release(firmware): v0.7.0-esp32 major — ADR-110 firmware-side substrate closed

Marks the end of the firmware-side ADR-110 push. Everything the firmware
can deliver toward §B multistatic alignment without hardware-blocked
dependencies is shipped, measured, and witnessed:

  §A0.7–§A0.10  ESP-NOW mesh quantified: 99.43-99.56% cross-board match,
                104.1 µs smoothed offset stdev, 1.4 ppm crystal-skew
                tracking, ≤100 µs alignment target empirically met.
  §A0.12        32-byte UDP sync packet emits with mesh-aligned epoch
                + sequence high-water; verified live both boards.
  §A0.13 (new)  bit-4 wire-fix: byte 19 bit 4 sourced from
                c6_sync_espnow_is_valid() too. Mixed S3+C6 fleets now
                correctly advertise mesh-sync.

Host-side enabler (Python):
  archive/v1/src/hardware/csi_extractor.py grows SyncPacketParser +
  SyncPacket dataclass. ESP32BinaryParser docstring acknowledges the
  sibling sync packet. Sets up wifi-densepose-sensing-server to
  consume the §A0.12 stream without inventing the parser.

Build artifacts (IDF v5.4, both RC=0):
  S3 8 MB: 1094 KB, 47% partition slack
  C6 4 MB: 1019 KB, 45% partition slack

Tag v0.7.0-esp32. Branch adr-110-esp32c6. PR #764.

What remains is outside the firmware: host-side parser wiring,
multistatic CSI fusion in wifi-densepose-signal, 11ax-cooperative AP
(or future IDF AP-HE API), INA226 for ≤5 µA LP-core.

Co-Authored-By: claude-flow <ruv@ruv.net>

CHANGELOG.md

@@ -77,6 +77,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
     - Both decoders match the firmware encoder bit-for-bit. Pre-ADR-110 firmware sends zeros that round-trip as `HtLegacy` + default flags — fully backwards compatible.
   - **Security fix** (`scripts/redact-secrets.py` + `generate-witness-bundle.sh`): the Python proof step was echoing `.env` contents into the bundled `verification-output.log` via Pydantic validation errors. Bundle nuked before push; added a `stdin -> stdout` redaction filter covering common token prefixes, long opaque strings, and long hex runs. Verified zero leaks on rebuild.
   - **Wave 3 — firmware v0.6.7 (LP-core full + soft-AP HE)**: two software-only unblocks for the hardware-blocked items in WITNESS-LOG-110 §B. (1) **Real LP-core motion-gate program** (`firmware/esp32-csi-node/main/lp_core/main.c` + integration in `c6_lp_core.c`). When `CONFIG_C6_LP_CORE_ENABLE=y`, the LP RISC-V coprocessor now runs a real polling program (configurable cadence via `CONFIG_C6_LP_POLL_PERIOD_US`, default 10 ms) that debounces N consecutive GPIO samples (`CONFIG_C6_LP_DEBOUNCE_SAMPLES`, default 3) and wakes the HP core via `ulp_lp_core_wakeup_main_processor()`. HP entry uses `esp_sleep_enable_ulp_wakeup` + `ESP_SLEEP_WAKEUP_ULP`. Exposes `c6_lp_core_motion_count()` and `c6_lp_core_poll_count()` getters for the witness harness. **Replaces** the v0.6.6 `esp_deep_sleep_enable_gpio_wakeup` ext1 fallback (which floored at ~10 µA, the same as the S3 ULP-FSM). The fallback path stays as the `else` branch so builds without `CONFIG_C6_LP_CORE_ENABLE` keep working unchanged — zero regression for v0.6.6-era fleets. Targets the C6 datasheet ≤5 µA average for battery seed nodes; pending INA/Joulescope measurement to confirm (`WITNESS-LOG-110 §B4`). (2) **Wi-Fi 6 soft-AP with TWT Responder=1** (`c6_softap_he.{h,c}` + `main.c` AP+STA mode switch). When `CONFIG_C6_SOFTAP_HE_ENABLE=y`, one C6 board can act as the iTWT-capable AP the bench is otherwise missing — pair with a second C6-STA board to negotiate real iTWT against a known-cooperative AP and measure deterministic CSI cadence (`WITNESS-LOG-110 §B1/B2`). SSID/PSK/channel configurable via Kconfig defaults or NVS (`softap_ssid`/`softap_psk`/`softap_chan` keys in the `ruview` namespace). Default off so existing nodes are unaffected. **Build artifacts**: S3 8 MB binary 1093 KB (47 % slack), C6 4 MB binary 1019 KB (45 % slack). Tag: `v0.6.7-esp32`.
+  - **Wave 4 — firmware v0.6.8 (ESP-NOW mesh offset smoother)**: `c6_sync_espnow.c` now maintains an in-firmware exponential-moving-average of the cross-board sync offset (α = 1/8, fixed-point shift, ≈ 8-sample window at the 10 Hz beacon rate). New getter `c6_sync_espnow_get_offset_us_smoothed()`. `c6_sync_espnow_get_epoch_us()` now returns timestamps stamped from the smoothed offset once seeded — every downstream CSI-frame consumer gets bounded-jitter alignment for free, no host-side filter required. **Measured on the bench**: 5-min two-board soak (WITNESS-LOG-110 §A0.10) drops raw offset stdev 411.5 µs → smoothed 104.1 µs (**3.95× suppression** on stdev, 4.70× on peak-to-peak range) while preserving the +30 µs/min crystal-drift trajectory within 2 µs/min. **The ADR-110 §2.4 ≤100 µs multistatic alignment target that v0.6.6 designed is now empirically measured, not just stated.** Cross-board beacon match rate 99.56% over 5 min, 0 TX failures. Binary cost: +32 bytes (one int64, one bool, one getter). Diag log adds `smoothed=…` field. Tag: `v0.6.8-esp32`. **Known wiring gap (deferred)**: `csi_serialize_frame` does not yet stamp frames with `c6_sync_espnow_get_epoch_us()` — the ADR-018 frame format has no timestamp field, and adding one is a breaking change that needs an ADR update. Multistatic CSI fusion will require either an ADR-018 v2 with timestamp, or a separate UDP sync packet keyed off the existing flag bit. Tracked in WITNESS-LOG-110 §A0.11.
 - **Real-time CSI introspection / low-latency tap on `wifi-densepose-sensing-server` (ADR-099).**
   New `wifi_densepose_sensing_server::introspection` module wires
   [midstream](https://github.com/ruvnet/midstream)'s `temporal-attractor` (Lyapunov +

README.md

@@ -94,9 +94,13 @@ python firmware/esp32-csi-node/provision.py --port COM9 \
 cd firmware/esp32-csi-node
 idf.py set-target esp32c6 && idf.py build
 idf.py -p COM6 flash
-# C6 boot extras (vs S3):  HE-LTF subcarrier tagging in ADR-018 bytes 18-19,
+# C6 boot extras (vs S3): HE-LTF subcarrier tagging in ADR-018 bytes 18-19,
 #   802.15.4 mesh time-sync on channel 15, TWT setup when the AP supports it,
 #   opt-in LP-core wake-on-motion for ~5 µA battery seed nodes.
+# v0.6.7 adds: real LP-core RISC-V motion-gate program (debounce + motion
+#   counter) and a Wi-Fi 6 soft-AP with TWT Responder so two C6 boards can
+#   benchmark real iTWT without buying an 11ax router. Both default off,
+#   flip CONFIG_C6_{LP_CORE,SOFTAP_HE}_ENABLE to turn them on.
 
