做一台桌面小车：无线请求、状态反馈与失联COAST

idf.py -B build-closed -D IDF_TARGET=esp32s3 -D SDKCONFIG=build-closed/sdkconfig -D SDKCONFIG_DEFAULTS=sdkconfig.defaults reconfigure
idf.py -B build-closed build
idf.py -B build-closed -p /dev/你的桥串口 flash monitor

# 以下两份local文件须先按README填入真实对端MAC；分别操作对应串口。
idf.py -B build-controller -D IDF_TARGET=esp32s3 -D SDKCONFIG=build-controller/sdkconfig "-D SDKCONFIG_DEFAULTS=sdkconfig.defaults;config/controller.local.defaults" reconfigure
idf.py -B build-controller build
idf.py -B build-controller -p /dev/控制端桥串口 flash monitor
idf.py -B build-rover -D IDF_TARGET=esp32s3 -D SDKCONFIG=build-rover/sdkconfig "-D SDKCONFIG_DEFAULTS=sdkconfig.defaults;config/rover.local.defaults" reconfigure
idf.py -B build-rover build
idf.py -B build-rover -p /dev/车端桥串口 flash monitor

// ---- main/rover_model.h ----
/* SPDX-License-Identifier: MIT */
#pragma once
#include <stdbool.h>
#include <stdint.h>
#include <stddef.h>
#include <string.h>
#define V8_WIRE_BYTES 48
#define V8_MAX_DUTY 256
#define V8_LEASE_US UINT64_C(500000)
#define V8_OWNER_GAP_US UINT64_C(100000)
#define V8_RUN_LIMIT_US UINT64_C(3000000)
#define V8_COAST_GAP_US UINT64_C(200000)
enum { V8_HELLO=1,V8_COMMAND=2,V8_ACK=3 };
enum { V8_ACCEPTED=0,V8_DUPLICATE=1,V8_SESSION=2,V8_STALE=3,V8_CONFLICT=4,V8_STOP_REQUIRED=5,V8_FAULT=6,V8_TOO_OLD=7 };
enum { V8_BOOT=0,V8_EXPLICIT_STOP=1,V8_LEASE_EXPIRED=2,V8_RUN_LIMIT=3,V8_OWNER_LATE=4,V8_DRIVER_FAULT=5,V8_LOCAL_STOP=6,V8_API_FAULT=7,V8_CLOCK_FAULT=8,V8_RADIO_FAULT=9 };
enum { V8_FLAG_API_KNOWN=1,V8_FLAG_ARMED=2,V8_FLAG_FAULT=4 };
typedef struct {
 uint8_t kind,status,flags,reason;
 uint64_t sender,receiver;
 uint32_t seq,last_seq;
 int16_t left,right,api_left,api_right;
 uint16_t remaining_ms;
} V8Frame;
static inline uint32_t v8_crc(const uint8_t *p,size_t n){uint32_t c=UINT32_MAX;for(size_t i=0;i<n;i++){c^=p[i];for(unsigned k=0;k<8;k++)c=(c>>1)^((c&1)?UINT32_C(0xedb88320):0);}return ~c;}
static inline void v8_put(uint8_t *p,uint64_t v,unsigned n){for(unsigned i=0;i<n;i++)p[i]=(uint8_t)(v>>(8*(n-1-i)));}
static inline uint64_t v8_get(const uint8_t *p,unsigned n){uint64_t v=0;for(unsigned i=0;i<n;i++)v=(v<<8)|p[i];return v;}
static inline int16_t v8_i16(uint16_t u){return u<=INT16_MAX?(int16_t)u:(int16_t)(-(int32_t)(UINT32_C(65536)-u));}
static inline bool v8_duty(int16_t x){return x>=-V8_MAX_DUTY&&x<=V8_MAX_DUTY;}
static inline void v8_encode(const V8Frame *f,uint8_t b[V8_WIRE_BYTES]){
 memset(b,0,V8_WIRE_BYTES);b[0]='V';b[1]='8';b[2]=1;b[3]=f->kind;b[4]=f->status;b[5]=f->flags;b[6]=f->reason;
 v8_put(b+8,f->sender,8);v8_put(b+16,f->receiver,8);v8_put(b+24,f->seq,4);v8_put(b+28,f->last_seq,4);
 v8_put(b+32,(uint16_t)f->left,2);v8_put(b+34,(uint16_t)f->right,2);v8_put(b+36,(uint16_t)f->api_left,2);v8_put(b+38,(uint16_t)f->api_right,2);
 v8_put(b+40,f->remaining_ms,2);v8_put(b+44,v8_crc(b,44),4);
}
static inline bool v8_decode(const uint8_t *b,size_t n,V8Frame *out){
 if(!b||!out||n!=V8_WIRE_BYTES||b[0]!='V'||b[1]!='8'||b[2]!=1||b[7]||b[42]||b[43]||v8_get(b+44,4)!=v8_crc(b,44))return false;
 V8Frame f={.kind=b[3],.status=b[4],.flags=b[5],.reason=b[6],.sender=v8_get(b+8,8),.receiver=v8_get(b+16,8),.seq=(uint32_t)v8_get(b+24,4),.last_seq=(uint32_t)v8_get(b+28,4),.left=v8_i16((uint16_t)v8_get(b+32,2)),.right=v8_i16((uint16_t)v8_get(b+34,2)),.api_left=v8_i16((uint16_t)v8_get(b+36,2)),.api_right=v8_i16((uint16_t)v8_get(b+38,2)),.remaining_ms=(uint16_t)v8_get(b+40,2)};
 if(!f.receiver||f.flags>7||f.reason>V8_RADIO_FAULT||f.status>V8_TOO_OLD||f.remaining_ms>500||!v8_duty(f.left)||!v8_duty(f.right)||!v8_duty(f.api_left)||!v8_duty(f.api_right))return false;
 if(f.kind==V8_HELLO){if(f.seq||f.status||f.left||f.right)return false;}
