M3C.1: bind SV sample-zero epochs to consecutive PTP seconds

[masarray]

CURRENT CHECKPOINT — M3E.2 ordered bench fault evidence (2026-10-15)

• Head 993bace2d4d6c7f530981743963d4ff6d2b37da6, Draft stacked on PR M2A: bounded continuous PTP–SMV phase authority and guarded ESP32-P4 observer #157. M3E.2 closes the false-positive software-evidence path for RECEIVER UNLOCKED-only logs. --scenario supports measured-reported acquisition, loss/relock, GM handoff and SOURCE ready while retaining immutable hardware qualification fields.
• Exact-head 26 regression tests #38661979955 SUCCESS; CI Routing Policy #38661979985 SUCCESS. Firmware/other heavy Draft matrices skipped intentionally.
• M3D.2 unmodified SOURCE/RECEIVER bench artifact #38655888456 is the physical test candidate. No physical ESP32-P4 or external PTP GM/PPS/wire-phase/IED acceptance yet. AUTO smpSynch=0; no release/merge/Studio installer change.
• M3E.2 acceptance and handoff. One-shot Draft CI marker absent.

PREVIOUS CHECKPOINT — M3E.1 Bench Evidence Preflight (2026-10-15)

• Host-only commit a1ae7acaf50c079ec62197a1105c3d5e6b08fc08 on top of M3D.2 validated firmware 7d2d514; PR remains Draft stacked on M2A: bounded continuous PTP–SMV phase authority and guarded ESP32-P4 observer #157. No new firmware binary build required for this milestone.
• 11 adversarial M3E preflight regressions #38660907259 SUCCESS and CI Routing Policy #38660907139 SUCCESS; heavy Draft CI skipped by design.
• M3D.2 SOURCE/RECEIVER bench firmware artifact #38655888456 remains pinned to 7d2d5146..., GitHub artifact ID 11936537835, expires October 21, 2026 UTC; both images/checksums/flash offsets independently VERIFIED by new M3E tool.
• M3E host tool + bench instructions. A real serial IDENTIFY/PTP SHOW transcript, classic-PCAP and independent GM/PPS/MAC timestamp + relay evidence remain MISSING; AUTO smpSynch stays 0. Do not promote to public stable without physical acceptance. Detailed checkpoint.

PREVIOUS CHECKPOINT — M3D.2 + ESP32-P4 bench artifact (2026-10-15)

• Exact head 7d2d5146b1892124c1744ad26ab31b3489e8387e. Draft, stacked on PR M2A: bounded continuous PTP–SMV phase authority and guarded ESP32-P4 observer #157. M3A.1 canonical authority, M3B.1 RECEIVER lease, M3C.2 receiver PTP epoch binding, M3D.1 EMAC ownership, and M3D.2 START/STOP cancellation implemented.
• PTP Lab checkpoint #38655888456 SUCCESS (portable cancellation/phase regression, guarded SOURCE + RECEIVER builds and both artifact stages). CI Routing Policy #38655888405 SUCCESS.
• Artifact esp32p4-m3d-ptp-bench-7d2d5146b1892124c1744ad26ab31b3489e8387e (GitHub ID 11936537835) under run #38655888456, retention until October 21, 2026 UTC. Contains independent SOURCE/RECEIVER application images, bootloader, partition table, config, offset mapping, SHA-256 manifests; ZIP independently verified. Bench flashing candidate only, not release.
• No physical board/GM/PPS/relay wire acceptance. No AUTO smpSynch promotion (remains 0); no changes to native Studio installer or stable release. Heavy Draft matrices intentionally skipped; one-shot opt-in marker removed. Full acceptance in PR comment.

