CURRENT VERIFIED STAGING AUTHORITY — P10.9K GENERIC MULTI-VENDOR CONTROL SAFETY (12 OCTOBER 2026)

P10.9K supersedes P10.9J as the current CodeVerified-only STAGING head; not a new physical acceptance, not a mainline release. ARSAS staging fix/512-goose-event-header-alignment exact SHA 069890df0a007d196ba0a9498c2c5972f8ab5c5b; immutable checkpoint checkpoint/p10-9k-generic-control-069890df. Engine staging feat/495-dataset-type-closure exact SHA a43b9b4864a9565c02f544d4135fe157c2fac577; checkpoint checkpoint/p10-9k-generic-control-a43b9b4. No force push; ARSAS main remains 7d8d8026ae96d45f44d47f361d115a437af88fbe. Both PRs are merged to staging only.

• Engine: ARIEC PR #168, .NET CI #38231327892 SUCCESS. Pure, vendor-neutral Iec61850ControlSemanticResolver fails closed when declared CDC differs from corroborating live status/ctlVal; raw two-bit/integer/boolean MMS encoding alone is not permission to Operate. Bounded legacy control NameList inventory single-flight reused only within one MMS association (especially Open SCL), with complete Smart Discovery authority preferred. No control writes added.
• Consumer: ARSAS PR #541 MERGED through expected SHA guarded nonforce FF from P10.9J 858289e3.... Safe command readiness and execution gated before any MMS Write; BSC UI is Raise/Lower Tcmd, no numeric BSC tap target, INC/ISC UI numeric rather than generic directional; removed generic primitive-only dispatch and arbitrary-text changed-value confirmation. Engine pin exactly PR Release ARSAS 1.6.28 #168 with appended provenance and adversarial guard tests; all P10.9I/J and physical R7/R10 records untouched.
• Verified candidate: 14/14 workflow SUCCESS against final candidate head 069890df..., canonical Build #38233003891 SUCCESS, 1,650/1,650 ARSAS regression tests and 19/19 pinned engine smoke PASS, Windows build/packaging. Portable artifact #11739602446, installer artifact #11739587676.
• Post-promotion: staging's fresh 16-workflow PR run is in progress, Build #38233823373; do not declare final post-FF verification until all are green and tree parity is checked. See P10.9K issue #540 for work in progress.
• Still pending: actual ZIV CID Open SCL / on-site BSC command safety qualification, precise SCL EnumType-to-ctlVal authority, nested/aggregate ST model variants, strictly targeted probes, quantitative request/memory benchmarks, real multi-vendor lab matrix. Do NOT test physical regulator Raise/Lower automatically. BCUGE SqNum/BufOvfl issue #520 remains OPEN; no new reporting fallback, cyclic MMS polling, RCB/GI mutation, full discovery fallback, release/mainline promotion or hardware acceptance.

Preserved historical P10.9J and earlier handoff

CURRENT VERIFIED STAGING AUTHORITY — P10.9J ZIV SCL / BSC TAPCHG (12 OCTOBER 2026)

P10.9J supersedes P10.9I as current CodeVerified-only staging, NOT as physical acceptance. User-provided ZIV CID and two separate diagnostic reports substantiate a confirmed local SCL-plan rejection and a model semantics discrepancy. The original physical-trusted R7/R10 history and prior immutable checkpoints remain intact. P10.9I canonical report ingress safety also remains intact; BCUGE anomaly root cause #520 remains OPEN.

Reproduced defects and strict behavior

1. ZIV endpoint 192.16.1.177:102 answered TCP while P10.9I Open SCL refused before MMS with SCL_PLAN_INVALID for CID OSI-AP-Title 41,1,999,1. Earlier same-endpoint IP Discovery proved accepted MMS ACSE handshake and actual CSWI1 Open/Close. The ZIV CID uses a legacy ASN.1 BER-packed first subidentifier decimal 41=40*1+1; engine P10.9J decodes the single unambiguous value to canonical OID 1,1,1,999,1 with original SCL literal retained and explicit diagnostic warning. Other invalid/ambiguous values remain fail-closed; exact SCL IED/AP/endpoint authority preserved, no discovery substitution.
2. The CID declares ZIVAVRLD1/ATCC1.TapChg as CDC=BSC, ctlModel=4 (SBO Enhanced) and separate valWTr.posVal ST numeric feedback. Its Tcmd enum values are stop=0, lower=1, higher=2, reserved=3. IP Discovery previously inspected this control but labeled it DPC with Bad state because the short 2-bit ctlVal appeared like a switch. New engine identifies exact BSC from the live ST status path; consumer provides Raise/Lower (never DPC Open/Close or absolute numeric position), qualified Tcmd codes 1/2, rejects unsupported live MMS shape and invalid inputs, and only declares movement confirmed after numeric feedback changes in the requested direction. No control is automatically sent and tests are synthetic.
3. Runtime static selection remains 8 exact DataSet member rows, no cyclic MMS process-value polling; RCB/GI/decoder, discovery scope, and original current-state semantics remain intentionally untouched by this fix. Historical BCUGE SqNum/BufOvfl warnings are unrelated and not automatically cleared.

