[masarray]

Field incident and proof

Operator's independent NIC capture: 1231.679s, 4,926,580 SV frames, ~3999.89 fps, 0 missing/duplicate/reordered, 3693 PTP L2 frames. Capture ends INVALID_CAPTURE because publisher was STOPPED; this alone does not prove USB lease expiry versus operator/runtime STOP.

Root design problem

ESP32-P4 firmware live_control.cpp currently force-stops SV after a six-second missing Studio heartbeat. Qt DeviceController::shutdown also sends an implicit SV STOP when closing the GUI. This couples Ethernet data plane to Windows USB/COM liveness.

Change

• ESP32-P4 becomes authoritative owner of ongoing SV publication; heartbeat expiry disarms session-liveness telemetry but does not set g_running=false, clear START, invent a STOP cause or wake a stopped publisher. Verified START CFG transaction and explicit operator STOP are unchanged.
• Closing/crashing Studio or temporarily losing COM does not send implicit SV/PTP STOP. GUI re-identifies physical boot and reads board's actual SV/PTP state instead of assuming USB disconnection equals board STOP.
• Actual LAN disconnection invokes nonblocking PTP task teardown request (no waits in ESP event callback). Existing SV link gate + 400 consecutive TX failure fail-closed threshold remains. No automatic publisher restart after LAN fault.
• Add contract test invoked on every ESP32-P4 firmware build and physical runbook documenting USB, link and operator-command acceptance.

Required CI / acceptance

ESP-IDF 5.5.4 firmware and Qt/Windows source tests; matched Studio+firmware packaging, exact provenance. Physical USB unplug for 10 minutes with independent SV/PTP PCAP and reconnect readback; LAN down verified stop; 3600 s clean 4I4V capture; independent receiver acceptance. Do not merge or publish stable until required gates succeed; public M3.H.2 RC1 remains unchanged.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T03:01:33.293484Z	9196d0f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9196d0f1c3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[masarray]

Addressed all three P1 review findings on exact PR head c9f1e998bec69e55dee3f95764d1477e87f518b7

1. Boot SOURCE unintended restart after PHY recovery: PHY UP→DOWN is now first qualified by prior kLinkUpBit; event invokes role facade ar_ptp_lab_request_link_down_stop() and persistently sets ar_ptp_boot_supervisor_operator_override() until reboot. The existing SOURCE boot recovery policy cannot automatically restart after physical loss; manual operator PTP START remains allowed. No false link fault on no-cable initial boot.
2. TIME_RECEIVER/MONITOR cancellation: facade sends dedicated nonblocking atomic STOP requests to both SOURCE and receiver/monitor tasks. The receiver path uses g_receiver_stop_requested (not the SOURCE-only flag). Both roles have 5-ms worker polls. smpSynch source/receiver qualification is revoked on fault.
3. Stale PTP task handle race: Ethernet event callback no longer dereferences or notifies any task handle and performs no bounded 500-ms cleanup. It only writes atomic stop flags; task owners execute their own EMAC shutdown. START crossing a PHY-loss epoch is cancelled through existing PTP cancellation gate during START completion, outside event callback.

Relevant firmware jobs build-esp32p4, build-esp32p4-ptp-source, build-esp32p4-ptp-receiver and Qt smoke now passed; release packaging/sanitizers/Windows are still running. Code and physical acceptance remain distinct; issue #324 stays OPEN.