Final calm engineering polish — periodic SV report grouping, readable SCL and verified candidate FAT gates

.github/workflows/candidate-package.yml

@@ -15,8 +15,17 @@ on:
       - "src/**"
       - "tests/**"
       - "scripts/publish-windows-portable.ps1"
+      - "scripts/publish-windows-installer.ps1"
+      - "scripts/render-offline-manuals.py"
+      - "docs/USER_MANUAL.md"
+      - "docs/QUICK_START.md"
+      - "docs/INSTALLATION_AND_UPDATE.md"
+      - "docs/RELEASE_PACKAGING.md"
+      - "scripts/verify-windows-installer.ps1"
+      - "installer/**"
       - "scripts/verify-release-package.ps1"
       - "scripts/repository-health.ps1"
+      - "scripts/verify-workspace-spacing.ps1"
       - "docs/RELEASE_NOTES_v*.md"
       - ".github/workflows/candidate-package.yml"
       - ".github/workflows/release-package.yml"
@@ -38,7 +47,7 @@ jobs:
     name: Build verified Windows x64 candidate
     if: github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'stabilization/') || startsWith(github.head_ref, 'architecture/') || startsWith(github.head_ref, 'legal/') || startsWith(github.head_ref, 'fix/') || startsWith(github.head_ref, 'feat/')
     runs-on: windows-latest
-    timeout-minutes: 35
+    timeout-minutes: 50
 
     steps:
       - name: Checkout
@@ -66,10 +75,38 @@ jobs:
           "value=$version" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
           Write-Host "Candidate version: $version"
 
+      - name: Reject already-published version
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          $tag = "v${{ steps.version.outputs.value }}"
+          # GitHub CLI exits 1 for an expected 404. On modern PowerShell runners
+          # a failed native command can terminate the step BEFORE LASTEXITCODE
+          # is inspected. Query the REST status explicitly; 404 is an unused
+          # version, 200 is already published, and other statuses fail closed.
+          $uri = "https://api.github.com/repos/${{ github.repository }}/releases/tags/$tag"
+          $response = Invoke-WebRequest -Uri $uri -Method Get -SkipHttpErrorCheck -Headers @{
+            Authorization = "Bearer $env:GH_TOKEN"
+            Accept = "application/vnd.github+json"
+            "X-GitHub-Api-Version" = "2022-11-28"
+          }
+          if ($response.StatusCode -eq 200) {
+            throw "Version $tag was already published. Bump VersionPrefix; never replace historical public binaries."
+          }
+          if ($response.StatusCode -ne 404) {
+            throw "Unable to establish release-version availability: HTTP $($response.StatusCode)."
+          }
+          Write-Host "Unused release version verified: $tag"
+
       - name: Repository health gate
         shell: pwsh
         run: .\scripts\repository-health.ps1 -ExpectedVersion '${{ steps.version.outputs.value }}'
 
+      - name: Workspace spacing geometry gate
+        shell: pwsh
+        run: .\scripts\verify-workspace-spacing.ps1
+
       - name: Restore
         run: dotnet restore .\ProcessBusSuite.sln
 
@@ -79,6 +116,14 @@ jobs:
       - name: Test
         run: dotnet test .\ProcessBusSuite.sln -c Release --no-build --logger "trx;LogFileName=candidate-tests.trx" --results-directory .\TestResults
 
+      - name: Generate current offline PDF manuals
+        shell: pwsh
+        run: |
+          python -m pip install --disable-pip-version-check reportlab==4.4.9
+          if ($LASTEXITCODE -ne 0) { throw 'Pinned ReportLab PDF build dependency unavailable.' }
+          python .\scripts\render-offline-manuals.py
+          if ($LASTEXITCODE -ne 0) { throw 'Offline manual PDF generation failed.' }
+
       - name: Publish portable package
         shell: pwsh
         run: .\scripts\publish-windows-portable.ps1 -Version '${{ steps.version.outputs.value }}' -Configuration Release -Runtime win-x64
@@ -89,6 +134,24 @@ jobs:
           $zip = ".\artifacts\release\ProcessBusInsight-v${{ steps.version.outputs.value }}-win-x64-portable.zip"
           .\scripts\verify-release-package.ps1 -PackageZip $zip
 
