[masarray]

M3.D actual implementation (stacked #292 → #291 → #290 → proven checkpoint #288)

Do not merge into checkpoint/main or publicly release before hardware FAT. This is an isolated software candidate; no SV BER, 4I4V ISR, PTP packet encoder, or live setpoint mutations.

• Typed pure policy PtpAdvancedPolicy with INTERNAL_GM_ONLY, AUTO_PREFER_EXTERNAL, EXTERNAL_ONLY, MONITOR_ONLY. SOURCE is never silently promoted for EXTERNAL_ONLY or MONITOR_ONLY.
• Firmware PTP POLICY <mode> command: rejected during SV TX, active PTP worker, or role cleanup. Uses existing exclusive EMAC role-control transaction, configures effective hardware worker role, resets old bench emulated GNSS/UTC claim, publishes PTPPOLICY mode=... role=... boot_auto=... ext_candidate=... source_generation=... sv_running=... on actual SHOW and after successful apply. Board capabilities include PTP-POLICY-M3D-V1 so older devices fail closed.
• Boot PTP worker follows selected mode, including an external-only receiver and passive MONITOR auto-start; M3.C handover/fallback are only enabled for explicit AUTO policy, not compiled-on defaults. Monotonic policy generation invalidates stale preflight/ready_once flags on stopped transitions; no hidden PTP restart on SV STOP or GUI disconnect.
• Native Studio DeviceController parses firmware status with exact regex; capability and STOP checks protect the PTP POLICY command; SmartSessionController owns the UI mutation. PtpExpertPanel has an Advanced timing-source selector and actual-board readback (role, authority, foreign candidate, generation), disambiguates candidate Announce from measured discipline LOCK. No cosmetic-only success.
• Portable regression tests cover mode matrix, no local GM promotion in external/monitor modes, bounded backoff/stop/lock transition inherited M3.A Draft: park PTP-aligned sample grid across SV STOP/START (no timer rearm) #290-292. GitHub CI exact-head firmware+GCC/Clang/Windows preview gates.

Important limitations: runtime policy currently lives in RAM and reverts to Kconfig lab AUTO at reboot; Advanced UI explicitly states this. SOURCE/RECEIVER change deliberately demands verified STOP with SV not sending. This is not bumpless live GM handover or guaranteed SIPROTEC 5 acceptance. Need real ESP32-P4 100-cycle FAT, two GM/negative network tests and ARSAS+DigSub+SIPROTEC readback. No blind merge #166.

[masarray]

M3.D firmware/GUI software checkpoint — 2026-10-24

Exact HEAD: 3a33575f940f2cef98527b8177358fc01d56014b. Stack Draft #293 → #292 M3.C → #291 M3.B → #290 M3.A → checkpoint PR #288 (e820407). No changes to main, no checkpoint merge, no public release.

Delivered:

1. Four typed PTP policies: INTERNAL_GM_ONLY, AUTO_PREFER_EXTERNAL, EXTERNAL_ONLY, MONITOR_ONLY. Exact firmware policy generation fences the background supervisor; AUTO foreign-GM handover and bench local fallback are only enabled when policy AUTO; EXTERNAL_ONLY never starts local SOURCE. Boot worker can initialize the RECEIVER or MONITOR role when explicitly selected. Policy in board RAM; reboot restores firmware's lab policy.
2. Firmware PTP POLICY <mode> is an exclusive EMAC role-control transaction and refuses if SV TX, PTP SOURCE, RECEIVER or cleanup is running (in addition to CLI gate). Explicit PTP STOP retains precedence. It clears stale BENCH_GM simulated UTC/GNSS claims; no encoder/ISR changes. PTP SHOW emits actual PTPPOLICY mode, role, supervisor, stable external candidate, source generation and SV RUNNING.
3. Studio Advanced policy combo truly sends guarded command through SmartSessionController/DeviceController, requires firmware PTP-POLICY-M3D-V1, parses board readback, distinguishes candidate Announce vs measured external LOCK, displays rejection as error, and refreshes actual firmware state instead of optimistic success.
4. Portable GCC/Clang M3.D policy regression and Studio operator structural invariant assert firmware↔session↔QML control chain. Current exact-head PTP GCC/Clang, CI routing, naming, and ESP32-P4 preview firmware build PASS; Windows native installer job still in progress at note time: https://github.com/masarray/arstack61850/actions/runs/40030518172.

Still requires physical FAT: boot before Studio, SOURCE↔RECEIVER↔MONITOR mode changes, AUTO GM appears/disappears, wrong VLAN/domain/PCP negatives, 100 SV STOP/START with persistent sample grid and no phase reset, 30s/120s/3600s PCAP, ARSAS+DigSubAnalyzer 4I4V readback and SIPROTEC 5 real PTP/SMV acceptance. AUTO handover explicitly deferred while SV TX active; no bumpless live GM transfer claimed. Leave Draft #293 and issue #162 open until physical evidence.

[masarray]

P0 FIELD REGRESSION — BLOCK M3.D PUBLIC RELEASE / NO FALSE FAT CLAIM (2026-10-24)

Operator reports exact paired physical FAT build 3a33575f940f2cef98527b8177358fc01d56014b now shows LOCAL SYNCH instead of the previously successful bench GLOBAL smpSynch=2, and becomes NOT SYNCH after SV STOP→START. Operators need an isolated-lab internal ESP32-P4 Grandmaster with PTP-aligned 4I4V stream that the relay actually accepts. Existing all-green CI is not a physical SV/PTP interoperability pass.

