M2.17-M P0: reconcile #618/#620; canonical Data Model focused hydration + Explorer read SSOT

[masarray]

P0 SSOT Live Data Model — executable reconciliation of #618 and #620

Current tested HEAD: 1bf016057115955a83ece30d97a1729519409848 (2026-10-17). This is a draft stacked on #618; do not merge to main or promote without physical acceptance.

Reconciliation

Two-parent commit 0236502121c2d90df6c2e9479d40726085c51dde has exactly:

1. latest M2.17-K: isolated ARIEC PR173 typed C264 report integration trial #618 d3a7021376b3c2860922c24f4643135015f78774;
2. previously divergent M2.17-L: bounded on-selection SGCB / Data Model value hydration #620 53c3d7ecce49cf94850291aa27b2e9fecaa300a9.

The combined tree is based on latest #618 and preserves its latest typed report/schema corrections. No destructive force-push, change to engine engines/ARIEC61850.lock.json (still 51c2eefd61d6bcbe1116fda6b781b74bb9cf06da PR173), native lock, or Operate paths.

Implemented product behavior

• Retires pre-Dispatcher visited-key poisoning with metadata-only IedBrowserFocusedAdmission: device+association fence, bounded 128-page history and finite successful-start attempts. Queued-but-skipped/busy/changed-page callbacks are not counted as read attempts.
• Bounded focused Data Model LN/DO/DA current-verifiably-discovered MMS Read on page opening, DO row focus and chevron disclosure. All values go to the existing canonical device.LiveValues ledger; no new value authority, synthetic q/t, polling loop, write, or automatic Read All.
• Setting Groups auto-read scope from exact SGCB status (NumOfSG, ActSG, LActTm) and SG leaves with priority finite batches, no EditSG/CnfEdit or FC=SE writes.
• Strict DataSet FCDA member projection: removes unrelated units.SIUnit / units.multiplier CF rows and implicit CF reads from selected MX DataSet; leaves CF units/multiplier in Data Model; engineering display can only use authentic model+observed CF pair.
• Cross-application improvement: MMS Read accepted into the canonical ledger can update Device Explorer SignalDefinition even while monitoring if and only if no authoritative same-key Report is observed. Monitoring runtime point/SOE state is NOT mutated by a background read, and later Report always takes precedence; reconnect fences old observations.
• Behavior regressions: exact FC isolation, Report over Read, stale association rejection, Data Model vs DataSet unit ownership, skipped queued callback, DO/DA focused read, 1000 LN navigation bounded history, no point event from background MMS Read.

Windows exact-SHA evidence — SUCCESS

Build ARSAS run #39032889419 on 1bf016057115955a83ece30d97a1729519409848

• Solution build: success
• Pinned engine canonical SCL/identity: 19/19 passed
• ARSAS regression suite: 2236/2236 passed
• Packaged native-bridge tests: 6/6 passed
• Native ArdIrec build/CTest, portable single EXE build, EXE smoke test, package sealing/upload: success
• Artifacts: ARSAS-win-x64-portable-single-exe ID 12101705008 (73,517,426-byte ZIP); ARSAS-test-evidence ID 12101555559; Windows package-input ID 12100468883. Exact SHA pin and artifact identity provided by run.

Still NOT a full physical SSOT acceptance

• Siemens GR_X_7SX85/BCUGE Setting Groups page-open 24/24 values, MMXU Data Model exact CF unit/multiplier, XCBR Beh/Mod/Health and discovery-dependent leaves need on-wire validation against reference screenshots/pcap; negative read reasons must remain explicit.
• C264 previous 130/207 observed and 3/29 RCB routed coverage need fresh physical validation; never claim fixed by local tests.
• Remaining P0: reduce mutable SignalDefinition discovery/probe authority duplication, unify all Live Signal Values/Device Explorer projections with q/t/source for read-only snapshots, improve actionable per-target status and verify no stale cross-association state. Current patch is a meaningful part of SSOT contract, not completion.

