G2.5-B: fail-closed shadow report/direct-read verification

[masarray]

Status

G2.5-B is CODE/CI READY but PHYSICAL-A1 BLOCKED. It is a stacked draft on top of the frozen G2.5-A/A1 branch and is intentionally NOT operator-runnable yet.

Do not merge or expose G2.5-B until physical G2.5-A1 PASS proves a real qualified-member transition correlated with a spontaneous dchg report.

Parent A1 physical candidate remains immutable at 547fd5be3e73a07e3a4b4b84984a08373b08207b. ARIEC61850 remains pinned to physical-proven 26c85400a4da230c4429e6302847f230385b6687.

Exact G2.5-B code-ready head: 6bc3cd26d1b33274241c7b4ab0e915743fd282b0.

G2.5-B contract

• prerequisite is fail-closed: requires DynamicReportStimulusWitnessCommissioningResult.IsSuccess, stimulus witness proven, report correlation proven, non-empty correlated indexes, complete underlying G2.5-A activation/report proof, monitor cleanup, proof-field restore, and fresh cleanup closure;
• shadow report values are never authoritative for production;
• each shadow event must be reason-for-inclusion=data-change only;
• GI/integrity/qchg/dupd reasons reject the observation;
• report event ordinal, DataSet index, and exact member reference must match the independent direct-read observation;
• independent direct MMS read must succeed and occur after the report within <= 2 seconds;
• canonicalized report value must equal canonicalized direct-read value;
• acceptance requires 3 exact agreements and 0 mismatches;
• one mismatch fails closed;
• no profile save/advance, no ProductionEligible, no production policy change;
• no UI shortcut/entrypoint is added in this PR;
• production AllowDynamicBrcb/Urcb remains OFF.

Scope

New files only:

• Services/DynamicReportShadowVerificationService.cs
• tests/ARSAS.Tests/DynamicReportShadowVerificationServiceTests.cs

No G2.5-A/A1 runtime source is modified by G2.5-B.

CI — exact head 6bc3cd26...

• Build ARSAS #1384 — run 32453061941 — PASS
  • source/license invariants PASS
  • premium/release invariants PASS
  • exact engine checkout/API verification PASS
  • full solution build PASS
  • full ARSAS regression PASS
  • portable publish PASS
  • portable single-EXE smoke PASS
• Validate SV evidence bundles #496 — run 32453061978 — PASS
  • focused restore/build PASS
  • focused regressions PASS

Artifacts

• portable artifact 9436356301, SHA-256 067c9e5dfaae329208005b80a411744da3ff4a13addba8308cf726141c43552f
• test evidence artifact 9436341588, SHA-256 c86441f7f152f89b5a2feda3208bb5bbe211181df53b6ffbe140ac3a5d4ed9df
• source snapshot artifact 9436312846, SHA-256 14f060980b578791502479a9acd80aee5ff02c317dbc42f17d63b43db99572a6

Remaining prerequisite

Physical G2.5-A1 must PASS before G2.5-B receives runtime wiring/operator entrypoint. Until then this PR stays draft and stacked on the A1 branch.

Production automatic dynamic reporting remains OFF.