feat(esp32): port AP-First gate to the ESP32, covering 0x3FD/0x3EE/0x370 (#100/#108/#52)

The ESP32 injected ungated, so on 2026.14.x the FSD-enable (0x3FD/0x3EE) fired on the
AP activation edge — the steer-jerk @dunckencn reports on China 2026.8.3.6 HW3 (#108) —
and per @jewelrylin's #100 finding the nag-killer 0x370 echo trips the same preflight
and can block AP readiness on HW4. AP-First was Flipper-only.

Add the AP-First gate to the ESP32: a new ap_first prefs key + web-dashboard toggle
(off by default), fsd_ap_first_allows() (das_ap_state >= 2 held stable for
AP_FIRST_STABLE_MS=1000), ap_unstable_tick_ms stamped each frame while AP is not
engaged, and the gate applied to the 0x3FD, 0x3EE and 0x370 TX paths. Strictly
conservative: it can only withhold injection until AP is engaged and stable, never
inject more; default-off preserves current behavior.

Note vs the Flipper: the Flipper gates only 0x3FD/0x3EE; this also gates the nag 0x370
(the #100 extension). The Flipper side is unchanged in this commit.

All 7 ESP32 envs build; host suite (234) unaffected (shared core untouched).

Author: hypery11

esp32/.firmware/fsd_handler.cpp

@@ -85,6 +85,17 @@ bool fsd_can_transmit(const FSDState *state) {
     return true;
 }
 
+// AP-First gate (parity with the Flipper). When ap_first is on, hold AP/FSD/nag
+// injection until AP is engaged (das_ap_state >= 2) AND has held stable for
+// AP_FIRST_STABLE_MS — injecting on the activation edge is what trips the
+// 2026.14.x preflight (steer-jerk + AP disengage). now_ms = millis(),
+// ap_unstable_tick_ms is stamped whenever das_ap_state < 2.
+bool fsd_ap_first_allows(const FSDState *state, uint32_t now_ms) {
+    if (!state->ap_first) return true;             // gate off -> always allow
+    if (state->das_ap_state < 2u) return false;    // AP not engaged yet
+    return (now_ms - state->ap_unstable_tick_ms) >= AP_FIRST_STABLE_MS;
+}
+
 // ── HW version detection from GTW_carConfig (0x398) ──────────────────────────
 
 TeslaHWVersion fsd_detect_hw_version(const CanFrame *frame) {

esp32/.firmware/fsd_handler.h

@@ -34,6 +34,15 @@ void fsd_apply_hw_version(FSDState *state, TeslaHWVersion hw);
 /** Returns true if current state allows transmitting CAN frames. */
 bool fsd_can_transmit(const FSDState *state);
 
+/** AP-First stability window (ms): AP must hold engaged this long before AP/FSD/nag
+ *  injection is allowed when ap_first is on. */
+#define AP_FIRST_STABLE_MS 1000u
+
+/** AP-First gate: true if injection is allowed now. When ap_first is off, always
+ *  true. When on, requires das_ap_state >= 2 stable for AP_FIRST_STABLE_MS.
+ *  now_ms = millis(); ap_unstable_tick_ms is stamped whenever das_ap_state < 2. */
+bool fsd_ap_first_allows(const FSDState *state, uint32_t now_ms);
+
 /** Read GTW_carConfig (0x398) to detect HW version.
  *  Returns TeslaHW_Unknown if frame is not 0x398 or version unrecognised. */
 TeslaHWVersion fsd_detect_hw_version(const CanFrame *frame);

esp32/.firmware/main.cpp

@@ -983,6 +983,9 @@ static void update_led() {
 static void process_frame(CanBusId bus, const CanFrame &frame) {
     state_enter();
     g_state.rx_count++;
+    // AP-First stability debounce: stamp the last time AP was not engaged, so
+    // fsd_ap_first_allows() can require AP held stable for AP_FIRST_STABLE_MS (#100/#108).
+    if (g_state.das_ap_state < 2u) g_state.ap_unstable_tick_ms = millis();
     if (frame.id == CAN_ID_GTW_CAR_STATE)  g_state.seen_gtw_car_state++;
     if (frame.id == CAN_ID_GTW_CAR_CONFIG) g_state.seen_gtw_car_config++;
     if (frame.id == CAN_ID_AP_CONTROL)     g_state.seen_ap_control++;
@@ -1133,14 +1136,17 @@ static void process_frame(CanBusId bus, const CanFrame &frame) {
     // ── Beyond here only run when TX is allowed ───────────────────────────────
     state_enter();
     bool tx = fsd_can_transmit(&g_state);
+    // AP-First (#100/#108): when enabled, hold AP/FSD/nag injection until AP is
+    // engaged and stable. Gates 0x3FD / 0x3EE / 0x370 below; off by default.
+    bool ap_ok = fsd_ap_first_allows(&g_state, millis());
     state_exit();
 
     // NAG killer — build echo only when TX is currently allowed.
     if (frame.id == CAN_ID_EPAS_STATUS) {
         CanFrame echo;
         state_enter();
         fsd_handle_epas_status(&g_state, &frame);
-        bool fired = tx ? fsd_handle_nag_killer(&g_state, &frame, &echo) : false;
+        bool fired = (tx && ap_ok) ? fsd_handle_nag_killer(&g_state, &frame, &echo) : false;
         state_exit();
         if (fired) {
             uint8_t lvl     = (frame.data[4] >> 6) & 0x03;
@@ -1169,7 +1175,7 @@ static void process_frame(CanBusId bus, const CanFrame &frame) {
         state_enter();
         bool modified = fsd_handle_legacy_autopilot(&g_state, &f);
         state_exit();
-        if (modified && tx) send_on_bus(bus, f);
+        if (modified && tx && ap_ok) send_on_bus(bus, f);
         return;
     }
 