PREVIOUS CHECKPOINT — M3D.1 (2026-10-15)

• Head 08a1a5e746a7615d53fd39aa911544243321fe78; Draft, stacked on PR M2A: bounded continuous PTP–SMV phase authority and guarded ESP32-P4 observer #157. M3A.1 canonical PTP authority, M3B.1 RECEIVER lease, M3C.2 external receiver SV epoch binding, and M3D.1 cross-role EMAC worker ownership are implemented.
• Exact-head PTP Lab run #38653932002 SUCCESS (portable phase regression + guarded ESP32-P4 SOURCE and RECEIVER builds); routing policy #38653932360 SUCCESS. Heavy Draft CI skipped; opt-in marker removed.
• Software verified only. No physical board/GM/PPS/wire acceptance, no flashable binary artifact, no claim of globally qualified SV synchronization. AUTO smpSynch remains 0. Do not merge/release on this evidence alone.
• Remaining: STOP-during-START cancellation, real ESP32-P4 external grandmaster + timestamp capture, sustained phase/fault stress and approved artifact/installer release gates.

Scope — first M3 continuity hardening checkpoint (stacked Draft on #157)

Base #157 at 90062f391a9c97cb1ff20d072b7f15ba4a777fac; independent from moving main.

• Extend existing portable SvPtpPhaseAuthority with explicit integer-second identity for ISR smpCnt=0 deadlines, not just modulo-1s phase.
• First observation is cold baseline; consecutive sample generation and PTP integer seconds must each advance one before observer can publish phase steering validity.
• Reject clock steps, skipped zero epochs, stale source/session via existing generation gate; retain single control-plane PI and unchanged ISR complexity.
• Add portable phase test vectors (+/-1s step, missing sample epoch, near PTP-second rollover, GPTimer 32-bit wrap) and documentation.
• Source experimental gate remains OFF by default. Native Studio, receiver firmware, and public release untouched.

Validation policy

One opt-in portable/ESP32-P4 SOURCE CI checkpoint only; unrelated Qt installers and full two-role matrix should skip. CI may be pending; do not claim success before results. No silicon/IED phase or alarm-free claims.

Tracks #154; does not complete M3A/M3B, RECEIVER phase qualification, MAC egress, or AUTO smpSynch.

Exact-head software verification — 2026-10-15

• Commit: 27f7d39a5ed170a86846804e96fe546642434833.
• Targeted GitHub Actions checkpoint #38639840010 SUCCESS: Portable strict phase regression PASS and Compile guarded ESP32-P4 SOURCE firmware PASS. SOURCE/RECEIVER full two-role matrix intentionally SKIPPED, as were unrelated Draft workflows.
• One-shot one-shot checkpoint flag opt-in removed after dispatch. No automatic further costly jobs on routine Draft push.
• This establishes SOFTWARE VERIFIED only for M3C.1; no physical ESP32/IED/GM lock or measured MAC egress acceptance has been demonstrated.

[masarray]

M3C stacked-branch CI synchronization checkpoint: head 67bf52cb5b278e6fdd4cdf812e19a5968003cd9f fast-forwarded from original exact-head 27f7d39a5ed170a86846804e96fe546642434833, with merged parent 83a531a1d1bce036d86b4e7fcc2cbbf931fb3f26 from PR #157. Checked GitHub comparison of the new #157 base against this head: exactly four original M3C files (phase authority header, app_main.cpp, portable phase regression, M3C documentation). Preserved existing PTP SOURCE/RECEIVER settings, native GUI tests and bounded Draft checkpoint jobs; no firmware/runtime source changes were introduced by CI sync. M3 firmware/silicon acceptance remains separate from successful CI policy validation. PR stays Draft.

[masarray]

M3B.1 accepted — receiver clock lease generation fencing (2026-10-15)

Exact PR head: 4237050953064e4fcad389bd48bbafe343f6525d
Checkpoint: ESP32-P4 PTP Lab run #38647374456 — SUCCESS

• phase-guard-checkpoint: portable strict phase regression PASS (including new ptp_receiver_clock_authority_tests); guarded ESP32-P4 SOURCE firmware compilation PASS (CMake includes ptp_receiver_task.cpp and ptp_mode_facade.cpp).
• CI Routing Policy run #38647374453: SUCCESS.
• Heavy two-role PTP matrix and other Draft PR matrices SKIPPED intentionally. Artifact count: 0 for the targeted checkpoint; no flashable image from this run.
• PR M2A: bounded continuous PTP–SMV phase authority and guarded ESP32-P4 observer #157 policy regression was repaired and verified green at #38647242216.
• Opt-in marker removed after scheduling; no automatic repeat build on the next Draft synchronize event.

