Skip to content

M3: unified PTP–SMV context supervisor, continuous PPS↔smpCnt, dual clock authority and bounded recovery #162

Open
Open
M3: unified PTP–SMV context supervisor, continuous PPS↔smpCnt, dual clock authority and bounded recovery#162

Description

@masarray
masarray
opened on Oct 14, 2026

2026-10-23 status correction: Historical stacked PRs #153 (M1) and #157 (M2A) are CLOSED unmerged as redundant review entries after exact GitHub ancestry confirmed their heads are preserved in still OPEN Draft #166 (both 0 behind). #166 now owns full inherited M1/M2A/M3 source review. The older text below describing #153/#157 as OPEN Draft is historical, not live status. No new timing code was merged into main by this cleanup.
Separate current P0 no-regression lane: Draft #288 derives from the real PCAP buildId 7c95f70c because previous #286 042df0d4 failed SV reception in ARSAS/DigSubAnalyzer. Source inheritance in #166 does not prove physical timing or authorize transplant into #288. M3 SOURCE/RECEIVER, physical IED and smpCnt discipline requirements remain OPEN here and in #154; hardware EMAC-timestamp/4800 in #21.

M3 — Smart, reliable, context-aware ESP32-P4 PTP–SMV runtime

Decision / release guard

M3 is NOT achieved yet. The current M1–M2F work is in Draft PR #153 and PR #157; the latter was at 90062f391a9c97cb1ff20d072b7f15ba4a777fac when scoped and diverged from main (77 ahead / 13 behind). The public SMV Injector baseline must not be silently replaced. This issue is the M3 implementation/acceptance contract, not a claim of finished firmware or IED acceptance.

Core nonnegotiable acceptance: smpCnt=0 must be causally tied to each correct logical PTP one-second boundary and its subsequent frame/sample cadence must remain continuously disciplined, not merely PTP-aligned once at START. Support (A) ESP32-P4 internal local PTP Grandmaster using its own oscillator as a truthful, untraceable time source, and (B) TIME_RECEIVER disciplined by external GPS/PTP GM. Neither task alone proves the peer IED is locked. A physical PPS pin is OPTIONAL test instrumentation; the mandatory reference is the EMAC PTP epoch/second boundary.

Current code audit / exact starting point

  • include/ariec61850/time_sync/sv_ptp_epoch.hpp plan_sv_ptp_second_arm() aligns the initial GPTimer alarm to the next EMAC PTP whole second. It explicitly does not discipline subsequent sample intervals.
  • embedded/esp32p4_smv_injector/main/app_main.cpp plan_source_ptp_epoch_arm() rejects every role except AR_PTP_ROLE_LAB_SOURCE; otherwise START can use the free-running rational GPTimer. For the 1-ASDU / 80-SPC profile where sample_counter_modulus == publisher_rate_hz, smpCnt=0 is the logical per-second epoch. Do not assume this invariant for arbitrary ASDU grouping, frequency or SCL profile.
  • sv_ptp_phase_authority.hpp plus app_main.cpp M2A has bounded 1Hz control-plane PI/slew for SOURCE, with explicit session/fault/source generation guards, but CONFIG_AR_SMV_PTP_PHASE_SERVO_EXPERIMENTAL defaults OFF. M2C/M2D sparse actual-SV descriptor timestamp evidence is opt-in and can perturb TX; it has no on-hardware success evidence yet.
  • ptp_receiver_task.cpp has external-Ptp SOURCE discovery, hardware Pdelay, frequency/phase EMAC clock discipline, timeout and holdover; it does not yet supply the same continuously qualified SV/GPTimer bridge as SOURCE.
  • smp_synch_lab.cpp in PR M2A: bounded continuous PTP–SMV phase authority and guarded ESP32-P4 observer #157 retains g_sv_timeline_phase_qualified=false without production promotion. This correctly avoids falsely asserting smpSynch=1/2, but the acceptance gate is unfinished.
  • live_control.cpp START sets running before publisher profile/template validation; publisher may log START rejection and continue without atomically reporting STOP/error. Require explicit START transaction acknowledgement from actual runtime.
  • sdkconfig.defaults still enables CONFIG_AR_SMV_BROADCAST_MIRROR=y; the normal interop profile must disable noncanonical mirror/probes unless explicitly requested.
  • M2F SOURCE freshness/TAI/UTC flag truthfulness is important: internal GM clockClass=248, unknown accuracy and nontraceable must not be spoofed to force IED lock.

