ENGINE P10.9D / P10.9E SOURCE FIXES — COMPLETED UPSTREAM; ARSAS INTEGRATION BLOCKED (2026-10-11)

Do NOT change the P10.9C ARSAS safe/current code authority defined below. This is an additive engineering update, not a promotion. Operator asked to stop repeating diagnostics and get functional fixes.

• Engine P10.9D: ARIEC PR #163 MERGED; exact CI #38141582981 SUCCESS; immutable checkpoint checkpoint/p10-9d-simulator-report-fifo-ef0fe44f at ef0fe44f3b40e47dc18b1aac4476b635e67d531e. Single async FIFO sender/association removes simulator report-per-Task.Run race with deterministic two-GI blocked-send test. Simulator code is NOT in the ARSAS client dependency. It does NOT prove the cause of GE BCUGE SqNum or BufOvfl.
• Engine P10.9E: ARIEC PR #164 MERGED; exact CI #38142115574 SUCCESS; immutable checkpoint checkpoint/p10-9e-report-header-guard-fa93c9fd at fa93c9fdc7cd98fd3624227ee21c3eefc68bcac7. Core MMS RptID/DatSet contradiction is fail-closed before member-value projection; four new tests, preserves short/missing DataSet compatibility. Engine staging now fa93..., engine main unchanged. Actual SCADA safety fix, but not diagnosed as BCUGE external SqNum cause.
• ARSAS consumer attempted, BLOCKED: draft PR #530, commit 3e84d6951fa405f8ceb2505664f91e57827e3060 (only JSON engine pin). Exact PR-head 14 workflows: 4 successful / 10 failed. Canonical Windows Build #38142378711 compiled engine, 1590/1593 ARSAS xUnit tests passed, three provenance/physical-authority tests failed because lock no longer matches physically accepted/CodeVerified trial rules. Other R7/SCL/IO/SV/production jobs correctly fail closed on the same authority mismatch. Do not merge PR BLOCKED P10.9E — ARIEC core routing guard pin requires additive CodeVerified provenance, not merge-ready #530 and DO NOT give a Windows EXE from this failed build. This is not a failure of new engine functionality but a necessary release qualification gate.
• Next: Issue #531: qualify a deliberately bounded CodeVerified-only engine integration trial by preserving old field-verified SHA, ancestry, physical R7/R10 and mainline protection, then run the existing Windows CI once. No wholesale SHA replacement in tests/workflows.
• Unresolved: BCUGE BRCB #520, external GE Edition1/same-PC simulator still had 19 discontinuities/2 BufOvfl on each ingress in last operator report. Do not demand more identical text diag until a new independently testable causal change or permitted wire trace.

CURRENT CODE AUTHORITY — P10.9C (2026-10-11; exact SHA guarded)

Supersedes historical P10.9B / P10.9A / P10.8E / P10.8D HEAD references below; retain all older evidence and immutable checkpoints. Before successor coding always re-check live GitHub refs and exact-SHA staging CI.

P10.9C UX bug, isolated fix and field diagnostics

Operator uploaded a screenshot of Add IEC 61850 IED pre-filling hardcoded 192.168.1.10 even though prior IP Discovery was targeting 192.16.1.33:102. Root cause: MainWindow.xaml.cs had initial _newDeviceIp = "192.168.1.10", and IpConnectWizardWindow did not choose persisted last operator-submitted IP/port; old UserPreferenceStore tracked only successful endpoints. Repeated valid but failed/offline attempts therefore lost the operator's last input.

