[masarray]

P0 Command continuation (stacked on #614)

Addresses a verified consumer lifecycle hazard: StopDeviceAsync could await NativeIec61850Client.DisposeAsync indefinitely while an unresolved native control held the MMS I/O gate. The process-wide deviceId|controlReference map also allowed a late release from an old association to interfere with a new connection.

Changes

• Introduce association-scoped, atomic Iec61850ControlSessionLease with sticky quarantine, retirement, and an actual-native-release drain task.
• Replace process-wide target ownership with association-scoped single-flight admission for control AND ctlModel Write. An old session can no longer release new-session command authority.
• Retire before awaiting teardown; for unresolved native control, immediately cancel old monitoring, allow UI Stop/reconnect, and defer old client disposal until native control and monitor tasks actually settle.
• Reject late process/status publication from a retired runtime session and suppress late Command UI results using a per-session GUID. Existing ledger remains the only process-value authority.
• Advisory Command UI checks actual runtime quarantine as well as view-model busy state.
• Expand regression tests for native drain ordering, sticky quarantine, atomic retirement, and stale result rejection; update existing ctlModel source-contract test.

Important limitations / safety

• A native operation that ignores cancellation can still leave the detached old MMS socket allocated indefinitely. We do not force-release the native operation or promise physical wire cancellation. The actual IED state remains UNKNOWN until verified.
• This is consumer lifecycle recovery, not proof of the CSWI6 root cause or evidence of successful physical control. Requires bench tests, wire capture and engine investigation as applicable.
• Do not automatically retry Operate on live equipment.

Validation

Pending fresh GitHub CI on this PR and physical acceptance. Preserve ARIEC pin 036e2c00d83a0815b6160147b14ea05975057965 and ArdIrec pin 7dbc7149db668126a493ce338264363a6ec5ec00. No merge to main.

Additional fail-closed evidence and engine follow-up

• A completed native Task with CompletionState=WireStateUnknown (or explicit timeout state) also quarantines the association before release; no subsequent Operate is admitted.
• Command Dock distinguishes Command outcome UNKNOWN from Command not sent for both native-unknown and outer-deadline timeout paths.
• An association-retirement token cancels queued Command/ctlModel operations even when retirement races with the creation of the native Task. Cancellation callbacks never run under the admission lock.
• The UI-facing facade forwards the new association-fence APIs to the existing inner runtime.
• Engine investigation tracked separately in ARIEC61850 #172. A potentially unbounded BestEffortCancelAsync(CancellationToken.None) was identified by source audit; it is not yet proven to be the field incident's root cause. No engine repin.

Command snapshot / diagnostic hardening

• Every native control gets a detached, per-attempt SignalDefinition snapshot; a late ARIEC task cannot write its mutable control fields into the WPF-owned model after old-session retirement.
• Completed native Cancelled and AssociationLost control outcomes are conservatively quarantined alongside WireStateUnknown and TimedOut.
• Structured per-attempt diagnostics now correlate attemptId + associationId, admission UTC, native task creation (NOT evidence of an actual wire send), timeout, terminal result and late-native observation.
• Regression assertions updated from removed global deviceId target map to atomic per-association flight lease; detached command signal mutation test added.

No physical wire-send or invoke ID is claimed without ARIEC evidence.

Verified CI evidence (HEAD b22f0f8e92e76f7d602b7955321c165cf626499e)

• SCL Interoperability R7 Build: SUCCESS, including Release build, 2211/2211 ARSAS xUnit, 1127/1127 pinned ARIEC xUnit.
• Remaining workflows should be evaluated at this exact HEAD before changing draft status or considering merge.
• No hardware/IEDScout physical acceptance yet; server-vs-engine root cause remains unproven.

[masarray]

Reconciliation finding (2026-10-26): KEEP OPEN — command-safety unique-delta investigation. This PR HEAD b22f0f8e92e76f7d602b7955321c165cf626499e carries Services/Iec61850ControlRequestSnapshot.cs (blob 96277fceb3490a778ab0d7113fadc0bb13edee1a), absent from current RC 817c3910e8223fa2ac531a4426ada5d2d4bbbe50. The helper cloned a command-only Iec61850ControlCommandRequest/signal to prevent a retired async MMS association mutating a WPF-owned signal, while preserving only existing live-verified CDC authority. A successor may have replaced this design, but removal/renaming was not yet proved equivalent. Do not close based on commit ancestry or an apparent green build. Next: inspect the current per-association command request snapshot/ownership boundary and its adversarial tests (Stop/Reconnect, timeout, late reply, no phantom Write); if absent, reintroduce a safe equivalent on an isolated integration branch, not by reverting current RC. No main, engine repin, R7/R10 or stable-release changes authorized.

