P6.1: isolate dynamic RCB recovery from proven static behavior

[masarray]

P6.1 Stability Correction

This patch restores the pre-P0 safety boundary while keeping P1/P2/P5/P6 improvements.

Runtime change

• static activation/revalidation failure is no longer converted into a dynamic DataSet/alternate-RCB mutation;
• the former P4 recovery hook is retained only as a source-compatible fail-closed path: no dynamic write, bounded MMS fallback;
• genuine residual dynamic plans still use the attempt-aware ARIEC activation path;
• genuine failed dynamic activation still opens the P6 per-device process-lifetime circuit breaker;
• P6 mandatory static DataSet-member mapping remains intact.

Engine integration

Pins ARIEC P6.1 PR #87 / commit 1d052c3919ca1fdf043747d858dab9b6c384e827, where configured static RCBs remain visible to the stable planner and capability qualification gates only empty RCB slots requiring dynamic mutation.

Regression correction

Tests that previously asserted static failure -> dynamic recovery as desired behavior are inverted. CI now requires static failure to be side-effect free and unable to create a DataSet, write an alternate RCB, or open the dynamic circuit.

No merge to main is intended until full ARIEC + ARSAS CI is green.

[masarray]

P6.1 validation complete on head 12cdcc9beba9d02a5c10d501c259199ebb097ac2 with ARIEC pin 1d052c3919ca1fdf043747d858dab9b6c384e827 (ARIEC #87).

Green CI:

• Build ARSAS 32107107313: SUCCESS — source checks, immutable engine checkout, API verification, restore, build, full application regression tests, portable publish, portable smoke test
• Windows installer 32107107201: SUCCESS — build/test plus install/uninstall smoke
• IO List Testing 32107107213: SUCCESS
• SV evidence 32107107249: SUCCESS

The first validation attempt exposed only three stale tests that hard-coded the old P4 engine SHA; production build itself succeeded. Those guards were corrected to preserve immutable lock/provenance semantics without freezing an obsolete engine revision.

Static activation failure is now side-effect free: it cannot create a dynamic DataSet, write an alternate RCB, or open the dynamic-write circuit. Genuine residual dynamic activation remains attempt-aware and still opens the P6 circuit after a real failure.

[masarray]

Field follow-up from real IED diagnostic (app 1.6.31+12cdcc9 / engine 1d052c3): the first association successfully armed static BRCB Buffer02 for all 6 static members, then the first dynamic DefineNamedVariableList attempt failed and moved the association to MmsInitiateFailed. Immediate reconnect then observed freeBRCB=0 and fell to 115/115 polling. P6.1 follow-up commit 01b950c adds mixed-plan side-effect isolation: when an authoritative plan contains both static and dynamic segments, dynamic mutation is probationed before static RCB activation. Coverage precedence remains static -> dynamic -> polling; only activation side-effect ordering changes. Therefore a relay-aborting dynamic write cannot leave the proven static RCB transiently armed/owned before reconnect. Static-only ordering is unchanged. Regression tests cover mixed and static-only ordering. CI from 01b950c is green: Build ARSAS #1288 incl. full regression + portable smoke, installer #274 incl. install/uninstall smoke, IO #274, SV #410. Keep PR draft pending physical retest; do not weaken InUse/Owner classification because another RCB is genuinely used by ABB.