 else if(f.kind==V8_COMMAND){if(!f.sender||!f.seq||f.status||f.flags||f.reason||f.last_seq||f.api_left||f.api_right||f.remaining_ms)return false;}
 else if(f.kind==V8_ACK){if(!f.sender||!f.seq)return false;}
 else return false;
 *out=f;return true;
}
typedef struct {
 uint64_t own,bound_sender,last_tick,deadline,run_started,stopped_at,ramp_at;
 uint32_t last_seq;
 int16_t last_left,last_right,target_left,target_right,duty_left,duty_right;
 int8_t direction_left,direction_right;
 bool armed,fault;
 uint8_t reason;
 uint64_t accepted;
} V8Rover;
static inline bool v8_moving(const V8Rover *r){return r->target_left||r->target_right||r->duty_left||r->duty_right;}
static inline void v8_coast(V8Rover *r,uint64_t now,uint8_t reason){
 if(v8_moving(r))r->stopped_at=now;
 r->target_left=r->target_right=r->duty_left=r->duty_right=0;r->armed=false;r->deadline=0;r->run_started=0;r->reason=reason;
}
static inline void v8_latch(V8Rover *r,uint64_t now,uint8_t reason){v8_coast(r,now,reason);r->fault=true;}
static inline void v8_rover_init(V8Rover *r,uint64_t boot,uint64_t now){*r=(V8Rover){.own=boot,.last_tick=now,.stopped_at=now,.ramp_at=now,.reason=V8_BOOT};}
static inline int16_t v8_step(int16_t current,int16_t target){
 if(!target)return 0;
 if(current<target)return target-current>16?(int16_t)(current+16):target;
 if(current>target)return current-target>16?(int16_t)(current-16):target;
 return current;
}
/* Call before processing network requests. A late owner can only act when it
   resumes; neither this model nor PWM peripherals provide a hardware E-stop. */
static inline void v8_tick(V8Rover *r,uint64_t now,bool driver_fault,bool local_stop){
 if(now<r->last_tick){v8_latch(r,now,V8_CLOCK_FAULT);r->last_tick=now;return;}
 bool late=now-r->last_tick>V8_OWNER_GAP_US;r->last_tick=now;
 if(driver_fault){v8_latch(r,now,V8_DRIVER_FAULT);return;}
 if(local_stop){v8_latch(r,now,V8_LOCAL_STOP);return;}
 if(r->fault)return;
 if(late){v8_coast(r,now,V8_OWNER_LATE);r->stopped_at=now;return;}
 if(v8_moving(r)&&r->deadline&&now>=r->deadline){v8_coast(r,now,V8_LEASE_EXPIRED);return;}
 if(v8_moving(r)&&now-r->run_started>=V8_RUN_LIMIT_US){v8_coast(r,now,V8_RUN_LIMIT);return;}
 if(now>=r->ramp_at&&now-r->ramp_at>=50000){r->ramp_at=now;r->duty_left=v8_step(r->duty_left,r->target_left);r->duty_right=v8_step(r->duty_right,r->target_right);}
}
/* Pure candidate preparation. Owner commits candidate only after its bounded
   output update succeeds. Duplicate/rejected input never mutates state/lease. */
static inline uint8_t v8_prepare(const V8Rover *r,const V8Frame *f,uint64_t arrived,uint64_t now,V8Rover *next){
 if(f->kind!=V8_COMMAND||!r->own||f->receiver!=r->own||!f->sender||!f->seq||(r->bound_sender&&r->bound_sender!=f->sender))return V8_SESSION;
 if(!v8_duty(f->left)||!v8_duty(f->right))return V8_CONFLICT;
 if(f->seq<r->last_seq)return V8_STALE;
 if(f->seq==r->last_seq)return f->left==r->last_left&&f->right==r->last_right?V8_DUPLICATE:V8_CONFLICT;
 if(r->fault)return V8_FAULT;
 if(now<arrived||now-arrived>100000||arrived>UINT64_MAX-V8_LEASE_US)return V8_TOO_OLD;
 bool drive=f->left||f->right;
 if(drive){
  if(!r->armed)return V8_STOP_REQUIRED;
  if(!v8_moving(r)&&(now<r->stopped_at||now-r->stopped_at<V8_COAST_GAP_US))return V8_STOP_REQUIRED;
  if((r->direction_left>0&&f->left<0)||(r->direction_left<0&&f->left>0)||(r->direction_right>0&&f->right<0)||(r->direction_right<0&&f->right>0))return V8_STOP_REQUIRED;
 }
 *next=*r;next->bound_sender=f->sender;next->last_seq=f->seq;next->last_left=f->left;next->last_right=f->right;next->accepted++;
 if(!drive){v8_coast(next,now,V8_EXPLICIT_STOP);next->armed=true;next->direction_left=next->direction_right=0;next->ramp_at=now;return V8_ACCEPTED;}
 if(!v8_moving(r))next->run_started=now;
