diff --git a/.github/workflows/_ci-p1-windows-build-test.yml b/.github/workflows/_ci-p1-windows-build-test.yml
index 92eaa2e61..73d326fe0 100644
--- a/.github/workflows/_ci-p1-windows-build-test.yml
+++ b/.github/workflows/_ci-p1-windows-build-test.yml
@@ -11,6 +11,18 @@ on:
         description: Prevent this primitive from being mistaken for release/promotion authority
         type: boolean
         default: true
+      fast_dev:
+        description: Opt-in bounded test scope; not a FAT or release gate
+        type: boolean
+        default: false
+      focus:
+        description: FAST DEV regression selection
+        type: string
+        default: all
+      engine_trial_sha:
+        description: Explicit experimental ARIEC commit for isolated FAST DEV only
+        type: string
+        default: ''
 
 permissions:
   contents: read
@@ -61,7 +73,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           repository: ${{ steps.engine.outputs.repository }}
-          ref: ${{ steps.engine.outputs.commit }}
+          ref: ${{ inputs.fast_dev && inputs.engine_trial_sha != '' && inputs.engine_trial_sha || steps.engine.outputs.commit }}
           path: ARIEC61850
           fetch-depth: 1
           persist-credentials: false
@@ -69,14 +81,28 @@ jobs:
       - name: Verify exact engine and immutable history provenance
         shell: pwsh
         env:
-          EXPECTED_ENGINE_SHA: ${{ steps.engine.outputs.commit }}
+          EXPECTED_ENGINE_SHA: ${{ inputs.fast_dev && inputs.engine_trial_sha != '' && inputs.engine_trial_sha || steps.engine.outputs.commit }}
+          PINNED_ENGINE_SHA: ${{ steps.engine.outputs.commit }}
+          TRIAL_ENGINE_SHA: ${{ inputs.engine_trial_sha }}
+          FAST_DEV: ${{ inputs.fast_dev }}
         run: |
           $ErrorActionPreference = 'Stop'
+          if ($env:TRIAL_ENGINE_SHA -and $env:FAST_DEV -ne 'true') {
+            throw 'An engine trial is forbidden outside explicit FAST DEV.'
+          }
+          if ($env:TRIAL_ENGINE_SHA -and $env:TRIAL_ENGINE_SHA -cnotmatch '^[0-9a-f]{40}$') {
+            throw 'ENGINE_TRIAL_SHA must be an exact 40-character Git SHA.'
+          }
           $actual = (git -C .\ARIEC61850 rev-parse HEAD).Trim().ToLowerInvariant()
           if ($actual -cne $env:EXPECTED_ENGINE_SHA) {
-            throw "ARIEC61850 pinned checkout drifted: expected $env:EXPECTED_ENGINE_SHA, got $actual."
+            throw "ARIEC61850 exact checkout drifted: expected $env:EXPECTED_ENGINE_SHA, got $actual."
+          }
+          if ($env:TRIAL_ENGINE_SHA) {
+            if ($actual -ceq $env:PINNED_ENGINE_SHA) { throw 'Trial engine unexpectedly matches production pin.' }
+            Write-Host "NON-PROMOTABLE ENGINE TRIAL: $actual; unchanged production pin: $env:PINNED_ENGINE_SHA"
+          } else {
+            Write-Host "Reproducible compilation: ARSAS + production pinned ARIEC61850 $actual."
           }
-          Write-Host "Reproducible compilation authority: ARSAS + pinned ARIEC61850."
 
       - name: Setup .NET 8
         uses: actions/setup-dotnet@v6
@@ -91,20 +117,224 @@ jobs:
           restore-keys: |
             ci-p1-nuget-win-x64-
 
+      - name: Materialize temporary FAST DEV engine validation lock
+        if: ${{ inputs.fast_dev && inputs.engine_trial_sha != '' }}
+        shell: pwsh
+        env:
+          TRIAL_ENGINE_SHA: ${{ inputs.engine_trial_sha }}
+          APPROVED_ENGINE_SHA: ${{ steps.engine.outputs.commit }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $lock = Get-Content -LiteralPath '.\ARSAS\engines\ARIEC61850.lock.json' -Raw | ConvertFrom-Json
+          $actual = (git -C .\ARIEC61850 rev-parse HEAD).Trim().ToLowerInvariant()
+          if ($lock.commit -cne $env:APPROVED_ENGINE_SHA -or
+              $env:TRIAL_ENGINE_SHA -cnotmatch '^[0-9a-f]{40}$' -or
+              $actual -cne $env:TRIAL_ENGINE_SHA -or
+              $actual -ceq $lock.commit) {
+            throw 'Trial engine identity or approved production baseline disagrees.'
+          }
+          $lock.commit = $actual
+          $lock | Add-Member -NotePropertyName nonPromotableTrial -NotePropertyValue $true -Force
+          $lock | Add-Member -NotePropertyName approvedBaselineCommit -NotePropertyValue $env:APPROVED_ENGINE_SHA -Force
+          $ephemeral = Join-Path $env:RUNNER_TEMP 'ariec-ci-p1-nonpromotion-lock.json'
+          $lock | ConvertTo-Json -Depth 64 | Set-Content -LiteralPath $ephemeral -Encoding utf8
+          Write-Host "Validated CI-only engine $actual against unchanged approved lock."
+
       - name: Restore solution once
         run: dotnet restore .\ARSAS\ArIED61850Tester.sln
 
       - name: Build solution once
-        run: dotnet build .\ARSAS\ArIED61850Tester.sln -c Release --no-restore
+        shell: pwsh
+        env:
+          TRIAL_ENGINE_SHA: ${{ inputs.engine_trial_sha }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $buildArgs = @('.\ARSAS\ArIED61850Tester.sln', '-c', 'Release', '--no-restore')
+          if ($env:TRIAL_ENGINE_SHA) {
+            $ephemeral = Join-Path $env:RUNNER_TEMP 'ariec-ci-p1-nonpromotion-lock.json'
+            if (-not (Test-Path -LiteralPath $ephemeral)) { throw 'Trial-only validator lock missing.' }
+            $buildArgs += "-p:ArIec61850LockPath=$ephemeral"
+          }
+          & dotnet build @buildArgs
+          if ($LASTEXITCODE -ne 0) { throw 'CI-P1 Windows compilation failed.' }
+
+      - name: Run ARSAS regression (full or focused FAST DEV)
+        shell: pwsh
+        env:
+          FAST_DEV: ${{ inputs.fast_dev }}
+          FOCUS: ${{ inputs.focus }}
+          TRIAL_ENGINE_SHA: ${{ inputs.engine_trial_sha }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $arguments = @(
+            'test', '.\ARSAS\tests\ARSAS.Tests\ARSAS.Tests.csproj',
+            '-c', 'Release', '--no-build', '--no-restore',
+            '--logger', 'trx;LogFileName=ci-p1-shadow.trx',
+            '--results-directory', '.\ARSAS\TestResults'
+          )
+          if ($env:FAST_DEV -eq 'true') {
+            $filter = switch ($env:FOCUS) {
+              'quality-browser' { 'FullyQualifiedName~QualityInvalidAttentionTests|FullyQualifiedName~IedBrowserPresentationTests|FullyQualifiedName~M2TypedQualityEvidenceTests|FullyQualifiedName~P0ReadEvidenceCsvBehaviorTests|FullyQualifiedName~P0SiebcuReadAllAndLayoutRegressionTests' }
+              'smv' { 'FullyQualifiedName~SmvArstack|FullyQualifiedName~SmvLiveCaptureTests|FullyQualifiedName~SmvObservedTimebaseTests|FullyQualifiedName~SmvDigSubPortTests' }
+              'command-read' { 'FullyQualifiedName~ModelDrivenAutoCommandDockTests|FullyQualifiedName~P109UStableCommandProjectionTests|FullyQualifiedName~P109WCommandDockLifecycleArchitectureTests|FullyQualifiedName~P0CswiCrossDataSetCommandDiscoveryTests|FullyQualifiedName~P0GrxCswiSelectionVisibilityTests|FullyQualifiedName~P0GrxSclLiveCswiParityTests|FullyQualifiedName~P0ReadEvidenceCsvBehaviorTests|FullyQualifiedName~P109KGenericControlSafetyTests|FullyQualifiedName~ZivBscStepControlRegressionTests|FullyQualifiedName~G1ControlCorrectnessRegressionTests' }
+              'all' { 'FullyQualifiedName~QualityInvalidAttentionTests|FullyQualifiedName~SmvArstack|FullyQualifiedName~P0CswiCrossDataSetCommandDiscoveryTests|FullyQualifiedName~P0ReadEvidenceCsvBehaviorTests' }
+              default { throw 'Unknown FAST DEV scope; refusing to silently skip tests.' }
+            }
+            $arguments += @('--filter', $filter)
+            Write-Host "NON-FAT scoped regression only ($env:FOCUS). No release/physical authority."
+          } else {
+            Write-Host "FULL ARSAS regression; no selected-test filter."
+          }
+          if ($env:TRIAL_ENGINE_SHA) {
+            $ephemeral = Join-Path $env:RUNNER_TEMP 'ariec-ci-p1-nonpromotion-lock.json'
+            if (-not (Test-Path -LiteralPath $ephemeral)) { throw 'Trial-only validator lock missing before test.' }
+            $arguments += "-p:ArIec61850LockPath=$ephemeral"
+          }
+          # One .NET test invocation for both modes; CI sprawl budget unchanged.
+          & dotnet @arguments
+          if ($LASTEXITCODE -ne 0) { throw 'Selected ARSAS regression failed.' }
+          $trxPath = '.\ARSAS\TestResults\ci-p1-shadow.trx'
+          if (-not (Test-Path -LiteralPath $trxPath)) {
+            throw 'No TRX proof for selected regression; refusing empty pass.'
+          }
+          [xml]$trx = Get-Content -LiteralPath $trxPath -Raw
+          $counts = $trx.TestRun.ResultSummary.Counters
+          if ($null -eq $counts -or [int]$counts.executed -lt 1 -or [int]$counts.failed -gt 0) {
+            throw "No actual passing tests or failures in FAST DEV/full TRX."
+          }
+          Write-Host "Exact-source regression results: executed=$($counts.executed) passed=$($counts.passed) failed=$($counts.failed)."
 
-      - name: Run full ARSAS regression suite once
-        run: dotnet test .\ARSAS\tests\ARSAS.Tests\ARSAS.Tests.csproj -c Release --no-build --no-restore --logger "trx;LogFileName=ci-p1-shadow.trx" --results-directory .\ARSAS\TestResults
+      - name: Build locked ArdIrec bridge and native regression for SG7 BCU trial
+        if: ${{ inputs.fast_dev && inputs.engine_trial_sha != '' && inputs.focus == 'command-read' }}
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $bridge = [string](.\ARSAS\scripts\build-ardirec-bridge.ps1 `
+            -OutputDirectory (Join-Path $env:RUNNER_TEMP 'sg7-ardirec-bridge') `
+            -CTestJunitPath (Join-Path $env:RUNNER_TEMP 'sg7-ardirec-ctest.xml') |
+            Select-Object -Last 1)
+          $bridge = $bridge.Trim()
+          if (-not (Test-Path -LiteralPath $bridge -PathType Leaf) -or
+              -not (Test-Path (Join-Path $env:RUNNER_TEMP 'sg7-ardirec-ctest.xml') -PathType Leaf)) {
+            throw 'Native bridge build / CTest evidence missing.'
+          }
+          "SG7_NATIVE_BRIDGE=$bridge" | Out-File $env:GITHUB_ENV -Append -Encoding utf8
+
+      - name: Publish actual self-contained SG7 BCU Ed2 trial Windows EXE
+        if: ${{ inputs.fast_dev && inputs.engine_trial_sha != '' && inputs.focus == 'command-read' }}
+        shell: pwsh
+        env:
+          ARSAS_NONPROMOTION_ENGINE_TRIAL: 'true'
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $temporary = Join-Path $env:RUNNER_TEMP 'ariec-ci-p1-nonpromotion-lock.json'
+          if (-not (Test-Path $temporary -PathType Leaf) -or
+              -not (Test-Path $env:SG7_NATIVE_BRIDGE -PathType Leaf)) {
+            throw 'Engine/ArdIrec exact-SHA trial packaging prerequisites missing.'
+          }
+          .\ARSAS\scripts\publish-windows-portable.ps1 `
+            -Version '1.6.40-sg7bcued2trial' `
+            -Runtime win-x64 `
+            -SingleFile $true `
+            -SelfContained $true `
+            -EngineProject "$env:GITHUB_WORKSPACE\ARIEC61850\src\AR.Iec61850\AR.Iec61850.csproj" `
+            -NpcapProject "$env:GITHUB_WORKSPACE\ARIEC61850\src\AR.Iec61850.Transports.Npcap\AR.Iec61850.Transports.Npcap.csproj" `
+            -ArdIrecBridgePath $env:SG7_NATIVE_BRIDGE `
+            -EngineValidationLockPath $temporary
+          if ($LASTEXITCODE -ne 0) { throw 'Single EXE trial publish failed.' }
+
+      - name: Execute portable EXE smoke and seal physical FAT trial identity
+        if: ${{ inputs.fast_dev && inputs.engine_trial_sha != '' && inputs.focus == 'command-read' }}
+        shell: pwsh
+        env:
+          SOURCE_SHA: ${{ inputs.source_sha }}
+          EXPERIMENTAL_ENGINE: ${{ inputs.engine_trial_sha }}
+          BASELINE_ENGINE: ${{ steps.engine.outputs.commit }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $root = '.\ARSAS\dist'
+          $source = Join-Path $root 'ARSAS-1.6.40-sg7bcued2trial-win-x64-portable.exe'
+          $identityPath = Join-Path $root 'ARSAS-1.6.40-sg7bcued2trial-win-x64-portable-build-identity.json'
+          if (-not (Test-Path $source -PathType Leaf) -or -not (Test-Path $identityPath -PathType Leaf)) {
+            throw 'Single file EXE / portable identity missing.'
+          }
+          $ident = Get-Content $identityPath -Raw | ConvertFrom-Json
+          $exeHash = (Get-FileHash $source -Algorithm SHA256).Hash.ToLowerInvariant()
+          $bridgeHash = (Get-FileHash $env:SG7_NATIVE_BRIDGE -Algorithm SHA256).Hash.ToLowerInvariant()
+          $sourceSha = (git -C .\ARSAS rev-parse HEAD).Trim().ToLowerInvariant()
+          $engineSha = (git -C .\ARIEC61850 rev-parse HEAD).Trim().ToLowerInvariant()
+          $lock = Get-Content '.\ARSAS\engines\ARIEC61850.lock.json' -Raw | ConvertFrom-Json
+          if ($ident.sourceCommit -cne $env:SOURCE_SHA -or
+              $ident.engineCommit -cne $env:EXPERIMENTAL_ENGINE -or
+              $ident.ardIrecBridgeSha256 -cne $bridgeHash -or
+              $ident.portableSha256 -cne $exeHash -or
+              $sourceSha -cne $env:SOURCE_SHA -or
+              $engineSha -cne $env:EXPERIMENTAL_ENGINE -or
+              $lock.commit -cne $env:BASELINE_ENGINE -or
+              $engineSha -ceq $env:BASELINE_ENGINE) {
+            throw 'Exact SHA provenance, binary hash, or unchanged production lock failed.'
+          }
+          $exePath = (Resolve-Path $source).Path
+          $proc = Start-Process -FilePath $exePath -ArgumentList @('--portable-smoke-test') -PassThru
+          if (-not $proc.WaitForExit(90000)) {
+            $proc.Kill()
+            throw 'Portable EXE smoke timeout.'
+          }
+          if ($proc.ExitCode -ne 0) { throw "Portable EXE smoke failed: $($proc.ExitCode)" }
+          $out = '.\ARSAS\TestResults\sg7-bcu-fat-trial'
+          New-Item -ItemType Directory -Path $out -Force | Out-Null
+          $name = 'ARSAS-SG7_BCU-ED2-FAT-TRIAL-' + $engineSha.Substring(0,8) + '-win-x64.exe'
+          $exe = Join-Path $out $name
+          Copy-Item $source $exe -Force
+          if ((Get-FileHash $exe -Algorithm SHA256).Hash.ToLowerInvariant() -cne $exeHash) {
+            throw 'Staged trial EXE differs from smoke-tested EXE.'
+          }
+          Copy-Item $identityPath (Join-Path $out 'portable-build-identity.json') -Force
+          Copy-Item (Join-Path $env:RUNNER_TEMP 'sg7-ardirec-ctest.xml') (Join-Path $out 'native-ardirec-ctest.xml') -Force
+          [ordered]@{
+            schemaVersion = 1
+            kind = 'arsas-nonrelease-supervised-iec61850-ed2-fat-trial'
+            sourceSha = $sourceSha
+            engineTrialSha = $engineSha
+            sourceApprovedEngineSha = $lock.commit
+            ardIrecSourceSha = $ident.ardIrecLockCommit
+            nativeBridgeSha256 = $bridgeHash
+            exeFileName = $name
+            exeSha256 = $exeHash
+            exeSizeBytes = (Get-Item $exe).Length
+            smokeTestExitCode = $proc.ExitCode
+            regressionTrx = 'ci-p1-shadow.trx'
+            externalRelayTestPerformed = $false
+            productionReleaseAuthority = $false
+          } | ConvertTo-Json -Depth 6 | Set-Content (Join-Path $out 'FAT-TRIAL-SHA256.json') -Encoding utf8
+          @'
+          ARSAS SG7_BCU IEC 61850 EDITION 2 | SUPERVISED FAT TRIAL
+          -------------------------------------------------------
+          THIS IS NOT AN OFFICIAL RELEASE; NO PHYSICAL RELAY TEST HAS BEEN PERFORMED.
+          Extract the EXE. Check its SHA256 against FAT-TRIAL-SHA256.json
+          using PowerShell: Get-FileHash -Algorithm SHA256 .\ARSAS-SG7_BCU-*.exe
+          Single-file self-contained Windows x64, pinned native bridge included.
+          Stage 1: Connect / discover / monitor / reporting READ ONLY.
+          Stage 2: Inspect verified Command Dock candidates, including renamed
+          GE Bkr0XCBR2.Pos, disconnector and TapChg, and confirm StatusOnly blocked.
+          Stage 3: Only under test engineer/operator approval, physically isolated
+          safe bench and documented switching permission, test SBOw / Operate /
+          CommandTermination; preserve interlock, negative response, LastApplError,
+          actual status q/t, reporting BufferOverflow/Invalid evidence.
+          No automatic Operate retry when acceptance/feedback is uncertain.
+          An automation PASS does not prove physical command success.
+          The repository production engine lock remains the qualified #184.
+          '@ | Set-Content (Join-Path $out 'READ-ME-FIRST.txt') -Encoding utf8
+          Write-Host "EXE SMOKE SUCCESS: $name SHA256 $exeHash"
+          Write-Host 'SUPERVISED FAT candidate only. No release or physical command authority.'
 
       - name: Write non-promotion build authority manifest
         if: always()
         shell: pwsh
         env:
-          ENGINE_SHA: ${{ steps.engine.outputs.commit }}
+          ENGINE_SHA: ${{ inputs.fast_dev && inputs.engine_trial_sha != '' && inputs.engine_trial_sha || steps.engine.outputs.commit }}
+          BASELINE_ENGINE_SHA: ${{ steps.engine.outputs.commit }}
+          ENGINE_TRIAL_SHA: ${{ inputs.engine_trial_sha }}
           ENGINE_REPOSITORY: ${{ steps.engine.outputs.repository }}
           HISTORICAL_ENGINE_SHA: ${{ steps.engine.outputs.merged-main-commit }}
           PHYSICAL_TESTED_ENGINE_SHA: ${{ steps.engine.outputs.physical-tested-commit }}
@@ -118,7 +348,14 @@ jobs:
             Select-Object -ExpandProperty Name)
           $manifest = [ordered]@{
             schemaVersion = 1
-            kind = 'ci-p1-nonpromotion-shadow'
+            kind = if ('${{ inputs.fast_dev }}' -eq 'true') { 'ci-p1-fast-dev-nonfat' } else { 'ci-p1-nonpromotion-shadow' }
+            fastDev = '${{ inputs.fast_dev }}'
+            focus = '${{ inputs.focus }}'
+            engineTrialSha = $env:ENGINE_TRIAL_SHA
+            approvedPinnedEngineSha = $env:BASELINE_ENGINE_SHA
+            engineIsExperimental = -not [string]::IsNullOrWhiteSpace($env:ENGINE_TRIAL_SHA)
+            validatorLockKind = if ($env:ENGINE_TRIAL_SHA) { 'ephemeral-nonpromotion' } else { 'source-approved-lock' }
+            fullRegressionQualified = ('${{ inputs.fast_dev }}' -ne 'true' -and [string]::IsNullOrWhiteSpace($env:ENGINE_TRIAL_SHA))
             exactArsasSha = $sourceSha
             exactEngineSha = $engineActual
             expectedEngineSha = $env:ENGINE_SHA
@@ -136,13 +373,39 @@ jobs:
             throw 'CI-P1 shadow SHA/TRX proof is incomplete; fail closed.'
           }
 
-      - name: Upload inspectable shadow TRX and SHA manifest
+      # Single upload keeps CI-sprawl budget unchanged. FAST = raw executable;
+      # ordinary shadow = TRX + manifest diagnostics, unchanged gates.
+      - name: Choose FAST EXE or diagnostic artifact
+        id: artifact-mode
+        if: always()
+        shell: pwsh
+        env:
+          FAST_DEV: ${{ inputs.fast_dev }}
+          TRIAL_SHA: ${{ inputs.engine_trial_sha }}
+          FOCUS: ${{ inputs.focus }}
+        run: |
+          $trial = ($env:FAST_DEV -eq 'true' -and
+                    $env:TRIAL_SHA -match '^[0-9a-f]{40}$' -and
+                    $env:FOCUS -eq 'command-read')
+          if ($trial) {
+            "artifact_name=ARSAS-SG7-BCU-FAT-TRIAL-$env:GITHUB_RUN_ID.exe" | Out-File $env:GITHUB_OUTPUT -Append -Encoding utf8
+            "artifact_path=ARSAS/TestResults/sg7-bcu-fat-trial/ARSAS-SG7_BCU-ED2-FAT-TRIAL-*-win-x64.exe" | Out-File $env:GITHUB_OUTPUT -Append -Encoding utf8
+            "artifact_archive=false" | Out-File $env:GITHUB_OUTPUT -Append -Encoding utf8
+          } else {
+            "artifact_name=ci-p1-shadow-$env:GITHUB_RUN_ID-$env:GITHUB_RUN_ATTEMPT" | Out-File $env:GITHUB_OUTPUT -Append -Encoding utf8
+            "artifact_path<<END_OF_PATHS" | Out-File $env:GITHUB_OUTPUT -Append -Encoding utf8
+            "ARSAS/TestResults/*.trx" | Out-File $env:GITHUB_OUTPUT -Append -Encoding utf8
+            "$env:RUNNER_TEMP/ci-p1-shadow-manifest.json" | Out-File $env:GITHUB_OUTPUT -Append -Encoding utf8
+            "END_OF_PATHS" | Out-File $env:GITHUB_OUTPUT -Append -Encoding utf8
+            "artifact_archive=true" | Out-File $env:GITHUB_OUTPUT -Append -Encoding utf8
+          }
+
+      - name: Upload directly downloadable FAST EXE or normal CI proof
         if: always()
         uses: actions/upload-artifact@v7
         with:
-          name: ci-p1-shadow-${{ github.run_id }}-${{ github.run_attempt }}
-          path: |
-            ARSAS/TestResults/*.trx
-            ${{ runner.temp }}/ci-p1-shadow-manifest.json
-          if-no-files-found: warn
-          retention-days: 7
+          name: ${{ steps.artifact-mode.outputs.artifact_name }}
+          path: ${{ steps.artifact-mode.outputs.artifact_path }}
+          archive: ${{ steps.artifact-mode.outputs.artifact_archive }}
+          if-no-files-found: error
+          retention-days: 14
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4f781495c..0dd5d1174 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -4,6 +4,10 @@ on:
   push:
     branches: [ main ]
   pull_request:
+    # A trial-manifest-only PR already runs FAST CI-P1; don't duplicate a
+    # full Windows application build, native bridge build or package upload.
+    paths-ignore:
+      - "engines/ARIEC61850.trial.json"
   workflow_dispatch:
 
 concurrency:
@@ -676,11 +680,13 @@ jobs:
           if-no-files-found: error
           retention-days: 30
 
-      - name: Upload portable single EXE
+      # GitHub Actions upload-artifact v7: a SINGLE file plus archive:false
+      # makes the artifact itself download as a real .exe in the browser.
+      # Keep the canonical sealed Windows package (previous upload) unchanged:
+      # it carries portable-build-identity.json, manifests and release evidence.
+      - name: Upload directly downloadable portable EXE (no ZIP)
         uses: actions/upload-artifact@v7
         with:
-          name: ARSAS-win-x64-portable-single-exe
-          path: |
-            ArIED61850Tester\dist\ARSAS-*-win-x64-portable.exe
-            ArIED61850Tester\dist\ARSAS-*-win-x64-portable-build-identity.json
+          path: ArIED61850Tester\dist\ARSAS-*-win-x64-portable.exe
+          archive: false
           if-no-files-found: error
diff --git a/.github/workflows/ci-p1-shadow.yml b/.github/workflows/ci-p1-shadow.yml
index cb522daad..65dac337b 100644
--- a/.github/workflows/ci-p1-shadow.yml
+++ b/.github/workflows/ci-p1-shadow.yml
@@ -22,6 +22,20 @@ on:
       - "*.xaml"
       - "MainWindow*.cs"
   workflow_dispatch:
+    inputs:
+      fast_dev:
+        description: 'FAST DEV compile + scoped regression; never release qualified'
+        type: boolean
+        default: false
+      focus:
+        description: 'Focused regression group'
+        type: choice
+        options: [quality-browser, smv, command-read, all]
+        default: quality-browser
+      engine_trial_sha:
+        description: 'Optional exact 40-char experimental ARIEC SHA; FAST DEV only, never FAT'
+        type: string
+        default: ''
 
 permissions:
   contents: read
@@ -43,6 +57,7 @@ jobs:
       packaging: ${{ steps.changed.outputs.packaging }}
       ci: ${{ steps.changed.outputs.ci }}
       risk: ${{ steps.changed.outputs.risk }}
+      engine_trial_sha: ${{ steps.trial.outputs.sha }}
     steps:
       - name: Checkout PR merge source
         uses: actions/checkout@v7
@@ -69,6 +84,30 @@ jobs:
               --summary "$GITHUB_STEP_SUMMARY"
           fi
 
+      - id: trial
+        name: Resolve explicit nonrelease engine trial (label-gated)
+        if: ${{ github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ci-p1-shadow') }}
+        shell: bash
+        run: |
+          if [[ -f engines/ARIEC61850.trial.json ]]; then
+            python3 - <<'PY' >> "$GITHUB_OUTPUT"
+          import json
+          import re
+
+          with open("engines/ARIEC61850.lock.json", encoding="utf-8") as handle:
+              production = json.load(handle)
+          with open("engines/ARIEC61850.trial.json", encoding="utf-8") as handle:
+              trial = json.load(handle)
+          sha = str(trial.get("commit", ""))
+          if (not re.fullmatch(r"[0-9a-f]{40}", sha)
+              or trial.get("runMode") != "fast-dev-nonpromotion"
+              or trial.get("scope") != "command-read"
+              or sha == production.get("commit")):
+              raise SystemExit("Invalid or non-isolated engine trial manifest")
+          print("sha=" + sha)
+          PY
+          fi
+
   windows-shadow:
     name: Compare reusable build/test with legacy authority
     needs: classify
@@ -82,6 +121,13 @@ jobs:
       }}
     uses: ./.github/workflows/_ci-p1-windows-build-test.yml
     with:
-      source_sha: ${{ github.sha }}
+      # PR validation must package the immutable branch HEAD, not GitHub's
+      # synthetic refs/pull/<n>/merge SHA. The synthetic merge remains covered
+      # independently by canonical PR CI; FAST DEV evidence must match the
+      # exact operator-downloaded source revision.
+      source_sha: ${{ github.event.pull_request.head.sha || github.sha }}
       shadow_mode: true
+      fast_dev: ${{ (github.event_name == 'workflow_dispatch' && inputs.fast_dev == true) || (github.event_name == 'pull_request' && needs.classify.outputs.engine_trial_sha != '') }}
+      focus: ${{ github.event_name == 'workflow_dispatch' && inputs.fast_dev == true && inputs.focus || needs.classify.outputs.engine_trial_sha != '' && 'command-read' || 'all' }}
+      engine_trial_sha: ${{ github.event_name == 'workflow_dispatch' && inputs.fast_dev == true && inputs.engine_trial_sha || needs.classify.outputs.engine_trial_sha || '' }}
     secrets: {}
diff --git a/.github/workflows/fat-direct-exe.yml b/.github/workflows/fat-direct-exe.yml
deleted file mode 100644
index 6b31236b3..000000000
--- a/.github/workflows/fat-direct-exe.yml
+++ /dev/null
@@ -1,165 +0,0 @@
-name: Publish direct EXE FAT preview (manual only)
-
-# CI artifact downloads are always ZIP. PRs run ONLY read-only tests;
-# publishing a public, non-production GitHub prerelease is manual-only.
-on:
-  pull_request:
-    paths:
-      - '.github/workflows/fat-direct-exe.yml'
-      - 'scripts/verify-fat-direct-exe.py'
-      - 'scripts/test-fat-direct-exe.py'
-  workflow_dispatch:
-    inputs:
-      tested_sha:
-        description: CI-qualified exact 40-character source SHA
-        type: string
-        required: true
-      build_run_id:
-        description: Successful exact-SHA Build ARSAS workflow run ID
-        type: string
-        required: true
-      installer_run_id:
-        description: Optional successful exact-SHA installer run ID; 0 skips
-        type: string
-        required: true
-        default: '0'
-      public_preview_ack:
-        description: Type PUBLISH PUBLIC NONPRODUCTION FAT EXE to authorize public FAT-only assets
-        type: string
-        required: true
-
-permissions:
-  contents: read
-  actions: read
-
-concurrency:
-  group: fat-direct-exe-preview
-  cancel-in-progress: false
-
-jobs:
-  verifier-tests:
-    name: Reject stale, failed and disguised-fat-build artifacts
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout for safe offline verifier tests
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - name: Run positive and negative direct EXE publication guard tests
-        run: python3 scripts/test-fat-direct-exe.py
-
-  preview:
-    name: Verify tested PE bytes before manual immutable FAT prerelease
-    permissions:
-      contents: write
-      actions: read
-    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    environment: fat-preview-publication
-    env:
-      GH_TOKEN: ${{ github.token }}
-      TESTED_SHA: ${{ inputs.tested_sha }}
-      BUILD_RUN_ID: ${{ inputs.build_run_id }}
-      INSTALLER_RUN_ID: ${{ inputs.installer_run_id }}
-      PUBLIC_ACK: ${{ inputs.public_preview_ack }}
-    steps:
-      - name: Checkout approved workflow and verifier, not untrusted candidate scripts
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-          fetch-depth: 1
-
-      - name: Verify explicit consent and exact HEAD full CI
-        shell: bash
-        run: |
-          set -euo pipefail
-          python3 scripts/test-fat-direct-exe.py
-          [[ "$PUBLIC_ACK" == "PUBLISH PUBLIC NONPRODUCTION FAT EXE" ]] || {
-            echo "An explicit public preview acknowledgement is required." >&2; exit 1;
-          }
-          [[ "$TESTED_SHA" =~ ^[0-9a-f]{40}$ ]] || exit 1
-          [[ "$BUILD_RUN_ID" =~ ^[0-9]+$ ]] || exit 1
-          [[ "$INSTALLER_RUN_ID" =~ ^[0-9]+$ ]] || exit 1
-          gh api "repos/$GITHUB_REPOSITORY/actions/runs?head_sha=$TESTED_SHA&per_page=100" > ci.json
-          jq --arg sha "$TESTED_SHA" -e '
-            [.workflow_runs[] | select(.head_sha == $sha) |
-              select(.event == "pull_request" or .event == "push")] as $runs |
-            ($runs | length >= 10) and
-            ([$runs[] | select(.status != "completed" or .conclusion != "success")] | length == 0)
-          ' ci.json || { echo "All exact-SHA CI workflows must be successful." >&2; exit 1; }
-          TAG="fat-${TESTED_SHA:0:12}"
-          echo "PREVIEW_TAG=$TAG" >> "$GITHUB_ENV"
-          if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
-            echo "Immutable preview already exists; never overwrite an asset." >&2; exit 1
-          fi
-
-      - name: Verify downloaded Windows portable is the actual CI-tested EXE
-        shell: bash
-        run: |
-          set -euo pipefail
-          mkdir -p staged/portable published
-          gh api "repos/$GITHUB_REPOSITORY/actions/runs/$BUILD_RUN_ID" > build-run.json
-          gh run download "$BUILD_RUN_ID" --repo "$GITHUB_REPOSITORY" \
-            --name ARSAS-win-x64-portable-single-exe --dir staged/portable
-          mapfile -t files < <(find staged/portable -type f -name '*.exe')
-          [[ "${#files[@]}" -eq 1 ]] || { echo "Expected exactly one EXE." >&2; exit 1; }
-          python3 scripts/verify-fat-direct-exe.py \
-            --run-json build-run.json --sha "$TESTED_SHA" --workflow "Build ARSAS" \
-            --exe "${files[0]}" --output published/portable-provenance.json
-          cp "${files[0]}" "published/ARSAS-FAT-${TESTED_SHA:0:12}-win-x64-portable.exe"
-
-      - name: Optionally verify separately successful exact-SHA installer
-        shell: bash
-        run: |
-          set -euo pipefail
-          if [[ "$INSTALLER_RUN_ID" == 0 ]]; then exit 0; fi
-          mkdir -p staged/installer
-          gh api "repos/$GITHUB_REPOSITORY/actions/runs/$INSTALLER_RUN_ID" > installer-run.json
-          gh run download "$INSTALLER_RUN_ID" --repo "$GITHUB_REPOSITORY" \
-            --pattern 'ARSAS-*-win-x64-installer' --dir staged/installer
-          mapfile -t files < <(find staged/installer -type f -name '*-setup.exe')
-          [[ "${#files[@]}" -eq 1 ]] || { echo "Expected exactly one installer." >&2; exit 1; }
-          python3 scripts/verify-fat-direct-exe.py \
-            --run-json installer-run.json --sha "$TESTED_SHA" \
-            --workflow "Validate ARSAS Windows installer" \
-            --exe "${files[0]}" --output published/installer-provenance.json
-          cp "${files[0]}" "published/ARSAS-FAT-${TESTED_SHA:0:12}-win-x64-setup.exe"
-
-      - name: Publish only approved non-production direct EXE preview assets
-        shell: bash
-        run: |
-          set -euo pipefail
-          (cd published && sha256sum ./*.exe > SHA256SUMS.txt && sha256sum -c SHA256SUMS.txt)
-          cat > published/NOT-PRODUCTION.txt <<EOF
-          ARSAS manual public prerelease FAT preview.
-          Exact tested source: $TESTED_SHA
-          Windows Build run: $BUILD_RUN_ID
-          Installer run: $INSTALLER_RUN_ID (0 means not included).
-          No physical FAT acceptance. No production release.
-          EOF
-          cat > release-notes.md <<EOF
-          ARSAS engineering FAT preview only; NOT a production release.
-          Source SHA: $TESTED_SHA
-          Build run ID: $BUILD_RUN_ID
-          Installer run ID: $INSTALLER_RUN_ID
-
-          Direct executable files are release assets, not CI ZIP artifacts.
-          Verify SHA256SUMS.txt. No physical IED acceptance is implied.
-          Stable releases, mainline acceptance and production metadata remain unchanged.
-          EOF
-          gh release create "$PREVIEW_TAG" published/* --repo "$GITHUB_REPOSITORY" \
-            --target "$TESTED_SHA" --title "ARSAS FAT Preview ${TESTED_SHA:0:12}" \
-            --notes-file release-notes.md --prerelease
-          {
-            echo "## Direct .exe FAT preview (NOT production)"
-            echo "Source: $TESTED_SHA"
-            echo "Portable: https://github.com/$GITHUB_REPOSITORY/releases/download/$PREVIEW_TAG/ARSAS-FAT-${TESTED_SHA:0:12}-win-x64-portable.exe"
-            if [[ "$INSTALLER_RUN_ID" != 0 ]]; then
-              echo "Installer: https://github.com/$GITHUB_REPOSITORY/releases/download/$PREVIEW_TAG/ARSAS-FAT-${TESTED_SHA:0:12}-win-x64-setup.exe"
-            fi
-          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/installer-windows.yml b/.github/workflows/installer-windows.yml
index c0701d288..24d24c6a4 100644
--- a/.github/workflows/installer-windows.yml
+++ b/.github/workflows/installer-windows.yml
@@ -37,6 +37,7 @@ on:
       - "engines/ARIEC61850.lock.json"
       - "engines/ARDIREC.lock.json"
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     paths:
       - "installer/**"
       - "scripts/build-windows-installer.ps1"
@@ -83,7 +84,7 @@ concurrency:
 jobs:
   package-ready:
     name: Wait for exact canonical package metadata
-    if: github.event_name != 'workflow_dispatch'
+    if: github.event_name != 'workflow_dispatch' && (github.event_name != 'pull_request' || !github.event.pull_request.draft)
     runs-on: ubuntu-latest
     timeout-minutes: 25
     outputs:
@@ -185,6 +186,7 @@ jobs:
     if: >-
       ${{
         always() &&
+        (github.event_name != 'pull_request' || !github.event.pull_request.draft) &&
         (github.event_name == 'workflow_dispatch' ||
          needs.package-ready.result == 'success')
       }}
@@ -484,6 +486,53 @@ jobs:
           ) -Wait -PassThru
           if ($uninstall.ExitCode -ne 0) { throw "Uninstaller exited with code $($uninstall.ExitCode)." }
 
+      # Preserve the retired SMV preview workflow's protected-folder upgrade
+      # qualification inside the canonical installer workflow (no extra CI runner).
+      - name: Verify protected Program Files in-place DLL repair and uninstall
+        shell: powershell
+        run: |
+          $exe = ".\\ArIED61850Tester\\dist\\ARSAS-$env:APP_VERSION-win-x64-setup.exe"
+          if (-not (Test-Path $exe -PathType Leaf)) { throw 'Canonical installer missing.' }
+          $target = Join-Path $env:ProgramFiles 'ARSAS-FAT-ProtectedFolder-CI'
+          $dirArgument = '/DIR="' + $target + '"'
+          $params = @('/VERYSILENT','/SUPPRESSMSGBOXES','/NORESTART','/SP-','/CLOSEAPPLICATIONS',$dirArgument)
+          $installed = $false
+          try {
+            $install = Start-Process -FilePath $exe -ArgumentList $params -Wait -PassThru
+            if ($install.ExitCode -ne 0) { throw "Protected-folder install failed: $($install.ExitCode)." }
+            $installed = $true
+            if (-not (Test-Path (Join-Path $target 'ARSAS.exe') -PathType Leaf)) {
+              throw "Silent install did not use requested Program Files directory: $target"
+            }
+            $legacyAccessibility = Join-Path $target 'Accessibility.dll'
+            $publishedAccessibility = Join-Path $env:INSTALLER_INPUT_DIR 'Accessibility.dll'
+            if (-not (Test-Path $legacyAccessibility) -and -not (Test-Path $publishedAccessibility)) {
+              [System.IO.File]::WriteAllBytes($legacyAccessibility, [byte[]](65,82,83,65,83,83,45,79,76,68))
+              Write-Host 'Seeded a legacy Accessibility.dll as a prior-install fixture.'
+            }
+            $repairName = if (Test-Path $publishedAccessibility -PathType Leaf) { 'Accessibility.dll' } else { 'AR.Iec61850.Transports.Npcap.dll' }
+            $repairPath = Join-Path $target $repairName
+            if (-not (Test-Path $repairPath -PathType Leaf)) { throw "Shipped upgrade-test DLL is missing: $repairName" }
+            $expectedHash = (Get-FileHash $repairPath -Algorithm SHA256).Hash
+            [System.IO.File]::WriteAllBytes($repairPath, [byte[]](65,82,83,65,83,45,79,76,68,45,68,76,76))
+            $upgrade = Start-Process -FilePath $exe -ArgumentList $params -Wait -PassThru
+            if ($upgrade.ExitCode -ne 0) { throw "In-place Program Files upgrade failed: $($upgrade.ExitCode)." }
+            $actualHash = (Get-FileHash $repairPath -Algorithm SHA256).Hash
+            if ($actualHash -ne $expectedHash) { throw "Upgrade did not restore shipped DLL: $repairName" }
+            Write-Host "SMART_INNO_UPGRADE_PASS: Protected Program Files upgrade restored exact $repairName bytes."
+            foreach ($file in @('ARSAS.exe','AR.Iec61850.Transports.Npcap.dll','SharpPcap.dll','PacketDotNet.dll','Tools\\ArdIrec\\ardirec_bridge.dll')) {
+              if (-not (Test-Path (Join-Path $target $file) -PathType Leaf)) { throw "Installed runtime missing: $file" }
+            }
+          }
+          finally {
+            $uninstaller = Join-Path $target 'unins000.exe'
+            if ($installed -or (Test-Path $uninstaller -PathType Leaf)) {
+              if (-not (Test-Path $uninstaller -PathType Leaf)) { throw 'Uninstaller missing.' }
+              $uninstall = Start-Process -FilePath $uninstaller -ArgumentList @('/VERYSILENT','/SUPPRESSMSGBOXES','/NORESTART') -Wait -PassThru
+              if ($uninstall.ExitCode -ne 0) { throw "Uninstall failed: $($uninstall.ExitCode)." }
+            }
+          }
+
       - name: Create release checksums
         shell: powershell
         run: |
diff --git a/.github/workflows/interoperability-reference-guard.yml b/.github/workflows/interoperability-reference-guard.yml
index 0f8277e81..a7a4cfd31 100644
--- a/.github/workflows/interoperability-reference-guard.yml
+++ b/.github/workflows/interoperability-reference-guard.yml
@@ -137,11 +137,34 @@ jobs:
                            [bool]$serverAt.physicalQualificationRequired -and
                            [bool]$serverAt.noAutomaticMmsFailover -and
                            $lock.ref -eq 'main'
+          # An exact typed-control trial on the existing staging ancestry:
+          # do not promote it, and never reinterpret it as physical R7/R10.
+          $typedControl = $lock.globalTypedControlStageTrial
+          $typedControlTrialValid = (
+            $null -ne $typedControl -and
+            $lock.commit -ceq 'f75e323e9f8443aa20e0a3818a1d5d77255b2c0f' -and
+            $lock.ref -ceq 'main' -and
+            [int]$lock.sourcePullRequest -eq 192 -and
+            $typedControl.baseEngineCommit -ceq '9c7cb40364023a7b217e5ec31ab3105ba90142eb' -and
+            $typedControl.exactCommit -ceq $lock.commit -and
+            [int]$typedControl.enginePullRequest -eq 192 -and
+            [long]$typedControl.engineCiRun -eq 39909260816L -and
+            $typedControl.status -ceq 'engine-ci-success-consumer-trial-not-physical' -and
+            [bool]$typedControl.typedStatusReadRequired -and
+            [bool]$typedControl.sameDataObjectFeedbackRequired -and
+            [bool]$typedControl.ctlModelAndOperShapeRequired -and
+            [bool]$typedControl.sbowEnhancedSafetyRequired -and
+            [bool]$typedControl.noAutomaticOperate -and
+            [bool]$typedControl.physicalQualificationRequired -and
+            [bool]$typedControl.mainlinePromotionForbidden -and
+            $lock.p0CStageObservationTrial.exactCommit -ceq $typedControl.baseEngineCommit -and
+            $env:GITHUB_BASE_REF -ne 'main' -and $env:GITHUB_REF_NAME -ne 'main'
+          )
           if ($null -ne $trial) {
             if ($trial.status -ne 'code-verified-not-physical' -or
                 [int]$trial.issue -ne 144 -or
                 [int]$trial.integrationPullRequest -ne 148 -or
-                -not ($originalTrial -or $serverAtTrial -or $datasetTrial -or $p10Trial -or $coreRoutingTrialValid -or $m217KTrialValid -or $p0AIdentityTrialValid -or $p0BRcbTrialValid -or $p0CTypedReadTrialValid) -or
+                -not ($originalTrial -or $serverAtTrial -or $datasetTrial -or $p10Trial -or $coreRoutingTrialValid -or $m217KTrialValid -or $p0AIdentityTrialValid -or $p0BRcbTrialValid -or $p0CTypedReadTrialValid -or $typedControlTrialValid) -or
                 -not [bool]$trial.fullDiscoveryFallbackForbidden -or
                 -not [bool]$trial.vendorBranchingForbidden -or
                 -not [bool]$trial.physicalPromotionRequired) {
diff --git a/.github/workflows/scl-interoperability-r7.yml b/.github/workflows/scl-interoperability-r7.yml
index 11ad9ab5a..bbab235b5 100644
--- a/.github/workflows/scl-interoperability-r7.yml
+++ b/.github/workflows/scl-interoperability-r7.yml
@@ -173,6 +173,29 @@ jobs:
           elseif ($coreRoutingTrialValid) {
             Write-Host 'P10.9F routing core accepted for CodeVerified staging CI ONLY; R7/R10 physical authority unchanged.'
           }
+          elseif ($lock.commit -ceq 'f75e323e9f8443aa20e0a3818a1d5d77255b2c0f') {
+            $typed = $lock.globalTypedControlStageTrial
+            if ($null -eq $typed -or
+                $lock.ref -cne 'main' -or
+                [int]$lock.sourcePullRequest -ne 192 -or
+                $typed.exactCommit -cne $lock.commit -or
+                $typed.baseEngineCommit -cne '9c7cb40364023a7b217e5ec31ab3105ba90142eb' -or
+                $lock.p0CStageObservationTrial.exactCommit -cne $typed.baseEngineCommit -or
+                [int]$typed.enginePullRequest -ne 192 -or
+                [long]$typed.engineCiRun -ne 39909260816L -or
+                $typed.status -cne 'engine-ci-success-consumer-trial-not-physical' -or
+                -not [bool]$typed.typedStatusReadRequired -or
+                -not [bool]$typed.sameDataObjectFeedbackRequired -or
+                -not [bool]$typed.ctlModelAndOperShapeRequired -or
+                -not [bool]$typed.sbowEnhancedSafetyRequired -or
+                -not [bool]$typed.noAutomaticOperate -or
+                -not [bool]$typed.physicalQualificationRequired -or
+                -not [bool]$typed.mainlinePromotionForbidden -or
+                $env:GITHUB_BASE_REF -eq 'main' -or $env:GITHUB_REF_NAME -eq 'main') {
+              throw 'Unqualified typed-control staging pin cannot replace physical R7/R10 authority.'
+            }
+            Write-Host 'Exact typed-control staging trial accepted for draft CI only; R7/R10 physical acceptance unchanged.'
+          }
           elseif ($lock.commit -eq $convergence.activeStack.engineModelAndScl.head) {
             if ([int]$lock.sourcePullRequest -notin @(134, 135) -or
                 $lock.purpose -notmatch 'R7 physical SCL repair pin') {
diff --git a/.github/workflows/smart-discovery-capture-build.yml b/.github/workflows/smart-discovery-capture-build.yml
index 95fe9fae7..b3aad602a 100644
--- a/.github/workflows/smart-discovery-capture-build.yml
+++ b/.github/workflows/smart-discovery-capture-build.yml
@@ -2,36 +2,27 @@ name: Smart Discovery Field Capture Build
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     paths:
-      - "*.cs"
-      - "**/*.cs"
-      - "*.csproj"
-      - "**/*.csproj"
-      - "*.sln"
-      - "**/*.sln"
-      - "*.props"
-      - "**/*.props"
-      - "*.targets"
-      - "**/*.targets"
-      - "global.json"
-      - "*.xaml"
-      - "**/*.xaml"
-      - "app.manifest"
+      # Fast PR routing: only Smart Discovery authority/dependencies trigger this gate.
+      - "Services/NativeIec61850Client*.cs"
+      - "Services/*SmartDiscovery*.cs"
+      - "Services/Iec61850MonitorRuntime.cs"
+      - "Services/Iec61850DeviceIdentityResolver.cs"
+      - "Models/MonitorModels.cs"
+      - "ArIED61850Tester.csproj"
+      - "Directory.Build.*"
       - "VERSION"
-      - ".release/**"
-      - ".github/workflows/**"
-      - "Assets/**"
-      - "Resources/**"
-      - "installer/**"
-      - "engine-patches/**"
-      - "landing/release-notes*.json"
-      - "landing/latest.json"
       - "engines/**"
-      - "scripts/**"
-      - "tests/**"
-      - "evidence/**"
+      - "engine-patches/**"
+      - "scripts/*smart-discovery*"
+      - "scripts/enable-smart-discovery-capture.ps1"
+      - "tests/ARSAS.Tests/*SmartDiscovery*.cs"
+      - "evidence/smart-discovery-*.json"
+      - "evidence/interoperability-reference-target.json"
       - "docs/INTEROPERABILITY_REFERENCE_CONTRACT.md"
-      - ".github/workflows/smart-discovery-*.yml"
+      - ".github/actions/resolve-ariec-engine/**"
+      - ".github/workflows/smart-discovery-capture-build.yml"
   workflow_dispatch:
 
 permissions:
@@ -57,6 +48,7 @@ jobs:
     if: >-
       ${{
         always() &&
+        (github.event_name != 'pull_request' || !github.event.pull_request.draft) &&
         (github.event_name != 'workflow_dispatch' ||
          needs.manual-regression.result == 'success')
       }}
diff --git a/.github/workflows/smart-discovery-golden-budget-lock.yml b/.github/workflows/smart-discovery-golden-budget-lock.yml
index 083a05b26..e639ef7cf 100644
--- a/.github/workflows/smart-discovery-golden-budget-lock.yml
+++ b/.github/workflows/smart-discovery-golden-budget-lock.yml
@@ -2,36 +2,15 @@ name: Smart Discovery Golden Budget Lock
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     paths:
-      - "*.cs"
-      - "**/*.cs"
-      - "*.csproj"
-      - "**/*.csproj"
-      - "*.sln"
-      - "**/*.sln"
-      - "*.props"
-      - "**/*.props"
-      - "*.targets"
-      - "**/*.targets"
-      - "global.json"
-      - "*.xaml"
-      - "**/*.xaml"
-      - "app.manifest"
-      - "VERSION"
-      - ".release/**"
-      - ".github/workflows/**"
-      - "Assets/**"
-      - "Resources/**"
-      - "installer/**"
-      - "engine-patches/**"
-      - "landing/release-notes*.json"
-      - "landing/latest.json"
-      - "engines/**"
-      - "scripts/**"
-      - "tests/**"
-      - "evidence/**"
-      - "docs/INTEROPERABILITY_REFERENCE_CONTRACT.md"
-      - ".github/workflows/smart-discovery-*.yml"
+      # Fast PR routing: only Smart Discovery authority/dependencies trigger this gate.
+      - "scripts/new-smart-discovery-golden-lock.ps1"
+      - "scripts/verify-smart-discovery-golden-lock.ps1"
+      - "evidence/smart-discovery-golden-target.json"
+      - "evidence/smart-discovery-golden-lock.json"
+      - "tests/ARSAS.Tests/*SmartDiscovery*.cs"
+      - ".github/workflows/smart-discovery-golden-budget-lock.yml"
   workflow_dispatch:
 
 concurrency:
@@ -40,6 +19,7 @@ concurrency:
 
 jobs:
   verify-golden-lock:
+    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Verify P0-5e evidence-derived hard budget
     runs-on: windows-latest
     steps:
diff --git a/.github/workflows/smart-discovery-golden-provenance.yml b/.github/workflows/smart-discovery-golden-provenance.yml
index 0b5d62cd0..4fd2345b0 100644
--- a/.github/workflows/smart-discovery-golden-provenance.yml
+++ b/.github/workflows/smart-discovery-golden-provenance.yml
@@ -2,36 +2,15 @@ name: Smart Discovery Golden Provenance
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     paths:
-      - "*.cs"
-      - "**/*.cs"
-      - "*.csproj"
-      - "**/*.csproj"
-      - "*.sln"
-      - "**/*.sln"
-      - "*.props"
-      - "**/*.props"
-      - "*.targets"
-      - "**/*.targets"
-      - "global.json"
-      - "*.xaml"
-      - "**/*.xaml"
-      - "app.manifest"
-      - "VERSION"
-      - ".release/**"
-      - ".github/workflows/**"
-      - "Assets/**"
-      - "Resources/**"
-      - "installer/**"
-      - "engine-patches/**"
-      - "landing/release-notes*.json"
-      - "landing/latest.json"
-      - "engines/**"
-      - "scripts/**"
-      - "tests/**"
-      - "evidence/**"
-      - "docs/INTEROPERABILITY_REFERENCE_CONTRACT.md"
-      - ".github/workflows/smart-discovery-*.yml"
+      # Fast PR routing: only Smart Discovery authority/dependencies trigger this gate.
+      - "scripts/new-smart-discovery-golden-lock.ps1"
+      - "scripts/verify-smart-discovery-golden-lock.ps1"
+      - "evidence/smart-discovery-golden-target.json"
+      - "evidence/smart-discovery-golden-lock.json"
+      - "tests/ARSAS.Tests/*SmartDiscovery*.cs"
+      - ".github/workflows/smart-discovery-golden-provenance.yml"
   workflow_dispatch:
 
 concurrency:
@@ -40,6 +19,7 @@ concurrency:
 
 jobs:
   verify-provenance:
+    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Verify P0-5e capture build and target provenance
     runs-on: windows-latest
     steps:
diff --git a/.github/workflows/smart-discovery-mainline-readiness.yml b/.github/workflows/smart-discovery-mainline-readiness.yml
index 46efab1b3..ae66488c0 100644
--- a/.github/workflows/smart-discovery-mainline-readiness.yml
+++ b/.github/workflows/smart-discovery-mainline-readiness.yml
@@ -2,36 +2,23 @@ name: Smart Discovery Mainline Readiness
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     paths:
-      - "*.cs"
-      - "**/*.cs"
-      - "*.csproj"
-      - "**/*.csproj"
-      - "*.sln"
-      - "**/*.sln"
-      - "*.props"
-      - "**/*.props"
-      - "*.targets"
-      - "**/*.targets"
-      - "global.json"
-      - "*.xaml"
-      - "**/*.xaml"
-      - "app.manifest"
-      - "VERSION"
-      - ".release/**"
-      - ".github/workflows/**"
-      - "Assets/**"
-      - "Resources/**"
-      - "installer/**"
-      - "engine-patches/**"
-      - "landing/release-notes*.json"
-      - "landing/latest.json"
-      - "engines/**"
-      - "scripts/**"
-      - "tests/**"
-      - "evidence/**"
+      # Fast PR routing: only Smart Discovery authority/dependencies trigger this gate.
+      - "Services/NativeIec61850Client*.cs"
+      - "Services/*SmartDiscovery*.cs"
+      - "Services/Iec61850MonitorRuntime.cs"
+      - "Models/MonitorModels.cs"
+      - "ArIED61850Tester.csproj"
+      - "Directory.Build.*"
+      - "engines/ARIEC61850.lock.json"
+      - "scripts/enable-smart-discovery-capture.ps1"
+      - "scripts/*smart-discovery*"
+      - "evidence/interoperability-reference-target.json"
+      - "evidence/smart-discovery-*.json"
+      - "tests/ARSAS.Tests/*SmartDiscovery*.cs"
       - "docs/INTEROPERABILITY_REFERENCE_CONTRACT.md"
-      - ".github/workflows/smart-discovery-*.yml"
+      - ".github/workflows/smart-discovery-mainline-readiness.yml"
   workflow_dispatch:
 
 permissions:
@@ -44,6 +31,7 @@ concurrency:
 
 jobs:
   mainline-readiness:
+    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Require R10 physical authority before mainline review
     runs-on: windows-latest
     steps:
diff --git a/.github/workflows/smart-discovery-merge-execution-guard.yml b/.github/workflows/smart-discovery-merge-execution-guard.yml
index 70948c723..64c1afe8a 100644
--- a/.github/workflows/smart-discovery-merge-execution-guard.yml
+++ b/.github/workflows/smart-discovery-merge-execution-guard.yml
@@ -2,36 +2,22 @@ name: Smart Discovery Merge Execution Guard
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     paths:
-      - "*.cs"
-      - "**/*.cs"
-      - "*.csproj"
-      - "**/*.csproj"
-      - "*.sln"
-      - "**/*.sln"
-      - "*.props"
-      - "**/*.props"
-      - "*.targets"
-      - "**/*.targets"
-      - "global.json"
-      - "*.xaml"
-      - "**/*.xaml"
-      - "app.manifest"
-      - "VERSION"
-      - ".release/**"
-      - ".github/workflows/**"
-      - "Assets/**"
-      - "Resources/**"
-      - "installer/**"
-      - "engine-patches/**"
-      - "landing/release-notes*.json"
-      - "landing/latest.json"
-      - "engines/**"
-      - "scripts/**"
-      - "tests/**"
-      - "evidence/**"
-      - "docs/INTEROPERABILITY_REFERENCE_CONTRACT.md"
-      - ".github/workflows/smart-discovery-*.yml"
+      # Fast PR routing: only Smart Discovery authority/dependencies trigger this gate.
+      - "Services/NativeIec61850Client*.cs"
+      - "Services/*SmartDiscovery*.cs"
+      - "Models/MonitorModels.cs"
+      - "engines/ARIEC61850.lock.json"
+      - "scripts/new-smart-discovery-mainline-merge-manifest.ps1"
+      - "scripts/verify-smart-discovery-live-merge-preflight.ps1"
+      - "scripts/verify-smart-discovery-post-merge-production.ps1"
+      - "evidence/smart-discovery-mainline-merge-target.json"
+      - "evidence/smart-discovery-mainline-merge-manifest.json"
+      - "evidence/interoperability-reference-target.json"
+      - "tests/ARSAS.Tests/*SmartDiscovery*.cs"
+      - "docs/P0-5H_MAINLINE_MERGE_POST_MERGE_VERIFICATION.md"
+      - ".github/workflows/smart-discovery-merge-execution-guard.yml"
   workflow_dispatch:
 
 permissions:
@@ -44,6 +30,7 @@ concurrency:
 
 jobs:
   verify-merge-execution-contract:
+    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Verify P0-5h ordered merge contract
     runs-on: ubuntu-latest
     timeout-minutes: 23
diff --git a/.github/workflows/smart-discovery-production-promotion.yml b/.github/workflows/smart-discovery-production-promotion.yml
index fc6defb4b..2dd2d6bef 100644
--- a/.github/workflows/smart-discovery-production-promotion.yml
+++ b/.github/workflows/smart-discovery-production-promotion.yml
@@ -2,36 +2,23 @@ name: Smart Discovery Production Promotion Guard
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     paths:
-      - "*.cs"
-      - "**/*.cs"
-      - "*.csproj"
-      - "**/*.csproj"
-      - "*.sln"
-      - "**/*.sln"
-      - "*.props"
-      - "**/*.props"
-      - "*.targets"
-      - "**/*.targets"
-      - "global.json"
-      - "*.xaml"
-      - "**/*.xaml"
-      - "app.manifest"
-      - "VERSION"
-      - ".release/**"
-      - ".github/workflows/**"
-      - "Assets/**"
-      - "Resources/**"
-      - "installer/**"
-      - "engine-patches/**"
-      - "landing/release-notes*.json"
-      - "landing/latest.json"
-      - "engines/**"
-      - "scripts/**"
-      - "tests/**"
-      - "evidence/**"
+      # Fast PR routing: only Smart Discovery authority/dependencies trigger this gate.
+      - "Services/NativeIec61850Client*.cs"
+      - "Services/*SmartDiscovery*.cs"
+      - "Services/Iec61850MonitorRuntime.cs"
+      - "Models/MonitorModels.cs"
+      - "ArIED61850Tester.csproj"
+      - "Directory.Build.*"
+      - "engines/ARIEC61850.lock.json"
+      - "scripts/enable-smart-discovery-capture.ps1"
+      - "scripts/*smart-discovery*"
+      - "evidence/interoperability-reference-target.json"
+      - "evidence/smart-discovery-*.json"
+      - "tests/ARSAS.Tests/*SmartDiscovery*.cs"
       - "docs/INTEROPERABILITY_REFERENCE_CONTRACT.md"
-      - ".github/workflows/smart-discovery-*.yml"
+      - ".github/workflows/smart-discovery-production-promotion.yml"
   workflow_dispatch:
 
 permissions:
@@ -44,6 +31,7 @@ concurrency:
 
 jobs:
   verify-production-route:
+    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Verify physical-proven Smart Discovery production parity
     runs-on: windows-latest
     timeout-minutes: 25
diff --git a/.github/workflows/smart-discovery-repeat-run-stability.yml b/.github/workflows/smart-discovery-repeat-run-stability.yml
index 3f38fcb41..1d6827b98 100644
--- a/.github/workflows/smart-discovery-repeat-run-stability.yml
+++ b/.github/workflows/smart-discovery-repeat-run-stability.yml
@@ -2,36 +2,15 @@ name: Smart Discovery Repeat-Run Stability
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
     paths:
-      - "*.cs"
-      - "**/*.cs"
-      - "*.csproj"
-      - "**/*.csproj"
-      - "*.sln"
-      - "**/*.sln"
-      - "*.props"
-      - "**/*.props"
-      - "*.targets"
-      - "**/*.targets"
-      - "global.json"
-      - "*.xaml"
-      - "**/*.xaml"
-      - "app.manifest"
-      - "VERSION"
-      - ".release/**"
-      - ".github/workflows/**"
-      - "Assets/**"
-      - "Resources/**"
-      - "installer/**"
-      - "engine-patches/**"
-      - "landing/release-notes*.json"
-      - "landing/latest.json"
-      - "engines/**"
-      - "scripts/**"
-      - "tests/**"
-      - "evidence/**"
-      - "docs/INTEROPERABILITY_REFERENCE_CONTRACT.md"
-      - ".github/workflows/smart-discovery-*.yml"
+      # Fast PR routing: only Smart Discovery authority/dependencies trigger this gate.
+      - "scripts/new-smart-discovery-repeat-run-authority.ps1"
+      - "scripts/finalize-smart-discovery-repeat-run-stability.ps1"
+      - "evidence/smart-discovery-repeat-run-target.json"
+      - "evidence/smart-discovery-golden-target.json"
+      - "tests/ARSAS.Tests/*SmartDiscovery*.cs"
+      - ".github/workflows/smart-discovery-repeat-run-stability.yml"
   workflow_dispatch:
 
 concurrency:
@@ -40,6 +19,7 @@ concurrency:
 
 jobs:
   verify-repeat-run-stability:
+    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     name: Verify P0-5f repeat-run stability contract
     runs-on: windows-latest
     steps:
diff --git a/.github/workflows/smv-direct-inno-preview.yml b/.github/workflows/smv-direct-inno-preview.yml
deleted file mode 100644
index 5b6e30fcd..000000000
--- a/.github/workflows/smv-direct-inno-preview.yml
+++ /dev/null
@@ -1,194 +0,0 @@
-name: Direct Inno SMV Preview EXE
-
-# One tested Windows runner; no ZIP artifact upload/download.
-# Trusted, narrowly scoped branch only. Stable release is never modified.
-on:
-  push:
-    branches: [feat/smv-sharp-latest-p0-20261022]
-
-permissions:
-  contents: write
-
-concurrency:
-  group: smv-inno-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  direct-preview:
-    if: github.repository == 'masarray/arsas' && github.ref == 'refs/heads/feat/smv-sharp-latest-p0-20261022'
-    runs-on: windows-latest
-    timeout-minutes: 65
-    defaults:
-      run:
-        shell: powershell
-    steps:
-      - name: Checkout exact source
-        uses: actions/checkout@v7
-        with:
-          path: ArIED61850Tester
-          ref: ${{ github.sha }}
-          persist-credentials: false
-          fetch-depth: 1
-
-      - name: Validate SHA and immutable engine/native locks
-        run: |
-          $actual = (git -C .\ArIED61850Tester rev-parse HEAD).Trim().ToLowerInvariant()
-          if ($actual -ne $env:GITHUB_SHA.ToLowerInvariant()) { throw 'Source SHA mismatch.' }
-          $iec = Get-Content .\ArIED61850Tester\engines\ARIEC61850.lock.json -Raw | ConvertFrom-Json
-          $native = Get-Content .\ArIED61850Tester\engines\ARDIREC.lock.json -Raw | ConvertFrom-Json
-          if ($iec.repository -ne 'masarray/ARIEC61850' -or $iec.commit -notmatch '^[0-9a-f]{40}$' -or $native.repository -ne 'masarray/ardirec' -or $native.commit -notmatch '^[0-9a-f]{40}$' -or $native.bridge.abi -ne 1 -or $native.bridge.mode -ne 'native-only') { throw 'Engine lock invalid.' }
-          [xml]$props = Get-Content .\ArIED61850Tester\Directory.Build.props -Raw
-          [xml]$project = Get-Content .\ArIED61850Tester\ArIED61850Tester.csproj -Raw
-          $version = [string]$props.Project.PropertyGroup.Version
-          if ($version -notmatch '^\d+\.\d+\.\d+$' -or $version -ne [string]$project.Project.PropertyGroup.Version -or $version -ne (Get-Content .\ArIED61850Tester\VERSION -Raw).Trim()) { throw 'Inconsistent app version.' }
-          $short = $actual.Substring(0,12)
-          "ARSAS_VERSION=$version" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
-          "SMV_VERSION=$version-smvpreview.$short" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
-          "SMV_TAG=smv-preview-$short" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
-          "ARIEC_SHA=$($iec.commit)" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
-          "ARDIREC_SHA=$($native.commit)" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
-
-      - name: Enforce source and license boundaries
-        run: .\ArIED61850Tester\scripts\verify-source-clean.ps1
-
-      - name: Validate Inno packaging PowerShell syntax before expensive build
-        run: |
-          $tokens = $null
-          $errors = $null
-          $scriptPath = (Resolve-Path .\ArIED61850Tester\scripts\build-windows-installer.ps1).Path
-          [System.Management.Automation.Language.Parser]::ParseFile($scriptPath, [ref]$tokens, [ref]$errors) | Out-Null
-          if ($errors.Count -gt 0) { throw ("Invalid installer PowerShell syntax: " + ($errors | ForEach-Object Message | Out-String)) }
-
-      - name: Checkout pinned independent engines
-        run: |
-          git clone --quiet --filter=blob:none --no-checkout https://github.com/masarray/ARIEC61850.git ARIEC61850
-          if ($LASTEXITCODE -ne 0) { throw 'ARIEC clone failed.' }
-          git -C .\ARIEC61850 fetch --quiet --depth 1 origin $env:ARIEC_SHA
-          if ($LASTEXITCODE -ne 0) { throw 'ARIEC pin fetch failed.' }
-          git -C .\ARIEC61850 checkout --quiet --detach $env:ARIEC_SHA
-          if ($LASTEXITCODE -ne 0) { throw 'ARIEC pin checkout failed.' }
-          git clone --quiet --filter=blob:none --no-checkout https://github.com/masarray/ardirec.git ArdIrec
-          if ($LASTEXITCODE -ne 0) { throw 'Native clone failed.' }
-          git -C .\ArdIrec fetch --quiet --depth 1 origin $env:ARDIREC_SHA
-          if ($LASTEXITCODE -ne 0) { throw 'Native pin fetch failed.' }
-          git -C .\ArdIrec checkout --quiet --detach $env:ARDIREC_SHA
-          if ($LASTEXITCODE -ne 0) { throw 'Native pin checkout failed.' }
-          if ((git -C .\ARIEC61850 rev-parse HEAD).Trim() -ne $env:ARIEC_SHA -or (git -C .\ArdIrec rev-parse HEAD).Trim() -ne $env:ARDIREC_SHA) { throw 'Pinned engine revision mismatch.' }
-
-      - name: Setup .NET 8
-        uses: actions/setup-dotnet@v6
-        with:
-          dotnet-version: 8.0.x
-
-      - name: Restore, build and test full ARSAS and pinned engine
-        run: |
-          dotnet restore .\ArIED61850Tester\ArIED61850Tester.sln
-          if ($LASTEXITCODE -ne 0) { throw 'Restore failed.' }
-          dotnet build .\ArIED61850Tester\ArIED61850Tester.sln -c Release --no-restore
-          if ($LASTEXITCODE -ne 0) { throw 'Windows build failed.' }
-          dotnet test .\ArIED61850Tester\tests\ARSAS.Tests\ARSAS.Tests.csproj -c Release --no-build --no-restore
-          if ($LASTEXITCODE -ne 0) { throw 'Full application regression failed.' }
-          dotnet test .\ARIEC61850\tests\AR.Iec61850.Tests\AR.Iec61850.Tests.csproj -c Release --filter 'FullyQualifiedName~TrustedSclIedIdentityMatcherTests|FullyQualifiedName~CanonicalLiveIedSclExporterTests'
-          if ($LASTEXITCODE -ne 0) { throw 'Engine regression failed.' }
-
-      - name: Build and native-test exact pinned ArdIrec bridge
-        run: |
-          $bridge = [string]( & .\ArIED61850Tester\scripts\build-ardirec-bridge.ps1 -ArdIrecSource "$env:GITHUB_WORKSPACE\ArdIrec" -OutputDirectory "$env:RUNNER_TEMP\smv-native" -BuildDirectory "$env:RUNNER_TEMP\smv-native-build" -CTestJunitPath "$env:RUNNER_TEMP\smv-native-ctest.xml" | Select-Object -Last 1 )
-          $bridge = $bridge.Trim()
-          if (-not (Test-Path $bridge -PathType Leaf) -or -not (Test-Path "$env:RUNNER_TEMP\smv-native-ctest.xml")) { throw 'Native bridge or CTest proof missing.' }
-          "ARDIREC_BRIDGE=$bridge" | Out-File $env:GITHUB_ENV -Encoding utf8 -Append
-
-      - name: Publish canonical installer input in same runner
-        run: |
-          & .\ArIED61850Tester\scripts\publish-windows-portable.ps1 -Version $env:ARSAS_VERSION -Runtime win-x64 -SingleFile $false -SelfContained $true -EngineProject "$env:GITHUB_WORKSPACE\ARIEC61850\src\AR.Iec61850\AR.Iec61850.csproj" -NpcapProject "$env:GITHUB_WORKSPACE\ARIEC61850\src\AR.Iec61850.Transports.Npcap\AR.Iec61850.Transports.Npcap.csproj" -ArdIrecBridgePath $env:ARDIREC_BRIDGE
-          if ($LASTEXITCODE -ne 0) { throw 'Installer input publish failed.' }
-          $folder = ".\ArIED61850Tester\dist\ARSAS-$env:ARSAS_VERSION-win-x64"
-          $native = Join-Path $folder 'Tools\ArdIrec\ardirec_bridge.dll'
-          if (-not (Test-Path $native) -or (Get-FileHash $native -Algorithm SHA256).Hash -ne (Get-FileHash $env:ARDIREC_BRIDGE -Algorithm SHA256).Hash) { throw 'Packaged native bridge differs from tested bridge.' }
-          if (Test-Path .\ArdIrec\LICENSE) { Copy-Item .\ArdIrec\LICENSE (Join-Path $folder 'Tools\ArdIrec\LICENSE.txt') -Force }
-
-      - name: Ensure Inno Setup 6
-        run: |
-          if (-not (Test-Path 'C:\Program Files (x86)\Inno Setup 6\ISCC.exe')) {
-            choco install innosetup --no-progress --yes
-            if ($LASTEXITCODE -ne 0) { throw 'Inno Setup installation failed.' }
-          }
-
-      - name: Compile tested Inno Setup executable directly (no ZIP)
-        run: |
-          & .\ArIED61850Tester\scripts\build-windows-installer.ps1 -Version $env:SMV_VERSION -Runtime win-x64 -PublishedDirectory "$env:GITHUB_WORKSPACE\ArIED61850Tester\dist\ARSAS-$env:ARSAS_VERSION-win-x64" -OutputDirectory "$env:GITHUB_WORKSPACE\ArIED61850Tester\dist" -TestAssemblyPath "$env:GITHUB_WORKSPACE\ArIED61850Tester\tests\ARSAS.Tests\bin\Release\net8.0-windows\ARSAS.Tests.dll" -FixtureCfg "$env:GITHUB_WORKSPACE\ArdIrec\tests\data\minimal_1999.cfg" -LocusFixtureCfg "$env:GITHUB_WORKSPACE\ArdIrec\tests\data\distance_p1.cfg"
-          if ($LASTEXITCODE -ne 0) { throw 'Installer build or pre-package bridge smoke failed.' }
-
-      - name: Silent install, installed-runtime smoke and uninstall
-        run: |
-          $exe = ".\ArIED61850Tester\dist\ARSAS-$env:SMV_VERSION-win-x64-setup.exe"
-          if (-not (Test-Path $exe -PathType Leaf)) { throw 'Installer missing.' }
-          # Reproduce the actual customer upgrade location and UAC mode.
-          # A protected Program Files folder exposes issues missed by RUNNER_TEMP.
-          $target = Join-Path $env:ProgramFiles 'ARSAS-SMV-Preview-CI'
-          # Start-Process joins argument elements: embed quotes inside /DIR so
-          # "C:\Program Files\..." reaches Inno Setup as exactly ONE parameter.
-          $dirArgument = '/DIR="' + $target + '"'
-          $params = @('/VERYSILENT','/SUPPRESSMSGBOXES','/NORESTART','/SP-','/CLOSEAPPLICATIONS',$dirArgument)
-          $install = Start-Process -FilePath $exe -ArgumentList $params -Wait -PassThru
-          if ($install.ExitCode -ne 0) { throw "Protected-folder install failed: $($install.ExitCode)." }
-          if (-not (Test-Path (Join-Path $target 'ARSAS.exe') -PathType Leaf)) {
-            throw "Silent install did not use requested Program Files directory: $target"
-          }
-          # Existing releases may include Accessibility.dll, while later releases
-          # do not. Test the exact shipped bytes of a real private DLL.
-          $legacyAccessibility = Join-Path $target 'Accessibility.dll'
-          $publishedAccessibility = Join-Path $env:GITHUB_WORKSPACE "ArIED61850Tester\dist\ARSAS-$env:ARSAS_VERSION-win-x64\Accessibility.dll"
-          if (-not (Test-Path $legacyAccessibility) -and -not (Test-Path $publishedAccessibility)) {
-            [System.IO.File]::WriteAllBytes($legacyAccessibility, [byte[]](65,82,83,65,83,83,45,79,76,68))
-            Write-Host 'Seeded a legacy Accessibility.dll as a prior-install fixture.'
-          }
-          $repairName = if (Test-Path $publishedAccessibility -PathType Leaf) { 'Accessibility.dll' } else { 'AR.Iec61850.Transports.Npcap.dll' }
-          $repairPath = Join-Path $target $repairName
-          if (-not (Test-Path $repairPath -PathType Leaf)) { throw "Shipped upgrade-test DLL is missing: $repairName" }
-          $expectedHash = (Get-FileHash $repairPath -Algorithm SHA256).Hash
-          [System.IO.File]::WriteAllBytes($repairPath, [byte[]](65,82,83,65,83,45,79,76,68,45,68,76,76))
-          $upgrade = Start-Process -FilePath $exe -ArgumentList $params -Wait -PassThru
-          if ($upgrade.ExitCode -ne 0) { throw "In-place Program Files upgrade failed: $($upgrade.ExitCode)." }
-          $actualHash = (Get-FileHash $repairPath -Algorithm SHA256).Hash
-          if ($actualHash -ne $expectedHash) { throw "Upgrade did not restore shipped DLL: $repairName" }
-          Write-Host "SMART_INNO_UPGRADE_PASS: Protected Program Files upgrade restored exact $repairName bytes."
-          foreach ($file in @('ARSAS.exe','AR.Iec61850.Transports.Npcap.dll','SharpPcap.dll','PacketDotNet.dll','Tools\ArdIrec\ardirec_bridge.dll')) {
-            if (-not (Test-Path (Join-Path $target $file) -PathType Leaf)) { throw "Installed runtime missing: $file" }
-          }
-          $env:ARSAS_ARDIREC_BRIDGE_PATH = Join-Path $target 'Tools\ArdIrec\ardirec_bridge.dll'
-          $env:ARSAS_NATIVE_COMTRADE_TEST_CFG = "$env:GITHUB_WORKSPACE\ArdIrec\tests\data\minimal_1999.cfg"
-          $env:ARSAS_NATIVE_LOCUS_TEST_CFG = "$env:GITHUB_WORKSPACE\ArdIrec\tests\data\distance_p1.cfg"
-          dotnet vstest ".\ArIED61850Tester\tests\ARSAS.Tests\bin\Release\net8.0-windows\ARSAS.Tests.dll" '--TestCaseFilter:FullyQualifiedName~ArdIrecNativeBridgeIntegrationTests|FullyQualifiedName~ArdIrecLocusNativeSessionIntegrationTests'
-          if ($LASTEXITCODE -ne 0) { throw 'Installed native runtime smoke failed.' }
-          $uninstaller = Join-Path $target 'unins000.exe'
-          if (-not (Test-Path $uninstaller)) { throw 'Uninstaller missing.' }
-          $uninstall = Start-Process -FilePath $uninstaller -ArgumentList @('/VERYSILENT','/SUPPRESSMSGBOXES','/NORESTART') -Wait -PassThru
-          if ($uninstall.ExitCode -ne 0) { throw "Uninstall failed: $($uninstall.ExitCode)." }
-
-      - name: Publish immutable GitHub prerelease with direct EXE asset
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          $dist = "$env:GITHUB_WORKSPACE\ArIED61850Tester\dist"
-          $exe = Join-Path $dist "ARSAS-$env:SMV_VERSION-win-x64-setup.exe"
-          if (-not (Test-Path $exe -PathType Leaf)) { throw 'Validated installer missing.' }
-          $name = Split-Path $exe -Leaf
-          $sha256 = (Get-FileHash $exe -Algorithm SHA256).Hash.ToLowerInvariant()
-          $sums = Join-Path $dist 'SHA256SUMS.txt'
-          "$sha256  $name" | Set-Content $sums -Encoding ascii
-          $provenance = Join-Path $dist 'SMV-PREVIEW-PROVENANCE.json'
-          @{sourceSha=$env:GITHUB_SHA;engineSha=$env:ARIEC_SHA;ardirecSha=$env:ARDIREC_SHA;installer=$name;installerSha256=$sha256;installedSmokePassed=$true;channel='engineering-preview'} | ConvertTo-Json | Set-Content $provenance -Encoding utf8
-          $notes = Join-Path $dist 'SMV-PREVIEW-NOTES.md'
-          @("# ARSAS SMV Preview $env:SMV_VERSION",'','Direct Inno Setup EXE, without any workflow ZIP artifact.','Windows build, ARSAS regression, engine check, native CTest, silent install, bridge validation and uninstall passed.','Raw SMV channels are not calibrated voltage/current. Physical merging-unit acceptance remains pending.','Npcap must be installed separately. Authenticode signing is not asserted.',"Source: $env:GITHUB_SHA","SHA256: $sha256") | Set-Content $notes -Encoding utf8
-          # gh release create refuses to create a second release with an existing
-          # tag. Do not probe a missing release with a failing native CLI command:
-          # Windows PowerShell 5.1 treats its stderr as a terminating error.
-          gh release create $env:SMV_TAG $exe $sums $provenance --repo $env:GITHUB_REPOSITORY --target $env:GITHUB_SHA --title "ARSAS SMV Preview $env:SMV_VERSION" --notes-file $notes --prerelease --latest=false
-          if ($LASTEXITCODE -ne 0) { throw 'Direct release upload failed.' }
-          $verified = gh release view $env:SMV_TAG --repo $env:GITHUB_REPOSITORY --json tagName,isPrerelease,assets | ConvertFrom-Json
-          if ($LASTEXITCODE -ne 0 -or -not $verified.isPrerelease -or $verified.tagName -ne $env:SMV_TAG -or -not ($verified.assets | Where-Object { $_.name -eq $name })) { throw 'Release asset verification failed.' }
-          $url = "https://github.com/$env:GITHUB_REPOSITORY/releases/download/$env:SMV_TAG/$name"
-          "Direct Inno Setup EXE: $url" | Out-File $env:GITHUB_STEP_SUMMARY -Encoding utf8 -Append
-          "Installer SHA-256: $sha256" | Out-File $env:GITHUB_STEP_SUMMARY -Encoding utf8 -Append
-          Write-Host "DIRECT_INSTALLER_EXE=$url"
diff --git a/App.xaml b/App.xaml
index b134cf642..d2fe57403 100644
--- a/App.xaml
+++ b/App.xaml
@@ -126,7 +126,7 @@
              Static faces are intentional because WPF does not provide reliable variable-font
              axis selection. Ideal metrics + ClearType keep compact engineering text smooth. -->
         <FontFamily x:Key="AppFontFamily">./Assets/Fonts/#Inter</FontFamily>
-        <FontFamily x:Key="AppCodeFontFamily">Cascadia Mono, Consolas</FontFamily>
+        <FontFamily x:Key="AppCodeFontFamily">./Assets/Fonts/#Inter</FontFamily>
 
         <Style TargetType="{x:Type Window}">
             <Setter Property="FontFamily" Value="{StaticResource AppFontFamily}"/>
@@ -689,7 +689,9 @@
                         <Grid Background="Transparent" SnapsToDevicePixels="True">
                             <Grid.RowDefinitions>
                                 <RowDefinition Height="Auto"/>
-                                <RowDefinition Height="Auto"/>
+                                <!-- Critical: bounded * viewport rather than Auto-size content which
+                                     overflows the fixed Dock row and defeats DataGrid scrolling. -->
+                                <RowDefinition Height="*" MinHeight="0"/>
                             </Grid.RowDefinitions>
                             <ToggleButton x:Name="CommandDockHeaderToggle" Grid.Row="0"
                                           Content="{TemplateBinding Header}"
@@ -734,6 +736,7 @@
                                 </ToggleButton.Template>
                             </ToggleButton>
                             <ContentPresenter x:Name="CommandDockContentHost" Grid.Row="1"
+                                              MinHeight="0" VerticalAlignment="Stretch"
                                               ContentSource="Content" Visibility="Collapsed"/>
                         </Grid>
                         <ControlTemplate.Triggers>
diff --git a/App.xaml.cs b/App.xaml.cs
index 51a039ebb..19e1aaac3 100644
--- a/App.xaml.cs
+++ b/App.xaml.cs
@@ -48,6 +48,10 @@ protected override void OnStartup(StartupEventArgs e)
         // smoke test validate that the vector ResourceDictionary is packaged.
         InstallArvrelMiniIedFascia();
 
+        // Install workstation templates before StartupUri creates its first visual
+        // tree. No theme/style dictionary should be injected on window activation.
+        P2IndustrialWorkstationUx.PreloadResources();
+
         if (Array.Exists(e.Args, argument =>
                 string.Equals(argument, "--portable-smoke-test", StringComparison.OrdinalIgnoreCase)))
         {
@@ -55,6 +59,11 @@ protected override void OnStartup(StartupEventArgs e)
             return;
         }
 
+        // Loaded runs before the initial ContentRendered frame. Apply the
+        // legacy-only chrome once per real window, not on every focus change.
+        EventManager.RegisterClassHandler(typeof(Window), FrameworkElement.LoadedEvent,
+            new RoutedEventHandler(AppWindow_Loaded), handledEventsToo: true);
+
         GridUxBehavior.Install();
         P2InteractionBehavior.Install();
         FaultRecordUxBehavior.Install();
@@ -71,19 +80,24 @@ protected override void OnStartup(StartupEventArgs e)
             new Action(() => _ = AppUpdateCoordinator.RunLazyAsync(_updateCancellation.Token)));
     }
 
-    protected override void OnActivated(EventArgs e)
+    // Style installation on every Activated/focus return used to overwrite the
+    // bundled Inter font and re-template live controls, causing visible repaint.
+    // The one-time Loaded path handles both MainWindow and independently opened FAT.
+    private readonly System.Runtime.CompilerServices.ConditionalWeakTable<Window, object> _styledWindows = new();
+
+    private void AppWindow_Loaded(object sender, RoutedEventArgs e)
     {
-        base.OnActivated(e);
+        if (sender is not Window window || !ReferenceEquals(e.OriginalSource, window))
+            return;
+        if (_styledWindows.TryGetValue(window, out _))
+            return;
 
-        // A handful of legacy controls own local visual resources. Re-apply the
-        // tiny P2 adapter when windows activate so newly opened FAT workspaces also
-        // inherit the selected industrial theme without touching engine workflows.
         P2BlueSteelGreigeUx.ApplyToOpenWindows(this);
+        _styledWindows.Add(window, new object());
 
