[masarray]

Root cause

In the 2026-10-22 capture of PR#282 the ESP32-P4 SOURCE PTP Announce, Sync/Follow_Up and the SV 4kfps/gmIdentity stream were already structurally valid, but AUTO held smpSynch=0 for 85,001 frames (~21.25s). The hard-coded SvLocalRefAcquisition::kRequiredCleanEpochs=10 is a conservative multi-second probation appropriate for an external GM receiver but unnecessarily slow for the ESP32's own EMAC 1588 hardware GM. Manual FORCE_2 immediately sets the flag but bypasses timing evidence.

Changes

• Add a SOURCE-only fast gate requiring two consecutive live 1Hz software phase-qualified epochs with a genuine measured coherent canonical SV MAC TX timestamp pair and same PTP clock source/session/fault generation. This preserves actual GPTimer→EMAC phase and smpCnt=0 epoch alignment, not just packet flags.
• Receiver/external-GM retains existing conservative 10-epoch qualification. Fast SOURCE gate cannot be entered by a mere GUI FORCE_2, fresh MAC-less stream, PTP SOURCE loss, skipped epoch, changed GM, publisher fault, software phase >4us, or expired descriptor evidence.
• Existing PTP SOURCE emulation and independent SV/GM identities, VLAN profile, 4kHz ISR, no-loss smpCnt and hardware timestamp schedule remain untouched.
• Regression exercises AUTO becoming available after first two real evidence-qualified 1Hz epochs (synthetic ~4–5 seconds vs prior ~21s observed), and immediate revocation for changes/faults.

Hardware gate

CI compilation and portable tests do not certify relay. Run on isolated SIPROTEC bench, measure phase lock acquisition after START, Pdelay exchange and relay accepted SV/current/voltage with no sync alarm. Expected faster lock is not a claimed physical result until measured. Never merge to main or stable without review.

---

2026-10-22 SCL-derived SV metadata and SOURCE_FAST checkpoint

• Added SCL-backed 4I+4V SV metadata wire mapping: 50Hz 80 samples/period produces smpRate=80/smpMod=0 at 4000 fps, 60Hz 80 samples/period produces 4800 fps; per-second mode remains smpMod=1; legacy optional omission remains backward-compatible. Code commit 017d9a8db9c4ab7f2598577446c5827f82654ec5; integrated binary 4I4V validation and BER roundtrip regression.
• Removed MSVC /WX optional narrowing warning in sample-rate regression; updated Qt Studio PTP SOURCE_FAST structural contract to require real measured MAC/phase evidence and conservative 10-epoch COLD/WARM tests (25accab5eb45a2036e507f0759ffde0fda9c9b92). Corrected inspector mode SmpPerSec matching the SCL model (3ebe7299c3bc8c777567dba36ffbdb1f505da457).
• ESP32-P4 firmware, PTP Core, PTP Lab Profile, Embedded Profile CI SUCCESS at 017d9a8. Windows C++ and Qt contracts initially failed on test-only issues, fixed in subsequent commits above; final exact-HEAD CI still pending at checkpoint. Do not imply ESP32 physical retest.
• Full external PTP AUTO_FAILOVER policy/BMCA/time-lease handoff is not implemented yet; current SOURCE/RECEIVER/MONITOR base remains. Fast SOURCE AUTO patch preserved, but ≤5sec physical lock, selected SIPROTEC GM/Pdelay/PTP LOCKED, SV accepted 4I4V without alarm, external failover/return and 1h soak remain HW FAT TODO.
• Do not bypass smpSynch=2 qualification, alter main/stable, or merge stacked PRs without verifying exact parent graph/CI and explicit user permission.

