M2.6B: hierarchical LN/DO/DA/BDA Browser and raw report q/t wire authority

[masarray]

Physical AA1E1F06R4 comparison (user screenshots)

• DataSets: primary values arrive via static Report, q shows "good" but individual Quality flags Not exposed, t shows a timestamp but clock-quality children Not exposed. Reference app shows verified q/t subfields.
• Data Model: LN / DO selection shows a flat object/navigation list in right panel rather than a hierarchical live model.

Implementation

• Remove model LN/DO from generic right-hand navigation-card shortcut. LN opens lazy DO rows (distinct DO glyph, value from schema-proven scalar alias), DO opens actual structured DA/BDA hierarchy; reuses existing virtualized flat detail projection, including native q/t children, not new UI framework or per-tick recursive model walk.
• Capture q/t typed wire payloads from pinned ARIEC MmsReportFrame before normalized text projection. Unique root-level Quality (13-bit decoded only) and UTC-Time (8 original byte engine forensic evidence only) in a reported DO structure are candidates. Direct q/t members are supported; multiple q candidates / nested inference / synthetics fail closed.
• Runtime validates exact DataSet membership and FunctionalConstraint, maps to model-declared DO.q and DO.t in O(reference depth), and publishes typed Report channel evidence after normalized displays so "good"/ISO strings never overwrite the authoritative bit properties. Never enable RCB, GI, or MMS polling.
• Explicit read-only MMS Read q now retains typed original Quality evidence alongside existing engine UTC-Time evidence; association fences and Report/Read precedence remain intact.
• Add focused positive/negative tests for raw payloads, ambiguity, stale association, LN/DO hierarchy, nested DA/BDA.

Gate

Draft stacked on green PR #559. Run exact-SHA Windows WPF, ARIEC, full ARSAS, packaged native, CTest, portable EXE smoke and actual downloadable preview. No public main merge; field relay acceptance to follow.

[masarray]

M2.6B implementation checkpoint (NOT YET CI-GREEN): head 5d30b8f6f758d3cb09cce279937e7b2e8d1b0bee, stacked on fully verified PR #559. Real physical AA1E1F06R4 screenshots exposed flattened Data Model LN/DO navigation and q=good/t timestamp without individual flags. Implemented unified lazy DO→DA→BDA right-panel detail, exact 13-bit original MMS q / eight-byte UTC-Time t ingress from pinned ARIEC report frames (direct q/t or unambiguous immediate DO-structure children), schema/FC/DataSet owner guards, typed association-fenced Browser registry and explicit Read q evidence. No new polling, RCB/GI, static-report-only changes, engine bump or main merge. Added focused hierarchical and payload positive/negative tests. Windows CI run https://github.com/masarray/arsas/actions/runs/38521874020 remains QUEUED pending GitHub Windows runner. Do not claim build success, publication readiness, or field acceptance until full exact-SHA regression and portable artifact upload.

[masarray]

CI red root-cause fixed, awaiting new exact-SHA run: prior run https://github.com/masarray/arsas/actions/runs/38521874020 compiled WPF/ARIEC successfully but ARSAS regression failed 2/1853 tests (IedBrowserPresentationTests.ModelHierarchy_RendersLDThenLNThenDOLists_OnTheRight, LeftDataModelStopsAtLogicalNode_WhileRightDrillsDoAndDa). Both tests asserted old right-pane NavigateTo DO/DA cards; new M2.6B intentionally displays expandable semantic DO→DA/BDA rows. Updated legacy tests to assert DO glyph/semantic reference and expandable DA/FC without reintroducing flat navigation; left tree LN boundary remains asserted. Fix commit 8587d78741bb5b4ddb8b03bca3f6937e51b5f177; new Windows run https://github.com/masarray/arsas/actions/runs/38524321060 currently queued. Do not mark green or publish preview until full regression and portable smoke pass.