-        // Keep onboarding task-first while preserving the existing protocol handlers:
-        // Add IED exposes SCL/CID/ICD or IP discovery, and bulk connect appears only
-        // when multiple loaded IEDs make the action useful. The behavior is dispatcher-safe.
-        if (Current?.MainWindow is MainWindow mainWindow)
+        // One onboarding install per MainWindow: model/collection notifications
+        // continue refreshing after the window is displayed.
+        if (window is MainWindow mainWindow)
             SmartIedOnboardingBehavior.Install(mainWindow);
     }
 
diff --git a/BrowserBatchWriteWindow.xaml b/BrowserBatchWriteWindow.xaml
new file mode 100644
index 000000000..66e07714a
--- /dev/null
+++ b/BrowserBatchWriteWindow.xaml
@@ -0,0 +1,111 @@
+<Window x:Class="ArIED61850Tester.BrowserBatchWriteWindow"
+        xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+        Title="Write Data to IED"
+        Width="760" Height="490" MinWidth="620" MinHeight="360" MaxHeight="700"
+        WindowStartupLocation="CenterOwner" ResizeMode="CanResize"
+        Background="#F7F9FC" FontFamily="{StaticResource AppFontFamily}" FontSize="11.5"
+        Loaded="Window_Loaded" Closed="Window_Closed">
+    <Grid Margin="14,12,14,12">
+        <Grid.RowDefinitions>
+            <RowDefinition Height="Auto"/>
+            <RowDefinition Height="Auto"/>
+            <RowDefinition Height="*" MinHeight="100"/>
+            <RowDefinition Height="Auto"/>
+        </Grid.RowDefinitions>
+        <StackPanel Grid.Row="0" Margin="2,0,2,10">
+            <TextBlock Text="Write Data to IED · Data Object" Foreground="#293E56"
+                       FontWeight="SemiBold" FontSize="15"/>
+            <TextBlock x:Name="IdentityLabel" Foreground="#5F7389" FontSize="11"
+                       TextTrimming="CharacterEllipsis" Margin="0,3,0,0"/>
+            <TextBlock Text="Read live values, select one or several editable attributes, then Write."
+                       Foreground="#637990" FontSize="10.5" Margin="0,3,0,0"/>
+        </StackPanel>
+        <TextBlock Grid.Row="1" Text="Name / Value · CO commands are handled separately by Control."
+                   TextTrimming="CharacterEllipsis" Foreground="#596D84" FontSize="10.5" Margin="2,0,2,7"/>
+        <DataGrid x:Name="RowsGrid" Grid.Row="2" ItemsSource="{Binding Rows}"
+                  Style="{StaticResource ModernDataGrid}" IsReadOnly="False"
+                  AutoGenerateColumns="False" CanUserAddRows="False" CanUserDeleteRows="False"
+                  RowHeight="35" ColumnHeaderHeight="31" MinHeight="0"
+                  ScrollViewer.VerticalScrollBarVisibility="Auto"
+                  ScrollViewer.HorizontalScrollBarVisibility="Auto"
+                  VirtualizingPanel.IsVirtualizing="True" VirtualizingPanel.VirtualizationMode="Recycling"
+                  EnableRowVirtualization="True">
+            <DataGrid.Columns>
+                <DataGridTemplateColumn Header=" " Width="36">
+                    <DataGridTemplateColumn.CellTemplate>
+                        <DataTemplate>
+                            <CheckBox IsChecked="{Binding Selected, Mode=TwoWay, UpdateSourceTrigger=PropertyChanged}"
+                                      IsEnabled="{Binding Eligible}" VerticalAlignment="Center"
+                                      HorizontalAlignment="Center" ToolTip="{Binding Status}"/>
+                        </DataTemplate>
+                    </DataGridTemplateColumn.CellTemplate>
+                </DataGridTemplateColumn>
+                <DataGridTextColumn Header="Name" Binding="{Binding DisplayName}"
+                                    Width="2.15*" MinWidth="150" IsReadOnly="True"/>
+                <DataGridTextColumn Header="FC" Binding="{Binding Fc}" Width="43" IsReadOnly="True"/>
+                <DataGridTemplateColumn Header="Value" Width="2*" MinWidth="155">
+                    <DataGridTemplateColumn.CellTemplate>
+                        <DataTemplate>
+                            <Grid>
+                                <TextBox Text="{Binding NewValue, Mode=TwoWay, UpdateSourceTrigger=PropertyChanged}"
+                                         IsEnabled="{Binding CanEdit}" Visibility="{Binding TextEditorVisibility}"
+                                         Padding="6,3" ToolTip="{Binding Status}"/>
+                                <ComboBox ItemsSource="{Binding BooleanChoices}"
+                                          SelectedItem="{Binding NewValue, Mode=TwoWay, UpdateSourceTrigger=PropertyChanged}"
+                                          Visibility="{Binding BooleanEditorVisibility}"
+                                          IsEnabled="{Binding CanEdit}" Padding="5,1"/>
+                            </Grid>
+                        </DataTemplate>
+                    </DataGridTemplateColumn.CellTemplate>
+                </DataGridTemplateColumn>
+                <DataGridTextColumn Header="Readback / Result" Binding="{Binding Status}"
+                                    Width="1.5*" MinWidth="145" IsReadOnly="True"/>
+            </DataGrid.Columns>
+        </DataGrid>
+        <Grid Grid.Row="3" Margin="1,10,1,0">
+            <Grid.RowDefinitions>
+                <RowDefinition Height="Auto"/>
+                <RowDefinition Height="Auto"/>
+            </Grid.RowDefinitions>
+            <Border x:Name="ResultBanner" Background="Transparent" CornerRadius="6"
+                    Padding="8,5" Margin="0,0,0,5">
+                <TextBlock x:Name="StatusLabel" Text="Reading live values from IED…"
+                           TextWrapping="Wrap" Foreground="#314B63" FontSize="10.5"/>
+            </Border>
+            <Grid Grid.Row="1">
+                <Grid.ColumnDefinitions>
+                    <ColumnDefinition Width="*"/>
+                    <ColumnDefinition Width="Auto"/>
+                    <ColumnDefinition Width="Auto"/>
+                    <ColumnDefinition Width="Auto"/>
+                </Grid.ColumnDefinitions>
+                <TextBlock Grid.Column="0" Text="Sequential Write · no automatic retry"
+                           Foreground="#70849B" FontSize="10" TextWrapping="Wrap"
+                           VerticalAlignment="Center" Margin="0,0,8,0"/>
+                <Button x:Name="InspectButton" Grid.Column="1" Content="Read"
+                        Style="{StaticResource SoftButton}" Width="89" Height="31"
+                        ContentTemplate="{StaticResource MaterialReadAction}"
+                        Margin="0,0,7,0" Click="Inspect_Click"/>
+                <Button x:Name="WriteButton" Grid.Column="2" Content="Write"
+                        Width="94" Height="31" IsEnabled="False" Background="#255F99"
+                        Foreground="White" BorderBrush="#255F99"
+                        Margin="0,0,7,0" Click="Write_Click">
+                    <Button.ContentTemplate>
+                        <DataTemplate>
+                            <StackPanel Orientation="Horizontal" HorizontalAlignment="Center">
+                                <Viewbox Width="15" Height="15" Margin="0,0,6,0" IsHitTestVisible="False">
+                                    <Path Data="{StaticResource MaterialEditIcon}" Fill="White"/>
+                                </Viewbox>
+                                <TextBlock Text="{Binding}" VerticalAlignment="Center"/>
+                            </StackPanel>
+                        </DataTemplate>
+                    </Button.ContentTemplate>
+                </Button>
+                <Button Grid.Column="3" Content="Close" Width="72" Height="31"
+                        Style="{StaticResource SoftButton}" ContentTemplate="{StaticResource MaterialCancelAction}"
+                        Click="Close_Click"/>
+            </Grid>
+        </Grid>
+    </Grid>
+</Window>
\ No newline at end of file
diff --git a/BrowserBatchWriteWindow.xaml.cs b/BrowserBatchWriteWindow.xaml.cs
new file mode 100644
index 000000000..991c87e94
--- /dev/null
+++ b/BrowserBatchWriteWindow.xaml.cs
@@ -0,0 +1,481 @@
+using System.Collections.ObjectModel;
+using System.ComponentModel;
+using System.Runtime.CompilerServices;
+using System.Windows;
+using System.Windows.Controls;
+using AR.Iec61850.Discovery;
+using AR.Iec61850.Mms;
+using ArIED61850Tester.Models;
+using ArIED61850Tester.Services;
+
+namespace ArIED61850Tester;
+
+/// <summary>
+/// Explicit, bounded same-DO multi-DA editor. Only user-checked and changed
+/// scalar leaves enter the immutable native transaction plan; no DO overwrite.
+/// All network access is through the existing association and runtime.
+/// </summary>
+public partial class BrowserBatchWriteWindow : Window
+{
+    private readonly Iec61850MonitorRuntime _runtime;
+    private readonly Iec61850MonitorDevice _device;
+    private readonly LiveIedModelDiscoveryDocument _model;
+    private readonly long _association;
+    private readonly CancellationTokenSource _lifetime = new();
+    private bool _busy;
+    private bool _prepared;
+    public long WriteAssociation { get; private set; }
+    public IReadOnlyList<(string Reference, string Fc)> AttemptedLeaves { get; private set; } =
+        Array.Empty<(string Reference, string Fc)>();
+    public string WriteStatus { get; private set; } = "";
+
+    public ObservableCollection<BrowserBatchWriteRow> Rows { get; } = new();
+
+    public BrowserBatchWriteWindow(
+        Iec61850MonitorRuntime runtime,
+        Iec61850MonitorDevice device,
+        LiveIedModelDiscoveryDocument model,
+        LiveIedDataObjectModel owner)
+    {
+        _runtime = runtime ?? throw new ArgumentNullException(nameof(runtime));
+        _device = device ?? throw new ArgumentNullException(nameof(device));
+        _model = model ?? throw new ArgumentNullException(nameof(model));
+        ArgumentNullException.ThrowIfNull(owner);
+        if (owner.Attributes.Count is 0 or > 256)
+            throw new InvalidOperationException("The focused DO needs 1–256 explicit attributes.");
+
+        _association = device.LiveValues.Association;
+        var duplicated = owner.Attributes
+            .GroupBy(a => a.FunctionalConstraint + "|" + a.MmsReference, StringComparer.Ordinal)
+            .Where(g => g.Count() > 1)
+            .Select(g => g.Key)
+            .ToHashSet(StringComparer.Ordinal);
+
+        foreach (var attr in owner.Attributes)
+        {
+            MmsObjectReference? reference = null;
+            try { reference = MmsObjectReference.Parse(attr.MmsReference, attr.FunctionalConstraint); }
+            catch (Exception ex) when (ex is ArgumentException or FormatException) { }
+
+            var parts = reference?.Item.Split('$') ?? [];
+            var sameOwner = reference is not null && parts.Length >= 4 &&
+                string.Equals(parts[1], reference.Value.FunctionalConstraint, StringComparison.OrdinalIgnoreCase) &&
+                string.Equals(reference.Value.Domain + "/" + parts[0] + "." + parts[2],
+                    owner.Reference, StringComparison.Ordinal);
+            var fcOk = reference is not null && reference.Value.FunctionalConstraint.ToUpperInvariant() is "CF" or "SP" or "DC";
+            var isControlMember = parts.Skip(2).Any(p => p is "Oper" or "SBO" or "SBOw" or "Cancel" or "ctlModel");
+            var isDuplicate = duplicated.Contains(attr.FunctionalConstraint + "|" + attr.MmsReference);
+            var eligible = sameOwner && fcOk && !isControlMember && !isDuplicate;
+            var row = new BrowserBatchWriteRow(
+                reference, attr.MmsReference, attr.FunctionalConstraint, eligible,
+                !sameOwner ? "Not an exact live DA of this DO" :
+                isDuplicate ? "Ambiguous duplicate in live model" :
+                isControlMember ? "Use IEC Control / dedicated ctlModel service" :
+                !fcOk ? "FC not approved for generic Write" : "Select, edit and inspect");
+            row.PropertyChanged += Row_PropertyChanged;
+            Rows.Add(row);
+        }
+
+        InitializeComponent();
+        DataContext = this;
+        IdentityLabel.Text = device.Name + " · " + owner.Reference +
+            " · association " + _association;
+    }
+
+    private bool CurrentAssociation =>
+        !_lifetime.IsCancellationRequested && _device.IsConnected &&
+        !_device.IsDemo && !_device.IsBusy &&
+        !_device.LiveValues.IsOffline &&
+        ReferenceEquals(_device.LiveDiscoveryModel, _model) &&
+        _device.LiveValues.Association == _association;
+
+    private void Row_PropertyChanged(object? sender, PropertyChangedEventArgs e)
+    {
+        if (e.PropertyName is nameof(BrowserBatchWriteRow.Selected) or
+            nameof(BrowserBatchWriteRow.NewValue))
+        {
+            _prepared = false;
+            if (WriteButton is not null) WriteButton.IsEnabled = CanWriteSelection;
+        }
+    }
+
+    private bool CanWriteSelection => !_busy && CurrentAssociation &&
+        Rows.Any(row => row.Selected && row.Eligible && row.CanEdit && row.HasEdited);
+
+    private void SetBusy(bool busy)
+    {
+        _busy = busy;
+        RowsGrid.IsEnabled = !busy;
+        InspectButton.IsEnabled = !busy;
+        WriteButton.IsEnabled = CanWriteSelection;
+    }
+
+    private async void Window_Loaded(object sender, RoutedEventArgs e)
+    {
+        var work = SystemParameters.WorkArea;
+        Height = Math.Max(MinHeight, Math.Min(490, work.Height - 26));
+        Width = Math.Max(MinWidth, Math.Min(660, work.Width - 26));
+        // A DO editor opens populated, just like a single-DA editor. Bound
+        // the initial read to prevent a large DO from blocking the operator;
+        // the Read button can inspect an additional explicit selection.
+        await PrimeLiveEditorsAsync();
+    }
+
+    private async Task PrimeLiveEditorsAsync()
+    {
+        if (!CurrentAssociation) return;
+        var visible = Rows.Where(r => r.Eligible).Take(24).ToArray();
+        SetBusy(true);
+        try
+        {
+            foreach (var row in visible)
+            {
+                _lifetime.Token.ThrowIfCancellationRequested();
+                if (!CurrentAssociation) return;
+                var preview = await _runtime.PreviewBrowserDataAttributeWriteAsync(
+                    _device, row.Reference!.Value, _lifetime.Token);
+                if (!CurrentAssociation) return;
+                row.Preview = preview.IsAvailable ? preview : null;
+                row.Type = preview.Type?.MmsType ?? "unverified";
+                row.Old = preview.CurrentText;
+                row.ApplyLiveEditor(preview.Type?.MmsType == "boolean", preview.CurrentText);
+                row.Status = preview.IsAvailable ? "Live Read" : preview.Message;
+                row.NotifyEditorChanged();
+            }
+            StatusLabel.Text = $"Read {visible.Length} DA(s). Edit and select one or more values, then Write.";
+        }
+        catch (OperationCanceledException) { }
+        catch (Exception ex)
+        {
+            StatusLabel.Text = "Read unavailable: " + ex.Message;
+        }
+        finally { SetBusy(false); }
+    }
+
+    private BrowserBatchWriteRow[] CheckedRows()
+    {
+        RowsGrid.CommitEdit(DataGridEditingUnit.Cell, true);
+        RowsGrid.CommitEdit(DataGridEditingUnit.Row, true);
+        return Rows.Where(r => r.Selected).ToArray();
+    }
+
+    private async void Inspect_Click(object sender, RoutedEventArgs e)
+    {
+        if (_busy) return;
+        _prepared = false;
+        WriteButton.IsEnabled = false;
+        var selected = CheckedRows();
+        if (selected.Length is 0 or > IedBrowserTypedWriteBatch.MaxSelectedAttributes ||
+            selected.Any(r => !r.Eligible) || !CurrentAssociation)
+        {
+            StatusLabel.Text =
+                "Select 1–64 eligible DAs, explicitly edit each new value and keep the same online association. No Write sent.";
+            return;
+        }
+
+        SetBusy(true);
+        try
+        {
+            for (var i = 0; i < selected.Length; i++)
+            {
+                var row = selected[i];
+                _lifetime.Token.ThrowIfCancellationRequested();
+                if (!CurrentAssociation)
+                    throw new InvalidOperationException("IED association changed during inspection.");
+                StatusLabel.Text = $"Read-only inspect {i + 1}/{selected.Length}: {row.ReferenceText}";
+                row.Preview = null;
+                row.NotifyEditorChanged();
+                var preview = await _runtime.PreviewBrowserDataAttributeWriteAsync(
+                    _device, row.Reference!.Value, _lifetime.Token);
+                if (!CurrentAssociation)
+                    throw new InvalidOperationException("IED association changed during inspection.");
+                row.Preview = preview.IsAvailable ? preview : null;
+                row.Type = preview.Type?.MmsType ?? "unverified";
+                row.Old = preview.CurrentText;
+                row.ApplyLiveEditor(preview.Type?.MmsType == "boolean", preview.CurrentText);
+                row.Status = preview.Message;
+                if (row.Preview is null)
+                {
+                    StatusLabel.Text = "One DA has no valid live typed Read/GVA proof. No Write sent.";
+                    return;
+                }
+            }
+
+            if (selected.All(r => !r.HasEdited))
+            {
+                StatusLabel.Text = $"Read {selected.Length} live DA(s). Edit one or more values before Write.";
+                return;
+            }
+            if (!TryFreezePlan(selected, out _, out var rejection))
+            {
+                StatusLabel.Text = rejection + " No Write sent.";
+                return;
+            }
+            _prepared = true;
+            WriteButton.IsEnabled = true;
+            StatusLabel.Text = $"{selected.Length} changed DA(s) inspected. Review all old/new values before confirming; zero Writes so far.";
+        }
+        catch (OperationCanceledException)
+        {
+            StatusLabel.Text = "Inspection cancelled; no Write requested.";
+        }
+        catch (Exception ex)
+        {
+            StatusLabel.Text = "Inspection stopped (no Write sent): " + ex.Message;
+        }
+        finally { SetBusy(false); }
+    }
+
+    private static bool TryFreezePlan(
+        IReadOnlyList<BrowserBatchWriteRow> selected,
+        out IReadOnlyList<IedBrowserTypedWriteStep>? steps,
+        out string reason)
+    {
+        steps = null;
+        reason = "";
+        var pending = new List<IedBrowserTypedWriteStep>(selected.Count);
+        foreach (var row in selected)
+        {
+            var preview = row.Preview;
+            if (!row.Eligible || !row.HasEdited ||
+                preview is not { IsAvailable: true, Type: not null, OldValue: not null } ||
+                row.Reference is null ||
+                !IedBrowserTypedWriteInput.TryParse(preview.Type, row.NewValue,
+                    out var proposed, out var error) || proposed is null)
+            {
+                reason = $"{row.ReferenceText}: typed value or inspection missing.";
+                return false;
+            }
+            var live = new MmsVariableAccessAttributesResult
+            {
+                IsSuccess = true, Reference = row.Reference.Value,
+                TypeSpecification = preview.Type
+            };
+            var reject = IedBrowserTypedWriteAdmission.RejectReason(
+                row.Reference.Value, live, preview.GvaSignature, proposed);
+            if (reject is not null)
+            {
+                reason = $"{row.ReferenceText}: {reject}";
+                return false;
+            }
+            if (MmsDataCodec.Encode(preview.OldValue).AsSpan().SequenceEqual(
+                    MmsDataCodec.Encode(proposed)))
+            {
+                reason = $"{row.ReferenceText}: unchanged value is not staged.";
+                return false;
+            }
+            pending.Add(new(row.Reference.Value, preview.GvaSignature,
+                preview.OldValue, proposed));
+        }
+
+        try { steps = IedBrowserTypedWriteBatch.Freeze(pending); }
+        catch (ArgumentException ex) { reason = ex.Message; return false; }
+        return true;
+    }
+
+    private async void Write_Click(object sender, RoutedEventArgs e)
+    {
+        if (_busy || !CurrentAssociation) return;
+        var selected = CheckedRows();
+        if (selected.Length is 0 or > IedBrowserTypedWriteBatch.MaxSelectedAttributes ||
+            selected.Any(r => !r.Eligible || !r.HasEdited || !r.CanEdit))
+        {
+            StatusLabel.Text = "Select and edit 1–64 live-readable DA values.";
+            return;
+        }
+
+        // Clicking Write is sufficient operator intent. Perform fresh GVA +
+        // current-value inspection before dispatch, freezing all target values.
+        // No extra modal confirmation, no Write on open/Read/edit.
+        SetBusy(true);
+        _prepared = false;
+        IReadOnlyList<IedBrowserTypedWriteStep>? steps = null;
+        try
+        {
+            foreach (var row in selected)
+            {
+                _lifetime.Token.ThrowIfCancellationRequested();
+                if (!CurrentAssociation)
+                    throw new InvalidOperationException("IED association changed; no Write sent.");
+                var baseline = row.Preview;
+                var preview = await _runtime.PreviewBrowserDataAttributeWriteAsync(
+                    _device, row.Reference!.Value, _lifetime.Token);
+                if (!CurrentAssociation)
+                    throw new InvalidOperationException("IED association changed; no Write sent.");
+                if (baseline is not { IsAvailable: true, OldValue: not null } ||
+                    preview is not { IsAvailable: true, OldValue: not null } ||
+                    !string.Equals(baseline.GvaSignature, preview.GvaSignature, StringComparison.Ordinal) ||
+                    !MmsDataCodec.Encode(baseline.OldValue).AsSpan()
+                        .SequenceEqual(MmsDataCodec.Encode(preview.OldValue)))
+                {
+                    row.Preview = null;
+                    row.Status = "Live DA changed; press Read and edit again.";
+                    row.NotifyEditorChanged();
+                    throw new InvalidOperationException(
+                        "Live value or MMS type changed since editing " + row.ReferenceText +
+                        ". Refresh before Write; zero Writes sent.");
+                }
+                row.Preview = preview;
+                row.Type = preview.Type?.MmsType ?? "unverified";
+                row.Old = preview.CurrentText;
+                row.ApplyLiveEditor(preview.Type?.MmsType == "boolean", preview.CurrentText);
+                row.NotifyEditorChanged();
+            }
+            if (!TryFreezePlan(selected, out steps, out var reason) || steps is null)
+            {
+                StatusLabel.Text = "Write ditolak: " + reason;
+                return;
+            }
+            if (!CurrentAssociation)
+                throw new InvalidOperationException("IED association changed; no Write sent.");
+
+            WriteAssociation = _association;
+            AttemptedLeaves = steps.Select(step => (
+                step.Reference.Domain + "/" + step.Reference.Item,
+                step.Reference.FunctionalConstraint)).ToArray();
+            StatusLabel.Text = $"Writing {steps.Count} changed DA(s)…";
+            // Native typed admission checks every GVA/old-value/association;
+            // sequential, stop-on-failure, no automatic retry or rollback.
+            var result = await _runtime.WriteBrowserDataAttributesAsync(
+                _device, steps, true, _lifetime.Token);
+            for (var i = 0; i < selected.Length; i++)
+            {
+                var row = selected[i];
+                if (i < result.Rows.Count)
+                {
+                    row.Status = result.Rows[i].State + ": " + result.Rows[i].Message;
+                    row.Preview = null;
+                    row.NotifyEditorChanged();
+                }
+            }
+
+            WriteStatus = result.Rejected > 0 || result.Unknown > 0 ||
+                result.Unverified > 0 || result.Unattempted > 0
+                ? $"Write ditolak / unverified: {result.Rows.LastOrDefault()?.Message ?? "IED refused"}"
+                : $"Write verified · {result.Verified} DA(s)";
+        }
+        catch (OperationCanceledException)
+        {
+            WriteStatus = "Write uncertain: connection interrupted.";
+        }
+        catch (Exception ex)
+        {
+            WriteStatus = "Write ditolak / unresolved: " + ex.Message;
+        }
+        finally
+        {
+            _prepared = false;
+            SetBusy(false);
+            // Never read/write Browser state from the dialog. Let the owner
+            // close the popup and run canonical exact-leaf Read + SSOT ingress.
+            if (AttemptedLeaves.Count > 0 && IsLoaded) Close();
+        }
+    }
+
+    private void Close_Click(object sender, RoutedEventArgs e) => Close();
+    private void Window_Closed(object? sender, EventArgs e) => _lifetime.Cancel();
+}
+
+public sealed class BrowserBatchWriteRow : INotifyPropertyChanged
+{
+    private bool _selected;
+    private string _newValue = "Inspect first";
+    private string _status;
+    private string _type = "Inspect first";
+    private string _old = "—";
+
+    public MmsObjectReference? Reference { get; }
+    public string ReferenceText { get; }
+    public string DisplayName { get; }
+    public string Fc { get; }
+    public bool Eligible { get; }
+    public bool CanEdit => Eligible &&
+        Preview is { IsAvailable: true, Type: not null } p &&
+        (p.Type.MmsType switch
+        {
+            "boolean" => p.CurrentText.Equals("true", StringComparison.OrdinalIgnoreCase) ||
+                         p.CurrentText.Equals("false", StringComparison.OrdinalIgnoreCase),
+            "integer" or "unsigned" or "visible-string" or "mms-string" => true,
+            "floating-point" when p.Type.Size == 32 => true,
+            _ => false // Unknown enum/struct/FLOAT64 is not a qualified editable leaf.
+        });
+    public bool HasEdited { get; private set; }
+    public IedBrowserNativeWritePreview? Preview { get; set; }
+    public event PropertyChangedEventHandler? PropertyChanged;
+
+    public BrowserBatchWriteRow(
+        MmsObjectReference? reference, string referenceText, string fc,
+        bool eligible, string reason)
+    {
+        Reference = reference;
+        ReferenceText = referenceText;
+        DisplayName = referenceText.Split((char)36).LastOrDefault() ?? referenceText;
+        Fc = fc;
+        Eligible = eligible;
+        _status = reason;
+    }
+
+    public void NotifyEditorChanged() => Changed(nameof(CanEdit));
+    public IReadOnlyList<string> BooleanChoices { get; } = new[] { "true", "false" };
+    public Visibility BooleanEditorVisibility => _booleanEditor ? Visibility.Visible : Visibility.Collapsed;
+    public Visibility TextEditorVisibility => _booleanEditor ? Visibility.Collapsed : Visibility.Visible;
+    private bool _booleanEditor;
+
+    public void ApplyLiveEditor(bool boolean, string actualValue)
+    {
+        if (_booleanEditor != boolean)
+        {
+            _booleanEditor = boolean;
+            Changed(nameof(BooleanEditorVisibility));
+            Changed(nameof(TextEditorVisibility));
+        }
+        if (!HasEdited && !string.IsNullOrWhiteSpace(actualValue))
+        {
+            _newValue = actualValue;
+            Changed(nameof(NewValue));
+        }
+        Changed(nameof(CanEdit));
+    }
+
+    public void ResetToReadback(string actual)
+    {
+        _newValue = actual;
+        HasEdited = false;
+        Selected = false;
+        Changed(nameof(NewValue));
+    }
+
+    public bool Selected
+    {
+        get => _selected;
+        set { if (_selected != value) { _selected = value; Changed(); } }
+    }
+    public string NewValue
+    {
+        get => _newValue;
+        set
+        {
+            if (_newValue == value) return;
+            _newValue = value;
+            HasEdited = true;
+            Changed();
+        }
+    }
+    public string Status
+    {
+        get => _status;
+        set { _status = value; Changed(); }
+    }
+    public string Type
+    {
+        get => _type;
+        set { _type = value; Changed(); }
+    }
+    public string Old
+    {
+        get => _old;
+        set { _old = value; Changed(); }
+    }
+    private void Changed([CallerMemberName] string? propertyName = null)
+        => PropertyChanged?.Invoke(this, new PropertyChangedEventArgs(propertyName));
+}
diff --git a/BrowserDataWriteWindow.xaml b/BrowserDataWriteWindow.xaml
new file mode 100644
index 000000000..ab0754396
--- /dev/null
+++ b/BrowserDataWriteWindow.xaml
@@ -0,0 +1,95 @@
+<Window x:Class="ArIED61850Tester.BrowserDataWriteWindow"
+        xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+        Title="Write Data to IED" Width="540" Height="315"
+        MinWidth="480" MinHeight="295" MaxHeight="440"
+        WindowStartupLocation="CenterOwner" ResizeMode="CanResize"
+        Background="#F7F9FC" FontFamily="{StaticResource AppFontFamily}" FontSize="11.5"
+        Loaded="Window_Loaded" Closed="Window_Closed">
+    <Grid Margin="15,13,15,12">
+        <Grid.RowDefinitions>
+            <RowDefinition Height="Auto"/>
+            <RowDefinition Height="*"/>
+            <RowDefinition Height="Auto"/>
+        </Grid.RowDefinitions>
+        <TextBlock x:Name="ReferenceLabel" Grid.Row="0" Margin="2,0,2,10"
+                   Foreground="#2A435F" FontFamily="{StaticResource AppCodeFontFamily}"
+                   TextTrimming="CharacterEllipsis" ToolTip="{Binding Text, RelativeSource={RelativeSource Self}}"/>
+        <Border Grid.Row="1" Background="White" BorderBrush="#D8E1EC"
+                BorderThickness="1" CornerRadius="7" Padding="8">
+            <Grid>
+                <Grid.RowDefinitions>
+                    <RowDefinition Height="Auto"/>
+                    <RowDefinition Height="Auto"/>
+                    <RowDefinition Height="*"/>
+                </Grid.RowDefinitions>
+                <Grid Background="#E9EEF5" Height="29">
+                    <Grid.ColumnDefinitions>
+                        <ColumnDefinition Width="45*"/>
+                        <ColumnDefinition Width="55*"/>
+                    </Grid.ColumnDefinitions>
+                    <TextBlock Text="Name" Margin="9,0" VerticalAlignment="Center" Foreground="#52667B"/>
+                    <TextBlock Grid.Column="1" Text="Value" Margin="9,0" VerticalAlignment="Center" Foreground="#52667B"/>
+                </Grid>
+                <Grid Grid.Row="1" Height="37" Background="#F5F8FC">
+                    <Grid.ColumnDefinitions>
+                        <ColumnDefinition Width="45*"/>
+                        <ColumnDefinition Width="55*"/>
+                    </Grid.ColumnDefinitions>
+                    <StackPanel Orientation="Horizontal" VerticalAlignment="Center" Margin="8,0">
+                        <TextBlock Text="DA" Foreground="#226EB9" FontWeight="SemiBold" Margin="0,0,7,0"/>
+                        <TextBlock x:Name="AttributeLabel" Text="Value" Foreground="#293D54" VerticalAlignment="Center"/>
+                        <TextBlock x:Name="TypeLabel" Foreground="#76879B" FontSize="10" Margin="6,0,0,0"
+                                   VerticalAlignment="Center"/>
+                    </StackPanel>
+                    <Grid Grid.Column="1" Margin="4,3,5,3">
+                        <ComboBox x:Name="BoolPicker" Visibility="Collapsed" Height="29"
+                                  SelectionChanged="BoolPicker_SelectionChanged" IsEnabled="False">
+                            <ComboBoxItem Content="true" Tag="true"/>
+                            <ComboBoxItem Content="false" Tag="false"/>
+                        </ComboBox>
+                        <TextBox x:Name="NewValueBox" Height="29" Padding="7,4"
+                                 IsEnabled="False" VerticalContentAlignment="Center"
+                                 TextChanged="NewValueBox_TextChanged"/>
+                    </Grid>
+                </Grid>
+                <StackPanel Grid.Row="2" Margin="8,10,8,2">
+                    <TextBlock x:Name="CurrentLabel" Text="Reading IED…" Foreground="#597087" FontSize="10.5"/>
+                    <TextBlock x:Name="DiffLabel" Text="" Foreground="#55738D"
+                               TextWrapping="Wrap" FontSize="10.5" Margin="0,5,0,0"/>
+                </StackPanel>
+            </Grid>
+        </Border>
+        <Grid Grid.Row="2" Margin="2,10,2,0">
+            <Grid.ColumnDefinitions>
+                <ColumnDefinition Width="*"/>
+                <ColumnDefinition Width="Auto"/>
+                <ColumnDefinition Width="Auto"/>
+            </Grid.ColumnDefinitions>
+            <Border x:Name="ResultBanner" Grid.Column="0"
+                    Background="Transparent" CornerRadius="5"
+                    Padding="7,5" Margin="0,0,7,0">
+                <TextBlock x:Name="StatusLabel" Text="Reading live MMS type…"
+                           Foreground="#314B63" TextTrimming="CharacterEllipsis"
+                           VerticalAlignment="Center" FontSize="10.5"/>
+            </Border>
+            <Button x:Name="WriteButton" Grid.Column="1" Content="Write"
+                    Width="94" Height="31" IsEnabled="False"
+                    Style="{StaticResource PrimaryButton}" Click="Write_Click" Margin="0,0,7,0">
+                <Button.ContentTemplate>
+                    <DataTemplate>
+                        <StackPanel Orientation="Horizontal" HorizontalAlignment="Center">
+                            <Viewbox Width="15" Height="15" Margin="0,0,6,0" IsHitTestVisible="False">
+                                <Path Data="{StaticResource MaterialEditIcon}" Fill="White"/>
+                            </Viewbox>
+                            <TextBlock Text="{Binding}" VerticalAlignment="Center"/>
+                        </StackPanel>
+                    </DataTemplate>
+                </Button.ContentTemplate>
+            </Button>
+            <Button Grid.Column="2" Content="Cancel" Width="84" Height="31"
+                    Style="{StaticResource SoftButton}"
+                    ContentTemplate="{StaticResource MaterialCancelAction}" Click="Close_Click"/>
+        </Grid>
+    </Grid>
+</Window>
diff --git a/BrowserDataWriteWindow.xaml.cs b/BrowserDataWriteWindow.xaml.cs
new file mode 100644
index 000000000..8fd5f8454
--- /dev/null
+++ b/BrowserDataWriteWindow.xaml.cs
@@ -0,0 +1,218 @@
+using System.Windows;
+using System.Windows.Controls;
+using AR.Iec61850.Mms;
+using AR.Iec61850.Discovery;
+using ArIED61850Tester.Models;
+using ArIED61850Tester.Services;
+
+namespace ArIED61850Tester;
+
+/// <summary>
+/// Explicit, one-DA data Write workflow. This is not IEC Control and never
+/// calls Select/Operate or reconfigures a Report/GOOSE control block.
+/// </summary>
+public partial class BrowserDataWriteWindow : Window
+{
+    private readonly Iec61850MonitorRuntime _runtime;
+    private readonly Iec61850MonitorDevice _device;
+    private readonly MmsObjectReference _reference;
+    private readonly long _association;
+    private readonly LiveIedModelDiscoveryDocument? _model;
+    private readonly CancellationTokenSource _lifetime = new();
+    private bool CurrentAssociation => _device.IsConnected && !_device.IsDemo &&
+        !_device.IsBusy && !_device.LiveValues.IsOffline &&
+        _device.LiveValues.Association == _association &&
+        ReferenceEquals(_device.LiveDiscoveryModel, _model) &&
+        !_lifetime.IsCancellationRequested;
+    private IedBrowserNativeWritePreview? _preview;
+    private bool _busy;
+    public bool WriteAttempted { get; private set; }
+    public long WriteAssociation { get; private set; }
+    public string WriteStatus { get; private set; } = "";
+    public (string Reference, string Fc) AttemptedLeaf =>
+        (_reference.Domain + "/" + _reference.Item, _reference.FunctionalConstraint);
+
+    public BrowserDataWriteWindow(
+        Iec61850MonitorRuntime runtime,
+        Iec61850MonitorDevice device,
+        LiveIedDataAttributeModel attribute)
+    {
+        InitializeComponent();
+        _runtime = runtime ?? throw new ArgumentNullException(nameof(runtime));
+        _device = device ?? throw new ArgumentNullException(nameof(device));
+        _association = device.LiveValues.Association;
+        _model = device.LiveDiscoveryModel;
+        ArgumentNullException.ThrowIfNull(attribute);
+        _reference = MmsObjectReference.Parse(
+            attribute.MmsReference, attribute.FunctionalConstraint);
+        ReferenceLabel.Text = $"{_device.Name}  •  {_reference.Domain}/{_reference.Item}";
+        AttributeLabel.Text = _reference.Item.Split((char)36).LastOrDefault() ?? "Value";
+    }
+
+    private async void Window_Loaded(object sender, RoutedEventArgs e)
+    {
+        _busy = true;
+        try
+        {
+            if (!CurrentAssociation)
+                throw new InvalidOperationException("IED connection changed; reopen Write.");
+            _preview = await _runtime.PreviewBrowserDataAttributeWriteAsync(
+                _device, _reference, _lifetime.Token);
+            if (!CurrentAssociation) return;
+            if (_preview is not { IsAvailable: true, Type: not null, OldValue: not null } p)
+            {
+                StatusLabel.Text = _preview?.Message ?? "Live GVA and value not available.";
+                DiffLabel.Text = "No Write is permitted. Select another live DA.";
+                return;
+            }
+
+            CurrentLabel.Text = $"Current: {p.CurrentText}";
+            TypeLabel.Text = p.Type.SclBType.Length > 0
+                ? $"{p.Type.SclBType} ({p.Type.MmsType}, {p.Type.Size?.ToString() ?? "?"})"
+                : $"{p.Type.MmsType} ({p.Type.Size?.ToString() ?? "?"})";
+            var supported = p.Type.MmsType switch
+            {
+                "boolean" or "integer" or "unsigned" or "visible-string" or "mms-string" => true,
+                "floating-point" when p.Type.Size == 32 => true,
+                _ => false
+            };
+            var boolean = p.Type.MmsType == "boolean";
+            BoolPicker.Visibility = boolean ? Visibility.Visible : Visibility.Collapsed;
+            NewValueBox.Visibility = boolean ? Visibility.Collapsed : Visibility.Visible;
+            if (boolean)
+            {
+                var current = p.CurrentText.Trim();
+                BoolPicker.SelectedIndex = current.Equals("true", StringComparison.OrdinalIgnoreCase) ? 0 :
+                    current.Equals("false", StringComparison.OrdinalIgnoreCase) ? 1 : -1;
+                BoolPicker.IsEnabled = supported && BoolPicker.SelectedIndex >= 0;
+                if (BoolPicker.SelectedIndex < 0)
+                {
+                    StatusLabel.Text = "Unrecognized live Boolean; Write disabled.";
+                    DiffLabel.Text = "Read a verified true/false value before Write.";
+                    return;
+                }
+            }
+            else
+            {
+                NewValueBox.Text = p.CurrentText;
+                NewValueBox.IsEnabled = supported;
+            }
+            StatusLabel.Text = supported ? "Choose a value, then Write" : "Unsupported live MMS type";
+            DiffLabel.Text = supported ? "No change" : "No qualified editor for this MMS type.";
+            if (supported && !boolean) NewValueBox.SelectAll();
+        }
+        catch (OperationCanceledException)
+        {
+            if (!_lifetime.IsCancellationRequested)
+                StatusLabel.Text = "Preview cancelled; no Write sent.";
+        }
+        catch (Exception ex)
+        {
+            if (!_lifetime.IsCancellationRequested)
+                StatusLabel.Text = "Preview refused: " + ex.Message;
+        }
+        finally
+        {
+            _busy = false;
+            RefreshInput();
+        }
+    }
+
+    private void NewValueBox_TextChanged(object sender, TextChangedEventArgs e) => RefreshInput();
+    private void BoolPicker_SelectionChanged(object sender, SelectionChangedEventArgs e) => RefreshInput();
+    private string SelectedInput() => BoolPicker.Visibility == Visibility.Visible
+        ? (BoolPicker.SelectedItem as ComboBoxItem)?.Tag?.ToString() ?? ""
+        : NewValueBox.Text;
+
+    private void RefreshInput()
+    {
+        if (WriteButton is null || DiffLabel is null || NewValueBox is null || BoolPicker is null) return;
+        WriteButton.IsEnabled = false;
+        if (_busy || !CurrentAssociation ||
+            _preview is not { IsAvailable: true, Type: not null, OldValue: not null } p ||
+            !(BoolPicker.Visibility == Visibility.Visible ? BoolPicker.IsEnabled : NewValueBox.IsEnabled))
+            return;
+        if (!IedBrowserTypedWriteInput.TryParse(p.Type, SelectedInput(), out var value, out var error) || value is null)
+        {
+            DiffLabel.Text = error;
+            return;
+        }
+        var gva = new MmsVariableAccessAttributesResult
+        {
+            IsSuccess = true, Reference = _reference, TypeSpecification = p.Type
+        };
+        var rejection = IedBrowserTypedWriteAdmission.RejectReason(_reference, gva, p.GvaSignature, value);
+        if (rejection is not null) { DiffLabel.Text = rejection; return; }
+        var changed = !MmsDataCodec.Encode(p.OldValue).AsSpan().SequenceEqual(MmsDataCodec.Encode(value));
+        DiffLabel.Text = changed ? p.CurrentText + " → " + MmsDataCodec.ToDisplayString(value) : "No change";
+        WriteButton.IsEnabled = changed;
+    }
+
+    private async void Write_Click(object sender, RoutedEventArgs e)
+    {
+        if (_busy || _preview is not { IsAvailable: true, Type: not null, OldValue: not null } p ||
+            !WriteButton.IsEnabled ||
+            !IedBrowserTypedWriteInput.TryParse(p.Type, SelectedInput(),
+                out var proposed, out _) || proposed is null)
+            return;
+        var gva = new MmsVariableAccessAttributesResult
+        {
+            IsSuccess = true, Reference = _reference, TypeSpecification = p.Type
+        };
+        if (IedBrowserTypedWriteAdmission.RejectReason(
+                _reference, gva, p.GvaSignature, proposed) is not null)
+        {
+            RefreshInput();
+            return;
+        }
+
+        // Write is the explicit operator action. Do not display a second
+        // confirmation or silently retry; native admission verifies typed
+        // evidence and the original association at the wire boundary.
+        if (!CurrentAssociation)
+        {
+            StatusLabel.Text = "Connection changed. Reopen Write.";
+            return;
+        }
+
+        _busy = true;
+        WriteButton.IsEnabled = false;
+        NewValueBox.IsEnabled = false;
+        BoolPicker.IsEnabled = false;
+        StatusLabel.Text = "Writing…";
+        bool verified = false;
+        string feedback = "IED did not verify Write.";
+        WriteAttempted = true;
+        WriteAssociation = _association;
+        try
+        {
+            var step = new IedBrowserTypedWriteStep(
+                _reference, p.GvaSignature, p.OldValue, proposed);
+            var outcome = await _runtime.WriteBrowserDataAttributesAsync(
+                _device, new[] { step }, true, _lifetime.Token);
+            verified = outcome.Verified == 1;
+            feedback = verified ? "Write verified" :
+                "Write ditolak: " + (outcome.Rows.FirstOrDefault()?.Message ?? "IED refused");
+        }
+        catch (OperationCanceledException)
+        {
+            feedback = "Write outcome unknown: connection interrupted.";
+        }
+        catch (Exception ex)
+        {
+            feedback = "Write ditolak / unknown: " + ex.Message;
+        }
+        finally
+        {
+            WriteStatus = feedback;
+            _busy = false;
+            // No duplicate read of the value inside this popup. Browser will
+            // issue its own exact live MMS Read and publish only into SSOT.
+            if (IsLoaded) Close();
+        }
+    }
+
+    private void Close_Click(object sender, RoutedEventArgs e) => Close();
+
+    private void Window_Closed(object? sender, EventArgs e) => _lifetime.Cancel();
+}
diff --git a/ControlCommandWindow.xaml b/ControlCommandWindow.xaml
index a50655032..6d89da6b9 100644
--- a/ControlCommandWindow.xaml
+++ b/ControlCommandWindow.xaml
@@ -1,171 +1,219 @@
 <Window x:Class="ArIED61850Tester.ControlCommandWindow"
         xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
         xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
-        Title="IEC 61850 Control"
-        Width="680" Height="690" MinWidth="620" MinHeight="620"
-        WindowStartupLocation="CenterOwner"
-        Background="{StaticResource Bg}"
-        FontFamily="{StaticResource AppFontFamily}"
-        Icon="Assets/app-icon.ico"
-        Loaded="Window_Loaded"
-        Closing="Window_Closing">
+        Title="Control · IEC 61850" Width="565" Height="500"
+        MinWidth="505" MinHeight="390" MaxHeight="670"
+        WindowStartupLocation="CenterOwner" ResizeMode="CanResize"
+        Background="{StaticResource Bg}" FontFamily="{StaticResource AppFontFamily}"
+        FontSize="11.5" Icon="Assets/app-icon.ico"
+        Loaded="Window_Loaded" Closing="Window_Closing">
     <Window.Resources>
-        <Style x:Key="CommandOptionCheckBox" TargetType="CheckBox" BasedOn="{StaticResource {x:Type CheckBox}}">
-            <Setter Property="Margin" Value="0,0,18,0"/>
+        <Style x:Key="ControlCheckBox" TargetType="CheckBox" BasedOn="{StaticResource {x:Type CheckBox}}">
+            <Setter Property="Margin" Value="0,0,17,0"/>
             <Setter Property="VerticalAlignment" Value="Center"/>
-            <Setter Property="FontSize" Value="12.2"/>
-            <Setter Property="Foreground" Value="#344054"/>
+            <Setter Property="Foreground" Value="{StaticResource Ink}"/>
+            <Setter Property="FontSize" Value="11.5"/>
+        </Style>
+        <Style x:Key="ControlFieldLabel" TargetType="TextBlock">
+            <Setter Property="Foreground" Value="{StaticResource Muted}"/>
+            <Setter Property="FontSize" Value="10.5"/>
+            <Setter Property="Margin" Value="0,0,0,5"/>
         </Style>
     </Window.Resources>
-
-    <Grid Margin="18">
+    <Grid Margin="17,13,17,13">
         <Grid.RowDefinitions>
             <RowDefinition Height="Auto"/>
             <RowDefinition Height="Auto"/>
-            <RowDefinition Height="*"/>
+            <RowDefinition Height="*" MinHeight="75"/>
+            <RowDefinition Height="Auto"/>
             <RowDefinition Height="Auto"/>
         </Grid.RowDefinitions>
 
-        <Grid Margin="2,0,2,14">
+        <!-- Compact identity bar: one current association and exact control object. -->
+        <Grid Grid.Row="0" Margin="0,0,0,11">
             <Grid.ColumnDefinitions>
-                <ColumnDefinition Width="Auto"/>
                 <ColumnDefinition Width="*"/>
                 <ColumnDefinition Width="Auto"/>
             </Grid.ColumnDefinitions>
-            <Border Width="42" Height="42" CornerRadius="13" ClipToBounds="True" Margin="0,0,13,0">
-                <Image Source="Assets/app-icon.png" Width="42" Height="42" RenderOptions.BitmapScalingMode="HighQuality"/>
-            </Border>
-            <StackPanel Grid.Column="1" VerticalAlignment="Center">
-                <TextBlock Text="IEC 61850 Control" FontSize="22" FontWeight="SemiBold" Foreground="{StaticResource Ink}"/>
-                <TextBlock Text="{Binding DeviceSummary}" Style="{StaticResource Caption}" Margin="0,3,0,0"/>
+            <StackPanel>
+                <TextBlock Text="Control" Foreground="{StaticResource Ink}"
+                           FontWeight="SemiBold" FontSize="15"/>
+                <TextBlock Text="{Binding DeviceSummary}" Foreground="{StaticResource Muted}"
+                           TextTrimming="CharacterEllipsis" FontSize="10.5" Margin="0,3,0,0"/>
+                <TextBlock Text="{Binding Telegram}" Foreground="{StaticResource Ink}"
+                           TextTrimming="CharacterEllipsis" FontWeight="Medium"
+                           FontSize="11.5" Margin="0,4,0,0"/>
             </StackPanel>
-            <Border Grid.Column="2" Background="#F3F0FF" BorderBrush="#DDD6FE" BorderThickness="1" CornerRadius="13" Padding="11,7" VerticalAlignment="Center">
-                <TextBlock Text="{Binding ControlCdcText}" Foreground="#6941C6" FontWeight="SemiBold" FontSize="12"/>
+            <Border Grid.Column="1" Background="#EAF1FA" BorderBrush="#CCDCEF"
+                    BorderThickness="1" CornerRadius="6" Padding="9,5"
+                    Margin="12,0,0,0" VerticalAlignment="Center">
+                <TextBlock Text="{Binding ControlCdcText}" FontWeight="SemiBold"
+                           Foreground="#245480" FontSize="10.5"/>
             </Border>
         </Grid>
 
-        <Border Grid.Row="1" Style="{StaticResource Card}" Padding="15" Margin="0,0,0,12">
+        <Border Grid.Row="1" Background="White" BorderBrush="{StaticResource Line}"
+                BorderThickness="1" CornerRadius="7" Padding="11,9" Margin="0,0,0,11">
             <Grid>
                 <Grid.ColumnDefinitions>
                     <ColumnDefinition Width="*"/>
                     <ColumnDefinition Width="Auto"/>
                 </Grid.ColumnDefinitions>
                 <StackPanel>
-                    <TextBlock Text="{Binding SignalName}" FontSize="17" FontWeight="SemiBold" Foreground="{StaticResource Ink}"/>
-                    <TextBlock Text="{Binding Telegram}" FontSize="12" Foreground="#475467" Margin="0,5,0,0" TextWrapping="Wrap"/>
-                    <TextBlock Text="Control model is read live from ctlModel; Direct Operate or SBO is selected automatically."
-                               FontSize="11.7" Foreground="{StaticResource Muted}" Margin="0,6,0,0" TextWrapping="Wrap"/>
+                    <TextBlock Text="CONTROL MODEL" FontSize="9" Foreground="{StaticResource Muted}"/>
+                    <TextBlock Text="{Binding ModelShortText}" FontSize="11.5"
+                               FontWeight="SemiBold" Foreground="{StaticResource Ink}"
+                               Margin="0,3,0,0"/>
+                </StackPanel>
+                <StackPanel Grid.Column="1" HorizontalAlignment="Right">
+                    <TextBlock Text="CURRENT" FontSize="9" Foreground="{StaticResource Muted}"
+                               HorizontalAlignment="Right"/>
+                    <TextBlock Text="{Binding CurrentValue}" FontWeight="SemiBold"
+                               Foreground="{StaticResource Ink}" FontSize="12.5"
+                               HorizontalAlignment="Right" Margin="0,2,0,0"/>
                 </StackPanel>
-                <Border Grid.Column="1" Background="#F8FAFC" BorderBrush="{StaticResource Line}" BorderThickness="1" CornerRadius="12" Padding="11,8" Margin="14,0,0,0" VerticalAlignment="Center">
-                    <StackPanel>
-                        <TextBlock Text="CURRENT" FontSize="9.5" FontWeight="SemiBold" Foreground="#667085" HorizontalAlignment="Center"/>
-                        <TextBlock Text="{Binding CurrentValue}" FontSize="15" FontWeight="SemiBold" Foreground="{StaticResource Ink}" Margin="0,3,0,0" HorizontalAlignment="Center"/>
-                    </StackPanel>
-                </Border>
             </Grid>
         </Border>
 
-        <Border Grid.Row="2" Style="{StaticResource Card}" Padding="16">
-            <ScrollViewer VerticalScrollBarVisibility="Auto">
-                <StackPanel>
-                    <Grid>
-                        <Grid.ColumnDefinitions>
-                            <ColumnDefinition Width="145"/>
-                            <ColumnDefinition Width="*"/>
-                        </Grid.ColumnDefinitions>
-                        <TextBlock Text="Control model" FontSize="12" Foreground="{StaticResource Muted}" VerticalAlignment="Center"/>
-                        <Border Grid.Column="1" Background="#EEF4FF" BorderBrush="#C7D7FE" BorderThickness="1" CornerRadius="10" Padding="10,7">
-                            <TextBlock Text="{Binding ControlModelText}" FontWeight="SemiBold" Foreground="#1849A9" TextWrapping="Wrap"/>
-                        </Border>
-                    </Grid>
-
-                    <Grid Margin="0,12,0,0">
-                        <Grid.ColumnDefinitions>
-                            <ColumnDefinition Width="145"/>
-                            <ColumnDefinition Width="*"/>
-                        </Grid.ColumnDefinitions>
-                        <TextBlock Text="Control engine" FontSize="12" Foreground="{StaticResource Muted}" VerticalAlignment="Top" Margin="0,8,0,0"/>
-                        <Border Grid.Column="1" Background="#ECFDF3" BorderBrush="#86EFAC" BorderThickness="1" CornerRadius="10" Padding="10,8">
-                            <StackPanel>
-                                <TextBlock Text="SMART CONTROL ENGINE" FontSize="9.5" FontWeight="Bold" Foreground="#067647"/>
-                                <TextBlock Text="{Binding EngineStatusText}" FontSize="11.4" Foreground="#05603A" TextWrapping="Wrap" Margin="0,3,0,0"/>
-                            </StackPanel>
-                        </Border>
-                    </Grid>
-
-                    <Grid Margin="0,12,0,0">
-                        <Grid.ColumnDefinitions>
-                            <ColumnDefinition Width="145"/>
-                            <ColumnDefinition Width="*"/>
-                        </Grid.ColumnDefinitions>
-                        <TextBlock Text="Sequence" FontSize="12" Foreground="{StaticResource Muted}" VerticalAlignment="Top" Margin="0,7,0,0"/>
-                        <Border Grid.Column="1" Background="#F8FAFC" BorderBrush="{StaticResource Line}" BorderThickness="1" CornerRadius="10" Padding="10,8">
-                            <TextBlock Text="{Binding SequenceText}" FontSize="11.7" Foreground="#344054" TextWrapping="Wrap"/>
-                        </Border>
-                    </Grid>
+        <!-- Scrollable details; status and actions never disappear below the screen. -->
+        <ScrollViewer Grid.Row="2" VerticalScrollBarVisibility="Auto"
+                      HorizontalScrollBarVisibility="Disabled" MinHeight="0">
+            <StackPanel Margin="1,0,6,1">
+                <TextBlock Text="Command value" Style="{StaticResource ControlFieldLabel}"/>
+                <ComboBox x:Name="CommandValueBox" Height="34"
+                          ItemsSource="{Binding ValueOptions}"
+                          Text="{Binding SelectedValue, UpdateSourceTrigger=PropertyChanged}"
+                          IsEditable="{Binding AllowCustomValue}" IsEnabled="{Binding CanEdit}"
+                          Padding="8,4" VerticalContentAlignment="Center"
+                          ToolTip="Control value according to the live CDC and MMS ctlVal type"/>
 
-                    <Grid Margin="0,14,0,0">
-                        <Grid.ColumnDefinitions>
-                            <ColumnDefinition Width="145"/>
-                            <ColumnDefinition Width="*"/>
-                        </Grid.ColumnDefinitions>
-                        <TextBlock Text="Command value" FontSize="12" Foreground="{StaticResource Muted}" VerticalAlignment="Center"/>
-                        <ComboBox Grid.Column="1" ItemsSource="{Binding ValueOptions}" Text="{Binding SelectedValue, UpdateSourceTrigger=PropertyChanged}"
-                                  IsEditable="True" Height="38" Padding="9,4" IsEnabled="{Binding IsReady}"
-                                  ToolTip="Open/Close, On/Off, Raise/Lower, or a numeric setpoint according to the discovered CDC"/>
-                    </Grid>
+                <WrapPanel Margin="0,12,0,9" IsEnabled="{Binding CanEdit}">
+                    <CheckBox Content="Interlock" IsChecked="{Binding InterlockCheck}"
+                              Style="{StaticResource ControlCheckBox}"
+                              ToolTip="IEC 61850 interlock-check bit"/>
+                    <CheckBox Content="Synchrocheck" IsChecked="{Binding SynchroCheck}"
+                              Style="{StaticResource ControlCheckBox}"
+                              ToolTip="IEC 61850 synchrocheck bit"/>
+                    <CheckBox Content="Test" IsChecked="{Binding TestMode}"
+                              Style="{StaticResource ControlCheckBox}"
+                              ToolTip="Test flag is sent to the IED; it does not simulate success"/>
+                </WrapPanel>
 
-                    <Border Background="#F8FAFC" BorderBrush="{StaticResource Line}" BorderThickness="1" CornerRadius="12" Padding="12" Margin="0,15,0,0"
-                            IsEnabled="{Binding IsReady}">
-                        <StackPanel>
-                            <TextBlock Text="Command checks" FontSize="12.5" FontWeight="SemiBold" Foreground="{StaticResource Ink}"/>
-                            <WrapPanel Margin="0,10,0,0">
-                                <CheckBox Content="Interlock check" IsChecked="{Binding InterlockCheck}" Style="{StaticResource CommandOptionCheckBox}"
-                                          ToolTip="Set the IEC 61850 interlock-check bit"/>
-                                <CheckBox Content="Synchrocheck" IsChecked="{Binding SynchroCheck}" Style="{StaticResource CommandOptionCheckBox}"
-                                          ToolTip="Set the IEC 61850 synchrocheck bit"/>
-                                <CheckBox Content="Test" IsChecked="{Binding TestMode}" Style="{StaticResource CommandOptionCheckBox}"
-                                          ToolTip="Set Test=true in the IEC 61850 control request"/>
-                            </WrapPanel>
-                        </StackPanel>
-                    </Border>
-
-                    <Border x:Name="LiveCommandWarning" Background="#FFF4ED" BorderBrush="#FDB022" BorderThickness="1" CornerRadius="12" Padding="12" Margin="0,13,0,0">
-                        <StackPanel>
-                            <TextBlock Text="LIVE COMMAND" FontSize="10" FontWeight="Bold" Foreground="#B54708"/>
-                            <TextBlock Text="This can operate primary equipment. Confirm the selected IED, object, value, and site safety conditions before sending."
-                                       FontSize="11.7" Foreground="#7A2E0E" TextWrapping="Wrap" Margin="0,4,0,8"/>
-                            <CheckBox Content="I confirm this live IEC 61850 command is authorized" IsChecked="{Binding ConfirmLiveCommand}"
-                                      FontWeight="SemiBold" Foreground="#7A2E0E"/>
-                        </StackPanel>
-                    </Border>
+                <Border x:Name="LiveCommandWarning" Background="#FFF7EA"
+                        BorderBrush="#EBD7B9" BorderThickness="1"
+                        CornerRadius="6" Padding="10,9" Margin="0,0,0,9"
+                        IsEnabled="{Binding CanEdit}">
+                    <CheckBox Content="I am authorized to operate this IED"
+                              IsChecked="{Binding ConfirmLiveCommand}"
+                              Foreground="#795321" FontSize="11.5"
+                              ToolTip="Live command may operate primary equipment"/>
+                </Border>
 
-                    <Expander Header="Technical control evidence" Margin="0,13,0,0" Foreground="#475467">
-                        <Border Background="#F8FAFC" BorderBrush="{StaticResource Line}" BorderThickness="1" CornerRadius="10" Padding="11" Margin="0,7,0,0">
-                            <TextBlock Text="{Binding ControlEvidenceText}" FontFamily="{StaticResource AppCodeFontFamily}" FontSize="10.8" Foreground="#344054" TextWrapping="Wrap"/>
-                        </Border>
-                    </Expander>
+                <!-- Advanced information is still accessible, never mixed into the primary task. -->
+                <Expander Header="Advanced · originator &amp; diagnostics"
+                          IsEnabled="{Binding CanEdit}" Foreground="{StaticResource Ink}" FontSize="11"
+                          Margin="0,3,0,0">
+                    <StackPanel Margin="3,10,2,5">
+                        <Grid>
+                            <Grid.ColumnDefinitions>
+                                <ColumnDefinition Width="*"/>
+                                <ColumnDefinition Width="*"/>
+                            </Grid.ColumnDefinitions>
+                            <StackPanel Margin="0,0,7,0">
+                                <TextBlock Text="Origin category" Style="{StaticResource ControlFieldLabel}"/>
+                                <ComboBox ItemsSource="{Binding OriginCategories}"
+                                          SelectedItem="{Binding SelectedOriginCategory}"
+                                          Height="30" Padding="5,3"/>
+                            </StackPanel>
+                            <StackPanel Grid.Column="1" Margin="7,0,0,0">
+                                <TextBlock Text="Originator ID" Style="{StaticResource ControlFieldLabel}"/>
+                                <TextBox Text="{Binding OriginatorId, UpdateSourceTrigger=PropertyChanged}"
+                                         MaxLength="64" Height="30" Padding="7,5"/>
+                            </StackPanel>
+                        </Grid>
+                        <Grid Margin="0,9,0,0">
+                            <Grid.ColumnDefinitions>
+                                <ColumnDefinition Width="*"/>
+                                <ColumnDefinition Width="*"/>
+                            </Grid.ColumnDefinitions>
+                            <StackPanel Margin="0,0,7,0">
+                                <TextBlock Text="ctlNum" Style="{StaticResource ControlFieldLabel}"/>
+                                <TextBox Text="{Binding ControlNumberText, Mode=OneWay}" IsReadOnly="True"
+                                         Height="30" Padding="7,5"
+                                         ToolTip="Assigned by the native IEC control service; never guessed"/>
+                            </StackPanel>
+                            <StackPanel Grid.Column="1" Margin="7,0,0,0">
+                                <TextBlock Text="Termination" Style="{StaticResource ControlFieldLabel}"/>
+                                <TextBox Text="{Binding TerminationText, Mode=OneWay}" IsReadOnly="True"
+                                         Height="30" Padding="7,5"/>
+                            </StackPanel>
+                        </Grid>
+                        <TextBlock Text="{Binding SequenceText}" Foreground="{StaticResource Muted}"
+                                   TextWrapping="Wrap" FontSize="10.5" Margin="0,9,0,0"/>
+                        <TextBlock Text="{Binding OriginValidationText}" Foreground="#A43B32"
+                                   TextWrapping="Wrap" FontSize="10.5" Margin="0,6,0,0"/>
+                        <Expander Header="Wire response · LastApplError" Margin="0,9,0,0">
+                            <TextBlock Text="{Binding ControlEvidenceText}" FontFamily="{StaticResource AppCodeFontFamily}"
+                                       Foreground="{StaticResource Ink}" TextWrapping="Wrap"
+                                       FontSize="10" Margin="5,7,0,0"/>
+                        </Expander>
+                    </StackPanel>
+                </Expander>
+            </StackPanel>
+        </ScrollViewer>
 
-                    <Border x:Name="ResultPanel" Background="#F8FAFC" BorderBrush="{StaticResource Line}" BorderThickness="1" CornerRadius="12" Padding="12" Margin="0,13,0,0">
-                        <StackPanel>
-                            <TextBlock Text="{Binding CommandStage}" FontSize="12.5" FontWeight="SemiBold" Foreground="{StaticResource Ink}"/>
-                            <TextBlock Text="{Binding CommandStatus}" FontSize="11.7" Foreground="#475467" TextWrapping="Wrap" Margin="0,4,0,0"/>
-                        </StackPanel>
-                    </Border>
-                </StackPanel>
-            </ScrollViewer>
+        <Border x:Name="ResultPanel" Grid.Row="3" Background="#F2F6FA"
+                BorderBrush="{StaticResource Line}" BorderThickness="1"
+                CornerRadius="7" Padding="10,9" Margin="0,10,0,0">
+            <Grid>
+                <Grid.RowDefinitions>
+                    <RowDefinition Height="Auto"/>
+                    <RowDefinition Height="Auto"/>
+                    <RowDefinition Height="Auto"/>
+                </Grid.RowDefinitions>
+                <Grid.ColumnDefinitions>
+                    <ColumnDefinition Width="*"/>
+                    <ColumnDefinition Width="Auto"/>
+                </Grid.ColumnDefinitions>
+                <TextBlock Grid.Row="0" Grid.Column="0" Text="{Binding CommandStage}"
+                           Foreground="{StaticResource Ink}" VerticalAlignment="Center"
+                           FontWeight="SemiBold" FontSize="11.5"/>
+                <Button x:Name="CopyEvidenceButton" Grid.Row="0" Grid.Column="1"
+                        Content="Copy evidence" Style="{StaticResource SoftButton}"
+                        IsEnabled="{Binding CanCopyEvidence}" Click="CopyEvidence_Click"
+                        Padding="8,3" MinWidth="90" Height="25" FontSize="10"
+                        ToolTip="Copy IED/object, origin, command response and diagnostics for FAT; sends no MMS requests"/>
+                <TextBlock Grid.Row="1" Grid.ColumnSpan="2" Text="{Binding CommandStatus}"
+                           Foreground="#50647A" TextWrapping="Wrap" MaxHeight="38"
+                           FontSize="10.5" Margin="0,3,0,0"/>
+                <TextBlock Grid.Row="2" Grid.ColumnSpan="2" Text="{Binding WireTimelineText}"
+                           Foreground="#546981" TextWrapping="Wrap" FontSize="10"
+                           MaxHeight="32" Margin="0,4,0,0"
+                           ToolTip="Only received native MMS control wire steps; not physical feedback"/>
+            </Grid>
         </Border>
 
-        <Grid Grid.Row="3" Margin="0,13,0,0">
+        <Grid Grid.Row="4" Margin="0,11,0,0">
             <Grid.ColumnDefinitions>
                 <ColumnDefinition Width="*"/>
                 <ColumnDefinition Width="Auto"/>
+                <ColumnDefinition Width="Auto"/>
+                <ColumnDefinition Width="Auto"/>
             </Grid.ColumnDefinitions>
-            <TextBlock Text="The IED response and process feedback are recorded in Diagnostics." Style="{StaticResource Caption}" VerticalAlignment="Center" TextWrapping="Wrap"/>
-            <StackPanel Grid.Column="1" Orientation="Horizontal">
-                <Button Content="Close" Style="{StaticResource SoftButton}" Click="Close_Click" Margin="0,0,8,0"/>
-                <Button Content="{Binding SendButtonText}" Style="{StaticResource PrimaryButton}" Click="SendCommand_Click" IsEnabled="{Binding CanSend}" MinWidth="126"/>
-            </StackPanel>
+            <TextBlock Text="{Binding SequenceHint}" Foreground="{StaticResource Muted}"
+                       FontSize="10.5" VerticalAlignment="Center"
+                       TextWrapping="Wrap" Margin="0,0,10,0"/>
+            <Button Grid.Column="1" Content="Reinspect" Style="{StaticResource SoftButton}"
+                    Click="Reinspect_Click" IsEnabled="{Binding CanReinspect}"
+                    Width="89" Height="32" Margin="0,0,7,0"
+                    ToolTip="Read current live ctlModel and IED state before a new command"/>
+            <Button Grid.Column="2" Content="Close" Style="{StaticResource SoftButton}"
+                    Click="Close_Click" IsEnabled="{Binding CanClose}"
+                    Width="75" Height="32" Margin="0,0,7,0"/>
+            <Button x:Name="SendCommandButton" Grid.Column="3"
+                    Content="{Binding SendButtonText}" Style="{StaticResource PrimaryButton}"
+                    Click="SendCommand_Click" IsEnabled="{Binding CanSend}"
+                    MinWidth="145" Height="32"/>
         </Grid>
     </Grid>
-</Window>
+</Window>
\ No newline at end of file
diff --git a/ControlCommandWindow.xaml.cs b/ControlCommandWindow.xaml.cs
index b2074ba0c..ae8377550 100644
--- a/ControlCommandWindow.xaml.cs
+++ b/ControlCommandWindow.xaml.cs
@@ -21,11 +21,21 @@ public partial class ControlCommandWindow : Window, INotifyPropertyChanged
     private string _sequenceText = "Detecting the required IEC 61850 control sequence…";
     private string _controlEvidenceText = string.Empty;
     private string _selectedValue = string.Empty;
+    private string _modelShortText = "Inspecting…";
+    private string _sequenceHint = "Inspecting control…";
+    private string _originatorId = "ARSAS";
+    private string _selectedOriginCategory = "StationControl";
+    private string _controlNumberText = "Auto";
+    private string _terminationText = "—";
+    private string _wireTimelineText = string.Empty;
+    private Iec61850ControlModelKind _liveControlModel = Iec61850ControlModelKind.Unknown;
     private bool _interlockCheck = true;
     private bool _synchroCheck;
     private bool _testMode;
     private bool _confirmLiveCommand;
     private bool _isBusy;
+    private bool _commandFlightActive;
+    private bool _commandAttempted;
     private bool _isReady;
     private string _commandStage = "Ready to inspect";
     private string _commandStatus = "ArIED will read the live control model and current status before enabling Send Command.";
@@ -33,6 +43,11 @@ public partial class ControlCommandWindow : Window, INotifyPropertyChanged
     public event PropertyChangedEventHandler? PropertyChanged;
 
     public ObservableCollection<string> ValueOptions { get; } = new();
+    public IReadOnlyList<string> OriginCategories { get; } = new[]
+    {
+        "StationControl", "BayControl", "RemoteControl", "AutomaticBay",
+        "AutomaticStation", "AutomaticRemote", "Maintenance", "Process"
+    };
     public string DeviceSummary => $"{_device.Name} • {_device.EndpointText}";
     public string SignalName => _signal.Name;
     public string Telegram => Iec61850MonitorPoint.StripIedNamePrefix(_signal.ObjectReference, _device.Name);
@@ -41,8 +56,48 @@ public partial class ControlCommandWindow : Window, INotifyPropertyChanged
     public string CurrentValue { get => _currentValue; private set => Set(ref _currentValue, value); }
     public string EngineStatusText { get => _engineStatusText; private set => Set(ref _engineStatusText, value); }
     public string SequenceText { get => _sequenceText; private set => Set(ref _sequenceText, value); }
-    public string ControlEvidenceText { get => _controlEvidenceText; private set => Set(ref _controlEvidenceText, value); }
+    public string ControlEvidenceText
+    {
+        get => _controlEvidenceText;
+        private set
+        {
+            if (Set(ref _controlEvidenceText, value)) Raise(nameof(CanCopyEvidence));
+        }
+    }
     public string SelectedValue { get => _selectedValue; set { if (Set(ref _selectedValue, value)) Raise(nameof(CanSend)); } }
+    public string ModelShortText { get => _modelShortText; private set => Set(ref _modelShortText, value); }
+    public string SequenceHint { get => _sequenceHint; private set => Set(ref _sequenceHint, value); }
+    public string ControlNumberText { get => _controlNumberText; private set => Set(ref _controlNumberText, value); }
+    public string TerminationText { get => _terminationText; private set => Set(ref _terminationText, value); }
+    public string WireTimelineText { get => _wireTimelineText; private set => Set(ref _wireTimelineText, value); }
+    public string SelectedOriginCategory
+    {
+        get => _selectedOriginCategory;
+        set
+        {
+            if (Set(ref _selectedOriginCategory, value)) Raise(nameof(CanSend));
+        }
+    }
+    public string OriginatorId
+    {
+        get => _originatorId;
+        set
+        {
+            if (Set(ref _originatorId, value))
+            {
+                Raise(nameof(OriginValidationText));
+                Raise(nameof(CanSend));
+            }
+        }
+    }
+    public string OriginValidationText => IsValidOriginator(OriginatorId)
+        ? string.Empty : "Originator ID requires 1–64 printable ASCII characters.";
+    public static bool IsValidOriginator(string? id) =>
+        !string.IsNullOrWhiteSpace(id) && id.Length <= 64 &&
+        id.All(c => c is >= ' ' and <= '~');
+    public bool AllowCustomValue
+        => _controlCdcText is "APC" or "INC" or "ISC" or "INC/ISC";
+
     public bool InterlockCheck { get => _interlockCheck; set => Set(ref _interlockCheck, value); }
     public bool SynchroCheck { get => _synchroCheck; set => Set(ref _synchroCheck, value); }
     public bool TestMode
@@ -53,6 +108,7 @@ public bool TestMode
             if (!Set(ref _testMode, value)) return;
             UpdateLiveWarning();
             Raise(nameof(CanSend));
+            Raise(nameof(SendButtonText));
         }
     }
     public bool ConfirmLiveCommand
@@ -71,9 +127,18 @@ private set
         {
             if (!Set(ref _isBusy, value)) return;
             Raise(nameof(CanSend));
+            Raise(nameof(CanClose));
+            Raise(nameof(CanReinspect));
+            Raise(nameof(CanEdit));
+            Raise(nameof(CanCopyEvidence));
             Raise(nameof(SendButtonText));
         }
     }
+    public bool CanClose => !_commandFlightActive;
+    public bool CanCopyEvidence => !IsBusy && !_commandFlightActive &&
+        !string.IsNullOrWhiteSpace(ControlEvidenceText);
+    public bool CanReinspect => !_commandFlightActive && !IsBusy;
+    public bool CanEdit => IsReady && !IsBusy && !_commandAttempted;
     public bool IsReady
     {
         get => _isReady;
@@ -82,12 +147,18 @@ private set
             if (!Set(ref _isReady, value)) return;
             UpdateLiveWarning();
             Raise(nameof(CanSend));
+            Raise(nameof(CanEdit));
         }
     }
     public string CommandStage { get => _commandStage; private set => Set(ref _commandStage, value); }
     public string CommandStatus { get => _commandStatus; private set => Set(ref _commandStatus, value); }
-    public string SendButtonText => IsBusy ? "Sending…" : TestMode ? "Send Test" : "Send Command";
-    public bool CanSend => IsReady && !IsBusy && !string.IsNullOrWhiteSpace(SelectedValue) && (TestMode || ConfirmLiveCommand);
+    public string SendButtonText => IsBusy ? "Working…" : TestMode ? "Send test" :
+        _liveControlModel is Iec61850ControlModelKind.SboNormal or
+            Iec61850ControlModelKind.SboEnhanced ? "Select → Operate" : "Operate";
+    public bool CanSend => IsReady && !IsBusy && !_commandAttempted &&
+        !string.IsNullOrWhiteSpace(SelectedValue) &&
+        IsValidOriginator(OriginatorId) && OriginCategories.Contains(SelectedOriginCategory) &&
+        ConfirmLiveCommand;
 
     public ControlCommandWindow(
         Iec61850MonitorRuntime runtime,
@@ -104,11 +175,26 @@ public ControlCommandWindow(
 
     private async void Window_Loaded(object sender, RoutedEventArgs e)
     {
+        // Honor the actual DPI-aware working area. All details scroll while
+        // the command confirmation footer stays on-screen at 1366x768/150%.
+        var work = SystemParameters.WorkArea;
+        Height = Math.Max(MinHeight, Math.Min(500, work.Height - 24));
+        Width = Math.Max(MinWidth, Math.Min(565, work.Width - 24));
         await InspectAsync();
     }
 
     private async Task InspectAsync()
     {
+        if (_commandFlightActive || IsBusy) return;
+        _commandAttempted = false;
+        ConfirmLiveCommand = false;
+        IsReady = false;
+        SelectedValue = string.Empty;
+        ControlNumberText = "Auto";
+        TerminationText = "—";
+        WireTimelineText = string.Empty;
+        ControlEvidenceText = string.Empty; // Do not export stale association evidence.
+        if (CopyEvidenceButton is not null) CopyEvidenceButton.Content = "Copy evidence";
         IsBusy = true;
         CommandStage = "Inspecting control";
         CommandStatus = "Reading ctlModel and current status from the IED…";
@@ -121,7 +207,22 @@ private async Task InspectAsync()
                 _cancellation.Token);
 
             ControlModelText = capabilities.ControlModelText;
+            _liveControlModel = capabilities.ControlModel;
+            ModelShortText = capabilities.ControlModel switch
+            {
+                Iec61850ControlModelKind.DirectNormal => "Direct · normal",
+                Iec61850ControlModelKind.DirectEnhanced => "Direct · enhanced",
+                Iec61850ControlModelKind.SboNormal => "SBO · normal",
+                Iec61850ControlModelKind.SboEnhanced => "SBO · enhanced",
+                Iec61850ControlModelKind.StatusOnly => "Status only",
+                _ => "Unverified"
+            };
+            SequenceHint = !capabilities.SupportsOperate ? "Not operable" :
+                capabilities.UsesSelectBeforeOperate
+                ? "Native: Select → Operate" : "Native: Operate";
+            Raise(nameof(SendButtonText));
             ControlCdcText = string.IsNullOrWhiteSpace(capabilities.ControlCdc) ? "CONTROL" : capabilities.ControlCdc;
+            Raise(nameof(AllowCustomValue));
             CurrentValue = capabilities.CurrentValue;
             EngineStatusText = capabilities.EngineControlServiceStatus;
             SequenceText = capabilities.SequenceText;
@@ -138,7 +239,7 @@ private async Task InspectAsync()
             {
                 CommandStage = capabilities.SupportsOperate ? "Ready" : "Control unavailable";
                 CommandStatus = capabilities.SupportsOperate
-                    ? $"{capabilities.ControlModelText}. {capabilities.SequenceText}. Select a command value and required check flags."
+                    ? "Choose a value and verify the checks before sending."
                     : capabilities.EngineControlServiceStatus;
                 SetResultTone(capabilities.SupportsOperate ? "Ready" : "Error");
             }
@@ -166,6 +267,24 @@ private async void SendCommand_Click(object sender, RoutedEventArgs e)
         if (!CanSend)
             return;
 
+        // Keep explicit staged safety confirmation without cluttering the main popup.
+        // SBO selection is part of the native one-shot sequence, NOT an already-held lease.
+        var confirm = MessageBox.Show(this,
+            $"IED: {_device.Name}\nObject: {Telegram}\nValue: {SelectedValue}\n" +
+            $"Sequence: {ModelShortText}\nOrigin: {SelectedOriginCategory}/{OriginatorId.Trim()}\n\n" +
+            (TestMode ? "Send an IEC 61850 command with Test=true?" :
+                        "Send a LIVE IEC 61850 command to this IED?"),
+            "Confirm control", MessageBoxButton.YesNo,
+            MessageBoxImage.Warning, MessageBoxResult.No);
+        if (confirm != MessageBoxResult.Yes) return;
+
+        // One explicit wire attempt consumes the preview. Subsequent commands
+        // need a fresh typed ctlModel / state inspection on this association.
+        _commandAttempted = true;
+        Raise(nameof(CanSend));
+        _commandFlightActive = true;
+        Raise(nameof(CanClose));
+        Raise(nameof(CanReinspect));
         IsBusy = true;
         CommandStage = TestMode ? "Sending test command" : "Sending live command";
         CommandStatus = "Executing the IEC 61850 control sequence selected from ctlModel…";
@@ -183,22 +302,27 @@ private async void SendCommand_Click(object sender, RoutedEventArgs e)
                     TestMode = TestMode,
                     FeedbackTimeoutMs = _signal.IsPositionControl ? 12000 : 8000,
                     CommandTerminationTimeoutMs = 10000,
-                    OriginCategory = "StationControl"
+                    Originator = OriginatorId.Trim(),
+                    OriginCategory = SelectedOriginCategory
                 },
                 _cancellation.Token);
 
-            CommandStage = result.IsSuccess && !TestMode ? "Command accepted" : result.Stage;
-            CommandStatus = BuildCommandResultText(result);
-            if (result.IsSuccess && !TestMode)
-            {
-                CommandStatus += " Command accepted by the IEC 61850 control service. Waiting for independent IED process feedback; monitored stVal is not changed from the command path.";
-            }
-            SetResultTone(result.IsSuccess ? "Success" : "Error");
+            ControlNumberText = result.ControlNumber;
+            WireTimelineText = Iec61850ControlOutcomePresentation.WireTimeline(result);
+            TerminationText = result.CommandTerminationReceived
+                ? result.PositiveTermination ? "Positive" : "Negative" : "Not reported";
+            var outcome = Iec61850ControlOutcomePresentation.From(result, TestMode);
+            CommandStage = outcome.Stage;
+            CommandStatus = outcome.Summary;
+            // IEC 61850 service acceptance is not process-image authority.
+            // Wire steps, termination, LastApplError and timeout remain inspectable.
+            ControlEvidenceText += "\n\nRESULT\n" + BuildCommandResultText(result);
+            SetResultTone(outcome.Tone);
         }
         catch (OperationCanceledException)
         {
-            CommandStage = "Cancelled";
-            CommandStatus = "The command operation was cancelled.";
+            CommandStage = "Outcome uncertain";
+            CommandStatus = "Request may have reached the IED. Verify before another attempt.";
             SetResultTone("Neutral");
         }
         catch (InvalidOperationException ex) when (
@@ -212,16 +336,31 @@ private async void SendCommand_Click(object sender, RoutedEventArgs e)
         }
         catch (Exception ex)
         {
-            CommandStage = "Command failed";
-            CommandStatus = $"{ex.GetType().Name}: {ex.Message}";
-            SetResultTone("Error");
+            // An unexpected failure after dispatch cannot prove the command was NOT sent.
+            CommandStage = "Outcome unresolved";
+            CommandStatus = $"{ex.GetType().Name}: {ex.Message}. Verify IED state before retry.";
+            SetResultTone("Warning");
         }
         finally
         {
+            _commandFlightActive = false;
+            Raise(nameof(CanClose));
+            Raise(nameof(CanReinspect));
             IsBusy = false;
+            Raise(nameof(CanCopyEvidence));
+            Raise(nameof(CanSend));
+            Raise(nameof(CanEdit));
         }
     }
 
+    private async void Reinspect_Click(object sender, RoutedEventArgs e)
+    {
+        // Only a read-only live reinspection can re-arm the command action.
+        // Never retry a timed out or ambiguous native command automatically.
+        if (!CanReinspect) return;
+        await InspectAsync();
+    }
+
     private void PopulateValueOptions(string cdc, string currentValue)
     {
         ValueOptions.Clear();
@@ -271,7 +410,9 @@ private void PopulateValueOptions(string cdc, string currentValue)
                 break;
         }
 
-        SelectedValue = ValueOptions.FirstOrDefault() ?? string.Empty;
+        // Never pre-select Open, Close, Raise, or a numeric setpoint.
+        // The operator must deliberately choose an action after inspection.
+        SelectedValue = string.Empty;
     }
 
 
@@ -344,7 +485,9 @@ private void UpdateLiveWarning()
     {
         if (LiveCommandWarning == null)
             return;
-        LiveCommandWarning.Visibility = IsReady && !TestMode ? Visibility.Visible : Visibility.Collapsed;
+        // Test=true is an MMS control flag, not an offline simulator.
+        // Some servers may still change equipment: authorization is mandatory.
+        LiveCommandWarning.Visibility = IsReady ? Visibility.Visible : Visibility.Collapsed;
         if (TestMode)
             ConfirmLiveCommand = false;
     }
@@ -371,11 +514,41 @@ private static SolidColorBrush BrushFrom(string hex)
         return new SolidColorBrush(color);
     }
 
+    private void CopyEvidence_Click(object sender, RoutedEventArgs e)
+    {
+        if (!CanCopyEvidence) return;
+        // Pure local clipboard export: NO read, Select, Operate, Cancel, Write,
+        // reconnect or other MMS/network action is permitted in this handler.
+        var snapshot = new Iec61850ControlFatEvidence(
+            DateTimeOffset.UtcNow,
+            DeviceSummary, Telegram, ControlCdcText, ControlModelText,
+            CurrentValue, SelectedValue, SelectedOriginCategory, OriginatorId,
+            InterlockCheck, SynchroCheck, TestMode, CommandStage, CommandStatus,
+            ControlNumberText, TerminationText, WireTimelineText, ControlEvidenceText);
+        try
+        {
+            Clipboard.SetText(snapshot.ToClipboardText());
+            CopyEvidenceButton.Content = "Copied";
+        }
+        catch (System.Runtime.InteropServices.ExternalException)
+        {
+            CopyEvidenceButton.Content = "Copy failed";
+        }
+    }
+
     private void Close_Click(object sender, RoutedEventArgs e)
         => Close();
 
     private void Window_Closing(object? sender, CancelEventArgs e)
     {
+        // Never abandon a dispatched native control flight by simply closing
+        // its UI. Late responses need the owning session to resolve/quarantine.
+        if (_commandFlightActive)
+        {
+            e.Cancel = true;
+            CommandStatus = "IED operation still resolving. Close after the result is known.";
+            return;
+        }
         _cancellation.Cancel();
         _cancellation.Dispose();
     }
diff --git a/ControlModelWriteWindow.xaml b/ControlModelWriteWindow.xaml
index 77171121e..4478b0b76 100644
--- a/ControlModelWriteWindow.xaml
+++ b/ControlModelWriteWindow.xaml
@@ -1,53 +1,102 @@
 <Window x:Class="ArIED61850Tester.ControlModelWriteWindow"
         xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
         xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
-        Title="Write Data to IED" Width="510" Height="290" MinWidth="490"
-        ResizeMode="NoResize" WindowStartupLocation="CenterOwner"
-        Background="#F4F7FB" FontFamily="{StaticResource AppFontFamily}"
+        Title="Write Data to IED" Width="495" Height="284" MinWidth="455"
+        MinHeight="265" MaxHeight="450" ResizeMode="CanResize"
+        WindowStartupLocation="CenterOwner" Background="#F5F7FB"
+        FontFamily="{StaticResource AppFontFamily}" FontSize="11.5"
         Icon="Assets/app-icon.ico" Loaded="Window_Loaded" Closing="Window_Closing">
-    <Grid Margin="16">
+    <Grid Margin="14,12,14,12">
         <Grid.RowDefinitions>
             <RowDefinition Height="Auto"/>
             <RowDefinition Height="Auto"/>
-            <RowDefinition Height="*"/>
+            <RowDefinition Height="*" MinHeight="0"/>
             <RowDefinition Height="Auto"/>
         </Grid.RowDefinitions>
-        <TextBlock x:Name="ReferenceLabel" Grid.Row="0" FontSize="11.5"
-                   Foreground="{StaticResource Ink}" FontFamily="{StaticResource AppCodeFontFamily}"
-                   TextTrimming="CharacterEllipsis" Margin="0,0,0,12"/>
-        <Border Grid.Row="1" BorderThickness="1" BorderBrush="{StaticResource Line}"
-                CornerRadius="8" Background="#F8FAFC" Padding="10,12">
+
+        <!-- Exact IEC object identity; the only editable DA is ctlModel [CF]. -->
+        <TextBlock x:Name="ReferenceLabel" Grid.Row="0" FontSize="11"
+                   Foreground="{StaticResource Ink}" FontFamily="{StaticResource AppFontFamily}"
+                   TextTrimming="CharacterEllipsis"
+                   ToolTip="{Binding Text, RelativeSource={RelativeSource Self}}"
+                   Margin="2,0,2,10"/>
+
+        <!-- One-row Name | Value editor, with verified enum choices only. -->
+        <Border Grid.Row="1" Background="White" BorderBrush="{StaticResource Line}"
+                BorderThickness="1" CornerRadius="7" Padding="10,8">
             <Grid>
                 <Grid.ColumnDefinitions>
-                    <ColumnDefinition Width="105"/>
+                    <ColumnDefinition Width="117"/>
                     <ColumnDefinition Width="*"/>
-                    <ColumnDefinition Width="Auto"/>
+                    <ColumnDefinition Width="83"/>
                 </Grid.ColumnDefinitions>
-                <TextBlock Text="ctlModel [CF]" VerticalAlignment="Center"
-                           Foreground="{StaticResource Ink}" FontSize="12"/>
-                <ComboBox x:Name="ModelPicker" Grid.Column="1" Height="31"
+                <Grid.RowDefinitions>
+                    <RowDefinition Height="Auto"/>
+                    <RowDefinition Height="1"/>
+                    <RowDefinition Height="Auto"/>
+                </Grid.RowDefinitions>
+                <TextBlock Text="Name" Grid.Row="0" FontSize="10" Foreground="{StaticResource Muted}"
+                           Margin="2,0,0,6"/>
+                <TextBlock Text="Value" Grid.Row="0" Grid.Column="1" FontSize="10"
+                           Foreground="{StaticResource Muted}" Margin="3,0,0,6"/>
+                <Border Grid.Row="1" Grid.ColumnSpan="3" Background="#E6ECF2"/>
+                <TextBlock Text="ctlModel [CF]" Grid.Row="2" Foreground="{StaticResource Ink}"
+                           VerticalAlignment="Center" Margin="2,8,0,0"/>
+                <ComboBox x:Name="ModelPicker" Grid.Row="2" Grid.Column="1"
+                          Height="31" Margin="2,8,7,0" IsEnabled="False"
                           ItemsSource="{Binding Choices}" DisplayMemberPath="Label"
-                          SelectionChanged="ModelPicker_SelectionChanged" IsEnabled="False"/>
-                <Button x:Name="ReadButton" Grid.Column="2" Content="Read" Click="Read_Click"
-                        Style="{StaticResource SoftButton}" Height="29" MinHeight="29"
-                        Padding="10,3" Margin="8,0,0,0"/>
+                          SelectionChanged="ModelPicker_SelectionChanged"
+                          ToolTip="Verified current ctlModel is preselected after live Read"/>
+                <Button x:Name="ReadButton" Grid.Row="2" Grid.Column="2"
+                        Style="{StaticResource SoftButton}" Click="Read_Click"
+                        Height="30" MinHeight="30" Margin="0,8,0,0" Padding="6,3">
+                    <StackPanel Orientation="Horizontal" HorizontalAlignment="Center">
+                        <Viewbox Width="15" Height="15" Margin="0,0,5,0">
+                            <Path Data="{StaticResource MaterialRefreshIcon}" Fill="#415771"/>
+                        </Viewbox>
+                        <TextBlock Text="Read" VerticalAlignment="Center"/>
+                    </StackPanel>
+                </Button>
             </Grid>
         </Border>
-        <StackPanel Grid.Row="2" Margin="2,10,0,5">
-            <TextBlock x:Name="StatusLabel" FontSize="11" TextWrapping="Wrap"
-                       Foreground="{StaticResource Muted}" Text="Reading ctlModel from IED…"/>
-            <TextBox x:Name="FailureDetails" Visibility="Collapsed" Margin="0,7,0,0"
-                     IsReadOnly="True" IsTabStop="False" TextWrapping="Wrap"
-                     VerticalScrollBarVisibility="Auto" MaxHeight="73" MinHeight="48"
-                     FontSize="11" Padding="8,6" BorderThickness="1" BorderBrush="#E7C4C4"
-                     Background="#FFF8F8" Foreground="#923C3C"/>
-        </StackPanel>
-        <StackPanel Grid.Row="3" Orientation="Horizontal" HorizontalAlignment="Right">
-            <Button x:Name="WriteButton" Content="Write" Click="Write_Click"
-                    Style="{StaticResource PrimaryButton}" Width="93" Height="31"
-                    MinHeight="31" Padding="10,4" IsEnabled="False" Margin="0,0,8,0"/>
-            <Button Content="Cancel" Click="Close_Click" Style="{StaticResource SoftButton}"
-                    Width="85" Height="31" MinHeight="31" Padding="10,4"/>
-        </StackPanel>
+
+        <!-- Inline readback notification, no second confirmation window. -->
+        <ScrollViewer Grid.Row="2" VerticalScrollBarVisibility="Auto"
+                      HorizontalScrollBarVisibility="Disabled" MinHeight="0"
+                      Margin="0,8,0,2">
+            <Border x:Name="ResultBanner" CornerRadius="6" Padding="9,7"
+                    Background="Transparent">
+                <TextBlock x:Name="StatusLabel" FontSize="11"
+                           TextWrapping="Wrap" Foreground="{StaticResource Ink}"
+                           Text="Reading current ctlModel from IED…"/>
+            </Border>
+        </ScrollViewer>
+
+        <Grid Grid.Row="3" Margin="0,9,0,0">
+            <Grid.ColumnDefinitions>
+                <ColumnDefinition Width="*"/>
+                <ColumnDefinition Width="Auto"/>
+                <ColumnDefinition Width="Auto"/>
+            </Grid.ColumnDefinitions>
+            <Button x:Name="WriteButton" Grid.Column="1" Click="Write_Click"
+                    Style="{StaticResource PrimaryButton}" Width="94" Height="32"
+                    MinHeight="32" Padding="9,4" IsEnabled="False" Margin="0,0,8,0">
+                <StackPanel Orientation="Horizontal" HorizontalAlignment="Center">
+                    <Viewbox Width="16" Height="16" Margin="0,0,6,0">
+                        <Path Data="{StaticResource MaterialEditIcon}" Fill="White"/>
+                    </Viewbox>
+                    <TextBlock Text="Write" VerticalAlignment="Center"/>
+                </StackPanel>
+            </Button>
+            <Button Grid.Column="2" Click="Close_Click" Style="{StaticResource SoftButton}"
+                    Width="84" Height="32" MinHeight="32" Padding="8,4">
+                <StackPanel Orientation="Horizontal" HorizontalAlignment="Center">
+                    <Viewbox Width="14" Height="14" Margin="0,0,5,0">
+                        <Path Data="{StaticResource MaterialCloseIcon}" Fill="#415771"/>
+                    </Viewbox>
+                    <TextBlock Text="Cancel" VerticalAlignment="Center"/>
+                </StackPanel>
+            </Button>
+        </Grid>
     </Grid>
 </Window>
diff --git a/ControlModelWriteWindow.xaml.cs b/ControlModelWriteWindow.xaml.cs
index bf11df221..e21b50b07 100644
--- a/ControlModelWriteWindow.xaml.cs
+++ b/ControlModelWriteWindow.xaml.cs
@@ -20,8 +20,22 @@ public sealed record ModelChoice(Iec61850ControlModelKind Model, string Label);
     private readonly SignalDefinition _signal;
     private readonly CancellationTokenSource _cancellation = new();
     private bool _busy;
+    public bool VerifiedWriteOccurred { get; private set; }
+    public bool WriteAttempted { get; private set; }
+    public string WriteStatus { get; private set; } = "";
+    public long WriteAssociation { get; private set; }
     private bool _liveModelReady;
     private Iec61850ControlModelKind _liveModel = Iec61850ControlModelKind.Unknown;
+    // Read/GVA evidence belongs to one live MMS association and one immutable
+    // model instance. A reconnect cannot keep a previously enabled Write valid.
+    private long _inspectedAssociation;
+    private object? _inspectedLiveModel;
+
+    private bool InspectionIsCurrent =>
+        _inspectedLiveModel is not null &&
+        ReferenceEquals(_device.LiveDiscoveryModel, _inspectedLiveModel) &&
+        _device.LiveValues.Association == _inspectedAssociation &&
+        _device.IsConnected && !_cancellation.IsCancellationRequested;
 
     public ObservableCollection<ModelChoice> Choices { get; } = new()
     {
@@ -52,7 +66,7 @@ private void ModelPicker_SelectionChanged(object sender, SelectionChangedEventAr
     private void UpdateWriteButton()
     {
         ReadButton.IsEnabled = !_busy;
-        WriteButton.IsEnabled = !_busy && _device.IsConnected && _liveModelReady &&
+        WriteButton.IsEnabled = !_busy && _liveModelReady && InspectionIsCurrent &&
             ModelPicker.SelectedItem is ModelChoice choice && choice.Model != _liveModel;
     }
 