+      - name: Install Inno Setup 6
+        shell: pwsh
+        run: |
+          choco install innosetup --yes --no-progress
+          if ($LASTEXITCODE -ne 0) { throw 'Inno Setup compiler installation failed.' }
+
+      - name: Compile Inno installer
+        shell: pwsh
+        run: .\scripts\publish-windows-installer.ps1 -Version '${{ steps.version.outputs.value }}'
+
+      - name: Smoke test Inno installation and repair
+        shell: pwsh
+        run: |
+          $version = '${{ steps.version.outputs.value }}'
+          $installer = ".\artifacts\release\ProcessBusInsight-v$version-win-x64-setup.exe"
+          $stage = ".\artifacts\package\ProcessBusInsight-v$version-win-x64-portable"
+          .\scripts\verify-windows-installer.ps1 -Installer $installer -StageDir $stage
+
       - name: Create candidate manifest
         shell: pwsh
         run: |
@@ -100,6 +163,10 @@ jobs:
             sourceRef = '${{ github.head_ref || github.ref_name }}'
             runtime = 'win-x64'
             framework = 'net8.0-windows'
+            primaryDistribution = 'inno-setup-exe'
+            offlineManuals = @('User Manual.pdf', 'Quick Start.pdf')
+            upgradeMode = 'stable-inno-appid-in-place-repair'
+            installerSigned = $false
             communityLicense = 'GPL-3.0-or-later'
             historicalBoundary = '85d43a0fe58a5888a9e8008c168ab76d2333ea87'
             timestampUtc = (Get-Date).ToUniversalTime().ToString('o')
@@ -109,9 +176,9 @@ jobs:
       - name: Upload verified candidate
         uses: actions/upload-artifact@v7
         with:
-          name: ProcessBusInsight-v${{ steps.version.outputs.value }}-win-x64-candidate-${{ github.run_number }}
+          name: ProcessBusInsight-v${{ steps.version.outputs.value }}-win-x64-inno-candidate-${{ github.run_number }}
           path: |
-            artifacts/release/ProcessBusInsight-v${{ steps.version.outputs.value }}-win-x64-portable.zip
+            artifacts/release/ProcessBusInsight-v${{ steps.version.outputs.value }}-win-x64-setup.exe
             artifacts/release/SHA256SUMS.txt
             artifacts/release/candidate-manifest.json
             TestResults/**

.github/workflows/ci.yml

@@ -37,6 +37,10 @@ jobs:
         shell: pwsh
         run: .\scripts\repository-health.ps1
 
+      - name: Workspace spacing geometry gate
+        shell: pwsh
+        run: .\scripts\verify-workspace-spacing.ps1
+
       - name: Restore
         run: dotnet restore .\ProcessBusSuite.sln
 

.github/workflows/release-package.yml

@@ -1,14 +1,19 @@
-name: Release Windows portable package
+name: Release Windows installer and portable package
 
 on:
   workflow_dispatch:
     inputs:
       version:
-        description: Version label, for example 1.4.0
+        description: Version label, for example 1.4.1
         required: true
-        default: 1.4.0
+        default: 1.4.1
       publish_release:
-        description: Create or update a GitHub Release
+        description: Publish GitHub Release after successful validation (manual only)
+        required: true
+        default: false
+        type: boolean
+      field_acceptance_verified:
+        description: "I confirm documented real-NIC capture, injector agreement, and soak acceptance on the target Windows configuration"
         required: true
         default: false
         type: boolean
@@ -25,7 +30,7 @@ on:
       release_notes_file:
         description: Markdown file used as release body
         required: true
-        default: docs/RELEASE_NOTES_v1.4.0.md
+        default: docs/RELEASE_NOTES_v1.4.1.md
   push:
     tags:
       - "v*"
@@ -45,7 +50,7 @@ jobs:
   package:
     name: Validate and package Windows x64
     runs-on: windows-latest
-    timeout-minutes: 35
+    timeout-minutes: 55
 
     steps:
       - name: Checkout
@@ -70,10 +75,30 @@ jobs:
           "value=$version" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
           Write-Host "Release version: $version"
 
+      # Tags can build reproducible packages, but never auto-publish an
+      # unreviewed stable release simply because a tag was pushed.
+      - name: Public release authorization gate
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish_release }}
+        shell: pwsh
+        env:
+          FIELD_ACCEPTANCE: ${{ inputs.field_acceptance_verified }}
+          RUN_REF: ${{ github.ref }}
+        run: |
+          if ($env:RUN_REF -ne 'refs/heads/main') {
+            throw 'Public releases must be built from the validated main branch.'
+          }
+          if ($env:FIELD_ACCEPTANCE -ne 'true') {
+            throw 'Public release blocked: field acceptance has not been explicitly verified.'
+          }
+
       - name: Repository health gate
         shell: pwsh
         run: .\scripts\repository-health.ps1 -ExpectedVersion '${{ steps.version.outputs.value }}'
 
