Keep ESP32 OTA reachable whatever the firmware does

- Rollback: override verifyRollbackLater() so a new OTA image stays
  pending until it ran 60 s with WiFi; any earlier restart rolls back
  (the Arduino core marked every image valid at boot before)
- Task watchdog (30 s) on loop(), paused during OTA uploads
- Crash counter in RTC memory: OTA-only window after a crash, 10 min
  safe mode (WiFi + OTA only) after 3 crashes in a row
- Restart when WiFi stays down for 10 min
- Home Assistant sensor 'FlipDot Display Firmware' with version/state
- logic/boot_policy with tests (60 tests total)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/esp32/net/home_assistant.cpp

@@ -2,6 +2,7 @@
 
 #include <ArduinoHA.h>
 #include <WiFi.h>
+#include <string.h>
 
 #include "config.h"
 #include "credentials.h"
@@ -13,6 +14,10 @@ static HAMqtt mqtt(client, device);
 // Unique ids: do not change, Home Assistant's entities are linked to them
 static HASwitch clockSwitch("FlipDotDisplayClock");
 static HASwitch powerSwitch("FlipDotDisplayPower");
+static HASensor firmwareSensor("FlipDotDisplayFirmware");
+
+static char firmware_status[64] = "";
+static bool firmware_status_sent = false;
 
 static DisplayController *displayController = nullptr;
 
@@ -46,10 +51,25 @@ void homeAssistantBegin(DisplayController &controller)
 	powerSwitch.setCurrentState(controller.powerEnabled());
 	powerSwitch.onCommand(onPowerCommand);
 
+	firmwareSensor.setName("FlipDot Display Firmware");
+	firmwareSensor.setIcon("mdi:chip");
+	// The sensor doesn't resend its value on reconnect by itself
+	mqtt.onConnected([]() { firmware_status_sent = false; });
+
 	mqtt.begin(BROKER_ADDR, MQTT_USER, MQTT_PASSWORD);
 }
 
 void homeAssistantLoop()
 {
 	mqtt.loop();
+	if (!firmware_status_sent && firmware_status[0] && mqtt.isConnected())
+		firmware_status_sent = firmwareSensor.setValue(firmware_status);
+}
+
+void homeAssistantSetFirmwareStatus(const char *status)
+{
+	if (strcmp(status, firmware_status) == 0)
+		return;
+	strncpy(firmware_status, status, sizeof(firmware_status) - 1);
+	firmware_status_sent = false;
 }

src/esp32/net/home_assistant.h

@@ -2,8 +2,12 @@
 
 #include "logic/display_controller.h"
 
-// Home Assistant integration over MQTT (with discovery). Two switches:
-//   FlipDot Display Clock  on = clock, off = Nintendo logo
-//   FlipDot Display Power  off = clear the display and switch it off
+// Home Assistant integration over MQTT (with discovery):
+//   FlipDot Display Clock     switch: on = clock, off = Nintendo logo
+//   FlipDot Display Power     switch: off = clear the display and switch it off
+//   FlipDot Display Firmware  sensor: version and health, e.g. "2.1.0, ok, 0 crashes"
 void homeAssistantBegin(DisplayController &controller);
 void homeAssistantLoop();
+
+// Publish the firmware status (only sent when it changes, and again after a reconnect)
+void homeAssistantSetFirmwareStatus(const char *status);

src/esp32/net/wifi_ota.cpp

@@ -2,24 +2,26 @@
 
 #include <ArduinoOTA.h>
 #include <WiFi.h>
-#include <rom/rtc.h>
 
 #include "config.h"
 #include "credentials.h"
+#include "system/firmware_guard.h"
+
+static uint32_t wifi_lost_at = 0;
+static bool wifi_lost = false;
 
 void wifiBegin()
 {
 	WiFi.setHostname(HOSTNAME);
 	WiFi.mode(WIFI_STA);
+	WiFi.setAutoReconnect(true);
 	WiFi.begin(WIFI_SSID, WIFI_PASSWORD);
 	Serial.println("Connecting to WiFi");
-	if (WiFi.waitForConnectResult() != WL_CONNECTED)
+	if (WiFi.waitForConnectResult(WIFI_CONNECT_TIMEOUT) != WL_CONNECTED)
 	{
 		Serial.println("WiFi connection failed, restarting");
-		delay(5000);
 		ESP.restart();
 	}
-	// Later disconnects are handled by the WiFi driver's auto reconnect
 	Serial.print("Connected, IP ");
 	Serial.println(WiFi.localIP());
 }
@@ -29,12 +31,38 @@ bool wifiConnected()
 	return WiFi.status() == WL_CONNECTED;
 }
 