What the code does: worker-owned, allocation-free clock lease with generation changes for source identity/port handoff, lock transitions, PTP clock steps, failed actuation, source timeout and STOP/START. timing_authority_generation plus timing_authority_clock_usable are emitted in the same status snapshot. The SOURCE and RECEIVER generation sequences are role-scoped: consumers must also compare status.role, selected GM identity and usable state, rather than comparing raw integers across roles.

Not claimed: external PTP hardware lock, PPS-to-smpCnt=0 receiver epoch binding, SMV realtime egress phase evidence, GPS traceability, physical ESP32-P4 acceptance, complete M3A/M3B/M3C, or smpSynch=1/2. The existing SV phase gate remains fail-closed. Continue next with M3A consolidated authority snapshot then M3C RECEIVER independent epoch/PPS continuity; preserve branch stacking and avoid full CI until an explicit Ready/release checkpoint.

[masarray]

M3A.1 checkpoint — canonical dual-role PTP clock authority (2026-10-15)

Exact head: 712dfc3bc3154741bf1abe47e8e711c9e8104029 — software checkpoint PASS

Evidence:

• Targeted ESP32-P4 PTP Lab run #38649665900: phase-guard-checkpoint SUCCESS, Portable strict phase regression SUCCESS (including new ptp_canonical_authority_tests), Compile guarded ESP32-P4 SOURCE firmware SUCCESS (firmware includes both ptp_mode_facade.cpp and ptp_receiver_task.cpp).
• CI Routing Policy run #38649666012: SUCCESS.
• The full SOURCE/RECEIVER PTP matrix and unrelated Draft jobs skipped intentionally. This targeted run produces zero firmware artifacts. Opt-in marker is removed; no repeat expensive CI is requested.
• PR remains Draft and mergeable, stacked on PR M2A: bounded continuous PTP–SMV phase authority and guarded ESP32-P4 observer #157 (be7ef029af8491e9cc1d332abc14137c69dbd802).

Implementation:

1. ar_ptp_lab_get_timing_authority() returns a quiet, canonical status-derived SOURCE/RECEIVER/MONITOR clock lease: role, generation, readiness, selected GM identity+port, global traceability, and explicit sv_phase_qualified=false. The pre-existing serial/GUI status API uses the same private status collector. SOURCE generation is double-checked around status retrieval. Neither lab SOURCE nor MONITOR claims global traceability.
2. ptp_receiver_runtime_active() distinguishes worker ownership (including startup/cleanup) from READY. The PTP facade blocks config and cross-role START until the old worker completes hardware cleanup; STOP immediately revokes clock usability, measured sync and traceability even if a prior snapshot still showed LOCKED.
3. SOURCE epoch arm/phase observer consumes the canonical quiet SOURCE generation instead of assembling separate mode/config/generation checks. No changes to high-frequency SMV ISR or publisher encoder. No new per-sample IOCTL/heap/lock.
4. Strict portable canonical regression checks zero/stale generations, false receiver lock, GM identity projection, traceability revocation, and invalid roles. Documented in docs/PTP_CANONICAL_RUNTIME_AUTHORITY_M3A.md.

Next critical work: this is M3A.1, not complete M3. RECEIVER smpCnt=0 to external PTP second/PPS epoch association, measured egress phase evidence, SOURCE/RECEIVER full matrix, fault-injection rearm, and physical ESP32-P4/IED/GM acceptance remain unresolved. smpSynch AUTO stays fail-closed (0). Do not merge/release as a physical synchronisation qualification solely on this software checkpoint.

[masarray]

M3C.2 engineering checkpoint — external RECEIVER PTP-second / SV epoch lease

Exact PR head: e75992cf322884ddfe029474ef08c903f528b575 (2026-10-15). Single fast-forward commit stacked on validated M3A.1 712dfc3; PR remains Draft. Modified 6 files (portable clock-lease guard, portable regression, phase observer/arm, test registration, scoped CI, docs).