Physical retest required

On a permitted bench, open original CID with Open SCL, choose ZIVAVR/S1 at 192.16.1.177:102, Play/Connect. Connection must advance past SCL validation to MMS handshake, then verify it reports current static DataSet values and lists TapChg with BSC / SBO Enhanced / Raise-Lower and numeric valWTr.posVal. Do not command a physical regulator as a connectivity probe: tap Raise/Lower requires explicit authorized procedure and an independently safe device state. No claim of actual ZIV association/operate success on P10.9J before operator evidence. The original CID/real capture was not committed to public repos; deterministic sanitized tests only. Issue #538 tracks this.

CURRENT VERIFIED STAGING AUTHORITY — P10.9I BOUNDED CANONICAL MMS REPORT INGRESS (2026-10-12)

P10.9I supersedes P10.9H as current code-only staging authority. Physical R7/R10 authority and historical immutable checkpoints remain unchanged. This fixes a source-proven independent client ingress reliability defect (unbounded canonical InformationReport queue and hidden terminal receive fault), not GE/BCUGE BRCB SqNum/BufOvfl causality, which remains Issue #520 OPEN.

Proven cause, functional protection and tests

Engine baseline MmsReceiveRouter used an unbounded canonical Queue<MmsPduEnvelope> (unlike already bounded secondary subscribers), and terminal receive pump exceptions faulted pending confirmed operations and optional observers but were not signaled to the canonical static-report consumer. Engine P10.9I enforces maximum 2,048 canonical report envelopes / 32 MiB queued MMS PDU payloads, preserves already accepted FIFO order, explicitly faults on overload (no DropOldest), propagates terminal receive errors to the canonical monitor, and resets only on association/router reset. No new network polling/timer/task-per-report or RCB/GI writes.

Four new targeted engine regression tests cover bounded count, bounded byte budget, subscriber wake on terminal fault, and receive pump overflow/confirmed fault. Consumer P10.9I changes only integration lock/guard/test files, adds six negative mainline-guard and three resolver fixtures, keeps P10.9G code-only ancestry and physically accepted historical authority intact. First consumer candidate 60783e72... failed two stale provenance assertions (out of 1,615), was not promoted; second candidate 0d00fe33... updated precisely those tests and passed 14/14 candidate workflows. No production application reporting/discovery/GOOSE/SV source changed on the consumer side.

BCUGE field reality unchanged: 67/67 displayed, 6/6 static RCBs, 0 cyclic MMS polling, 27 BRCB SqNum discontinuities, 2 BufOvfl in last real test. This code-only hardening does not prove GE simulator/network attribution, TCP wire order or lossless SOE. Independent authorized packet/server evidence remains required. Issue #536 tracks this milestone.

CURRENT VERIFIED STAGING AUTHORITY — P10.9H IEC CONTEXT-AWARE DIAGNOSTICS (2026-10-12)

P10.9H supersedes the P10.9G staged head below; all prior field-tested checkpoints/physical evidence remain unchanged. Do NOT infer that an external GE/BCUGE SqNum or BufOvfl root cause has been fixed; report-only static acquisition and original continuity warnings are unchanged.

Real scope

Operator BCUGE 07:27 WIB 12 October field diagnostic: 67/67 visible points, six/six routed static RCBs, 80 InformationReports, 603 process updates, zero cyclic polling; 27 observed BRCB SqNum discontinuities (21 CSWI GW, six EVE GW), 2 BufOvfl, all four URCBs without findings, raw OptFlds metadata 80/80. The latest CSWI SqNum 4→1, not GI tagged, was observed ~48.574 seconds after RCB start-return. Therefore startup-only diagnosis is factually false. Actual on-wire packet sequence and event completeness still unverified; do not suppress counters or blame GI.

Confirmed application defect corrected: the existing route note treated multiple local IPv4 aliases on a single KM_Test interface as competing NICs and incorrectly advised disabling adapters or changing interface metrics. It also treated IP 192.16.1.33 assigned to the same PC like a remote physically connected IED. P10.9H deduplicates by Windows NetworkInterface.Id, identifies locally assigned endpoint and actual multi-interface ambiguity, retains full adapter matrix/OS-derived UDP route, and preserves gateway possibility even if no direct subnet match. No OS changes performed.

