build: move to pioarduino 55.03.312 (Arduino 3.3.12, ESP-IDF 5.5)

IDF 4.4 gets no more security fixes, and the planned RMT radio needs
IDF 5's RMT driver.  See docs/adr/0003-pioarduino-idf55.md.

- Every env on one pinned pioarduino release.  C6 drops its own
  library list and flags but stays a debug build on huge_app.
- Release envs build at CORE_DEBUG_LEVEL=2 so the ESP32 image fits its
  1.5 MB OTA slot (17 KB free); debug envs stay at 3.
- Drop the C3: its image is 76.5 KB over the OTA slot on IDF 5.5.
- CI installs pioarduino's Core and checks firmware.bin against the app
  partition, failing under 8 KB free.  PlatformIO's "Flash:" figure
  reads ~45 KB low and passed a C3 image that doesn't fit.
- esp_task_wdt_reconfigure(): on 3.x the core already starts the watchdog
  and esp_task_wdt_init() fails, so the C6 build kept the 5 s default.
- An updated firmware is kept only once it has run 60 s with the
  network up; a reset before then rolls back to the previous one.
- ETH.begin() takes the 3.x argument order; Arduino 2.x branches gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/ESPNetwork.cpp

@@ -396,7 +396,7 @@ bool ESPNetwork::connectWired() {
     if(!ethPhyType(settings.Ethernet.phyType, phyType))
       ESP_LOGE(TAG, "Ethernet PHY type %u is not supported", (unsigned int)settings.Ethernet.phyType);
     else
-      begun = ETH.begin(settings.Ethernet.phyAddress, settings.Ethernet.PWRPin, settings.Ethernet.MDCPin, settings.Ethernet.MDIOPin, phyType, settings.Ethernet.CLKMode);
+      begun = ETH.begin(phyType, settings.Ethernet.phyAddress, settings.Ethernet.MDCPin, settings.Ethernet.MDIOPin, settings.Ethernet.PWRPin, settings.Ethernet.CLKMode);
     if(!begun) {
       ESP_LOGE(TAG, "Ethernet Begin failed");
       this->ethStarted = false;

src/LogLock.cpp

@@ -18,7 +18,6 @@
 // progress (see LogLockPolicy.h).
 #include <Arduino.h>
 #include <stdarg.h>
-#include "esp_idf_version.h"
 #include "freertos/FreeRTOS.h"
 #include "freertos/semphr.h"
 #include "freertos/task.h"
@@ -41,19 +40,12 @@ static volatile TaskHandle_t logOwner = nullptr;
 // line takes about 20ms at 115200 baud.
 #define LOG_LOCK_WAIT_MS 20
 
-#if ESP_IDF_VERSION_MAJOR >= 5
-#define taskOnCore(core) xTaskGetCurrentTaskHandleForCore(core)
-#define taskCore(task) xTaskGetCoreID(task)
-#else
-#define taskOnCore(core) xTaskGetCurrentTaskHandleForCPU(core)
-#define taskCore(task) xTaskGetAffinity(task)
-#endif
 static LogHolder logHolder(TaskHandle_t owner) {
   if(!owner) return LogHolder::unknown;
   for(BaseType_t core = 0; core < portNUM_PROCESSORS; core++)
-    if(taskOnCore(core) == owner) return LogHolder::running;
+    if(xTaskGetCurrentTaskHandleForCore(core) == owner) return LogHolder::running;
   // A task pinned elsewhere only runs once whatever preempted it there is done.
-  const BaseType_t core = taskCore(owner);
+  const BaseType_t core = xTaskGetCoreID(owner);
   if(core == tskNO_AFFINITY || core == xPortGetCoreID()) return LogHolder::preemptedHere;
   return LogHolder::preemptedElsewhere;
 }

src/SomfyController.ino

@@ -16,18 +16,20 @@
 #include "GitOTA.h"
 #include "esp_core_dump.h"
 #include "esp_system.h"
-#include "esp_idf_version.h"
-#if ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(5, 0, 0)
 #include "esp_app_desc.h"
-#define getRunningElfSha esp_app_get_elf_sha256
-#else
 #include "esp_ota_ops.h"
-#define getRunningElfSha esp_ota_get_app_elf_sha256
-#endif
 #include "Timing.h"
 
 static const char *TAG = "Main";
 #define LOOP_SLOW_MS 100
+// How long an updated firmware has to run, and then have the network up, before
+// it is kept.  A reset before then rolls back to the previous firmware.
+#define OTA_PROVEN_MS 60000
+
+// Overrides the core's weak hook so it leaves an updated firmware unverified
+// at boot.  loop() confirms it once otaProven().
+extern "C" bool verifyRollbackLater() { return true; }
+static bool otaPending = false;
 
