M3.A–D FAT repair: simulated Global GM on boot/fallback and lossless warm SV STOP/START by masarray · Pull Request #295 · masarray/arstack61850

masarray · 2026-10-23T22:39:30Z

Physical defect reproduced by user on M3.D (`3a33575`)

Relay sees LOCAL SV while it needs GLOBAL PTP synchronization.
After SV STOP -> START, stream returns NOT SYNC although PTP is expected to remain alive.
A green software CI did not prove relay acceptance.

Root causes found in live firmware

M3.B boot SOURCE defaults to bench_global_gm=false; after honest phase/MAC acquisition, smp_synch_lab.cpp advertises LOCAL (1) instead of simulated Global (2). M3.C fallback explicitly clears the bench seed.
M3.D role/policy change discards even a fresh source UTC seed.
M3.A retains GPTimer/1Hz phase on STOP, but every START clears sparse MAC descriptor evidence. The first expected baseline produces a false loss, and 1Hz qualification is restarted.
Studio Linux Qt smoke had early undefined combo-theme binding warnings.

Corrective software

Kconfig opt-in isolated FAT CONFIG_AR_PTP_BOOT_SIMULATED_GLOBAL_GM=y in paired injector preview: on boot with no GPS/USB, seed the SOURCE test-set PTP/TAI hardware clock from a plausible RTC or explicitly synthetic UTC anchor+monotonic; PTP Announce uses the existing simulated GNSS bench GM profile. This is NOT a physical GNSS time source and MUST NOT be used in an energized/live process bus.
Default SOURCE clock stays on independently of SV injection. M3.C fallback obtains a fresh simulated laboratory GM seed rather than LOCAL. Policy SOURCE->SOURCE retains still-valid seed; SOURCE selected from RECEIVER/MONITOR resamples a fresh seed.
Keep existing measured PTP↔SV phase/MAC gate, never force a smpSynch byte. For an already previously certified SOURCE on an unchanged continuously disciplined sample grid, preserve sync on warm START across the first expected post-reset MAC baseline, bounded by 8 live epochs for new MAC evidence. Any real phase fault, source/lease change, missing frame, descriptor failure, repeat baseline, or timeout immediately revokes. Cold START cannot use this grace.
100× portable warm STOP/START and positive/negative fault-policy regressions. Studio startup combobox uses a tiny temporary token fallback until actual theme binds; no ISR/QML large re-render modifications.
Canonical SV BER, 4I4V channel format, 4k/4.8k timer ISR arithmetic and packet encoder remain unchanged.

Release/FAT gates

Exactly matched Windows Setup+firmware HEAD and all relevant CI must pass. Then only physical ESP32-P4+SIPROTEC capture can show PTP GM accepted, SMV accepted, smpSynch=2 stable across 100 cycles, no PTP restart/generation change and measured channel values. DO NOT merge into M3.D, checkpoint or main, and DO NOT declare hardware FAT success solely from GitHub CI. Source stack: #288 -> #290 -> #291 -> #292 -> #293; this Draft #295 layers on top.

chatgpt-codex-connector · 2026-10-23T22:40:22Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T22:59:03.299901Z	`3f4e9ee`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

…y and fallback

…TART with bounded MAC requalification

… isolated GM bootstrap

…are compiled out

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3f4e9ee893

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-23T22:59:00Z

+                    ar::iec61850::time_sync::SvWarmResumePolicy::retain(
+                        warm_first, observation.last_sv_epoch_generation,
+                        valid_live_phase,
+                        same_sv_ptp_clock_lease(
+                            armed_lease, g_sample_clock_context.armed_ptp_clock),
+                        no_new_publisher_fault, smp_synch_source_local_qualified());


Revoke warm retention when fresh MAC evidence fails its bounds

During a warm SOURCE restart, a coherent descriptor pair can return Evidence::measured while its TX offset is outside SvLocalSyncEvidenceGate's allowed range. observe() then resets the MAC qualification, but the publisher only revokes for results other than measured, and this retention path checks software phase and publisher faults without checking that MAC rejection. Consequently, warm_resume_authorized keeps advertising synchronization until the eight-epoch window expires despite newly measured invalid MAC evidence. Distinguish evidence that is still pending from evidence that has failed, and revoke warm retention immediately for the latter.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-10-23T22:59:01Z

+            g_warm_resume_first_epoch.store(
+                warm_resume
+                    ? g_sample_clock_context.epoch_generation.load(
+                        std::memory_order_acquire) : 0U,
+                std::memory_order_release);


Preserve the reacquisition deadline across repeated warm starts

If an already-qualified SOURCE repeatedly STOPs and STARTs before obtaining a new coherent MAC pair, every START resets both evidence trackers and replaces the warm-resume deadline with the current epoch. The retained qualification makes the next START eligible for warm resume again, so cycles shorter than the two-epoch descriptor cadence can advertise synchronization indefinitely without fresh MAC evidence, bypassing the stated eight-epoch reacquisition bound. Preserve the original outstanding deadline across these restarts, or require successful MAC requalification before granting another warm window.