 if(f->left)next->direction_left=f->left>0?1:-1;
 if(f->right)next->direction_right=f->right>0?1:-1;
 next->target_left=f->left;next->target_right=f->right;next->deadline=arrived+V8_LEASE_US;
 /* Component zero requests coast that bridge immediately. */
 if(!f->left)next->duty_left=0;
 if(!f->right)next->duty_right=0;
 return V8_ACCEPTED;
}
static inline uint16_t v8_remaining(const V8Rover *r,uint64_t now){return !r->deadline||now>=r->deadline?0:(uint16_t)((r->deadline-now+999)/1000);}

// ---- main/w02_pair.h ----
/* SPDX-License-Identifier: MIT */
#pragma once
#include <stdbool.h>
#include <stdint.h>
#include <stddef.h>
#include <string.h>
/* Version1, explicit big-endian bytes; no native packed struct on wire. */
#define PAIR_BYTES 16
static inline void pair_encode(uint8_t b[PAIR_BYTES],uint64_t boot,uint32_t seq,bool on){
 b[0]='W';b[1]='1';b[2]=1;b[3]=on?1:0;
 for(unsigned i=0;i<8;i++)b[4+i]=(uint8_t)(boot>>(56-8*i));
 for(unsigned i=0;i<4;i++)b[12+i]=(uint8_t)(seq>>(24-8*i));
}
static inline bool pair_decode(const uint8_t *b,size_t n,uint64_t *boot,uint32_t *seq,bool *on){
 if(!b||!boot||!seq||!on||n!=PAIR_BYTES||b[0]!='W'||b[1]!='1'||b[2]!=1||b[3]>1)return false;
 uint64_t x=0;uint32_t y=0;
 for(unsigned i=0;i<8;i++)x=(x<<8)|b[4+i];
 for(unsigned i=0;i<4;i++)y=(y<<8)|b[12+i];
 if(!x||!y)return false;
 *boot=x;*seq=y;*on=b[3]!=0;return true;
}
static inline int pair_hex(char c){if(c>='0'&&c<='9')return c-'0';if(c>='a'&&c<='f')return c-'a'+10;if(c>='A'&&c<='F')return c-'A'+10;return -1;}
static inline bool pair_mac(const char *s,uint8_t out[6]){
 if(!s||strlen(s)!=17)return false;
 uint8_t m[6];unsigned sum=0;
 for(unsigned i=0;i<6;i++){
  int a=pair_hex(s[3*i]),b=pair_hex(s[3*i+1]);if(a<0||b<0||(i<5&&s[3*i+2]!=':'))return false;
  m[i]=(uint8_t)((a<<4)|b);sum|=m[i];
 }
 if(!sum||(m[0]&1))return false;
 memcpy(out,m,6);return true;
}
/* Startup press is not an event; stable released level must first arm. */
typedef struct {bool candidate,stable,armed;uint64_t since;} PairButton;
static inline bool pair_button(PairButton *b,bool pressed,uint64_t now){
 if(pressed!=b->candidate){b->candidate=pressed;b->since=now;}
 if(now-b->since<50000)return false;
 if(!pressed)b->armed=true;
 if(pressed==b->stable)return false;
 b->stable=pressed;
 if(pressed&&b->armed){b->armed=false;return true;}
 return false;
}

// ---- main/controller_model.h ----
/* SPDX-License-Identifier: MIT */
#pragma once
#include "rover_model.h"
#include "w02_pair.h"
#define V8_RETRY_US UINT64_C(120000)
#define V8_FRESH_US UINT64_C(100000)
#define V8_HELLO_AGE_US UINT64_C(3000000)
typedef struct {
 uint64_t own,remote,hello_at,ready_at,next_fresh,retry_at,direction_at,last_tick;
 uint32_t sequence;
 uint8_t attempts,direction_candidate,direction_stable,held_direction;
 bool initialized,peer_blocked,run_latch,stop_requested,stop_ready,pending,have_last_motion,clock_fault;
 PairButton deadman;
 V8Frame command,last_motion;
} V8Controller;
static inline bool v8_one_direction(uint8_t d){return d==1||d==2||d==4||d==8;}
static inline void v8_control_stop(V8Controller *c,bool send_stop){
 c->run_latch=false;c->stop_ready=false;c->pending=false;
 c->stop_requested=send_stop&&c->remote&&!c->peer_blocked;
 /* Existing press never becomes a new intent after a protocol failure. */
 c->deadman.armed=false;
}
static inline void v8_control_init(V8Controller *c,uint64_t boot,bool pressed,uint64_t now){
 *c=(V8Controller){.own=boot,.initialized=true,.last_tick=now,.direction_at=now,.deadman={.candidate=pressed,.stable=true,.since=now}};
}
static inline bool v8_control_recent(const V8Controller *c,uint64_t now){return c->remote&&!c->peer_blocked&&!c->clock_fault&&now>=c->hello_at&&now-c->hello_at<=V8_HELLO_AGE_US;}
