[masarray]

M2.17-D / BCUGE field-feedback correctness slice — stacked draft on #605

This patch follows the physical operator screenshots. It deliberately fixes documented seams, not an entire UI repaint or a fabricated "all data complete" claim.

Root causes and repairs

1. GOOSE: real subscriber frame invisible in GoCB Browser. The existing IedBrowserGooseInspection.Select rejected every wire frame when the online GoCB discovery did not disclose its DataSet reference. Permit a single exact received GoCbRef (matching declared GoID/AppID/confRev when available) to supply its ACTUAL PDU DataSet reference. A conflicting known DataSet, different IED model, APPID, rev, or ambiguous duplicate still fails closed. Reuse the existing GOOSE Sniff subscriber via a visible Subscribe GOOSE action; never start a second reader/decoder/cache. For missing or conflicting FCDA directories, surface original allData positions as explicitly Wire entry #N (unbound), never name them as model FCDA or borrow sibling FC. Do not infer MMS GoEna from passive reception.
2. SGCB: no initial NumOfSG/ActSG/LActTm. The M2.17-C priority plan only scanned LN DO attributes. The verified live SGCB attribute inventory lives elsewhere; include only those 3 read-only fields, with domain/FC/inventory proof, under the SAME sequential 32-target / 10-second hydration budget. Never read EditSG/CnfEdit, select/edit groups or write a setting. Historical SCL-only declarations remain non-authoritative.
3. Data Model: Read appeared ineffective. Expanding a DO silently changed the later LN Read target to that last-clicked DO; the screenshot showed a successful 3/4 sweep while other DOs remained Not read. Read now means the whole selected LN and Read All still means the whole model. Clicking/expanding rows is navigation, not a hidden acquisition-scope change. Existing read results are still fenced by association/catalog.
4. Report flag collapsibility regression. Trigger/optional flag rows now live beneath Control Block attributes instead of becoming separate Section siblings. The existing engine flag codec and shared section projection remain authoritative; no bit decoder added.
5. Report RCB activity indicator stale. Runtime RCB activation completes asynchronously after IsMonitoring changes. Rebuild existing glyphs only when the actual activated RCB identity set changes. Explicit read-only RCB checks are additionally fenced against association/schema swap. RCB use by another client still requires a real read-only status check, never inference from name or missing report frames.
6. Files indentation. Add a small inner padding on the Filename icon/text cell only; no new WPF cards, icons or file transfer behavior.

Tests and safety

Seven added focused regressions covering selected physical-style GoCB + subscriber allData, missing directory, duplicate/conflicting frame rejection, bounded exact SGCB read priorities and unauthorized FC rejection, report-control collapse hierarchy, existing subscriber use, RCB association fences and file indent. No engine re-pin, no native library change, no protocol replacement, no GOOSE emission, no MMS writes, no auto Read All.

What this does NOT claim

• Remote RCB occupancy needs on-device check; a passive Report is not proof of remote owner.
• Unread SG leaf values and analog DataSet values still require real model-proven Read/Report evidence; missing or BER-unprojectable attributes are not assigned default zero.
• No physical acceptance claim without a repeat capture and per-row failure diagnostics from the same IED.

Keep draft; merge/promotion only after exact-SHA CI and physical interoperability review.

[masarray]

Reconciliation finding (2026-10-26): KEEP OPEN — unproven unique regression delta. The original #606 source 9474a5ca07e1d245ce0020d873ff9445bc19aa78 contains tests/ARSAS.Tests/M217DFieldEvidenceConvergenceTests.cs (blob 9df525047ac1186ed822a7f2a0cd0f86f811a4a9, 7 test cases) that is absent by exact path from current RC 817c3910e8223fa2ac531a4426ada5d2d4bbbe50 (recursive Git tree checked). Cases cover exact GoCB wire identity, wrong-publisher rejection, ordered real PDU/unbound slots, SGCB live evidence/fail-closed paths, report-control section nesting, and passive subscribe + RCB association fencing. Absence of the file is not yet proof that behavior regressed; equivalents may exist under other classes. Do not close this PR before mapping every assertion to live RC regression tests or porting distinct coverage. Preserve branch and field evidence; do not invent physical acceptance or mutate the currently trial-pinned engine. See repository audit checkpoint branch audit/arsas-pr-issue-reconciliation-20261026. Next: semantic assertion matrix old-to-current, targeted test restoration on an isolated branch if coverage is missing, then existing required CI and physical gate review.

[masarray]

Reconciliation D1 — 7-test historical coverage map (2026-10-26)

Disposition: D — KEEP OPEN until the two incomplete assertions are resolved. Old test blob 9df525047ac1186ed822a7f2a0cd0f86f811a4a9 is absent from RC 817c3910e8223fa2ac531a4426ada5d2d4bbbe50; original branch and full file remain intact. The PR is diverged from RC (ahead 1236, behind 11 from old HEAD → RC), so ancestry is NOT sufficient.

