docs: repair GOOSE handoff and preserve exact RCB report authority acceptance

docs/WORKBENCH_CURRENT_HANDOFF.md

@@ -1,21 +1,24 @@
 # Native Qt IEC 61850 Workbench — current cross-thread handoff
 
-> **Updated:** 2026-10-16 (WIB), snapshot only; always refresh GitHub refs and PR state before editing.
+> **Updated:** 2026-10-17 (WIB), snapshot only; always refresh GitHub refs and PR state before editing.
 > **Primary strategy and ownership contract:** [WORKBENCH_ARSAS_GUI_SSOT_STRATEGY.md](WORKBENCH_ARSAS_GUI_SSOT_STRATEGY.md).
 > **Scope:** installed native ARStack Workbench in apps/ied_simulator. Not a web app, WPF clone, or the separate ESP32-P4/SMV Studio track.
 
+## P0 exact RCB InformationReport authority — 2026-10-17 (WIB)
+
+- **Integrated main:** `a33271e90fea369abad551e7601b446752e10d54` ([PR #203](https://github.com/masarray/arstack61850/pull/203) MERGED). Exact source head `723ad3f46728b864c91e553820e410ab4171ad9a` passed **13/13 workflows**, including native IED Simulator Qt 55/55 steps, C++ GCC/Clang/Windows MSVC, Security ASan/UBSan/libFuzzer, SCL-assisted, dynamic RCB, BRCB, interoperability and naming guard. All code-review threads resolved. This is automated replay/protocol gate evidence, **not** physical relay interoperability acceptance.
+- **Critical issue closed in source:** original subscription mapped every incoming InformationReport against the selected RCB DataSet before proving source ownership; Inspector filtered only by RptID. New authority boundary checks exact RptID *before* mapping and then validates optional DatSet/ConfRev (when present), ordered unique inclusion indexes and wire DataRef against exact directory identity before exposing process values. Foreign/stale reports are rejected, counted separately from decode failures, and never enter continuity stream.
+- **Browser output:** each accepted frame carries its association's active RCB reference, and Inspector requires both exact RCB reference and RptID where known. Bounded lifecycle events include explicit GI sent/not sent/failure and a warning on rejected frames/decoder errors, not an invented successful subscription.
+- **Static RCB safety:** discovery-chosen DataSet reference is pinned across the live activation probe and compared with the fresh RCB readback before any write; mismatch fails closed. GI is a Write trigger, removed from both targeted SCL attach Read set and subscription Read set. URCB reservation / BRCB separation, guarded TrgOps/OptFlds, RptEna-last and cleanup ownership remain one existing C++ runtime authority (no second decoder or polling association).
+- **Regression:** native C++ tests for valid and foreign RptID, wrong DataSet, ConfRev change, out-of-order/duplicate indices, wrong/swap/empty DataRef, typed MMS DataRef, missing directory, valid minimal OptFlds; scripted MMS transport rejects foreign report then accepts good report without poisoning counters, and rejects a live RCB DataSet rebind before writes. Existing Qt GOOSE/Browser reports smoke, SCL, 3-platform MMS, interop and sanitizers are required.
+- **Physical acceptance outstanding:** verify on an actual IED with exact selected static URCB/BRCB instance; verify RptEna/Resv/Owner readbacks, GI Write outcome (not merely request), optional-fields profile, first report's real RptID and DataRef, index/member order and quality/time, disconnect/reconnect and RCB cleanup. This is not physical manufacturer interop certification. It remains impossible to infer which of two identical wire RptIDs emitted a frame without additional uniqueness/association evidence.
+
 ## M2N native Browser GOOSE Subscribe + ARSAS/ARIEC parity — 2026-10-16 (WIB)
 
