P0: restore relay-bench GM global SV sync + bounded STOP/START phase continuity

.github/workflows/esp32p4-smv-injector.yml

@@ -59,7 +59,7 @@ jobs:
     # On draft consolidation, do not run ordinary expensive standalone builds.
     # The Studio Native Preview explicitly requests a paired firmware via
     # workflow_call phase_sync_preview=true; allow only that purposeful build.
-    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft || (inputs.phase_sync_preview == true && (github.event.pull_request.head.ref == 'feat/ptp-source-policy-fsm-20261022' || github.event.pull_request.head.ref == 'fix/autolive-from-pcap-proven-7c95-20261023' || github.event.pull_request.head.ref == 'feat/m3a-persistent-sv-grid-20261023' || github.event.pull_request.head.ref == 'feat/m3b-boot-timebase-supervisor-20261023' || github.event.pull_request.head.ref == 'feat/m3c-safe-external-gm-handover-20261023' || github.event.pull_request.head.ref == 'feat/m3d-ptp-advanced-policy-diagnostics-20261024')) || github.event.pull_request.head.ref == 'feat/m3a-persistent-sv-grid-20261023' || github.event.pull_request.head.ref == 'feat/m3b-boot-timebase-supervisor-20261023' || github.event.pull_request.head.ref == 'feat/m3c-safe-external-gm-handover-20261023' || github.event.pull_request.head.ref == 'feat/m3d-ptp-advanced-policy-diagnostics-20261024' }}
+    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft || (inputs.phase_sync_preview == true && (github.event.pull_request.head.ref == 'feat/ptp-source-policy-fsm-20261022' || github.event.pull_request.head.ref == 'fix/autolive-from-pcap-proven-7c95-20261023' || github.event.pull_request.head.ref == 'feat/m3a-persistent-sv-grid-20261023' || github.event.pull_request.head.ref == 'feat/m3b-boot-timebase-supervisor-20261023' || github.event.pull_request.head.ref == 'feat/m3c-safe-external-gm-handover-20261023' || github.event.pull_request.head.ref == 'feat/m3d-ptp-advanced-policy-diagnostics-20261024' || github.event.pull_request.head.ref == 'fix/m3d-relay-bench-global-ptp-persistent-20261024')) || github.event.pull_request.head.ref == 'feat/m3a-persistent-sv-grid-20261023' || github.event.pull_request.head.ref == 'feat/m3b-boot-timebase-supervisor-20261023' || github.event.pull_request.head.ref == 'feat/m3c-safe-external-gm-handover-20261023' || github.event.pull_request.head.ref == 'feat/m3d-ptp-advanced-policy-diagnostics-20261024' || github.event.pull_request.head.ref == 'fix/m3d-relay-bench-global-ptp-persistent-20261024' }}
     runs-on: ubuntu-latest
     timeout-minutes: 25
     env:
@@ -158,6 +158,7 @@ jobs:
           # M3.B must really be linked into the exact shipped ESP32-P4 binary.
           # A disabled dependency would otherwise silently negate sdkconfig.defaults.
           grep -qx 'CONFIG_AR_PTP_BOOT_SOURCE_AUTOSTART=y' sdkconfig
+          grep -qx 'CONFIG_AR_SMV_RELAY_BENCH_GLOBAL_GUARD=y' sdkconfig
           grep -qx 'CONFIG_AR_PTP_AUTO_PREFER_EXTERNAL=y' sdkconfig
           grep -qx 'CONFIG_AR_PTP_AUTO_LOCAL_FALLBACK=y' sdkconfig
           grep -qx 'CONFIG_AR_SMV_HW_TX_EVIDENCE_EXPERIMENTAL=y' sdkconfig