[masarray]

Engineering handoff checkpoint — 2026-10-14

P0 recovered (exact prior SHA 8587d78741bb5b4ddb8b03bca3f6937e51b5f177)

• Canonical Windows CI: https://github.com/masarray/arsas/actions/runs/38524321060 — success.
• Pinned engine: 19/19; ARSAS: 1,853/1,853; packaged runtime: 6/6; native ArdIrec bridge/CTest, Windows publish and portable EXE smoke: success.

P1 reliability fix and final exact-SHA evidence (a615308f362f2af10a21660ad620b0099431f1a1)

• Models/IedBrowserStructuredDetails.cs: isolate nested attribute branches by segment and normalized FC, rather than incorrectly merging common DA paths across ST and CO.
• tests/ARSAS.Tests/M2IedBrowserHierarchyAndReportWireTests.cs: adversarial regression proving isolated ST/CO expansions and exact leaf references.
• One atomic commit to draft PR M2.6B: hierarchical LN/DO/DA/BDA Browser and raw report q/t wire authority #560. No main, public release, pinned ARIEC, MMS monitoring authority or File/COMTRADE changes.
• Build ARSAS exact-SHA Windows CI: SUCCESS https://github.com/masarray/arsas/actions/runs/38527092707
• Test log: ARIEC 19 passed / 0 failed; ARSAS 1,854 passed / 0 failed; packaged runtime 6 passed / 0 failed.
• Native ArdIrec bridge and CTest: successful.
• Portable single-EXE publish and executable smoke: successful.
• Exact-HEAD portable executable artifact: https://github.com/masarray/arsas/actions/runs/38527092707/artifacts/11876915703 (ARSAS-win-x64-portable-single-exe).
• All 12 workflow checks on exact SHA a615308 completed SUCCESS, 0 failed/pending, including Smart Discovery Field Capture Build and Windows installer validation/silent-install smoke. Installer validation run: https://github.com/masarray/arsas/actions/runs/38527092813

Known field acceptance blockers: Physical relay AA1E1F06R4 still needed to verify CSWI1.Pos UI hierarchy and GGIO6.CBPond.q/t raw DataSet reporting parity with screenshots. q/t FCD structured payload extraction currently checks unique top-level typed candidates; schema-proven direct-leaf position binding deserves further scrutiny before claiming universal interoperable decoding. Never fabricate q/t bits or enable implicit polling. Static DataSet report-only monitoring must remain authoritative.

CI efficiency: This one code commit triggered 12 separate workflows because several Smart Discovery guards match **/*.cs; scope path filtering rationalization as a separate CI engineering task while preserving merge/release safety gates.

[masarray]

M2.7 evidence fidelity / DO display follow-up (draft PR #560)

Physical AA1E1F06R4 screenshots confirm two distinct problems:

1. DataSet GGIO6.CBPond.q displays report-derived good, but overflow/source/test/operator-blocked details are Not exposed; .t timestamp likewise has no displayed time-quality children.
2. Data Model CSWI1.Pos has stVal [ST] = Open [01] from Report while its owning DO row says Not read after an explicit 37/40 Read sweep.

Implementation on exact HEAD 7d6a4dbb040c2a184fdfdb5ee8ecc123e049eb0e (after d13b04f, b4fa6db):

• IedBrowserLiveValues.TryGet(..., requiredEvidence) can use verified per-leaf typed evidence from a direct, explicit MMS Read when the normally authoritative Report channel contains only summarized good / rendered timestamp. Only q/t children request this fallback; parent q/t value and ordinary status retain Report precedence. The child provenance explicitly becomes MMS Read; association fencing and offline labels remain. No cyclic polling or report ownership change.
• IedBrowserSchemaIndex.TryGetUniqueProcessLeaf defines exact canonical DO/FC process leaf identity with fail-closed ambiguity; IedBrowserStructuredDetails.DataObject binds the DO display to this unique leaf directly rather than relying on a possibly absent DO→DA projection alias. No first-match sibling guessing.
• Added positive/adversarial regression for Report summary + typed Read details, process Report authority, association switching, observed DO leaf, ambiguous siblings.
• Follow-up guard: typed Read is usable only if its observation revision is newer than the summary-only Report; a subsequent Report update invalidates this fallback instead of showing stale quality/time flags. FC normalization is case-insensitive and still uses exact IEC object identity.
• Root-cause fix: MainWindow.xaml.cs coalesces UI point snapshots and calls LiveValues.PublishReport after runtime raw typed ingress. That compatibility mirror was overwriting the typed q/t. It now publishes a missing Report key only, preserving authoritative raw Report evidence. New regression verifies quality/timestamp retain wire flags after legacy UI snapshot mirroring.
• No ARIEC engine pin changes, MMS write, GI, poll, unrelated release changes.