Scoped 4-file P10.9C fix: MainWindow.xaml.cs initial IP becomes blank, and only AddRelay_Click opts in to preferLastDiscoveryEndpoint: true. IpConnectWizardWindow.xaml.cs loads persisted last Discovery IP/port ahead of other card defaults, obtains live editable ComboBox.Text (avoids stale LostFocus WPF binding), validates IPv4/IPv6 and port then persists at valid Connect & Discover submission BEFORE network; Cancel/invalid do not write; IOException/UnauthorizedAccessException preference failures never block network. Other uses of same dialog (e.g. EnsureSclEndpointBinding) do not auto-fill or persist the last unrelated Discovery target. Services/UserPreferenceStore.cs adds backward-compatible LastDiscoveryIpAddress and LastDiscoveryMmsPort in existing user-local user-preferences.json, preserving successful relay and signal selection profiles and legacy migration; saved Discovery IP is first in recent dropdown. No new DB, timer, background task, engine, network or admin requirement. 5 new deterministic .NET tests in tests/ARSAS.Tests/DiscoveryEndpointPreferenceRegressionTests.cs, isolated temporary JSON files, verify custom-port roundtrip, overwrite precedence, invalid/corrupt preference fail closed, legacy profile preservation, and explicit SCL opt-in boundary. Canonical Windows .NET test step SUCCESS.

Two private operator Open SCL / Discovery reports (2026-10-11 18:49 / 18:53 WIB), app merge-test SHA 405d0d17bec1f07f288374bdd3897a5469b91426 (parents P10.9A/P10.9B), ARIEC pinned SHA, share exact semantic fingerprint 439d4dc0507019533b154ed68f7f4007f39f6be92b5cd3f413ff3b84f619727e, endpoint 192.16.1.33:102, 8 static DS /124 members / 67/67 visible /6/6 RCB traffic /0 MMS cyclic process polling. Both now use identical CSWI+EVE BRCB GW slots (unlike earlier GW vs SOGI), allowing only same-slot observational comparison: Open 56 frames / 18 findings / 16 discontinuities / 2 BufOvfl; Discovery 60 /20 /18 /2. CSWI GW frames 43 vs45, each BufOvfl=1; EVE GW frames 5 vs7, each BufOvfl=1 and two later clean receive frames. CSWI chronology omittedMiddle=3 vs5, so P10.9B full-history gap metric must be UNVERIFIABLE, not fabricated. Same-slot does NOT establish TCP wire packet order, SOE losslessness, or physical R10 acceptance. Raw user reports and screenshots not committed; BRCB anomalies remain open #520.

No ARIEC code, report/SCL/discovery pipeline, RCB activation, GI, decoder, GOOSE, control, network, cyclic polling or new CI workflows changed. Parent #512 remains draft; no main/release. Next acceptance requires operator Windows GUI test: enter 192.16.1.33:102, click Connect & Discover, close/reopen ARSAS, verify exact prefilled IP/port; retry offline target; verify Cancel/invalid preservation and separate SCL endpoint flow. P10.9B BRCB causal packet-trace and engine 6400/64 partial-name blockers remain separate.

CURRENT CODE AUTHORITY — P10.9B (2026-10-11; exact SHA verified)

This top section supersedes the historical P10.9A, P10.8E and P10.8D HEAD snapshots below. Preserve older checkpoints and findings. Live status must be re-read before successor coding.

Operator evidence — repeat BCUGE reports captured 2026-10-11 18:22 / 18:24 WIB

Two private operator reports are from ARSAS 1.6.40+7bc0241f6361474a4e63f748be18097f52b84a2b, merge-test commit with P10.9A exact commit as a parent (not a new staging authority); engine 00ad2819.... Open SCL and Discovery retain identical semantic fingerprint 439d4dc0507019533b154ed68f7f4007f39f6be92b5cd3f413ff3b84f619727e; 8 static DataSets / 124 members / 67/67 displayed / 6/6 real RCB ingress / 0 cyclic MMS polling. But still different CSWI/EVE BRCB slots (GW vs SOGI); reliability A/B invalid.

