M2.17-C Data Model: bounded priority MMS hydration on full live discovery

[masarray]

M2.17-C — bounded, evidence-first initial MMS hydration for full LIVE discovery

Base: stacked draft #604 (exact SHA 5a83f4510bf7159c8534e5deb32bf41516ff563e). Do not merge upstream drafts or repin ARIEC without review. This follows the verified SCL-assisted initial observation reuse in #604, but fixes the distinct IP/full live discovery gap: discovery produces the canonical schema while priority leaf values have not been admitted to the shared per-IED observation ledger, so Browser Data Model can legitimately show many Not read rows.

Architecture-preserving patch

• Extend the existing IedBrowserReadPlan with BuildInitialPriority and an explicit finite target budget (max 32). Only real live-discovery declarations with exact case-sensitive reference+FC are eligible. Rank LLN0/LPHD Mod/Beh/Health, schema-proven XCBR/XSWI/CSWI.Pos.stVal, LLN0/LPHD NamPlt DC leaves, remaining LN status, switch q/t and remaining NamPlt leaves. Reject ambiguous duplicates, unsupported FC CO/control, vendor guesses, and previously observed current-association values.
• Reuse Iec61850MonitorRuntime.ReadBrowserValuesAsync as-is, sequential on the pinned ARIEC MMS gate, with existing 5s per-target timeout and a 10s whole-hydration envelope. No unbounded traversal/read, new transport, thread, poll loop, decoder, cache, new RCB subscription, write or command.
• Use the existing synchronous IedBrowserReadResultInbox; publish only accepted values to device.LiveValues.PublishForAssociation with typed Quality/UTC evidence if actually present. Fence by exact runtime session, IED, live model object, association, and monitoring state. Timeout may leave remaining attributes Not read; never fabricate them.
• Reuse the existing failure-only IedBrowserReadFailureEvidence, anchored to the accepted live model for auto hydration (not to the subsequently replaced WPF signal catalog); show attempted failed leaves as Unavailable with reason, without adding another value owner. Explicit manual Read keeps the prior strict UI projection-epoch fencing.
• Reuse IedBrowserReadBindingIndex for a one-time read-only re-projection of verified initial Read evidence when new SignalDefinition rows are actually attached on the UI thread. This is an existing presentation mirror, not an extra observation channel or event generator. Report authority remains independent and wins when monitoring.

Focused regression

Eight tests for station health/status/typed DPS priority; skip already accepted Read/Report; wrong FC/type/CDC and ambiguous declarations; deterministic 400-object model bounded to 24 targets; model+association-bound failure provenance; manual Read UI epoch invalidation; catalog reattachment/monitoring guard; and source-level verification of the actual bounded serial runtime seam.

Limitations and BCUGE gates

• This is finite initial evidence hydration, not automatic Read All and not complete field parity for every Mod/Beh/Health/NamPlt across very large IEDs. The plan is deliberately stopped at 32 targets / 10s and may cover fewer values on slow IEDs. See per-IED diagnostic log for planned/completed/published/failed/exhausted counts. Manual Read All remains explicit.
• No claim of real BCUGE field endpoint physical acceptance; verify actual values, timestamps, error reasons and reference engineering application comparison from a live session.
• Remaining M2.17-D workspace projection, SGCB/GoCB/RCB and COMTRADE interoperability will be separate evidence-driven increments. This patch does not alter them.
• Engine 036e2c00d83a0815b6160147b14ea05975057965 and ArdIrec locks untouched; base PR chain stays draft.

Validation

Changes staged and diff/ancestry reviewed prior to PR. No local .NET SDK available in agent runtime; one GitHub Actions exact-SHA run is the executable compile/regression/build proof. Keep draft until green CI; field acceptance is separate.