[masarray]

Scope / why this is NOT historical PR #606 cherry-pick

Isolated current-tree rescue of two unique M2.17-D safety invariants identified during ARSAS reconciliation D2. Historical #606 remains OPEN until regression parity is proven. Its old branch is diverged, has obsolete subscriber/read APIs, and must not be wholesale merged.

Exact integration base: protected draft RC 817c3910e8223fa2ac531a4426ada5d2d4bbbe50 (#727/#729); PR contains exactly six focused files (three source, three test files), no engine or release changes.

Implemented read-only safeguards

1. IedBrowserGooseInspection.OrderedUnboundWireEntries: require nonzero exact PDU count, contiguous zero-based DataSetIndex, one-based Order, and no empty/<missing in frame> value across the entire vector before displaying any unbound allData rows. No FCDA inference, no extra capture/decoder and no MMS ledger promotion.
2. MainWindow.IedBrowser.cs: consume only validated unbound vector, otherwise no raw-value rows. Exact directory-backed VerifiedMembers path is unchanged; UI still limits display to 128 validated rows.
3. IedBrowserReadPlan.BuildInitialPriority: pre-index exact MMS LogicalDevice domains, admit initial read-only SGCB and GoCB state only if the control block belongs to that same live model domain. Existing inventory/FC checks, association ledger, bounded budget and no edit-group Write remain unchanged.
4. Added tests in IedBrowserGooseInspectionTests for mismatch, duplicate/out-of-order slots, missing/empty values plus UI callsite guard; IedBrowserControlStateEvidenceTests for mixed valid and foreign SGCB/GoCB and all-foreign rejection.

Safety / ownership / promotion gates

• Draft / do not auto-merge. Not a claim of IED wire FAT, decoder completeness, R7/R10 qualification or accepted stable source promotion.
• This is NOT a replacement for INTEGRATION GATE ONLY: user-accepted Write onto latest SSOT V2; preserve advanced SMV #726 frozen MMS Write, FAT Write safety: reject unrecognized live Boolean instead of selecting false #716 Boolean Write safety, P0 follow-up: retire unresolved MMS control sessions without blocking reconnect #615 retired command-session ownership, P0 SG7_BCU: async Browser model indexing, bounded metrics and CF-aware units #688 SG7 performance, RC0 INTEGRATED — GUI P0/P1/P2 + SSOT/Write + main SV; physical release gates open #727 RC integration or P0: reconcile v1.6.42 shipped source + stable docs to main (physical R7/R10 gates pending) #729 physical-gated promotion. No touched files overlap their primary command/engine code paths.
• No production UI design change. Inconsistent or incomplete GOOSE packet slot evidence is withheld rather than fabricated.
• No workflow, engine pin, tag, release asset or accepted stable v1.6.42 changed.
• Zero branch deletion and no mainline merge. Original M2.17-D Field convergence: GoCB passive evidence, SGCB initial status, RCB/Read correctness #606 seven-test file still recoverable. If another owner has modified this exact RC lane, rebase and review rather than force-push.

Validation gate (not yet asserted as passed)

Targeted managed tests (Windows/.NET 8):

dotnet test tests/ARSAS.Tests/ARSAS.Tests.csproj -c Release --filter "FullyQualifiedName~IedBrowserGooseInspectionTests|FullyQualifiedName~IedBrowserControlStateEvidenceTests" --no-restore

Requires normal restore/build and exact pinned native bridge/engine setup in canonical CI. No local .NET SDK available in the audit environment, no local test-pass claim. Inspect actual PR-context CI, complete red-job triage and review before any integration. Run physical qualification independently for #729.

Reconciliation disposition

This new narrowly scoped corrective PR should only replace the two missing current tree invariants, not close #606 until test continuity and integration are verified. Revisit historical #606 only after required CI and a full seven-assertion map. No inappropriate blanket closure.

D5 additive exact-current-tree regression recovery (2026-10-26)

After full CI succeeded on initial 5-file head d0fbb5c2ae9f69f56badbba9bef5e15d66a78dc7 (Windows run 40280841713), a single test-only commit added tests/ARSAS.Tests/M217DCurrentTreeEvidenceContinuityTests.cs. Current head 410a2fd3c8757f9c9cac46e2df6cb4ce047585b7, now 6 files versus frozen RC 817c3910e8223fa2ac531a4426ada5d2d4bbbe50 (3 source/3 tests, ahead6/behind0). New tests validate: (1) exact GoCB wire authority without MMS DataSet inventory and no FCDA inference; (2) verified initial SGCB SP read-only 3→2 after observation, bounded maxTargets and offline; (3) SCL-only/incorrect FC/zero-budget initial SGCB rejection. All are synthetic read-only / no native command or simulator capture.

New exact-head CI is authoritative: Windows run 40299449108 and SCL run 40299449103 were in progress at this amendment. Do not cite the older green 5-file result as proof for this new SHA. Historical #606 seven-method coverage map and remaining GUI acceptance distinction is documented; #606 remains OPEN. No draft-to-ready, merge, engine repin, stable v1.6.42 mutation or physical-release authorization.

