diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml
index 12b67ef..dd2f9f5 100644
--- a/.github/ISSUE_TEMPLATE/bug.yml
+++ b/.github/ISSUE_TEMPLATE/bug.yml
@@ -1,5 +1,5 @@
name: Bug report
-description: Report a reproducible runtime, protocol, UI, or packaging defect.
+description: Report a reproducible runtime, protocol, UI, replay, or packaging defect.
title: "[Bug]: "
labels: [bug, triage]
body:
@@ -11,7 +11,7 @@ body:
id: version
attributes:
label: Process Bus Insight version
- placeholder: 1.3.0-beta.2 or commit SHA
+ placeholder: 1.4.0-beta.1 or commit SHA
validations:
required: true
- type: dropdown
@@ -20,6 +20,7 @@ body:
label: Area
options:
- SV analyzer / waveform / phasor
+ - PCAP replay / runtime snapshot
- GOOSE inspector
- PTP / timing context
- SCL validation
@@ -33,8 +34,8 @@ body:
id: environment
attributes:
label: Environment
- description: Windows version, Npcap version, adapter type, and capture path.
- placeholder: Windows 11 x64; Npcap 1.x; Intel NIC via TAP
+ description: Windows version, Npcap version, adapter type, and capture/replay path.
+ placeholder: Windows 11 x64; Npcap 1.x; Intel NIC via TAP or sanitized PCAP replay
validations:
required: true
- type: textarea
@@ -42,9 +43,9 @@ body:
attributes:
label: Reproduction steps
placeholder: |
- 1. Start capture...
+ 1. Start capture or replay...
2. Select stream...
- 3. Change publisher setting...
+ 3. Change publisher setting or replay the sanitized file...
validations:
required: true
- type: textarea
diff --git a/.github/workflows/candidate-package.yml b/.github/workflows/candidate-package.yml
index 4fb9889..7b53bf4 100644
--- a/.github/workflows/candidate-package.yml
+++ b/.github/workflows/candidate-package.yml
@@ -29,7 +29,7 @@ env:
jobs:
candidate:
name: Build verified Windows x64 candidate
- if: github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'stabilization/')
+ if: github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'stabilization/') || startsWith(github.head_ref, 'architecture/')
runs-on: windows-latest
timeout-minutes: 35
diff --git a/.github/workflows/release-package.yml b/.github/workflows/release-package.yml
index c9a552e..ebe60a6 100644
--- a/.github/workflows/release-package.yml
+++ b/.github/workflows/release-package.yml
@@ -4,9 +4,9 @@ on:
workflow_dispatch:
inputs:
version:
- description: Version label, for example 1.3.0-beta.2
+ description: Version label, for example 1.4.0-beta.1
required: true
- default: 1.3.0-beta.2
+ default: 1.4.0-beta.1
publish_release:
description: Create or update a GitHub Release
required: true
@@ -25,7 +25,7 @@ on:
release_notes_file:
description: Markdown file used as release body
required: true
- default: docs/RELEASE_NOTES_v1.3.0-beta.2.md
+ default: docs/RELEASE_NOTES_v1.4.0-beta.1.md
push:
tags:
- "v*"
@@ -130,7 +130,7 @@ jobs:
$sha = "artifacts/release/SHA256SUMS.txt"
$manifest = "artifacts/release/release-manifest.json"
$notesFile = '${{ github.event.inputs.release_notes_file }}'
- if ([string]::IsNullOrWhiteSpace($notesFile)) { $notesFile = 'docs/RELEASE_NOTES_v1.3.0-beta.2.md' }
+ if ([string]::IsNullOrWhiteSpace($notesFile)) { $notesFile = 'docs/RELEASE_NOTES_v1.4.0-beta.1.md' }
if (-not (Test-Path $notesFile)) { throw "Release notes file not found: $notesFile" }
$releaseArgs = @('release', 'create', $tag, $zip, $sha, $manifest, '--title', "Process Bus Insight $tag", '--notes-file', $notesFile, '--target', '${{ github.sha }}')
diff --git a/.github/workflows/runtime-architecture.yml b/.github/workflows/runtime-architecture.yml
new file mode 100644
index 0000000..2670e1a
--- /dev/null
+++ b/.github/workflows/runtime-architecture.yml
@@ -0,0 +1,90 @@
+name: Runtime architecture
+
+on:
+ pull_request:
+ branches: [main]
+ paths:
+ - "src/ProcessBus.Iec61850.Raw/Runtime/**"
+ - "src/ProcessBus.Iec61850.Raw/Replay/**"
+ - "tests/ProcessBus.Tests/Pcap*Tests.cs"
+ - "tests/ProcessBus.Tests/AnalyzerRuntimeSnapshotSourceTests.cs"
+ - ".github/workflows/runtime-architecture.yml"
+ schedule:
+ - cron: "17 3 * * 4"
+ workflow_dispatch:
+ inputs:
+ iterations:
+ description: Number of deterministic architecture passes