Implemented: optional RECEIVER smpCnt=0 GPTimer epoch arm, admitted only under experimental phase-servo configuration with canonical receiver clock usable/LOCKED and selected GM. SOURCE keeps existing PTP-arm behavior. Startup PTP clock read and every subsequent 1-second phase observation fence role + generation + grandmaster clock identity/port before/after clock read and before handing off an existing bounded correction. A changed/lost/relocked PTP authority or publisher fault revokes software phase correction; explicit SV STOP/START is required to arm under a different lease. Normal RECEIVER remains free-running and AUTO smpSynch remains 0. No ISR IOCTL, heap, lock or per-sample overhead added.

Targeted GitHub Actions (triggered once; PR-body marker removed):

• M3C.2 ESP32-P4 PTP Lab #38653136480: portable regression and one-job guarded SOURCE then RECEIVER builds.
• CI Routing Policy #38653136449.
  Both were QUEUED at the time of this comment. Do not represent this commit as CI-PASS until actual job results are verified. Heavy two-role matrix intentionally skipped on Draft.

Not established: board hardware test, PPS GPIO capture, TX MAC timestamp to wire, external GPS/GM quality, relay conformance, or smpSynch=1/2. Documentation: docs/PTP_SV_RECEIVER_EPOCH_BINDING_M3C2.md. Next gates: exact-head CI then physical ESP32-P4 locked RECEIVER/GM capture, sustained epoch drift, deliberate source/lock/PTP phase-step fault injection.

[masarray]

M3D.1 — EMAC SOURCE/RECEIVER worker-lifetime ownership fence (2026-10-15)

Exact Draft PR #166 head: 08a1a5e746a7615d53fd39aa911544243321fe78, one fast-forward commit on previous software-verified M3C.2 e75992c; 7-file scoped delta.

Root cause: ar_ptp_source_is_running() reports fresh measured SOURCE readiness rather than ownership of the EMAC hardware timestamp path. During SOURCE START, loss of evidence/holdover and STOP cleanup it can be false while the SOURCE worker still owns EMAC. The PTP facade previously used that false READY to admit a second role or to route status as idle.

Changes: ar_ptp_source_runtime_active() exposes SOURCE's existing atomic worker lifecycle; facade now reuses the same pure can_change_ptp_emac_role() guard for configuration/START and distinguishes SOURCE active from SOURCE READY in canonical status collection. A bounded, nonblocking RAII atomic control admission guard also rejects simultaneous START/configure requests without holding a spinlock across the worker's blocking START. MONITOR and RECEIVER ownership/cleanup remain guarded. No change to ISR, protocol wire, sample-counter encoder, smpSynch AUTO or default runtime profile.

Regression: ptp_emac_role_ownership_tests covers all SOURCE/RECEIVER active and pending-cleanup combinations under -Werror. Existing M3C PTP lease/phase regressions retained. Previous exact head M3C.2 run #38653136480 SUCCESS: portable regression + ESP32-P4 SOURCE and RECEIVER guarded compilations; CI Routing Policy #38653136449 SUCCESS.

New exact-head M3D.1 gate: PTP Lab #38653932002 in progress at comment time; Routing Policy #38653932360 SUCCESS. One-shot Draft marker removed. Verify M3D.1 portable test and both firmware role builds before declaring new head green; this check does not upload a flashable artifact.

Remaining: concurrent STOP during a not-yet-admitted START needs an explicit cancellation-ack handoff if callers can issue commands in parallel; do not infer this from the atomic admission guard alone. Hardware PTP GM discipline, external PPS, measured wire SV phase, sustained fault injection and public release are unverified.

[masarray]

M3D.1 exact-head acceptance — SOFTWARE VERIFIED (2026-10-15)

Head 08a1a5e746a7615d53fd39aa911544243321fe78:

• ESP32-P4 PTP Lab run #38653932002 SUCCESS. phase-guard-checkpoint PASS for (1) portable strict phase regression including ptp_emac_role_ownership_tests, (2) guarded ESP32-P4 SOURCE firmware compile, (3) guarded ESP32-P4 RECEIVER firmware compile.
• CI Routing Policy #38653932360 SUCCESS; Draft heavy role matrix skipped by design. Opt-in marker has been removed from PR description.
• Targeted run published zero binary artifacts; no image is offered as an approved board release.