Verified source regression root #1: embedded/esp32p4_smv_injector/main/smp_synch_lab.cpp auto_evidence() returns local_synchronized (1) for a qualified SOURCE unless ar_ptp_lab_bench_global_ready() is true; this requires g_bench_global_active = config.bench_global_gm && ptp_tai_epoch_seeded plus fresh SOURCE evidence (ptp_lab_task.cpp). Kconfig fill_kconfig_defaults() initializes bench_global_gm=false; the M3.D ar_ptp_lab_set_advanced_policy() unconditionally zeros bench_global_gm, bench_utc_epoch_seconds, milliseconds and mono seed on every new policy selection, including INTERNAL_GM_ONLY / AUTO_PREFER_EXTERNAL (ptp_mode_facade.cpp). Therefore boot SOURCE / policy SOURCE can legitimately emit smpSynch=1 even with valid PTP Announce/Sync/FU and phase-qualified SV. This is a source-level causal defect, not yet an independently reproduced packet-level result for the user's newest M3D trial.

Verified source regression root #2: M3.A/B preserves running GPTimer across healthy STOP, but app_main.cpp START unconditionally resets g_local_sync_evidence, g_tx_egress_evidence and zero_epoch_frames_seen. sv_ptp_phase_observer_task requires fresh live canonical MAC evidence; warm acquisition needs three live phase+MAC epochs, cold as many as ten. stop_sample_clock() still revokes qualification when invoked. Thus resumptions are not guaranteed to publish smpSynch=2 immediately even when PTP SOURCE/clock generation is unchanged. Need phase/clock persistent owner, carefully designed warm continuity lease, and fail-closed resets only for actual GM/clock/phase/link faults. No unconditional force smpSynch=2, UI-only override, or fabricated physical relay LOCK.

P0 next thread work: create a separate recovery branch from exact M3.D head (keep #293 Draft, #290–292 and e820407 checkpoint untouched); restore explicit opt-in bench global internal SOURCE mode with coherent PTP Announce timeProperties/TAI seed and same-EMAC SV epoch evidence. Do not quietly erase it on source policy changes or host reconnect. Add readback for bench_global_gm, bench_global_ready, UTC seed validity and reason, selected SOURCE generation, smpSynch mode/decision, phase and MAC proof/age. Prove boot without Studio; STOP SV no PTP/phase resets; START preserves validated continuity and requires actual on-wire proof for the relay. Cover INTERNAL/AUTO/EXTERNAL/MONITOR, manual override, GM/link/lease failures, and 100 STOP→START. CI paired installer/BIN exact same SHA plus real PCAP ARSAS/DigSub and SIPROTEC. Mark all current M3.D artifacts ENGINEERING EXPERIMENTAL / FAT FAIL (operator observation), not stable.

Historical known wire: capture ARStack_SV_20261023_002658_189.pcap firmware buildId 7c95f70cced4d126: 140271 valid SV; smpSynch 0→2 after ~3.0s, remains 2; and 10:42 capture at same baseline firmware 490881 SV/375 PTP with STOP→START and ~5.25s reacquisition. This PCAP does not prove today's M3D trial wire. User has not supplied a new M3D packet trace in this current message. New handoff source files will be attached to the next thread by operator.

[masarray]

P0 bench regression detected by operator after exact M3.D artifact 3a33575f: AUTO SOURCE starts LOCAL before Studio seed and Studio incorrectly adopted same-role RUNNING as if bench GM had qualified; same-role PTP POLICY erased bench seed; warm SV STOP→START reacquired MAC baseline and revoked previously healthy sync. Do not use 3a33575 as relay FAT candidate or merge #293. Superseding isolated fix is Draft #294, stacked above this PR. It adds verified PTPGM status, one-time user-initiated UTC bench GM commissioning while SV OFF, seed retention, seven-epoch same-GPTimer SOURCE warm sync with immediate fault cancellation, and lab FAT guard rejecting LOCAL SOURCE SV START. Portable PTP regression PASS; both ESP32 profiles and matched Windows build are under test. No PCAP from latest failed run was attached; only source-level causes are confirmed. Physical SIPROTEC lock/continuous global SV must still be reverified before merging.

[masarray]

Integrated into main through PR #299 — historical stacked review closed.

Verified on 24 Oct 2026: this PR's exact HEAD 3a33575f940f2cef98527b8177358fc01d56014b is now a Git ancestor of main (GitHub compare reports 0 behind). The entire validated M3.H ancestry was reconciled with newer main docs and merged through #299, main merge ad2ebd0e7696dcbc389f1241fedbec5ecf504881, after 14/14 exact-candidate CI workflows passed. Verified shipped firmware/Studio source remains a922e9bdba4e57a4e88406eb83344455dd8ff142; five Stable release assets unchanged.

This PR targeted an intermediate stacked branch, not main. It is therefore closed as ancestry already integrated through #299, not claimed to have been separately merged through its own PR button. Branch/commit history preserved. Real external relay interoperability, UTC/GNSS traceability and 120-second endurance remain separate evidence gaps, not an obstacle to the stable lab simulator release.