@@ -60,15 +74,29 @@ private async Task ReadModelAsync()
     {
         _busy = true;
         _liveModelReady = false;
+        _inspectedLiveModel = null;
         ModelPicker.IsEnabled = false;
         UpdateWriteButton();
         StatusLabel.Text = "Reading current ctlModel…";
-        FailureDetails.Visibility = Visibility.Collapsed;
-        FailureDetails.Text = string.Empty;
+        var association = _device.LiveValues.Association;
+        var model = _device.LiveDiscoveryModel;
+        ResultBanner.Background = System.Windows.Media.Brushes.Transparent;
         try
         {
+            if (!_device.IsConnected || model is null)
+                throw new InvalidOperationException("A connected IED with verified live model is required.");
             var capabilities = await _runtime.InspectControlAsync(
                 _device.DeviceId, _signal, _cancellation.Token);
+            if (_cancellation.IsCancellationRequested || !IsLoaded)
+                return;
+            if (!_device.IsConnected || _device.LiveValues.Association != association ||
+                !ReferenceEquals(_device.LiveDiscoveryModel, model))
+            {
+                StatusLabel.Text = "IED connection or live model changed. Read again before Write.";
+                return;
+            }
+            _inspectedAssociation = association;
+            _inspectedLiveModel = model;
             _liveModel = capabilities.ControlModel;
             _liveModelReady = _liveModel != Iec61850ControlModelKind.Unknown &&
                 capabilities.EngineControlServiceAvailable;
@@ -105,63 +133,77 @@ private async void Read_Click(object sender, RoutedEventArgs e)
 
     private async void Write_Click(object sender, RoutedEventArgs e)
     {
-        if (_busy || !_liveModelReady || !_device.IsConnected ||
+        if (_busy || !_liveModelReady || !InspectionIsCurrent ||
             ModelPicker.SelectedItem is not ModelChoice selected || selected.Model == _liveModel)
             return;
-        // Exact expected value is confirmed again by ARIEC immediately before
-        // the one permitted CF Write. No automatic mode trials.
+
+        // Clicking Write is the operator's explicit action. No second modal
+        // confirmation, no automatic retry and no IEC Control Operate.
+        // Revalidate the exact association/model/selection at dispatch time.
         var expected = _liveModel;
+        if (!InspectionIsCurrent || ModelPicker.SelectedItem is not ModelChoice current ||
+            current.Model != selected.Model || _liveModel != expected)
+        {
+            _liveModelReady = false;
+            UpdateWriteButton();
+            ShowWriteFailure("IED connection or selection changed. Read again.");
+            return;
+        }
+
         _busy = true;
         _liveModelReady = false;
         ModelPicker.IsEnabled = false;
         UpdateWriteButton();
-        StatusLabel.Text = "Writing ctlModel and checking readback…";
+        StatusLabel.Text = "Writing ctlModel…";
+        ResultBanner.Background = System.Windows.Media.Brushes.Transparent;
+        string? failure = null;
+        bool verified = false;
+        WriteAttempted = true;
+        WriteAssociation = _inspectedAssociation;
         try
         {
+            // The pinned native dispatcher checks expected-old value and
+            // executes exactly one CF Write followed by MMS readback.
             var result = await ConfigureExactModelAsync(expected, selected.Model, _cancellation.Token);
-            if (!result.WriteAccepted || !result.ReadbackVerified ||
-                (int)result.AfterModel != (int)selected.Model)
-            {
-                ShowWriteFailure(result.Detail, (int)selected.Model, (int)result.AfterModel, result.ReadbackVerified);
-                return;
-            }
-
-            // The engine has completed the exact CF write and authoritative MMS readback.
-            // Do not issue a second inspection or keep the commissioning dialog open.
-            if (!_cancellation.IsCancellationRequested && IsLoaded)
-                DialogResult = true;
+            if (_cancellation.IsCancellationRequested || !IsLoaded) return;
+            verified = result.WriteAccepted && result.ReadbackVerified &&
+                (int)result.AfterModel == (int)selected.Model;
+            if (verified)
+                VerifiedWriteOccurred = true;
+            else
+                failure = string.IsNullOrWhiteSpace(result.Detail)
+                    ? "IED rejected the value or readback did not match."
+                    : result.Detail;
         }
         catch (OperationCanceledException)
         {
-            ShowWriteFailure("Connection interrupted or operation cancelled. Read actual ctlModel before retrying.");
+            failure = "Connection interrupted; Write outcome is unknown.";
         }
         catch (Exception ex)
         {
-            ShowWriteFailure($"Write not verified: {ex.Message}. Read actual ctlModel.");
+            failure = ex.Message;
         }
         finally
         {
+            WriteStatus = verified
+                ? "ctlModel Write verified; refreshing Data Model…"
+                : "ctlModel Write ditolak / unknown: " +
+                  (string.IsNullOrWhiteSpace(failure) ? "IED did not verify Write." : failure);
             _busy = false;
-            UpdateWriteButton();
+            // Browser owns the post-Write MMS Read and SSOT publication.
+            // Close the editor immediately, including on rejected Writes.
+            if (IsLoaded) Close();
         }
     }
 
-    private void ShowWriteFailure(string? detail,
-        int? expected = null,
-        int? actual = null, bool readbackVerified = false)
+    private void ShowWriteFailure(string? detail)
     {
-        if (_cancellation.IsCancellationRequested || !IsLoaded)
-            return;
-
-        var reason = string.IsNullOrWhiteSpace(detail)
-            ? "IED did not provide a verified write result."
-            : detail.Trim();
-        if (readbackVerified && expected.HasValue && actual.HasValue && expected != actual)
-            reason = $"Readback mismatch • Expected {expected.Value}, actual {actual.Value}. {reason}";
-
-        FailureDetails.Text = reason;
-        FailureDetails.Visibility = Visibility.Visible;
-        StatusLabel.Text = "Write not verified • no further write will be sent automatically.";
+        if (_cancellation.IsCancellationRequested || !IsLoaded) return;
+        var reason = string.IsNullOrWhiteSpace(detail) ? "IED did not verify Write." : detail.Trim();
+        StatusLabel.Text = "Write ditolak / belum terverifikasi: " +
+            (reason.Length > 150 ? reason[..147] + "…" : reason);
+        ResultBanner.Background = new System.Windows.Media.SolidColorBrush(
+            System.Windows.Media.Color.FromRgb(255, 242, 228));
     }
 
     // Compile-time transport bridge; no reflection or ad-hoc MMS Write.
diff --git a/IedBrowserWriteWindow.xaml b/IedBrowserWriteWindow.xaml
new file mode 100644
index 000000000..78500fdc1
--- /dev/null
+++ b/IedBrowserWriteWindow.xaml
@@ -0,0 +1,152 @@
+<Window x:Class="ArIED61850Tester.IedBrowserWriteWindow"
+        xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+        xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+        Title="Write Data to IED" Width="940" Height="520"
+        MinWidth="750" MinHeight="390" MaxHeight="780"
+        WindowStartupLocation="CenterOwner" ResizeMode="CanResize"
+        Background="#F5F7FB" FontFamily="{StaticResource AppFontFamily}"
+        Icon="Assets/app-icon.ico" Loaded="Window_Loaded" Closing="Window_Closing">
+    <Grid Margin="14,11,14,11">
+        <Grid.RowDefinitions>
+            <RowDefinition Height="Auto"/>
+            <RowDefinition Height="*" MinHeight="150"/>
+            <RowDefinition Height="Auto"/>
+        </Grid.RowDefinitions>
+        <StackPanel Grid.Row="0" Margin="1,0,1,10">
+            <TextBlock Text="Write Data to IED" FontSize="14" FontWeight="SemiBold"
+                       Foreground="#273E58"/>
+            <TextBlock x:Name="IdentityText" FontSize="11" Foreground="#5A718A"
+                       Margin="0,4,0,0" TextTrimming="CharacterEllipsis"
+                       ToolTip="{Binding Text, RelativeSource={RelativeSource Self}}"/>
+        </StackPanel>
+        <DataGrid Grid.Row="1" x:Name="WriteRowsGrid" ItemsSource="{Binding Rows}"
+                  Style="{StaticResource ModernDataGrid}"
+                  AutoGenerateColumns="False" CanUserAddRows="False" CanUserDeleteRows="False"
+                  IsReadOnly="False" RowHeight="34" ColumnHeaderHeight="30"
+                  AlternatingRowBackground="#F5F8FC"
+                  Background="White" BorderBrush="#CCD9E8"
+                  ScrollViewer.VerticalScrollBarVisibility="Auto"
+                  ScrollViewer.HorizontalScrollBarVisibility="Auto"
+                  VirtualizingPanel.IsVirtualizing="True"
+                  VirtualizingPanel.VirtualizationMode="Recycling"
+                  EnableRowVirtualization="True" MinHeight="0">
+            <DataGrid.Columns>
+                <DataGridCheckBoxColumn Header="" Binding="{Binding Selected, Mode=TwoWay}"
+                                        Width="42"/>
+                <DataGridTextColumn Header="Data Attribute" Binding="{Binding ShortName}"
+                                    Width="1.6*" MinWidth="132" IsReadOnly="True">
+                    <DataGridTextColumn.ElementStyle>
+                        <Style TargetType="TextBlock">
+                            <Setter Property="VerticalAlignment" Value="Center"/>
+                            <Setter Property="TextTrimming" Value="CharacterEllipsis"/>
+                            <Setter Property="ToolTip" Value="{Binding Reference}"/>
+                            <Setter Property="Foreground" Value="#314963"/>
+                        </Style>
+                    </DataGridTextColumn.ElementStyle>
+                </DataGridTextColumn>
+                <DataGridTextColumn Header="FC" Binding="{Binding FunctionalConstraint}"
+                                    Width="44" IsReadOnly="True"/>
+                <DataGridTextColumn Header="Current" Binding="{Binding Current}"
+                                    Width="1*" MinWidth="93" IsReadOnly="True">
+                    <DataGridTextColumn.ElementStyle>
+                        <Style TargetType="TextBlock">
+                            <Setter Property="VerticalAlignment" Value="Center"/>
+                            <Setter Property="TextTrimming" Value="CharacterEllipsis"/>
+                            <Setter Property="ToolTip" Value="{Binding Current}"/>
+                        </Style>
+                    </DataGridTextColumn.ElementStyle>
+                </DataGridTextColumn>
+                <DataGridTemplateColumn Header="Value" Width="1.45*" MinWidth="150">
+                    <DataGridTemplateColumn.CellTemplate>
+                        <DataTemplate>
+                            <Grid Margin="2,0" VerticalAlignment="Center">
+                                <TextBox x:Name="ValueEditor"
+                                         Height="27" Padding="6,3" FontSize="11"
+                                         Text="{Binding RequestedValue, Mode=TwoWay, UpdateSourceTrigger=PropertyChanged}"
+                                         Visibility="{Binding TextEditorVisibility}"
+                                         BorderBrush="#B9CCE1"
+                                         ToolTip="Edit the live value that was read from this IED"/>
+                                <ComboBox x:Name="BooleanPicker" Height="27" FontSize="11"
+                                          ItemsSource="{Binding BooleanOptions}"
+                                          SelectedItem="{Binding RequestedValue, Mode=TwoWay, UpdateSourceTrigger=PropertyChanged}"
+                                          Visibility="{Binding BooleanEditorVisibility}"
+                                          ToolTip="Choose true or false"/>
+                                <ComboBox x:Name="CtlPicker" Height="27" FontSize="11"
+                                          SelectedValue="{Binding RequestedValue, Mode=TwoWay, UpdateSourceTrigger=PropertyChanged}"
+                                          SelectedValuePath="Tag"
+                                          Visibility="{Binding CtlModelEditorVisibility}"
+                                          ToolTip="IEC 61850 ctlModel enumeration">
+                                    <ComboBoxItem Tag="0" Content="0 · status-only"/>
+                                    <ComboBoxItem Tag="1" Content="1 · direct-normal"/>
+                                    <ComboBoxItem Tag="2" Content="2 · sbo-normal"/>
+                                    <ComboBoxItem Tag="3" Content="3 · direct-enhanced"/>
+                                    <ComboBoxItem Tag="4" Content="4 · sbo-enhanced"/>
+                                </ComboBox>
+                                <TextBlock Text="{Binding PlaceholderText}" VerticalAlignment="Center"
+                                           Foreground="#8193A7" FontSize="10"
+                                           Visibility="{Binding PlaceholderVisibility}"/>
+                            </Grid>
+                        </DataTemplate>
+                    </DataGridTemplateColumn.CellTemplate>
+                </DataGridTemplateColumn>
+                <DataGridTextColumn Header="MMS type" Binding="{Binding DataType}"
+                                    Width="1*" MinWidth="88" IsReadOnly="True"/>
+                <DataGridTextColumn Header="Result" Binding="{Binding Result}"
+                                    Width="1.7*" MinWidth="145" IsReadOnly="True">
+                    <DataGridTextColumn.ElementStyle>
+                        <Style TargetType="TextBlock">
+                            <Setter Property="VerticalAlignment" Value="Center"/>
+                            <Setter Property="TextTrimming" Value="CharacterEllipsis"/>
+                            <Setter Property="ToolTip" Value="{Binding Result}"/>
+                        </Style>
+                    </DataGridTextColumn.ElementStyle>
+                </DataGridTextColumn>
+            </DataGrid.Columns>
+        </DataGrid>
+        <Grid Grid.Row="2" Margin="2,9,2,0">
+            <Grid.ColumnDefinitions>
+                <ColumnDefinition Width="*"/>
+                <ColumnDefinition Width="Auto"/>
+                <ColumnDefinition Width="Auto"/>
+                <ColumnDefinition Width="Auto"/>
+            </Grid.ColumnDefinitions>
+            <Border x:Name="ResultBanner" Grid.Column="0"
+                    Background="Transparent" CornerRadius="6"
+                    Padding="8,5" Margin="0,0,7,0">
+                <TextBlock x:Name="StatusText" Foreground="#314B63" FontSize="10.5"
+                           TextWrapping="NoWrap" TextTrimming="CharacterEllipsis"
+                           VerticalAlignment="Center"
+                           ToolTip="{Binding Text, RelativeSource={RelativeSource Self}}"
+                           Text="Reading current MMS values…"/>
+            </Border>
+            <Button Grid.Column="1" x:Name="ReadButton" Width="82" Height="32"
+                    Margin="0,0,7,0" Style="{StaticResource SoftButton}" Click="Read_Click">
+                <StackPanel Orientation="Horizontal" HorizontalAlignment="Center">
+                    <Viewbox Width="15" Height="15" Margin="0,0,5,0">
+                        <Path Data="{StaticResource MaterialRefreshIcon}" Fill="#45617C"/>
+                    </Viewbox>
+                    <TextBlock Text="Read" VerticalAlignment="Center"/>
+                </StackPanel>
+            </Button>
+            <Button Grid.Column="2" x:Name="WriteButton" Width="94" Height="32"
+                    MinHeight="32" Margin="0,0,7,0" IsEnabled="False"
+                    Style="{StaticResource PrimaryButton}" Click="Write_Click">
+                <StackPanel Orientation="Horizontal" HorizontalAlignment="Center">
+                    <Viewbox Width="16" Height="16" Margin="0,0,6,0">
+                        <Path Data="{StaticResource MaterialEditIcon}" Fill="White"/>
+                    </Viewbox>
+                    <TextBlock Text="Write" VerticalAlignment="Center"/>
+                </StackPanel>
+            </Button>
+            <Button Grid.Column="3" Width="82" Height="32"
+                    Style="{StaticResource SoftButton}" Click="Close_Click">
+                <StackPanel Orientation="Horizontal" HorizontalAlignment="Center">
+                    <Viewbox Width="12" Height="12" Margin="0,0,5,0">
+                        <Path Data="{StaticResource MaterialCloseIcon}" Fill="#415771"/>
+                    </Viewbox>
+                    <TextBlock Text="Close" VerticalAlignment="Center"/>
+                </StackPanel>
+            </Button>
+        </Grid>
+    </Grid>
+</Window>
\ No newline at end of file
diff --git a/IedBrowserWriteWindow.xaml.cs b/IedBrowserWriteWindow.xaml.cs
new file mode 100644
index 000000000..3221de18d
--- /dev/null
+++ b/IedBrowserWriteWindow.xaml.cs
@@ -0,0 +1,253 @@
+using System.Collections.ObjectModel;
+using System.ComponentModel;
+using System.Windows;
+using System.Windows.Controls;
+using AR.Iec61850.Discovery;
+using AR.Iec61850.Mms;
+using ArIED61850Tester.Models;
+using ArIED61850Tester.Services;
+
+namespace ArIED61850Tester;
+
+/// <summary>
+/// Operator-initiated IEC 61850 MMS Write dialog, not an Operate command.
+/// UI stages edits, runtime validates current association and ARIEC performs
+/// the single native wire Write with independent before/after typed MMS reads.
+/// </summary>
+public partial class IedBrowserWriteWindow : Window
+{
+    private readonly Iec61850MonitorRuntime _runtime;
+    private readonly Iec61850MonitorDevice _device;
+    private readonly LiveIedModelDiscoveryDocument _model;
+    private readonly long _association;
+    private readonly CancellationTokenSource _lifetime = new();
+    private bool _busy;
+    // A ctlModel Write may reach the wire even if cancellation hides its reply.
+    // Invalidate stale Command Dock permission on modal close in that case.
+    public HashSet<string> PotentiallyChangedControlModels { get; } =
+        new(StringComparer.OrdinalIgnoreCase);
+    public long WriteAssociation => _association;
+    public List<(string Reference, string Fc)> AttemptedLeaves { get; } = new();
+    public string WriteStatus { get; private set; } = "";
+    public ObservableCollection<IedBrowserWriteRow> Rows { get; }
+
+    public IedBrowserWriteWindow(
+        Iec61850MonitorRuntime runtime, Iec61850MonitorDevice device,
+        LiveIedModelDiscoveryDocument model, IReadOnlyList<IedBrowserWriteRow> rows)
+    {
+        _runtime = runtime ?? throw new ArgumentNullException(nameof(runtime));
+        _device = device ?? throw new ArgumentNullException(nameof(device));
+        _model = model ?? throw new ArgumentNullException(nameof(model));
+        ArgumentNullException.ThrowIfNull(rows);
+        _association = device.LiveValues.Association;
+        Rows = new ObservableCollection<IedBrowserWriteRow>(rows);
+        foreach (var row in Rows)
+            row.PropertyChanged += (_, _) => UpdateWriteEnabled();
+        InitializeComponent();
+        DataContext = this;
+        IdentityText.Text = _device.Name + " · " + _device.IpAddress +
+            " · association " + _association + " · " + Rows.Count +
+            " live-verified configuration DA(s)";
+    }
+
+    private async void Window_Loaded(object sender, RoutedEventArgs e)
+    {
+        var work = SystemParameters.WorkArea;
+        Height = Math.Max(MinHeight, Math.Min(520, work.Height - 26));
+        Width = Math.Max(MinWidth, Math.Min(940, work.Width - 26));
+        // operator-friendly editor: preload bounded current values from this live
+        // association. Read-only traffic only; never write on opening.
+        await ReadRowsAsync(Rows.Take(24).ToArray());
+    }
+
+    private void UpdateWriteEnabled()
+    {
+        if (WriteButton is null) return;
+        WriteButton.IsEnabled = !_busy && CurrentAssociation &&
+            Rows.Any(row => row.Selected && row.HasVerifiedRead && row.HasEdited);
+    }
+
+    private bool CurrentAssociation =>
+        _device.IsConnected && !_device.IsDemo &&
+        !_lifetime.IsCancellationRequested &&
+        ReferenceEquals(_device.LiveDiscoveryModel, _model) &&
+        _device.LiveValues.Association == _association;
+
+    private void SetBusy(bool busy)
+    {
+        _busy = busy;
+        ReadButton.IsEnabled = !busy;
+        UpdateWriteEnabled();
+        WriteRowsGrid.IsEnabled = !busy;
+    }
+
+    private async void Read_Click(object sender, RoutedEventArgs e)
+    {
+        if (_busy || !CurrentAssociation) return;
+        WriteRowsGrid.CommitEdit(DataGridEditingUnit.Cell, true);
+        WriteRowsGrid.CommitEdit(DataGridEditingUnit.Row, true);
+        var selected = Rows.Where(row => row.Selected).ToArray();
+        if (selected.Length == 0)
+        {
+            StatusText.Text = "Select the Data Attributes you want to read.";
+            return;
+        }
+        await ReadRowsAsync(selected);
+    }
+
+    private async Task ReadRowsAsync(IedBrowserWriteRow[] selected)
+    {
+        if (_busy || !CurrentAssociation || selected.Length == 0) return;
+        SetBusy(true);
+        try
+        {
+            var i = 0;
+            foreach (var row in selected)
+            {
+                _lifetime.Token.ThrowIfCancellationRequested();
+                if (!CurrentAssociation)
+                    throw new InvalidOperationException("IED association changed. Reopen Write.");
+                StatusText.Text = "Reading " + (++i) + "/" + selected.Length + " · " + row.ShortName;
+                var observation = await _runtime.ReadBrowserConfigurationAsync(
+                    _device.DeviceId, _model, _association, row, _lifetime.Token);
+                if (!CurrentAssociation)
+                    throw new InvalidOperationException("IED association changed. Reopen Write.");
+                if (observation.IsSuccess && observation.Value is not null)
+                {
+                    row.ApplyLiveRead(observation.Value);
+                    row.Result = "Ready to edit";
+                }
+                else
+                {
+                    row.ExpireLiveRead();
+                    row.Current = "Read unavailable";
+                    row.Result = "Read failed: " + observation.Message;
+                }
+            }
+            StatusText.Text = "Choose a value, tick its row and click Write. No Write sent.";
+        }
+        catch (OperationCanceledException)
+        {
+            StatusText.Text = "Read cancelled; no Write attempted.";
+        }
+        catch (Exception ex)
+        {
+            StatusText.Text = "Read stopped: " + ex.Message;
+        }
+        finally { SetBusy(false); }
+    }
+
+    private async void Write_Click(object sender, RoutedEventArgs e)
+    {
+        if (_busy || !CurrentAssociation) return;
+        WriteRowsGrid.CommitEdit(DataGridEditingUnit.Cell, true);
+        WriteRowsGrid.CommitEdit(DataGridEditingUnit.Row, true);
+        var selected = Rows.Where(row => row.Selected).ToArray();
+        if (selected.Length == 0)
+        {
+            StatusText.Text = "Select at least one DA; no Write was sent.";
+            return;
+        }
+        if (selected.Any(row => !row.HasVerifiedRead || !row.HasEdited ||
+                              row.LiveBeforeValue is null))
+        {
+            StatusText.Text = "Read the selected DAs and choose a different value before Write.";
+            return;
+        }
+        if (selected.Length > 16)
+        {
+            StatusText.Text = "At most 16 explicitly staged DA(s) per supervised Write. Refine the selection.";
+            return;
+        }
+
+        var staged = new List<(IedBrowserWriteRow Row, MmsDataValue Value)>();
+        try
+        {
+            foreach (var row in selected)
+            {
+                var candidate = IedBrowserWritePlan.EncodeValue(
+                    row.DataType, row.RequestedValue, row.Reference);
+                if (MmsDataCodec.Encode(candidate).AsSpan().SequenceEqual(
+                        MmsDataCodec.Encode(row.LiveBeforeValue!)))
+                {
+                    StatusText.Text = row.ShortName + ": unchanged value. No Write sent.";
+                    return;
+                }
+                staged.Add((row, candidate));
+            }
+        }
+        catch (Exception ex) when (ex is FormatException or OverflowException or NotSupportedException)
+        {
+            StatusText.Text = "Typed validation failed; zero Writes sent: " + ex.Message;
+            return;
+        }
+
+        // The enabled Write button is explicit operator intent. Native
+        // configuration admission still verifies the same association,
+        // typed before-value and readback. No second modal prompt.
+        if (!CurrentAssociation)
+        {
+            StatusText.Text = "IED connection changed; no Write sent.";
+            return;
+        }
+
+        SetBusy(true);
+        var passed = 0;
+        try
+        {
+            foreach (var (row, requested) in staged)
+            {
+                _lifetime.Token.ThrowIfCancellationRequested();
+                if (!CurrentAssociation)
+                    throw new InvalidOperationException("Live MMS association/model changed. No further Write.");
+                StatusText.Text = "Writing " + (passed + 1) + "/" + staged.Count +
+                    " · " + row.Reference;
+                row.Result = "Write / readback pending…";
+                row.ExpireLiveRead(); // each attempt requires a NEW explicit Read
+                if (row.IsControlModel)
+                    PotentiallyChangedControlModels.Add(row.Reference[..^".ctlModel".Length]);
+                AttemptedLeaves.Add((row.Reference, row.FunctionalConstraint));
+                var result = await _runtime.WriteBrowserConfigurationAsync(
+                    _device.DeviceId, _model, _association, row, requested, _lifetime.Token);
+                row.Current = result.ReadbackVerified ? result.After : result.Before;
+                row.Result = result.NoChange ? "Unchanged · verified" :
+                    result.Succeeded ? "Write + readback PASS" :
+                    "NOT VERIFIED: " + result.Detail;
+                if (!result.Succeeded)
+                {
+                    var reason = string.IsNullOrWhiteSpace(result.Detail)
+                        ? "IED refused the requested value." : result.Detail;
+                    StatusText.Text = "Write ditolak: " +
+                        (reason.Length > 130 ? reason[..127] + "…" : reason) +
+                        $" · {passed}/{staged.Count} verified. No automatic retry.";
+            ResultBanner.Background = new System.Windows.Media.SolidColorBrush(
+                System.Windows.Media.Color.FromRgb(255, 242, 228));
+                    return;
+                }
+                passed++;
+            }
+            StatusText.Text = "Verified " + passed + "/" + staged.Count +
+                " configuration DA(s) using native MMS readback. No IEC Operate issued.";
+            ResultBanner.Background = new System.Windows.Media.SolidColorBrush(
+                System.Windows.Media.Color.FromRgb(232, 248, 237));
+        }
+        catch (Exception ex)
+        {
+            StatusText.Text = "Write unresolved: " + ex.Message +
+                " · no automatic retry.";
+            ResultBanner.Background = new System.Windows.Media.SolidColorBrush(
+                System.Windows.Media.Color.FromRgb(255, 242, 228));
+        }
+        finally
+        {
+            WriteStatus = StatusText.Text;
+            SetBusy(false);
+            if (AttemptedLeaves.Count > 0 && IsLoaded) Close();
+        }
+    }
+
+    private void Close_Click(object sender, RoutedEventArgs e) => Close();
+
+    private void Window_Closing(object? sender, CancelEventArgs e)
+        => _lifetime.Cancel();
+}
diff --git a/IoListTestingWindow.CommandPanel.cs b/IoListTestingWindow.CommandPanel.cs
index d08372f69..39c615c36 100644
--- a/IoListTestingWindow.CommandPanel.cs
+++ b/IoListTestingWindow.CommandPanel.cs
@@ -371,7 +371,7 @@ private FatCommandRowView BuildFatCommandRow(SignalDefinition signal)
         row.ColumnDefinitions.Add(new ColumnDefinition { Width = new GridLength(1.55, GridUnitType.Star), MinWidth = 190 });
 
         var reference = FatCommandText(signal.ObjectReference, 11.0, FontWeights.SemiBold);
-        reference.FontFamily = new FontFamily("Cascadia Mono, Consolas");
+        reference.FontFamily = new FontFamily(new Uri("pack://application:,,,/"), "./Assets/Fonts/#Inter");
         reference.ToolTip = signal.ObjectReference;
         AddFatCommandCell(row, reference, 0);
 
diff --git a/IoListTestingWindow.FatV2Ux.cs b/IoListTestingWindow.FatV2Ux.cs
index 8f73887a1..440d579a8 100644
--- a/IoListTestingWindow.FatV2Ux.cs
+++ b/IoListTestingWindow.FatV2Ux.cs
@@ -171,7 +171,7 @@ private static DataGridTextColumn TextColumn(
         style.Setters.Add(new Setter(TextBlock.FontSizeProperty, 11.2));
         style.Setters.Add(new Setter(TextBlock.ForegroundProperty, new SolidColorBrush(Color.FromRgb(68, 84, 107))));
         if (monospace)
-            style.Setters.Add(new Setter(TextBlock.FontFamilyProperty, new FontFamily("Cascadia Mono, Consolas")));
+            style.Setters.Add(new Setter(TextBlock.FontFamilyProperty, new FontFamily(new Uri("pack://application:,,,/"), "./Assets/Fonts/#Inter")));
 
         return new DataGridTextColumn
         {
@@ -234,7 +234,7 @@ private DataGridTemplateColumn CreateValueColumn(FatValueSlot slot)
             ? nameof(IoTestPointPlan.Value1RelayTimestampText)
             : nameof(IoTestPointPlan.Value2RelayTimestampText)));
         timestamp.SetValue(TextBlock.FontSizeProperty, 8.8);
-        timestamp.SetValue(TextBlock.FontFamilyProperty, new FontFamily("Cascadia Mono, Consolas"));
+        timestamp.SetValue(TextBlock.FontFamilyProperty, new FontFamily(new Uri("pack://application:,,,/"), "./Assets/Fonts/#Inter"));
         timestamp.SetValue(TextBlock.ForegroundProperty, new SolidColorBrush(Color.FromRgb(112, 126, 145)));
         panel.AppendChild(timestamp);
 
diff --git a/IoListTestingWindow.P0BenchUx.cs b/IoListTestingWindow.P0BenchUx.cs
index acac468e1..7ed4a6535 100644
--- a/IoListTestingWindow.P0BenchUx.cs
+++ b/IoListTestingWindow.P0BenchUx.cs
@@ -145,7 +145,7 @@ private static DataTemplate BuildP0EvidenceValueTemplate(FatValueSlot slot)
             ? nameof(IoTestPointPlan.Value1RelayTimestampText)
             : nameof(IoTestPointPlan.Value2RelayTimestampText)));
         timestamp.SetValue(TextBlock.FontSizeProperty, 8.8);
-        timestamp.SetValue(TextBlock.FontFamilyProperty, new FontFamily("Cascadia Mono, Consolas"));
+        timestamp.SetValue(TextBlock.FontFamilyProperty, new FontFamily(new Uri("pack://application:,,,/"), "./Assets/Fonts/#Inter"));
         timestamp.SetValue(TextBlock.ForegroundProperty, new SolidColorBrush(Color.FromRgb(112, 126, 145)));
         panel.AppendChild(timestamp);
 
diff --git a/IoListTestingWindow.PrintPreview.cs b/IoListTestingWindow.PrintPreview.cs
index e968eaf0f..21081eb76 100644
--- a/IoListTestingWindow.PrintPreview.cs
+++ b/IoListTestingWindow.PrintPreview.cs
@@ -435,7 +435,7 @@ private static DataTemplate CenteredTemplate(
         text.SetValue(TextBlock.FontSizeProperty, fontSize);
         text.SetValue(TextBlock.FontWeightProperty, fontWeight);
         if (mono)
-            text.SetValue(TextBlock.FontFamilyProperty, new FontFamily("Cascadia Mono, Consolas"));
+            text.SetValue(TextBlock.FontFamilyProperty, new FontFamily(new Uri("pack://application:,,,/"), "./Assets/Fonts/#Inter"));
         return new DataTemplate { VisualTree = text };
     }
 
diff --git a/IpConnectWizardWindow.xaml b/IpConnectWizardWindow.xaml
index 44e76c3e6..92ae8f411 100644
--- a/IpConnectWizardWindow.xaml
+++ b/IpConnectWizardWindow.xaml
@@ -1,8 +1,8 @@
 <Window x:Class="ArIED61850Tester.IpConnectWizardWindow"
         xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
         xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
-        Title="Add IEC 61850 IED" Width="700" MinWidth="640" MaxHeight="620"
-        SizeToContent="Height" WindowStartupLocation="CenterOwner"
+        Title="Add IEC 61850 IED" Width="480" Height="350" MinWidth="480" MaxWidth="480"
+        SizeToContent="Manual" WindowStartupLocation="CenterOwner"
         ResizeMode="NoResize" ShowInTaskbar="False"
         Background="{DynamicResource TaskDialogCanvas}"
         FontFamily="{DynamicResource AppFontFamily}" Icon="Assets/app-icon.ico">
@@ -11,12 +11,126 @@
             <ResourceDictionary.MergedDictionaries>
                 <ResourceDictionary Source="Styles/IedTaskDialogStyles.xaml"/>
             </ResourceDictionary.MergedDictionaries>
+
+            <Style x:Key="SmartIpOctet" TargetType="{x:Type TextBox}">
+                <Setter Property="Width" Value="38"/>
+                <Setter Property="Height" Value="32"/>
+                <Setter Property="MaxLength" Value="3"/>
+                <Setter Property="Padding" Value="1,4"/>
+                <Setter Property="FontSize" Value="13"/>
+                <Setter Property="FontWeight" Value="Medium"/>
+                <Setter Property="FontFamily" Value="{DynamicResource AppFontFamily}"/>
+                <Setter Property="TextAlignment" Value="Center"/>
+                <Setter Property="VerticalContentAlignment" Value="Center"/>
+                <Setter Property="BorderThickness" Value="0"/>
+                <Setter Property="Background" Value="Transparent"/>
+                <Setter Property="Foreground" Value="{StaticResource TaskDialogInk}"/>
+                <Setter Property="CaretBrush" Value="{DynamicResource Accent}"/>
+                <Setter Property="InputMethod.IsInputMethodEnabled" Value="False"/>
+                <EventSetter Event="PreviewTextInput" Handler="Octet_PreviewTextInput"/>
+                <EventSetter Event="PreviewKeyDown" Handler="Octet_PreviewKeyDown"/>
+                <EventSetter Event="TextChanged" Handler="Octet_TextChanged"/>
+            </Style>
+            <Style x:Key="SmartIpDot" TargetType="{x:Type TextBlock}">
+                <Setter Property="Foreground" Value="{StaticResource TaskDialogMuted}"/>
+                <Setter Property="FontSize" Value="13"/>
+                <Setter Property="VerticalAlignment" Value="Center"/>
+                <Setter Property="TextAlignment" Value="Center"/>
+                <Setter Property="Width" Value="7"/>
+                <Setter Property="Margin" Value="0"/>
+            </Style>
+            <Style x:Key="SmartIpHistoryButton" TargetType="{x:Type Button}">
+                <Setter Property="Cursor" Value="Hand"/>
+                <Setter Property="Background" Value="Transparent"/>
+                <Setter Property="BorderThickness" Value="0"/>
+                <Setter Property="Template">
+                    <Setter.Value>
+                        <ControlTemplate TargetType="{x:Type Button}">
+                            <Border x:Name="HistoryChrome" Background="{TemplateBinding Background}"
+                                    CornerRadius="0,8,8,0">
+                                <!-- Google Material Icons: expand_circle_down (24dp). -->
+                                <Path Data="M12,2 C6.48,2 2,6.48 2,12 C2,17.52 6.48,22 12,22 C17.52,22 22,17.52 22,12 C22,6.48 17.52,2 12,2 Z M12,16.5 L6,10.5 7.41,9.09 12,13.67 16.59,9.09 18,10.5 Z"
+                                      Width="20" Height="20" Stretch="Uniform"
+                                      Fill="{StaticResource TaskDialogMuted}"
+                                      HorizontalAlignment="Center" VerticalAlignment="Center"/>
+                            </Border>
+                            <ControlTemplate.Triggers>
+                                <Trigger Property="IsMouseOver" Value="True">
+                                    <Setter TargetName="HistoryChrome" Property="Background" Value="#ECF3FF"/>
+                                </Trigger>
+                                <Trigger Property="IsKeyboardFocused" Value="True">
+                                    <Setter TargetName="HistoryChrome" Property="Background" Value="#ECF3FF"/>
+                                </Trigger>
+                            </ControlTemplate.Triggers>
+                        </ControlTemplate>
+                    </Setter.Value>
+                </Setter>
+            </Style>
+            <!-- Own the disclosure chrome instead of the default black circular
+                 WPF Expander arrow; retain native IsExpanded and keyboard behavior. -->
+            <Style x:Key="SmartIpOptionsExpander" TargetType="{x:Type Expander}">
+                <Setter Property="Template">
+                    <Setter.Value>
+                        <ControlTemplate TargetType="{x:Type Expander}">
+                            <StackPanel>
+                                <ToggleButton x:Name="AdvancedToggle"
+                                              AutomationProperties.Name="Advanced settings"
+                                              HorizontalAlignment="Left" Cursor="Hand"
+                                              IsChecked="{Binding IsExpanded, RelativeSource={RelativeSource TemplatedParent}, Mode=TwoWay}">
+                                    <ToggleButton.Template>
+                                        <ControlTemplate TargetType="{x:Type ToggleButton}">
+                                            <Border x:Name="Chrome" CornerRadius="6" Padding="2,5"
+                                                    Background="Transparent">
+                                                <StackPanel Orientation="Horizontal">
+                                                    <!-- Same Material circle-chevron as the IP history control. -->
+                                                    <Path x:Name="AdvancedChevron"
+                                                          Data="M12,2 C6.48,2 2,6.48 2,12 C2,17.52 6.48,22 12,22 C17.52,22 22,17.52 22,12 C22,6.48 17.52,2 12,2 Z M12,16.5 L6,10.5 7.41,9.09 12,13.67 16.59,9.09 18,10.5 Z"
+                                                          Width="17" Height="17" Stretch="Uniform"
+                                                          RenderTransformOrigin="0.5,0.5"
+                                                          Fill="{StaticResource TaskDialogMuted}"
+                                                          VerticalAlignment="Center"/>
+                                                    <TextBlock Text="Advanced settings"
+                                                               Margin="8,0,0,0" FontSize="11.5"
+                                                               Foreground="{StaticResource TaskDialogMuted}"
+                                                               VerticalAlignment="Center"/>
+                                                </StackPanel>
+                                            </Border>
+                                            <ControlTemplate.Triggers>
+                                                <Trigger Property="IsChecked" Value="True">
+                                                    <Setter TargetName="AdvancedChevron" Property="RenderTransform">
+                                                        <Setter.Value>
+                                                            <RotateTransform Angle="180"/>
+                                                        </Setter.Value>
+                                                    </Setter>
+                                                </Trigger>
+                                                <Trigger Property="IsMouseOver" Value="True">
+                                                    <Setter TargetName="Chrome" Property="Background" Value="#EAF2FF"/>
+                                                </Trigger>
+                                                <Trigger Property="IsKeyboardFocused" Value="True">
+                                                    <Setter TargetName="Chrome" Property="Background" Value="#EAF2FF"/>
+                                                </Trigger>
+                                            </ControlTemplate.Triggers>
+                                        </ControlTemplate>
+                                    </ToggleButton.Template>
+                                </ToggleButton>
+                                <ContentPresenter x:Name="ExpandSite" ContentSource="Content"
+                                                  Visibility="Collapsed"/>
+                            </StackPanel>
+                            <ControlTemplate.Triggers>
+                                <Trigger Property="IsExpanded" Value="True">
+                                    <Setter TargetName="ExpandSite" Property="Visibility" Value="Visible"/>
+                                </Trigger>
+                            </ControlTemplate.Triggers>
+                        </ControlTemplate>
+                    </Setter.Value>
+                </Setter>
+            </Style>
         </ResourceDictionary>
     </Window.Resources>
 
     <ScrollViewer VerticalScrollBarVisibility="Auto" HorizontalScrollBarVisibility="Disabled"
                   Focusable="False">
-        <Grid Margin="24,22,24,22">
+        <Grid Margin="24,19,24,18">
             <Grid.RowDefinitions>
                 <RowDefinition Height="Auto"/>
                 <RowDefinition Height="Auto"/>
@@ -24,74 +138,170 @@
             </Grid.RowDefinitions>
 
             <StackPanel>
-                <TextBlock Text="Add IEC 61850 IED" Style="{StaticResource TaskDialogHeading}"/>
-                <TextBlock Margin="0,5,0,0" Style="{StaticResource TaskDialogSubtitle}"
-                           Text="Enter the IED IP address to connect and discover available signals."/>
+                <TextBlock Text="Connect to IED" FontSize="17" FontWeight="SemiBold"
+                           Foreground="{StaticResource TaskDialogInk}"/>
+                <TextBlock Text="Enter the IP address of your device."
+                           Margin="0,4,0,0" FontSize="11.5"
+                           Foreground="{StaticResource TaskDialogMuted}"/>
             </StackPanel>
 
-            <Border Grid.Row="1" Margin="0,18,0,0" Style="{StaticResource TaskDialogCardStyle}">
+            <StackPanel Grid.Row="1" Margin="0,21,0,0">
+                <TextBlock Text="IP address" FontSize="12" FontWeight="SemiBold"
+                           Foreground="{StaticResource TaskDialogInk}" Margin="0,0,0,8"/>
                 <Grid>
-                    <Grid.RowDefinitions>
-                        <RowDefinition Height="Auto"/>
-                        <RowDefinition Height="Auto"/>
-                        <RowDefinition Height="Auto"/>
-                    </Grid.RowDefinitions>
-                    <Grid.ColumnDefinitions>
-                        <ColumnDefinition Width="*"/>
-                        <ColumnDefinition Width="14"/>
-                        <ColumnDefinition Width="128"/>
-                    </Grid.ColumnDefinitions>
-
-                    <StackPanel Grid.Row="0" Grid.Column="0">
-                        <TextBlock Text="IED IP Address" Style="{StaticResource TaskDialogFieldLabel}"
-                                   Margin="0,0,0,7"/>
-                        <ComboBox x:Name="RelayIpBox" Height="40" MinWidth="0"
-                                  Foreground="{StaticResource TaskDialogInk}"
-                                  Background="{StaticResource TaskDialogCard}"
-                                  BorderBrush="{StaticResource TaskDialogBorder}"
-                                  IsEditable="True" IsTextSearchEnabled="False"
-                                  HorizontalContentAlignment="Center" VerticalContentAlignment="Center"
-                                  Loaded="RelayIpBox_Loaded"
-                                  ToolTip="Enter a new IP address or choose a previously saved address"
-                                  ItemsSource="{Binding RecentRelayIps, RelativeSource={RelativeSource AncestorType=Window}}"
-                                  Text="{Binding RelayIpAddress, RelativeSource={RelativeSource AncestorType=Window}, UpdateSourceTrigger=LostFocus}"/>
-                    </StackPanel>
-                    <StackPanel Grid.Row="0" Grid.Column="2">
-                        <TextBlock Text="MMS Port" Style="{StaticResource TaskDialogFieldLabel}"
-                                   Margin="0,0,0,7"/>
-                        <TextBox Height="40" VerticalContentAlignment="Center"
-                                 Padding="9,5" Foreground="{StaticResource TaskDialogInk}"
-                                 Background="{StaticResource TaskDialogCard}"
-                                 BorderBrush="{StaticResource TaskDialogBorder}"
-                                 ToolTip="IEC 61850 MMS normally uses TCP port 102"
-                                 Text="{Binding MmsPortText, RelativeSource={RelativeSource AncestorType=Window}, UpdateSourceTrigger=PropertyChanged}"/>
-                    </StackPanel>
+                    <Border x:Name="IpEditorHost" Width="265" Height="43" HorizontalAlignment="Left" CornerRadius="9"
+                            BorderThickness="1" Background="{StaticResource TaskDialogCard}">
+                        <Border.Style>
+                            <Style TargetType="Border">
+                                <Setter Property="BorderBrush" Value="{StaticResource TaskDialogBorder}"/>
+                                <Style.Triggers>
+                                    <Trigger Property="IsMouseOver" Value="True">
+                                        <Setter Property="BorderBrush" Value="#A4BAD3"/>
+                                    </Trigger>
+                                    <Trigger Property="IsKeyboardFocusWithin" Value="True">
+                                        <Setter Property="BorderBrush" Value="{DynamicResource Accent}"/>
+                                    </Trigger>
+                                </Style.Triggers>
+                            </Style>
+                        </Border.Style>
+                        <Grid>
+                            <Grid.ColumnDefinitions>
+                                <ColumnDefinition Width="*"/>
+                                <ColumnDefinition Width="1"/>
+                                <ColumnDefinition Width="40"/>
+                            </Grid.ColumnDefinitions>
+                            <StackPanel x:Name="OctetEditor" Orientation="Horizontal"
+                                        HorizontalAlignment="Center"
+                                        VerticalAlignment="Center">
+                                <TextBox x:Name="Octet1Box" Style="{StaticResource SmartIpOctet}"
+                                         AutomationProperties.Name="IP address, group 1"/>
+                                <TextBlock Text="." Style="{StaticResource SmartIpDot}"/>
+                                <TextBox x:Name="Octet2Box" Style="{StaticResource SmartIpOctet}"
+                                         AutomationProperties.Name="IP address, group 2"/>
+                                <TextBlock Text="." Style="{StaticResource SmartIpDot}"/>
+                                <TextBox x:Name="Octet3Box" Style="{StaticResource SmartIpOctet}"
+                                         AutomationProperties.Name="IP address, group 3"/>
+                                <TextBlock Text="." Style="{StaticResource SmartIpDot}"/>
+                                <TextBox x:Name="Octet4Box" Style="{StaticResource SmartIpOctet}"
+                                         AutomationProperties.Name="IP address, group 4"/>
+                            </StackPanel>
+                            <Border Grid.Column="1" Height="20"
+                                    Background="{StaticResource TaskDialogBorder}"
+                                    VerticalAlignment="Center"/>
+                            <Button x:Name="HistoryButton" Grid.Column="2"
+                                    Style="{StaticResource SmartIpHistoryButton}"
+                                    ToolTip="Choose a recently entered address"
+                                    AutomationProperties.Name="Recent IP addresses"
+                                    Click="HistoryButton_Click"/>
+                        </Grid>
+                    </Border>
+                    <TextBox x:Name="RawIpBox" Width="265" Height="43" HorizontalAlignment="Left" Padding="12,7"
+                             VerticalContentAlignment="Center" Visibility="Collapsed"
+                             FontSize="13"
+                             Foreground="{StaticResource TaskDialogInk}"
+                             Background="{StaticResource TaskDialogCard}"
+                             BorderBrush="{StaticResource TaskDialogBorder}"
+                             Text="{Binding RelayIpAddress, RelativeSource={RelativeSource AncestorType=Window}, UpdateSourceTrigger=LostFocus}"
+                             ToolTip="Enter an IP address manually"
+                             AutomationProperties.Name="Manual IP address"/>
+                </Grid>
 
-                    <Border Grid.Row="1" Grid.ColumnSpan="3" Margin="0,16,0,0"
-                            Background="{StaticResource TaskDialogHintSurface}"
-                            BorderBrush="{StaticResource TaskDialogHintBorder}"
-                            BorderThickness="1" CornerRadius="10" Padding="12,11">
+                <Popup x:Name="HistoryPopup" PlacementTarget="{Binding ElementName=IpEditorHost}"
+                       Placement="Bottom" VerticalOffset="4" AllowsTransparency="True"
+                       StaysOpen="False" PopupAnimation="Fade">
+                    <Border Width="{Binding ActualWidth, ElementName=IpEditorHost}"
+                            MaxHeight="240" CornerRadius="10" Background="White"
+                            BorderThickness="1" BorderBrush="{StaticResource TaskDialogBorder}"
+                            Padding="10" SnapsToDevicePixels="True">
+                        <Border.Effect>
+                            <DropShadowEffect Color="#25334D" BlurRadius="12" ShadowDepth="3" Opacity="0.15"/>
+                        </Border.Effect>
                         <StackPanel>
-                            <TextBlock Text="Smart discovery" FontSize="12.5" FontWeight="SemiBold"
+                            <TextBlock Text="Recent addresses" Margin="5,0,0,7"
+                                       FontFamily="{DynamicResource AppFontFamily}"
+                                       FontSize="11.5" FontWeight="SemiBold"
                                        Foreground="{StaticResource TaskDialogInk}"/>
-                            <TextBlock Margin="0,3,0,0" Style="{StaticResource TaskDialogSubtitle}"
-                                       Text="Reads the live DataSets and RCBs, and restores saved signal choices."/>
+                            <TextBox x:Name="HistorySearchBox" Height="33" Padding="9,5"
+                                     FontFamily="{DynamicResource AppFontFamily}"
+                                     VerticalContentAlignment="Center" FontSize="12"
+                                     Background="#F8FAFD"
+                                     BorderBrush="{StaticResource TaskDialogBorder}"
+                                     ToolTip="Filter saved IP addresses"
+                                     AutomationProperties.Name="Search saved addresses"
+                                     TextChanged="HistorySearchBox_TextChanged"
+                                     PreviewKeyDown="HistorySearchBox_PreviewKeyDown"/>
+                            <ListBox x:Name="HistoryListBox" MaxHeight="158" Margin="0,5,0,0"
+                                     FontFamily="{DynamicResource AppFontFamily}"
+                                     FontSize="12" BorderThickness="0" Background="Transparent"
+                                     ScrollViewer.HorizontalScrollBarVisibility="Disabled"
+                                     MouseLeftButtonUp="HistoryListBox_MouseLeftButtonUp"
+                                     PreviewKeyDown="HistoryListBox_PreviewKeyDown">
+                                <ListBox.ItemTemplate>
+                                    <DataTemplate>
+                                        <StackPanel Margin="7,5">
+                                            <TextBlock Text="{Binding IpAddress}" FontSize="12.5"
+                                                       FontWeight="Medium"
+                                                       Foreground="{StaticResource TaskDialogInk}"/>
+                                            <TextBlock Text="{Binding Subtitle}" FontSize="11"
+                                                       Foreground="{StaticResource TaskDialogMuted}"/>
+                                        </StackPanel>
+                                    </DataTemplate>
+                                </ListBox.ItemTemplate>
+                            </ListBox>
+                            <TextBlock x:Name="HistoryEmptyText" Margin="7,8,0,3"
+                                       FontFamily="{DynamicResource AppFontFamily}"
+                                       Text="No matching addresses" Visibility="Collapsed"
+                                       Style="{StaticResource TaskDialogSubtitle}"/>
                         </StackPanel>
                     </Border>
+                </Popup>
 
-                    <TextBlock x:Name="WizardStatusText" Grid.Row="2" Grid.ColumnSpan="3"
-                               Margin="0,12,0,0" Style="{StaticResource TaskDialogError}"
-                               AutomationProperties.LiveSetting="Assertive"/>
-                </Grid>
-            </Border>
+                <TextBlock x:Name="AddressHintText" Text="Example: 192.168.1.10"
+                           FontSize="11" Margin="2,7,0,0"
+                           Foreground="{StaticResource TaskDialogMuted}"/>
 
-            <StackPanel Grid.Row="2" Orientation="Horizontal" HorizontalAlignment="Right"
-                        Margin="0,18,0,0">
-                <Button Content="Cancel" Style="{StaticResource TaskDialogFooterButton}"
-                        Click="Cancel_Click" IsCancel="True" Margin="0,0,10,0"/>
-                <Button Content="Connect &amp; Discover" Style="{StaticResource TaskDialogSubmitAction}"
-                        MinWidth="174" MinHeight="38" IsDefault="True" Click="Connect_Click"/>
+                <Expander x:Name="MoreOptionsExpander" Margin="0,12,0,0"
+                          Style="{StaticResource SmartIpOptionsExpander}"
+                          AutomationProperties.Name="Advanced connection settings">
+                    <StackPanel Margin="2,9,0,0">
+                        <TextBlock Text="Port" FontSize="11"
+                                   Foreground="{StaticResource TaskDialogMuted}"
+                                   Margin="0,0,0,5"/>
+                        <Border Width="96" Height="36" HorizontalAlignment="Left"
+                                Background="{StaticResource TaskDialogCard}"
+                                BorderBrush="{StaticResource TaskDialogBorder}"
+                                BorderThickness="1" CornerRadius="9">
+                            <TextBox x:Name="MmsPortBox" BorderThickness="0"
+                                     Background="Transparent" Padding="10,5"
+                                     FontSize="12" VerticalContentAlignment="Center"
+                                     Foreground="{StaticResource TaskDialogInk}"
+                                     ToolTip="Default port: 102"
+                                     Text="{Binding MmsPortText, RelativeSource={RelativeSource AncestorType=Window}, UpdateSourceTrigger=PropertyChanged}"/>
+                        </Border>
+                    </StackPanel>
+                </Expander>
+
+                <TextBlock x:Name="WizardStatusText" Margin="2,9,0,0"
+                           Style="{StaticResource TaskDialogError}"
+                           AutomationProperties.LiveSetting="Assertive"/>
             </StackPanel>
+
+            <Grid Grid.Row="2" Margin="0,20,0,0">
+                <Grid.RowDefinitions>
+                    <RowDefinition Height="1"/>
+                    <RowDefinition Height="Auto"/>
+                </Grid.RowDefinitions>
+                <Border Background="{StaticResource TaskDialogBorder}" Opacity="0.7"/>
+                <StackPanel Grid.Row="1" Orientation="Horizontal"
+                            HorizontalAlignment="Right" Margin="0,13,0,0">
+                    <Button Content="Cancel" Style="{StaticResource TaskDialogFooterButton}"
+                            MinHeight="36" MinWidth="92" Padding="14,7"
+                            Click="Cancel_Click" IsCancel="True" Margin="0,0,9,0"/>
+                    <Button Content="Connect" Style="{StaticResource TaskDialogSubmitAction}"
+                            MinWidth="114" MinHeight="36" Padding="16,7"
+                            IsDefault="True" Click="Connect_Click"/>
+                </StackPanel>
+            </Grid>
         </Grid>
     </ScrollViewer>
 </Window>
diff --git a/IpConnectWizardWindow.xaml.cs b/IpConnectWizardWindow.xaml.cs
index da52f2cae..6ec671606 100644
--- a/IpConnectWizardWindow.xaml.cs
+++ b/IpConnectWizardWindow.xaml.cs
@@ -1,7 +1,12 @@
 using System.Collections.ObjectModel;
+using System.ComponentModel;
 using System.Globalization;
+using System.Net;
+using System.Net.Sockets;
 using System.Windows;
 using System.Windows.Controls;
+using System.Windows.Data;
+using System.Windows.Input;
 using ArIED61850Tester.Services;
 
 namespace ArIED61850Tester;
@@ -9,10 +14,12 @@ namespace ArIED61850Tester;
 public partial class IpConnectWizardWindow : Window
 {
     public static readonly DependencyProperty RelayIpAddressProperty = DependencyProperty.Register(
-        nameof(RelayIpAddress), typeof(string), typeof(IpConnectWizardWindow), new PropertyMetadata(string.Empty));
+        nameof(RelayIpAddress), typeof(string), typeof(IpConnectWizardWindow),
+        new PropertyMetadata(string.Empty));
 
     public static readonly DependencyProperty MmsPortTextProperty = DependencyProperty.Register(
-        nameof(MmsPortText), typeof(string), typeof(IpConnectWizardWindow), new PropertyMetadata("102"));
+        nameof(MmsPortText), typeof(string), typeof(IpConnectWizardWindow),
+        new PropertyMetadata("102"));
 
     public string RelayIpAddress
     {
@@ -27,70 +34,347 @@ public string MmsPortText
     }
 
     private readonly bool _rememberDiscoveryEndpoint;
+    private readonly ICollectionView _historyView;
+    private bool _updatingOctets;
+    private bool _rawAddressMode;
     public int MmsPort { get; private set; } = 102;
-    public ObservableCollection<string> RecentRelayIps { get; } = new();
+
+    // UI projection ONLY; UserPreferenceStore remains the sole persistence authority.
+    public ObservableCollection<UserPreferenceStore.RecentEndpointDetail> RecentEndpointDetails { get; } = new();
 
     public IpConnectWizardWindow(string initialIp = "", int initialPort = 102,
         bool preferLastDiscoveryEndpoint = false)
     {
         _rememberDiscoveryEndpoint = preferLastDiscoveryEndpoint;
         InitializeComponent();
-        foreach (var endpoint in UserPreferenceStore.LoadRecentEndpoints())
-            RecentRelayIps.Add(endpoint);
 
-        // This dialog is reused from several workspace actions. The last
-        // explicitly confirmed address, not a selected card or hardcoded NIC,
-        // is the primary suggestion for the next IP Discovery action.
+        foreach (var endpoint in UserPreferenceStore.LoadRecentEndpointDetails())
+            RecentEndpointDetails.Add(endpoint);
+
+        _historyView = CollectionViewSource.GetDefaultView(RecentEndpointDetails);
+        _historyView.Filter = item =>
+        {
+            if (item is not UserPreferenceStore.RecentEndpointDetail e) return false;
+            var term = HistorySearchBox.Text.Trim();
+            return term.Length == 0 ||
+                   e.IpAddress.Contains(term, StringComparison.OrdinalIgnoreCase) ||
+                   e.IedName.Contains(term, StringComparison.OrdinalIgnoreCase);
+        };
+        HistoryListBox.ItemsSource = _historyView;
+
+        var selectedIp = initialIp?.Trim() ?? string.Empty;
+        var selectedPort = initialPort is > 0 and <= 65535 ? initialPort : 102;
         if (_rememberDiscoveryEndpoint &&
             UserPreferenceStore.TryLoadLastDiscoveryEndpoint(out var lastIp, out var lastPort))
         {
-            RelayIpAddress = lastIp;
-            MmsPortText = lastPort.ToString(CultureInfo.InvariantCulture);
+            selectedIp = lastIp;
+            selectedPort = lastPort;
+        }
+        MmsPortText = selectedPort.ToString(CultureInfo.InvariantCulture);
+        ApplyAddress(selectedIp);
+        // Never conceal a nonstandard port in the collapsed expert section.
+        if (selectedPort != 102)
+            MoreOptionsExpander.IsExpanded = true;
+
+        foreach (var box in Octets)
+            DataObject.AddPastingHandler(box, Octet_Pasting);
+
+        Loaded += (_, _) =>
+        {
+            if (_rawAddressMode) RawIpBox.Focus();
+            else Octet1Box.Focus();
+        };
+    }
+
+    private TextBox[] Octets => [Octet1Box, Octet2Box, Octet3Box, Octet4Box];
+
+    private static bool IsValidPartialOctet(string text)
+        => text.Length <= 3 &&
+           (text.Length == 0 ||
+            (text.All(ch => ch is >= '0' and <= '9') &&
+             int.TryParse(text, NumberStyles.None, CultureInfo.InvariantCulture, out var value) &&
+             value <= 255));
+
+    internal static bool TryNormalizeIpv4Octets(
+        IReadOnlyList<string> octets, out string address)
+    {
+        address = string.Empty;
+        if (octets.Count != 4) return false;
+        var values = new int[4];
+        for (int i = 0; i < 4; i++)
+        {
+            var text = octets[i];
+            if (string.IsNullOrEmpty(text) ||
+                text.Length > 3 ||
+                !text.All(ch => ch is >= '0' and <= '9') ||
+                !int.TryParse(text, NumberStyles.None, CultureInfo.InvariantCulture, out values[i]) ||
+                values[i] is < 0 or > 255)
+                return false;
+        }
+        address = string.Join(".", values);
+        return IPAddress.TryParse(address, out var parsed) &&
+               parsed.AddressFamily == AddressFamily.InterNetwork;
+    }
+
+    internal static bool TrySplitIpv4(string source, out string[] octets)
+    {
+        octets = [];
+        var parts = source.Trim().Split('.');
+        if (!TryNormalizeIpv4Octets(parts, out var normalized)) return false;
+        octets = normalized.Split('.');
+        return true;
+    }
+
+    private void ApplyAddress(string address)
+    {
+        RelayIpAddress = address;
+        if (TrySplitIpv4(address, out var parts))
+        {
+            _rawAddressMode = false;
+            _updatingOctets = true;
+            try
+            {
+                var boxes = Octets;
+                for (int i = 0; i < 4; i++) boxes[i].Text = parts[i];
+            }
+            finally { _updatingOctets = false; }
+            SetAddressMode(false);
+        }
+        else if (!string.IsNullOrWhiteSpace(address))
+        {
+            _rawAddressMode = true;
+            RawIpBox.Text = address;
+            SetAddressMode(true);
         }
         else
         {
-            RelayIpAddress = initialIp?.Trim() ?? string.Empty;
-            MmsPortText = (initialPort is > 0 and <= 65535 ? initialPort : 102)
-                .ToString(CultureInfo.InvariantCulture);
+            _rawAddressMode = false;
+            _updatingOctets = true;
+            try { foreach (var box in Octets) box.Clear(); }
+            finally { _updatingOctets = false; }
+            SetAddressMode(false);
         }
-        Loaded += (_, _) => RelayIpBox.Focus();
+        WizardStatusText.Text = string.Empty;
     }
 
-    // WPF's editable ComboBox displays text in a templated TextBox, not directly
-    // in its selection presenter. Apply alignment to both modes while preserving
-    // the theme template, keyboard editing, focus and recent-address binding.
-    private void RelayIpBox_Loaded(object sender, RoutedEventArgs e)
+    private void SetAddressMode(bool manual)
     {
-        if (RelayIpBox.Template.FindName("PART_EditableTextBox", RelayIpBox) is TextBox editor)
+        IpEditorHost.Visibility = manual ? Visibility.Collapsed : Visibility.Visible;
+        OctetEditor.Visibility = manual ? Visibility.Collapsed : Visibility.Visible;
+        HistoryButton.Visibility = manual ? Visibility.Collapsed : Visibility.Visible;
+        RawIpBox.Visibility = manual ? Visibility.Visible : Visibility.Collapsed;
+        _rawAddressMode = manual;
+        AddressHintText.Text = manual
+            ? "Enter the address exactly as provided."
+            : "Example: 192.168.1.10";
+    }
+
+    private int OctetIndex(TextBox box) => Array.IndexOf(Octets, box);
+
+    private void FocusOctet(int index, bool atEnd = false)
+    {
+        var boxes = Octets;
+        if (index < 0 || index >= boxes.Length) return;
+        var box = boxes[index];
+        box.Focus();
+        box.CaretIndex = atEnd ? box.Text.Length : 0;
+        if (!atEnd) box.SelectAll();
+    }
+
+    private void Octet_PreviewTextInput(object sender, TextCompositionEventArgs e)
+    {
+        if (sender is not TextBox box) return;
+        if (e.Text == ".")
+        {
+            e.Handled = true;
+            FocusOctet(OctetIndex(box) + 1);
+            return;
+        }
+        var replacement = box.Text.Remove(box.SelectionStart, box.SelectionLength)
+            .Insert(box.SelectionStart, e.Text);
+        if (!IsValidPartialOctet(replacement))
         {
-            editor.TextAlignment = TextAlignment.Center;
-            editor.HorizontalContentAlignment = HorizontalAlignment.Center;
-            editor.VerticalContentAlignment = VerticalAlignment.Center;
+            e.Handled = true;
+            WizardStatusText.Text = "Each number must be between 0 and 255.";
         }
     }
 
-    private void Connect_Click(object sender, RoutedEventArgs e)
+    private void Octet_PreviewKeyDown(object sender, KeyEventArgs e)
+    {
+        if (sender is not TextBox box) return;
+        var index = OctetIndex(box);
+        if (e.Key is Key.OemPeriod or Key.Decimal)
+        {
+            FocusOctet(index + 1);
+            e.Handled = true;
+        }
+        else if (e.Key == Key.Back && box.SelectionLength == 0 && box.CaretIndex == 0 && index > 0)
+        {
+            var previous = Octets[index - 1];
+            if (previous.Text.Length != 0)
+                previous.Text = previous.Text[..^1];
+            FocusOctet(index - 1, atEnd: true);
+            e.Handled = true;
+        }
+        else if (e.Key == Key.Left && box.SelectionLength == 0 && box.CaretIndex == 0 && index > 0)
+        {
+            FocusOctet(index - 1, atEnd: true);
+            e.Handled = true;
+        }
+        else if (e.Key == Key.Right && box.SelectionLength == 0 &&
+                 box.CaretIndex == box.Text.Length && index < 3)
+        {
+            FocusOctet(index + 1);
+            e.Handled = true;
+        }
+    }
+
+    private void Octet_TextChanged(object sender, TextChangedEventArgs e)
+    {
+        if (_updatingOctets || sender is not TextBox box) return;
+        WizardStatusText.Text = string.Empty;
+        if (box.Text.Length == 3 && IsValidPartialOctet(box.Text) &&
+            box.IsKeyboardFocusWithin)
+            FocusOctet(OctetIndex(box) + 1);
+    }
+
+    private void Octet_Pasting(object sender, DataObjectPastingEventArgs e)
     {
-        // Editable ComboBox commits its binding on LostFocus. Enter can submit
-        // while the editor still owns focus: read the live text to avoid stale IPs.
-        RelayIpAddress = RelayIpBox.Text.Trim();
-        if (!System.Net.IPAddress.TryParse(RelayIpAddress, out _))
+        if (sender is not TextBox box ||
+            !e.SourceDataObject.GetDataPresent(DataFormats.UnicodeText))
         {
-            WizardStatusText.Text = "Enter a valid IPv4 or IPv6 address.";
-            RelayIpBox.Focus();
+            e.CancelCommand();
             return;
         }
 
-        if (!int.TryParse(MmsPortText, NumberStyles.Integer, CultureInfo.InvariantCulture, out var port) || port is <= 0 or > 65535)
+        var pasted = (e.SourceDataObject.GetData(DataFormats.UnicodeText) as string ?? "").Trim();
+        if (pasted.Contains('.'))
         {
-            WizardStatusText.Text = "MMS port must be between 1 and 65535. Standard IEC 61850 MMS uses TCP 102.";
+            e.CancelCommand();
+            if (TrySplitIpv4(pasted, out _))
+            {
+                ApplyAddress(pasted);
+                FocusOctet(3, atEnd: true);
+            }
+            else
+                WizardStatusText.Text = "Paste a full IP address, for example 192.168.1.10.";
             return;
         }
 
-        MmsPort = port;
+        var next = box.Text.Remove(box.SelectionStart, box.SelectionLength)
+            .Insert(box.SelectionStart, pasted);
+        if (!IsValidPartialOctet(next))
+        {
+            e.CancelCommand();
+            WizardStatusText.Text = "Each number must be between 0 and 255.";
+        }
+    }
+
+    private void HistoryButton_Click(object sender, RoutedEventArgs e)
+    {
+        HistoryPopup.IsOpen = !HistoryPopup.IsOpen;
+        if (HistoryPopup.IsOpen)
+        {
+            HistorySearchBox.Clear();
+            _historyView.Refresh();
+            HistorySearchBox.Focus();
+        }
+    }
+
+    private void HistorySearchBox_TextChanged(object sender, TextChangedEventArgs e)
+    {
+        _historyView?.Refresh();
+        if (HistoryEmptyText is not null)
+            HistoryEmptyText.Visibility = _historyView?.IsEmpty == true
+                ? Visibility.Visible : Visibility.Collapsed;
+    }
+
+    private void HistorySearchBox_PreviewKeyDown(object sender, KeyEventArgs e)
+    {
+        if (e.Key == Key.Down && !_historyView.IsEmpty)
+        {
+            HistoryListBox.SelectedIndex = 0;
+            HistoryListBox.Focus();
+            e.Handled = true;
+        }
+        else if (e.Key == Key.Escape)
+        {
+            HistoryPopup.IsOpen = false;
+            e.Handled = true;
+        }
+        else if (e.Key == Key.Enter && !_historyView.IsEmpty)
+        {
+            HistoryListBox.SelectedIndex = 0;
+            CommitHistorySelection();
+            e.Handled = true;
+        }
+    }
+
+    private void HistoryListBox_MouseLeftButtonUp(object sender, MouseButtonEventArgs e)
+        => CommitHistorySelection();
+
+    private void HistoryListBox_PreviewKeyDown(object sender, KeyEventArgs e)
+    {
+        if (e.Key == Key.Enter)
+        {
+            CommitHistorySelection();
+            e.Handled = true;
+        }
+        else if (e.Key == Key.Escape)
+        {
+            HistoryPopup.IsOpen = false;
+            e.Handled = true;
+        }
+    }
+
+    private void CommitHistorySelection()
+    {
+        if (HistoryListBox.SelectedItem is not UserPreferenceStore.RecentEndpointDetail selection)
+            return;
+        ApplyAddress(selection.IpAddress);
+        // Selecting history restores the exact saved IP:port, even when unverified.
+        // This is recall only; the connection still requires explicit submission.
+        MmsPortText = selection.MmsPort.ToString(CultureInfo.InvariantCulture);
+        if (selection.MmsPort != 102)
+            MoreOptionsExpander.IsExpanded = true;
+        HistoryPopup.IsOpen = false;
+        if (_rawAddressMode) RawIpBox.Focus();
+        else Octet1Box.Focus();
+        // Recalling an endpoint is UI-only. Only Connect_Click submits.
+    }
+
+    private void Connect_Click(object sender, RoutedEventArgs e)
+    {
+        string submittedAddress;
+        if (_rawAddressMode)
+        {
+            submittedAddress = RawIpBox.Text.Trim();
+            if (!IPAddress.TryParse(submittedAddress, out _))
+            {
+                WizardStatusText.Text = "Enter a valid IP address.";
+                RawIpBox.Focus();
+                return;
+            }
+        }
+        else
+        {
+            if (!TryNormalizeIpv4Octets(Octets.Select(b => b.Text).ToArray(), out submittedAddress))
+            {
+                WizardStatusText.Text = "Enter all four parts of the IP address (0–255).";
+                return;
+            }
+        }
+
+        if (!int.TryParse(MmsPortText, NumberStyles.Integer, CultureInfo.InvariantCulture,
+                out var port) || port is <= 0 or > 65535)
+        {
+            WizardStatusText.Text =
+                "Port must be between 1 and 65535.";
+            return;
+        }
 
-        // Persist the operator's valid *submission*, not only a successful
-        // MMS association. Cancel/invalid inputs never overwrite the last IP.
+        RelayIpAddress = submittedAddress;
+        MmsPort = port;
         if (_rememberDiscoveryEndpoint)
         {
             try
@@ -99,7 +383,6 @@ private void Connect_Click(object sender, RoutedEventArgs e)
             }
             catch (Exception ex) when (ex is System.IO.IOException or UnauthorizedAccessException)
             {
-                // Preference storage must never prevent an intentional connection.
                 System.Diagnostics.Debug.WriteLine($"Discovery address could not be saved: {ex.Message}");
             }
         }
diff --git a/MainWindow.CommandPanelUx.cs b/MainWindow.CommandPanelUx.cs
index ee907c8cd..c851893cf 100644
--- a/MainWindow.CommandPanelUx.cs
+++ b/MainWindow.CommandPanelUx.cs
@@ -296,7 +296,10 @@ private async Task PreloadControlModelsAsync()
             do
             {
                 _controlModelPreloadPending = false;
-                foreach (var device in Devices.Where(device => device.IsConnected && device.SelectedControlSignalCount > 0))
+                foreach (var device in Devices.Where(device => device.IsConnected &&
+                    (device.SelectedControlSignalCount > 0 ||
+                     (device.LiveDiscoveryModel is not null && device.Signals.Any(
+                         signal => signal.HasControlServiceEvidence && signal.IsValidControlObject)))))
             {
                 foreach (var signal in device.Signals.Where(signal => signal.IsSelected && signal.IsValidControlObject))
                     EnsureDefaultControlSafetyChecks(signal);
@@ -306,12 +309,32 @@ private async Task PreloadControlModelsAsync()
                 if (device.CommandSignals.Any(signal => signal.ControlCommandBusy))
                     continue;
 
-                // Cache aliases of the same DataObject share one ctlModel probe.
-                var candidates = Iec61850ControlIdentity.InspectionRepresentatives(device.Signals);
+                // Fast read-only ctlModel scan across ALL DOs with actual CO/CF
+                // evidence. A prefixed GE switch, a TapChg or any vendor DO is
+                // admitted identically. Selected commissioning rows remain
+                // inspectable, but only verified operable controls enter Dock.
+                var selectedCandidates = Iec61850ControlIdentity
+                    .InspectionRepresentatives(device.Signals);
+                var independentControls = device.LiveDiscoveryModel is not null
+                    ? Iec61850ControlIdentity.DiscoveredControlInspectionCandidates(device.Signals)
+                    : [];
+                var candidates = selectedCandidates.Concat(independentControls)
+                    .Where(signal => !signal.ControlModelResolved)
+                    .DistinctBy(signal => Iec61850ControlIdentity.Normalize(signal.ObjectReference),
+                        StringComparer.OrdinalIgnoreCase)
+                    .OrderByDescending(signal => signal.IsSelected)
+                    .ThenBy(Iec61850ControlIdentity.ControlInspectionPriority)
+                    .ToArray();
 
                 if (candidates.Length == 0)
                     continue;
 
+                // Bound presentation work without waiting for every control in
+                // a large IED to finish its serialized, read-only inspection.
+                // Only a newly VERIFIED operable DO schedules a projection.
+                // Unchanged/status-only candidates never churn DataGrid rows.
+                var inspectedSinceProjection = 0;
+                var hasNewVerifiedControl = false;
                 foreach (var signal in candidates)
                 {
                     // A single MMS association already serializes all reads.
@@ -330,9 +353,32 @@ private async Task PreloadControlModelsAsync()
                     signal.ControlInspectionBusy = true;
                     try
                     {
+                        // One cheap CF Read before any expensive Oper/SBOw
+                        // descriptor acquisition. Never inspect status-only,
+                        // unsupported or unreadable models as an executable DO.
+                        var probe = await _runtime.ProbeControlModelAsync(
+                            device.DeviceId, signal, _applicationCancellation.Token);
+                        if (!probe.Decoded)
+                        {
+                            signal.ControlInspectionEvidence = probe.Detail;
+                            signal.ControlModelText = "Unknown";
+                            continue;
+                        }
+                        // Do not publish a partially validated positive ctlModel.
+                        // The full inspection publishes its typed evidence in one
+                        // step; otherwise buttons/rows briefly enable and then
+                        // disable whenever the user reopens the Command Dock.
+                        // StatusOnly is conclusive, safe read-only evidence.
+                        if (probe.ControlModel is AR.Iec61850.Control.Iec61850ControlModel.StatusOnly
+                            or AR.Iec61850.Control.Iec61850ControlModel.Unknown)
+                        {
+                            signal.ControlModelText = probe.ControlModel.ToString();
+                            signal.ControlInspectionEvidence = probe.Detail;
+                            continue;
+                        }
+
                         var capabilities = await _runtime.InspectControlAsync(
-                            device.DeviceId,
-                            signal,
+                            device.DeviceId, signal,
                             _applicationCancellation.Token);
 
                         if (!signal.ControlCommandBusy)
@@ -361,9 +407,27 @@ private async Task PreloadControlModelsAsync()
                     {
                         signal.ControlInspectionBusy = false;
                     }
+
+                    hasNewVerifiedControl |= signal.ControlSupportsOperate;
+                    if (++inspectedSinceProjection >= 16)
+                    {
+                        if (hasNewVerifiedControl && device.IsConnected)
+                            device.RefreshCommandSignalProjection();
+                        hasNewVerifiedControl = false;
+                        inspectedSinceProjection = 0;
+                    }
                 }
 
