M2.17-I: exact FCDA SCL projection and bounded phasor q/t+angle acquisition

[masarray]

Scope / baseline

Stacked on draft PR #614 (HEAD 35caaddd7a60d3d7d312ac900640bad42129107e, 13/13 workflows green), which includes drafts #613 and #612. No merge, no protocol engine pin changes.

Verified gaps and implementation

1. Exact FCDA leaf: SCL-only schema presentation previously accepted only descendants of a DataSet member reference, not an exact leaf. A live DataSet FCDA pointing directly to e.g. MMXU1.PhV.phsA.q could remain invisible despite exact SCL schema. Allow exact match only when the selected-IED owner and FC match; never supply a value or authorize a read from SCL.
2. Missing observed MX companion evidence: previous initial plan seeded 6 magnitudes but skipped true, live-model/DataSet-covered cVal.ang.f, q, t. Add at most 9 live FCDA companions for the original, at most 6 coherently selected MMXU magnitudes. Only exact same-owner companions, nonduplicate live declarations, exact FC=MX, real DataSet membership, and current-association unobserved leaves qualify. Already received magnitude from Report remains a valid schema seed for its missing companions. Never derive values/bits.
3. Still one existing client association, one original Read/Report ledger, 32 total targets, 10-second global initial budget, 5-second per-leaf cancellation, no extra worker, no Read All/GOOSE control/RCB writes.

Test / acceptance

• Behavioral test of exact FCDA leaf SCL fallback, wrong FC, wrong LN/domain, and no value synthesis.
• Behavioral tests of 3-phase magnitude/angle/q/t ordering, real Report reuse, FC mismatch, duplicate declarations, wrong leaf names, no DataSet authority, 32-target cap and original time budget.
• Windows CI and lab acceptance are gates; no claim that all Not read / Not exposed are solved. For absent or timed-out MMS evidence display must remain unavailable. PR stays draft and stacked until verified.

Physical acceptance

BCUGE live discovery and DataSet phasor: confirm exact MMS Read requests/responses for A/B/C mag, ang, q, t; verify that raw quality/time bits only display when actually decoded, Data Model & DataSet rows use same live association ledger; record unexposed schema/failure reasons; reconnect and confirm no stale values. Never run Command on energized equipment without switching authorization.

Observation absence classification

• Added a bounded typed absence verdict on the existing per-association initial-read failure ledger: Failed for actual attempted MMS Read failures; Deferred for a selected target that was never attempted because the finite initial sweep ended (especially the 10-second budget).
• An actual failure always wins over a later deferred marker for the same IEC reference/FC. Association/model changes invalidate both. No process data is duplicated.
• Browser shows Not read / Initial read deferred for deferred targets, while true protocol errors remain Unavailable / MMS Read failed. Details are placed in row tooltips, not additional noisy overlays.
• Tests cover deferred→wire-failure precedence, clear-on-success, wrong FC rejection, and reconnect invalidation. An explicit Read DO / DataSet read is the operator-driven follow-up.

Outstanding: a canceled native MMS Read is not proof of wire cancellation. Per-leaf cancellation is bounded by a 5-second token, but if pinned engine ignores it the transport lifetime needs separately proven recovery. Physical BCUGE/IED acceptance remains required; do not call all Not read/Not exposed resolved.

Correctness follow-up: in-flight budget expiry

Initial hydration tracks attempted vs completed MMS Read targets synchronously at the producer boundary. A target whose Read started but did not return by cancellation/budget is Interrupted / wire outcome UNKNOWN, never Deferred / NotAttempted. Only genuinely untouched targets receive Deferred. The UI keeps the distinction in an existing row source/tooltip, without creating a process-value cache or launching a retry. The typed evidence store preserves actual wire failures over both kinds and rejects old association/model epochs. Deterministic tests cover the priority rules.

The existing 10-second initial sweep remains a cancellation-token budget. If the pinned native engine does not honor cancellation, end-to-end wall-clock boundedness and MMS receive-pump cleanup remain an explicit next milestone, not claimed fixed here.