Validation (exact SHA 7d6a4db): Canonical Build ARSAS SUCCESS: ARIEC 19/19, ARSAS 1,857/1,857, packaged runtime 6/6, native bridge/CTest, portable EXE smoke all PASS. Windows installer validation SUCCESS. All 12/12 exact-SHA workflows SUCCESS, no failed or pending. Portable EXE artifact, ARSAS-win-x64-portable-single-exe. The Not exposed state remains correct when neither Report nor explicit Read supplies verified original q/UTC-Time wire evidence. Physical field acceptance still required.

[masarray]

M2.8 — physical AA1E1F06R4 Browser crash + parent-value parity (2026-10-14)

Grounded field diagnostics: app 1.6.40 (diagnostic SHA 205b946), ARIEC engine SHA 036e2c00. Static 58/58 displayed process values, 2/2 RCB traffic routed, cyclic process polling disabled. Report sequence anomaly observations are separate from this UI defect. Clicking Reports causes WPF System.ArgumentException: An item with the same key has already been added. Key: ItemsControl+ItemInfo, stack via IedBrowserDetailProjection.Reset → RenderIedBrowserSelection → IedBrowserTree_SelectionChanged. Analog DataSet phsCA → cVal → mag → f shows f=0 while ancestors remain Not read.

Exact draft PR HEAD: ffe14bf95eab91e91cd60218ab7958d9b8ca1c96 (first UI commit 61e8f7b, followed by targeted CS0165 compile correction).

• MainWindow.IedBrowser.cs: defer selection-triggered rendering to next WPF dispatcher turn with a monotonic selection ticket, reject stale device/tab/tree selections, detach detail ListView ItemsSource and clear selection before projection Reset; do the same for lazy toggles to prevent Selector reentrancy.
• IedBrowserStructuredDetails.cs: static DataSet FCD parent can bind to one exact uniquely declared process leaf in same FC; cVal/mag intermediate DA can reflect the sole descendant's observed leaf, without a second cache, wire reads or a guessed sibling.
• Targeted adversarial tests validate analog FCD and intermediate leaf observation, ambiguous intermediate fail-closed, WPF source contract detach-before-reset/deferred navigation.
• Source-of-truth constraint: Only values already received by Report or an explicit bounded MMS Read appear. Non-DataSet items (Mod/Beh/Health/control) can remain Not read until actually read, as expected. No implicit cyclic polling, no RCB/GI/control modifications, no engine pin change, no main merge/public release.

Current validation: Build ARSAS exact SHA in progress. A previous attempt at 61e8f7b failed compile (CS0165 from a conditional out leaf), corrected with ffe14bf; do not recommend prior artifact. Await regression, native bridge, EXE smoke and installer checks on current SHA; verify Reports click and model/data-set UI on physical IED.

[masarray]

M2.13C — atomic observed tuple projection (2026-10-15)

Verified exact HEAD dfc7ae02b146493c07b7bcfaf664bd081f5f570f on draft PR #560 (runtime implementation 8f8e1730, old source contract update dfc7ae02). main, releases and pinned ARIEC61850 engine are unchanged.

