[masarray]

Stacked milestone for #144, based on PR #147.

Goal

Move the next orchestration boundary into ARIEC61850 so ARSAS does not have to reproduce IEC 61850 static-coverage -> live-RCB targeting -> availability semantics.

The engine must know the difference between:

• canonical/SCL structural evidence;
• actual live MMS-observed report inventory.

A design/SCL inventory must never be silently promoted to live operational RCB evidence.

Changes

• make MmsReportInventory self-describing with explicit MmsReportInventoryAuthority:
  • LiveMmsObserved
  • SclDesignProjection
  • Unknown;
• inventories produced by live MMS discovery are stamped LiveMmsObserved at the mapper boundary rather than relying on a caller-supplied authority flag;
• add pure MmsCanonicalStaticAcquisitionPreflightPlanner;
• planner composes:
  1. canonical configured-static coverage;
  2. exact canonical -> live RCB resolution;
  3. explicit unresolved-segment evidence;
• if inventory is not live MMS-observed, operational target resolution is withheld and no network probe is authorized;
• unresolved live segments remain unresolved; no sibling/name-family guess and no automatic broad scan;
• add preferred one-shot PrepareCanonicalStaticAcquisitionAsync so planning and execution consume the same inventory instance;
• add ProbeCanonicalStaticAcquisitionAsync for explicit plan/execute separation, with an execution-time authority recheck so an SCL inventory cannot be swapped in after planning;
• exact target budget is fail-closed: if the target set exceeds budget, no partial subset is probed;
• availability execution reuses PR P4 #144: targeted RCB hot path and association-scoped static DataSet evidence #147 exact-target RCB probing and association-scoped static DataSet evidence.

Canonical structural projection

• add MmsCanonicalReportInventoryProjection.Build(CanonicalIedModel) so applications do not recreate DataSet/RCB projection logic;
• exact configured identities are preserved;
• no 01/indexed RCB instance is fabricated;
• no writable attribute exposure, RptEna, reservation, Owner or other live state is invented;
• SCL ingress is tagged SclDesignProjection; discovery-derived canonical snapshots are tagged CanonicalModelProjection, not live runtime authority.

This directly prepares removal of ARSAS-side BuildTrustedSclReportInventory/indexed-name fabrication once the engine pin can be coordinated.

Anti-naive boundary

This closes a subtle Open-SCL trap: an application can synthesize an RCB inventory from SCL for structural planning, but that inventory is not live evidence. The new contract prevents a consumer from accidentally calling it operational truth.

No vendor branching, broad fallback, indexed-name fabrication, or UI-level IEC semantics are introduced.

Tests

• SCL-projected inventory is never promoted to live target evidence;
• live inventory resolves only exact targets;
• partial resolution remains explicit and does not broaden unresolved siblings;
• a non-operational plan performs zero network work even on a disconnected session;
• target-budget overflow fails before network access and never starts a partial probe.

Consumer direction

ARSAS #446 should consume this contract later:

• ARSAS supplies selected signal intent;
• ARIEC computes canonical static coverage and exact live target evidence;
• ARIEC performs bounded targeted availability;
• ARSAS consumes the result rather than re-implementing report semantics.

No ARSAS engine-lock or active #425/#445/#450 files are changed in this milestone.

Software gate

Combined P0-P6 integration head 51fa7092e83472a125aae9a29f033d31f59e6281 passed .NET CI #758 end-to-end in CI-only PR #148:

• source/provenance verification;
• restore;
• Release build;
• complete tests;
• package;
• artifact/diagnostics upload.

CI #754 first caught a test-only canonical evidence enum-name typo; it was corrected before the green exact-head gate. No runtime workaround was introduced.

[masarray]

Staging reconciliation 2026-10-22: this old standalone PR's intended functional scope exists in the newer staging implementation, but the old branch still diverges from the newer code. Do NOT cherry-pick the historic file snapshots. Original HEAD 2faaff016bb2e475534128f7ec87453fd4d4e62f is not claimed an ancestor of staging.

Code and test evidence: Staging has MmsCanonicalStaticAcquisitionPreflightPlanner, authority-gated LiveInventoryRequired (no SCL design inventory promoted to live), exact-target planning, ProbeCanonicalStaticAcquisitionAsync and tests for SCL refusal, exact targets, unresolved no-broadening, inventory swap rejection. Newer tests additionally cover bounded exact-target pagination replacing the legacy global abort.

This source scope passed Windows PR #192 synthetic merge CI #39782663272: 1,262/1,262 tests, zero warnings/errors, exact staging SHA 44ac7554f43f2ba06763f3895242cb569b2e6a1c. Closing old PR as functionally superseded (without merge); Git branch/commits retained, and staging→main #192 stays DRAFT pending consumer and physical acceptance. Reopen if a specific missing invariant is documented.