Design contract: small, deterministic, no naive global state explosion

One single-writer, event-driven control-plane supervisor publishes a fixed-size immutable ContextSnapshot (atomic generation+snapshot handoff, or provably coherent bounded critical section). Separate orthogonal facts rather than one enormous branch tree:

  • ClockRole: LOCAL_GM | EXTERNAL_RECEIVER | MONITOR | OFF.
  • ClockEvidence: NOT_READY | ACQUIRING | LOCAL_READY | EXTERNAL_LOCKED | HOLDOVER | STALE | FAULT; include selected master identity, source/clock generation, offset uncertainty, time provenance and age.
  • SampleEvidence: STOPPED | ARMING | PHASE_ACQUIRING | PHASE_TRACKING | UNQUALIFIED | FAULT; include profile generation, epoch generation, planned alarm time, rational sample index, missed-slots and TX-fault generation, last observed phase, bounded uncertainty.
  • LinkHealth and ControlLease; explicit UserPolicy on whether bench-only unqualified/free-running SV is permitted.
  • Derive can_start, can_continue, can_assert_smpSynch, should_rearm from a pure policy engine with exhaustive portable truth-table tests. Every asynchronous result carries (session_id, source_generation, profile_generation); stale commands must be discarded.
  • Control plane owns role changes; PTP and SMV ISR never perform network IOCTL, logging, heap allocation, mutex waiting, free-running correction calculations or unbounded loops. Allow only O(1) constant-time tick/atomic work at 4000/4800 fps.

Milestones, in strict order

M3.0 — verified integration foundation (before a firmware refactor)

M3.1 — context authority and transactional lifecycle

  • Implement immutable PtpSvContextSnapshot, pure decide_ptp_sv_action(), event/transition table, role/session lease and source/profile generation, reason codes and bounded timestamps.
  • Make START a transaction: config/preflight -> link/clock policy -> profile/frame verification -> GPTimer armed -> publisher acknowledged. On failure: STOP/release, expose the real reason to Studio; no running=true ghost state.
  • Implement idempotent STOP, stale notification suppression, serialized teardown, bounded timeout and explicit BUSY/CLEANUP_PENDING, with exhaustive STOP/START concurrency tests.

M3.2 — PPS/second-boundary ↔ smpCnt continuous synchronization (highest technical priority)

  • Define SvSampleEpochPolicy from explicit SCL/profile semantics: ASDU per packet, fs, counter modulus, samples per nominal period and second-boundary relationship. Reject unsupported mappings instead of assuming modulus == fps universally.
  • For one-ASDU 80 samples/nominal cycle: 50Hz ×80 = 4000 samples/s, target smpCnt=0 at each PTP second; 60Hz ×80 = 4800 samples/s. For other ASDU modes use a correct profile-specific mapping.
  • On START, obtain bounded nonblocking cross-clock observation of EMAC hardware PTP clock and GPTimer, reject stale/step/unsupported time and arm the next safe second boundary. In EXTERNAL_RECEIVER require verified selected source + sufficiently stable discipline/lock; in LOCAL_GM require fresh local source, not GPS/UTC traceability.
  • Continue disciplining the GPTimer sample deadline against EMAC seconds for the entire run using the existing bounded phase PI/slew and rational fractional intervals. Sample n nominally corresponds to PTP_second_boundary + n*1e9/fs and smpCnt must correspond to that sample's scheduled epoch, not CPU wake time. Never advance or reset smpCnt spuriously merely to hide drift; missed slots remain visible and revoke phase qualification.
  • Handle 32-bit timer rollover (>71 minutes at 1 MHz), 16-bit counters/epoch generations, clock step/frequency changes, first-sample timing, PTP source change and arbitrary START/STOP. Timestamp each canonical SV egress only in sparse lab diagnostics; do NOT busy-wait on every SV frame or fake hardware evidence with software send time.
  • Test virtual clock multi-hour monotonic PPS/epoch coherence at 4000/4800 samples/s, rational tick error, rollover, ± phase error, injected offsets/drift and skew, lost slots, and source restart. Software-only numerical acceptance: exact correct smpCnt per profile and no unbounded correction/catch-up/bursts; phase/egress physical tolerances will be profile/standard-derived and must be measured on hardware, not invented.