Root cause: M2.13A/B consolidated canonical Value precedence but the coalesced WPF point renderer still copied snapshot.Quality, snapshot.DeviceTimestamp and snapshot.SourceMode even when CanonicalPointSnapshotAuthority.ProcessDisplay selected a different, newer canonical Report value. A queued stale frame could display 50 Hz with bad/T0 metadata belonging to 99 Hz. SignalDefinition/point projections of a new Read/Report with missing metadata also retained old quality/timestamp, falsely treating historical evidence as current.

Exact changes:

• CanonicalPointSnapshotAuthority.Project now provides one immutable CanonicalPointPresentation containing Value, Quality, DeviceTimestamp, SourceMode and a flag identifying authoritative canonical Report evidence. Only exact reference, FC, connected monitoring and current association can select canonical Report; non-matching/unobserved/old-association paths return the full runtime snapshot tuple unchanged. Existing ProcessDisplay remains as backwards-compatible scalar projection.
• WPF point batch consumes presentation.Value/Quality/DeviceTimestamp/SourceMode together; process event sequencing, SOE, RCB routing, feedback, and legacy snapshot fallback remain untouched. Provenance is StaticBRCB etc when same reported frame is verified, otherwise Report for canonical evidence.
• IedBrowserReadBindingIndex now projects missing quality/timestamp explicitly as Unknown/- for BOTH Report and explicit MMS Read. Does not carry an old observation's q/t metadata into a newer scalar, and does not fabricate typed q/t evidence. Raw IEC quality and timestamp sidecars remain in IedBrowserLiveValues as independent canonical evidence.
• 5 adversarial regression tests: conflicting canonical and snapshot tuple, later MMS Read cannot displace Report tuple, missing Report metadata must not inherit older q/t, FC and reconnect fail-closed, and Read projection clears old metadata; UI source contract asserts tuple fields are used.

Exact-SHA CI proof: Build ARSAS SUCCESS: ARIEC 19/19, ARSAS 1,885/1,885, packaged runtime 6/6, pinned native bridge/CTest and portable EXE smoke SUCCESS. Portable test EXE (ARSAS-win-x64-portable-single-exe). Windows installer validation SUCCESS, including silent-install and field-runtime smoke. All 13/13 exact-HEAD workflows SUCCESS; 0 failures, 0 pending.

Safety/limits: No new store, cyclic MMS polling, RCB/GI/control change or engine modification; prior M2.8–M2.13B regression remains green. M2.13C automated gate passed; physical AA1E1F06R4 testing and full SSOT acceptance are NOT complete. Remaining work: explicit association-aware stale/unknown state for SignalDefinition presentation, ensure per-leaf canonical q/t sidecar provenance is correctly surfaced without cross-frame fusion, and benchmark multi-RCB/reconnect high-rate behavior before merge. PR stays draft.

[masarray]

M2.13D — canonical signal observation lifecycle and stale runtime callback fencing

Exact HEAD: ed428c8980907729b56827ca5096d59b98a9369f (M2.13D implementation 1de2cabd, explicit demo compatibility guard ed428c89) on draft PR #560. Prior M2.13A–C remains intact; no main, engine pin, GI/RCB semantics, control writes, MMS polling or release changes.

Audited failure: last-known SignalDefinition values were retained across pause/disconnect/reconnect without association-aware freshness. Even when canonical IedBrowserLiveValues was offline, old signal Value/q/t could be mistaken for a current measurement. Separately, a late queued runtime point snapshot arriving after Stop Monitoring could re-set WPF point.IsOffline=false, unless the session/monitor state was rechecked at dequeue.