static inline void v8_control_hello(V8Controller *c,const V8Frame *f,uint64_t now){
 if(f->kind!=V8_HELLO||!f->receiver)return;
 if(c->remote!=f->receiver){v8_control_stop(c,false);c->have_last_motion=false;c->remote=f->receiver;}
 c->hello_at=now;c->peer_blocked=(f->sender&&f->sender!=c->own)||(f->flags&V8_FLAG_FAULT);
 if(c->peer_blocked)v8_control_stop(c,false);
 else if(c->run_latch&&!(f->flags&V8_FLAG_ARMED))v8_control_stop(c,true);
}
static inline void v8_control_inputs(V8Controller *c,uint8_t direction,bool pressed,uint64_t now){
 if(now<c->last_tick){c->clock_fault=true;v8_control_stop(c,true);c->last_tick=now;return;}
 if(now-c->last_tick>V8_OWNER_GAP_US)v8_control_stop(c,true);
 c->last_tick=now;
 if(direction!=c->direction_candidate){c->direction_candidate=direction;c->direction_at=now;}
 if(now>=c->direction_at&&now-c->direction_at>=50000)c->direction_stable=direction;
 bool edge=pair_button(&c->deadman,pressed,now);
 if(c->run_latch&&(!pressed||direction!=c->held_direction))v8_control_stop(c,true);
 if(c->run_latch&&!v8_control_recent(c,now))v8_control_stop(c,true);
 if(edge&&v8_one_direction(direction)&&direction==c->direction_stable&&v8_control_recent(c,now)){
  c->run_latch=true;c->held_direction=direction;c->pending=false;c->stop_ready=false;c->stop_requested=true;
 }
}
static inline bool v8_control_queue(V8Controller *c,int16_t left,int16_t right,uint64_t now){
 if(!c->remote||c->peer_blocked||c->clock_fault||c->sequence==UINT32_MAX||!v8_duty(left)||!v8_duty(right))return false;
 /* Reserve the last sequence for a zero command; never roll back to one. */
 if((left||right)&&c->sequence>=UINT32_MAX-1){v8_control_stop(c,true);return false;}
 c->command=(V8Frame){.kind=V8_COMMAND,.sender=c->own,.receiver=c->remote,.seq=++c->sequence,.left=left,.right=right};
 c->pending=true;c->attempts=0;c->retry_at=now;
 if(left||right){c->last_motion=c->command;c->have_last_motion=true;c->next_fresh=now+V8_FRESH_US;}
 return true;
}
static inline bool v8_control_ack(V8Controller *c,const V8Frame *f,uint64_t now){
 if(!c->pending||f->kind!=V8_ACK||f->sender!=c->command.sender||f->receiver!=c->command.receiver||f->seq!=c->command.seq||f->left!=c->command.left||f->right!=c->command.right)return false;
 bool motion=c->command.left||c->command.right;c->pending=false;
 if(f->status>V8_DUPLICATE||f->last_seq!=c->command.seq||(f->flags&V8_FLAG_FAULT)||!(f->flags&V8_FLAG_API_KNOWN)||!(f->flags&V8_FLAG_ARMED)||(motion&&!f->remaining_ms)){
  v8_control_stop(c,motion);return true;
 }
 if(!motion){c->stop_ready=true;c->ready_at=now;}
 return true;
}
/* Returns0none,1attempt,2bounded application-ACK timeout. Call only after
   current physical inputs and peer events have been consumed by the owner. */
static inline unsigned v8_control_action(V8Controller *c,uint64_t now,bool radio_free){
 if(!radio_free)return 0;
 if(c->stop_requested&&!c->peer_blocked){
  c->stop_requested=false;
  if(!v8_control_queue(c,0,0,now))return 0;
 }
 if(!c->pending&&c->run_latch&&c->stop_ready&&v8_control_recent(c,now)&&now>=c->ready_at&&now-c->ready_at>=250000&&now>=c->next_fresh){
  int16_t left=0,right=0;
  if(c->held_direction==1)left=right=V8_MAX_DUTY;
  else if(c->held_direction==2)left=right=-V8_MAX_DUTY;
  else if(c->held_direction==4)right=V8_MAX_DUTY;
  else if(c->held_direction==8)left=V8_MAX_DUTY;
  if(!v8_control_queue(c,left,right,now))return 0;
 }
 if(!c->pending||now<c->retry_at)return 0;
 if(c->attempts>=4){bool motion=c->command.left||c->command.right;v8_control_stop(c,motion);return 2;}
 return 1;
}
static inline void v8_control_attempt(V8Controller *c,uint64_t now){c->attempts++;c->retry_at=now+V8_RETRY_US;}
/* Bench-only exact replay, not a new motion intent. No heartbeat/lease reset.