+ required: true
+ default: "3"
+
+permissions:
+ contents: read
+
+concurrency:
+ group: runtime-architecture-${{ github.workflow }}-${{ github.ref }}
+ cancel-in-progress: true
+
+env:
+ DOTNET_NOLOGO: true
+ DOTNET_CLI_TELEMETRY_OPTOUT: true
+
+jobs:
+ architecture:
+ name: Immutable snapshot and PCAP replay gate
+ runs-on: windows-latest
+ timeout-minutes: 30
+
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4
+
+ - name: Setup .NET
+ uses: actions/setup-dotnet@v5
+ with:
+ dotnet-version: 8.0.x
+
+ - name: Restore
+ run: dotnet restore .\ProcessBusSuite.sln
+
+ - name: Build
+ run: dotnet build .\ProcessBusSuite.sln -c Release --no-restore /p:ContinuousIntegrationBuild=true
+
+ - name: Repeat runtime architecture suite
+ shell: pwsh
+ run: |
+ $requested = '${{ github.event.inputs.iterations }}'
+ $iterations = 3
+ if (-not [string]::IsNullOrWhiteSpace($requested)) {
+ $parsed = 0
+ if (-not [int]::TryParse($requested, [ref]$parsed)) {
+ throw "Invalid iterations value: $requested"
+ }
+ $iterations = [Math]::Clamp($parsed, 1, 20)
+ }
+
+ New-Item -ItemType Directory -Path .\TestResults\RuntimeArchitecture -Force | Out-Null
+ Write-Host "Runtime architecture iterations: $iterations"
+
+ for ($iteration = 1; $iteration -le $iterations; $iteration++) {
+ Write-Host "=== Runtime architecture pass $iteration/$iterations ==="
+ dotnet test .\tests\ProcessBus.Tests\ProcessBus.Tests.csproj `
+ -c Release `
+ --no-build `
+ --filter "Category=RuntimeArchitecture" `
+ --logger "trx;LogFileName=runtime-architecture-$iteration.trx" `
+ --results-directory .\TestResults\RuntimeArchitecture
+
+ if ($LASTEXITCODE -ne 0) {
+ throw "Runtime architecture pass $iteration failed."
+ }
+ }
+
+ - name: Upload runtime architecture evidence
+ if: always()
+ uses: actions/upload-artifact@v7
+ with:
+ name: runtime-architecture-${{ github.run_id }}
+ path: TestResults/RuntimeArchitecture/**
+ if-no-files-found: error
+ retention-days: 30
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 25dbe15..1988bce 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,11 +6,35 @@ All notable changes are documented here. The project follows Semantic Versioning
### Planned
-- Golden PCAP replay corpus with sanitized multi-stream scenarios
+- Sanitized golden PCAP/PCAPNG replay corpus with broader multi-vendor scenarios
- Further decomposition of the analyzer runtime and WPF workspace
- Expanded SCL multi-vendor validation
- Evidence export for FAT/SAT reports
+## [1.4.0-beta.1] - 2026-07-11
+
+### Added
+
+- Immutable selected-stream runtime generations with copied waveform, analog, identity, and diagnostic evidence
+- Atomic runtime snapshot publisher for coherent consumer reads
+- Classic Ethernet PCAP replay through the same raw decoder/analyzer path used by live Npcap capture
+- Microsecond and nanosecond PCAP timestamp variants in little-endian and big-endian formats
+- Bounded rejection for unsupported link types, invalid headers, oversized records, and truncated captures
+- Deterministic runtime-architecture tests covering replay timing, snapshot immutability, and three-stream isolation
+- Dedicated Runtime Architecture GitHub Actions gate with downloadable TRX evidence
+- Release-candidate packaging support for `architecture/*` branches
+
+### Changed
+
+- Release and documentation versioning use `1.4.0-beta.1`
+- Runtime architecture now exposes a coherent publication boundary instead of requiring consumers to retain mutable analyzer display models
+- Offline replay is explicitly treated as a reproducibility path, not a separate decoder or a traffic publisher
+
+### Limitations
+
+- PCAPNG is not yet supported by the first replay reader
+- The internal analyzer remains partly monolithic; complete per-stream runtime extraction and live UI migration continue in later v1.4 builds
+
## [1.3.0-beta.2] - 2026-07-10
### Added
@@ -58,6 +82,7 @@ All notable changes are documented here. The project follows Semantic Versioning
- Hardened BER parsing, Npcap lifecycle, release version propagation, and public-repository packaging.