[masarray]

Reconciliation D1 — confirmed outstanding WPF command-ownership hazard (2026-10-26)

Disposition: D/E — KEEP OPEN. This is NOT proven equivalent to integrated RC, frozen MMS Write #726, or Boolean-safety #716.

Reproducible source-path evidence (same byte-identical runtime file in RC 817c3910e8223fa2ac531a4426ada5d2d4bbbe50, #726, and #716):

1. MainWindow.xaml.cs:1854-1860 creates a request with Signal = signal where signal is the WPF/device model object.
2. Iec61850MonitorRuntime.cs:1357 sends the same request instance via session.Client.ExecuteControlAsync(request, ...); no command-only snapshot at this boundary. WaitForNativeAsync protects timing/admission/quarantine, not alias ownership.
3. NativeIec61850Client.cs:1520,1564-1569,1691 writes into request.Signal (e.g. ControlSemanticVerified, CDC, model, control status reference/current value) after awaits.
4. Iec61850MonitorRuntime.cs:1394-1400 intentionally lets a still-active native task finish late after the caller's timeout. A retired association's delayed task therefore retains the original mutable SignalDefinition alias.

The historical missing Services/Iec61850ControlRequestSnapshot.cs blob 96277fceb3490a778ab0d7113fadc0bb13edee1a supplied a command-only copy and preserved only already verified CDC, with no process-value authority. This is a specific ownership gap / plausible late-mutation path, not proof of observed field regression. Existing single-flight/UNKNOWN quarantine tests protect wire re-admission but do not establish object isolation.

Safety & required follow-up: Keep #615 OPEN; coordinate with active MMS Control/Write owner before source edit. Add focused regression proving that late native session completion cannot mutate the WPF signal after stop/reconnect; review every caller (UI facade, headless runtime, command dock), validate immutable command-only copy at the single owner boundary, and keep new verified MMS control semantics on the local command copy only until an association-fenced UI publication. Preserve exact command target, SBO/Operate order, fail-closed control admission, and frozen #726 Write/SSOT behavior. Targeted regression + required canonical CI before merge. Do NOT blind-cherry-pick the old PR, authorize physical operation, or close as integrated.

[masarray]

D4 P0 Control/Write owner handoff — proof and execution gate (2026-10-26)

Status / safety: KEEP #615 OPEN. I re-read exact protected RC 817c3910e8223fa2ac531a4426ada5d2d4bbbe50 after #753 CI; no evidence this control path is repaired in RC or accepted for field. This is an independent blocker from the now-green GOOSE/SGCB read-only #753.

Source-proven ownership defect in current RC (no physical incident asserted):

1. MainWindow.xaml.cs at current blob 44e26f5ffbb4be50c56fee26d819267021d674a1 creates new Iec61850ControlCommandRequest { Signal = signal, ... } by aliasing the WPF-owned selected SignalDefinition; no GetControlAssociationId, IsControlAssociationCurrent, or CONTROL_STALE_RESULT_IGNORED UI fence exists there.
2. Services/Iec61850MonitorRuntime.cs, current RC blob 0f783af40b2af82a462b9388e3a6d327188cfa9c, dispatches the SAME object via session.Client.ExecuteControlAsync(request, nativeCancellation.Token); it does not invoke Iec61850ControlRequestSnapshot; after a timeout, ObserveLateControlFlightAsync can observe the still-running native task.
3. Services/NativeIec61850Client.cs RC blob b74398faf4d206286ab1dcac8b6e5ab414783393 mutates request.Signal.ControlSemanticVerified, model/status and ControlCurrentValue after native asynchronous steps. Thus a late reply on a retired association may change old GUI-owned state even if admission/quarantine prevents a second MMS Operate. Safety claim is a proven mutable-alias path, not a proven relay event.
4. Current tests/ARSAS.Tests/M217P0ControlSingleFlightRecoveryTests.cs, blob 6132ed923e6622f4a9f03482c1f40cd2efcb8458, lacks NativeFlightSnapshotNeverSharesMutableGuiSignal and BrowserDiscardsResultFromRetiredControlAssociation. Historic P0 follow-up: retire unresolved MMS control sessions without blocking reconnect #615 already contains command-only Services/Iec61850ControlRequestSnapshot.cs (old unique blob 96277fceb3490a778ab0d7113fadc0bb13edee1a) and the candidate regression tests; preserve them, but do not cherry-pick the entire diverged PR.

