--- man
+++ cas
@@ -1,60 +1,97 @@
-// slice of Import\TestCase_SGP_23.js - cases: TC_eUICC_ES8_ReplaceSessionKeys_01_Error_Incorrect_PPK_size (extracted verbatim)
+// Author: 卡思Cas智能体
+// Date: 20261005-152741
+// Function: （purpose 原文未由 SGP.23 该 TC 提供，corpus vacuum 登记）TC_eUICC_ES8+.ReplaceSessionKeys，Test Sequence #01 Error: Incorrect PPK size（B 行名称注记：except test sequence #11 and #12——本 TC 仅含 #01），适用性 M。
+// Test points: S4-C1 SW；S5-C1 SW；S6-C1 SW；S7-C1 SW；S7-C2 SW；S7-C2 resp present
+// 本函数由 CaseIR 4.2.6.2.1 编译生成（fullwave-blindgen-live-70，SGP.23 v1.16 × SGP.22 v2.7）：字节权威=CaseIR，非誊录黄金脚本。
+// Value-free template: every data byte is injected from CaseIR fields; no scaffold globals (see docs/speconly/compile-symbol-migration.md).
+// 适用性 M：编译期门，运行时由 harness 环境前置承担。
+// PRECONDITION (declared, NOT compiled): initial_conditions 缺语料过程体（Annex C.2 absent from input package, corpus vacuum）: IC 序列属测试工具/卡态编排责任，本脚本不虚构初始化步骤；语义影响见 CaseIR open_items。
+// GIC 通信初始化+ISD-R 选择+相互认证+End User Confirmation+PrepareDownload（#PREP_DOWNLOAD_NO_CC）: declared unexpanded (no fabricated bytes; provenance = expansion_source).
+// GIC-sub PROC_EUICC_INITIALIZATION_SEQUENCE（R2 闭合，K_annexC2_procs 表1256：RESET/[SELECT_MF]/[TERMINAL_CAPABILITY_LPAd]/[TERMINAL_PROFILE]）: declared unexpanded (no fabricated bytes; provenance = expansion_source).
+// GIC-sub PROC_OPEN_LOGICAL_CHANNEL_AND_SELECT_ISDR（R2 闭合，K_annexC2_procs 表1258：[MANAGE_CHANNEL_OPEN]/MTD_SELECT(#ISD_R_AID)）: declared unexpanded (no fabricated bytes; provenance = expansion_source).
+function TC_eUICC_ES8_ReplaceSessionKeys_01_11_12_01_merged() {
+    var bind = curBind;
 
-function TC_eUICC_ES8_ReplaceSessionKeys_01_Error_Incorrect_PPK_size()
-{
+    // 步骤 1：IC1: Generate the <OTPK_S_SM_DP+_ECKA> and <OT_SK_S_SM_DP+_ECKA>（tc_step；non_wire）
+    // test-tool internal preparation (no APDU face): runtime-domain
+    // values per CaseIR unresolved (G Annex B generation rules);
+    // no fabricated bytes emitted here.
 
