[masarray]

Continuation of #268; NOT main merge or public release

Physical baseline: 2026-10-20T23:05:09Z PCAP, head 6c97195e80c0058f, stable smpSynch=1 105 s with 499,988 SV frames, but acquired only ~19.77 s after capture began (not click-to-LOCK). PTP SOURCE remained active.

Root cause

SvLocalRefAcquisition always discarded preflight and demanded ten fresh live MAC+phase epochs after START even when ESP32-P4 GPTimer/PTP had already demonstrated prolonged stable preflight. Independent canonical MAC TX evidence must still be measured in the live publisher, not guessed from the dry GPTimer clock.

Implemented

• Preserve up to 10 consecutive, identity-bound preflight phase-only measurements while SV TX is OFF. No preflight sample may authorize smpSynch=1.
• Under a matching warmed timer session/source/fault generation, promote LOCAL only after actual canonical descriptor MAC pairs plus three consecutive live phase+MAC epochs. Limit warm privilege to 8 live acquisition epochs. If not warm, keep original ten-live-epoch threshold unchanged.
• Any PTP/GM/source, session, phase, fault, live epoch gap or established MAC evidence loss resets immediately. No safety gate disabled. No logging in ISR/4kHz critical path.
• Extend 1Hz firmware AUTO control-plane logs to show warm phase count, live clean count and live age. Add exact Studio session/boot/token lifecycle logs for TXN_BEGIN → CFG_COMMITTED → CFG_VERIFIED → START_ACK_VERIFIED and STOP/failed START readback. Existing 60K bounded log, no duplicate GUI state.
• Deterministic positive and negative unit tests for warm/cold, initial MAC absence, established MAC loss, clock/GM/session/fault mutation, epoch skips/duplicates, expired warm history.

Acceptance gates

Run native/embedded/Windows packaging CI at exact HEAD; after green, provide integrated Studio GUI installer+embedded firmware to bench operator. Warm acceleration is a design improvement, not hardware-proven LOCK speed. Warm requires 10 consecutive qualifying pre-START epochs; immediate click when no preflight remains conservatively cold. External GM/PTP hardware accuracy and IED acceptance remain unproven. Do not merge to main or release prior to physical tests.

Stack: #269 → #268 → #267 (subject to assigned PR number).

Additional P0 lifecycle fix (same branch)

• Root-cause vulnerability for unexpected SV STOP: ESP32-P4's control-session lease expires after 2500ms; Studio's 700ms HEARTBEAT previously competed in the normal 64-command FIFO and could be rejected while an exclusive CFG batch was active. In Studio's sole DeviceIoWorker serial owner, a single coalesced reserved heartbeat slot now preempts ordinary CFG/profile traffic but NOT SV STOP or PTP STOP and still respects serial pacing. This does not extend firmware lease, invent RUNNING, or mask a failed serial transport.
• Regression harness checks saturation by a full 64-command exclusive FIFO, heartbeat coalescing, and safety STOP preemption.
• Studio's existing bounded 60KB serial/session diagnostics log now records transaction stages, operator/fail-safe STOP, unsolicited readback and per-event ISO-8601 UTC millisecond stamps for correlation against the independent PCAP.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T00:14:16.917426Z	76b1468	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 76b1468c19

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve warm qualification after promotion

When the warm path first qualifies at the real descriptor cadence, live_age_ is 8 and count_ is 3; on the next otherwise healthy epoch, live_age_ becomes 9, this clears preflight_epochs_, and the return expression becomes false because count_ is only 4. Firmware therefore advertises LOCAL for one second, revokes it for the following healthy epochs, and only restores it when the cold count reaches 10—the exact intermittent synchronization behavior this change is intended to prevent. Latch an explicit warm-promoted state (cleared on evidence loss or identity changes), or otherwise expire warm eligibility only before promotion.

AGENTS.md reference: AGENTS.md:L74-L76

Useful? React with 👍 / 👎.

[masarray]

Final engineering checkpoint — 2026-10-21, exact HEAD verified

PR #269 HEAD: d21d66e2872de4cd2423fce78efd0bb7e677d3bc, based on unmerged #268 6c97195e80c0058f675ad2bf6f4be053687453dc. Both remain OPEN/unmerged to main, no public release.

Implemented in this stacked branch

• Firmware AUTO local acquisition now supports 10 consecutive phase-only preflight epochs while SV publisher is OFF, followed by real canonical MAC descriptor evidence and 3 consecutive LIVE qualified epochs within 8 live epochs; cold fallback remains 10 full live epochs. It cannot assert LOCAL from dry preflight. Loss of verified MAC, clock/role/source, phase, session/epoch continuity and publisher fault still deasserts immediately. This is a proposed warm-start optimization not yet physically proven.
• Native Studio serial owner's HEARTBEAT previously had ordinary 64-item FIFO admission despite ESP32-P4's 2500ms fail-safe control lease. One bounded/coalesced reserved heartbeat slot now runs ahead of ordinary commands but behind both SV and PTP STOP, respects serial pacing and same QSerialPort owner. Firmware lease timeout remains unchanged, no blind extension or fake RUNNING.
• Studio's bounded log now stamps UTC with milliseconds and records exact CFG/START/STOP transitions plus classified runtime fail-safe STOP vs operator STOP ACK and firmware lease/transport faults; no QML watchdog or duplicate state source.
• Portable and Qt positive/negative regressions plus structural contract protect warm-vs-cold qualification, MAC/source/epoch faults, heartbeat saturation/coalescing and operator-vs-firmware STOP provenance.

CI exact SHA: 10/10 complete SUCCESS

Product Naming Guard, Security and Evidence, Embedded Profile CI, ESP32-P4 SMV Injector, ESP32-P4 PTP Lab Profile (SOURCE + RECEIVER), PTP Core CI, C++ CI (Linux GCC+Clang/Windows MSVC), ARStack Studio Qt (native session harness, contract, clipboard), ARStack Studio Windows Lifecycle, ARStack Studio Native Preview. Windows native preview verifies matching firmware build, packaged GUI smoke, Inno install/upgrade/uninstall, real public NSIS 0.1.1 migration.

Physical bench Windows package: https://github.com/masarray/arstack61850/actions/runs/39520909050/artifacts/12311670512 — arstack-studio-native-preview-win-x64-269-d21d66e2872de4cd2423fce78efd0bb7e677d3bc (~78 MB, artifact retention ~7 days). Includes installer, portable and exact-head embedded firmware manifest. Native preview run: https://github.com/masarray/arstack61850/actions/runs/39520909050.

Remaining gates

Flash same build via Studio GUI, compare installed firmware Build ID d21d66e2872de4cd; test warm PTP preflight (allow >=10 healthy 1Hz phases before SV START) vs immediate cold START, record click-to-smpSynch timeline and physical phase/MAC evidence from Studio Capture and Copy diagnostics, test repeated START/STOP (including heartbeat under load), PTP toggle, 1h endurance and external IED/GM interoperability. The prior physical capture proved ~105s steady LOCAL only on old #268 build. Never state #269 is hardware PASS or merge/main/release based solely on CI.