[masarray]

P7.5 — Source-proven SCD multi-AccessPoint endpoint selection

Stacked draft onto P7.4 PR #473 (base head df3f8ebbaf46e823bf46083cce0efeefb227d786). Linked engine P6.2 ARIEC61850 #153, exact trial commit 352c81e6a798635c6addcee0683235ca87ad416d.

Physical case and root cause

Real Siemens 7SX85 station SCD declares one IED GR_X_7SX85 with J/<Server> and F/<ServerAt apName="J"/>; both have their own direct Communication/SubNetwork type="8-MMS"/ConnectedAP/Address/P type="IP". J can be a valid local independent local MMS test server MMS server and must not be rejected simply because it coincides with a host NIC address. No customer SCD or network addresses are committed.

Changes

• Keep one Engineering card per IED from P7.1 but retain the engine-proven complete same-IED MmsEndpoints inventory.
• On the existing native WPF IED endpoint label, right-click to select any other valid source-declared AccessPoint/IP:port. Inactive entries explicitly disabled during an active or busy association.
• Choice reloads the same source SHA and exact IEDName+AP+IP+port workspace using the P6.2 engine, so AP F retains J's referenced server model without borrowing J's IP address.
• Rebind the offline signals/model to that AP and reset stale discovery/canonical state. Do not auto-connect, probe or fail over. The next Play uses the chosen exact AP.
• Add pure exact endpoint-topology matching, no synthesized endpoint, and focused sanitized J/F tests and WPF no-network guards.
• Update engine lock trial only to engine P2.1: unify industrial workstation UX, Lucide actions and fast search #153 exact commit; retain prior physically proven ancestry.

Regression / acceptance

• Engine: StationServerAtRegressionTests validates both APs' model and DataSet/RCB, dangling ref rejection.
• Consumer: SclServerAtEndpointSelectionTests validates J/F resolution, no cross-IED/IP borrowing, WPF native action source invariants.
• CI build and regression gates required; keep draft, no main merge or public release until live independent local MMS test server J/AP and F/AP tests and static report-only regression are physically verified. No RCB changes or cyclic MMS polling added.

[masarray]

P7.5 field qualification checklist (do not promote yet)

• Source: user's Siemens edition-2007-C station SCD, kept private; one IED with AP J / physical Server and AP F / ServerAt referencing J. Both declare independent 8-MMS ConnectedAP IPv4 addresses. A local test-server address on the same PC is legitimate and is never rejected simply for being local.
• Native WPF import expected: one logical IED card, AP J selected deterministically, no duplicate/no-endpoint card. Right-click endpoint label: shows both source-declared AP J and F; no auto failover.
• Switch to AP F while offline: exact source-SHA and exact IED/AP/IPv4/port verification; model LD/LN, DataSets, report controls remain populated through engine P2.1: unify industrial workstation UX, Lucide actions and fast search #153 ServerAt resolution. Switch back to J and validate same canonical model. Selected AP and both candidates must appear in Copy Diagnostic.
• Local server test on AP J: Play must perform a fresh MMS association. Diagnose IP/port reachability separately from SCD parsing. Verify static DataSet/report-only behavior, RCB evidence and first accepted InformationReport; no cyclic MMS polling.
• Disconnect and switch: stale on-screen points and pending updates from the previous endpoint must be cleared; another IED's points untouched.
• Malformed ServerAt and changed SCD source SHA: fail closed, preserve card; never guess IP, borrow another IED's server or edit source.
• Qualification status: engine synthetic .NET CI passed at ebffc41c9d (CI-only PR Release ARSAS 1.6.25 #154); consumer CI, native Windows artifact and physical test must all pass before merge. Historical accepted R7/R10 baseline remains unchanged.

[masarray]

Downstream handoff: P7.5 → P7.6A

ARSAS P7.6A PR #480 is stacked on this P7.5 head and is now CodeVerified/CI passed at code SHA 1384185a1f42bcf2901e9be0f730863813420ba4, 11/11 Actions success, 1,359 tests passed. Native Win x64 EXE: artifact 11544118143.

P7.6A solves the follow-up missing-IP case by keeping AccessPoint identity independent from SCD ConnectedAP IP, preventing J's endpoint from leaking to F, and storing source SHA + IED + AP-specific successful associations. P7.5's ServerAt model resolution and static report-only paths remain intact; no engine repin.

Detailed shared technical handoff: docs/ENGINEERING_HANDOFF_P7_6A_SCD_ACCESSPOINT.md. Both PRs stay draft/unmerged. Field J↔F AP switching and Discovery↔Open-SCL parity are not yet physically signed off.

[masarray]

D17 P7.5 historical SCD ServerAt / dual MMS AccessPoint reconciliation — evidence-gated closure as superseded RC ancestor, NOT stable release approval.

• Exact PR HEAD 7384de375aad981b4dd75cf5d8c947d72dd4e656 remains OPEN and is an ancestor of protected RC 817c3910e8223fa2ac531a4426ada5d2d4bbbe50 (behind=0, ahead=1953). Checked all 13 original changed paths against RC: none missing. The original positive/negative tests/ARSAS.Tests/SclServerAtEndpointSelectionTests.cs is byte-identical at the two Git trees. The 12 other files have evolved: DO NOT call them byte-identical or replay old lock/workflow changes.
• Current RC source still has SclEndpointTopology.Candidates, Choices, FindExactWorkspace, valid ConnectedAP address proof, ambiguous AP rejection, and AP identity-preserving WPF selection. The later #480 evidence already mapped missing-IP AP choices and sourceSHA+IED+AP binding. No silent endpoint borrowing or automatic MMS failover is authorized.
• The historical P2.1: unify industrial workstation UX, Lucide actions and fast search #153 engine trial lock SHA is not the currently pinned engine. Current RC engines/ARIEC61850.lock.json retains the sclServerAtTrial physical-qualification and noAutomaticMmsFailover provenance while pinning trial engine f75e323e9f8443aa20e0a3818a1d5d77255b2c0f. Production/mainline guard is still fail-closed. This obsolete candidate is not a reason to repin the engine backwards.
• Exact RC-head Windows, SCL R7, interop reference guard are SUCCESS. This is code evidence, not physical Siemens J/F switching validation, no new R7/R10 FAT or approval to merge P0: reconcile v1.6.42 shipped source + stable docs to main (physical R7/R10 gates pending) #729.

Decision: close old P7.5 PR as superseded integrated historical branch; exact original regression tests remain and #446 plus release/physical test gates stay OPEN. No source write, auto-merge, engine repin, release promotion or parallel-owner change.