[masarray]

M3.A phase-grid lifetime separation — no main/release merge

Baseline: physically PCAP-proven source 7c95f70c, checkpoint merger e82040716c549af887579b369965ba96a890a4db from PR #288, with Studio AutoLive and 5-file forensic capture untouched.

Root cause: stop_sample_clock() deletes GPTimer and explicitly revokes SV phase on session STOP; previous preflight only covered the idle-before-start path, but an active clock could not be parked. PTP SOURCE itself continues.

Changes (firmware only plus portable regression):

• SvAutoPreflightPolicy::can_park_running_grid() — pure, constexpr, fail-closed reuse contract (timer+epoch+phase, unchanged source lease/profile/rate and healthy AUTO).
• When STOP/heartbeat expiry suppresses SV, keep existing 4/4.8k GPTimer + 1 Hz phase observer and source generation; atomically disable only 4kHz publisher ISR notifications; turn clock into dry preflight without reallocating or recreating timer; no packets while STOPPED. On next verified START reuse existing PTP-aligned grid and wake publisher on next smpCnt=0 epoch. Flush queued pre-STOP task notifications. Genuine GM/lease/rate/link fault still tears down and requalifies.
• Preserve previously measured SV source-quality context in dry mode only when phase measurement remains valid, instead of unconditional publisher_stop revocation; cold preflight cannot claim SV MAC quality. Canonical SV encoder, PTP frame builder, Windows AutoLive, and Capture code untouched.
• Portable test evaluates 100 cycles at 4k and 4.8k, and six failure modes requiring fail-closed teardown.

Known remaining integration limits / gates: exact-source ESP32 CI must pass; PCAP proving no extra wire frames after STOP, no uncommanded START, PTP source generation remains fixed, no phase reset across 100 STOP/START, and real ARSAS/DigSub decoding. The current MAC-egress proof gate still conditions smpSynch on live descriptor evidence after resume, so never claim no smpSynch dip until physical FAT. Fully always-on clock from boot, external AUTO/BMCA and Advanced UI are M3.B/C/D — out of scope here.

Do NOT auto-merge checkpoint or main. Coordinate M3 issue #162 / design PR #289 / unrelated Draft #166 without cherry-picking untested code.

[masarray]

2026-10-23 M3.A CODE STATUS — isolated from checkpoint e820407 (SV/packet codec and Studio unchanged).

Draft PR #290 head 71c134d. The implementation parks the running SOURCE/RECEIVER AUTO GPTimer and 1Hz phase observer while SV TX is OFF: disable 4kHz task notifications, keep PTP source lease/epoch generation and ISR grid, reuse at the next canonical smpCnt=0 boundary on START. Fail closed and rearm only on changed clock source/GM lease, incompatible profile/rate/mode, physical link loss or phase fault. Also handles rapid STOP→START overtaking the 200ms idle park by recognizing and silencing a still-owned timer before epoch launch; flush stale task notification count.

Code: embedded/esp32p4_smv_injector/main/app_main.cpp; pure policy in include/ariec61850/time_sync/sv_ptp_phase_authority.hpp; portable 100-cycle/4k+4.8k/hot-start/fault regression in tests/test_sv_ptp_phase_authority.cpp. Scoped Draft CI exception ONLY branch M3A: ESP32 build + GCC/Clang PTP + paired Windows installer, routing policy guards cross-branch bypass. No main or checkpoint merge; no public release. One prior exact-head portable run PASS and firmware SUCCESS; final exact-head GCC/Clang PASS, policy PASS; final-source dual ESP32 + Windows run remains under way (https://github.com/masarray/arstack61850/actions/runs/39950300989).

Important scope limit: this fixes CLOCK/GRID lifecycle, not external-auto BMCA (M3.C), power-on auto-start PTP policy (M3.B) or MAC descriptor reacquisition after resumed SV. The next source-fast MAC proof can still affect wire smpSynch in early live epochs; do NOT claim zero 2→0→2 until real STOP/START PCAP on physical ESP32 with source generation and SVSYNC log. Acceptance gate: 100 rapid + normal STOP/START; PTP Announce/Sync/FU continue, no SV during STOP, return at same timeline/selected GM, stable ARSAS/DigSub, no TX slot errors. Preserve previous FAT baseline checkpoint and external-IED lock requirement.

[masarray]

Integrated into main through PR #299 — historical stacked review closed.

Verified on 24 Oct 2026: this PR's exact HEAD 71c134db169c0a14b8ed112f5d06215c9aa86fb9 is now a Git ancestor of main (GitHub compare reports 0 behind). The entire validated M3.H ancestry was reconciled with newer main docs and merged through #299, main merge ad2ebd0e7696dcbc389f1241fedbec5ecf504881, after 14/14 exact-candidate CI workflows passed. Verified shipped firmware/Studio source remains a922e9bdba4e57a4e88406eb83344455dd8ff142; five Stable release assets unchanged.

This PR targeted an intermediate stacked branch, not main. It is therefore closed as ancestry already integrated through #299, not claimed to have been separately merged through its own PR button. Branch/commit history preserved. Real external relay interoperability, UTC/GNSS traceability and 120-second endurance remain separate evidence gaps, not an obstacle to the stable lab simulator release.