Harden safety paths: sensor fail-safe, monotonic time, structured logging

[CamSoper]

Implements a batch of code-review findings, concentrated on the fire-control paths where a bug has physical consequences. All 76 tests pass (Debug and Release build clean).

Safety fixes

• Sear mode now enables the blower before feeding. Smoke() and Hold() both turn the blower on before running the auger, but the Sear() main path did not. A Sear entered from a cold blower (e.g. straight after Ready with a still-warm firepot, where the fire-started/establish gates can pass immediately) could feed pellets into residual embers with no combustion air. Added _blower.On() on the main sear path.
• Sensor fail-safe in FireMinder. RtdArray drains to NaN after a sustained sensor failure and the Smoker surfaces that as -1. FireMinder was consuming -1 as a real temperature — below the check temp, so after the debounce it declared the fire unhealthy and ran the aggressive ~75%-duty recovery feed blind. It now counts consecutive invalid readings during a cook and fails safe to Error (fuel + igniter cut, blower clears the firepot).
• Display dispose order. Dispose() freed the I2C bus before the LCD/driver that write through it on teardown; reordered to LCD → driver → I2C, matching Init().

Correctness

• GetFireCheckTemp integer division. SetPoint - (SetPoint / 180 * 30) is integer math: SetPoint / 180 is 1 across 180–359 and 2 at 360+, so the fire-health threshold was a step function with a ~30 °F cliff at setpoint 360. Replaced with the intended proportional curve (5/6 of setpoint — a 30 °F margin at the 180 °F floor). Added a regression test pinning continuity across 360.

Robustness

• Monotonic time. Duration measurements — shutdown cooldown (Smoker), igniter/fire/debounce timeouts (FireMinder), and PID dt (SmokerPid) — now use an injected TimeProvider and monotonic GetTimestamp/GetElapsedTime. The RTC-less Pi steps its wall clock when NTP syncs (plausibly during startup ignition); a forward step could previously fire a 10-minute timeout instantly, a backward step could hang it. Wall time is retained only for the status display fields.
• Structured logging. Replaced Debug.WriteLine/Console.WriteLine with ILogger<T> across Smoker, FireMinder, SmokerPid, DisplayUpdater, and RtdArray, wired through DI in Program.cs. Debug.WriteLine is compiled out of the Release builds the deploy ships, so the entire mode/fire narrative was previously absent from journald.
• Loop back-off. The mode loop and fire-minder loop now delay briefly after an exception so a persistently-throwing iteration can't spin the CPU at 100%.

Tests

• Migrated FireMinder tests from the hand-rolled Func<DateTime> clock to FakeTimeProvider.
• Added coverage for the sensor-fault fail-safe (sustained fault → Error; brief burst tolerated) and the fire-check-temp continuity at setpoint 360.
• 71 → 76 tests, all green.

🤖 Generated with Claude Code

https://claude.ai/code/session_012nMVayWzPQkxynui9ZwDVB

---

Generated by Claude Code

[pulumi]

🚀 The Update (preview) for CamSoper-org/inferno-deploy/main (at f6fe2ca) was successful.

Resource Changes

    Name         Type                    Operation
+-  restart-api  command:remote:Command  replaced
+-  publish-api  command:local:Command   replaced