diff --git a/docs/BRINGUP.md b/docs/BRINGUP.md
index 5e2e1b0..2433e67 100644
--- a/docs/BRINGUP.md
+++ b/docs/BRINGUP.md
@@ -1436,11 +1436,25 @@ accordingly ("Automatic — AP country, else World").
the bit reads 0 = satisfied/good-to-go; Pro brings it out for an
external lockout chain. Must NOT gate motion (beam is
hardware-gated).
- **SW_ESTOP reads LOW during ANY motion** (measured 2026-08-07:
- polled at 20 ms through X and Z jogs — low for the whole run, ~70/75
- samples, recovers instantly at idle; True at idle) — must NOT gate
- motion on the factory board either (it false-tripped every legacy
- cloud motion ~0.1 s in). Doors/door1/door2 stay stable during motion.
+ **`hv_enable` (EV_SW bit 4, GPIO4_06) is the readback of the safety
+ chain's HV_ENABLE output** through the U24 inverter — not an input.
+ Active for the whole duration of any run (the window in which the
+ charge pump is fed and HV_ENABLE is alive), inactive at idle, and it
+ drops ≈0.45 s after the last charge-pump pulse (measured 2026-08-07 at
+ 20 ms through X and Z jogs, ~70/75 samples; watchdog period measured
+ 2026-08-15). It gates nothing anywhere — it is telemetry (`/status`
+ `switches.hv_enable`, control-panel "HV enable"). Naming note: the
+ factory design labels this net **E-STOP**, and dated entries below
+ written before 2026-08-15 call it `estop`/`SW_ESTOP` with the
+ pre-rename polarity (the device tree then declared the pin active-high,
+ so the bit read HIGH at idle and LOW through a run — the same physical
+ behavior, inverted); the DTS now declares it active-low so the bit
+ reads as HV_ENABLE itself. The former `estop_halts_motion` /
+ `MOTION.ESTOP_HALTS_MOTION` opt-in (gate motion on this line, for a
+ hypothetical retrofit) is removed: it only ever made sense while the
+ line was misread as an e-stop input, and a real e-stop belongs in the
+ lid-switch chain (`docs/SAFETY.md`). Doors/door1/door2 stay stable
+ during motion.
- Machine identity from OCOTP nvmem: HW_OCOTP_MAC0 is the serial,
base-23-encoded to the factory hostname — fuse-verified on the bench
against the factory label. The bench machine's actual values are
@@ -2083,14 +2097,11 @@ accordingly ("Automatic — AP country, else World").
hardware chain already does to the beam. Bit 3 is the series
combination the safety chain itself uses, not the individual door
switches.
- - **e-stop (bit 4): opt-in only.** The line rests ACTIVE on a
- healthy machine and drops for the duration of any stepper motion
- on this board, so gating on it would abort every job. Set
- `estop_halts_motion` in `/data/forgefirm.conf` (hand-edited; it is
- not in forgectrl's settings whitelist, and unknown keys survive
- forgectrl's writes) for a machine retrofitted with a real e-stop
- circuit. Same escape hatch as the cloud client's
- `MOTION.ESTOP_HALTS_MOTION`.
+ - **hv_enable (bit 4): never gated on.** It is the readback of the
+ chain's HV_ENABLE output (facts bank above), telemetry only; the
+ core's `e_stop` capability is not advertised. (The `estop_halts_motion`
+ opt-in that existed until 2026-08-15 is gone, together with the
+ name — see the facts bank.)
- **interlock latch (bit 6): deliberately not gated on.** Its
resting state on a healthy machine is not characterized and a
false assertion would wedge every job; the hardware chain enforces
@@ -2315,6 +2326,18 @@ accordingly ("Automatic — AP country, else World").
- The uniprocessor locking assumption and the panic/dead-man safe
states are documented in `kernel-module-glowforge/UAPI.md`; no
bench item.
+ - **`hv_enable` rename + polarity flip (2026-08-15) rides the same
+ flash.** The gpio-keys node for GPIO4_06 is now `hv_enable`,
+ declared active-low, so EV_SW bit 4 reads as the HV_ENABLE output
+ itself (inactive at idle, active through a run). forgectrl
+ (`/status` key `switches.hv_enable`, panel "HV enable"), the grblHAL
+ driver (`SW_BIT_HV_ENABLE`, no gating) and gfhardware
+ (`InputSwitch.SW_HV_ENABLE`, no gating) all ship in the same image
+ and read the new polarity; the DTS and that userspace must not be
+ mixed across the flash (a mismatch only inverts the telemetry — nothing
+ gates on the bit — but the dashboard would lie). **Bench:** `/status`
+ shows `hv_enable:false` at idle, `true` during a jog, back to `false`
+ ≈0.45 s after the run ends, in lockstep with `charge_pump_alive`.