   Physical release remains required before another intentional run. */
static inline bool v8_control_replay(V8Controller *c,uint64_t now){
 if(c->run_latch||c->pending||c->stop_requested||!c->have_last_motion||c->last_motion.receiver!=c->remote||!v8_control_recent(c,now))return false;
 c->command=c->last_motion;c->pending=true;c->attempts=0;c->retry_at=now;return true;
}

// ---- main/rover_output.h ----
/* SPDX-License-Identifier: MIT */
#pragma once
#include "driver/ledc.h"
#include "rover_model.h"
/* All four calls are attempted even after one error. This requests low logic;
   success does not prove bridge voltage or physical shaft stop. */
static inline esp_err_t v8_output_coast(void){
 esp_err_t first=ESP_OK;
 for(unsigned i=0;i<4;i++){esp_err_t e=ledc_stop(LEDC_LOW_SPEED_MODE,(ledc_channel_t)i,0);if(first==ESP_OK&&e!=ESP_OK)first=e;}
 return first;
}
static inline esp_err_t v8_output_bridge(unsigned base,int16_t value){
 if(base>2||(base&1)||!v8_duty(value))return ESP_ERR_INVALID_ARG;
 if(!value){esp_err_t a=ledc_stop(LEDC_LOW_SPEED_MODE,(ledc_channel_t)base,0);esp_err_t b=ledc_stop(LEDC_LOW_SPEED_MODE,(ledc_channel_t)(base+1),0);return a==ESP_OK?b:a;}
 unsigned selected=base+(value<0?1:0),opposite=base+(value<0?0:1);
 esp_err_t e=ledc_stop(LEDC_LOW_SPEED_MODE,(ledc_channel_t)opposite,0);
 if(e==ESP_OK)e=ledc_set_duty(LEDC_LOW_SPEED_MODE,(ledc_channel_t)selected,(uint32_t)(value<0?-value:value));
 return e==ESP_OK?ledc_update_duty(LEDC_LOW_SPEED_MODE,(ledc_channel_t)selected):e;
}
static inline esp_err_t v8_output_pair(int16_t left,int16_t right){
 if(!v8_duty(left)||!v8_duty(right))return ESP_ERR_INVALID_ARG;
 esp_err_t e=v8_output_bridge(0,left);
 return e==ESP_OK?v8_output_bridge(2,right):e;
}

// ---- main/rover_owner.h ----
/* SPDX-License-Identifier: MIT */
#pragma once
#include "rover_output.h"
typedef struct { bool known; int16_t left,right; } V8ApiOutput;
/* Sole owner uses this exact helper for tick and candidate commits. Last
   successful API request is retained after failure, with known=false. */
static inline bool v8_owner_write(V8Rover *r,V8ApiOutput *io,int16_t left,int16_t right,uint64_t now){
 if(!io->known){(void)v8_output_coast();return false;}
 if(left==io->left&&right==io->right)return true;
 esp_err_t e=left||right?v8_output_pair(left,right):v8_output_coast();
 if(e!=ESP_OK){(void)v8_output_coast();io->known=false;v8_latch(r,now,V8_API_FAULT);return false;}
 io->left=left;io->right=right;return true;
}
static inline void v8_owner_tick(V8Rover *r,V8ApiOutput *io,uint64_t now,bool fault,bool stop){
 v8_tick(r,now,fault,stop);
 (void)v8_owner_write(r,io,r->duty_left,r->duty_right,now);
}
static inline uint8_t v8_owner_command(V8Rover *r,V8ApiOutput *io,const V8Frame *f,uint64_t at,uint64_t now){
 V8Rover candidate;uint8_t status=v8_prepare(r,f,at,now,&candidate);
 if(status!=V8_ACCEPTED)return status;
 /* Do not commit seq/target until this immediate output update succeeds. */
 if(!v8_owner_write(r,io,candidate.duty_left,candidate.duty_right,now))return V8_FAULT;
 *r=candidate;return V8_ACCEPTED;
}
static inline V8Frame v8_owner_feedback(const V8Rover *r,const V8ApiOutput *io,const V8Frame *command,uint8_t status,uint64_t now){
 V8Frame f={.kind=command?V8_ACK:V8_HELLO,.status=command?status:0,
  .flags=(io->known?V8_FLAG_API_KNOWN:0)|(r->armed?V8_FLAG_ARMED:0)|(r->fault?V8_FLAG_FAULT:0),
  .reason=r->reason,.sender=command?command->sender:r->bound_sender,.receiver=r->own,
  .seq=command?command->seq:0,.last_seq=r->last_seq,.left=command?command->left:0,.right=command?command->right:0,
  .api_left=io->left,.api_right=io->right,.remaining_ms=v8_remaining(r,now)};
 return f;
}

// ---- main/main.c ----
/* SPDX-License-Identifier: MIT */
#include <stdio.h>
#include <inttypes.h>
#include <string.h>
#include "freertos/FreeRTOS.h"
#include "freertos/task.h"
#include "freertos/queue.h"
#include "esp_event.h"
#include "esp_log.h"
#include "esp_mac.h"
#include "esp_netif.h"
#include "esp_now.h"
#include "esp_random.h"
#include "esp_timer.h"
#include "esp_wifi.h"
#include "nvs_flash.h"
#include "driver/gpio.h"
#include "rover_owner.h"
#include "controller_model.h"
#ifdef CONFIG_V8_CONTROLLER
#define CONTROLLER 1
#else
#define CONTROLLER 0
#endif
#ifndef CONFIG_V8_DROP_FIRST_ACK
#define CONFIG_V8_DROP_FIRST_ACK 0
#endif
static const char *TAG="V08";
typedef struct {bool tx;int status;uint64_t at;uint8_t data[V8_WIRE_BYTES];} V8Event;
static QueueHandle_t events;
static uint8_t peer[6];
static portMUX_TYPE drops_lock=portMUX_INITIALIZER_UNLOCKED;
static unsigned drops;
/* The high-priority Wi-Fi callbacks only whitelist and copy bounded data.
