P0 follow-up: retire unresolved MMS control sessions without blocking reconnect

MainWindow.xaml.cs

@@ -1500,7 +1500,8 @@ private bool RejectCommandWhenIedFlightUnavailable(
         // Reuse existing CommandSignals state instead of mirroring a new
         // runtime busy flag into the WPF view model.
         if (device is null ||
-            !device.CommandSignals.Any(active => active.ControlCommandBusy))
+            (!device.CommandSignals.Any(active => active.ControlCommandBusy) &&
+             !_runtime.IsControlFlightUnavailable(device.DeviceId)))
             return false;
         const string reason =
             "another IED command is still active or its wire outcome is unresolved";
@@ -1671,6 +1672,7 @@ private async Task ExecuteClaimedControlAsync(SignalDefinition signal, ControlCo
 
         DismissControlShout();
         var clickStopwatch = Stopwatch.StartNew();
+        Guid dispatchedAssociation = Guid.Empty;
         signal.ControlLastResult = $"Dispatching {claim.RequestedValue}…";
         SetStatus($"{device.Name}: dispatching {signal.Name} = {claim.RequestedValue}…");
         AddLog("INFO", device.Name,
@@ -1700,6 +1702,7 @@ private async Task ExecuteClaimedControlAsync(SignalDefinition signal, ControlCo
 
             AddLog("INFO", device.Name,
                 $"IEC 61850 control execution started: {signal.ObjectReference}; sequence={claim.Sequence}; value={claim.RequestedValue}; wire send is not assumed until native evidence is returned.");
+            dispatchedAssociation = _runtime.GetControlAssociationId(device.DeviceId);
             var result = await _runtime.ExecuteControlAsync(
                 device.DeviceId,
                 new Iec61850ControlCommandRequest
@@ -1716,6 +1719,26 @@ private async Task ExecuteClaimedControlAsync(SignalDefinition signal, ControlCo
                 },
                 _applicationCancellation.Token);
 
+            if (!_runtime.IsControlAssociationCurrent(device.DeviceId, dispatchedAssociation))
+            {
+                AddLog("WARN", device.Name,
+                    $"CONTROL_STALE_RESULT_IGNORED: {signal.ObjectReference}; " +
+                    "original association retired while native operation was pending.");
+                return;
+            }
+
+            if (Iec61850ControlWireOutcomePolicy.RequiresQuarantine(result.CompletionState))
+            {
+                signal.ControlLastResult =
+                    "Control outcome UNKNOWN — native MMS result is inconclusive. " +
+                    "Verify IED state and reconnect before another command.";
+                AddLog("ERROR", device.Name,
+                    $"CONTROL_UI_NATIVE_UNKNOWN: {signal.ObjectReference}; " +
+                    $"completion={result.CompletionState}; {result.Message}");
+                MarkDiagnosticAlert();
+                ShowControlShout(Iec61850ControlShout.FromUnknownWireOutcome());
+                return; // Do not publish ambiguous feedback as a process value.
+            }
             if (!string.IsNullOrWhiteSpace(result.ControlModelText))
                 signal.ControlModelText = result.ControlModelText;
             if (!string.IsNullOrWhiteSpace(result.FeedbackValue) && result.FeedbackValue != "-")
@@ -1738,6 +1761,8 @@ private async Task ExecuteClaimedControlAsync(SignalDefinition signal, ControlCo
         }
         catch (OperationCanceledException)
         {
+            if (dispatchedAssociation != Guid.Empty &&
+                !_runtime.IsControlAssociationCurrent(device.DeviceId, dispatchedAssociation)) return;
             signal.ControlLastResult = "Command cancelled; if Operate was already dispatched, verify actual IED position.";
             SetStatus($"{device.Name}: {signal.Name} command cancelled; verify the final process state.");
         }
@@ -1746,6 +1771,8 @@ private async Task ExecuteClaimedControlAsync(SignalDefinition signal, ControlCo
             (ex.Message.Contains("in progress", StringComparison.OrdinalIgnoreCase) ||
              ex.Message.Contains("unresolved", StringComparison.OrdinalIgnoreCase)))
         {
+            if (dispatchedAssociation != Guid.Empty &&
+                !_runtime.IsControlAssociationCurrent(device.DeviceId, dispatchedAssociation)) return;
             signal.ControlLastResult = "Command NOT SENT: " + ex.Message;
             AddLog("WARN", device.Name,
                 $"CONTROL_UI_LOCAL_GATE: {signal.ObjectReference}; {ex.Message}");
@@ -1756,18 +1783,21 @@ private async Task ExecuteClaimedControlAsync(SignalDefinition signal, ControlCo
         }
         catch (TimeoutException ex)
         {
+            if (dispatchedAssociation != Guid.Empty &&
+                !_runtime.IsControlAssociationCurrent(device.DeviceId, dispatchedAssociation)) return;
             signal.ControlLastResult =
                 "Control outcome UNKNOWN — MMS flight exceeded deadline. " +
                 "Verify IED process state and reconnect before another command.";
             AddLog("ERROR", device.Name,
                 $"CONTROL_UI_TIMEOUT: {signal.ObjectReference}; {ex.Message}");
             SetStatus($"{device.Name}: {signal.Name} control outcome UNKNOWN; check Diagnostics.");
             MarkDiagnosticAlert();
-            ShowControlShout(Iec61850ControlShout.FromLocalRejection(
-                "Control timed out with UNKNOWN wire outcome. Verify the IED position and reconnect; do not blindly retry"));
+            ShowControlShout(Iec61850ControlShout.FromUnknownWireOutcome());
         }
         catch (Exception ex)
         {
+            if (dispatchedAssociation != Guid.Empty &&
+                !_runtime.IsControlAssociationCurrent(device.DeviceId, dispatchedAssociation)) return;
             signal.ControlLastResult = $"Command failed: {ex.Message}";
             AddLog("ERROR", device.Name, $"Quick control failed for {signal.ObjectReference}: {ex}");
             SetStatus($"{device.Name}: {signal.Name} command failed — {ex.Message}");