- **GATE A kernel fixes added to the same flash (2026-08-14):**
the controlled-deceleration ramp now floors at the minimum step
frequency with a saturating decrement, and `epit_hz_to_divisor()`
diff --git a/docs/SAFETY.md b/docs/SAFETY.md
index 0e29606..194af32 100644
--- a/docs/SAFETY.md
+++ b/docs/SAFETY.md
@@ -52,7 +52,7 @@ away kills emission in hardware, not in software.
| U17 | SN74AHC08 quad 2-input AND | The four gates: DOORS, HV_ENABLE, and the two-stage LASER_ON gate |
| U23 | CD4043B quad R/S latch (NOR type, active-high S/R, output enable tied high) | Latch 1 = button latch, latch 2 = interlock latch |
| U32 | 74AHC1G32 single 2-input OR | Lid-open OR SoC lock → button latch SET |
-| U24 | 74AHC1G04 single inverter | E-STOP sense line = ¬HV_ENABLE |
+| U24 | 74AHC1G04 single inverter | HV_ENABLE readback to the SoC (the pin carries ¬HV_ENABLE; the factory design labels this net **E-STOP**) |
| U18 | i.MX6 Solo | The SoC: drives CHG_PUMP, LATCH_RESET, INTERLOCK_RESET, FIRE; reads everything else |
### 2.2 Inputs
@@ -68,7 +68,7 @@ away kills emission in hardware, not in software.
| Button latch state | U23-1 Q → U5-6 → U6-1 | double inversion | GPIO1_03 (R7) | `cnc/button_latch`, `interlock_circuit` bit 2 | 1 = latch SET (fire blocked / not armed), 0 = armed |
| Interlock latch state | U23-2 Q → U6-3 → U6-4 | double inversion | GPIO1_02 (T1) | code 6 `interlock_latch`, active high → **active = latch SET** | 1 = interlock latch blocking |
| LASER_ON readback | J1_12 net (U17-3 output) | U6-5 inverts | GPIO1_05 (R4) | `cnc/laser_on`, `laser_on_sampled`, `interlock_circuit` bit 0 (raw, active low) | The gated output — the only software-visible proof of emission permission |
-| E-STOP | U24 = ¬HV_ENABLE | — | GPIO4_06 (W5) | code 4 `estop`, active high | Sense line, **not** an input: high whenever HV_ENABLE is low (idle), low while HV_ENABLE is alive |
+| HV_ENABLE readback (factory net name E-STOP) | U24 = ¬HV_ENABLE | — | GPIO4_06 (W5) | code 4 `hv_enable`, active low → **active = HV_ENABLE asserted** | Readback of the chain's own output, **not** an input: inactive at idle, active only while a run feeds the watchdog with the lid closed |
| LASER_PGOOD | J1_14 (the supply's HV_OK line) | — | GPIO4_21 (P24) | `cnc/laser_pgood`, `laser_pgood_sampled` (active low) | Read as "power good" from the laser supply; what the supply actually signals on it is not fully characterized |
### 2.3 SoC outputs into the chain
@@ -91,7 +91,7 @@ on end-of-data or underrun.
DOORS_OK = DOOR_SW1 · DOOR_SW2 (U17-1)
WDOG_ALIVE = U1-1 Q, retriggered by every CHG_PUMP rising edge
HV_ENABLE = DOORS_OK · WDOG_ALIVE (U17-4) → J1_16
-E_STOP = ¬HV_ENABLE (U24 inverter) → GPIO4_06
+ ¬HV_ENABLE (U24 inverter) → GPIO4_06, read back as `hv_enable`
Button latch (U23-1):
SET = ¬DOORS_OK + LATCH_RESET (U32 OR)
@@ -124,11 +124,13 @@ machine when the lid is closed *and* the SoC has already released its lock.
| Remote-interlock loop opens (Pro) | unchanged | blocked: the kernel drives INTERLOCK_RESET high on the switch edge, setting the interlock latch. Opening the loop by itself only releases the latch's RESET — the board has no direct trip path — so this SoC drive is what makes the interlock a hardware cut (see §3.1); software additionally parks the job on `interlock` | close the loop: the kernel releases INTERLOCK_RESET and the closed loop resets the latch |
| Interlock latch already SET | unchanged | blocked | closing the loop clears it |
-Note the *E-STOP* line: despite the factory name it is an output of this
-chain — the inverse of HV_ENABLE. It reads active on a healthy idle machine and
-drops for the whole duration of any kernel run, the window in which the charge
-pump is fed and HV_ENABLE is alive. Nothing in ForgeFIRM gates on it unless a
-machine settings key opts in for a retrofitted circuit.
+`hv_enable` (GPIO4_06) is a readback of this chain's own output, not an
+input: it is inactive on an idle machine and active for the duration of any
+kernel run — the window in which the charge pump is fed and HV_ENABLE is
+alive. Nothing in ForgeFIRM gates on it; it is telemetry. (The factory design
+labels the net E-STOP; no Glowforge model has an e-stop input, and a
+retrofitted one belongs in the lid-switch chain, where the hardware enforces
+it.)
---
@@ -247,10 +249,10 @@ kernel readbacks (the runbook `BRINGUP.md` holds the drill records):
for the in-flight run; a locked latch survives a stop + resume replay.
- Armed kill mid-FIRE: emission tail equals the ring in-flight only
(15–171 ms), the latch relocks, the burn line ends abruptly.
