review #1: 診断記録とビルド番号（1.6.5 起点・段階1）

lib/Epub/Epub/Section.cpp

@@ -7,6 +7,7 @@
 #include <Memory.h>
 #include <Serialization.h>
 
+#include "../../../src/util/InputDiag.h"
 #include "Epub/css/CssParser.h"
 #include "Page.h"
 #include "hyphenation/Hyphenator.h"
@@ -98,12 +99,17 @@ uint32_t Section::onPageComplete(std::unique_ptr<Page> page) {
     return 0;
   }
 
+  // Timed apart from the rest of the build: writing a laid-out page to the card is the one
+  // phase that is storage-bound rather than parse- or measure-bound, so it has to be separable
+  // before anything is attributed to "the build being slow".
+  const unsigned long writeStartMs = millis();
   const uint32_t position = file.position();
   if (!page->serialize(file)) {
     LOG_ERR("SCT", "Failed to serialize page %d", builtPageCount_);
     return 0;
   }
   LOG_DBG("SCT", "Page %d processed", builtPageCount_);
+  InputDiag::noteBuildPageWrite(millis() - writeStartMs);
 
   builtPageCount_++;
   // pageCount is the pages available to read: a rebuild over a partial only raises it

lib/hal/HalGPIO.cpp

@@ -156,6 +156,8 @@ bool HalGPIO::wasAnyPressed() const { return inputMgr.wasAnyPressed(); }
 
 bool HalGPIO::wasReleased(uint8_t buttonIndex) const { return inputMgr.wasReleased(buttonIndex); }
 
+bool HalGPIO::isDebouncePending() const { return inputMgr.isDebouncePending(); }
+
 bool HalGPIO::wasAnyReleased() const { return inputMgr.wasAnyReleased(); }
 
 bool HalGPIO::rawInputActive() {

lib/hal/HalGPIO.h

@@ -75,6 +75,9 @@ class HalGPIO {
   bool wasPressed(uint8_t buttonIndex) const;
   bool wasAnyPressed() const;
   bool wasReleased(uint8_t buttonIndex) const;
+  // A button sample changed but has not been committed yet (InputManager's two-sample debounce).
+  // Consumed by the INPUT_DIAG timing diagnostics.
+  bool isDebouncePending() const;
   bool wasAnyReleased() const;
   unsigned long getHeldTime() const;
   unsigned long getPowerButtonHeldTime() const;

lib/hal/HalSystem.cpp

@@ -10,6 +10,10 @@
 #include "esp_private/esp_cpu_internal.h"
 #include "esp_private/esp_system_attr.h"
 #include "esp_private/panic_internal.h"
+// Generated per build by scripts/ost_version.py. The version macro names the commit, which
+// cannot tell two builds apart while the tree carries uncommitted changes -- and a crash
+// report read against the wrong firmware is worse than no report.
+#include "ostBuildId.generated.h"
 #if !__riscv
 #include <xtensa_context.h>  // XtExcFrame for the stack capture below
 #endif
@@ -165,7 +169,8 @@ std::string getPanicInfo(bool full) {
   } else {
     std::string info;
 
-    info += "CrossPoint version: " CROSSPOINT_VERSION;
+    info += "OST build: " OST_BUILD_ID;
+    info += "\nCrossPoint version: " CROSSPOINT_VERSION;
     // A lockup or hardware watchdog resets without running any panic hook, so
     // the reason and stack come back empty; the reset cause is then the only
     // way to tell those apart from a true panic.

platformio.ini

@@ -117,6 +117,7 @@ extra_scripts =
   pre:scripts/build_html.py
   pre:scripts/gen_i18n.py
   pre:scripts/git_branch.py
+  pre:scripts/ost_version.py
   pre:scripts/patch_jpegdec.py
   post:scripts/register_unit_tests_target.py
   post:scripts/patch_arduino_rom_libc.py