Specific owner remediation gate, in active Command/Write lane only:

• Before native dispatch, clone all authorized command inputs and only current-association verified control identity; NotSame(original.Signal, requestForNative.Signal). Client may mutate its detached copy; old GUI model must remain byte-for-byte unchanged even when timed-out native completion arrives later.
• Gate any UI result/feedback publication by a nonreusable association identity (not by device ID or target string alone). When stop/reconnect swaps the session, log CONTROL_STALE_RESULT_IGNORED and make zero WPF model mutation. Do not promise “not sent” for unresolved wire outcome.
• Atomic single-flight/quarantine must remain by physical association: second command (same or different CSWI) rejected while unresolved; late old release cannot unlock replacement MMS socket; CTS/disposal/native drain and bounded teardown remain explicit.
• Regression three scenarios: (a) detachment survives late native mutation after timeout; (b) reconnect/new MMS association while old command outstanding never publishes old GUI state or permits undesired Operate; (c) uncertain completed native wire result remains quarantined. Verify actual race with TaskCompletionSource/late mock, not only source text; standard cancellation and positive SBOw/direct-control must still pass.
• Coordinate with INTEGRATION GATE ONLY: user-accepted Write onto latest SSOT V2; preserve advanced SMV #726 frozen MMS Write and FAT Write safety: reject unrecognized live Boolean instead of selecting false #716 Boolean Write; no change to verified Write/readback, ctlModel authorization, engine pin, active GUI layout, or physical release gates. Run targeted + full Windows canonical CI at final exact head and separately physical R7/R10 acceptance before promotion.

Current associated work: #753 GOOSE/SGCB read-only draft canonical Windows application/native/packaging CI success, yet #615 is still open. This comment is an owner handoff and verifiable acceptance contract, not a fix, merge or CI claim for Control.

[masarray]

D10 P0 remediation is now REAL SOURCE/TEST, staged for coordinated integration — KEEP #615 OPEN

Previous exact RC 817c3910e8223fa2ac531a4426ada5d2d4bbbe50 still contains the mutable WPF → native SignalDefinition alias. A narrow candidate repair has now been implemented, NOT merged, as draft #754, SHA 25cdc1764beaf47a174e8cd0b2244cbd58af2fe5, ahead1/behind0 RC, precisely five files.

Implementation: restored historic #615 command-only Iec61850ControlRequestSnapshot blob 96277fceb3490a778ab0d7113fadc0bb13edee1a, but connected it at the CURRENT runtime boundary, after existing per-association single-flight. No native task now receives WPF's original object. Inner runtime exposes nonreusable GUID ControlSessionIdentity, facade forwards it, GUI pins expected identity before dispatch and suppresses all late stale result/exception feedback with CONTROL_STALE_RESULT_IGNORED. Actual runtime refuses a changed expected association before command admission. Existing UNKNOWN wire outcome/quarantine/retired native drain remains.

Regression: DetachedLateFlightCannotMutateGuiOwnedSignalAfterCancellation uses TaskCompletionSource + canceled caller wait to prove original signal unchanged after simulated native late mutation, sticky quarantine; OperatorControlPublicationUsesNonreusableAssociationFence checks current source association gating and dispatch identity. Existing single-flight tests preserved. This is not a simulated physical Operate or a proof of positive relay actuation.

CI: exact-head Windows and SCL R7 were running when first inspected; Reference Guard and P1 Advisory already succeeded. No blanket reruns. Keep #615 OPEN until compile, meaningful async regression, owner code review, and RC integration/retest accepted.