No mainline merge; retain draft until field results.

[masarray]

M2.17-N field screenshot regression repair — exact-SHA Windows green

HEAD: 4ec55377ef3708ed8daeb3dc1bffa7c271388046.

Cause 1 — Device Explorer height collapse: Legacy ExplorerCommandDockRow remained inside the Explorer tab after the Command Dock expander was reparented into the shared persistent workbench. The old >5-command resize method still set the now-empty row to 1*, stealing a large portion of the Live Signal Values viewport. Fixed both at transfer time and on subsequent resize/refresh using a pure, tested detached-dock policy. No command execution/Operate logic altered.

Cause 2 — NamPlt shows Not read with observed DC children: The LN DO row had no ST/MX process scalar and never projected exact FC=DC child evidence. New IedBrowserNameplatePresentation chooses unique verified vendor, then d/swRev/configRev leaf from the same canonical association-bound value ledger, without manufacturing a parent MMS scalar, trusting SCL-only declarations or caching values. Offline labels stale evidence; reconnect clears previous association.

Regression: 4 new behavioral/source tests cover NamPlt vendor = GE Multilin, exact FC/ref isolation, stale/offline/reconnect, >5 and up to 150 Command Dock signal geometry plus transfer invariant. Updated obsolete legacy screenshot-source guard rather than restoring the broken star-row behavior.

CI: Windows #39034902824 SUCCESS; .NET build, 19/19 pinned ARIEC identity/SCL tests, 2240/2240 ARSAS regression tests, 6/6 packaged native tests, native CTest, portable EXE smoke, Windows package sealing/upload. 12/12 commit workflows successful.

Portable: GitHub Actions artifact ARSAS-win-x64-portable-single-exe 12101174316 (ZIP 73,518,817 bytes); exact SHA and verified provenance in run. Package-input 12101209076, test-evidence 12101638854.

Acceptance still required: physical IED screenshot comparison for NamPlt parent and dock proportions after installing this SHA; CI cannot prove monitor-side WPF pixels or MMS peer compatibility. Keep #621 draft until field pass.

[masarray]

M2.17-P: GE BCU Setting Groups Read — capture-guided root STRUCTURE acquisition

Captured evidence (user-supplied IEDScout_Connect_BCU_GE(1).pcapng): 723 enhanced packet blocks; TCP/102 loopback capture contains 22 distinct LN$SG root variable names (e.g. SGphHiPIOC1$SG, SGndPIOC1$SG, SGgndPIOC1$SG). The Read requests are MMS Confirmed-Read [4] with domain-specific FC-root ObjectName, not individually enumerated $SG$...$setVal leaf requests. No full pcap committed (field capture remains with operator).

Root cause: Browser SGCB scope was reading 24–32 SG leaves individually. GE 650-style MMS structure Read behavior evident in capture was not part of Browser's acquisition plan; 15s finite auto-read budget filled with failed leaf attempts. The existing pinned ARIEC typed MmsDataValue.Structure, GetVariableAccessAttributes, and ReadSingleVariableAsync APIs were unused here.

Implemented: IedBrowserSgRootProjection, NativeIec61850Client.ReadVerifiedSgRootAsync, IedBrowserSgRootReadFlight. At most eight verified FC=SG roots per focused page, two serial read-only requests (GVA TypeSpecification + MMS root Read), exact ordered type name/value mapping, strict schema node counts and case-preserved child identity, exact target reference/FC allowlist, primitive wire kind verification. Source only publishes IedBrowserReadResult via existing association-bound canonical SSOT inbox; per-leaf Read remains bounded fallback if root unavailable. No edit group, writing, polling, SCL-derived values, second persistent cache, Operate changes or ARIEC engine repin. Works via both runtime and isolated read-only association during monitor.