.github/workflows/ptp-core-ci.yml

@@ -50,7 +50,7 @@ concurrency:
 jobs:
   portable-ptp:
     # Exactly this isolated Draft M3.A runs GCC/Clang phase regression.
-    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft || (github.event.pull_request.head.ref == 'feat/m3a-persistent-sv-grid-20261023' || github.event.pull_request.head.ref == 'feat/m3b-boot-timebase-supervisor-20261023' || github.event.pull_request.head.ref == 'feat/m3c-safe-external-gm-handover-20261023' || github.event.pull_request.head.ref == 'feat/m3d-ptp-advanced-policy-diagnostics-20261024') }}
+    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft || (github.event.pull_request.head.ref == 'feat/m3a-persistent-sv-grid-20261023' || github.event.pull_request.head.ref == 'feat/m3b-boot-timebase-supervisor-20261023' || github.event.pull_request.head.ref == 'feat/m3c-safe-external-gm-handover-20261023' || github.event.pull_request.head.ref == 'feat/m3d-ptp-advanced-policy-diagnostics-20261024' || github.event.pull_request.head.ref == 'fix/m3d-relay-bench-global-ptp-persistent-20261024') }}
     strategy:
       fail-fast: false
       matrix:

apps/arstack_studio/qml/PtpExpertPanel.qml

@@ -79,8 +79,11 @@ SurfacePanel {
     }
 
     function startRole(role) {
+        const commissioningBench = role === "SOURCE" && benchGmCheck.checked &&
+            !panel.device.running && !panel.startPending
         if (!panel.session || !panel.device.ptpAvailable || !panel.device.deviceVerified
-                || panel.device.ptpRunning || panel.startPending || panel.session.updatingFirmware)
+                || (panel.device.ptpRunning && !commissioningBench) ||
+                panel.startPending || panel.session.updatingFirmware)
             return false
         const accepted = panel.session.requestStartPtpConfigured(role, panel.ptpProfile(role))
         if (!accepted && panel.controller)
@@ -431,9 +434,15 @@ SurfacePanel {
                     tone: "accent"
                     text: panel.stopPending ? "Stop pending…"
                         : panel.startPending ? "Starting…"
+                        : modeCombo.currentIndex === 0 && panel.device.ptpRunning &&
+                            benchGmCheck.checked ? "Verify / Commission Bench GM"
                         : modeCombo.currentIndex === 0 ? "Start PTP Source"
                         : modeCombo.currentIndex === 1 ? "Start PTP Receiver" : "Start Monitor"
-                    enabled: panel.session && panel.device.ptpAvailable && !panel.device.ptpRunning && !panel.startPending && !panel.session.updatingFirmware
+                    enabled: panel.session && panel.device.ptpAvailable &&
+                        (!panel.device.ptpRunning ||
+                         (modeCombo.currentIndex === 0 && benchGmCheck.checked &&
+                          !panel.device.running)) &&
+                        !panel.startPending && !panel.session.updatingFirmware
                     onClicked: panel.startSelectedMode()
                 }
                 CalmButton {

