G2.6 Smart Auto + physical shadow verification: guarded dynamic reporting recovery

[masarray]

Goal

Advance ARSAS from deterministic command-bound A3 into the physical G2.6 report-vs-independent-MMS shadow phase without weakening the production gate.

Current chain:

G2.4 InformationReport proof -> A2.1 command-bound MMS transition -> deterministic Q0 A3 dchg PASS -> physical two-association shadow -> independent regressions -> later explicit ProductionEligible

The persisted field profile remains InformationReportProven. Production automatic dynamic reporting remains OFF.

Smart Auto behavior already in this branch

• keep ARIEC capability/availability planning authoritative
• on a static RCB revalidation/readiness failure, exclude the failed static RCB and search only for an alternate DynamicBRCB/DynamicURCB
• preserve the original runtime PlanId while switching the acquisition target
• re-enter the normal StartHybridReportMonitorAsync path so fresh discovery and exact availability are checked immediately before any dynamic write
• retain the per-device dynamic-write circuit breaker
• if static activation already touched RCB state, permit dynamic recovery only when engine rollback reports CleanupSucceeded
• otherwise fail closed to bounded MMS polling

Deterministic A3 ancestry

PR #231 was merged into this branch after the exact Q0 field run and false-positive hardening. A3 acceptance remains bounded to authoritative native MMS control-result evidence, a qualified post-command MMS transition, a later spontaneous dchg InformationReport on the same exact DataSet index, and mandatory cleanup. A3 does not grant production eligibility.

ARIEC engine pin

ARSAS now pins merged ARIEC61850 PR #99:

main @ 1efad9a2cdb6b4452b13687bbcd8c7ec41a9e53f

PR #98 introduced the pure typed shadow evaluator. PR #99 hardens the production-facing bridge so QualityRegressionPassed additionally requires actually observed paired report/poll quality evidence and actually observed paired report/poll device-timestamp evidence. Absence of q/t evidence cannot become a production PASS.

Physical shadow collector

DynamicReportShadowVerificationCommissioningService implements an explicit two-phase commissioning collector.

Entry point:

Ctrl + Shift + S

Each phase uses two independent MMS associations:

1. a transactional exact one-URCB report association with TrgOps=dchg, GI/integrity/qchg/dupd disabled, and the exact persisted member sequence;
2. a read-only direct-MMS polling association over that same exact member sequence.

The collector performs:

• phase 1 report + independent polling;
• full monitor/proof-field/fresh-association cleanup;
• one deliberate teardown/reconnect;
• phase 2 report re-subscription + polling-reference recovery;
• cleanup again;
• typed ARIEC shadow evaluation.

READY markers:

• G2.6 SHADOW PHASE 1 READY — CAUSE ONE SAFE CHANGE
• G2.6 SHADOW PHASE 2 READY — CAUSE ONE SAFE CHANGE

The collector issues zero automatic control commands. The operator causes exactly one already-approved safe change only after each READY marker.

Evidence boundaries

The physical recorder is exact-index/member only and bounded. It records real report values, independent MMS polling values, report ordering/sequence when supplied, reconnect counters, re-subscription/recovery counters and dynamic activation attempts.

Report quality/timestamp is accepted only when ARIEC physically projects it from the received InformationReport. ARSAS does not copy polling metadata into report evidence, does not treat report receive time or header TimeOfEntry as a data-object timestamp, and does not synthesize missing q/t.

The current scalar proven envelope may therefore expose a legitimate new physical blocker: if q/t are not transported with the report member, strict shadow acceptance remains fail-closed. That is field evidence to resolve, not a condition to bypass.

Acceptance boundary

DynamicReportShadowVerificationAcceptanceService now uses MmsDynamicReportShadowProductionAcceptancePolicy.BuildStrict(...) from ARIEC PR #99.

Current shadow thresholds remain deliberately strict:

• at least 2 report observations
• report-to-poll lag <= 3 s
• polling-transition-to-report correlation <= 3 s
• quality evidence required
• device timestamp evidence required
• device timestamp delta <= 250 ms
• deliberate reconnect required
• maximum one dynamic activation attempt per association

Ctrl+Shift+S supplies independent Smart Control/static-report regression inputs as false; it never assumes those unrelated gates passed.

The service can construct only an in-memory production-acceptance candidate. It never saves the profile and never calls MarkProductionEligible.

Shadow PASS != ProductionEligible is an invariant.

Cleanup and mutation safety

• exact identity-bound persisted evidence only
• exact persisted URCB/member sequence only
• temporary dchg-only proof-field lease
• no GI in shadow phases
• dynamic DataSet deleted on stop
• monitor cleanup mandatory
• exact TrgOps/OptFlds restore mandatory
• fresh-association RCB/DataSet closure mandatory
• one bounded activation attempt per report association
• no automatic profile promotion
• production automatic dynamic reporting remains OFF

Field objective

The next physical run should use Ctrl+Shift+S on the already-qualified IED and retain the evidence window even if strict q/t closes fail-closed. Do not merge this PR merely because CI is green; keep it draft until the physical shadow result and remaining independent Smart Control/static-report regressions are reviewed.