[masarray]

Cause / physical evidence

The independent NIC report (25 October 2026) captured 4,926,580 SV frames over 1231.679 s, 0 smpCnt gaps/reorder/duplicates, 1231 PTP Sync+FollowUp+Announce triplets. Capture ended early when board SV stopped; actual historical SVLIFE stop cause is unavailable from the submitted PCAP report. Existing firmware source definitely stops SV on a 6s Studio heartbeat lease, and Desktop shutdown also sends STOP if running. These create independent reasons why USB/Studio cannot be reliable production-time dependencies.

Architectural change

• ESP32-P4 owns SV/PTP lifecycle once operator explicitly STARTed with profile commit/readback and real LAN link up. USB/Studio/HEARTBEAT is observer/control only; lost COM no longer stops the publisher. Studio shutdown no longer sends hidden STOP.
• Real Ethernet DISCONNECTED and driver STOP events atomically revoke SV immediately with ETHERNET_LINK_DOWN; START is prohibited without actual PHY link, including race recheck. Unrelated 400-consecutive canonical TX failures still fail-closed as before.
• PTP SOURCE stops attempting wire TX and revokes freshness/READY on PHY-down, retains clock process and resynchronizes from actual new packets when PHY returns. Explicit operator SV STOP and PTP STOP remain separate verified controls.
• Studio reconnect must read back authoritative board RUNNING/PTP state and not automatically overwrite a live board because the local default is STOPPED. No automatic SV rearm on PHY restoration.
• Breaking capability SV-LAN-AUTONOMY-V1 replaces SESSION-LEASE across firmware, Studio identity, Firmware Manager manifest and Windows/native CI. Use exact paired GUI+firmware package.
• Add regression: adopting independently RUNNING board after USB COM number changes; revise static safety guard; document 3600s lab and LAN/USB fault injection matrix.

Scope & gates

This is a pre-stable P0 hardware fix. Does NOT modify existing released Stable M3.H.1 or RC1. All CI jobs must be green before merge; a new correctly paired Windows artifact is needed before physical operator acceptance. Do not close #324 until independent receiver PCAP + ARSAS/DigSubAnalyzer receive and 3600s endurance are verified.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-25T02:26:51.790278Z	fc69307	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[masarray]

Reconciliation update (2026-10-25): #331 is merged on main (0ec12c04) and already covers USB-heartbeat decoupling plus asynchronous PTP Ethernet teardown. Follow-up #332 contains the non-duplicate, safety-critical gaps reviewed from this PR: atomic START/PHY interlock, ETH driver STOP handling, SV-LAN-AUTONOMY-V1 Studio/firmware/manifest handshake, and coherent 4I4V readback on reconnect. Do not merge this conflicted PR wholesale; keep it as historical implementation/evidence until #332 is validated. Physical RX/3600s and issue #324 remain open.