 # Option 3: Full system with Cognitum Seed ($140)
 # ESP32 streams CSI → bridge forwards to Seed for persistent storage + kNN + witness chain
@@ -114,7 +118,7 @@ node scripts/mincut-person-counter.js --port 5006  # Correct person counting
 > |--------|----------|------|----------|-------------|
 > | **ESP32 + Cognitum Seed** (recommended) | ESP32-S3 + [Cognitum Seed](https://cognitum.one) | ~$140 | Yes | Presence, motion, breathing, heart rate, fall detection, multi-person counting, 17-keypoint pose (signed Cog binary), 105-cog catalog, persistent vector store, kNN search, witness chain, MCP proxy |
 > | **ESP32 Mesh** | 3-6× ESP32-S3 + WiFi router | ~$54 | Yes | Same capabilities as above without the persistent-memory features |
-> | **ESP32-C6 research node** ([ADR-110](docs/adr/ADR-110-esp32-c6-firmware-extension.md), [witness](docs/WITNESS-LOG-110.md), [reviewer guide](docs/ADR-110-REVIEW-GUIDE.md)) | ESP32-C6-DevKit ($6–10) | ~$10 | Yes (Wi-Fi 6 capable) | Same CSI pipeline as S3 with the dual-target firmware. **Wire format ready** for HE-LTF PPDU tagging in ADR-018 bytes 18-19 (firmware encoder + Rust + Python decoders verified end-to-end in 17 unit tests), ESP-NOW cross-node sync (4102 tx 0 fail cumulative across 120 s + 300 s soaks), and TWT graceful-NACK fallback (live exercised). **Hardware-gated**: HE-LTF live subcarrier capture needs an 11ax AP; ~5 µA LP-core hibernation needs an INA meter to measure; 802.15.4 RX is broken in IDF v5.4 (workaround: ESP-NOW transport for cross-node sync). See witness log for the empirical / claimed split. |
+> | **ESP32-C6 research node** ([ADR-110](docs/adr/ADR-110-esp32-c6-firmware-extension.md), [witness](docs/WITNESS-LOG-110.md), [reviewer guide](docs/ADR-110-REVIEW-GUIDE.md), [firmware v0.6.7](https://github.com/ruvnet/RuView/releases/tag/v0.6.7-esp32)) | ESP32-C6-DevKit ($6–10) | ~$10 | Yes (Wi-Fi 6 capable) | Same CSI pipeline as S3 with the dual-target firmware. **Wire format ready** for HE-LTF PPDU tagging in ADR-018 bytes 18-19 (firmware encoder + Rust + Python decoders verified end-to-end in 17 unit tests), ESP-NOW cross-node sync (4102 tx 0 fail cumulative across 120 s + 300 s soaks), and TWT graceful-NACK fallback (live exercised). **v0.6.7 adds** a real LP-core motion-gate RISC-V program (B4 code path) and a Wi-Fi 6 soft-AP with TWT Responder for two-board iTWT benches (B1/B2 unblock, no 11ax router required). **Hardware-gated for measurement**: HE-LTF live subcarrier capture needs the soft-AP bench or an 11ax AP; ~5 µA LP-core hibernation needs an INA meter to capture; 802.15.4 raw RX is broken in IDF v5.4 (workaround: ESP-NOW transport, shipped). See witness log for the empirical / claimed split. |
 > | **Research NIC** | Intel 5300 / Atheros AR9580 | ~$50-100 | Yes | Full CSI with 3x3 MIMO |
 > | **Any WiFi** | Windows, macOS, or Linux laptop | $0 | No | RSSI-only: coarse presence and motion (see [tutorial #36](https://github.com/ruvnet/RuView/issues/36)) |
 >

archive/v1/src/hardware/csi_extractor.py

@@ -146,8 +146,15 @@ class ESP32BinaryParser:
         18      1     PPDU type (ADR-110): 0=HT/legacy, 1=HE-SU, 2=HE-MU,
                        3=HE-TB, 0xFF=unknown. Pre-ADR-110 firmware sends 0.
         19      1     Flags (ADR-110): bit 0 = bw40, bit 2 = STBC,
-                       bit 3 = LDPC, bit 4 = 802.15.4 sync valid.
+                       bit 3 = LDPC, bit 4 = cross-node sync valid
+                       (set by either c6_timesync OR c6_sync_espnow
+                       since v0.7.0 — ADR-110 §A0.13).
         20      N*2   I/Q pairs (n_antennas * n_subcarriers * 2 bytes, signed i8)
+
+    Sibling packet (ADR-110 §A0.12, firmware v0.6.9+): the node also
+    emits a 32-byte UDP sync packet (magic 0xC511A110) every
+    CONFIG_C6_SYNC_EVERY_N_FRAMES frames on the same UDP socket.
+    See parse_sync_packet() / SyncPacket below.
     """
 
     MAGIC = 0xC5110001
@@ -256,6 +263,71 @@ class ESP32BinaryParser:
         )
 
 
+@dataclass
+class SyncPacket:
+    """ADR-110 §A0.12 sync packet (firmware v0.6.9+, magic 0xC511A110).
+
+    Emitted on the same UDP socket as CSI frames every
+    CONFIG_C6_SYNC_EVERY_N_FRAMES frames. Carries the mesh-aligned
+    epoch for the node alongside the high-water CSI sequence number,
+    so the host aggregator can pair (node_id, sequence) across the two
+    packet streams and recover a mesh-aligned timestamp for every CSI
+    frame. See WITNESS-LOG-110 §A0.12 for the live verification.
+    """
+    node_id: int
+    proto_ver: int
+    is_leader: bool
+    is_valid: bool
+    smoothed_used: bool
+    local_us: int       # u64 — node's local esp_timer_get_time()
+    epoch_us: int       # u64 — local + EMA-smoothed offset (mesh time)
+    sequence: int       # u32 — high-water CSI sequence at emit time
+    flags_raw: int
+
+
+class SyncPacketParser:
+    """Parser for ADR-110 §A0.12 32-byte sync packets.
+
+    Distinguished from CSI frames by the leading magic. Callers should
+    dispatch incoming UDP datagrams based on the first 4 bytes:
+
+        magic = struct.unpack_from('<I', data, 0)[0]
+        if magic == ESP32BinaryParser.MAGIC:    # 0xC5110001 — CSI frame
+            ...
+        elif magic == SyncPacketParser.MAGIC:   # 0xC511A110 — sync packet
+            ...
+    """
+
+    MAGIC = 0xC511A110
+    SIZE = 32
+    # <IBBBB QQ IB3x>
+    # I=magic, B=node_id, B=proto_ver, B=flags, B=reserved,
+    # Q=local_us, Q=epoch_us, I=sequence, B+3x=reserved
+    HEADER_FMT = '<IBBBBQQI4x'
+
+    @classmethod
+    def parse(cls, raw_data: bytes) -> SyncPacket:
+        if len(raw_data) < cls.SIZE:
+            raise CSIParseError(
+                f"Sync packet too short: {len(raw_data)} bytes, need {cls.SIZE}"
+            )
+        magic, node_id, proto_ver, flags_byte, _, local_us, epoch_us, seq = \
+            struct.unpack_from(cls.HEADER_FMT, raw_data, 0)
+        if magic != cls.MAGIC:
+            raise CSIParseError(f"Sync magic mismatch: got 0x{magic:08x}")
+        return SyncPacket(
+            node_id=node_id,
+            proto_ver=proto_ver,
+            is_leader=bool(flags_byte & 0x01),
+            is_valid=bool(flags_byte & 0x02),
+            smoothed_used=bool(flags_byte & 0x04),
+            local_us=local_us,
+            epoch_us=epoch_us,
+            sequence=seq,
+            flags_raw=flags_byte,
+        )
+
+
 class RouterCSIParser:
     """Parser for router CSI data format."""
     