Latest Open SCL 49 frames, 16 findings, 13 discontinuities, 3 BufOvfl; CSWI BRB_CSWI_GW010101 39/39 fully retained receive frames and SqNum 12→1, GIreason NO, BufOvfl NO, frame#38, 19,734.103 ms after previous received frame and 20,041.650 ms after RCB start-return, with one later clean report. Discovery 50 frames, 14 findings, 11 discontinuities, 3 BufOvfl; CSWI BRB_CSWI_SOGI101 40/40 fully retained and SqNum 8→1, GIreason NO, BufOvfl NO, frame#39, 19,615.422 ms receive gap and 19,904.610 ms after start-return, one clean report after. EVEGGIO on both ingresses has exactly two GIreason YES+BufOvfl YES frames (SqNum 0/0, changed EntryID) and zero clean follow-up. These are decoder receive-order observations, not captured wire chronology, confirmed lost SOE, timer/root-cause identification, or real hardware R10 acceptance. Full user reports never committed. Issue #520 has detailed triage.

Exactly scoped P10.9B change, validation and boundaries

Only scripts/compare-p10-brcb-sessions.py + scripts/test-compare-p10-brcb-sessions.py changed, with 25 fixture tests (19 existing + 6 new) run in canonical Windows CI and passed. P10.9A opt-in --independent-triage gains full bounded decoder receive chronology gate, including declared first+recent count, 1..N contiguous frame indices, omitted-middle guard, valid timezone-aware monotonic callback timestamps. Where fully covered, expose max receive gap plus strongest non-GI, non-BufOvfl, documented finding with backward/repeat SqNum after a gap (frame IDs, counters, times). Otherwise output UNVERIFIABLE with null metrics, never fabricate timelines. Existing strict default same-slot compare() preserved. Usage:
python scripts/compare-p10-brcb-sessions.py OpenSCL-Diagnostic.txt Discovery-Diagnostic.txt --independent-triage --output ReceiveGapEvidence.json.

No engine, IEC/MMS networking, report activation, GI/RCB state machine, SCL/discovery, decoder, GOOSE, control, cyclic polling or new workflow changes. No main merge or public release. Open blockers: actual MMS packet/association trace and same physically free RCB slot (#520), buffered SOE continuity, engine NameList 64-page/6400-name partial (#162), physical GE R10 and GOOSE E2E. Do not hide BufOvfl or alter decoder based on these reports; future evidence must use safe simulator data indications and permissioned wire capture.

CURRENT CODE AUTHORITY — P10.9A (2026-10-11, post-FF verified)

Supersedes historical P10.8E/P10.8D HEAD snapshots below. Re-read live refs and exact-SHA GitHub Actions status before any successor change.

New operator evidence and P10.9A code scope

Private user-uploaded 2026-10-11 17:29 / 17:32 WIB Open SCL and IP Discovery full BCUGE diagnostics are generated by app merge-test SHA f4b07d454215f14dc659e2e9e57e3cfea62b4e98 (verified parents P10.8D and P10.8E); pinned ARIEC 00ad2819.... Both show 8 static DataSets / 124 ordered members / 67/67 runtime values / 6/6 real static RCBs routed / 0 cyclic MMS process polling and matching 7-row semantic fingerprint 439d4dc0507019533b154ed68f7f4007f39f6be92b5cd3f413ff3b84f619727e. Full raw reports not committed. Issue #520 records extracted metadata.

Critical: Open SCL selected CSWI/EVE GW BRCB slots, while Discovery selected SOGI BRCB slots; fail-closed paired reliability A/B remains mandatory. 13 vs 7 findings does NOT establish better Discovery. Each ingress has total BufOvfl=3. CSWI both have six actual later frames without subsequent findings; EVEGGIO only two initial GI+BufOvfl frames (SqNum 0 then 0, changed opaque EntryID) and zero post-finding frames. Observed last anomaly after RCB start-return: CSWI Open 267.880ms / Discovery 240.127ms, EVE 30.870ms / 30.752ms. No on-wire packet ordering or physical SOE losslessness proof.