+                    // Final trailing group, or genuine revocation. The
+                    // identity-preserving projection emits no collection events
+                    // when neither membership nor order changed.
                     device.RefreshCommandSignalProjection();
+                    // On first live proof XCBR/CSWI rows may be inserted before
+                    // hundreds of GGIO rows while the DataGrid keeps its
+                    // previous scroll anchor. Show the actual equipment instead.
+                    if (ReferenceEquals(SelectedDevice, device) &&
+                        CommandPanelExpander?.IsExpanded == true)
+                        ScrollVerifiedEquipmentCommandsIntoView();
                     RebuildControlFeedbackIndex(device);
                 }
             }
diff --git a/MainWindow.GooseSubscriber.cs b/MainWindow.GooseSubscriber.cs
index 0feab44ce..f8eef05d4 100644
--- a/MainWindow.GooseSubscriber.cs
+++ b/MainWindow.GooseSubscriber.cs
@@ -452,7 +452,10 @@ private void FlushGooseSubscriberUi()
 
         var processed = 0;
         var scopeIdentityChanged = false;
-        foreach (var pair in _pendingGooseFrames.ToArray())
+        // ConcurrentDictionary iteration is safe while ingress continues.
+        // Stop after 64 entries rather than copying the entire pending GOOSE
+        // dictionary into a new array on each WPF Dispatcher tick.
+        foreach (var pair in _pendingGooseFrames)
         {
             if (processed >= 64)
                 break;
diff --git a/MainWindow.IecNaturalSort.cs b/MainWindow.IecNaturalSort.cs
index 3bf13d4f3..ff042ca99 100644
--- a/MainWindow.IecNaturalSort.cs
+++ b/MainWindow.IecNaturalSort.cs
@@ -2,6 +2,7 @@
 using System.Collections;
 using System.ComponentModel;
 using System.Windows;
+using System.Windows.Threading;
 using System.Windows.Controls;
 using System.Windows.Data;
 using ArIED61850Tester.Models;
@@ -16,9 +17,14 @@ namespace ArIED61850Tester;
 public partial class MainWindow
 {
     private readonly HashSet<DataGrid> _iecNaturallySortedGrids = new();
+    private bool _globalNaturalSortThresholdQueued;
+    private bool _globalNaturalSortLargeMode;
 
     private void ExplorerLiveGrid_Loaded(object sender, RoutedEventArgs e)
-        => AttachIecNaturalGridSort(sender as DataGrid, IecNaturalLiveMonitorSort.Instance);
+    {
+        AttachLivePointViewportPriority(sender as DataGrid);
+        AttachIecNaturalGridSort(sender as DataGrid, IecNaturalLiveMonitorSort.Instance);
+    }
 
     private void CommandGrid_Loaded(object sender, RoutedEventArgs e)
     {
@@ -29,7 +35,10 @@ private void CommandGrid_Loaded(object sender, RoutedEventArgs e)
     }
 
     private void GlobalLiveGrid_Loaded(object sender, RoutedEventArgs e)
-        => AttachIecNaturalGridSort(sender as DataGrid, IecNaturalGlobalMonitorSort.Instance);
+    {
+        AttachLivePointViewportPriority(sender as DataGrid);
+        AttachIecNaturalGridSort(sender as DataGrid, IecNaturalGlobalMonitorSort.Instance);
+    }
 
     private void AttachIecNaturalGridSort(DataGrid? grid, IComparer comparer)
     {
@@ -40,6 +49,27 @@ private void AttachIecNaturalGridSort(DataGrid? grid, IComparer comparer)
                 ItemsControl.ItemsSourceProperty, typeof(DataGrid));
             descriptor?.AddValueChanged(grid, (_, _) =>
                 grid.Dispatcher.BeginInvoke(new Action(() => ApplyIecNaturalSort(grid, comparer))));
+
+            if (ReferenceEquals(grid, GlobalLiveGrid))
+            {
+                // Source instance stays stable as device sets grow/shrink.
+                // Re-evaluate only when crossing the 2048-point threshold;
+                // not for each of the next 32,900 incoming point additions.
+                _globalNaturalSortLargeMode = GlobalPoints.Count > 2048;
+                GlobalPoints.CollectionChanged += (_, _) =>
+                {
+                    if ((GlobalPoints.Count > 2048) == _globalNaturalSortLargeMode ||
+                        _globalNaturalSortThresholdQueued)
+                        return;
+                    _globalNaturalSortThresholdQueued = true;
+                    grid.Dispatcher.BeginInvoke(DispatcherPriority.Background, new Action(() =>
+                    {
+                        _globalNaturalSortThresholdQueued = false;
+                        _globalNaturalSortLargeMode = GlobalPoints.Count > 2048;
+                        ApplyIecNaturalSort(grid, comparer);
+                    }));
+                };
+            }
         }
         ApplyIecNaturalSort(grid, comparer);
     }
@@ -47,8 +77,21 @@ private void AttachIecNaturalGridSort(DataGrid? grid, IComparer comparer)
     private static void ApplyIecNaturalSort(DataGrid grid, IComparer comparer)
     {
         if (grid.ItemsSource is null) return;
+        // WPF CustomSort performs O(N log N) work synchronously on the Dispatcher.
+        // Both process grids can hold SG7-size models (Global may contain 4 IEDs).
+        // Preserve stable source order for large lists, without changing IEC
+        // DataSet/FCDA order. Command Dock ALWAYS retains its verified ordering.
         if (CollectionViewSource.GetDefaultView(grid.ItemsSource) is not ListCollectionView view)
             return;
+        if ((grid.Name is "ExplorerLiveValuesGrid" or "GlobalLiveGrid") &&
+            grid.ItemsSource is ICollection { Count: > 2048 })
+        {
+            // A live collection may grow past the threshold AFTER a previous
+            // small-grid CustomSort was installed. Remove only our own sorter.
+            if (ReferenceEquals(view.CustomSort, comparer))
+                view.CustomSort = null;
+            return;
+        }
         if (ReferenceEquals(view.CustomSort, comparer)) return;
         view.SortDescriptions.Clear();
         view.CustomSort = comparer;
diff --git a/MainWindow.IedBrowser.AsyncDetails.cs b/MainWindow.IedBrowser.AsyncDetails.cs
new file mode 100644
index 000000000..9e4a34bea
--- /dev/null
+++ b/MainWindow.IedBrowser.AsyncDetails.cs
@@ -0,0 +1,74 @@
+using AR.Iec61850.Discovery;
+using ArIED61850Tester.Models;
+using ArIED61850Tester.Services;
+
+namespace ArIED61850Tester;
+
+public partial class MainWindow
+{
+    // One CPU-heavy details projection at a time; rapid IED/LN switching
+    // never creates an unbounded pool of concurrent schema traversal workers.
+    private readonly SemaphoreSlim _iedBrowserDetailBuildGate = new(1, 1);
+    private int _iedBrowserDetailBuildGeneration;
+
+    private async Task BuildIedBrowserDetailsAsync(
+        IedBrowserTreeRow page, LiveIedModelDiscoveryDocument? model,
+        LiveIedModelDiscoveryDocument? designModel,
+        Iec61850MonitorDevice? owner, bool connected,
+        string detailStatus, int generation, long association)
+    {
+        try
+        {
+            await _iedBrowserDetailBuildGate.WaitAsync(_applicationCancellation.Token);
+            IReadOnlyList<IedBrowserDetailRow> rows;
+            try
+            {
+                // Before entering the worker, abandon superseded navigation.
+                if (generation != _iedBrowserDetailBuildGeneration ||
+                    !ReferenceEquals(SelectedDevice, owner) ||
+                    _applicationCancellation.IsCancellationRequested)
+                    return;
+                rows = await Task.Run(() =>
+                {
+                    using var phase = IedBrowserPerformanceProbe.Measure(
+                        "Browser.DetailsBuild", owner?.Name);
+                    return IedBrowserPresentation.Details(page, model, connected, designModel);
+                }, _applicationCancellation.Token);
+            }
+            finally
+            {
+                _iedBrowserDetailBuildGate.Release();
+            }
+
+            if (generation != _iedBrowserDetailBuildGeneration ||
+                _applicationCancellation.IsCancellationRequested ||
+                MainTabs.SelectedIndex != IedBrowserWorkspaceIndex ||
+                !ReferenceEquals(SelectedDevice, owner) ||
+                !ReferenceEquals(_iedBrowserRenderedPage, page) ||
+                owner?.LiveValues.Association != association ||
+                owner.IsConnected != connected ||
+                !ReferenceEquals(owner.LiveDiscoveryModel ?? owner.SclWorkspace?.DesignModel, model))
+                return;
+
+            IedBrowserDetailStatus.Text = detailStatus;
+            ReplaceIedBrowserDetails(rows);
+            _iedBrowserLastLiveVersion = -1;
+            RefreshIedBrowserVisibleValues();
+            RefreshIedBrowserReadButtons();
+            QueueIedBrowserFocusedRead(page);
+            QueueIedBrowserRcbFocusedRead(page);
+            if (_iedBrowserDetails.Rows.Count > 0)
+                IedBrowserDetailList.ScrollIntoView(_iedBrowserDetails.Rows[0]);
+        }
+        catch (OperationCanceledException)
+        {
+            // Closing/replacement is normal; no stale page may be published.
+        }
+        catch (Exception ex)
+        {
+            if (generation == _iedBrowserDetailBuildGeneration &&
+                ReferenceEquals(SelectedDevice, owner))
+                IedBrowserDetailStatus.Text = "Detail projection unavailable · " + ex.Message;
+        }
+    }
+}
diff --git a/MainWindow.IedBrowser.ContextControl.cs b/MainWindow.IedBrowser.ContextControl.cs
new file mode 100644
index 000000000..534f6de5f
--- /dev/null
+++ b/MainWindow.IedBrowser.ContextControl.cs
@@ -0,0 +1,167 @@
+using System.Windows;
+using AR.Iec61850.Discovery;
+using ArIED61850Tester.Models;
+
+namespace ArIED61850Tester;
+
+/// <summary>
+/// Browser Control action is a consumer of existing Command Dock live
+/// authority, NEVER a fresh speculative IED-wide lookup. The existing native
+/// ControlCommandWindow remains responsible for inspecting the live command
+/// descriptor and obtaining an explicit operator confirmation before sending.
+/// </summary>
+public partial class MainWindow
+{
+    private (SignalDefinition Signal, LiveIedDataObjectModel Object)?
+        BrowserSelectedLiveControl()
+    {
+        var device = SelectedDevice;
+        if (device is not { IsConnected: true, IsDemo: false, IsBusy: false } ||
+            device.LiveDiscoveryModel is null || device.LiveValues.IsOffline)
+            return null;
+        // A CO ctlVal leaf is a control action on its exact DO; all status
+        // leaves remain read-only. This does not send any request on selection.
+        var leaf = IedBrowserDetailList?.SelectedItem as IedBrowserDetailRow;
+        var coValue = leaf is { Kind: "Data", IsDataObject: false,
+                                FunctionalConstraint: "CO" } &&
+                      (leaf.ValueReference.EndsWith("$ctlVal", StringComparison.Ordinal) ||
+                       leaf.ValueReference.EndsWith(".ctlVal", StringComparison.Ordinal)) &&
+                      (leaf.ValueReference.Contains("$Oper$", StringComparison.Ordinal) ||
+                       leaf.ValueReference.Contains("$SBOw$", StringComparison.Ordinal) ||
+                       leaf.ValueReference.Contains(".Oper.", StringComparison.Ordinal) ||
+                       leaf.ValueReference.Contains(".SBOw.", StringComparison.Ordinal));
+        if (leaf is { Kind: "Data", IsDataObject: false } && !coValue)
+            return null;
+        var page = _iedBrowserNavigation.Current;
+        var focused = page?.Payload switch
+        {
+            LiveIedDataObjectModel obj => obj.Reference,
+            LiveIedLogicalNodeModel => _iedBrowserSelectedDoReference,
+            _ => null
+        };
+        if (string.IsNullOrWhiteSpace(focused)) return null;
+
+        var slash = focused.IndexOf('/');
+        var name = slash > 0 ? focused[(slash + 1)..] : "";
+        var dot = name.IndexOf('.');
+        if (slash < 1 || dot < 1) return null;
+
+        // Exact owner lookup within one LD/LN, not a visible-grid scan.
+        var source = device.LiveDiscoveryModel.LogicalDevices
+            .FirstOrDefault(ld =>
+                string.Equals(ld.MmsDomain, focused[..slash], StringComparison.Ordinal))?
+            .LogicalNodes.FirstOrDefault(ln =>
+                string.Equals(ln.Name, name[..dot], StringComparison.Ordinal))?
+            .DataObjects.FirstOrDefault(obj =>
+                string.Equals(obj.Reference, focused, StringComparison.Ordinal));
+        if (source is null) return null;
+        if (coValue && !source.Attributes.Any(a =>
+                a.FunctionalConstraint == "CO" &&
+                string.Equals(a.MmsReference, leaf!.ValueReference, StringComparison.Ordinal)))
+            return null;
+
+        // This collection is already filtered by the Command Dock live
+        // operational verification. All StatusOnly/unknown stay outside.
+        var candidates = device.OperableCommandSignals.Where(signal =>
+            signal.IsValidControlObject &&
+            signal.HasControlServiceEvidence &&
+            signal.ControlSemanticVerified &&
+            signal.ControlModelResolved &&
+            string.Equals(signal.ObjectReference, focused, StringComparison.Ordinal))
+            .Take(2).ToArray();
+        if (candidates.Length != 1) return null;
+        var command = candidates[0];
+        var inspected = new Iec61850ControlCapabilities
+        {
+            ObjectReference = command.ObjectReference,
+            ControlModelReference = command.ControlModelReference,
+            StatusReference = command.ControlStatusReference,
+            ControlModel = command.ControlModelKind,
+            ControlCdc = command.VerifiedLiveControlCdc,
+            CtlValSignature = command.ControlValueType,
+            EngineControlServiceAvailable = command.HasControlServiceEvidence,
+            IsOperationallyReady = command.ControlSupportsOperate
+        };
+        var allow = IedBrowserControlEligibility.Check(
+            focusIsExactDo: true, focusedReference: focused,
+            onlineDo: source, liveControl: inspected,
+            currentAssociationVerified: !device.LiveValues.IsOffline,
+            operatorAuthorized: true);
+        return allow.CanControl ? (command, source) : null;
+    }
+
+    private SignalDefinition? BrowserSelectedControlModelSignal()
+    {
+        var device = SelectedDevice;
+        if (device is not { IsConnected: true, IsDemo: false, IsBusy: false } ||
+            device.LiveDiscoveryModel is null || device.LiveValues.IsOffline ||
+            _iedBrowserReadOperation is not null)
+            return null;
+
+        if (IedBrowserDetailList?.SelectedItem is not IedBrowserDetailRow
+                { Kind: "Data", IsDataObject: false,
+                  FunctionalConstraint: "CF" } row)
+            return null;
+        if (!row.ValueReference.EndsWith("$ctlModel", StringComparison.Ordinal) &&
+            !row.ValueReference.EndsWith(".ctlModel", StringComparison.Ordinal))
+            return null;
+
+        var page = _iedBrowserNavigation.Current;
+        var focused = page?.Payload switch
+        {
+            LiveIedDataObjectModel obj => obj.Reference,
+            LiveIedLogicalNodeModel => _iedBrowserSelectedDoReference,
+            _ => null
+        };
+        if (string.IsNullOrWhiteSpace(focused)) return null;
+        var slash = focused.IndexOf('/');
+        var dot = slash < 0 ? -1 : focused.IndexOf('.', slash + 1);
+        if (slash < 1 || dot <= slash + 1) return null;
+
+        var source = device.LiveDiscoveryModel.LogicalDevices
+            .FirstOrDefault(ld => string.Equals(ld.MmsDomain, focused[..slash],
+                StringComparison.Ordinal))?
+            .LogicalNodes.FirstOrDefault(ln => string.Equals(ln.Name,
+                focused[(slash + 1)..dot], StringComparison.Ordinal))?
+            .DataObjects.FirstOrDefault(obj =>
+                string.Equals(obj.Reference, focused, StringComparison.Ordinal));
+        if (source is null || !source.Attributes.Any(attr =>
+                attr.FunctionalConstraint == "CF" &&
+                string.Equals(attr.MmsReference, row.ValueReference, StringComparison.Ordinal)))
+            return null;
+
+        return device.OperableCommandSignals.Concat(device.CommandSignals)
+            .Where(signal => signal.IsValidControlObject &&
+                string.Equals(signal.ObjectReference, focused, StringComparison.Ordinal))
+            .Distinct().FirstOrDefault();
+    }
+
+    private void RefreshIedBrowserControlButton()
+    {
+        if (IedBrowserControlButton is null) return;
+        var current = BrowserSelectedLiveControl();
+        IedBrowserControlButton.IsEnabled = current is not null;
+        IedBrowserControlButton.ToolTip = current is null
+            ? "Control disabled: focus a DO with existing live-proven ctlModel/CDC/CO. StatusOnly is never operable."
+            : "Inspect exact native IEC Control model and confirm the command explicitly; no automatic Operate.";
+    }
+
+    private void IedBrowserControl_Click(object sender, RoutedEventArgs e)
+    {
+        var control = BrowserSelectedLiveControl();
+        if (control is null || SelectedDevice is not { } device)
+        {
+            RefreshIedBrowserControlButton();
+            return;
+        }
+        // Reuse native Direct/SBO normal/enhanced safety pipeline. Its
+        // Window_Loaded explicitly re-inspects current wire authority before
+        // enabling Send Command; selection alone never issues any command.
+        var dialog = new ControlCommandWindow(_runtime, device, control.Value.Signal)
+        {
+            Owner = this
+        };
+        dialog.ShowDialog();
+        RefreshIedBrowserControlButton();
+    }
+}
diff --git a/MainWindow.IedBrowser.Performance.cs b/MainWindow.IedBrowser.Performance.cs
new file mode 100644
index 000000000..78316b4de
--- /dev/null
+++ b/MainWindow.IedBrowser.Performance.cs
@@ -0,0 +1,268 @@
+using System.Runtime.CompilerServices;
+using AR.Iec61850.Discovery;
+using AR.Iec61850.Scl.Export;
+using ArIED61850Tester.Services;
+using ArIED61850Tester.Models;
+
+namespace ArIED61850Tester;
+
+public partial class MainWindow
+{
+    private readonly IedBrowserUnitProjectionCache _iedBrowserUnitCache = new();
+    // Schema tasks are shared with Read bindings through SharedIedSchemaIndex.
+    private Task<IedBrowserSchemaIndex>? _iedBrowserAwaitedSchema;
+    private Iec61850MonitorDevice? _iedBrowserAwaitedSchemaDevice;
+    private Iec61850MonitorDevice? _iedBrowserPreparingDevice;
+    private LiveIedModelDiscoveryDocument? _iedBrowserPreparingModel;
+
+    // Keep a small bounded pool of completed/in-flight SCL inventories across
+    // IED switching: BCUGE -> SG7 -> BCUGE must not reparse unchanged SCL.
+    private readonly BoundedFifoCache<string, Task<SclReportControlInventoryResult>>
+        _iedBrowserInventoryFlights = new(8, StringComparer.Ordinal);
+    private Task<SclReportControlInventoryResult>? _iedBrowserInventoryTask;
+    private Task<SclReportControlInventoryResult>? _iedBrowserAwaitedInventory;
+    private Iec61850MonitorDevice? _iedBrowserAwaitedInventoryDevice;
+
+    private Task<IedBrowserAcceptanceMetrics>? _iedBrowserMetricsFlight;
+    private Iec61850MonitorDevice? _iedBrowserMetricsDevice;
+    private LiveIedModelDiscoveryDocument? _iedBrowserMetricsModel;
+    private long _iedBrowserMetricsAssociation;
+    private DateTime _iedBrowserMetricsStartedUtc;
+
+    private void ShowIedBrowserPreparing(Iec61850MonitorDevice device,
+        LiveIedModelDiscoveryDocument model,
+        string stage = "Indexing model on background worker…")
+    {
+        if (ReferenceEquals(_iedBrowserPreparingDevice, device) &&
+            ReferenceEquals(_iedBrowserPreparingModel, model))
+        {
+            IedBrowserDetailStatus.Text = stage;
+            return;
+        }
+        _iedBrowserPreparingDevice = device;
+        _iedBrowserPreparingModel = model;
+        // Never leave the previous IED's tree clickable during model preparation.
+        _iedBrowserNavigationRenderTicket++;
+        _iedBrowserRenderedPage = null;
+        _iedBrowserNavigation.SelectFromTree(null);
+        _iedBrowserSyncingSelection = true;
+        try
+        {
+            IedBrowserTreeGrid.SelectedItem = null;
+            _iedBrowserTree.Reset([]);
+            IedBrowserTreeGrid.ItemsSource = _iedBrowserTree.Rows;
+            ReplaceIedBrowserDetails([]);
+        }
+        finally { _iedBrowserSyncingSelection = false; }
+        IedBrowserObjectPath.Text = device.Name + " · preparing engineering model";
+        IedBrowserDetailStatus.Text = stage;
+    }
+
+    private bool TryActivateIedBrowserSchema(
+        Iec61850MonitorDevice device, LiveIedModelDiscoveryDocument? model)
+    {
+        if (ReferenceEquals(_iedBrowserValueSchemaIndex?.SourceModel, model))
+            return true;
+        if (model is null)
+        {
+            _iedBrowserValueSchemaIndex = null;
+            return true;
+        }
+        var task = SharedIedSchemaIndex.PrepareAsync(model);
+        if (task.IsCompletedSuccessfully)
+        {
+            _iedBrowserValueSchemaIndex = task.Result;
+            _iedBrowserPreparingDevice = null;
+            _iedBrowserPreparingModel = null;
+            return true;
+        }
+        ShowIedBrowserPreparing(device, model);
+        if (task.IsFaulted || task.IsCanceled)
+        {
+            IedBrowserDetailStatus.Text = "Model indexing unavailable · " +
+                (task.Exception?.GetBaseException().Message ?? "worker canceled");
+            return false;
+        }
+        if (!ReferenceEquals(_iedBrowserAwaitedSchema, task) ||
+            !ReferenceEquals(_iedBrowserAwaitedSchemaDevice, device))
+        {
+            _iedBrowserAwaitedSchema = task;
+            _iedBrowserAwaitedSchemaDevice = device;
+            _ = CompleteIedBrowserSchemaAsync(task, device, model,
+                device.LiveValues.Association);
+        }
+        return false;
+    }
+
+    private async Task CompleteIedBrowserSchemaAsync(
+        Task<IedBrowserSchemaIndex> task, Iec61850MonitorDevice device,
+        LiveIedModelDiscoveryDocument model, long association)
+    {
+        try { await task; }
+        catch (Exception) { /* The faulted state is shown by the guarded caller. */ }
+        if (_applicationCancellation.IsCancellationRequested ||
+            MainTabs.SelectedIndex != IedBrowserWorkspaceIndex ||
+            !ReferenceEquals(SelectedDevice, device) ||
+            !ReferenceEquals(device.LiveDiscoveryModel ?? device.SclWorkspace?.DesignModel, model) ||
+            device.LiveValues.Association != association)
+            return;
+        RefreshIedBrowser();
+    }
+
+    private bool TryResolveIedBrowserSclInventory(Iec61850MonitorDevice device,
+        LiveIedModelDiscoveryDocument? model, string sourcePath, DateTime sourceStamp,
+        out SclReportControlInventoryResult? inventory)
+    {
+        inventory = null;
+        if (sourceStamp == DateTime.MinValue) return true;
+        var iedName = EffectiveSclIedName(device);
+        var accessPoint = device.SclAccessPointName;
+        var key = string.Join("|", sourcePath, sourceStamp.Ticks,
+            iedName, accessPoint);
+        if (!_iedBrowserInventoryFlights.TryGetValue(key, out var task))
+        {
+            // Cache failed tasks too: bad/unavailable XML must not launch an
+            // endless retry/Refresh loop. Source stamp change or explicit
+            // operator Refresh is the only retry trigger for the same key.
+            // A completed task is reused when the operator returns to the IED.
+            task = Task.Run(() =>
+            {
+                using var measure = IedBrowserPerformanceProbe.Measure(
+                    "SCL.Inventory", device.Name);
+                return SclReportControlFilter.InspectFile(sourcePath, iedName, accessPoint);
+            });
+            _iedBrowserInventoryFlights.Set(key, task);
+        }
+        _iedBrowserInventoryTask = task;
+        if (!task.IsCompleted)
+        {
+            if (model is not null)
+                ShowIedBrowserPreparing(device, model,
+                    "Reading SCL inventory on background worker…");
+            else IedBrowserDetailStatus.Text = "Reading SCL inventory on background worker…";
+            if (!ReferenceEquals(_iedBrowserAwaitedInventory, task) ||
+                !ReferenceEquals(_iedBrowserAwaitedInventoryDevice, device))
+            {
+                _iedBrowserAwaitedInventory = task;
+                _iedBrowserAwaitedInventoryDevice = device;
+                _ = CompleteIedBrowserInventoryAsync(task, device, model,
+                    device.LiveValues.Association);
+            }
+            return false;
+        }
+        if (!task.IsCompletedSuccessfully)
+        {
+            IedBrowserDetailStatus.Text = "Source inventory unavailable · " +
+                (task.Exception?.GetBaseException().Message ?? "worker canceled");
+            return true; // Same nonfatal behavior as the previous source-file inspector.
+        }
+        inventory = task.Result;
+        return true;
+    }
+
+    private async Task CompleteIedBrowserInventoryAsync(
+        Task<SclReportControlInventoryResult> task,
+        Iec61850MonitorDevice device, LiveIedModelDiscoveryDocument? model, long association)
+    {
+        try { await task; }
+        catch (Exception) { /* Nonfatal inventory failure is displayed on next refresh. */ }
+        if (_applicationCancellation.IsCancellationRequested ||
+            MainTabs.SelectedIndex != IedBrowserWorkspaceIndex ||
+            !ReferenceEquals(SelectedDevice, device) ||
+            !ReferenceEquals(device.LiveDiscoveryModel ?? device.SclWorkspace?.DesignModel, model) ||
+            device.LiveValues.Association != association)
+            return;
+        RefreshIedBrowser();
+    }
+
+    // SSOT coverage is not a five-Hz UI task. Model declarations are indexed
+    // separately; the observation ledger itself is never copied or modified.
+    private void QueueIedBrowserAcceptanceMetrics(
+        Iec61850MonitorDevice device, LiveIedModelDiscoveryDocument model)
+    {
+        var association = device.LiveValues.Association;
+        var sameScope = ReferenceEquals(_iedBrowserMetricsDevice, device) &&
+                        ReferenceEquals(_iedBrowserMetricsModel, model) &&
+                        _iedBrowserMetricsAssociation == association;
+        if (!sameScope)
+        {
+            _iedBrowserMetricsDevice = device;
+            _iedBrowserMetricsModel = model;
+            _iedBrowserMetricsAssociation = association;
+            // A scope switch must not inherit the previous IED's five-second
+            // throttle; an older in-flight calculation may finish first.
+            _iedBrowserMetricsStartedUtc = DateTime.MinValue;
+            IedBrowserSubtitle.ToolTip = "IEC SSOT · calculating read-only coverage…";
+        }
+        if (_iedBrowserMetricsFlight is { IsCompleted: false } ||
+            (sameScope && DateTime.UtcNow - _iedBrowserMetricsStartedUtc <
+                TimeSpan.FromSeconds(5)))
+            return;
+        var failures = _iedBrowserReadFailureEvidence?.SnapshotCurrent(device, 32);
+        var enumEvidence = _iedBrowserSclEnumEvidence;
+        _iedBrowserMetricsStartedUtc = DateTime.UtcNow;
+        var flight = Task.Run(() =>
+        {
+            using var measure = IedBrowserPerformanceProbe.Measure(
+                "Metrics.Capture", device.Name);
+            return IedBrowserAcceptanceMetrics.Capture(model, device.LiveValues,
+                enumEvidence, failures);
+        });
+        _iedBrowserMetricsFlight = flight;
+        _ = PublishIedBrowserAcceptanceMetricsAsync(
+            flight, device, model, association);
+    }
+
+    // If selection changes while an old full-model coverage flight is running,
+    // schedule exactly the *latest* requested IED once that flight completes.
+    // Without this handoff a quiet IED can stay on "calculating" indefinitely.
+    private void QueuePendingIedBrowserMetricsAfter(
+        Task<IedBrowserAcceptanceMetrics> completed,
+        Iec61850MonitorDevice completedDevice,
+        LiveIedModelDiscoveryDocument completedModel, long completedAssociation)
+    {
+        if (!ReferenceEquals(_iedBrowserMetricsFlight, completed) ||
+            MainTabs.SelectedIndex != IedBrowserWorkspaceIndex ||
+            _applicationCancellation.IsCancellationRequested ||
+            SelectedDevice is not { } current)
+            return;
+        var currentModel = current.LiveDiscoveryModel;
+        if (currentModel is null ||
+            !ReferenceEquals(current, _iedBrowserMetricsDevice) ||
+            !ReferenceEquals(currentModel, _iedBrowserMetricsModel) ||
+            current.LiveValues.Association != _iedBrowserMetricsAssociation)
+            return;
+        if (ReferenceEquals(completedDevice, current) &&
+            ReferenceEquals(completedModel, currentModel) &&
+            completedAssociation == current.LiveValues.Association)
+            return;
+        QueueIedBrowserAcceptanceMetrics(current, currentModel);
+    }
+
+    private async Task PublishIedBrowserAcceptanceMetricsAsync(
+        Task<IedBrowserAcceptanceMetrics> flight,
+        Iec61850MonitorDevice device, LiveIedModelDiscoveryDocument model, long association)
+    {
+        IedBrowserAcceptanceMetrics metrics;
+        try { metrics = await flight; }
+        catch (Exception ex)
+        {
+            if (ReferenceEquals(SelectedDevice, device) &&
+                ReferenceEquals(_iedBrowserMetricsFlight, flight) &&
+                _iedBrowserMetricsAssociation == association)
+                IedBrowserSubtitle.ToolTip = "IEC SSOT coverage unavailable · " + ex.Message;
+            QueuePendingIedBrowserMetricsAfter(flight, device, model, association);
+            return;
+        }
+        QueuePendingIedBrowserMetricsAfter(flight, device, model, association);
+        if (_applicationCancellation.IsCancellationRequested ||
+            MainTabs.SelectedIndex != IedBrowserWorkspaceIndex ||
+            !ReferenceEquals(SelectedDevice, device) ||
+            !ReferenceEquals(_iedBrowserMetricsFlight, flight) ||
+            !ReferenceEquals(device.LiveDiscoveryModel, model) ||
+            device.LiveValues.Association != association)
+            return;
+        IedBrowserSubtitle.ToolTip = metrics.Summary +
+            " · sampled " + DateTime.Now.ToString("HH:mm:ss");
+    }
+}
diff --git a/MainWindow.IedBrowser.ReactiveSsot.cs b/MainWindow.IedBrowser.ReactiveSsot.cs
new file mode 100644
index 000000000..034e36587
--- /dev/null
+++ b/MainWindow.IedBrowser.ReactiveSsot.cs
@@ -0,0 +1,46 @@
+using ArIED61850Tester.Models;
+
+namespace ArIED61850Tester;
+
+public partial class MainWindow
+{
+    // Only an index of UI ROW IDENTITIES + exact IEC model dependency scopes.
+    // Observations stay exclusively in device.LiveValues. Rebuilt when the
+    // virtualized detail projection changes, never on a Report value update.
+    private CanonicalBrowserViewportIndex? _iedBrowserViewportIndex;
+    private Iec61850MonitorDevice? _iedBrowserViewportDevice;
+    private IedBrowserTreeRow? _iedBrowserViewportPage;
+
+    private void RebuildIedBrowserViewportIndex()
+    {
+        _iedBrowserViewportDevice = SelectedDevice;
+        _iedBrowserViewportPage = _iedBrowserRenderedPage;
+        _iedBrowserViewportIndex = new CanonicalBrowserViewportIndex(
+            _iedBrowserDetails.Rows);
+    }
+
+    /// <summary>
+    /// Returns null whenever the source/delta/viewport isn't fully provable:
+    /// fallback to the original complete projection. An empty set means all
+    /// changes are outside the current page, so no detail Value bindings fire.
+    /// RCB/GOOSE/SGCB have independent ownership/TTL/control state and stay on
+    /// the original refresh path regardless of the canonical ledger revision.
+    /// </summary>
+    private HashSet<IedBrowserDetailRow>? SelectIedBrowserReactiveRows(
+        Iec61850MonitorDevice device, long newestVersion)
+    {
+        if (_iedBrowserLastLiveVersion < 0 ||
+            _iedBrowserLastLiveVersion >= newestVersion ||
+            !ReferenceEquals(_iedBrowserLastCfCanonicalModel, device.LiveCanonicalModel) ||
+            !ReferenceEquals(_iedBrowserViewportDevice, device) ||
+            !ReferenceEquals(_iedBrowserViewportPage, _iedBrowserRenderedPage) ||
+            _iedBrowserRenderedPage?.Kind is "RCB" or "GoCB" or "SGCB" ||
+            _iedBrowserViewportIndex is not { } index)
+            return null;
+
+        var changes = device.LiveValues.ReadChanges(
+            _iedBrowserLastLiveVersion, maxChanges: 4096);
+        return index.TryFindDirtyRows(changes, newestVersion, out var dirty)
+            ? dirty : null;
+    }
+}
diff --git a/MainWindow.IedBrowser.TypedDataWrite.cs b/MainWindow.IedBrowser.TypedDataWrite.cs
new file mode 100644
index 000000000..d755b9216
--- /dev/null
+++ b/MainWindow.IedBrowser.TypedDataWrite.cs
@@ -0,0 +1,273 @@
+using System.Windows;
+using System.Windows.Controls;
+using AR.Iec61850.Discovery;
+using AR.Iec61850.Mms;
+using ArIED61850Tester.Models;
+
+namespace ArIED61850Tester;
+
+public partial class MainWindow
+{
+    /// <summary>
+    /// Only the currently selected, exact model-declared DA may enter the
+    /// explicit staged write dialog. Selection does NOT contact MMS.
+    /// Bounded to the visible LN/DO; never enumerate all IED rows.
+    /// </summary>
+    private LiveIedDataAttributeModel? BrowserWritableSelectedAttribute()
+    {
+        if (SelectedDevice is not { IsConnected: true, IsDemo: false, IsBusy: false,
+                                   IsBrowserReading: false } device ||
+            device.LiveDiscoveryModel is null ||
+            _iedBrowserReadOperation is not null ||
+            IedBrowserDetailList?.SelectedItem is not IedBrowserDetailRow
+            {
+                Kind: "Data", IsDataObject: false
+            } row ||
+            string.IsNullOrWhiteSpace(row.ValueReference) ||
+            row.FunctionalConstraint is not ("CF" or "SP" or "DC"))
+            return null;
+
+        var page = _iedBrowserNavigation.Current;
+        LiveIedDataObjectModel? owner = page?.Payload switch
+        {
+            LiveIedDataObjectModel obj => obj,
+            LiveIedLogicalNodeModel ln when
+                !string.IsNullOrWhiteSpace(_iedBrowserSelectedDoReference) =>
+                ln.DataObjects.FirstOrDefault(obj =>
+                    string.Equals(obj.Reference, _iedBrowserSelectedDoReference,
+                        StringComparison.Ordinal)),
+            _ => null
+        };
+        if (owner is null) return null;
+
+        var model = device.LiveDiscoveryModel;
+        // A navigated page or reconnected model cannot lend authority to
+        // stale row objects. Resolve exact owner in CURRENT live LD/LN.
+        var slash = owner.Reference.IndexOf('/');
+        var dotted = slash < 0 ? "" : owner.Reference[(slash + 1)..];
+        var dot = dotted.IndexOf('.');
+        if (slash < 1 || dot < 1) return null;
+        var domain = owner.Reference[..slash];
+        var lnName = dotted[..dot];
+        var liveOwner = model.LogicalDevices
+            .FirstOrDefault(ld => string.Equals(ld.MmsDomain, domain, StringComparison.Ordinal))?
+            .LogicalNodes.FirstOrDefault(ln => string.Equals(ln.Name, lnName, StringComparison.Ordinal))?
+            .DataObjects.FirstOrDefault(obj => string.Equals(obj.Reference, owner.Reference, StringComparison.Ordinal));
+        if (liveOwner is null) return null;
+        // Never treat a synthetic parent display/reference as a selected
+        // leaf. The clicked row must expose the EXACT MMS DA identity from
+        // live discovery, not a canonicalised proxy/engineering projection.
+        var candidates = liveOwner.Attributes.Where(attr =>
+                string.Equals(attr.FunctionalConstraint, row.FunctionalConstraint,
+                    StringComparison.OrdinalIgnoreCase) &&
+                string.Equals(attr.MmsReference, row.ValueReference,
+                    StringComparison.Ordinal))
+            .Take(2).ToArray();
+        if (candidates.Length != 1) return null; // duplicates are ambiguous.
+        var exact = candidates[0];
+        var reference = MmsObjectReference.Parse(
+            exact.MmsReference, exact.FunctionalConstraint);
+        var parts = reference.Item.Split('$');
+        if (parts.Length < 4 ||
+            !string.Equals(parts[1], reference.FunctionalConstraint,
+                StringComparison.OrdinalIgnoreCase) ||
+            parts.Skip(2).Any(x => x is "Oper" or "SBO" or "SBOw" or "Cancel" or "ctlModel"))
+            return null;
+        return exact;
+    }
+
+    // A DO focus has a bounded local list of live attributes, never an IED-wide scan.
+    // The dialog checks the exact same current live model and association again.
+    private LiveIedDataObjectModel? BrowserWritableSelectedDo(bool allowLeafSelection = false)
+    {
+        if (SelectedDevice is not { IsConnected: true, IsDemo: false, IsBusy: false,
+                                   IsBrowserReading: false } device ||
+            device.LiveValues.IsOffline || device.LiveDiscoveryModel is null ||
+            _iedBrowserReadOperation is not null)
+            return null;
+        // A focused status-only DA cannot borrow its parent DO's writable siblings.
+        if (!allowLeafSelection && IedBrowserDetailList?.SelectedItem is IedBrowserDetailRow
+            { Kind: "Data", IsDataObject: false })
+            return null;
+
+        var page = _iedBrowserNavigation.Current;
+        var focused = page?.Payload switch
+        {
+            LiveIedDataObjectModel obj => obj.Reference,
+            LiveIedLogicalNodeModel when !string.IsNullOrWhiteSpace(_iedBrowserSelectedDoReference)
+                => _iedBrowserSelectedDoReference,
+            _ => null
+        };
+        if (string.IsNullOrWhiteSpace(focused)) return null;
+        var slash = focused.IndexOf('/');
+        var dot = slash < 0 ? -1 : focused.IndexOf('.', slash + 1);
+        if (slash < 1 || dot <= slash + 1) return null;
+
+        var owner = device.LiveDiscoveryModel.LogicalDevices
+            .FirstOrDefault(ld => string.Equals(ld.MmsDomain, focused[..slash], StringComparison.Ordinal))?
+            .LogicalNodes.FirstOrDefault(ln => string.Equals(ln.Name,
+                focused[(slash + 1)..dot], StringComparison.Ordinal))?
+            .DataObjects.FirstOrDefault(obj => string.Equals(obj.Reference, focused, StringComparison.Ordinal));
+        if (owner is null || owner.Attributes.Count is 0 or > 256) return null;
+
+        return owner.Attributes.Any(a =>
+            a.FunctionalConstraint is "CF" or "SP" or "DC" &&
+            !string.IsNullOrWhiteSpace(a.MmsReference) &&
+            !a.MmsReference.Contains("$Oper", StringComparison.Ordinal) &&
+            !a.MmsReference.Contains("$SBO", StringComparison.Ordinal) &&
+            !a.MmsReference.EndsWith("$ctlModel", StringComparison.Ordinal))
+            ? owner : null;
+    }
+
+    private void RefreshIedBrowserWriteButton()
+    {
+        if (IedBrowserWriteButton is null || IedBrowserWriteDoButton is null) return;
+        // Multi-DA Write is an independent explicit DO action, available
+        // even if the operator has a leaf such as ctlModel selected.
+        IedBrowserWriteDoButton.IsEnabled =
+            BrowserWritableSelectedDo(allowLeafSelection: true) is not null;
+        var ctlModel = BrowserSelectedControlModelSignal();
+        var selected = ctlModel is null ? BrowserWritableSelectedAttribute() : null;
+        var selectedDo = ctlModel is null && selected is null ? BrowserWritableSelectedDo() : null;
+        IedBrowserWriteButton.IsEnabled =
+            ctlModel is not null || selected is not null || selectedDo is not null;
+        // Keep the Material-pencil + Write visual from XAML intact.
+        // Refresh selection changes only Enabled/ToolTip, never Button.Content.
+        IedBrowserWriteButton.ToolTip = ctlModel is not null
+            ? "Read live ctlModel, choose IEC enum 0–4, confirm a guarded CF Write and verify readback."
+            : selected is not null
+                ? "Exact DA: inspect live GVA, review old/new and confirm one MMS Write."
+                : selectedDo is not null
+                    ? "Exact DO: select changed attributes, inspect and confirm sequential non-atomic Writes."
+                    : "Select an exact CF/SP/DC DA, ctlModel CF leaf or owning DO. CO members use Control.";
+    }
+
+    private void IedBrowserDetailList_SelectionChanged(
+        object sender, SelectionChangedEventArgs e)
+    {
+        if (ReferenceEquals(sender, IedBrowserDetailList))
+        {
+            RefreshIedBrowserWriteButton();
+            RefreshIedBrowserControlButton();
+        }
+    }
+
+    private void IedBrowserWrite_Click(object sender, RoutedEventArgs e)
+    {
+        var device = SelectedDevice;
+        var modelSignal = BrowserSelectedControlModelSignal();
+        var attribute = modelSignal is null ? BrowserWritableSelectedAttribute() : null;
+        var owner = modelSignal is null && attribute is null ? BrowserWritableSelectedDo() : null;
+        if (device is null || (modelSignal is null && attribute is null && owner is null))
+        {
+            IedBrowserSubtitle.Text =
+                "Write requires a current online CF/SP/DC attribute or exact owning DO.";
+            RefreshIedBrowserWriteButton();
+            return;
+        }
+
+        if (modelSignal is not null)
+        {
+            // Route ctlModel through the existing dedicated engine service,
+            // not generic CF Write and NEVER through CO Operate.
+            var dialog = new ControlModelWriteWindow(_runtime, device, modelSignal)
+            {
+                Owner = this
+            };
+            dialog.ShowDialog();
+            if (dialog.WriteAttempted && device.LiveDiscoveryModel is { } model)
+                QueueIedBrowserPostWriteRead(device, model, dialog.WriteAssociation,
+                    new[] { (Reference: modelSignal.ObjectReference + ".ctlModel", Fc: "CF") },
+                    dialog.WriteStatus);
+            if (dialog.VerifiedWriteOccurred && device.IsConnected)
+                _ = RefreshControlValuesAsync(device, force: true);
+        }
+        else if (attribute is not null)
+        {
+            var dialog = new BrowserDataWriteWindow(_runtime, device, attribute)
+            {
+                Owner = this
+            };
+            dialog.ShowDialog();
+            if (dialog.WriteAttempted && device.LiveDiscoveryModel is { } model)
+                QueueIedBrowserPostWriteRead(device, model, dialog.WriteAssociation,
+                    new[] { dialog.AttemptedLeaf }, dialog.WriteStatus);
+        }
+        else if (owner is not null && device.LiveDiscoveryModel is { } model)
+        {
+            var dialog = new BrowserBatchWriteWindow(_runtime, device, model, owner)
+            {
+                Owner = this
+            };
+            dialog.ShowDialog();
+            if (dialog.AttemptedLeaves.Count > 0)
+                QueueIedBrowserPostWriteRead(device, model, dialog.WriteAssociation,
+                    dialog.AttemptedLeaves, dialog.WriteStatus);
+        }
+        RefreshIedBrowserWriteButton();
+        // A successful MMS Write is NOT process feedback. An explicit Read or
+        // subsequent verified report remains the only live value authority.
+    }
+    // Visible sibling of Write: single leaf remains a focused editor, while
+    // Write DO opens the complete bounded group for explicit multi-DA editing.
+    private void IedBrowserWriteDo_Click(object sender, RoutedEventArgs e)
+    {
+        var device = SelectedDevice;
+        var owner = BrowserWritableSelectedDo(allowLeafSelection: true);
+        if (device is null || owner is null || device.LiveDiscoveryModel is not { } model)
+        {
+            RefreshIedBrowserWriteButton();
+            return;
+        }
+        var dialog = new BrowserBatchWriteWindow(_runtime, device, model, owner)
+        {
+            Owner = this
+        };
+        dialog.ShowDialog();
+        if (dialog.AttemptedLeaves.Count > 0)
+            QueueIedBrowserPostWriteRead(device, model, dialog.WriteAssociation,
+                dialog.AttemptedLeaves, dialog.WriteStatus);
+        RefreshIedBrowserWriteButton();
+    }
+
+    private async void QueueIedBrowserPostWriteRead(
+        Iec61850MonitorDevice device, LiveIedModelDiscoveryDocument model,
+        long association, IReadOnlyCollection<(string Reference, string Fc)> attempted,
+        string status)
+    {
+        // Never push the popup's preview into Data Model. Resolve exact,
+        // uniquely declared live DA identities, then enter the SAME typed MMS
+        // Read → SSOT → visible-row pipeline as the Browser Read button.
+        var request = IedBrowserPostWriteReadRequest.Create(
+            device, model, association, attempted, status);
+        if (request is null || !ReferenceEquals(SelectedDevice, device))
+        {
+            IedBrowserDetailStatus.Text =
+                "Post-Write Read unavailable: IED association/model changed.";
+            return;
+        }
+        IedBrowserDetailStatus.Text = string.IsNullOrWhiteSpace(status)
+            ? "Reading written DA from IED into Data Model…"
+            : status;
+        // A prior automatic Browser Read may still be draining when the
+        // modal closes. Do not silently discard the post-Write refresh or
+        // cancel that reader. Wait briefly for its bounded flight to finish.
+        for (var checks = 0;
+             (_iedBrowserReadOperation is not null || device.IsBusy) && checks < 200;
+             checks++)
+        {
+            await Task.Delay(100);
+            if (!request.Matches(device) || !ReferenceEquals(SelectedDevice, device))
+                return; // reconnect or navigation changed: no stale publication
+        }
+        if (!request.Matches(device) || !ReferenceEquals(SelectedDevice, device) ||
+            _iedBrowserReadOperation is not null || device.IsBusy)
+        {
+            IedBrowserDetailStatus.Text =
+                "Post-Write Read not started; previous Browser Read still active.";
+            return;
+        }
+        IedBrowserReadValues_Click(new Button { Tag = request }, new RoutedEventArgs());
+    }
+
+}
diff --git a/MainWindow.IedBrowser.Write.cs b/MainWindow.IedBrowser.Write.cs
new file mode 100644
index 000000000..e0f039aad
--- /dev/null
+++ b/MainWindow.IedBrowser.Write.cs
@@ -0,0 +1,61 @@
+using System.Windows;
+using ArIED61850Tester.Models;
+
+namespace ArIED61850Tester;
+
+public partial class MainWindow
+{
+    private void IedBrowserWriteValues_Click(object sender, RoutedEventArgs e)
+    {
+        var device = SelectedDevice;
+        var liveModel = device?.LiveDiscoveryModel;
+        if (device is null || liveModel is null || !device.IsConnected || device.IsDemo ||
+            device.IsBusy || _iedBrowserReadOperation is not null)
+        {
+            IedBrowserDetailStatus.Text =
+                "Connect a real IED with LIVE discovery before configuration Write.";
+            return;
+        }
+        var page = _iedBrowserNavigation.Current;
+        var selectedDo = page?.Kind == "LN" ? _iedBrowserSelectedDoReference : null;
+        var plan = IedBrowserWritePlan.Build(liveModel, page, selectedDo);
+        if (plan.Count == 0)
+        {
+            IedBrowserDetailStatus.Text =
+                "No supported live CF/DC/SP/SG/SE primitive DA in the selected object. " +
+                "Select a specific Data Object (DO) or Data Attribute (DA), not a whole LN.";
+            return;
+        }
+        // The editor retains exact model and association identities. A late
+        // reconnect cannot turn its staged values into a write on a new IED.
+        var editor = new IedBrowserWriteWindow(_runtime, device, liveModel, plan)
+        {
+            Owner = this
+        };
+        editor.ShowDialog();
+        if (editor.AttemptedLeaves.Count > 0)
+            QueueIedBrowserPostWriteRead(device, liveModel, editor.WriteAssociation,
+                editor.AttemptedLeaves, editor.WriteStatus);
+        if (editor.PotentiallyChangedControlModels.Count > 0 &&
+            device.IsConnected && ReferenceEquals(device.LiveDiscoveryModel, liveModel))
+        {
+            // Once a configuration Write was attempted, the previous live
+            // ctlModel evidence is no longer authoritative for Operate.
+            // Refuse stale green command buttons until fresh typed inspection.
+            foreach (var signal in device.Signals.Where(signal =>
+                         editor.PotentiallyChangedControlModels.Contains(signal.ObjectReference)))
+            {
+                signal.ClearLiveControlAuthority();
+                signal.ControlModelText = "Auto-detect";
+                signal.ControlInspectionEvidence =
+                    "ctlModel Write attempted in Browser; fresh typed inspection required.";
+                signal.ClearControlConfirmation();
+            }
+            device.RefreshCommandSignalProjection();
+            ResetControlPreloadAttempts(device);
+            _ = PreloadControlModelsAsync();
+        }
+        if (editor.AttemptedLeaves.Count == 0)
+            IedBrowserDetailStatus.Text = "Configuration editor closed; no Write sent.";
+    }
+}
diff --git a/MainWindow.IedBrowser.cs b/MainWindow.IedBrowser.cs
index 2cde53614..d96d7e9d0 100644
--- a/MainWindow.IedBrowser.cs
+++ b/MainWindow.IedBrowser.cs
@@ -216,7 +216,18 @@ private void IedBrowserBrowseFiles_Click(object sender, RoutedEventArgs e)
 
     private void IedBrowserRefresh_Click(object sender, RoutedEventArgs e)
     {
-        // The operator explicitly requested a new local projection, not MMS discovery.
+        // Explicit local refresh may retry previously faulted background metadata
+        // builds; ordinary live ticks never create retry storms.
+        if (SelectedDevice is { } selected)
+        {
+            var model = selected.LiveDiscoveryModel ?? selected.SclWorkspace?.DesignModel;
+            if (model is not null)
+                SharedIedSchemaIndex.ForgetFaulted(model);
+        }
+        // Explicit refresh deliberately discards cached local SCL inventories.
+        // Routine IED switching keeps the bounded per-source cache warm.
+        _iedBrowserInventoryFlights.Clear();
+        _iedBrowserInventoryTask = null;
         _iedBrowserForceRefresh = true;
         RefreshIedBrowser();
     }
@@ -301,6 +312,16 @@ private async void IedBrowserExportReadEvidence_Click(object sender, RoutedEvent
                     target.Reference, target.FunctionalConstraint, reason, kind);
             return null;
         }
+        // Validate the EXACT same bounded selection used for exported rows.
+        // A category, Report control or stale/no-target page is not a read.
+        var exportTargets = IedBrowserReadEvidenceCsv.Plan(model, page);
+        if (exportTargets.Count == 0)
+        {
+            IedBrowserSubtitle.Text =
+                $"ZERO_TARGETS · {page.Kind}: {page.Title} · " +
+                "No verified FC attributes for this page. Select a DataSet, LD, LN, DO or DA.";
+            return;
+        }
         var dialog = new Microsoft.Win32.SaveFileDialog
         {
             FileName = "ARSAS-IEC-read-evidence-" +
@@ -313,8 +334,8 @@ private async void IedBrowserExportReadEvidence_Click(object sender, RoutedEvent
         if (dialog.ShowDialog(this) != true) return;
         try
         {
-            var csv = IedBrowserReadEvidenceCsv.Build(
-                model, page, device.LiveValues, ResolveAbsence);
+            var csv = IedBrowserReadEvidenceCsv.BuildSelection(
+                exportTargets, device.LiveValues, ResolveAbsence);
             if (dialog.FilterIndex == 2)
             {
                 var appVersion = typeof(MainWindow).Assembly
@@ -339,8 +360,8 @@ await System.IO.File.WriteAllTextAsync(dialog.FileName, csv,
                     new System.Text.UTF8Encoding(encoderShouldEmitUTF8Identifier: true));
             }
             IedBrowserSubtitle.Text =
-                "Read evidence exported · exact FC, ledger, failures and deferrals; " +
-                "GVA/invoke not instrumented (never inferred).";
+                $"Read evidence exported · {exportTargets.Count} exact FC targets · " +
+                "ledger/failure evidence; GVA/invoke not instrumented.";
         }
         catch (Exception ex)
         {
@@ -360,6 +381,12 @@ private async void IedBrowserReadValues_Click(object sender, RoutedEventArgs e)
         // A dedicated read-only MMS association is used if monitoring is active.
         // Its bounded reads never interfere with the reporting session.
 
+        var postWriteRequest = (sender as Button)?.Tag as IedBrowserPostWriteReadRequest;
+        if (postWriteRequest is not null && !postWriteRequest.Matches(device))
+        {
+            IedBrowserDetailStatus.Text = "IED association changed; post-Write Read cancelled.";
+            return;
+        }
         var configRequest = (sender as Button)?.Tag as IedBrowserVisibleConfigurationReadRequest;
         var companionRequest = (sender as Button)?.Tag as IedBrowserExactCompanionReadRequest;
         // A selected Report's CF unit hydration is a READ OF THE REFERENCED
@@ -367,9 +394,11 @@ private async void IedBrowserReadValues_Click(object sender, RoutedEventArgs e)
         // ordinary typed Read → association-fenced LiveValues pipeline.
         var reportUnitRequest = sender is Button { Tag: "ReportUnitAuto" };
         var automatic = sender is Button { Tag: "Auto" } ||
-            configRequest is not null || companionRequest is not null || reportUnitRequest;
+            configRequest is not null || companionRequest is not null ||
+            reportUnitRequest || postWriteRequest is not null;
         var readAll = sender is Button { Tag: "All" };
-        if (!readAll && !reportUnitRequest && companionRequest is null)
+        if (!readAll && !reportUnitRequest && companionRequest is null &&
+            postWriteRequest is null)
         {
             switch (IedBrowserReadPlan.SelectionKind(_iedBrowserNavigation.Current))
             {
@@ -404,7 +433,14 @@ private async void IedBrowserReadValues_Click(object sender, RoutedEventArgs e)
             targets = IedBrowserReadPlan.PrioritizeExplicitLn(targets);
         if (automatic)
         {
-            if (reportUnitRequest)
+            if (postWriteRequest is not null)
+            {
+                // Exactly the DA(s) the operator attempted, regardless of
+                // tree selection or the current LN page. The ordinary MMS
+                // Read result inbox is the ONLY publisher to LiveValues.
+                targets = postWriteRequest.Targets;
+            }
+            else if (reportUnitRequest)
             {
                 if (currentPage is not { Kind: "RCB", Payload: RcbExportRow })
                     return;
@@ -493,7 +529,7 @@ _iedBrowserReadFailureEvidence is { } previousFailures &&
         // Admission is claimed only after a concrete, nonempty verified plan
         // reaches the read handler. A queued Dispatcher callback is NOT a read.
         // Rejected/busy/cancelled preflight cannot poison a future visit.
-        var automaticKey = automatic && currentPage is not null
+        var automaticKey = automatic && postWriteRequest is null && currentPage is not null
             ? IedBrowserFocusedAdmission.PageKey(
                 currentPage.Key, reportUnitRequest ? "|unit-CF" :
                     companionRequest is not null
@@ -514,7 +550,13 @@ companionRequest is not null
         // connection and reject a previously planned schema.
         IedBrowserReadBindingIndex? bindingIndex = null;
         var cts = CancellationTokenSource.CreateLinkedTokenSource(_applicationCancellation.Token);
-        if (automatic) cts.CancelAfter(TimeSpan.FromSeconds(15));
+        if (automatic)
+        {
+            if (postWriteRequest is null)
+                cts.CancelAfter(TimeSpan.FromSeconds(15));
+            else
+                cts.CancelAfter(TimeSpan.FromSeconds(30));
+        }
         // Read All may include thousands of attributes. It is cancellable by the
         // operator, never a new continuous acquisition/polling process.
         _iedBrowserReadOperation = cts;
@@ -523,6 +565,9 @@ companionRequest is not null
         if (!automatic || currentPage?.Kind != "SGCB")
             _iedBrowserReadFailureEvidence = null;
         var sourceDevice = device;
+        // A post-Write refresh must prove NEW exact association-bound MMS evidence;
+        // a cached pre-Write observation is never a successful readback.
+        var postWriteBaselineRevision = sourceDevice.LiveValues.Version;
         var successes = 0;
         var failures = 0;
         var unverifiedReadTargets = 0;
@@ -578,7 +623,8 @@ void DrainReadResults()
                     result.UtcTimeEvidence, result.QualityEvidence,
                     typedBoolean: result.TypedBoolean,
                     verifiedStringWireKind: result.VerifiedStringWireKind,
-                    declaredDataType: result.Target.DataType);
+                    declaredDataType: result.Target.DataType,
+                    readWireShapeEvidence: result.WireShapeEvidence);
                 if (!accepted) return;
                 _iedBrowserReadFailureEvidence?.ClearFailure(result.Target);
                 successes++;
@@ -734,6 +780,35 @@ bool HasTerminalFailure(IedBrowserReadTarget target)
                         : "\nFirst unavailable attributes (no scalar was published):\n" +
                           string.Join("\n", failureExamples));
                 RefreshIedBrowserVisibleValues();
+                if (postWriteRequest is not null)
+                {
+                    // The Browser owns this fresh Read and the visible grid.
+                    // Verify all attempted exact reference/FC keys obtained
+                    // a new MMS Read since the post-Write sweep started.
+                    var verified = 0;
+                    foreach (var target in postWriteRequest.Targets)
+                    {
+                        if (sourceDevice.LiveValues.TryGet(target.Reference,
+                                target.FunctionalConstraint, out var observed,
+                                preferReport: false) &&
+                            !observed.IsStale &&
+                            observed.Association == readAssociation &&
+                            observed.Revision > postWriteBaselineRevision &&
+                            string.Equals(observed.Source, "MMS Read",
+                                StringComparison.Ordinal))
+                            verified++;
+                    }
+                    var writeOutcome = string.IsNullOrWhiteSpace(postWriteRequest.WriteStatus)
+                        ? "Write attempted" : postWriteRequest.WriteStatus;
+                    var readOutcome = verified == postWriteRequest.Targets.Count
+                        ? $"Data Model refreshed from IED · {verified}/{postWriteRequest.Targets.Count} DA MMS Read verified."
+                        : $"Data Model Read incomplete · {verified}/{postWriteRequest.Targets.Count} DA refreshed; " +
+                          $"{failures} Read failed. Check the leaf before another Write.";
+                    // A successful Read of the actual old value never upgrades
+                    // a rejected Write into an apparent Write success.
+                    IedBrowserDetailStatus.Text = writeOutcome + " · " + readOutcome;
+                    IedBrowserDetailStatus.ToolTip = IedBrowserDetailStatus.Text;
+                }
                 // A few permanently refused SG leaves must not block the next
                 // finite SGCB chunk. Per-page auto admission still caps attempts
                 // to three; this never becomes Read All or cyclic polling.
@@ -745,7 +820,13 @@ bool HasTerminalFailure(IedBrowserReadTarget target)
         {
             DrainReadResults(); // retain observations completed before cancellation
             if (ReferenceEquals(SelectedDevice, sourceDevice))
+            {
                 IedBrowserSubtitle.Text = $"Read cancelled · {successes:N0} value(s) received; no settings changed.";
+                if (postWriteRequest is not null)
+                    IedBrowserDetailStatus.Text =
+                        postWriteRequest.WriteStatus +
+                        " · Data Model Read interrupted · verify the exact DA before another Write.";
+            }
         }
         catch (Exception ex)
         {
@@ -754,6 +835,9 @@ bool HasTerminalFailure(IedBrowserReadTarget target)
             {
                 device.MarkDiscoveryFailed(ex.Message);
                 IedBrowserSubtitle.Text = "Read failed: " + ex.Message;
+                if (postWriteRequest is not null)
+                    IedBrowserDetailStatus.Text =
+                        postWriteRequest.WriteStatus + " · Data Model not refreshed · MMS Read failed: " + ex.Message;
             }
         }
         finally
@@ -900,11 +984,23 @@ private void RefreshIedBrowserReadButtons()
             IedBrowserReadPageButton.Content = "Read LN";
         IedBrowserReadPageButton.IsEnabled = ready;
         IedBrowserReadAllButton.IsEnabled = ready;
+        // Native Browser configuration editor is distinct from the FAT
+        // typed multi-attribute Write tool. Never share their enabled state.
+        if (IedBrowserConfigWriteButton is not null)
+        {
+            var current = _iedBrowserNavigation.Current;
+            IedBrowserConfigWriteButton.IsEnabled = device is { IsConnected: true, IsDemo: false } &&
+                device.LiveDiscoveryModel is not null && _iedBrowserReadOperation is null &&
+                (current?.Kind is "DO" or "DA" ||
+                 current?.Kind == "LN" && !string.IsNullOrWhiteSpace(_iedBrowserSelectedDoReference));
+        }
         if (IedBrowserExportReadEvidenceButton is not null)
             IedBrowserExportReadEvidenceButton.IsEnabled =
                 device?.LiveDiscoveryModel is not null &&
                 _iedBrowserNavigation.Current is not null;
         IedBrowserCancelReadButton.IsEnabled = _iedBrowserReadOperation != null;
+        RefreshIedBrowserWriteButton();
+        RefreshIedBrowserControlButton();
     }
 
     private bool TryGetBrowserReadFailure(
@@ -959,6 +1055,8 @@ private void RefreshIedBrowserVisibleValues()
         if (MainTabs.SelectedIndex != IedBrowserWorkspaceIndex ||
             SelectedDevice is not { } device)
             return;
+        using var valuesPerf = IedBrowserPerformanceProbe.Measure(
+            "Browser.VisibleValues", device.Name, _iedBrowserDetails.Rows.Count);
         // RCB start/stop does not increment the process LiveValues ledger
         // version. Independently update just the already materialized RCB
         // row glyphs from runtime activation authority on the UI flush tick,
@@ -996,6 +1094,10 @@ private void RefreshIedBrowserVisibleValues()
                 UpdateIedBrowserRcbReportDetails();
             return;
         }
+        // SSOT v2: consume exactly this page's independent canonical cursor.
+        // Null means an unsafe/unknown dependency or missed journal revision:
+        // preserve the original complete projection without skipping evidence.
+        var reactiveRows = SelectIedBrowserReactiveRows(device, version);
         _iedBrowserLastLiveVersion = version;
         _iedBrowserLastCfCanonicalModel = device.LiveCanonicalModel;
         // No MMS call occurs during navigation or refresh. Exact CF/DC
@@ -1008,18 +1110,20 @@ private void RefreshIedBrowserVisibleValues()
         // adding another subscription. They do not claim consumer comparison
         // until distinct consumer projections have actually been compared.
         if (ReferenceEquals(model, device.LiveDiscoveryModel) && model is not null)
-        {
-            var failures = _iedBrowserReadFailureEvidence?.SnapshotCurrent(device, 32);
-            IedBrowserSubtitle.ToolTip = IedBrowserAcceptanceMetrics.Capture(
-                model, device.LiveValues, _iedBrowserSclEnumEvidence,
-                failures).Summary;
-        }
+            QueueIedBrowserAcceptanceMetrics(device, model);
         else
             IedBrowserSubtitle.ToolTip =
                 "Offline/SCL declarations are not proof of fresh IEC MMS observations.";
-        var engineeringUnits = cfEvidence.BuildVerifiedUnits(device.Signals, model);
+        IReadOnlyDictionary<string, string?> engineeringUnits;
+        using (IedBrowserPerformanceProbe.Measure(
+            "Browser.Units", device.Name, device.Signals.Count))
+        {
+            engineeringUnits = _iedBrowserUnitCache.Resolve(device, model, cfEvidence);
+        }
         foreach (var row in _iedBrowserDetails.Rows)
         {
+            if (reactiveRows is not null && !reactiveRows.Contains(row))
+                continue; // unrelated current-page rows produce zero WPF bindings
             if (string.IsNullOrWhiteSpace(row.ValueReference)) continue;
             // An IEC NamPlt DO has DC children, not a fictional scalar under
             // NamPlt [DC]. Show the exact vendor/d/swRev leaf already observed
@@ -1901,6 +2005,8 @@ private void RefreshIedBrowser()
     {
         if (IedBrowserTab == null || MainTabs.SelectedIndex != IedBrowserWorkspaceIndex)
             return;
+        using var browserPerf = IedBrowserPerformanceProbe.Measure(
+            "Browser.Refresh", SelectedDevice?.Name, SelectedDevice?.Signals.Count ?? 0);
 
         var device = SelectedDevice;
         ObserveIedBrowserDevice(device);
@@ -1955,11 +2061,9 @@ private void RefreshIedBrowser()
         catch (IOException) { /* An unavailable source file cannot poison in-memory browsing. */ }
         catch (UnauthorizedAccessException) { /* Still show the cached/discovered model. */ }
 
-        // Model index is immutable and independent from transient report/RCB
-        // refreshes. Build once per actual engineering schema object.
-        if (!ReferenceEquals(_iedBrowserValueSchemaIndex?.SourceModel, model))
-            _iedBrowserValueSchemaIndex = model is null
-                ? null : new IedBrowserSchemaIndex(model);
+        // Heavy schema indexing must never block the WPF selection dispatcher.
+        if (!TryActivateIedBrowserSchema(device, model))
+            return;
 
         var changed = _iedBrowserForceRefresh ||
                       !ReferenceEquals(device, _iedBrowserCachedDevice) ||
@@ -1981,20 +2085,10 @@ private void RefreshIedBrowser()
                 ? _iedBrowserTree.ExpandedKeys()
                 : new HashSet<string>(StringComparer.Ordinal);
 
-            SclReportControlInventoryResult? inventory = null;
-            if (stamp != DateTime.MinValue)
-            {
-                try
-                {
-                    inventory = SclReportControlFilter.InspectFile(
-                        sourcePath, EffectiveSclIedName(device), device.SclAccessPointName);
-                }
-                catch (Exception ex) when (ex is IOException or UnauthorizedAccessException
-                                             or InvalidDataException or ArgumentException)
-                {
-                    IedBrowserDetailStatus.Text = "Source inventory unavailable: " + ex.Message;
-                }
-            }
+            // Source inspection parses SCL XML; never perform it inside a click handler.
+            if (!TryResolveIedBrowserSclInventory(
+                    device, model, sourcePath, stamp, out var inventory))
+                return;
 
             var rcbs = BuildRcbExportRows(device, inventory, _iedBrowserSnapshot);
             if (rcbs.Count == 0 && model != null)
@@ -2233,6 +2327,7 @@ private void ReplaceIedBrowserDetails(IReadOnlyList<IedBrowserDetailRow> rows)
         IedBrowserDetailList.SelectedItem = null;
         IedBrowserDetailList.ItemsSource = null;
         _iedBrowserDetails.Reset(rows);
+        RebuildIedBrowserViewportIndex();
         IedBrowserDetailList.ItemsSource = _iedBrowserDetails.Rows;
     }
 
@@ -2247,6 +2342,7 @@ private void ToggleIedBrowserDetails(IedBrowserDetailRow row)
             IedBrowserDetailList.SelectedItem = null;
             IedBrowserDetailList.ItemsSource = null;
             _iedBrowserDetails.Toggle(row);
+            RebuildIedBrowserViewportIndex();
             IedBrowserDetailList.ItemsSource = _iedBrowserDetails.Rows;
             _iedBrowserLastLiveVersion = -1;
             RefreshIedBrowserVisibleValues();
@@ -2375,6 +2471,7 @@ private void RenderIedBrowserSelection(
             _iedBrowserSelectedDoReference = null;
         _iedBrowserRenderedPage = row;
         _iedBrowserRenderedConnected = connected;
+        var detailGeneration = ++_iedBrowserDetailBuildGeneration;
         _iedBrowserGooseExpected = null;
         _iedBrowserGooseDirectory = null;
         if (row is { Kind: "GoCB", Payload: LiveIedControlBlockModel gooseBlock } &&
@@ -2410,17 +2507,17 @@ private void RenderIedBrowserSelection(
             ? r.Inspection.Summary(connected)
             : connected ? "Connected · Report values shown; use Read for CF/DC configuration values"
                         : "Offline · cached SCL/discovery model";
-        ReplaceIedBrowserDetails(IedBrowserPresentation.Details(row, model,
-            connected, SelectedDevice?.SclWorkspace?.DesignModel));
-        _iedBrowserLastLiveVersion = -1;
-        RefreshIedBrowserVisibleValues();
-        RefreshIedBrowserReadButtons();
-        QueueIedBrowserFocusedRead(row);
-        QueueIedBrowserRcbFocusedRead(row);
-        // Folder entry opens at its first child, regardless of the scroll
-        // position in the previously inspected RCB, LN or DataSet.
-        if (_iedBrowserDetails.Rows.Count > 0)
-            IedBrowserDetailList.ScrollIntoView(_iedBrowserDetails.Rows[0]);
+        var detailDevice = SelectedDevice;
+        var association = detailDevice?.LiveValues.Association ?? -1;
+        var detailStatus = IedBrowserDetailStatus.Text;
+        // Show the selected location immediately; populate only its details
+        // after a bounded worker has constructed the immutable row projection.
+        // This keeps WPF input/rendering free even for fat SG7 LN/DO directories.
+        ReplaceIedBrowserDetails([]);
+        IedBrowserDetailStatus.Text = "Preparing selected engineering details…";
+        _ = BuildIedBrowserDetailsAsync(row, model,
+            detailDevice?.SclWorkspace?.DesignModel, detailDevice, connected,
+            detailStatus, detailGeneration, association);
     }
 
 }
diff --git a/MainWindow.IoTesting.AutoConnect.cs b/MainWindow.IoTesting.AutoConnect.cs
index 790ba33d7..915ce49f1 100644
--- a/MainWindow.IoTesting.AutoConnect.cs
+++ b/MainWindow.IoTesting.AutoConnect.cs
@@ -497,6 +497,11 @@ private async Task ObserveSharedStaticReportEvidenceAsync(
         TimeSpan proofWindow)
     {
         var startedUtc = DateTime.UtcNow;
+        // A single A01 frame is NOT proof that B01, D01 and I01 have also
+        // delivered their initial GI image. Keep one bounded observation
+        // window for all four RCBs before logging their individual truth.
+        // This is timer-only diagnostics: no MMS Read, Write, GI or retry.
+        var association = device.LiveValues.Association;
         try
         {
             var trafficObserved = await WaitForReportStreamAsync(
@@ -504,9 +509,21 @@ private async Task ObserveSharedStaticReportEvidenceAsync(
                 proofWindow,
                 _applicationCancellation.Token).ConfigureAwait(true);
 
-            if (!device.IsMonitoring || !IsSharedStaticDataSetAuthority(device))
+            var remaining = proofWindow - (DateTime.UtcNow - startedUtc);
+            if (remaining > TimeSpan.Zero)
+                await Task.Delay(remaining, _applicationCancellation.Token)
+                    .ConfigureAwait(true);
+
+            if (!device.IsMonitoring ||
+                device.LiveValues.Association != association ||
+                !IsSharedStaticDataSetAuthority(device))
                 return;
 
+            // One live RCB never proves the other three. Diagnose each exact
+            // DataSet/RCB against actual per-stream InformationReport ingress.
+            // This observer never drives MMS IO, GI or a cyclic fallback.
+            LogStaticRcbImageTriage(device);
+
             if (trafficObserved && device.HasReportStream)
             {
                 var reportPoints = device.Points.Count(point =>
@@ -516,7 +533,7 @@ private async Task ObserveSharedStaticReportEvidenceAsync(
                 AddLog(
                     "INFO",
                     device.Name,
-                    $"Static DataSet report evidence: actual InformationReport traffic observed after {firstReportLatency.TotalMilliseconds:0} ms; report-backed runtime point(s)={reportPoints}. RCB/GI path is alive.");
+                    $"Static DataSet report evidence: actual InformationReport traffic observed after {firstReportLatency.TotalMilliseconds:0} ms; report-backed runtime point(s)={reportPoints}. At least one RCB delivered a frame; each other RCB remains independently unverified until its actual ingress is observed.");
                 return;
             }
 
diff --git a/MainWindow.LivePointViewportPriority.cs b/MainWindow.LivePointViewportPriority.cs
new file mode 100644
index 000000000..e9c9f6751
--- /dev/null
+++ b/MainWindow.LivePointViewportPriority.cs
@@ -0,0 +1,80 @@
+using System.Collections.Generic;
+using System.Windows;
+using System.Windows.Controls;
+using ArIED61850Tester.Models;
+
+namespace ArIED61850Tester;
+
+public partial class MainWindow
+{
+    private readonly LivePointViewportPriorityTracker _livePointViewport = new();
+    private readonly HashSet<DataGrid> _viewportPriorityAttachedGrids = new();
+
+    // Dictionary is owned by the WPF dispatcher. Changes to the ObservableCollection
+    // invalidate it: never scan/group every connected IED on every 200-ms flush.
+    private readonly Dictionary<string, Iec61850MonitorDevice> _uiPointOwners =
+        new(StringComparer.OrdinalIgnoreCase);
+    private bool _uiPointOwnersDirty = true;
+
+    private IReadOnlyDictionary<string, Iec61850MonitorDevice> UiPointOwners()
+    {
+        if (!_uiPointOwnersDirty) return _uiPointOwners;
+        _uiPointOwners.Clear();
+        foreach (var device in Devices)
+            _uiPointOwners.TryAdd(device.DeviceId, device);
+        _uiPointOwnersDirty = false;
+        return _uiPointOwners;
+    }
+
+    private void AttachLivePointViewportPriority(DataGrid? grid)
+    {
+        if (grid is null || !_viewportPriorityAttachedGrids.Add(grid)) return;
+        grid.LoadingRow += LivePointViewport_LoadingRow;
+        grid.UnloadingRow += LivePointViewport_UnloadingRow;
+        grid.Unloaded += LivePointViewport_Unloaded;
+    }
+
+    private LivePointViewportKind LivePointViewportType(DataGrid grid)
+        => ReferenceEquals(grid, GlobalLiveGrid)
+            ? LivePointViewportKind.Global : LivePointViewportKind.Explorer;
+
+    private void LivePointViewport_LoadingRow(object? sender, DataGridRowEventArgs e)
+    {
+        if (sender is not DataGrid grid ||
+            e.Row.Item is not Iec61850MonitorPoint point) return;
+        var key = CanonicalPointSnapshotAuthority.UiQueueKey(point);
+        if (!_livePointViewport.Realize(LivePointViewportType(grid), key)) return;
+
+        // When a user scrolls into a long-existing backlog, prioritize only
+        // this newly realized row; do not re-enumerate 25k pending IED values.
+        if (_pendingPointSnapshots.ContainsKey(key))
+            _priorityPointUiKeys.Enqueue(key);
+    }
+
+    private void LivePointViewport_UnloadingRow(object? sender, DataGridRowEventArgs e)
+    {
+        if (sender is not DataGrid grid ||
+            e.Row.Item is not Iec61850MonitorPoint point) return;
+        _livePointViewport.Unrealize(LivePointViewportType(grid),
+            CanonicalPointSnapshotAuthority.UiQueueKey(point));
+    }
+
+    private void LivePointViewport_Unloaded(object sender, RoutedEventArgs e)
+    {
+        if (sender is DataGrid grid && ReferenceEquals(e.OriginalSource, grid))
+            _livePointViewport.Clear(LivePointViewportType(grid));
+    }
+
+    // Every fourth *accepted* batch slot is reserved for the older background
+    // FIFO. This prevents a continuous visible Report storm from starving
+    // other IEDs, while newly visible cells take the first three slots.
+    private bool TryDequeueUiPointKey(int processedPoints, out string key)
+    {
+        if ((processedPoints & 3) == 3 &&
+            _pendingPointUiKeys.TryDequeue(out key))
+            return true;
+        if (_priorityPointUiKeys.TryDequeue(out key))
+            return true;
+        return _pendingPointUiKeys.TryDequeue(out key);
+    }
+}
diff --git a/MainWindow.LiveSearch.cs b/MainWindow.LiveSearch.cs
index 5fa128c9f..2fbfe9263 100644
--- a/MainWindow.LiveSearch.cs
+++ b/MainWindow.LiveSearch.cs
@@ -2,13 +2,14 @@
 using System.Windows.Controls;
 using System.Windows.Data;
 using ArIED61850Tester.Models;
+using ArIED61850Tester.Services;
 
 namespace ArIED61850Tester;
 
 public partial class MainWindow
 {
     private void ExplorerLiveSearch_TextChanged(object sender, TextChangedEventArgs e)
-        => ApplyExplorerLiveSearchFilter();
+        => ScheduleUnifiedLiveSignalSearch();
 
     private void ExplorerLiveSearchClear_Click(object sender, RoutedEventArgs e)
     {
@@ -21,6 +22,14 @@ private void ExplorerLiveSearchClear_Click(object sender, RoutedEventArgs e)
 
     private void ApplyExplorerLiveSearchFilter()
     {
+        // The runtime-installed search and the native Explorer box must share
+        // ONE ICollectionView filter owner. Two independent Filter assignments
+        // otherwise replace one another and synchronously enumerate SG7 twice.
+        if (_liveSignalSearchInstalled && _liveSignalSearchGrid is not null)
+        {
+            ApplyLiveSignalSearch();
+            return;
+        }
         var device = SelectedDevice;
         if (device == null)
             return;
@@ -32,10 +41,15 @@ private void ApplyExplorerLiveSearchFilter()
         var query = ExplorerLiveSearchBox?.Text?.Trim() ?? string.Empty;
         if (query.Length == 0)
         {
-            view.Filter = null;
-            view.Refresh();
+            // WPF Filter assignment itself refreshes the CollectionView.
+            // The old path refreshed twice even for an empty query on every
+            // IED selection, causing avoidable synchronous SG7 UI work.
+            if (view.Filter is not null)
+                view.Filter = null;
             return;
         }
+        using var filterPerf = IedBrowserPerformanceProbe.Measure(
+            "Explorer.Filter", device.Name, device.Points.Count);
 
         view.Filter = item =>
         {
@@ -51,7 +65,8 @@ private void ApplyExplorerLiveSearchFilter()
                    Contains(point.Category, query) ||
                    Contains(point.IecDataType, query);
         };
-        view.Refresh();
+        // CollectionView.Filter setter already performs RefreshOrDefer.
+        // A second explicit Refresh doubles the UI enumeration/sort cost.
     }
 
     private static bool Contains(string? value, string query)
diff --git a/MainWindow.LiveSignalSearch.cs b/MainWindow.LiveSignalSearch.cs
index fa437780d..362861508 100644
--- a/MainWindow.LiveSignalSearch.cs
+++ b/MainWindow.LiveSignalSearch.cs
@@ -6,6 +6,7 @@
 using System.Windows.Data;
 using System.Windows.Input;
 using System.Windows.Media;
+using System.Windows.Threading;
 using ArIED61850Tester.Models;
 using ArIED61850Tester.Services;
 
@@ -27,6 +28,12 @@ public partial class MainWindow
     private INotifyCollectionChanged? _liveSignalSearchCollection;
     private DependencyPropertyDescriptor? _liveSignalItemsSourceDescriptor;
     private bool _liveSignalSearchInstalled;
+    private string _unifiedExplorerSearchText = "";
+    private string[] _unifiedLiveSearchTokens = Array.Empty<string>();
+    private bool _liveSignalCountRefreshScheduled;
+    // Debounce only large point-model text edits. Switching IED and clearing
+    // the query still applies immediately so the visible workspace is current.
+    private DispatcherTimer? _liveSignalFilterDebounce;
 
     private static bool RegisterLiveSignalSearchClassHandler()
     {
@@ -181,7 +188,7 @@ private void AttachLiveSignalSearchSource()
     {
         if (_liveSignalSearchCollection != null)
             _liveSignalSearchCollection.CollectionChanged -= LiveSignalSearch_CollectionChanged;
-        if (_liveSignalSearchView != null)
+        if (_liveSignalSearchView?.Filter != null)
             _liveSignalSearchView.Filter = null;
 
         var source = _liveSignalSearchGrid?.ItemsSource;
@@ -194,72 +201,132 @@ private void AttachLiveSignalSearchSource()
             : CollectionViewSource.GetDefaultView(source);
         // Natural ordering is presentation-only. The underlying static DataSet
         // descriptors and MMS/GOOSE FCDA order must remain untouched.
+        // WPF CustomSort is O(N log N) on the Dispatcher. On large models,
+        // retain deterministic source order rather than freezing the IED switch.
         if (_liveSignalSearchView is ListCollectionView listView &&
+            _liveSignalSearchGrid?.ItemsSource is ICollection sourceCollection &&
+            sourceCollection.Count <= 2048 &&
             listView.SortDescriptions.Count == 0 && listView.CustomSort is null)
             listView.CustomSort = IecNaturalLiveMonitorSort.Instance;
         ApplyLiveSignalSearch();
     }
 
     private void LiveSignalSearch_TextChanged(object sender, TextChangedEventArgs e)
-        => ApplyLiveSignalSearch();
+        => ScheduleUnifiedLiveSignalSearch();
+
+    private void ScheduleUnifiedLiveSignalSearch()
+    {
+        var explorerText = ExplorerLiveSearchBox?.Text?.Trim();
+        var toolbarText = _liveSignalSearchBox?.Text?.Trim();
+        // Empty search is especially important during reconnect/IED switching:
+        // drop the old filter immediately, not after a debounce period.
+        var cleared = string.IsNullOrEmpty(explorerText) &&
+                      string.IsNullOrEmpty(toolbarText);
+        if (cleared ||
+            _liveSignalSearchGrid?.ItemsSource is not ICollection { Count: > 2048 })
+        {
+            _liveSignalFilterDebounce?.Stop();
+            ApplyExplorerLiveSearchFilter();
+            return;
+        }
+
+        if (_liveSignalFilterDebounce is null)
+        {
+            _liveSignalFilterDebounce = new DispatcherTimer(
+                DispatcherPriority.Background, Dispatcher)
+            {
+                Interval = TimeSpan.FromMilliseconds(220)
+            };
+            _liveSignalFilterDebounce.Tick += (_, _) =>
+            {
+                _liveSignalFilterDebounce.Stop();
+                ApplyExplorerLiveSearchFilter();
+            };
+        }
+        // Latest text wins. Never queue one 33k-row WPF Refresh per keystroke.
+        _liveSignalFilterDebounce.Stop();
+        _liveSignalFilterDebounce.Start();
+    }
 
     private void LiveSignalSearch_CollectionChanged(object? sender, NotifyCollectionChangedEventArgs e)
-        => Dispatcher.BeginInvoke(new Action(UpdateLiveSignalSearchCount));
+    {
+        if (_liveSignalCountRefreshScheduled) return;
+        _liveSignalCountRefreshScheduled = true;
+        Dispatcher.BeginInvoke(System.Windows.Threading.DispatcherPriority.Background,
+            new Action(() =>
+            {
+                _liveSignalCountRefreshScheduled = false;
+                UpdateLiveSignalSearchCount();
+            }));
+    }
 
     private void ApplyLiveSignalSearch()
     {
+        _liveSignalFilterDebounce?.Stop();
+        _unifiedExplorerSearchText = (ExplorerLiveSearchBox?.Text ?? "").Trim();
+        var detailedQuery = (_liveSignalSearchBox?.Text ?? "").Trim();
+        _unifiedLiveSearchTokens = detailedQuery.Split(
+            new[] { ' ', '\t', '\r', '\n' },
+            StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
         if (_liveSignalSearchView == null)
         {
             UpdateLiveSignalSearchCount();
             return;
         }
-
-        _liveSignalSearchView.Filter = LiveSignalSearch_Matches;
-        _liveSignalSearchView.Refresh();
+        using var filterPerf = IedBrowserPerformanceProbe.Measure(
+            "Explorer.UnifiedFilter", SelectedDevice?.Name,
+            _liveSignalSearchGrid?.Items.Count ?? 0);
+        if (_unifiedExplorerSearchText.Length == 0 && _unifiedLiveSearchTokens.Length == 0)
+        {
+            if (_liveSignalSearchView.Filter is not null)
+                _liveSignalSearchView.Filter = null;
+        }
+        else
+        {
+            // Filter assignment refreshes the view; never Refresh() again.
+            _liveSignalSearchView.Filter = LiveSignalSearch_Matches;
+        }
         UpdateLiveSignalSearchCount();
     }
 
     private bool LiveSignalSearch_Matches(object item)
     {
-        var query = (_liveSignalSearchBox?.Text ?? string.Empty).Trim();
-        if (query.Length == 0)
-            return true;
-        if (item is not Iec61850MonitorPoint point)
-            return true;
-
-        var searchable = string.Join('\n', new[]
-        {
-            point.DeviceName,
-            point.SignalName,
-            point.IecTelegram,
-            point.IecReference,
-            point.Value,
-            point.Quality,
-            point.DeviceTimestamp,
-            point.SourceMode
-        }.Where(value => !string.IsNullOrWhiteSpace(value)));
-
-        // Multiple terms use AND semantics: "MMXU instCVal" quickly narrows large workspaces.
-        var tokens = query.Split(
-            new[] { ' ', '\t', '\r', '\n' },
-            StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
-        return tokens.All(token => searchable.Contains(token, StringComparison.OrdinalIgnoreCase));
+        if (item is not Iec61850MonitorPoint point) return false;
+        if (_unifiedExplorerSearchText.Length > 0 &&
+            !LiveSignalSearchContains(point, _unifiedExplorerSearchText))
+            return false;
+        foreach (var token in _unifiedLiveSearchTokens)
+            if (!LiveSignalSearchContains(point, token))
+                return false;
+        return true;
     }
 
+    private static bool LiveSignalSearchContains(Iec61850MonitorPoint point, string token)
+        => Contains(point.DeviceName, token) ||
+           Contains(point.SignalName, token) ||
+           Contains(point.IecTelegram, token) ||
+           Contains(point.IecReference, token) ||
+           Contains(point.DisplayValue, token) ||
+           Contains(point.Quality, token) ||
+           Contains(point.DeviceTimestamp, token) ||
+           Contains(point.SourceMode, token) ||
+           Contains(point.Category, token) ||
+           Contains(point.IecDataType, token);
+
     private void UpdateLiveSignalSearchCount()
     {
-        if (_liveSignalSearchCount == null)
+        if (_liveSignalSearchCount is null)
             return;
 
         var source = _liveSignalSearchGrid?.ItemsSource;
-        var total = source switch
-        {
-            ICollection collection => collection.Count,
-            IEnumerable<object> enumerable => enumerable.Count(),
-            _ => 0
-        };
-        var visible = _liveSignalSearchView?.Cast<object>().Count() ?? total;
-        var filtered = !string.IsNullOrWhiteSpace(_liveSignalSearchBox?.Text);
+        var total = source is ICollection collection ? collection.Count : 0;
+        // Unfiltered view count equals source count; do not enumerate all SG7
+        // points merely to update a small toolbar caption on each notification.
+        var filtered = _unifiedExplorerSearchText.Length > 0 ||
+                       _unifiedLiveSearchTokens.Length > 0;
+        var visible = filtered
+            ? (_liveSignalSearchView?.Cast<object>().Count() ?? total)
+            : total;
         _liveSignalSearchCount.Text = filtered
             ? $"{visible:N0} of {total:N0} shown"
             : $"{total:N0} signals";
@@ -278,10 +345,17 @@ private void LiveSignalSearch_WindowPreviewKeyDown(object sender, KeyEventArgs e
 
     private void LiveSignalSearch_BoxPreviewKeyDown(object sender, KeyEventArgs e)
     {
-        if (e.Key != Key.Escape)
-            return;
-        ClearLiveSignalSearch();
-        e.Handled = true;
+        if (e.Key == Key.Enter)
+        {
+            _liveSignalFilterDebounce?.Stop();
+            ApplyLiveSignalSearch();
+            e.Handled = true;
+        }
+        else if (e.Key == Key.Escape)
+        {
+            ClearLiveSignalSearch();
+            e.Handled = true;
+        }
     }
 
     private void ClearLiveSignalSearch()
@@ -294,13 +368,14 @@ private void ClearLiveSignalSearch()
 
     private void LiveSignalSearch_WindowClosed(object? sender, EventArgs e)
     {
+        _liveSignalFilterDebounce?.Stop();
         PreviewKeyDown -= LiveSignalSearch_WindowPreviewKeyDown;
         Closed -= LiveSignalSearch_WindowClosed;
         if (_liveSignalSearchGrid != null)
             _liveSignalItemsSourceDescriptor?.RemoveValueChanged(_liveSignalSearchGrid, LiveSignalSearch_ItemsSourceChanged);
         if (_liveSignalSearchCollection != null)
             _liveSignalSearchCollection.CollectionChanged -= LiveSignalSearch_CollectionChanged;
-        if (_liveSignalSearchView != null)
+        if (_liveSignalSearchView?.Filter != null)
             _liveSignalSearchView.Filter = null;
     }
 
diff --git a/MainWindow.NativeFatDiagnostics.cs b/MainWindow.NativeFatDiagnostics.cs
index 92b231b6e..fdd675175 100644
--- a/MainWindow.NativeFatDiagnostics.cs
+++ b/MainWindow.NativeFatDiagnostics.cs
@@ -197,7 +197,7 @@ private void NativeFatTimeSyncButton_Click(object sender, RoutedEventArgs e)
             TextWrapping = TextWrapping.Wrap,
             VerticalScrollBarVisibility = ScrollBarVisibility.Auto,
             HorizontalScrollBarVisibility = ScrollBarVisibility.Disabled,
-            FontFamily = new FontFamily("Consolas"),
+            FontFamily = new FontFamily(new Uri("pack://application:,,,/"), "./Assets/Fonts/#Inter"),
             FontSize = 12.2,
             Padding = new Thickness(16),
             BorderThickness = new Thickness(0),
diff --git a/MainWindow.NativeFatP4CColumnContract.cs b/MainWindow.NativeFatP4CColumnContract.cs
index 889e03dbe..1e046056c 100644
--- a/MainWindow.NativeFatP4CColumnContract.cs
+++ b/MainWindow.NativeFatP4CColumnContract.cs
@@ -140,7 +140,7 @@ protected override FrameworkElement GenerateElement(DataGridCell cell, object da
                 Text = dataItem is Iec61850MonitorPoint point
                     ? _owner.ReadNativeFatTimestamp(point, Field)
                     : string.Empty,
-                FontFamily = new FontFamily("Consolas"),
+                FontFamily = new FontFamily(new Uri("pack://application:,,,/"), "./Assets/Fonts/#Inter"),
                 FontSize = 11,
                 VerticalAlignment = VerticalAlignment.Center,
                 TextTrimming = TextTrimming.CharacterEllipsis
diff --git a/MainWindow.StaticReportEvidence.cs b/MainWindow.StaticReportEvidence.cs
index 07b618564..ac934c796 100644
--- a/MainWindow.StaticReportEvidence.cs
+++ b/MainWindow.StaticReportEvidence.cs
@@ -4,6 +4,23 @@ namespace ArIED61850Tester;
 
 public partial class MainWindow
 {
+    /// <summary>
+    /// Bounded per-RCB evidence, run only after the initial report observation
+    /// window. Counts already displayed members separately from wire frames
+    /// and keeps RptEna/GI/write outcomes explicitly unverified when absent.
+    /// No process read, subscription change or Dispatcher-wide model walk.
+    /// </summary>
+    private void LogStaticRcbImageTriage(Iec61850MonitorDevice device)
+    {
+        var groups = ArIED61850Tester.Services.StaticDataSetRcbImageTriage.Evaluate(
+            device.Points, device.ReportContinuityEvidence, maxGroups: 16);
+        foreach (var group in groups)
+            AddLog(group.Pending > 0 || !group.HasActualReportFrames ? "WARN" : "INFO",
+                device.Name,
+                "Static DataSet RCB evidence: " + group.Summary +
+                " (display completeness and actual stream traffic are separate facts).");
+    }
+
     /// <summary>
     /// Emits a protocol-feasibility inventory before monitoring starts. A configured
     /// DataSet is not automatically reportable: at least one configured BRCB/URCB must
diff --git a/MainWindow.TopBarContainerHardening.cs b/MainWindow.TopBarContainerHardening.cs
index bce6fe911..fefce9d6a 100644
--- a/MainWindow.TopBarContainerHardening.cs
+++ b/MainWindow.TopBarContainerHardening.cs
@@ -67,10 +67,9 @@ private static void Apply(MainWindow window)
 
         if (window.FindName("WorkflowNavShell") is Border shell)
         {
-            shell.Height = 64d;
-            shell.MinHeight = 64d;
+            // NavigationLayoutFix owns shell height (60) and padding. The
+            // container guard only prevents clipping/Z-order mistakes.
             shell.Margin = new Thickness(0, 2, 0, 2);
-            shell.Padding = new Thickness(5, 7, 5, 7);
             shell.ClipToBounds = false;
             Panel.SetZIndex(shell, 60);
         }
diff --git a/MainWindow.WorkbenchP1PanelGeometry.cs b/MainWindow.WorkbenchP1PanelGeometry.cs
index 041472ea3..e7bee2b91 100644
--- a/MainWindow.WorkbenchP1PanelGeometry.cs
+++ b/MainWindow.WorkbenchP1PanelGeometry.cs
@@ -29,6 +29,7 @@ private sealed class P1PanelGeometryState
         public required GridSplitter DockSplitter { get; init; }
         public required Border DockGuide { get; init; }
         public bool DockDragging { get; set; }
+        public bool ApplyingGeometry { get; set; }
         public Dictionary<int, double> DockHeightByWorkspace { get; } = new()
         {
             // First paint should expose a complete command row without forcing the operator
@@ -104,10 +105,19 @@ private void TryInstallP1PanelGeometry()
         // P0 used row 1 directly for the command Expander. Insert a real gutter row so the
         // dock can use the same quiet resizer language as the Explorer.
         var dockRow = shell.RowDefinitions[1];
+        // The workspace is the remaining star row. A fixed dock height must
+        // never be measured outside the window's real client area.
+        shell.RowDefinitions[0].Height = new GridLength(1, GridUnitType.Star);
+        shell.RowDefinitions[0].MinHeight = 0;
+        shell.ClipToBounds = true;
         var dockGutterRow = new RowDefinition { Height = new GridLength(0) };
         shell.RowDefinitions.Insert(1, dockGutterRow);
 