IEC-aware BRCB interpretation: one extra bounded diagnostic line per anomalous BRCB summarizes GI-tagged SqNum discontinuities, those lacking confirmed GI reason (unknown remains unknown), advertised BufOvfl, elapsed milliseconds to last anomaly, and flags recurrence >5 sec as NOT startup-only. Never claims absence/presence of lost SOE, harmless GI reset, or original TCP wire ordering. Uses existing association-local metadata; no new packet copies, tasks, polls, timers, buffers.

Files changed: ONLY Services/DiagnosticReportBuilder.cs plus new tests/ARSAS.Tests/ContextAwareIec61850DiagnosisTests.cs. Seven new deterministic regression tests and normal tests passed. First candidate SHA 9a52679... failed exactly one new wording test (the route text contained "unreachable" in a negated sentence); fixed in second commit 14399369..., exact head 10/10 CI green. Never merged the failed SHA.

Issue #535 records this milestone. External BRCB causality Issue #520 remains OPEN. No operator repeated identical diagnostic logs needed to validate the local interface advice and conservative IEC-context classification. Next genuine BRCB causality step requires independently authorized server/wire proof or reproducible simulator fault, not speculative RCB reconfiguration.

CURRENT CODE AUTHORITY — P10.9G REPORT SUBSCRIBER INTEGRITY (12 October 2026)

Supersedes P10.9F staged HEAD below; keep older physical R7/R10 proof unchanged. This is an engine routing safety hardening for secondary subscribers, not a claim that the external BCUGE BRCB source was fixed. No new physical acceptance is asserted.

Meaningful functional change and strictly bounded inference

New engine MmsReceiveRouter fixes a real silent oldest-message drop in optional SubscribeInformationReports secondary observers. Former Channel.CreateBounded(capacity=32, FullMode=DropOldest) discarded oldest frames without notification; corrected Wait + nonblocking TryWrite faults only the slow subscriber with IOException and leaves its original queued entries readable; canonical persistent-report FIFO, fast subscribers and confirmed MMS operations remain unaffected. 3 deterministic tests: 80 ordered reports / cap 8 loss visibility + main FIFO intact, slow/fast observer isolation and confirmed response, full-capacity consume/replenish. O(capacity) subscriber memory and O(subscribers) normal fan-out; no blocking network loop, unbounded buffer or per-report task.

Critical distinction: user BCUGE 12-Oct real Discovery report (app merge-test 76c1f5348739be83f6a8684b93ff9ac958039d0e, engine P10.9F fa93...) had 80 frames, 67/67 values shown, 6/6 routed, zero cyclic MMS polling, 21 BRCB SqNum discontinuities and 2 BufOvfl clustered within 300ms startup. The actual ARSAS persistent static reporter drains the separate canonical FIFO, NOT the secondary subscriber channel fixed here. So neither those BRCB discontinuities nor physical lossless SOE are certified resolved by P10.9G. External #520 remains open; do NOT ask operator for identical diagnostics merely to verify an unrelated subscriber hardening.

Consumer integration changes only five files: existing lock + additive reportSubscriberIntegrityTrial exact fa93... → d700... ancestry/CI/PR #165/issue #532, pre-existing CodeVerified helper, three existing Windows regression classes including negative SHA/parent/CI/physical/mainline tests. No workflow created, no static monitoring/RCB/GI/decoder/network/GOOSE/controls/cyclic polling code changed; historical physically accepted SHA never rewritten.

Before successor work: verify current exact staging ref and 16 post-promotion CI status; respect all immutable checkpoints and no accidental main release.

CURRENT ARSAS CODE AUTHORITY — P10.9F CODE-ONLY STAGING (2026-10-12)

This current integration HEAD supersedes the previous P10.9C stage head and the P10.9D–E BLOCKED integration note below. Historical physically tested R7/R10 metadata is UNMODIFIED; do not interpret code-only integration as fresh physical acceptance. Exact GitHub checks below verified before guarded FF; do not automatically claim 16 post-FF staging workflows passed until verified separately.

Why this is a FUNCTIONAL milestone: ARIEC client now quarantines an InformationReport carrying matching RptID but explicitly conflicting domain-qualified DatSet before projecting values by positional DataSet members. Existing missing/short DatSet compatibility retained. This is an actual data-integrity fix in the compiled ARSAS core. ARIEC standalone simulator sender additionally uses one FIFO consumer/association instead of competing report-per-Task.Run writers, preventing out-of-order simulator MMS sends. Simulator project is NOT bundled into ARSAS application; do not attribute external BCUGE behavior to simulator FIFO.

Gate strategy: Issue #531 P10.9F resolved previous 10/14 CI failures with exactly one reusable PowerShell 5.1/7 code-only SHA/provenance helper scripts/test-p10-9f-core-routing-trial.ps1, additions to existing resolver and three existing workflows, plus three existing regression classes and additive coreReportRoutingTrial lock metadata (9 total files vs original one-file draft pin). Literal exact SHA fa93... and ancestry 00ad... → ef0f... → fa93..., immutable historical association and R10 metadata, exact upstream CI run IDs and issue/PR IDs, fail-closed negative mutations and mainline guard were validated in all candidate workflows. No special product vendor detection, timers, polling, GI changes, decoder rewrites, new workflow, main merge or release.