scripts/ost_version.py

@@ -0,0 +1,170 @@
+"""
+PlatformIO pre-build script: stamp this fork's build marker.
+
+Upstream numbers its releases, but a fork rebuilt several times a day has no way
+to tell one binary from the next -- neither the .bin files waiting on the desk
+nor the firmware already on the device. This stamps both.
+
+Version format: YYYYMMDDNN -- the build date plus a counter starting at 01 each
+day, so 2026080901 is the first build of 9 August 2026.
+
+The counter lives in .ost-build (gitignored) and is deliberately local to this
+machine. It answers "which build is on the device", not "which release is this",
+so there is nothing for anyone else to reproduce. A fresh clone restarts at 01;
+the date in front keeps the ordering right regardless.
+
+Copies the built image to dist/ under a name carrying the number. Diagnostic
+builds (INPUT_DIAG) get a -diag suffix so the two cannot be confused on the card.
+
+The number stays out of the compile: defining it (a past OST_VERSION macro) put
+a value that changes every build into every translation unit's command line,
+which invalidated all objects -- libraries included -- and made each no-change
+rebuild a 3-minute full recompile. Nothing ever read the macro; the filename is
+the only consumer. If the firmware is ever to display it, generate a header and
+include it from the one file that shows it.
+"""
+
+import datetime
+import os
+import shlex
+import shutil
+import sys
+
+COUNTER_FILE = '.ost-build'
+DIST_DIR = 'dist'
+
+
+def warn(msg):
+    print(f'WARNING [ost_version.py]: {msg}', file=sys.stderr)
+
+
+def next_version(project_dir):
+    """Return YYYYMMDDNN, advancing the per-day counter."""
+    today = datetime.date.today().strftime('%Y%m%d')
+    path = os.path.join(project_dir, COUNTER_FILE)
+
+    stored_date, stored_seq = '', 0
+    try:
+        with open(path, 'r', encoding='utf-8') as f:
+            stored_date, _, seq_text = f.read().strip().partition(' ')
+            stored_seq = int(seq_text)
+    except FileNotFoundError:
+        pass
+    except (ValueError, OSError) as e:
+        warn(f'could not read {COUNTER_FILE} ({e}); restarting the counter')
+
+    seq = stored_seq + 1 if stored_date == today else 1
+    if seq > 99:
+        # Two digits is the format. Past 99 builds in a day, keep counting rather
+        # than silently reusing a number -- the string just gets one wider.
+        warn(f'{seq} builds today; the number is now wider than 10 digits')
+
+    try:
+        with open(path, 'w', encoding='utf-8') as f:
+            f.write(f'{today} {seq}\n')
+    except OSError as e:
+        warn(f'could not write {COUNTER_FILE} ({e}); the number may repeat')
+
+    return f'{today}{seq:02d}'
+
+
+def _flag_sets_input_diag(text):
+    return text == '-DINPUT_DIAG' or text.startswith('-DINPUT_DIAG=')
+
+
+def has_input_diag(env):
+    """True when this build carries INPUT_DIAG.
+
+    Every route the flag can arrive by is checked, because a diagnostic image
+    named as a plain one is the mix-up this suffix exists to prevent, and the
+    cost of it lands on the device: an SD write and a repro cycle against
+    firmware that is not what it says it is.
+
+    The routes differ in when they become visible. A pre: script runs before
+    PlatformIO has folded build_flags into CPPDEFINES, so a -D from
+    platformio.ini or platformio.local.ini is still only in the raw flag list;
+    PLATFORMIO_BUILD_FLAGS reaches the compiler without passing through either
+    at that point, and is only readable from the environment. Called again from
+    the post action, CPPDEFINES has everything -- main() ORs the two, so a route
+    that misses one is still caught by the other.
+    """
+    for define in env.get('CPPDEFINES', []):
+        name = define[0] if isinstance(define, (list, tuple)) else define
+        if str(name) == 'INPUT_DIAG':
+            return True
+
+    for flag in env.get('BUILD_FLAGS', []) or []:
+        if _flag_sets_input_diag(str(flag)):
+            return True
+
+    for var in ('PLATFORMIO_BUILD_FLAGS', 'PLATFORMIO_BUILD_SRC_FLAGS'):
+        raw = os.environ.get(var)
+        if not raw:
+            continue
+        try:
+            flags = shlex.split(raw)
+        except ValueError:
+            # Unbalanced quotes: fall back to whitespace splitting rather than
+            # reporting a diagnostic build as plain.
+            flags = raw.split()
+        if any(_flag_sets_input_diag(f) for f in flags):
+            return True
+
+    return False
+
+
+def write_build_id_header(project_dir, build_id):
+    """Publish the build number to the firmware through a generated header.
+
+    A define would reach every translation unit and make each build a full
+    rebuild; only the two files that write diagnostics need the string, so it
+    goes in a header that only they include. It lives under lib/hal because
+    that path is reachable from both lib and src, which src/util is not.
+    """
+    path = os.path.join(project_dir, 'lib', 'hal', 'ostBuildId.generated.h')
+    body = f'#pragma once\n#define OST_BUILD_ID "{build_id}"\n'
+    try:
+        with open(path, 'r', encoding='utf-8') as f:
+            if f.read() == body:
+                return
+    except OSError:
+        pass
+    try:
+        with open(path, 'w', encoding='utf-8') as f:
+            f.write(body)
+    except OSError as e:
+        warn(f'could not write {path} ({e}); the build id will be stale')
+
+
+def copy_to_dist(project_dir, version, suffix, source):
+    dist = os.path.join(project_dir, DIST_DIR)
+    target = os.path.join(dist, f'crosspoint-OST-{version}{suffix}.bin')
+    try:
+        os.makedirs(dist, exist_ok=True)
+        shutil.copyfile(source, target)
+        print(f'OST build {version}{suffix} -> {os.path.relpath(target, project_dir)}')
+    except OSError as e:
+        warn(f'could not copy the image to {DIST_DIR} ({e})')
+
+
+def main(env):
+    project_dir = env.subst('$PROJECT_DIR')
+    version = next_version(project_dir)
+    diag_at_pre = has_input_diag(env)
+    write_build_id_header(project_dir, f'{version}{"-diag" if diag_at_pre else ""}')
+
+    def post_action(target, source, env):
+        # Re-check against the fully folded environment and keep whichever pass
+        # saw the flag: the name has to be wrong in the safe direction.
+        suffix = '-diag' if (diag_at_pre or has_input_diag(env)) else ''
+        copy_to_dist(project_dir, version, suffix, str(target[0]))
+
+    env.AddPostAction('$BUILD_DIR/${PROGNAME}.bin', post_action)
+
+
+# PlatformIO/SCons entry point — Import and env are SCons builtins injected at runtime.
+try:
+    Import('env')  # noqa: F821  # type: ignore[name-defined]
+    main(env)  # noqa: F821  # type: ignore[name-defined]
+except NameError:
+    pass