Implemented:

• Add CanonicalSignalObservationState and UI-only SignalDefinition.ObservationState, ObservationAssociation, ObservationLabel, IsLiveObservation (all JsonIgnore). These statuses are not IEC quality: Unobserved, Awaiting, LiveReport, LiveRead, Paused, Offline. Signal detail summary now exposes observed state without modifying the underlying engineering value, q or timestamp.
• One O(signal count) state-transition sweep on Iec61850MonitorDevice.IsConnected/ IsMonitoring changes; no scan per incoming Report. On reconnect the new association marks prior values awaiting; stop pauses last-known; disconnect marks offline. Repeated live observations of the same source/association are cheap no-ops.
• Canonical projection index marks Report and explicit Read signal rows live only after strict same-reference+FC/association evidence admission. Old-association Read callbacks remain rejected.
• WPF point batch rejects real IED point frames unless connected, monitoring, and carrying the current nonzero observation association, so late callbacks cannot reactivate paused/offline rows. Synthetic demo retains its explicitly exempt zero-association path; real IEDs never get this exemption.
• Four new M2.13D regression tests: full Report→Pause→Disconnect→Reconnect lifecycle with value retention and freshness demotion; explicit Read after reconnect; runtime freshness status not persisted or misrepresented as IEC quality; WPF source invariants incl. demo guard. Existing suite remains green.

Exact-SHA validation: Build ARSAS SUCCESS: pinned engine 19/19, ARSAS 1,889/1,889, packaged runtime 6/6, native bridge/CTest and portable single EXE smoke PASS. Exact-HEAD Windows portable EXE (ARSAS-win-x64-portable-single-exe). Windows installer validation SUCCESS (silent install and field-runtime smoke); Smart Discovery Field Capture SUCCESS. All 13/13 exact-HEAD workflows PASS, 0 failed, 0 pending.

Not yet field accepted: Physical AA1E1F06R4 verification required for stop→late burst, reconnect→first Report, simultaneous static RCB + explicit Read, and q/t detail provenance. Full strict SSOT still incremental because runtime retains SOE/RCB state. Keep draft and do not merge/release before field acceptance.

Next meaningful work: adversarial multi-RCB high-rate cross-workspace stress/invariants and monitored association transition coverage, preferably without another broad CI-triggered source commit until acceptance tests can be scoped.

[masarray]

M2.13E — high-rate multi-RCB snapshot ordering and reconnect invariants

Exact tested HEAD c8eebde9cbe83cb128410c6a16a260267929c52d (production implementation a4ec3657, legacy source-contract relocation c8eebde9) on draft PR #560. Previous M2.13A–D acceptance checkpoints preserved. main, public release, and pinned ARIEC61850 engine unchanged.

Audit finding / root cause: RuntimePointState.Sequence increments only for semantic process-value changes (appropriately, for SOE). Two successive RCB updates for the same point with identical process values but different quality, timestamp, RCB coverage or status can share exactly the same Sequence. The WPF ConcurrentDictionary.AddOrUpdate coalescer previously selected the last callback arriving on a thread, not necessarily the last emitted runtime snapshot; equal-Sequence out-of-order callbacks could revert operator metadata, fail to preserve latest RCB provenance, or produce a spurious highlight. Reconnect also resets per-session process sequence.

Targeted solution, no new observation store:

• Add monotonic per-point RuntimePointState.SnapshotRevision, incremented on every emitted value/metadata/status snapshot. Add immutable Iec61850PointSnapshot.SnapshotRevision. Keep semantic Sequence and SOE event generation unchanged. No new network reads or temporal heuristics.
• CanonicalPointSnapshotAuthority.NewerSnapshot prioritizes association generation, then publication revision, and only falls back to process Sequence for old zero-revision/demo frames. Handles zero-association legacy vs real-association comparison.
• Extract single deterministic CanonicalPointSnapshotBatch + pure Merge method from WPF private PendingPointUpdate. A rejected stale update cannot introduce a fresh value-edge/highlight, and new associations cannot inherit the previous association's edge.
• UI point tracks a lightweight non-notifying LastSnapshotAssociation/LastSnapshotRevision apply watermark. This rejects delayed callbacks even after an earlier batch was already painted, not just during concurrent queue coalescing. Last-known canonical tuples, RCB provenance and prior M2.13D offline fencing preserved.
• Four regressions: 16,000 synthetic same-point metadata-only updates alternating BRCB and URCB sources with deliberate delayed older callbacks; no fabricated SOE edge; reconnect with low sequence vs old high sequence; zero-stamp legacy/demo fallback; source contract asserting ingress revision increments independently of semantic SOE sequence.