Services/Iec61850ControlFlightAdmission.cs

@@ -28,3 +28,89 @@ public static void Quarantine(ref int quarantine)
     public static void Release(ref int active)
         => Interlocked.Exchange(ref active, 0);
 }
+
+
+/// <summary>
+/// One physical MMS association's command lifetime. Retirement atomically
+/// prevents admission and never equates WaitAsync cancellation with release
+/// of the underlying native operation.
+/// </summary>
+public sealed class Iec61850ControlSessionLease
+{
+    private readonly object _sync = new();
+    private TaskCompletionSource<bool>? _activeFlightReleased;
+    private readonly CancellationTokenSource _retirement = new();
+    private int _active;
+    private int _quarantine;
+    private int _retired;
+
+    // Linked into native operations so Stop can cancel even the narrow window
+    // between successful admission and native task creation.
+    public CancellationToken RetirementToken => _retirement.Token;
+    public bool IsActive => Volatile.Read(ref _active) != 0;
+    public bool IsRetired => Volatile.Read(ref _retired) != 0;
+    public bool IsUnavailable =>
+        IsRetired || Iec61850ControlFlightAdmission.IsUnavailable(ref _active, ref _quarantine);
+
+    public bool TryEnter()
+    {
+        lock (_sync)
+        {
+            if (_retired != 0 ||
+                !Iec61850ControlFlightAdmission.TryEnter(ref _active, ref _quarantine))
+                return false;
+            _activeFlightReleased = new TaskCompletionSource<bool>(
+                TaskCreationOptions.RunContinuationsAsynchronously);
+            return true;
+        }
+    }
+
+    public void Quarantine()
+        => Iec61850ControlFlightAdmission.Quarantine(ref _quarantine);
+
+    public void Release()
+    {
+        lock (_sync)
+        {
+            Iec61850ControlFlightAdmission.Release(ref _active);
+            _activeFlightReleased?.TrySetResult(true);
+        }
+    }
+
+    /// <summary>
+    /// Prevent future commands and return a drain which finishes only when
+    /// the original admitted native operation has actually released its lease.
+    /// </summary>
+    public Task Retire()
+    {
+        Task drain;
+        lock (_sync)
+        {
+            Volatile.Write(ref _retired, 1);
+            Quarantine();
+            drain = _active != 0
+                ? _activeFlightReleased!.Task
+                : Task.CompletedTask;
+        }
+        // Never execute native cancellation callbacks under the admission lock.
+        // Retirement was already committed atomically before releasing it.
+        _retirement.Cancel();
+        return drain;
+    }
+}
+
+
+/// <summary>
+/// A completed Task is not necessarily a definite wire result. Native services
+/// can return UNKNOWN/timeout completion without throwing an exception.
+/// </summary>
+public static class Iec61850ControlWireOutcomePolicy
+{
+    public static bool RequiresQuarantine(string? completionState) =>
+        !string.IsNullOrWhiteSpace(completionState) &&
+        (completionState.Contains("Unknown", StringComparison.OrdinalIgnoreCase) ||
+         completionState.Contains("TimedOut", StringComparison.OrdinalIgnoreCase) ||
+         completionState.Contains("Timeout", StringComparison.OrdinalIgnoreCase) ||
+         completionState.Equals("AssociationLost", StringComparison.OrdinalIgnoreCase) ||
+         completionState.Equals("Cancelled", StringComparison.OrdinalIgnoreCase));
+}