         CommandPanelExpander.Margin = new Thickness(0);
+        CommandPanelExpander.MinHeight = 0;
+        CommandPanelExpander.ClipToBounds = true;
+        EquipmentCommandGrid.MinHeight = 0;
+        EquipmentCommandGrid.SetValue(ScrollViewer.VerticalScrollBarVisibilityProperty, ScrollBarVisibility.Auto);
         Grid.SetRow(CommandPanelExpander, 2);
         Grid.SetRowSpan(CommandPanelExpander, 1);
 
@@ -172,6 +182,7 @@ private void TryInstallP1PanelGeometry()
         CommandPanelExpander.Collapsed += P1DockExpander_ExpandedCollapsed;
         CommandPanelExpander.IsVisibleChanged += P1DockExpander_IsVisibleChanged;
         MainTabs.SelectionChanged += P1PanelGeometry_MainTabsSelectionChanged;
+        shell.SizeChanged += P1DockShell_SizeChanged;
         Closed += P1PanelGeometry_Closed;
 
         ApplyP1DockGeometry(state, MainTabs.SelectedIndex);
@@ -259,6 +270,7 @@ private void P1DockSplitter_DragCompleted(object sender, DragCompletedEventArgs
                 state.DockHeightByWorkspace[MainTabs.SelectedIndex] = measured;
         }
 
+        ApplyP1DockGeometry(state, MainTabs.SelectedIndex);
         var target = state.DockSplitter.IsMouseOver ? 0.96 : 0;
         AnimateP1SplitterGuide(state.DockGuide, target, 130);
     }
@@ -289,8 +301,19 @@ private void P1PanelGeometry_MainTabsSelectionChanged(object sender, SelectionCh
         }));
     }
 
+    private void P1DockShell_SizeChanged(object sender, SizeChangedEventArgs e)
+    {
+        if (_p1PanelGeometry is { DockDragging: false, ApplyingGeometry: false } state &&
+            e.HeightChanged)
+            ApplyP1DockGeometry(state, MainTabs.SelectedIndex);
+    }
+
     private void ApplyP1DockGeometry(P1PanelGeometryState state, int workspaceIndex)
     {
+        if (state.ApplyingGeometry || state.DockDragging) return;
+        state.ApplyingGeometry = true;
+        try
+        {
         var dockActive = CommandPanelExpander.IsVisible && CommandPanelExpander.IsExpanded;
         if (!dockActive)
         {
@@ -303,17 +326,25 @@ private void ApplyP1DockGeometry(P1PanelGeometryState state, int workspaceIndex)
             return;
         }
 
-        var availableHeight = Math.Max(520, _persistentWorkbench?.Shell.ActualHeight ?? ActualHeight);
+        // ActualHeight, never a fictitious 520px minimum. The previous floor
+        // could leave the dock below the visible window at low DPI/resize.
+        var availableHeight = _persistentWorkbench?.Shell.ActualHeight ?? ActualHeight;
+        if (!double.IsFinite(availableHeight) || availableHeight <= 0) return;
         var preferred = state.DockHeightByWorkspace.TryGetValue(workspaceIndex, out var stored)
             ? stored
             : 224d;
-        preferred = Math.Clamp(preferred, 126d, Math.Min(430d, availableHeight * 0.48d));
+        // Keep at least 120 DIP for the live workspace and 10 for the splitter.
+        // On very short windows prioritize staying on-screen over dock rows.
+        var maxDock = Math.Max(0d, Math.Min(440d, availableHeight - 130d));
+        preferred = Math.Min(Math.Max(0, preferred), maxDock);
 
         state.DockGutterRow.Height = new GridLength(10);
         state.DockSplitter.Visibility = Visibility.Visible;
-        state.DockRow.MinHeight = 112;
-        state.DockRow.MaxHeight = Math.Min(440, availableHeight * 0.52d);
+        state.DockRow.MinHeight = 0;
+        state.DockRow.MaxHeight = maxDock;
         state.DockRow.Height = new GridLength(preferred);
+        }
+        finally { state.ApplyingGeometry = false; }
     }
 
     private void P1PanelGeometry_Closed(object? sender, EventArgs e)
@@ -331,6 +362,8 @@ private void P1PanelGeometry_Closed(object? sender, EventArgs e)
         CommandPanelExpander.Collapsed -= P1DockExpander_ExpandedCollapsed;
         CommandPanelExpander.IsVisibleChanged -= P1DockExpander_IsVisibleChanged;
         MainTabs.SelectionChanged -= P1PanelGeometry_MainTabsSelectionChanged;
+        if (_persistentWorkbench is { } workbench)
+            workbench.Shell.SizeChanged -= P1DockShell_SizeChanged;
         Closed -= P1PanelGeometry_Closed;
         _p1PanelGeometry = null;
     }
diff --git a/MainWindow.xaml b/MainWindow.xaml
index ae0e85e36..a6b1a12fa 100644
--- a/MainWindow.xaml
+++ b/MainWindow.xaml
@@ -4,7 +4,7 @@
         xmlns:views="clr-namespace:ArIED61850Tester.Views"
         Title="ARSAS - Smart IEC 61850 Communication Tester"
         Height="900" Width="1480" MinHeight="760" MinWidth="1180"
-        WindowStartupLocation="CenterScreen" Background="{StaticResource AppBackgroundGradient}"
+        WindowStartupLocation="CenterScreen" WindowState="Maximized" Background="{StaticResource AppBackgroundGradient}"
         FontFamily="{StaticResource AppFontFamily}"
         UseLayoutRounding="True" SnapsToDevicePixels="True"
         TextOptions.TextFormattingMode="Ideal"
@@ -12,6 +12,21 @@
         TextOptions.TextHintingMode="Fixed"
         Icon="Assets/app-icon.ico" Closing="Window_Closing" PreviewKeyDown="MainWindow_PreviewKeyDown">
     <Window.Resources>
+        <!-- IEC validity attention is display-only; use a single vector and avoid font-dependent emojis. -->
+        <GeometryGroup x:Key="InvalidQualityWarningGeometry" FillRule="EvenOdd">
+            <PathGeometry Figures="M 40,-120 L 480,-880 920,-120 Z"/>
+            <PathGeometry Figures="M 178,-200 L 782,-200 480,-720 Z"/>
+            <RectangleGeometry Rect="440,-560,80,200"/>
+            <EllipseGeometry Center="480,-280" RadiusX="40" RadiusY="40"/>
+        </GeometryGroup>
+        <Style x:Key="InvalidQualityWarningIconStyle" TargetType="{x:Type Path}">
+            <Setter Property="Visibility" Value="Collapsed"/>
+            <Style.Triggers>
+                <DataTrigger Binding="{Binding IsInvalidQuality}" Value="True">
+                    <Setter Property="Visibility" Value="Visible"/>
+                </DataTrigger>
+            </Style.Triggers>
+        </Style>
         <!-- Exact operator-supplied circular unlocked-padlock vector; no font glyph. -->
         <Geometry x:Key="BrowserRcbEnabledIconGeometry">M380-320h200q25 0 42.5-17.5T640-380v-120q0-25-17.5-42.5T580-560v-60q0-42-29-71t-71-29q-42 0-71 29t-29 71h60q0-17 11.5-28.5T480-660q17 0 28.5 11.5T520-620v60H380q-25 0-42.5 17.5T320-500v120q0 25 17.5 42.5T380-320ZM480-80q-83 0-156-31.5T197-197q-54-54-85.5-127T80-480q0-83 31.5-156T197-763q54-54 127-85.5T480-880q83 0 156 31.5T763-763q54 54 85.5 127T880-480q0 83-31.5 156T197-197q-54 54-127 85.5T480-80Zm0-80q134 0 227-93t93-227q0-134-93-227t-227-93q-134 0-227 93t-93 227q0 134 93 227t227 93Zm0-320Z</Geometry>
         <!-- Preserve compact columns; hover reveals the complete list of
@@ -623,7 +638,21 @@
                                                     </DataTemplate>
                                                 </DataGridTemplateColumn.CellTemplate>
                                             </DataGridTemplateColumn>
-                                            <DataGridTextColumn Header="Quality" Binding="{Binding Quality}" Width="0.72*" MinWidth="105"/>
+                                            <DataGridTemplateColumn Header="Quality" Width="0.72*" MinWidth="105">
+                                                <DataGridTemplateColumn.CellTemplate>
+                                                    <DataTemplate>
+                                                        <StackPanel Orientation="Horizontal" VerticalAlignment="Center">
+                                                            <TextBlock Text="{Binding Quality}" ToolTip="{Binding Quality}"
+                                                                       VerticalAlignment="Center" TextTrimming="CharacterEllipsis"/>
+                                                            <Path Data="{StaticResource InvalidQualityWarningGeometry}" Width="12" Height="12"
+                                              Stretch="Uniform" Fill="#B97800" Margin="5,0,0,0"
+                                              VerticalAlignment="Center"
+                                              Style="{StaticResource InvalidQualityWarningIconStyle}"
+                                              ToolTip="IED-reported quality validity: Invalid"/>
+                                                        </StackPanel>
+                                                    </DataTemplate>
+                                                </DataGridTemplateColumn.CellTemplate>
+                                            </DataGridTemplateColumn>
                                             <DataGridTextColumn Header="IED Timestamp" Binding="{Binding DeviceTimestamp}" Width="1.05*" MinWidth="155"/>
                                             <DataGridTextColumn Header="Acquisition" Binding="{Binding AcquisitionShort}" IsReadOnly="True" ElementStyle="{StaticResource RcbAcquisitionTextStyle}" Width="1.05*" MinWidth="150"/>
                                         </DataGrid.Columns>
@@ -667,17 +696,27 @@
                                             <RowDefinition Height="Auto"/>
                                         </Grid.RowDefinitions>
 
-                                        <Grid Grid.Row="0">
-                                            <DataGrid ItemsSource="{Binding SelectedDevice.CommandSignals}" Loaded="CommandGrid_Loaded" IsReadOnly="False" CanUserAddRows="False" CanUserDeleteRows="False"
+                                        <Grid Grid.Row="0" MinHeight="0" ClipToBounds="True">
+                                            <DataGrid x:Name="EquipmentCommandGrid" ItemsSource="{Binding SelectedDevice.CommandSignals}" Loaded="CommandGrid_Loaded" IsReadOnly="False" CanUserAddRows="False" CanUserDeleteRows="False"
                                                       Style="{StaticResource CommandDataGrid}" RowStyle="{StaticResource CommandDataGridRow}"
                                                       CellStyle="{StaticResource CommandDataGridCell}" ColumnHeaderStyle="{StaticResource CommandDataGridHeader}"
                                                       AutoGenerateColumns="False" MinHeight="56" RowHeight="43" MinRowHeight="42" ColumnHeaderHeight="35" FrozenColumnCount="1"
                                                       EnableRowVirtualization="True" EnableColumnVirtualization="True"
                                                       VirtualizingPanel.IsVirtualizing="True" VirtualizingPanel.VirtualizationMode="Recycling"
-                                                      ScrollViewer.CanContentScroll="True" ScrollViewer.VerticalScrollBarVisibility="Auto" ScrollViewer.HorizontalScrollBarVisibility="Disabled"
+                                                      ScrollViewer.CanContentScroll="True" ScrollViewer.VerticalScrollBarVisibility="Visible" ScrollViewer.HorizontalScrollBarVisibility="Disabled"
+                                                      ScrollViewer.IsDeferredScrollingEnabled="False" ScrollViewer.PanningMode="VerticalOnly"
+                                                      VirtualizingPanel.ScrollUnit="Pixel"
                                                       CanUserResizeColumns="False" ClipToBounds="True">
                                                 <DataGrid.Columns>
-                                                    <DataGridTextColumn Header="IEC Telegram" Binding="{Binding DisplayReference}" Width="1.9*" MinWidth="145" IsReadOnly="True"/>
+                                                    <DataGridTextColumn Header="IEC Telegram" Binding="{Binding DisplayReference}" Width="1.5*" MinWidth="165" IsReadOnly="True"/>
+                                                    <DataGridTextColumn Header="Control role" Binding="{Binding ControlDockRole}" Width="1.05*" MinWidth="143" IsReadOnly="True">
+                                                        <DataGridTextColumn.ElementStyle>
+                                                            <Style TargetType="TextBlock">
+                                                                <Setter Property="TextTrimming" Value="CharacterEllipsis"/>
+                                                                <Setter Property="ToolTip" Value="Presentation class only. Live typed MMS model decides Operate eligibility; CSWI/CILO/XCBR physical relationships are never guessed."/>
+                                                            </Style>
+                                                        </DataGridTextColumn.ElementStyle>
+                                                    </DataGridTextColumn>
                                                     <DataGridTemplateColumn Header="Value" Width="0.93*" MinWidth="137">
                                                         <DataGridTemplateColumn.CellTemplate>
                                                             <DataTemplate>
@@ -726,9 +765,9 @@
                                                                             <ColumnDefinition Width="*"/>
                                                                             <ColumnDefinition Width="Auto"/>
                                                                         </Grid.ColumnDefinitions>
-                                                                        <StackPanel Orientation="Horizontal">
-                                                                            <StackPanel.Style>
-                                                                                <Style TargetType="StackPanel">
+                                                                        <Grid>
+                                                                            <Grid.Style>
+                                                                                <Style TargetType="Grid">
                                                                                     <Setter Property="Visibility" Value="Collapsed"/>
                                                                                     <Style.Triggers>
                                                                                         <MultiDataTrigger>
@@ -740,14 +779,15 @@
                                                                                         </MultiDataTrigger>
                                                                                     </Style.Triggers>
                                                                                 </Style>
-                                                                            </StackPanel.Style>
-                                                                            <Button Content="Open" Tag="{Binding}" CommandParameter="Open [01]" Click="ControlStageAction_Click"
-                                                                                    Style="{StaticResource CommandOpenButton}" Margin="0,0,7,0"
-                                                                                    Width="72" MinWidth="72" HorizontalAlignment="Left" IsEnabled="{Binding ControlCanInspectPosition}" Height="29" MinHeight="29" Padding="10,3"/>
-                                                                            <Button Content="Close" Tag="{Binding}" CommandParameter="Closed [10]" Click="ControlStageAction_Click"
-                                                                                    Style="{StaticResource CommandCloseButton}" Margin="0,0,7,0"
-                                                                                    Width="72" MinWidth="72" HorizontalAlignment="Left" IsEnabled="{Binding ControlCanInspectPosition}" Height="29" MinHeight="29" Padding="10,3"/>
-                                                                        </StackPanel>
+                                                                            </Grid.Style>
+                                                                            <Grid.ColumnDefinitions><ColumnDefinition Width="72"/><ColumnDefinition Width="7"/><ColumnDefinition Width="72"/></Grid.ColumnDefinitions>
+                                                                            <Button Grid.Column="0" Content="Open" Tag="{Binding}" CommandParameter="Open [01]" Click="ControlStageAction_Click"
+                                                                                    Style="{StaticResource CommandOpenButton}" Margin="0"
+                                                                                    HorizontalAlignment="Stretch" IsEnabled="{Binding ControlCanInspectPosition}" Height="29" MinHeight="29" MinWidth="72" Padding="6,3"/>
+                                                                            <Button Grid.Column="2" Content="Close" Tag="{Binding}" CommandParameter="Closed [10]" Click="ControlStageAction_Click"
+                                                                                    Style="{StaticResource CommandCloseButton}" Margin="0"
+                                                                                    HorizontalAlignment="Stretch" IsEnabled="{Binding ControlCanInspectPosition}" Height="29" MinHeight="29" MinWidth="72" Padding="6,3"/>
+                                                                        </Grid>
 
                                                                         <StackPanel Orientation="Horizontal">
                                                                             <StackPanel.Style>
@@ -790,29 +830,31 @@
                                                                                     IsEnabled="{Binding ControlSupportsOperate}" Height="29" MinHeight="29" Padding="10,3"/>
                                                                         </StackPanel>
 
-                                                                        <StackPanel Orientation="Horizontal">
-                                                                            <StackPanel.Style>
-                                                                                <Style TargetType="StackPanel"><Setter Property="Visibility" Value="Collapsed"/>
+                                                                        <Grid>
+                                                                            <Grid.Style>
+                                                                                <Style TargetType="Grid"><Setter Property="Visibility" Value="Collapsed"/>
                                                                                     <Style.Triggers><MultiDataTrigger><MultiDataTrigger.Conditions><Condition Binding="{Binding IsRaiseLowerControl}" Value="True"/><Condition Binding="{Binding ControlConfirmationPending}" Value="False"/></MultiDataTrigger.Conditions><Setter Property="Visibility" Value="Visible"/></MultiDataTrigger></Style.Triggers>
                                                                                 </Style>
-                                                                            </StackPanel.Style>
-                                                                            <Button Content="Raise" Tag="{Binding}" CommandParameter="Raise" Click="ControlStageAction_Click" Style="{StaticResource CommandRaiseButton}" Margin="0,0,7,0"
-                                                                                    IsEnabled="{Binding ControlSupportsOperate}" Height="29" MinHeight="29" Padding="10,3"/>
-                                                                            <Button Content="Lower" Tag="{Binding}" CommandParameter="Lower" Click="ControlStageAction_Click" Style="{StaticResource CommandLowerButton}"
-                                                                                    IsEnabled="{Binding ControlSupportsOperate}" Height="29" MinHeight="29" Padding="10,3"/>
-                                                                        </StackPanel>
-
-                                                                        <StackPanel Orientation="Horizontal">
-                                                                            <StackPanel.Style>
-                                                                                <Style TargetType="StackPanel"><Setter Property="Visibility" Value="Collapsed"/>
+                                                                            </Grid.Style>
+                                                                            <Grid.ColumnDefinitions><ColumnDefinition Width="72"/><ColumnDefinition Width="7"/><ColumnDefinition Width="72"/></Grid.ColumnDefinitions>
+                                                                            <Button Grid.Column="0" Content="Raise" Tag="{Binding}" CommandParameter="Raise" Click="ControlStageAction_Click" Style="{StaticResource CommandRaiseButton}" Margin="0"
+                                                                                    IsEnabled="{Binding ControlSupportsOperate}" Height="29" MinHeight="29" MinWidth="72" Padding="6,3"/>
+                                                                            <Button Grid.Column="2" Content="Lower" Tag="{Binding}" CommandParameter="Lower" Click="ControlStageAction_Click" Style="{StaticResource CommandLowerButton}"
+                                                                                    IsEnabled="{Binding ControlSupportsOperate}" Height="29" MinHeight="29" MinWidth="72" Padding="6,3"/>
+                                                                        </Grid>
+
+                                                                        <Grid>
+                                                                            <Grid.Style>
+                                                                                <Style TargetType="Grid"><Setter Property="Visibility" Value="Collapsed"/>
                                                                                     <Style.Triggers><DataTrigger Binding="{Binding IsBooleanControl}" Value="True"><Setter Property="Visibility" Value="Visible"/></DataTrigger></Style.Triggers>
                                                                                 </Style>
-                                                                            </StackPanel.Style>
-                                                                            <Button Content="True" Tag="{Binding}" CommandParameter="True" Click="ControlQuickAction_Click" Style="{StaticResource CommandCloseButton}" Margin="0,0,7,0"
-                                                                                    IsEnabled="{Binding ControlSupportsOperate}" Height="29" MinHeight="29" Padding="10,3"/>
-                                                                            <Button Content="False" Tag="{Binding}" CommandParameter="False" Click="ControlQuickAction_Click" Style="{StaticResource CommandOpenButton}"
-                                                                                    IsEnabled="{Binding ControlSupportsOperate}" Height="29" MinHeight="29" Padding="10,3"/>
-                                                                        </StackPanel>
+                                                                            </Grid.Style>
+                                                                            <Grid.ColumnDefinitions><ColumnDefinition Width="72"/><ColumnDefinition Width="7"/><ColumnDefinition Width="72"/></Grid.ColumnDefinitions>
+                                                                            <Button Grid.Column="0" Content="True" Tag="{Binding}" CommandParameter="True" Click="ControlQuickAction_Click" Style="{StaticResource CommandCloseButton}" Margin="0"
+                                                                                    IsEnabled="{Binding ControlSupportsOperate}" Height="29" MinHeight="29" MinWidth="72" Padding="6,3"/>
+                                                                            <Button Grid.Column="2" Content="False" Tag="{Binding}" CommandParameter="False" Click="ControlQuickAction_Click" Style="{StaticResource CommandOpenButton}"
+                                                                                    IsEnabled="{Binding ControlSupportsOperate}" Height="29" MinHeight="29" MinWidth="72" Padding="6,3"/>
+                                                                        </Grid>
 
                                                                         <StackPanel Orientation="Horizontal">
                                                                             <StackPanel.Style>
@@ -854,7 +896,7 @@
                                                     <Style TargetType="Border">
                                                         <Setter Property="Visibility" Value="Collapsed"/>
                                                         <Style.Triggers>
-                                                            <DataTrigger Binding="{Binding SelectedDevice.CommandSignals.Count}" Value="0"><Setter Property="Visibility" Value="Visible"/></DataTrigger>
+                                                            <DataTrigger Binding="{Binding SelectedDevice.OperableCommandSignals.Count}" Value="0"><Setter Property="Visibility" Value="Visible"/></DataTrigger>
                                                         </Style.Triggers>
                                                     </Style>
                                                 </Border.Style>
@@ -1016,7 +1058,21 @@
                                 <DataGridTextColumn Header="Signal" Binding="{Binding SignalName}" Width="195"/>
                                 <DataGridTextColumn Header="IEC Telegram" Binding="{Binding IecTelegram}" Width="320"/>
                                 <DataGridTemplateColumn Header="Value" Width="125" CellTemplate="{StaticResource ProcessValueBadgeTemplate}"/>
-                                <DataGridTextColumn Header="Quality" Binding="{Binding Quality}" Width="155"/>
+                                <DataGridTemplateColumn Header="Quality" Width="155">
+                                                <DataGridTemplateColumn.CellTemplate>
+                                                    <DataTemplate>
+                                                        <StackPanel Orientation="Horizontal" VerticalAlignment="Center">
+                                                            <TextBlock Text="{Binding Quality}" ToolTip="{Binding Quality}"
+                                                                       VerticalAlignment="Center" TextTrimming="CharacterEllipsis"/>
+                                                            <Path Data="{StaticResource InvalidQualityWarningGeometry}" Width="12" Height="12"
+                                              Stretch="Uniform" Fill="#B97800" Margin="5,0,0,0"
+                                              VerticalAlignment="Center"
+                                              Style="{StaticResource InvalidQualityWarningIconStyle}"
+                                              ToolTip="IED-reported quality validity: Invalid"/>
+                                                        </StackPanel>
+                                                    </DataTemplate>
+                                                </DataGridTemplateColumn.CellTemplate>
+                                            </DataGridTemplateColumn>
                                 <DataGridTextColumn Header="IED Timestamp" Binding="{Binding DeviceTimestamp}" Width="185"/>
                                 <DataGridTextColumn Header="Acquisition" Binding="{Binding AcquisitionShort}" IsReadOnly="True" ElementStyle="{StaticResource RcbAcquisitionTextStyle}" Width="190"/>
                             </DataGrid.Columns>
@@ -1771,8 +1827,15 @@
                                            Foreground="#48586B" TextTrimming="CharacterEllipsis"/>
                             </Border>
                             <Border Grid.Column="1" BorderBrush="#E3E8EF" BorderThickness="0,0,0,1" Padding="7,3">
-                                <TextBlock Text="{Binding Value}" FontSize="11.2"
-                                           Foreground="#24364B" TextTrimming="CharacterEllipsis"/>
+                                <StackPanel Orientation="Horizontal" VerticalAlignment="Center">
+                                    <TextBlock Text="{Binding Value}" FontSize="11.2"
+                                               Foreground="#24364B" TextTrimming="CharacterEllipsis"/>
+                                    <Path Data="{StaticResource InvalidQualityWarningGeometry}" Width="12" Height="12"
+                                              Stretch="Uniform" Fill="#B97800" Margin="5,0,0,0"
+                                              VerticalAlignment="Center"
+                                              Style="{StaticResource InvalidQualityWarningIconStyle}"
+                                              ToolTip="IED-reported quality validity: Invalid"/>
+                                </StackPanel>
                             </Border>
                         </Grid>
                     </DataTemplate>
@@ -1831,9 +1894,16 @@
                                             </Style>
                                         </TextBlock.Style>
                                     </TextBlock>
-                                    <TextBlock Grid.Column="0" Text="{Binding Value}" ToolTip="{Binding Value}"
-                                               FontSize="11.2" Foreground="#344860"
-                                               TextTrimming="CharacterEllipsis"/>
+                                    <StackPanel Grid.Column="0" Orientation="Horizontal" VerticalAlignment="Center">
+                                        <TextBlock Text="{Binding Value}" ToolTip="{Binding Value}"
+                                                   FontSize="11.2" Foreground="#344860"
+                                                   TextTrimming="CharacterEllipsis"/>
+                                        <Path Data="{StaticResource InvalidQualityWarningGeometry}" Width="12" Height="12"
+                                              Stretch="Uniform" Fill="#B97800" Margin="5,0,0,0"
+                                              VerticalAlignment="Center"
+                                              Style="{StaticResource InvalidQualityWarningIconStyle}"
+                                              ToolTip="IED-reported quality validity: Invalid"/>
+                                    </StackPanel>
                                 </Grid>
                             </Border>
                         </Grid>
@@ -1981,10 +2051,34 @@
                                 <Button Content="Refresh view" Style="{StaticResource SoftButton}" Margin="0,0,6,0"
                                         Click="IedBrowserRefresh_Click"
                                         ToolTip="Rebuild view from cached SCL/discovery only; does not contact the IED"/>
+                                <Button x:Name="IedBrowserControlButton" Content="Control…"
+                                        Style="{StaticResource SoftButton}" Margin="0,0,6,0"
+                                        IsEnabled="False" Click="IedBrowserControl_Click"
+                                        ToolTip="Only enabled when this online DO has an existing live-verified native IEC Control descriptor."/>
+                                <Button x:Name="IedBrowserWriteButton" Style="{StaticResource SoftButton}"
+                                        Margin="0,0,6,0" MinWidth="81"
+                                        IsEnabled="False" Click="IedBrowserWrite_Click"
+                                        ToolTip="Write the selected Data Attribute or focused Data Object using the exact live MMS type.">
+                                    <StackPanel Orientation="Horizontal">
+                                        <Viewbox Width="15" Height="15" Margin="0,0,5,0" IsHitTestVisible="False">
+                                            <Path Width="960" Height="960" Fill="#345A83"
+                                                  Data="M167,840 Q146,845 130.5,829.5 T120,793 L160,602 358,800 167,840 Z M358,800 L160,602 618,144 Q641,121 675,121 T732,144 L816,228 Q839,251 839,285 T816,342 L358,800 Z M675,200 L261,614 346,699 760,285 675,200 Z"/>
+                                        </Viewbox>
+                                        <TextBlock Text="Write" VerticalAlignment="Center"/>
+                                    </StackPanel>
+                                </Button>
+                                <Button x:Name="IedBrowserWriteDoButton" Style="{StaticResource SoftButton}"
+                                        Content="Write DO" IsEnabled="False" Click="IedBrowserWriteDo_Click"
+                                        Margin="0,0,6,0" MinWidth="84"
+                                        ToolTip="Edit one or several live configuration Data Attributes of the focused DO. CO operations use Control."/>
                                 <Button x:Name="IedBrowserReadPageButton" Content="Read" Tag="Page"
                                         Style="{StaticResource SoftButton}" Margin="0,0,6,0"
                                         Click="IedBrowserReadValues_Click"
                                         ToolTip="Read values for the current Browser object over MMS. Live monitoring uses the report stream."/>
+                                <Button x:Name="IedBrowserConfigWriteButton" Content="Config Write…" IsEnabled="False"
+                                        Style="{StaticResource SoftButton}" Margin="0,0,6,0"
+                                        Click="IedBrowserWriteValues_Click"
+                                        ToolTip="Open explicit native MMS configuration Write for the selected live DO/DA; never sends Operate"/>
                                 <Button x:Name="IedBrowserReadLnButton" Content="Read LN" Tag="LN"
                                         Visibility="Collapsed" Style="{StaticResource SoftButton}" Margin="0,0,6,0"
                                         Click="IedBrowserReadValues_Click"
@@ -2172,6 +2266,7 @@
                                 </Border>
                                 <Grid Grid.Row="1">
                                 <ListView x:Name="IedBrowserDetailList"
+                                          SelectionChanged="IedBrowserDetailList_SelectionChanged"
                                           SelectionMode="Single"
                                           ClipToBounds="True"
                                           ScrollViewer.HorizontalScrollBarVisibility="Disabled"
@@ -2400,14 +2495,32 @@
             </TabItem>
         </TabControl>
 
-        <Border Grid.Row="2" Margin="0,10,0,0" Background="#EAF1FF" BorderBrush="#CFE0FF" BorderThickness="1" CornerRadius="14" Padding="11,7">
-            <Grid>
-                <Grid.ColumnDefinitions><ColumnDefinition Width="*"/><ColumnDefinition Width="Auto"/></Grid.ColumnDefinitions>
-                <StackPanel Orientation="Horizontal">
-                    <Ellipse Width="8" Height="8" Fill="{StaticResource Accent}" Margin="0,0,9,0" VerticalAlignment="Center"/>
-                    <TextBlock Text="{Binding LastStatusText}" FontSize="12" FontWeight="SemiBold" Foreground="{StaticResource Ink}" TextTrimming="CharacterEllipsis"/>
-                </StackPanel>
-                <TextBlock Grid.Column="1" Text="{Binding RuntimeSummaryText}" FontSize="11.8" Foreground="{StaticResource Muted}" Margin="12,0,0,0"/>
+        <!-- The status strip must NEVER grow when diagnostics contain newlines or stack traces. -->
+        <Border Grid.Row="2" Height="34" MinHeight="34" MaxHeight="34"
+                Margin="0,7,0,0" Background="#EAF1FF" BorderBrush="#CFE0FF"
+                BorderThickness="1" CornerRadius="8" Padding="10,0" ClipToBounds="True">
+            <Grid Height="32" VerticalAlignment="Center" ClipToBounds="True">
+                <Grid.ColumnDefinitions>
+                    <ColumnDefinition Width="*"/>
+                    <ColumnDefinition Width="Auto"/>
+                </Grid.ColumnDefinitions>
+                <Grid Grid.Column="0" MinWidth="0" ClipToBounds="True">
+                    <Grid.ColumnDefinitions>
+                        <ColumnDefinition Width="Auto"/>
+                        <ColumnDefinition Width="*"/>
+                    </Grid.ColumnDefinitions>
+                    <Ellipse Width="7" Height="7" Fill="{StaticResource Accent}"
+                             Margin="0,0,8,0" VerticalAlignment="Center"/>
+                    <TextBlock Grid.Column="1" Text="{Binding LastStatusText}"
+                               VerticalAlignment="Center" FontSize="11" FontWeight="Medium"
+                               Foreground="{StaticResource Ink}" TextWrapping="NoWrap"
+                               TextTrimming="CharacterEllipsis" MaxHeight="19"/>
+                </Grid>
+                <TextBlock Grid.Column="1" Text="{Binding RuntimeSummaryText}"
+                           VerticalAlignment="Center" FontSize="10.5"
+                           Foreground="{StaticResource Muted}" Margin="12,0,0,0"
+                           TextWrapping="NoWrap" TextTrimming="CharacterEllipsis"
+                           MaxHeight="19"/>
             </Grid>
         </Border>
 
diff --git a/MainWindow.xaml.cs b/MainWindow.xaml.cs
index 0eed0e818..4b397f427 100644
--- a/MainWindow.xaml.cs
+++ b/MainWindow.xaml.cs
@@ -27,6 +27,16 @@ public partial class MainWindow : Window, INotifyPropertyChanged
     private readonly Dictionary<string, HashSet<string>> _pendingProjectSelections = new(StringComparer.OrdinalIgnoreCase);
     private readonly Dictionary<SignalDefinition, Iec61850MonitorDevice> _signalOwners = new();
     private readonly ConcurrentDictionary<string, CanonicalPointSnapshotBatch> _pendingPointSnapshots = new(StringComparer.Ordinal);
+    // A point key enters this queue only when absent from the coalescing map.
+    // Large SG7 bursts are consumed in bounded slices, not a full-map UI sweep.
+    private readonly ConcurrentQueue<string> _pendingPointUiKeys = new();
+    private readonly ConcurrentQueue<string> _priorityPointUiKeys = new();
+    private const int UiPointBatchLimit = 192;
+    private const int UiEventBatchLimit = 160;
+    private const int UiDiagnosticBatchLimit = 80;
+    // Informational totals may trail process values by <1 second. Individual
+    // point bindings and lossless SOE never wait for the summary refresh.
+    private long _nextUiPointSummaryTicks;
     // Monitoring-lifetime O(1) immutable reference/FC lookup for SignalDefinition.
     // Rebuilt after the selected signal/point model is materialized.
     private readonly Dictionary<string, IedBrowserReadBindingIndex> _canonicalSignalProjections =
@@ -69,7 +79,21 @@ public partial class MainWindow : Window, INotifyPropertyChanged
     public string NewDeviceIp { get => _newDeviceIp; set => Set(ref _newDeviceIp, value); }
     public string NewDevicePort { get => _newDevicePort; set => Set(ref _newDevicePort, value); }
     public int PollingIntervalMs { get => _pollingIntervalMs; set => Set(ref _pollingIntervalMs, Math.Clamp(value, 50, 600000)); }
-    public string LastStatusText { get => _lastStatusText; set => Set(ref _lastStatusText, value); }
+    public string LastStatusText
+    {
+        get => _lastStatusText;
+        set => Set(ref _lastStatusText, FormatSingleLineStatus(value));
+    }
+
+    // Diagnostics owns full exceptions, including stack traces. The bottom
+    // strip is one short summary, never a resizable log or multi-line surface.
+    public static string FormatSingleLineStatus(string? text)
+    {
+        if (string.IsNullOrWhiteSpace(text)) return "Ready";
+        var first = text.Split(new[] { '\r', '\n' }, StringSplitOptions.RemoveEmptyEntries)
+            .FirstOrDefault()?.Trim() ?? "Ready";
+        return first.Length <= 180 ? first : first[..177] + "…";
+    }
 
     public Iec61850MonitorDevice? SelectedDevice
     {
@@ -77,12 +101,17 @@ public Iec61850MonitorDevice? SelectedDevice
         set
         {
             if (ReferenceEquals(_selectedDevice, value)) return;
+            using var selectionPerf = IedBrowserPerformanceProbe.Measure(
+                "IED.Select", value?.Name, value?.Signals.Count ?? 0);
             if (_selectedDevice != null)
             {
                 _selectedDevice.IsActive = false;
                 ClearPendingControlConfirmations(_selectedDevice);
             }
             _selectedDevice = value;
+            // WPF LoadingRow now prioritizes actual virtualized viewport rows
+            // on this device switch. Never assume the first 48 data-model rows
+            // are currently visible after scroll/filter/sort.
             if (_selectedDevice != null)
             {
                 ClearPendingControlConfirmations(_selectedDevice);
@@ -128,6 +157,10 @@ public Iec61850MonitorDevice? SelectedDevice
     public MainWindow()
     {
         InitializeComponent();
+        // Register before first WPF layout; initial realized row events can
+        // precede Loaded, while the existing Loaded hooks stay idempotent.
+        AttachLivePointViewportPriority(ExplorerLiveValuesGrid);
+        AttachLivePointViewportPriority(GlobalLiveGrid);
         // The actual deployed assembly version, never an invented UI number.
         var assembly = typeof(MainWindow).Assembly;
         var compiled = assembly.GetCustomAttributes(
@@ -139,6 +172,7 @@ public MainWindow()
         if (version.Length > 0)
             Title = $"ARSAS v{version} - Smart IEC 61850 Communication Tester";
         DataContext = this;
+        Devices.CollectionChanged += (_, _) => _uiPointOwnersDirty = true;
         _controlShoutTimer.Tick += (_, _) =>
         {
             _controlShoutTimer.Stop();
@@ -1422,6 +1456,29 @@ private void CommandPanel_Expanded(object sender, RoutedEventArgs e)
         // The command model is preloaded on real association/selection changes.
         // A manual Refresh values remains available for explicit readback.
         ResizeCommandDockForVerifiedControls();
+        ScrollVerifiedEquipmentCommandsIntoView();
+    }
+
+    // The dock is a virtualized DataGrid: when verified equipment rows are
+    // inserted ahead of an existing generic I/O inventory, WPF can preserve
+    // the old vertical viewport at GGIO despite the sorted backing collection.
+    // Scroll to the first verified equipment DO, never manufacture a command.
+    private void ScrollVerifiedEquipmentCommandsIntoView()
+    {
+        if (SelectedDevice is not { } device || EquipmentCommandGrid is null)
+            return;
+        var first = device.CommandSignals.FirstOrDefault(signal =>
+            signal.ControlSupportsOperate &&
+            Iec61850ControlIdentity.CommandDockDisplayPriority(signal) < 100);
+        if (first is null)
+            return;
+        Dispatcher.BeginInvoke(System.Windows.Threading.DispatcherPriority.Loaded,
+            new Action(() =>
+            {
+                if (ReferenceEquals(SelectedDevice, device) &&
+                    device.CommandSignals.Contains(first))
+                    EquipmentCommandGrid.ScrollIntoView(first);
+            }));
     }
 
     private void CommandPanel_Collapsed(object sender, RoutedEventArgs e)
@@ -2516,10 +2573,29 @@ private void EnsureOfflinePointProjection(Iec61850MonitorDevice device)
 
     private void Runtime_PointUpdated(Iec61850PointSnapshot snapshot)
     {
-        _pendingPointSnapshots.AddOrUpdate(
-            CanonicalPointSnapshotAuthority.UiQueueKey(snapshot.Point),
-            _ => new CanonicalPointSnapshotBatch(snapshot, snapshot.IsValueEdge),
-            (_, current) => CanonicalPointSnapshotAuthority.Merge(current, snapshot));
+        var key = CanonicalPointSnapshotAuthority.UiQueueKey(snapshot.Point);
+        // AddOrUpdate's value-factory may run multiple times under contention.
+        // Only enqueue after a successful first insert; failed compare/exchange
+        // retries preserve association/revision semantics of Merge.
+        while (true)
+        {
+            if (_pendingPointSnapshots.TryGetValue(key, out var current))
+            {
+                var merged = CanonicalPointSnapshotAuthority.Merge(current, snapshot);
+                if (_pendingPointSnapshots.TryUpdate(key, merged, current))
+                    return;
+            }
+            else if (_pendingPointSnapshots.TryAdd(key,
+                new CanonicalPointSnapshotBatch(snapshot, snapshot.IsValueEdge)))
+            {
+                _pendingPointUiKeys.Enqueue(key);
+                // Queue urgent work only for rows WPF has actually realized.
+                // Exact FC-qualified identity; no second value store or SOE.
+                if (_livePointViewport.IsRealized(key))
+                    _priorityPointUiKeys.Enqueue(key);
+                return;
+            }
+        }
     }
 
     private void Runtime_EventRaised(Iec61850EventEntry entry)
@@ -2555,25 +2631,38 @@ private static async Task WaitForDiscoveryProgressAnimationAsync(
 
     private void UiFlushTimer_Tick(object? sender, EventArgs e)
     {
+        using var flushPerf = IedBrowserPerformanceProbe.Measure(
+            "UI.Flush", SelectedDevice?.Name, _pendingPointSnapshots.Count);
         FlushGooseSubscriberUi();
 
         var pointChanged = false;
-        // One device-owner index for the entire coalesced batch: avoid scanning
-        // every IED for every reported point in a high-rate static DataSet.
-        var queuedKeys = _pendingPointSnapshots.Keys.ToArray();
-        var deviceOwners = queuedKeys.Length == 0
-            ? null
-            : Devices.GroupBy(device => device.DeviceId, StringComparer.OrdinalIgnoreCase)
-                .ToDictionary(group => group.Key, group => group.First(),
-                    StringComparer.OrdinalIgnoreCase);
-        foreach (var pointKey in queuedKeys)
+        // Strict per-dispatch budget: a large initial SG7 data image must not
+        // monopolize WPF input/rendering. Queue holds only unique pending keys;
+        // latest canonical observation remains in the coalescing map.
+        var uiStartTicks = Stopwatch.GetTimestamp();
+        var uiDeadlineTicks = uiStartTicks + Stopwatch.Frequency / 125; // ~8 ms
+        var processedPoints = 0;
+        var deviceOwners = UiPointOwners();
+        while (processedPoints < UiPointBatchLimit &&
+               Stopwatch.GetTimestamp() < uiDeadlineTicks &&
+               TryDequeueUiPointKey(processedPoints, out var pointKey))
         {
             if (!_pendingPointSnapshots.TryRemove(pointKey, out var pending)) continue;
+            processedPoints++;
             var snapshot = pending.Snapshot;
             var point = snapshot.Point;
-            if (deviceOwners == null ||
-                !deviceOwners.TryGetValue(point.DeviceId, out var observedOwner))
-                continue;
+            if (!deviceOwners.TryGetValue(point.DeviceId, out var observedOwner) ||
+                !string.Equals(observedOwner.DeviceId, point.DeviceId,
+                    StringComparison.OrdinalIgnoreCase))
+            {
+                // DeviceId is project-deserializable. If it was rebound
+                // in-place without an ObservableCollection mutation, rebuild
+                // once instead of dropping valid session observations.
+                _uiPointOwnersDirty = true;
+                deviceOwners = UiPointOwners();
+                if (!deviceOwners.TryGetValue(point.DeviceId, out observedOwner))
+                    continue;
+            }
             // Reject queued frames from an earlier MMS connection even if
             // the new session resets its point Sequence counter to zero.
             // Never re-activate Paused/Offline rows from late runtime callbacks.
@@ -2620,7 +2709,8 @@ private void UiFlushTimer_Tick(object? sender, EventArgs e)
             // Live Monitor and SOE. Browser never has its own report decoder.
             // Canonical ingress remains first authority. The point snapshot
             // is a compatibility mirror only when Report evidence is absent.
-            observedOwner.LiveValues.PublishReport(point, snapshot.IsReportTraffic);
+            // Canonical Report compatibility mirror is admitted on the runtime
+            // ingress lane BEFORE this WPF tick, never on the Dispatcher.
             // Never mirror the payload into signals directly. Only the actual
             // canonical Report observation with matching association can feed
             // selected SignalDefinition presentation rows.
@@ -2645,7 +2735,7 @@ private void UiFlushTimer_Tick(object? sender, EventArgs e)
         }
 
         var eventBatch = new List<Iec61850EventEntry>(256);
-        while (eventBatch.Count < 1000 && _pendingEvents.TryDequeue(out var entry))
+        while (eventBatch.Count < UiEventBatchLimit && _pendingEvents.TryDequeue(out var entry))
             eventBatch.Add(entry);
         if (eventBatch.Count > 0)
         {
@@ -2670,7 +2760,7 @@ private void UiFlushTimer_Tick(object? sender, EventArgs e)
         }
 
         var diagnosticBatch = new List<DiagnosticEntry>(128);
-        while (diagnosticBatch.Count < 500 && _pendingDiagnostics.TryDequeue(out var diagnostic))
+        while (diagnosticBatch.Count < UiDiagnosticBatchLimit && _pendingDiagnostics.TryDequeue(out var diagnostic))
             diagnosticBatch.Add(diagnostic);
         if (diagnosticBatch.Count > 0)
         {
@@ -2713,8 +2803,13 @@ private void UiFlushTimer_Tick(object? sender, EventArgs e)
             }
         }
 
-        if (pointChanged || eventBatch.Count > 0 || diagnosticBatch.Count > 0)
+        var nowTicks = Stopwatch.GetTimestamp();
+        if (eventBatch.Count > 0 || diagnosticBatch.Count > 0 ||
+            (pointChanged && nowTicks >= _nextUiPointSummaryTicks))
+        {
             RaiseWorkspaceCounts();
+            _nextUiPointSummaryTicks = nowTicks + Stopwatch.Frequency;
+        }
         if (MainTabs.SelectedIndex == IedBrowserWorkspaceIndex)
             RefreshIedBrowserVisibleValues();
     }
diff --git a/Models/CanonicalBrowserViewportIndex.cs b/Models/CanonicalBrowserViewportIndex.cs
new file mode 100644
index 000000000..5b8d6be84
--- /dev/null
+++ b/Models/CanonicalBrowserViewportIndex.cs
@@ -0,0 +1,122 @@
+namespace ArIED61850Tester.Models;
+
+/// <summary>
+/// A per-rendered-page, immutable map from verified canonical dirty references
+/// to WPF detail rows. The ledger remains the only observation authority:
+/// this index stores dependency KEYS and row identities, never process values.
+/// </summary>
+public sealed class CanonicalBrowserViewportIndex
+{
+    private readonly IReadOnlyDictionary<string, IedBrowserDetailRow[]> _rowsByScope;
+    private readonly bool _hasOpaqueRows;
+
+    public CanonicalBrowserViewportIndex(IEnumerable<IedBrowserDetailRow> rows)
+    {
+        ArgumentNullException.ThrowIfNull(rows);
+        var scopeRows = new Dictionary<string, List<IedBrowserDetailRow>>(StringComparer.Ordinal);
+        var rowCount = 0;
+        var opaque = false;
+        foreach (var row in rows)
+        {
+            rowCount++;
+            var dependencies = new HashSet<string>(StringComparer.Ordinal);
+            Add(row.ValueReference);
+            Add(row.FallbackValueReference);
+            Add(row.EngineeringUnitReference);
+            Add(row.ReadObjectReference);
+            foreach (var candidate in row.ParentObservedChildCandidates)
+                Add(candidate.Reference);
+            foreach (var child in row.NameplateDcReferences)
+                Add(child);
+            if (row.PolarPlan is { } polar)
+            {
+                Add(polar.MagnitudeReference);
+                Add(polar.AngleReference);
+            }
+            foreach (var phasePlan in row.PhasePlans)
+            {
+                Add(phasePlan.MagnitudeReference);
+                Add(phasePlan.AngleReference);
+            }
+            foreach (var vector in row.VectorComponents)
+            {
+                Add(vector.MagnitudeReference);
+                Add(vector.AngleReference);
+            }
+            foreach (var scalar in row.ScalarComponents)
+                Add(scalar.Reference);
+            // A synthetic aggregate or a vendor-specific resolver without any
+            // declared key cannot safely be optimized by an exact-key filter.
+            if ((row.Kind is "Data" or "Object") && dependencies.Count == 0)
+                opaque = true;
+            foreach (var scope in dependencies)
+            {
+                if (!scopeRows.TryGetValue(scope, out var matches))
+                    scopeRows[scope] = matches = new List<IedBrowserDetailRow>();
+                matches.Add(row);
+            }
+
+            void Add(string? reference)
+            {
+                if (string.IsNullOrWhiteSpace(reference)) return;
+                var canonical = IedBrowserLiveValues.CanonicalReference(reference);
+                var scope = DataObjectScope(canonical);
+                if (scope.Length == 0)
+                    opaque = true;
+                else
+                    dependencies.Add(scope);
+            }
+        }
+        _rowsByScope = scopeRows.ToDictionary(
+            pair => pair.Key, pair => pair.Value.ToArray(), StringComparer.Ordinal);
+        _hasOpaqueRows = opaque || rowCount == 0;
+    }
+
+    /// <summary>
+    /// Returns true only when the journal covers the entire cursor range and
+    /// every potentially affected row is identified. Otherwise caller must
+    /// run the original full projection unchanged (fail open for UI refresh).
+    /// </summary>
+    public bool TryFindDirtyRows(CanonicalValueChangeBatch delta, long expectedVersion,
+        out HashSet<IedBrowserDetailRow> dirty)
+    {
+        ArgumentNullException.ThrowIfNull(delta);
+        dirty = new HashSet<IedBrowserDetailRow>(ReferenceEqualityComparer.Instance);
+        if (_hasOpaqueRows || delta.RequiresFullRefresh ||
+            delta.ThroughRevision != expectedVersion ||
+            delta.LatestRevision != expectedVersion)
+            return false;
+
+        var dirtyScopes = new HashSet<string>(StringComparer.Ordinal);
+        foreach (var change in delta.Changes)
+        {
+            if (change.Kind == CanonicalValueChangeKind.AssociationInvalidated ||
+                change.FunctionalConstraint is "CF" or "DC" or "SG" or "SE" or "RP" or "BR")
+                return false; // Metadata, control and shared units may affect many rows.
+            var scope = DataObjectScope(change.Reference);
+            if (scope.Length == 0) return false;
+            dirtyScopes.Add(scope);
+        }
+        foreach (var scope in dirtyScopes)
+        {
+            if (_rowsByScope.TryGetValue(scope, out var affected))
+                foreach (var row in affected) dirty.Add(row);
+        }
+        return true;
+    }
+
+    // The first named DO in LD/LN.DO.* is the stable IEC containment boundary.
+    // Matching at DO level deliberately refreshes the whole q/t/phasor sibling
+    // group, rather than risking missed quality, vector or parent summaries.
+    private static string DataObjectScope(string reference)
+    {
+        if (string.IsNullOrWhiteSpace(reference)) return "";
+        var slash = reference.IndexOf('/');
+        if (slash < 1 || slash == reference.Length - 1) return "";
+        var dot = reference.IndexOf('.', slash + 1);
+        if (dot < 0 || dot == reference.Length - 1) return "";
+        var nextDot = reference.IndexOf('.', dot + 1);
+        var end = nextDot < 0 ? reference.Length : nextDot;
+        return reference[..end];
+    }
+}
diff --git a/Models/CanonicalValueChangeJournal.cs b/Models/CanonicalValueChangeJournal.cs
new file mode 100644
index 000000000..044b71957
--- /dev/null
+++ b/Models/CanonicalValueChangeJournal.cs
@@ -0,0 +1,77 @@
+namespace ArIED61850Tester.Models;
+
+/// <summary>
+/// Revision-only notification from the canonical ledger. This is NOT another
+/// live-value store, Report decoder, event history, or IEC acquisition channel.
+/// Readers always resolve the current evidence through IedBrowserLiveValues.
+/// </summary>
+public enum CanonicalValueChangeKind
+{
+    AssociationInvalidated,
+    Report,
+    Read,
+    ReportCompanion
+}
+
+public sealed record CanonicalValueChange(
+    long Revision, long Association, string Reference, string FunctionalConstraint,
+    CanonicalValueChangeKind Kind);
+
+public sealed record CanonicalValueChangeBatch(
+    long ThroughRevision, long LatestRevision, bool RequiresFullRefresh,
+    IReadOnlyList<CanonicalValueChange> Changes);
+
+/// <summary>
+/// Constant-memory revision ring shared by arbitrarily many independent cursor
+/// readers. All methods run within the enclosing IedBrowserLiveValues gate:
+/// there is no second lock, cross-thread event handler, UI callback, or queue
+/// consumer that can steal another workspace's notifications.
+/// </summary>
+internal sealed class CanonicalValueChangeJournal
+{
+    private readonly CanonicalValueChange?[] _ring;
+    private int _count;
+    private long _latestRevision;
+
+    internal CanonicalValueChangeJournal(int capacity = 4096)
+    {
+        if (capacity < 2) throw new ArgumentOutOfRangeException(nameof(capacity));
+        _ring = new CanonicalValueChange[capacity];
+    }
+
+    internal void Append(CanonicalValueChange change)
+    {
+        if (change.Revision != _latestRevision + 1)
+            throw new InvalidOperationException("Canonical revision journal must be contiguous.");
+        _latestRevision = change.Revision;
+        _ring[(int)(_latestRevision % _ring.Length)] = change;
+        if (_count < _ring.Length) _count++;
+    }
+
+    internal CanonicalValueChangeBatch Read(long afterRevision, int maxChanges)
+    {
+        if (maxChanges is < 1 or > 4096)
+            throw new ArgumentOutOfRangeException(nameof(maxChanges));
+        if (afterRevision < 0 || afterRevision > _latestRevision)
+            return new(_latestRevision, _latestRevision, true, []);
+        if (afterRevision == _latestRevision)
+            return new(afterRevision, _latestRevision, false, []);
+
+        var earliestRetained = _latestRevision - _count + 1;
+        if (afterRevision < earliestRetained - 1)
+            return new(_latestRevision, _latestRevision, true, []);
+
+        var upper = Math.Min(_latestRevision, afterRevision + maxChanges);
+        var changes = new CanonicalValueChange[(int)(upper - afterRevision)];
+        var invalidated = false;
+        for (long revision = afterRevision + 1; revision <= upper; revision++)
+        {
+            var change = _ring[(int)(revision % _ring.Length)]!;
+            if (change.Revision != revision)
+                return new(_latestRevision, _latestRevision, true, []);
+            changes[(int)(revision - afterRevision - 1)] = change;
+            invalidated |= change.Kind == CanonicalValueChangeKind.AssociationInvalidated;
+        }
+        return new(upper, _latestRevision, invalidated, changes);
+    }
+}
diff --git a/Models/Iec61850ControlFatEvidence.cs b/Models/Iec61850ControlFatEvidence.cs
new file mode 100644
index 000000000..1e39b4b17
--- /dev/null
+++ b/Models/Iec61850ControlFatEvidence.cs
@@ -0,0 +1,57 @@
+namespace ArIED61850Tester.Models;
+
+/// <summary>
+/// Copy-only field FAT snapshot. Never polls the relay, sends MMS requests,
+/// changes a control lease, or claims physical feedback from a service reply.
+/// </summary>
+public sealed record Iec61850ControlFatEvidence(
+    DateTimeOffset CapturedAtUtc,
+    string Ied,
+    string ControlObject,
+    string Cdc,
+    string ControlModel,
+    string CurrentValueAtInspection,
+    string RequestedValue,
+    string OriginCategory,
+    string OriginatorId,
+    bool InterlockCheck,
+    bool SynchroCheck,
+    bool Test,
+    string ResultStage,
+    string ResultSummary,
+    string ControlNumber,
+    string CommandTermination,
+    string WireTimeline,
+    string DiagnosticEvidence)
+{
+    public string ToClipboardText()
+    {
+        static string Line(string? value) =>
+            (value ?? "").Replace("\r", " ").Replace("\n", " ").Trim();
+
+        return string.Join(Environment.NewLine, new[]
+        {
+            "ARSAS IEC 61850 CONTROL FAT EVIDENCE",
+            "Captured UTC: " + CapturedAtUtc.ToUniversalTime().ToString("O", System.Globalization.CultureInfo.InvariantCulture),
+            "IED: " + Line(Ied),
+            "Object: " + Line(ControlObject),
+            "CDC / ctlModel: " + Line(Cdc) + " / " + Line(ControlModel),
+            "IED value at last inspection: " + Line(CurrentValueAtInspection),
+            "Requested value: " + Line(RequestedValue),
+            "Origin: " + Line(OriginCategory) + " / " + Line(OriginatorId),
+            "InterlockCheck: " + InterlockCheck.ToString(System.Globalization.CultureInfo.InvariantCulture),
+            "SynchroCheck: " + SynchroCheck.ToString(System.Globalization.CultureInfo.InvariantCulture),
+            "Test: " + Test.ToString(System.Globalization.CultureInfo.InvariantCulture),
+            "Result: " + Line(ResultStage),
+            "Summary: " + Line(ResultSummary),
+            "ctlNum: " + Line(ControlNumber),
+            "CommandTermination: " + Line(CommandTermination),
+            "MMS steps (evidence only): " + Line(WireTimeline),
+            "",
+            "IEC 61850 DIAGNOSTICS",
+            DiagnosticEvidence ?? "",
+            "",
+            "NOTICE: MMS service acceptance does not prove primary equipment movement. Verify independent process feedback and Wireshark capture."
+        });
+    }
+}
diff --git a/Models/Iec61850ControlOutcomePresentation.cs b/Models/Iec61850ControlOutcomePresentation.cs
new file mode 100644
index 000000000..526870bca
--- /dev/null
+++ b/Models/Iec61850ControlOutcomePresentation.cs
@@ -0,0 +1,81 @@
+namespace ArIED61850Tester.Models;
+
+/// <summary>
+/// UI-only interpretation of an actual IEC 61850 control-service result.
+/// Never equate MMS acceptance with independent IED process feedback, or an
+/// unknown transport outcome with an IED rejection.
+/// </summary>
+public sealed record Iec61850ControlOutcomeView(
+    string Stage, string Summary, string Tone);
+
+public static class Iec61850ControlOutcomePresentation
+{
+    /// <summary>
+    /// Compact user-facing wire sequence derived only from actual reported steps.
+    /// Does not imply that a physical breaker/contact position changed.
+    /// </summary>
+    public static string WireTimeline(Iec61850ControlCommandResult result)
+    {
+        ArgumentNullException.ThrowIfNull(result);
+        var stages = result.WireSteps.Select(step =>
+        {
+            var action = step.Action.Equals("SelectWithValue", StringComparison.OrdinalIgnoreCase)
+                ? "SBOw" : step.Action;
+            return action + (step.RequestAccepted ? " ✓" : " rejected");
+        }).ToList();
+        if (result.CommandTerminationReceived)
+            stages.Add(result.PositiveTermination ? "Termination ✓" : "Termination negative");
+        return string.Join("  →  ", stages);
+    }
+
+    public static Iec61850ControlOutcomeView From(
+        Iec61850ControlCommandResult result, bool testMode)
+    {
+        ArgumentNullException.ThrowIfNull(result);
+        static Iec61850ControlOutcomeView View(string stage, string summary, string tone)
+            => new(stage, summary, tone);
+
+        // A live preflight can discover that the requested position already
+        // matches the IED. This is a verified no-op, not an Operate success.
+        if (result.CompletionState.Equals("NotSent", StringComparison.OrdinalIgnoreCase) &&
+            result.IsSuccess && result.FeedbackConfirmed &&
+            result.Stage.Equals("Already at requested state", StringComparison.OrdinalIgnoreCase))
+            return View("Already in position",
+                "Live IED preflight matched the requested value. No Select or Operate was sent.", "Ready");
+
+        if (result.CompletionState.Equals("NotSent", StringComparison.OrdinalIgnoreCase))
+            return View("Not sent", "No MMS control request was sent.", "Warning");
+
+        if (result.CommandTerminationReceived && !result.PositiveTermination)
+            return View("Negative termination",
+                "The IED returned a negative CommandTermination. Check diagnostics.", "Error");
+
+        if (result.WireSteps.Any(step => !step.RequestAccepted) ||
+            result.CompletionState.Equals("Rejected", StringComparison.OrdinalIgnoreCase))
+            return View("IED rejected", "The IED rejected a control-service request. Check diagnostics.", "Error");
+
+        if (result.CompletionState is "TimedOut" or "AssociationLost" or "Unknown" or
+            "WireStateUnknown" ||
+            result.CompletionState.Equals("Cancelled", StringComparison.OrdinalIgnoreCase))
+            return View("Outcome uncertain",
+                "The request may have reached the IED. Verify its state before retry.", "Warning");
+
+        if (result.FeedbackConfirmed && result.ServiceAccepted && result.IsSuccess)
+            return View("Feedback confirmed",
+                "IED service accepted; independent process feedback verified.", "Success");
+
+        if (result.ServiceAccepted)
+        {
+            if (testMode)
+                return View("Test response accepted",
+                    "Test=true was sent and accepted; this does not prove equipment state.", "Warning");
+            return View("Feedback not verified",
+                "IED accepted the control request; independent process feedback is not confirmed.", "Warning");
+        }
+
+        // Without affirmative service evidence, generic failures cannot claim
+        // either that the IED rejected the control or that nothing was sent.
+        return View("Outcome unresolved",
+            "No definitive IED acceptance was observed. Verify before another attempt.", "Warning");
+    }
+}
diff --git a/Models/IedBrowserAcceptanceMetrics.cs b/Models/IedBrowserAcceptanceMetrics.cs
index 2877e3ca0..f8e989670 100644
--- a/Models/IedBrowserAcceptanceMetrics.cs
+++ b/Models/IedBrowserAcceptanceMetrics.cs
@@ -1,3 +1,4 @@
+using System.Runtime.CompilerServices;
 using AR.Iec61850.Discovery;
 
 namespace ArIED61850Tester.Models;
@@ -29,26 +30,56 @@ public sealed record IedBrowserAcceptanceMetrics(
         $"· q {QualityDecoded}/{QualityObserved} · t {TimestampDecoded}/{TimestampObserved} " +
         "· consumer mismatch not measured";
 
-    public static IedBrowserAcceptanceMetrics Capture(
-        LiveIedModelDiscoveryDocument model,
-        IedBrowserLiveValues ledger,
-        IedBrowserSclEnumEvidence? enumEvidence = null,
-        IReadOnlyList<IedBrowserReadFailureSample>? failures = null)
+    // Cache only immutable model declarations; never cache observed process values.
+    // A model's 25k+ attributes must not be regrouped on every WPF refresh.
+    private sealed record Target(string Reference, string Fc, bool Quality, bool Timestamp, bool SettingEnum);
+    private sealed record ModelTargets(Target[] Attributes, string[] CfPairOwners);
+    private static readonly ConditionalWeakTable<LiveIedModelDiscoveryDocument, ModelTargets>
+        TargetCache = new();
+
+    private static ModelTargets IndexModel(LiveIedModelDiscoveryDocument model)
     {
-        ArgumentNullException.ThrowIfNull(model);
-        ArgumentNullException.ThrowIfNull(ledger);
         var readableFc = new HashSet<string>(
             ["ST", "MX", "CF", "DC", "SP", "SG", "SE", "EX"],
             StringComparer.OrdinalIgnoreCase);
-        var targets = model.LogicalDevices.SelectMany(ld => ld.LogicalNodes)
+        var unique = model.LogicalDevices.SelectMany(ld => ld.LogicalNodes)
             .SelectMany(ln => ln.DataObjects).SelectMany(o => o.Attributes)
             .Where(a => readableFc.Contains(a.FunctionalConstraint) &&
                 !string.IsNullOrWhiteSpace(a.MmsReference))
             .GroupBy(a => Key(a.MmsReference, a.FunctionalConstraint),
                 StringComparer.Ordinal)
-            // Duplicate declarations are never counted as independently
-            // verified attributes, nor used to fabricate coverage.
             .Where(g => g.Count() == 1).Select(g => g.Single()).ToArray();
+        var targets = unique.Select(attr =>
+        {
+            var reference = IedBrowserLiveValues.CanonicalReference(attr.MmsReference);
+            var fc = attr.FunctionalConstraint;
+            return new Target(reference, fc,
+                reference.EndsWith(".q", StringComparison.Ordinal),
+                reference.EndsWith(".t", StringComparison.Ordinal),
+                fc.Equals("SG", StringComparison.OrdinalIgnoreCase) &&
+                reference.EndsWith(".setVal", StringComparison.Ordinal) &&
+                (attr.SclBType.Equals("Enum", StringComparison.OrdinalIgnoreCase) ||
+                 attr.MmsType.Equals("enumerated", StringComparison.OrdinalIgnoreCase) ||
+                 attr.MmsType.Equals("enum", StringComparison.OrdinalIgnoreCase)));
+        }).ToArray();
+        var allCf = targets.Where(a => a.Fc.Equals("CF", StringComparison.OrdinalIgnoreCase))
+            .Select(a => a.Reference).ToHashSet(StringComparer.Ordinal);
+        var owners = allCf.Where(x =>
+            x.EndsWith(".units.SIUnit", StringComparison.Ordinal) &&
+            allCf.Contains(x[..^".SIUnit".Length] + ".multiplier"))
+            .Select(x => x[..^".SIUnit".Length]).ToArray();
+        return new ModelTargets(targets, owners);
+    }
+
+    public static IedBrowserAcceptanceMetrics Capture(
+        LiveIedModelDiscoveryDocument model,
+        IedBrowserLiveValues ledger,
+        IedBrowserSclEnumEvidence? enumEvidence = null,
+        IReadOnlyList<IedBrowserReadFailureSample>? failures = null)
+    {
+        ArgumentNullException.ThrowIfNull(model);
+        ArgumentNullException.ThrowIfNull(ledger);
+        var targets = TargetCache.GetValue(model, IndexModel);
         var fresh = 0;
         var qObserved = 0;
         var qDecoded = 0;
@@ -58,12 +89,12 @@ public static IedBrowserAcceptanceMetrics Capture(
         var sgDecoded = 0;
         var missing = 0;
 
-        foreach (var target in targets)
+        foreach (var target in targets.Attributes)
         {
-            var reference = IedBrowserLiveValues.CanonicalReference(target.MmsReference);
-            var fc = target.FunctionalConstraint;
-            var isQuality = reference.EndsWith(".q", StringComparison.Ordinal);
-            var isTime = reference.EndsWith(".t", StringComparison.Ordinal);
+            var reference = target.Reference;
+            var fc = target.Fc;
+            var isQuality = target.Quality;
+            var isTime = target.Timestamp;
             var kind = isQuality ? "Quality" : isTime ? "Timestamp" : "";
             if (!ledger.TryGet(reference, fc, out var observed,
                     requiredEvidence: kind) ||
@@ -84,26 +115,14 @@ public static IedBrowserAcceptanceMetrics Capture(
                 if (observed.TimeBits is { IsDecoded: true,
                     HasWireProvenance: true }) tDecoded++;
             }
-            if (fc.Equals("SG", StringComparison.OrdinalIgnoreCase) &&
-                reference.EndsWith(".setVal", StringComparison.Ordinal) &&
-                (target.SclBType.Equals("Enum", StringComparison.OrdinalIgnoreCase) ||
-                 target.MmsType.Equals("enumerated", StringComparison.OrdinalIgnoreCase) ||
-                 target.MmsType.Equals("enum", StringComparison.OrdinalIgnoreCase)))
+            if (target.SettingEnum)
             {
                 sgObserved++;
                 if (enumEvidence?.TryFormat(reference, fc, observed.Value,
                         out _, out _) == true) sgDecoded++;
             }
         }
-        var allCf = targets.Where(a =>
-            a.FunctionalConstraint.Equals("CF", StringComparison.OrdinalIgnoreCase))
-            .Select(a => IedBrowserLiveValues.CanonicalReference(a.MmsReference))
-            .ToHashSet(StringComparer.Ordinal);
-        var cfOwners = allCf.Where(x =>
-            x.EndsWith(".units.SIUnit", StringComparison.Ordinal) &&
-            allCf.Contains(x[..^".SIUnit".Length] + ".multiplier"))
-            .Select(x => x[..^".SIUnit".Length])
-            .ToArray();
+        var cfOwners = targets.CfPairOwners;
         var cfEvidence = new IedBrowserCfEvidencePresentation(ledger, model, null);
         var proved = cfOwners.Count(x =>
             cfEvidence.TryFormatUnitsParent(x, "CF", out _, out _, out var authority) &&
@@ -111,7 +130,7 @@ public static IedBrowserAcceptanceMetrics Capture(
         var failedSamples = failures?.Count(x =>
             x.Kind is IedBrowserReadAbsenceKind.Failed or
                 IedBrowserReadAbsenceKind.Interrupted) ?? 0;
-        return new IedBrowserAcceptanceMetrics(targets.Length, fresh,
+        return new IedBrowserAcceptanceMetrics(targets.Attributes.Length, fresh,
             missing, failedSamples, cfOwners.Length, proved,
             sgObserved, sgDecoded, qObserved, qDecoded, tObserved, tDecoded);
     }
diff --git a/Models/IedBrowserControlEligibility.cs b/Models/IedBrowserControlEligibility.cs
new file mode 100644
index 000000000..5b0190dc0
--- /dev/null
+++ b/Models/IedBrowserControlEligibility.cs
@@ -0,0 +1,61 @@
+using AR.Iec61850.Discovery;
+
+namespace ArIED61850Tester.Models;
+
+/// <summary>
+/// Pure Browser toolbar decision. It never discovers, reads, selects or sends
+/// an IEC command. Caller must establish the live DO and descriptor belong
+/// to the SAME current IED association before evaluating this decision.
+/// </summary>
+public sealed record IedBrowserControlEligibility(bool CanControl, string Reason)
+{
+    public static IedBrowserControlEligibility Check(
+        bool focusIsExactDo,
+        string? focusedReference,
+        LiveIedDataObjectModel? onlineDo,
+        Iec61850ControlCapabilities? liveControl,
+        bool currentAssociationVerified,
+        bool operatorAuthorized)
+    {
+        static IedBrowserControlEligibility Off(string reason) => new(false, reason);
+
+        if (!focusIsExactDo || string.IsNullOrWhiteSpace(focusedReference))
+            return Off("Focus a verified controllable Data Object, not a status DA or folder.");
+        if (!currentAssociationVerified || onlineDo is null)
+            return Off("Current online IED association and model are not verified.");
+        if (!string.Equals(onlineDo.Reference, focusedReference, StringComparison.Ordinal))
+            return Off("Focused DO does not match the current online model.");
+        if (!operatorAuthorized)
+            return Off("Operator control authorization is required.");
+        if (liveControl is null ||
+            !string.Equals(liveControl.ObjectReference, focusedReference, StringComparison.Ordinal))
+            return Off("No exact live control descriptor for this Data Object.");
+        if (liveControl.ControlModel is Iec61850ControlModelKind.Unknown or
+            Iec61850ControlModelKind.StatusOnly)
+            return Off("Control model is unknown or StatusOnly (0).");
+
+        if (!liveControl.SupportsOperate ||
+            !liveControl.EngineControlServiceAvailable ||
+            !liveControl.IsOperationallyReady)
+            return Off("Native IEC Control did not verify an operable CO service.");
+
+        if (!string.Equals(liveControl.ControlModelReference,
+                focusedReference + ".ctlModel", StringComparison.Ordinal) ||
+            string.IsNullOrWhiteSpace(liveControl.StatusReference) ||
+            string.IsNullOrWhiteSpace(liveControl.CtlValSignature))
+            return Off("Live ctlModel, typed ctlVal or process feedback descriptor is incomplete.");
+
+        // A label such as Pos, CSWI or XCBR is never independent authority.
+        // A missing CDC on model discovery can be supplemented by the native
+        // live control descriptor; an explicit contradictory CDC must fail.
+        var cdc = liveControl.ControlCdc.ToUpperInvariant();
+        if (cdc is not ("SPC" or "DPC" or "INC" or "ENC" or "BSC" or "APC"))
+            return Off("Control CDC is unsupported or not established from live typing.");
+        var declaredCdc = (onlineDo.InferredCdc ?? "").ToUpperInvariant();
+        if (declaredCdc.Length > 0 && declaredCdc != "UNKNOWN" &&
+            declaredCdc != cdc)
+            return Off("Declared DO CDC contradicts the live typed control descriptor.");
+
+        return new(true, $"Verified {cdc} · {liveControl.ControlModel} · explicit operator command only.");
+    }
+}
diff --git a/Models/IedBrowserLiveValues.cs b/Models/IedBrowserLiveValues.cs
index ad2ef9e65..2980e831d 100644
--- a/Models/IedBrowserLiveValues.cs
+++ b/Models/IedBrowserLiveValues.cs
@@ -13,7 +13,8 @@ public sealed record IedBrowserObservedValue(
     long Revision = 0, long Association = 0, bool IsStale = false,
     MmsQualityEvidence? QualityBits = null,
     Iec61850UtcTimeEvidence? TimeBits = null,
-    bool? TypedBoolean = null);
+    bool? TypedBoolean = null,
+    string ReadWireShapeEvidence = "");
 
 internal sealed record IedBrowserObservationChannels(
     IedBrowserObservedValue? Report = null,
@@ -32,9 +33,28 @@ public sealed class IedBrowserLiveValues
     private readonly Dictionary<string, IedBrowserObservationChannels> _values =
         new(StringComparer.Ordinal);
     private long _version;
+    // One bounded cursor-based change journal for every workspace. SSOT holds
+    // the actual immutable observations; the journal holds only dirty keys.
+    private readonly CanonicalValueChangeJournal _changeJournal = new();
+    public CanonicalValueChangeBatch ReadChanges(long afterRevision, int maxChanges = 256)
+    {
+        lock (_gate) return _changeJournal.Read(afterRevision, maxChanges);
+    }
+
+    private void RecordChange(string reference, string fc, CanonicalValueChangeKind kind)
+    {
+        // Called only while holding _gate, after _version advances exactly once.
+        _changeJournal.Append(new CanonicalValueChange(
+            _version, _association, CanonicalReference(reference),
+            (fc ?? "").Trim().ToUpperInvariant(), kind));
+    }
+    // Only CF changes invalidate engineering-unit projection; ordinary ST/MX
+    // report traffic must not rebuild its signal/unit directory.
+    private long _configurationVersion;
     private long _association;
     private bool _offline;
     public long Version { get { lock (_gate) return _version; } }
+    public long ConfigurationVersion { get { lock (_gate) return _configurationVersion; } }
     public long Association { get { lock (_gate) return _association; } }
     public bool IsOffline { get { lock (_gate) return _offline; } }
 
@@ -62,7 +82,9 @@ public long BeginAssociation()
             _association++;
             _offline = false;
             _values.Clear();
+            _configurationVersion++;
             _version++;
+            RecordChange("", "", CanonicalValueChangeKind.AssociationInvalidated);
             return _association;
         }
     }
@@ -74,7 +96,9 @@ public void MarkOffline()
         {
             _offline = true;
             _association++; // invalidate in-flight callbacks even before reconnect
+            _configurationVersion++;
             _version++;
+            RecordChange("", "", CanonicalValueChangeKind.AssociationInvalidated);
         }
     }
 
@@ -85,7 +109,9 @@ public void Clear()
             _association++;
             _offline = true;
             _values.Clear();
+            _configurationVersion++;
             _version++;
+            RecordChange("", "", CanonicalValueChangeKind.AssociationInvalidated);
         }
     }
 
@@ -104,11 +130,13 @@ public bool PublishForAssociation(long association, string reference, string fc,
         MmsQualityEvidence? qualityEvidence = null,
         bool? typedBoolean = null,
         AR.Iec61850.Mms.MmsDataKind? verifiedStringWireKind = null,
-        string? declaredDataType = null)
+        string? declaredDataType = null,
+        string? readWireShapeEvidence = null)
         => TryPublish(reference, fc, value, quality, timestamp, source, association,
             utcTimeEvidence, qualityEvidence, typedBoolean: typedBoolean,
             verifiedStringWireKind: verifiedStringWireKind,
-            declaredDataType: declaredDataType);
+            declaredDataType: declaredDataType,
+            readWireShapeEvidence: readWireShapeEvidence);
 
     /// <summary>
     /// Atomically attach a verified, exact-model-owned q or t Report companion
@@ -152,6 +180,7 @@ channels.Report is not { } prior ||
             };
             _values[key] = channels with { Report = updated };
             _version++;
+            RecordChange(processReference, fc, CanonicalValueChangeKind.ReportCompanion);
             return true;
         }
     }
@@ -162,7 +191,8 @@ private bool TryPublish(string reference, string fc, string? value, string? qual
         MmsQualityEvidence? qualityEvidence, bool onlyIfNoReport = false,
         bool? typedBoolean = null,
         AR.Iec61850.Mms.MmsDataKind? verifiedStringWireKind = null,
-        string? declaredDataType = null)
+        string? declaredDataType = null,
+        string? readWireShapeEvidence = null)
     {
         if (string.IsNullOrWhiteSpace(reference) || string.IsNullOrWhiteSpace(fc) ||
             string.IsNullOrWhiteSpace(value) ||
@@ -219,11 +249,20 @@ quality is not ("Unknown" or "Pending / q not supplied" or
                           string.Equals(timestamp, previousReport?.DeviceTimestamp,
                               StringComparison.Ordinal)
                             ? previousReport?.TimeBits : null,
-                TypedBoolean: typedBoolean);
+                TypedBoolean: typedBoolean,
+                ReadWireShapeEvidence: source == "MMS Read" &&
+                    !string.IsNullOrWhiteSpace(readWireShapeEvidence)
+                        ? readWireShapeEvidence[..Math.Min(192, readWireShapeEvidence.Length)]
+                        : "");
             _values[key] = isReport
                 ? channels with { Report = observed }
                 : channels with { Read = observed };
+            if (string.Equals(fc, "CF", StringComparison.OrdinalIgnoreCase))
+                _configurationVersion++;
             _version++;
+            RecordChange(reference, fc, isReport
+                ? CanonicalValueChangeKind.Report
+                : CanonicalValueChangeKind.Read);
             return true;
         }
     }
@@ -275,6 +314,20 @@ public void PublishReport(Iec61850MonitorPoint point, bool observedReportIngress
                 point.DeviceTimestamp, "", point.DeviceTimestamp, "Report timestamp");
     }
 
+    /// <summary>
+    /// Last-resort canonical bridge for a real routed InformationReport where
+    /// the typed primary route did not publish. Runtime lane only; no WPF and
+    /// no fabricated q/t. Exact association check rejects reconnect races.
+    /// Typed primary evidence always wins via onlyIfNoReport.
+    /// </summary>
+    public bool MirrorRoutedReportIfMissingForAssociation(long association,
+        string reference, string fc, string? value, string? quality,
+        string? timestamp)
+        => association > 0 && TryPublish(reference, fc, value, quality,
+            timestamp, "Report compatibility", expectedAssociation: association,
+            utcTimeEvidence: null, qualityEvidence: null,
+            onlyIfNoReport: true);
+
     private void MirrorReportIfMissing(string reference, string fc,
         string? value, string? quality, string? timestamp, string source)
         => TryPublish(reference, fc, value, quality, timestamp, source,
@@ -358,5 +411,6 @@ public sealed record IedBrowserReadResult(
     Iec61850UtcTimeEvidence? UtcTimeEvidence = null,
     MmsQualityEvidence? QualityEvidence = null,
     bool? TypedBoolean = null,
-    AR.Iec61850.Mms.MmsDataKind? VerifiedStringWireKind = null);
+    AR.Iec61850.Mms.MmsDataKind? VerifiedStringWireKind = null,
+    string WireShapeEvidence = "");
 public sealed record IedBrowserReadProgress(int Completed, int Total);
diff --git a/Models/IedBrowserPostWriteReadRequest.cs b/Models/IedBrowserPostWriteReadRequest.cs
new file mode 100644
index 000000000..5b71afa7d
--- /dev/null
+++ b/Models/IedBrowserPostWriteReadRequest.cs
@@ -0,0 +1,59 @@
+using AR.Iec61850.Discovery;
+
+namespace ArIED61850Tester.Models;
+
+/// <summary>
+/// One-shot, exact-leaf MMS Read after an operator Write. Resolves targets
+/// from the same live discovery model and association as the completed dialog.
+/// Nothing is published to the Browser until the normal typed Read pipeline
+/// independently returns evidence from the IED.
+/// </summary>
+public sealed record IedBrowserPostWriteReadRequest(
+    string DeviceId, long Association, LiveIedModelDiscoveryDocument Model,
+    IReadOnlyList<IedBrowserReadTarget> Targets, string WriteStatus = "")
+{
+    public static IedBrowserPostWriteReadRequest? Create(
+        Iec61850MonitorDevice device,
+        LiveIedModelDiscoveryDocument? model,
+        long association,
+        IReadOnlyCollection<(string Reference, string Fc)> attempted,
+        string writeStatus = "")
+    {
+        if (model is null || !device.IsConnected || device.IsDemo ||
+            device.LiveValues.IsOffline || device.LiveValues.Association != association ||
+            !ReferenceEquals(device.LiveDiscoveryModel, model) ||
+            attempted.Count is < 1 or > 64)
+            return null;
+
+        var attributes = model.LogicalDevices.SelectMany(ld => ld.LogicalNodes)
+            .SelectMany(ln => ln.DataObjects)
+            .SelectMany(obj => obj.Attributes)
+            .Where(attr => attr.FunctionalConstraint is "CF" or "DC" or "SP" or "SG" or "SE")
+            .ToLookup(attr => IedBrowserLiveValues.CanonicalReference(attr.MmsReference) +
+                              "|" + attr.FunctionalConstraint.ToUpperInvariant(),
+                      StringComparer.Ordinal);
+        var targets = new List<IedBrowserReadTarget>(attempted.Count);
+        var seen = new HashSet<string>(StringComparer.Ordinal);
+        foreach (var (reference, fc) in attempted)
+        {
+            if (string.IsNullOrWhiteSpace(reference) ||
+                fc is not ("CF" or "DC" or "SP" or "SG" or "SE")) return null;
+            var key = IedBrowserLiveValues.CanonicalReference(reference) + "|" + fc;
+            if (!seen.Add(key)) continue;
+            var group = attributes[key].Take(2).ToArray();
+            if (group.Length != 1) return null; // never borrow another DA or ambiguous FC
+            var attr = group[0];
+            targets.Add(new IedBrowserReadTarget(attr.MmsReference,
+                attr.FunctionalConstraint,
+                string.IsNullOrWhiteSpace(attr.SclBType) ? attr.MmsType : attr.SclBType));
+        }
+        return targets.Count == 0 ? null :
+            new IedBrowserPostWriteReadRequest(device.DeviceId, association, model, targets,
+                writeStatus);
+    }
+
+    public bool Matches(Iec61850MonitorDevice device)
+        => device.DeviceId == DeviceId && device.IsConnected && !device.IsDemo &&
+           !device.LiveValues.IsOffline && device.LiveValues.Association == Association &&
+           ReferenceEquals(device.LiveDiscoveryModel, Model);
+}
diff --git a/Models/IedBrowserPresentation.cs b/Models/IedBrowserPresentation.cs
index a695a45b0..aba5a1760 100644
--- a/Models/IedBrowserPresentation.cs
+++ b/Models/IedBrowserPresentation.cs
@@ -197,8 +197,18 @@ public string Value
             if (_displayValue == value) return;
             _displayValue = value;
             PropertyChanged?.Invoke(this, new PropertyChangedEventArgs(nameof(Value)));
+            PropertyChanged?.Invoke(this, new PropertyChangedEventArgs(nameof(IsInvalidQuality)));
         }
     }
+    /// <summary>Presentation only: never alters the evidence or an IEC quality bit.</summary>
+    public bool IsInvalidQuality =>
+        QualityInvalidAttention.IsInvalid(Value) &&
+        (EvidenceKind == "Quality" &&
+            (EvidenceField.Length == 0 || EvidenceField == "Validity") ||
+         EvidenceField.Length == 0 &&
+            (FunctionalConstraint is "ST" or "MX" or "SV") &&
+            (ValueReference.EndsWith(".q", StringComparison.Ordinal) ||
+             ValueReference.EndsWith("$q", StringComparison.Ordinal)));
     private string _observationSource = "";
     private string _observationTooltip = "";
     /// <summary>Explicit observation channel, never model metadata or a source guess.</summary>
diff --git a/Models/IedBrowserRcbEnabledPresentation.cs b/Models/IedBrowserRcbEnabledPresentation.cs
index ded9db63e..2966dba6c 100644
--- a/Models/IedBrowserRcbEnabledPresentation.cs
+++ b/Models/IedBrowserRcbEnabledPresentation.cs
@@ -1,4 +1,6 @@
 using AR.Iec61850.Discovery;
+using System.Collections.ObjectModel;
+using System.Runtime.CompilerServices;
 
 namespace ArIED61850Tester.Models;
 