-[Unreleased]: https://github.com/masarray/DigSubAnalyzer/compare/v1.3.0-beta.2...HEAD
+[Unreleased]: https://github.com/masarray/DigSubAnalyzer/compare/v1.4.0-beta.1...HEAD
+[1.4.0-beta.1]: https://github.com/masarray/DigSubAnalyzer/compare/v1.3.0-beta.2...v1.4.0-beta.1
[1.3.0-beta.2]: https://github.com/masarray/DigSubAnalyzer/compare/v1.3.0-beta.1...v1.3.0-beta.2
[1.3.0-beta.1]: https://github.com/masarray/DigSubAnalyzer/releases/tag/v1.3.0-beta.1
diff --git a/Directory.Build.props b/Directory.Build.props
index 44bac22..a667847 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -10,8 +10,8 @@
en
- 1.3.0
- beta.2
+ 1.4.0
+ beta.1$(VersionPrefix)-$(VersionSuffix)$(Version)$(VersionPrefix).0
diff --git a/README.md b/README.md
index 9f7df65..5418475 100644
--- a/README.md
+++ b/README.md
@@ -2,6 +2,7 @@
[](https://github.com/masarray/DigSubAnalyzer/actions/workflows/ci.yml)
[](https://github.com/masarray/DigSubAnalyzer/actions/workflows/runtime-stability.yml)
+[](https://github.com/masarray/DigSubAnalyzer/actions/workflows/runtime-architecture.yml)
[](https://github.com/masarray/DigSubAnalyzer/actions/workflows/codeql.yml)
[](https://github.com/masarray/DigSubAnalyzer/actions/workflows/pages.yml)
[](https://github.com/masarray/DigSubAnalyzer/actions/workflows/release-package.yml)
@@ -12,9 +13,9 @@
**Process Bus Insight** is a free, open-source, receive-only **IEC 61850 Process Bus analyzer for Windows**. It provides engineering visibility into **Sampled Values (SV)**, **GOOSE**, **PTPv2 timing context**, and **SCL expected-vs-observed validation** for FAT, SAT, commissioning, interoperability checks, and troubleshooting.
-The project is currently released as a **public beta**. Its design goal is field clarity without overstating measurement confidence: identify live publishers, inspect protocol evidence, isolate unhealthy streams, compare observed traffic against SCL, and capture defensible findings.
+The project is currently released as a **public beta**. Its design goal is field clarity without overstating measurement confidence: identify live publishers, inspect protocol evidence, isolate unhealthy streams, reproduce captured traffic offline, compare observed traffic against SCL, and capture defensible findings.
-> **Timing confidence:** normal Windows/Npcap timestamps are software based. Arrival timing is useful for screening and troubleshooting, but is not certification-grade jitter evidence unless the capture path is validated with appropriate hardware timestamping, TAP, or trusted timing equipment.
+> **Timing confidence:** normal Windows/Npcap timestamps and replayed capture timestamps are software evidence. Arrival timing is useful for screening and troubleshooting, but is not certification-grade jitter evidence unless the capture path is validated with appropriate hardware timestamping, TAP, or trusted timing equipment.
@@ -27,6 +28,8 @@ Current capabilities include:
| Area | Capability |
| --- | --- |
| SV analyzer | Multi-stream discovery, APPID/svID/MAC/VLAN/confRev evidence, selected-stream workspace, raw decoded sample waveform, RMS, phasor, sequence diagnostics, shape/distortion indication, and selectable scope windows. |
+| Runtime snapshots | Immutable selected-stream generations containing copied identity, waveform, analog, phasor, shape, and diagnostic evidence for coherent consumer reads. |
+| PCAP replay | Bounded classic Ethernet PCAP replay through the same raw decoder/analyzer entry point used by live Npcap capture. |
| GOOSE inspector | Publisher discovery, stNum/sqNum tracking, event timeline, typed `allData` decoding, change summaries, and SCL-assisted semantic context. |
| PTP visibility | Passive PTPv2 message context, grandmaster/domain evidence where available, freshness wording, and timestamp-confidence boundaries. |
| SCL validation | Load SCD/ICD/CID files and compare expected publishers/streams against observed APPID, destination MAC, VLAN, svID, confRev, and related evidence. |
@@ -40,6 +43,7 @@ Wireshark remains an essential packet-analysis tool. Process Bus Insight focuses
- Is the observed APPID, MAC, VLAN, svID, or confRev consistent with the SCL design?