[masarray]

D5 exact-head CI stage attestation — current 6-file test recovery (2026-10-26)

Pinned head: 410a2fd3c8757f9c9cac46e2df6cb4ce047585b7, base protected RC 817c3910e8223fa2ac531a4426ada5d2d4bbbe50, exactly 6 files (3 source/3 tests), no merge/rebase. The additional three #606 current-tree regression tests are in tests/ARSAS.Tests/M217DCurrentTreeEvidenceContinuityTests.cs, introduced by one test-only commit to the earlier green 5-file patch.

At latest actual GitHub job-steps check, Windows run 40299449108 / job 121493442949 had completed SUCCESS: source/immutable-lock verification, .NET8 setup/restore, Build solution, pinned engine canonical regression, Run ARSAS application regression tests, and exact-SHA test attestation. No failing job step as checked. Native ArdIrec CTest, portable single-EXE packaging and full job conclusion were still IN PROGRESS, so no “entire CI green” assertion for this new SHA yet. SCL run 40299449103 still required its final conclusion. Previous five-file Windows run 40280841713 was fully successful but does not replace final 6-file head proof.

Review/ownership gate: read 7-case historical #606 parity disposition, including intentional change from literal RCB root section assertions to current nested collapse and in-place GOOSE subscriber. Coordinate RC #727/#729 owner and active #726/#716 Control/Write before target integration, and keep the later #615 native-late-command ownership blocker separate. Do not close #606 just because managed tests pass. Physical GOOSE, SGCB and IEC field/R7/R10 qualification are independent. v1.6.42 public stable untouched.

[masarray]

D6 — exact 6-file HEAD canonical CI fully passed; review/field gates remain distinct

Verified immutable head 410a2fd3c8757f9c9cac46e2df6cb4ce047585b7, protected draft RC base 817c3910e8223fa2ac531a4426ada5d2d4bbbe50; 6-path change (3 read-only source + 3 regression files, including current-tree historical #606 continuity). No post-CI head mutation.

Required CI at this EXACT head: Windows run 40299449108 / job 121493442949 COMPLETED SUCCESS; checked all 36 job steps with zero failed: immutable engine + native bridge lock, .NET8 Build solution, pinned engine regression, ARSAS application regression tests including new 3-case class, exact-SHA test attestation, compiled + tested pinned native bridge CTest, managed integration against packaged bridge, real portable single EXE publish + smoke, sealed Windows input. SCL run 40299449103 SUCCESS. Advisory changed-area classifier success; comparison reusable test intentionally skipped.

Exact-HEAD, NON-STABLE artifacts: application test evidence 12640350496 digest sha256:c512379e5758d0fba9bcb1fd939d2da474e4c4bdc9bc9ca56f5cec9c702fa266; native CTest 12639722807; direct portable single EXE artifact 12639857894 digest sha256:405f21003fce3394cb454c1f97b39df61d46a2f71001047364d0973271313f15; sealed Windows package 12639887804 digest sha256:ce37084a4471324b3e2e1412b4bca636f77047c6dc0010eb584d8e89405a8674.

Integration decision: preserve DRAFT #753 and source branch (no merge/automerge/retarget) until RC #727/#729 owner explicitly evaluates old #606 seven-contract matrix (detail) and its deliberate RCB visual nesting/subscriber semantic changes. Current code CI success does not close historical #606, clear #615 late-native Control object alias, enable Control/Write, or qualify physical R7/R10. Stable v1.6.42 accepted tag and published assets unaffected. No unnecessary CI rerun requested.

[masarray]

D9: strengthen exact FCDA GOOSE admission — new source + regression SHA (2026-10-26)

NEW HEAD 0652f66bed0c72dded20ff547e23e2ef1989341c (parent 410a2fd3c8757f9c9cac46e2df6cb4ce047585b7), still DRAFT and unmerged on the same protected RC base 817c3910e8223fa2ac531a4426ada5d2d4bbbe50. This is a two-file modification within the existing six-file PR; no RC/main/stable/engine lock change.

Source safety fix: Models/IedBrowserGooseInspection.VerifiedMembers now refuses to promote a cached-directory FCDA match unless the received PDU datSet exactly matches the directory reference, and validates all declared zero-based DataSet ordinals and corresponding one-based wire presentation positions. Existing exact signal-reference/FC and count fences remain. This closes an unchecked combination where a foreign/replaced datSet or inconsistent ordinal metadata could be labeled as canonical FCDA even if leaf identities happened to coincide. On mismatch, verification is unavailable; raw allData remains explicitly unbound and must satisfy the whole-PDU gate.

Tests: IedBrowserGooseInspectionTests.cs now rejects foreign frame datSet, invalid wire Order, noncontiguous directory member index; additionally checks an invalid 129th unbound leaf rejects the whole PDU despite the 128-row UI viewport clamp. Deterministic synthetic read-only tests, no MMS write/control/native calls.

CI status: New exact-head Windows Build run #40308062610 and SCL R7 run #40308062583 were in_progress at initial check; advisory #40308062656 succeeded. Prior 410a2fd full green runs/artifacts do not attest this new HEAD. Verify fresh run conclusion and tests before integration. No physical GOOSE/SGCB/R7/R10 qualification implied, and do not merge before #606/RC owner review. Stable v1.6.42 is untouched.