   No motor API, printf, retries, model or user input is handled here. */
static void post(const V8Event *e){
 if(xQueueSend(events,e,0)!=pdTRUE){portENTER_CRITICAL(&drops_lock);drops++;portEXIT_CRITICAL(&drops_lock);}
}
static void received(const esp_now_recv_info_t *i,const uint8_t *d,int n){
 if(!i||!i->src_addr||!d||n!=V8_WIRE_BYTES||memcmp(i->src_addr,peer,6))return;
 V8Event e={.at=(uint64_t)esp_timer_get_time()};memcpy(e.data,d,sizeof e.data);post(&e);
}
static void sent(const esp_now_send_info_t *i,esp_now_send_status_t status){
 if(!i||!i->des_addr||memcmp(i->des_addr,peer,6))return;
 V8Event e={.tx=true,.status=status,.at=(uint64_t)esp_timer_get_time()};post(&e);
}
static unsigned queue_drops(void){portENTER_CRITICAL(&drops_lock);unsigned n=drops;portEXIT_CRITICAL(&drops_lock);return n;}
static bool parse_mac(const char *s,uint8_t mac[6]){
 if(!s||strlen(s)!=17)return false;
 unsigned any=0;
 for(unsigned k=0;k<6;k++){
  unsigned x=0;
  for(unsigned j=0;j<2;j++){
   unsigned char c=(unsigned char)s[k*3+j];unsigned v;
   if(c>='0'&&c<='9')v=c-'0';else if(c>='a'&&c<='f')v=c-'a'+10;else if(c>='A'&&c<='F')v=c-'A'+10;else return false;
   x=x*16+v;
  }
  if(k<5&&s[k*3+2]!=':')return false;
  mac[k]=(uint8_t)x;any|=x;
 }
 return any&&!(mac[0]&1);
}
static esp_err_t inputs(uint64_t pins){gpio_config_t c={.pin_bit_mask=pins,.mode=GPIO_MODE_INPUT,.pull_up_en=GPIO_PULLUP_DISABLE,.pull_down_en=GPIO_PULLDOWN_DISABLE,.intr_type=GPIO_INTR_DISABLE};return gpio_config(&c);}
static esp_err_t hardware_init(void){
 if(CONTROLLER)return inputs((1ULL<<4)|(1ULL<<5)|(1ULL<<6)|(1ULL<<7)|(1ULL<<10)|(1ULL<<11));
 const int pins[4]={16,17,18,21};uint64_t mask=0;
 for(unsigned k=0;k<4;k++){esp_err_t e=gpio_set_level(pins[k],0);if(e!=ESP_OK)return e;mask|=1ULL<<pins[k];}
 gpio_config_t c={.pin_bit_mask=mask,.mode=GPIO_MODE_OUTPUT,.pull_up_en=GPIO_PULLUP_DISABLE,.pull_down_en=GPIO_PULLDOWN_DISABLE};
 esp_err_t e=gpio_config(&c);if(e!=ESP_OK)return e;
 e=inputs((1ULL<<4)|(1ULL<<10));if(e!=ESP_OK)return e;
 ledc_timer_config_t t={.speed_mode=LEDC_LOW_SPEED_MODE,.duty_resolution=LEDC_TIMER_10_BIT,.timer_num=LEDC_TIMER_0,.freq_hz=20000,.clk_cfg=LEDC_USE_APB_CLK};
 e=ledc_timer_config(&t);if(e!=ESP_OK)return e;
 for(unsigned k=0;k<4;k++){
  ledc_channel_config_t ch={.gpio_num=pins[k],.speed_mode=LEDC_LOW_SPEED_MODE,.channel=(ledc_channel_t)k,.timer_sel=LEDC_TIMER_0,.duty=0,.hpoint=0};
  e=ledc_channel_config(&ch);if(e!=ESP_OK){(void)v8_output_coast();return e;}
 }
 return v8_output_coast();
}
static esp_err_t radio_init(void){
 esp_err_t e=nvs_flash_init(); /* No automatic NVS erase on version/full errors. */
 if(e!=ESP_OK)return e;
 e=esp_netif_init();if(e!=ESP_OK)return e;
 e=esp_event_loop_create_default();if(e!=ESP_OK)return e;
 wifi_init_config_t cfg=WIFI_INIT_CONFIG_DEFAULT();
 e=esp_wifi_init(&cfg);if(e!=ESP_OK)return e;
 e=esp_wifi_set_storage(WIFI_STORAGE_RAM);if(e!=ESP_OK)return e;
 e=esp_wifi_set_mode(WIFI_MODE_STA);if(e!=ESP_OK)return e;
 e=esp_wifi_start();if(e!=ESP_OK)return e;
 e=esp_wifi_set_ps(WIFI_PS_NONE);if(e!=ESP_OK)return e;
 wifi_country_t country={0};e=esp_wifi_get_country(&country);if(e!=ESP_OK)return e;
 if(CONFIG_V8_CHANNEL<country.schan||CONFIG_V8_CHANNEL>=country.schan+country.nchan)return ESP_ERR_INVALID_ARG;
 e=esp_wifi_set_channel(CONFIG_V8_CHANNEL,WIFI_SECOND_CHAN_NONE);if(e!=ESP_OK)return e;
 events=xQueueCreate(16,sizeof(V8Event));if(!events)return ESP_ERR_NO_MEM;
 e=esp_now_init();if(e!=ESP_OK)return e;
 e=esp_now_register_recv_cb(received);if(e!=ESP_OK)return e;
 e=esp_now_register_send_cb(sent);if(e!=ESP_OK)return e;
 esp_now_peer_info_t p={.channel=0,.ifidx=WIFI_IF_STA,.encrypt=false};memcpy(p.peer_addr,peer,6);
