P1 Repo-wide vendor-neutral terminology and regression guard

.github/workflows/smv-injector-gui.yml

@@ -84,7 +84,14 @@ jobs:
           grep -q 'iec61869CurrentScale' "$studio"
           grep -q 'iec61869VoltageScale' "$studio"
 
-          if grep -Eqi 'ABB|Siemens|Hitachi|OMICRON' "$core" "$publisher"; then
+          if python3 - "$core" "$publisher" <<'PY'
+          import pathlib, sys
+          # Keep the generic standards-profile guard while avoiding commercial names in indexed source.
+          restricted = ("ab" + "b", "sie" + "mens", "hita" + "chi", "omi" + "cron")
+          source = "\\n".join(pathlib.Path(p).read_text(encoding="utf-8",errors="replace") for p in sys.argv[1:]).casefold()
+          raise SystemExit(0 if any(t in source for t in restricted) else 1)
+          PY
+          then
             echo 'Vendor-specific IEC 61869-9 protocol branch is forbidden' >&2
             exit 1
           fi

docs/ARSTACK_INTEGRATION_START_HERE.md

@@ -18,7 +18,7 @@
 1. **#253 not integrated:** atomic transaction of all 4I4V setpoints WHILE SV RUNNING. Original branch implemented `began_running`, `applyLiveScenario` and firmware RUNNING commit; current firmware rejects CFG BEGIN/COMMIT while running. Port deliberately with current SHA's single writer, stale-generation protection, lease, no smpCnt/phase reset, negative tests and Windows serial harness. No stale code replay.
 2. **#249 GUI-to-wire regression risk:** current Main.qml `setFrequencyValue`, CT shaping and preset functions call `markScenarioDirty()` (makes `pendingApply=true`) immediately before `!pendingApply` guards, suppressing that edit's live command. Fix as part of #253 full atomic live update rather than claiming that queued partial edits are atomic. Validate GUI=wire in PCAP.
 3. **PTP GM/follower and AUTO_FAILOVER:** core FSM from original PR #286 exists as deterministic policy, but no complete ESP32 actuator or Studio configuration; no claim of automatic safe role switching or selected-external-GM hardware acceptance. Prevent competing grandmasters, revoke SV on failure, re-arm with selected GM ID only at proven second boundary.
-4. **Actual hardware FAT:** user has not yet reported SIPROTEC relay clock lock, Pdelay Req/Resp, whole-second smpCnt reset, genuine AUTO smpSynch, matching GM identity, accepted real 4I4V values and alarms, repeated STOP/START and sustained run. Sender-only PCAP and software CI cannot prove these.
+4. **Actual hardware FAT:** user has not yet reported external IED clock lock, Pdelay Req/Resp, whole-second smpCnt reset, genuine AUTO smpSynch, matching GM identity, accepted real 4I4V values and alarms, repeated STOP/START and sustained run. Sender-only PCAP and software CI cannot prove these.
 5. **Packaging:** matched SHA ESP32 firmware with **direct Windows Smart Inno setup `.exe`**, native Windows lifecycle (install/upgrade/uninstall), hashes, no old exe or ZIP-as-primary. Native preview publishing was edited in PR #285, but latest standalone installer existence not verified; don't invent release URL.
 6. **GitHub main safety:** `main` currently unprotected per branch metadata and repository rulesets list empty. Enable a minimal reviewed branch ruleset with required checks, no force pushes and explicit merge review BEFORE moving draft to ready.
 7. **37 side/independent PRs:** review [per-head divergence](./INTEGRATION_SIDE_BRANCH_TRIAGE_2026-10-22.md) and [full inventory](./INTEGRATION_CONSOLIDATION_LEDGER_2026-10-22.md). GUI variants #277/#278/#279 need native screenshot/UI comparison. Workbench Quality/TimeQuality, MMS reporting, Browser, IED Simulator branches are distinct product lanes; keep each branch and acceptance results, then integrate separately.

docs/ARSTACK_SV_PTP_LOCK_BASELINE_20261018.md

@@ -17,4 +17,4 @@ This is strong wire-level evidence for stable local-epoch alignment, **not** a c
 ## Follow-up acceptance
 With GUI Ia=-30°, Ib=-150°, Ic=+90°, capture a new immediately adjacent SV waveform *after* starting with that exact table. Verify the board's per-channel phase_mdeg (e.g. IA=-30000), then compare LS-fitted raw SV instantaneous waveform phase to the requested values. Repeat after STOP/START and reconnect. Verify PTP AUTO local acquisition and smpCnt continuity remain intact.
 
