P4A: field analysis core, PCAPNG replay, and support bundles

[masarray]

Purpose

Add the first real-world field-usage layer on top of the merged reusable SV core. This draft is paired with the ArSubsv Field MVP PR and remains unmerged for field acceptance testing.

Implemented

• unified offline reader for classic PCAP and PCAPNG Enhanced Packet Blocks
• Ethernet link-type validation and PCAPNG timestamp-resolution handling
• five independent field-health axes: CAPTURE, PROTOCOL, STREAM, CONFIGURATION, and MEASUREMENT
• operational health separated from configuration/measurement review state
• robust signal-state analysis using median, MAD, RMS, fundamental estimate, residual RMS, and SNR
• signal states: Unresolved, Quiet, NoiseDominated, and Active
• no forced-zero or destructive noise suppression
• optional ASDU-field presence reporting; absent datSet, refrTm, smpRate, or smpMod is evidence, not parse failure
• scored SCL binding that does not require optional datSet on wire
• missing captured VLAN tag can remain indeterminate when APPID and destination MAC match, because NIC/driver VLAN stripping is possible
• confRev mismatch remains configuration evidence and does not reject an otherwise strong stream binding
• known-injection comparison contract with REVIEW when no tolerance is supplied
• reproducible ZIP support-bundle writer with manifest, SHA-256 checksums, privacy mode, and safe path validation

Ahmed acceptance behavior represented in deterministic tests

• healthy operational stream remains GOOD while confRev mismatch is CONFIGURATION warning
• noise-dominated zero-input data becomes QUIET / NOISE FLOOR presentation evidence
• APPID 0x4001, destination 01:0C:CD:04:00:00, svID, 64-byte payload, and nofASDU=1 can produce strong SCL binding even when datSet is absent on wire
• expected confRev=100 versus observed confRev=200 remains explicit conflict evidence

Generic boundary

No manufacturer identity is used by parsing, binding, signal classification, scaling, or health logic. Captures from any manufacturer are interoperability fixtures only.

Branch state

The branch was rebuilt directly on merged main, so this PR contains only P4 field-core changes rather than the already-merged engine-unification history.

Validation

ARIEC61850 .NET CI run 240 passed on the rebased P4 head:

• source hygiene, provenance, wording, and licensing checks
• complete restore and warnings-clean build
• deterministic field-core and existing engine tests
• uploaded test diagnostics

The companion ArSubsv PR pins functional engine commit bcecea84b50c628ddce699f1ddafa966aa3255f8; the current PR head adds documentation only after that functional commit.

Pending before merge

• actual Ahmed PCAPNG + CID local replay
• Publisher → capture → ArSubsv end-to-end validation
• known-injection result using a real injected value
• authorized isolated live MU validation

This PR remains draft and does not claim calibrated measurement or formal IEC 61850 conformance.

[masarray]

Repository cleanup audit (2026-08-14): closing this draft PR as deferred, not merged. The field-core work remains preserved on agent/sv-field-core-p4 / head e532c46f418d6953605ab850760add316d5db0d6, but current main has advanced 18 commits beyond the merge base and the PR still explicitly requires real PCAPNG/CID, publisher→capture→consumer, known-injection, and isolated live-MU validation. Keeping a stale draft open would imply a merge path that is no longer valid. Re-port the validated field-core changes onto current main when that acceptance work resumes; do not merge this historical branch directly.