- Is the problem owned by the stream, publisher, timing source, adapter, or capture path?
- Are waveform, RMS, and phasor values coming from the same selected stream?
+- Can a sanitized capture reproduce the same decoder and runtime behavior away from site?
- What evidence can be copied into a FAT/SAT finding without overclaiming timing accuracy?
## Download and run
@@ -54,7 +58,7 @@ Wireshark remains an essential packet-analysis tool. Process Bus Insight focuses
Current public-beta package naming:
```text
-ProcessBusInsight-v1.3.0-beta.2-win-x64-portable.zip
+ProcessBusInsight-v1.4.0-beta.1-win-x64-portable.zip
SHA256SUMS.txt
release-manifest.json
```
@@ -66,19 +70,18 @@ See [`docs/QUICK_START.md`](docs/QUICK_START.md) for the field checklist.
## Architecture
```text
-Process Bus / TAP / Mirror Port
- ↓
-Npcap raw Ethernet capture
- ↓
-ProcessBus.Iec61850.Raw
- SV / GOOSE / PTP decode and per-stream runtime
- ↓
-ProcessBus.Core immutable display models
- ↓
-ProcessBus.App.Wpf engineering workspaces
+Process Bus / TAP / Mirror Port ──> Npcap raw Ethernet capture ─┐
+ ├─> ProcessBus.Iec61850.Raw
+Classic Ethernet PCAP ───────────> bounded replay reader ───────┘ SV / GOOSE / PTP decode
+ ↓
+ immutable runtime generation
+ ↓
+ WPF / tests / future export
```
-The selected SV stream is the source of truth for waveform, RMS, phasor, and stream details. Per-stream state must remain isolated; UI refresh must never combine values from different publishers. See [`docs/architecture/STREAM_RUNTIME.md`](docs/architecture/STREAM_RUNTIME.md).
+The selected SV stream is the source of truth for waveform, RMS, phasor, and stream details. Per-stream state must remain isolated; consumers must never combine values from different publishers. The v1.4 runtime snapshot boundary copies mutable analyzer collections before atomic publication. See [`docs/architecture/STREAM_RUNTIME.md`](docs/architecture/STREAM_RUNTIME.md) and [`docs/architecture/RUNTIME_SNAPSHOT_AND_REPLAY.md`](docs/architecture/RUNTIME_SNAPSHOT_AND_REPLAY.md).
+
+The first replay reader supports classic PCAP 2.4 with Ethernet link type 1 in little/big-endian microsecond or nanosecond variants. PCAPNG is not yet claimed.
## Build from source
@@ -106,8 +109,8 @@ dotnet run --project .\src\ProcessBus.App.Wpf\ProcessBus.App.Wpf.csproj -c Relea
Create and verify a portable package:
```powershell
-.\scripts\publish-windows-portable.ps1 -Version "1.3.0-beta.2"
-.\scripts\verify-release-package.ps1 -PackageZip ".\artifacts\release\ProcessBusInsight-v1.3.0-beta.2-win-x64-portable.zip"
+.\scripts\publish-windows-portable.ps1 -Version "1.4.0-beta.1"
+.\scripts\verify-release-package.ps1 -PackageZip ".\artifacts\release\ProcessBusInsight-v1.4.0-beta.1-win-x64-portable.zip"
```
Run the repository-quality gate:
@@ -122,9 +125,15 @@ Run only the deterministic runtime-stability suite:
dotnet test .\tests\ProcessBus.Tests\ProcessBus.Tests.csproj -c Release --filter "Category=RuntimeStability"
```
+Run only the immutable snapshot and PCAP replay suite:
+
+```powershell
+dotnet test .\tests\ProcessBus.Tests\ProcessBus.Tests.csproj -c Release --filter "Category=RuntimeArchitecture"
+```
+
## Validation status
-The repository includes parser and regression tests, repeated deterministic multi-stream stability evidence, CI build/test evidence, CodeQL analysis, dependency review, release-package verification, and explicit repository-hygiene checks. Public-beta status does **not** imply vendor certification or measurement-grade timing validation.