apps/arstack_studio/src/DeviceController.cpp

@@ -77,6 +77,9 @@ const QRegularExpression kIdentityExpression{
         "(?:build=([A-Fa-f0-9]{16}) )?"
         "(?:boot_id=([A-Fa-f0-9]{16}) )?capabilities=([A-Z0-9_,.\\-]+)"),
     QRegularExpression::CaseInsensitiveOption};
+const QRegularExpression kPtpBenchReadyExpression{
+    QStringLiteral("PTPGM bench_configured=([01]) bench_ready=([01]) source_active=([01])"),
+    QRegularExpression::CaseInsensitiveOption};
 const QRegularExpression kPtpStatusExpression{
     QStringLiteral("PTP status=(RUNNING|STOPPED) Announce=(\\d+) Sync=(\\d+) FollowUp=(\\d+) PdelayFrames=(\\d+) TXfail=(\\d+)"),
     QRegularExpression::CaseInsensitiveOption};
@@ -1441,6 +1444,8 @@ void DeviceController::resetPtpStartup() noexcept {
     ptpStartStage_ = PtpStartStage::idle;
     pendingPtpRole_.clear();
     pendingPtpConfig_.clear();
+    pendingPtpBenchRequested_ = false;
+    ptpPreflightBenchReady_ = false;
     ptpRuntimeRoleSeen_ = false;
     ptpRuntimeRunningSeen_ = false;
 }
@@ -1451,6 +1456,8 @@ bool DeviceController::beginPtpStopVerification() {
     ptpStartStage_ = PtpStartStage::awaiting_stop_ack;
     pendingPtpRole_.clear();
     pendingPtpConfig_.clear();
+    pendingPtpBenchRequested_ = false;
+    ptpPreflightBenchReady_ = false;
     ptpRuntimeRoleSeen_ = false;
     ptpRuntimeRunningSeen_ = false;
     ptpStatus_ = QStringLiteral("Stopping PTP; waiting for board confirmation...");
@@ -1495,8 +1502,14 @@ void DeviceController::failPtpStartup(const QString& reason, const bool rollback
 bool DeviceController::startPtpConfigured(const QString& requestedRole,
                                            const QVariantMap& profile) {
     const QString role = requestedRole.trimmed().toUpper();
+    const bool benchRequested = profile.value(QStringLiteral("benchGlobalGm")).toBool();
+    // Boot PTP SOURCE is intentionally conservative before a Studio UTC
+    // seed arrives. An *explicit* bench START may commission it once with
+    // a verified stop/reconfigure, never on a routine SV STOP/START.
+    const bool mayCommission = role == QStringLiteral("SOURCE") &&
+        benchRequested && !running_ && scenarioStage_ == ScenarioStage::idle;
     if (!deviceVerified_ || !connected_ || !ioWorkerReady_ || !ptpAvailable_ ||
-        ptpRunning_ || ptpStarting() ||
+        (ptpRunning_ && !mayCommission) || ptpStarting() ||
         (role != QStringLiteral("SOURCE") &&
          role != QStringLiteral("RECEIVER") &&
          role != QStringLiteral("MONITOR"))) {
@@ -1532,6 +1545,8 @@ bool DeviceController::startPtpConfigured(const QString& requestedRole,
     ptpLastStartFailure_.clear();
     pendingPtpRole_ = role;
     pendingPtpConfig_ = command;
+    pendingPtpBenchRequested_ = benchRequested;
+    ptpPreflightBenchReady_ = false;
     // Verify actual firmware runtime before selecting another role. A stale
     // local OFF flag after reconnect must not provoke a rejected PTPROLE or
     // force-stop a transmitter still running on the board.
@@ -1549,6 +1564,15 @@ bool DeviceController::startPtpConfigured(const QString& requestedRole,
 void DeviceController::advancePtpStartup(const QString& line) {
     if (!ptpStarting() || ptpStartStage_ == PtpStartStage::stop_unconfirmed) return;
     if (ptpStartStage_ == PtpStartStage::awaiting_preflight) {
+        const auto benchProof = kPtpBenchReadyExpression.match(line);
+        if (benchProof.hasMatch()) {
+            ptpPreflightBenchReady_ = benchProof.captured(2) == QStringLiteral("1");
+            // This is live SOURCE generation, not merely a saved role. It
+            // arrives before the authoritative PTP RUNNING line in SHOW.
+            if (pendingPtpRole_ == QStringLiteral("SOURCE") &&
+                benchProof.captured(3) == QStringLiteral("1"))
+                ptpRuntimeRoleSeen_ = true;
+        }
         // PTP SHOW provides measured PTP2 role before status. Only adopt an
         // already-active transmitter if THIS preflight saw the expected role;
         // historical UI role cannot authorize mutation or claim an exact role.
@@ -1559,11 +1583,33 @@ void DeviceController::advancePtpStartup(const QString& line) {
         if (!actual.hasMatch()) return;
