Phase 03: ESP32-C5 serial link hardening + bench diagnostics

Enumeration:
- Merge the library's stock probe table instead of replacing it, so adding
  Espressif 0x303A/0x1001 doesn't drop every other supported device
- Select the ESP32-C5 by VID/PID rather than list position
- Log USB interface descriptors to distinguish CDC data from the JTAG interface
Lifecycle:
- Don't close the shared port in MqttViewModel.onCleared() - the foreground
  recording service outlives the ViewModel and would beacon into a dead port
- Handle ACTION_USB_DEVICE_DETACHED so the UI stops reporting a stale link
- Implement the STATUS heartbeat on both sides (1 Hz) plus a phone-side watchdog
- Surface write failures and firmware drop counters on the CAM Pinger card
Protocol:
- Assert DTR/RTS on open (unverified on hardware - see FLASHING.md step 5)
- Raise SERIAL_LINK_MAX_PAYLOAD 160 -> 512 on both sides; real third-party CAMs
  exceed 160 and were being silently dropped at the resync branch
- Move the enlarged buffers off task stacks; serialize send_frame with a mutex
Firmware and app must be updated together - a 512/160 mismatch fails silently.

obu-firmware/main/serial_link.h

@@ -4,11 +4,18 @@
 #include <stddef.h>
 #include <stdbool.h>
 
-// Binary framing for the phone <-> ESP32-C5 link (Phase 03). Deliberately NOT the same UART as
-// the ESP-IDF console/ESP_LOG output (UART0, see sdkconfig CONFIG_ESP_CONSOLE_UART_NUM=0) -
-// mixing binary frames with human-readable log text on one wire would corrupt both. This runs
-// on a dedicated UART (see SERIAL_LINK_UART_NUM / TX / RX pins below - CHANGE THESE to match
-// your board's actual wiring from the USB-C connector's UART bridge to ESP32-C5 GPIOs).
+// Binary framing for the phone <-> ESP32-C5 link (Phase 03). This runs over the ESP32-C5's
+// native USB Serial/JTAG peripheral (driver/usb_serial_jtag.h) - the same physical USB-C port
+// used for JTAG, exposed to the host as a fixed-VID/PID (0x303A/0x1001) USB CDC-ACM device.
+// Deliberately NOT the same wire as the ESP-IDF console/ESP_LOG output, which stays on the
+// OTHER USB-C port (the UART-bridge one, UART0, see sdkconfig CONFIG_ESP_CONSOLE_UART_NUM=0) -
+// mixing binary frames with human-readable log text on one wire would corrupt both, and this
+// way they're physically separate ports so there's no risk of that regardless.
+//
+// On the Android side, connect the phone (via USB-OTG) to the board's NATIVE USB-C port, not
+// the UART-bridge/flashing port. The usb-serial-for-android library's default prober doesn't
+// know Espressif's 0x303A/0x1001 VID/PID, so UsbSerialTransport.kt registers it manually via a
+// custom ProbeTable pointed at CdcAcmSerialDriver - see that file's KDoc.
 //
 // Frame format (both directions, symmetric):
 //   [0xAA][0x55][type:1][length:2 LE][payload: length bytes][crc16:2 LE]
@@ -26,29 +33,39 @@
 //     framing by gn_unwrap.c. The phone never sees raw 802.11 frames. No station id is carried
 //     separately - CAM's own ItsPduHeader.stationID (the first field inside the UPER bytes) is
 //     already the meaningful identifier; see gn_unwrap.h for why a second one isn't added here.
-//   SERIAL_MSG_STATUS (0x03), ESP32 -> phone: 1-byte heartbeat (0 = ok), sent periodically so
-//     the phone can distinguish "link idle" from "link dead" independent of CAM traffic.
+//   SERIAL_MSG_STATUS (0x03), ESP32 -> phone: heartbeat + counters, sent at 1 Hz so the phone can
+//     distinguish "link idle" from "link dead" independent of CAM traffic (the app's watchdog in
+//     UsbSerialTransport.kt declares the link dead after 3 missed beats). Payload is 7 bytes:
+//       [status:1][oversize_drops:2 LE][tx_failures:2 LE][rx_crc_errors:2 LE]
+//     status 0 = ok. The counters are free-running totals since boot, saturating at 0xFFFF.
+//     They exist because the alternative - ESP_LOGW on the flashing port - is invisible to the
+//     phone, which is the only thing watching during a bench session. Mirrored by EspLinkStatus
+//     in the app's SerialFrame.kt.
 #define SERIAL_MSG_CAM_TX   0x01
 #define SERIAL_MSG_CAM_RX   0x02
 #define SERIAL_MSG_STATUS   0x03
 
