[masarray]

Cause / physical evidence

The independent NIC report (25 October 2026) captured 4,926,580 SV frames over 1231.679 s, 0 smpCnt gaps/reorder/duplicates, 1231 PTP Sync+FollowUp+Announce triplets. Capture ended early when board SV stopped; actual historical SVLIFE stop cause is unavailable from the submitted PCAP report. Existing firmware source definitely stops SV on a 6s Studio heartbeat lease, and Desktop shutdown also sends STOP if running. These create independent reasons why USB/Studio cannot be reliable production-time dependencies.

Architectural change

• ESP32-P4 owns SV/PTP lifecycle once operator explicitly STARTed with profile commit/readback and real LAN link up. USB/Studio/HEARTBEAT is observer/control only; lost COM no longer stops the publisher. Studio shutdown no longer sends hidden STOP.
• Real Ethernet DISCONNECTED and driver STOP events atomically revoke SV immediately with ETHERNET_LINK_DOWN; START is prohibited without actual PHY link, including race recheck. Unrelated 400-consecutive canonical TX failures still fail-closed as before.
• PTP SOURCE stops attempting wire TX and revokes freshness/READY on PHY-down, retains clock process and resynchronizes from actual new packets when PHY returns. Explicit operator SV STOP and PTP STOP remain separate verified controls.
• Studio reconnect must read back authoritative board RUNNING/PTP state and not automatically overwrite a live board because the local default is STOPPED. No automatic SV rearm on PHY restoration.
• Breaking capability SV-LAN-AUTONOMY-V1 replaces SESSION-LEASE across firmware, Studio identity, Firmware Manager manifest and Windows/native CI. Use exact paired GUI+firmware package.
• Add regression: adopting independently RUNNING board after USB COM number changes; revise static safety guard; document 3600s lab and LAN/USB fault injection matrix.

Scope & gates

This is a pre-stable P0 hardware fix. Does NOT modify existing released Stable M3.H.1 or RC1. All CI jobs must be green before merge; a new correctly paired Windows artifact is needed before physical operator acceptance. Do not close #324 until independent receiver PCAP + ARSAS/DigSubAnalyzer receive and 3600s endurance are verified.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-25T02:26:51.790278Z	fc69307	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[masarray]

Reconciliation update (2026-10-25): #331 is merged on main (0ec12c04) and already covers USB-heartbeat decoupling plus asynchronous PTP Ethernet teardown. Follow-up #332 contains the non-duplicate, safety-critical gaps reviewed from this PR: atomic START/PHY interlock, ETH driver STOP handling, SV-LAN-AUTONOMY-V1 Studio/firmware/manifest handshake, and coherent 4I4V readback on reconnect. Do not merge this conflicted PR wholesale; keep it as historical implementation/evidence until #332 is validated. Physical RX/3600s and issue #324 remain open.

[masarray]

Reconciled against integrated main b7871b8901c842fa4057f04ed7385ff963cd71b4 (2026-11-04). Closing this old branch as superseded, NOT merging its 50-commit, 115-commit-behind diff.

Verified the production contract is already implemented and covered on current main:

• DeviceController::shutdown(): normal Studio close passes requestSvStop=false, requestPtpStop=false; explicit safety STOP remains separate.
• embedded/.../live_control.cpp: HEARTBEAT tracks control path only and cannot revoke autonomous board SV output after START; real link-down path reports ETHERNET_LINK_DOWN.
• Main.qml: reconnect safely adopts complete live 4I+4V board readback (including CT), rather than overwriting active output with local stale defaults.
• FirmwareManager, board identity and preview manifest use SV-LAN-AUTONOMY-V1 with exact revision pairing, not SESSION-LEASE.
• tests/test_board_autonomous_publisher_contract.py, Studio deterministic harness, and docs/BOARD_AUTONOMOUS_SV_PTP_CONTROL.md are already in main.
• All 19 integrated-main CI checks on b7871b8 completed successfully.

This is code-level reconciliation only, not physical 3600-second endurance or third-party SV receiver acceptance. Those remain separate evidence gates. Applying this outdated PR would risk reverting newer firmware STOP safety (#355), Windows NIC mapping (#356), and canonical SV metadata (#357). No files or release assets are changed by this closure.