M3.3 — symmetric internal GM and external GPS-GM paths

  • Reuse one time-authority-to-sample scheduler bridge for both roles; source-specific clock qualification belongs outside the shared servo. External RECEIVER drives EMAC clock; LOCAL_GM owns EMAC clock, announces its real local quality and responds Pdelay.
  • Select modes explicitly and supervise transitions. External source/GM change and holdover are not equivalent to local GM: no invisible failover/rogue GM on an energized process bus. Provide opt-in, configurable island fallback with delayed advertisement, safe re-arm and mandatory phase reacquisition. Strict IED may reject untraceable local GM; never falsify clockClass, timeTraceable, frequencyTraceable, ptpTimescale or UTC offset.
  • Preserve and verify PTP profile values: domain, transportSpecific, VLAN, Announce/Sync cadence, sourceIdentity, stepsRemoved, Pdelay request/response. Keep all adjustments off the hard realtime SV path.

M3.4 — evidence-driven smpSynch and receiver interop semantics

  • Create a separate qualifier taking PTP source/receiver evidence + SV planned phase continuity + bounded uncertainty + fault-free canonical frame history + freshness + matching session/generation.
  • In AUTO, smpSynch=0 until evidence passes; only then consider 1 for proven local synchronization domain and 2 for proven global synchronization per the relevant IEC 61850-9-2 / IEC 61869-9 mapping, not merely external GM lock. Revoke immediately on source loss, interval slip, clock step, TX loss or stale age. Lab force overrides must be visibly flagged and never accepted as measured.
  • Do not claim IED locked based only on ESP32's own SOURCE sending; only an independent receiver/bench observation can establish IED acceptance.

M3.5 — bounded recovery and context awareness

  • Inject Ethernet LINK_DOWN/UP, SOURCE stale, external GM disappeared/changed, clock step, unstable Pdelay, missed sample slots, TX 400-consecutive-failure stop, lease expiry, rapid START/STOP, receiver asynchronous cleanup.
  • Pure policy gives retryable | recoverable_rearm | requires_user_action reason; bounded debounce, limited backoff, retry budget and clean reset of source/session/servo. Never infinite recover/restart storm or a stale READY.
  • Explicit operational policy: Strict interop refuses qualified SMV before clock+phase qualification; optional Bench permissive permits TX with smpSynch=0 and a visible FREE_RUNNING/UNQUALIFIED status. Switching policy is explicit, not silent.
  • Distinguish transport STOP, PTP reacquisition and SV quality demotion. Do not restart a healthy publisher merely to update telemetry.

M3.6 — realtime performance, diagnostics and resource budget

  • Disable broadcast mirror and probe frames for production-shaped interop baseline; avoid unbounded shared EMAC lock contention between timestamped PTP TX and 4000/4800 SV fps. Instrument missed deadline, skipped slots, TX time, and bounded phase drift without per-frame allocation/log/IOCTL.
  • One low-rate aggregated telemetry snapshot with clockRole, clockState, selectedGM, PTPoffset, sourceAge, PPS/smpCnt phase, SV synchronization qualification, TX/missedSlots, recoveryReason, epochGeneration, and explicit UNKNOWN where instrumentation is absent. Studio must never show stale LOCKED.
  • Distinguish scheduled sample ISR phase, actual Ethernet MAC egress phase, protocol Sync frame hardware timestamp and IED receiver lock. These are not interchangeable.