Services/Iec61850ControlRequestSnapshot.cs

@@ -0,0 +1,55 @@
+using ArIED61850Tester.Models;
+
+namespace ArIED61850Tester.Services;
+
+/// <summary>
+/// Makes one disposable, command-only copy of the operator's selected signal.
+/// ARIEC may update the request's SignalDefinition after an asynchronous MMS
+/// reply; a retired association must never mutate a WPF-owned signal model.
+/// The copy carries no process-value authority or extra observation cache.
+/// </summary>
+public static class Iec61850ControlRequestSnapshot
+{
+    public static Iec61850ControlCommandRequest Create(Iec61850ControlCommandRequest request)
+    {
+        ArgumentNullException.ThrowIfNull(request);
+        return new Iec61850ControlCommandRequest
+        {
+            Signal = CopySignal(request.Signal),
+            ValueText = request.ValueText,
+            InterlockCheck = request.InterlockCheck,
+            SynchroCheck = request.SynchroCheck,
+            TestMode = request.TestMode,
+            Originator = request.Originator,
+            OriginCategory = request.OriginCategory,
+            FeedbackTimeoutMs = request.FeedbackTimeoutMs,
+            CommandTerminationTimeoutMs = request.CommandTerminationTimeoutMs
+        };
+    }
+
+    private static SignalDefinition CopySignal(SignalDefinition signal)
+    {
+        ArgumentNullException.ThrowIfNull(signal);
+        var copy = new SignalDefinition
+        {
+            Name = signal.Name,
+            ObjectReference = signal.ObjectReference,
+            FunctionalConstraint = signal.FunctionalConstraint,
+            DataType = signal.DataType,
+            Category = signal.Category,
+            IsControlSignal = signal.IsControlSignal,
+            ControlCdc = signal.ControlCdc,
+            ControlStatusReference = signal.ControlStatusReference,
+            ControlValueType = signal.ControlValueType,
+            ControlModelReference = signal.ControlModelReference,
+            ControlModelText = signal.ControlModelText,
+            ControlCurrentValue = signal.ControlCurrentValue,
+            ControlSemanticVerified = signal.ControlSemanticVerified
+        };
+        // Preserve only the authority already verified by the current MMS
+        // association. Never promote DataSet/SCL advisory CDC to live proof.
+        if (!string.IsNullOrWhiteSpace(signal.VerifiedLiveControlCdc))
+            copy.AcceptVerifiedLiveControlCdc(signal.VerifiedLiveControlCdc);
+        return copy;
+    }
+}

Services/Iec61850ControlShout.cs

@@ -118,6 +118,11 @@ explanation.Confidence is "ConfirmedClient" or "LocalValidation"
         Safe($"ARSAS blocked the request before dispatch: {reason}.", 175),
         Iec61850ControlNoticeTone.Warning);
 
+    internal static Notice FromUnknownWireOutcome() => new(
+        "Command outcome UNKNOWN",
+        "MMS wire result is inconclusive. Verify actual IED state and reconnect before any new Operate.",
+        Iec61850ControlNoticeTone.Warning);
+
     internal static Notice FromDemo(string feedback) => new(
         "Simulation updated",
         Safe($"Demo feedback: {feedback}. No command was sent to a physical IED.", 175),