P10.9G — fail-closed InformationReport subscriber burst overflow, bounded FIFO, exact-engine qualification #532

Concrete target, not another BCUGE diagnostic-only loop

12 Oct 2026 operator BCUGE Discovery real test at 05:21–05:23 WIB: exact engine fa93c9fdc7cd98fd3624227ee21c3eefc68bcac7, 8 static DataSets /124 members /67 of 67 shown/6 of 6 RCB routed/0 cyclic polling; 80 report frames and 603 process updates; BRCB CSWI 16 discontinuities + 1 BufOvfl; EVEGGIO 5 discontinuities +1 BufOvfl, concentrated in the first 0.3s. All four URCBs had zero findings. App build is merge-test 76c1f5348739be83f6a8684b93ff9ac958039d0e with exact P10.9F stage parent.

Source audit facts: ARSAS persistent static reporting drains the ARIEC router's canonical ordered queue and is not the SubscribeInformationReports secondary observer. Thus no evidence points to client callback reordering as the actual cause of BCUGE external SqNum restarts. Do not reset SqNum, suppress BufOvfl, insert dynamic polling, or modify GI/RCB writes speculatively.

Separately, src/AR.Iec61850/Mms/MmsReceiveRouter.cs secondary subscriber fan-out used a bounded capacity-32 Channel DropOldest and ignored overflow. Under bursts it silently loses oldest frames while outwardly appearing healthy; this is an independent reproducible data-integrity defect. ARIEC PR #165 replaces this with explicit fail-closed overflow for only the slow subscriber, retains original queued frames, preserves canonical FIFO and healthy observers, O(1) per-subscription bounded memory, O(n subscriber) existing fan-out, no task-per-frame or polling. Three targeted tests: 80-frame ordered burst, isolated slow-vs-fast consumers, at-capacity resume without spurious abort.

Acceptance gates:

1. Exact engine SHA and .NET Windows regression SUCCESS; guarded FF to engine staging and immutable checkpoint.
2. ARSAS code-only candidate on P10.9F checkpoint e62b42bfbc7d1a9db0ec1ae55bb46789f5fec347; update lock + additive successor provenance contract anchoring P10.9F fa93..., preserve all historical physical SHA/CI evidence and mainline release guards.
3. Negative provenance tests (invalid SHA, parent, CI ID, incorrect control flags, attempts to target main) fail closed. Existing canonical Windows, native bridge, R7/SCL, IO/SV, field-capture and installer workflows all green at exactly candidate SHA. Guarded non-force FF, checkpoint and verified artifact only afterward.
4. No claim BCUGE 21 discontinuities/2 BufOvfl cured without separately validated on-wire cause. Keep BRCB #520 open. Do not demand another identical pair of operator diagnostics.

Optimization: do not create or rerun redundant GitHub workflows; use existing CI at actual PR-head, stop on first unexpected quality gate, never force-merge to main.