FAT: canonical Engineering rows and legacy evidence migration

[masarray]

Follow-up to #296 for the field duplicate-row failure and the canonical Engineering -> FAT thin-view convergence.

Current branch scope:

• normal FAT binds directly to canonical Engineering SelectedDevice.Points; FAT owns no second mutable row collection or acquisition runtime,
• sparse FAT evidence is keyed only by stable IEC identity (IEDName + IEC Telegram) and remains outside canonical Engineering rows,
• legacy/manual evidence is accepted only as passive migration/provenance and only on unique canonical mapping; ambiguous/orphan evidence fails closed,
• native FAT column authority owns exactly Signal | IEC Telegram | Quality | Live Value | Value 1 | V1 Timestamp | Value 2 | V2 Timestamp | Result,
• FAT workspace keeps canonical IED Explorer identity; report snapshot now resolves its operator-facing Signal through the shared IoFatSignalDisplayNameFormatter without rewriting IEC identity,
• ARM evidence provides visible 1 / 2 observations and 2 / 2 observations; native workspace Result becomes COMPLETE when both observations exist, while the customer-facing report renders completed rows as OK,
• command safety defaults initialize Interlock and Sync checked once per signal at the model boundary while remaining operator-editable afterward,
• explicit Print Preview captures one immutable selected-IED native snapshot, maps it once to IoFatReportLayoutPlan, renders through the existing FixedDocument/DocumentViewer authority, and Save PDF serializes that exact same layout instance,
• Print Preview provides Print, zoom -/+, whole-page Fit, previous/next page, page indicator, Refresh and Save PDF with vector/Lucide-style toolbar icons; the action strip is centered and no redundant Close action is shown,
• report pages and final sign-off share one vector ARSAS brand mark in the common report-command layout, so Preview and PDF render the same branding without bitmap/external-file dependencies,
• customer-facing report copy no longer exposes implementation terms such as immutable snapshot / sparse overlay / acquisition restart,
• report evidence preserves the actual captured Value 1 / Value 2 timestamps; native report paths do not instantiate a hidden IoTestProject and do not fabricate COMTRADE/time-sync evidence or placeholder supplemental evidence,
• final report page contains TESTED BY | WITNESSED BY | APPROVED BY,
• restart/reorder evidence isolation includes CSWI vs unrelated ThdPPV, cross-IED same-name isolation, orphan and duplicate identity fail-closed behavior, timestamp retention for digital/analog/DbPos/tap evidence, exact selected-IED report count/order, WPF recycled-cell current-row binding, and exact command TX -> feedback correlation,
• command correlation uses explicit control StatusReference only; native correlation and global stable-command confirmation fail closed when status identity is missing or ambiguous and never infer feedback from ObjectReference, SignalName, row/index order, or runtime DeviceId,
• legacy automatic MainWindow.ProductionFatEngineeringBootstrap.cs, MainWindow.ProductionFatNoFlicker.cs, obsolete Engineering projection services, and the zero-reparse Engineering-workspace adoption bridge are retired,
• regression guards block projection/bootstrap/reconnect/second-acquisition APIs from native grid, ARM and report paths and fail if retired bridge files/authorities are reintroduced,
• explicit/manual IoListTestingWindow compatibility remains an isolated operator boundary only; normal IO testing import/preflight behavior stays available there, while native FAT legacy snapshot reading remains passive evidence migration and never opens the legacy workspace.

Latest field-test build milestone:

• HEAD: 050520805a2a244d29076f50d4dd8fbce8343b48
• Build ARSAS #2691: success
• Validate IO List Testing #1244: success
• Validate SV evidence bundles #1693: success
• Windows portable artifact: ARSAS-1.6.35-win-x64-portable.exe

PR remains draft and unmerged for field/file testing.

[masarray]

Field regression follow-up (2026-09-11): previous candidate 2cc9495 failed before FAT opened with Canonical Engineering FAT still contains a legacy manual SCL row after migration. The real Engineering projection uses immutable BindingStatus = ENGINEERING_SCL_DATASET_AUTHORITY, while the shared static-DataSet predicate recognized only SCL_DATASET_AUTHORITY; migration therefore skipped the real 58-row Engineering IED and the later guard found restored scl-manual-* history.

Fix on current head 4a02d82:

• shared IoTestSignalSelectionService.IsSclDataSetAuthority now recognizes both direct-SCL and Engineering-projection static DataSet authority labels before synchronization/resolution,
• migration keeps BindingStatus immutable and physically removes legacy manual aliases once canonical authority is present,
• regression reproduces the field family (AA1E1F06R4, scl-manual-7496d038be4fdc18e340) and asserts authority is recognized before migration, evidence migrates to the unique canonical row, and no legacy row remains.

CI for current head: Build ARSAS #2585 success (including portable publish + smoke test), Validate IO List Testing #1138 success, Validate SV evidence bundles #1587 success. Next gate is relay field verification: Engineering 58 -> FAT 58, no legacy guard error, no 58->116 growth, Start FAT stays on shared Engineering acquisition.