---

P1 external-GM AUTO failover — implementation checkpoint

• Head of earlier UI checkpoint: 056c7bf0c27f1856bcfe779447f4c7d890912e84 (branch fix/ptp-source-fast-auto-lock-20261022). Base remains original PR#283; no main/stable merge and no PR history deleted.
• True Ethernet discovery: SOURCE RX verifies external Announce frame through native PTP codec, transportSpecific/domain, exactly matching VLAN, no QinQ, non-self clock; class=255 and malformed/empty GM rejected. Candidate needs 3 distinct Announce separated at least 200ms within 3000ms profile freshness; prior to operator opt-in, passive detection is telemetry only.
• Explicit PTP AUTOSWITCH 1|0|SHOW CLI, only allow ON after active verified SOURCE; Studio invokes only via SmartSessionController, readback from firmware, exposes candidate GM identity/port/class, valid count, switch/return/fail counters. No optimistic LOCK/SV claimed.
• Worker SOURCE→RECEIVER and RECEIVER→SOURCE uses the existing PTP control cancellation gate; revokes both SV sync claims before stop, waits for exclusive old EMAC worker cleanup (up to 5s), configures and starts the next physical PTP engine. Receiver must acquire genuine selected GM + measured Pdelay/servo lock before it can report timing usable. 12s receiver initial acquisition failure, 5s after held LOCK loss, 20s re-entry cooldown, 10s bounded SOURCE-restart retry after stranded failure. Human STOP disables auto immediately and cancels a pending START.
• Portable CTest test ariec61850_ptp_external_failover_tests registered in root CMake for real stable 3-Announce, duplicate/reorder, wrong GM/clock class, mutual-exclusion, lock timeout, post-lock loss, recovery, cooldown and disabled policy. No new workflow created.
• Earlier exact-head 9f3067a43e9722aaa5ea36dcbb61682bc1687998 passed PTP Core GCC/Clang/MSVC, C++ CI GCC/Clang/MSVC and ESP32 PTP SOURCE+RECEIVER IDF builds. Current exact 056c7bf0 CI status must be checked again before merge; changes after 9f include bounded rollback retry and metadata UI.
• OUTSTANDING HARDWARE FAT: synchronized SV epoch/smpCnt after each lease switch; genuine selected GM/receiver LOCK at SIPROTEC, Pdelay values, 4I4V waveform, VLAN/domain faults, external GM clock step, hot disconnect/reconnect, ≤5s SOURCE AUTO phase qualification and 1-hour no-loss capture. Do not call physical acceptance complete until these have on-wire evidence.
• Latest integrated admission regression c0f3b4e3c22dff62f011a9cf88af6fbdf42a50c0: shared production ptp_external_candidate_from_frame validates PTP Announce, domain, transport, VLAN/untagged/QinQ, not-self, source port and clock class; portable CTest now exercises the exact predicate used by the ESP32 source RX, not a duplicate test-only network filter. Final exact-HEAD CI and physical tests remain unverified until results.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-22T03:33:57.979039Z	79e2224	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[masarray]

M3.H source reconciliation (2026-10-24): #284 is not an ancestor of the final shipped M3.H source; comparison final a922e9bd... relative to this PR head is 199 ahead / 17 behind. Its external GM AUTO_FAILOVER work and associated hardware acceptance must not be silently considered shipped just because M3.H provides a simulated internal Global GM. Preserve this branch independently; reconcile only genuinely missing, separately tested features in a future review. PR #299 integrates the exact released lab-only SV/PTP source into main without importing divergent timing changes.

[masarray]

M3.H release=main reconciliation — 2026-10-24

Verified product baseline is a922e9bdba4e57a4e88406eb83344455dd8ff142 (ESP32-P4 firmware Build ID a922e9bdba4e57a4); consolidated PR #299 is MERGED to main with 14/14 integration checks passing. The official M3.H Stable tag and tested source are ancestors of main.

This PR has a distinct historical/divergent change scope and is not part of the immutable shipped M3.H baseline. It remains DRAFT / NOT READY for merge; do not merge against an obsolete stacked base or count its tests as final M3.H acceptance. Reconcile only still-needed unique behavior into a fresh branch from current main, with implementation-level comparison, all affected CI tests, and targeted ESP32-P4 FAT where relevant. If superseded, close with an explicit feature-by-feature disposition instead of importing old firmware wholesale.

Canonical closure record: https://github.com/masarray/arstack61850/blob/main/docs/integration/M3H_MAINLINE_RELEASE_SOURCE_CLOSURE_2026-10-24.md .

[masarray]

PR archival decision — M3.H release hygiene (2026-10-24)

CLOSED as SUPERSEDED HISTORICAL IMPLEMENTATION — NOT MERGED and NOT marked as a completed feature.

• Historical PR head (preserved): c0f3b4e3c22dff62f011a9cf88af6fbdf42a50c0.
• Validated/shipped firmware+Studio commit: a922e9bdba4e57a4e88406eb83344455dd8ff142, integrated through merged Integrate tested M3.H Process Bus source into main without release drift #299 into main (14/14 integration CI PASS).
• Disposition: SOURCE-fast acquisition candidate is historical; current M3.H SOURCE already has measured 40.76 s stable on-wire smpSynch=2. PR's distinct AUTO_FAILOVER/external GM behavior is NOT accepted and stays in physical PTP/IED tracker.
• Canonical open acceptance owner(s): M3: unified PTP–SMV context supervisor, continuous PPS↔smpCnt, dual clock authority and bounded recovery #162 and M2: continuously PTP-disciplined SV timeline, truthful smpSynch and IED sync-alarm acceptance #154.

This branch diverges from current main; its unique changes have not passed the validated M3.H release gate. The old source and discussion stay reachable for traceability. Future implementation must be a new, narrowly scoped PR based on current main, with focused CI and hardware evidence where applicable. Closing the obsolete PR removes misleading release-ready queue items while preserving the unresolved feature requirements.

Evidence ledger: M3.H Mainline Source Closure.