G2.5-A: spontaneous dchg InformationReport proof without GI

[masarray]

Status

G2.5-A implementation is CODE/CI READY, PHYSICAL PROOF PENDING. This branch starts from merged G2.4 ARSAS main (da5d4a11ab5e04686c766c8920657322a2350636) and keeps the merged physical-proven engine immutable.

Production automatic dynamic reporting remains OFF. The persisted profile remains InformationReportProven; this gate cannot set ProductionEligible.

Exact physical candidate

• ARSAS: 16de2018bbb327d93e811df7ebe21cfcd2f80807
• ARIEC61850 engine lock: 26c85400a4da230c4429e6302847f230385b6687
• branch: g2.5-a-spontaneous-dchg-proof
• shortcut: Ctrl+Shift+D

G2.5-A safety / trigger contract

• consumes only an identity-compatible InformationReportProven profile;
• reuses the exact G2.4-proven URCB and exact G2.4-proven member set; it does not select a different URCB;
• fresh direct reads and forced-live free-URCB evidence are required before mutation;
• temporary TrgOps is dchg ONLY, canonical target 0240;
• temporary OptFlds is reason-for-inclusion + data-set-name, canonical target 061800;
• post-lease gate requires UsedByCaller, endpoint-bound Owner when exposed, empty DatSet, RptEna=false, and strict dchg=true / qchg=false / dupd=false / integrity=false / GI=false;
• one temporary DataSet named AR_G25A_* is built from the exact proven member order;
• report monitor is started with triggerGeneralInterrogation:false;
• receive slice also uses triggerGeneralInterrogation:false;
• no polling fallback is used during the proof window;
• NO GI is sent anywhere in G2.5-A.

Physical proof semantics

The UI reports G2.5-A ARMED — NO GI only after exact DataSet readback, DatSet binding, RptEna=true, association health, and report routing are proven.

Only after that ARMED status, the operator causes ONE normal safe physical/process status change affecting one of the eight proven points. No RCB/DataSet manual edits.

PASS requires an ACTUAL spontaneous InformationReport with:

• exact RptID;
• exact temporary DataSet identity;
• at least one included successful member;
• every included DataSet index valid and mapped to the exact proven member at that index;
• optional DataRef, when present, matching the exact member;
• every included member carrying reason-for-inclusion=data-change;
• any general-interrogation, integrity, quality-change, or data-update reason rejects the frame as G2.5-A proof;
• association healthy after the valid report.

Unlike the G2.4 GI proof, a spontaneous dchg report is intentionally allowed to contain only the changed subset; 8/8 inclusion is NOT required.

Cleanup contract

After success, timeout, or fail-closed abort after the proof-field lease:

1. stop/disable the monitor when a session exists;
2. clear DatSet/delete temporary DataSet through the existing persistent-monitor cleanup;
3. restore captured original OptFlds then TrgOps using the proven significant-bit restore path;
4. close the commissioning association;
5. open a NEW read-only association;
6. require exact URCB DatSet empty, RptEna=false, Resv=false, Owner empty;
7. require exact AR_G25A_* temporary DataSet absent both from NamedVariableList discovery and direct DataSet directory read;
8. require fresh association healthy.

The persisted InformationReportProven profile is never saved, downgraded, or advanced by G2.5-A.

Regression coverage

New tests prove:

• constants dchg / canonical 0240 and OptFlds 061800;
• source has no triggerGeneralInterrogation:true;
• strict dchg-only post-lease state PASS;
• reject dchg+GI, dchg+integrity, dchg+qchg, dchg+dupd, and GI-only;
• reject external ownership / Owner IP mismatch;
• valid single-member and non-contiguous partial included-index dchg frames PASS;
• reject GI/integrity/quality-change/data-update and mixed dchg+GI reason;
• reject wrong RptID/DataSet/index/member or access failure;
• profile save/ProductionEligible mutation absent;
• fresh cleanup closure required;
• production AllowDynamicBrcb/Urcb remains disabled;
• Ctrl+Shift+D + ARMED/NO-GI field UX present.

Diff boundary

Compared with merged ARSAS main, exact candidate changes only four files:

• Services/DynamicReportSpontaneousDataChangeCommissioningService.cs
• DynamicReportQualificationResultWindow.G25A.cs
• DynamicReportQualificationUiBehavior.cs
• tests/ARSAS.Tests/DynamicReportSpontaneousDataChangeCommissioningServiceTests.cs

No engine lock, G1 control, production report planner, runtime dynamic-policy flag, or existing G2.4 implementation is modified.

CI — exact candidate

All workflows triggered for exact SHA 16de2018bbb327d93e811df7ebe21cfcd2f80807 are green:

• Build ARSAS #1375 — PASS — run 32439362169
  • source/license/release invariants PASS
  • exact immutable engine checkout/API verification PASS
  • full solution build PASS
  • full ARSAS regression PASS
  • portable publish PASS
  • portable single-EXE smoke PASS
• SV evidence #487 — PASS — run 32439362143
  • focused restore/build PASS
  • focused regression PASS

Installer and IO workflows were not triggered by the G2.5-A path filters on this SHA; no PASS is claimed for workflows that did not run.

Exact artifacts

• portable artifact 9431936560, SHA-256 bebe0b051527b4da8586a26c91e66cf1575718278dc470bc0ad402e36d11cae6
• test evidence artifact 9431923761, SHA-256 2b3b501cea53a1c54fcf5c39985fa986029e1ee6fc168720098ed50b68e78e74
• source snapshot artifact 9431881917, SHA-256 b70bec70ff4c89722aaec9d8ea815d224a553ba593bdeec87f786009e3f57a59

Remaining gate

Physical SIPROTEC spontaneous dchg proof only. Keep this PR draft and do not merge until physical evidence proves:

• strict dchg-only 0240 lease;
• GIrequested=false throughout;
• actual spontaneous report with data-change reason and exact included-member mapping;
• monitor/proof-field cleanup;
• fresh-association cleanup closure.

Production automatic dynamic reporting remains OFF regardless of this G2.5-A outcome.