[masarray]

M3.B — Boot-timebase orchestration stacked on proven M3.A

Base PR #290 (feat/m3a-persistent-sv-grid-20261023), ultimately checkpoint e820407... / PCAP-verified SV/PTP source 7c95f70c. Do not merge directly into main, public stable, or checkpoint before hardware FAT.

What changes: guarded Kconfig CONFIG_AR_PTP_BOOT_SOURCE_AUTOSTART (default n; explicitly y in isolated injector bench sdkconfig defaults when phase servo is enabled), core0 low-priority boot clock supervisor waits for ETH PHY UP and configured SOURCE only, uses existing verified PTP SOURCE start, bounded exponential retries (four max), no self-promotion for RECEIVER/MONITOR, and never sends SV on its own. Existing 200ms dry-grid preflight from M3.A automatically aligns GPTimer and 1Hz phase observer once boot SOURCE is usable, without USB/Studio or SV START. Keep low-rate phase observer telemetry, never claim GNSS/global evidence from boot readiness.

Ownership: Manual PTP START, PTP STOP, PTP CONFIG atomically disable boot auto-start only until reboot. Explicit PTP START on a running SOURCE is idempotent and must not reseed EMAC. Studio window/USB shutdown requests only SV STOP, not PTP STOP; operator explicit PTP STOP remains available. M3.A unchanged and retained as parent branch.

Quality: constexpr boot role/admission/backoff pure policy with GCC/Clang wrap and negative tests; Studio workspace shutdown regression; scoped Draft ESP32 firmware and native Qt matched-image preview CI; no wire codec, Ethernet payload, 4I4V phase or SV BER changes.

Limitations / gates: SOURCE background autoboot is lab-only opt-in; external GM discovery/selection/BMCA not implemented here (M3.C). GPTimer allocation still goes through existing publisher-idle preflight, but does so autonomously with no GUI START; moving all physical timer control into a dedicated supervisor is future isolation work if hardware shows ownership races. Hardware FAT requires PTP and 4k/4.8k dry grid readiness after boot, 100 STOP/START, host disconnect, no unexpected GM source, and ARSAS+DigSub SV/smpSynch verified. SIPROTEC 5 global source interop is separate. Keep Draft until tested.

[masarray]

M3.B boot timebase supervisor — implementation checkpoint (2026-10-23)

Stacked Draft PR #291 on M3.A #290 (checkpoint ancestry e820407/true on-wire 7c95). Exact code HEAD f3b6fdfc4396925efcc79546bb2fa65629d488c1. No main merge, no public stable.

• Optional config AR_PTP_BOOT_SOURCE_AUTOSTART default OFF in Kconfig, explicitly ON for isolated ESP32-P4 lab's sdkconfig.defaults, dependent on PTP and phase servo. Matched native Studio firmware CI asserts CONFIG_AR_PTP_BOOT_SOURCE_AUTOSTART=y really survived Kconfig.
• CPU0 low-priority boot supervisor waits for Ethernet PHY evidence and configured SOURCE only; uses verified EMAC start; retries at bounded 2/4/8/16-second intervals, max four attempts. Does not invent SV packets; existing M3.A dry sample-grid preflight advances even before operator START. No external AUTO/BMCA here (M3.C).
• Operator PTP START/STOP/CONFIG cancel boot auto-attempts through atomic latch. Existing running SOURCE PTP START is idempotent; not re-seeded. Studio on exit requests SV STOP but NOT PTP STOP; board/USB reconnect independent.
• Recovery allowed only on true PHY-down/up and SOURCE-runtime absence; deny on SV STOP, USB loss, manual takeover, external RECEIVER/MONITOR, or an already-running source. If source actually restarts, generation and phase gate must requalify.
• SV, PTP wire encoder, packet BER, ISR/timer schedule unchanged relative to M3.A. Pure policy unit regression incl monotonic wrap and PHY source handling, Studio shutdown structural regression.
• Current exact-head GCC and Clang PTP CI PASS, CI Routing Policy PASS, paired firmware ESP32-P4 job PASS; native Windows Studio job remains in progress. NO hardware FAT proof yet: boot PTP before USB, 100 STOP/START with uninterrupted PTP source, SV silent while STOPPED, reconnect, DigSub/ARSAS readback and SIPROTEC time acceptance all remain field gates. Do not promote or merge M3.A Draft: park PTP-aligned sample grid across SV STOP/START (no timer rearm) #290/M3.B Draft: boot PTP SOURCE supervisor and silent SV grid without GUI dependency #291 before FAT.

[masarray]

Integrated into main through PR #299 — historical stacked review closed.

Verified on 24 Oct 2026: this PR's exact HEAD f3b6fdfc4396925efcc79546bb2fa65629d488c1 is now a Git ancestor of main (GitHub compare reports 0 behind). The entire validated M3.H ancestry was reconciled with newer main docs and merged through #299, main merge ad2ebd0e7696dcbc389f1241fedbec5ecf504881, after 14/14 exact-candidate CI workflows passed. Verified shipped firmware/Studio source remains a922e9bdba4e57a4e88406eb83344455dd8ff142; five Stable release assets unchanged.

This PR targeted an intermediate stacked branch, not main. It is therefore closed as ancestry already integrated through #299, not claimed to have been separately merged through its own PR button. Branch/commit history preserved. Real external relay interoperability, UTC/GNSS traceability and 120-second endurance remain separate evidence gaps, not an obstacle to the stable lab simulator release.