+void wifiWatchdog()
+{
+	if (wifiConnected())
+	{
+		wifi_lost = false;
+		return;
+	}
+	if (!wifi_lost)
+	{
+		wifi_lost = true;
+		wifi_lost_at = millis();
+	}
+	else if (millis() - wifi_lost_at >= WIFI_RESTART_TIME)
+	{
+		Serial.println("WiFi down for too long, restarting");
+		ESP.restart();
+	}
+}
+
 void otaBegin()
 {
 	ArduinoOTA.setHostname(HOSTNAME);
-	ArduinoOTA.onStart([]() { Serial.println("OTA update started"); });
+	ArduinoOTA.onStart([]() {
+		// The update blocks loop() until it is done
+		firmwareGuardStopWatchdog();
+		Serial.println("OTA update started");
+	});
 	ArduinoOTA.onEnd([]() { Serial.println("OTA update done"); });
-	ArduinoOTA.onError([](ota_error_t error) { Serial.printf("OTA error %u\n", error); });
+	ArduinoOTA.onError([](ota_error_t error) {
+		Serial.printf("OTA error %u, restarting\n", error);
+		ESP.restart();
+	});
 	ArduinoOTA.begin();
 }
 
@@ -43,27 +71,15 @@ void otaLoop()
 	ArduinoOTA.handle();
 }
 
-// A normal start is a power on of CPU 0 or a start of CPU 1 by CPU 0
-static bool unexpectedReset()
+void otaOnlyMode(uint32_t duration, int led_pin)
 {
-	RESET_REASON cpu0 = rtc_get_reset_reason(0);
-	RESET_REASON cpu1 = rtc_get_reset_reason(1);
-	Serial.printf("Reset reason: CPU0 %d, CPU1 %d\n", cpu0, cpu1);
-	return cpu0 != POWERON_RESET && cpu1 != EXT_CPU_RESET;
-}
-
-void otaPanicWindow(int led_pin)
-{
-	if (!unexpectedReset())
-		return;
-
-	Serial.println("Unexpected reset: waiting for an OTA update");
+	Serial.printf("OTA only for %lu s\n", (unsigned long)(duration / 1000));
 	uint32_t start = millis();
-	while (millis() - start < OTA_PANIC_WINDOW)
+	while (millis() - start < duration)
 	{
 		ArduinoOTA.handle();
-		// fast blink
-		digitalWrite(led_pin, (millis() / 50) % 2);
+		wifiWatchdog();
+		digitalWrite(led_pin, (millis() / 50) % 2); // fast blink
 		delay(10);
 	}
 	digitalWrite(led_pin, LOW);

src/esp32/net/wifi_ota.h

@@ -1,14 +1,19 @@
 #pragma once
 
+#include <stdint.h>
+
 // Connect to WiFi. Restarts the ESP32 when the first connection fails.
 void wifiBegin();
 
 bool wifiConnected();
 
+// Restarts the ESP32 when WiFi has been down for WIFI_RESTART_TIME (a stuck WiFi stack
+// would otherwise make OTA unreachable). Call every loop.
+void wifiWatchdog();
+
 // Over-the-air updates of the ESP32 firmware (pio run -e esp32 -t upload)
 void otaBegin();
 void otaLoop();
 
-// After a crash or unexpected reset, run only OTA for OTA_PANIC_WINDOW, so a firmware that
-// crashes at boot can still be replaced. Does nothing after a normal power on.
-void otaPanicWindow(int led_pin);
+// Run only WiFi and OTA for `duration` ms (after a crash / safe mode), LED blinking fast
+void otaOnlyMode(uint32_t duration, int led_pin);