fix: restart from WebUI no longer needs the browser tab to stay open

A restart requested from the WebUI (Restart button, firmware upload,
firmware update from URL, settings or customization upload) is set to
PENDING_RESTART and was only escalated to RESTART_REQUESTED when the
WebUI's SystemMonitor polled /rest/systemStatus. If the tab was closed,
nothing ever escalated it and the generic 5 minute status timeout reset
it back to NORMAL, so the restart was dropped and an uploaded firmware
was never booted.

- System::loop() now escalates a pending restart itself if it hasn't been
  picked up within 10 seconds (the SystemMonitor polls every second)
- the generic status reset timeout skips PENDING_RESTART, and its timer is
  cleared whenever the status is back to normal, so a start time left over
  from an earlier status can't reset a later one (e.g. a pending restart
  right after a firmware download) immediately

CHANGELOG_LATEST.md

@@ -32,6 +32,7 @@ This release is based on the latest Espressif/Arduino core version 3. It brings
 
 ## Fixed
 
+- restart from the WebUI (Restart button, firmware/settings upload) only happened while the browser tab stayed open. If the tab was closed the restart was silently dropped after 5 minutes, leaving a new firmware uninstalled. EMS-ESP now restarts on its own if the WebUI hasn't picked up the pending restart within 10 seconds
 - shunting yard show json
 - `system/sendmail` called from a Command or the Scheduler computed its value twice, which stripped the quotes from literal text and then failed on characters like `!`. Also shunting yard treated a `?` inside a quoted string as a ternary, so text like `"too hot?"` returned nothing
 - memory leak when using different timezones for ems-esp and thermostat[#3184](https://github.com/emsesp/EMS-ESP32/issues/3184)

src/core/emsesp.cpp

@@ -2110,9 +2110,11 @@ void EMSESP::loop() {
         }
     }
 
-    // reset status after a timeout
-    if (EMSESP::system_.systemStatus() != SYSTEM_STATUS::SYSTEM_STATUS_NORMAL) {
-        static uint32_t starttime = 0;
+    // reset status after a timeout. A pending restart is never reset, it's handled in System::loop()
+    static uint32_t starttime = 0;
+    if (EMSESP::system_.systemStatus() == SYSTEM_STATUS::SYSTEM_STATUS_NORMAL || EMSESP::system_.systemStatus() == SYSTEM_STATUS::SYSTEM_STATUS_PENDING_RESTART) {
+        starttime = 0;
+    } else {
         if (starttime == 0) {
             starttime = uuid::get_uptime_ms();
         } else if (uuid::get_uptime_ms() - starttime > SYSTEM_STATUS_RESET_TIMEOUT) {

src/core/system.cpp

@@ -1025,6 +1025,20 @@ void System::uart_init() {
 // checks system health and handles LED flashing wizardry
 // returns true if the LED flash is active
 bool System::loop() {
+    // a restart requested from the WebUI is first set to pending, so the WebUI's SystemMonitor can pick it up
+    // and show the restart screen before the connection drops. Don't depend on the browser tab staying open though:
+    // if nothing has polled the status after a short grace period, go ahead and restart anyway
+    if (systemStatus() == SYSTEM_STATUS::SYSTEM_STATUS_PENDING_RESTART) {
+        if (pending_restart_start_ == 0) {
+            pending_restart_start_ = uuid::get_uptime_ms();
+        } else if (uuid::get_uptime_ms() - pending_restart_start_ > PENDING_RESTART_TIMEOUT) {
+            LOG_INFO("No WebUI response to pending restart, restarting now");
+            systemStatus(SYSTEM_STATUS::SYSTEM_STATUS_RESTART_REQUESTED);
+        }
+    } else {
+        pending_restart_start_ = 0;
+    }
+
     // check if we're supposed to do a reset/restart
     if (systemStatus() == SYSTEM_STATUS::SYSTEM_STATUS_RESTART_REQUESTED) {
         system_restart();

src/core/system.h

@@ -391,6 +391,11 @@ class System {
 
     volatile uint8_t systemStatus_; // uses SYSTEM_STATUS enum - written from the AsyncTCP task (e.g. cancel) and read from the main loop during OTA
 
+    uint32_t pending_restart_start_ = 0; // uptime (ms) when a pending restart was first seen in the main loop
+    // restart anyway if a pending restart hasn't been picked up by the WebUI within this time (in ms)
+    // the SystemMonitor polls every second, so this only kicks in when the browser tab was closed or lost connection
+    static constexpr uint32_t PENDING_RESTART_TIMEOUT = 10000;
+
     void set_partition_install_date();
 
     volatile bool recovery_installed_pending_ = false; // set by the main loop, handled on the AsyncTCP task