ESP32_GENERIC_S3: raise INT_WDT timeout 300→1000 ms + pin brownout ON (fluispotter #44) - #1

What

ports/esp32/boards/ESP32_GENERIC_S3/sdkconfig.board:

• CONFIG_ESP_INT_WDT_TIMEOUT_MS=1000 (was the IDF default 300 ms)
• CONFIG_ESP_BROWNOUT_DET=y + CONFIG_ESP_BROWNOUT_DET_LVL_SEL_7=y (pin the
  brownout detector ON explicitly — this is already the IDF default level 7,
  made explicit so it can't drift)

Why

The Fluispotter device had intermittent mid-session reboots
(machine.reset_cause() == WDT / code 3, ~8.5% per dose). Bench forensics
(fluispotter/fluispotter-firmware issue micropython#44):

• The only armed watchdog is the ESP-IDF Interrupt Watchdog (TIMG1,
  stage-0 = system reset); RTC WDT and TG0 WDT are disabled, and no user
  machine.WDT is created.
• Reproduced directly: machine.disable_irq() + 800 ms busy-wait → reset
  cause 3. So the reboots are the IWDT firing on a transient >300 ms
  interrupts-off window in the WiFi/lightsleep path.
• Ruled out by on-board measurement: flash os.sync ~33 µs even with a
  60 KB WiFi POST in flight; the real lightsleep path (WiFi assoc + EXT1 hall
  wake + lightsleep + WiFi TX) survived 40/40; the pump motor draws
  ~20-30 mA vs ~300 mA WiFi+CPU (not a power sag; and it's the interrupt
  watchdog, not a brownout).

3× margin (1000 ms) absorbs the transient; the watchdog stays enabled. The ULP
coprocessor regulates the pumps independently of CPU interrupts, so a longer
interrupt watchdog does not weaken pump safety. Value tunable (500–1000 ms).
The explicit brownout pin is a medical-device safety default.

Verify after flashing

• machine.disable_irq() + 500 ms → now SURVIVES (was a reset at the 300 ms
  default); + 1200 ms → still resets. Confirms the new timeout.
• Full-length session endurance run → expect zero WDT reboots.
• Any future power-sag reboot now reports as PWRON/brownout (code 1), distinct
  from the WDT (code 3) interrupt-timing reboots this fixes.

🤖 Generated with Claude Code