P10.9A changes only scripts/compare-p10-brcb-sessions.py and scripts/test-compare-p10-brcb-sessions.py, no new CI workflow. Adds explicit opt-in --independent-triage to reuse original offline parser, output separate per-ingress BRCB BufOvfl/SqNum/GI/post-finding/RCB-lifecycle timing evidence, and mark different-slot pairing blocked. Original strict default compare() behavior unchanged. Missing optional GI/time fields become unknown, not fabricated zero, and impossible summary counts fail. Existing 13 tests plus 6 new positive/negative = 19 tests passed by canonical Windows CI. No ARSAS runtime/engine/decoder/RCB state machine/GI setup/network I/O/control/GOOSE/polling change.

Example: python scripts/compare-p10-brcb-sessions.py OpenSCL-Diagnostic.txt Discovery-Diagnostic.txt --independent-triage --output IndependentTriage.json. Default without flag still rejects cross-slot comparison.

Still open / NEVER claim solved: BRCB startup overflows, underlying server-versus-consumer receive/wire-order cause and buffered SOE continuity (#520); ARIEC 64/6400 partial NameList (#162); GOOSE end-to-end configuration/packets; physical R10 qualification. Next causal step: genuinely free same physical RCB slots in both ingresses, simulator-safe non-control indications and authorized timestamped MMS wire trace. No PurgeBuf, slot takeover, control command, dynamic process polling or main/public release.

CURRENT CODE AUTHORITY — P10.8E (2026-10-11, post-FF verified)

This section supersedes the P10.8D HEAD in the historical handoff below; prior findings and immutable checkpoints remain valid.

Scope: P10.8E changes only scripts/compare-p10-brcb-sessions.py and scripts/test-compare-p10-brcb-sessions.py: the offline exact-BRCB-slot comparator now includes per-slot decoded BufOvfl=true frame counts and rejects missing/impossible BRCB overflow metadata. 13 Python fixture tests (9 existing + 4 new) passed in the exact canonical Windows job. No runtime decoder, ARIEC engine, MMS requests, RCB activation, GI, controls, dynamic polling, UI, GOOSE or SCL semantic changes. Comparator continues to emit SAME_SLOT_OBSERVATION_ONLY; NOT SOE lossless, NOT wire-order evidence and NOT physical R10 qualification. Root cause of historical 13 findings / 10 Sq discontinuities / 3 BufOvfl requires authorized same-slot MMS wire capture as in Issue #520. Engine 64-page NameList budget remains ARIEC #162.

ARSAS / ARIEC61850 — CANONICAL THREAD HANDOFF: P10.8D

Snapshot verified directly against GitHub on 2026-10-11. This issue is the durable thread-handoff index, not an authorization to merge, release, or change IEC 61850 wire behavior. A successor thread MUST re-read actual GitHub refs and CI before work, since branches can advance after this snapshot.

0. FIRST READ / EXACT CODE AUTHORITY

CRITICAL: ARSAS staging has ALREADY advanced from P10.8A a7f4edbf... through P10.8B → P10.8C → P10.8D. Do NOT start coding from older P10.8A or P10.6 just because previous thread messages mention them. The latest HEAD ce73df3a... is descended from P10.6 by 22 commits and behind=0 as of this snapshot.

1. PROTECTED OPERATOR-VERIFIED MILESTONE — P10.6

Formal, immutable P10.6 milestone #518:

• checkpoint/p10-6-field-verified-bcuge-parity-a8835102 → a883510218c62ac02096de37e831feede389f4a1. Do not move/rewrite this checkpoint.
• GE F650 Edition 1, same-PC authorized KM_Test simulator, endpoint 192.16.1.33:102, trusted original engineering BCU_GE.iid (IID SHA256 2776bf5b26d1c8dbac8a00e88149931d0787b8493896106af217951e71df3002).
• Open SCL explicitly resolves IEDName BCUGE, AP S1. IP Discovery after previously verified IID-assisted association also resolves BCUGE with TrustedSclExactDomainMatch (High). Original MMS wire-domain remains BCUGEF650, LD alias F650. Do not heuristically infer IEDName from MMS domain prefix.
• Both paths verified 8/8 static DataSets, 124/124 ordered members, 67/67 unique monitored values, 6/6 real static RCBs receiving InformationReports, 0 cyclic MMS process polling. Report-only authority is essential.
• Independent user-submitted Open SCL and Discovery Diagnostic Reports show 7/7 identical static semantic rows and identical SHA256 439d4dc0507019533b154ed68f7f4007f39f6be92b5cd3f413ff3b84f619727e. Do not turn historical AWAITING PEER INGRESS into fake runtime MATCH without a real peer-capture process.
• Passing these means simulator identity/static semantics/report-routing, not complete MMS discovery model and not lossless BRCB SOE.

2. CHRONOLOGY OF VERIFIED INTEGRATION / CHECKPOINTS

Every listed PR merged into the ARSAS staging parent branch only, by guarded non-force fast-forward. Historical checkpoints are not to be reset.

P10.1/P10.2 main-CI ancestry reconciliation (#514), P10.3/P10.4 offline trusted-IID structural evidence (#515), and P10.5 unique static signal coverage (#516) are already in this lineage. Do NOT redo them.

3. WHAT P10.8D ACTUALLY DOES (NOT A WIRE FIX)

• Services/Iec61850ReportContinuityInspector.cs: constant-memory, association-local BRCB chronology first 32 / latest 8 decoded metadata frames; lazy independent latest 8 anomalous metadata frames; no raw opaque EntryID bytes, no process values or full MMS PDUs.
• Services/DiagnosticReportBuilder.cs: bounded BRCB chronology, BRCB anomaly history, per-RCB RCB triage and RCB follow-up. Historical warnings and BufOvfl preserved.
• scripts/compare-p10-brcb-sessions.py: offline-only comparison of two operator Diagnostic Reports. FAILS CLOSED unless IEDName, engine SHA, static semantic fingerprint, exact BRCB slot reference SET and per-slot DataSet match. Compares counts/receive chronology only. Explicit status SAME_SLOT_OBSERVATION_ONLY; never establishes network wire order or lossless SOE.
• scripts/test-compare-p10-brcb-sessions.py: 9 negative/positive fixtures, invoked by canonical Windows .github/workflows/build.yml.
• Focused C# tests: tests/ARSAS.Tests/P108BBoundedReportChronologyTests.cs, tests/ARSAS.Tests/P108CAnomalyChronologyTests.cs; older P10.7/P10.8A tests retained. No protocol-side code/engine modifications in P10.8A/B/C/D.

To use offline comparator from the repository root with Python 3:

python .\scripts\compare-p10-brcb-sessions.py "C:\field\OpenSCL-Diagnostic.txt" "C:\field\Discovery-Diagnostic.txt" --output "C:\field\P10-BRCB-Comparison.json"

Use actual paths and preserve original diagnostic files. If BRCB slots differ, do not bypass rejection or relabel slots to fake comparable tests.