M3.7 — deterministic acceptance / efficient CI / deployment gate

  • Portable unit tests: policy state table, timer/smpCnt/PPS math, 4000/4800Hz epochs, 32-bit rollover, SOURCE/RECEIVER symmetry, stale generation, clock jumps, holdover limits, sync promotion/revocation, bounded retry, single-writer snapshot consistency.
  • Independent wire/PCAP fixture for PTP Announce/Sync/FollowUp/Pdelay and SV smpCnt monotonic/wrap, APPID/VLAN/ASDU/sequence, quality/time semantics.
  • One lightweight portable CI on relevant changes. Run one explicit guarded ESP32-P4 SOURCE+RECEIVER compile only on checkpoints or ready-to-merge; do not rebuild Windows installer, unrelated Qt, or many matrices per micro-commit. Publish a smoke-test firmware artifact for physical trial at a clean milestone only.
  • Software PASS != hardware qualification. With no IED/GPS/PPS hardware available, deliver software evidence and an external capture checklist; keep release/merge gates explicit. Hardware acceptance later requires actual MAC timing/clock capture, IED lock/alarms and long-running 50/60Hz interop.

Invariants / prohibited shortcuts

  • One authority per session for PTP epoch and SV sample grid; conflicting SOURCE+RECEIVER role must not start.
  • Deterministic smpCnt follows scheduled sample index; never renumber past dropped samples as if nothing happened. A phase fault invalidates smpSynch immediately.
  • PTP READY means fresh evidence, not GPS traceability; PTP LOCKED alone does not imply SV qualified. No fake PPS/GPS, no fabricated TX timestamps, no hard-coded clock-quality promotions.
  • Never introduce a synchronous PTP ioctl, TX descriptor busy-wait, heap allocation, logging or unbounded loop into the 4000/4800Hz ISR.
  • No naive duplicated state machines or per-frame dynamic fallbacks. Use pure small algorithms, explicit profile contracts, immutable snapshots and narrow task ownership.
  • Do not merge Draft PR M1: standards-aligned PTP source defaults and fail-closed SV epoch startup #153/M2A: bounded continuous PTP–SMV phase authority and guarded ESP32-P4 observer #157 to main, auto-release, or change the public installer as a side effect of creating this plan.

Exit gate

M3 READY only once internal GM and external receiver share the verified continuous PPS/smpCnt phase bridge, clock changes cannot produce phantom RUNNING_QUALIFIED, fail-closed smpSynch is derived from proper evidence, bounded recovery/fault injection and realtime regression pass on the reconciled main baseline. Full interop/physical sign-off remains blocked until independent ESP32-P4/IED/GPS measurements become available.

Activity

  1. masarray commented on Oct 23, 2026

    @masarray
    masarray
    on Oct 23, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    2026-10-23 confirmed live FAT defect: STOP must NOT revoke clock/phase

    Operator clarified mandatory design: ESP32-P4 runs PTP clock authority + continuously phase-aligned SV sample grid from boot; both persist with zero SV traffic when operator presses STOP. START/STOP gate only 4I4V output. In AUTO mode begin on local GM/grid while externally discovering a compatible master; select an external GM only after qualification/hysteresis, and revert/holdover according to explicit Advanced policy. No unexpected local GM promotion on a live process bus.

    Observed wire: on firmware buildId 7c95f70cced4d126, PCAP ARStack_SV_20261023_104209_207.pcap had 490881 good SV, 375 PTP (125 x Announce, Sync, Follow_Up), one 2.3599 s SV pause on STOP/START, smpSynch 2→0 then reacquire 5.25 s. PTP Announce/Sync/FU persisted across the gap (PTP itself was not restarted). Source-level ROOT CAUSE in embedded/.../app_main.cpp: stop_sample_clock() unconditionally calls revoke_sv_auto_claims(SvSyncLossReason::publisher_stop), resets armed_ptp_clock and phase-authority and destroys GPTimer. The dry-clock preflight in publisher_task already exists, but is created/destroyed under SV publisher ownership and START only conditionally reuses it; this is why injection STOP can force reacquisition with unchanged PTP SOURCE.

    Implementation priority: first decouple ClockAuthority and SampleGrid lifetime from SV TX/USB-heartbeat lease; preserve qualified PTP/phase through 100 STOP/START operations and optional 6s control lease expiry; only promote actual GM-change/link-loss/clock fault to requalification. Source-publisher BER/SMV wire format must remain unchanged from true PCAP-proven 7c95f70c. External receiver/BMCA and configurable Advanced AUTO come next in an isolated PR; coordinate inherited #166 without blind cherry-picks. No contradictory simultaneous local SOURCE + external RECEIVER on same PTP domain.