Historical assertion	Current canonical candidate (RC)	Disposition
ExactGoCbWireIdentityRecoversLiveMetadataWithoutMmsDataSetInventory	IedBrowserGooseInspectionTests.FullyQualifiedWireGoCbCanBeObservedWithoutMmsDataSetDirectory plus BrowserHasUnboundWireAllDataFallbackWithoutRewritingLedger	Partial: GoCB identity preserved, historical raw slot validation method removed
NeverSelectWrongPublisherAmbiguousFrameOrConflictingConfiguration	IedBrowserGooseInspectionTests.ExactCanonicalControlIdentityAndOnePublisherRequired; Select rejects ambiguous duplicate publishers, wrong AppID/ConfRev, wrong IED	Covered for specified identity conditions
UnboundWireSlotsRequireCompleteOrderedRealPdu	VerifiedMembers validates bound directory slots; raw unbound view in MainWindow.IedBrowser.cs:1706-1758 displays frameView.Leaves with min(128) and no local WireDataSetEntryCount==Leaves.Count, contiguous unique index or missing-value check	GAP/needs tracing: validate guarantee at the subscriber decoder boundary or add fail-closed raw unbound slot admission plus focused regression. Do not restore removed OrderedWireEntries blindly
SGCBStatusIsHydratedFromExactLiveInventoryWithoutWritingEditGroup	IedBrowserControlStateEvidenceTests.FullLiveInitialHydrationIncludesOnlyVerifiedReadOnlySgcbStatus, SgcbReadsOnlyExactInventoryDeclaredReadOnlyMmsLeaves	Covered incl bounded 3→2→1 and no EditSG/CnfEdit
SGCBFailsClosedForSclOnlyUnknownFcOrWrongDomain	IedBrowserControlStateEvidenceTests.UnverifiedOrConflictingSgcbNeverTriggersProbe, InitialSgcbPlanRejectsSclOnlyAndAmbiguousInventory	Partial: SCL/wrong FC covered; verify wrong-domain control block relative to model LogicalDevices (not just self-consistent block identity)
TriggerAndOptionalFlagsAreChildrenOfReportControlSection	M217DGooseRcbFilesUxRegressionTests.ReportFlagsStayInsideControlBlockExpandableSection	Covered
PassiveSubscribeAndRcbGlyphReuseExistingRuntimeAndAreAssociationFenced	IedBrowserGooseInspectionTests.BrowserSubscribeIsInlineAndSharesOriginalNpcapStartStop; present IedBrowserGooseSubscribe_Click calls StartGooseSubscriber_Click(sender,e), not the obsolete OpenIedGooseSubscriber(device). Live association fences are present in read/UI code	Updated subscriber UX covered; check async model/association epoch attribution separately; old source-text assertion is now intentionally obsolete

Safety: no code or test was ported without checking new APIs; raw allData is always labeled unbound and must never be promoted to FCDA or MMS ledger. Never merge the historical file as-is (obsolete OrderedWireEntries and OpenIedGooseSubscriber expectations).

Follow-up: ask canonical IED Browser/GOOSE owner to trace decoder invariants for wire count/order/missing sentinel and add minimal test-only cases for any true missing behavior. Likewise prove/fence wrong-domain SGCB (a syntactically valid block from another model domain must not silently become current association authority). Keep #606 open pending focused tests and required CI; no physical GOOSE/safety acceptance implied.

[masarray]

Reconciliation D3 — focused rescue is now a separate current-RC draft PR

Disposition: KEEP historical #606 OPEN (no blind cherry-pick / no ancestry-only closure). The two unique current-tree gaps identified in D1 7-method matrix now have a narrowly scoped corrective candidate: #753, branch safety/m217d-raw-goose-sgcb-admission-20261026, head d0fbb5c2ae9f69f56badbba9bef5e15d66a78dc7, base protected RC 817c3910e8223fa2ac531a4426ada5d2d4bbbe50.

• GOOSE unbound allData: newly validates full nonempty exact packet count, contiguous/ordered unique slots and no missing/empty value. Browser refuses to display partial evidence or to claim FCDA for unbound slots; adds focused malformed-vector tests.
• SGCB/GoCB initial inventory: exact MMS LogicalDevice-domain membership fence, shared indexed HashSet; no unrelated-domain control-state reads and no EditSG/CnfEdit/Operate.
• Exactly 5 current files, 3 source/2 focused existing test files; not a duplicate of obsolete historical seven-test PR branch.
• Safety: no engine pin, control/Write/RCB semantics, v1.6.42 release, mainline SHA, or user-accepted GUI changes; original historical M2.17-D Field convergence: GoCB passive evidence, SGCB initial status, RCB/Read correctness #606 branch remains intact.
• Follow-up: PR M2.17-D safety: reject incomplete unbound GOOSE and foreign-domain SGCB/GoCB reads #753 draft review, Windows/.NET8 targeted tests and canonical CI first, semantic/physical follow-up separately. Do not close M2.17-D Field convergence: GoCB passive evidence, SGCB initial status, RCB/Read correctness #606 based on a mere PR creation or passing build; after M2.17-D safety: reject incomplete unbound GOOSE and foreign-domain SGCB/GoCB reads #753 is actually integrated into canonical RC and full seven-test coverage is adjudicated, comment with final per-assertion proof before any closure. No R7/R10 claims.