Owner gate: frozen field-accepted Write #726 / Boolean editor #716, SG7 #688, IP form #732 and protected #727/#729 branch not modified. New draft is explicitly for owner reconciliation, not competing wholesale branch merge. Review exact five-file diff and native command outcomes before deciding RC integration. No accepted v1.6.42/stable/tag/engine repin changed.

[masarray]

D10 final-head correction to draft #754 (does NOT close #615)

Draft #754 latest HEAD is 2aab054b6cf9eb5500b1dce5ef5957eb8ba0232d (not the initial 25cdc176). It remains five changed files vs unchanged RC 817c3910; all subsequent changes were tests only:

1. 63434a1...: added the required ArIED61850Tester.Models import after compiler error CS0246 (initial application itself compiled).
2. 2aab054...: changed one brittle test expectation. Verified CDC normalization converts the original WPF ControlCurrentValue spelling Open [01] to Open at construction time; the correct late-flight isolation property is equality of actual pre-flight GUI state before and after mutation of detached native request. The intermediate SCL run 40312555609 confirmed 2,988/2,989 tests passed and exposed this single formatting assertion. No native/control/Write source changed in these two corrections.
   Only valid current SHA CI: Windows 40313104906, SCL 40313104592 in progress when last checked. Keep P0 follow-up: retire unresolved MMS control sessions without blocking reconnect #615 OPEN and do not integrate until actual green exact-head CI + owner FAT approval. D10 audit checkpoint.

[masarray]

D12 P0: previously hidden read-only native inspection GUI alias now corrected on isolated #755 only

During D12 source review of fully green original #755 a0b96118..., found Services/NativeIec61850Client.InspectControlAsync mutates WPF-owned SignalDefinition (CDC, ctlModel, feedback, live operability) before Services/Iec61850MonitorRuntime post-await association/retirement fence. The D10 #754 command request snapshot covered ExecuteControlAsync but NOT this distinct inspection path. A late old read-only inspection could therefore alter new Command Dock state. No actual physical misoperate claimed.

New candidate draft #755, HEAD b52d4824bbadb04dc0d897b476b38bcf507cda38, child of tested D11 integration, 12 changed paths vs protected RC. Added one Iec61850ControlInspectionPublication helper and isolated native inspection through a caller-context snapshot + inner-runtime detached copy. Actual GUI SignalDefinition is mutated only after the existing per-device operation returns and nonreusable ControlSessionIdentity, exact control object, and !ControlCommandBusy gates pass. Verified Direct/SBO status/typed CDC is applied last; StatusOnly/unready clears typed command authority (read-only, no Operate). Existing post-Write inspect caller receives the same returned capabilities after facade publication; native control protocol unchanged. No extra MMS calls or shadow ledger.

Test: deterministic wrong-association/foreign-root reject, verified direct control, StatusOnly downgrade, and native/caller source contract. Initial SCL 40321106212 built and ran 2,996 tests (2,995 pass); one brittle expectation used raw StatusOnly source text vs intentional SignalDefinition.ControlLastResult operator normalization; fixed test-only at current HEAD b52d4824bbadb04dc0d897b476b38bcf507cda38 with no new source mutation. Current SHA CI pending: Windows 40321671036, SCL 40321671103. This is not yet a qualified green D12 artifact.

D12 handoff checkpoint: full source/CI/status. #753 GOOSE 0652f..., #754 original command 2aab..., RC 817c..., frozen #726 Write and #716 Boolean, #688 SG7, #732 IP, trial engine pin and public stable v1.6.42 untouched. #615/#606/#727 remain OPEN; no auto merge until Command UI owner, GOOSE/SGCB 7-case GUI, and real IED R7/R10 checks.

[masarray]

D12 P0 read-only inspection ownership — exact-head fully QUALIFIED by managed/native CI, not physical FAT

Latest OPEN DRAFT #755 source HEAD b52d4824bbadb04dc0d897b476b38bcf507cda38 adds a typed, synchronous GUI publication gate for native read-only control inspection, in addition to previously qualified D11 command-only detached request + GOOSE FCDA validation. No source change after the test-only StatusOnly display expectation correction.