         if (actual.captured(1).compare(QStringLiteral("RUNNING"), Qt::CaseInsensitive) == 0) {
             if (ptpRuntimeRoleSeen_) {
+                if (pendingPtpBenchRequested_ && !ptpPreflightBenchReady_) {
+                    if (running_ || scenarioStage_ != ScenarioStage::idle) {
+                        failPtpStartup(QStringLiteral(
+                            "Cannot commission bench GM while SV is running. STOP SV first."), false);
+                        return;
+                    }
+                    // The operator specifically requested bench-GM START.
+                    // Replace the early LOCAL SOURCE with a UTC-seeded GM
+                    // ONCE, not on any subsequent SV injection restart.
+                    ptpStartStage_ = PtpStartStage::awaiting_stop_ack;
+                    ptpStatus_ = QStringLiteral(
+                        "Commissioning bench GM: verifying PTP STOP before UTC reseed...");
+                    emit ptpStateChanged();
+                    if (!sendCommand(QStringLiteral("PTP STOP"))) {
+                        markPtpStopUnconfirmed(QStringLiteral(
+                            "Could not queue PTP STOP for bench GM commissioning."));
+                        return;
+                    }
+                    ptpStartTimer_.start(5000);
+                    return;
+                }
                 const QString existingRole = pendingPtpRole_;
                 resetPtpStartup();
-                ptpStatus_ = QStringLiteral("PTP %1 already active on board; external sync unqualified").arg(existingRole);
+                ptpStatus_ = QStringLiteral(
+                    "PTP %1 already active with verified requested timing profile.").arg(existingRole);
                 emit ptpStateChanged();
-                return; // No redundant role/config/start, no surprise STOP.
+                return;
             }
             ptpLastStartFailure_ = QStringLiteral(
                 "Board PTP is already RUNNING. Click Stop PTP, wait for verified STOPPED, then retry Start.");
@@ -1608,10 +1654,33 @@ void DeviceController::advancePtpStartup(const QString& line) {
         // still deferred. It cannot verify the requested STOP.
         if (!readback.hasMatch() || deferredPtpShow_) return;
         if (readback.captured(1).compare(QStringLiteral("STOPPED"), Qt::CaseInsensitive) == 0) {
-            resetPtpStartup();
             ptpRunning_ = false;
-            ptpStatus_ = QStringLiteral("PTP stopped — confirmed by board");
-            emit ptpStateChanged();
+            if (pendingPtpBenchRequested_ && !pendingPtpConfig_.isEmpty() &&
+                pendingPtpRole_ == QStringLiteral("SOURCE")) {
+                // UTC must be sampled after STOP confirmation: never seed
+                // from a host timestamp already stale in the serial queue.
+                const int marker = pendingPtpConfig_.lastIndexOf(QStringLiteral(" 1 "));
+                if (marker < 0) {
+                    failPtpStartup(QStringLiteral("Bench GM UTC seed missing."), false);
+                    return;
+                }
+                pendingPtpConfig_ = pendingPtpConfig_.left(marker) +
+                    QStringLiteral(" 1 %1").arg(QDateTime::currentMSecsSinceEpoch());
+                ptpStartStage_ = PtpStartStage::awaiting_role_ack;
+                ptpStatus_ = QStringLiteral(
+                    "PTP STOPPED; selecting SOURCE with a fresh bench UTC epoch...");
+                emit ptpStateChanged();
+                if (!sendCommand(QStringLiteral("PROFILE PTPROLE SOURCE"))) {
+                    failPtpStartup(QStringLiteral(
+                        "Could not select PTP SOURCE after verified STOP."), false);
+                    return;
+                }
+                ptpStartTimer_.start(5000);
+            } else {
+                resetPtpStartup();
+                ptpStatus_ = QStringLiteral("PTP stopped — confirmed by board");
+                emit ptpStateChanged();
+            }
         } else if (!ptpStopPollTimer_.isActive()) {
             // Firmware stop is asynchronous. Poll on Qt timers without
             // extending the absolute five-second verification deadline.

