[masarray]

Scope

Adds an exact LN$CF$DO$ctlModel read-only diagnostic probe, retaining typed distinction between MMS read failure, unsupported value, explicit StatusOnly (0), and operable model (1–4). Bounded request/response hex evidence; no GetNameList, GetVariableAccessAttributes, or MMS Write in this probe.

Verification

Adds fake MMS transport regression tests for ZIV AVR ATCC1.TapChg (0/3/4) and failed MMS read; asserts zero Write.

Safety / baseline

Parent a43b9b4864a9565c02f544d4135fe157c2fac577 (P10.9K). No reporting/discovery/control sequence changes. CI SUCCESS: run 38239451501, Build and Test success at exact head 5e17da5f673eedce125b5c66e7dc2fa0abef2851. This is code-only; no physical control claim.

P10.9Q commissioning follow-up

Exact head f7a4e3ba2f9771e34e04073c0db0900112aa55fa from verified P10.9L 5e17da5f. CI .NET #38257606517 SUCCESS. Adds opt-in ConfigureControlModelAsync: pre-read exact CF ctlModel, compare expected, one typed integer MMS Write only if different and preflight valid, then exact readback; fails closed on mismatch/uncertainty. Writes never touch CO/Oper/SBO. Tests cover exact reference and one write, stale expected (zero writes), unknown target (zero writes), and already-equal (zero writes). Explicitly not qualified on a physical IED.

P10.9R (2026-10-13): simple select/write value 0 support

Exact engine head d1dd8fc14e79c5de15fbc52d77aea48a14c7c02b; .NET CI #38311424952 SUCCESS. Extends guarded one-shot CF ctlModel configuration to accept explicit 0 (StatusOnly), matching the full IEC 61850 model values 0–4 in the consumer's simplified Write Data to IED dialog. No Operate is sent, preflight current-model match and MMS readback remain required. No physical IED write qualification is claimed.

P10.9T — standard position control / structured ST status compatibility

• Head 9d82523978c29dcbf38f60cbfb384c3b050eae7c, .NET CI #38320987660 SUCCESS.
• If a domain NameList only includes structured LN$ST$Pos, verify fixed status descendants by a typed MMS Read rather than declaring no status reference. Unreadable/incorrect status still fails semantic authorization.
• Normal SBO Select → Operate no longer depends on a Cancel type specification; enhanced security retains its more stringent cancellation requirements. No vendor-specific behavior or speculative Operate, no static reporting changes.
• Consumer behavior in ARSAS PR #543 now allows a user to request preflight on Open/Close once ctlModel is Direct/SBO, while still requiring successful typed live semantics before confirmation/dispatch. Staging remains unqualified on physical IED.

P10.9U truncated MMS NameList interoperability

Exact head ad43399, .NET CI #38324547203 SUCCESS (1,121/1,121). Standard CSWI/XCBR/XSWI.Pos permits a single read-only typed ST.Pos.stVal attempt even if the peer's NameList is truncated, without authorizing command semantics from naming alone. Exact two-bit DPC bit-string required; unreadable/wrong-width status denies control. Preflight only; explicit Confirm/Select/Operate downstream remains mandatory. ARSAS staging consumer is PR #543 at 4071cac9857df3361212cebbeb7c15b21d6f276d. Field qualification pending.

P10.9V — exact live BSC authority over stale SPC projection (2026-10-13)

• Head 036e2c00d83a0815b6160147b14ea05975057965; exact parent-lineage comparison vs P10.9U ad43399: ahead 2, behind 0; only the engine semantic resolver and its tests changed.
• Root cause: Resolve() preferred declaredCdc=SPC from persisted/static DataSet metadata over the engine's live descriptor BSC. This created a circular rejection: the consumer promotes verified CDC only after resolver success, so a stale SPC could never be superseded.
• Live BSC overrides advisory SPC only with same-object ST.valWTr.posVal plus a typed exact two-bit ctlVal. Wrong width/type, cross-object feedback, or incompatible declared CDC continues to fail closed. Verification reason records the superseded advisory provenance; no vendor name condition.
• Regression coverage: positive SPC→BSC/reinspection, wrong bit width and Boolean type, unrelated status object, persisted feedback disagreement, and unrelated declared CDC.
• Exact engine .NET CI #38328335496: SUCCESS. This is code-tested, not physical ZIV acceptance. No change to SBO/Operate, report transport, dynamic DataSets, or RCB/GI.
• Consumer staging remains ARSAS PR #543; do not merge before physical authorized command/feedback retest.

[masarray]

P10.9U corrective follow-up: engine head ad43399ed411cc72e6eb68b67e198db5e7b95381, .NET CI #38324547203 SUCCESS (1121/1121 tests). ZIV AVR diagnostic established the real preflight blocker: CSWI1.Pos SBO Normal and CSWI2.Pos Direct Normal expose ctlVal:boolean and reported 2-bit stVal, but domain NamedVariable inventory stops at 6400 names/64 pages. The prior FindStatusReferenceAsync refused to read Pos.stVal when its parent name was absent from the truncated NameList, yielding semanticSafe=False and zero Select/Operate sends. New behavior: for only standard CSWI/XCBR/XSWI .Pos, allow exactly one targeted read of ST.Pos.stVal even when it is not in NameList; validate exact two-bit bit-string from returned MMS data. Missing/unreadable/wrong-width status denies control. This is a read-only preflight probe, not automatic Operate, new dynamic polling, or an authority bypass. Previous P10.9T flows preserved; physical acceptance pending.

[masarray]

Consolidation cleanup (2026-10-22): this immutable source HEAD 036e2c00d83a0815b6160147b14ea05975057965 is already a verified ancestor of DRAFT #190 candidate 14b19d30466fd296ad1e6d0bddcdd574992bc464 (0 missing commits), whose Windows merged-tree CI run https://github.com/masarray/ARIEC61850/actions/runs/39778971482 passed 1,262/1,262 tests. Closing this redundant stacked PR without merging it independently. Its branch and all commits remain recoverable, including the ARSAS pinned historical engine source when relevant. #190 has NOT been promoted to main, physical FAT acceptance is NOT claimed, and no consumer engine lock is changed. Reopen if this consolidation is withdrawn.