216     ; an enabled unit must report MORE than this many ports up
-WT_INTERVAL = 10      ; seconds between polls
+WT_MIN      = 216     ; an enabled unit must report AT LEAST this many ports up
+                      ; (216 = 108 loopback pairs x 2, i.e. every cabled port)
+WT_INTERVAL = 60      ; seconds between polls
 ; -----------------------------------------------------------------------------
 
 timeout = 60          ; per-wait cap; bcmcmd ps is not instant