M1: standards-aligned PTP source defaults and fail-closed SV epoch startup

[masarray]

Purpose

Improve real ESP32-P4 PTP/SV interoperability without faking synchronization or breaking stable 4I+4V publisher. Standards-referenced M1 only; not yet an alarm-free IED acceptance claim.

Base: main@9e70a4937874e3e1752b725264fe5a2008aa8fb0.

Code

• IEC/IEEE 61850-9-3 lab SOURCE defaults: 1-second Sync, retained 1-second Announce/Pdelay; receiver sync timeout 3000 ms rather than one nominal sync interval.
• PTP SOURCE readiness fails closed when requested EMAC Pdelay hardware RX unavailable; TX failure drops ready state.
• When verified LAB_SOURCE running before SV START: plan bounded first GPTimer wake from EMAC IEEE1588 clock observation so smpCnt=0 starts near its next PTP second (coarse initial alignment).
• AUTO smpSynch fails closed on bare PTP clock lock: SV timeline phase qualification is still required; laboratory forced statuses remain distinct.
• Add pure portable epoch planner + unit tests; update PTP firmware CI matrix nominal Sync to 1s.
• See docs/PTP_SV_EPOCH_M1_ACCEPTANCE.md for precise evidence/standards boundary and M2 physical acceptance.

Limits / next gates

GPTimer is NOT yet continuously disciplined by the EMAC PTP clock. No universal IEC 61869-9 epoch rule is inferred for arbitrary profiles. No claim of IEC/IEEE 61850-9-3 conformance or zero IED sync alarms until hardware timestamps, sample phase stability, relay time lock, and canonical SV capture pass.

Do not merge or tag public release until C++/ESP/Qt/security CI AND real ESP32-P4 + representative IED acceptance are reviewed.

Standards-first software-only continuation (2026-10-14)

The current user has no relay/timing test equipment. Do not silently treat host simulations as IED acceptance.

• PTP portable runtime default 1000 ms Sync, aligned with firmware/Studio.
• Portable read-only 9-3 cadence diagnostics: include/ariec61850/time_sync/ptp_power_profile.hpp.
• Decoded-wire regressions: tests/test_ptp_power_profile.cpp, Linux GCC/Clang + Windows MSVC CI, checking L2/0x88F7, multicast, Pdelay, 1 Hz Sync/Announce, sequence, identity, domain, VLAN, class 248 and no false traceability.
• tests/test_sv_ptp_epoch.cpp now also runs 120-second 4000/4800 rate/modulus mathematical schedule checks using the existing portable RationalTickSchedule (no second implementation).
• Standards and evidence ledger: IEC61850_PTP_SV_SOFTWARE_COMPATIBILITY_MATRIX.md.
• Known blockers: LAB_SOURCE PTP/TAI timescale/currentUtcOffset provenance and standard clock-state behavior not fully resolved; continuous PTP↔GPTimer steering and true SV TX timing not implemented. No equipment means these remain unverified, not passed.

M1+ PTP/TAI source correctness (2026-10-14 continued)

• New PtpTimeProperties flags are encoded consistently into PTPv2 Announce/Sync/Follow_Up/Pdelay. Low octet flagField is independently checked via raw wire octet tests, not only codec roundtrips.
• try_seed_ptp_tai_seconds bounds-checks a plausible UTC epoch, configured TAI-UTC offset, and uint32 ESP32-P4 EMAC seconds before seeding the clock. Hardware write is followed by bounded readback before flagging the PTP timescale.
• Without plausible RTC or hardware seed, no PTP timescale validity claim is advertised. This mode is a limited lab source, not full IEC/IEEE 61850-9-3 conformance.
• currentUtcOffsetValid defaults to false; manual opt-in CONFIG_AR_PTP_MANUAL_UTC_OFFSET_VALID additionally requires successful TAI seed. Neither timeTraceable nor frequencyTraceable may be asserted by LAB_SOURCE.
• LAB_SOURCE rejects unproven grandmaster source quality, including a forged clockClass or GPS timeSource.
• Portable tests now cover raw Ethernet flag byte positions, valid/invalid UTC-to-TAI conversions, and inconsistent validity options. Software-only, no physical accuracy assertions.
• Non-goals remain unchanged: no automatic merging/releasing or claiming IED alarm-free; continuous PTP-disciplined GPTimer and physical IED acceptance are still separate milestones tracked in M2: continuously PTP-disciplined SV timeline, truthful smpSynch and IED sync-alarm acceptance #154.

CI policy: Evaluate exact latest PR head SHA. Previous runs may be cancelled on subsequent pushes; do not treat an older green job as current-head evidence.