 return esp_now_add_peer(&p);
}
static uint64_t nonce(void){uint64_t n=0;do{esp_fill_random(&n,sizeof n);}while(!n);return n;}
static esp_err_t transmit(const V8Frame *f,bool *busy,uint64_t *since){
 uint8_t bytes[V8_WIRE_BYTES];v8_encode(f,bytes);
 esp_err_t e=esp_now_send(peer,bytes,sizeof bytes);
 if(e==ESP_OK){*busy=true;*since=(uint64_t)esp_timer_get_time();}
 return e;
}
static void print_feedback(const V8Frame *f){
 ESP_LOGI(TAG,"FEEDBACK kind=%u seq=%"PRIu32" status=%u last_seq=%"PRIu32" flags=%u reason=%u api_last=%d,%d remaining_ms=%u; NOT shaft/RPM",f->kind,f->seq,f->status,f->last_seq,f->flags,f->reason,f->api_left,f->api_right,f->remaining_ms);
}
static void rover_transition(const V8Rover *r,const V8ApiOutput *io){
 static bool have;static V8Rover last;static V8ApiOutput previous;
 if(have&&last.target_left==r->target_left&&last.target_right==r->target_right&&last.reason==r->reason&&last.armed==r->armed&&last.fault==r->fault&&previous.left==io->left&&previous.right==io->right&&previous.known==io->known)return;
 /* Sampled after synchronous output helper returns: software observation,
    neither exact GPIO-edge timestamp nor physical shaft-stop time. */
 ESP_LOGI(TAG,"OUTPUT_STATE mono_us=%"PRIu64" target=%d,%d api_last=%d,%d known=%u arm=%u fault=%u reason=%u deadline_us=%"PRIu64,(uint64_t)esp_timer_get_time(),r->target_left,r->target_right,io->left,io->right,io->known,r->armed,r->fault,r->reason,r->deadline);
 last=*r;previous=*io;have=true;
}
void app_main(void){
 uint8_t own[6]={0};esp_err_t e=hardware_init();
 if(e!=ESP_OK){ESP_LOGE(TAG,"HW_INIT=%s; keep motor VIN switched OFF; inspect, RESET",esp_err_to_name(e));return;}
 e=esp_read_mac(own,ESP_MAC_WIFI_STA);if(e!=ESP_OK){ESP_LOGE(TAG,"MAC=%s; radio CLOSED",esp_err_to_name(e));return;}
 ESP_LOGI(TAG,"STA="MACSTR" role=%s GPIO map is role-specific; physical=UNTESTED",MAC2STR(own),CONTROLLER?"controller":"rover");
 if(!parse_mac(CONFIG_V8_PEER_MAC,peer)||!memcmp(peer,own,6)){
  ESP_LOGW(TAG,"PEER missing/invalid/self: radio CLOSED, outputs requested0/0; configure actual other STA MAC in a NEW build directory");return;
 }
 e=radio_init();if(e!=ESP_OK){if(!CONTROLLER)(void)v8_output_coast();ESP_LOGE(TAG,"RADIO_INIT=%s; diagnose then RESET; NVS was NOT erased",esp_err_to_name(e));return;}
 uint64_t now=(uint64_t)esp_timer_get_time(),boot=nonce(),radio_at=0,hello_at=now,report_at=now;
 V8Rover rover;v8_rover_init(&rover,boot,now);V8ApiOutput io={.known=true};
 V8Controller control;v8_control_init(&control,boot,gpio_get_level(GPIO_NUM_10)==0,now);
 PairButton replay={.candidate=CONTROLLER&&gpio_get_level(GPIO_NUM_11)==0,.stable=true,.since=now};
 bool busy=false,radio_fault=false,ack_pending=false,dropped_ack=false;V8Frame ack_command={0};uint8_t ack_status=0;
 ESP_LOGI(TAG,"BOOT=%016"PRIx64" channel=%d, unencrypted bench; CRC/MAC are NOT authentication. Lease500ms/ownerGap100ms/runCap3s",boot,CONFIG_V8_CHANNEL);
 for(;;){
  now=(uint64_t)esp_timer_get_time();
  if(queue_drops()||(busy&&now>=radio_at&&now-radio_at>2000000))radio_fault=true;
  if(!CONTROLLER){if(radio_fault)v8_latch(&rover,now,V8_RADIO_FAULT);v8_owner_tick(&rover,&io,now,gpio_get_level(GPIO_NUM_4)==0,gpio_get_level(GPIO_NUM_10)==0);rover_transition(&rover,&io);}
  /* Finite work each turn. Dequeue BEFORE reading now; callback timestamps may
     otherwise be in the apparent future after a cross-core interleaving. */
  for(unsigned handled=0;handled<16;handled++){
   V8Event ev;if(xQueueReceive(events,&ev,0)!=pdTRUE)break;now=(uint64_t)esp_timer_get_time();
   if(ev.tx){busy=false;ESP_LOGD(TAG,"MAC delivery=%d, not application ACK",ev.status);continue;}