Operator acceptance: single targeted test of ordinary Open SCL and Discovery reporting to ensure zero regression in 67/67 displayed static values, 6/6 routed RCBs and zero cyclic MMS polling; not another identical pair of diagnostic-only reports. External BCUGE still had 19 SqNum discontinuities and two BufOvfl each ingress before this fix; root cause has NOT been proven/cleared by this milestone and remains open Issue #520. Future wire-level capture only for a new, permissioned causal hypothesis.

ENGINE P10.9D / P10.9E SOURCE FIXES — COMPLETED UPSTREAM; ARSAS INTEGRATION BLOCKED (2026-10-11)

Do NOT change the P10.9C ARSAS safe/current code authority defined below. This is an additive engineering update, not a promotion. Operator asked to stop repeating diagnostics and get functional fixes.

• Engine P10.9D: ARIEC PR #163 MERGED; exact CI #38141582981 SUCCESS; immutable checkpoint checkpoint/p10-9d-simulator-report-fifo-ef0fe44f at ef0fe44f3b40e47dc18b1aac4476b635e67d531e. Single async FIFO sender/association removes simulator report-per-Task.Run race with deterministic two-GI blocked-send test. Simulator code is NOT in the ARSAS client dependency. It does NOT prove the cause of GE BCUGE SqNum or BufOvfl.
• Engine P10.9E: ARIEC PR #164 MERGED; exact CI #38142115574 SUCCESS; immutable checkpoint checkpoint/p10-9e-report-header-guard-fa93c9fd at fa93c9fdc7cd98fd3624227ee21c3eefc68bcac7. Core MMS RptID/DatSet contradiction is fail-closed before member-value projection; four new tests, preserves short/missing DataSet compatibility. Engine staging now fa93..., engine main unchanged. Actual SCADA safety fix, but not diagnosed as BCUGE external SqNum cause.
• ARSAS consumer attempted, BLOCKED: draft PR #530, commit 3e84d6951fa405f8ceb2505664f91e57827e3060 (only JSON engine pin). Exact PR-head 14 workflows: 4 successful / 10 failed. Canonical Windows Build #38142378711 compiled engine, 1590/1593 ARSAS xUnit tests passed, three provenance/physical-authority tests failed because lock no longer matches physically accepted/CodeVerified trial rules. Other R7/SCL/IO/SV/production jobs correctly fail closed on the same authority mismatch. Do not merge PR BLOCKED P10.9E — ARIEC core routing guard pin requires additive CodeVerified provenance, not merge-ready #530 and DO NOT give a Windows EXE from this failed build. This is not a failure of new engine functionality but a necessary release qualification gate.
• Next: Issue #531: qualify a deliberately bounded CodeVerified-only engine integration trial by preserving old field-verified SHA, ancestry, physical R7/R10 and mainline protection, then run the existing Windows CI once. No wholesale SHA replacement in tests/workflows.
• Unresolved: BCUGE BRCB #520, external GE Edition1/same-PC simulator still had 19 discontinuities/2 BufOvfl on each ingress in last operator report. Do not demand more identical text diag until a new independently testable causal change or permitted wire trace.

CURRENT CODE AUTHORITY — P10.9C (2026-10-11; exact SHA guarded)

Supersedes historical P10.9B / P10.9A / P10.8E / P10.8D HEAD references below; retain all older evidence and immutable checkpoints. Before successor coding always re-check live GitHub refs and exact-SHA staging CI.

P10.9C UX bug, isolated fix and field diagnostics

Operator uploaded a screenshot of Add IEC 61850 IED pre-filling hardcoded 192.168.1.10 even though prior IP Discovery was targeting 192.16.1.33:102. Root cause: MainWindow.xaml.cs had initial _newDeviceIp = "192.168.1.10", and IpConnectWizardWindow did not choose persisted last operator-submitted IP/port; old UserPreferenceStore tracked only successful endpoints. Repeated valid but failed/offline attempts therefore lost the operator's last input.