 - **Integrated `main` at this checkpoint:** `71580659f28c49207db94efd7f7d302d5fd12901`, [PR #200](https://github.com/masarray/arstack61850/pull/200) MERGED after exact-head `4df620874bdab9c0bf280d31a342c12dfa6ab38a` **3/3 relevant workflows SUCCESS**: 55/55 native IED Simulator Qt job steps, SCL-Assisted Workbench CI and Product Naming Guard. Three P1 review findings fixed/answered/resolved. Exact post-merge main jobs (IED Simulator Qt, SCL-assisted, Release Hardening) were still running; verify separately.
 - **Reference-backed root cause:** `BrowserGoosePane.qml` previously presented only canonical configured SCL/control-block data, while `GooseWorkspace` already received real Ethernet GOOSE via `GooseMonitorController`, bounded AF_PACKET/Npcap, native `GooseFrameCodec`, sequence/TAL supervision and PCAP export. Cross-checked ARSAS `docs/GOOSE_SUBSCRIBER.md`, `GooseSubscriberRuntime.cs`, `GooseSubscriberLiteView.xaml` and ARIEC `GooseFrameParser.cs`. This ports missing capability into the existing native owner; **not** a duplicate parser, second NIC socket, .NET app, timer, poller or cache.
 - **User-visible capability:** Browser → GOOSE has explicit interface picker, Refresh NICs and GOOSE Subscribe/Stop for the *shared passive* monitor; never silently auto-select first NIC. The selected configured stream displays actual matching wire stNum/sqNum, packet/timeout state and decoded ordered `allData`. After capture stops, retained values are clearly historical, not live. The full Sniffer remains available.
-- **Identity and safe engineering naming:** exact case-preserved `goCBRef` and available DataSet, APPID (SCL hexadecimal), destination MAC, goID and VLAN/PCP; typed live MMS `LD/LN.GO.gcb`/ `LD/LN.DataSet` → canonical `$GO# Native Qt IEC 61850 Workbench — current cross-thread handoff
-
-> **Updated:** 2026-10-16 (WIB), snapshot only; always refresh GitHub refs and PR state before editing.
-> **Primary strategy and ownership contract:** [WORKBENCH_ARSAS_GUI_SSOT_STRATEGY.md](WORKBENCH_ARSAS_GUI_SSOT_STRATEGY.md).
-> **Scope:** installed native ARStack Workbench in apps/ied_simulator. Not a web app, WPF clone, or the separate ESP32-P4/SMV Studio track.
-
-/`$DataSet` wire conversion only (no global dot replacement). No APPID-only guesses; malformed/ambiguous/wrong-publisher evidence rejected. A model member is labeled with an observed value **only when the configured ConfRev AND DataSet member count agree**. Otherwise raw allData remains visible, explicitly unbound, with mismatch warning, no invented FCDA mapping.
+- **Identity and safe engineering naming:** exact case-preserved `goCBRef` and available DataSet, APPID (SCL hexadecimal), destination MAC, goID and VLAN/PCP; typed live MMS `LD/LN.GO.gcb`/ `LD/LN.DataSet` → canonical `$GO$`/`$DataSet` wire conversion only (no global dot replacement). No APPID-only guesses; malformed/ambiguous/wrong-publisher evidence rejected. A model member is labeled with an observed value **only when the configured ConfRev AND DataSet member count agree**. Otherwise raw allData remains visible, explicitly unbound, with mismatch warning, no invented FCDA mapping.
 - **Bounded performance:** one `GooseMonitorController` for the application, 256 streams/256 members/256 events/4096 retained packets/64 packets per poll; NIC enumeration cached behind its own `interfacesChanged`, refreshed only on command and never per incoming frame. Multiple IED tabs reuse the one monitor with strict stream binding, not multiple receivers.
 - **Regression:** `ied_goose_workspace_qa` replays generated native GOOSE publisher PCAP; checks exact matching, allData order, canonical MMS references, wrong APPID/DataSet/MAC/goID/VLAN, malformed identity, case sensitivity, competing publishers with same ref/APPID, plus existing TTL/sequence/PCAP capacity. Qt QML smoke and rendered Browser routing passed on exact PR SHA. This is test evidence, **not** field IED capture or manufacturer interoperability certification.
 - **Outstanding product gates:** test on physical publisher/relay and selected Windows Npcap NIC (including VLAN/offload/network path and physical frame receipt), validate ConfRev/FCDA values with real SCD, time-to-first-observation, Windows installed Workbench package, and independent reporting/RCB controls. No guessed GOOSE subscription acknowledgements or device state changes. Separate ESP32-P4/PTP/SMV Studio track remains independent.