Fix seven storage, capture and UI defects found by review and bench testing

[hammad42]

What this changes

Seven defects found by code review and by bench testing on real hardware, plus a
backup CLI. Five were reported findings; two more surfaced while verifying them.

Storage and capture safety

• Out-of-bounds write in consumeDecode(). The bound came from the
  library's getCorrectedRawLength(), which budgets over rawbuf[0..rawlen-2],
  while the write loop walks rawbuf[1..rawlen-1]. Different sets: it reserves
  split-space for the leading gap we drop and never write, and none for the final
  element we do write. An interval above 65535 us in that last slot costs two
  unbudgeted entries and runs past the end of capBuf_. The leading gap is
  normally the largest value in the buffer, so its surplus had been masking the
  shortfall — luck, not correctness. Now counted over exactly the elements the
  loop reads, with a hard guard inside the loop as defence in depth.
• LittleFS left unmounted after a failed filesystem OTA. A filesystem update
  unmounts before Update.begin(); if that call failed, nothing remounted and
  the device ran with no storage until reboot — no web UI, no commands, no
  schedule saves. Tracked with a flag and remounted from every terminal path.
  The remount is now begin(false): quietly reformatting a half-written
  partition would destroy every learned command with no confirmation.
• Schedules deleted by a storage glitch. pruneMissingCommands() ran at
  boot regardless of whether the store mounted, and persists its result. A store
  that failed to mount made every schedule look orphaned, and they were deleted
  permanently while the commands were very likely still intact. Now gated on a
  successful mount, plus a guard that refuses to prune when the store is empty
  but schedules exist.
• IrStore::begin() formatted silently. LittleFS.begin(true) reformats on
  any mount failure — right for a blank partition, catastrophic for a damaged
  one, and the boot log looked normal afterwards. It now attempts a plain mount
  first and says what it is about to erase.

Usability

• "Discard" was a no-op on a finished capture. cancelLearn() only acted
  while still listening, so the state stayed Captured and the UI redrew the
  same card. The buffer kept the data too, so a following "capture another part"
  appended to the signal the user had just rejected.
• Stored passwords could not be cleared. Both layers refused empty secrets,
  so joining an open WiFi network, using an anonymous MQTT broker, or reopening
  the setup AP were impossible without a factory reset — which also destroys
  every learned command. The API now follows ordinary REST semantics (absent =
  unchanged, present = write it, including ""), and each field gained an
  explicit Clear it tick, since typing nothing should still mean "no change".
• WiFi scan showed one network out of nine. The SSID box was an
  <input list="...">, and a datalist filters against whatever is already typed
  in its input — which is pre-filled with the current network. Replaced with an
  explicit tap-to-pick list showing signal bars, RSSI and open networks.

Added

• tools/ir-backup.sh — save, list and restore learned commands over the REST
  API from a terminal. A filesystem update erases every command and the docs
  have always said to back up first, but the only way to do it was clicking
  through the browser, which is no use inside a flashing script.

Why

Every one of these turns a recoverable situation into damage, or hides a
working system behind a broken control. The three storage bugs share a theme
worth calling out: the codebase treated formatting the flash as a benign
recovery step in three separate places, and it never is.

The backup script exists because I hand-rolled the same extraction regex twice
while testing and got it wrong the second time, coming within one command of
losing a real air-conditioner capture.

How it was tested

• All four targets build: pio run -e esp32dev -e esp32dev_oled -e esp32s3 -e esp32c3 — clean, zero warnings
• Web UI exercised in a browser against the mock: untouched form sends no secret fields, "Clear it" sends "", typing sends the value; all four scanned networks render where the datalist showed one; tapping a row fills the SSID
• Tested on hardware — ESP32-D0WDQ6, VS1838B receiver, 2N2222-driven IR LED, updated over the air:
  • loopback self-test passes; NEC / SAMSUNG / SONY / RC5 all round-trip
  • mqttPass set → mqttPassSet: true; field omitted → stays true; explicit "" → false
  • learn cancel returns to idle with the capture buffer emptied
  • a schedule survives a reboot with its command store intact
  • six commands backed up, filesystem OTA'd, all six restored with timings and frame counts intact
• Documentation in docs/ updated — API.md (settings contract), USAGE.md (backup CLI, firmware-vs-filesystem)
• CHANGELOG.md updated under Unreleased

Notes for the reviewer

Two paths are reasoned about rather than exercised. Reproducing the failed
filesystem OTA and the corrupt-partition format means deliberately feeding a
device a damaged image while it holds real captures. I did not do that to a
working unit. The logic is straightforward to read; the flag is set at the one
unmount and cleared at every exit.

One reported finding is deliberately not fixed — a claimed receiver lockout
after transmitting while the diagnostics monitor is active. Every path is
balanced: sendStored, testCapture, sendRawArray and selfTest each
restore the receiver they disabled, enableIRIn() resumes internally, txBusy_
is cleared on all exits including the send-failure path, and the monitor branch
in loop() always resumes. Editing the receiver state machine on an
unreproduced report is precisely how the null-timer crash on main got in, so
this needs a bench repro first.

The goto overflow in consumeDecode() is unreachable by construction now
that the bound is exact. It stays because that loop writes a fixed buffer from
interrupt-sourced data, and a future arithmetic slip should surface as a
reported error rather than as silent corruption.

🤖 Generated with Claude Code