[masarray]

Scope (continuation of #331; reconciles relevant unresolved pieces of #330)

Engineering preview only; physical acceptance remains open.

Verified gaps in merged main

• START previously set RUNNING without an atomic physical-LAN check. A command could arm while disconnected or race a PHY-down event.
• Ethernet DISCONNECTED stopped SV/PTP, but ETHERNET_EVENT_STOP did not revoke either transmitter.
• Firmware advertised obsolete SESSION-LEASE even though the merged board is autonomous; Studio and firmware manifest still required it, leaving incompatible old behavior nominally compatible.
• Studio reconnected to RUNNING state but did not adopt one coherent 4I+4V setpoint bank.

Fix

• Introduce one short FreeRTOS critical-section boundary for Ethernet-link changes and verified START, separate from USB diagnostics and the 4-kHz transmission loop.
• Reject START while PHY down; consume the verified scenario token only when successfully armed; on Ethernet down/driver STOP revoke SV and request nonblocking PTP teardown. Cable recovery alone never restarts SV.
• Keep heartbeat freshness as START authorization/telemetry only; an optional observer timer cannot block legitimate START and expired heartbeat cannot stop ongoing SV.
• Migrate IDENTIFY, Studio, FirmwareManager and CI manifest to SV-LAN-AUTONOMY-V1; reject old lease-only firmware for this preview.
• Add SVBANK BEGIN/8 rows/END readback scoped by boot_id and generation, including CT waveform shaping (enable, DC offset, harmonic magnitude/order, clip). Reconnecting Studio adopts actual board values only if all fields are complete and no operator edit intervened. Never send START/STOP or silent CFG on reconnect.
• Preserve early PHY UP callbacks at bootstrap even when Ethernet driver starts before live-control initialization (review finding fixed).
• Extend deterministic session regressions and source contract test.

Quality gates

• Validate ESP-IDF 5.5.4 firmware, Qt Studio native preview, paired installer+firmware artifact, and all relevant GitHub Actions checks against the same head SHA.
• On isolated physical ESP32-P4 hardware: 15-min headless USB/Studio disconnect with independent continuous 4I4V SV/PTP capture; live board readback on USB/COM replug; explicit SV/PTP STOP; Ethernet disconnect and driver-down fail-closed; 3600-s independent NIC PCAP (no missing/dup/reordering); real ARSAS and DigSubAnalyzer receive acceptance.
• CI success is not physical validation. Do not relabel M3.H.2 RC1 or M3.H.1 stable; keep Community feedback: SV receiver visibility, VLAN and APPID/svID setup in lab analyzers #324 open.

Source

Base main 0ec12c0 (merged #331). #330 is an overlapping implementation and must not be merged wholesale.

Review and CI evidence at latest head

• Both Codex review findings (early PHY boot ordering and CT shaping overwrite) addressed and threads resolved.
• Latest reviewed head: 88f662cce24aed3f5658a8e15e83a80b9b2a69ce. ESP32-P4 firmware build and Embedded Profile CI: SUCCESS; remaining native Qt/Windows release packaging/workflows pending at last inspection.
• No hardware endorsement or stable tag created.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T04:37:17.995975Z	75db29f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 75db29f753

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[masarray]

2026-10-25 Native Preview CI repair: run 40162989021 failed after native Windows compile and matched firmware download, at Verify immutable public v0.1.1 flasher source and matched firmware. Root cause: workflow set ARSTACK_STUDIO_FIRMWARE_DIR to the new SV-LAN-AUTONOMY-V1 firmware before invoking the pinned v0.1.1 legacy GUI's own --check-firmware-contract, yielding exit 4. Commit 2231ac35 separates verification into legacy GUI + original SHA-pinned legacy firmware, then new Studio + exact-head firmware and strict SHA/capability checks. This is a CI pairing fix, not a relaxation of firmware compatibility nor a claim of physical acceptance. New run: https://github.com/masarray/arstack61850/actions/runs/40165495478 . Keep #324 physical interop and 3600s validation open.