M3D.1 closes the cross-role false-idle window by distinguishing SOURCE g_ptp_started worker ownership from measured READY, matching existing RECEIVER lifecycle and a nonblocking atomic START/config admission guard. Same logic shared by status routing and config/start checks. No ISR/SV wire/auto smpSynch semantics changed.

Evidence boundary: portable/core regression + ESP-IDF compilation only. No physical ESP32-P4, external GM/PPS, relay interoperability, or wire-time acceptance. Concurrent STOP-vs-in-flight START cancellation acknowledgment still needs a separate control-path regression; do not imply that the admission guard alone resolves it. Continue with M3D.2 lifecycle cancellation and hardware test artifact gate, keeping full CI cost scoped.

[masarray]

M3D.2 acceptance — SOFTWARE VERIFIED + BENCH ARTIFACT VERIFIED (2026-10-15)

Exact PR head: 7d2d5146b1892124c1744ad26ab31b3489e8387e. PR #166 remains Draft, stacked on PR #157 (base be7ef029af8491e9cc1d332abc14137c69dbd802).

Scoped engineering: atomic START/config/STOP cancellation handshake with no lost-STOP gap at final release, measured clock/lease revocation while STOP pending, and 200 deterministic portable two-thread START/STOP interleavings. Follow-up commit 7d2d514 fixes the GCC syntax error caught on initial cfb0082 build; no force-push and no protocol/ISR/SV wire changes.

Exact-head software checkpoint

• PTP Lab workflow run #38655888456: SUCCESS on 7d2d5146b1892124c1744ad26ab31b3489e8387e.
  • Portable strict phase regression PASS (including new cancellation tests).
  • Guarded ESP32-P4 SOURCE compile PASS and role-specific artifact staging PASS.
  • Guarded ESP32-P4 RECEIVER compile PASS and role-specific artifact staging PASS.
  • actions/upload-artifact SUCCESS.
• CI Routing Policy #38655888405: SUCCESS. Full heavy Draft matrix skipped intentionally.
• One-shot Draft opt-in marker removed after the run was registered.

Downloadable GitHub Actions artifact: esp32p4-m3d-ptp-bench-7d2d5146b1892124c1744ad26ab31b3489e8387e, GitHub artifact ID 11936537835, 568,446 compressed bytes, retained until 2026-10-21 23:48 UTC. Open the workflow run → Artifacts (requires permitted GitHub login for download).

Independent ZIP validation performed: 12 ZIP entries total, source/ and receiver/ directories, each includes manifest.json, sdkconfig, flasher_args.json, bootloader at 0x2000, partition at 0x8000, application at 0x10000; all file sizes and embedded per-image SHA-256 hashes match manifests. SOURCE and RECEIVER application binaries have different SHA-256 despite equal sizes (443,472 bytes). Both images contain semantic source build ID 7d2d5146b1892124. prHeadCommit is the true PR head; checkoutCommit records GitHub's synthetic PR merge SHA separately. AUTO smpSynch remains unqualified (0).

Hardware acceptance remains OPEN: This is a flashable experimental bench package, not an official production/stable firmware release and not a successful physical ESP32-P4 flash or GM/PPS/IED conformance test. Confirm board silicon revision and compare manifest offsets/config before flashing, then run SOURCE and RECEIVER separately with external GM lock, PPS/epoch, GM switch/STOP START fault injection and captured on-wire SV phase evidence. Do not merge/ship on software-only evidence.

[masarray]

M3E.1 — bench evidence preflight merged into Draft stack (software-only, 2026-10-15)

Current PR #166 head: a1ae7acaf50c079ec62197a1105c3d5e6b08fc08 (fast-forward on firmware-verified M3D.2 7d2d5146b1892124c1744ad26ab31b3489e8387e), Draft, base PR #157 be7ef029af8491e9cc1d332abc14137c69dbd802. Only 4 host-side files changed: scripts/ptp_m3e_bench_gate.py, tests/test_ptp_m3e_bench_gate.py, docs/PTP_M3E_BENCH_EVIDENCE_GATE.md, .github/workflows/ptp-m3e-bench-preflight.yml. No ESP-IDF, ISR, PTP servo, SMV encoder, Studio native installer, or public stable image changes.