Scoped 4-file P10.9C fix: MainWindow.xaml.cs initial IP becomes blank, and only AddRelay_Click opts in to preferLastDiscoveryEndpoint: true. IpConnectWizardWindow.xaml.cs loads persisted last Discovery IP/port ahead of other card defaults, obtains live editable ComboBox.Text (avoids stale LostFocus WPF binding), validates IPv4/IPv6 and port then persists at valid Connect & Discover submission BEFORE network; Cancel/invalid do not write; IOException/UnauthorizedAccessException preference failures never block network. Other uses of same dialog (e.g. EnsureSclEndpointBinding) do not auto-fill or persist the last unrelated Discovery target. Services/UserPreferenceStore.cs adds backward-compatible LastDiscoveryIpAddress and LastDiscoveryMmsPort in existing user-local user-preferences.json, preserving successful relay and signal selection profiles and legacy migration; saved Discovery IP is first in recent dropdown. No new DB, timer, background task, engine, network or admin requirement. 5 new deterministic .NET tests in tests/ARSAS.Tests/DiscoveryEndpointPreferenceRegressionTests.cs, isolated temporary JSON files, verify custom-port roundtrip, overwrite precedence, invalid/corrupt preference fail closed, legacy profile preservation, and explicit SCL opt-in boundary. Canonical Windows .NET test step SUCCESS.

Two private operator Open SCL / Discovery reports (2026-10-11 18:49 / 18:53 WIB), app merge-test SHA 405d0d17bec1f07f288374bdd3897a5469b91426 (parents P10.9A/P10.9B), ARIEC pinned SHA, share exact semantic fingerprint 439d4dc0507019533b154ed68f7f4007f39f6be92b5cd3f413ff3b84f619727e, endpoint 192.16.1.33:102, 8 static DS /124 members / 67/67 visible /6/6 RCB traffic /0 MMS cyclic process polling. Both now use identical CSWI+EVE BRCB GW slots (unlike earlier GW vs SOGI), allowing only same-slot observational comparison: Open 56 frames / 18 findings / 16 discontinuities / 2 BufOvfl; Discovery 60 /20 /18 /2. CSWI GW frames 43 vs45, each BufOvfl=1; EVE GW frames 5 vs7, each BufOvfl=1 and two later clean receive frames. CSWI chronology omittedMiddle=3 vs5, so P10.9B full-history gap metric must be UNVERIFIABLE, not fabricated. Same-slot does NOT establish TCP wire packet order, SOE losslessness, or physical R10 acceptance. Raw user reports and screenshots not committed; BRCB anomalies remain open #520.

No ARIEC code, report/SCL/discovery pipeline, RCB activation, GI, decoder, GOOSE, control, network, cyclic polling or new CI workflows changed. Parent #512 remains draft; no main/release. Next acceptance requires operator Windows GUI test: enter 192.16.1.33:102, click Connect & Discover, close/reopen ARSAS, verify exact prefilled IP/port; retry offline target; verify Cancel/invalid preservation and separate SCL endpoint flow. P10.9B BRCB causal packet-trace and engine 6400/64 partial-name blockers remain separate.

CURRENT CODE AUTHORITY — P10.9B (2026-10-11; exact SHA verified)

This top section supersedes the historical P10.9A, P10.8E and P10.8D HEAD snapshots below. Preserve older checkpoints and findings. Live status must be re-read before successor coding.

Operator evidence — repeat BCUGE reports captured 2026-10-11 18:22 / 18:24 WIB

Two private operator reports are from ARSAS 1.6.40+7bc0241f6361474a4e63f748be18097f52b84a2b, merge-test commit with P10.9A exact commit as a parent (not a new staging authority); engine 00ad2819.... Open SCL and Discovery retain identical semantic fingerprint 439d4dc0507019533b154ed68f7f4007f39f6be92b5cd3f413ff3b84f619727e; 8 static DataSets / 124 members / 67/67 displayed / 6/6 real RCB ingress / 0 cyclic MMS polling. But still different CSWI/EVE BRCB slots (GW vs SOGI); reliability A/B invalid.

Latest Open SCL 49 frames, 16 findings, 13 discontinuities, 3 BufOvfl; CSWI BRB_CSWI_GW010101 39/39 fully retained receive frames and SqNum 12→1, GIreason NO, BufOvfl NO, frame#38, 19,734.103 ms after previous received frame and 20,041.650 ms after RCB start-return, with one later clean report. Discovery 50 frames, 14 findings, 11 discontinuities, 3 BufOvfl; CSWI BRB_CSWI_SOGI101 40/40 fully retained and SqNum 8→1, GIreason NO, BufOvfl NO, frame#39, 19,615.422 ms receive gap and 19,904.610 ms after start-return, one clean report after. EVEGGIO on both ingresses has exactly two GIreason YES+BufOvfl YES frames (SqNum 0/0, changed EntryID) and zero clean follow-up. These are decoder receive-order observations, not captured wire chronology, confirmed lost SOE, timer/root-cause identification, or real hardware R10 acceptance. Full user reports never committed. Issue #520 has detailed triage.