+The repository includes parser and regression tests, repeated deterministic multi-stream stability evidence, immutable runtime/replay evidence, CI build/test evidence, CodeQL analysis, dependency review, release-package verification, and explicit repository-hygiene checks. Public-beta status does **not** imply vendor certification or measurement-grade timing validation.
Before interpreting results, review:
@@ -140,8 +149,9 @@ Before interpreting results, review:
- [`docs/USER_MANUAL.md`](docs/USER_MANUAL.md) — user workflow
- [`docs/TROUBLESHOOTING.md`](docs/TROUBLESHOOTING.md) — capture and interpretation issues
- [`docs/architecture/STREAM_RUNTIME.md`](docs/architecture/STREAM_RUNTIME.md) — selected-stream and snapshot invariants
+- [`docs/architecture/RUNTIME_SNAPSHOT_AND_REPLAY.md`](docs/architecture/RUNTIME_SNAPSHOT_AND_REPLAY.md) — immutable generation and PCAP replay design
- [`docs/validation/TESTED_CONFIGURATIONS.md`](docs/validation/TESTED_CONFIGURATIONS.md) — explicitly tested environments
-- [`docs/validation/V1.3.0_BETA2_FIELD_EVIDENCE.md`](docs/validation/V1.3.0_BETA2_FIELD_EVIDENCE.md) — maintained live/replay evidence form
+- [`docs/validation/V1.3.0_BETA2_FIELD_EVIDENCE.md`](docs/validation/V1.3.0_BETA2_FIELD_EVIDENCE.md) — maintained 60-minute live stability evidence
- [`docs/RELEASE_PACKAGING.md`](docs/RELEASE_PACKAGING.md) — portable packaging design
- [`ROADMAP.md`](ROADMAP.md) — product direction
- [`SECURITY.md`](SECURITY.md) — vulnerability reporting and data-handling policy
diff --git a/ROADMAP.md b/ROADMAP.md
index 8a3582f..ca3bce6 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -2,29 +2,36 @@
The product is moving from a capable public beta toward a repeatable, evidence-backed field instrument.
-## Release gate: v1.3.x beta
+## Completed foundation: v1.3.x beta
- Deterministic selected-stream ownership without click-triggered refresh
- Coherent waveform, RMS, and phasor snapshots
- Verified 2/4/8-cycle timebases
- Fast harmonic/shape change detection when raw payload changes
- Multi-stream, rollover, malformed-frame, and publisher-restart regression coverage
-- Repository, CI, security, and release hardening
+- Repeated deterministic Runtime Stability workflow with downloadable TRX evidence
+- Maintained 60-minute Windows/Npcap field evidence
+- Repository, CI, security, candidate-package, and release hardening
-### v1.3.0-beta.2 stabilization
+## Current: v1.4 runtime architecture
-- Repeated deterministic Runtime Stability workflow with downloadable TRX evidence
-- Eight-stream selected-stream isolation coverage
-- 4000/65536 rollover, duplicate, gap, and coherent-window regression coverage
-- Waveform/RMS same-window evidence
-- Maintained field-evidence template for Windows/Npcap smoke and 30–60 minute soak validation
+### v1.4.0-beta.1
+
+- Immutable selected-stream runtime generations with copied samples and diagnostics
+- Atomic snapshot publication boundary for coherent consumer reads
+- Classic Ethernet PCAP replay through the same raw analyzer path used by live capture
+- Bounded PCAP parsing with endian and micro/nanosecond timestamp variants
+- Replay, immutability, capture timing, truncation, and multi-stream isolation regression coverage
+- Dedicated Runtime Architecture workflow with downloadable TRX evidence
-## Next: runtime architecture (v1.4)
+### Later v1.4 builds
-- Extract `SvStreamRuntime`, sequence tracking, waveform windowing, phasor calculation, and shape analysis from the monolithic analyzer
-- Publish immutable per-stream snapshots
-- Add PCAP replay as a first-class test and demonstration path
+- Extract the complete `SvStreamRuntime` from the monolithic analyzer
+- Extract sequence tracking, waveform windowing, phasor calculation, and shape analysis into independently tested components
+- Migrate the live WPF workspace to immutable runtime generations
+- Add PCAPNG and a maintained sanitized golden replay corpus
- Add memory/CPU soak tests and observable performance budgets
+- Add replay controls and evidence selection to the user interface after the engine boundary is stable
## Next: protocol and SCL maturity
diff --git a/docs/RELEASE_NOTES_v1.4.0-beta.1.md b/docs/RELEASE_NOTES_v1.4.0-beta.1.md
new file mode 100644
index 0000000..27bd678
--- /dev/null
+++ b/docs/RELEASE_NOTES_v1.4.0-beta.1.md
@@ -0,0 +1,37 @@
+# Process Bus Insight v1.4.0-beta.1
+
+This architecture beta introduces a reproducible offline analysis path and a coherent immutable runtime publication boundary. The receive-only safety model is unchanged.
