[masarray]

No-regression recovery isolation

User's 2026-10-23 00:26:58 PCAP physically showed 140,271 decodable SV frames, zero missing/malformed, only smpSynch=0→2, originating firmware buildId 7c95f70cced4d126.

Prior AutoLive fat pack 042df0d4 was NOT FAT proven. It contains post-capture changes to START ACK/control health/firmware stop sequence, so presenting it as preserving physical acceptance was a release-baseline selection error. Withdraw that package as a release candidate.

This recovery PR intentionally branches exact commit 7c95f70 and ports only Studio QML Main.qml, WorkflowBar.qml and operator regression checks, preserving bit-identical source files for all embedded SV, PTP and COM control-path code. No main merge, no issue/PR cleanup. Do not merge this PR into a public release until field-proven on a live bench.

QA: verify first 30s that SV is visible in DigSubAnalyzer/ARSAS with no field edits; then run Enter/focus-out auto-apply IA, UA and frequencies without stopping publisher; check on-wire PCAP, START ACK, SVLIFE, selected GM and PTP. Newly compiled recovery firmware has new buildId; exact-source preservation does not itself guarantee physical wire behavior until capture. Full paired Windows/firmware CI is required. Original exact-wire binary 7c95 + original installer independently recovered from run 39874249108.

[masarray]

Release-staging coordination / no-code review · 2026-10-23

This is a repository hygiene and acceptance audit from a parallel cleanup thread. No changes to your code, branch, CI configuration, checkpoints, firmware, or QML. Do not treat it as a request to merge.

• The 35-second, ~140,271-SV-frame / ~7s AUTO field capture identifies firmware buildId 7c95f70cced4d126. The later 042df0d4 EXE+BIN lost ARSAS/DigSubAnalyzer reception and is withdrawn as a release candidate. The cause is not established from current diagnostics. PR integration(RC · DO NOT MERGE): ARStack Studio + ESP32-P4 PTP/SV consolidated #286 now has an explicit top-of-body RELEASE HOLD.
• Exact recovery PR head inspected: 90e2755f1412d7b959b4403653f818a16ea70bb6, base captured 7c95f70c, 5 ahead / 0 behind. Changed paths: Studio Main.qml, WorkflowBar.qml, check_operator_workspace.py; CI-scoped esp32p4-smv-injector.yml, check_ci_trigger_policy.py. Firmware SV/PTP/COM runtime source not changed, but a newly compiled BIN gets a new build identity; physical recheck remains compulsory.
• Feature-preservation read: source of CHECKPOINT MERGE: Auto-Live and 5-file capture on PCAP-proven SV/PTP baseline #288 still has four-bank concurrent snapshot reader pins, separate priority SV/PTP STOP slots, token/hash/boot-generation CFG commit/readback, full 4I4V START snapshot, disabled-row preset migration, and QML automatic live edit without manual Apply Live. Prior closures P0 SMV SSOT reliability: concurrent snapshot safety and fail-closed START #248/P0 Studio: fix live GUI frequency and channel ENABLE delivery; define on-wire acceptance #249/P0 Studio: cancel queued SV START with bounded priority STOP and block bare START #250/P0 SMV: atomic 8-channel firmware scenario commit with token/hash ACK and verified START #251/P1 Studio: checkbox-free 4I+4V tables and accessible 3-phase switch #255 are feature-supersession dispositions, not evidence their diverged git commits were cherry-picked or physically accepted.
• DO NOT bundle/stage/release yet: first run 30 seconds without any GUI edit confirming board RUNNING, DigSubAnalyzer and ARSAS see 4I4V, actual PTP & smpSynch 0→2 and contiguous smpCnt. Record flashed IDENTIFY buildId, STOP cause/SVLIFE, native packet capture. Then edit IA amplitude/phase, UA amplitude/phase, frequency with Enter/Tab/focus-out while publisher RUNNING; verify firmware CFG ACK/readback and new on-wire RMS/angle without STOP, smpCnt reset or PTP rearm. Separate SIPROTEC 5 PTP LOCKED, accepted SV/values and long-soak gates remain.
• The reviewed Native Preview run 39886625064 was in progress at inspection. Its success, if achieved, will be a software build gate only. Stage→main requires exact final HEAD full CI (not skipped workflows), paired installer/BIN, physical FAT, separate P0: make ARStack Studio shutdown deterministic on Windows #99 Windows Lifecycle clean-exit/reopen proof, and explicit human approval. Keep CHECKPOINT MERGE: Auto-Live and 5-file capture on PCAP-proven SV/PTP baseline #288 DRAFT; no main merge.