Exactly scoped P10.9B change, validation and boundaries

Only scripts/compare-p10-brcb-sessions.py + scripts/test-compare-p10-brcb-sessions.py changed, with 25 fixture tests (19 existing + 6 new) run in canonical Windows CI and passed. P10.9A opt-in --independent-triage gains full bounded decoder receive chronology gate, including declared first+recent count, 1..N contiguous frame indices, omitted-middle guard, valid timezone-aware monotonic callback timestamps. Where fully covered, expose max receive gap plus strongest non-GI, non-BufOvfl, documented finding with backward/repeat SqNum after a gap (frame IDs, counters, times). Otherwise output UNVERIFIABLE with null metrics, never fabricate timelines. Existing strict default same-slot compare() preserved. Usage:
python scripts/compare-p10-brcb-sessions.py OpenSCL-Diagnostic.txt Discovery-Diagnostic.txt --independent-triage --output ReceiveGapEvidence.json.

No engine, IEC/MMS networking, report activation, GI/RCB state machine, SCL/discovery, decoder, GOOSE, control, cyclic polling or new workflow changes. No main merge or public release. Open blockers: actual MMS packet/association trace and same physically free RCB slot (#520), buffered SOE continuity, engine NameList 64-page/6400-name partial (#162), physical GE R10 and GOOSE E2E. Do not hide BufOvfl or alter decoder based on these reports; future evidence must use safe simulator data indications and permissioned wire capture.

CURRENT CODE AUTHORITY — P10.9A (2026-10-11, post-FF verified)

Supersedes historical P10.8E/P10.8D HEAD snapshots below. Re-read live refs and exact-SHA GitHub Actions status before any successor change.

New operator evidence and P10.9A code scope

Private user-uploaded 2026-10-11 17:29 / 17:32 WIB Open SCL and IP Discovery full BCUGE diagnostics are generated by app merge-test SHA f4b07d454215f14dc659e2e9e57e3cfea62b4e98 (verified parents P10.8D and P10.8E); pinned ARIEC 00ad2819.... Both show 8 static DataSets / 124 ordered members / 67/67 runtime values / 6/6 real static RCBs routed / 0 cyclic MMS process polling and matching 7-row semantic fingerprint 439d4dc0507019533b154ed68f7f4007f39f6be92b5cd3f413ff3b84f619727e. Full raw reports not committed. Issue #520 records extracted metadata.

Critical: Open SCL selected CSWI/EVE GW BRCB slots, while Discovery selected SOGI BRCB slots; fail-closed paired reliability A/B remains mandatory. 13 vs 7 findings does NOT establish better Discovery. Each ingress has total BufOvfl=3. CSWI both have six actual later frames without subsequent findings; EVEGGIO only two initial GI+BufOvfl frames (SqNum 0 then 0, changed opaque EntryID) and zero post-finding frames. Observed last anomaly after RCB start-return: CSWI Open 267.880ms / Discovery 240.127ms, EVE 30.870ms / 30.752ms. No on-wire packet ordering or physical SOE losslessness proof.

P10.9A changes only scripts/compare-p10-brcb-sessions.py and scripts/test-compare-p10-brcb-sessions.py, no new CI workflow. Adds explicit opt-in --independent-triage to reuse original offline parser, output separate per-ingress BRCB BufOvfl/SqNum/GI/post-finding/RCB-lifecycle timing evidence, and mark different-slot pairing blocked. Original strict default compare() behavior unchanged. Missing optional GI/time fields become unknown, not fabricated zero, and impossible summary counts fail. Existing 13 tests plus 6 new positive/negative = 19 tests passed by canonical Windows CI. No ARSAS runtime/engine/decoder/RCB state machine/GI setup/network I/O/control/GOOSE/polling change.

Example: python scripts/compare-p10-brcb-sessions.py OpenSCL-Diagnostic.txt Discovery-Diagnostic.txt --independent-triage --output IndependentTriage.json. Default without flag still rejects cross-slot comparison.

Still open / NEVER claim solved: BRCB startup overflows, underlying server-versus-consumer receive/wire-order cause and buffered SOE continuity (#520); ARIEC 64/6400 partial NameList (#162); GOOSE end-to-end configuration/packets; physical R10 qualification. Next causal step: genuinely free same physical RCB slots in both ingresses, simulator-safe non-control indications and authorized timestamped MMS wire trace. No PurgeBuf, slot takeover, control command, dynamic process polling or main/public release.

CURRENT CODE AUTHORITY — P10.8E (2026-10-11, post-FF verified)

This section supersedes the P10.8D HEAD in the historical handoff below; prior findings and immutable checkpoints remain valid.