Proven exact-head CI: Windows Build+regression+native CTest+packaged managed bridge+portable EXE smoke+seal #40321671036 COMPLETED SUCCESS; SCL R7 canonical + engine + portable #40321671103 COMPLETED SUCCESS; IEC guard SUCCESS. Portable EXE artifact #12649647222 is a candidate, not the stable v1.6.42 release. Complete D12 source/test checkpoint.

Code contract: background native inspection now receives detached SignalDefinition only. Facade on captured caller GUI context publishes typed capabilities only with current nonreusable association GUID, exact control-root identity, and no in-flight command. Ready direct/SBO model may receive semantic proof only from typed live descriptor; StatusOnly/Unknown fails closed and clears prior verified live CDC. Old/cancelled IED native continuations cannot mutate the new GUI signal. No native Operate protocol change, extra MMS call, or new observation cache. This correction is additional to original D11 union; current #755 is 12-path follow-up, not byte-identical 6+5 overlay anymore.

Release/owner stop: #753/#754 historical candidate branches remain unchanged, RC #727/#729 817c3910..., main/stable, engine pin and frozen Write #726/#716, SG7 #688, IP #732 untouched. #615 Command owner must still accept Direct/SBO post-Write reinspection behavior, #606 owner must validate GOOSE/SGCB 7-case on relay, R7/R10 physical FAT separate. No merge/closure solely on CI.

[masarray]

D13 real P0 correction — post-Write stale inspection dual-epoch publication gate; #755 draft, not merged

Source: draft #755, exact HEAD 7d235554225aa0341561b4e887a852fb6fd8e269 (12 changed paths vs unchanged protected RC 817c3910e8223fa2ac531a4426ada5d2d4bbbe50). Original independently green #753 GOOSE 0652f66b... and #754 detached Control 2aab054b... were not touched.

Previously unchecked GUI ownership leak: even with D12's detached native Inspection, MainWindow.ReinspectConfiguredControlAsync could reset a NEW connection's ControlSemanticVerified/ctlModel in stale cancellation/error paths. A caller-only postawait check of writeAssociation also happens AFTER the facade can already publish capabilities onto the mutable GUI row.

Implemented on isolated #755 with precisely two follow-up commits 139f2f4... → 7d235554225aa0341561b4e887a852fb6fd8e269:

1. Pin current nonreusable MMS association GUID plus device.LiveValues.Association model epoch and live signal membership; pure Iec61850ControlInspectionPublication.IsCurrentPostWriteTarget tests connection/current model. When stale, success, cancellation, and fault branches log CTL_MODEL_POSTWRITE_STALE_IGNORED and do NOT clear/overwrite typed GUI authority/status or project old Control Dock.
2. Pass optional UI-context stillCurrentPublicationTarget predicate to the existing facade InspectControlAsync (all normal three-argument callers unchanged). Check it before sending read, BEFORE TryApply can synchronously publish typed capabilities, and before any native failure can revoke GUI authority. No second MMS connection, native Operate or CF Write; direct/SBO control gate, report and GOOSE unchanged.
3. Added deterministic matrix for invalid/valid GUID, live model epoch, disconnected/unowned signal; source-contract assertions enforce facade pre-publication and fault fences. New code remains candidate pending latest exact-head CI Windows 40325732039, SCL 40325732197. Exact-head reference guard 40325732127 and advisory 40325732341 have completed success.

Full immutable D13 audit and handoff. Owner gates remain: #615 native Command Direct/SBO and post-Write inspect behavioral owner acceptance, #606 GOOSE/SGCB seven cases on real relay, #727/#729 integrated RC, R7/R10 physical FAT. No physical Operate/readback success inferred from CI. Frozen #726 Write/readback, #716 Boolean, #688 SG7, #732 IP, SMV, engine pin and accepted v1.6.42 untouched. Do not merge draft #755 automatically.

[masarray]

D13 FINAL: post-Write dual-epoch Command GUI fence — current SHA full CI SUCCESS (NOT physical FAT)

Exact #755 HEAD 7d235554225aa0341561b4e887a852fb6fd8e269 (commit), branch still DRAFT OPEN, base/protected RC 817c3910e8223fa2ac531a4426ada5d2d4bbbe50, 12 paths, ahead5/behind0. Original source #753 and #754 unaffected.