+
+## Highlights
+
+- Immutable selected-stream runtime generations with copied waveform samples, analog values, identity, and diagnostics
+- Atomic snapshot publication so consumers see either the previous complete generation or the next complete generation
+- Classic PCAP Ethernet replay through the same `RawProcessBusAnalyzer.ObserveOwnedFrame` entry point used by live capture
+- Little-endian and big-endian PCAP support with microsecond and nanosecond timestamp variants
+- Explicit limits and rejection for unsupported link types, oversized records, invalid timestamp fractions, and truncated captures
+- Deterministic replay regression coverage for coherent two-cycle windows, three-stream isolation, timing preservation, and snapshot immutability
+- Dedicated Runtime Architecture workflow with downloadable TRX evidence
+- Verified Windows x64 candidate packaging for `architecture/*` branches
+
+## Engineering intent
+
+The replay path is not a second decoder. It feeds captured Ethernet frames into the same raw decoder and analyzer used by Npcap live capture. This makes field defects reproducible without requiring the original merging unit or network to remain connected.
+
+The immutable runtime snapshot is the first step toward separating per-stream state, calculations, and UI consumption. The internal monolithic analyzer is not yet fully decomposed in this beta; that work continues in later v1.4 builds.
+
+## Supported replay scope
+
+- Classic PCAP version 2.4
+- Ethernet link type 1
+- Microsecond and nanosecond timestamp magic variants
+- SV, GOOSE, and PTP frames already supported by the raw decoder
+
+PCAPNG, non-Ethernet link types, capture editing, and traffic transmission are not claimed in this release.
+
+## Important limitations
+
+- This remains a public beta, not a certified protection or timing instrument.
+- Windows/Npcap and replay timestamps are engineering screening evidence unless the capture path is independently validated.
+- Replay preserves recorded ordering and timing context but does not recreate network loading, NIC buffering, or hardware timestamp behavior.
+- The runtime snapshot boundary is available to replay and engineering consumers; full live UI migration to the new runtime architecture remains staged work.
+- Npcap must be installed separately for live capture.
diff --git a/docs/RELEASE_PACKAGING.md b/docs/RELEASE_PACKAGING.md
index c6c21c3..592cda7 100644
--- a/docs/RELEASE_PACKAGING.md
+++ b/docs/RELEASE_PACKAGING.md
@@ -39,16 +39,18 @@ git add -f docs/QUICK_START.pdf docs/USER_MANUAL.pdf
## Local packaging
```powershell
-.\scripts\repository-health.ps1 -ExpectedVersion "1.3.0-beta.2"
-.\scripts\publish-windows-portable.ps1 -Version "1.3.0-beta.2"
-.\scripts\verify-release-package.ps1 -PackageZip ".\artifacts\release\ProcessBusInsight-v1.3.0-beta.2-win-x64-portable.zip"
+.\scripts\repository-health.ps1 -ExpectedVersion "1.4.0-beta.1"
+.\scripts\publish-windows-portable.ps1 -Version "1.4.0-beta.1"
+.\scripts\verify-release-package.ps1 -PackageZip ".\artifacts\release\ProcessBusInsight-v1.4.0-beta.1-win-x64-portable.zip"
```
-## GitHub workflow
+## GitHub workflows
+
+The candidate workflow runs for `stabilization/*` and `architecture/*` pull requests. It restores, builds, tests, packages, verifies the ZIP, creates a candidate manifest, and uploads the candidate without publishing a public release.
The release workflow runs manually or for tags matching `v*`. It restores, builds, tests, packages, verifies the ZIP, produces a checksum and release manifest, uploads workflow evidence, and optionally creates or updates a GitHub Release.
-Manual inputs:
+Manual release inputs:
- `version` — semantic version label
- `publish_release` — create/update the GitHub Release
@@ -58,4 +60,4 @@ Manual inputs:
## Packaging design notes
-The publish script performs a runtime-specific restore and then publishes with `--no-restore`. It splits prerelease versions into numeric assembly/file version and informational/package version so a label such as `1.3.0-beta.2` remains valid while Windows assembly versions stay numeric.