Scope: P10.8E changes only scripts/compare-p10-brcb-sessions.py and scripts/test-compare-p10-brcb-sessions.py: the offline exact-BRCB-slot comparator now includes per-slot decoded BufOvfl=true frame counts and rejects missing/impossible BRCB overflow metadata. 13 Python fixture tests (9 existing + 4 new) passed in the exact canonical Windows job. No runtime decoder, ARIEC engine, MMS requests, RCB activation, GI, controls, dynamic polling, UI, GOOSE or SCL semantic changes. Comparator continues to emit SAME_SLOT_OBSERVATION_ONLY; NOT SOE lossless, NOT wire-order evidence and NOT physical R10 qualification. Root cause of historical 13 findings / 10 Sq discontinuities / 3 BufOvfl requires authorized same-slot MMS wire capture as in Issue #520. Engine 64-page NameList budget remains ARIEC #162.

ARSAS / ARIEC61850 — CANONICAL THREAD HANDOFF: P10.8D

Snapshot verified directly against GitHub on 2026-10-11. This issue is the durable thread-handoff index, not an authorization to merge, release, or change IEC 61850 wire behavior. A successor thread MUST re-read actual GitHub refs and CI before work, since branches can advance after this snapshot.

0. FIRST READ / EXACT CODE AUTHORITY

CRITICAL: ARSAS staging has ALREADY advanced from P10.8A a7f4edbf... through P10.8B → P10.8C → P10.8D. Do NOT start coding from older P10.8A or P10.6 just because previous thread messages mention them. The latest HEAD ce73df3a... is descended from P10.6 by 22 commits and behind=0 as of this snapshot.

1. PROTECTED OPERATOR-VERIFIED MILESTONE — P10.6

Formal, immutable P10.6 milestone #518:

• checkpoint/p10-6-field-verified-bcuge-parity-a8835102 → a883510218c62ac02096de37e831feede389f4a1. Do not move/rewrite this checkpoint.
• GE F650 Edition 1, same-PC authorized KM_Test simulator, endpoint 192.16.1.33:102, trusted original engineering BCU_GE.iid (IID SHA256 2776bf5b26d1c8dbac8a00e88149931d0787b8493896106af217951e71df3002).
• Open SCL explicitly resolves IEDName BCUGE, AP S1. IP Discovery after previously verified IID-assisted association also resolves BCUGE with TrustedSclExactDomainMatch (High). Original MMS wire-domain remains BCUGEF650, LD alias F650. Do not heuristically infer IEDName from MMS domain prefix.
• Both paths verified 8/8 static DataSets, 124/124 ordered members, 67/67 unique monitored values, 6/6 real static RCBs receiving InformationReports, 0 cyclic MMS process polling. Report-only authority is essential.
• Independent user-submitted Open SCL and Discovery Diagnostic Reports show 7/7 identical static semantic rows and identical SHA256 439d4dc0507019533b154ed68f7f4007f39f6be92b5cd3f413ff3b84f619727e. Do not turn historical AWAITING PEER INGRESS into fake runtime MATCH without a real peer-capture process.
• Passing these means simulator identity/static semantics/report-routing, not complete MMS discovery model and not lossless BRCB SOE.

2. CHRONOLOGY OF VERIFIED INTEGRATION / CHECKPOINTS

Every listed PR merged into the ARSAS staging parent branch only, by guarded non-force fast-forward. Historical checkpoints are not to be reset.

P10.1/P10.2 main-CI ancestry reconciliation (#514), P10.3/P10.4 offline trusted-IID structural evidence (#515), and P10.5 unique static signal coverage (#516) are already in this lineage. Do NOT redo them.

3. WHAT P10.8D ACTUALLY DOES (NOT A WIRE FIX)

• Services/Iec61850ReportContinuityInspector.cs: constant-memory, association-local BRCB chronology first 32 / latest 8 decoded metadata frames; lazy independent latest 8 anomalous metadata frames; no raw opaque EntryID bytes, no process values or full MMS PDUs.
• Services/DiagnosticReportBuilder.cs: bounded BRCB chronology, BRCB anomaly history, per-RCB RCB triage and RCB follow-up. Historical warnings and BufOvfl preserved.
• scripts/compare-p10-brcb-sessions.py: offline-only comparison of two operator Diagnostic Reports. FAILS CLOSED unless IEDName, engine SHA, static semantic fingerprint, exact BRCB slot reference SET and per-slot DataSet match. Compares counts/receive chronology only. Explicit status SAME_SLOT_OBSERVATION_ONLY; never establishes network wire order or lossless SOE.
• scripts/test-compare-p10-brcb-sessions.py: 9 negative/positive fixtures, invoked by canonical Windows .github/workflows/build.yml.
• Focused C# tests: tests/ARSAS.Tests/P108BBoundedReportChronologyTests.cs, tests/ARSAS.Tests/P108CAnomalyChronologyTests.cs; older P10.7/P10.8A tests retained. No protocol-side code/engine modifications in P10.8A/B/C/D.