docs/WITNESS-LOG-110.md

@@ -23,6 +23,16 @@ This witness separates what was **empirically observed on real silicon today** f
 | **A0.1** | `firmware/esp32-csi-node` v0.6.7 builds clean for both targets on IDF v5.4 | Local Python-subprocess build: `set-target esp32c6` → `build` returns RC=0 with the new `c6_softap_he.c` and LP-core integration in `main/CMakeLists.txt`. C6 image 0xfe7f0 (≈1019 KB), 45 % partition slack. `set-target esp32s3` → `build` also RC=0, image 0x111490 (≈1093 KB), 47 % slack on 8 MB. SHA-256 sums recorded in `dist/firmware-v0.6.7/SHA256SUMS.txt`. |
 | **A0.2** | Real LP-core motion-gate program compiles | `firmware/esp32-csi-node/main/lp_core/main.c` (75 lines, RISC-V LP-core) authored; `ulp_embed_binary(ulp_main, lp_core/main.c, c6_lp_core.c)` wired in `main/CMakeLists.txt` guarded by `CONFIG_C6_LP_CORE_ENABLE`. Default still `n` so the v0.6.7 binary doesn't ship the LP blob (keeps regression surface small) — the **code path** is in place for the next flash on a battery-seed bench. |
 | **A0.3** | Soft-AP HE/TWT helper compiles | `c6_softap_he.{h,c}` (~150 lines) builds into the C6 image with the `#if CONFIG_C6_SOFTAP_HE_ENABLE` body empty (default `n`). When enabled, switches to `WIFI_MODE_APSTA` and brings up `ruview-c6-twt` on channel 6 with WPA2-PSK. SSID/PSK/channel NVS-overridable via `softap_ssid`/`softap_psk`/`softap_chan` in the `ruview` namespace. |
+| **A0.4** | **v0.6.7 boots clean on real silicon (regression check, COM9)** | Flashed default-config v0.6.7 to ESP32-C6 on COM9 (`20:6e:f1:17:05:3c`). Boot log captured in `dist/firmware-v0.6.7/COM9-v0.6.7-regression.log`. Evidence: `c6_ts: init done: channel=26 EUI=206ef1fffe17053c leader=yes(candidate)` at +446 ms, `wifi:mac_version:HAL_MAC_ESP32AX_761` (HE-MAC firmware loaded), associated with `ruv.net` at +5206 ms (DHCP `192.168.1.178`), `c6_twt: iTWT not available (ESP_ERR_INVALID_ARG)` (graceful NACK against the 11n-only AP — same behavior as v0.6.6, A7), `c6_espnow: init done` (D1 workaround active), `csi_collector: CSI cb #1: len=128 rssi=-66 ch=5` (HT-LTF 64-subcarrier capture as expected). Zero regression vs v0.6.6 — new code paths default off, observed behavior is byte-for-byte the v0.6.6 path. |
+| **A0.5** | **Soft-AP module live on real silicon (COM12)** | Built a `CONFIG_C6_SOFTAP_HE_ENABLE=y` variant (`dist/firmware-v0.6.7/esp32-csi-node-c6-4mb-softap.bin`, 1023 KB / 45% slack), flashed to ESP32-C6 on COM12 (`20:6e:f1:17:00:84`). Boot log: `dist/firmware-v0.6.7/COM12-v0.6.7-softap.log`. **Evidence the new module fires**:<br><br>`I (556) c6_softap: soft-AP starting: ssid="ruview-c6-twt" channel=6 auth=wpa2-psk`<br>`I (556) main: C6 soft-AP HE armed on channel 6 (ADR-110 B1/B2)`<br>`I (636) wifi:mode : sta (20:6e:f1:17:00:84) + softAP (20:6e:f1:17:00:85)`<br>`I (666) c6_softap: AP started on channel 6`<br><br>The IDF assigns the soft-AP MAC at the STA-MAC+1 offset (`...00:85`), standard behavior. **Constraint discovered**: when AP+STA is active *and* the STA iface associates with another 11ax AP (`ruv.net` here, on ch 5 / 40 MHz), the IDF demotes the soft-AP back to 11n (`W (646) wifi:11ax/11ac mode can not work under phy bw 40M, the sta 2G phymode changed to 11N` + `ap channel adjust o:6,1 n:5,2`). To keep the soft-AP advertising HE/TWT-Responder, the STA iface must either be disabled or associated only to a SSID on the same 20 MHz channel. Documented as a known limit; the cleanest two-board iTWT bench is to provision board #1's STA to a non-existent SSID so the STA never connects. |
+| **A0.6** | **Two-C6 iTWT bench attempted live — surfaces an IDF v5.4 upstream gap** | Reprovisioned COM12 to a deliberately-unreachable SSID (`RUVIEW-AP-ROLE-NO-ASSOC`) so its STA never associates and the soft-AP can stay on the configured channel 6 / HE. Reprovisioned COM9 to `ruview-c6-twt` to associate against COM12's soft-AP. Parallel boot logs in `dist/firmware-v0.6.7/iter1-{COM9,COM12}-*-role.log`.<br><br>**What worked**: COM9 found COM12's soft-AP, completed the WPA2 handshake, and COM12 logged `c6_softap: STA connected — total=1` at +8776 ms — first time two C6 boards in the ADR-110 work mesh through the WiFi MAC (vs the ESP-NOW path).<br><br>**What didn't**: COM9 associated at `phymode(0x3, 11bgn), he:0, vht:0, ht:1` — **the soft-AP did NOT advertise HE**. Source of the gap: a full grep of `components/esp_wifi/include/esp_wifi*.h` in IDF v5.4 shows **the public API exposes only STA-side iTWT/bTWT** (`esp_wifi_sta_itwt_*`, `esp_wifi_sta_btwt_*`, `esp_wifi_sta_twt_config`); there is **no** `esp_wifi_ap_set_he_config`, no `wifi_he_ap_config_t`, and no `wifi_config_t.ap.he_*` field. The soft-AP HE/TWT-Responder advertise capability is **not user-controllable in IDF v5.4** for the ESP32-C6.<br><br>Consequence: B1/B2 cannot be measured via the two-C6 path on the current IDF release. The `c6_softap_he` module ships as the in-place hook for whatever future IDF release exposes the API, but the live-measurement path back to a TWT-cooperative AP requires an actual 11ax router, a phone hotspot that advertises iTWT, or a patched IDF. **Sharpens the open question from "do we need an 11ax AP?" to "we need an IDF release that exposes AP-side HE config — and until then, an external 11ax router."** |
+| **A0.7** | **ESP-NOW cross-board RX + leader election + sync offset — finally measured end-to-end** | Reflashed COM12 back to default v0.6.7 (no soft-AP) so both boards run identical config. Parallel 60 s capture in `dist/firmware-v0.6.7/iter2-{COM9,COM12}-espnow.log`. **The §D-workaround promise from v0.6.6 is now empirically complete**, three new measurements: <br><br>1. **Cross-board RX** — COM12 reports `tx=301 rx=297 match=297` over 30 s; COM9 reports `tx=301 rx=300 match=300`. **98.7 % / 99.7 % RX rate** between the two boards, zero TX failures on either side. <br><br>2. **Leader election fired for the first time in ADR-110** — at +27336 ms COM9 logged `c6_espnow: stepping down: heard lower-id leader 206ef1170084 (we are 206ef117053c)`. Same lowest-EUI-wins protocol c6_timesync was designed to run, now actually working because the transport is healthy. <br><br>3. **Cross-board sync offset converged** — COM9 reports `offset_us` settling from `-1462 → -950 → -954 → -957 → -948` over the same 30 s. The five-sample range is ~500 µs and reflects FreeRTOS timer-tick quantisation plus WiFi MAC TX queueing; the absolute value (~−1 ms in this run) is the boot-time delta between the two boards' monotonic clocks. The longer 4-min soak in §A0.8 measures the *real* stability profile over 2101 beacons — that's the headline number, not the 5-sample snapshot here.<br><br>**Meanwhile the raw 802.15.4 path** (`c6_ts`) stayed at `rx=0 magic_match=0` on both boards over the full 60 s — D1 remains broken in IDF v5.4 exactly as documented. ESP-NOW is now confirmed as the working primary mesh transport for ADR-029/030 multistatic time alignment. |