+      - name: Workspace spacing geometry gate
+        shell: pwsh
+        run: .\scripts\verify-workspace-spacing.ps1
+
       - name: Restore
         run: dotnet restore .\ProcessBusSuite.sln
 
@@ -83,6 +108,14 @@ jobs:
       - name: Test
         run: dotnet test .\ProcessBusSuite.sln -c Release --no-build --logger "trx;LogFileName=release-tests.trx" --results-directory .\TestResults
 
+      - name: Generate current offline PDF manuals
+        shell: pwsh
+        run: |
+          python -m pip install --disable-pip-version-check reportlab==4.4.9
+          if ($LASTEXITCODE -ne 0) { throw 'Pinned ReportLab PDF build dependency unavailable.' }
+          python .\scripts\render-offline-manuals.py
+          if ($LASTEXITCODE -ne 0) { throw 'Offline manual PDF generation failed.' }
+
       - name: Publish portable package
         shell: pwsh
         run: .\scripts\publish-windows-portable.ps1 -Version '${{ steps.version.outputs.value }}' -Configuration Release -Runtime win-x64
@@ -93,6 +126,24 @@ jobs:
           $zip = ".\artifacts\release\ProcessBusInsight-v${{ steps.version.outputs.value }}-win-x64-portable.zip"
           .\scripts\verify-release-package.ps1 -PackageZip $zip
 
+      - name: Install Inno Setup 6
+        shell: pwsh
+        run: |
+          choco install innosetup --yes --no-progress
+          if ($LASTEXITCODE -ne 0) { throw 'Inno Setup compiler installation failed.' }
+
+      - name: Compile Inno installer
+        shell: pwsh
+        run: .\scripts\publish-windows-installer.ps1 -Version '${{ steps.version.outputs.value }}'
+
+      - name: Smoke test Inno installation and repair
+        shell: pwsh
+        run: |
+          $version = '${{ steps.version.outputs.value }}'
+          $installer = ".\artifacts\release\ProcessBusInsight-v$version-win-x64-setup.exe"
+          $stage = ".\artifacts\package\ProcessBusInsight-v$version-win-x64-portable"
+          .\scripts\verify-windows-installer.ps1 -Installer $installer -StageDir $stage
+
       - name: Create release manifest
         shell: pwsh
         run: |
@@ -102,6 +153,11 @@ jobs:
             commit = '${{ github.sha }}'
             runtime = 'win-x64'
             framework = 'net8.0-windows'
+            primaryDistribution = 'inno-setup-exe'
+            secondaryDistribution = 'portable-zip'
+            offlineManuals = @('User Manual.pdf', 'Quick Start.pdf')
+            upgradeMode = 'stable-inno-appid-in-place-repair'
+            installerSigned = $false
             communityLicense = 'GPL-3.0-or-later'
             historicalBoundary = '85d43a0fe58a5888a9e8008c168ab76d2333ea87'
             timestampUtc = (Get-Date).ToUniversalTime().ToString('o')
@@ -111,8 +167,9 @@ jobs:
       - name: Upload workflow artifact
         uses: actions/upload-artifact@v7
         with:
-          name: ProcessBusInsight-v${{ steps.version.outputs.value }}-win-x64-portable
+          name: ProcessBusInsight-v${{ steps.version.outputs.value }}-win-x64-installer-and-portable
           path: |
+            artifacts/release/ProcessBusInsight-v${{ steps.version.outputs.value }}-win-x64-setup.exe
             artifacts/release/ProcessBusInsight-v${{ steps.version.outputs.value }}-win-x64-portable.zip
             artifacts/release/SHA256SUMS.txt
             artifacts/release/release-manifest.json
@@ -121,32 +178,33 @@ jobs:
           retention-days: 30
 
       - name: Publish GitHub Release
-        if: ${{ github.event_name == 'push' || github.event.inputs.publish_release == 'true' }}
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish_release }}
         shell: pwsh
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           $version = '${{ steps.version.outputs.value }}'
           $tag = "v$version"
           $zip = "artifacts/release/ProcessBusInsight-v$version-win-x64-portable.zip"
+          $installer = "artifacts/release/ProcessBusInsight-v$version-win-x64-setup.exe"
           $sha = "artifacts/release/SHA256SUMS.txt"
           $manifest = "artifacts/release/release-manifest.json"
           $notesFile = '${{ github.event.inputs.release_notes_file }}'
-          if ([string]::IsNullOrWhiteSpace($notesFile)) { $notesFile = 'docs/RELEASE_NOTES_v1.4.0.md' }
+          if ([string]::IsNullOrWhiteSpace($notesFile)) { $notesFile = 'docs/RELEASE_NOTES_v1.4.1.md' }
           if (-not (Test-Path $notesFile)) { throw "Release notes file not found: $notesFile" }
 