Related OPEN: #42 physical AUTO-LIVE, #154 PTP–SV IED physical gate, #284 external GM P1 actuator, #99 Windows lifecycle. Independent Workbench/Simulator lanes are not part of this RC.

[masarray]

P0 STAGE→MAIN SOURCE GAP (review requested; no code edits) · 2026-10-23

Exact reviewed recovery HEAD: #288 90e2755f1412d7b959b4403653f818a16ea70bb6. This is a source-level missing authorization gate, not evidence a physical unsafe write has happened. Please preserve existing 7c95 wire source and implement/verify only in your dedicated GUI lane.

Potential regression vs source PR #253's explicit reconnect guard: Main.qml lines ~60–86: scheduleAutoLiveEdit() automatically queues on device.running && device.deviceVerified && workflowBar.injectionRunning, then drainAutoLiveEdits() accepts liveControlReady; onDeviceVerifiedChanged() lines ~257–263 only clears queued edits and marks dirty. WorkflowBar.qml injectionRunning simply aliases device.running. SmartSessionController.cpp::liveControlReady() lines ~175–177 returns true if device_->running(), and requestApplyLiveScenario() lines ~343–348 has no recorded operator START authorization. WorkflowBar has boot-bound startIntentPending only for deferred START, not a retained live-edit authorization latch. Therefore after USB reconnect to an ESP32 board still transmitting SV, a new focus-out GUI edit could trigger automatic whole-eight-channel CFG without a START intentionally approved in this new Studio session. The old #253 explicitly called for disarm until token-bound operator-approved START ACK.

Release-safe requirement: keep all automatic Enter/Tab/focus-out live commits for a normally operator-STARTed verified RUNNING session; however disarm live CFG on lost device verification, port release/reconnect, bootId/sessionGeneration change, firmware reflash, rejected START, unexpected RUNNING telemetry and actual STOP. Arm only on a current-boot, current-session operator START verified by token/hash/generation START ACK/readback; leave drafts dirty but do not emit CFG if the only evidence is unsolicited RUNNING. Ensure explicit STOP remains available. If allowing intentional adoption of an already RUNNING board, use a visible deliberate operator action and bounded readback, never implicit arm.

Negative/positive regression QA: simulate reconnect with observed RUNNING but no operator START; edit IA or UA and assert zero CFG BEGIN/COMMIT. Then intentionally operator START on same verified boot and confirm live edit yields exactly one atomic CFG with ACK/readback, no SV STOP/smpCnt/PTP reset. Simulate changed bootId, stale ACK, USB reconnection during edit. Real PCAP before/after remains obligatory; do not declare hardware acceptance from source checks.

Disposition: keep #253 OPEN until this unique reconnect authorization behavior is reconciled; do not close it merely because generic atomic transactions exist. No changes to #288 source, tests, CI definitions, or branch were made by cleanup.

[masarray]

Release-staging status update 2026-10-23: #288 CI software PASS; physical/reconnect gates OPEN

Exact recovery head 90e2755f1412d7b959b4403653f818a16ea70bb6: ARStack Studio Native Preview run 39886625064 completed SUCCESS; both firmware/build-esp32p4 and windows-preview jobs passed. Product Naming Guard and CI Routing Policy passed on same commit. Windows Lifecycle, standalone ESP32 CI, C++ CI and native Studio Qt full workflows were SKIPPED on the Draft policy — do not call whole CI green.

No physical SV/FAT result for this recompiled #288 image is yet posted. 7c95f70c is the exact earlier captured firmware source/build identity, not proof its new rebuilt image passed ARSAS/DigSubAnalyzer. Previous #286 042df0d4 package still rejected due to missing subscriber SV.