    Checkpoint already merged: PR #288 into checkpoint/sv-ptp-autolive-capture-ci-merged-20261023, merge SHA e82040716c549af887579b369965ba96a890a4db, main untouched. New Draft DESIGN PR #289 #289 stores the detailed always-on architecture, exact tasks, and FAT gates. No actual always-on firmware refactor has been committed yet. Keep #162 open until hardware PCAP+ARSAS+DigSubAnalyzer+SIPROTEC5 acceptance.

  2. masarray commented on Oct 23, 2026

    @masarray
    masarray
    on Oct 23, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    2026-10-23 architecture handoff: always-on clock / sample grid belongs to Draft design #289

    New Draft PR #289, head 3d8942fc6388dc4628269b206e4429dc6d77da0e, is spec-only, based on separate recovered checkpoint from merged #288 (e82040716c549af887579b369965ba96a890a4db). It documents current issue: STOP SV calls stop_sample_clock() to delete GPTimer/revoke smpSynch although PTP SOURCE keeps transmitting, rearm resets sample grid. Proposed split ClockAuthority / SampleGrid / SV TX lifecycle is not yet implemented or hardware tested. Preserve disjoint ownership: #289 design, #166 cumulative M1/M2A/M3 source candidate (NOT blindly merged), #288 recovery checkpoint, #154 physical PTP/SV IED acceptance.

    Current original 7c95 125s capture has one 2.359893s real STOP gap, smpSynch=2→0→2, with PTP Announce SOURCE advertised GPS/clockClass6 while no upstream source actually locked. Any M3 development must preserve true local nontraceable clock source, no fake flags, and full EMAC/PTP timestamps. Keep this milestone OPEN, acceptance to require ≥100 STOP/START cycles preserving sample-grid qualification only after actual new code is accepted and full bench evidence, plus external receiver dual-clock choice/holdover.

  3. masarray commented on Oct 23, 2026

    @masarray
    masarray
    on Oct 23, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    2026-10-23 M3 branch ownership after repository cleanup — #290 now implements narrow M3.A

    New separate firmware-only Draft #290, 12358bde64a7459b4f6e8c5a62e0e0e8eba7e6d8, base checkpoint/sv-ptp-autolive-capture-ci-merged-20261023. #289 3d8942fc6388dc4628269b206e4429dc6d77da0e is the architecture spec. #290 implements an attempted STOP-to-dry-grid PARK with preserved PTP phase rather than deleting GPTimer, limited 4/4.8kHz and source lease/profile/rate health; this is NOT yet a passed hardware feature.

    Do not close #162 / #154 or auto-merge either draft: CI and hardware still needed: no packets during STOPPED, no implicit restart, fresh board Source GM identity/provenance (do not fake GPS/clockClass6 traceability without source lock), >100 STOP/START cycles with stable qualification after actual resume, no new smpCnt gaps/flaps, ARSAS/DigSub decoding and IED PTP LOCKED. #166 contains older M1/M2A/M3 branch source, not a safe automatic cherry-pick onto recovered checkpoint.

    No code changes from housekeeping. Original field PCAP shows a real 2.359893s stop/restart gap on 7c95; #290 aims to change that behavior, so no existing packet capture can certify #290's new timer-lifetime path.

  4. masarray commented on Oct 23, 2026

    @masarray
    masarray
    on Oct 23, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    M3.A implementation handoff — 2026-10-23: Draft PR #290, base exact merged checkpoint e82040716c549af887579b369965ba96a890a4db; isolated branch feat/m3a-persistent-sv-grid-20261023, current head 71c134db169c0a14b8ed112f5d06215c9aa86fb9. PTP/SV codec and Studio untouched. Initial implementation preserves active PTP-aligned GPTimer, 1Hz phase observer and lease across healthy SV STOP; disables ISR->publisher notifications while OFF; verified SV START reuses grid on next 1s epoch. Rapid STOP→START overtaking 200ms park now covered. PTP/GM/phase/rate/profile fault still fail closed. Zero-cost constexpr policy for 4k/4.8k; 100-cycle policy test, GCC/Clang PASS. First ESP firmware CI PASS; final matching ESP32/Windows CI still running, do NOT merge or overwrite physically captured baseline. This alone does NOT establish instant smpSynch=2 after START: live MAC evidence gate can still require fresh on-wire measurements. Need 100-cycle physical FAT. M3.B/C (startup clock authority / external AUTO GM) remain separate. Avoid code overlap with #166 and #286.

