[masarray]

Field capture audit (2026-10-24)

Captured PCAP: 21,824 correctly ordered SV packets all smpSynch=2 (0 malformed, 0 duplicates, no missing smpCnt inside each live publishing segment) and 24 L2 PTP packets (8 Announce, 8 Sync, 8 Follow_Up) with one unchanged GM clock identity, domain 0 and sequence IDs 67–74. Active SV ~4000 fps, 2.783s STOP→START gap but first resumed SV frame still smpSynch=2. The 8.238s PCAP is INVALID_CAPTURE/partial, not a 120s acceptance test. PTP advertises simulated class 6 / GPS timeSource metadata and Jan 1 2026 synthetic epoch; neither external UTC-traceable Global GM nor sub-µs physical accuracy can be established from PC host timestamps. Freeze M3.E firmware/clock as a working isolated lab simulation baseline, not certified global clock conformance.

Independent Studio-only fix

Root cause: DeviceIoWorker's 750-ms OS port inventory emitted a list change, but did not retire a QSerialPort handle which Windows USB drivers can leave isOpen() after a physical unplug. The supervisor sees the phantom connected=true, blocking rediscovery until Studio restart.

• Reuse existing 750-ms OS enumeration with two consecutive missing scans and verified identity gates. Retire only the stale COM handle via existing transport-failure cleanup path; no new thread/timer/polling, no PTP STOP, SV STOP, reflash, or device reboot.
• On NEW port enumeration only, queue an automatic semantic IDENTIFY through SmartSessionController once its firmware-ownership, generation, and discovery gates allow it. COM-number changes are handled; prior verified COM remains just a priority hint.
• New deterministic tests for absent-once vs absent-twice, COM renumber/arrival, manual disconnect/no new arrival; structural no-PTP-touch guard. Existing wrong-device protection, loss/failure handling, session generation, and no auto-START remain unchanged.

Acceptance

Native Windows and CI tests must pass; physical plug/unplug/replug test required (especially quick reconnect and same COM). Do NOT merge/rebase/fiddle the stable M3.E PTP/SV firmware or main. Keep draft until device FAT passes.

M3.G Hotplug latency field follow-up (2026-10-24)

Operator evidence: after USB OTG unplug/replug, Studio sometimes remains 'ESP32-P4 not verified' before later showing Device ready/COM15. The GUI had two competing USB disconnect owners, and pending rediscovery depended on 2.5s periodic discovery or bounded health timeout. This was independently reproduced in source paths.

• Eliminate StudioDeviceController's immediate portsChanged disconnect which defeated the DeviceIoWorker's two consecutive 750ms snapshot hysteresis. There is now exactly one low-rate USB absence authority.
• On actual verified serial loss, DeviceIoWorker retires the stale QSerialPort and emits unexpectedPortLoss(generation, port) after handle close; intentional manual DISCONNECT never emits it.
• If Windows retains the same COM number through a rapid plug cycle, the existing bounded bidirectional health monitor retires a proven dead COM through recoverUnresponsivePort; the old code treated this as a manual disconnect and waited for the 2.5s discovery timer.
• DeviceController relays a generation-stamped unexpectedTransportLoss; SmartSessionController immediately re-enters semantic discovery once generation, firmware ownership, session, and port visibility gates pass. New port arrival uses the existing 750ms enumerator; no additional serial polling, thread, QML busy loop or board restart.
• Static regression locks one loss owner, post-close signal, no SV/PTP STOP, and prompt ownership-safe rediscovery. Existing 100-cycle phase SV/PTP baseline not modified.

CI and artifact

HEAD a8ca25293311575d170d1f9ef1cd3aa388a8c002, 4/4 named workflows PASS (Studio Qt, Windows Lifecycle, Native Preview, Naming). Inno clean install/running upgrade/uninstall and NSIS→Inno acceptance all PASS. Firmware build is a packaging requirement but no embedded/ESP32/PTP/SV source was changed; existing compatible M3.E firmware need not be flashed. Source/firmware build IDs differ by packaging SHA only. Physical rapid/same-COM/renumbered-COM unplug–replug timing remains unmeasured in CI. Keep Draft for user board FAT.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T02:27:05.309630Z	a8ca252	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a9cc5321e8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Exclude comments from the STOP-command structural check

Running python3 apps/arstack_studio/tests/check_operator_workspace.py fails on this assertion because refreshPortsInternal() contains the comment NEVER issue SV/PTP STOP, which includes the forbidden substring PTP STOP despite issuing no such command. This breaks the existing “Studio operator workspace layout and PTP authority contract” step in .github/workflows/arstack-studio-qt.yml on every run. Strip comments or check actual command expressions so the guard accepts the implementation while still detecting prohibited writes.

Useful? React with 👍 / 👎.

[masarray]

Integrated into main through PR #299 — historical stacked review closed.

Verified on 24 Oct 2026: this PR's exact HEAD a8ca25293311575d170d1f9ef1cd3aa388a8c002 is now a Git ancestor of main (GitHub compare reports 0 behind). The entire validated M3.H ancestry was reconciled with newer main docs and merged through #299, main merge ad2ebd0e7696dcbc389f1241fedbec5ecf504881, after 14/14 exact-candidate CI workflows passed. Verified shipped firmware/Studio source remains a922e9bdba4e57a4e88406eb83344455dd8ff142; five Stable release assets unchanged.

This PR targeted an intermediate stacked branch, not main. It is therefore closed as ancestry already integrated through #299, not claimed to have been separately merged through its own PR button. Branch/commit history preserved. Real external relay interoperability, UTC/GNSS traceability and 120-second endurance remain separate evidence gaps, not an obstacle to the stable lab simulator release.

[masarray]

Integrated into main through PR #299 — stacked review closed. Exact PR HEAD a8ca25293311575d170d1f9ef1cd3aa388a8c002 is now an ancestor of main (GitHub compare: 0 behind). Main commit ad2ebd0e7696dcbc389f1241fedbec5ecf504881 was merged after 14/14 CI success on c90a979.... M3.H tested source a922e9bd... and release tag a4b6e53d... are both contained in main, without modifying published firmware/binary. This PR had an intermediate base branch, so it is closed as already integrated via #299, not claimed as separately merged through this PR. Preserve historical commits and branch; full 120-second endurance/physical IED relay acceptance still not claimed.