[masarray]

Problem

An Edition 1 single MMS domain BCUGEF650 cannot prove by itself where IED name ends and logical-device instance begins. Current heuristic properly falls back to host, but consumer SCL export can accidentally encode that provisional host ID as an authoritative IED identity.

Engine implementation

• Add read-only TrustedSclIedIdentityMatcher.TryMatch: compare all observed MMS domains with actual SCL IED/AccessPoint/Server/LDevice effective domains (ldName where explicit; otherwise IED.name + inst). Require one unambiguous AP/IED topology and compatible configured IP if present; no vendor suffixes or hidden guesses.
• Return verified confidence/evidence and exact mmsDomain → LDevice.inst mapping only after a full unique match. No network operations, SCL parsing is in-memory, no retries, polling, worker, or discovery overhead.
• Extend authoritative export with optional VerifiedIdentity: fail closed on incomplete aliases, conflicts, or ambiguous identity; normalize IED.name, ConnectedAP.iedName, LDevice.inst/ldName, and dependent FCDA.ldInst together, then validate that every original MMS domain survives. Legacy export path unchanged unless verified evidence is explicitly provided.
• Regression covers GE BCUGE/F650 Edition1, an explicit communication ldName, wrong IP/IED/domain, duplicate AP, unverified identity, and existing multi-domain OLSF501/OCR7SJ8 heuristics.

Boundaries

This is a separately qualified engine candidate; consumer pin remains immutable until validated. No native MMS receive/control/RCB changes, no automatic host-as-authoritative promotion, no vendor naming switch. Physical BCUGE Open SCL/Discovery round-trip must be verified before public release.

[masarray]

Integration safety note (2026-10-11): this #160 is a separately tested MAIN-based P10 patch, not the ancestry used by ARSAS. P10 has now been integrated using the exact pinned Discovery line via PR #161 -> PR #157 at SHA 00ad281, preserving ~97 pre-existing engine commits. Do NOT replace ARSAS's immutable engine pin with this main-based #160 branch or merge this duplicate into that integration without a deliberate ancestry/content audit. Keep this PR as historical/reference candidate; real BCUGE physical round-trip and R10 mainline promotion remain pending.

[masarray]

2026-10-22 staging→main audit triage. Keep this PR OPEN (unique/divergent functionality), do not cherry-pick or close as duplicate.

SHA 5cba8dff0e2890dd8a3af65b6d5c47d6d83f4aad. Evidence: AuthoritativeLiveIedSclExporter.cs and LiveIedSclExportModels.cs ARE byte-identical to staging, but TrustedSclIedIdentityMatcher.cs and TrustedSclIedIdentityMatcherTests.cs DIFFER. Review exact SCL AP/domain normalization and ambiguous identity cases; do not copy the old matcher over the newer staging version.

Current staging SHA 44ac7554f43f2ba06763f3895242cb569b2e6a1c (CI https://github.com/masarray/ARIEC61850/actions/runs/39782663272 = 1,262/1,262 PASS), main promotion DRAFT PR #192. Reconcile on staging only, with new exact SHA and regression proof. No consumer repin or field qualification claimed. Tracking stays in #144 and #192; no duplicate issue.

[masarray]

2026-10-22 semantic reconciliation completed against staging (not a verbatim Git merge): original #160 HEAD 5cba8dff0e2890dd8a3af65b6d5c47d6d83f4aad. The exact Git blobs for AuthoritativeLiveIedSclExporter.cs and LiveIedSclExportModels.cs are identical in staging at 44ac7554f43f2ba06763f3895242cb569b2e6a1c. All six original TrustedSclIedIdentityMatcherTests cases exist by the same test-method names in current staging, plus newer tests (11 total). The staged matcher is strictly more fail-closed at verified endpoint: it requires unique ConnectedAP/IP, exact parsed observed IP, optional exact selected AP name and case-sensitive wire-domain identity, with ambiguous/unbound topology rejection. Replacing it with the older #160 source would regress validation. This is functional supersession, not ancestor/incorporation of every old source commit. Closing without merge; preserve original ref, branch and discussion. Staging→main #192 remains DRAFT, engine pin/FAT untouched. Reopen if future field evidence proves a missing behavior.