Cleanup source-ancestry: old stacked PR #136 (R1A) closed unmerged because it is exact ancestor of #137; #153 and #157 closed unmerged since both are exact ancestors of cumulative #166. R1B duplicate issue #134 consolidated into OPEN #129; P3-H #139 checked six completed VLAN/code items from merged #140 but hardware gates open. This does not affect your recovery branch.

New potential P0 source gate: unsolicited board RUNNING after reconnect may currently permit auto-live edits without a new operator-START authorization. Precise source and required regressions in this review. Preserve explicit operator START + boot/session-bound ACK permission; auto-live must still work instantly during normally operator-started run. Do not close #253/#42 before reconciling.

Stage→main remains NO-GO pending physical clean 30s no-edit 4kfps dual-analyzer proof, on-wire IA/UA/frequency live changes without resets/gaps, SIPROTEC PTP LOCKED/4I4V, exact release CI/lifecycle, and explicit human authorization. No changes to firmware/QML, checkpoints, branches or main by cleanup.

[masarray]

2026-10-23 10:42 UTC physical capture audit + UX regression fix

Operator tested original paired firmware buildId 7c95f70, original recovery Studio (still shows manual Apply Live). Independent full 75,627,448-byte PCAP ARStack_SV_20261023_104209_207.pcap parsed independently, regardless of defective INVALID_CAPTURE JSON.

Wire: 490,881 IEC SV L2 frames (valid BER, 4I+4V /64 bytes, APPID 0x4000, smpCnt modulo 4000, svID ARSTACK_SV01, VLAN VID0 PCP4) and 375 PTP frames = 125 contiguous Announce seq 31..155 + 125 Sync + 125 matching Follow_Up, ~1s spacing. One real on-wire SV gap 2.359893 sec at ~10:42:37.734–10:42:40.094 UTC; restart smpCnt 2561→0. Among 490,880 SV neighbor deltas, 490,879 consecutive +1 modulo4000, one restart. Before/after the gap, rates ~3999.88fps measured on PC clock, zero smpCnt drops within sessions. smpSynch 0→2 at +0.985s, 2→0 at +30.736s on STOP, and 0→2 at +35.986s (reacquire after restart ~5.25s), then remains 2 through end. 465,945 smpSynch2 and 24,936 smpSynch0. PTP/SV sample-epoch comparison ~0.15 sample phase within ~123 matched cycles, but NOT HW-timestamp-calibrated UTC accuracy.

PTP GM qualification blocker: Announce advertises clockClass 6, timeSource 0x20(GPS), clockAccuracy 0x23, 0x003c time/frequencyTraceable, PTP-timescale, UTC offset 37, while the board serial diag says SOURCE, upstream source NONE and discipline UNLOCKED. Do not claim actual UTC traceability based on simulated GM advertisements; physical SIPROTEC 5 lock not established; zero PdelayReq/Resp traffic in current trace.

Actual UI defect: screenshot shows UA draft 20V + pending manual Apply Live, but on-wire UA RMS ~1000 counts = 10V with scale 100 counts/V. This is an operator-visible failure to apply the edit automatically in original rollback GUI (7c); the build predates AutoLive. Recovery #288 contains QML AutoLive change with no Apply Live button, only GUI code on exact PCAP-proven board baseline.

Captured evidence preservation bug fixed in this PR: aborted/STOP capture wrote only PCAP+JSON and falsely set sv_frames:0 while PCAP has 490881. New partial decode path produces all FIVE forensic files and writes INVALID_CAPTURE, error, capture_interrupted=true, partial_wire_evidence=true, real frame counts, and a regression harness for this scenario. CPP header/implementation and harness now changed, but NO embedded PTP/SV code changed. Current SHA 8a2428503ee8a1595b03901ac8c1ca2b8343c728 is undergoing exact-head CI. Keep Draft; require matched Windows installer and on-wire UA 10→20 without restart and real relay PTPlock before release.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-23T11:19:20.776306Z	8a24285	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.