pandad: recover internal panda after one normal boot window

openpilot/selfdrive/pandad/pandad.py

@@ -14,6 +14,8 @@ from openpilot.common.swaglog import cloudlog
 
 from openpilot.sunnypilot.selfdrive.pandad.rivian_long_flasher import flash_rivian_long
 
+MAX_NORMAL_RESETS_BEFORE_RECOVERY = 1
+
 
 def get_expected_signature() -> bytes:
   fn = os.path.join(FW_PATH, McuType.H7.config.app_fn)
@@ -121,13 +123,12 @@ def main() -> None:
             pass
         time.sleep(0.5)
       if not panda_serials:
-        # Never force a board that already has firmware into the ROM bootloader
-        # right away: recover erases the app sector before reflashing. Only a
-        # truly blank board needs it, and that is detected after several normal
-        # resets fail to produce a panda at all.
-        if not PandaDFU.list() and recover_attempts < 3:
+        # Allow one full boot window for an existing app to appear. If it
+        # still does not enumerate, recover through the ROM bootloader instead
+        # of leaving users in a multi-minute retry loop after an update.
+        if not PandaDFU.list() and recover_attempts < MAX_NORMAL_RESETS_BEFORE_RECOVERY:
           recover_attempts += 1
-          cloudlog.warning(f"Panda did not appear after reset ({recover_attempts}/3), retrying normal reset...")
+          cloudlog.warning(f"Panda did not appear after reset ({recover_attempts}/{MAX_NORMAL_RESETS_BEFORE_RECOVERY}), retrying normal reset...")
           continue
         cloudlog.info("Panda missing after normal resets, entering ROM bootloader (recover)...")
         HARDWARE.recover_internal_panda()