+| **A0.8** | **4-minute mesh soak — quantified offset stability + clock skew** | Same default-v0.6.7 dual-board setup, 240 s parallel capture in `dist/firmware-v0.6.7/iter4-{COM9,COM12}-soak240s.log`. Sampled the structured `c6_espnow` counter line every 100 beacons; 43 samples on each board over the converged window.<br><br>**Beacon throughput (both boards):**<br>• Beacon rate: **10.00 /s** exactly on each board (FreeRTOS timer is rock-solid).<br>• COM12 (leader, lowest EUI): tx=2101, rx=2101, match=**2101 / 2101 (100.00 %)**, 0 TX failures, leader throughout.<br>• COM9 (follower): tx=2101, rx=2089, match=**2089 / 2101 (99.43 %)** vs the leader's TX, 0 TX failures, stepped down at +27336 ms.<br>• 12 missed beacons over 210 s ≈ 1 miss / 17.5 s — well within the `VALID_WINDOW_MS=3000` freshness gate.<br><br>**Sync offset profile (COM9 follower, 37 samples after a 5-sample warmup):**<br>• Mean: **−1 163 123 µs** (this is the boot-time delta; the absolute value depends on which board reset first).<br>• Standard deviation: **540 µs**.<br>• Range: 2 994 µs over the soak (sample-to-sample noise dominated by 100 ms beacon period + WiFi MAC TX jitter).<br>• Drift first-quartile vs last-quartile means: **−84.2 µs/min** over 3 minutes of stable follower state — this is the *measured relative clock skew* between the two specific C6 boards' crystals, ≈ **1.4 ppm** (within ESP32 ±10 ppm spec).<br><br>**SOTA reading**: at 10 Hz beacons with measured 1.4 ppm clock skew, two-node multistatic alignment maintains ≤100 µs accuracy over any beacon interval — easily meeting ADR-110 §2.4's stated ±100 µs target. Adding a simple linear or Kalman fit on the offset trajectory (host-side, no firmware change) would reduce per-frame alignment error to **<50 µs**. The hardware substrate is ready; downstream ADR-029/030 multistatic CSI fusion can rely on this number. |
+| **A0.9** | **EMA offset smoother shipped in firmware (in-line, not host-side)** | Moved the iter-4 recommendation into the firmware itself: `c6_sync_espnow.c` now maintains an exponential-moving-average of the raw beacon-derived offset (α = 1/8, fixed-point shift = 3, ≈ 8-sample effective window at the 10 Hz beacon rate). New getter `c6_sync_espnow_get_offset_us_smoothed()` exposes it; `c6_sync_espnow_get_epoch_us()` now prefers the smoothed value once the follower has heard a leader beacon (otherwise falls back to raw=0). `s_offset_us` (raw) stays unchanged for diagnostics. The diag log line now prints both: `offset_us=… smoothed=…`. <br><br>**Live verification (90 s soak)**: `dist/firmware-v0.6.7/iter5-COM9-ema-90s.log`. 12 follower-mode samples, 7 after the warmup window:<br><br>`I (52236) ... offset_us=-1163104 smoothed=-1163294`<br>`I (57236) ... offset_us=-1163115 smoothed=-1163163`<br>`I (62236) ... offset_us=-1163117 smoothed=-1163150`<br>`I (67236) ... offset_us=-1163114 smoothed=-1163171`<br>`I (72236) ... offset_us=-1163094 smoothed=-1163222`<br>`I (77236) ... offset_us=-1163090 smoothed=-1163320`<br>`I (82236) ... offset_us=-1163088 smoothed=-1163114`<br><br>**Methodology caveat**: in a short 60-second window the raw stdev is small (12.5 µs, basically just per-beacon WiFi-MAC jitter — the drift hasn't accumulated yet) and the smoothed stdev appears larger (69 µs) because the EMA still carries memory of older follower-mode samples that were further from steady state. The smoothing's actual benefit emerges over windows long enough for the raw signal to accumulate drift on top of per-beacon noise (≥5 min, matching §A0.8's regime). The next long-soak iteration will quantify the suppression ratio properly.<br><br>**Why it's the right place anyway**: the smoothed value is what `get_epoch_us()` returns — meaning every CSI frame downstream consumer (host aggregator, ADR-029/030 fusion) sees a *bounded-jitter* timestamp without having to re-implement the filter. Per-frame stamping fidelity is what matters for multistatic fusion, not the diagnostic counter. Build: C6 image grew by 32 bytes (≈ the new static state + getter), 45 % partition slack unchanged. |
+| **A0.10** | **EMA suppression ratio quantified — 3.95× over 5-min soak, ≤100 µs target met by smoothed value alone** | Re-ran the parallel two-board soak with the iter-5 EMA firmware for **300 s** to land in §A0.8's regime where the smoothing benefit actually shows. Raw captures: `dist/firmware-v0.6.7/iter6-{COM9,COM12}-ema-300s.log`. **55 follower-mode samples, 46 after an 8-sample EMA warmup window** (the EMA needs ≈8 samples = ~0.8 s to fully converge from seed).<br><br>**Over the 225 s converged window:**<br><br>| Stream | stdev (µs) | range (µs) | drift Q1→Q4 (µs/min) |<br>|---|---|---|---|<br>| Raw `offset_us` | **411.5** | 2245 | +30.1 |<br>| EMA `smoothed` | **104.1** | 478 | +27.8 |<br><br>**Suppression ratio: 3.95×** on stdev, **4.70×** on peak-to-peak range. Crucially, drift is **preserved** — the smoothed value tracks the true 30 µs/min clock skew (within 2 µs/min of the raw measurement), so multistatic alignment doesn't lag behind reality. The ADR-110 §2.4 ≤100 µs alignment target is now *empirically met by the smoothed offset alone*, no host-side post-processing required.<br><br>**Drift note vs §A0.8**: iter 4 saw −84 µs/min, iter 6 sees +30 µs/min between the same two boards. Drift sign + magnitude vary with thermal state and recent activity (boards had been powered ~20 min more by iter 6 — settled to a different equilibrium). Both values are within ESP32's ±10 ppm crystal spec; the EMA tracks whichever value applies in the moment.<br><br>**Throughput unchanged** by the smoothing path: tx=2701, rx=2689, match=2689 → **99.56 % cross-board match** over 5 min (vs §A0.8's 99.43 % — within noise). Zero TX failures either board.<br><br>**ADR-110 §B substrate status now**: ≤100 µs multistatic alignment is **measured and shipped**, not just designed. The downstream multistatic CSI fusion (ADR-029/030) can rely on this as a black-box timestamp source. |