   V8Frame f;if(now<ev.at||now-ev.at>100000||!v8_decode(ev.data,sizeof ev.data,&f))continue;
   if(CONTROLLER){
    if(f.kind==V8_HELLO){v8_control_hello(&control,&f,ev.at);print_feedback(&f);}
    else if(f.kind==V8_ACK){if(v8_control_ack(&control,&f,now))print_feedback(&f);}
   }else if(f.kind==V8_COMMAND){
    v8_owner_tick(&rover,&io,now,gpio_get_level(GPIO_NUM_4)==0,gpio_get_level(GPIO_NUM_10)==0);
    uint8_t status=v8_owner_command(&rover,&io,&f,ev.at,now);
    rover_transition(&rover,&io);
    ESP_LOGI(TAG,"REQUEST seq=%"PRIu32" target=%d,%d status=%u accepted=%"PRIu64" deadline_us=%"PRIu64"",f.seq,f.left,f.right,status,rover.accepted,rover.deadline);
    if(CONFIG_V8_DROP_FIRST_ACK&&!dropped_ack&&status==V8_ACCEPTED&&(f.left||f.right)){
     dropped_ack=true;ESP_LOGW(TAG,"BENCH omit first accepted motion APP_ACK; duplicates must NOT rewrite or renew");
    }else{ack_command=f;ack_status=status;ack_pending=true;}
   }
  }
  now=(uint64_t)esp_timer_get_time();
  if(CONTROLLER){
   uint8_t d=(gpio_get_level(GPIO_NUM_4)==0?1:0)|(gpio_get_level(GPIO_NUM_5)==0?2:0)|(gpio_get_level(GPIO_NUM_6)==0?4:0)|(gpio_get_level(GPIO_NUM_7)==0?8:0);
   v8_control_inputs(&control,d,gpio_get_level(GPIO_NUM_10)==0,now);
   if(radio_fault){control.clock_fault=true;v8_control_stop(&control,false);}
   if(pair_button(&replay,gpio_get_level(GPIO_NUM_11)==0,now))ESP_LOGI(TAG,"BENCH replay accepted=%u; never new sequence",v8_control_replay(&control,now));
   unsigned action=v8_control_action(&control,now,!busy&&!radio_fault);
   if(action==1){
    e=transmit(&control.command,&busy,&radio_at);v8_control_attempt(&control,now);
    ESP_LOGI(TAG,"SEND seq=%"PRIu32" target=%d,%d attempt=%u err=%s",control.command.seq,control.command.left,control.command.right,control.attempts,esp_err_to_name(e));
    if(e!=ESP_OK)radio_fault=true;
   }else if(action==2)ESP_LOGW(TAG,"APP_ACK_TIMEOUT: execution uncertain; disarmed, bounded STOP queued if applicable");
  }else if(!busy&&!radio_fault){
   if(ack_pending){V8Frame f=v8_owner_feedback(&rover,&io,&ack_command,ack_status,now);e=transmit(&f,&busy,&radio_at);if(e==ESP_OK)ack_pending=false;else radio_fault=true;}
   else if(now>=hello_at){V8Frame f=v8_owner_feedback(&rover,&io,NULL,0,now);e=transmit(&f,&busy,&radio_at);hello_at=now+1000000;if(e!=ESP_OK)radio_fault=true;}
  }
  if(now>=report_at){
   report_at=now+1000000;
   if(CONTROLLER)ESP_LOGI(TAG,"STATE controller boot=%016"PRIx64" peer=%016"PRIx64" intent=%u pending=%u radio_fault=%u drops=%u",boot,control.remote,control.run_latch,control.pending,radio_fault,queue_drops());
   else ESP_LOGI(TAG,"STATE rover boot=%016"PRIx64" target=%d,%d api_last=%d,%d known=%u arm=%u fault=%u reason=%u lease_ms=%u",boot,rover.target_left,rover.target_right,io.left,io.right,io.known,rover.armed,rover.fault,rover.reason,v8_remaining(&rover,now));
  }
  vTaskDelay(pdMS_TO_TICKS(10));
 }
}

clang -std=c11 -Wall -Wextra -Werror -fsanitize=address,undefined -fno-omit-frame-pointer host_check.c -o /tmp/v08-rover-host
/tmp/v08-rover-host
clang -std=c11 -Wall -Wextra -Werror -fsanitize=address,undefined -fno-omit-frame-pointer host_controller.c -o /tmp/v08-controller-host
/tmp/v08-controller-host
clang -std=c11 -Wall -Wextra -Werror -fsanitize=address,undefined -fno-omit-frame-pointer -Imain -Itests/stubs tests/output_owner.c -o /tmp/v08-output-host
/tmp/v08-output-host
python3 tests/actual_main_body.py /tmp/v08-main-body
clang -std=c11 -Wall -Wextra -Werror -fsanitize=address,undefined -fno-omit-frame-pointer -Imain -Itests/stubs tests/protocol_loop.c -o /tmp/v08-loop-host
/tmp/v08-loop-host