Bump pins: grblHAL a9446fe (door signal hidden while idle/jog/homing), forgectrl f7276c5; docs

LIGHTBURN: lid open mid-job = Door, Resume continues; the lid is free at idle. SAFETY/SERVICES/BRINGUP: the visibility policy and its bench check.

docs/BRINGUP.md

@@ -2096,10 +2096,23 @@ accordingly ("Automatic — AP country, else World").
    item 11; the "recovery" seen in commissioning was the software
    safety-door path, not the hardware latch.
    **Bench items:** open the lid mid-job (expect `Door` at the sender,
-   motion parked, resume on close); jog and `$H` with the lid open
-   (refused); a Pro with an unjumpered interlock connector (expect the
-   same door behavior); confirm no spurious door events across a full
-   job. Underrun → alarm was already covered by the stream-fault path.
+   motion parked, cycle start resumes after close); a Pro with an
+   unjumpered interlock connector (expect the same door behavior);
+   confirm no spurious door events across a full job. Underrun → alarm
+   was already covered by the stream-fault path.
+   **Changed 2026-08-15 (grblHAL a9446fe, host-tested, pin bumped, bench
+   validation pending):** the door signal is now hidden from the core while it is
+   IDLE, JOG or HOMING (`gfsw_visible`, applied to both `get_state()` and
+   the edge delivery) and delivered the moment it is in any other state.
+   Reason: a lid cycle at idle — every material load, and a power-up with
+   the lid open — left grblHAL parked in `Door:0` until a cycle start,
+   and LightBurn then sat at "Waiting for connection". Consequences: jog
+   and `$H` are allowed with the lid open (beam hardware-blocked; upstream
+   "ignore when idle" semantics), a job started with the lid open parks on
+   the first poll, mid-job opens park exactly as before, and the cloud
+   client (own EV_SW reader) is unaffected. Bench check: lid open/close
+   at idle → state stays Idle; open mid-job → Door, close, `~` → resumes;
+   Start with the lid open → Door immediately.
 4b. **Cloud-mode complete review** (operator-directed 2026-08-03):
    `load_motion` preloads a job's ENTIRE pulse file into the ring with
    no backpressure recovery — with the 16 MiB default ring that caps

docs/LIGHTBURN.md

@@ -107,6 +107,12 @@ restart the controller with the head re-parked.)
   in a layer is clamped by the controller ($110/$111 = 12000 mm/min).
 - **Pause** = grbl feed hold: motion parks within ~0.4 s (0.2 s stream
   queue + deceleration); Resume continues exactly.
+- **Opening the lid (or a Pro's interlock loop) during a job** parks it
+  the same way and LightBurn shows **Door**; close the lid and press
+  **Resume** (a cycle start) to continue. At idle, while jogging, or during
+  homing the lid is yours to open and close freely — the controller does
+  not enter Door there (the hardware blocks the beam anyway), so a lid
+  cycle while loading material never leaves LightBurn waiting.
 - **Stop** = soft reset: motion aborts with a controlled deceleration
   and grblHAL raises an alarm with **position declared lost** (the
   stream queue means up to ~40 mm of in-flight difference). Recovery:

docs/SAFETY.md

@@ -195,9 +195,14 @@ would not allow.
   from the cooling engine (flow verification, over-temperature, lid-IR
   emission witness); a stale or failed verdict relocks in-process.
 - **Safety door.** `doors` (lid) and `interlock` (loop open) are the core's
-  safety-door signal: a running job parks; once the door/loop closes the
-  controller reports `Door:0` and a cycle start resumes it. This is a
-  motion/UX gate; the lid is *also* cut in hardware by the button latch,
+  safety-door signal, shown to the core only while it is in a job-time state
+  (cycle, hold, tool change, door): a running job parks; once the door/loop
+  closes the controller reports `Door:0` and a cycle start resumes it. While
+  idle, jogging or homing the signal is hidden — the lid is opened at idle
+  every time material is loaded and a door seen there would strand the
+  controller in Door — and it is delivered the moment the core leaves those
+  states, so a job started with the lid open parks on its first poll. This
+  is a motion/UX gate; the lid is *also* cut in hardware by the button latch,
   and the interlock by the interlock latch (§3.1).
 - **Head/motion witnesses.** Position counters are not proof of motion (the
   step-stream drives are open loop); the head accelerometer is the motion

meta-forgefirm/recipes-forgefirm/forgectrl/forgectrl.bb

@@ -9,7 +9,7 @@ PV = "0.1.0"
 
 SRC_URI = "git://github.com/ScottW514/forgectrl.git;protocol=https;branch=main"
 # Pinned; bump deliberately after pushing forgectrl changes.
-SRCREV = "a451e7cd6e6d41cb5ef1d640badca0e8b4b5724b"
+SRCREV = "f7276c5788b823f669baec9997bc1b0737c0b027"
 
 S = "${WORKDIR}/git"
 

meta-forgefirm/recipes-forgefirm/grblhal-glowforge/grblhal-glowforge.bb

@@ -11,7 +11,7 @@ PV = "0.1.0"
 # upstream).
 SRC_URI = "gitsm://github.com/ScottW514/grblHAL-glowforge.git;protocol=https;branch=main"
 # Pinned; bump deliberately after pushing grblHAL-glowforge changes.
-SRCREV = "91807a255682e271d69fc07ee18870319f0d6d8f"
+SRCREV = "a9446fe73059c040cb1e59497ae41f3c2badbadf"
 
 SRC_URI += "file://grblhal.init"