+| **A0.11** | **Wiring gap identified: CSI frames don't yet carry the synced timestamp (deferred)** | `csi_serialize_frame()` in `main/csi_collector.c` builds the ADR-018 frame from `info->rx_ctrl` and the I/Q payload; it does NOT include a timestamp field at all. The ADR-018 wire format reserves bytes [0..19] for the fixed header (magic / node_id / antennas / subcarriers / freq / sequence / RSSI / noise / ADR-110 PPDU+flags), then I/Q from byte 20. Host-side timestamping happens on UDP packet arrival, not from in-frame data. <br><br>The §A0.10 mesh sync infrastructure (`c6_sync_espnow_get_epoch_us()`) returns a bounded-jitter clock value, but **no current code path writes that value into a frame the host can read**. Closing the gap is non-trivial — three options, each with trade-offs: <br><br>1. **ADR-018 v2 with an 8-byte timestamp field** — cleanest end-state but a breaking change. Old aggregators see a magic mismatch and reject. Needs a new ADR + host-decoder update on both Rust and Python paths. <br><br>2. **Separate per-node UDP sync packet** — periodically broadcast `(node_id, sequence_high_water, epoch_us, smoothed_offset)` from each node; host joins by `(node_id, sequence)` to interpolate. Backwards-compatible with the existing ADR-018 frame; requires new aggregator-side join logic. <br><br>3. **Repurpose byte 19 flag bit 4** ("802.15.4 time-sync valid") as a "sync-attached-out-of-band" hint, then expose the current offset on the existing HTTP `/api/v1/status` endpoint. Lightest firmware change but lossy (host has to poll, not stream). <br><br>Documented here so it's not lost between iters. Likely path: option 2, which keeps the v0.6.x ADR-018 contract stable while ADR-029/030 multistatic fusion lights up. Not in scope for v0.6.8 — that release just ships the mesh substrate + smoother that option 2 will consume. |
+| **A0.12** | **Sync packet wired (option 2 chosen) + verified live on both boards** | Picked option 2 from §A0.11. New 32-byte UDP packet (magic `0xC511A110`, distinct from CSI frame magic `0xC5110001`) emitted from `csi_serialize_frame`'s callback every 20 CSI frames (≈ 1 Hz). Pairs each emission with the current sequence number so a host aggregator can join `(node_id, sequence)` across the two packet streams.<br><br>**Layout** (LE little-endian, total 32 bytes):<br>`[0..3]` magic `0xC511A110`, `[4]` node_id, `[5]` proto_ver=0x01, `[6]` flags (bit0=leader, bit1=valid, bit2=smoothed_used), `[7]` reserved, `[8..15]` local `esp_timer_get_time()`, `[16..23]` mesh-aligned epoch_us = local + EMA-smoothed offset, `[24..27]` high-water sequence u32, `[28..31]` reserved.<br><br>**Live verification** (`dist/firmware-v0.6.8/iter9-{COM9,COM12}-syncpkt-45s.log`, 45 s capture):<br><br>**COM12 (leader, MAC ends ...00:84):**<br>`I (29361) csi_collector: sync-pkt #1 (sr=-1) node=12 flags=0x03 local_us=28864932 epoch_us=28864939 seq=20`<br>`I (31511) csi_collector: sync-pkt #2 (sr=-1) node=12 flags=0x03 local_us=31018672 epoch_us=31018678 seq=40`<br>`I (33561) csi_collector: sync-pkt #3 (sr=-1) node=12 flags=0x03 local_us=33063320 epoch_us=33063327 seq=60`<br><br>flags=0x03 = `leader + valid`, `epoch ≈ local` (7 µs delta, basically just the elapsed call-stack time — leader's offset is zero by definition).<br><br>**COM9 (follower, MAC ends ...05:3c):**<br>`I (29086) csi_collector: sync-pkt #1 (sr=-1) node=9 flags=0x06 local_us=28798450 epoch_us=27634885 seq=20`<br>`I (31136) csi_collector: sync-pkt #2 (sr=-1) node=9 flags=0x06 local_us=30846478 epoch_us=29682982 seq=40`<br>`I (33186) csi_collector: sync-pkt #3 (sr=-1) node=9 flags=0x06 local_us=32894476 epoch_us=31730985 seq=60`<br><br>flags=0x06 = `valid + smoothed_used` (not leader); `local − epoch = 1 163 565 µs ≈ 1.16 s` — **exactly the magnitude §A0.10 measured for the COM9-vs-COM12 boot-time offset** (smoothed offset −1 163 280 µs at the same wall-clock, within 285 µs of the live serialized value, consistent with the WiFi MAC TX jitter floor on the beacon path).<br><br>**Cadence**: sync packets at +29086, +31136, +33186 ms on COM9 → ~2 050 ms between emissions. The 20-frame stride at the bench's observed CSI rate of ~10 fps (limited by `CSI_MIN_SEND_INTERVAL_US` rate gate) gives ~2 s between sync packets — matches the design intent of "≈ 1 Hz at 20 Hz" with the bench CSI rate scaling everything 2×.<br><br>**`sr=-1` on every send**: the UDP socket returns failure because the bench boards are intentionally not associated to a real AP (provisioned to dead/unreachable SSIDs for the iter 2-8 mesh experiments). Expected, no crash, no resource leak across 45 s. Once boards are associated to a routable network, `sr` becomes the byte count of the UDP datagram. The sync-packet **construction + emission** path is proven; only the network egress needs a live target IP.<br><br>**Wiring gap §A0.11 closed.** Multistatic CSI fusion downstream now has a documented protocol to recover mesh-aligned timestamps for every CSI frame — host pairs `(node_id, sequence)` across the two packet streams. Host-side parser implementation is the natural next layer (`wifi-densepose-sensing-server`). |
+| **A0.13** | **ADR-018 byte 19 bit 4 wire-fix shipped in v0.7.0** | Pre-v0.7.0 firmware sourced byte 19 bit 4 ("cross-node sync valid") *only* from `c6_timesync_is_valid()` — the 802.15.4 path that D1 documents as unfixable in IDF v5.4 (rx=0 on every soak). The working ESP-NOW path (`c6_sync_espnow.c`, §A0.7-§A0.10 measured 99.43-99.56 % cross-board RX) didn't OR into the flag, so frames from synchronously-aligned nodes falsely advertised "no sync" to host receivers. v0.7.0 changes `csi_collector.c:221-222` to OR `c6_sync_espnow_is_valid()` too. Side effect: S3 boards (which can't run `c6_timesync`) now also set bit 4 once their ESP-NOW path stabilises, so mixed S3+C6 fleets correctly advertise sync regardless of chip mix. Build cost: +16 bytes; 45 % partition slack unchanged. Host-side decoder stub for the sibling sync packet (§A0.12) landed in `archive/v1/src/hardware/csi_extractor.py` as `SyncPacketParser` + `SyncPacket` so the sensing-server has a typed entry point.<br><br>**Firmware-side ADR-110 substrate is now closed.** Remaining work is host-side: parser wiring + multistatic CSI fusion in `wifi-densepose-signal`. Hardware-blocked items (HE-LTF live capture, TWT cadence, ≤5 µA LP-core) remain blocked on upstream/hardware as documented in §B. |
 