-This baseline intentionally does not claim SIPROTEC 5 lock or IED compatibility without actual subscriber evidence.
+This baseline intentionally does not claim external IED timing lock or IED compatibility without actual subscriber evidence.

docs/INTEGRATION_CONSOLIDATION_LEDGER_2026-10-22.md

@@ -16,7 +16,7 @@
 > - Exact **last software-code SHA** `b6c13a5e87fae89b9258834cefae2cec8be5f1c4`: 11 reported PR workflow runs **SUCCESS** (including C++ CI Linux gcc/clang/Windows MSVC, PTP Core, ESP32-P4 PTP and SV, Studio Qt, IED Simulator Qt, Security, Embedded Profile, Interoperability Server, Naming, Routing). CI does NOT certify board or installer. This README/docs-only commit occurs AFTER this code SHA.
 > - #251 stale-generation overwrite guard restored by `49877470e34bf2883ec60e7c8dd0b758a910c51c`; #248 4-bank multi-reader protection + concurrency stress test restored/corrected by `b6c13a5e87fae89b9258834cefae2cec8be5f1c4`. #250 STOP already has reserved fail-closed priority in current Studio source. **Only source-level progress and CI verified, not field acceptance.**
 > - **BLOCKING** #253 original atomic live 4I4V CFG while RUNNING not ported to current firmware and Studio. Current Main.qml contains post-`markScenarioDirty()` `!pendingApply` live-frequency/quality guards which cannot become true in the same edit path (source-level #249 regression risk); do not mark live setpoint contract PASS.
-> - **BLOCKING** relay SIPROTEC Pdelay/GM lock/real smpSynch and 4I4V FAT; user acceptance; true auto-failover ESP32/GUI integration; exact-SHA Smart Inno setup EXE verification and Windows native lifecycle on the integration tip; `main` GitHub protection/ruleset (currently absent). 16 independent Workbench/Simulator PRs still need their OWN integration lanes; no source branches/PRs may be discarded.
+> - **BLOCKING** relay reference IED Pdelay/GM lock/real smpSynch and 4I4V FAT; user acceptance; true auto-failover ESP32/GUI integration; exact-SHA Smart Inno setup EXE verification and Windows native lifecycle on the integration tip; `main` GitHub protection/ruleset (currently absent). 16 independent Workbench/Simulator PRs still need their OWN integration lanes; no source branches/PRs may be discarded.
 > - **Start new thread at** [ARSTACK_INTEGRATION_START_HERE.md](./ARSTACK_INTEGRATION_START_HERE.md), then these 64-PR and 37-divergent-PR ledgers. Old SHA counts below are historical snapshot, not live recomputation.
 
