P4B: ArSubsv Field Mode with PCAPNG, layered health, and support bundle

[masarray]

Purpose

Make ArSubsv immediately useful for field engineers such as Ahmed Mohaisn without waiting for ideal support for every Sampled Values implementation.

This draft targets merged main directly and pins ARIEC61850 P4 field-core commit bcecea84b50c628ddce699f1ddafa966aa3255f8 from PR #47. It remains unmerged for local field acceptance.

Implemented

Offline and live workflow

• opens classic .pcap and .pcapng
• capture-file parsing is owned by ARIEC61850 so offline and live traffic use the same SV parser/runtime pipeline
• PCAPNG Enhanced Packet Blocks and timestamp resolution are supported by the shared engine
• offline replay forwards only Ethernet SV EtherType candidates; unrelated LLDP, PTP, ARP, and management traffic is not mislabeled as an SV parse error

Evidence-scored SCL binding

• candidates use APPID, destination MAC, svID, payload length, ASDU count, VLAN visibility, optional datSet, and confRev evidence
• optional datSet is not required on wire
• a missing captured VLAN tag does not automatically block binding when APPID and destination MAC match; diagnostics explain possible NIC/driver VLAN stripping
• confRev mismatch is CONFIGURATION evidence rather than a protocol failure

Field health presentation

The selected stream now shows a visible strip above the waveform with independent axes:

• CAPTURE
• PROTOCOL
• STREAM
• CONFIGURATION
• MEASUREMENT

Operational failures are separated from configuration and measurement confidence. A healthy stream can remain operationally GOOD while configuration is WARN and measurement is QUIET or provisional.

Quiet/noise-floor handling

• waveform evidence uses the shared median/MAD/RMS/fundamental/SNR analyzer
• signal states include ACTIVE, QUIET, NOISE DOMINATED, and UNRESOLVED
• raw samples are never zeroed or suppressed
• current field state and signal evidence are kept in the evidence panel without accumulating stale duplicate lines

Known-injection validation

A Validate toolbar action now opens a practical known-injection dialog:

• choose an available engineering phasor
• enter expected RMS
• optionally enter amplitude, angle, and frequency tolerances
• no tolerance produces REVIEW with numerical error rather than invented PASS/FAIL
• result is stored in selected-stream evidence and included in the support bundle

Support bundle

Export creates a reproducible .zip bundle containing:

• manifest.json
• sha256sums.txt
• receiver evidence Markdown and JSON
• five-axis field summary JSON
• selected-stream diagnostics Markdown
• explicit CT/VT measurement-context JSON when configured
• application/engine revision evidence
• SCL SHA-256 when an SCL/CID is loaded

The first tranche is metadata-only by default and does not silently copy the full PCAP or original SCL.

Health correction

Cumulative parse errors no longer make a valid decoded session permanently BAD. Decoded SV plus some parse errors becomes WARN; BAD is reserved for operational failure.

Ahmed acceptance target

CAPTURE        GOOD
PROTOCOL       GOOD
STREAM         GOOD
CONFIGURATION  WARN   (for example confRev 100 expected / 200 observed)
MEASUREMENT    QUIET or WARN depending on scaling/context evidence

No manufacturer-specific runtime rule is introduced.

Validation on head f6f0b1e3e3f40be31cdfced4dccc83db74f9eb41

Paired CI run 309 — passed

• licensing, provenance, public wording, and engine ownership
• exact pinned ARIEC61850 checkout
• restore
• Publisher warnings-as-errors build
• Subscriber warnings-as-errors build
• 133/133 existing ARSVIN tests
• application-consumed protocol-core coverage gate
• Publisher and Subscriber dependency vulnerability reports

CodeQL run 313 — passed

• exact pinned engine checkout
• paired restore
• paired warnings-as-errors build
• CodeQL analysis completed successfully

Windows release validation run 220 — passed

• build and tests with warnings as errors
• Publisher and ArSubsv single-file portable applications
• Windows installer
• CycloneDX SBOM
• artifact validation
• silent install/uninstall smoke test
• SHA-256 checksums

GitHub Release publication was skipped because this is a draft PR, not a release tag.

ARIEC61850 P4 deterministic CI also passed.

Pairing

• application PR: this PR
• engine PR: masarray/ARIEC61850#47
• pinned functional engine commit: bcecea84b50c628ddce699f1ddafa966aa3255f8

Pending before merge

• actual Ahmed PCAPNG + CID local replay
• verify eight ordered channels and 64-byte payload presentation
• verify expected/observed confRev warning
• verify zero-input noise state and waveform minimum-axis presentation
• known-injection validation using a real injected value
• optional capture excerpt inclusion in support bundle

This PR remains draft and unmerged.