G2.6 Smart Dynamic RCB: guarded normal runtime with MMS fallback

[masarray]

Goal

Make Smart Dynamic RCB work again in the normal ARSAS monitoring path without requiring the operator to repeat commissioning/shadow hotkeys and without conflating runtime operation with ProductionEligible certification.

Normal operator workflow after this PR:

Connect IED -> select proven signal(s) -> Start Monitor

No Ctrl+Shift+S is required for normal Smart Dynamic operation.

Physical basis already proven

The qualified field IED has already demonstrated the exact dynamic path twice across a deliberate reconnect:

• exact URCB activation and DataSet binding succeeded;
• RptEna=true succeeded;
• spontaneous dchg InformationReport traffic arrived for the exact Q0 CSWI/XCBR members;
• cleanup/restore/fresh closure succeeded;
• a deliberate reconnect succeeded and the exact report path re-subscribed successfully.

The later strict shadow result remained fail-closed because the scalar InformationReport did not transport report-side q/t and because the certification comparator rejected parity/missing-edge conditions. That certification result is retained as evidence, but it no longer blocks the already-proven guarded runtime acquisition path.

The persisted field profile remains InformationReportProven. This PR never calls MarkProductionEligible and never saves a promoted profile.

ARIEC engine

ARSAS now pins merged ARIEC61850 PR #100:

main @ c899b05f18ba2bd4c82ebff6879e4748036e0d90

PR #100 adds a separate guarded runtime planner while leaving the existing ProductionEligible production planner unchanged.

Guarded dynamic authorization requires:

• current association passes the ARIEC dynamic-report capability gate;
• persisted profile schema is supported;
• current stable identity/model fingerprint matches the profile;
• profile state is InformationReportProven or stronger;
• RCB activation proof is successful;
• actual InformationReport proof is successful and DataChange;
• activation/report RCB and DataSet identities match;
• activation/report member sequences match;
• report members remain an ordered subset of the accepted exact envelope;
• emitted dynamic planning is limited to the exact proven RCB and at most one dynamic group.

Any point outside the proven envelope remains on MMS polling.

ARSAS normal runtime integration

NativeIec61850Client now loads the current qualification profile read-only at normal monitor planning time using DynamicReportQualificationIdentity.Build(...) plus DynamicReportQualificationProfileStore.LoadAsync(...).

If the identity-compatible profile is InformationReportProven with successful dchg evidence, ARSAS supplies MmsDynamicReportGuardedRuntimePlanningContext to ARIEC.

The same PlanId-bound guarded context is reused at fresh execution revalidation immediately before any dynamic write. Planning is therefore not indefinite permission: ARSAS still performs fresh report discovery and exact RCB availability immediately before activation.

Static configured reporting remains eligible. For residual proven points the exact guarded dynamic RCB may be used. Everything else remains polling.

Smart Auto static -> dynamic recovery

If a static RCB cannot be used, existing Smart Auto recovery now carries the same guarded context by PlanId. Recovery:

• excludes the failed static RCB;
• disables static candidates for the recovery attempt;
• may select only the exact dynamic RCB allowed by the InformationReportProven profile;
• requires proven cleanup if the static path already mutated RCB state;
• re-enters normal StartHybridReportMonitorAsync for another fresh availability/revalidation pass.

It cannot substitute an arbitrary free RCB.

Runtime fallback remains active

The existing ARSAS runtime already keeps MMS validation beside report acquisition. If MMS sees a value transition that the armed report did not deliver, the point is degraded to MMS fallback and report verification must recover before report delivery is trusted again.

A real dynamic activation failure still opens the existing per-device process-lifetime dynamic-write circuit breaker so ARSAS does not repeat destabilizing dynamic mutations. Static reporting stays eligible and affected points fall back to bounded MMS polling.

Certification boundary

The physical shadow collector and strict q/t acceptance remain available as certification/debug evidence, but are not an operator prerequisite for normal guarded Smart Dynamic runtime.

InformationReportProven guarded runtime authorization != ProductionEligible certification

No profile promotion is performed by this PR.

Field objective

After exact-head CI is green, field validation is intentionally simple:

1. connect the already-qualified IED normally;
2. select one or more members inside the proven envelope;
3. press Start Monitor;
4. verify diagnostics show the exact proven DynamicURCB/DataSet activation and InformationReport updates;
5. if dynamic activation/report delivery fails, verify automatic MMS fallback rather than a repeated write loop.

Keep this PR draft until that normal-runtime field run is observed cleanly.

[masarray]

G2.6 independent polling q/t increment is implemented and exact-head CI is green at ae1e6b6bf9e86da7e01cd57b13b4fdd762f22017.

Implementation boundary:

• isolated read-only MMS polling association derives exact bounded q/t siblings from each proven process member;
• companion must resolve exactly in the live MMS directory under the same FC and must not be a control/report attribute;
• at most one q read + one t read per successful primary-value observation;
• q uses ARIEC Iec61850QualityDecoder;
• t is accepted only from decoded physical Iec61850UtcTime, normalized to UTC;
• no host read-time fallback, no report-copy, no TimeOfEntry fallback;
• missing/read-failed/undecodable metadata remains missing and strict acceptance stays fail-closed.

Exact-head validation:

• Build ARSAS #1458: success; build 0 errors; regression tests 602/602 passed; portable publish + smoke test passed.
• Windows installer #408: success, including solution build/test and silent install/uninstall validation.
• IO List #401: success.
• SV evidence #570: success.

PR remains draft and unmerged. InformationReportProven remains authoritative; ProductionEligible and production automatic dynamic reporting remain OFF. Next evidence gate is the physical two-phase Ctrl+Shift+S shadow run.