Windows 40325732039 COMPLETED SUCCESS: Windows .NET8 solution, pinned engine identity/SCL regression, all ARSAS app tests (D13 dual-epoch invalid/positive tests), pinned ArdIrec native CTest, packaged bridge managed integration, portable EXE publish/smoke/seal. SCL R7 40325732197 SUCCESS, IEC guard 40325732127 and advisory 40325732341 SUCCESS. Exact-HEAD portable candidate artifact #12652020557, named ARSAS-1.6.42-win-x64-portable.exe by pipeline convention only — NOT public stable v1.6.42.

Root cause closed in candidate source: stale post-Write ReinspectConfiguredControlAsync success/cancel/error could previously revoke/overwrite new GUI typed command authority; more importantly D12 facade could already mutate GUI before invoking post-Write's own model epoch check. D13 pinned both MMS-session GUID and LiveValues.Association model epoch, current connection/signal membership; facade validates caller epoch before operation, before typed GUI publication and before fault downgrade. Old/retired results are logged CTL_MODEL_POSTWRITE_STALE_IGNORED and cannot change new typed control proof. No extra MMS calls, native/engine rework, automatic Operate/Write or process-state invention.

D13 historical semantic audit #599 collapsed-by-default and #583 revised Nav+SMV order remain KEEP OPEN, no blind closure. Complete source/test/CI checkpoint.

Still release-blocked pending owner & real IED tests: #615 Direct/SBO post-Write/Stop/reconnect acceptance; #606 seven-case GOOSE/SGCB GUI/IED; #727/#729 RC integration owner, R7/R10 FAT. Do NOT merge #755 just because CI passed. #726 accepted Write, #716 Boolean, SG7 #688, IP form #732, SMV, engine pin, RC/main/stable remain unmodified.

[masarray]

D15 incremental P0 safety fix — routine Command Dock Refresh now honors MMS GUID + live model epoch

Found distinct gap after D13 #755 exact head 7d235554225aa0341561b4e887a852fb6fd8e269: MainWindow.xaml.cs:RefreshControlValuesAsync still called InspectControlAsync(deviceId, signal, token) without a same-live-model publication predicate. D13 post-Write had this guard, but routine Refresh could retain an old selected SignalDefinition after same-socket rebind/rescan and replay typed capabilities or a stale failure into Command Dock. No physical misoperate alleged.

Real narrow candidate: stacked draft #756, SHA 098ec4abdf7ce8681ec97111f12f3f6151eade78; base is exact #755 branch, ahead1/behind0, 2 files only (MainWindow.xaml.cs routine Refresh section and new tests/ARSAS.Tests/M217P0RefreshControlModelEpochTests.cs). This DOES NOT edit the #755 owner head, #753/#754 source, frozen Write, RC, engine pin, main, or stable.

Implementation pins MMS association GUID + device.LiveValues.Association before the first Dispatcher yield; reuses existing IsCurrentPostWriteTarget and checks original device.Signals.Contains(signal) identity, not only IEC object reference; gives callback to facade which already blocks stale dispatch, typed GUI publish, and exception revocation; rechecks before local result/error and suppresses stale batch projection. No additional MMS read or write, native change, queue, timer, or shadow cache. Two deterministic tests cover same-socket model rebind, foreign same-path signal, old association, disconnection and source-level UI/facade seam. Parent CI Windows #40325732039 and SCL #40325732197 passed; new exact HEAD SCL 40331840419 completed SUCCESS, Windows 40331840977 still processing native/portable at writing. Do not claim final Windows qualification until run completion.

D15 full checkpoint. Keep both #755/#756 draft until Control owner #615/RC owner #727 review and physical IED R7/R10 acceptance; GOOSE/SGCB #606 7-case field checks separate. No automatic merge.

[masarray]

D28 legacy candidate archived, not merged. Per the operator's explicit instruction, the latest accepted ARSAS working evidence is the baseline; no new hardware/packet capture cycle is required for cleaning up outdated PRs. Historical candidate b22f0f8e92e76f7d602b7955321c165cf626499e is withdrawn from the integration queue, with source/review history intact. Closing it does not assert its unmerged source fixes shipped, does not authorize weakening protocol safety, and does not modify main, stable, RC or engine pins.