  5. masarray commented on Oct 23, 2026

    @masarray
    masarray
    on Oct 23, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    2026-10-23 exact HEAD Draft #290 M3.A software gate / physical NO-GO

    Latest #290 head 71c134db169c0a14b8ed112f5d06215c9aa86fb9 (recovered checkpoint-based STOP→park-grid firmware change, not #289 design-only source). Exact-source workflow statuses: ESP32-P4 SMV Injector #39950300994, ARStack Studio Native Preview #39950300989, PTP Core CI #39950300871, Product Naming Guard and CI Routing Policy all SUCCESS. Embedded Profile CI, C++ CI, Security/Evidence and ESP32-P4 PTP Lab Profile were SKIPPED on this Draft SHA. Do not claim complete full CI, let alone hardware proof.

    Acceptance still open: STOPPED must transmit zero SV without destroying a qualified PTP clock/sample grid; exactly 100 STOP/START cycles at 4k/4.8k plus USB lease-loss/reconnect, genuine source change fail closed, capture first renewed smpCnt/phase and any 2→0 transition, internal GM truthful class/time provenance, independent ARSAS/DigSub + SIPROTEC 5 receiver proof. #289 design covers later M3.B/C/D with source-exclusive documentation, so it is not an obsolete branch to close simply because #290 exists. Neither PR authorized for main merge.

    Repo cleanup lane has not changed runtime/branches/code. This is an exact SHA acceptance record, not a software sign-off for public release.

  6. masarray commented on Oct 23, 2026

    @masarray
    masarray
    on Oct 23, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    M3.B physical FAT handoff: Draft #291, HEAD f3b6fdfc4396925efcc79546bb2fa65629d488c1 stacked on M3.A #290. Boot SOURCE-only clock starts without Studio on isolated lab, with bounded retries, operator override, PHY-cycle recovery, and Studio shutdown SV-only. GCC/Clang + firmware PASS; Windows CI pending at the time of writing. No external-GM AUTO/BMCA yet (M3.C), no physical 100-cycle STOP/START proof; keep #162 OPEN and original PCAP baseline untouched.

  7. masarray commented on Oct 23, 2026

    @masarray
    masarray
    on Oct 23, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    M3.C code handoff: Draft PR #292, exact HEAD 249de266f6a602f04055242700c49c4d0757818b, stacked above M3.B #291/M3.A #290. SOURCE passive foreign-Announce best-GM observation on the already owned hardware-Pdelay callback (4 bounded per-port candidates; domain/transport/VID/PCP, 3s hysteresis); safe SOURCE drain -> measured RECEIVER startup only while SV STOPPED; optional >=15s quiet local fallback in lab; 30s anti-flap; operator PTP manual precedence and no concurrent EMAC ownership. GCC/Clang + ESP standalone + paired firmware PASS. Windows build and hardware FAT pending. Do NOT mark relay global-sync complete. #166 overlaps 6 files, no cherry-pick.

  8. masarray commented on Oct 23, 2026

    @masarray
    masarray
    on Oct 23, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    M3.D code delivered as stacked Draft PR #293, exact HEAD 3a33575f940f2cef98527b8177358fc01d56014b. Four runtime source policies with generation-fenced boot supervisor and single-EMAC role ownership; Studio Advanced mode selection wired to PTP POLICY firmware with rejection/readback, no cosmetic-only mode state; zero SV/packet codec edits. GCC/Clang/PTP regression + ESP32 firmware PASS; Windows preview CI in progress. Hardware/relay FAT still required, no main/checkpoint merge.

  9. masarray commented on Oct 23, 2026

    @masarray
    masarray
    on Oct 23, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    P0 FIELD REGRESSION — BLOCK M3.D PUBLIC RELEASE / NO FALSE FAT CLAIM (2026-10-24)

    Operator reports exact paired physical FAT build 3a33575f940f2cef98527b8177358fc01d56014b now shows LOCAL SYNCH instead of the previously successful bench GLOBAL smpSynch=2, and becomes NOT SYNCH after SV STOP→START. Operators need an isolated-lab internal ESP32-P4 Grandmaster with PTP-aligned 4I4V stream that the relay actually accepts. Existing all-green CI is not a physical SV/PTP interoperability pass.