-- Switch bits 0–3, 5, 6 verified against physical state; bit 4 (`estop`)
- characterized live: high at idle, low through any run, and it flips
- together with `charge_pump_alive` on both edges (HV_ENABLE = DOORS_OK ·
- WDOG_ALIVE observed).
+- Switch bits 0–3, 5, 6 verified against physical state; bit 4
+ (`hv_enable`) characterized live: inactive at idle, active through any run,
+ and it flips together with `charge_pump_alive` on both edges (HV_ENABLE =
+ DOORS_OK · WDOG_ALIVE observed).
- Interlock latch drive: with the connector unjumpered, `interlock`,
`interlock_latch_reset` and `interlock_latch` all assert within one 50 ms
sample and all clear when the loop is closed again.
@@ -265,9 +267,9 @@ Present gaps in the hardware picture. None of them changes the safety
argument (every gap is on the readback/sense side or is a "which part" question),
but each is worth closing:
-- **`estop` toggles seen inside motion windows** are run boundaries: `estop`
- follows the watchdog exactly (low from the first pulse of a run, high
- ≈0.45 s after its last), and homing and jogs are several short runs. A
- feed late by more than ~250 ms would look the same and has not been
- observed.
+- **`hv_enable` toggles seen inside motion windows** are run boundaries:
+ `hv_enable` follows the watchdog exactly (active from the first pulse of a
+ run, inactive ≈0.45 s after its last), and homing and jogs are several
+ short runs. A feed late by more than ~250 ms would look the same and has
+ not been observed.
- **`laser_pgood` (HV_OK, J1_14) semantics** are not fully characterized.
diff --git a/docs/img/safety-chain.svg b/docs/img/safety-chain.svg
index f269591..8c6c099 100644
--- a/docs/img/safety-chain.svg
+++ b/docs/img/safety-chain.svg
@@ -75,13 +75,13 @@
HV_ENABLE
-
+
NOTU24
-
- estopEV_SW 4 · GPIO4_06 · = ¬HV_ENABLE
+
+ hv_enableEV_SW 4 · GPIO4_06 · readback
J1_16HV_ENABLE
diff --git a/meta-forgefirm/recipes-forgefirm/forgectrl/forgectrl.bb b/meta-forgefirm/recipes-forgefirm/forgectrl/forgectrl.bb
index 5ea7427..55bab27 100644
--- a/meta-forgefirm/recipes-forgefirm/forgectrl/forgectrl.bb
+++ b/meta-forgefirm/recipes-forgefirm/forgectrl/forgectrl.bb
@@ -9,7 +9,7 @@ PV = "0.1.0"
SRC_URI = "git://github.com/ScottW514/forgectrl.git;protocol=https;branch=main"
# Pinned; bump deliberately after pushing forgectrl changes.
-SRCREV = "f7276c5788b823f669baec9997bc1b0737c0b027"
+SRCREV = "801f1f3a1f90c38157429ee1e4ff79b0c2fe68e3"
S = "${WORKDIR}/git"
diff --git a/meta-forgefirm/recipes-forgefirm/forgefirm-app/forgefirm-app.inc b/meta-forgefirm/recipes-forgefirm/forgefirm-app/forgefirm-app.inc
index db20d31..64bba8c 100644
--- a/meta-forgefirm/recipes-forgefirm/forgefirm-app/forgefirm-app.inc
+++ b/meta-forgefirm/recipes-forgefirm/forgefirm-app/forgefirm-app.inc
@@ -11,11 +11,11 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=62f8bb455fcc4bf177ecab380f71cd5d"
SRC_URI = "git://github.com/ScottW514/python3-gfhardware.git;protocol=https;branch=master"
# Pinned; bump deliberately (AUTOREV is not reproducible).
-SRCREV = "6c7534a050f61e1f205743f34a9d2743a1a7b96f"
+SRCREV = "c3d1790e6cd8f11eee7b386b5314d53454a1c2db"
# Bump PV with every SRCREV move: the hash-derived package version is not
# monotonic on its own and buildhistory QA fails the build when it sorts
# backwards.
-PV = "0.1.4+git"
+PV = "0.1.5+git"
S = "${WORKDIR}/git"
diff --git a/meta-forgefirm/recipes-forgefirm/grblhal-glowforge/grblhal-glowforge.bb b/meta-forgefirm/recipes-forgefirm/grblhal-glowforge/grblhal-glowforge.bb
index 202d9c4..ce2cd89 100644
--- a/meta-forgefirm/recipes-forgefirm/grblhal-glowforge/grblhal-glowforge.bb
+++ b/meta-forgefirm/recipes-forgefirm/grblhal-glowforge/grblhal-glowforge.bb
@@ -11,7 +11,7 @@ PV = "0.1.0"
# upstream).
SRC_URI = "gitsm://github.com/ScottW514/grblHAL-glowforge.git;protocol=https;branch=main"
# Pinned; bump deliberately after pushing grblHAL-glowforge changes.
-SRCREV = "a9446fe73059c040cb1e59497ae41f3c2badbadf"
+SRCREV = "b629c188227a0ad4eb47095cf9ebe7783a2b9a74"
SRC_URI += "file://grblhal.init"