-	tracenamestr = "测试目的：验证eUICC检查所有PPK大小是否与会话密钥相同";
-	curDis.TraceStart(sno++,tracenamestr);
+    // 步骤 2：IC2: <BPP> = MTD_GENERATE_BPP（tc_step）
+    // BPP synthesized (4.2.6.2.1 seq#1, structural layer, SCP03t-unprotected): 1120 bytes; segments: INIT=191B, A0=22B, A1=58B, A2=53B, A3=796B.
+    // Segment bytes are runtime-domain (BPP load step data=null per CaseIR unresolved); not injected into this script. Provenance:
+    //   [SPEC] TC — SGP.23 4.2.6.2.1 seq#1 接线（段选择/注入面）
+    //   [SPEC] BF36 — SGP.22 §2.5.4 :1566 BoundProfilePackage [54]
+    //   [SPEC] BF36/A0 — Table 4 :1588 firstSequenceOf87
+    //   [SPEC] BF36/A1 — Table 4 :1590 sequenceOf88
+    //   [SPEC] BF36/A3 — Table 4 :1595 sequenceOf86
+    //   [HYPOTHESIS] 87/88/86 段值 — UNPROTECTED：明文承载，SCP03t 包壳属后续 lane
+    //   [SPEC] BF23 — SGP.22 §5.5.1 :7241 InitialiseSecureChannelRequest [35]
+    //   [SPEC] BF23/82 remoteOpId — SGP.22 :1400 RemoteOpId [2] INTEGER
+    //   [HYPOTHESIS] BF23/80 transactionId — SM-DP+ 会话值，Annex E 缺席，调用方注入
+    //   [SPEC] BF23/A6 controlRefTemplate — SGP.22 :7255-7263 CRT 子集
+    //   [SPEC] BF23/A6/80 keyType — SGP.22 :7257 AES='88'
+    //   [SPEC] BF23/A6/81 keyLen — SGP.22 :7259 SHALL be 0x10
+    //   [HYPOTHESIS] BF23/A6/84 hostId — Host ID 值，Annex E 缺席
+    //   [HYPOTHESIS] BF23/5F49 smdpOtpk — otPK.DP.ECKA，需真实密钥协商 lane
+    //   [HYPOTHESIS] BF23/5F37 smdpSign — SK.DPbp.ECDSA 签名，需签名 lane
+    //   [SPEC] BF24 — SGP.22 §5.5.2 :7319 ConfigureISDPRequest [36]
+    //   [HYPOTHESIS] BF24/B8 dpProprietaryData — dpOid 与填充为 SM-DP+ 自有树自定值（Annex E 缺席）；变体 nominal
+    //   [SPEC] BF25 — SGP.22 §5.5.3 :7365 StoreMetadataRequest [37]
+    //   [SPEC] BF25/5A iccid — SGP.22 :1398 Iccid [APPLICATION 26] tag '5A'；值域 HYPOTHESIS（Annex E 缺席，需与 UPP EF-ICCID 一致）
+    //   [HYPOTHESIS] BF25/91 serviceProviderName — Annex E 缺席
+    //   [HYPOTHESIS] BF25/92 profileName — Annex E 缺席
+    //   [SPEC] BF25/95 profileClass — SGP.22 :13218 ProfileClass INTEGER；取 operational(2)
+    //   [SPEC] UPP — PITS ProfileElement 序列 header+mf+usim+end（最小集）
+    //   [SPEC] PE header — PITS asn:26 ProfileElement header CHOICE [0]
+    //   [SPEC] PE header/version — PITS asn:67-68 2/3
+    //   [SPEC] PE header/profileType — PITS asn:942 Test Profile 值
+    //   [HYPOTHESIS] PE header/iccid — eUICC 忽略此值（SGP.22 :7511）；随参数化 ICCID
+    //   [SPEC] PE header/services+GFSTE — PITS asn:946-958 子集转录
+    //   [SPEC] PE mf — PITS asn:222 PE-MF + mfVal :961-1039
+    //   [HYPOTHESIS] PE mf/ef-iccid — ICCID 参数化（EF 编码形态）；其余模板值 SPEC
+    //   [SPEC] PE usim — PITS asn:284 PE-USIM + usimValue :1166-1218
+    //   [HYPOTHESIS] PE usim/ef-imsi — IMSI 参数化（mccMnc+MSIN）；TBCD 编码面 3GPP 24.008 SPEC
+    //   [SPEC] PE end — PITS asn:906 PE-End + endVal :2106 id=99
+    //   [SPEC] BF36/A2 — Table 4 :1593 secondSequenceOf87
+    //   [SPEC] BF26 — SGP.22 §5.5.4 :7481 ReplaceSessionKeysRequest [38]
+    //   [HYPOTHESIS] BF26/04 initialMacChainingValue — 自定随机值
+    //   [HYPOTHESIS] BF26/04 ppkEnc — 自定随机值
+    //   [HYPOTHESIS] BF26/04 ppkCmac — 自定随机值
+    //   [HYPOTHESIS] BF26/04 ppkEnc — 注入 ppk_invalid_size：16B→8B（4.2.6.2.1 seq#01）
+    // S2-C1: binding:bpp_override_rule_carried_by_synthesis_contract(bpp_injection-provenance) (check_attestation)
 