Useful? React with 👍 / 👎.

… release vs main separation

masarray · 2026-10-24T07:38:26Z

Integrated into main through PR #299 — historical stacked review closed.

Verified on 24 Oct 2026: this PR's exact HEAD a0a2a4350dadacacd73120e83e3fc3b13f42edd8 is now a Git ancestor of main (GitHub compare reports 0 behind). The entire validated M3.H ancestry was reconciled with newer main docs and merged through #299, main merge ad2ebd0e7696dcbc389f1241fedbec5ecf504881, after 14/14 exact-candidate CI workflows passed. Verified shipped firmware/Studio source remains a922e9bdba4e57a4e88406eb83344455dd8ff142; five Stable release assets unchanged.

This PR targeted an intermediate stacked branch, not main. It is therefore closed as ancestry already integrated through #299, not claimed to have been separately merged through its own PR button. Branch/commit history preserved. Real external relay interoperability, UTC/GNSS traceability and 120-second endurance remain separate evidence gaps, not an obstacle to the stable lab simulator release.

masarray added 5 commits October 24, 2026 05:38

fix(ptp): preserve fresh bench GM source epoch on mode change

27e7444

fix(ptp): preserve fresh bench GM source epoch on mode change

c8cddb6

fix(ptp): preserve fresh bench GM source epoch on mode change

cceb4b7

fix(ptp): preserve fresh bench GM source epoch on mode change

25b97c0

test(studio): guard against silent bench GM downgrade on PTP policy

d236499

masarray marked this pull request as ready for review October 23, 2026 22:40

masarray marked this pull request as draft October 23, 2026 22:40

masarray added 3 commits October 24, 2026 05:55

fix(ptp): boot isolated simulated Global GM; preserve it across polic…

fe2d93d

…y and fallback

fix(sv): preserve previously certified SOURCE sync across warm STOP/S…

6093016

…TART with bounded MAC requalification

test(ptp): regress 100 warm resume cycles, phase fault revocation and…

3f4e9ee

… isolated GM bootstrap

masarray marked this pull request as ready for review October 23, 2026 22:57

masarray added 2 commits October 24, 2026 05:57

fix(studio): avoid unbound combo theme QML TypeError on early render

c3a7436

fix(build): keep warm clock phase token valid when descriptor probes …

a0a2a43

…are compiled out

chatgpt-codex-connector Bot reviewed Oct 23, 2026

View reviewed changes

masarray changed the title ~~M3.D P0: preserve fresh internal bench Grandmaster seed across SOURCE policy changes~~ M3.A–D FAT repair: simulated Global GM on boot/fallback and lossless warm SV STOP/START Oct 23, 2026

masarray marked this pull request as draft October 23, 2026 23:08

masarray added a commit that referenced this pull request Oct 24, 2026

docs(m3h): record audited PR #295-#298 dependency chain and immutable…

cf871c3

… release vs main separation

This was referenced Oct 24, 2026

Integrate tested M3.H Process Bus source into main without release drift #299

Merged

P0: restore relay-bench GM global SV sync + bounded STOP/START phase continuity #294

Closed

masarray closed this Oct 24, 2026

Navigation Menu

Repository navigation

M3.A–D FAT repair: simulated Global GM on boot/fallback and lossless warm SV STOP/START - #295

M3.A–D FAT repair: simulated Global GM on boot/fallback and lossless warm SV STOP/START#295
masarray wants to merge 10 commits into
feat/m3d-ptp-advanced-policy-diagnostics-20261024from
fix/m3d-preserve-fresh-bench-gm-seed-20261024

masarray commented Oct 23, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Oct 23, 2026

Uh oh!

chatgpt-codex-connector Bot Oct 23, 2026

Uh oh!

masarray commented Oct 24, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

masarray commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Physical defect reproduced by user on M3.D (3a33575)

Root causes found in live firmware

Corrective software

Release/FAT gates

Uh oh!

chatgpt-codex-connector Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

masarray commented Oct 24, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

masarray commented Oct 23, 2026 •

edited

Loading

Physical defect reproduced by user on M3.D (`3a33575`)

chatgpt-codex-connector Bot commented Oct 23, 2026 •

edited

Loading