[masarray]

Stack / immutable checkpoint

Base: #656, exact SHA 1314005f7f44bf6995a776b4baeaab581f5b7398 (11/11 workflow green; Windows x64 portable/test artifacts confirmed). Before that #655 exact consumer and #184 exact engine pin remain unchanged. No main changes.

Field evidence + remaining failure possibility

ZIVAVR TapChg report carries ATCC1.TapChg.q=Good as Report quality · raw MMS, process ATCC1.TapChg.valWTr.posVal=6 as separate valid Report value. Earlier UI quality Unknown is an incongruent projection, not a wire-proven bad quality. A stale quality companion hint (TapChg.valWTr.q or a sibling hint) can veto the exact schema-derived TapChg.q route in #656, leaving the user-visible issue unresolved despite proven q evidence.

Fix

• Exact model declaration + FC is the only quality ownership authority. An inventory hint never replaces this declaration; conflicting hints are diagnosed once per model-scoped route-index construction.
• No new MMS I/O, GUI polling, synthetic process values, SOE edges, or historical state. Bounded conflict examples (3), no per-Report enumeration of all selected signals.
• Tests prove stale nested-owner hint, contradictory sibling hint, wrong FC/sibling, and 500 conflicting hints with a bound of 3 diagnostic examples. The model route retains the q payload only for the right process owner.

Acceptance

Use exact HEAD Windows regression + Windows portable artifact; recheck ZIVAVR TapChg quality after Report ingress with Good, Invalid, Test, Substituted where possible. Cross-IED and mismatched-FC must remain isolated. Field FAT NOT qualified by CI alone. OpCnt.stVal unattempted and units.multiplier GVA/invoke unverified remain separate pending P0 issues.

[masarray]

D27 reconciled: HEAD is already an exact Git ancestor of integrated RC.

Verified GitHub compare 81cde9e0bd2f9bc822e737ed2954b758eb8c2bdc..d2d0ca731061824102058756fba8599ddfa2342e: ahead_by=732, behind_by=0. All source commits of this historical SSOT/data-model stack are already represented in protected staging RC #727. Closing this old PR as absorbed/superseded (not directly merged) avoids repeatedly proposing its parent commit chain. Mainline entry remains tracked by blocked integration #729, and existing physical FAT/engine locks are unchanged.