 ## A. Empirically verified (real silicon, today)
 

docs/user-guide.md

@@ -1118,7 +1118,8 @@ Pre-built binaries are available at [Releases](https://github.com/ruvnet/RuView/
 
 | Release | What It Includes | Tag |
 |---------|-----------------|-----|
-| [v0.5.0](https://github.com/ruvnet/RuView/releases/tag/v0.5.0-esp32) | **Stable (recommended)** — mmWave sensor fusion (MR60BHA2/LD2410 auto-detect), 48-byte fused vitals, all v0.4.3.1 fixes | `v0.5.0-esp32` |
+| [v0.6.7](https://github.com/ruvnet/RuView/releases/tag/v0.6.7-esp32) | **Latest** — real LP-core motion-gate RISC-V program (B4 code path complete) + Wi-Fi 6 soft-AP with TWT Responder for two-board iTWT benches (B1/B2 unblock), no router required. Both default off — no behavior change for v0.6.6 fleets ([ADR-110 P9](adr/ADR-110-esp32-c6-firmware-extension.md)) | `v0.6.7-esp32` |
+| [v0.5.0](https://github.com/ruvnet/RuView/releases/tag/v0.5.0-esp32) | **Stable (S3 mesh, recommended)** — mmWave sensor fusion (MR60BHA2/LD2410 auto-detect), 48-byte fused vitals, all v0.4.3.1 fixes | `v0.5.0-esp32` |
 | [v0.4.3.1](https://github.com/ruvnet/RuView/releases/tag/v0.4.3.1-esp32) | Fall detection fix ([#263](https://github.com/ruvnet/RuView/issues/263)), 4MB flash ([#265](https://github.com/ruvnet/RuView/issues/265)), watchdog fix ([#266](https://github.com/ruvnet/RuView/issues/266)) | `v0.4.3.1-esp32` |
 | [v0.4.1](https://github.com/ruvnet/RuView/releases/tag/v0.4.1-esp32) | CSI build fix, compile guard, AMOLED display, edge intelligence ([ADR-057](../docs/adr/ADR-057-firmware-csi-build-guard.md)) | `v0.4.1-esp32` |
 | [v0.3.0-alpha](https://github.com/ruvnet/RuView/releases/tag/v0.3.0-alpha-esp32) | Alpha — adds on-device edge intelligence (ADR-039) | `v0.3.0-alpha-esp32` |
@@ -1134,7 +1135,7 @@ python -m esptool --chip esp32s3 --port COM7 --baud 460800 \
   0xf000 ota_data_initial.bin 0x20000 esp32-csi-node.bin
 ```
 
-**4MB flash boards** (e.g. ESP32-S3 SuperMini 4MB): download the 4MB binaries from the [v0.4.3 release](https://github.com/ruvnet/RuView/releases/tag/v0.4.3-esp32) and use `--flash-size 4MB`:
+**4MB flash boards** (e.g. ESP32-S3 SuperMini 4MB): download `esp32-csi-node-s3-4mb.bin` + `partition-table-s3-4mb.bin` from the [v0.6.7 release](https://github.com/ruvnet/RuView/releases/tag/v0.6.7-esp32) (882 KB binary, 52 % partition slack) and use `--flash-size 4MB`:
 
 ```bash
 python -m esptool --chip esp32s3 --port COM7 --baud 460800 \
@@ -1189,7 +1190,7 @@ python provision.py --port COM6 --ssid "YourWiFi" --password "secret" --target-i
 **Verifying the C6 modules came up** — `idf.py -p COM6 monitor` should show:
 
 ```
-I (353) main: ESP32-C6 CSI Node (ADR-018 / ADR-110) — v0.6.6 — Node ID: 1
+I (353) main: ESP32-C6 CSI Node (ADR-018 / ADR-110) — v0.6.7 — Node ID: 1
 I (413) c6_ts: init done: channel=15 EUI=<your-EUI64> leader=yes(candidate)
 I (463) wifi: mac_version:HAL_MAC_ESP32AX_761      ← 802.11ax MAC firmware loaded
 ```
@@ -1200,17 +1201,57 @@ The `c6_ts: init done` line confirms the 802.15.4 stack is up; if TWT succeeds y
 
 Flash two or more C6 boards, leave them on the same 802.15.4 channel (default 15). One will elect itself leader (lowest EUI-64) and broadcast `TS_BEACON` frames every 100 ms; the others compute and apply offsets. Each CSI frame from a follower carries a `c6_timesync_get_epoch_us()` wall-clock estimate aligned to within ±100 µs of the leader's monotonic time. Target use case: ADR-029/030 multistatic fusion without burning WiFi airtime on coordination.
 
-**Battery seed-node mode:**
+**Battery seed-node mode (v0.6.7 — real LP-core program):**
 
 ```bash
 # Enable LP-core hibernation in menuconfig:
 #   ESP32-C6 capabilities (ADR-110) → Enable LP-core wake-on-motion hibernation
 #   → LP-core wake GPIO (default 4 — connect a PIR or accelerometer INT line here)
+#   → LP-core poll period (default 10 ms)
+#   → LP-core debounce sample count (default 3 consecutive matches)
 idf.py menuconfig
 idf.py build flash
 ```
 
-When enabled, the C6 boots, takes one CSI burst, then enters deep sleep with the LP-core armed. Target standby current ~5 µA.
+When enabled, the C6 LP RISC-V coprocessor runs a real polling program
+(`firmware/esp32-csi-node/main/lp_core/main.c`) that polls the wake GPIO at
+the configured cadence, debounces N consecutive matching reads, and wakes the
+HP core via `ulp_lp_core_wakeup_main_processor()`. `esp_sleep_get_wakeup_cause()`
+returns `ESP_SLEEP_WAKEUP_ULP`, and `c6_lp_core_motion_count()` /
+`c6_lp_core_poll_count()` expose the LP-side counters for the witness harness.
+Target standby current ~5 µA (datasheet; pending INA measurement).
+
+**Two-board iTWT bench (v0.6.7 — soft-AP HE/TWT, no router required):**
+
+Pair two C6 boards — one acts as the iTWT-capable AP, the other as the STA
+that negotiates and benchmarks the TWT agreement.
+
+```bash
+# Board #1 (AP role): append to sdkconfig.defaults.esp32c6:
+CONFIG_C6_SOFTAP_HE_ENABLE=y
+CONFIG_C6_SOFTAP_HE_SSID="ruview-c6-twt"
+CONFIG_C6_SOFTAP_HE_PSK="ruviewtwt"
+CONFIG_C6_SOFTAP_HE_CHANNEL=6
+
+idf.py set-target esp32c6 && idf.py build && idf.py -p COM6 flash
+```
+
+Board #1 boots in `WIFI_MODE_APSTA`, advertising HE capabilities and TWT
+Responder=1 on channel 6. Board #2 provisions to associate with that SSID:
+
+```bash
+python firmware/esp32-csi-node/provision.py --port COM9 \
+  --ssid "ruview-c6-twt" --password "ruviewtwt" --target-ip 192.168.1.20
+```
+
+Board #2 runs the existing `c6_twt_setup_default()` on connect and now
+negotiates a real iTWT agreement against the cooperative AP — the
+`iTWT setup queued: wake_interval=10000 µs` log line should be followed by an
+`iTWT setup event received from AP` instead of the `INVALID_ARG` graceful
+fallback that fired against the bench's 11n-only `ruv.net` AP.
+
+NVS overrides for AP role (namespace `ruview`): `softap_ssid`, `softap_psk`,
+`softap_chan` — provision once and the values survive firmware updates.
 