Tests: Wire-typed synthetic regression checks 22-root shape/SG leaf mapping (InMagTyp/PIOCEna/StrVal), exact FC and IED fence, structure count mismatch, duplicate/ambiguous paths, mismatched primitive MMS kind, cross-association write rejection. No IED physical parity asserted yet.

CI exact SHA: Build #39037104143, commit 7116fa49f39a8f7c1c1d9cc44ca804d938ef2ef5:

• Windows solution build PASS, pinned engine 19/19
• ARSAS regression 2244/2244 PASS
• Packaged native 6/6 PASS; native CTest and portable single EXE smoke PASS
• Real portable artifact ARSAS-win-x64-portable-single-exe ID 12103100384, uploaded ZIP 73,525,328 bytes
• Canonical test evidence ID 12102531808, Windows installer input ID 12101859539
• Full physical acceptance still pending for root type GVA support, GE 650 value readback and IEDScout comparison (including symbolic enum labels), read duration, and untouched RCB/Operate behavior. Keep draft, do not merge to main.

[masarray]

P0 field evidence triage — 2026-10-18 08:15 GUI / 15:16 local diagnostic / IEDScout PCAPNG

Baseline tested binary differs from PR head: user diagnostics show ARSAS v1.6.40+12f2af32be6338c82fd19d1c2515dd20225f24a2 (engine 51c2eefd). PR #621's preceding patch was 66b9d36c.... Screen captures from that binary cannot validate/reject the later focused Protection fixes.

Physical/network evidence parsed (read-only): Provided loopback PCAPNG 723 packets; 362 TCP client→server packets and 361 reverse; MMS TCP/102, destination and source 192.16.1.33 on local interface. IEDScout request payload contains a batch confirmed MMS Read service (A4) naming exact FC root variables gndPTOC2$SP0, gndPTOC2$ST, gndPTOC2$CF0, gndPIOC2$SP0, XCBR1$ST, SGgndPIOC1$SG0. The capture proves grouped FC root Read, NOT arbitrary guessed leaf values or a live physical relay distinct from the host.

RCB active authority vs UI: Diagnostic 6/6 static RCB report plans routed and 18 report frames/598 process updates; all six monitored streams show RptEnaWrite=YES and GIWrite=YES. The UI's '?' comes from a code-cache timing bug: RCB UsedByCaller was stamped only when RefreshIedBrowser() rebuilt lazy tree, while BrowserActiveRcbs transitions on a later Iec61850MonitorRuntime report activation (no model/source stamp change). Fix now reconciles cached RCB list from GetActiveBrowserRcbReferences(device.DeviceId) on the existing UI flush even when ledger Version unchanged; raises per-row bound glyph notifications without tree resets. Clears ONLY locally injected caller evidence upon stop/disconnect; preserves independently read remote InUse status. Regression: P0BrowserRcbLiveOwnershipReconciliationTests.

Protection Read throughput: IedBrowserSgRootProjection/read-flight were previously SG-only. Expanded read-only typed FC root to exact LN$SP0 seen on captured wire. GetVariableAccessAttributes type with fully ordered children must validate the returned MMS structure and the exact live-model SP target/FC before projecting an observed scalar through the existing isolated association/read-result inbox/canonical ledger. Unknown/mismatched structure falls back to existing individually bounded leaf read; SE/CO not admitted and no FC root Write. Tests: P0ProtectionSp0RootFieldEvidenceTests including Boolean/enum typed member and malformed structure rejection.

Remaining independent field gates: The report screenshots still need exact-revision retest, complete per-LN stale/deferred/failed Read coverage matrix, IID/CID-matched vendor enum/proof, full XCBR CF unit proof, and verification whether the target is a simulator on the same machine (diagnostic detects 192.16.1.33 assigned locally). Do NOT equate CI with IEDScout physical parity. Exact-head CI currently running; attach results after successful completion.

Final release gate for this patch set

Exact final PR #621 HEAD: e23bf97ad4d3f72d84a48634ea5d357e4e180763. ALL 13/13 Windows workflows SUCCESS.

