[masarray]

Physical evidence 2026-10-20

On-board ESP32-P4 v1.3, write-bin and reset succeeded but immediate serial IDENTIFY timed out. Later PCAP Studio telemetry showed exact bundled build c959486 running, so flash was written; UI incorrectly reported a terminal failure. At the same time ~125s on-wire SV sample sequence was continuous (499,696 packets, 3,999.900 fps, missing=0, duplicate=0, malformed=0), while smpSynch went 0→1→0→1. PTP SOURCE packet presence does not prove external GM lock and all Studio snapshots reported UNLOCKED; release stays blocked.

Corrections

• Introduce post-flash identity-pending supervisor state after bounded reconnect attempts instead of treating successful write as failed flash; keep identity-only recovery alive (never reflash automatically), inform operator to press RESET/reconnect USB, and only promote VERIFIED on exact firmware identity matching the bundled build, including delayed replies.
• Make firmware post-flash waiting nonmodal and distinguish from real flashing/identity mismatches.
• Explicit Preview control only in stable offline state; while a real board is CONNECTING/awaiting identity, the physical START cannot silently become offline preview. Keep transactional START/ACK validation and visible Starting state.
• Include bounded passive 1-Hz firmware console tail in Studio's own synchronized SV+PTP capture evidence, no serial polling or TX-path interference.
• Add UI structural regression verifying these contracts; restore real-world test evidence.

Release gate

Do not merge main until exact-head CI passes and post-fix physical re-test demonstrates serial recovery, single-click START, and no transient LOCAL drops with IED/GM acceptance.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-20T07:04:25.434943Z	fa72fbb	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[masarray]

2026-10-23 source parity audit vs recovered checkpoint — KEEP OPEN

Source #259 head a852170c2e990eb75d2b8c024942f3a494651e8e is DIVERGED from recovered merged #288 final head 8a2428503ee8a1595b03901ac8c1ca2b8343c728; this is not ancestry-contained. Source-wide feature review uncovered unported semantic behavior. In recovered source: SmartSessionController.hpp/.cpp contain no postFlashVerificationPending_ / firmwareVerificationPending contract, DeterministicSessionHarness.cpp contains no postFlashDelayedIdentityRecovers or postFlashWrongBuildFailsClosed test, and SvCapturePanel.qml contains no firmware_log_tail_UNVERIFIED bounded passive firmware log tail. Current ModernRibbon has different physical START/Connecting/Preview logic, but it does not establish equivalence of #259 delayed identity recovery.

Historical #259 had specific physical evidence (flash verified much later than immediate USB IDENTIFY, exact c959... found) and a fail-closed post-flash identity wait. Unique release gate: write-bin success followed by USB CDC delay must not generate a false failed-flash/reflash or VERIFIED without exact build ID; tests must separately cover delayed correct identity, wrong identity and preview-instead-of-START transitions on Windows. The 1-Hz bounded serial tail is a distinct field-forensic feature and is NOT proven by the newer #288 partial-PCAP recovery fix.

Disposition: KEEP OPEN, not obsolete, until deliberately ported/retested into selected Stage→Main source or explicitly descoped with maintainer approval. No code copied, no branch changed, and no merge.