To use offline comparator from the repository root with Python 3:

python .\scripts\compare-p10-brcb-sessions.py "C:\field\OpenSCL-Diagnostic.txt" "C:\field\Discovery-Diagnostic.txt" --output "C:\field\P10-BRCB-Comparison.json"

Use actual paths and preserve original diagnostic files. If BRCB slots differ, do not bypass rejection or relabel slots to fake comparable tests.

4. REMAINING BLOCKERS — DO NOT MARK DONE

1. ARSAS BRCB continuity investigation #520: GE simulator BRCB CSWI and EVEGGIO startup shows up to 13 findings / 10 SqNum discontinuities / 3 BufOvfl in same GW RCB-slot captures. Changes in SqNum with opaque EntryID and GI may reflect server replay/buffer state or receive-order issues; NOT yet conclusively attributed. Need authorized actual MMS packet-order evidence, deterministic safe simulated indication changes after GI (no breaker controls), and same actual free RCB slots across ingress. Do not suppress warnings or call SOE lossless because new post-startup reports arrived. A BRCB with only 2 total frames cannot be considered proven healthy based on time alone.
2. ARIEC NameList completeness #162: live discovery bounded 64 pages / 6,400 NamedVariable names, complete=False, incompleteChains=1; 65 LN / 897 DO / 6,274 DA live vs 153 / 2,228 / 14,668 engineering design are different measurement scopes. Need bounded, deferred, cancellable and resumable discovery completeness; do NOT blindly increase page cap or degrade fast first-pass discovery latency.
3. Original IID GOOSE bindings: missing/invalid APPID/MAC, empty/invalid GOOSE dataset and confRev=0 in supplied engineering source. Actual end-to-end GOOSE not proven. Do not suppress discrepancies or invent SCL values.
4. GE real physical relay acceptance is NOT DONE: simulator != independent substation BCU. Actual original IID + authorized relay capture required for physical R10 qualification. Historical R10 evidence belongs to a different device and cannot be silently reused.
5. ARSAS PR GOOSE UX: tidy event header alignment without altering capture #512 and engine PR Show full-resolution IEC 61850 timestamp on FAT hover #157 remain OPEN DRAFT. Do NOT merge to either main or public-release an unqualified P10 trial.

5. SMART / EFFICIENT NEXT WORKFLOW FOR THE NEXT THREAD

1. Call GitHub connector (or API) and re-read both staging refs, lock JSON, PR GOOSE UX: tidy event header alignment without altering capture #512, PR Show full-resolution IEC 61850 timestamp on FAT hover #157, milestone MILESTONE LOCK: P10.6 BCUGE IED identity + 7-row static parity verified on simulator #518 and issue P10.8: isolate BCUGE BRCB BufOvfl and SqNum/EntryID discontinuities with same-slot wire-order evidence #520, Restore first-run SCL, IP and Excel launcher cards #162; inspect latest workflow runs and checkpoint list. Stop if SHA differs, understand newer changes rather than overwrite them. The present snapshot is P10.8D ce73df3a....
2. Review user-provided new P10.8D field reports if present; files were previously attached in chats, not committed to public GitHub. If files are missing, request them; do not infer raw packet sequences from synthetic tests.
3. Run offline same-slot comparator with actual Open SCL / IP Discovery reports; explicitly distinguish per-session counters from deltas within one association. If no comparable same-slot evidence, make only minimal observability improvements (or focus on independent issue Restore first-run SCL, IP and Excel launcher cards #162), never rewrite RCB activation logic speculatively.
4. For new engineering milestone, create a new isolated branch from the latest verified staging HEAD, minimal typed change and focused positive + negative tests. Prefer O(1) hot path, bounded memory, fixed-size evidence, per-device cancellation, original engine APIs and exact SHA pins; no naive polling/dynamic fallback. Avoid rebuilding full CI repeatedly: let one canonical Windows build run and reuse tested artifact/proof in other workflow checks.
5. Require exact-SHA CI green, record portable EXE GitHub Actions artifact, audit diff vs baseline (runtime, engine lock, reporting, GOOSE, controls), guard FF update with expected_sha, create a new immutable checkpoint, then fast-forward staging only. No force-push or main merge. Maintain parent PR comments + this issue with current authority.
6. For field test, original independent trusted IID first (Open SCL + successful association once), then IP Discovery to same endpoint, Static DataSet in both, verify 8/124/67/6 and no cyclic polling. For BRCB, capture complete timestamped same-slot MMS wire order if allowed; no PurgeBuf or RCB ownership takeover, no device control commands.

6. HANDOFF RULE

The next thread should treat GitHub code/ref state as authoritative. This issue preserves the verified context and stop conditions; do not treat a prior assistant's promise, a successful mock fixture, historical different-device R10 evidence, or a green CI alone as field certification. Keep updating this issue with each new checkpoint, changed scope and evidence.

Related source of truth: ARSAS parent PR #512, engine PR #157, milestone #518, BRCB investigation #520, NameList #162.