G2.6/G2.7 Smart Dynamic RCB: field-stable per-IED bootstrap + full eligible residual coverage - #230

Goal

Restore Smart Dynamic RCB as the normal ARSAS monitoring path so every eligible exact-resolved residual leaves MMS polling and is acquired through static or Dynamic BRCB/URCB. MMS polling remains only for genuine unsupported/unmapped/degraded points, real RCB-capacity overflow, or a real activation failure that opens the dynamic-write circuit breaker.

ProductionEligible remains a separate certification boundary and is never promoted by this PR.

Runtime acquisition contract

Planning order is:

1. configured static report coverage first;
2. exact live MMS resolution for still-uncovered selected signals;
3. identity-bound P1.6/P1.7 field-capability authorization;
4. fresh current-association verified-free RCB inventory;
5. bounded 1..N Dynamic DataSet/RCB groups using deterministic per-RCB AR_HYB_<hash> identities;
6. MMS polling only for the genuine residual set.

For native P1.7, the generic MaxDynamicReportPlans=8 budget no longer strands otherwise eligible signals on polling. The native-only plan budget expands to the freshly checked association RCB inventory with an application hard ceiling of 64 plans. ARIEC still admits only exact verified-free RCB slots.

P1.7 field-stable per-IED bootstrap

A previously unseen IED is commissioned explicitly with Ctrl+Shift+B:

G2.3 bounded Dynamic DataSet qualification
 -> exact fresh-association residue recovery when association/cleanup fails
 -> retain largest prior cleanup-safe multi-member envelope after exact residue closure
G2.4 transactional free-URCB activation + actual InformationReport proof
G2.5 strict NO-GI spontaneous dchg proof
monitor cleanup + proof-field restore + fresh-association closure
persist native DataChange InformationReportProven profile
persist separate exact native cleanup/capability sidecar

The bootstrap issues zero automatic process/control commands. At G2.5 ARMED the operator causes exactly one already-approved safe physical/status change affecting one listed proven member.

G2.3 field recovery rule

If a smaller milestone is fully cleanup-safe but a later larger DefineNamedVariableList destabilizes the association:

• the failed exact LLN0.ARQ<8hex> residue is inspected on a fresh association;
• delete is allowed only after exact ordered member readback matches the failed attempt;
• closure requires proven namespace absence + completed direct-directory absence + healthy association;
• discovery/directory exceptions never count as absence evidence;
• after closure, ARSAS retains the largest prior IsQualificationSuccess multi-member envelope;
• the later failed larger milestone is never generalized as safe;
• if no prior clean multi-member envelope exists, the unchanged G2.3 ladder gets at most one fresh retry.

Retaining that envelope grants only EnvelopeQualified; G2.4/G2.5 remain mandatory.

P1.7 envelope-bounded normal runtime

Merged ARIEC PR #110 adds an envelope-bounded native runtime wrapper.

The physical dchg witness proves the Dynamic RCB mechanism for fresh exact-resolved members; it is not a permanent commissioning-member whitelist. However each individual runtime Dynamic DataSet is capped to:

min(configured MaxDynamicMembersPerReport,
 Profile.ProvenSafeMemberCount)

Therefore a relay that physically survives 4 members but destabilizes at 8 will be covered by multiple <=4-member Dynamic RCB groups instead of being asked to create an unsafe larger list.

Example when safe envelope=4 and enough free RCBs exist:

132 eligible residuals
-> 33 bounded Dynamic groups
-> 132 Dynamic BRCB/URCB signals
-> 0 MMS polling residual

If only 31 verified-free RCBs exist, at most 124 of those 132 can be Dynamic at that 4-member envelope; the remaining 8 are genuine current-association capacity residual, not an artificial planner fallback.

Two-part durable native authorization

A native DataChange profile alone is insufficient. Normal P1.7 runtime also requires a separate sidecar bound to the exact:

• stable IED identity;
• model fingerprint;
• profile revision;
• RCB and temporary DataSet;
• activation/report evidence IDs;
• included-member mapping;
• actual NO-GI dchg reason;
• association health;
• monitor cleanup;
• proof-field restore;
• fresh-association cleanup closure.

Any mismatch fails closed.

Safety retained

• static reporting precedence;
• exact live MMS member resolution;
• fresh current-association RCB availability before every write;
• per-group size bounded by the physical G2.3 envelope for native P1.7;
• native total plan count bounded by fresh RCB inventory and hard application ceiling;
• deterministic per-RCB AR_HYB_<hash> identity;
• isolated execution-time revalidation before mutation;
• process-lifetime dynamic-write circuit breaker after a real activation failure;
• cleanup/reconnect/revalidation;
• no capability authorization from advertised MMS services alone;
• no MarkProductionEligible call.

ARIEC engine

Current lock pins merged ARIEC:

main @ 9b60458ed910a410b843185384f0e04d3ca78ce0
source PR #110

Relevant lineage:

• PR Add adoption onboarding and field-proof evidence #104 — general field-capability Dynamic RCB member coverage;
• PR [Pages Health] ARSAS production deployment is stale #105 — deterministic per-RCB AR_HYB_<SHA256-prefix> identity;
• PR Harden ARSAS 1.6.19 P0 safety, tests, and release provenance #107 — native per-IED profile + separate physical cleanup witness authorization;
• PR Add portable Sampled Values engineering evidence bundles #108 — exact fresh-association G2.3 residue recovery;
• PR Add auditable Sampled Values evidence bundles #109 — namespace + direct-directory absence proof; exceptions are never absence evidence;
• PR Add unified FAT/SAT test and evidence workspace #110 — cap each native runtime Dynamic DataSet to ProvenSafeMemberCount while retaining multi-group general coverage.

Current physical gate — AA1E1F06R4

Observed field baseline before this recovery slice:

static URCB coverage ~= 6 signals
dynamicBRCB=0
dynamicURCB=0
MMS polling ~=132
freeURCB=31
dynamicAllowed=True

Ctrl+Shift+B reached G2.3 and correctly failed closed when association continuity/cleanup was not proven. No profile was advanced.

Next physical sequence

Open SCL
-> Connect AA1E1F06R4
-> DO NOT Start Monitor first
-> Ctrl+Shift+B
-> G2.3 qualification/recovery
-> G2.4 activation proof
-> G2.5 ARMED
-> cause exactly one approved safe physical/status change on a listed proven member
-> P1.7 PASS
-> Disconnect
-> Connect
-> Start Monitor

Acceptance evidence

After reconnect/start monitor:

• P1.7 native field-capability candidate loads;
• all exact-resolved residuals that fit the fresh free-RCB capacity are assigned Dynamic BRCB/URCB;
• Dynamic groups=N reflects however many bounded groups are necessary, not an artificial 8-plan ceiling;
• each Dynamic group has members <= ProvenSafeMemberCount;
• each group uses a stable AR_HYB_<hash> DataSet;
• RptEna / report monitoring activates successfully;
• spontaneous dchg updates are observed;
• MMS polling contains only unmapped/unsupported/degraded/capacity-overflow points;
• disconnect/reconnect performs fresh revalidation/re-arm without mutation loops.

Keep PR #230 DRAFT + UNMERGED until this physical bootstrap + full eligible residual runtime + reconnect evidence is reviewed cleanly.