P10.9F — qualify ARIEC core routing guard as an explicit code-only engine trial (preserve physical R7/R10 gates) #531

Why this issue exists: do not silently weaken verified physical authority

2026-10-11 operator requested meaningful optimized fixes instead of repeated BCUGE reports. Upstream ARIEC61850 completed two actual source fixes, CI and immutable staging checkpoints:

• Engine PR #163 MERGED at ef0fe44f3b40e47dc18b1aac4476b635e67d531e, exact .NET CI #38141582981 SUCCESS, checkpoint checkpoint/p10-9d-simulator-report-fifo-ef0fe44f: per-association single sender FIFO fixes simulator's competing Task.Run InformationReport emission. Not a change to ARSAS client, simulation class not referenced by ARSAS, cannot attribute external BCUGE BufOvfl=true to this fix.
• Engine PR #164 MERGED at fa93c9fdc7cd98fd3624227ee21c3eefc68bcac7, exact .NET CI #38142115574 SUCCESS, checkpoint checkpoint/p10-9e-report-header-guard-fa93c9fd: core client now quarantines contradictory explicitly domain-qualified RptID/DatSet header before value projection. Four deterministic tests pass; preserves short/missing DatSet interoperability. This is a real ARSAS-relevant core bug independently reproduced by tests; it is not evidence of BCUGE's SqNum root cause.

Engine staging feat/495-dataset-type-closure is at fa93c9fdc7cd98fd3624227ee21c3eefc68bcac7; ARIEC main remains e5deed1d8aa11d97991695c6e390baafea7ab797.

Consumer integration attempted, consciously NOT promoted: ARSAS draft PR #530 at 3e84d6951fa405f8ceb2505664f91e57827e3060 changes ONLY engines/ARIEC61850.lock.json to fa93... and PR #164. Candidate canonical Windows Build #38142378711 FAILED: compilation of core succeeded, 1590/1593 ARSAS tests passed, but 3 deliberately fail-closed physical provenance tests rejected new lock. Full PR-head CI final: 4 success / 10 failure / 14 total. Failures are repeated checks of one provenance authority mismatch through multiple workflows: R7 SCL, interoperability, SV, IO, merge/mainline/production gates, field capture and installer. Examples: Unknown engine pin; neither physical R7 nor exact CodeVerified trial, SCL association physical-tested engine head differs from integration, and Runtime engine pin is neither the physically accepted authority nor an exact ancestry-bounded CodeVerified trial.

Safe current ARSAS authority remains P10.9C staging fix/512-goose-event-header-alignment = 83e3ac4d4437f60b73b3a1328c1188dc36c3d4a5, lock = 00ad2819b99ffe6b3f885e59aa24a6afb2b4d8e1, checkpoint checkpoint/p10-9c-discovery-last-ip-83e3ac4d, 16/16 staging workflows previously green. Parent #512 remains DRAFT and main remains untouched. Do NOT claim a consumer portable artifact exists for PR #530; canonical Build failed.

Next exact qualified action — not a mass CI bypass

1. Define one additive explicitly code-verified/non-physical engine routing trial in lock metadata: tested head fa93..., base previous accepted P10 engine 00ad..., engine PR P0.1: restore immediate FAT evidence priority without UI starvation #163/Integrate ARIEC61850 UTC-Time precision fix #164 ancestry, both successful exact-SHA engine CI links. Historical physical R7/R10, P10 identity field-tested SHA and evidence remain unchanged.
2. Centralize or consistently adapt only necessary existing policy logic to distinguish acceptance of a code-only candidate on staging from promotion to production/main. Do not replace historical SHA constants, fake GE physical acceptance, change prior checkpoint refs, disable tests or bypass mainline promotion guards. Add regression cases: exact ancestry match passes staging CI as code-only; missing/tampered ancestry and mainline/release promotion fail closed. Reuse the existing CI workflows rather than creating duplicates.
3. Integrate only after consumer exact-candidate CI, canonical Build, native bridge, SCL/IO/SV, all historical security gates are ALL GREEN. Promote by non-force expected-SHA FF, create checkpoint and verify artifact matches final SHA. If scope requires widespread rewrites to historical frozen proofs, stop and re-evaluate rather than accept a risky/naive exception.
4. Keep BRCB external #520 open: 2026-10-11 two BCUGE same-slot reports: 19 SqNum discontinuities and 2 BufOvfl per ingress despite 67/67 display, 6/6 routed, no polling. Do not repeatedly ask operator for the same two diagnostic reports; causality needs one authorized wire capture or unique new hypothesis.

Acceptance: staging code-only engine pin provenance explicitly qualified without changing old physical acceptance, all 14 consumer PR workflows pass, canonical Windows artifact real; no mainline or physical R10 claims until separately verified.