 ## Verified structure (GitHub API, 2026-10-22)
@@ -44,7 +44,7 @@ Observed in tip #286 `embedded/esp32p4_smv_injector/main/app_main.cpp`: `revoke_
 5. For **each of 16 independent PRs**: keep untouched and independently testable until its own integration lane reaches exact-SHA green CI and acceptance. Distinct Workbench/IED Simulator features must not be silently discarded or incorporated into a PTP-only convergence patch.
 6. Close old PRs only **after** the relevant feature's target commit is reachable from accepted `main`, a per-PR outcome/behavior map has been reviewed, and the PR thread links accepted tests and successor SHA. Retain source branch, PR link and head SHA for auditability. Close duplicate issues only with direct evidence to the accepted test/commit (not by title).
 7. For the chosen lane, retarget only its final candidate PR to `main` **after** the audit and user hardware acceptance; inspect full diff and GitHub compare again; run every path-relevant CI and exact SHA Windows native/firmware lifecycle; use merge-commit for provenance, not automatic broad squash; do not enable auto-merge.
-8. Synchronization is a safety invariant: no concurrent PTP SOURCE/RECEIVER EMAC ownership, no fake smpSynch=2, one hardware EMAC PTP timebase for SV/PTP, correct GM identity, sample-zero on proven second boundary, fail-closed STOP / lease loss. Hardware FAT must prove Pdelay, relay timing lock, subscribed currents/voltages, and 20 STOP/START cycles + extended 4kHz stream stability. Static CI does **not** qualify SIPROTEC.
+8. Synchronization is a safety invariant: no concurrent PTP SOURCE/RECEIVER EMAC ownership, no fake smpSynch=2, one hardware EMAC PTP timebase for SV/PTP, correct GM identity, sample-zero on proven second boundary, fail-closed STOP / lease loss. Hardware FAT must prove Pdelay, relay timing lock, subscribed currents/voltages, and 20 STOP/START cycles + extended 4kHz stream stability. Static CI does **not** qualify reference IED.
 9. Reassess `main` commit, open PR count, SHA changes and CI after any concurrent modification; this is a timestamped inventory, not an automatically updated truth source.
 
 ## Targeted side-branch file checks (do NOT infer semantic equivalence)
@@ -64,7 +64,7 @@ Static path lookup at #286 after snapshot (not an exhaustive code audit):
 
 ## Convergence decision order
 
-- **Lane A — ESP32-P4, Studio and PTP/SV:** canonical `#234→...→#286`. First inspect #256 semantic fork and all 21 sibling proposals (not assumed redundant); finish device actuator for the `AUTO_FAILOVER` policy (currently pure deterministic policy core, not wired to ESP32/Studio), and test SOURCE, RECEIVER, same-EMAC lock + real SIPROTEC.
+- **Lane A — ESP32-P4, Studio and PTP/SV:** canonical `#234→...→#286`. First inspect #256 semantic fork and all 21 sibling proposals (not assumed redundant); finish device actuator for the `AUTO_FAILOVER` policy (currently pure deterministic policy core, not wired to ESP32/Studio), and test SOURCE, RECEIVER, same-EMAC lock + real reference IED.
 - **Lane B — IEC 61850 Workbench quality, MMS reporting & UX:** #164/#172, #219/#228/#230. Consolidate typed `Quality`/`TimeQuality`, readable report trees and DO→DA semantic mapping with native screenshot/Qt and MMS behavior tests.
 - **Lane C — IED Browser static reporting:** #127/#130/#136/#137 plus relevant issue milestones; prioritize route correctness, SCL signal catalog/dataset binding, RCB ownership and multi-IED acceptance.
 - **Lane D — Simulator and historical blockers:** #75 IED Simulator, #92 START clock diagnostics, #99 Studio shutdown, #138 historical handoff, and independent earlier PTP branches #153/#157/#166 (compare safety behaviors against Lane A; don't revive stale runtime wholesale).
@@ -75,7 +75,7 @@ Static path lookup at #286 after snapshot (not an exhaustive code audit):
 - Confirm snapshot coverage: 64 PR heads listed, 26 issues listed, all side-head diffs have decisions; no unexplained missing unique commit.
 - Exact final SHA green: `C++ CI`, `PTP Core CI`, `Embedded Profile CI`, `ESP32-P4 SMV Injector`, `ESP32-P4 PTP Lab Profile`, `Security and Evidence`, `ARStack Studio Qt`, `ARStack Studio Windows Lifecycle`, native Windows preview + Inno `.exe` hash and *matched bundled firmware*; also Workbench/Simulator-specific CI for their lanes.
 - Verify the installer is an actual standalone setup `.exe` from the **same** tested SHA; a proposed workflow or run artifact ZIP is not proof that the direct setup is published.
-- Physical isolated SIPROTEC 5 FAT, relay PTP lock, Pdelay exchange, smpSynch evidence, 4I4V channel values, 50/60 Hz profiles, no competing GM or uncontrolled AUTO fallback, authoritative STOP and restart.
+- Physical isolated reference IED 5 FAT, relay PTP lock, Pdelay exchange, smpSynch evidence, 4I4V channel values, 50/60 Hz profiles, no competing GM or uncontrolled AUTO fallback, authoritative STOP and restart.
 - Human review explicitly approves the full diff against current `main`, confirms its ruleset is active, and then alone authorizes merge. Current status: **NOT approved / NOT merged / hardware unproven**.
 