• SCL R7 Windows: 2333/2333 ARSAS PASS and 1136/1136 ARIEC extended PASS; R7 artifact.
• Main Windows build: 2333/2333 ARSAS PASS; 19/19 pinned ARIEC PASS; 6/6 managed native tests PASS. Portable single EXE.
• Installer validation: SUCCESS including silent install and smoke. Installer artifact.

Test-first exceptions explicitly resolved before release: empty IReadOnlySet regression test initialized with concrete HashSet; broken source replacement in typed root projector repaired; legacy SG-only assertion updated to accept SP0 as a distinct separately verified FC root while continuing to reject SP members when projecting SG. Clean-room source guard also passed.

New BCUGE recheck: Use portable/installer above and confirm Diagnostics App version=...+e23bf97..., not previous uploaded ...+12f2af32.... With monitoring running, check RCB BRB_CSWI_GW010101, BRB_EVE_GW01, URB_ALS_SOGI20101, URB_MX_SOGI10101, URB_MX_SOGI301, urcb01_4401 now show caller-active glyph ● as they appear in runtime caller-owned set. Check gndPTOC2 exact SP process/enum and raw proof after scoped Read, including PTOCEna, InMagTyp, StrVal, TmMult. UI/field status remains REQUIRES PHYSICAL IED / TARGET RECHECK despite CI passing; uploaded capture is local loopback with same-host destination/address and does not itself establish a separate physical IED.

[masarray]

P0 Protection FC-root parity continuation — 2026-10-18

Field regression: InMagTyp, StrVal, RsMod, StrMult, ExNumTr remain Not read in the previous release; PTOCEna is observed. No physical acceptance for this new patch yet.

Fixes on ARSAS consumer PR #621:

• Fair 24-target focused LN admission now reserves SP/SG and CF alongside ST/MX, avoiding status-heavy LN starvation. Full explicit Read LN retains ALL targets, but prioritizes settings/metadata.
• Removed former _targets.Count > 32 guard which DISABLED typed FC-root reads on dense PTOC/XCBR LNs. Read is bounded by 512 page targets, <=128 root members, 8 roots, and independent 5s root deadline.
• Capture shows GetNameList variable candidates LN$SP0, LN$SG0, LN$CF0, LN$DC0, LN$EX0 (not successful Read proof). Added exact typed GetVariableAccessAttributes+MMS Read for all five; accept only ordered names/types, canonical FC, actual observed values, no fabrication or SG/SE write.
• Root timeout negative-cached once per FC group; auto leaf fallback 2s max, manual leaf timeout remains 5s.
• Regression tests for busy ST LN plus eight named settings, CF/SP isolation, no target loss on full manual Read LN, old SG regression, strict evidence.

Exact PR HEAD 5633c4fae3801346b6fa311aa99da72deec0174b:

• Windows R7 SUCCESS: 2341/2341 ARSAS, 1136/1136 ARIEC engine tests.
• Main Windows build SUCCESS: 2341 ARSAS, 19 engine, 6 native tests PASS. Portable artifact.
• Installer workflow: validating from same SHA.

Still required: field recheck against BCUGE on exact SHA, especially expanded parent/leaf InMagTyp, RsMod, StrVal, TmMult/StrMult, ExNumTr; include read progress/failure and new Diagnostic Report. CI success != physical IEDScout parity. No Report/RCB control or polling changes.

[masarray]

Release gate final untuk SHA 5633c4fae3801346b6fa311aa99da72deec0174b: 13/13 GitHub Actions workflows SUCCESS termasuk installer validation, silent installation and smoke. Installer artifact, portable single-EXE. Field status remains NOT YET VERIFIED on BCUGE; inspect exact build app SHA, click Read LN and expand missing parent/leaf, capture diagnostic with FC-root/leaf errors for any remaining Not read/Unavailable. No CI pass implies physically correct enums or process readings.