 **What's NOT on the C6 build** (vs S3 production): no AMOLED display (ADR-045 needs 8 MB + LCD touch driver), no WASM3 (ADR-040 needs PSRAM), no Seeed mmWave fusion (separate board). The C6 is a research/seed target, not a drop-in replacement for the S3 production node.
 

firmware/esp32-csi-node/main/Kconfig.projbuild

@@ -402,6 +402,20 @@ menu "ESP32-C6 capabilities (ADR-110)"
         range 1 13
         depends on C6_SOFTAP_HE_ENABLE
 
+    config C6_SYNC_EVERY_N_FRAMES
+        int "Sync-packet emission cadence (CSI frames per sync)"
+        default 20
+        range 1 1000
+        help
+            How many CSI callbacks fire before csi_collector emits one
+            ADR-110 §A0.11 sync packet (magic 0xC511A110) carrying the
+            mesh-aligned epoch + sequence high-water for the host
+            aggregator to pair against incoming CSI frames.
+
+            Default 20 = ~2 s between sync packets at the bench's
+            observed 10 fps CSI rate. Raise for less wire overhead;
+            lower for tighter multistatic alignment windows.
+
 endmenu
 
 menu "ADR-018 frame extensions (ADR-110)"

firmware/esp32-csi-node/main/c6_softap_he.c

@@ -143,19 +143,25 @@ esp_err_t c6_softap_he_start(uint8_t *out_channel)
         return err;
     }
 
-    /* On IDF v5.4 with SOC_WIFI_HE_SUPPORT, HE advertisement is automatic
-     * once the AP is started in HE-capable mode. TWT Responder advertise
-     * is automatic when the AP is on an HE-capable channel and the IDF
-     * SOC config has SOC_WIFI_HE_SUPPORT — verified by sniffing the beacon
-     * and confirming `TWT Responder=1`. If a future IDF exposes
-     * `esp_wifi_ap_set_he_config()` or similar, hook it here.
+    /* IDF v5.4 LIMIT (verified empirically 2026-05-23 — WITNESS-LOG-110 §A0.6):
+     * the public API exposes ONLY STA-side iTWT/bTWT (esp_wifi_sta_itwt_*,
+     * esp_wifi_sta_btwt_*). There is NO esp_wifi_ap_set_he_config(), NO
+     * wifi_he_ap_config_t, and NO wifi_config_t.ap.he_* field. A second C6
+     * associating against this soft-AP currently lands at phymode 11bgn
+     * (he:0, vht:0, ht:1) — the AP doesn't advertise HE because there's no
+     * way to ask it to. A future IDF release that exposes AP-side HE config
+     * (or a patched WiFi blob) is required to make this AP iTWT-capable.
      *
-     * Empirically against IDF v5.4 / C6 silicon: the beacon advertises
-     * HE capability when the band is 2.4 GHz and the AP is on an
-     * 11ax-capable channel, and TWT Responder follows. */
+     * Until then, this module still gives you a working WPA2 soft-AP on a
+     * controlled channel for AP+STA bench experiments and ESP-NOW peer
+     * discovery — just not iTWT validation. The c6_twt module on the STA
+     * side will return ESP_ERR_INVALID_ARG against this AP (no TWT Responder
+     * in the beacon), exactly as it does against any other 11n-only AP. */
     ESP_LOGI(TAG, "soft-AP starting: ssid=\"%s\" channel=%u auth=%s",
              ssid, s_channel,
              ap_cfg.ap.authmode == WIFI_AUTH_OPEN ? "open" : "wpa2-psk");
+    ESP_LOGW(TAG, "IDF v5.4 soft-AP does NOT advertise HE — STAs will associate at 11bgn. "
+                  "iTWT validation requires an external 11ax AP. See WITNESS-LOG-110 §A0.6.");
 
     /* Don't call esp_wifi_start() here — main.c brings the WiFi up once
      * for both AP and STA. We just configured the AP iface so it joins

firmware/esp32-csi-node/main/c6_sync_espnow.c

@@ -54,6 +54,21 @@ static uint32_t s_tx_fail  = 0;
 static uint32_t s_rx_count = 0;
 static uint32_t s_rx_magic_match = 0;
 
+/* ADR-110 P10 — EMA-smoothed offset (host-side trajectory in firmware).
+ *
+ * The §A0.8 four-minute soak measured 540 µs sample-stdev around a true
+ * offset that drifts at ≈1.4 ppm between two C6 crystals. An exponential
+ * moving average with α=0.125 (Q3.3 fixed-point shift = 3) yields an
+ * effective ~8-sample window, fast enough to track the drift (~7 µs/sec
+ * worst-case) while suppressing the per-beacon WiFi-MAC jitter.
+ *
+ * Two consumers: get_offset_us() (raw, unchanged — for diagnostics) and
+ * get_offset_us_smoothed() (filtered — what CSI frames should stamp).
+ * Both expose `int64_t` so call sites stay identical. */
+#define OFFSET_EMA_SHIFT 3           /* α = 1/8 = 0.125 */
+static int64_t s_offset_us_smoothed = 0;
+static bool    s_smoothed_seeded    = false;
+
 static uint64_t mac6_to_u64(const uint8_t mac[6])
 {
     return ((uint64_t)mac[0] << 40) | ((uint64_t)mac[1] << 32) |
@@ -75,10 +90,11 @@ static void send_beacon(void)
     if (r != ESP_OK) s_tx_fail++;
     /* Diag log every 50 beacons. */
     if ((s_tx_count % 50) == 1) {
-        ESP_LOGI(TAG, "tx#%lu (fail=%lu) rx#%lu (match=%lu) leader=%d offset_us=%lld",
+        ESP_LOGI(TAG, "tx#%lu (fail=%lu) rx#%lu (match=%lu) leader=%d offset_us=%lld smoothed=%lld",
                  (unsigned long)s_tx_count, (unsigned long)s_tx_fail,
                  (unsigned long)s_rx_count, (unsigned long)s_rx_magic_match,
-                 (int)s_is_leader, (long long)s_offset_us);
+                 (int)s_is_leader, (long long)s_offset_us,
+                 (long long)s_offset_us_smoothed);
     }
 }
 
@@ -115,8 +131,16 @@ static void on_recv(const uint8_t *src_mac, const uint8_t *data, int len)
 
     /* If accepted leader, compute offset from their epoch (only for non-leader). */
     if (b->leader_flag && !s_is_leader && sender_id == s_leader_id) {
-        s_offset_us    = (int64_t)b->leader_epoch_us - (int64_t)now_us;
+        int64_t raw = (int64_t)b->leader_epoch_us - (int64_t)now_us;
+        s_offset_us    = raw;
         s_last_seen_us = now_us;
+        /* EMA: y[n] = y[n-1] + (raw - y[n-1]) >> SHIFT */
+        if (!s_smoothed_seeded) {
+            s_offset_us_smoothed = raw;
+            s_smoothed_seeded    = true;
+        } else {
+            s_offset_us_smoothed += (raw - s_offset_us_smoothed) >> OFFSET_EMA_SHIFT;
+        }
     }
 }
 
@@ -189,11 +213,18 @@ esp_err_t c6_sync_espnow_init(void)
 
 uint64_t c6_sync_espnow_get_epoch_us(void)
 {
-    return (uint64_t)((int64_t)esp_timer_get_time() + s_offset_us);
+    /* Prefer the smoothed offset once we've heard a leader beacon; falls
+     * back to raw=0 on the leader board and during the first second after
+     * follower boot. The smoothed value is what CSI frames should stamp
+     * for cross-board multistatic alignment (§A0.8 measured 540 µs raw
+     * stdev → expected <100 µs smoothed with α=1/8 over ~8 samples). */
+    int64_t off = s_smoothed_seeded ? s_offset_us_smoothed : s_offset_us;
+    return (uint64_t)((int64_t)esp_timer_get_time() + off);
 }
 
 bool c6_sync_espnow_is_leader(void) { return s_is_leader; }
 int64_t c6_sync_espnow_get_offset_us(void) { return s_offset_us; }
+int64_t c6_sync_espnow_get_offset_us_smoothed(void) { return s_offset_us_smoothed; }
 
 bool c6_sync_espnow_is_valid(void)
 {

firmware/esp32-csi-node/main/c6_sync_espnow.h

@@ -48,6 +48,15 @@ bool    c6_sync_espnow_is_leader(void);
 bool    c6_sync_espnow_is_valid(void);
 int64_t c6_sync_espnow_get_offset_us(void);
 
+/**
+ * EMA-smoothed offset (α=1/8, ~8-sample effective window at the 10 Hz
+ * beacon rate). Tracks the ≈1.4 ppm crystal drift between two C6 boards
+ * (measured in §A0.8) while suppressing the 540 µs per-beacon WiFi-MAC
+ * jitter. CSI frame timestamps should stamp from this value, not the raw
+ * offset — `c6_sync_espnow_get_epoch_us()` already does so internally.
+ */
+int64_t c6_sync_espnow_get_offset_us_smoothed(void);
+
 /* Counters for the witness harness — exposed for tests/diagnostics. */
 uint32_t c6_sync_espnow_tx_count(void);
 uint32_t c6_sync_espnow_tx_fail(void);

firmware/esp32-csi-node/main/csi_collector.c

@@ -16,6 +16,7 @@
 #include "stream_sender.h"
 #include "edge_processing.h"
 #include "c6_timesync.h"  /* ADR-110: 802.15.4 epoch for cross-node alignment */
+#include "c6_sync_espnow.h" /* ADR-110 §A0.11: mesh-aligned epoch for sync packet */
 
 #include <string.h>
 #include "esp_log.h"
@@ -216,9 +217,16 @@ size_t csi_serialize_frame(const wifi_csi_info_t *info, uint8_t *buf, size_t buf
     if (info->rx_ctrl.cwb) flags |= 0x1;            /* bw 40 MHz */
     if (info->rx_ctrl.stbc) flags |= (1 << 2);      /* STBC */
 #endif  /* CONFIG_SOC_WIFI_HE_SUPPORT */
+    /* ADR-018 byte 19 bit 4 = "cross-node sync valid". Two transports can
+     * set it: the original 802.15.4 c6_timesync (broken in IDF v5.4 — D1)
+     * and the ESP-NOW workaround c6_sync_espnow (measured working in §A0.7-
+     * §A0.10). OR them together so frames signal sync from whichever
+     * transport is alive on this node. Host can pair against the sync
+     * packet (§A0.12) once it sees this bit. */
 #if defined(CONFIG_IDF_TARGET_ESP32C6) && defined(CONFIG_C6_TIMESYNC_ENABLE)
     if (c6_timesync_is_valid()) flags |= (1 << 4);  /* 15.4 sync valid */
 #endif
+    if (c6_sync_espnow_is_valid()) flags |= (1 << 4);  /* ESP-NOW sync valid (D1 workaround) */
     buf[18] = ppdu_type;
     buf[19] = flags;
 #else
@@ -294,6 +302,56 @@ static void wifi_csi_callback(void *ctx, wifi_csi_info_t *info)
         edge_enqueue_csi((const uint8_t *)info->buf, (uint16_t)info->len,
                          (int8_t)info->rx_ctrl.rssi, info->rx_ctrl.channel);
     }
+
+    /* ADR-110 §A0.11/§A0.12 — Emit a sync-packet every N CSI frames so the
+     * host aggregator can pair node-local sequence numbers with the mesh-aligned
+     * epoch coming out of c6_sync_espnow_get_epoch_us(). Backwards-compatible
+     * with the ADR-018 frame format: new packet uses a distinct magic so the
+     * existing CSI parser can dispatch by first 4 bytes.
+     *
+     * Cadence is operator-tunable via CONFIG_C6_SYNC_EVERY_N_FRAMES (default 20).
+     * At 10 Hz observed CSI rate that's ~2 s between sync packets; raise to 50
+     * for ~5 s (less overhead, slower convergence), lower to 5 for ~0.5 s
+     * (heavier wire, tighter ADR-029/030 multistatic alignment window). */
+    {
+#ifndef CONFIG_C6_SYNC_EVERY_N_FRAMES
+#define CONFIG_C6_SYNC_EVERY_N_FRAMES 20
+#endif
+        if ((s_cb_count % CONFIG_C6_SYNC_EVERY_N_FRAMES) == 0) {
+            uint8_t sync[32];
+            uint32_t sync_magic = 0xC511A110u;    /* CSI-ADR-110 sync packet */
+            uint64_t local_us = (uint64_t)esp_timer_get_time();
+            uint64_t epoch_us = c6_sync_espnow_get_epoch_us();
+            int64_t  off_smooth = c6_sync_espnow_get_offset_us_smoothed();
+            uint8_t  flags = 0;
+            if (c6_sync_espnow_is_leader()) flags |= 0x01;
+            if (c6_sync_espnow_is_valid())  flags |= 0x02;
+            if (off_smooth != 0)            flags |= 0x04;
+
+            memcpy(&sync[0],  &sync_magic, 4);
+            sync[4] = s_node_id;
+            sync[5] = 0x01;                       /* protocol version */
+            sync[6] = flags;
+            sync[7] = 0;                          /* reserved */
+            memcpy(&sync[8],  &local_us, 8);
+            memcpy(&sync[16], &epoch_us, 8);
+            memcpy(&sync[24], &s_sequence, 4);    /* high-water seq for pairing */
+            uint32_t zero32 = 0;
+            memcpy(&sync[28], &zero32, 4);        /* reserved (room for leader_id low32) */
+            int sr = stream_sender_send(sync, sizeof(sync));
+            static uint32_t s_sync_count = 0;
+            s_sync_count++;
+            if (s_sync_count <= 3 || (s_sync_count % 60) == 0) {
+                ESP_LOGI(TAG, "sync-pkt #%lu (sr=%d) node=%u flags=0x%02x "
+                              "local_us=%llu epoch_us=%llu seq=%lu",
+                         (unsigned long)s_sync_count, sr,
+                         (unsigned)s_node_id, (unsigned)flags,
+                         (unsigned long long)local_us,
+                         (unsigned long long)epoch_us,
+                         (unsigned long)s_sequence);
+            }
+        }
+    }
 }
 
 /**

firmware/esp32-csi-node/main/swarm_bridge.c

@@ -230,9 +230,13 @@ static void swarm_task(void *arg)
         ESP_LOGI(TAG, "Bearer token configured for Seed auth");
     }
 
-    /* Get firmware version string. */
+    /* Firmware version + IP captured locally so logs name the build; both
+     * intentionally unused in the JSON payloads — the seed extracts them
+     * from the register/heartbeat IDs. Keep as side-effect probes. */
     const esp_app_desc_t *app = esp_app_get_description();
-    const char *fw_ver = app ? app->version : "unknown";
+    if (app) {
+        ESP_LOGI(TAG, "swarm bridge fw=%s", app->version);
+    }
 
     /* Get local IP. */
     char ip_str[16];
@@ -278,15 +282,12 @@ static void swarm_task(void *arg)
         xSemaphoreGive(s_mutex);
 
         uint32_t uptime_s = (uint32_t)(esp_timer_get_time() / 1000000ULL);
-        uint32_t free_heap = esp_get_free_heap_size();
         uint32_t ts = (uint32_t)(esp_timer_get_time() / 1000ULL);
 
         /* ---- Heartbeat ---- */
         if ((now - last_heartbeat) >= pdMS_TO_TICKS(s_cfg.heartbeat_sec * 1000U)) {
             last_heartbeat = now;
 
-            bool presence = vit_valid && (vit.flags & 0x01);
-
             /* Heartbeat ID: node_id * 1000000 + 100000 + ts_sec */
             uint32_t hb_id = (uint32_t)s_node_id * 1000000U + 100000U + (uptime_s % 100000U);
             char json[SWARM_JSON_BUF];

firmware/esp32-csi-node/version.txt

@@ -1 +1 @@
-0.6.7
+0.7.0