-	curDis.TestStepStart2(stno++,"eUICC卡片初始化；");
-	Ini_powerOn_eUICC_LPAe_not_activate();
+    // 步骤 3：IC3: Split the <BPP> into several segments arrays named: <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A2>, <BPP_SEG_A3>（tc_step）
+    // BPP segment declaration (no APDU face): <BPP_SEG_INIT>, <BPP_SEG_A0>, <BPP_SEG_A1>, <BPP_SEG_A2>, <BPP_SEG_A3>.
+    // Segment partitioning lives in bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651 segment table; single source of segmentation knowledge — wire sends BPP_SEG_INIT first).
+    // Segment bytes are runtime-domain (BPP synthesized at the MTD_GENERATE_BPP step); not injected into this script; load steps follow the SCRIPT data=null contract.
+    // S3-C1: binding:bpp_split_per_annexB_segment_table(segment_bpp;SGP.22-2.5.5) (check_attestation)
 
-	curDis.TestStepStart2(stno++,"读卡器向卡片发送MANAGE_CHANNEL命令，打开辅助逻辑通道；");
-	TS_MANAGE_CHANNEL_OPEN();
+    // 步骤 4：IC4: MTD_STORE_DATA_SCRIPT（tc_step）
+    // BPP segment load (data=null contract): <BPP_SEG_INIT> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+    // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+    var s4 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+    bind.checkData("S4-C1 SW", "9000", s4.sw);
 
-	curLogicChannel = 1;
+    // 步骤 5：IC5: MTD_STORE_DATA_SCRIPT（tc_step）
+    // BPP segment load (data=null contract): <BPP_SEG_A0> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+    // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+    var s5 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+    bind.checkData("S5-C1 SW", "9000", s5.sw);
 
-	curDis.TestStepStart2(stno++,"读卡器向卡片发送SELECT命令，选择ISD-R；");
-	TS_SELECT("Select ISD",ISD_R_AID,"9000");
+    // 步骤 6：IC6: MTD_STORE_DATA_SCRIPT（tc_step）
+    // BPP segment load (data=null contract): <BPP_SEG_A1> bytes are runtime-domain (BPP synthesized at MTD_GENERATE_BPP;
+    // segmentation single source = bpp_synthesizer.segment_bpp (SGP.22 §2.5.5 :1633-1651) — no bytes fabricated here.
+    var s6 = bind.sendApdu(null, "E2", "00", "00", null, "00", "9000");
+    bind.checkData("S6-C1 SW", "9000", s6.sw);
 
-	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccInfo1Request；");
-	var Profile_load_procedure = new RSP_profile_load_procedure_LPAd(PROFILE_OPERATIONAL1_DATA);
-	Profile_load_procedure.ICCID = ICCID_OP_PROF1;
-	Profile_load_procedure.ES10b_GetEUICCInfo1();
-
-	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccChallengeRequest；");
-	Profile_load_procedure.ES10b_GetEUICCChallenge();
-
-	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行AuthenticateServerRequest；");
-	Profile_load_procedure.ES10b_AuthenticateServer();
-
-	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行PrepareDownloadRequest；");
-	Profile_load_procedure.ES10b_PrepareDownload();
-
-	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行GetEuiccDataRequest(GetEID)；");
-	Profile_load_procedure.ES10b_GetEID();
-
-	curDis.TestStepStart2(stno++,"读卡器向卡片发送 StoreData命令，执行BoundProfilePackage，ReplaceSessionKeysRequest域中使用错误长度的PPK initialMacChaining；");
…（差异行超限，共 152 行，此处截断）