Reject impossible IEC 61850 report values before Event Log mutation

[masarray]

Field evidence

ARSAS 1.6.31+a7e2f91 with engine e23b295 was retested against AA1C1F13R4. StaticUrcb Event Log rows still briefly showed report metadata/process misalignment (bits(0000, ...), long all-ones inclusion bitmaps, and DPC bit strings under unrelated Boolean .stVal references) while MMS verification moments later produced the correct scalar values.

Engine root cause

ARIEC61850 PR #81 identified and fixed the upstream cause: a valid zero-OptFlds report was rejected and could fall through to raw AccessResult-by-index projection. PR #81 is merged to engine main as becda399b4a3ae34831215fc915798b4f846c1be; ARSAS is immutably pinned to that revision in this PR.

ARSAS defense in depth

Public SOE/Event Log must not depend on one parser assumption alone. This PR adds a consumer-side type safety boundary immediately before report values can mutate runtime state or raise SOE events:

• Boolean/SPS signals reject report BIT STRING values.
• DPC/Dbpos accepts only the exact 2-significant-bit MMS form (unused=6); report inclusion/OptFlds bitmaps are rejected.
• Scalar numeric/enum signals reject residual BIT STRING or Structure/Array output that failed scalar projection.
• Legitimate native BitString and Quality signals remain allowed.
• Recognized structured scalar values remain allowed when the existing formatter successfully projects them (e.g. Structure{stVal=false,...} -> False, numeric BCR/actVal -> scalar).
• Rejected report samples set report verification back to unverified, preserve existing state/SOE history, emit REPORT_VALUE_REJECTED once per affected point, and leave MMS verification/fallback authoritative.

Regression coverage

• Field-shaped Boolean CILO1.EnaOpn.stVal rejects bits(...) metadata.
• Real DPC CSWI1.Pos.stVal accepts bits(40, unused=6) and formats Open [01].
• DPC rejects long inclusion bitmap masquerading as a value.
• Structured Boolean scalar remains accepted after formatter projection.
• Unprojected scalar Structure is rejected.
• Native BitString and Quality values remain allowed.
• Source invariant proves the safety gate executes before ApplyValueUpdate and therefore before state/SOE mutation.
• Engine pin regression updated to merged PR Surface detailed fault-transfer failures on record rows #81.

Temporary patch tooling was removed before this PR; final diff contains only production source, engine lock, and tests.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.