[masarray]

Physical FAT P0 regression after M3.D artifact 3a33575 (2026-10-24)

The operator reports the delivered paired Studio+ESP32-P4 artifact reverted to SV LOCAL and SV START after STOP requalifies from unsynchronized. No new PCAP/log was uploaded with that complaint; this PR fixes independently confirmed source-level causes and must not claim physical acceptance before a new capture.

Root causes:

• Boot M3.B SOURCE starts before Studio's UTC epoch and is conservatively LOCAL. Studio's explicit Start PTP Source was disabled while it already ran, and startPtpConfigured accepted the pre-existing same-role runtime without checking benchGlobalGm readiness. No seeded simulated PTP bench GM was ever commissioned; smpSynch_lab correctly returned 1 instead of required simulated bench 2.
• M3.D ar_ptp_lab_set_advanced_policy unconditionally erased the SOURCE bench UTC epoch, silently demoting even an operator-configured GM.
• SV START always clears sparse MAC descriptor evidence; the first fresh descriptor is a baseline and firmware revoked the prior qualified source even when M3.A kept precisely the same GPTimer, PTP lease, and phase observer alive.

Fix:

1. Preserve a SOURCE's configured simulated bench epoch across same-role Advanced policy selection; clear it when switching to EXTERNAL_ONLY/MONITOR_ONLY; no stale SOURCE timing if a true GM change.
2. PTP SHOW reports independent PTPGM bench_configured/bench_ready from the board. Studio's explicit SOURCE bench Start button stays available even while boot PTP SOURCE runs, distinguishes same-role from actually seeded GM. When boot LOCAL SOURCE is active and SV stopped, execute a single explicit verified PTP STOP -> STOPPED readback -> PTPROLE SOURCE -> fresh host UTC CONFIG -> PTP START -> RUNNING readback. No automatic STOP/START on routine SV injection. Never adopt LOCAL as bench global.
3. Warm continuity only for previously qualified SOURCE on identical GPTimer, hardware PTP lease, measured 1Hz phase, no publisher fault, and bench global seed still READY; bounded to 7 SV sample epochs pending actual sparse descriptor MAC revalidation. A cold start cannot pass. New descriptor BASELINE is not automatically a clock fault; any real MAC error/lease change/phase failure revokes promptly.
4. Portable negative regression (no cold promotion, fault, lease, stale, wrap) and Studio end-to-end control contract.

Quality bars: maintain existing 4I4V PTP/SV encoder, 4000fps sample timing, AUTO live editor and five-file PCAP reporting. This is a bench simulation; internal SOURCE PTP domain plus SV share a hardware clock, not externally GPS-traceable. No assertion of SIPROTEC 5 LOCKED until relay FAT. Do not merge to checkpoint/main or close issue #162 before 100 STOP/START with no smpSynch loss and real relay acceptance.

[masarray]

2026-10-24 P0 observed regression report + root-cause repair — physical complaint from operator: paired M3.D FAT artifact 3a33575f displayed LOCAL SYNC and STOP/START returned to unqualified SV. No fresh PCAP/serial log was attached to the latest complaint, so this is a source-code-confirmed regression repair, not a physical interoperability PASS.

Exact P0 recovery Draft #294, head c0b025fe2146e3ff54952f3101a1fb37a1f49c78, stacked on Draft #293. Root causes: M3.B boots PTP SOURCE before Studio can seed the simulated bench GM UTC epoch, and Studio's start logic falsely adopted any same-role RUNNING SOURCE as though bench global ready; M3.D same-role policy change discarded bench_global_gm and UTC seed; START cleared MAC verification despite M3.A persistent phase grid. Repairs: board PTPGM configured/ready/actual source proof, explicit user bench-GM commissioning with verified STOP→fresh host-UTC CONFIG→PTP START (SV OFF only), preserve source bench seed on same-role policy, and seven-epoch bounded warm source continuity conditional on previous canonical MAC evidence, same PTP lease, continuous phase and no fault. First new descriptor baseline isn't a clock fault; real error invalidates immediately. Dedicated bench FAT Kconfig guard rejects unseeded LOCAL SOURCE SV START, instead of transmitting relay-rejected packets. Portable GCC+Clang PTP, routing and naming PASS. Matched ESP32/Windows build still running. Do not promote 3a33575, merge to checkpoint/main, or claim SIPROTEC LOCKED. Physical FAT must check smpSynch=2 after bench commissioning, 100 STOP/START without 2→0/1, PTP Announce/Sync/FU continuity, 4I4V readback and relay lock. Note cold power-on without retained/reference UTC still requires one-time Studio bench commissioning; an isolated simulated GM is not externally traceable UTC.

[masarray]

M3.H integration audit (2026-10-24): #294 is a divergent alternative, NOT the source of the released M3.H package. GitHub compare #294 HEAD → final verified a922e9bd... = 54 ahead / 22 behind; therefore do not assert this branch is fully represented or safely merge it into the tested firmware. #295→#298 form the shipped, measured 40.76 s SV/PTP path being integrated via PR #299. Keep #294 Draft for explicit equivalence/source review; it does not gate distribution of the verified lab simulator, and physical relay PTP/SV acceptance remains unverified.

[masarray]

Triage closure (24 Oct 2026) — superseded, NOT merged. This is an alternate M3.D relay-bench patch branch (22 unique commits, NOT an ancestor of shipped M3.H). The selected and PCAP-verified resolution was #295→#298, now integrated into main via #299. Superseded as M3.H implementation route; do not mix untested alternative code into released PTP/SV. Real relay acceptance remains open under #154/#162. Retain branch/history for selective future review.

Verified main merge #299 passed 14/14 workflows; release and firmware assets unchanged. Closing this old competing PR is a review-queue cleanup, not a deletion or certification.