4. REMAINING BLOCKERS — DO NOT MARK DONE

1. ARSAS BRCB continuity investigation #520: GE simulator BRCB CSWI and EVEGGIO startup shows up to 13 findings / 10 SqNum discontinuities / 3 BufOvfl in same GW RCB-slot captures. Changes in SqNum with opaque EntryID and GI may reflect server replay/buffer state or receive-order issues; NOT yet conclusively attributed. Need authorized actual MMS packet-order evidence, deterministic safe simulated indication changes after GI (no breaker controls), and same actual free RCB slots across ingress. Do not suppress warnings or call SOE lossless because new post-startup reports arrived. A BRCB with only 2 total frames cannot be considered proven healthy based on time alone.
2. ARIEC NameList completeness #162: live discovery bounded 64 pages / 6,400 NamedVariable names, complete=False, incompleteChains=1; 65 LN / 897 DO / 6,274 DA live vs 153 / 2,228 / 14,668 engineering design are different measurement scopes. Need bounded, deferred, cancellable and resumable discovery completeness; do NOT blindly increase page cap or degrade fast first-pass discovery latency.
3. Original IID GOOSE bindings: missing/invalid APPID/MAC, empty/invalid GOOSE dataset and confRev=0 in supplied engineering source. Actual end-to-end GOOSE not proven. Do not suppress discrepancies or invent SCL values.
4. GE real physical relay acceptance is NOT DONE: simulator != independent substation BCU. Actual original IID + authorized relay capture required for physical R10 qualification. Historical R10 evidence belongs to a different device and cannot be silently reused.
5. ARSAS PR GOOSE UX: tidy event header alignment without altering capture #512 and engine PR Show full-resolution IEC 61850 timestamp on FAT hover #157 remain OPEN DRAFT. Do NOT merge to either main or public-release an unqualified P10 trial.

5. SMART / EFFICIENT NEXT WORKFLOW FOR THE NEXT THREAD

1. Call GitHub connector (or API) and re-read both staging refs, lock JSON, PR GOOSE UX: tidy event header alignment without altering capture #512, PR Show full-resolution IEC 61850 timestamp on FAT hover #157, milestone MILESTONE LOCK: P10.6 BCUGE IED identity + 7-row static parity verified on simulator #518 and issue P10.8: isolate BCUGE BRCB BufOvfl and SqNum/EntryID discontinuities with same-slot wire-order evidence #520, Restore first-run SCL, IP and Excel launcher cards #162; inspect latest workflow runs and checkpoint list. Stop if SHA differs, understand newer changes rather than overwrite them. The present snapshot is P10.8D ce73df3a....
2. Review user-provided new P10.8D field reports if present; files were previously attached in chats, not committed to public GitHub. If files are missing, request them; do not infer raw packet sequences from synthetic tests.
3. Run offline same-slot comparator with actual Open SCL / IP Discovery reports; explicitly distinguish per-session counters from deltas within one association. If no comparable same-slot evidence, make only minimal observability improvements (or focus on independent issue Restore first-run SCL, IP and Excel launcher cards #162), never rewrite RCB activation logic speculatively.
4. For new engineering milestone, create a new isolated branch from the latest verified staging HEAD, minimal typed change and focused positive + negative tests. Prefer O(1) hot path, bounded memory, fixed-size evidence, per-device cancellation, original engine APIs and exact SHA pins; no naive polling/dynamic fallback. Avoid rebuilding full CI repeatedly: let one canonical Windows build run and reuse tested artifact/proof in other workflow checks.
5. Require exact-SHA CI green, record portable EXE GitHub Actions artifact, audit diff vs baseline (runtime, engine lock, reporting, GOOSE, controls), guard FF update with expected_sha, create a new immutable checkpoint, then fast-forward staging only. No force-push or main merge. Maintain parent PR comments + this issue with current authority.
6. For field test, original independent trusted IID first (Open SCL + successful association once), then IP Discovery to same endpoint, Static DataSet in both, verify 8/124/67/6 and no cyclic polling. For BRCB, capture complete timestamped same-slot MMS wire order if allowed; no PurgeBuf or RCB ownership takeover, no device control commands.

6. HANDOFF RULE

The next thread should treat GitHub code/ref state as authoritative. This issue preserves the verified context and stop conditions; do not treat a prior assistant's promise, a successful mock fixture, historical different-device R10 evidence, or a green CI alone as field certification. Keep updating this issue with each new checkpoint, changed scope and evidence.

Related source of truth: ARSAS parent PR #512, engine PR #157, milestone #518, BRCB investigation #520, NameList #162.