-          $releaseArgs = @('release', 'create', $tag, $zip, $sha, $manifest, '--title', "Process Bus Insight $tag", '--notes-file', $notesFile, '--target', '${{ github.sha }}')
+          $releaseArgs = @('release', 'create', $tag, $installer, $zip, $sha, $manifest, '--title', "Process Bus Insight $tag", '--notes-file', $notesFile, '--target', '${{ github.sha }}')
           $isDraft = '${{ github.event.inputs.draft }}'
           $isPrerelease = '${{ github.event.inputs.prerelease }}'
-          if ('${{ github.event_name }}' -eq 'push') {
-            $isPrerelease = if ($version -match '-') { 'true' } else { 'false' }
-          }
+          # A pre-release version must always remain a prerelease.
+          if ($version -match '-') { $isPrerelease = 'true' }
           if ($isDraft -eq 'true') { $releaseArgs += '--draft' }
           if ($isPrerelease -eq 'true') { $releaseArgs += '--prerelease' }
 
+          # Immutable release identity: never overwrite a published historical
+          # EXE/ZIP/checksum with a new binary under the same semver tag.
           gh release view $tag *> $null
           if ($LASTEXITCODE -eq 0) {
-            gh release upload $tag $zip $sha $manifest --clobber
-          } else {
-            gh @releaseArgs
+            throw "Release $tag already exists. Bump VersionPrefix; public assets are immutable."
           }
+          gh @releaseArgs

.github/workflows/runtime-architecture.yml

@@ -5,6 +5,11 @@ on:
     branches: [main]
     paths:
       - "src/ProcessBus.Iec61850.Raw/Runtime/**"
+      - "src/ProcessBus.Iec61850.Raw/Analysis/RawProcessBusAnalyzer.cs"
+      - "src/ProcessBus.Core/Presentation/**"
+      - "src/ProcessBus.App.Wpf/Controls/PhasorDiagramControl.cs"
+      - "tests/ProcessBus.Tests/PhasorPresentationContractTests.cs"
+      - "tests/ProcessBus.Tests/OperatorPresentationReleaseTests.cs"
       - "src/ProcessBus.Iec61850.Raw/Replay/**"
       - "tests/ProcessBus.Tests/Pcap*Tests.cs"
       - "tests/ProcessBus.Tests/AnalyzerRuntimeSnapshotSourceTests.cs"

CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes are documented here. The project follows Semantic Versioning
 
 ## [Unreleased]
 
+### Implemented in release-candidate branch (public stable acceptance pending)
+
+- Unified selected-stream phasor RMS/angle display without UI-side nominal phase overrides; improved six-vector label collisions, separate measured U/I scales, legible 270° convention, stale data and live-with-warning semantics
+- Removed fabricated Ethernet adapter fallback and pinned native Npcap discovery/capture to trusted Windows x64 system library paths
+- Added deterministic phasor, compact-caption, adapter and status regression tests
+- Made Inno Setup self-contained EXE the primary Windows distribution, with same-version repair, in-place upgrade, offline manuals and install/repair/uninstall CI evidence
+- Generated packaged PDF manuals from current Markdown source, with SHA256 provenance and stale-PDF rejection
+- Hardened stable publication to manual main-only authorization after documented physical acceptance; no automatic public release on tag push
+- Physical target-NIC/injector 60-minute acceptance remains pending for the current candidate; earlier 1.3.0 soak evidence does not substitute
+
 ### Planned
 
 - Sanitized golden PCAP/PCAPNG replay corpus with broader interoperability scenarios

Directory.Build.props

@@ -10,7 +10,7 @@
     <NeutralLanguage>en</NeutralLanguage>
 
     <!-- Public release version. Pre-release versions may set VersionSuffix explicitly. -->
-    <VersionPrefix Condition="'$(VersionPrefix)' == ''">1.4.0</VersionPrefix>
+    <VersionPrefix Condition="'$(VersionPrefix)' == ''">1.4.1</VersionPrefix>
     <VersionSuffix Condition="'$(VersionSuffix)' == ''"></VersionSuffix>
     <Version Condition="'$(Version)' == '' and '$(VersionSuffix)' == ''">$(VersionPrefix)</Version>
     <Version Condition="'$(Version)' == '' and '$(VersionSuffix)' != ''">$(VersionPrefix)-$(VersionSuffix)</Version>