 ConfigSettings settings;
 Web webServer;
@@ -101,7 +103,7 @@ void setup() {
     static_assert(sizeof(crashedSha) <= sizeof(summary.app_elf_sha256), "copy would read past app_elf_sha256");
     SETCHARPROP(crashedSha, (const char *)summary.app_elf_sha256, sizeof(crashedSha));
     char runningSha[APP_ELF_SHA256_SZ] = {0};
-    getRunningElfSha(runningSha, sizeof(runningSha));
+    esp_app_get_elf_sha256(runningSha, sizeof(runningSha));
     if(strcmp(crashedSha, runningSha) == 0)
       CRASH_LOG("  Build: %s (running %s, same build)", crashedSha, runningSha);
     else
@@ -129,14 +131,15 @@ void setup() {
   net.setup();  
   somfy.begin();
   //git.checkForUpdate();
-#if ESP_ARDUINO_VERSION_MAJOR >= 3
+  // The core starts the watchdog with a 5s timeout before setup(), so
+  // esp_task_wdt_init() would fail and keep that.
   const esp_task_wdt_config_t wdt_config = { .timeout_ms = 15000, .idle_core_mask = 1, .trigger_panic = true };
-  esp_task_wdt_init(&wdt_config);
-#else
-  esp_task_wdt_init(15, true); //enable panic so ESP32 restarts
-#endif
+  esp_task_wdt_reconfigure(&wdt_config);
   esp_task_wdt_add(NULL); //add current thread to WDT watch
-
+  esp_ota_img_states_t otaState;
+  otaPending = esp_ota_get_state_partition(esp_ota_get_running_partition(), &otaState) == ESP_OK &&
+    otaState == ESP_OTA_IMG_PENDING_VERIFY;
+  if(otaPending) ESP_LOGW(TAG, "Updated firmware, keeping it once it has run %ds with the network up", OTA_PROVEN_MS / 1000);
 }
 
 void loop() {
@@ -183,6 +186,11 @@ void loop() {
     net.end();
     ESP.restart();
   }
+  if(otaPending && otaProven(net.connected(), millis(), OTA_PROVEN_MS)) {
+    otaPending = false;
+    if(esp_ota_mark_app_valid_cancel_rollback() == ESP_OK) ESP_LOGI(TAG, "Updated firmware confirmed, rollback cancelled");
+    else ESP_LOGE(TAG, "Unable to confirm the updated firmware");
+  }
   esp_task_wdt_reset();
   loopStats.record(pass.us());
 }

src/Utils.cpp

@@ -147,6 +147,9 @@ void RssiBroadcast::sent(bool broadcast, int rssi, int channel, uint32_t now) {
 bool worthRoaming(bool connected, int currentRssi, int apRssi, int minGain) {
   return !connected || apRssi >= currentRssi + minGain;
 }
+bool otaProven(bool networkUp, unsigned long uptimeMs, unsigned long minUptimeMs) {
+  return networkUp && uptimeMs >= minUptimeMs;
+}
 const char *wifiAuthModeName(uint8_t authMode) {
   switch(authMode) {
     case 0: return "OPEN";

src/Utils.h

@@ -82,6 +82,10 @@ enum class heap_emit_t : uint8_t { none, client, broadcast, room };
 // num is the socket client asked for, 255 for everyone.  A broadcast goes out
 // every intervalMs; in between only the clients in room 0 get one.
 heap_emit_t heapEmitTarget(uint8_t num, uint32_t sinceLastMs, uint32_t intervalMs, bool roomHasClients);
+// Whether a firmware the bootloader is holding for verification after an
+// update has proven itself: it has run for minUptimeMs and the network is
+// up.  Until then a reset rolls back to the previous firmware.
+bool otaProven(bool networkUp, unsigned long uptimeMs, unsigned long minUptimeMs);
 // How well loop() keeps up: the passes it made per second and its longest
 // pass, over the window since the last memStatus broadcast.  Only the loop
 // task calls record(), rate(), maxUs() and publish().  publish() closes the