@@ -9,14 +11,23 @@ namespace ArIED61850Tester.Models;
 /// </summary>
 public static class IedBrowserRcbEnabledPresentation
 {
-    // Build once per coalesced UI projection, O(number of model RCBs).
-    // Ambiguous duplicate identities are never accepted as Boolean authority.
+    // Declarations never change within one live model identity. Build once,
+    // not on every 200 ms value flush. Weak keys release obsolete IED models.
+    private static readonly ConditionalWeakTable<LiveIedModelDiscoveryDocument,
+        IReadOnlyDictionary<string, IedBrowserReadTarget>> VerifiedIndexCache = new();
+    private static readonly IReadOnlyDictionary<string, IedBrowserReadTarget> EmptyIndex =
+        new ReadOnlyDictionary<string, IedBrowserReadTarget>(
+            new Dictionary<string, IedBrowserReadTarget>(StringComparer.Ordinal));
+
     public static IReadOnlyDictionary<string, IedBrowserReadTarget> VerifiedTargets(
         LiveIedModelDiscoveryDocument? verified)
+        => verified is null ? EmptyIndex : VerifiedIndexCache.GetValue(verified, BuildTargets);
+
+    // Ambiguous duplicate RCB identities still fail closed.
+    private static IReadOnlyDictionary<string, IedBrowserReadTarget> BuildTargets(
+        LiveIedModelDiscoveryDocument verified)
     {
         var targets = new Dictionary<string, IedBrowserReadTarget>(StringComparer.Ordinal);
-        if (verified is null) return targets;
-
         foreach (var group in verified.ReportControls.GroupBy(
                      item => IedBrowserLiveValues.CanonicalReference(item.Reference),
                      StringComparer.Ordinal))
@@ -30,7 +41,7 @@ public static IReadOnlyDictionary<string, IedBrowserReadTarget> VerifiedTargets(
             targets.Add(reference, new IedBrowserReadTarget(
                 reference + ".RptEna", fc, "Boolean"));
         }
-        return targets;
+        return new ReadOnlyDictionary<string, IedBrowserReadTarget>(targets);
     }
 
     public static bool TryVerifiedTrue(IedBrowserLiveValues ledger,
diff --git a/Models/IedBrowserReadBindingIndex.cs b/Models/IedBrowserReadBindingIndex.cs
index 5f2208dba..125a07bfc 100644
--- a/Models/IedBrowserReadBindingIndex.cs
+++ b/Models/IedBrowserReadBindingIndex.cs
@@ -22,7 +22,9 @@ public IedBrowserReadBindingIndex(Iec61850MonitorDevice device)
     {
         _device = device ?? throw new ArgumentNullException(nameof(device));
         var model = device.LiveDiscoveryModel ?? device.SclWorkspace?.DesignModel;
-        var schema = model is null ? null : new IedBrowserSchemaIndex(model);
+        // Same immutable schema instance as IED Browser and future consumers.
+        // Existing synchronous read-binding admission semantics are preserved.
+        var schema = model is null ? null : SharedIedSchemaIndex.GetForBinding(model);
         // Optional, strictly model-proven DO -> process leaf lookup. No
         // first-child heuristics and never borrow another FC's value.
         var signalsByKey = new Dictionary<string, List<SignalDefinition>>(StringComparer.Ordinal);
diff --git a/Models/IedBrowserReadEvidenceCsv.cs b/Models/IedBrowserReadEvidenceCsv.cs
index 4dc4bedad..3cd13bcc9 100644
--- a/Models/IedBrowserReadEvidenceCsv.cs
+++ b/Models/IedBrowserReadEvidenceCsv.cs
@@ -16,13 +16,34 @@ public static string Build(
         Func<IedBrowserReadTarget, IedBrowserReadFailureSample?>? absence = null,
         int maxTargets = 4096)
     {
+        return BuildSelection(Plan(model, page, maxTargets), ledger, absence);
+    }
+
+    /// <summary>One exact, bounded selected-page plan shared by UI preflight and export.</summary>
+    public static IReadOnlyList<IedBrowserReadTarget> Plan(
+        LiveIedModelDiscoveryDocument? model, IedBrowserTreeRow? page,
+        int maxTargets = 4096)
+        => model is null || page is null || maxTargets <= 0
+            ? Array.Empty<IedBrowserReadTarget>()
+            : IedBrowserReadPlan.Build(model, page, readAll: false)
+                .Take(Math.Min(maxTargets, 4096)).ToArray();
+
+    /// <summary>
+    /// Fail closed on an empty selection; never label a header-only export as
+    /// completed evidence. This method does not initiate MMS network traffic.
+    /// </summary>
+    public static string BuildSelection(
+        IReadOnlyList<IedBrowserReadTarget> targets,
+        IedBrowserLiveValues ledger,
+        Func<IedBrowserReadTarget, IedBrowserReadFailureSample?>? absence = null)
+    {
+        ArgumentNullException.ThrowIfNull(targets);
         ArgumentNullException.ThrowIfNull(ledger);
+        if (targets.Count == 0)
+            throw new InvalidOperationException(
+                "ZERO_TARGETS: no model-verified FC attributes in selected Browser page.");
         var result = new StringBuilder();
-        result.AppendLine("CanonicalReference,FC,MmsReference,ModelType,RootCandidate,LedgerState,FailureKind,Reason,Association,ObservedUtc,Source,RawValue,Quality,DeviceTimestamp,GvaStatus,MmsInvokeStatus,UiProjection,FailureReasonCode");
-        if (model is null || page is null || maxTargets <= 0)
-            return result.ToString();
-        var targets = IedBrowserReadPlan.Build(model, page, readAll: false)
-            .Take(Math.Min(maxTargets, 4096)).ToArray();
+        result.AppendLine("CanonicalReference,FC,MmsReference,ModelType,RootCandidate,LedgerState,FailureKind,Reason,Association,ObservedUtc,Source,RawValue,Quality,DeviceTimestamp,GvaStatus,MmsInvokeStatus,UiProjection,FailureReasonCode,DecodedMmsWireShape");
         foreach (var target in targets)
         {
             var projection = IedBrowserReadEvidenceProjector.Project(
@@ -41,7 +62,10 @@ public static string Build(
                 observation?.Source ?? "", observation?.Value ?? "",
                 observation?.Quality ?? "", observation?.DeviceTimestamp ?? "",
                 "NOT_CAPTURED", "NOT_CAPTURED", "NOT_MEASURED",
-                projection.FailureReasonCode
+                projection.FailureReasonCode,
+                // Decoded wire-kind shape is captured from MMS result, never
+                // parsed from displayed strings. No invoke/GVA proof fabricated.
+                observation?.ReadWireShapeEvidence ?? ""
             };
             result.AppendLine(string.Join(",", cells.Select(Csv)));
         }
diff --git a/Models/IedBrowserSgRootProjection.cs b/Models/IedBrowserSgRootProjection.cs
index 3f306e40b..315498a8e 100644
--- a/Models/IedBrowserSgRootProjection.cs
+++ b/Models/IedBrowserSgRootProjection.cs
@@ -109,7 +109,8 @@ void Walk(MmsTypeSpecificationNode schema, MmsDataValue value, string path, int
             output.Add(new IedBrowserReadResult(target, accepted, "", "", "",
                 TypedBoolean: value.Kind == MmsDataKind.Boolean && value.Value is bool typed
                     ? typed : null,
-                VerifiedStringWireKind: stringKind));
+                VerifiedStringWireKind: stringKind,
+                WireShapeEvidence: IedBrowserReadWireShapeEvidence.Describe(value)));
         }
         Walk(wireType, wireData, "", 0);
         return output;
diff --git a/Models/IedBrowserTypedWriteAdmission.cs b/Models/IedBrowserTypedWriteAdmission.cs
new file mode 100644
index 000000000..25cfd81e3
--- /dev/null
+++ b/Models/IedBrowserTypedWriteAdmission.cs
@@ -0,0 +1,142 @@
+using System.Text;
+using AR.Iec61850.Mms;
+
+namespace ArIED61850Tester.Models;
+
+/// <summary>
+/// Fail-closed admission for an explicit Browser data Write. The live GVA
+/// descriptor is a wire-type authority, not proof of server write permission.
+/// Control operations, setting-group lifecycles and control-block configuration
+/// must use their dedicated IEC services, never this generic path.
+/// </summary>
+public static class IedBrowserTypedWriteAdmission
+{
+    /// <summary>Exact scalar descriptor fingerprint, including wire size/constraint.</summary>
+    public static string Fingerprint(MmsTypeSpecificationNode type)
+    {
+        ArgumentNullException.ThrowIfNull(type);
+        return $"{type.Signature}|{type.MmsType}|{type.Size?.ToString() ?? "?"}|{type.SizeConstraintKind}|{type.RawSizeConstraint?.ToString() ?? "?"}";
+    }
+
+    public static string? RejectReason(
+        MmsObjectReference reference,
+        MmsVariableAccessAttributesResult live,
+        string expectedSignature,
+        MmsDataValue proposed)
+    {
+        ArgumentNullException.ThrowIfNull(live);
+        ArgumentNullException.ThrowIfNull(proposed);
+
+        if (string.IsNullOrWhiteSpace(reference.Domain) ||
+            string.IsNullOrWhiteSpace(reference.Item) ||
+            string.IsNullOrWhiteSpace(reference.FunctionalConstraint))
+            return "An exact domain, item and functional constraint are required.";
+
+        var fc = reference.FunctionalConstraint.ToUpperInvariant();
+        var segments = reference.Item.Split('$');
+        if (segments.Length < 4 ||
+            !string.Equals(segments[1], fc, StringComparison.OrdinalIgnoreCase))
+            return "MMS item does not contain the exact requested FC at its IEC position.";
+
+        if (fc == "CO" || segments.Skip(2).Any(x =>
+                x is "Oper" or "SBO" or "SBOw" or "Cancel"))
+            return "Control-service members must use IEC Control, not generic Write.";
+
+        // Existing ctlModel workflow invalidates cached control authority and
+        // re-inspects the descriptor. Generic data Write MUST NOT bypass it.
+        if (segments[^1] == "ctlModel")
+            return "ctlModel requires the existing guarded ConfigureControlModel workflow.";
+
+        // Deliberately conservative initial admission. SV substitution,
+        // setting groups, report/GOOSE blocks, BL and vendor-specific FCs need
+        // individual lifecycles/authorization before promotion.
+        if (fc is not ("CF" or "SP" or "DC"))
+            return $"FC={fc} has no approved generic data-write policy.";
+
+        if (!live.IsSuccess || live.TypeSpecification is null ||
+            live.Reference != reference ||
+            string.IsNullOrWhiteSpace(expectedSignature) ||
+            !string.Equals(expectedSignature, Fingerprint(live.TypeSpecification), StringComparison.Ordinal))
+            return "Current live GVA type or exact expected signature is unavailable/mismatched.";
+
+        var type = live.TypeSpecification;
+        if (type.Children.Count != 0 ||
+            type.MmsType is "structure" or "array" or "unknown")
+            return "Composite or unknown MMS type requires a separately verified schema editor.";
+
+        switch (type.MmsType)
+        {
+            case "boolean":
+                return proposed.Kind == MmsDataKind.Boolean && proposed.Value is bool
+                    ? null : "Expected an MMS boolean.";
+            case "integer":
+                if (proposed.Kind != MmsDataKind.Integer || proposed.Value is not long signed)
+                    return "Expected a signed MMS integer.";
+                if (!ValidWidth(type.Size)) return "Signed integer wire width is unknown.";
+                if (type.Size < 64)
+                {
+                    var min = -(1L << (type.Size!.Value - 1));
+                    var max = (1L << (type.Size!.Value - 1)) - 1;
+                    if (signed < min || signed > max)
+                        return "Signed value is outside the live MMS width.";
+                }
+                return null;
+            case "unsigned":
+                if (proposed.Kind != MmsDataKind.Unsigned || proposed.Value is not ulong unsigned)
+                    return "Expected an unsigned MMS integer.";
+                if (!ValidWidth(type.Size)) return "Unsigned integer wire width is unknown.";
+                if (type.Size < 64 && unsigned >= (1UL << type.Size!.Value))
+                    return "Unsigned value is outside the live MMS width.";
+                return null;
+            case "floating-point":
+                // MmsDataCodec currently emits single precision. Never
+                // silently narrow FLOAT64 or an unknown wire format.
+                return type.Size == 32 && proposed.Kind == MmsDataKind.FloatingPoint &&
+                       proposed.Value is float f && float.IsFinite(f)
+                    ? null : "Only live FLOAT32 with a finite single-precision value is supported.";
+            case "visible-string":
+            case "mms-string":
+                if (proposed.Kind != (type.MmsType == "visible-string"
+                        ? MmsDataKind.VisibleString : MmsDataKind.MmsString) ||
+                    proposed.Value is not string s)
+                    return "String MMS kind does not match the live type.";
+                if (s.Any(c => c > 0x7f || char.IsControl(c)))
+                    return "Non-ASCII/control characters cannot be losslessly encoded by the current codec.";
+                return ValidByteLength(type, Encoding.ASCII.GetByteCount(s))
+                    ? null : "String length violates the live MMS size constraint.";
+            case "octet-string":
+                return proposed.Kind == MmsDataKind.OctetString &&
+                       ValidByteLength(type, proposed.RawValue.Count)
+                    ? null : "Octet-string type or declared size mismatch.";
+            case "bit-string":
+                if (proposed.Kind != MmsDataKind.BitString ||
+                    proposed.RawValue.Count < 2) return "Invalid MMS bit-string.";
+                var unused = proposed.RawValue[0];
+                var count = (proposed.RawValue.Count - 1) * 8 - unused;
+                if (unused > 7 || count < 1 ||
+                    (proposed.RawValue[^1] & ((1 << unused) - 1)) != 0)
+                    return "Bit-string unused bits or padding are invalid.";
+                if (type.Size is null ||
+                    (type.SizeConstraintKind == MmsTypeSizeConstraintKind.Fixed && count != type.Size) ||
+                    (type.SizeConstraintKind == MmsTypeSizeConstraintKind.Maximum && count > type.Size))
+                    return "Bit-string width is not verified by live GVA.";
+                return null;
+            // Unverified UTC/binary time quality and all other primitive
+            // kinds remain read-only until exact write-format tests exist.
+            default:
+                return $"MMS type {type.MmsType} is not enabled for generic Write.";
+        }
+    }
+
+    private static bool ValidWidth(int? width)
+        => width is 8 or 16 or 32 or 64;
+
+    private static bool ValidByteLength(MmsTypeSpecificationNode type, int bytes)
+        => type.Size is >= 0 &&
+           (type.SizeConstraintKind switch
+           {
+               MmsTypeSizeConstraintKind.Fixed => bytes == type.Size,
+               MmsTypeSizeConstraintKind.Maximum => bytes <= type.Size,
+               _ => false
+           });
+}
diff --git a/Models/IedBrowserTypedWriteInput.cs b/Models/IedBrowserTypedWriteInput.cs
new file mode 100644
index 000000000..1dc6794d9
--- /dev/null
+++ b/Models/IedBrowserTypedWriteInput.cs
@@ -0,0 +1,69 @@
+using System.Globalization;
+using AR.Iec61850.Mms;
+
+namespace ArIED61850Tester.Models;
+
+/// <summary>
+/// Typed scalar editor: converts operator input only after a live GVA preview.
+/// No guessed string-to-IEC encoding, no overflow, no culture-dependent
+/// decimal separator and no silent Boolean/enum coercion.
+/// </summary>
+public static class IedBrowserTypedWriteInput
+{
+    public static bool TryParse(
+        MmsTypeSpecificationNode? type,
+        string? text,
+        out MmsDataValue? value,
+        out string error)
+    {
+        value = null;
+        error = "";
+        if (type is null)
+        {
+            error = "Live GVA type has not been inspected.";
+            return false;
+        }
+        var input = (text ?? "").Trim();
+        switch (type.MmsType)
+        {
+            case "boolean":
+                if (input.Equals("true", StringComparison.OrdinalIgnoreCase))
+                    value = MmsDataValue.Boolean(true);
+                else if (input.Equals("false", StringComparison.OrdinalIgnoreCase))
+                    value = MmsDataValue.Boolean(false);
+                else error = "Enter true or false; 1/0 are not auto-coerced.";
+                break;
+            case "integer":
+                if (long.TryParse(input, NumberStyles.AllowLeadingSign,
+                    CultureInfo.InvariantCulture, out var signed))
+                    value = MmsDataValue.Integer(signed);
+                else error = "Enter a signed decimal integer.";
+                break;
+            case "unsigned":
+                if (ulong.TryParse(input, NumberStyles.None,
+                    CultureInfo.InvariantCulture, out var unsigned))
+                    value = MmsDataValue.Unsigned(unsigned);
+                else error = "Enter a non-negative unsigned decimal integer.";
+                break;
+            case "floating-point" when type.Size == 32:
+                if (float.TryParse(input, NumberStyles.AllowLeadingSign |
+                    NumberStyles.AllowDecimalPoint | NumberStyles.AllowExponent,
+                    CultureInfo.InvariantCulture, out var number) && float.IsFinite(number))
+                    value = MmsDataValue.FloatingPoint(number);
+                else error = "Enter a finite, invariant-culture FLOAT32 number (use '.').";
+                break;
+            case "visible-string":
+                value = MmsDataValue.VisibleString(text ?? "");
+                break;
+            case "mms-string":
+                value = MmsDataValue.MmsString(text ?? "");
+                break;
+            default:
+                error = $"Typed text input for {type.MmsType} is not qualified.";
+                break;
+        }
+        if (value is null) return false;
+        // Admission again validates exact range, byte widths and string sizes.
+        return true;
+    }
+}
diff --git a/Models/IedBrowserUnitProjectionCache.cs b/Models/IedBrowserUnitProjectionCache.cs
new file mode 100644
index 000000000..c319aed07
--- /dev/null
+++ b/Models/IedBrowserUnitProjectionCache.cs
@@ -0,0 +1,64 @@
+using System.Runtime.CompilerServices;
+using AR.Iec61850.Discovery;
+
+namespace ArIED61850Tester.Models;
+
+/// <summary>
+/// UI-owned metadata projection cache. ST/MX Report updates never invalidate
+/// units; exact CF publication, association, model, or SignalDefinition metadata
+/// changes do. No copied observations, MMS side effects or cross-IED state.
+/// </summary>
+public sealed class IedBrowserUnitProjectionCache
+{
+    private readonly ConditionalWeakTable<Iec61850MonitorDevice, Entry> _devices = new();
+
+    public IReadOnlyDictionary<string, string?> Resolve(Iec61850MonitorDevice device,
+        LiveIedModelDiscoveryDocument? model, IedBrowserCfEvidencePresentation evidence)
+        => _devices.GetValue(device, static d => new Entry(d)).Resolve(device, model, evidence);
+
+    private sealed class Entry
+    {
+        private long _collectionRevision;
+        private long _lastCollectionRevision = -1;
+        private long _lastUnitRevision = -1;
+        private long _lastConfigurationVersion = -1;
+        private long _lastAssociation = -1;
+        private LiveIedModelDiscoveryDocument? _model;
+        private LiveIedCanonicalModel? _canonical;
+        private IReadOnlyDictionary<string, string?>? _units;
+
+        public Entry(Iec61850MonitorDevice device)
+        {
+            // One collection subscription per IED, not one handler per signal.
+            device.Signals.CollectionChanged += (_, _) =>
+                Interlocked.Increment(ref _collectionRevision);
+        }
+
+        public IReadOnlyDictionary<string, string?> Resolve(Iec61850MonitorDevice device,
+            LiveIedModelDiscoveryDocument? model, IedBrowserCfEvidencePresentation evidence)
+        {
+            var collection = Interlocked.Read(ref _collectionRevision);
+            var unit = SignalDefinition.UnitMetadataRevision;
+            var config = device.LiveValues.ConfigurationVersion;
+            var association = device.LiveValues.Association;
+            if (_units is not null &&
+                ReferenceEquals(_model, model) &&
+                ReferenceEquals(_canonical, device.LiveCanonicalModel) &&
+                _lastCollectionRevision == collection &&
+                _lastUnitRevision == unit &&
+                _lastConfigurationVersion == config &&
+                _lastAssociation == association)
+                return _units;
+
+            var rebuilt = evidence.BuildVerifiedUnits(device.Signals, model);
+            _units = rebuilt;
+            _model = model;
+            _canonical = device.LiveCanonicalModel;
+            _lastCollectionRevision = collection;
+            _lastUnitRevision = unit;
+            _lastConfigurationVersion = config;
+            _lastAssociation = association;
+            return rebuilt;
+        }
+    }
+}
diff --git a/Models/IedBrowserVerifiedDoProjection.cs b/Models/IedBrowserVerifiedDoProjection.cs
index 9d9ff1d95..0f3ccd9d5 100644
--- a/Models/IedBrowserVerifiedDoProjection.cs
+++ b/Models/IedBrowserVerifiedDoProjection.cs
@@ -127,7 +127,8 @@ void Walk(MmsTypeSpecificationNode schema, MmsDataValue wire,
                 found.Add(new IedBrowserReadResult(target, accepted, "", "", "",
                     TypedBoolean: wire.Kind == MmsDataKind.Boolean && wire.Value is bool typed
                         ? typed : null,
-                    VerifiedStringWireKind: stringKind));
+                    VerifiedStringWireKind: stringKind,
+                    WireShapeEvidence: IedBrowserReadWireShapeEvidence.Describe(wire)));
         }
         Walk(type, data, "", 0);
         return found;
diff --git a/Models/IedBrowserWritePlan.cs b/Models/IedBrowserWritePlan.cs
new file mode 100644
index 000000000..4b073611a
--- /dev/null
+++ b/Models/IedBrowserWritePlan.cs
@@ -0,0 +1,273 @@
+using System.Collections.ObjectModel;
+using System.ComponentModel;
+using System.Globalization;
+using System.Windows;
+using AR.Iec61850.Discovery;
+using AR.Iec61850.Mms;
+
+namespace ArIED61850Tester.Models;
+
+/// <summary>
+/// A finite, per-click MMS configuration Write plan. Only the exact LIVE MMS
+/// attribute directory can authorize a target. A DataSet or SCL-only row never
+/// becomes a Write target. No CO service, ST/MX/q/t or RCB fields are admitted.
+/// This is a configuration editor, NOT an IEC control-command substitute.
+/// </summary>
+public static class IedBrowserWritePlan
+{
+    private static readonly HashSet<string> ConfigurationFc =
+        new(["CF", "DC", "SP", "SG", "SE"], StringComparer.OrdinalIgnoreCase);
+
+    public const int MaxTargets = 128;
+
+    public static IReadOnlyList<IedBrowserWriteRow> Build(
+        LiveIedModelDiscoveryDocument? liveModel,
+        IedBrowserTreeRow? page, string? focusedDoReference = null)
+    {
+        if (liveModel is null || page is null || page.Kind is not ("LN" or "DO" or "DA") ||
+            page.Kind == "LN" && string.IsNullOrWhiteSpace(focusedDoReference))
+            return [];
+
+        var candidates = IedBrowserReadPlan.Build(
+            liveModel, page, false, focusedDoReference);
+        if (candidates.Count > MaxTargets * 20)
+            return []; // Refuse huge LN-wide selections; focus the exact DO.
+        var admitted = candidates
+            .Where(target => ConfigurationFc.Contains(target.FunctionalConstraint))
+            // ctlModel has a dedicated native Control-model configuration service.
+            // Never send it through the Browser primitive MMS Write path.
+            .Where(target => !target.Reference.EndsWith(".ctlModel", StringComparison.OrdinalIgnoreCase))
+            .Where(target => !target.Reference.EndsWith(".q", StringComparison.OrdinalIgnoreCase) &&
+                             !target.Reference.EndsWith(".t", StringComparison.OrdinalIgnoreCase))
+            .Where(target => IsSupported(target.DataType))
+            .DistinctBy(target => target.Reference + "|" + target.FunctionalConstraint,
+                StringComparer.OrdinalIgnoreCase)
+            .Take(MaxTargets + 1)
+            .ToArray();
+        if (admitted.Length > MaxTargets)
+            return []; // No silent partial bulk writes.
+        return admitted.Select(target => new IedBrowserWriteRow(
+            target.Reference, target.FunctionalConstraint, target.DataType)).ToArray();
+    }
+
+    public static bool IsSupported(string type)
+    {
+        var t = (type ?? "").Trim().ToUpperInvariant();
+        return t is "BOOLEAN" or "BOOL" or "ENUM" or "ENUMERATED" or
+            "INT8" or "INT16" or "INT32" or "INT64" or "INTEGER" or
+            "INT8U" or "INT16U" or "INT24U" or "INT32U" or "INT64U" or
+            "UNSIGNED" or "FLOAT32" or "FLOAT" or
+            "VISSTRING32" or "VISSTRING64" or "VISSTRING65" or
+            "VISSTRING129" or "VISSTRING255" or "VISIBLESTRING" or
+            "STRING" or "STRING255" or "MMSSTRING";
+    }
+
+    public static MmsDataValue EncodeValue(string type, string raw, string reference)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(reference);
+        raw ??= "";
+        var t = (type ?? "").Trim().ToUpperInvariant();
+        var invariant = CultureInfo.InvariantCulture;
+        if (reference.EndsWith(".ctlModel", StringComparison.OrdinalIgnoreCase))
+            throw new NotSupportedException(
+                "ctlModel requires the dedicated verified native ControlModel configuration service.");
+        return t switch
+        {
+            "BOOLEAN" or "BOOL" => raw.Trim().ToLowerInvariant() switch
+            {
+                "true" or "1" => MmsDataValue.Boolean(true),
+                "false" or "0" => MmsDataValue.Boolean(false),
+                _ => throw new FormatException("Boolean must be true/false or 1/0.")
+            },
+            // MMS integer representation does not prove an SCL EnumType mapping.
+            // Until symbol/ordinal evidence is available, never guess an enum.
+            "ENUM" or "ENUMERATED" => throw new NotSupportedException(
+                "Enumerated Write requires exact verified SCL EnumType metadata."),
+            "INT8" or "INT16" or "INT32" or "INT64" or
+                "INTEGER" => EncodeSignedInteger(raw, t, invariant),
+            "INT8U" or "INT16U" or "INT24U" or "INT32U" or "INT64U" or
+                "UNSIGNED" => EncodeUnsignedInteger(raw, t, invariant),
+            // Engine MmsDataCodec currently emits IEEE-754 binary32 only.
+            // Do NOT silently narrow a double/IEEE-754 binary64 MMS DA.
+            "FLOAT32" or "FLOAT" => EncodeFloat(raw, invariant),
+            "VISSTRING32" or "VISSTRING64" or "VISSTRING65" or
+                "VISSTRING129" or "VISSTRING255" or "VISIBLESTRING" =>
+                    EncodeString(raw, t, mms: false),
+            "STRING" or "STRING255" or "MMSSTRING" =>
+                EncodeString(raw, t, mms: true),
+            _ => throw new NotSupportedException(
+                "No verified safe primitive MMS encoder for this DA type: " + type)
+        };
+    }
+
+    private static MmsDataValue EncodeSignedInteger(string raw, string declaredType,
+        CultureInfo culture)
+    {
+        var value = long.Parse(raw.Trim(), NumberStyles.Integer, culture);
+        var (min, max) = declaredType switch
+        {
+            "INT8" => ((long)sbyte.MinValue, sbyte.MaxValue),
+            "INT16" => ((long)short.MinValue, short.MaxValue),
+            "INT32" => ((long)int.MinValue, int.MaxValue),
+            _ => (long.MinValue, long.MaxValue)
+        };
+        if (value < min || value > max)
+            throw new OverflowException("Integer is outside the declared " + declaredType + " range.");
+        return MmsDataValue.Integer(value);
+    }
+
+    private static MmsDataValue EncodeUnsignedInteger(string raw, string declaredType,
+        CultureInfo culture)
+    {
+        var value = ulong.Parse(raw.Trim(), NumberStyles.Integer, culture);
+        var max = declaredType switch
+        {
+            "INT8U" => (ulong)byte.MaxValue,
+            "INT16U" => ushort.MaxValue,
+            "INT24U" => 0xFFFFFFUL,
+            "INT32U" => uint.MaxValue,
+            _ => ulong.MaxValue
+        };
+        if (value > max)
+            throw new OverflowException("Unsigned integer exceeds the declared " +
+                                        declaredType + " range.");
+        return MmsDataValue.Unsigned(value);
+    }
+
+    private static MmsDataValue EncodeFloat(string raw, CultureInfo culture)
+    {
+        var f = float.Parse(raw.Trim(), NumberStyles.Float, culture);
+        if (!float.IsFinite(f))
+            throw new FormatException("Float must be a finite numeric value.");
+        return MmsDataValue.FloatingPoint(f);
+    }
+
+    private static MmsDataValue EncodeString(string raw, string type, bool mms)
+    {
+        var limit = type switch
+        {
+            "VISSTRING32" => 32,
+            "VISSTRING64" => 64,
+            "VISSTRING65" => 65,
+            "VISSTRING129" => 129,
+            _ => 255
+        };
+        if (raw.Length > limit)
+            throw new FormatException("String exceeds the declared length " + limit + ".");
+        if (raw.Any(c => c > 0x7F))
+            throw new FormatException("This MMS string encoder supports ASCII only.");
+        return mms ? MmsDataValue.MmsString(raw) : MmsDataValue.VisibleString(raw);
+    }
+}
+
+public sealed class IedBrowserWriteRow : INotifyPropertyChanged
+{
+    private bool _selected;
+    private string _requestedValue = "";
+    private string _current = "Not read";
+    private string _result = "Pending";
+    private bool _hasVerifiedRead;
+    public MmsDataValue? LiveBeforeValue { get; private set; }
+    public bool HasEdited { get; private set; }
+    public bool HasVerifiedRead
+    {
+        get => _hasVerifiedRead;
+        private set
+        {
+            if (_hasVerifiedRead == value) return;
+            _hasVerifiedRead = value;
+            Notify(nameof(HasVerifiedRead));
+            Notify(nameof(TextEditorVisibility));
+            Notify(nameof(BooleanEditorVisibility));
+            Notify(nameof(CtlModelEditorVisibility));
+            Notify(nameof(PlaceholderVisibility));
+            Notify(nameof(PlaceholderText));
+        }
+    }
+    public string ShortName =>
+        Reference.Split('.').LastOrDefault() ?? Reference;
+    public bool IsBoolean => DataType.Equals("BOOLEAN", StringComparison.OrdinalIgnoreCase) ||
+                             DataType.Equals("BOOL", StringComparison.OrdinalIgnoreCase);
+    public bool IsUnverifiedEnum => !IsControlModel &&
+        (DataType.Equals("ENUM", StringComparison.OrdinalIgnoreCase) ||
+         DataType.Equals("ENUMERATED", StringComparison.OrdinalIgnoreCase));
+    public string PlaceholderText => IsUnverifiedEnum
+        ? "Enum mapping unverified — Write disabled"
+        : "Read to edit";
+    public IReadOnlyList<string> BooleanOptions { get; } = new[] { "false", "true" };
+    public Visibility TextEditorVisibility =>
+        HasVerifiedRead && !IsBoolean && !IsControlModel && !IsUnverifiedEnum
+            ? Visibility.Visible : Visibility.Collapsed;
+    public Visibility BooleanEditorVisibility =>
+        HasVerifiedRead && IsBoolean && !IsControlModel
+            ? Visibility.Visible : Visibility.Collapsed;
+    public Visibility CtlModelEditorVisibility =>
+        HasVerifiedRead && IsControlModel
+            ? Visibility.Visible : Visibility.Collapsed;
+    public Visibility PlaceholderVisibility =>
+        HasVerifiedRead && !IsUnverifiedEnum ? Visibility.Collapsed : Visibility.Visible;
+
+    public void ApplyLiveRead(MmsDataValue value)
+    {
+        LiveBeforeValue = value;
+        Current = MmsDataCodec.ToDisplayString(value);
+        _requestedValue = value.Value switch
+        {
+            bool b => b ? "true" : "false",
+            string text => text,
+            long or ulong or int or uint or float or double =>
+                Convert.ToString(value.Value, CultureInfo.InvariantCulture) ?? "",
+            _ => ""
+        };
+        HasEdited = false;
+        Notify(nameof(RequestedValue));
+        HasVerifiedRead = true;
+    }
+
+    public void ExpireLiveRead()
+    {
+        HasVerifiedRead = false;
+        HasEdited = false;
+        LiveBeforeValue = null;
+    }
+
+    private void Notify(string field) =>
+        PropertyChanged?.Invoke(this, new PropertyChangedEventArgs(field));
+
+    public IedBrowserWriteRow(string reference, string fc, string type)
+    {
+        Reference = reference;
+        FunctionalConstraint = fc;
+        DataType = type;
+    }
+    public string Reference { get; }
+    public string FunctionalConstraint { get; }
+    public string DataType { get; }
+    public bool IsControlModel => Reference.EndsWith(".ctlModel", StringComparison.OrdinalIgnoreCase);
+    public string Current
+    {
+        get => _current;
+        set { if (_current == value) return; _current = value; PropertyChanged?.Invoke(this,
+            new PropertyChangedEventArgs(nameof(Current))); }
+    }
+    public string Result
+    {
+        get => _result;
+        set { if (_result == value) return; _result = value; PropertyChanged?.Invoke(this,
+            new PropertyChangedEventArgs(nameof(Result))); }
+    }
+    public bool Selected
+    {
+        get => _selected;
+        set { if (_selected == value) return; _selected = value; PropertyChanged?.Invoke(this,
+            new PropertyChangedEventArgs(nameof(Selected))); }
+    }
+    public string RequestedValue
+    {
+        get => _requestedValue;
+        set { if (_requestedValue == value) return; _requestedValue = value;
+            if (HasVerifiedRead) HasEdited = true;
+            Notify(nameof(RequestedValue)); }
+    }
+    public event PropertyChangedEventHandler? PropertyChanged;
+}
diff --git a/Models/LivePointViewportPriorityTracker.cs b/Models/LivePointViewportPriorityTracker.cs
new file mode 100644
index 000000000..1d72fc340
--- /dev/null
+++ b/Models/LivePointViewportPriorityTracker.cs
@@ -0,0 +1,43 @@
+using System.Collections.Concurrent;
+
+namespace ArIED61850Tester.Models;
+
+/// <summary>
+/// Immutable identity-only viewport hints for the *existing* canonical point
+/// presentation queue. No process value, session, event or IEC observation is
+/// owned here. Independent Explorer and Global grids may realize the same row.
+/// Concurrent reads are safe from the acquisition callback thread.
+/// </summary>
+public enum LivePointViewportKind { Explorer, Global }
+
+public sealed class LivePointViewportPriorityTracker
+{
+    private readonly ConcurrentDictionary<string, byte> _explorer =
+        new(StringComparer.Ordinal);
+    private readonly ConcurrentDictionary<string, byte> _global =
+        new(StringComparer.Ordinal);
+
+    private ConcurrentDictionary<string, byte> For(LivePointViewportKind viewport)
+        => viewport == LivePointViewportKind.Global ? _global : _explorer;
+
+    /// <returns>True only when this exact point first became realized.</returns>
+    public bool Realize(LivePointViewportKind viewport, string exactKey)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(exactKey);
+        return For(viewport).TryAdd(exactKey, 0);
+    }
+
+    public void Unrealize(LivePointViewportKind viewport, string exactKey)
+    {
+        if (!string.IsNullOrWhiteSpace(exactKey))
+            For(viewport).TryRemove(exactKey, out _);
+    }
+
+    public void Clear(LivePointViewportKind viewport) => For(viewport).Clear();
+
+    public bool IsRealized(string exactKey)
+        => !string.IsNullOrWhiteSpace(exactKey) &&
+           (_explorer.ContainsKey(exactKey) || _global.ContainsKey(exactKey));
+
+    public int RealizedCount => _explorer.Count + _global.Count;
+}
diff --git a/Models/MonitorModels.cs b/Models/MonitorModels.cs
index b7be5cff0..4f9ed5b73 100644
--- a/Models/MonitorModels.cs
+++ b/Models/MonitorModels.cs
@@ -53,6 +53,12 @@ public sealed class Iec61850MonitorDevice : ObservableObject
     public BulkObservableCollection<SignalDefinition> Signals { get; } = new();
     public BulkObservableCollection<Iec61850MonitorPoint> Points { get; } = new();
     public BulkObservableCollection<SignalDefinition> CommandSignals { get; } = new();
+    /// <summary>
+    /// Live, verified-operable presentation only. The engineering catalog above
+    /// deliberately keeps StatusOnly/Unknown objects for model inspection.
+    /// Command Dock binds ONLY to this collection.
+    /// </summary>
+    public BulkObservableCollection<SignalDefinition> OperableCommandSignals { get; } = new();
     // Shared per-IED live model for the Browser, Explorer and all read-only
     // engineering consumers. Runtime report ingress and manual MMS reads use
     // identical reference/FC keys; not persisted across associations.
@@ -742,12 +748,23 @@ private void RefreshCommandSignals()
         // CO DataObjects including ZIV ctlModel=0 so commissioning can explicitly
         // read/configure them; every physical action is still gated by typed
         // live ctlModel + CDC proof in SignalDefinition/runtime.
+        // Cross-DataSet CSWI targets require exact live typed ctlModel/CO verification;
+        // never promote status-only XCBR/XSWI or mutate DataSet membership.
         var selected = Iec61850ControlIdentity.DistinctSelected(Signals)
-            .OrderBy(signal => signal.SortPriority)
+            .Concat(IsConnected && LiveDiscoveryModel is not null
+                ? Iec61850ControlIdentity.DiscoveredIndependentCswiControls(Signals)
+                : [])
+            .GroupBy(signal => Iec61850ControlIdentity.Normalize(signal.ObjectReference),
+                StringComparer.OrdinalIgnoreCase)
+            .Select(group => group.OrderByDescending(signal => signal.IsSelected)
+                .ThenByDescending(signal => signal.ControlSupportsOperate).First())
+            .OrderBy(Iec61850ControlIdentity.CommandDockDisplayPriority)
             .ThenBy(signal => signal.LogicalNode, StringComparer.OrdinalIgnoreCase)
-            .ThenBy(signal => signal.Name, StringComparer.OrdinalIgnoreCase)
+            .ThenBy(signal => signal.ObjectReference, StringComparer.OrdinalIgnoreCase)
             .ToArray();
 
+        // Live ctlModel verification may change display priority once; no
+        // detached/rebuilt row objects, full collection Reset, or MMS write.
         // Common case: verification/report/navigation changed data, not the
         // selected DataObject membership or its order. O(N) identity check,
         // zero WPF collection events, zero row recycling and checkbox flicker.
@@ -760,7 +777,11 @@ private void RefreshCommandSignals()
                 same = false;
                 break;
             }
-            if (same) return;
+            if (same)
+            {
+                RefreshOperableCommandSignals();
+                return;
+            }
         }
 
         // Reconcile real membership changes by *reference identity* and keep
@@ -794,6 +815,49 @@ private void RefreshCommandSignals()
             else
                 CommandSignals.Insert(index, selected[index]);
         }
+
+        RefreshOperableCommandSignals();
+    }
+
+    // Reconcile only actual verified command DOs. Identity-preserving, no
+    // List Reset/Replace or bound-grid row recycling on unchanged reporting.
+    private void RefreshOperableCommandSignals()
+    {
+        var targets = Iec61850ControlIdentity.VerifiedCommandTargets(
+                Signals, admitDiscovered: IsConnected && LiveDiscoveryModel is not null)
+            .OrderBy(Iec61850ControlIdentity.CommandDockDisplayPriority)
+            .ThenBy(signal => signal.LogicalNode, StringComparer.OrdinalIgnoreCase)
+            .ThenBy(signal => signal.ObjectReference, StringComparer.OrdinalIgnoreCase)
+            .ToArray();
+        if (OperableCommandSignals.Count == targets.Length &&
+            OperableCommandSignals.SequenceEqual(targets, ReferenceEqualityComparer.Instance))
+            return;
+
+        var membership = new HashSet<SignalDefinition>(
+            targets, ReferenceEqualityComparer.Instance);
+        for (var i = OperableCommandSignals.Count - 1; i >= 0; i--)
+            if (!membership.Contains(OperableCommandSignals[i]))
+                OperableCommandSignals.RemoveAt(i);
+
+        for (var i = 0; i < targets.Length; i++)
+        {
+            if (i < OperableCommandSignals.Count &&
+                ReferenceEquals(OperableCommandSignals[i], targets[i]))
+                continue;
+            var existing = -1;
+            for (var j = i + 1; j < OperableCommandSignals.Count; j++)
+            {
+                if (ReferenceEquals(OperableCommandSignals[j], targets[i]))
+                {
+                    existing = j;
+                    break;
+                }
+            }
+            if (existing >= 0)
+                OperableCommandSignals.Move(existing, i);
+            else
+                OperableCommandSignals.Insert(i, targets[i]);
+        }
     }
 
     // Conservative GoCB evidence: current live association outranks saved SCL.
@@ -945,7 +1009,17 @@ public string Value
         IecDataType,
         Category,
         IecReference);
-    public string Quality { get => _quality; set => Set(ref _quality, string.IsNullOrWhiteSpace(value) ? "Unknown" : value); }
+    public string Quality
+    {
+        get => _quality;
+        set
+        {
+            if (Set(ref _quality, string.IsNullOrWhiteSpace(value) ? "Unknown" : value))
+                Raise(nameof(IsInvalidQuality));
+        }
+    }
+    /// <summary>Warning glyph is a UI projection, not protocol or command authority.</summary>
+    public bool IsInvalidQuality => QualityInvalidAttention.IsInvalid(Quality);
     public string DeviceTimestamp { get => _deviceTimestamp; set => Set(ref _deviceTimestamp, string.IsNullOrWhiteSpace(value) ? "-" : value); }
     public string SourceMode
     {
diff --git a/Models/QualityInvalidAttention.cs b/Models/QualityInvalidAttention.cs
new file mode 100644
index 000000000..a00c15329
--- /dev/null
+++ b/Models/QualityInvalidAttention.cs
@@ -0,0 +1,15 @@
+namespace ArIED61850Tester.Models;
+
+/// <summary>
+/// Strict UI-only attention classification. Source validity is never mutated, and a
+/// string merely containing "invalid" in an unrelated description is not an alarm.
+/// </summary>
+public static class QualityInvalidAttention
+{
+    public static bool IsInvalid(string? quality)
+    {
+        var value = quality.AsSpan().Trim();
+        return value.StartsWith("Invalid".AsSpan(), StringComparison.OrdinalIgnoreCase) &&
+               (value.Length == 7 || value[7] is ' ' or '/' or ':' or '(' or '[');
+    }
+}
diff --git a/Models/SharedIedSchemaIndex.cs b/Models/SharedIedSchemaIndex.cs
new file mode 100644
index 000000000..a700e29a0
--- /dev/null
+++ b/Models/SharedIedSchemaIndex.cs
@@ -0,0 +1,60 @@
+using System.Runtime.CompilerServices;
+using AR.Iec61850.Discovery;
+
+namespace ArIED61850Tester.Models;
+
+/// <summary>
+/// One declaration-only IEC 61850 schema index for a concrete immutable model.
+/// Browser, Read projection and future workspace adapters must share the SAME
+/// index instance. Observations, sessions and process values are never stored.
+/// Weak model identity allows replaced discovery/SCL models to be collected.
+/// </summary>
+public static class SharedIedSchemaIndex
+{
+    private static readonly ConditionalWeakTable<LiveIedModelDiscoveryDocument,
+        Lazy<Task<IedBrowserSchemaIndex>>> Models = new();
+
+    /// <summary>
+    /// Thread-safe one-flight index creation off the WPF dispatcher. Calling
+    /// this API only schedules/prepares; it never synchronously walks the model.
+    /// </summary>
+    public static Task<IedBrowserSchemaIndex> PrepareAsync(LiveIedModelDiscoveryDocument model)
+    {
+        ArgumentNullException.ThrowIfNull(model);
+        return Models.GetValue(model, static source =>
+            new Lazy<Task<IedBrowserSchemaIndex>>(
+                () => Task.Run(() => new IedBrowserSchemaIndex(source)),
+                LazyThreadSafetyMode.ExecutionAndPublication)).Value;
+    }
+
+    /// <summary>
+    /// Synchronous compatibility path for existing explicit read binding.
+    /// Reuses the same prepared index; callers on the Dispatcher should prefer
+    /// PrepareAsync and only inspect a successfully completed task.
+    /// </summary>
+    public static IedBrowserSchemaIndex GetForBinding(LiveIedModelDiscoveryDocument model)
+        => PrepareAsync(model).GetAwaiter().GetResult();
+
+    /// <summary>Explicit operator retry only; no background fault-retry storm.</summary>
+    public static void ForgetFaulted(LiveIedModelDiscoveryDocument model)
+    {
+        ArgumentNullException.ThrowIfNull(model);
+        if (Models.TryGetValue(model, out var lazy) &&
+            lazy.IsValueCreated && (lazy.Value.IsFaulted || lazy.Value.IsCanceled))
+            Models.Remove(model);
+    }
+
+    public static bool TryGetPrepared(LiveIedModelDiscoveryDocument model,
+        out IedBrowserSchemaIndex index)
+    {
+        ArgumentNullException.ThrowIfNull(model);
+        if (Models.TryGetValue(model, out var lazy) &&
+            lazy.IsValueCreated && lazy.Value.IsCompletedSuccessfully)
+        {
+            index = lazy.Value.Result;
+            return true;
+        }
+        index = null!;
+        return false;
+    }
+}
diff --git a/Models/SignalDefinition.cs b/Models/SignalDefinition.cs
index 323251aaf..14ea7c122 100644
--- a/Models/SignalDefinition.cs
+++ b/Models/SignalDefinition.cs
@@ -87,7 +87,23 @@ public string DisplayReference
     public string FunctionalConstraint { get; set; } = "";
     public string DataType { get; set; } = "";
     public string Category { get; set; } = "";
-    public string Unit { get; set; } = "";
+    // Monotonic generation for model metadata projection invalidation. This
+    // preserves the old plain Unit setter's UI notification behavior (none),
+    // without subscribing handlers to tens of thousands of SG7 signals.
+    private static long _unitMetadataRevision;
+    private string _unit = "";
+    public static long UnitMetadataRevision => Interlocked.Read(ref _unitMetadataRevision);
+    public string Unit
+    {
+        get => _unit;
+        set
+        {
+            var next = value ?? "";
+            if (string.Equals(_unit, next, StringComparison.Ordinal)) return;
+            _unit = next;
+            Interlocked.Increment(ref _unitMetadataRevision);
+        }
+    }
     public string Confidence { get; set; } = "Medium";
     public string DataSetReference { get; set; } = "";
     public string ReportControlReference { get; set; } = "";
@@ -102,6 +118,12 @@ public string DisplayReference
     public string TimestampReference { get; set; } = "";
     public string Source { get; set; } = "Online";
     public bool IsControlSignal { get; set; }
+    /// <summary>
+    /// Exact MMS CO service / CF ctlModel inventory evidence, never inferred from LN
+    /// names or ST feedback. Read-only candidate evidence is NOT operate authority.
+    /// </summary>
+    [System.Text.Json.Serialization.JsonIgnore]
+    public bool HasControlServiceEvidence { get; set; }
     public bool IsValidControlObject => IsControlSignal && IsControlObjectReference(ObjectReference);
     /// <summary>Association-scoped CDC proved by a typed live control descriptor.</summary>
     [System.Text.Json.Serialization.JsonIgnore]
@@ -123,6 +145,8 @@ public string ControlCdc
                 !candidate.Equals(_verifiedLiveControlCdc, StringComparison.OrdinalIgnoreCase))
                 return;
             if (!Set(ref _controlCdc, candidate)) return;
+            Raise(nameof(ControlDockRole));
+            RefreshControlProcessValue();
             RaiseControlActionProperties();
         }
     }
@@ -135,15 +159,25 @@ public void AcceptVerifiedLiveControlCdc(string cdc)
         var validated = cdc.Trim().ToUpperInvariant();
         // This method must only be called after the engine's typed live semantic
         // resolver succeeded; it is not an SCL authority override.
-        _verifiedLiveControlCdc = validated;
-        Raise(nameof(VerifiedLiveControlCdc));
+        // A repeated read of the same typed CDC is not an authority change.
+        // Suppress redundant WPF notifications on refresh/report traffic.
+        if (!string.Equals(_verifiedLiveControlCdc, validated, StringComparison.Ordinal))
+        {
+            _verifiedLiveControlCdc = validated;
+            Raise(nameof(VerifiedLiveControlCdc));
+            Raise(nameof(ControlDockRole));
+        }
         ControlCdc = validated;
     }
 
     public bool ApplyDataSetAdvisoryControlMetadata(string cdc, string? statusReference)
     {
-        _dataSetAdvisoryCdc = cdc?.Trim().ToUpperInvariant() ?? string.Empty;
-        Raise(nameof(DataSetAdvisoryCdc));
+        var advisory = cdc?.Trim().ToUpperInvariant() ?? string.Empty;
+        if (!string.Equals(_dataSetAdvisoryCdc, advisory, StringComparison.Ordinal))
+        {
+            _dataSetAdvisoryCdc = advisory;
+            Raise(nameof(DataSetAdvisoryCdc));
+        }
         if (_verifiedLiveControlCdc.Length > 0)
         {
             // Reporting membership is independent of the control plane. Do not
@@ -160,10 +194,16 @@ public bool ApplyDataSetAdvisoryControlMetadata(string cdc, string? statusRefere
     public void ClearLiveControlAuthority()
     {
         // Called only at MMS association teardown/new association boundary.
-        _verifiedLiveControlCdc = string.Empty;
-        _dataSetAdvisoryCdc = string.Empty;
-        Raise(nameof(VerifiedLiveControlCdc));
-        Raise(nameof(DataSetAdvisoryCdc));
+        if (_verifiedLiveControlCdc.Length > 0)
+        {
+            _verifiedLiveControlCdc = string.Empty;
+            Raise(nameof(VerifiedLiveControlCdc));
+        }
+        if (_dataSetAdvisoryCdc.Length > 0)
+        {
+            _dataSetAdvisoryCdc = string.Empty;
+            Raise(nameof(DataSetAdvisoryCdc));
+        }
         ControlSemanticVerified = false;
     }
     // Preserve exact read-only MMS proof independently of ControlLastResult,
@@ -174,7 +214,15 @@ public string ControlInspectionEvidence
         set => Set(ref _controlInspectionEvidence, value?.Trim() ?? string.Empty);
     }
     public string ControlModelReference { get => _controlModelReference; set => Set(ref _controlModelReference, value?.Trim() ?? string.Empty); }
-    public string ControlStatusReference { get => _controlStatusReference; set => Set(ref _controlStatusReference, value?.Trim() ?? string.Empty); }
+    public string ControlStatusReference
+    {
+        get => _controlStatusReference;
+        set
+        {
+            if (Set(ref _controlStatusReference, value?.Trim() ?? string.Empty))
+                RefreshControlProcessValue();
+        }
+    }
     public string ControlModelText
     {
         get => _controlModelText;
@@ -239,20 +287,27 @@ private Iec61850ProcessValueBadge BuildControlProcessValue()
     {
         var position = IsPositionSemanticControl ||
             string.Equals(ControlCdc, "DPC", StringComparison.OrdinalIgnoreCase);
-        var type = position ? "Dbpos" :
+        var step = string.Equals(ControlCdc, "BSC",
+                StringComparison.OrdinalIgnoreCase) &&
+            ArIED61850Tester.Services.Iec61850ValueFormatter.IsBscStepPosition(
+                ControlStatusReference, ControlCdc);
+        var type = position ? "Dbpos" : step ? "Int8" :
             !string.IsNullOrWhiteSpace(ControlValueType) ? ControlValueType : ControlCdc;
         var boolType = type.Equals("SPS", StringComparison.OrdinalIgnoreCase) ||
                        type.Equals("SPC", StringComparison.OrdinalIgnoreCase) ||
                        type.Equals("Boolean", StringComparison.OrdinalIgnoreCase);
-        var display = position || boolType
-            ? ArIED61850Tester.Services.Iec61850ValueFormatter.FormatReportProcessValue(
-                ControlCurrentValue, type, "", position ? "Position" : "Status", ObjectReference)
-            : ControlCurrentValue;
+        var display = step
+            ? ArIED61850Tester.Services.Iec61850ValueFormatter.FormatBscStepPosition(
+                ControlCurrentValue)
+            : position || boolType
+                ? ArIED61850Tester.Services.Iec61850ValueFormatter.FormatReportProcessValue(
+                    ControlCurrentValue, type, "", position ? "Position" : "Status", ObjectReference)
+                : ControlCurrentValue;
         return new Iec61850ProcessValueBadge(
             display, type,
             Iec61850ValueStatePresentation.TypeToken(type),
             Iec61850ValueStatePresentation.ClassifyVisualKind(
-                display, type, reference: ObjectReference));
+                display, type, reference: step ? ControlStatusReference : ObjectReference));
     }
 
     private void RefreshControlProcessValue()
@@ -546,19 +601,11 @@ private void PublishCommandClaimed()
     // ControlSupportsOperate still independently gates every staged/direct write.
     private bool CanExposeControlActions => IsValidControlObject;
 
-    private bool IsPositionSemanticControl
-    {
-        get
-        {
-            var reference = (ObjectReference ?? string.Empty).Replace('$', '.').TrimEnd('.');
-            var leaf = reference[(reference.LastIndexOf('.') + 1)..];
-            return leaf.Equals("Pos", StringComparison.OrdinalIgnoreCase) ||
-                   ((LogicalNodeClass.Equals("CSWI", StringComparison.OrdinalIgnoreCase) ||
-                     LogicalNodeClass.Equals("XCBR", StringComparison.OrdinalIgnoreCase) ||
-                     LogicalNodeClass.Equals("XSWI", StringComparison.OrdinalIgnoreCase)) &&
-                    reference.Contains(".Pos", StringComparison.OrdinalIgnoreCase));
-        }
-    }
+    // Action widgets are derived from the declared/live CDC, not the LN or
+    // data-object name. An arbitrary vendor-named DPC is still a DPC; a
+    // coincidentally named Pos object without DPC evidence is not Open/Close.
+    private bool IsPositionSemanticControl =>
+        string.Equals(ControlCdc, "DPC", StringComparison.OrdinalIgnoreCase);
 
     public bool IsPositionControl => CanExposeControlActions && IsPositionSemanticControl;
     public bool IsRaiseOnlyControl => CanExposeControlActions && (ContainsControlToken("TapOpR") || ContainsControlToken("Raise"));
@@ -822,6 +869,13 @@ public bool IsReportCapable
         ? 45
         : CalculateSortPriority(LogicalNodeClass, ObjectReference, Category, Confidence, IsScadaCoreSignal);
 
+    // Non-authoritative UI role, derived from IEC object identity and typed
+    // CDC. Control readiness is still guarded solely by live MMS evidence.
+    [System.Text.Json.Serialization.JsonIgnore]
+    public string ControlDockRole =>
+        ArIED61850Tester.Services.Iec61850ControlIdentity.CommandDockRole(this);
+
+
     public string ReportCoverage
     {
         get => _reportCoverage;
diff --git a/P2BlueSteelGreigeUx.cs b/P2BlueSteelGreigeUx.cs
index 26995bf1f..87a504ef1 100644
--- a/P2BlueSteelGreigeUx.cs
+++ b/P2BlueSteelGreigeUx.cs
@@ -16,20 +16,28 @@ namespace ArIED61850Tester;
 /// </summary>
 internal static class P2BlueSteelGreigeUx
 {
-    private static readonly FontFamily PreferredFont =
-        new("Plus Jakarta Sans, Aptos, Segoe UI Variable Text, Segoe UI");
+    // Each WPF window receives its visual adapter exactly once. A later
+    // dialog activation must never restyle the already-visible MainWindow.
+    private static readonly System.Runtime.CompilerServices.ConditionalWeakTable<Window, object>
+        AppliedWindows = new();
 
     public static void ApplyToOpenWindows(Application application)
     {
         ArgumentNullException.ThrowIfNull(application);
 
         foreach (Window window in application.Windows)
+        {
+            if (!window.IsLoaded || AppliedWindows.TryGetValue(window, out _))
+                continue;
             Apply(window);
+            AppliedWindows.Add(window, new object());
+        }
     }
 
     private static void Apply(Window window)
     {
-        window.FontFamily = PreferredFont;
+        // The bundled AppFontFamily (Inter) is the only window typography
+        // authority. A runtime local FontFamily value masked XAML inheritance.
 
         switch (window)
         {
@@ -62,10 +70,8 @@ private static void ApplyMainWindow(MainWindow window)
         }
 
         if (window.FindName("WorkflowPill") is Border workflowPill)
-        {
             workflowPill.CornerRadius = new CornerRadius(9);
-            workflowPill.Height = 36;
-        }
+        // NavigationLayoutFix owns all nav/pill height after construction.
 
         var deviceList = Descendants<ListBox>(window)
             .FirstOrDefault(list => ReferenceEquals(list.ItemsSource, window.Devices));
@@ -78,7 +84,8 @@ private static void ApplyMainWindow(MainWindow window)
 
     private static void ApplyIoFatWindow(IoListTestingWindow window)
     {
-        window.WindowState = WindowState.Maximized;
+        if (window.WindowState != WindowState.Maximized)
+            window.WindowState = WindowState.Maximized;
 
         var fatIedList = Descendants<ListBox>(window)
             .FirstOrDefault(list => ReferenceEquals(list.ItemsSource, window.Project.Ieds));
diff --git a/P2IndustrialWorkstationUx.cs b/P2IndustrialWorkstationUx.cs
index a42a39c40..fa558bda2 100644
--- a/P2IndustrialWorkstationUx.cs
+++ b/P2IndustrialWorkstationUx.cs
@@ -23,6 +23,9 @@ internal static class P2IndustrialWorkstationUx
     private static readonly ConditionalWeakTable<MainWindow, MainSearchState> MainStates = new();
     private static readonly ConditionalWeakTable<IoListTestingWindow, FatSearchState> FatStates = new();
 
+    // Resolve control templates before any visible window is constructed.
+    public static void PreloadResources() => EnsureResources();
+
     public static void Apply(Window window)
     {
         EnsureResources();
@@ -62,13 +65,14 @@ private static void ApplyMain(MainWindow window)
         {
             navShell.CornerRadius = new CornerRadius(6);
             navShell.BorderThickness = new Thickness(1);
-            navShell.Height = 52;
+            // NavigationLayoutFix is the sole authority for shell height.
+            // An activation/Loaded adapter must not fight that layout owner.
         }
 
         if (window.FindName("WorkflowPill") is Border pill)
         {
             pill.CornerRadius = new CornerRadius(5);
-            pill.Height = 34;
+            // Selection pill height is owned by NavigationLayoutFix.
         }
 
         InstallMainIedSearch(window);
diff --git a/Services/DiagnosticReportBuilder.cs b/Services/DiagnosticReportBuilder.cs
index a79fd0f55..024765509 100644
--- a/Services/DiagnosticReportBuilder.cs
+++ b/Services/DiagnosticReportBuilder.cs
@@ -199,6 +199,29 @@ public static async Task<string> BuildAsync(
                     if (evidence.Length > 480) evidence = evidence[..480] + "…";
                     builder.AppendLine($"  {command.ObjectReference} | CDC={command.ControlCdc} | liveVerifiedCdc={command.VerifiedLiveControlCdc} | dataSetCdc={command.DataSetAdvisoryCdc} | model={command.ControlModelText} | canOperate={command.ControlSupportsOperate} | {evidence}");
                 }
+                // A static DataSet may report XCBR/XSWI Pos but omit the
+                // separate command-owning CSWI.Pos in another LD. Report the
+                // live discovery candidates independently of user selection;
+                // diagnostic visibility NEVER grants an MMS control command.
+                var independentCswi = device.LiveDiscoveryModel is not null
+                    ? Iec61850ControlIdentity.IndependentCswiInspectionCandidates(device.Signals)
+                    : [];
+                var cswiTotal = device.Signals
+                    .Count(s => !s.IsSelected &&
+                        Iec61850ControlIdentity.IsIndependentCswiCandidate(s));
+                builder.AppendLine($"CSWI outside DataSet: live candidates={cswiTotal}, bounded candidates={independentCswi.Length}, typed-operable={independentCswi.Count(s => s.ControlSupportsOperate)}, unresolved/status-only={independentCswi.Count(s => !s.ControlSupportsOperate)}; discovery does not imply command authority");
+                foreach (var cswi in independentCswi.Take(12))
+                {
+                    var note = (cswi.ControlInspectionEvidence ?? string.Empty)
+                        .Replace('\r', ' ').Replace('\n', ' ');
+                    if (note.Length > 180) note = note[..180] + "…";
+                    builder.AppendLine($"  CSWI {cswi.ObjectReference} | model={cswi.ControlModelText} | verifiedCDC={cswi.VerifiedLiveControlCdc} | operable={cswi.ControlSupportsOperate} | {note}");
+                }
+                // Side-effect-free SCD ↔ wire-model command parity for Siemens,
+                // ZIV and other vendors; do not confuse offline ctlModel design
+                // intent with a live MMS inspection or promote StatusOnly rows.
+                foreach (var parity in Iec61850SclLiveCswiParityDiagnostic.Summarize(device))
+                    builder.AppendLine(parity);
                 builder.AppendLine($"Logical Devices  : {EmptyAsUnavailable(device.LogicalDeviceSummary)}");
                 builder.AppendLine($"Identity source  : {EmptyAsUnavailable(device.IdentitySource)}");
 
diff --git a/Services/Iec61850ControlIdentity.cs b/Services/Iec61850ControlIdentity.cs
index 95bae27cb..8de719084 100644
--- a/Services/Iec61850ControlIdentity.cs
+++ b/Services/Iec61850ControlIdentity.cs
@@ -41,6 +41,224 @@ public static bool NeedsInspection(SignalDefinition signal, bool force)
            (force || !signal.ControlModelResolved ||
             (signal.ControlSupportsOperate && signal.ControlCurrentValue == "-"));
 
+    /// <summary>
+    /// A control is NOT a DataSet member merely because its feedback Pos.stVal
+    /// is reported. Yet a verified live CSWI.Pos may exist in another LD and
+    /// must remain discoverable without changing the operator's signal selection.
+    /// Candidate admission deliberately does not require a pre-proved CDC:
+    /// the purpose of the bounded native inspection is to verify that CDC.
+    /// No control is enabled until
+    /// the exact live ctlModel and Oper structure pass native inspection.
+    /// </summary>
+    public static bool IsIndependentCswiCandidate(SignalDefinition signal)
+        => signal.IsValidControlObject &&
+           string.Equals(SignalDefinition.DetectLogicalNodeClass(signal.LogicalNode),
+               "CSWI", StringComparison.OrdinalIgnoreCase) &&
+           Normalize(signal.ObjectReference).EndsWith(".Pos",
+               StringComparison.OrdinalIgnoreCase);
+
+    public static SignalDefinition[] IndependentCswiInspectionCandidates(
+        IEnumerable<SignalDefinition> signals, int budget = 24)
+    {
+        if (budget <= 0) return [];
+        return signals.Where(s => !s.IsSelected && IsIndependentCswiCandidate(s))
+            .GroupBy(s => Normalize(s.ObjectReference), StringComparer.OrdinalIgnoreCase)
+            .Select(g => g.OrderByDescending(s => s.ControlModelResolved)
+                .ThenByDescending(s => s.ControlSupportsOperate).First())
+            .OrderBy(s => Normalize(s.ObjectReference), StringComparer.OrdinalIgnoreCase)
+            .Take(budget).ToArray();
+    }
+
+    public static SignalDefinition[] VerifiedIndependentCswiControls(
+        IEnumerable<SignalDefinition> signals)
+        => IndependentCswiInspectionCandidates(signals)
+            .Where(s => s.ControlModelResolved && s.ControlSupportsOperate)
+            .ToArray();
+
+    /// <summary>
+    /// Operator inventory != authority to Operate. An independently declared
+    /// CSWI.Pos may be shown in Command Dock before native CDC verification,
+    /// but must never enter VerifiedCommandTargets unless type-safe and live.
+    /// CO-service evidence (or a completed live ctlModel inspection) prevents
+    /// name-only and status-only aliases from masquerading as control objects.
+    /// No first-24 display truncation; budget applies to read-only PROBES only.
+    /// </summary>
+    public static SignalDefinition[] DiscoveredIndependentCswiControls(
+        IEnumerable<SignalDefinition> signals)
+        => signals.Where(s => !s.IsSelected && IsIndependentCswiCandidate(s) &&
+                              s.HasControlServiceEvidence)
+            .GroupBy(s => Normalize(s.ObjectReference), StringComparer.OrdinalIgnoreCase)
+            .Select(g => g.OrderByDescending(s => s.ControlSupportsOperate)
+                .ThenByDescending(s => s.ControlModelResolved).First())
+            .OrderBy(s => Normalize(s.ObjectReference), StringComparer.OrdinalIgnoreCase)
+            .ToArray();
+
+
+    /// <summary>
+    /// Read-only probe priority. These are IEC function hints, NOT commands
+    /// or eligibility decisions. A switch position can be behind any vendor
+    /// prefix or logical device; prefer its typed ctlModel discovery over
+    /// generic channel banks so operator equipment appears promptly.
+    /// Unrecognized LN classes remain in the queue.
+    /// </summary>
+    public static int ControlInspectionPriority(SignalDefinition signal)
+    {
+        ArgumentNullException.ThrowIfNull(signal);
+        var reference = Normalize(signal.ObjectReference);
+        var dot = reference.LastIndexOf('.');
+        var doName = dot < 0 ? string.Empty : reference[(dot + 1)..];
+        var ln = signal.LogicalNodeClass.ToUpperInvariant();
+        if (doName.Equals("Pos", StringComparison.OrdinalIgnoreCase))
+            return ln switch { "CSWI" => 0, "XCBR" => 1, "XSWI" => 2, _ => 8 };
+        if (doName.Equals("TapChg", StringComparison.OrdinalIgnoreCase))
+            return 3;
+        if (ln == "ATCC") return 12;
+        if (ln == "GGIO") return 90;
+        if (ln == "CILO") return 95;
+        return 40;
+    }
+
+    /// <summary>
+    /// Discover control-service candidates independently of LN class, display
+    /// name, DataSet membership and operator selection. CO/CF service evidence
+    /// only schedules a read-only ctlModel probe; typed live Oper/SBOw status
+    /// proof is still mandatory before a command is admitted. The default
+    /// scan does not silently truncate very large vendor control inventories.
+    /// </summary>
+    public static SignalDefinition[] DiscoveredControlInspectionCandidates(
+        IEnumerable<SignalDefinition> signals, int budget = int.MaxValue)
+    {
+        if (budget <= 0) return [];
+        return signals.Where(signal => signal.IsValidControlObject &&
+                                       signal.HasControlServiceEvidence &&
+                                       !signal.ControlModelResolved)
+            .GroupBy(signal => Normalize(signal.ObjectReference),
+                StringComparer.OrdinalIgnoreCase)
+            .Select(group => group.OrderByDescending(signal => signal.IsSelected)
+                .ThenByDescending(signal => signal.ControlSupportsOperate).First())
+            .OrderByDescending(signal => signal.IsSelected)
+            .ThenBy(ControlInspectionPriority)
+            .ThenBy(signal => Normalize(signal.ObjectReference), StringComparer.OrdinalIgnoreCase)
+            .Take(budget).ToArray();
+    }
+
+    public static SignalDefinition[] VerifiedCommandTargets(
+        IEnumerable<SignalDefinition> signals, bool admitDiscovered)
+        => signals.Where(signal => signal.IsValidControlObject &&
+                                   signal.ControlSupportsOperate &&
+                                   !signal.IsGenericControl &&
+                                   (signal.IsSelected ||
+                                    (admitDiscovered && signal.HasControlServiceEvidence)))
+            .GroupBy(signal => Normalize(signal.ObjectReference),
+                StringComparer.OrdinalIgnoreCase)
+            .Select(group => group.OrderByDescending(signal => signal.ControlCommandBusy)
+                .ThenByDescending(signal => signal.ControlConfirmationPending)
+                .ThenByDescending(signal => signal.IsSelected).First())
+            .ToArray();
+
+
+    /// <summary>
+    /// Presentation classification only, never Operate authority or asserted
+    /// physical wiring. IEC LN class and typed CDC sort verified command
+    /// objects; MMS ctlModel and Oper/SBOw proof alone grant authorization.
+    /// A GGIO DPC does not become a breaker merely because it has ctlVal.
+    /// </summary>
+    public static (int Rank, string Role) DescribeCommandRole(SignalDefinition signal)
+    {
+        ArgumentNullException.ThrowIfNull(signal);
+        var cdc = (signal.VerifiedLiveControlCdc.Length > 0
+            ? signal.VerifiedLiveControlCdc : signal.ControlCdc).Trim().ToUpperInvariant();
+        var reference = Normalize(signal.ObjectReference);
+        var lastDot = reference.LastIndexOf('.');
+        var dataObject = lastDot < 0 ? string.Empty : reference[(lastDot + 1)..];
+        var ln = signal.LogicalNodeClass.ToUpperInvariant();
+
+        // Discovery visibility must not depend on a native live CDC result.
+        // A CSWI.Pos with verified CO service declarations can legitimately
+        // have an unresolved/contradictory typed CDC (e.g. SG7 DPC DO with
+        // Boolean Oper.ctlVal). Rank it as an *inspection candidate* first,
+        // while SignalDefinition.ControlSupportsOperate and native admission
+        // remain independent and fail closed. Do NOT infer operability here.
+        if (ln == "CSWI" &&
+            dataObject.Equals("Pos", StringComparison.OrdinalIgnoreCase) &&
+            signal.HasControlServiceEvidence)
+            return (0, signal.ControlSupportsOperate
+                ? "Switch controller · CSWI"
+                : "Switch controller · CSWI · verification required");
+
+        // A name-only CSWI (even with a copied DPC label) is NOT a verified
+        // discovery candidate. Without exact CO service evidence it must not
+        // receive CSWI-front-row admission through the generic DPC branch.
+        if (ln == "CSWI" && dataObject.Equals("Pos", StringComparison.OrdinalIgnoreCase)
+            && !signal.HasControlServiceEvidence)
+            return (150, "Unverified IEC control · no CO service evidence");
+
+        if (cdc == "DPC" && dataObject.Equals("Pos", StringComparison.OrdinalIgnoreCase))
+            return ln switch
+            {
+                "CSWI" => (0, "Switch controller · CSWI"),
+                "XCBR" => (10, "Circuit breaker · XCBR"),
+                "XSWI" => (20, "Disconnector · XSWI"),
+                _ => (85, "Position control · equipment unlinked")
+            };
+
+        if (cdc == "BSC" && dataObject.Equals("TapChg", StringComparison.OrdinalIgnoreCase))
+            return (40, ln == "ATCC" ? "Tap changer · ATCC" : "Tap changer · equipment unlinked");
+
+        if (cdc == "APC" && (ln == "AVCO" || ln == "AVC"))
+            return (50, "Voltage control");
+
+        if (cdc == "BSC")
+            return (90, "Step control · equipment unlinked");
+
+        // Maintenance and block commands remain available but are never
+        // confused with switch position Open/Close.
+        if (new[] { "MemClr", "RsStat", "EvtRcdClr", "LEDRs", "BlkOpn",
+                    "BlkCls", "TagOn", "Mod", "LocSta", "CmdBlk" }
+            .Contains(dataObject, StringComparer.OrdinalIgnoreCase))
+            return (350, "Auxiliary / maintenance");
+
+        if (ln == "GGIO")
+            return (250, "Generic I/O · equipment unlinked");
+
+        return (150, "Other IEC control · equipment unlinked");
+    }
+
+    /// <summary>
+    /// Presentation-only order: verified BSC step/tap controls first, other
+    /// verified operating controls next, unresolved last, and exact live
+    /// StatusOnly at the bottom. Never grant control from display priority.
+    /// </summary>
+    public static int CommandDockDisplayPriority(SignalDefinition signal)
+    {
+        ArgumentNullException.ThrowIfNull(signal);
+        var rolePriority = CommandDockPriority(signal);
+
+        // A proved ctlModel=0 remains in the engineering catalog, but below
+        // both operable DOs and yet-to-be-inspected candidates.
+        if (signal.ControlModelResolved &&
+            signal.ControlModelKind == Iec61850ControlModelKind.StatusOnly)
+            return 20_000 + rolePriority;
+
+        // Unverified/disabled items never displace an operable command.
+        if (!signal.ControlSupportsOperate)
+            return 10_000 + rolePriority;
+
+        // Step/tap class is live CDC=BSC, not ATCC/CSWI/brand naming.
+        var cdc = signal.VerifiedLiveControlCdc.Length > 0
+            ? signal.VerifiedLiveControlCdc : signal.ControlCdc;
+        if (string.Equals(cdc, "BSC", StringComparison.OrdinalIgnoreCase))
+            return -100 + rolePriority;
+
+        return rolePriority;
+    }
+
+    public static int CommandDockPriority(SignalDefinition signal)
+        => DescribeCommandRole(signal).Rank;
+
+    public static string CommandDockRole(SignalDefinition signal)
+        => DescribeCommandRole(signal).Role;
+
     public static SignalDefinition[] InspectionRepresentatives(IEnumerable<SignalDefinition> signals)
         => DistinctSelected(signals).Where(s => !s.ControlModelResolved).ToArray();
 }
diff --git a/Services/Iec61850MonitorRuntime.BrowserWrite.cs b/Services/Iec61850MonitorRuntime.BrowserWrite.cs
new file mode 100644
index 000000000..da62a8fa4
--- /dev/null
+++ b/Services/Iec61850MonitorRuntime.BrowserWrite.cs
@@ -0,0 +1,121 @@
+using AR.Iec61850.Discovery;
+using AR.Iec61850.Mms;
+using ArIED61850Tester.Models;
+
+namespace ArIED61850Tester.Services;
+
+/// <summary>
+/// Browser configuration Writes share control-flight admission, native MMS
+/// association and cancellation quarantine. No temporary write connection,
+/// hidden retry, process-value polling or bypass around the Command Dock.
+/// </summary>
+public sealed partial class Iec61850MonitorRuntime
+{
+    public async Task<MmsReadResult> ReadBrowserConfigurationAsync(
+        string deviceId, LiveIedModelDiscoveryDocument model, long association,
+        IedBrowserWriteRow target, CancellationToken cancellationToken)
+    {
+        var session = CurrentBrowserWriteSession(deviceId, model, association, target);
+        return await session.Client.ReadBrowserConfigurationAsync(
+            target.Reference, target.FunctionalConstraint, cancellationToken)
+            .ConfigureAwait(false);
+    }
+
+    public async Task<BrowserMmsWriteOutcome> WriteBrowserConfigurationAsync(
+        string deviceId, LiveIedModelDiscoveryDocument model, long association,
+        IedBrowserWriteRow target, MmsDataValue desired, CancellationToken cancellationToken)
+    {
+        var session = CurrentBrowserWriteSession(deviceId, model, association, target);
+        if (!Iec61850ControlFlightAdmission.TryEnter(
+                ref session.ControlCommandActive, ref session.ControlFlightQuarantined))
+            throw new InvalidOperationException(
+                "An IEC control/configuration flight is active or quarantined on this MMS association.");
+        var lifetime = CancellationTokenSource.CreateLinkedTokenSource(
+            cancellationToken, session.ControlLifetimeCancellation.Token);
+        Task<BrowserMmsWriteOutcome>? native = null;
+        try
+        {
+            Log("WARN", session.Device.Name,
+                "OPERATOR_BROWSER_MMS_WRITE: " + target.Reference + " [" +
+                target.FunctionalConstraint + "]; explicit operator confirmation; at most one Write.");
+            native = session.Client.WriteBrowserConfigurationAsync(
+                target.Reference, target.FunctionalConstraint, desired, lifetime.Token);
+            var result = await Iec61850ControlFlightAdmission.WaitForNativeAsync(
+                native, ControlFlightDeadline, cancellationToken,
+                () => Iec61850ControlFlightAdmission.Quarantine(ref session.ControlFlightQuarantined),
+                lifetime.Cancel).ConfigureAwait(false);
+            if (!_sessions.TryGetValue(deviceId, out var current) ||
+                !ReferenceEquals(current, session) ||
+                session.ControlLifetimeCancellation.IsCancellationRequested ||
+                session.Device.LiveValues.Association != association ||
+                !ReferenceEquals(session.Device.LiveDiscoveryModel, model))
+                throw new InvalidOperationException(
+                    "MMS association/model changed; this Write outcome cannot be attributed to the new session.");
+            Log(result.Succeeded ? "INFO" : "WARN", session.Device.Name,
+                "BROWSER_MMS_WRITE_RESULT: " + target.Reference +
+                "; accepted=" + result.WriteAccepted +
+                "; noChange=" + result.NoChange +
+                "; readbackVerified=" + result.ReadbackVerified + "; " + result.Detail);
+            return result;
+        }
+        finally
+        {
+            if (native is { IsCompleted: false })
+            {
+                Iec61850ControlFlightAdmission.Quarantine(ref session.ControlFlightQuarantined);
+                // Never free admission while the native MMS request may still be in flight.
+                _ = ObserveBrowserWriteCompletionAsync(native, lifetime, session);
+            }
+            else
+            {
+                Iec61850ControlFlightAdmission.Release(ref session.ControlCommandActive);
+                lifetime.Dispose();
+            }
+        }
+    }
+
+    private static async Task ObserveBrowserWriteCompletionAsync(
+        Task<BrowserMmsWriteOutcome> native, CancellationTokenSource lifetime,
+        DeviceSession session)
+    {
+        try { await native.ConfigureAwait(false); }
+        catch (Exception) { /* outcome remains UNKNOWN, quarantine survives */ }
+        finally
+        {
+            Iec61850ControlFlightAdmission.Release(ref session.ControlCommandActive);
+            lifetime.Dispose();
+        }
+    }
+
+    private DeviceSession CurrentBrowserWriteSession(
+        string deviceId, LiveIedModelDiscoveryDocument model, long association,
+        IedBrowserWriteRow target)
+    {
+        if (!_sessions.TryGetValue(deviceId, out var session) ||
+            !session.Client.IsConnected || !session.Device.IsConnected ||
+            session.Device.IsDemo || session.ControlLifetimeCancellation.IsCancellationRequested ||
+            !ReferenceEquals(session.Device.LiveDiscoveryModel, model) ||
+            session.Device.LiveValues.Association != association)
+            throw new InvalidOperationException(
+                "Browser Write requires the exact current live MMS model and association.");
+        var matching = model.LogicalDevices
+            .SelectMany(ld => ld.LogicalNodes)
+            .SelectMany(ln => ln.DataObjects)
+            .SelectMany(obj => obj.Attributes)
+            .Where(attr => string.Equals(attr.MmsReference, target.Reference,
+                                StringComparison.Ordinal) &&
+                           string.Equals(attr.FunctionalConstraint, target.FunctionalConstraint,
+                                StringComparison.OrdinalIgnoreCase))
+            .Take(2).ToArray();
+        if (matching.Length != 1 ||
+            !IedBrowserWritePlan.IsSupported(target.DataType) ||
+            !string.Equals(
+                string.IsNullOrWhiteSpace(matching[0].SclBType)
+                    ? matching[0].MmsType : matching[0].SclBType,
+                target.DataType, StringComparison.OrdinalIgnoreCase) ||
+            target.FunctionalConstraint is not ("CF" or "DC" or "SP" or "SG" or "SE"))
+            throw new InvalidOperationException(
+                "DA Write target/type was not uniquely verified in the current LIVE MMS directory.");
+        return session;
+    }
+}
diff --git a/Services/Iec61850MonitorRuntime.cs b/Services/Iec61850MonitorRuntime.cs
index ff3293671..0f783af40 100644
--- a/Services/Iec61850MonitorRuntime.cs
+++ b/Services/Iec61850MonitorRuntime.cs
@@ -11,7 +11,7 @@ namespace ArIED61850Tester.Services;
 /// existing static RCB/DataSet reporting first, then an association-scoped dynamic
 /// DataSet/URCB, and uses cyclic MMS reads only for points that reporting cannot cover.
 /// </summary>
-public sealed class Iec61850MonitorRuntime : IAsyncDisposable
+public sealed partial class Iec61850MonitorRuntime : IAsyncDisposable
 {
     private sealed class RuntimePointState
     {
@@ -105,7 +105,16 @@ private sealed class DeviceSession
         public int ControlFlightQuarantined;
         public HybridReportPhysicalValidationTracker HybridValidation { get; } = new();
         public StaticDataSetReportProjectionAccumulator StaticReportProjection { get; } = new();
+        // Frozen membership and stable point object references: reports cannot
+        // allocate/walk a fresh dictionary snapshot for every process leaf.
+        // Rebuilt when a new monitor selection starts, released on stop.
+        public Iec61850MonitorPoint[] StaticProjectionPoints { get; set; } = [];
         public bool StaticDataSetReportOnly { get; set; }
+        // Independent canonical journal cursor: no second value store or
+        // cyclic MMS read is introduced for operator-triggered snapshots.
+        public long StaticReadJournalCursor { get; set; }
+        // Bounded recovery if a large Report storm wraps the journal ring.
+        public int StaticReadResyncIndex { get; set; } = -1;
         public Guid CurrentStaticParityAttemptId { get; set; }
     }
 
@@ -125,6 +134,137 @@ public IReadOnlySet<string> GetActiveBrowserRcbReferences(string deviceId)
     public int ConnectedDeviceCount => _sessions.Values.Count(session => session.Client.IsConnected);
     public int MonitoringDeviceCount => _sessions.Values.Count(session => session.Device.IsMonitoring);
 
+    /// <summary>
+    /// Read-only preview for a single exact live model DA; no re-discovery,
+    /// client creation or Write. Frozen with the current association epoch.
+    /// </summary>
+    public async Task<IedBrowserNativeWritePreview> PreviewBrowserDataAttributeWriteAsync(
+        Iec61850MonitorDevice device,
+        AR.Iec61850.Mms.MmsObjectReference reference,
+        CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(device);
+        var model = device.LiveDiscoveryModel;
+        if (device.IsDemo || device.IsBusy ||
+            model is null || !device.IsConnected ||
+            !_sessions.TryGetValue(device.DeviceId, out var session) ||
+            !ReferenceEquals(session.Device, device) || !session.Client.IsConnected ||
+            session.ControlLifetimeCancellation.IsCancellationRequested)
+            throw new InvalidOperationException(
+                "Data Write preview requires a current, idle, online IED model.");
+
+        var parts = reference.Item.Split('$');
+        var ld = model.LogicalDevices.FirstOrDefault(x =>
+            string.Equals(x.MmsDomain, reference.Domain, StringComparison.Ordinal));
+        var ln = parts.Length > 0 ? ld?.LogicalNodes.FirstOrDefault(x =>
+            string.Equals(x.Name, parts[0], StringComparison.Ordinal)) : null;
+        var objRef = parts.Length > 2
+            ? reference.Domain + "/" + parts[0] + "." + parts[2] : "";
+        var obj = ln?.DataObjects.FirstOrDefault(x =>
+            string.Equals(x.Reference, objRef, StringComparison.Ordinal));
+        if (parts.Length < 4 || obj is null || !obj.Attributes.Any(attr =>
+                string.Equals(attr.FunctionalConstraint, reference.FunctionalConstraint,
+                    StringComparison.OrdinalIgnoreCase) &&
+                MmsReferenceMatches(attr.MmsReference, attr.FunctionalConstraint, reference)))
+            throw new InvalidOperationException(
+                "The selected DA/FC is not declared in this exact current online DO.");
+
+        var epoch = device.LiveValues.Association;
+        bool Current() =>
+            _sessions.TryGetValue(device.DeviceId, out var actual) &&
+            ReferenceEquals(actual, session) && session.Client.IsConnected &&
+            ReferenceEquals(device.LiveDiscoveryModel, model) &&
+            device.LiveValues.Association == epoch && !device.LiveValues.IsOffline &&
+            device.IsConnected && !device.IsBusy &&
+            !session.ControlLifetimeCancellation.IsCancellationRequested;
+        return await session.Client.PreviewDataAttributeWriteAsync(
+            reference, Current, cancellationToken).ConfigureAwait(false);
+    }
+
+    /// <summary>
+    /// Operator-confirmed, same-DO generic MMS data Write using the CURRENT IED
+    /// association. The Browser passes an immutable per-DA plan frozen after
+    /// preview; this runtime rejects SCL-only or stale attribute ownership.
+    /// Uses the same existing serialized MMS association while RCB monitoring can continue;\n    /// never changes report ownership or triggers cyclic polling. No control flight may be active.
+    /// </summary>
+    public async Task<IedBrowserTypedWriteBatchResult> WriteBrowserDataAttributesAsync(
+        Iec61850MonitorDevice device,
+        IReadOnlyList<IedBrowserTypedWriteStep> confirmedPlan,
+        bool explicitOperatorConfirmation,
+        CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(device);
+        var plan = IedBrowserTypedWriteBatch.Freeze(confirmedPlan);
+        var model = device.LiveDiscoveryModel;
+        if (!explicitOperatorConfirmation || device.IsDemo || device.IsBusy ||
+            model is null || !device.IsConnected ||
+            !_sessions.TryGetValue(device.DeviceId, out var session) ||
+            !ReferenceEquals(session.Device, device) || !session.Client.IsConnected ||
+            session.ControlLifetimeCancellation.IsCancellationRequested ||
+            Volatile.Read(ref session.ControlCommandActive) != 0 ||
+            Volatile.Read(ref session.ControlFlightQuarantined) != 0)
+            throw new InvalidOperationException(
+                "Generic data Write requires explicit confirmation, current live model, " +
+                "idle IED association and no active/unresolved command.");
+
+        var epoch = device.LiveValues.Association;
+        var first = plan[0].Reference;
+        var parts = first.Item.Split('$');
+        // Validate in exactly one owner LN/DO instead of scanning the whole IED.
+        var ld = model.LogicalDevices.FirstOrDefault(x =>
+            string.Equals(x.MmsDomain, first.Domain, StringComparison.Ordinal));
+        var ln = ld?.LogicalNodes.FirstOrDefault(x =>
+            string.Equals(x.Name, parts[0], StringComparison.Ordinal));
+        var exactDoReference = first.Domain + "/" + parts[0] + "." + parts[2];
+        var owner = ln?.DataObjects.FirstOrDefault(x =>
+            string.Equals(x.Reference, exactDoReference, StringComparison.Ordinal));
+        if (owner is null)
+            throw new InvalidOperationException("Selected DO is not in the current live IEC model.");
+
+        foreach (var step in plan)
+        {
+            if (!owner.Attributes.Any(a =>
+                    string.Equals(a.FunctionalConstraint,
+                        step.Reference.FunctionalConstraint, StringComparison.OrdinalIgnoreCase) &&
+                    MmsReferenceMatches(a.MmsReference, a.FunctionalConstraint, step.Reference)))
+                throw new InvalidOperationException(
+                    "One or more selected DAs are not exact live model attributes of this DO.");
+        }
+
+        bool Current() =>
+            _sessions.TryGetValue(device.DeviceId, out var active) &&
+            ReferenceEquals(active, session) &&
+            ReferenceEquals(active.Device, device) &&
+            ReferenceEquals(device.LiveDiscoveryModel, model) &&
+            device.LiveValues.Association == epoch &&
+            !device.LiveValues.IsOffline &&
+            device.IsConnected && active.Client.IsConnected &&
+            !device.IsBusy &&
+            !active.ControlLifetimeCancellation.IsCancellationRequested &&
+            Volatile.Read(ref active.ControlCommandActive) == 0 &&
+            Volatile.Read(ref active.ControlFlightQuarantined) == 0;
+
+        return await IedBrowserTypedWriteBatch.ExecuteAsync(
+            plan,
+            (step, token) => session.Client.WriteVerifiedDataAttributeAsync(
+                step.Reference, step.ExpectedGvaSignature, step.ExpectedOldValue,
+                step.ProposedValue, Current, explicitOperatorConfirmation, token),
+            Current, cancellationToken).ConfigureAwait(false);
+    }
+
+    private static bool MmsReferenceMatches(
+        string modelReference, string declaredFc,
+        AR.Iec61850.Mms.MmsObjectReference target)
+    {
+        if (string.IsNullOrWhiteSpace(modelReference)) return false;
+        var candidate = AR.Iec61850.Mms.MmsObjectReference.Parse(
+            modelReference, declaredFc);
+        return string.Equals(candidate.Domain, target.Domain, StringComparison.Ordinal) &&
+               string.Equals(candidate.Item, target.Item, StringComparison.Ordinal) &&
+               string.Equals(candidate.FunctionalConstraint, target.FunctionalConstraint,
+                   StringComparison.OrdinalIgnoreCase);
+    }
+
     /// <summary>
     /// Explicit operator-commanded read-only MMS sweep. Uses the existing
     /// association and a single sequential request lane. No report subscription,
@@ -221,6 +361,24 @@ private async Task<int> ReadBrowserValuesAsync(
         return succeeded;
     }
 
+    /// <summary>
+    /// Before the first actual InformationReport, show the exact declared
+    /// DataSet/RCB routing context. This is not proof that RptEna/GI succeeded
+    /// or that the server has ever emitted a process observation. Do not
+    /// synthesise current values, alter any wire setting, or start polling.
+    /// </summary>
+    internal static string StaticReportAwaitingReason(SignalDefinition signal)
+    {
+        ArgumentNullException.ThrowIfNull(signal);
+        var dataSet = signal.DataSetReference?.Trim() ?? "";
+        var control = signal.ReportControlReference?.Trim() ?? "";
+        if (dataSet.Length == 0)
+            return "No verified static DataSet member; Report-only mode does not poll";
+        if (control.Length == 0)
+            return $"Static DataSet {dataSet}: no matched RCB; awaiting live routing evidence (polling disabled)";
+        return $"Static DataSet {dataSet} / RCB {control}: awaiting first routed InformationReport (RptEna/GI not yet proven; polling disabled)";
+    }
+
     private const int InitialHydrationMaxTargets = 32;
     private static readonly TimeSpan InitialHydrationTotalBudget = TimeSpan.FromSeconds(10);
 