@@ -1238,7 +1244,7 @@ static void process_frame(CanBusId bus, const CanFrame &frame) {
         state_enter();
         bool modified = fsd_handle_autopilot_frame(&g_state, &f);
         state_exit();
-        if (modified && tx) send_on_bus(bus, f);
+        if (modified && tx && ap_ok) send_on_bus(bus, f);
         return;
     }
 }

esp32/.firmware/prefs.cpp

@@ -13,6 +13,7 @@ void prefs_load(FSDState *state) {
     }
     state->nag_killer               = g_prefs.getBool("nag",    true);
     state->continuous_ap            = g_prefs.getBool("contap", false);
+    state->ap_first                 = g_prefs.getBool("apfirst",false);
     state->suppress_speed_chime     = g_prefs.getBool("chime",  true);
     state->ignore_ota               = g_prefs.getBool("ignota", false);
     state->fsd_unlock               = g_prefs.getBool("unlock", false);
@@ -59,6 +60,7 @@ void prefs_save(const FSDState *state) {
     g_prefs.putBool("ok",     true);
     g_prefs.putBool("nag",    state->nag_killer);
     g_prefs.putBool("contap", state->continuous_ap);
+    g_prefs.putBool("apfirst",state->ap_first);
     g_prefs.putBool("chime",  state->suppress_speed_chime);
     g_prefs.putBool("ignota", state->ignore_ota);
     g_prefs.putBool("unlock", state->fsd_unlock);

esp32/.firmware/web_dashboard.cpp

@@ -418,6 +418,10 @@ input:checked+.sl2:before{transform:translateX(20px);background:#fff}
     <span class="lbl">Continuous AP</span>
     <label class="sw"><input type="checkbox" id="swContinuousAp" onchange="cmd('continuous_ap',this.checked)"><span class="sl2"></span></label>
   </div>
+  <div class="row">
+    <span class="lbl">AP-First (14.x)</span>
+    <label class="sw"><input type="checkbox" id="swApFirst" onchange="cmd('ap_first',this.checked)"><span class="sl2"></span></label>
+  </div>
   <div class="row">
     <span class="lbl">BMS Display</span>
     <label class="sw"><input type="checkbox" id="swBms" onchange="cmd('bms',this.checked)"><span class="sl2"></span></label>
@@ -661,6 +665,7 @@ function updateControlsSummary(d){
   if(d.fsd_unlock)items.push('FSD Unlock');
   if(d.nag_killer)items.push('NAG Killer');
   if(d.continuous_ap)items.push('Continuous AP');
+  if(d.ap_first)items.push('AP-First');
   if(d.bms_output)items.push('BMS');
   if(d.force_fsd)items.push('Force FSD');
   if(d.china_mode)items.push('China');
@@ -720,6 +725,7 @@ function upd(d){
   if(document.getElementById('swFsdUnlock')) document.getElementById('swFsdUnlock').checked=d.fsd_unlock;
   if(document.getElementById('swNag')) document.getElementById('swNag').checked=d.nag_killer;
   if(document.getElementById('swContinuousAp')) document.getElementById('swContinuousAp').checked=d.continuous_ap;
+  if(document.getElementById('swApFirst')) document.getElementById('swApFirst').checked=d.ap_first;
   if(document.getElementById('swBms')) document.getElementById('swBms').checked=d.bms_output;
   if(document.getElementById('swFsd')) document.getElementById('swFsd').checked=d.force_fsd;
   if(document.getElementById('swChina')) document.getElementById('swChina').checked=d.china_mode;
@@ -1235,6 +1241,7 @@ static String build_json() {
     j += "\"fsd_unlock\":";    j += state.fsd_unlock                   ? "true" : "false"; j += ',';
     j += "\"nag_killer\":";    j += state.nag_killer                   ? "true" : "false"; j += ',';
     j += "\"continuous_ap\":"; j += state.continuous_ap                 ? "true" : "false"; j += ',';
+    j += "\"ap_first\":";      j += state.ap_first                      ? "true" : "false"; j += ',';
     j += "\"bms_output\":";    j += state.bms_output                   ? "true" : "false"; j += ',';
     j += "\"force_fsd\":";     j += state.force_fsd                    ? "true" : "false"; j += ',';
     j += "\"china_mode\":";    j += state.china_mode                   ? "true" : "false"; j += ',';
@@ -1365,6 +1372,18 @@ static void ws_event(uint8_t num, WStype_t type,
             Serial.printf("[Web] Continuous AP: %s\n", enabled ? "ON" : "OFF");
             prefs_save(&saved);
         }
+    } else if (strstr(buf, "\"ap_first\"")) {
+        if (vptr) {
+            while (*vptr == ' ' || *vptr == ':') vptr++;
+            bool enabled = (strncmp(vptr, "true", 4) == 0);
+            FSDState saved;
+            state_enter();
+            g_state->ap_first = enabled;
+            saved = *g_state;
+            state_exit();
+            Serial.printf("[Web] AP-First: %s\n", enabled ? "ON" : "OFF");
+            prefs_save(&saved);
+        }
     }
 #if defined(BOARD_TTGO_DISPLAY)
     else if (strstr(buf, "\"disp\"")) {