Exact-head CI: M3E bench preflight #38660907259 SUCCESS (11 deterministic positive/adversarial Python tests, log confirms Ran 11 tests, OK). CI Routing Policy #38660907139 SUCCESS. Heavy firmware/C++ Draft matrices intentionally SKIPPED because firmware code did not change.

Real M3D.2 artifact preflight: ran the new host checker against the existing GitHub-generated ZIP esp32p4-m3d-ptp-bench-7d2d5146b1892124c1744ad26ab31b3489e8387e (artifact ID 11936537835, build #38655888456, expires 2026-10-21 UTC). SOURCE and RECEIVER manifests, actual binary SHA-256, semantic build IDs and distinct application binaries, SDKCONFIG role/guards, and ESP-IDF flash map all VERIFIED; ZIP SHA-256 2ba3f9d60fbe921f4f28bec0edebba6be32e32186c43cd089b940adcf472f7d9. Retained firmware build ID is 7d2d5146b1892124 because M3E.1 modifies host tooling only.

No duplicate PTP/SV protocol parsing: for a real classic-PCAP, the CLI calls the existing streaming ariec61850_ptp_sv_wire_audit --json, checking canonical SV identity/counter/wrap and fail-closed wire smpSynch=0 (at least two sample-zero events) and matching PTP source visibility. A real IDENTIFY and repeated PTP SHOW serial log is required for source/role/build validation, including rejection of LOCKED without selected GM. Reports bind serial/PCAP hashes and distinguish reported receiver lock from independent physical accuracy.

Intentionally NOT qualified: local artifact preflight has serial.status=MISSING, wire.status=MISSING; independentHardwarePhaseQualified=null, independentPTPGrandmasterAccuracyQualified=null, relayAcceptanceQualified=null, autoSmpSynchPromotionPermitted=false, publicReleasePermitted=false. No physical ESP32-P4, external GM/PPS, MAC SV egress measurement, IED alarms, or relay interoperability was tested in this turn.

Next physical gate: use native ARStack Studio + isolated test process bus, flash one role with manifest offsets after preserving stable image, record IDENTIFY + multiple PTP SHOW states, capture canonical VLAN SV plus Announce/Sync/Follow_Up in classic-PCAP, then run scripts/ptp_m3e_bench_gate.py as documented; use separate segments across GM switches. Never promote smpSynch=1/2 or release production firmware based on this software evidence.

[masarray]

M3E.2 — Ordered receiver acquisition/recovery/GM handoff evidence (2026-10-15)

Exact Draft head: 993bace2d4d6c7f530981743963d4ff6d2b37da6, fast-forward of M3E.1 a1ae7ac (stacked on #157 be7ef0). Three host-only files: existing scripts/ptp_m3e_bench_gate.py, corresponding regression tests and bench evidence documentation. No firmware, ISR, wire encoder or native ARStack Studio release modifications.

Root cause closed: M3E.1's softwareEvidenceConsistent could be true on a clean canonical PCAP and a same-build RECEIVER log containing only UNLOCKED/ACQUIRING. That is not evidence of receiver acquisition. M3E.2 requires an explicit ordered operationalLifecycle.status=OBSERVED gate in addition to previous serial identity + canonical SV/PTP PCAP conditions.

Scenarios (host CLI --scenario): auto resolves SOURCE→source-ready and RECEIVER→receiver-acquisition; explicit receiver-recovery requires LOCKED→demotion→LOCKED and receiver-gm-handoff requires LOCKED GM A→demotion→LOCKED GM B. LOCKED snapshots require selected nonzero GM/port, numeric offset/path/jitter and positive RX Sync/FollowUp/Pdelay/accepted counts. Reject incomplete LOCKED, direct LOCKED-to-LOCKED GM swap, unrelated boot IDs, missing 16-hex boot identity and scenario/role mismatch. SOURCE readiness requires reported RUNNING plus successful Announce, Sync and FollowUp TX. The lifecycle algorithm is one O(n) scan; serial input is capped at 16 MiB.

