diff --git a/CLAUDE.md b/CLAUDE.md
index 3ae477d..7936fe5 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -45,7 +45,7 @@ Repo: https://gitea.apointless.space/bsncubed/aes67-ESP32-P4
 - [x] 2. Web server + config store (cJSON in NVS) + embedded index.html; /api/config, /api/status (stub values), /api/reboot.
 - [x] 2a. Finding the device: mDNS (hostname.local + _http._tcp), then LLDP (switch shows name + IP).
 - [x] 2b. Firmware update: /api/ota upload + rollback self-test. Test: update to a new build, then deliberately flash a build that fails its self-test and confirm it rolls back. After this, flash over the network; keep USB for recovery.
-- [ ] 3. PTP TimeReceiver: lock to an existing GM (Riedel), fill `status.ptp`. Confirm EMAC hardware timestamps work. First check whether the installed ESP-IDF has a PTP example/component for the P4 before writing one.
+- [x] 3. PTP TimeReceiver: lock to an existing GM (Riedel), fill `status.ptp`. Confirm EMAC hardware timestamps work. First check whether the installed ESP-IDF has a PTP example/component for the P4 before writing one.
 - [ ] 4. AES67 TX with a 1 kHz test tone, PTP-paced; /stream.sdp. Verify: import SDP on a Riedel Artist 4-wire AES67 port, and check packets/timestamps in Wireshark.
 - [ ] 5. SAP discovery, then syslog, then health/temperatures, then VLAN split (one at a time).
 - [ ] 6. PTP TimeTransmitter: BMCA roles (auto/master), hybrid mode.
diff --git a/docs/aes67-core-base.md b/docs/aes67-core-base.md
index 0240bed..155d54e 100644
--- a/docs/aes67-core-base.md
+++ b/docs/aes67-core-base.md
@@ -54,6 +54,12 @@ Reference devices for UI and defaults: Riedel Bolero (PTP status), Riedel Direct
   - Note: Riedel Bolero reports its own clock class as 228.
 - When the GM changes (including this device becoming GM): update SDP ts-refclk, bump session_ver, send SAP immediately.
 - Hardware timestamping preferred (ESP32-P4 EMAC has IEEE 1588 support); software fallback flagged in status.
+- ESP32-P4 implementation (aes67_ptp):
+  - IDF's `examples/ethernet/ptp` (ptpd) is Layer 2 only, so it is not used. IDF's EMAC clock is used: `ETH_MAC_ESP_CMD_PTP_ENABLE`, then the IPv4/UDP snapshot bit (`emac_ll_ts_ptp_ip4_enable`), which IDF leaves off.
+  - RX timestamps: a hook on the driver's info input path (`esp_eth_update_input_path_info`) records port-319 event timestamps and forwards every frame to lwIP. TX: Delay_Req is a raw Eth/IPv4/UDP frame sent with `esp_eth_transmit_ctrl_vargs` for its HW timestamp. Needs `CONFIG_ETH_TRANSMIT_MUTEX`.
+  - Servo: step on the first Sync from a new GM (frequency seeded from the measured rate), then linuxptp-style PI (kp 0.7 / ki 0.3 at 1 Sync/s, scaled by the interval); re-step above 1 ms. Locked: 8 Syncs below 1 µs; unlocked after 3 above. GM loss keeps the frequency (holdover).
+  - Path delay is corrected for offset drift between t2 and t3 until the clock is syntonised; delay statistics start at lock.
+  - Measured vs ptp4l (Intel i210 GM, non-PTP switch): lock in ~35 s cold, ~22 s after GM loss; offset within a few hundred ns; board crystal -39.8 ppm. Link asymmetry (1G GM / 100M board through a store-and-forward switch) adds a constant offset error of a few µs that no receiver can see.
 
 ### PTP status (`status.ptp`) — main panel modelled on Riedel Bolero "PTP Status"
 | UI row | field(s) | notes |