-// CHANGE THESE to match your board's actual USB-C -> UART bridge wiring. UART0 is already
-// claimed by the console/ESP_LOG; picking UART1 here to stay clear of it. These are common
-// free GPIOs on ESP32-C5 devkits but are NOT guaranteed free on your specific board - check
-// your schematic before flashing.
-#define SERIAL_LINK_UART_NUM   1
-#define SERIAL_LINK_TX_GPIO    4
-#define SERIAL_LINK_RX_GPIO    5
-#define SERIAL_LINK_BAUD       115200
+// USB Serial/JTAG has no baud rate or GPIO pins to configure - it's a fixed on-chip USB device
+// controller wired directly to the native USB-C port's D+/D- lines in silicon. RX/TX buffer
+// sizes for usb_serial_jtag_driver_install() (see serial_link.c) are sized generously relative
+// to SERIAL_LINK_MAX_PAYLOAD below.
+#define SERIAL_LINK_USB_BUF_SIZE  1024
 
-// Max CAM payload this link will carry. cam.c sizes its own encode buffer at 96 bytes; 160
-// gives headroom for the RX path's extra station_id+rssi prefix plus margin.
-#define SERIAL_LINK_MAX_PAYLOAD  160
+// Max CAM payload this link will carry. MUST match SERIAL_LINK_MAX_PAYLOAD in the app's
+// SerialFrame.kt - a mismatch means every frame above the smaller of the two is rejected by that
+// side's "length exceeds max, resync" branch, silently.
+//
+// Raised from 160 to 512: 160 was reasoned from cam.c's 96-byte encode buffer, which only ever
+// described OUR OWN minimal CAM. A third-party CAM off the air carrying a path-history or
+// special-vehicle container comfortably exceeds it, and those stations would then never reach the
+// phone at all. 512 clears any realistic CAM; the real upstream ceiling on the RX path is
+// rx_item_t.data (400 bytes) in main.c, so nothing larger can get here anyway.
+#define SERIAL_LINK_MAX_PAYLOAD  512
 
-// Initializes the dedicated UART and its background RX-framing task. Call once from app_main,
-// after nvs/event loop init. `on_cam_tx` is invoked (from the RX task's context - keep it fast,
-// it blocks the next frame's parsing) whenever a complete, checksummed SERIAL_MSG_CAM_TX frame
-// arrives from the phone.
+// Initializes the USB Serial/JTAG driver and its background RX-framing and 1 Hz heartbeat tasks.
+// Call once from app_main, after nvs/event loop init. `on_cam_tx` is invoked (from the RX task's
+// context - keep it fast, it blocks the next frame's parsing) whenever a complete, checksummed
+// SERIAL_MSG_CAM_TX frame arrives from the phone.
 typedef void (*serial_link_cam_tx_cb_t)(const uint8_t *cam_uper, int cam_len);
 void serial_link_init(serial_link_cam_tx_cb_t on_cam_tx);
 
@@ -57,7 +74,13 @@ void serial_link_init(serial_link_cam_tx_cb_t on_cam_tx);
 // end-to-end ack - the phone may still drop it, e.g. serial buffer overrun).
 bool serial_link_send_cam_rx(int8_t rssi, const uint8_t *cam_uper, int cam_len);
 
-// Sends a 1-byte SERIAL_MSG_STATUS heartbeat frame.
+// Sends one SERIAL_MSG_STATUS heartbeat frame immediately (status byte + the current counters).
+// Normally unnecessary to call by hand - serial_link_init() starts a task that does this at 1 Hz.
 bool serial_link_send_status(uint8_t status);
 
+// Records a failed esp_wifi_80211_tx() so it shows up in the next heartbeat's tx_failures
+// counter. Called from main.c's tx_radio_task - a CAM that reached the radio but didn't go out is
+// otherwise indistinguishable, from the phone's side, from one that transmitted fine.
+void serial_link_note_tx_failure(void);
+
 #endif