+The publish script performs a runtime-specific restore and then publishes with `--no-restore`. It splits prerelease versions into numeric assembly/file version and informational/package version so a label such as `1.4.0-beta.1` remains valid while Windows assembly versions stay numeric.
diff --git a/docs/architecture/RUNTIME_SNAPSHOT_AND_REPLAY.md b/docs/architecture/RUNTIME_SNAPSHOT_AND_REPLAY.md
new file mode 100644
index 0000000..0964b5b
--- /dev/null
+++ b/docs/architecture/RUNTIME_SNAPSHOT_AND_REPLAY.md
@@ -0,0 +1,83 @@
+# Runtime Snapshot and Replay Architecture
+
+## Purpose
+
+The v1.4 architecture introduces two linked boundaries:
+
+1. a coherent immutable snapshot for consumers such as UI, replay, export, and tests;
+2. an offline capture replay path that feeds the same raw analyzer entry point used by live Npcap capture.
+
+This avoids building a second protocol implementation for offline analysis and prevents consumers from retaining mutable analyzer display objects across refreshes.
+
+## Data flow
+
+```text
+Live Npcap frame ───────────────┐
+ ├─> RawProcessBusAnalyzer.ObserveOwnedFrame
+Classic Ethernet PCAP frame ───┘ │
+ ▼
+ AnalyzerSnapshot under analyzer lock
+ │
+ ▼ copy all mutable collections
+ SvRuntimeSnapshotPublisher
+ │
+ ▼ atomic reference publication
+ Immutable SvRuntimeSnapshot generation
+```
+
+## Snapshot guarantees
+
+Each `SvRuntimeSnapshot` generation contains copied values for:
+
+- selected stream identity;
+- voltage and current channel samples;
+- instant, RMS, and phasor angle values;
+- waveform shape evidence;
+- sample rate, samples per cycle, measured frequency, and window duration;
+- packet, decode, sequence, missing-sample, timing, and jitter diagnostics.
+
+A consumer sees either the previous complete generation or the next complete generation. Publication does not expose a partially assembled mix. Sample arrays are copied into read-only collections before publication, so advancing the analyzer cannot change an already published generation.
+
+The snapshot does not claim that the internal analyzer has been fully decomposed. It is the compatibility boundary used while per-stream acquisition, sequence tracking, windowing, and calculations are progressively extracted.
+
+## Replay guarantees
+
+`ProcessBusReplaySession` reads bounded classic PCAP records and calls the same `RawProcessBusAnalyzer.ObserveOwnedFrame` method used by live capture. Recorded capture timestamps are converted into deterministic monotonic tick deltas for the analyzer timing path.
+
+Supported in v1.4.0-beta.1:
+
+- classic PCAP version 2.4;
+- Ethernet link type 1;
+- little-endian and big-endian files;
+- microsecond and nanosecond timestamp variants;
+- SV, GOOSE, and PTP frames understood by the existing raw decoder.
+
+Rejected explicitly:
+
+- unsupported magic/version/link type;
+- zero or oversized captured frames;
+- captured length above snap length;
+- original length smaller than captured length;
+- invalid timestamp fractions;
+- truncated headers or frame payloads.
+
+## Safety boundary
+
+Replay is file input only. It does not open a transmit socket, publish SV/GOOSE, send IEC 61850 controls, or emulate a merging unit. Process Bus Insight remains receive-only.
+
+## Known limitations
+
+- PCAPNG is not supported by the first reader.
+- Replay does not recreate switch loading, NIC buffering, hardware timestamping, or packet loss that was not present in the recorded capture.
+- The WPF live workspace still consumes the existing analyzer display snapshot. Migration to the immutable runtime boundary is staged to avoid a risky all-at-once rewrite.
+- Full `SvStreamRuntime` extraction remains planned for later v1.4 builds.