src/activities/ActivityManager.cpp

@@ -28,6 +28,7 @@
 #include "util/BmpViewerActivity.h"
 #include "util/FrontlightPanelActivity.h"
 #include "util/FullScreenMessageActivity.h"
+#include "util/InputDiag.h"
 
 static portMUX_TYPE activityManagerSpinlock = portMUX_INITIALIZER_UNLOCKED;
 
@@ -70,10 +71,36 @@ void ActivityManager::renderTaskLoop() {
     RenderLock lock;
     if (currentActivity) {
       HalPowerManager::Lock powerLock;  // Ensure we don't go into low-power mode while rendering
+#ifdef INPUT_DIAG
+      // Snapshot the name onto the stack before rendering. render() receives the lock by value and
+      // may release it partway, after which the main task can pop and destroy this activity -- so
+      // reading the name after render() returns is not safe. Guarded rather than routed through the
+      // no-op InputDiag stub because the snapshot itself would otherwise cost every build a copy.
+      char renderedName[16];
+      snprintf(renderedName, sizeof(renderedName), "%s", currentActivity->name.c_str());
+      const unsigned long renderStart = millis();
+      InputDiag::noteRenderStart();
+#endif
       // Night mode is a global output polarity applied to every activity.
       // The sleep screen forces normal polarity itself (SleepActivity).
       display.setInverted(SETTINGS.screenInverted != 0);
       currentActivity->render(std::move(lock));
+#ifdef INPUT_DIAG
+      const unsigned long renderDurationMs = millis() - renderStart;
+      // The glyph counters (on-demand loads, arena rebuilds) come with the font stage; 0 until then.
+      InputDiag::noteRender(renderedName, renderDurationMs, 0, 0, 0);
+      // A render this slow isn't drawing -- it's stuck somewhere upstream (SD I/O, glyph
+      // cache, allocation). The 16-line log ring is system-wide and short, so whatever ran
+      // during the stall is likely still in it right now; a routine render would evict it
+      // within a few more renders. captureLogs() keeps only the first capture, so repeat
+      // stalls this session don't overwrite the one that still has the culprit.
+      constexpr unsigned long SLOW_RENDER_CAPTURE_MS = 5000;
+      if (renderDurationMs >= SLOW_RENDER_CAPTURE_MS) {
+        char reason[48];
+        snprintf(reason, sizeof(reason), "slow-render %s %lums", renderedName, renderDurationMs);
+        InputDiag::captureLogs(reason);
+      }
+#endif
     }
     // Notify any task blocked in requestUpdateAndWait() that the render is done.
     TaskHandle_t waiter = nullptr;

src/activities/home/HomeActivity.cpp

@@ -24,6 +24,7 @@
 #include "RecentBooksStore.h"
 #include "components/UITheme.h"
 #include "fontIds.h"
+#include "util/InputDiag.h"
 
 int HomeActivity::getMenuItemCount() const {
   int count = 4;  // File Browser, Library, File transfer, Settings
@@ -227,6 +228,8 @@ void HomeActivity::loadRecentCovers(int coverHeight) {
 
 void HomeActivity::onEnter() {
   Activity::onEnter();
+  // What is still allocated once the previous screen is gone (diag builds only).
+  InputDiag::dumpHeapMap("home-enter");
 
   hasOpdsServers = OPDS_STORE.hasServers();