P0 RECEIVER: actual canonical SV phase/MAC proof on external GM PTP lease

[masarray]

P0 continuation stacked on #254 (itself stacked on #252); no merge to main before physical relay acceptance.

Proven source-level failure: g_sv_timeline_phase_qualified was initialized false but never promoted anywhere. RECEIVER with real external GM discipline therefore could never emit qualified AUTO SV. Sparse descriptor evidence also called ar_ptp_lab_source_generation(), which intentionally returns zero for RECEIVER, making every receiver MAC observation invalid.

Code:

1. Shared existing clock lease before/after sparse real canonical descriptor timestamp applies to SOURCE and RECEIVER. Explicit source-identity/GM generation, session, fault, sample epoch and phase uncertainty continuity; no host timestamp substitute.
2. The existing 10-consecutive-live-epoch gate + 2 measured MAC pairs remains, plus receiver PTP discipline LOCKED. Global claim still solely from measured GM traceability; receiver holdover without independent error bound is UNSYNC; SOURCE is never GLOBAL.
3. Write/clear the previously unused RECEIVER SV timeline atomic, cancel immediately on measured unlock, PTP STOP, publisher STOP, skipped slot, MAC/TX fault, observer stall or lease/source change; operator AUTO return invalidates stale claims before mode publish.
4. Permit pre-START dry GPTimer phase alignment for qualified RECEIVER GM as well as SOURCE; zero SV before explicit START, zero early smpSynch claim, same session lease/clock generation enforced at START. This can reduce post-START phase acquisition without bypassing independent live MAC proof.
5. Firmware AUTO resolver is now linked into existing strict GCC/Clang/MSVC smp_synch_policy_tests, proving receiver GM-only=0, true phase+MAC gate and traceable GM=2, loss/relock=0, source-only=1 and manual override invalidation. Additional portable MAC/GM generation/fault and receiver preflight tests. Correct stale Kconfig descriptor cadence comment 16→2.

Important blockers: This repairs deterministic code path only. ESP-IDF 5.5.4 MAC TX descriptor polling is experimental and remains a real-time risk; must instrument 4kfps, phase, 120/3600s SV+PTP PCAP, independent time source, 10x cold/warm, real external GM and target relay (IED). No certification, no auto-flash, no source/receiver binary equivalence, no main merge.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T04:55:10.484954Z	72d5163	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 72d5163546

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep receiver qualification after measured timestamps

When external-GM RECEIVER mode has qualified, every scheduled descriptor timestamp enters this block, but this call clears the receiver timeline unconditionally—even when result is measured. The 1 Hz observer does not restore it until roughly 250 ms later, so about 1,000 subsequent 4 kHz frames advertise smpSynch=0 every two seconds despite valid evidence. Move this revocation under the non-measured-result condition alongside the source revocation.

Useful? React with 👍 / 👎.