feat: Licht nach einem OTA wie bei power_on_behaviour=last wiederherstellen

Spec 8.2 verlangt, dass ein durch ein Update ausgelöster Neustart nicht wie ein
Stromausfall wirkt: Das Flag ota_pending wurde bisher nur geschrieben und beim
nächsten Boot wieder gelöscht, nl_boot_state() wendet aber weiterhin das normale
power_on_behaviour an. Eine eingeschaltete Lampe mit pob=off kam nach einem Update
aus zurück, mit pob=on umgekehrt.

nl_boot_state() bekommt dafür ein Argument after_ota; ist ein gespeicherter
Zustand vorhanden, wird er unverändert übernommen. Ohne gespeicherten Zustand
gelten weiterhin die normalen Regeln.

Hosttests: vier neue Fälle in test_boot_state.c (pob=off/on über ein OTA,
Sanitisierung bleibt aktiv, kein gespeicherter Zustand).

src/app_main.c

@@ -149,7 +149,7 @@ static void app_task(void *arg)
     uint32_t base = nl_flash_region_base();
     nl_engine_cfg_t cfg;
     nl_light_state_t last, initial, pending;
-    bool have_last, counter_cleared = false;
+    bool have_last, after_ota, counter_cleared = false;
     bool light_alive = false, net_alive = false, http_alive = false;
     uint8_t boots;
     uint32_t boot_ms, light_seen, net_seen, http_seen;
@@ -165,10 +165,12 @@ static void app_task(void *arg)
     nl_state_log_init(base + NL_FL_STATE_0, base + NL_FL_STATE_1);
     have_last = nl_state_log_load(&last);
     store_unlock();
-    if (s_settings.ota_pending) {
-        /* We came back from an update attempt (accepted or rejected). Just clear the flag so it
-         * doesn't stick in flash forever; nl_boot_state() below restores the light from `last`/
-         * power_on_behaviour as on any other boot, no special-casing needed here. */
+    after_ota = s_settings.ota_pending != 0;
+    if (after_ota) {
+        /* We came back from an update attempt (accepted or rejected). Clear the flag so it does
+         * not stick in flash forever; nl_boot_state() below uses `after_ota` to restore the light
+         * effectively as power_on_behaviour = last (spec 8.2: a reboot caused by an update is not
+         * a power cut). */
         s_settings.ota_pending = 0;
         printf("boot after ota attempt\r\n");
         store_lock();
@@ -183,7 +185,8 @@ static void app_task(void *arg)
     cfg.ct_max = board->ct_max;
     cfg.output = led_out;
     cfg.ctx = NULL;
-    initial = nl_boot_state((nl_pob_t)s_settings.power_on_behaviour, have_last ? &last : NULL, board);
+    initial = nl_boot_state((nl_pob_t)s_settings.power_on_behaviour, have_last ? &last : NULL, board,
+                            after_ota);
     nl_app_lock();
     nl_engine_init(&cfg);
     nl_ctrl_init(board, s_settings.fade_in_ms, s_settings.fade_out_ms);

src/light/nl_boot_state.c

@@ -20,7 +20,8 @@ nl_light_state_t nl_boot_default_state(const nl_board_t *b)
     return s;
 }
 
-nl_light_state_t nl_boot_state(nl_pob_t pob, const nl_light_state_t *last, const nl_board_t *b)
+nl_light_state_t nl_boot_state(nl_pob_t pob, const nl_light_state_t *last, const nl_board_t *b,
+                               bool after_ota)
 {
     nl_light_state_t s = last ? *last : nl_boot_default_state(b);
 
@@ -30,6 +31,12 @@ nl_light_state_t nl_boot_state(nl_pob_t pob, const nl_light_state_t *last, const
         s.mode = NL_MODE_WHITE;
     s.ct = clamp_ct(s.ct, b);
 
+    /* Spec 8.2: after an OTA the light is restored effectively as power_on_behaviour = last -
+     * a reboot triggered by an update must not look like a power cut to the user. Without a
+     * stored state there is nothing to restore, so the normal rules apply. */
+    if (after_ota && last)
+        return s;
+
     if (pob == NL_POB_ON)
         s.on = true;
     else if (pob == NL_POB_OFF)

src/light/nl_boot_state.h

@@ -9,8 +9,12 @@
 /* Warm white, 100 %, on. */
 nl_light_state_t nl_boot_default_state(const nl_board_t *b);
 
-/* State to apply after power-up. last == NULL when nothing is stored. Stored values are sanitised. */
-nl_light_state_t nl_boot_state(nl_pob_t pob, const nl_light_state_t *last, const nl_board_t *b);
+/* State to apply after power-up. last == NULL when nothing is stored. Stored values are sanitised.
+ * after_ota: this boot follows a firmware update (settings flag ota_pending). Spec 8.2 - such a
+ * reboot is not a power cut, so the light comes back effectively as power_on_behaviour = last,
+ * whatever pob says. */
+nl_light_state_t nl_boot_state(nl_pob_t pob, const nl_light_state_t *last, const nl_board_t *b,
+                               bool after_ota);
 
 bool nl_light_state_equal(const nl_light_state_t *a, const nl_light_state_t *b);