@@ -874,6 +1032,8 @@ public async Task<IReadOnlyList<Iec61850MonitorPoint>> StartMonitoringAsync(
         session.HybridValidation.Reset(null);
         session.StaticReportProjection.Reset();
         session.StaticDataSetReportOnly = staticDataSetReportOnly;
+        session.StaticReadResyncIndex = -1;
+        session.StaticReadJournalCursor = device.LiveValues.Version;
 
         var safePollMs = Math.Clamp(pollingIntervalMs <= 0 ? 1000 : pollingIntervalMs, 50, 600000);
         foreach (var signal in selected)
@@ -889,12 +1049,19 @@ public async Task<IReadOnlyList<Iec61850MonitorPoint>> StartMonitoringAsync(
                     ? "Static DataSet report pending"
                     : signal.IsReportCapable ? "Report pending / polling fallback" : "MMS polling",
                 Reason = staticDataSetReportOnly
-                    ? "configured static DataSet / RCB required; cyclic MMS process polling disabled"
+                    ? StaticReportAwaitingReason(signal)
                     : signal.IsReportCapable ? "report plan pending" : "cyclic",
-                Status = staticDataSetReportOnly ? "Waiting for static RCB" : "Queued"
+                Status = staticDataSetReportOnly ? "Awaiting first static InformationReport" : "Queued"
             };
         }
 
+        session.StaticProjectionPoints = staticDataSetReportOnly
+            ? session.Points.Values.ToArray()
+            : [];
+        if (staticDataSetReportOnly)
+            session.StaticReportProjection.Prepare(
+                device.SclWorkspace?.DesignModel ?? device.LiveDiscoveryModel,
+                session.StaticProjectionPoints);
         session.HealthProbePointKey = staticDataSetReportOnly
             ? string.Empty
             : session.Points.Values
@@ -917,6 +1084,35 @@ public async Task<IReadOnlyList<Iec61850MonitorPoint>> StartMonitoringAsync(
         device.IsMonitoring = true;
         device.IsConnected = true;
         session.BrowserObservationAssociation = device.LiveValues.Association;
+        // Static report-only may reuse genuine initial scalar MMS Read evidence
+        // already held by this association. Never issue implicit MMS requests
+        // or mistake a previous Report for current RCB traffic.
+        if (staticDataSetReportOnly)
+        {
+            var seeded = 0;
+            foreach (var point in session.Points.Values)
+            {
+                if (!TryGetStaticInitialRead(device.LiveValues,
+                        session.BrowserObservationAssociation, point.IecReference,
+                        point.FunctionalConstraint, out var read))
+                    continue;
+                ApplyValueUpdate(session, point,
+                    FormatStaticSnapshotRead(point, read), read.Quality,
+                    read.DeviceTimestamp, "MMS Snapshot Read",
+                    $"Existing MMS Read at {read.ObservedUtc:O}; " +
+                    "awaiting first routed InformationReport for this monitor",
+                    read.ObservedUtc, "Snapshot / awaiting InformationReport",
+                    trustReportEdge: false);
+                seeded++;
+            }
+            if (seeded > 0)
+                Log("INFO", device.Name,
+                    $"Static report-only initial image: {seeded} actual association-scoped " +
+                    "MMS Read scalar(s) reused; zero additional MMS requests or Report claims.");
+        }
+        // Initial MMS Read reuse has finished. Only subsequent canonical
+        // revisions may produce another snapshot projection into runtime rows.
+        session.StaticReadJournalCursor = device.LiveValues.Version;
         device.Status = "Monitoring";
         if (staticDataSetReportOnly)
         {
@@ -1047,6 +1243,27 @@ Iec61850ControlModelKind.SboNormal or
         }
     }
 
+    public async Task<AR.Iec61850.Control.Iec61850ControlModelProbe> ProbeControlModelAsync(
+        string deviceId, SignalDefinition signal, CancellationToken cancellationToken)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(deviceId);
+        ArgumentNullException.ThrowIfNull(signal);
+        if (!_sessions.TryGetValue(deviceId, out var session) || !session.Client.IsConnected)
+            throw new InvalidOperationException("The IED must be connected before ctlModel discovery.");
+        if (Volatile.Read(ref session.ControlCommandActive) != 0 ||
+            Volatile.Read(ref session.ControlFlightQuarantined) != 0)
+            throw new InvalidOperationException("Control discovery deferred while a command is active.");
+        using var lifetime = CancellationTokenSource.CreateLinkedTokenSource(
+            cancellationToken, session.ControlLifetimeCancellation.Token);
+        var result = await session.Client.ProbeControlModelAsync(signal, lifetime.Token)
+            .ConfigureAwait(false);
+        if (!_sessions.TryGetValue(deviceId, out var current) ||
+            !ReferenceEquals(current, session) ||
+            session.ControlLifetimeCancellation.IsCancellationRequested)
+            throw new OperationCanceledException("Control discovery association was replaced.");
+        return result;
+    }
+
     public async Task<Iec61850ControlCapabilities> InspectControlAsync(
         string deviceId,
         SignalDefinition signal,
@@ -1481,11 +1698,17 @@ private async Task StartReportPlansAsync(
                         pointState.AcquisitionLabel = acquisitionLabel;
                         pointState.SourceMode = acquisitionLabel;
                         pointState.Reason = session.StaticDataSetReportOnly
-                            ? "awaiting configured static report / General Interrogation"
+                            ? $"RCB setup accepted: {activeReference}; awaiting first routed InformationReport (GI requested does not prove delivery)"
                             : "awaiting report / MMS initial read";
                         pointState.Status = session.StaticDataSetReportOnly
-                            ? "Static report armed / awaiting value"
+                            ? "RCB armed / awaiting first routed value"
                             : "Report armed / verification active";
+                        // Readback and traffic are separate proofs. Emit only
+                        // first-image status rows, never a fake process value.
+                        // The existing bounded UI coalescer handles these keys.
+                        if (session.StaticDataSetReportOnly && !pointState.HasValue)
+                            EmitStatusSnapshot(session, point, pointState,
+                                pointState.Status, "Pending / q not supplied");
                     }
                 }
 
@@ -1594,6 +1817,10 @@ private async Task MonitorLoopAsync(DeviceSession session, CancellationToken can
                 }
 
                 await ReceiveReportSlicesAsync(session, cancellationToken).ConfigureAwait(false);
+                // Browser's explicit MMS Read already published SSOT before
+                // WPF. The monitor consumes only changed, exact ST/MX keys;
+                // it never repeats the network read or impersonates a Report.
+                ConsumeStaticReadJournal(session);
                 await PollDuePointsAsync(session, cancellationToken).ConfigureAwait(false);
                 await ProbeSessionHealthAsync(session, cancellationToken).ConfigureAwait(false);
                 await TryStartPendingReportSetupAsync(session, cancellationToken).ConfigureAwait(false);
@@ -1815,7 +2042,7 @@ private async Task ReceiveReportSlicesAsync(DeviceSession session, CancellationT
                 var effectiveUpdates = session.StaticDataSetReportOnly
                     ? session.StaticReportProjection.Project(
                         session.Device.SclWorkspace?.DesignModel ?? session.Device.LiveDiscoveryModel,
-                        session.Points.Values.ToArray(),
+                        session.StaticProjectionPoints,
                         sourceUpdate)
                     : new[] { sourceUpdate };
 
@@ -2393,6 +2620,20 @@ private async Task PollDuePointsAsync(DeviceSession session, CancellationToken c
 
                 var normalizedQuality = NormalizeQuality(quality);
                 var normalizedTimestamp = string.IsNullOrWhiteSpace(deviceTimestamp) ? "-" : deviceTimestamp;
+                // Read evidence must enter SSOT before WPF. Awaited companion
+                // reads can outlive an association; reject obsolete sessions.
+                var readAssociation = session.BrowserObservationAssociation;
+                if (readAssociation == 0 ||
+                    !_sessions.TryGetValue(session.Device.DeviceId, out var readOwner) ||
+                    !ReferenceEquals(readOwner, session) ||
+                    !session.Client.IsConnected || !session.Device.IsConnected ||
+                    session.Device.LiveValues.Association != readAssociation)
+                    continue;
+                PublishVerifiedMmsReadToCanonical(
+                    session.Device.LiveValues, readAssociation, resolved,
+                    point.FunctionalConstraint, point.IecDataType,
+                    normalizedQuality, normalizedTimestamp);
+
                 var pollDetectedChange = state.HasValue && !string.Equals(state.Value, display, StringComparison.Ordinal);
                 var sourceMode = "MMS polling";
                 var reason = "cyclic";
@@ -2459,6 +2700,150 @@ private async Task PollDuePointsAsync(DeviceSession session, CancellationToken c
         }
     }
 
+    /// <summary>
+    /// Route an actual successful native scalar MMS Read to canonical SSOT,
+    /// not a Report or WPF-origin observation. Only the exact wire-resolved
+    /// reference/FC may be written. Non-scalar and CO values fail closed.
+    /// </summary>
+    internal static bool PublishVerifiedMmsReadToCanonical(
+        IedBrowserLiveValues liveValues, long association,
+        ResolvedIecSignalRead resolved, string functionalConstraint,
+        string declaredDataType, string quality, string timestamp)
+    {
+        ArgumentNullException.ThrowIfNull(liveValues);
+        ArgumentNullException.ThrowIfNull(resolved);
+        if (association <= 0 || string.IsNullOrWhiteSpace(resolved.EffectiveReference) ||
+            functionalConstraint is not ("ST" or "MX" or "CF" or "DC" or "SP" or "SG" or "SE" or "EX"))
+            return false;
+
+        var rich = resolved.Value as Iec61850ReadValue;
+        var scalar = Iec61850ReadValue.Unwrap(resolved.Value);
+        if (scalar is double d && !double.IsFinite(d) ||
+            scalar is float f && !float.IsFinite(f))
+            return false;
+        if (scalar is not (string or bool or byte or sbyte or short or ushort
+            or int or uint or long or ulong or float or double or decimal))
+            return false;
+        var rawText = scalar is IFormattable formattable
+            ? formattable.ToString(null, CultureInfo.InvariantCulture)
+            : scalar.ToString();
+        return liveValues.PublishForAssociation(
+            association, resolved.EffectiveReference, functionalConstraint,
+            rawText, quality, timestamp, "MMS Read",
+            rich?.UtcTimeEvidence, rich?.QualityEvidence,
+            typedBoolean: scalar is bool flag ? flag : null,
+            verifiedStringWireKind: rich?.VerifiedStringWireKind,
+            declaredDataType: declaredDataType,
+            readWireShapeEvidence: rich?.WireShapeEvidence);
+    }
+
+    /// <summary>
+    /// Bounded projection of an operator's verified Browser MMS Read into an
+    /// existing static report-only runtime point. The journal is the signal,
+    /// the association-scoped canonical ledger is the only value authority.
+    /// Report observations and SOE remain exclusively receive-path owned.
+    /// </summary>
+    /// <summary>
+    /// One display-only formatter for Report and actual MMS Snapshot Read.
+    /// DPC/Dbpos must show the correct Open/Close two-bit status rather than
+    /// a misleading bare integer; raw ledger evidence is never modified.
+    /// </summary>
+    internal static string FormatStaticSnapshotRead(
+        Iec61850MonitorPoint point, IedBrowserObservedValue evidence)
+    {
+        ArgumentNullException.ThrowIfNull(point);
+        ArgumentNullException.ThrowIfNull(evidence);
+        return Iec61850ValueFormatter.FormatReportProcessValue(
+            evidence.Value, point.IecDataType, point.Unit,
+            point.Category, point.IecReference);
+    }
+
+    private void ConsumeStaticReadJournal(DeviceSession session)
+    {
+        if (!session.StaticDataSetReportOnly || !session.Device.IsMonitoring ||
+            !session.Client.IsConnected || session.BrowserObservationAssociation == 0)
+            return;
+        var ledger = session.Device.LiveValues;
+        var association = session.BrowserObservationAssociation;
+        if (ledger.IsOffline || ledger.Association != association)
+            return;
+
+        // Max 32 canonical keys per iteration, independent of model size.
+        // Overflow means journal history is incomplete: inspect the selected
+        // points in bounded batches, never pretend that missing events occurred.
+        var changes = ledger.ReadChanges(session.StaticReadJournalCursor, 32);
+        session.StaticReadJournalCursor = changes.ThroughRevision;
+        if (changes.RequiresFullRefresh)
+            session.StaticReadResyncIndex = 0;
+
+        foreach (var change in changes.Changes)
+        {
+            if (change.Kind != CanonicalValueChangeKind.Read ||
+                change.Association != association ||
+                change.FunctionalConstraint is not ("ST" or "MX"))
+                continue;
+            var pointKey = session.Device.DeviceId + "|" + NormalizeReference(change.Reference);
+            if (session.Points.TryGetValue(pointKey, out var point) &&
+                point.FunctionalConstraint.Equals(change.FunctionalConstraint,
+                    StringComparison.OrdinalIgnoreCase))
+                ProjectStaticReadSnapshot(session, point, association);
+        }
+
+        if (session.StaticReadResyncIndex < 0)
+            return;
+        // Canonical journal overrun recovery is bounded and cancellable by
+        // the owning MonitorLoop; no full-model UI refresh or new I/O.
+        var offset = session.StaticReadResyncIndex;
+        var batch = session.Points.Values.Skip(offset).Take(32).ToArray();
+        foreach (var point in batch)
+            ProjectStaticReadSnapshot(session, point, association);
+        session.StaticReadResyncIndex = batch.Length < 32
+            ? -1 : offset + batch.Length;
+    }
+
+    private void ProjectStaticReadSnapshot(
+        DeviceSession session, Iec61850MonitorPoint point, long association)
+    {
+        if (!session.States.TryGetValue(point.PointKey, out var state) ||
+            state.ReportTrafficSeen ||
+            !TryGetStaticInitialRead(session.Device.LiveValues, association,
+                point.IecReference, point.FunctionalConstraint, out var read) ||
+            !session.Device.IsConnected || !session.Client.IsConnected ||
+            session.Device.LiveValues.Association != association)
+            return;
+        ApplyValueUpdate(session, point,
+            FormatStaticSnapshotRead(point, read), read.Quality,
+            read.DeviceTimestamp, "MMS Snapshot Read",
+            $"Explicit MMS Read at {read.ObservedUtc:O}; " +
+            "awaiting first routed InformationReport",
+            read.ObservedUtc, "Snapshot / awaiting InformationReport",
+            trustReportEdge: false);
+    }
+
+    /// <summary>
+    /// Reuse a previously decoded exact-reference ST/MX MMS Read as an initial
+    /// static DataSet snapshot. Does not infer Report ingress, alias a sibling
+    /// attribute, change RCB state or issue any network traffic.
+    /// </summary>
+    internal static bool TryGetStaticInitialRead(
+        IedBrowserLiveValues ledger, long association, string reference,
+        string functionalConstraint, out IedBrowserObservedValue evidence)
+    {
+        ArgumentNullException.ThrowIfNull(ledger);
+        evidence = null!;
+        if (association <= 0 || ledger.IsOffline ||
+            ledger.Association != association ||
+            string.IsNullOrWhiteSpace(reference) ||
+            functionalConstraint is not ("ST" or "MX"))
+            return false;
+        if (!ledger.TryGet(reference, functionalConstraint, out var observed) ||
+            observed.Association != association || observed.IsStale ||
+            !string.Equals(observed.Source, "MMS Read", StringComparison.Ordinal))
+            return false;
+        evidence = observed;
+        return true;
+    }
+
     private void ApplyValueUpdate(
         DeviceSession session,
         Iec61850MonitorPoint point,
@@ -2491,7 +2876,11 @@ private void ApplyValueUpdate(
                               !string.Equals(state.SourceMode, sourceMode, StringComparison.Ordinal) ||
                               !string.Equals(state.Reason, reason, StringComparison.Ordinal) ||
                               !string.Equals(state.Status, status, StringComparison.Ordinal);
-        var changed = hasProcessValue && hadValue && (trustReportEdge
+        // An isolated one-shot Snapshot Read is not continuous SOE
+        // evidence; never manufacture a breaker transition from its delta.
+        var changed = hasProcessValue && hadValue &&
+            !string.Equals(sourceMode, "MMS Snapshot Read", StringComparison.Ordinal) &&
+            (trustReportEdge
             ? HasExactSemanticEdge(point, oldValue, display)
             : HasMeaningfulEdge(point, oldValue, display));
 
@@ -2521,6 +2910,17 @@ private void ApplyValueUpdate(
         if (changed)
             state.Sequence++;
 
+        // Canonical ingress precedes ALL presentation callbacks. A typed raw
+        // Report already present in LiveValues wins; compatibility evidence
+        // may fill only a truly missing primary value on this association.
+        // Never run canonical publication on the WPF Dispatcher.
+        if (trustReportEdge && hasProcessValue &&
+            session.BrowserObservationAssociation != 0)
+            session.Device.LiveValues.MirrorRoutedReportIfMissingForAssociation(
+                session.BrowserObservationAssociation,
+                point.IecReference, point.FunctionalConstraint,
+                state.Value, quality, deviceTimestamp);
+
         if (!hadValue || displayChanged || qualityChangedForUi || metadataChanged)
         {
             PointUpdated?.Invoke(new Iec61850PointSnapshot
@@ -2786,6 +3186,8 @@ await DisposeClientForReconnectAsync(
         session.ContinuityUntrackedStreams = 0;
         session.Device.ReportContinuityEvidence = null;
         session.LastUnroutedReportCount = 0;
+        session.StaticReadJournalCursor = session.Device.LiveValues.Version;
+        session.StaticReadResyncIndex = -1;
         ResetAssociationReportEvidence(session);
 
         var legacyPlans = Iec61850ReportPlanner.BuildPlans(session.Device, session.Points.Values);
@@ -3126,6 +3528,8 @@ private async Task StopMonitoringSessionAsync(DeviceSession session, bool preser
         session.ReportSetupDeadlineUtc = DateTime.MinValue;
         if (!preservePointDefinitions)
         {
+            session.StaticReportProjection.ClearPrepared();
+            session.StaticProjectionPoints = [];
             session.Points.Clear();
             session.States.Clear();
             session.ReportReferenceIndex.Clear();
diff --git a/Services/Iec61850SclLiveCswiParityDiagnostic.cs b/Services/Iec61850SclLiveCswiParityDiagnostic.cs
new file mode 100644
index 000000000..a3054ec47
--- /dev/null
+++ b/Services/Iec61850SclLiveCswiParityDiagnostic.cs
@@ -0,0 +1,121 @@
+using AR.Iec61850.Discovery;
+using ArIED61850Tester.Models;
+
+namespace ArIED61850Tester.Services;
+
+/// <summary>
+/// Read-only comparison of an opened SCD design and the exact live MMS model.
+/// A DO declared in SCL, an MMS-discovered CO/CF attribute and a live proven
+/// command are THREE different facts. This diagnostic never reads, writes,
+/// promotes a design-only command or changes an operator's selection.
+/// </summary>
+public static class Iec61850SclLiveCswiParityDiagnostic
+{
+    private static readonly string[] RequiredCommandNames = ["Oper", "SBO", "SBOw", "Cancel"];
+
+    public static IReadOnlyList<string> Summarize(Iec61850MonitorDevice device, int sampleBudget = 12)
+    {
+        ArgumentNullException.ThrowIfNull(device);
+        sampleBudget = Math.Clamp(sampleBudget, 0, 24);
+        var design = device.SclWorkspace?.DesignModel;
+        var live = device.LiveDiscoveryModel;
+        if (design is null)
+            return ["SCD ↔ live CSWI: NO OPEN SCD for this IED; import the original SCD/IID to compare exact CSWI.Pos command ownership. Do not infer control from XCBR/XSWI status."];
+
+        static Dictionary<string, LiveIedDataObjectModel> Index(LiveIedModelDiscoveryDocument model)
+        {
+            var result = new Dictionary<string, LiveIedDataObjectModel>(StringComparer.Ordinal);
+            var duplicates = new HashSet<string>(StringComparer.Ordinal);
+            foreach (var ld in model.LogicalDevices)
+            foreach (var ln in ld.LogicalNodes)
+            {
+                if (!SignalDefinition.DetectLogicalNodeClass(ln.Name)
+                        .Equals("CSWI", StringComparison.OrdinalIgnoreCase))
+                    continue;
+                foreach (var obj in ln.DataObjects)
+                {
+                    if (!obj.Name.Equals("Pos", StringComparison.Ordinal) ||
+                        string.IsNullOrWhiteSpace(obj.Reference)) continue;
+                    // Strict exact object identity; duplicate declarations
+                    // are not arbitrarily resolved by first insertion.
+                    var key = Iec61850ControlIdentity.Normalize(obj.Reference);
+                    if (duplicates.Contains(key)) continue;
+                    if (!result.TryAdd(key, obj))
+                    {
+                        duplicates.Add(key);
+                        result.Remove(key);
+                    }
+                }
+            }
+            return result;
+        }
+
+        static bool HasLeaf(LiveIedDataObjectModel obj, string name, string fc)
+            => obj.Attributes.Any(a =>
+                a.FunctionalConstraint.Equals(fc, StringComparison.OrdinalIgnoreCase) &&
+                a.AttributePath.Split('.').FirstOrDefault()
+                    ?.Equals(name, StringComparison.Ordinal) == true);
+
+        var designIndex = Index(design);
+        var liveIndex = live is null
+            ? new Dictionary<string, LiveIedDataObjectModel>(StringComparer.Ordinal)
+            : Index(live);
+        var keys = designIndex.Keys.Union(liveIndex.Keys, StringComparer.Ordinal)
+            .OrderBy(k => k, StringComparer.Ordinal).ToArray();
+        var matched = designIndex.Keys.Count(liveIndex.ContainsKey);
+        var liveCo = liveIndex.Values.Count(obj =>
+            RequiredCommandNames.Any(name => HasLeaf(obj, name, "CO")));
+        var verifiedOperable = 0;
+        var observations = new List<string>(Math.Min(keys.Length, sampleBudget));
+        var signalIndex = device.Signals
+            .Where(s => s.IsValidControlObject)
+            .GroupBy(s => Iec61850ControlIdentity.Normalize(s.ObjectReference),
+                StringComparer.Ordinal)
+            .Where(g => g.Count() == 1)
+            .ToDictionary(g => g.Key, g => g.Single(), StringComparer.Ordinal);
+
+        foreach (var key in keys)
+        {
+            designIndex.TryGetValue(key, out var sclObject);
+            liveIndex.TryGetValue(key, out var liveObject);
+            signalIndex.TryGetValue(key, out var signal);
+            if (signal?.ControlModelResolved == true && signal.ControlSupportsOperate &&
+                liveObject is not null)
+                verifiedOperable++;
+            if (observations.Count >= sampleBudget) continue;
+            var designOperations = sclObject is null ? "-" :
+                string.Join("/", RequiredCommandNames.Where(n => HasLeaf(sclObject, n, "CO")));
+            var liveOperations = liveObject is null ? "-" :
+                string.Join("/", RequiredCommandNames.Where(n => HasLeaf(liveObject, n, "CO")));
+            var liveCtlModelDeclared = liveObject is not null && HasLeaf(liveObject, "ctlModel", "CF");
+            var verdict = liveObject is null
+                ? "SCL_ONLY / NOT_LIVE_PROVEN"
+                : signal?.ControlModelResolved == true && signal.ControlSupportsOperate
+                    ? "OPERABLE / LIVE_INSPECTED"
+                    : "MODEL_ONLY / LIVE_COMMAND_UNVERIFIED";
+            var cdc = signal?.VerifiedLiveControlCdc ?? "";
+            observations.Add("  " + key +
+                " | SCD_CO=" + (designOperations.Length == 0 ? "-" : designOperations) +
+                " | MMS_CO=" + (liveOperations.Length == 0 ? "-" : liveOperations) +
+                " | MMS_CF_ctlModel=" + liveCtlModelDeclared +
+                " | liveCDC=" + (cdc.Length == 0 ? "unverified" : cdc) +
+                " | " + verdict);
+        }
+
+        var output = new List<string>
+        {
+            "SCD ↔ live CSWI: design=" + designIndex.Count +
+            ", live=" + liveIndex.Count +
+            ", sameExactDO=" + matched +
+            ", liveCOdeclared=" + liveCo +
+            ", liveOperable=" + verifiedOperable +
+            ", SCDnotLive=" + designIndex.Keys.Count(key => !liveIndex.ContainsKey(key)) +
+            "; SCD ctlModel configuration is NOT live MMS ctlModel proof"
+        };
+        output.AddRange(observations);
+        if (keys.Length > sampleBudget)
+            output.Add("  ... " + (keys.Length - sampleBudget) +
+                " additional CSWI.Pos reference(s) omitted from bounded diagnostics");
+        return output;
+    }
+}
diff --git a/Services/Iec61850ValueFormatter.cs b/Services/Iec61850ValueFormatter.cs
index bd5234398..2c1646b60 100644
--- a/Services/Iec61850ValueFormatter.cs
+++ b/Services/Iec61850ValueFormatter.cs
@@ -68,6 +68,11 @@ public static string FormatReportProcessValue(
         if (TryExtractStructuredScalar(normalizedValue, dataType, out var structuredScalar))
             normalizedValue = structuredScalar;
 
+        // IEC 61850 BSC ValWithTrans.posVal is SIGNED INT8 (-64..63).
+        // Even stale Boolean/SPC metadata must not reinterpret 0/1 as states.
+        if (IsBscStepPosition(reference, dataType))
+            return FormatBscStepPosition(normalizedValue, unit);
+
         if (IsPositionSemantic(dataType, category, reference) &&
             TryNormalizeDbpos(normalizedValue, out var dbpos))
         {
@@ -84,6 +89,44 @@ public static string FormatReportProcessValue(
         return FormatNormalizedValue(normalizedValue, dataType, unit);
     }
 
+    public static bool IsBscStepPosition(string? reference, string? dataType)
+    {
+        var path = (reference ?? string.Empty).Trim().Replace('$', '.');
+        return path.EndsWith(".valWTr.posVal", StringComparison.OrdinalIgnoreCase) ||
+               (string.Equals(dataType?.Trim(), "BSC", StringComparison.OrdinalIgnoreCase) &&
+                path.EndsWith(".posVal", StringComparison.OrdinalIgnoreCase));
+    }
+
+    public static string FormatBscStepPosition(object? value, string? unit = null)
+    {
+        string? number = value switch
+        {
+            sbyte x when x is >= -64 and <= 63 => x.ToString(CultureInfo.InvariantCulture),
+            byte x when x <= 63 => x.ToString(CultureInfo.InvariantCulture),
+            short x when x is >= -64 and <= 63 => x.ToString(CultureInfo.InvariantCulture),
+            ushort x when x <= 63 => x.ToString(CultureInfo.InvariantCulture),
+            int x when x is >= -64 and <= 63 => x.ToString(CultureInfo.InvariantCulture),
+            uint x when x <= 63 => x.ToString(CultureInfo.InvariantCulture),
+            long x when x is >= -64 and <= 63 => x.ToString(CultureInfo.InvariantCulture),
+            ulong x when x <= 63 => x.ToString(CultureInfo.InvariantCulture),
+            string text when sbyte.TryParse(text.Trim(), NumberStyles.Integer,
+                CultureInfo.InvariantCulture, out var step) &&
+                step is >= -64 and <= 63 => step.ToString(CultureInfo.InvariantCulture),
+            _ => null
+        };
+        if (number != null)
+            return AppendUnit(number, unit ?? string.Empty);
+        // Never make up a step number from a raw Boolean shape mismatch.
+        return value switch
+        {
+            null => "-",
+            bool boolean => boolean
+                ? "true (BSC INT8 type mismatch)"
+                : "false (BSC INT8 type mismatch)",
+            _ => value.ToString() ?? "-"
+        };
+    }
+
     private static bool IsPositionSemantic(string dataType, string category, string reference)
     {
         if (IsDbposDataType(dataType))
diff --git a/Services/IecNaturalReferenceOrder.cs b/Services/IecNaturalReferenceOrder.cs
index a62084398..0b247384a 100644
--- a/Services/IecNaturalReferenceOrder.cs
+++ b/Services/IecNaturalReferenceOrder.cs
@@ -66,6 +66,16 @@ public int Compare(object? a, object? b)
         if (ReferenceEquals(a, b)) return 0;
         if (a is not SignalDefinition left || b is not SignalDefinition right)
             return Comparer.DefaultInvariant.Compare(a,b);
+        // WPF's ListCollectionView.CustomSort is the FINAL visual order.
+        // The underlying device.OperableCommandSignals is already ranked,
+        // but the view's alphabetical comparer used to override that rank:
+        // SG7_BCUMaster/GGIO2 sorted above SG7_BCUSystem/Bkr0XCBR.Pos.
+        // Match exactly the live-verified command role priority at the view
+        // boundary, while keeping natural instance order WITHIN each role.
+        // This is presentation only; no rank authorizes an MMS Operate.
+        var role = Iec61850ControlIdentity.CommandDockPriority(left)
+            .CompareTo(Iec61850ControlIdentity.CommandDockPriority(right));
+        if (role != 0) return role;
         var result = IecNaturalReferenceOrder.Compare(left.DisplayReference,right.DisplayReference);
         return result != 0 ? result : IecNaturalReferenceOrder.Compare(left.ObjectReference,right.ObjectReference);
     }
diff --git a/Services/IedBrowserIsolatedReadService.cs b/Services/IedBrowserIsolatedReadService.cs
index 5865d7553..9d0ad89e9 100644
--- a/Services/IedBrowserIsolatedReadService.cs
+++ b/Services/IedBrowserIsolatedReadService.cs
@@ -116,7 +116,8 @@ void EmitVerified(IedBrowserReadResult result)
                             read?.Quality ?? "", read?.DeviceTimestamp ?? "", "",
                             read?.UtcTimeEvidence, read?.QualityEvidence,
                             read?.Value is bool typed ? typed : null,
-                            read?.VerifiedStringWireKind));
+                            read?.VerifiedStringWireKind,
+                            read?.WireShapeEvidence ?? ""));
                     }
                     else
                     {
diff --git a/Services/IedBrowserPerformanceProbe.cs b/Services/IedBrowserPerformanceProbe.cs
new file mode 100644
index 000000000..f1285c847
--- /dev/null
+++ b/Services/IedBrowserPerformanceProbe.cs
@@ -0,0 +1,55 @@
+using System.Diagnostics;
+using System.Diagnostics.Tracing;
+
+namespace ArIED61850Tester.Services;
+
+/// <summary>
+/// Opt-in EventPipe/ETW diagnostics for SG7-size WPF model navigation.
+/// Disabled by default: no file writes, new UI controls, or network operations.
+/// Capture provider ARSAS-IEDBrowser-Performance with PerfView/dotnet-trace.
+/// </summary>
+[EventSource(Name = "ARSAS-IEDBrowser-Performance")]
+internal sealed class IedBrowserPerformanceEvents : EventSource
+{
+    internal static readonly IedBrowserPerformanceEvents Log = new();
+
+    [Event(1, Level = EventLevel.Informational)]
+    public void TimedPhase(string phase, string device, double elapsedMs, int itemCount)
+    {
+        if (IsEnabled())
+            WriteEvent(1, phase, device, elapsedMs, itemCount);
+    }
+}
+
+/// <summary>
+/// Measures an existing operation without scheduling, mutation or instrumentation
+/// overhead when no external diagnostics listener is attached.
+/// </summary>
+internal readonly struct IedBrowserPerformanceProbe : IDisposable
+{
+    private readonly string? _phase;
+    private readonly string? _device;
+    private readonly int _items;
+    private readonly long _started;
+
+    private IedBrowserPerformanceProbe(string phase, string device, int items)
+    {
+        _phase = phase;
+        _device = device;
+        _items = items;
+        _started = Stopwatch.GetTimestamp();
+    }
+
+    internal static IedBrowserPerformanceProbe Measure(string phase, string? device, int items = 0)
+        => IedBrowserPerformanceEvents.Log.IsEnabled()
+            ? new IedBrowserPerformanceProbe(phase, device ?? "", items)
+            : default;
+
+    public void Dispose()
+    {
+        if (_started == 0) return;
+        IedBrowserPerformanceEvents.Log.TimedPhase(
+            _phase ?? "", _device ?? "",
+            Stopwatch.GetElapsedTime(_started).TotalMilliseconds, _items);
+    }
+}
diff --git a/Services/IedBrowserTypedWriteBatch.cs b/Services/IedBrowserTypedWriteBatch.cs
new file mode 100644
index 000000000..f5a3791b1
--- /dev/null
+++ b/Services/IedBrowserTypedWriteBatch.cs
@@ -0,0 +1,121 @@
+using AR.Iec61850.Mms;
+
+namespace ArIED61850Tester.Services;
+
+/// <summary>
+/// One operator-selected, exact-FC scalar edit. A batch never implies a
+/// structure/DO overwrite, an alternate FC or a new association.
+/// </summary>
+public sealed record IedBrowserTypedWriteStep(
+    MmsObjectReference Reference,
+    string ExpectedGvaSignature,
+    MmsDataValue ExpectedOldValue,
+    MmsDataValue ProposedValue);
+
+public sealed record IedBrowserTypedWriteRowResult(
+    IedBrowserTypedWriteStep Step,
+    IedBrowserNativeWriteState? State,
+    string Message);
+
+public sealed record IedBrowserTypedWriteBatchResult(
+    IReadOnlyList<IedBrowserTypedWriteRowResult> Rows)
+{
+    public int Verified => Rows.Count(x => x.State == IedBrowserNativeWriteState.AcceptedVerified);
+    public int Rejected => Rows.Count(x => x.State == IedBrowserNativeWriteState.Rejected);
+    public int Unknown => Rows.Count(x => x.State == IedBrowserNativeWriteState.Unknown);
+    public int Unattempted => Rows.Count(x => x.State is null);
+    public int Unverified => Rows.Count(x => x.State is
+        IedBrowserNativeWriteState.AcceptedReadbackMismatch or
+        IedBrowserNativeWriteState.AcceptedReadbackUnavailable);
+}
+
+/// <summary>
+/// Sequential, non-atomic multi-DA transaction runner. All submitted targets
+/// must belong to ONE exact IEC DO and have distinct exact FC+leaf identities.
+/// Stops at first failure/uncertainty. It never retries or compensates.
+/// </summary>
+public static class IedBrowserTypedWriteBatch
+{
+    public const int MaxSelectedAttributes = 64;
+
+    public static IReadOnlyList<IedBrowserTypedWriteStep> Freeze(
+        IEnumerable<IedBrowserTypedWriteStep> selected)
+    {
+        ArgumentNullException.ThrowIfNull(selected);
+        var steps = selected.ToArray();
+        if (steps.Length is 0 or > MaxSelectedAttributes)
+            throw new ArgumentException("Select 1–64 exact data attributes.", nameof(selected));
+
+        string? ownerDo = null;
+        var seen = new HashSet<string>(StringComparer.Ordinal);
+        foreach (var step in steps)
+        {
+            if (step is null || step.ExpectedOldValue is null ||
+                step.ProposedValue is null || string.IsNullOrWhiteSpace(step.ExpectedGvaSignature))
+                throw new ArgumentException("Each selected edit needs typed old/new values and live GVA signature.");
+
+            var reference = step.Reference;
+            var parts = reference.Item.Split('$');
+            if (string.IsNullOrWhiteSpace(reference.Domain) || parts.Length < 4 ||
+                parts.Any(string.IsNullOrWhiteSpace) ||
+                !string.Equals(parts[1], reference.FunctionalConstraint, StringComparison.OrdinalIgnoreCase) ||
+                reference.FunctionalConstraint.ToUpperInvariant() is not ("CF" or "SP" or "DC"))
+                throw new ArgumentException("Exact IEC DA identity or FC is not eligible for the generic plan.");
+
+            if (parts.Skip(2).Any(x => x is "Oper" or "SBO" or "SBOw" or "Cancel"))
+                throw new ArgumentException("IEC control service cannot be a generic Write target.");
+
+            var thisDo = reference.Domain + "/" + parts[0] + "$" + parts[2];
+            if (ownerDo is null) ownerDo = thisDo;
+            else if (!string.Equals(ownerDo, thisDo, StringComparison.Ordinal))
+                throw new ArgumentException("All selected DAs must belong to the same exact DO.");
+
+            if (!seen.Add(reference.Domain + "/" + reference.Item))
+                throw new ArgumentException("Duplicate MMS references are not allowed in a batch.");
+        }
+        return Array.AsReadOnly(steps);
+    }
+
+    public static async Task<IedBrowserTypedWriteBatchResult> ExecuteAsync(
+        IReadOnlyList<IedBrowserTypedWriteStep> frozen,
+        Func<IedBrowserTypedWriteStep, CancellationToken, Task<IedBrowserNativeWriteResult>> oneShot,
+        Func<bool> associationLeaseIsCurrent,
+        CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(oneShot);
+        ArgumentNullException.ThrowIfNull(associationLeaseIsCurrent);
+        // Revalidate caller-provided collection; don't trust a mutable list.
+        var steps = Freeze(frozen);
+        var results = new List<IedBrowserTypedWriteRowResult>(steps.Count);
+        var stopped = false;
+
+        foreach (var step in steps)
+        {
+            if (stopped || cancellationToken.IsCancellationRequested || !associationLeaseIsCurrent())
+            {
+                results.Add(new(step, null, "Not attempted (prior failure, cancellation or stale association)."));
+                stopped = true;
+                continue;
+            }
+
+            IedBrowserNativeWriteResult result;
+            try
+            {
+                result = await oneShot(step, cancellationToken).ConfigureAwait(false);
+            }
+            catch (Exception ex) when (ex is OperationCanceledException or
+                                       IOException or InvalidOperationException or
+                                       ObjectDisposedException)
+            {
+                // The callback could have dispatched before it faulted.
+                result = new(IedBrowserNativeWriteState.Unknown,
+                    $"Outcome unknown after attempted dispatch ({ex.GetType().Name}).");
+            }
+
+            results.Add(new(step, result.State, result.Message));
+            // AcceptedVerified is the only state allowing another request.
+            stopped = result.State != IedBrowserNativeWriteState.AcceptedVerified;
+        }
+        return new IedBrowserTypedWriteBatchResult(results.AsReadOnly());
+    }
+}
diff --git a/Services/NativeIec61850Client.BrowserWrite.cs b/Services/NativeIec61850Client.BrowserWrite.cs
new file mode 100644
index 000000000..6bd3384f3
--- /dev/null
+++ b/Services/NativeIec61850Client.BrowserWrite.cs
@@ -0,0 +1,95 @@
+using AR.Iec61850.Mms;
+
+namespace ArIED61850Tester.Services;
+
+public sealed record BrowserMmsWriteOutcome(
+    bool WriteAccepted, bool ReadbackVerified, bool NoChange,
+    string Before, string After, string Detail)
+{
+    public bool Succeeded => (WriteAccepted || NoChange) && ReadbackVerified;
+}
+
+/// <summary>
+/// Native association-bound MMS DA editor: typed pre-read, at most one Write,
+/// then independently decoded readback. Uses the SAME ARIEC receive pump and
+/// per-IED gate as monitoring/commands. No ad-hoc BER or second connection.
+/// </summary>
+public sealed partial class NativeIec61850Client
+{
+    public async Task<MmsReadResult> ReadBrowserConfigurationAsync(
+        string reference, string fc, CancellationToken cancellationToken)
+    {
+        ValidateBrowserConfigurationTarget(reference, fc);
+        var target = MmsObjectReference.FromIec61850Reference(reference, fc);
+        return await RunMmsOperationAsync(
+            () => _session.ReadSingleVariableAsync(target, cancellationToken),
+            cancellationToken).ConfigureAwait(false);
+    }
+
+    public async Task<BrowserMmsWriteOutcome> WriteBrowserConfigurationAsync(
+        string reference, string fc, MmsDataValue desired, CancellationToken cancellationToken)
+    {
+        ValidateBrowserConfigurationTarget(reference, fc);
+        // Only a WRITE is forbidden here; read-only inspection is unaffected.
+        var wireTarget = MmsObjectReference.FromIec61850Reference(reference, fc);
+        if (wireTarget.Item.Split((char)36).Skip(2).Any(segment =>
+                segment.Equals("ctlModel", StringComparison.OrdinalIgnoreCase) ||
+                segment is "Oper" or "SBO" or "SBOw" or "Cancel"))
+            throw new InvalidOperationException(
+                "Control service and ctlModel configuration require dedicated native APIs; generic MMS Write forbidden.");
+        ArgumentNullException.ThrowIfNull(desired);
+        if (desired.Kind is MmsDataKind.Array or MmsDataKind.Structure or
+            MmsDataKind.Unknown or MmsDataKind.BitString or MmsDataKind.UtcTime)
+            throw new InvalidOperationException("Only admitted primitive typed configuration DA writes are supported.");
+
+        var target = MmsObjectReference.FromIec61850Reference(reference, fc);
+        return await RunMmsOperationAsync(async () =>
+        {
+            var before = await _session.ReadSingleVariableAsync(target, cancellationToken)
+                .ConfigureAwait(false);
+            if (!before.IsSuccess || before.Value is null)
+                return new BrowserMmsWriteOutcome(false, false, false, "", "",
+                    "Pre-write live MMS Read failed: " + before.Message + ". No Write sent.");
+            var beforeText = MmsDataCodec.ToDisplayString(before.Value);
+            if (before.Value.Kind != desired.Kind)
+                return new BrowserMmsWriteOutcome(false, false, false, beforeText, "",
+                    "Typed live MMS data kind differs from requested encoder. No Write sent.");
+
+            if (MmsDataCodec.Encode(before.Value).AsSpan().SequenceEqual(MmsDataCodec.Encode(desired)))
+                return new BrowserMmsWriteOutcome(false, true, true, beforeText, beforeText,
+                    "Live value already equals requested value. No Write sent.");
+
+            cancellationToken.ThrowIfCancellationRequested();
+            var sent = await _session.WriteSingleVariableAsync(target, desired, cancellationToken)
+                .ConfigureAwait(false);
+            if (!sent.IsSuccess || sent.AccessResults.Count != 1 || !sent.AccessResults[0].IsSuccess)
+                return new BrowserMmsWriteOutcome(false, false, false, beforeText, "",
+                    "MMS Confirmed-Write not accepted: " + sent.Message + ". No automatic retry.");
+
+            var after = await _session.ReadSingleVariableAsync(target, cancellationToken)
+                .ConfigureAwait(false);
+            if (!after.IsSuccess || after.Value is null)
+                return new BrowserMmsWriteOutcome(true, false, false, beforeText, "",
+                    "Write acknowledged, but exact MMS readback failed: " + after.Message);
+            var afterText = MmsDataCodec.ToDisplayString(after.Value);
+            var matches = after.Value.Kind == desired.Kind &&
+                MmsDataCodec.Encode(after.Value).AsSpan().SequenceEqual(MmsDataCodec.Encode(desired));
+            return new BrowserMmsWriteOutcome(true, matches, false, beforeText, afterText,
+                matches ? "Confirmed-Write accepted and typed MMS readback verified." :
+                    "Write accepted but readback mismatch. Do not retry automatically.");
+        }, cancellationToken).ConfigureAwait(false);
+    }
+
+    private void ValidateBrowserConfigurationTarget(string reference, string fc)
+    {
+        if (!IsConnected || _liveModel is null)
+            throw new InvalidOperationException("The current LIVE MMS association/model is unavailable.");
+        if (string.IsNullOrWhiteSpace(reference) || !reference.Contains('/'))
+            throw new ArgumentException("Expected an exact live LD/LN.DO.DA reference.");
+        if (fc is not ("CF" or "DC" or "SP" or "SG" or "SE"))
+            throw new InvalidOperationException("Browser MMS Write refuses control/process/report namespaces.");
+        var target = MmsObjectReference.FromIec61850Reference(reference, fc);
+        if (string.IsNullOrWhiteSpace(target.Domain) || string.IsNullOrWhiteSpace(target.Item))
+            throw new InvalidOperationException("Invalid domain/item identity for MMS Write.");
+    }
+}
diff --git a/Services/NativeIec61850Client.TypedDataWrite.cs b/Services/NativeIec61850Client.TypedDataWrite.cs
new file mode 100644
index 000000000..4ec6fcdfc
--- /dev/null
+++ b/Services/NativeIec61850Client.TypedDataWrite.cs
@@ -0,0 +1,177 @@
+using AR.Iec61850.Mms;
+using ArIED61850Tester.Models;
+
+namespace ArIED61850Tester.Services;
+
+public enum IedBrowserNativeWriteState
+{
+    NotSent,
+    Rejected,
+    Unknown,
+    AcceptedVerified,
+    AcceptedReadbackMismatch,
+    AcceptedReadbackUnavailable
+}
+
+public sealed record IedBrowserNativeWriteResult(
+    IedBrowserNativeWriteState State,
+    string Message,
+    MmsWriteResult? WriteResponse = null,
+    MmsReadResult? Readback = null);
+
+/// <summary>
+/// The ONLY native generic Browser data-write entrypoint. Uses the existing
+/// ARIEC MMS association and its single shared I/O gate. Caller must furnish
+/// an epoch-aware lease, exact GVA signature, and exact prior typed read.
+/// No Write is issued on inspection, preview, stale lease or type failure.
+/// No silent retry, rollback or implicit control operation.
+/// </summary>
+public sealed partial class NativeIec61850Client
+{
+    public Task<IedBrowserNativeWriteResult> WriteVerifiedDataAttributeAsync(
+        MmsObjectReference reference,
+        string expectedGvaSignature,
+        MmsDataValue expectedOldValue,
+        MmsDataValue proposedValue,
+        Func<bool> leaseIsCurrent,
+        bool operatorConfirmed,
+        CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(expectedOldValue);
+        ArgumentNullException.ThrowIfNull(proposedValue);
+        ArgumentNullException.ThrowIfNull(leaseIsCurrent);
+        if (!operatorConfirmed)
+            return Task.FromResult(new IedBrowserNativeWriteResult(
+                IedBrowserNativeWriteState.NotSent,
+                "Operator did not explicitly approve this exact Write."));
+
+        // Keep GVA, compare-before-write, Confirmed-Write and exact readback
+        // within the SAME client's MMS arbitration gate.
+        return RunMmsOperationAsync(async () =>
+        {
+            if (!IsConnected || !leaseIsCurrent() || cancellationToken.IsCancellationRequested)
+                return new IedBrowserNativeWriteResult(
+                    IedBrowserNativeWriteState.NotSent, "Association lease is no longer current.");
+
+            MmsVariableAccessAttributesResult gva;
+            try
+            {
+                gva = await _session.GetVariableAccessAttributesAsync(
+                    reference, cancellationToken).ConfigureAwait(false);
+            }
+            catch (Exception ex) when (ex is OperationCanceledException or IOException or
+                                       InvalidOperationException or ObjectDisposedException)
+            {
+                return new IedBrowserNativeWriteResult(
+                    IedBrowserNativeWriteState.NotSent,
+                    $"Schema inspection failed before dispatch ({ex.GetType().Name}); no Write sent.");
+            }
+
+            var rejection = IedBrowserTypedWriteAdmission.RejectReason(
+                reference, gva, expectedGvaSignature, proposedValue);
+            rejection ??= IedBrowserTypedWriteAdmission.RejectReason(
+                reference, gva, expectedGvaSignature, expectedOldValue);
+            if (rejection is not null)
+                return new IedBrowserNativeWriteResult(
+                    IedBrowserNativeWriteState.NotSent, rejection);
+
+            if (!IsConnected || !leaseIsCurrent() || cancellationToken.IsCancellationRequested)
+                return new IedBrowserNativeWriteResult(
+                    IedBrowserNativeWriteState.NotSent, "Association changed before read.");
+
+            MmsReadResult before;
+            try
+            {
+                before = await _session.ReadSingleVariableAsync(
+                    reference, cancellationToken).ConfigureAwait(false);
+            }
+            catch (Exception ex) when (ex is OperationCanceledException or IOException or
+                                       InvalidOperationException or ObjectDisposedException)
+            {
+                return new IedBrowserNativeWriteResult(
+                    IedBrowserNativeWriteState.NotSent,
+                    $"Pre-write read failed before dispatch ({ex.GetType().Name}); no Write sent.");
+            }
+
+            if (!before.IsSuccess || before.Value is null ||
+                !SameValue(before.Value, expectedOldValue))
+                return new IedBrowserNativeWriteResult(
+                    IedBrowserNativeWriteState.NotSent,
+                    "Exact pre-write read differs or is unavailable. Refresh and review.");
+
+            if (SameValue(expectedOldValue, proposedValue))
+                return new IedBrowserNativeWriteResult(
+                    IedBrowserNativeWriteState.NotSent, "No changed value; no Write sent.");
+
+            if (!IsConnected || !leaseIsCurrent() || cancellationToken.IsCancellationRequested)
+                return new IedBrowserNativeWriteResult(
+                    IedBrowserNativeWriteState.NotSent, "Association changed before dispatch.");
+
+            MmsWriteResult write;
+            try
+            {
+                // After entering this call, cancellation/transport failure may
+                // mean the IED processed the request. NEVER retry automatically.
+                write = await _session.WriteSingleVariableAsync(
+                    reference, proposedValue, cancellationToken).ConfigureAwait(false);
+            }
+            catch (Exception ex) when (ex is OperationCanceledException or
+                                       IOException or InvalidOperationException or
+                                       ObjectDisposedException)
+            {
+                return new IedBrowserNativeWriteResult(
+                    IedBrowserNativeWriteState.Unknown,
+                    $"Write outcome unknown after dispatch ({ex.GetType().Name}); read manually before retry.");
+            }
+
+            // The existing engine returns a failed response with NO per-item
+            // access result for certain transport faults. A possibly delivered
+            // request with no confirmed result is UNKNOWN, never IED Rejected.
+            if (write.AccessResults.Count == 0)
+                return new IedBrowserNativeWriteResult(
+                    IedBrowserNativeWriteState.Unknown,
+                    $"No definitive MMS Write access result; manual readback required. {write.Message}", write);
+
+            if (!write.IsSuccess || write.AccessResults.Count != 1 ||
+                !write.AccessResults[0].IsSuccess)
+                return new IedBrowserNativeWriteResult(
+                    IedBrowserNativeWriteState.Rejected,
+                    $"IED did not confirm one successful Write access: {write.Message}", write);
+
+            if (!IsConnected || !leaseIsCurrent())
+                return new IedBrowserNativeWriteResult(
+                    IedBrowserNativeWriteState.AcceptedReadbackUnavailable,
+                    "Write accepted; association changed before readback.", write);
+
+            try
+            {
+                // A readback failure does NOT erase a confirmed Write.
+                var after = await _session.ReadSingleVariableAsync(
+                    reference, cancellationToken).ConfigureAwait(false);
+                if (!after.IsSuccess || after.Value is null)
+                    return new IedBrowserNativeWriteResult(
+                        IedBrowserNativeWriteState.AcceptedReadbackUnavailable,
+                        "Write accepted; exact readback unavailable.", write, after);
+                return SameValue(after.Value, proposedValue)
+                    ? new IedBrowserNativeWriteResult(
+                        IedBrowserNativeWriteState.AcceptedVerified,
+                        "Write accepted and exact same-FC readback matches.", write, after)
+                    : new IedBrowserNativeWriteResult(
+                        IedBrowserNativeWriteState.AcceptedReadbackMismatch,
+                        "Write accepted; exact same-FC readback differs.", write, after);
+            }
+            catch (Exception ex) when (ex is OperationCanceledException or
+                                       IOException or InvalidOperationException or
+                                       ObjectDisposedException)
+            {
+                return new IedBrowserNativeWriteResult(
+                    IedBrowserNativeWriteState.AcceptedReadbackUnavailable,
+                    $"Write accepted; readback unavailable ({ex.GetType().Name}).", write);
+            }
+        }, cancellationToken);
+    }
+
+    private static bool SameValue(MmsDataValue left, MmsDataValue right)
+        => left.Kind == right.Kind &&
+           MmsDataCodec.Encode(left).AsSpan().SequenceEqual(MmsDataCodec.Encode(right));
+}
diff --git a/Services/NativeIec61850Client.TypedDataWritePreview.cs b/Services/NativeIec61850Client.TypedDataWritePreview.cs
new file mode 100644
index 000000000..3504abea5
--- /dev/null
+++ b/Services/NativeIec61850Client.TypedDataWritePreview.cs
@@ -0,0 +1,67 @@
+using AR.Iec61850.Mms;
+using ArIED61850Tester.Models;
+
+namespace ArIED61850Tester.Services;
+
+/// <summary>
+/// Read-only, per-association inspection for a single exact MMS DA. This
+/// object contains staged evidence, never approval or write authority.
+/// </summary>
+public sealed record IedBrowserNativeWritePreview(
+    bool IsAvailable,
+    string Message,
+    MmsObjectReference Reference,
+    string GvaSignature = "",
+    MmsTypeSpecificationNode? Type = null,
+    MmsDataValue? OldValue = null)
+{
+    public string CurrentText => OldValue is null ? "-" : MmsDataCodec.ToDisplayString(OldValue);
+}
+
+public sealed partial class NativeIec61850Client
+{
+    public Task<IedBrowserNativeWritePreview> PreviewDataAttributeWriteAsync(
+        MmsObjectReference reference,
+        Func<bool> leaseIsCurrent,
+        CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(leaseIsCurrent);
+        return RunMmsOperationAsync(async () =>
+        {
+            IedBrowserNativeWritePreview Deny(string reason) =>
+                new(false, reason, reference);
+            if (!IsConnected || !leaseIsCurrent())
+                return Deny("MMS association changed; preview unavailable.");
+
+            MmsVariableAccessAttributesResult gva;
+            MmsReadResult read;
+            try
+            {
+                gva = await _session.GetVariableAccessAttributesAsync(
+                    reference, cancellationToken).ConfigureAwait(false);
+                if (!gva.IsSuccess || gva.TypeSpecification is null)
+                    return Deny("GVA unavailable: " + gva.Message);
+                if (!IsConnected || !leaseIsCurrent())
+                    return Deny("Association changed during GVA.");
+                read = await _session.ReadSingleVariableAsync(
+                    reference, cancellationToken).ConfigureAwait(false);
+            }
+            catch (Exception ex) when (ex is OperationCanceledException or IOException or
+                                       InvalidOperationException or ObjectDisposedException)
+            {
+                return Deny($"MMS preview failed ({ex.GetType().Name}).");
+            }
+            if (!read.IsSuccess || read.Value is null || !IsConnected || !leaseIsCurrent())
+                return Deny("Current typed value could not be read on this association.");
+
+            var signature = IedBrowserTypedWriteAdmission.Fingerprint(gva.TypeSpecification);
+            var rejection = IedBrowserTypedWriteAdmission.RejectReason(
+                reference, gva, signature, read.Value);
+            return rejection is null
+                ? new IedBrowserNativeWritePreview(
+                    true, "Read-only current value and exact live wire type verified.",
+                    reference, signature, gva.TypeSpecification, read.Value)
+                : Deny(rejection);
+        }, cancellationToken);
+    }
+}
diff --git a/Services/NativeIec61850Client.cs b/Services/NativeIec61850Client.cs
index 34a2cae0c..b74398faf 100644
--- a/Services/NativeIec61850Client.cs
+++ b/Services/NativeIec61850Client.cs
@@ -1234,6 +1234,31 @@ private async Task InvalidateCachedControlSessionAsync(string objectReference)
             await stale.DisposeAsync().ConfigureAwait(false);
     }
 
+    /// <summary>
+    /// One read-only CF ctlModel probe, using the established association and its
+    /// native MMS single-flight. Does not open Oper/SBOw, write or cache authority.
+    /// A status-only control costs one MMS Read instead of a full typed inspection.
+    /// </summary>
+    public async Task<ArControl.Iec61850ControlModelProbe> ProbeControlModelAsync(
+        SignalDefinition signal, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(signal);
+        if (!signal.IsValidControlObject || !_session.IsMmsInitiated)
+            throw new InvalidOperationException("A connected IEC control DataObject root is required.");
+        await _controlCommandGate.WaitAsync(cancellationToken).ConfigureAwait(false);
+        try
+        {
+            return await RunMmsOperationAsync(
+                () => new ArControl.Iec61850ControlService().ProbeControlModelAsync(
+                    _session, signal.ObjectReference, cancellationToken),
+                cancellationToken).ConfigureAwait(false);
+        }
+        finally
+        {
+            _controlCommandGate.Release();
+        }
+    }
+
     public async Task<Iec61850ControlCapabilities> InspectControlAsync(
         SignalDefinition signal,
         CancellationToken cancellationToken)
@@ -1328,6 +1353,7 @@ private async Task<Iec61850ControlCapabilities> InspectControlCoreAsync(
         var semantic = ArControl.Iec61850ControlSemanticResolver.Resolve(
             descriptor, signal.ControlCdc, signal.ControlStatusReference);
         var effectiveCdc = semantic.Cdc;
+        var exactDpcBooleanFeedback = HasExactDpcBooleanFeedback(descriptor, effectiveCdc);
         var status = await RunMmsOperationAsync(
             () => control.ReadStatusAsync(cancellationToken),
             cancellationToken).ConfigureAwait(false);
@@ -1341,7 +1367,9 @@ private async Task<Iec61850ControlCapabilities> InspectControlCoreAsync(
         // TapOpR/TapOpL -> TapChg.valWTr.posVal. The native descriptor remains the source
         // of truth for the command sequence, while the preferred feedback reference makes
         // commissioning feedback more useful for pulse-style controls.
-        if (!string.IsNullOrWhiteSpace(signal.ControlStatusReference) &&
+        if (!(effectiveCdc.Equals("DPC", StringComparison.OrdinalIgnoreCase) &&
+              descriptor.CtlValSpecification.MmsType.Equals("boolean", StringComparison.OrdinalIgnoreCase)) &&
+            !string.IsNullOrWhiteSpace(signal.ControlStatusReference) &&
             !string.Equals(signal.ControlStatusReference, descriptor.StatusReference, StringComparison.OrdinalIgnoreCase))
         {
             var preferred = await ReadValueAsync(
@@ -1371,8 +1399,16 @@ private async Task<Iec61850ControlCapabilities> InspectControlCoreAsync(
         // Atomic visual publication boundary: after ALL awaited descriptor
         // and status reads have finished, install one complete typed proof.
         // A changed CDC cannot reuse the previous association's verified CDC.
-        signal.ClearLiveControlAuthority();
-        if (semantic.IsCommandSafe)
+        // Reinspection of an unchanged, already verified command must not
+        // publish an interim disabled state. Only an actual semantic change
+        // revokes authority. This removes avoidable Command Dock flicker.
+        var fullyVerified = semantic.IsCommandSafe &&
+            descriptor.IsOperationallyReady && exactDpcBooleanFeedback;
+        if (!fullyVerified ||
+            (signal.VerifiedLiveControlCdc.Length > 0 &&
+             !signal.VerifiedLiveControlCdc.Equals(effectiveCdc, StringComparison.OrdinalIgnoreCase)))
+            signal.ClearLiveControlAuthority();
+        if (fullyVerified)
             signal.AcceptVerifiedLiveControlCdc(effectiveCdc);
         else
             signal.ControlCdc = effectiveCdc;
@@ -1383,12 +1419,13 @@ private async Task<Iec61850ControlCapabilities> InspectControlCoreAsync(
         signal.ControlModelText = modelText;
         // Publish operability last; a partial inspection never authorizes
         // a user action. Native Operate still validates its own descriptor.
-        signal.ControlSemanticVerified = semantic.IsCommandSafe && descriptor.IsOperationallyReady;
+        signal.ControlSemanticVerified = fullyVerified;
         signal.ControlInspectionEvidence =
             $"{descriptor.ObjectReference}.ctlModel | {modelText} | " +
             $"typedCdc={descriptor.Cdc}, effectiveCdc={effectiveCdc}, " +
             $"ctlVal={descriptor.CtlValSpecification.Signature}, status={statusReference}, " +
-            $"semanticSafe={semantic.IsCommandSafe} | {semantic.Reason} | {descriptor.DiscoveryEvidence}";
+            $"semanticSafe={semantic.IsCommandSafe}, exactDpcBooleanFeedback={exactDpcBooleanFeedback} | " +
+            $"{semantic.Reason} | {descriptor.DiscoveryEvidence}";
 
         return new Iec61850ControlCapabilities
         {
@@ -1403,19 +1440,39 @@ private async Task<Iec61850ControlCapabilities> InspectControlCoreAsync(
             CurrentValue = currentValue,
             CurrentState = currentState,
             EngineControlServiceAvailable = true,
-            IsOperationallyReady = descriptor.IsOperationallyReady && semantic.IsCommandSafe,
+            IsOperationallyReady = fullyVerified,
             SupportsCommandTermination = descriptor.SupportsCommandTermination,
             SupportsTimeActivatedOperate = descriptor.SupportsTimeActivatedOperate,
             SboTimeoutText = FormatControlTimeout(descriptor.SboTimeout),
             OperTimeoutText = FormatControlTimeout(descriptor.OperTimeout),
             SequenceText = FriendlyControlSequence(descriptor.ControlModel),
             DiscoveryEvidence = descriptor.DiscoveryEvidence,
-            EngineControlServiceStatus = semantic.IsCommandSafe
-                ? "ARIEC61850 Smart Control is ready. CDC, live ctlVal, status and Direct/SBO semantics agree."
-                : semantic.Reason
+            EngineControlServiceStatus = !exactDpcBooleanFeedback
+                ? "DPC Boolean blocked: live stVal is not the exact same-object status reference."
+                : fullyVerified
+                    ? "ARIEC61850 Smart Control is ready. CDC, live ctlVal, status and Direct/SBO semantics agree."
+                    : semantic.Reason
         };
     }
 
+    /// <summary>
+    /// Consumer read-only identity fence for typed DPC Boolean Oper.ctlVal.
+    /// A lookalike status .stVal on another object cannot authorize command.
+    /// Native ARIEC semantics and Operate gating remain independent.
+    /// </summary>
+    internal static bool HasExactDpcBooleanFeedback(
+        ArControl.Iec61850ControlObjectDescriptor descriptor, string cdc)
+    {
+        ArgumentNullException.ThrowIfNull(descriptor);
+        if (!string.Equals(cdc, "DPC", StringComparison.OrdinalIgnoreCase) ||
+            !string.Equals(descriptor.CtlValSpecification.MmsType,
+                "boolean", StringComparison.OrdinalIgnoreCase))
+            return true;
+        return !string.IsNullOrWhiteSpace(descriptor.ObjectReference) &&
+            string.Equals(descriptor.StatusReference,
+                descriptor.ObjectReference + ".stVal", StringComparison.Ordinal);
+    }
+
     public async Task<Iec61850ControlCommandResult> ExecuteControlAsync(
         Iec61850ControlCommandRequest request,
         CancellationToken cancellationToken)
@@ -1456,8 +1513,17 @@ private async Task<Iec61850ControlCommandResult> ExecuteControlCoreAsync(
         var semantic = ArControl.Iec61850ControlSemanticResolver.Resolve(
             descriptor, request.Signal.ControlCdc, request.Signal.ControlStatusReference);
         var effectiveCdc = semantic.Cdc;
-        request.Signal.ControlSemanticVerified = semantic.IsCommandSafe;
+        // Revalidate live typed feedback inside the FINAL native command gate,
+        // not only during Command Dock inspection. This runs before building
+        // a value, performing Select/Operate or reading substitute feedback.
+        var exactDpcBooleanFeedback = HasExactDpcBooleanFeedback(descriptor, effectiveCdc);
+        request.Signal.ControlSemanticVerified =
+            semantic.IsCommandSafe && exactDpcBooleanFeedback;
         var capabilities = BuildControlCapabilities(descriptor, request.Signal, "-", effectiveCdc);
+        if (!exactDpcBooleanFeedback)
+            return ControlFailure("Validation",
+                "DPC Boolean control NOT SENT: live stVal does not belong to this exact control object.",
+                capabilities, request.ValueText);
         if (!semantic.IsCommandSafe)
             return ControlFailure("Validation",
                 "Unsafe or ambiguous IEC 61850 control semantics: " + semantic.Reason,
@@ -3876,38 +3942,32 @@ private static void AddArIecControlTarget(
         var attributes = dataObject.Attributes ?? Array.Empty<LiveIedDataAttributeModel>();
         var hasControlOperation = attributes.Any(attribute =>
         {
-            var fc = attribute.FunctionalConstraint ?? string.Empty;
-            var path = attribute.AttributePath ?? string.Empty;
-            return fc.Equals("CO", StringComparison.OrdinalIgnoreCase) &&
-                   (path.Contains("Oper", StringComparison.OrdinalIgnoreCase) ||
-                    path.Contains("SBO", StringComparison.OrdinalIgnoreCase) ||
-                    path.Contains("Cancel", StringComparison.OrdinalIgnoreCase) ||
-                    path.EndsWith("ctlVal", StringComparison.OrdinalIgnoreCase));
+            if (!string.Equals(attribute.FunctionalConstraint, "CO", StringComparison.OrdinalIgnoreCase))
+                return false;
+            var segments = (attribute.AttributePath ?? string.Empty)
+                .Replace('$', '.').Split('.', StringSplitOptions.RemoveEmptyEntries);
+            return segments.Any(segment => segment.Equals("Oper", StringComparison.OrdinalIgnoreCase) ||
+                                           segment.Equals("SBO", StringComparison.OrdinalIgnoreCase) ||
+                                           segment.Equals("SBOw", StringComparison.OrdinalIgnoreCase) ||
+                                           segment.Equals("Cancel", StringComparison.OrdinalIgnoreCase));
         });
 
         var controlModelAttribute = attributes.FirstOrDefault(attribute =>
         {
             var path = attribute.AttributePath ?? string.Empty;
             var reference = attribute.ObjectReference ?? string.Empty;
-            return path.EndsWith("ctlModel", StringComparison.OrdinalIgnoreCase) ||
-                   reference.EndsWith(".ctlModel", StringComparison.OrdinalIgnoreCase);
+            return string.Equals(attribute.FunctionalConstraint, "CF", StringComparison.OrdinalIgnoreCase) &&
+                   (path.EndsWith("ctlModel", StringComparison.OrdinalIgnoreCase) ||
+                    reference.EndsWith(".ctlModel", StringComparison.OrdinalIgnoreCase));
         });
 
-        var hasControlStateEvidence = attributes.Any(attribute =>
-        {
-            var path = attribute.AttributePath ?? string.Empty;
-            var reference = attribute.ObjectReference ?? string.Empty;
-            return path.Contains("stSeld", StringComparison.OrdinalIgnoreCase) ||
-                   path.Contains("ctlNum", StringComparison.OrdinalIgnoreCase) ||
-                   reference.Contains(".stSeld", StringComparison.OrdinalIgnoreCase) ||
-                   reference.Contains(".ctlNum", StringComparison.OrdinalIgnoreCase);
-        });
+        // ST values and inferred CDC do not authorize command candidates.
 
         var cdc = (dataObject.InferredCdc ?? string.Empty).Trim().ToUpperInvariant();
         if (string.IsNullOrWhiteSpace(cdc))
             cdc = InferControlCdc(logicalNode, dataObject, attributes, hasControlOperation);
 
-        if (!hasControlOperation && !hasControlStateEvidence && controlModelAttribute == null && !ControllableCdcs.Contains(cdc))
+        if (!hasControlOperation && controlModelAttribute == null)
             return;
 
         var reference = (dataObject.Reference ?? string.Empty).Trim().Replace('$', '.');
@@ -3946,6 +4006,7 @@ private static void AddArIecControlTarget(
             Confidence = hasControlOperation ? "High" : "Medium",
             IsSelected = false,
             IsControlSignal = true,
+            HasControlServiceEvidence = true,
             ControlCdc = cdc,
             ControlModelReference = controlModelReference.Replace('$', '.'),
             ControlStatusReference = BuildControlStatusReference(reference, cdc),
diff --git a/Services/NativeMmsDiscoveryMapper.cs b/Services/NativeMmsDiscoveryMapper.cs
index 74795104c..d1d30faca 100644
--- a/Services/NativeMmsDiscoveryMapper.cs
+++ b/Services/NativeMmsDiscoveryMapper.cs
@@ -286,15 +286,7 @@ private static void AddCandidates(List<SignalDefinition> signals, string domain,
             return;
         }
 
-        // stSeld and ctlNum are status-side evidence that the parent data object is
-        // controllable even when a vendor omits CO members from the first NameList page.
-        if (fc.Equals("ST", StringComparison.OrdinalIgnoreCase) &&
-            pathParts.Skip(1).Any(part =>
-                part.Equals("stSeld", StringComparison.OrdinalIgnoreCase) ||
-                part.Equals("ctlNum", StringComparison.OrdinalIgnoreCase)))
-        {
-            AddControlCandidate(signals, resolvedDomain, logicalNode, pathParts, now, "Native MMS control-state evidence");
-        }
+        // ST feedback, stSeld and ctlNum are never command-service proof.
 
         foreach (var path in ExpandLikelyLeafPaths(logicalNode, fc, pathParts))
         {
@@ -340,7 +332,9 @@ private static void AddControlCandidate(
                                   signal.ObjectReference.Equals(reference, StringComparison.OrdinalIgnoreCase)))
             return;
 
-        var controlCdc = InferControlCdc(dataObject);
+        // NameList proves the CO/CF candidate, not a vendor-independent CDC.
+        // The live typed resolver must supply actual command semantics.
+        var controlCdc = string.Empty;
         signals.Add(new SignalDefinition
         {
             Name = $"{logicalNode} {dataObject} Control",
@@ -351,6 +345,7 @@ private static void AddControlCandidate(
             Confidence = "Medium",
             IsSelected = false,
             IsControlSignal = true,
+            HasControlServiceEvidence = true,
             ControlCdc = controlCdc,
             ControlModelReference = $"{reference}.ctlModel",
             ControlStatusReference = BuildControlStatusReference(reference, controlCdc),
diff --git a/Services/SmvLiveCaptureService.cs b/Services/SmvLiveCaptureService.cs
index 4aaa0b19f..910f7dbe1 100644
--- a/Services/SmvLiveCaptureService.cs
+++ b/Services/SmvLiveCaptureService.cs
@@ -236,12 +236,15 @@ public void Receive(SampledValuesFrame frame, SampledValueAsdu asdu,
         }
 
         if (_wordIndexes.Length == 0 || _payloadLength != payload.Length ||
-            _confRev != asdu.ConfigurationRevision || _smpSynch != asdu.SampleSynchronization ||
+            _confRev != asdu.ConfigurationRevision ||
             !DataSetReference.Equals(asdu.DataSetReference, StringComparison.Ordinal))
         {
             if (_wordIndexes.Length > 0) _restarts++;
             Configure(asdu, payload.Length);
         }
+        // smpSynch is ASDU synchronization evidence, not a stream schema change.
+        // Preserve coherent buffer and inferred timebase across 0 -> 2 transitions.
+        _smpSynch = asdu.SampleSynchronization;
 
         if (_timebase?.IsResolved != true || _length == 0)
         {
diff --git a/Services/StaticDataSetRcbImageTriage.cs b/Services/StaticDataSetRcbImageTriage.cs
new file mode 100644
index 000000000..d495ccfb8
--- /dev/null
+++ b/Services/StaticDataSetRcbImageTriage.cs
@@ -0,0 +1,54 @@
+using ArIED61850Tester.Models;
+
+namespace ArIED61850Tester.Services;
+
+/// <summary>
+/// Immutable, observational per-RCB initial-image triage. Never combines
+/// another RCB's actual ingress with this DataSet, issues a GI, enables
+/// RptEna, polls process values, or fabricates missing members.
+/// </summary>
+internal static class StaticDataSetRcbImageTriage
+{
+    internal sealed record Row(
+        string DataSet, string Rcb, int Selected, int Visible, int Pending,
+        int QualityNotSupplied, long Frames, bool? RptEnaWriteAccepted,
+        bool? GiWriteAccepted, long Overflow)
+    {
+        internal bool HasActualReportFrames => Frames > 0;
+        internal string Summary =>
+            $"{DataSet} / {Rcb}: initial image {Visible}/{Selected}, pending={Pending}, " +
+            $"q-unverified={QualityNotSupplied}, actualFrames={Frames}, " +
+            $"RptEnaWrite={Proof(RptEnaWriteAccepted)}, " +
+            $"GiWrite={Proof(GiWriteAccepted)}, overflowObserved={Overflow}";
+        private static string Proof(bool? value) => value switch
+        {
+            true => "accepted",
+            false => "rejected",
+            _ => "unverified"
+        };
+    }
+
+    internal static IReadOnlyList<Row> Evaluate(
+        IEnumerable<Iec61850MonitorPoint> points,
+        Iec61850ReportContinuitySnapshot? continuity,
+        int maxGroups = 16)
+    {
+        ArgumentNullException.ThrowIfNull(points);
+        if (maxGroups is < 1 or > 64)
+            throw new ArgumentOutOfRangeException(nameof(maxGroups));
+
+        // A static member's current displayed value and actual RCB receive
+        // frame are independent evidence. Do not infer the latter from former.
+        var image = StaticDataSetInitialImageDiagnostic.Evaluate(points);
+        return image.Groups.Take(maxGroups).Select(group =>
+        {
+            var stream = IedBrowserRcbReportEvidence.Select(
+                continuity, group.RcbReference, group.DataSetReference, "");
+            return new Row(
+                group.DataSetReference, group.RcbReference, group.Selected,
+                group.ValueVisible, group.ValuePending, group.QualityNotSupplied,
+                stream?.Frames ?? 0L, stream?.RptEnaWriteAccepted,
+                stream?.GiWriteAccepted, stream?.Overflow ?? 0L);
+        }).ToArray();
+    }
+}
diff --git a/Services/StaticDataSetReportProjectionAccumulator.cs b/Services/StaticDataSetReportProjectionAccumulator.cs
index ac4e82d50..3e4db84b6 100644
--- a/Services/StaticDataSetReportProjectionAccumulator.cs
+++ b/Services/StaticDataSetReportProjectionAccumulator.cs
@@ -43,6 +43,48 @@ private sealed record CompanionMetadata(
     private readonly Dictionary<string, CompanionMetadata> _metadataByReference =
         new(StringComparer.OrdinalIgnoreCase);
 
+    // Membership is immutable for one monitor selection. Prepare once, then
+    // resolve descendants via their ancestor path rather than walking every
+    // selected IED point and rebuilding a query per InformationReport leaf.
+    // This is an index of identities, NEVER another value store.
+    private IReadOnlyCollection<Iec61850MonitorPoint>? _preparedPoints;
+    private LiveIedModelDiscoveryDocument? _preparedModel;
+    private HashSet<string>? _exactSelected;
+    private Dictionary<string, Iec61850MonitorPoint[]>? _aggregateByReference;
+    private readonly Dictionary<string, SchemaSafeAggregateProjectionService.ReadPlan>
+        _plannedAggregates = new(StringComparer.OrdinalIgnoreCase);
+    private readonly HashSet<string> _unsupportedAggregates =
+        new(StringComparer.OrdinalIgnoreCase);
+
+    public void Prepare(LiveIedModelDiscoveryDocument? model,
+        IReadOnlyCollection<Iec61850MonitorPoint> monitoredPoints)
+    {
+        ArgumentNullException.ThrowIfNull(monitoredPoints);
+        ClearPrepared();
+        _preparedModel = model;
+        _preparedPoints = monitoredPoints;
+        _exactSelected = new HashSet<string>(monitoredPoints.Select(point =>
+            NormalizeReference(point.IecReference)), StringComparer.Ordinal);
+        _aggregateByReference = monitoredPoints
+            .Where(point => IsAggregate(point.IecReference))
+            .GroupBy(point => NormalizeReference(point.IecReference), StringComparer.Ordinal)
+            // Retain up to two claims: ambiguous identities MUST stay
+            // ambiguous. Dropping duplicates would mistakenly pass the
+            // incoming leaf as if it had no known aggregate parent.
+            .ToDictionary(group => group.Key,
+                group => group.Take(2).ToArray(), StringComparer.Ordinal);
+    }
+
+    public void ClearPrepared()
+    {
+        _preparedPoints = null;
+        _preparedModel = null;
+        _exactSelected = null;
+        _aggregateByReference = null;
+        _plannedAggregates.Clear();
+        _unsupportedAggregates.Clear();
+    }
+
     public void Reset()
     {
         _leavesByParent.Clear();
@@ -74,13 +116,28 @@ public IReadOnlyList<NativeReportValueUpdate> Project(
         if (!effectiveUpdate.HasValue)
             return new[] { effectiveUpdate };
 
-        var exactSelected = monitoredPoints.Any(point =>
-            ReferencesEqual(point.IecReference, effectiveUpdate.Reference));
-
-        var aggregateParents = monitoredPoints
-            .Where(point => IsAggregate(point.IecReference))
-            .Where(point => IsDescendant(updateReference, NormalizeReference(point.IecReference)))
-            .ToArray();
+        var usePrepared = ReferenceEquals(monitoredPoints, _preparedPoints) &&
+            ReferenceEquals(authorityModel, _preparedModel) &&
+            _exactSelected is not null && _aggregateByReference is not null;
+        var exactSelected = usePrepared
+            ? _exactSelected!.Contains(updateReference)
+            : monitoredPoints.Any(point =>
+                ReferencesEqual(point.IecReference, effectiveUpdate.Reference));
+
+        // Bounded reference-depth guard: an abnormal wire path must not
+        // escape parent validation by overflowing the fast ancestor search.
+        if (usePrepared && (updateReference.Length > 1024 ||
+                            updateReference.Count(ch => ch == '.') > 32))
+            return exactSelected
+                ? new[] { effectiveUpdate }
+                : Array.Empty<NativeReportValueUpdate>();
+
+        var aggregateParents = usePrepared
+            ? FindPreparedAggregateParents(updateReference)
+            : monitoredPoints
+                .Where(point => IsAggregate(point.IecReference))
+                .Where(point => IsDescendant(updateReference, NormalizeReference(point.IecReference)))
+                .ToArray();
 
         // A semantic child may not be assigned to an aggregate unless its parent is unique.
         // In an ambiguous model, preserve only an independently selected exact child.
@@ -88,13 +145,22 @@ public IReadOnlyList<NativeReportValueUpdate> Project(
             return exactSelected ? new[] { effectiveUpdate } : aggregateParents.Length == 0 ? new[] { effectiveUpdate } : Array.Empty<NativeReportValueUpdate>();
 
         var parent = aggregateParents[0];
-        if (!SchemaSafeAggregateProjectionService.TryBuildReadPlan(
-                authorityModel,
-                parent.IecReference,
-                out var plan,
-                out _))
-        {
+        var parentKey = NormalizeReference(parent.IecReference);
+        if (usePrepared && _unsupportedAggregates.Contains(parentKey))
             return exactSelected ? new[] { effectiveUpdate } : Array.Empty<NativeReportValueUpdate>();
+
+        if (!usePrepared || !_plannedAggregates.TryGetValue(parentKey, out var plan))
+        {
+            if (!SchemaSafeAggregateProjectionService.TryBuildReadPlan(
+                    authorityModel, parent.IecReference, out plan, out _))
+            {
+                if (usePrepared)
+                    _unsupportedAggregates.Add(parentKey);
+                return exactSelected ? new[] { effectiveUpdate } : Array.Empty<NativeReportValueUpdate>();
+            }
+
+            if (usePrepared)
+                _plannedAggregates[parentKey] = plan;
         }
 
         var expectedLeaf = plan.Leaves.FirstOrDefault(leaf =>
@@ -106,7 +172,6 @@ public IReadOnlyList<NativeReportValueUpdate> Project(
             return exactSelected ? new[] { effectiveUpdate } : Array.Empty<NativeReportValueUpdate>();
         }
 
-        var parentKey = NormalizeReference(parent.IecReference);
         if (!_leavesByParent.TryGetValue(parentKey, out var leaves))
         {
             leaves = new Dictionary<string, LeafState>(StringComparer.OrdinalIgnoreCase);
@@ -132,6 +197,32 @@ public IReadOnlyList<NativeReportValueUpdate> Project(
             : new[] { projected };
     }
 
+    private Iec61850MonitorPoint[] FindPreparedAggregateParents(string descendant)
+    {
+        // IEC semantic member paths have bounded dot-separated depth in
+        // practice. Explicit cap also protects against malicious/unexpected
+        // MMS references while never guessing an ancestor on overflow.
+        if (_aggregateByReference is null || descendant.Length > 1024)
+            return [];
+        Iec61850MonitorPoint? first = null;
+        var depth = 0;
+        for (var dot = descendant.LastIndexOf('.'); dot > 0;
+             dot = descendant.LastIndexOf('.', dot - 1))
+        {
+            if (++depth > 32)
+                return [];
+            if (!_aggregateByReference.TryGetValue(descendant[..dot], out var candidates))
+                continue;
+            if (candidates.Length > 1)
+                return candidates; // duplicate selected parent: fail closed
+            var parent = candidates[0];
+            if (first is not null)
+                return [first, parent]; // overlapping selected parents: fail closed
+            first = parent;
+        }
+        return first is null ? [] : [first];
+    }
+
     private void RememberCompanionMetadata(string updateReference, NativeReportValueUpdate update)
     {
         if ((!update.HasQuality || !IsUsefulMetadata(update.Quality)) &&
diff --git a/Services/UiResponsiveIec61850MonitorRuntimeFacade.cs b/Services/UiResponsiveIec61850MonitorRuntimeFacade.cs
index 3169e8969..525477f2f 100644
--- a/Services/UiResponsiveIec61850MonitorRuntimeFacade.cs
+++ b/Services/UiResponsiveIec61850MonitorRuntimeFacade.cs
@@ -80,6 +80,48 @@ public IReadOnlySet<string> GetActiveBrowserRcbReferences(string deviceId)
     public int ConnectedDeviceCount => _inner.ConnectedDeviceCount;
     public int MonitoringDeviceCount => _inner.MonitoringDeviceCount;
 
+    // Explicit operator Browser configuration lane; the facade owns the same
+    // bounded per-device flight and never runs the native sync prefix on WPF.
+    // Inner runtime validates LIVE model, association, typed FC and quarantine.
+    public Task<AR.Iec61850.Mms.MmsReadResult> ReadBrowserConfigurationAsync(
+        string deviceId, AR.Iec61850.Discovery.LiveIedModelDiscoveryDocument model,
+        long association, IedBrowserWriteRow target, CancellationToken cancellationToken)
+        => RunDeviceOperationAsync(deviceId, cancellationToken,
+            token => _inner.ReadBrowserConfigurationAsync(
+                deviceId, model, association, target, token));
+
+    public Task<BrowserMmsWriteOutcome> WriteBrowserConfigurationAsync(
+        string deviceId, AR.Iec61850.Discovery.LiveIedModelDiscoveryDocument model,
+        long association, IedBrowserWriteRow target,
+        AR.Iec61850.Mms.MmsDataValue desired, CancellationToken cancellationToken)
+        => RunDeviceOperationAsync(deviceId, cancellationToken,
+            token => _inner.WriteBrowserConfigurationAsync(
+                deviceId, model, association, target, desired, token));
+
+    public Task<IedBrowserNativeWritePreview> PreviewBrowserDataAttributeWriteAsync(
+        Iec61850MonitorDevice device,
+        AR.Iec61850.Mms.MmsObjectReference reference,
+        CancellationToken cancellationToken)
+        => RunDeviceOperationAsync(
+            device.DeviceId, cancellationToken,
+            token => _inner.PreviewBrowserDataAttributeWriteAsync(device, reference, token),
+            rejectIfBusy: true);
+
+    /// <summary>
+    /// Strict non-queued operator Write lane, sharing the existing IED
+    /// lifecycle gate with Read and IEC Control. No independent MMS socket.
+    /// </summary>
+    public Task<IedBrowserTypedWriteBatchResult> WriteBrowserDataAttributesAsync(
+        Iec61850MonitorDevice device,
+        IReadOnlyList<IedBrowserTypedWriteStep> confirmedPlan,
+        bool explicitOperatorConfirmation,
+        CancellationToken cancellationToken)
+        => RunDeviceOperationAsync(
+            device.DeviceId, cancellationToken,
+            token => _inner.WriteBrowserDataAttributesAsync(
+                device, confirmedPlan, explicitOperatorConfirmation, token),
+            rejectIfBusy: true);
+
     public Task<int> ReadBrowserValuesAsync(
         Iec61850MonitorDevice device,
         IReadOnlyList<IedBrowserReadTarget> targets,
@@ -135,6 +177,13 @@ public Task<IReadOnlyList<Iec61850MonitorPoint>> StartMonitoringAsync(
             cancellationToken,
             token => _inner.StartMonitoringAsync(device, selectedSignals, pollingIntervalMs, token));
 
+    public Task<AR.Iec61850.Control.Iec61850ControlModelProbe> ProbeControlModelAsync(
+        string deviceId, SignalDefinition signal, CancellationToken cancellationToken)
+        => RunDeviceOperationAsync(
+            deviceId,
+            cancellationToken,
+            token => _inner.ProbeControlModelAsync(deviceId, signal, token));
+
     public Task<Iec61850ControlCapabilities> InspectControlAsync(
         string deviceId,
         SignalDefinition signal,
diff --git a/Services/UserPreferenceStore.cs b/Services/UserPreferenceStore.cs
index e874da83f..e7e5ed885 100644
--- a/Services/UserPreferenceStore.cs
+++ b/Services/UserPreferenceStore.cs
@@ -68,27 +68,86 @@ internal static void RecordLastDiscoveryEndpoint(string path, string ipAddress,
         File.WriteAllText(path, JsonSerializer.Serialize(prefs, Options));
     }
 
+    public sealed record RecentEndpointDetail(
+        string IpAddress, int MmsPort, string IedName, bool ConfirmedSuccessful,
+        bool WasLastSubmitted = false)
+    {
+        public string Subtitle => (WasLastSubmitted
+            ? (ConfirmedSuccessful ? "Last entered · Connected before" : "Last entered · Not yet connected")
+            : ConfirmedSuccessful
+                ? (string.IsNullOrWhiteSpace(IedName) ? "Connected before" : $"Connected before · {IedName}")
+                : "Previously saved") + (MmsPort == 102 ? string.Empty : $" · Port {MmsPort}");
+    }
+
+    // A read-only projection of the EXISTING user preference document.
+    // An endpoint is IP + MMS port, never just the IP address. This prevents
+    // a successful association on port A from authorizing a typed port B.
+    public static IReadOnlyList<RecentEndpointDetail> LoadRecentEndpointDetails(int maximum = 20)
+        => DescribeRecentEndpoints(LoadPreferences(), maximum);
+
+    internal static IReadOnlyList<RecentEndpointDetail> LoadRecentEndpointDetails(
+        string preferencesPath, int maximum = 20)
+        => DescribeRecentEndpoints(ReadPreferencesFile(preferencesPath) ?? new UserPreferences(), maximum);
+
+    private static IReadOnlyList<RecentEndpointDetail> DescribeRecentEndpoints(
+        UserPreferences preferences, int maximum)
+    {
+        var successes = preferences.SuccessfulRelays
+            .Where(e => !string.IsNullOrWhiteSpace(e.IpAddress) &&
+                        IPAddress.TryParse(e.IpAddress.Trim(), out _) &&
+                        e.MmsPort is > 0 and <= 65535)
+            .OrderByDescending(e => e.LastConnectedUtc)
+            .ToArray();
+        var records = new List<RecentEndpointDetail>();
+
+        if (IPAddress.TryParse(preferences.LastDiscoveryIpAddress?.Trim(), out _) &&
+            preferences.LastDiscoveryMmsPort is > 0 and <= 65535)
+        {
+            var ip = preferences.LastDiscoveryIpAddress.Trim();
+            var port = preferences.LastDiscoveryMmsPort;
+            var matched = successes.FirstOrDefault(e =>
+                string.Equals(e.IpAddress.Trim(), ip, StringComparison.OrdinalIgnoreCase) &&
+                e.MmsPort == port);
+            records.Add(new RecentEndpointDetail(ip, port,
+                matched?.IedName ?? string.Empty, matched is not null, WasLastSubmitted: true));
+        }
+
+        records.AddRange(successes.Select(e =>
+            new RecentEndpointDetail(e.IpAddress.Trim(), e.MmsPort,
+                e.IedName ?? string.Empty, true)));
+
+        foreach (var ip in GetRecentIpCandidates(preferences, 100))
+        {
+            if (!records.Any(e => e.IpAddress.Equals(ip, StringComparison.OrdinalIgnoreCase)))
+                records.Add(new RecentEndpointDetail(ip, 102, string.Empty, false));
+        }
+
+        return records
+            .DistinctBy(e => (e.IpAddress.Trim().ToUpperInvariant(), e.MmsPort))
+            .Take(Math.Clamp(maximum, 1, 100))
+            .ToArray();
+    }
+
     public static IReadOnlyList<string> LoadRecentEndpoints(int maximum = 20)
+        => GetRecentIpCandidates(LoadPreferences(), maximum);
+
+    private static IReadOnlyList<string> GetRecentIpCandidates(UserPreferences prefs, int maximum)
     {
         maximum = Math.Clamp(maximum, 1, 100);
-        var prefs = LoadPreferences();
         return new[] { prefs.LastDiscoveryIpAddress }
-            .Where(ip => !string.IsNullOrWhiteSpace(ip) && IPAddress.TryParse(ip.Trim(), out _))
-            .Select(ip => ip.Trim())
             .Concat(prefs.SuccessfulRelays
-            .Where(item => !string.IsNullOrWhiteSpace(item.IpAddress))
-            .OrderByDescending(item => item.LastConnectedUtc)
-            .Select(item => item.IpAddress.Trim()))
+                .OrderByDescending(item => item.LastConnectedUtc)
+                .Select(item => item.IpAddress))
             .Concat(prefs.SignalSelectionProfiles
-                .Where(item => !string.IsNullOrWhiteSpace(item.IpAddress))
                 .OrderByDescending(item => item.LastSavedUtc)
-                .Select(item => item.IpAddress.Trim()))
-            .Concat(prefs.RecentRelayIps
-                .Where(item => !string.IsNullOrWhiteSpace(item))
-                .Select(item => item.Trim()))
+                .Select(item => item.IpAddress))
+            .Concat(prefs.RecentRelayIps)
+            .Where(ip => !string.IsNullOrWhiteSpace(ip) &&
+                         IPAddress.TryParse(ip.Trim(), out _))
+            .Select(ip => ip.Trim())
             .Distinct(StringComparer.OrdinalIgnoreCase)
             .Take(maximum)
-            .ToList();
+            .ToArray();
     }
 
     public static void RecordSuccessfulEndpoint(string ipAddress, int port, string iedName)
diff --git a/SignalSelectionWizardWindow.xaml b/SignalSelectionWizardWindow.xaml
index 3d555158a..6ebb66b46 100644
--- a/SignalSelectionWizardWindow.xaml
+++ b/SignalSelectionWizardWindow.xaml
@@ -333,6 +333,9 @@
                                   Style="{StaticResource QuickFilterChip}" Click="QuickFilter_Click"/>
                     <ToggleButton x:Name="QuickControlButton" Content="Control" Tag="Control"
                                   Style="{StaticResource QuickFilterChip}" Click="QuickFilter_Click"/>
+                    <ToggleButton x:Name="QuickCswiButton" Content="CSWI" Tag="CSWI"
+                                  ToolTip="Show discovered CSWI control objects from this IED. Selection does not authorize a command; ctlModel/CDC must still be verified live."
+                                  Style="{StaticResource QuickFilterChip}" Click="QuickFilter_Click"/>
                     <ToggleButton x:Name="QuickSelectedButton" Content="Selected" Tag="Selected"
                                   Style="{StaticResource QuickFilterChip}" Click="QuickFilter_Click"/>
                 </StackPanel>
diff --git a/SignalSelectionWizardWindow.xaml.cs b/SignalSelectionWizardWindow.xaml.cs
index b82f64ba5..328710458 100644
--- a/SignalSelectionWizardWindow.xaml.cs
+++ b/SignalSelectionWizardWindow.xaml.cs
@@ -91,6 +91,13 @@ public SignalSelectionWizardWindow(Iec61850MonitorDevice device, int restoredSel
         };
 
         InitializeComponent();
+        var candidateCount = device.Signals.Count(s => s.IsValidControlObject);
+        var cswiCount = device.Signals.Count(s => s.IsValidControlObject && IsCswiControl(s));
+        QuickControlButton.Content = $"Control ({candidateCount:N0})";
+        QuickCswiButton.Content = $"CSWI ({cswiCount:N0})";
+        QuickCswiButton.ToolTip = cswiCount == 0
+            ? "No CSWI control object was discovered in this IED model. XCBR/XSWI status is not proof of a CSWI command object. Check CO/CF MMS discovery or SCL."
+            : $"{cswiCount:N0} CSWI control candidate(s) discovered. Select the exact CSWI.Pos required; physical control remains disabled until a live ctlModel and CDC check passes.";
         DataContext = this;
         Loaded += (_, _) =>
         {
@@ -152,11 +159,25 @@ private static string GetFilterField(SignalDefinition signal, string key)
             _ => string.Empty
         };
 
+    private static bool IsCswiControl(SignalDefinition signal)
+    {
+        if (!signal.IsValidControlObject) return false;
+        var reference = signal.ObjectReference ?? string.Empty;
+        var slash = reference.IndexOf('/');
+        if (slash < 0) return false;
+        var dot = reference.IndexOf('.', slash + 1);
+        if (dot < 0) return false;
+        var ln = reference[(slash + 1)..dot];
+        return System.Text.RegularExpressions.Regex.IsMatch(ln,
+            @"(?:^|_)CSWI[0-9]+$", RegexOptions.IgnoreCase);
+    }
+
     private bool MatchesQuickFilter(SignalDefinition signal)
         => _quickFilter switch
         {
             "Live" => !signal.IsControlSignal,
             "Control" => signal.IsValidControlObject,
+            "CSWI" => IsCswiControl(signal),
             "Selected" => signal.IsSelected,
             _ => true
         };
@@ -204,7 +225,7 @@ private void QuickFilter_Click(object sender, RoutedEventArgs e)
 
         _quickFilter = key;
         selected.IsChecked = true;
-        foreach (var button in new[] { QuickAllButton, QuickLiveButton, QuickControlButton, QuickSelectedButton })
+        foreach (var button in new[] { QuickAllButton, QuickLiveButton, QuickControlButton, QuickCswiButton, QuickSelectedButton })
         {
             if (!ReferenceEquals(button, selected))
                 button.IsChecked = false;
@@ -240,6 +261,7 @@ private void ClearFilters_Click(object sender, RoutedEventArgs e)
         QuickAllButton.IsChecked = true;
         QuickLiveButton.IsChecked = false;
         QuickControlButton.IsChecked = false;
+        QuickCswiButton.IsChecked = false;
         QuickSelectedButton.IsChecked = false;
         _columnFilters.Clear();
         foreach (var weak in _filterTextBoxes.Values)
diff --git a/docs/GE_ED2_PREFIXED_LN_DPC_FAT_TRIAL.md b/docs/GE_ED2_PREFIXED_LN_DPC_FAT_TRIAL.md
new file mode 100644
index 000000000..3382b1ca6
--- /dev/null
+++ b/docs/GE_ED2_PREFIXED_LN_DPC_FAT_TRIAL.md
@@ -0,0 +1,21 @@
+# IEC 61850 Edition 2 prefixed-LN DPC trial — SG7 BCU
+
+Source: SG7_BCU.iid plus ARSAS field diagnostics captured 2026-10-22. Never use this engineering note as physical permission to operate.
+
+## Root cause
+
+IEC LN names have prefix + lnClass + inst. The qualified engine (#184) classified Boolean Oper.ctlVal as SPC for `Bkr0XCBR2.Pos`, `Disc0XSWI1.Pos` and `BkrCSWI1.Pos`. Its semantic resolver recognized DPC Boolean ctlVal only where LN name began with CSWI/XCBR/XSWI; the configured prefixes were omitted from its parser. The SCL IID declares DPC Pos.stVal as Dbpos, ctlModel=sbo-with-enhanced-security, sboTimeout=30000 ms. ARSAS correctly refused conflicting DPC/SPC semantic authority, leaving 0/13 selected controls enabled.
+
+## Correction (vendor-neutral)
+
+Engine ARIEC61850 PR #189 now verifies Boolean DPC using the exact **live two-bit ST `.stVal` read**, matching the same DataObject as the Boolean Oper `ctlVal`; declared SCL CDC is advisory, and LN name/prefix is no longer the authority. The older prefix-aware CSWI/XCBR/XSWI recognizer remains only an optional probe optimization. This works for arbitrarily renamed IEC Edition 2 LN/control DOs while failing closed when the typed status is absent or wrong. The live descriptor still requires an operational control model, actual Oper and SBOw type proof, Cancel, and CommandTermination support. No blanket Boolean-to-DPC promotion, no automatic Select/Operate and no change to SBOw 400ms delayed LastApplError grace.
+
+## Isolated fast validation
+
+Production lock stays at engine #184 `9c7cb40364023a7b217e5ec31ab3105ba90142eb`. Use the existing CI-P1 reusable Windows build/test via manual FAST DEV, focus `command-read`, experimental engine SHA `5744f302fb3ee949bb57eb84800c9ff68fbbd040`. This compiles ARSAS against experimental engine and runs focused, read-only tests. The source manifest records the trial SHA and explicitly excludes this job from any FAT/release qualification. Engine PR #189 separately tests positive and negative semantic admission, including incorrect feedback and missing enhanced-control descriptor components.
+
+## Existing evidence versus remaining acceptance
+
+The SG7_BCU diagnostic already confirms ACSE/MMS association, six logical devices, 156 static DataSet members, 4/4 routed static RCBs, and 77/77 displayed values. It independently reports one BRCB BufOvfl=true and multiple invalid quality bits; preserve and highlight them rather than rewriting as Good. The field file does NOT prove an actual successful Select/SBOw, Operate, CommandTermination or breaker feedback caused by ARSAS. Operator-approved isolated FAT must record stage-specific command requests/responses, LastApplError, physical interlocks, final Pos.stVal, q, and timestamp before qualifying real control.
+
+The official application/engine lock must not be changed solely because this trial's synthetic tests pass. A separate reviewed promotion with full regression and physical evidence is required.
diff --git a/docs/WINDOWS_RELEASES.md b/docs/WINDOWS_RELEASES.md
index 4019a607c..998544ceb 100644
--- a/docs/WINDOWS_RELEASES.md
+++ b/docs/WINDOWS_RELEASES.md
@@ -5,7 +5,7 @@ ARSAS publishes two Windows x64 deliverables from the same reviewed source revis
 - `ARSAS-Windows-x64-Portable.exe` — a real self-contained single EXE for approved no-install use.
 - `ARSAS-Windows-x64-Setup.exe` — the Inno Setup installer with Start Menu integration, uninstall support, and the same pinned ARIEC61850 and ArdIrec native-analysis revisions used by the release build.
 