Exact-head CI: ESP32-P4 PTP M3E Bench Preflight #38661979955 SUCCESS (26 Python positive/adversarial tests); CI Routing Policy #38661979985 SUCCESS. Heavy Draft firmware, PTP core, C++ and security suites SKIPPED by policy. Locally checked the real M3D.2 ZIP arstack61850-esp32p4-m3d2-bench-7d2d514.zip as firmware.status=VERIFIED, operationalLifecycle.status=MISSING, softwareEvidenceConsistent=false; no false hardware PASS.

Evidence boundary: An OBSERVED lifecycle is only board-reported transitions sampled in serial logs. Captures may miss transient faults. Native C++ ariec61850_ptp_sv_wire_audit remains the sole PCAP/PTP/SV parser, not a second protocol parser. Independent external GM/PPS, SV EMAC hardware TX timestamp accuracy, physical jitter/epoch measurement and IED/relay acceptance remain UNKNOWN. smpSynch AUTO=0 remains fail-closed, autoSmpSynchPromotionPermitted=false, publicReleasePermitted=false. No new binary artifact required; existing M3D.2 firmware run #38655888456 and artifact ID 11936537835 are the same unmodified bench candidates.

Next real gate: flash one role to the corresponding ESP32-P4 lab board, capture IDENTIFY + PTP2 status through lock/loss/relock/handoff, collect canonical VLAN-preserving PCAP per uninterrupted GM segment, obtain independent PPS/MAC TX/IED measurements. Then run --scenario receiver-acquisition / receiver-recovery / receiver-gm-handoff separately and retain raw evidence and SHA. No physical board actions occurred in this checkpoint.

[masarray]

2026-10-17 experimental M3 checkpoint — PR #223 + #224 integrated (host/firmware CI, not physical acceptance)

Branch head: 2b68388afb994fe9087054b2be80f1101db558a3 (PR #166 remains Draft and stacked on PR #157; public main remains 1e972e2fbfcf8a52e7d2f2bcb7821d471434d7f8).

• PR M3E.3: fail-closed SOURCE readiness on STOP, TX faults and boot ambiguity #223 / M3E.3, merged ba3d6c3927702cf66956dfbf1ffae3cae20645d2: fail-closed SOURCE bench proof cannot inherit historical RUNNING across STOP/rejected START, malformed SHOW, failed PTP TX, or boot ambiguity. 29/29 positive/negative M3E tests PASS, run https://github.com/masarray/arstack61850/actions/runs/39017450895.
• PR M3C.3: include PTP/GPTimer clock-read uncertainty in SV phase tracking #224 / M3C.3, merged 2b68388afb994fe9087054b2be80f1101db558a3: phase tracker uses abs(phase_error_us) + observation_uncertainty_us for software-tracking confidence; adversarial phase tests. No post-timer START console log. Fixed MSVC VLAN test narrowing, built all five missing M3 portable test targets and updated CI structural guards for M3 clock-arm call + freshness-qualified SOURCE readiness. No feature-gate or smpSynch=AUTO promotion.
• Exact PR M3C.3: include PTP/GPTimer clock-read uncertainty in SV phase tracking #224 head CI 0dc0599dec9342acbd14f0a1119e4a9c86cebc5f: PTP Core (GCC/Clang/MSVC) PASS run 39018262411; PTP SOURCE + RECEIVER ESP-IDF build PASS run 39018262406; ESP32-P4 SMV Injector PASS run 39018262408; Embedded Profile PASS run 39018262409; Security/Evidence PASS run 39018262405; CI Routing PASS run 39018262417. Broad C++ CI run 39018262589 was still in progress at comment time—check final status before any promotion.

Not satisfied / release blocked: physical EMAC/GM/PPS → actual SV sample-zero epoch and egress correlation; long-run drift/jitter/STOP-START/fault/GM handoff validation; source-scoped accurate smpSynch=AUTO; IED cross-vendor synchronization/alarm acceptance; reconciled stack integration into current main and operator Windows release sign-off. No real board test was performed here. SOURCE oscillator quality remains untraceable without independent reference. Stable public v0.1.1 unchanged.

Next priority: reconcile stacked PR #153/#157/#166 against diverged current main without blindly merging; test with portable/deterministic gates, then collect independent physical SOURCE/RECEIVER bench evidence using the existing M3E gate and canonical packet capture. Do not change smpSynch from 0 or claim PTP-locked from build/host PCAP evidence.