+
+## Regression evidence
+
+Run the focused suite with:
+
+```powershell
+dotnet test .\tests\ProcessBus.Tests\ProcessBus.Tests.csproj -c Release --filter "Category=RuntimeArchitecture"
+```
+
+The `Runtime architecture` GitHub Actions workflow repeats the suite and retains TRX evidence. Tests cover decoder-path replay, coherent window publication, capture duration preservation, immutable generations, three-stream isolation, unsupported link types, and truncated records.
diff --git a/docs/development/RELEASE_CHECKLIST.md b/docs/development/RELEASE_CHECKLIST.md
index 7ec112a..555bd31 100644
--- a/docs/development/RELEASE_CHECKLIST.md
+++ b/docs/development/RELEASE_CHECKLIST.md
@@ -6,7 +6,7 @@
- [ ] Repository health script passes
- [ ] No nested repo, RnD solution, build output, logs, captures, or local settings are tracked
- [ ] Version matches `Directory.Build.props`, README, landing page, release workflow, and release notes
-- [ ] Changelog and tested-configuration notes are updated
+- [ ] Changelog, architecture notes, and tested-configuration notes are updated
## Automated validation
@@ -15,10 +15,14 @@
- [ ] All tests pass
- [ ] Runtime Stability workflow passes all repeated `Category=RuntimeStability` iterations
- [ ] Runtime Stability TRX artifact is retained with the release evidence
+- [ ] Runtime Architecture workflow passes all repeated `Category=RuntimeArchitecture` iterations
+- [ ] Runtime Architecture TRX artifact is retained with the release evidence
+- [ ] Classic PCAP little/big-endian and micro/nanosecond variants pass
+- [ ] Truncated, unsupported-link-type, invalid-timestamp, and oversized-record cases are rejected
- [ ] CodeQL completes
- [ ] Dependency review has no unresolved high-severity finding
-- [ ] Portable package verification succeeds
-- [ ] ZIP checksum and release manifest are generated
+- [ ] Portable candidate package verification succeeds
+- [ ] ZIP checksum and candidate/release manifest are generated
## Runtime smoke test
@@ -33,12 +37,24 @@
- [ ] Duplicate, forward-gap, and publisher-restart behavior is exercised
- [ ] GOOSE, PTP, and SCL workspaces open and update
- [ ] 30–60 minute soak test shows no material memory growth or UI freeze
-- [ ] `docs/validation/V1.3.0_BETA2_FIELD_EVIDENCE.md` is completed with sanitized evidence
+- [ ] Maintained live evidence remains available in `docs/validation/V1.3.0_BETA2_FIELD_EVIDENCE.md`
+
+## Replay and immutable snapshot checks
+
+- [ ] Sanitized classic Ethernet PCAP replays through `RawProcessBusAnalyzer.ObserveOwnedFrame`
+- [ ] Recorded frame order and capture duration are preserved
+- [ ] Selected-stream runtime generation contains copied identity, samples, analog, phasor, shape, and diagnostics
+- [ ] Advancing the analyzer does not mutate a previously published generation
+- [ ] Interleaved replay streams remain isolated when selected and published
+- [ ] Replay is file-input only and does not open a transmit path
+- [ ] PCAPNG is listed as unsupported until implemented and validated
## Claims and evidence
- [ ] Timing wording remains screening-level unless hardware evidence exists
+- [ ] Replay is not described as recreating NIC, switch, or hardware timestamp behavior
- [ ] Automated deterministic stress is not described as a replacement for live/replay soak validation
+- [ ] Full internal analyzer decomposition is not claimed before it is complete
- [ ] Screenshots match the released UI
- [ ] No customer or project-sensitive evidence is included
- [ ] Known limitations are listed in release notes
diff --git a/docs/index.html b/docs/index.html
index 44573ad..69003ae 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -4,8 +4,8 @@
Process Bus Insight - IEC 61850 SV, GOOSE, PTP and SCL Analyzer for Windows
-
-
+
+
@@ -19,14 +19,14 @@
-
+
-
+
@@ -42,7 +42,7 @@
"alternateName": "DigSubAnalyzer",
"applicationCategory": "EngineeringApplication",
"operatingSystem": "Windows 10, Windows 11",
- "softwareVersion": "1.3.0-beta.2",
+ "softwareVersion": "1.4.0-beta.1",
"license": "https://www.apache.org/licenses/LICENSE-2.0",
"isAccessibleForFree": true,
"url": "https://masarray.github.io/DigSubAnalyzer/",
@@ -54,9 +54,10 @@
"GOOSE publisher inspection",
"PTP timing context",
"SCL expected-vs-observed validation",
+ "Classic Ethernet PCAP replay",
"Windows portable EXE package"
],
- "description": "Free open-source Windows analyzer for IEC 61850 Process Bus SV, GOOSE, PTP timing context, and SCL validation during FAT, SAT, commissioning, and troubleshooting."
+ "description": "Free open-source Windows analyzer for IEC 61850 Process Bus SV, GOOSE, PTP timing context, SCL validation, and reproducible PCAP replay during FAT, SAT, commissioning, and troubleshooting."
}