P0-D: field-proven zero-length OCTET, exact LN Read coverage and report ingress UX

[masarray]

P0-D — field-evidence-driven IEC 61850 hardening (draft / NOT field accepted)

Field-tested app SHA: a4ed26d; engine pinned SHA: ba21d882f67de22c10d3155b449aac77aa8b4899. This branch descends from the exact merge source used in the operator test.

Observed evidence

• Five MMS domains resolve provisional SIEBCU (Medium); no trusted matching IID opened on this association.
• 66 RCBs discovered; 18/18 DataSet_1 initial values from Buffer01 Report; 126 process updates; four CSWI positive SBOw+Operate+CommandTermination+feedback traces.
• Report first GI frame BufOvfl=true; next 12 sequence counters were contiguous, not proof of no prior SOE loss. Another four-member DataSet has no configured RCB. Target address appears also on local NIC, so same-host simulation versus separate physical device remains unverified.
• Selected protection LN read CSV: 35/38 OBSERVED; one rejected zero-length Octet64 / Mod.origin.orIdent, two missing attempt evidence for NamPlt.swRev and NamPlt.d. Per-target GVA/invoke not recorded.

New code/regressions

1. Admit decoded empty OctetString/VisibleString/MMSString only when the wire type matches exact live declared datatype; labelled empty display; unchanged fail-closed for unknown BER/blank non-wire values. Smart and direct Read paths use the same helper and canonical ledger.
2. LN/DO/DA/DataSet Read accounting preserves unscheduled versus missing terminal-result evidence without inventing wire attempts or erasing genuine per-target failures.
3. Explicitly label Discovery-only live Report ingress proven while Open SCL parity remains uncaptured; no false dual-path acceptance.
4. Existing export action can optionally create bounded ZIP with read-evidence.csv and manifest.json with app/engine version, association, timestamp and explicit NOT_CAPTURED fields. CSV stays default. ZIP compression and file I/O are asynchronous; no PCAP or credentials.
5. Synthetic tests cover both valid and negative zero-length kinds, exact-FC missing-read accounting, 12 sequential frames after initial GI BufOvfl, single-versus-dual parity and ZIP integrity. Windows R7 gate now includes these P0-D source paths.

No read-time cyclic process polling, RCB/control mutation, alternative engine, or false physical acceptance. The field evidence predates this patch, so no new device success is claimed. Remaining acceptance: exact SHA CI/installer checks, optional new one-shot Read packet and WPF DPI/field retest before release/merge.