Exact-SHA CI evidence: Build ARSAS SUCCESS — pinned ARIEC 19/19, ARSAS 1,893/1,893, packaged runtime 6/6, native bridge/CTest PASS, actual portable single-EXE smoke PASS. Portable field artifact (ARSAS-win-x64-portable-single-exe). Windows installer validation SUCCESS, including silent-install and field-runtime smoke; Smart Discovery Field Capture SUCCESS. 13/13 exact-HEAD workflows PASS, 0 failed, 0 pending.

Known limits / field acceptance: The 16k burst is deterministic software stress, not a physical 34-RCB/wire-throughput test. Physical AA1E1F06R4 verification still required (analog q/t consistency, BRCB/URCB overlap, stop/restart/reconnect, no lost report, no cyclic MMS polling). An additional monitor-session generation/identity guard may be worth auditing for Stop/Start Monitoring within the SAME MMS association; association fencing alone covers reconnection but not every reuse of an existing connection. No merge/release before acceptance.

CI efficiency: No manual reruns; a failing legacy source-contract check on the first commit was corrected through one focused test-only commit, not by reintroducing duplicate UI selection logic.

[masarray]

M2.13E — Monotonic presentation ordering under multi-RCB bursts (exact-HEAD checkpoint)

Verified SHA c8eebde9cbe83cb128410c6a16a260267929c52d, draft PR #560. M2.13E implementation introduced at a4ec3657; source-contract regression updated at HEAD. No engine pin, main branch, public release, control or static RCB/GI behavior changes.

Root cause fixed: process/SOE Sequence incremented only on semantic transitions. Multi-RCB quality, timestamp, RCB-coverage and status updates can share identical Sequence, so queued/out-of-order WPF snapshot callbacks could roll back presentation metadata. Introduced separate monotonic per-point SnapshotRevision on runtime emission, including metadata-only status; preserved semantic Sequence for SOE. Pure CanonicalPointSnapshotAuthority.Merge and already-displayed revision fencing choose correct latest association/revision, without propagating stale rejected update edges.

Adversarial software coverage: 16,000 simulated multi-RCB metadata updates with injected late callbacks; reconnect with sequence/revision reset; zero-stamped legacy fallback; runtime/UI contract validating production projection order. Report/Read canonical authority and M2.13A–D invariants preserved. No new MMS reads, polling, or duplicate value cache.

Exact-SHA CI Build ARSAS SUCCESS: ARIEC 19/19, ARSAS 1,893/1,893, packaged runtime 6/6, native bridge/CTest and single portable EXE smoke PASS. Portable Windows artifact. All 13/13 exact-HEAD workflows success, no failed or pending. Draft PR retained, no merge/release.

Acceptance distinction: Stress regression is simulated; physical multi-RCB/rate/reconnect validation on IED AA1E1F06R4 still pending. Full SSOT acceptance remains open until that gate, including verifying no stale q/t, no lost real report edges, and stable WPF UI during bursts.

[masarray]

Thread B coordination checkpoint (no change to this PR's code or merge state): the separate Draft integration PR #566 #566 has FIRST parent your current HEAD 7a764c3a062a217919394ba90803ccdb78599528, SECOND parent M2.13J Thread A dde4c74a25624d0543499013984ba877b8052fbe, final HEAD adca74da9497a367d46b2b7668c596b1697de350. All 12/12 exact-SHA CI workflows SUCCESS, ARSAS 1,933/1,933, native bridge and portable EXE smoke SUCCESS. A+B reconciliation resolves mismatch between normal 3-phase strict timestamp/source matching and 4-component neutral-independent summary without fabricating phasors; user-facing Browser nav and q/t remain preserved. Please keep this PR's ownership and continued work isolated; any new M2.14 delta should be compared by SHA before intentionally updating #566. No merge to public main authorized; physical BCUGE acceptance pending.