[masarray]

Physical defect reproduced by user on M3.D (3a33575)

• Relay sees LOCAL SV while it needs GLOBAL PTP synchronization.
• After SV STOP -> START, stream returns NOT SYNC although PTP is expected to remain alive.
• A green software CI did not prove relay acceptance.

Root causes found in live firmware

1. M3.B boot SOURCE defaults to bench_global_gm=false; after honest phase/MAC acquisition, smp_synch_lab.cpp advertises LOCAL (1) instead of simulated Global (2). M3.C fallback explicitly clears the bench seed.
2. M3.D role/policy change discards even a fresh source UTC seed.
3. M3.A retains GPTimer/1Hz phase on STOP, but every START clears sparse MAC descriptor evidence. The first expected baseline produces a false loss, and 1Hz qualification is restarted.
4. Studio Linux Qt smoke had early undefined combo-theme binding warnings.

Corrective software

• Kconfig opt-in isolated FAT CONFIG_AR_PTP_BOOT_SIMULATED_GLOBAL_GM=y in paired injector preview: on boot with no GPS/USB, seed the SOURCE test-set PTP/TAI hardware clock from a plausible RTC or explicitly synthetic UTC anchor+monotonic; PTP Announce uses the existing simulated GNSS bench GM profile. This is NOT a physical GNSS time source and MUST NOT be used in an energized/live process bus.
• Default SOURCE clock stays on independently of SV injection. M3.C fallback obtains a fresh simulated laboratory GM seed rather than LOCAL. Policy SOURCE->SOURCE retains still-valid seed; SOURCE selected from RECEIVER/MONITOR resamples a fresh seed.
• Keep existing measured PTP↔SV phase/MAC gate, never force a smpSynch byte. For an already previously certified SOURCE on an unchanged continuously disciplined sample grid, preserve sync on warm START across the first expected post-reset MAC baseline, bounded by 8 live epochs for new MAC evidence. Any real phase fault, source/lease change, missing frame, descriptor failure, repeat baseline, or timeout immediately revokes. Cold START cannot use this grace.
• 100× portable warm STOP/START and positive/negative fault-policy regressions. Studio startup combobox uses a tiny temporary token fallback until actual theme binds; no ISR/QML large re-render modifications.
• Canonical SV BER, 4I4V channel format, 4k/4.8k timer ISR arithmetic and packet encoder remain unchanged.

Release/FAT gates

Exactly matched Windows Setup+firmware HEAD and all relevant CI must pass. Then only physical ESP32-P4+SIPROTEC capture can show PTP GM accepted, SMV accepted, smpSynch=2 stable across 100 cycles, no PTP restart/generation change and measured channel values. DO NOT merge into M3.D, checkpoint or main, and DO NOT declare hardware FAT success solely from GitHub CI. Source stack: #288 -> #290 -> #291 -> #292 -> #293; this Draft #295 layers on top.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T22:59:03.299901Z	3f4e9ee	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3f4e9ee893

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Revoke warm retention when fresh MAC evidence fails its bounds

During a warm SOURCE restart, a coherent descriptor pair can return Evidence::measured while its TX offset is outside SvLocalSyncEvidenceGate's allowed range. observe() then resets the MAC qualification, but the publisher only revokes for results other than measured, and this retention path checks software phase and publisher faults without checking that MAC rejection. Consequently, warm_resume_authorized keeps advertising synchronization until the eight-epoch window expires despite newly measured invalid MAC evidence. Distinguish evidence that is still pending from evidence that has failed, and revoke warm retention immediately for the latter.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Preserve the reacquisition deadline across repeated warm starts

If an already-qualified SOURCE repeatedly STOPs and STARTs before obtaining a new coherent MAC pair, every START resets both evidence trackers and replaces the warm-resume deadline with the current epoch. The retained qualification makes the next START eligible for warm resume again, so cycles shorter than the two-epoch descriptor cadence can advertise synchronization indefinitely without fresh MAC evidence, bypassing the stated eight-epoch reacquisition bound. Preserve the original outstanding deadline across these restarts, or require successful MAC requalification before granting another warm window.

Useful? React with 👍 / 👎.