    Verified source regression root #1: embedded/esp32p4_smv_injector/main/smp_synch_lab.cpp auto_evidence() returns local_synchronized (1) for a qualified SOURCE unless ar_ptp_lab_bench_global_ready() is true; this requires g_bench_global_active = config.bench_global_gm && ptp_tai_epoch_seeded plus fresh SOURCE evidence (ptp_lab_task.cpp). Kconfig fill_kconfig_defaults() initializes bench_global_gm=false; the M3.D ar_ptp_lab_set_advanced_policy() unconditionally zeros bench_global_gm, bench_utc_epoch_seconds, milliseconds and mono seed on every new policy selection, including INTERNAL_GM_ONLY / AUTO_PREFER_EXTERNAL (ptp_mode_facade.cpp). Therefore boot SOURCE / policy SOURCE can legitimately emit smpSynch=1 even with valid PTP Announce/Sync/FU and phase-qualified SV. This is a source-level causal defect, not yet an independently reproduced packet-level result for the user's newest M3D trial.

    Verified source regression root #2: M3.A/B preserves running GPTimer across healthy STOP, but app_main.cpp START unconditionally resets g_local_sync_evidence, g_tx_egress_evidence and zero_epoch_frames_seen. sv_ptp_phase_observer_task requires fresh live canonical MAC evidence; warm acquisition needs three live phase+MAC epochs, cold as many as ten. stop_sample_clock() still revokes qualification when invoked. Thus resumptions are not guaranteed to publish smpSynch=2 immediately even when PTP SOURCE/clock generation is unchanged. Need phase/clock persistent owner, carefully designed warm continuity lease, and fail-closed resets only for actual GM/clock/phase/link faults. No unconditional force smpSynch=2, UI-only override, or fabricated physical relay LOCK.

    P0 next thread work: create a separate recovery branch from exact M3.D head (keep #293 Draft, #290–292 and e820407 checkpoint untouched); restore explicit opt-in bench global internal SOURCE mode with coherent PTP Announce timeProperties/TAI seed and same-EMAC SV epoch evidence. Do not quietly erase it on source policy changes or host reconnect. Add readback for bench_global_gm, bench_global_ready, UTC seed validity and reason, selected SOURCE generation, smpSynch mode/decision, phase and MAC proof/age. Prove boot without Studio; STOP SV no PTP/phase resets; START preserves validated continuity and requires actual on-wire proof for the relay. Cover INTERNAL/AUTO/EXTERNAL/MONITOR, manual override, GM/link/lease failures, and 100 STOP→START. CI paired installer/BIN exact same SHA plus real PCAP ARSAS/DigSub and SIPROTEC. Mark all current M3.D artifacts ENGINEERING EXPERIMENTAL / FAT FAIL (operator observation), not stable.

    Historical known wire: capture ARStack_SV_20261023_002658_189.pcap firmware buildId 7c95f70cced4d126: 140271 valid SV; smpSynch 0→2 after ~3.0s, remains 2; and 10:42 capture at same baseline firmware 490881 SV/375 PTP with STOP→START and ~5.25s reacquisition. This PCAP does not prove today's M3D trial wire. User has not supplied a new M3D packet trace in this current message. New handoff source files will be attached to the next thread by operator.

  10. masarray commented on Oct 23, 2026

    @masarray
    masarray
    on Oct 23, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    P0 M3.D regression (LOCAL SV and STOP/START sync loss) is tracked in Draft PR #294, source-confirmed fixes: new PTPGM bench_ready/actual source readback, verified UTC commissioning (SV OFF), preserve SOURCE bench UTC on same-role Advanced setting, SOURCE-only bounded warm MAC/phase reuse, and fail-closed LOCAL SV START in relay FAT profile. GCC/Clang PTP PASS; hardware FAT pending. Keep previously proven baseline immutable; do not merge stable yet.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions