Merge Phase 3.5 Workstream C: on-demand GPS time sync
One-shot, power-gated GPS time sync for HAS_GPS boards (T-Deck Plus today,
generic for future GPS hardware), OFF by default with guaranteed power-down:
- In-house NMEA time parser ($GxRMC/$GxZDA, checksum-validated, UTC only).
- One-shot sync engine: power the receiver, wait for the first valid fix,
commit via the atomic rtc::setDateTime, record ClockSource::Gps, power
the receiver fully back off — on EVERY exit path (success, timeout,
cancel, begin-failure, and the PMIC deep-sleep hook + rail cut). The
parsed year is clamped to [2024,2099] before any clock write.
- Narrow platform/uart facade (device-only; releases the driver AND
hi-Zs the pins on end() so a rail cut cannot backfeed the module).
- Settings "GPS time sync" action + waiting overlay; GPS?/GPSSYNC debug
hooks (debug-build only) for headless/QA driving.
- ClockSource is display-only: running trust stays Volatile after a GPS
set, and GPS is NEVER a lockout anchor (verified: zero clock_source
reads in vault/trust/lockout; the rtc:: facade is untouched).
Zero idle cost: HAS_GPS=0 boards keep ~47 B of no-op stubs and GC the
UART facade entirely (nm-verified). Live HIL on the T-Deck: timeout and
cancel branches both power-down-asserted; sticks3 skip-clean.
Gates: native 1671/1671, fleet 18/18 -Werror (plus1 58.1% ceiling),
pio check 0, guards + doxygen clean, QA no-HW 38. Per-task + whole-branch
review clean (security isolation verified end-to-end).
Claude-Session: https://claude.ai/code/session_01U878bNJtg9bCvAMM8CFKqS