mikecarper
e2a1828987
Recover usable ESP32 preferences and channels before permitting replacement; keep identity and ACL persistence transactional and complete. Preserve MQTT commit boundaries, restore OTA identity and policy after deferred allocation, retain radio gain retries, and reject invalid flood limits. Add production-path fault regressions and CI coverage.
41 lines
1.4 KiB
C++
41 lines
1.4 KiB
C++
#pragma once
|
|
|
|
#include <stdint.h>
|
|
|
|
// Pure recovery policy for the three MQTT preference transaction files. The
|
|
// writer first moves the old primary to .bak, then moves the verified .tmp to
|
|
// the primary name. On a reset, the loader uses this policy before decoding
|
|
// /mqtt_prefs. "Preserve" is deliberately distinct from "Usable": it covers
|
|
// an unsupported newer layout, corruption, or an unreadable file and must
|
|
// never be replaced by an older image.
|
|
namespace MQTTPrefsRecovery {
|
|
|
|
enum class FileState : uint8_t {
|
|
Missing,
|
|
Usable,
|
|
Preserve,
|
|
};
|
|
|
|
enum class Action : uint8_t {
|
|
None,
|
|
KeepPrimary,
|
|
PromoteBackup,
|
|
DiscardTemp,
|
|
};
|
|
|
|
inline Action select(FileState primary, FileState temp, FileState backup) {
|
|
// A primary of any kind owns the name. In particular, do not roll a newer
|
|
// or corrupt primary back to an older backup just because it cannot be read
|
|
// by this firmware.
|
|
if (primary != FileState::Missing) return Action::KeepPrimary;
|
|
|
|
// Until temp has its final name, it is not committed. A failed publication
|
|
// may have been reported to the caller, so never activate it during recovery.
|
|
// The backup remains authoritative, including an opaque newer layout.
|
|
if (backup != FileState::Missing) return Action::PromoteBackup;
|
|
if (temp != FileState::Missing) return Action::DiscardTemp;
|
|
return Action::None;
|
|
}
|
|
|
|
} // namespace MQTTPrefsRecovery
|