apps/arstack_studio/src/DeviceController.hpp

@@ -477,6 +477,8 @@ class DeviceController : public QObject {
     QTimer logUpdateTimer_;
     QString pendingPtpRole_;
     QString pendingPtpConfig_;
+    bool pendingPtpBenchRequested_{false};
+    bool ptpPreflightBenchReady_{false};
     bool ptpRuntimeRoleSeen_{false};
     bool ptpRuntimeRunningSeen_{false};
     bool ioWorkerReady_{false};

apps/arstack_studio/tests/check_operator_workspace.py

@@ -725,6 +725,28 @@ def main() -> None:
             and "panel.session.requestPtpAdvancedPolicy(mode)" in expert,
             "M3.D Advanced PTP policy must be firmware-enforced, board-readback and session-owned")
 
+    # Relay bench regression: boot AUTO SOURCE can be LOCAL until the
+    # operator's host UTC epoch is applied. Studio must never silently
+    # adopt that running SOURCE as if it were a seeded GM, nor kill PTP on
+    # an ordinary SV STOP/START.
+    require("PTPGM bench_configured=%u bench_ready=%u source_active=%u" in live_control
+            and "START rejected: BENCH_GM_NOT_READY" in live_control
+            and "CONFIG_AR_SMV_RELAY_BENCH_GLOBAL_GUARD=y" in
+                (project_root / "embedded/esp32p4_smv_injector/sdkconfig.defaults").read_text(encoding="utf-8")
+            and "kPtpBenchReadyExpression" in device_cpp
+            and "pendingPtpBenchRequested_" in device_cpp
+            and "PTP STOPPED; selecting SOURCE with a fresh bench UTC epoch" in device_cpp
+            and "QDateTime::currentMSecsSinceEpoch()" in device_cpp
+            and "Verify / Commission Bench GM" in expert
+            and "panel.device.ptpRunning && !commissioningBench" in expert
+            and "SvWarmSourceResumePolicy::may_preserve" in firmware_source
+            and "warm_source_resume_epoch" in firmware_source
+            and "expected_new_baseline" in firmware_source
+            and "g_sample_clock_context.launch_on_next_epoch.store(" in firmware_source
+            and "bench_global_gm = false;" in ptp_facade,
+            "Boot LOCAL PTP must be explicitly UTC commissioned, and healthy "
+            "STOP/START must preserve verified SOURCE phase without faking a cold MAC lock")
+
     print("Studio operator workspace contract: PASS")
 
 

embedded/esp32p4_smv_injector/main/Kconfig.projbuild

@@ -83,6 +83,18 @@ config AR_SMV_HW_TX_EVIDENCE_EXPERIMENTAL
         unavailable, never substituted with esp_timer time or claimed as
         proof that a relay has synchronized. Defaults OFF.
 
+config AR_SMV_RELAY_BENCH_GLOBAL_GUARD
+    bool "Lab FAT: require seeded internal PTP GM before SOURCE SV injection"
+    default n
+    depends on AR_PTP_LAB_TX && AR_SMV_PTP_PHASE_SERVO_EXPERIMENTAL
+    help
+        In the isolated relay-test profile, refuse SV START while the local
+        PTP SOURCE has not passed the verified Studio UTC-seed/hardware
+        Grandmaster boot. This is safer than publishing LOCAL smpSynch=1 and
+        letting the relay silently reject the data. External PTP RECEIVER
+        remains governed by its independently measured clock discipline.
+        No change to the real PTP/SMV packet encoders.
+
 config AR_PTP_BOOT_SOURCE_AUTOSTART
     bool "LAB ONLY: start local PTP SOURCE and SV dry sample grid on boot"
     default n