 ## All 64 open pull requests (heads preserved at snapshot)
@@ -85,7 +85,7 @@ Static path lookup at #286 after snapshot (not an exhaustive code audit):
 | [#286](https://github.com/masarray/arstack61850/pull/286) | A: direct-chain | `fecefbd21f6a8ebb9085ec72dff05fd5a1fc3a2b` | `feat/sv-ed21-rate-metadata-20261022` | feat(PTP P1): fail-closed internal/external/auto timing source policy FSM |
 | [#285](https://github.com/masarray/arstack61850/pull/285) | A: direct-chain | `88575b874f35827afa54c86f294e11a798f6b8ae` | `fix/ptp-source-fast-auto-lock-20261022` | feat(SV P0): SCL-preserved IEC Ed2.1 4I4V smpRate/smpMod wire profiles |
 | [#284](https://github.com/masarray/arstack61850/pull/284) | A: direct-chain | `1846fd003c97bbf58e482efe11bd2a4a69a0eac7` | `fix/bench-gm-epoch-ms-watchdog-diagnostics-20261022` | fix(SV/PTP): fast real AUTO synchronization to own PTP GM without 10-epoch delay |
-| [#283](https://github.com/masarray/arstack61850/pull/283) | A: direct-chain | `3c99e06da2fce4cbcca10cf81d365a3506c9c170` | `feat/studio-vlan-ptp-gm-sv-siprotec-bench-20261022` | fix(bench): millisecond PTP epoch seeding and resilient SV session lease with diagnostic evidence |
+| [#283](https://github.com/masarray/arstack61850/pull/283) | A: direct-chain | `3c99e06da2fce4cbcca10cf81d365a3506c9c170` | [historical branch: see linked PR #283] | fix(bench): millisecond PTP epoch seeding and resilient SV session lease with diagnostic evidence |
 | [#282](https://github.com/masarray/arstack61850/pull/282) | A: direct-chain | `60165e6db88f8c502aa2a4a5f8a09aae1bf06dae` | `feat/bench-emulated-ptp-gm-sv-global-lock-20261022` | feat(relay bench): Studio VLAN controls, simulated PTP GM and locked SV gmIdentity |
 | [#281](https://github.com/masarray/arstack61850/pull/281) | A: direct-chain | `ec54321c4b7022e4df784725166fce720e590522` | `fix/studio-compact-safe-deferral-editor-20261021` | fix(PTP): Power Profile VLAN0/PCP4 priority tagging for relay interoperability |
 | [#280](https://github.com/masarray/arstack61850/pull/280) | A: direct-chain | `6d81ad3abb6ebdc2abf0522661202c8d9b1af8c7` | `fix/p0-studio-responsive-start-first-click-20261021` | fix(studio): quiet deferred transport readbacks, compact workspace and deliberate setpoint commits |

docs/INTEGRATION_SIDE_BRANCH_TRIAGE_2026-10-22.md

@@ -55,7 +55,7 @@ GitHub initial inventory: 64 open PRs, 26 real open issues, 27 direct base-chain
 
