[masarray]

M3.C implementation (stacked on M3.B #291 -> M3.A #290 -> checkpoint #288)

Draft only, no checkpoint or main merge. Preserves physically tested 4I4V SV and PTP encoder/phase-path. Do not ship to relay without on-wire FAT.

• Reuse SOURCE's existing hardware timestamp RX callback (already registered for 61850-9-3 Pdelay), not a second EMAC RX worker. Admit foreign Announce only when parsed with matching domain, transportSpecific, VLAN/PCP profile and strict quality rank (priority1, clockClass, accuracy, variance, priority2, clockIdentity, stepsRemoved). Exclude self GM identity, invalid hop-depth, stale/one-packet/burst candidate; require >=3s stable evidence, >=3 separate Announce timestamps. This is candidate evidence, not lock.
• CPU0 M3.B boot supervisor performs a guarded SOURCE→RECEIVER handover only while SV output is STOPPED, and no explicit operator PTP override is active: stop/drain old EMAC owner; configure existing PTP TIME_RECEIVER; start hardware timestamped Pdelay+Sync discipline. Receiver's existing measured LOCK state and source identity drive smpSynch; never claim external lock just for Announce.
• Explicit isolated LAB-only AR_PTP_AUTO_LOCAL_FALLBACK allows restoring SOURCE after no selected external Announce for >=15s AND SV remains STOPPED, link UP, no manual override. On recovery clear fake bench UTC timestamp, requalify new clock generation. No simultaneous SOURCE and RECEIVER TX; never auto-promote on a live substation.
• Strictly opt-in Kconfig flags with bench sdkconfig.defaults, exact-head firmware build-profile assertions, pure GCC/Clang regression of quality/hysteresis/fault/exclusivity policy. Existing M3.B PTP persistent clock and M3.A GPTimer ownership unchanged; canonical SV/packet BER unchanged.
• Limitations: serial/manual Advanced runtime policy selection UI is M3.D; AUTO transition while SV RUNNING is intentionally deferred (no unverified time-step or silent output STOP). Full standards BMCA multi-port election/GNSS trust and SIPROTEC lock are not proven. Hardware on-wire and 100-cycle endurance required before marking FAT PASS. Tests should include two external GMs, same/varying clock quality, wrong VLAN, Pdelay missing, source timeout/holdover, 4kHz continuity and SOURCE/RECEIVER mutual exclusion.

Link M3 #162 and design #289; coordinate old #166, no blind merge of divergent receiver code.

[masarray]

M3.C implementation status — 249de26 (2026-10-23, HEAD pinned)

Stack: M3.C Draft #292 -> M3.B #291 -> M3.A #290 -> merged checkpoint PR #288 (e820407).

Actual firmware code delivered (not design only):

1. SOURCE existing hardware timestamp RX callback is reused as a passive Announce observer alongside Pdelay; strict profile matched via shared PtpForeignWireProfile: domain, transportSpecific, exact VLAN ID and PCP, no QinQ. A GM cannot qualify from self-originated Announce or single/bursty packets.
2. PtpExternalCandidateGate: four fixed per-port candidate slots, no heap, BMCA-like comparison of announced priority1/class/accuracy/variance/priority2/identity/steps, expiry, 3s hysteresis and proper two-GM interleaved detection. Source only exports a read-only stable candidate boolean; this is NOT a measured PTP LOCK.
3. M3.B boot supervisor is the sole M3.C actuation owner. Only with SV STOPPED and no manual PTP override, orderly SOURCE stop/drain -> role configure -> hardware TIME_RECEIVER start; receiver's existing timestamped Pdelay+offset discipline must LOCK before advertising synced SV. No concurrent SOURCE+RECEIVER workers.
4. Configured lab-only AR_PTP_AUTO_LOCAL_FALLBACK may restore SOURCE only after receiver has no selected GM for >=15s, link up and SV stopped; old BENCH_GM clock/UTC claims cleared, new lease must reacquire. 30s timebase-role switch cooldown prevents flapping, uint32 wrap tested. No force-stop of operator SV TX or hidden SOURCE promotion outside lab policy.
5. Pure policy GCC/Clang tests cover 4-candidate arbitration, hysteresis, spoof/self, degraded quality, peer/port isolation, expiry, manual override, no simultaneous EMAC ownership, loss quiet period, and cooldown wrap. Real PTP codec regression constructs an Announce Ethernet frame, parses it, and checks domain, transport, VID and PCP mismatches. Canonical 4I4V encoder, sample timing ISR, and existing measured receiver kernel untouched.

CI on this exact head: GCC+Clang PTP SUCCESS, CI routing SUCCESS, naming guard SUCCESS, standalone ESP32-P4 firmware build SUCCESS, paired ESP32-P4 preview firmware build SUCCESS. Windows native job still in progress under run #39966633839. Hardware FAT still outstanding: 100x STOP/START, GM appears/vanishes, multiple GMs, wrong VLAN, Pdelay loss, holdover and reconnection with real PCAP + ARSAS/DigSub. No claim of SIPROTEC 5 locked or live-GM switch while SV RUNNING; during active SV external handover is deliberately deferred to avoid unqualified time-step and output corruption.

Old Draft #166 changes six overlapping files including app_main.cpp and ptp_lab_task.cpp; did not cherry-pick it. Do not merge M3.C or M3.B/A to checkpoint or main before physical FAT.

[masarray]

Integrated into main through PR #299 — historical stacked review closed.

Verified on 24 Oct 2026: this PR's exact HEAD 249de266f6a602f04055242700c49c4d0757818b is now a Git ancestor of main (GitHub compare reports 0 behind). The entire validated M3.H ancestry was reconciled with newer main docs and merged through #299, main merge ad2ebd0e7696dcbc389f1241fedbec5ecf504881, after 14/14 exact-candidate CI workflows passed. Verified shipped firmware/Studio source remains a922e9bdba4e57a4e88406eb83344455dd8ff142; five Stable release assets unchanged.

This PR targeted an intermediate stacked branch, not main. It is therefore closed as ancestry already integrated through #299, not claimed to have been separately merged through its own PR button. Branch/commit history preserved. Real external relay interoperability, UTC/GNSS traceability and 120-second endurance remain separate evidence gaps, not an obstacle to the stable lab simulator release.