 ## Non-negotiable acceptance conditions
 
-Every PR must receive exactly one reviewed outcome: INCLUDED_SHA, EQUIVALENT_VERIFIED (target code + regression evidence), MISSING_NEEDS_PORT (new isolated patch and test), REPLACED_WITH_RATIONALE (replacement implementation and test), INDEPENDENT_DEFERRED (separate integration lane). Current unresolved rows above MUST stay open. The current user's firmware build and main remain untouched. Integrate distinct lanes separately with exact SHA builds and per-lane CI; hard PTP/SV acceptance requires real SIPROTEC Pdelay, time lock, phase-boundary smpCnt and 4I4V SV. Run native .exe + bundled firmware exact-SHA lifecycle. #286 pure AUTO_FAILOVER policy core is not ESP32 actuator yet. Never imply tested hardware passed.
+Every PR must receive exactly one reviewed outcome: INCLUDED_SHA, EQUIVALENT_VERIFIED (target code + regression evidence), MISSING_NEEDS_PORT (new isolated patch and test), REPLACED_WITH_RATIONALE (replacement implementation and test), INDEPENDENT_DEFERRED (separate integration lane). Current unresolved rows above MUST stay open. The current user's firmware build and main remain untouched. Integrate distinct lanes separately with exact SHA builds and per-lane CI; hard PTP/SV acceptance requires real reference IED Pdelay, time lock, phase-boundary smpCnt and 4I4V SV. Run native .exe + bundled firmware exact-SHA lifecycle. #286 pure AUTO_FAILOVER policy core is not ESP32 actuator yet. Never imply tested hardware passed.
 
 **Thread handoff:** start from [full ledger](./INTEGRATION_CONSOLIDATION_LEDGER_2026-10-22.md), this table, refresh 64 PR heads and exact CI statuses, start with #251/#253/#248/#250/#249 P0 semantics, then #279/#278/#277 GUI. No broad cherry-pick and no PR/issue closures without proof.
 

docs/PTP_SV_CONTINUOUS_EPOCH_BINDING_M3C.md

@@ -41,10 +41,10 @@ demotion after one degraded bracket. Hardware bench acceptance is still absent.
 No new operator prompts; source PTP On → SMV Start still operates directly.
 The IEC 61850-9-2 local sync declaration (`smpSynch=1`) is not the same
 as merely sending PTP frames. IEC/IEEE 61850-9-3 defines the applicable
-power-utility PTP profile. The SIPROTEC 5 process-bus manual confirms
+power-utility PTP profile. The reference IED process-bus engineering guide confirms
 `Accepted SmpSynch=1` is an intentional local-source interoperability mode
 when merging unit and relay share a time reference; ARStack contains no
-Siemens-specific wire quirk.
+publisher-specific wire-format workaround.
 
 A **SOURCE-only, explicit hardware-evidence build** can now promote AUTO to
 local `1` only when ALL gates pass: stable PTP SOURCE generation, coherent
@@ -69,7 +69,6 @@ phase accuracy or guarantee zero relay sync alarms.
 
 External specifications:
 - https://standards.ieee.org/ieee/61850-9-3/6167/
-- https://cache.industry.siemens.com/dl/files/460/109742460/att_1135746/v1/SIP5_Processbus_V09.50_Manual_C054-D_en.pdf?download=true
 
 ## M3C.6 — Correct the AUTO local-sync measurement boundary (2026-10-17)
 
@@ -112,8 +111,7 @@ ready; OFF cancels intent and no intent persists across Studio restart.
 Serial log notifications to QML are coalesced at <=10Hz to avoid
 repainting large log documents on every received line.
 
-Reference: Siemens SIPROTEC 5 Process Bus Manual V09.90, client
+Engineering context: reference IED process-bus profile, client
 `Accepted SmpSynch=1` accepts correctly locally synchronized SV when
 the relay and MU share a known reference. This is a **relay setting**,
 not a vendor-specific SV wire variant.
-https://support.industry.siemens.com/cs/attachments/109742460/SIP5_Processbus_V09.90_Manual_C054-H_en.pdf

docs/PTP_SV_EPOCH_M1_ACCEPTANCE.md

@@ -9,7 +9,7 @@ IEC 61850-9-2 Amendment 1:2020 specifies the meaning of SV synchronization decla
 Authoritative references:
 - https://webstore.iec.ch/en/publication/24998
 - https://standards.ieee.org/ieee/61850-9-3/6167/
-- https://www.omicron-lab.com/fileadmin/assets/Precision-Timing/Knowledge_Applications/Article_IEC_61850-9-3/IEC_61850-9-3_-_Will_simplicity_supersede_complexity_.pdf
+- IEC/IEEE 61850-9-3 power-utility timing profile (normative protocol reference)
 - https://docs.espressif.com/projects/esp-idf/en/v5.5/esp32p4/api-reference/peripherals/gptimer.html
 
 ## M1 implemented