-The current stable application version is **1.6.40**. Public download metadata remains authoritative only after the corresponding tagged GitHub Release has been published and its checksums/provenance are visible. See the [v1.6.40 installed-release field acceptance](V1-6-40_INSTALLED_RELEASE_FIELD_ACCEPTANCE.md) for the exact physical Smart Discovery/static-reporting evidence, and the [v1.6.39 rejection record](../evidence/v1.6.39-physical-rejection.json) for the superseded release regression.
+The current public stable version is **[1.6.41](https://github.com/masarray/arsas/releases/tag/v1.6.41)** (source `e581a26dea5545034378adbeed5b78fc80aab773`, pinned ARIEC61850 `036e2c00d83a0815b6160147b14ea05975057965`). Public installer/portable, SHA-256, SBOM and provenance refer to that exact tag. The [v1.6.40 physical acceptance](V1-6-40_INSTALLED_RELEASE_FIELD_ACCEPTANCE.md) applies only to its historical app/engine pair and does not automatically qualify this new pin. See the [v1.6.39 rejection](../evidence/v1.6.39-physical-rejection.json) for older release regressions.
 
 ## Official stable release path
 
@@ -50,6 +50,26 @@ The active release automation has intentionally separate responsibilities. Maint
 
 The packaging scripts under `scripts/` remain active implementation details of these workflows. Do not remove a script merely because it is not called from application code; verify its workflow consumer first.
 
+## One-click development EXE from GitHub Actions
+
+For **PR/FAT builds**, the successful `Build ARSAS` workflow publishes
+`ARSAS-<version>-win-x64-portable.exe` using
+`actions/upload-artifact@v7` with `archive: false`. Its link in the
+workflow run's **Artifacts** section downloads the actual portable
+`.exe`, with **no ZIP extraction**. This behavior was introduced by
+GitHub Actions in February 2026; older workflow runs still deliver ZIP.
+
+The **canonical sealed Windows package** remains a separate, immutable
+CI artifact containing its executable, build identity, manifests and
+validation data. This direct-download convenience does not relax checks,
+convert a development build into a production release, or alter official
+stable-release assets. Download the EXE only from a passing exact-source
+CI run, and verify the EXE SHA-256 recorded by that run.
+
+GitHub uses the **original file basename** as the artifact name when
+`archive: false` is set; `name:` is ignored for a non-zipped artifact.
+Other multi-file/test-evidence artifacts intentionally remain archives.
+
 ## Public assets
 
 A successful stable release publishes these stable asset names:
diff --git a/docs/architecture/UNIFIED_IEC61850_SSOT_V2_2026-10-23.md b/docs/architecture/UNIFIED_IEC61850_SSOT_V2_2026-10-23.md
new file mode 100644
index 000000000..4876579b3
--- /dev/null
+++ b/docs/architecture/UNIFIED_IEC61850_SSOT_V2_2026-10-23.md
@@ -0,0 +1,69 @@
+# ARSAS — Unified IEC 61850 Model / Reactive SSOT v2
+
+**Status:** incremental engineering contract; phase 1 implemented on PR #695; **not released**.
+**Dependency:** PR #688 (SG7 UI budgets, model preparation); includes #679 Smart IP visual startup fixes and #686 SG7 Browser Write/Command Dock. All inherited history must stay intact. **Engine lock remains pinned.**
+
+## One authority, not one mutable UI object
+
+- **Engineering schema**: `LiveDiscoveryModel` / verified SCL, indexed once by immutable **model identity**; exact LD/LN/DO/DA/FC, DataSet member order, RCB and q/t relationships. Source declarations are not live evidence.
+- **Canonical current observation**: `Iec61850MonitorDevice.LiveValues` / `IedBrowserLiveValues` is the per-IED, association-scoped owner for admitted Report and MMS Read observations. Typed q/t evidence and source provenance are never guessed or copied from a display string.
+- **Runtime acquisition**: MMS Report first, association-safe Read/poll fallback according to configured policies. Control requests/results are separate from actual status observations and cannot fabricate process truth.
+- **GOOSE publisher**: a different transport and identity (publisher/stream/DataSet/ordinal). Never write into the MMS identity merely because two labels look alike. A future verified mapper can publish separate GOOSE-origin observations for a *proven* owner/ref/FC; no cross-IED aliasing.
+- **SOE & command lifecycle**: chronological, lossless events. A latest-value dirty-key journal is **not** event history.
+
+```text
+MMS Report ----+
+MMS Read/Poll -+--> canonical admission, exact FC + association ----+
+               |                                                  |
+GOOSE frames --+--> independently verified stream/leaf evidence --+--> source-aware views
+                                                                  |
+                    canonical revision/change journal ------------+--> independent cursors
+                                                                    --> viewport subscription
+                                                                    --> small UI row patches
+
+Immutable engineering model -- shared schema index --+
+                                                      +--> Browser/Explorer/FAT/Command read-only projections
+```
+
+## Implemented now — phase 1
+
+1. `Models/SharedIedSchemaIndex.cs`: `ConditionalWeakTable` keyed by *actual source model*, one `Lazy<Task<IedBrowserSchemaIndex>>` per model. `PrepareAsync` never parses on the WPF Dispatcher. Browser and `IedBrowserReadBindingIndex` share the same instance. The existing binding constructor is synchronous for compatibility, which is a **known future migration point**; don't hide it in FAT results.
+2. `Models/CanonicalValueChangeJournal.cs`: fixed ring of 4096 immutable change records. Records are **only** revision + association + exact reference/FC + channel kind; not process values, samples, or SOE.
+3. `IedBrowserLiveValues.ReadChanges(afterRevision,max)`: independent non-destructive cursor access under the already existing ledger gate. A journal gap, invalid cursor, or association reset triggers `RequiresFullRefresh`. A slow consumer must resync from the canonical ledger before returning to incremental projection. Each accepted canonical publication records a contiguous version; rejected/stale network callbacks emit **nothing**.
+4. Phase-1 tests validate multi-consumer cursor replay, concurrent model preparation identity, reconnect fences and overflow detection.
+5. Original #688 WPF bounded scheduling remains in place, without changing selection, command, Report or SOE semantics.
+
+## Target migration — controlled follow-up phases
+
+**Phase 2: viewport-aware subscriptions / value-only patches**
+
+- Build exact FC-qualified per-IED reference -> consumer/visible-row index, with explicit dependency keys for vectors, parent DO summaries, quality/timestamp, SIUnit/multiplier and RCB readback.
+- When selecting an IED, paint shell immediately, then read **current** canonical values only for visible viewport (+ small overscan). Do not enumerate all SG7 attributes, rebuild all binding rows, or trigger a second MMS scan.
+- Consume the per-workspace cursor in bounded batches. Only changed displayed row fields raise `PropertyChanged`. Offscreen keys mark view versions/dirty state, **not** WPF events.
+- If `RequiresFullRefresh`, reconcile snapshot from the same ledger/model for that IED; preserve scroll, selection and command focus.
+- Preserve separate SOE FIFO, report discontinuities, BufOvfl, q/t typed evidence and control Accepted/Termination ordering.
+
+**Phase 3: shared projection adapter for Explorer, Live Monitor, FAT and Command Dock**
+
+- Delete duplicated ad-hoc presentation caches only *after* proving feature parity.
+- Point and SignalDefinition are UI adapters, **never independent writers of process truth**.
+- Replace per-workspace full CollectionView refresh / dynamic sort with incremental filtered indexes and stable virtualization.
+- Proven GOOSE model binding feeds a **separate source-aware** channel. TTL expiry is freshness state, not a fabricated MMS value change.
+
+**Phase 4: physical FAT / promotion**
+
+- Four concurrently monitored IEDs, including SG7_BCU (~32.9k MMS variables/~25.5k DA); 100 alternating IED switches, selected and unselected; LN/DO open/close, continuous scroll, active Report storm, GOOSE frames, browser read/write, control docks.
+- ETW `ARSAS-IEDBrowser-Performance` + PerfView/WPF Dispatcher, GC allocation, backlog, time-to-first-paint and p50/p95/p99 interaction latency. Record *numbers*, not subjective `feels fast`.
+- Suggested initial gates: p95 selection input feedback <=50 ms; indexed Browser first paint <=150 ms; per UI patch p95 <=4 ms; no application-caused Dispatcher block >50 ms; no stale association, fabricated quality, missing SOE/RCB/control events.
+- Main and release remain gated on exact commit CI + physical FAT. Faster UI **must never** mean dropped protocol evidence or hidden Reads.
+
+## Zero-regression guardrails
+
+- Git branch ancestry must include latest relevant #679/#686/#688, checked at handoff and before merging; no force push.
+- Engine lock must match the qualified ARIEC61850/native-bridge revisions.
+- Do not reimplement MMS, RCB, FCDA identity, q/t parsing, source precedence, SOE or command sequence in a WPF adapter.
+- Publication and version changes are atomic under the current canonical `_gate`. Never call user/WPF event handlers under that gate.
+- Any UI scheduler may coalesce latest **presentation** per key, never chronological events.
+- No feature is called complete on a passing static/source test alone: canonical evidence, source compatibility, peak memory and live multi-IED responsiveness must all be measured.
+
+**Engineering checkpoint:** PR #695 remains draft until Windows CI and later phase-specific SG7_BCU field acceptance evidence are complete.
diff --git a/docs/engineering/GLOBAL_MMS_WRITE_BASELINE_GUARD_20261023.md b/docs/engineering/GLOBAL_MMS_WRITE_BASELINE_GUARD_20261023.md
new file mode 100644
index 000000000..6156da559
--- /dev/null
+++ b/docs/engineering/GLOBAL_MMS_WRITE_BASELINE_GUARD_20261023.md
@@ -0,0 +1,40 @@
+# Global MMS Write / Browser Control — protected ARSAS baseline
+Date: 2026-10-23 (Asia/Jakarta)
+
+## Exact consumer starting point
+
+- Integrated PR: https://github.com/masarray/arsas/pull/679
+- Integration branch: `fix/fat-integrated-quality-attention-20261022`
+- **Protected ancestry anchor:** `c3555b639de0bbed14fdd06b55683479cf25bd31`
+- This staging branch was created from that **exact SHA**, not `main`, a cached ZIP snapshot or the older `10b3ebf` checkpoint.
+- PR #679 was draft at the time of verification. Before merging or rebasing, re-read live PR HEAD, compare ancestry, review overlapping files and preserve newer unrelated changes. No force-push.
+
+## Already integrated — protect from regressions
+
+| Area | Proven ancestor commit | Current source/contract |
+| --- | --- | --- |
+| Compact SMV waveform / phasors / Measurements | `84cbc36089bf`, `b446e9abf92e` | `Views/SmvInlineViewer.xaml`, `Ports/DigSubAnalyzer/Controls/PhasorDiagramControl.cs`, `WaveformPanelControl.cs` |
+| Verified SCL-derived IP Discovery IEDName | `4474e490389b` | `Services/Iec61850MonitorRuntime.cs`; provisional if not SHA-reverified |
+| Stable Open/Close width in Command Dock | `559307216fe7` | `MainWindow.xaml`: both position buttons `Width=72, MinWidth=72` |
+| Command Dock internal scroll and viewport constraints | `fbe205b9161`, `10b3ebf73a9` | `MainWindow.WorkbenchP1PanelGeometry.cs`; `EquipmentCommandGrid` ScrollViewer Auto |
+| Verified control list, equipment ahead of GGIO and no CILO Operate | `c0845d28867`, `96b3128bee7`, `1f82e286807` | `MainWindow.IecNaturalSort.cs`, `tests/ARSAS.Tests/MultiGridNaturalSortRegressionTests.cs` |
+| Idempotent control list refresh / anti flicker | `19580fd708c`, `7b9f983491e` | Preserve identity/incremental update; never reset unchanged rows |
+| Typed exact model Read including single-flight ST/SE | `4935a63d3963`, `98df880ca62d`, `f2df9814fc50` | `Services/IedBrowserTypedDoReadFlight.cs`, `Models/IedBrowserReadWireShapeEvidence.cs` |
+| Command Dock scroll anchor recovery | `97bd92652ac0` | `MainWindow.CommandPanelUx.cs` |
+
+GitHub commit comparisons against consumer anchor showed **behind=0** for all selected feature ancestors above. This proves ancestry and source presence, not independent physical UI acceptance.
+
+## Engine qualification separation
+
+- Production lock: `engines/ARIEC61850.lock.json` pins `9c7cb40364023a7b217e5ec31ab3105ba90142eb`.
+- Vendor-neutral prefixed-LN trial: engine PR #189 SHA `24aae4698026f3a5cf7a35225c5d8000018af3e4`, **closed, not merged**; experimental only.
+- Generic MMS Write response cardinality work: engine PR #195 (draft), **not** an approved production-engine pin update.
+- Never silently replace trial features with the production engine, nor promote experimental engine into production lock. A controlled cross-repo Windows build needs explicit exact-SHA mapping.
+
+## Mandatory guard before next implementation change
+
+1. Fetch live PR #679 and feature branch HEAD and compare them; review overlaps if integration branch has advanced.
+2. Keep new feature changes isolated to typed Global Write + Browser Control paths. Reuse current `NativeIec61850Client`, `Iec61850MonitorRuntime`, `ControlCommandWindow`, `ControlModelWriteWindow`, existing `MmsWrite`, and session/authority gates.
+3. Run existing Command Dock WPF sorting/geometry, SV viewer, IEDName, model-read, R7 and Windows CI tests on **final new SHA**; no pass inherited from a different SHA.
+4. Preserve StatusOnly and CO generic-Write denial; no automatic Select/Operate, silent retry/rollback, physical FAT claim, or production pin change.
+5. Any new runtime UI control must keep Command Dock independent scrolling and fixed Open/Close button dimensions.
diff --git a/engines/ARIEC61850.lock.json b/engines/ARIEC61850.lock.json
index 08435582b..eacaf68a6 100644
--- a/engines/ARIEC61850.lock.json
+++ b/engines/ARIEC61850.lock.json
@@ -2,9 +2,9 @@
   "schemaVersion": 1,
   "repository": "masarray/ARIEC61850",
   "ref": "main",
-  "commit": "9c7cb40364023a7b217e5ec31ab3105ba90142eb",
-  "sourcePullRequest": 184,
-  "purpose": "P0-C stage-attributed SBOw asynchronous-error observation trial on engine #183 ancestry; delayed rejection regression code-qualified; no performance or physical acceptance yet.",
+  "commit": "f75e323e9f8443aa20e0a3818a1d5d77255b2c0f",
+  "sourcePullRequest": 192,
+  "purpose": "EXPLICIT DRAFT TRIAL ONLY: code-green engine staging #192 typed same-object control semantics. Original P0-C #184 pin retained below; field control and release physical acceptance NOT asserted.",
   "previousTrialPin": {
     "commit": "4467124775d8d9d76f3db194f9fbfd97144767a8",
     "sourcePullRequest": 134,
@@ -347,5 +347,19 @@
     "noUnqualifiedImmediateOperate": true,
     "physicalLatencyQualificationRequired": true,
     "mainlinePromotionForbidden": true
+  },
+  "globalTypedControlStageTrial": {
+    "status": "engine-ci-success-consumer-trial-not-physical",
+    "baseEngineCommit": "9c7cb40364023a7b217e5ec31ab3105ba90142eb",
+    "exactCommit": "f75e323e9f8443aa20e0a3818a1d5d77255b2c0f",
+    "enginePullRequest": 192,
+    "engineCiRun": 39909260816,
+    "typedStatusReadRequired": true,
+    "sameDataObjectFeedbackRequired": true,
+    "ctlModelAndOperShapeRequired": true,
+    "sbowEnhancedSafetyRequired": true,
+    "noAutomaticOperate": true,
+    "physicalQualificationRequired": true,
+    "mainlinePromotionForbidden": true
   }
 }
diff --git a/engines/ARIEC61850.trial.json b/engines/ARIEC61850.trial.json
new file mode 100644
index 000000000..7ef7da3e0
--- /dev/null
+++ b/engines/ARIEC61850.trial.json
@@ -0,0 +1,8 @@
+{
+  "schemaVersion": 1,
+  "repository": "masarray/ARIEC61850",
+  "commit": "24aae4698026f3a5cf7a35225c5d8000018af3e4",
+  "runMode": "fast-dev-nonpromotion",
+  "scope": "command-read",
+  "purpose": "IEC 61850 Ed2 live typed DPC/BSC NameList recovery across prefixed and renamed LN identities. No executable release authority."
+}
diff --git a/scripts/publish-windows-portable.ps1 b/scripts/publish-windows-portable.ps1
index e3aa95190..54fbfce95 100644
--- a/scripts/publish-windows-portable.ps1
+++ b/scripts/publish-windows-portable.ps1
@@ -6,7 +6,8 @@ param(
     [string]$EngineProject = "",
     [string]$NpcapProject = "",
     [string]$ArdIrecBridgePath = "",
-    [string]$ArdIrecSource = ""
+    [string]$ArdIrecSource = "",
+    [string]$EngineValidationLockPath = ""
 )
 
 $ErrorActionPreference = "Stop"
@@ -45,6 +46,32 @@ if ($SingleFile -and -not $SelfContained) {
     throw "The public portable build must be self-contained so it can run without an installed .NET runtime."
 }
 
+# Explicit non-promotion override, valid only for an isolated CI field-trial.
+$trialLockArguments = @()
+if (-not [string]::IsNullOrWhiteSpace($EngineValidationLockPath)) {
+    if ($env:GITHUB_ACTIONS -ne "true" -or $env:ARSAS_NONPROMOTION_ENGINE_TRIAL -ne "true") {
+        throw "Alternate engine lock forbidden outside CI-only nonpromotion trial."
+    }
+    $approved = Get-Content (Join-Path $root 'engines\ARIEC61850.lock.json') -Raw | ConvertFrom-Json
+    $tempLock = [System.IO.Path]::GetFullPath($EngineValidationLockPath)
+    if (-not (Test-Path -LiteralPath $tempLock -PathType Leaf) -or
+        $tempLock.StartsWith($root + [System.IO.Path]::DirectorySeparatorChar,
+            [System.StringComparison]::OrdinalIgnoreCase)) {
+        throw "Trial validator lock must be outside source and must exist."
+    }
+    $trial = Get-Content -LiteralPath $tempLock -Raw | ConvertFrom-Json
+    $actual = (& git -C (Split-Path -Parent $EngineProject) rev-parse HEAD).Trim().ToLowerInvariant()
+    if ($trial.nonPromotableTrial -ne $true -or
+        [string]$trial.approvedBaselineCommit -cne [string]$approved.commit -or
+        [string]$trial.commit -cne $actual -or
+        $actual -ceq [string]$approved.commit -or
+        $actual -cnotmatch '^[0-9a-f]{40}$') {
+        throw "Trial lock / exact engine / approved baseline mismatch."
+    }
+    $trialLockArguments = @("-p:ArIec61850LockPath=$tempLock")
+    Write-Host "NONRELEASE exact engine $actual; production source lock unchanged."
+}
+
 $normalizedVersion = $Version.Trim()
 if ($normalizedVersion.StartsWith("v", [System.StringComparison]::OrdinalIgnoreCase)) {
     $normalizedVersion = $normalizedVersion.Substring(1)
@@ -100,7 +127,8 @@ New-Item -ItemType Directory -Path $publishDir -Force | Out-Null
 Write-Host "==> Restoring ARSAS"
 dotnet restore $project `
     -p:ArIec61850Project="$EngineProject" `
-    -p:ArIec61850NpcapProject="$NpcapProject"
+    -p:ArIec61850NpcapProject="$NpcapProject" `
+    @trialLockArguments
 if ($LASTEXITCODE -ne 0) {
     throw "dotnet restore failed with exit code $LASTEXITCODE."
 }
@@ -128,6 +156,7 @@ $publishArguments = @(
     "-p:ArdIrecBridgeRequired=true",
     "-o", $publishDir
 )
+$publishArguments += $trialLockArguments
 
 if ($SingleFile) {
     # WPF and packet-capture dependencies use reflection, content files and native loading.
diff --git a/scripts/resolve-ariec-lock.ps1 b/scripts/resolve-ariec-lock.ps1
index 5033d8466..5f4f4e6f1 100644
--- a/scripts/resolve-ariec-lock.ps1
+++ b/scripts/resolve-ariec-lock.ps1
@@ -127,6 +127,29 @@ if ($null -ne $lock.sclAssociationInteroperability) {
             $p0BRcbTrialValid = Test-P0BRcbPlannerTrial -Lock $lock
             . (Join-Path $PSScriptRoot 'test-p0-c-typed-read-trial.ps1')
             $p0CTypedReadTrialValid = Test-P0CTypedReadTrial -Lock $lock
+            # Only this exact, reviewed staging ancestry can be assembled
+            # as a DRAFT Windows FAT candidate. The historical physical
+            # engine and P0-C provenance stay unchanged, and neither passing
+            # CI nor reading a status bit grants a real-world Operate.
+            $typedControl = $lock.globalTypedControlStageTrial
+            $typedControlValid = (
+                $null -ne $typedControl -and
+                [string]$lock.commit -ceq 'f75e323e9f8443aa20e0a3818a1d5d77255b2c0f' -and
+                [int]$lock.sourcePullRequest -eq 192 -and
+                [string]$typedControl.baseEngineCommit -ceq '9c7cb40364023a7b217e5ec31ab3105ba90142eb' -and
+                [string]$typedControl.exactCommit -ceq [string]$lock.commit -and
+                [int]$typedControl.enginePullRequest -eq 192 -and
+                [long]$typedControl.engineCiRun -eq 39909260816L -and
+                [string]$typedControl.status -ceq 'engine-ci-success-consumer-trial-not-physical' -and
+                [bool]$typedControl.typedStatusReadRequired -and
+                [bool]$typedControl.sameDataObjectFeedbackRequired -and
+                [bool]$typedControl.ctlModelAndOperShapeRequired -and
+                [bool]$typedControl.sbowEnhancedSafetyRequired -and
+                [bool]$typedControl.noAutomaticOperate -and
+                [bool]$typedControl.physicalQualificationRequired -and
+                [bool]$typedControl.mainlinePromotionForbidden -and
+                [string]$lock.p0CStageObservationTrial.exactCommit -ceq [string]$typedControl.baseEngineCommit
+            )
             $acceptedTrial = (
                 ($trialValid -and [string]$lock.commit -ceq [string]$trial.exactCommit -and [int]$lock.sourcePullRequest -eq 148) -or
                 ($serverAtValid -and [string]$lock.commit -ceq [string]$serverAt.exactCommit -and [int]$lock.sourcePullRequest -eq 153) -or
@@ -136,7 +159,8 @@ if ($null -ne $lock.sclAssociationInteroperability) {
                 $m217KTrialValid -or
                 $p0AIdentityTrialValid -or
                 $p0BRcbTrialValid -or
-                $p0CTypedReadTrialValid
+                $p0CTypedReadTrialValid -or
+                $typedControlValid
             )
             if (-not $historicalAnchorValid -or -not $acceptedTrial) {
                 throw 'SCL association physical-tested engine head differs from integration lock.'
diff --git a/scripts/test-ci-canonical-reuse.py b/scripts/test-ci-canonical-reuse.py
index 3513bc9f7..f8407fab4 100644
--- a/scripts/test-ci-canonical-reuse.py
+++ b/scripts/test-ci-canonical-reuse.py
@@ -9,6 +9,7 @@
 import urllib.request
 import zipfile
 from pathlib import Path
+from unittest.mock import patch
 
 ROOT = Path(__file__).resolve().parent
 
@@ -279,6 +280,36 @@ def test_artifact_ready_mode_still_rejects_completed_failed_run(self):
                 allow_in_progress_artifact=True,
             )
 
+    def test_artifact_ready_mode_rechecks_transient_red_but_never_uses_red_proof(self):
+        class CorrectedCanonicalStatus(FakeApi):
+            def __init__(self):
+                super().__init__()
+                self.queries = 0
+                self.artifacts_during_red = 0
+
+            def get(self, url: str, binary: bool = False):
+                if "/workflows/build.yml/runs?" in url:
+                    self.queries += 1
+                    if self.queries == 1:
+                        transient = dict(self.listing[0])
+                        transient.update(status="completed", conclusion="failure")
+                        return {"workflow_runs": [transient]}
+                if "/artifacts" in url and self.queries == 1:
+                    self.artifacts_during_red += 1
+                return super().get(url, binary=binary)
+
+        api = CorrectedCanonicalStatus()
+        with patch.object(consumer.time, "sleep", return_value=None):
+            proof = consumer.verify_canonical(
+                api, repository="masarray/arsas", branch=BRANCH,
+                head_sha=HEAD, merge_sha=SOURCE, engine_sha=ENGINE,
+                wait_seconds=2, poll_seconds=1, allow_in_progress_artifact=True
+            )
+        self.assertGreaterEqual(api.queries, 2)
+        self.assertEqual(api.artifacts_during_red, 0)
+        self.assertEqual(proof["canonicalRunConclusion"], "success")
+        self.assertEqual(proof["proofStage"], "completed-workflow")
+
     def test_artifact_ready_mode_waits_when_expected_artifact_is_not_uploaded(self):
         with self.assertRaisesRegex(consumer.ProofError, "artifact-ready canonical"):
             run_once(
@@ -353,6 +384,45 @@ def test_different_pr_head_or_branch_fails_closed(self):
         with self.assertRaisesRegex(consumer.ProofError, "Timed out"):
             run_once(api)
 
+    def test_latest_rerun_artifact_is_selected_without_deleting_failed_attempt_evidence(self):
+        first = {
+            "id": 101, "name": "ARSAS-test-evidence", "expired": False,
+            "workflow_run": {"id": RUN},
+            "created_at": "2026-10-23T00:50:45Z",
+            "archive_download_url": "https://example.invalid/old.zip",
+        }
+        second = {
+            "id": 102, "name": "ARSAS-test-evidence", "expired": False,
+            "workflow_run": {"id": RUN},
+            "created_at": "2026-10-23T00:57:03Z",
+            "archive_download_url": "https://example.invalid/current.zip",
+        }
+        self.assertEqual(
+            consumer.choose_artifact({"artifacts": [first, second]}, RUN)["id"], 102)
+        self.assertEqual(
+            consumer.choose_artifact({"artifacts": [second, first]}, RUN)["id"], 102)
+
+    def test_ambiguous_rerun_artifacts_fail_closed(self):
+        artifacts = [
+            {"id": 101, "name": "ARSAS-test-evidence", "expired": False,
+             "workflow_run": {"id": RUN}, "created_at": "2026-10-23T00:57:03Z"},
+            {"id": 102, "name": "ARSAS-test-evidence", "expired": False,
+             "workflow_run": {"id": RUN}, "created_at": "2026-10-23T00:57:03Z"},
+        ]
+        with self.assertRaisesRegex(consumer.ProofError, "ambiguous"):
+            consumer.choose_artifact({"artifacts": artifacts}, RUN)
+        artifacts[0].pop("created_at")
+        with self.assertRaisesRegex(consumer.ProofError, "timestamps"):
+            consumer.choose_artifact({"artifacts": artifacts}, RUN)
+
+    def test_stale_attempt_cannot_be_misrepresented_as_success(self):
+        older = zip_archive(fixture())  # Proven run_attempt=1.
+        with self.assertRaisesRegex(consumer.ProofError, "run attempt"):
+            consumer.validate_artifact_archive(
+                older, merge_sha=SOURCE, engine_sha=ENGINE,
+                workflow_run_id=RUN, run_attempt=2,
+            )
+
     def test_wrong_artifact_type_is_not_accepted(self):
         api = FakeApi()
         api.get = lambda url, binary=False: (
diff --git a/scripts/test-ci-workflows.py b/scripts/test-ci-workflows.py
index 1cb6bf9d9..0836f0b51 100644
--- a/scripts/test-ci-workflows.py
+++ b/scripts/test-ci-workflows.py
@@ -265,5 +265,91 @@ def test_budget_rejects_new_duplicate_build_cost(self):
         )
 
 
+
+class SmartDiscoveryFastRoutingTests(unittest.TestCase):
+    """Keep broad UI changes out of unrelated physical Smart Discovery CI."""
+
+    WORKFLOWS = (
+        ".github/workflows/smart-discovery-capture-build.yml",
+        ".github/workflows/smart-discovery-golden-provenance.yml",
+        ".github/workflows/smart-discovery-golden-budget-lock.yml",
+        ".github/workflows/smart-discovery-repeat-run-stability.yml",
+        ".github/workflows/smart-discovery-mainline-readiness.yml",
+        ".github/workflows/smart-discovery-merge-execution-guard.yml",
+        ".github/workflows/smart-discovery-production-promotion.yml",
+    )
+
+    @staticmethod
+    def pr_paths(workflow):
+        """Read PR path filters without depending on YAML/regex escaping."""
+        content = workflow.read_text(encoding="utf-8").splitlines()
+        try:
+            trigger = content.index("  pull_request:")
+            start = content.index("    paths:", trigger + 1)
+        except ValueError as exc:
+            raise AssertionError(f"Missing scoped PR path filters: {workflow}") from exc
+        patterns = []
+        for line in content[start + 1:]:
+            if not line.startswith("      "):
+                break
+            trimmed = line.strip()
+            if trimmed.startswith('- "') and trimmed.endswith('"'):
+                patterns.append(trimmed[3:-1])
+        if not patterns:
+            raise AssertionError(f"No scoped PR paths: {workflow}")
+        return patterns
+
+    def test_smart_discovery_pr_triggers_exclude_unrelated_ui_and_smv(self):
+        root = Path(__file__).resolve().parent.parent
+        from fnmatch import fnmatchcase
+        irrelevant = (
+            "MainWindow.xaml",
+            "MainWindow.IedBrowser.cs",
+            "Models/QualityInvalidAttention.cs",
+            "Services/SmvLiveCaptureService.cs",
+            "tests/ARSAS.Tests/QualityInvalidAttentionTests.cs",
+            "docs/WINDOWS_RELEASES.md",
+        )
+        for name in self.WORKFLOWS:
+            paths = self.pr_paths(root / name)
+            self.assertTrue(paths, name)
+            self.assertIn(name, paths)
+            for unrelated in irrelevant:
+                self.assertFalse(
+                    any(fnmatchcase(unrelated, pattern) for pattern in paths),
+                    f"{name} wrongly triggered by {unrelated}",
+                )
+
+    def test_draft_runs_fast_and_ready_for_review_reruns_full_gates(self):
+        root = Path(__file__).resolve().parent.parent
+        for name in (*self.WORKFLOWS, ".github/workflows/installer-windows.yml"):
+            content = (root / name).read_text(encoding="utf-8")
+            self.assertIn("types: [opened, synchronize, reopened, ready_for_review]",
+                          content, name)
+            self.assertIn(
+                "github.event_name != 'pull_request' || !github.event.pull_request.draft",
+                content, name)
+            self.assertIn("  workflow_dispatch:", content, name)
+
+    def test_smart_discovery_critical_changes_still_trigger_and_manual_exists(self):
+        root = Path(__file__).resolve().parent.parent
+        from fnmatch import fnmatchcase
+        for name in self.WORKFLOWS:
+            content = (root / name).read_text(encoding="utf-8")
+            self.assertIn("  workflow_dispatch:", content)
+            paths = self.pr_paths(root / name)
+            self.assertTrue(any(fnmatchcase(name, pattern) for pattern in paths))
+        shared = (
+            ".github/workflows/smart-discovery-capture-build.yml",
+            ".github/workflows/smart-discovery-mainline-readiness.yml",
+            ".github/workflows/smart-discovery-merge-execution-guard.yml",
+            ".github/workflows/smart-discovery-production-promotion.yml",
+        )
+        for name in shared:
+            paths = self.pr_paths(root / name)
+            for critical in ("Models/MonitorModels.cs", "engines/ARIEC61850.lock.json"):
+                self.assertTrue(any(fnmatchcase(critical, pattern) for pattern in paths),
+                                f"{name} omitted {critical}")
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/scripts/test-resolve-ariec-lock.ps1 b/scripts/test-resolve-ariec-lock.ps1
index e162d1375..8fa04ce6a 100644
--- a/scripts/test-resolve-ariec-lock.ps1
+++ b/scripts/test-resolve-ariec-lock.ps1
@@ -202,6 +202,31 @@ try {
         Assert-Rejects $invalidSuccessor 'physical-tested'
     }
 
+    # Candidate staging SHA must be exact, fail-closed and NEVER conflated
+    # with physically accepted baseline. Invalid metadata cannot unlock it.
+    foreach ($field in @('typedStatusReadRequired',
+                         'sameDataObjectFeedbackRequired',
+                         'ctlModelAndOperShapeRequired',
+                         'sbowEnhancedSafetyRequired',
+                         'noAutomaticOperate',
+                         'physicalQualificationRequired',
+                         'mainlinePromotionForbidden')) {
+        $invalidTyped = New-TrackedP10Fixture
+        $invalidTyped.globalTypedControlStageTrial.$field = $false
+        Assert-Rejects $invalidTyped 'physical-tested'
+    }
+    $wrongStageSha = New-TrackedP10Fixture
+    $wrongStageSha.globalTypedControlStageTrial.exactCommit = ('e' * 40)
+    Assert-Rejects $wrongStageSha 'physical-tested'
+
+    $wrongStageCi = New-TrackedP10Fixture
+    $wrongStageCi.globalTypedControlStageTrial.engineCiRun = 0
+    Assert-Rejects $wrongStageCi 'physical-tested'
+
+    $wrongStageParent = New-TrackedP10Fixture
+    $wrongStageParent.globalTypedControlStageTrial.baseEngineCommit = ('f' * 40)
+    Assert-Rejects $wrongStageParent 'physical-tested'
+
     Write-Host "CI-P1 immutable engine resolver: $checks synthetic cases PASS."
 }
 finally {
diff --git a/scripts/verify-ci-canonical-reuse.py b/scripts/verify-ci-canonical-reuse.py
index bca4a9dda..258026dbc 100644
--- a/scripts/verify-ci-canonical-reuse.py
+++ b/scripts/verify-ci-canonical-reuse.py
@@ -223,9 +223,30 @@ def choose_artifact(payload: dict, run_id: int, *, allow_missing: bool = False)
     ]
     if not matches and allow_missing:
         return None
-    if len(matches) != 1:
+    if len(matches) == 1:
+        return matches[0]
+    if not matches:
         raise ProofError("Expected exactly one non-expired canonical test artifact")
-    return matches[0]
+
+    # GitHub retains each attempt's same-named artifact after a workflow rerun.
+    # Never delete old evidence, and NEVER pick an older passing attempt when
+    # the latest canonical run/attempt has failed. The caller has already
+    # required the latest run conclusion=success, and the selected artifact's
+    # embedded manifest/TRX MUST prove the exact latest run_attempt and SHA.
+    # Artifact API has no run_attempt field: order by its server-issued
+    # created_at timestamp and refuse absent/ambiguous timestamps.
+    stamped = []
+    for candidate in matches:
+        created = candidate.get("created_at")
+        if (not isinstance(created, str) or
+                not created.endswith("Z") or
+                len(created) != len("2026-10-23T00:57:03Z")):
+            raise ProofError("Multiple canonical artifacts lack trustworthy creation timestamps")
+        stamped.append((created, candidate))
+    stamped.sort(key=lambda pair: pair[0], reverse=True)
+    if stamped[0][0] == stamped[1][0]:
+        raise ProofError("Canonical artifact rerun timestamp is ambiguous")
+    return stamped[0][1]
 
 
 class StripCrossOriginAuthorization(urllib.request.HTTPRedirectHandler):
@@ -302,15 +323,22 @@ def verify_canonical(
             conclusion = run.get("conclusion")
             previous = f"{run_id}/{attempt} {status}/{conclusion}"
 
-            # A canonical run that has already finished red is never usable, even
-            # if an all-pass regression artifact was uploaded before a later
-            # packaging/smoke failure.
-            if status == "completed" and conclusion != "success":
+            # A failed canonical run is NEVER usable evidence. For the
+            # artifact-ready CI-P2D consumers, however, GitHub's run listing
+            # can briefly expose a red intermediate status while the same
+            # canonical attempt is still finalizing. Do not accept its
+            # artifact; re-check THIS latest run/attempt within the existing
+            # finite deadline. Strict mode and a persistently failed run
+            # remain fail-closed, never falling back to older green attempts.
+            failed_canonical = status == "completed" and conclusion != "success"
+            if failed_canonical and (
+                not allow_in_progress_artifact or time.monotonic() >= deadline
+            ):
                 raise ProofError(
                     f"Latest canonical Build ARSAS run failed: {previous}"
                 )
 
-            can_read_artifact = (
+            can_read_artifact = not failed_canonical and (
                 status == "completed"
                 or (allow_in_progress_artifact and status == "in_progress")
             )
diff --git a/tests/ARSAS.Tests/C264FieldAlignmentRegressionTests.cs b/tests/ARSAS.Tests/C264FieldAlignmentRegressionTests.cs
index acca79728..f75aeda5f 100644
--- a/tests/ARSAS.Tests/C264FieldAlignmentRegressionTests.cs
+++ b/tests/ARSAS.Tests/C264FieldAlignmentRegressionTests.cs
@@ -11,26 +11,24 @@ public sealed class C264FieldAlignmentRegressionTests
     private static readonly XNamespace Wpf = "http://schemas.microsoft.com/winfx/2006/xaml/presentation";
 
     [Fact]
-    public void IedIpAddress_CentersEditableText_WithoutReplacingComboBoxTemplate()
+    public void IedIpAddress_HasFourAlignedOctets_SearchableHistory_AndNoDuplicateStorage()
     {
         var document = XDocument.Load(Find("IpConnectWizardWindow.xaml"));
-        var combo = document.Descendants(Wpf + "ComboBox")
-            .Single(x => (string?)x.Attribute(XName.Get("Name", "http://schemas.microsoft.com/winfx/2006/xaml")) == "RelayIpBox");
-
-        Assert.Equal("True", (string?)combo.Attribute("IsEditable"));
-        Assert.Equal("Center", (string?)combo.Attribute("HorizontalContentAlignment"));
-        Assert.Equal("Center", (string?)combo.Attribute("VerticalContentAlignment"));
-        Assert.Equal("RelayIpBox_Loaded", (string?)combo.Attribute("Loaded"));
-        Assert.Contains("RecentRelayIps", (string?)combo.Attribute("ItemsSource"));
-        Assert.Contains("RelayIpAddress", (string?)combo.Attribute("Text"));
-        Assert.Empty(combo.Elements(Wpf + "ComboBox.Template"));
+        var boxes = document.Descendants(Wpf + "TextBox")
+            .Where(e => ((string?)e.Attribute(XName.Get("Name", "http://schemas.microsoft.com/winfx/2006/xaml")))?.StartsWith("Octet", StringComparison.Ordinal) == true)
+            .ToArray();
 
+        Assert.Equal(4, boxes.Length);
+        Assert.All(boxes, box => Assert.Equal("{StaticResource SmartIpOctet}", (string?)box.Attribute("Style")));
+        Assert.Contains(document.Descendants(Wpf + "Popup"),
+            popup => (string?)popup.Attribute(XName.Get("Name", "http://schemas.microsoft.com/winfx/2006/xaml")) == "HistoryPopup");
         var source = File.ReadAllText(Find("IpConnectWizardWindow.xaml.cs"));
-        Assert.Contains("RelayIpBox.Template.FindName(\"PART_EditableTextBox\", RelayIpBox)", source);
-        Assert.Contains("editor.TextAlignment = TextAlignment.Center;", source);
-        Assert.Contains("editor.VerticalContentAlignment = VerticalAlignment.Center;", source);
-        Assert.Contains("UserPreferenceStore.LoadRecentEndpoints()", source);
-        Assert.Contains("System.Net.IPAddress.TryParse", source);
+        Assert.Contains("UserPreferenceStore.LoadRecentEndpointDetails()", source);
+        Assert.Contains("Octet_Pasting", source);
+        Assert.Contains("Octet_PreviewKeyDown", source);
+        Assert.Contains("CommitHistorySelection()", source);
+        Assert.Contains("RelayIpAddress = submittedAddress;", source);
+        Assert.DoesNotContain("File.WriteAllText", source);
     }
 
     [Fact]
diff --git a/tests/ARSAS.Tests/CanonicalLiveSclExportRegressionTests.cs b/tests/ARSAS.Tests/CanonicalLiveSclExportRegressionTests.cs
index c7b7a5597..ffcb8f9cb 100644
--- a/tests/ARSAS.Tests/CanonicalLiveSclExportRegressionTests.cs
+++ b/tests/ARSAS.Tests/CanonicalLiveSclExportRegressionTests.cs
@@ -495,9 +495,24 @@ public void EngineLock_PreservesPhysicalSclRepairBaselineAcrossCodeVerifiedInter
             stageTrial.GetProperty("baseEngineCommit").GetString());
         Assert.Equal("9c7cb40364023a7b217e5ec31ab3105ba90142eb",
             stageTrial.GetProperty("exactCommit").GetString());
+        var typedTrial = root.GetProperty("globalTypedControlStageTrial");
         Assert.Equal(stageTrial.GetProperty("exactCommit").GetString(),
+            typedTrial.GetProperty("baseEngineCommit").GetString());
+        Assert.Equal("f75e323e9f8443aa20e0a3818a1d5d77255b2c0f",
+            typedTrial.GetProperty("exactCommit").GetString());
+        Assert.Equal(typedTrial.GetProperty("exactCommit").GetString(),
             root.GetProperty("commit").GetString());
-        Assert.Equal(184, root.GetProperty("sourcePullRequest").GetInt32());
+        Assert.Equal(192, root.GetProperty("sourcePullRequest").GetInt32());
+        Assert.Equal(192, typedTrial.GetProperty("enginePullRequest").GetInt32());
+        Assert.Equal(39909260816L, typedTrial.GetProperty("engineCiRun").GetInt64());
+        Assert.Equal("engine-ci-success-consumer-trial-not-physical",
+            typedTrial.GetProperty("status").GetString());
+        foreach (var flag in new[] {
+            "typedStatusReadRequired", "sameDataObjectFeedbackRequired",
+            "ctlModelAndOperShapeRequired", "sbowEnhancedSafetyRequired",
+            "noAutomaticOperate", "physicalQualificationRequired",
+            "mainlinePromotionForbidden" })
+            Assert.True(typedTrial.GetProperty(flag).GetBoolean());
         Assert.Equal(184, stageTrial.GetProperty("enginePullRequest").GetInt32());
         Assert.Equal(185, stageTrial.GetProperty("engineCiOnlyPullRequest").GetInt32());
         Assert.Equal(1182, stageTrial.GetProperty("engineTestsPassed").GetInt32());
diff --git a/tests/ARSAS.Tests/CommandDockEqualActionLayoutRegressionTests.cs b/tests/ARSAS.Tests/CommandDockEqualActionLayoutRegressionTests.cs
new file mode 100644
index 000000000..c7638e97f
--- /dev/null
+++ b/tests/ARSAS.Tests/CommandDockEqualActionLayoutRegressionTests.cs
@@ -0,0 +1,31 @@
+using System.Text.RegularExpressions;
+
+namespace ARSAS.Tests;
+
+public sealed class CommandDockEqualActionLayoutRegressionTests
+{
+    [Theory]
+    [InlineData("Open", "Close")]
+    [InlineData("Raise", "Lower")]
+    [InlineData("True", "False")]
+    public void VisiblePairedActionsUseEqualGridTracks(string left, string right)
+    {
+        var xaml = File.ReadAllText(FindRepoFile("MainWindow.xaml"));
+        var leftPattern = $@"<Button Grid.Column=""0"" Content=""{left}""";
+        var rightPattern = $@"<Button Grid.Column=""2"" Content=""{right}""";
+        Assert.Contains(leftPattern.Replace("@", ""), xaml, StringComparison.Ordinal);
+        Assert.Contains(rightPattern.Replace("@", ""), xaml, StringComparison.Ordinal);
+        Assert.True(Regex.Matches(xaml,
+            @"<Grid.ColumnDefinitions><ColumnDefinition Width=""72""/><ColumnDefinition Width=""7""/><ColumnDefinition Width=""72""/></Grid.ColumnDefinitions>").Count >= 3);
+    }
+
+    private static string FindRepoFile(string path)
+    {
+        for (DirectoryInfo? dir = new(AppContext.BaseDirectory); dir != null; dir = dir.Parent)
+        {
+            var file = Path.Combine(dir.FullName, path);
+            if (File.Exists(file)) return file;
+        }
+        throw new FileNotFoundException(path);
+    }
+}
diff --git a/tests/ARSAS.Tests/CommandDockLivePriorityCheckpointTests.cs b/tests/ARSAS.Tests/CommandDockLivePriorityCheckpointTests.cs
new file mode 100644
index 000000000..1b10fd124
--- /dev/null
+++ b/tests/ARSAS.Tests/CommandDockLivePriorityCheckpointTests.cs
@@ -0,0 +1,125 @@
+using System.Collections.Specialized;
+using ArIED61850Tester.Models;
+using ArIED61850Tester.Services;
+
+namespace ARSAS.Tests;
+
+public sealed class CommandDockLivePriorityCheckpointTests
+{
+    private static SignalDefinition Control(
+        string reference, string cdc, string model, bool verified = false)
+    {
+        var dot = reference.LastIndexOf('.');
+        var signal = new SignalDefinition
+        {
+            Name = reference[(dot + 1)..],
+            ObjectReference = reference,
+            FunctionalConstraint = "CO",
+            IsControlSignal = true,
+            IsSelected = true,
+            ControlCdc = cdc,
+            ControlModelText = model
+        };
+        signal.ControlSemanticVerified = verified;
+        return signal;
+    }
+
+    private const string Direct = "Direct Operate (DO) • Normal security";
+
+    [Fact]
+    public void TapFirst_StatusOnlyLast_WithoutGrantingAnyNewCommandPermission()
+    {
+        var device = new Iec61850MonitorDevice();
+        var status = Control("ZIVAVRLD1/CSWI2.Pos", "DPC", "Status only");
+        var unknown = Control("ZIVAVRLD1/CSWI4.Pos", "DPC", "Auto-detect");
+        var cswi = Control("ZIVAVRLD1/CSWI1.Pos", "DPC", Direct, verified: true);
+        var xcb = Control("SG7_BCUSystem/Bkr0XCBR1.Pos", "DPC", Direct, verified: true);
+        var tap = Control("ZIVAVRLD1/ATCC1.TapChg", "BSC", Direct, verified: true);
+        foreach (var signal in new[] { status, unknown, xcb, cswi, tap })
+            device.Signals.Add(signal);
+        device.RecountSelectedSignals();
+
+        Assert.Equal(5, device.CommandSignals.Count);
+        Assert.Same(tap, device.CommandSignals[0]);
+        // Within operable non-BSC objects, keep the existing evidence-based
+        // role priority. Both must precede all unresolved/disabled entries.
+        Assert.True(device.CommandSignals.IndexOf(cswi) < device.CommandSignals.IndexOf(unknown));
+        Assert.True(device.CommandSignals.IndexOf(xcb) < device.CommandSignals.IndexOf(unknown));
+        Assert.Same(status, device.CommandSignals[^1]);
+        Assert.False(status.ControlSupportsOperate);
+        Assert.False(unknown.ControlSupportsOperate);
+        Assert.Equal(Iec61850ControlModelKind.StatusOnly, status.ControlModelKind);
+        Assert.Equal(5, device.SelectedControlSignalCount);
+        Assert.Equal(3, device.OperableCommandSignals.Count);
+        Assert.Same(tap, device.OperableCommandSignals[0]);
+    }
+
+    [Fact]
+    public void StatusOnlyTapDoesNotJumpAboveLiveCswi_WhenModelChangesReorderInPlace()
+    {
+        var device = new Iec61850MonitorDevice();
+        var cswi = Control("IED/CSWI1.Pos", "DPC", Direct, verified: true);
+        var tap = Control("IED/ATCC1.TapChg", "BSC", "Auto-detect");
+        device.Signals.Add(cswi);
+        device.Signals.Add(tap);
+        device.RecountSelectedSignals();
+
+        Assert.Same(cswi, device.CommandSignals[0]);
+        var resets = 0;
+        device.CommandSignals.CollectionChanged += (_, args) =>
+        {
+            if (args.Action == NotifyCollectionChangedAction.Reset)
+                resets++;
+        };
+
+        tap.ControlModelText = Direct;
+        tap.ControlSemanticVerified = true;
+        device.RefreshCommandSignalProjection();
+        Assert.Same(tap, device.CommandSignals[0]);
+        Assert.Same(cswi, device.CommandSignals[1]);
+
+        tap.ControlModelText = "Status only";
+        device.RefreshCommandSignalProjection();
+        Assert.Same(cswi, device.CommandSignals[0]);
+        Assert.Same(tap, device.CommandSignals[1]);
+        Assert.False(tap.ControlSupportsOperate);
+        Assert.Equal(0, resets);
+    }
+
+    [Fact]
+    public void IdenticalReportRefreshDoesNotRecreateRowsOrChangeOrder()
+    {
+        var device = new Iec61850MonitorDevice();
+        var tap = Control("IED/ATCC1.TapChg", "BSC", Direct, verified: true);
+        var cswi = Control("IED/CSWI1.Pos", "DPC", Direct, verified: true);
+        var readOnly = Control("IED/CSWI2.Pos", "DPC", "Status only");
+        foreach (var signal in new[] { readOnly, cswi, tap })
+            device.Signals.Add(signal);
+        device.RecountSelectedSignals();
+        var snapshots = device.CommandSignals.ToArray();
+        var collectionChanges = 0;
+        device.CommandSignals.CollectionChanged += (_, _) => collectionChanges++;
+        for (var i = 0; i < 100; i++)
+            device.RefreshCommandSignalProjection();
+        Assert.True(device.CommandSignals.SequenceEqual(
+            snapshots, ReferenceEqualityComparer.Instance));
+        Assert.Equal(0, collectionChanges);
+    }
+
+    [Fact]
+    public void ExistingSemanticRolesStayUnmodified_OnlyPresentationOrderChanges()
+    {
+        var tap = Control("IED/ATCC1.TapChg", "BSC", Direct, verified: true);
+        var cswi = Control("IED/CSWI1.Pos", "DPC", Direct, verified: true);
+        var status = Control("IED/CSWI2.Pos", "DPC", "Status only");
+        Assert.Equal(40, Iec61850ControlIdentity.CommandDockPriority(tap));
+        Assert.True(Iec61850ControlIdentity.CommandDockDisplayPriority(tap) <
+                    Iec61850ControlIdentity.CommandDockPriority(tap));
+        Assert.True(Iec61850ControlIdentity.CommandDockDisplayPriority(tap) <
+                    Iec61850ControlIdentity.CommandDockDisplayPriority(cswi));
+        Assert.True(Iec61850ControlIdentity.CommandDockDisplayPriority(status) >
+                    Iec61850ControlIdentity.CommandDockDisplayPriority(cswi));
+        Assert.Contains("Tap changer", tap.ControlDockRole);
+        Assert.False(status.ControlSupportsOperate);
+    }
+}
diff --git a/tests/ARSAS.Tests/ControlFatEvidenceExportTests.cs b/tests/ARSAS.Tests/ControlFatEvidenceExportTests.cs
new file mode 100644
index 000000000..17d5a9235
--- /dev/null
+++ b/tests/ARSAS.Tests/ControlFatEvidenceExportTests.cs
@@ -0,0 +1,77 @@
+using System.Xml.Linq;
+using ArIED61850Tester.Models;
+
+namespace ARSAS.Tests;
+
+public sealed class ControlFatEvidenceExportTests
+{
+    [Fact]
+    public void EvidenceSnapshot_IsDeterministic_AndLabelsWireVsIndependentFeedback()
+    {
+        var e = new Iec61850ControlFatEvidence(
+            new DateTimeOffset(2026, 10, 23, 8, 0, 0, TimeSpan.Zero),
+            "IED-A • 192.0.2.10:102", "LD0/CSWI1.Pos", "DPC", "SBO enhanced",
+            "Open", "Closed [10]", "StationControl", "ARSAS",
+            true, false, false, "Feedback not verified",
+            "IED accepted; independent process feedback not verified.",
+            "23", "Positive", "SBOw ✓ → Operate ✓ → Termination ✓",
+            "LastApplError: none\nMMS request: A1");
+        var text = e.ToClipboardText();
+        Assert.Contains("2026-10-23T08:00:00.0000000+00:00", text);
+        Assert.Contains("LD0/CSWI1.Pos", text);
+        Assert.Contains("Requested value: Closed [10]", text);
+        Assert.Contains("Origin: StationControl / ARSAS", text);
+        Assert.Contains("ctlNum: 23", text);
+        Assert.Contains("CommandTermination: Positive", text);
+        Assert.Contains("MMS steps (evidence only)", text);
+        Assert.Contains("LastApplError: none", text);
+        Assert.Contains("MMS service acceptance does not prove primary equipment movement", text);
+    }
+
+    [Fact]
+    public void SingleLineIdentifiers_CannotImpersonateOtherEvidenceFields()
+    {
+        var e = new Iec61850ControlFatEvidence(
+            DateTimeOffset.UnixEpoch, "IED-1\nResult: confirmed",
+            "LD0/CSWI1.Pos", "DPC", "SBO", "", "",
+            "StationControl", "ARSAS", true, false, false,
+            "Not sent", "No command", "Auto", "—", "", "");
+        var output = e.ToClipboardText();
+        Assert.Contains("IED: IED-1 Result: confirmed", output);
+        Assert.DoesNotContain("IED-1\nResult: confirmed", output);
+    }
+
+    [Fact]
+    public void PopupCopyEvidence_IsDisabledDuringFlightAndPerformsNoMmsIo()
+    {
+        var markup = ReadSource("ControlCommandWindow.xaml");
+        XDocument.Parse(markup);
+        Assert.Contains("Content=\"Copy evidence\"", markup);
+        Assert.Contains("Click=\"CopyEvidence_Click\"", markup);
+        Assert.Contains("IsEnabled=\"{Binding CanCopyEvidence}\"", markup);
+        var source = ReadSource("ControlCommandWindow.xaml.cs");
+        Assert.Contains("Clipboard.SetText(snapshot.ToClipboardText())", source);
+        Assert.Contains("!_commandFlightActive", source);
+        Assert.Contains("ControlEvidenceText = string.Empty; // Do not export stale association evidence.", source);
+        var handler = source.Split("private void CopyEvidence_Click(")[1]
+            .Split("private void Close_Click(", StringSplitOptions.None)[0];
+        Assert.DoesNotContain("ExecuteControlAsync(", handler);
+        Assert.DoesNotContain("InspectControlAsync(", handler);
+        Assert.DoesNotContain("OperateAsync(", handler);
+        Assert.DoesNotContain("WriteBrowser", handler);
+        Assert.DoesNotContain("CancelAsync(", handler);
+        Assert.DoesNotContain("SelectAsync(", handler);
+    }
+
+    private static string ReadSource(string file)
+    {
+        DirectoryInfo? directory = new(AppContext.BaseDirectory);
+        while (directory is not null)
+        {
+            var path = Path.Combine(directory.FullName, file);
+            if (File.Exists(path)) return File.ReadAllText(path);
+            directory = directory.Parent;
+        }
+        throw new FileNotFoundException(file);
+    }
+}
diff --git a/tests/ARSAS.Tests/ControlModelWriteAcceptanceTests.cs b/tests/ARSAS.Tests/ControlModelWriteAcceptanceTests.cs
new file mode 100644
index 000000000..30b19c320
--- /dev/null
+++ b/tests/ARSAS.Tests/ControlModelWriteAcceptanceTests.cs
@@ -0,0 +1,96 @@
+using System.Xml.Linq;
+
+namespace ARSAS.Tests;
+
+/// <summary>
+/// Regression contracts for the dedicated CF ctlModel editor. The native
+/// semantic gate is tested separately by the control service suite; these
+/// tests defend operator affordances and reconnect safety at the WPF seam.
+/// </summary>
+public sealed class ControlModelWriteAcceptanceTests
+{
+    private static readonly XNamespace P = "http://schemas.microsoft.com/winfx/2006/xaml/presentation";
+
+    private static string Source(string path)
+    {
+        for (var dir = new DirectoryInfo(AppContext.BaseDirectory); dir != null; dir = dir.Parent)
+        {
+            var file = Path.Combine(dir.FullName, path);
+            if (File.Exists(file)) return File.ReadAllText(file);
+        }
+        throw new FileNotFoundException(path);
+    }
+
+    [Fact]
+    public void SingleCfEditorHasOneInlineDropdownAndPersistentMaterialActionFooter()
+    {
+        var window = XDocument.Parse(Source("ControlModelWriteWindow.xaml"));
+        var root = Assert.IsType<XElement>(window.Root);
+        Assert.Equal(P + "Window", root.Name);
+        Assert.Equal("Write Data to IED", (string?)root.Attribute("Title"));
+        Assert.Equal("CanResize", (string?)root.Attribute("ResizeMode"));
+        Assert.Equal("{StaticResource AppFontFamily}", (string?)root.Attribute("FontFamily"));
+        Assert.Equal("450", (string?)root.Attribute("MaxHeight"));
+
+        var picker = Assert.Single(window.Descendants(P + "ComboBox"));
+        Assert.Equal("ModelPicker", (string?)picker.Attribute(XName.Get("Name",
+            "http://schemas.microsoft.com/winfx/2006/xaml")));
+        Assert.Equal("{Binding Choices}", (string?)picker.Attribute("ItemsSource"));
+        Assert.Equal("False", (string?)picker.Attribute("IsEnabled"));
+        Assert.Contains(window.Descendants(P + "TextBlock"), x => (string?)x.Attribute("Text") == "Name");
+        Assert.Contains(window.Descendants(P + "TextBlock"), x => (string?)x.Attribute("Text") == "Value");
+        Assert.Contains(window.Descendants(P + "TextBlock"), x => (string?)x.Attribute("Text") == "ctlModel [CF]");
+        Assert.All(window.Descendants(P + "TextBox"), x =>
+            Assert.Equal("True", (string?)x.Attribute("IsReadOnly")));
+
+        var button = Assert.Single(window.Descendants(P + "Button").Where(x =>
+            (string?)x.Attribute("Click") == "Write_Click"));
+        Assert.Equal("94", (string?)button.Attribute("Width"));
+        Assert.Equal("3", (string?)button.Parent?.Attribute("Grid.Row"));
+        Assert.Contains(button.Descendants(P + "TextBlock"), x =>
+            (string?)x.Attribute("Text") == "Write");
+        Assert.Contains(button.Descendants(P + "Path"), x =>
+            (string?)x.Attribute("Data") == "{StaticResource MaterialEditIcon}");
+        Assert.Contains(window.Descendants(P + "Path"), x =>
+            (string?)x.Attribute("Data") == "{StaticResource MaterialRefreshIcon}");
+        Assert.Contains(window.Descendants(P + "Path"), x =>
+            (string?)x.Attribute("Data") == "{StaticResource MaterialCloseIcon}");
+
+        var scrolling = Assert.Single(window.Descendants(P + "ScrollViewer"));
+        Assert.Equal("2", (string?)scrolling.Attribute("Grid.Row"));
+        Assert.Equal("Auto", (string?)scrolling.Attribute("VerticalScrollBarVisibility"));
+        var resources = Source("App.xaml");
+        Assert.Contains("x:Key=\"MaterialEditIcon\"", resources);
+        Assert.Contains("x:Key=\"MaterialRefreshIcon\"", resources);
+        Assert.Contains("x:Key=\"MaterialCloseIcon\"", resources);
+    }
+
+    [Fact]
+    public void ControlModelWriteUsesOneExplicitClick_LiveAssociationAndReadbackToast()
+    {
+        var source = Source("ControlModelWriteWindow.xaml.cs");
+        var requireRead = source.IndexOf("_inspectedAssociation = association", StringComparison.Ordinal);
+        var requireModel = source.IndexOf("_inspectedLiveModel = model", StringComparison.Ordinal);
+        var dispatchGuard = source.IndexOf("if (!InspectionIsCurrent", StringComparison.Ordinal);
+        var dispatch = source.IndexOf("ConfigureExactModelAsync(expected, selected.Model", StringComparison.Ordinal);
+        Assert.True(requireRead >= 0 && requireModel >= 0);
+        Assert.True(dispatchGuard > requireModel);
+        Assert.True(dispatch > dispatchGuard);
+        Assert.Contains("ReferenceEquals(_device.LiveDiscoveryModel, _inspectedLiveModel)", source);
+        Assert.Contains("_device.LiveValues.Association == _inspectedAssociation", source);
+        Assert.DoesNotContain("MessageBox.Show(", source);
+        Assert.Contains("await ReadModelAsync();", source);
+        Assert.Contains("VerifiedWriteOccurred = true;", source);
+        Assert.Contains("ResultBanner.Background", source);
+        Assert.DoesNotContain("OperateAsync(", source);
+        Assert.DoesNotContain("WriteDataAttributeAsync(", source);
+
+        var xaml = Source("ControlModelWriteWindow.xaml");
+        Assert.Contains("x:Name=\"ResultBanner\"", xaml);
+        Assert.DoesNotContain("x:Name=\"FailureDetails\"", xaml);
+        var bridge = Source("Services/Iec61850ControlModelWriteDispatcher.cs");
+        Assert.Contains("runtime.ConfigureControlModelAsync", bridge);
+        Assert.DoesNotContain("WriteDataAttributeAsync(", bridge);
+    }
+
+}
diff --git a/tests/ARSAS.Tests/ControlOutcomePresentationTests.cs b/tests/ARSAS.Tests/ControlOutcomePresentationTests.cs
new file mode 100644
index 000000000..7d6f90610
--- /dev/null
+++ b/tests/ARSAS.Tests/ControlOutcomePresentationTests.cs
@@ -0,0 +1,143 @@
+using ArIED61850Tester.Models;
+
+namespace ARSAS.Tests;
+
+public sealed class ControlOutcomePresentationTests
+{
+    private static Iec61850ControlCommandResult Outcome(
+        string completion = "Accepted", bool service = false, bool success = false,
+        bool feedback = false, bool termination = false, bool positive = false,
+        IReadOnlyList<Iec61850ControlWireEvidence>? wire = null) => new()
+        {
+            CompletionState = completion, ServiceAccepted = service,
+            IsSuccess = success, FeedbackConfirmed = feedback,
+            CommandTerminationReceived = termination, PositiveTermination = positive,
+            WireSteps = wire ?? Array.Empty<Iec61850ControlWireEvidence>()
+        };
+
+    [Fact]
+    public void ServiceAccepted_ButNoFeedback_NeverClaimsIedRejectionOrPhysicalSuccess()
+    {
+        var view = Iec61850ControlOutcomePresentation.From(
+            Outcome(completion: "PositiveTermination", service: true, success: false,
+                feedback: false, termination: true, positive: true), false);
+        Assert.Equal("Feedback not verified", view.Stage);
+        Assert.Equal("Warning", view.Tone);
+        Assert.Contains("independent process feedback", view.Summary);
+    }
+
+    [Fact]
+    public void VerifiedFeedback_IsTheOnlyPhysicalSuccessDisplay()
+    {
+        var view = Iec61850ControlOutcomePresentation.From(
+            Outcome(service: true, success: true, feedback: true), false);
+        Assert.Equal("Feedback confirmed", view.Stage);
+        Assert.Equal("Success", view.Tone);
+    }
+
+    [Theory]
+    [InlineData("TimedOut")]
+    [InlineData("AssociationLost")]
+    [InlineData("Unknown")]
+    [InlineData("Cancelled")]
+    public void AmbiguousWireOutcome_IsNotMisreportedAsIedRejection(string completion)
+    {
+        var view = Iec61850ControlOutcomePresentation.From(
+            Outcome(completion, service: false), false);
+        Assert.Equal("Outcome uncertain", view.Stage);
+        Assert.Equal("Warning", view.Tone);
+    }
+
+    [Fact]
+    public void ExplicitNegativeTermination_IsDefinitive()
+    {
+        var view = Iec61850ControlOutcomePresentation.From(
+            Outcome("NegativeTermination", service: true,
+                termination: true, positive: false), false);
+        Assert.Equal("Negative termination", view.Stage);
+        Assert.Equal("Error", view.Tone);
+    }
+
+    [Fact]
+    public void RejectedSelect_DoesNotClaimOperate()
+    {
+        var view = Iec61850ControlOutcomePresentation.From(
+            Outcome("Rejected", wire: new[] { new Iec61850ControlWireEvidence
+                { Action = "SelectWithValue", RequestAccepted = false } }), false);
+        Assert.Equal("IED rejected", view.Stage);
+    }
+
+    [Fact]
+    public void TestAccepted_IsNotPhysicalFeedback()
+    {
+        var view = Iec61850ControlOutcomePresentation.From(
+            Outcome("Accepted", service: true, success: true), true);
+        Assert.Equal("Test response accepted", view.Stage);
+        Assert.Equal("Warning", view.Tone);
+    }
+
+    [Fact]
+    public void WireTimeline_UsesOnlyActualWireStepsAndTerminatesFromEvidence()
+    {
+        var result = Outcome("PositiveTermination", service: true,
+            termination: true, positive: true,
+            wire: new[]
+            {
+                new Iec61850ControlWireEvidence
+                    { Action = "SelectWithValue", RequestAccepted = true },
+                new Iec61850ControlWireEvidence
+                    { Action = "Operate", RequestAccepted = true }
+            });
+        var text = Iec61850ControlOutcomePresentation.WireTimeline(result);
+        Assert.Equal("SBOw ✓  →  Operate ✓  →  Termination ✓", text);
+        Assert.DoesNotContain("feedback", text, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void WireTimeline_NoReportedSteps_MustNotInventSelectOrOperate()
+    {
+        Assert.Equal("", Iec61850ControlOutcomePresentation.WireTimeline(Outcome()));
+        var negative = Outcome("Rejected", wire: new[]
+        {
+            new Iec61850ControlWireEvidence
+                { Action = "Select", RequestAccepted = false }
+        });
+        Assert.Equal("Select rejected", Iec61850ControlOutcomePresentation.WireTimeline(negative));
+    }
+
+    [Fact]
+    public void AlreadyInPosition_IsVerifiedLiveNoOp_NotACommandOrWireSuccess()
+    {
+        var result = new Iec61850ControlCommandResult
+        {
+            IsSuccess = true,
+            ServiceAccepted = false,
+            FeedbackConfirmed = true,
+            CompletionState = "NotSent",
+            Stage = "Already at requested state"
+        };
+        var view = Iec61850ControlOutcomePresentation.From(result, false);
+        Assert.Equal("Already in position", view.Stage);
+        Assert.Equal("Ready", view.Tone);
+        Assert.Contains("No Select or Operate was sent", view.Summary);
+        Assert.Empty(result.WireSteps);
+    }
+
+    [Fact]
+    public void EncodedControlButNoProvenResponse_IsNotRejection()
+    {
+        var view = Iec61850ControlOutcomePresentation.From(
+            Outcome(completion: "WireStateUnknown", service: false), false);
+        Assert.Equal("Outcome uncertain", view.Stage);
+        Assert.Equal("Warning", view.Tone);
+    }
+
+    [Fact]
+    public void NoDispatchAndNoKnownOutcome_AreDifferent()
+    {
+        Assert.Equal("Not sent",
+            Iec61850ControlOutcomePresentation.From(Outcome("NotSent"), false).Stage);
+        Assert.Equal("Outcome unresolved",
+            Iec61850ControlOutcomePresentation.From(Outcome("Unexpected"), false).Stage);
+    }
+}
diff --git a/tests/ARSAS.Tests/ControlPopupCompactUxTests.cs b/tests/ARSAS.Tests/ControlPopupCompactUxTests.cs
new file mode 100644
index 000000000..982073686
--- /dev/null
+++ b/tests/ARSAS.Tests/ControlPopupCompactUxTests.cs
@@ -0,0 +1,122 @@
+using System.Xml.Linq;
+using ArIED61850Tester;
+
+namespace ARSAS.Tests;
+
+public sealed class ControlPopupCompactUxTests
+{
+    private static string Source(string name)
+    {
+        DirectoryInfo? directory = new(AppContext.BaseDirectory);
+        while (directory is not null)
+        {
+            var file = Path.Combine(directory.FullName, name);
+            if (File.Exists(file)) return File.ReadAllText(file);
+            directory = directory.Parent;
+        }
+        throw new FileNotFoundException(name);
+    }
+
+    [Fact]
+    public void CompactPopup_UsesArsasTypographyBoundedScrollableContentAndPinnedActionRow()
+    {
+        var xml = XDocument.Parse(Source("ControlCommandWindow.xaml"));
+        XNamespace p = "http://schemas.microsoft.com/winfx/2006/xaml/presentation";
+        XNamespace x = "http://schemas.microsoft.com/winfx/2006/xaml";
+        Assert.Equal("565", xml.Root!.Attribute("Width")?.Value);
+        Assert.Equal("{StaticResource AppFontFamily}", xml.Root.Attribute("FontFamily")?.Value);
+        var scroll = xml.Descendants(p + "ScrollViewer").Single();
+        Assert.Equal("2", scroll.Attribute("Grid.Row")?.Value);
+        Assert.Equal("Auto", scroll.Attribute("VerticalScrollBarVisibility")?.Value);
+        var send = xml.Descendants(p + "Button").Single(b => (string?)b.Attribute(x + "Name") == "SendCommandButton");
+        Assert.Equal("4", send.Parent?.Attribute("Grid.Row")?.Value);
+        Assert.Equal("{Binding CanSend}", send.Attribute("IsEnabled")?.Value);
+        var footer = send.Parent!;
+        Assert.Equal("4", footer.Attribute("Grid.Row")?.Value);
+        Assert.Contains(footer.Elements(p + "Button"), b => b.Attribute("Content")?.Value == "Close" &&
+            b.Attribute("IsEnabled")?.Value == "{Binding CanClose}");
+        Assert.Contains(xml.Descendants(p + "Border"), n => (string?)n.Attribute(x + "Name") == "LiveCommandWarning");
+        Assert.Contains(xml.Descendants(p + "Border"), n => (string?)n.Attribute(x + "Name") == "ResultPanel" &&
+            n.Attribute("Grid.Row")?.Value == "3");
+    }
+
+    [Fact]
+    public void AdvancedParameters_AreCollapsedButBoundToNativeRequestAndResponse()
+    {
+        var xml = XDocument.Parse(Source("ControlCommandWindow.xaml"));
+        XNamespace p = "http://schemas.microsoft.com/winfx/2006/xaml/presentation";
+        var advanced = xml.Descendants(p + "Expander").Single(e =>
+            ((string?)e.Attribute("Header"))?.StartsWith("Advanced", StringComparison.Ordinal) == true);
+        var markup = advanced.ToString();
+        Assert.Contains("SelectedOriginCategory", markup);
+        Assert.Contains("OriginatorId", markup);
+        Assert.Contains("ControlNumberText", markup);
+        Assert.Contains("TerminationText", markup);
+        Assert.Contains("ControlEvidenceText", markup);
+        var code = Source("ControlCommandWindow.xaml.cs");
+        Assert.Contains("Originator = OriginatorId.Trim()", code);
+        Assert.Contains("OriginCategory = SelectedOriginCategory", code);
+        Assert.Contains("ControlNumberText = result.ControlNumber", code);
+        Assert.Contains("result.CommandTerminationReceived", code);
+        Assert.Contains("BuildCommandResultText(result)", code);
+    }
+
+    [Fact]
+    public void SinglePrimaryAction_PreservesNativeSboSequenceAndDoesNotFakeSelectCancel()
+    {
+        var markup = Source("ControlCommandWindow.xaml");
+        var source = Source("ControlCommandWindow.xaml.cs");
+        Assert.Contains("Native: Select → Operate", source);
+        Assert.Contains("Select → Operate", source);
+        Assert.Contains("new Iec61850ControlCommandRequest", source);
+        Assert.Contains("_runtime.ExecuteControlAsync(", source);
+        Assert.Contains("MessageBoxResult.Yes", source);
+        Assert.DoesNotContain("SelectAsync(", source);
+        Assert.DoesNotContain("CancelAsync(", source);
+        Assert.Contains("IsBusy", source);
+        Assert.Contains("e.Cancel = true;", source);
+        Assert.Contains("IsEnabled=\"{Binding CanClose}\"", markup);
+    }
+
+    [Fact]
+    public void TestFlag_NeverBypassesExplicitControlAuthorization()
+    {
+        var code = Source("ControlCommandWindow.xaml.cs");
+        var start = code.IndexOf("public bool CanSend =>", StringComparison.Ordinal);
+        Assert.True(start >= 0);
+        var section = code[start..code.IndexOf("public ControlCommandWindow(", start, StringComparison.Ordinal)];
+        Assert.Contains("ConfirmLiveCommand;", section);
+        Assert.DoesNotContain("TestMode || ConfirmLiveCommand", section);
+        Assert.Contains("LiveCommandWarning.Visibility = IsReady ?", code);
+        Assert.Contains("if (TestMode)", code);
+        Assert.Contains("ConfirmLiveCommand = false;", code);
+    }
+
+    [Fact]
+    public void ControlAttempt_ConsumesAuthorizationUntilFreshReadOnlyInspection()
+    {
+        var xaml = Source("ControlCommandWindow.xaml");
+        var code = Source("ControlCommandWindow.xaml.cs");
+        Assert.Contains("Content=\"Reinspect\"", xaml);
+        Assert.Contains("Click=\"Reinspect_Click\"", xaml);
+        Assert.Contains("IsEnabled=\"{Binding CanReinspect}\"", xaml);
+        Assert.Contains("_commandAttempted = true;", code);
+        Assert.Contains("!_commandAttempted", code);
+        Assert.Contains("private async void Reinspect_Click(", code);
+        Assert.Contains("await InspectAsync();", code);
+        Assert.Contains("_commandAttempted = false;", code);
+        Assert.Contains("SelectedValue = string.Empty;", code);
+        Assert.Contains("ConfirmLiveCommand = false;", code);
+        Assert.DoesNotContain("SelectedValue = ValueOptions.FirstOrDefault()", code);
+    }
+
+    [Theory]
+    [InlineData("ARSAS", true)]
+    [InlineData("Station-Engineer_1", true)]
+    [InlineData("", false)]
+    [InlineData("   ", false)]
+    [InlineData("é", false)]
+    [InlineData("line\nfeed", false)]
+    public void OriginIdentifier_IsPrintableAsciiOnly(string value, bool expected)
+        => Assert.Equal(expected, ControlCommandWindow.IsValidOriginator(value));
+}
diff --git a/tests/ARSAS.Tests/DiscoveryEndpointPreferenceRegressionTests.cs b/tests/ARSAS.Tests/DiscoveryEndpointPreferenceRegressionTests.cs
index 0b079d1d2..39d198044 100644
--- a/tests/ARSAS.Tests/DiscoveryEndpointPreferenceRegressionTests.cs
+++ b/tests/ARSAS.Tests/DiscoveryEndpointPreferenceRegressionTests.cs
@@ -103,16 +103,18 @@ public void Dialog_UsesPersistedEndpointAheadOfCallerSelection_AndCommitsOnlyVal
         Assert.Contains("if (_rememberDiscoveryEndpoint &&", wizard);
         Assert.Contains("if (_rememberDiscoveryEndpoint)", wizard);
         Assert.Contains("TryLoadLastDiscoveryEndpoint(out var lastIp, out var lastPort)", wizard);
-        Assert.Contains("RelayIpAddress = lastIp;", wizard);
-        Assert.Contains("MmsPortText = lastPort.ToString(CultureInfo.InvariantCulture);", wizard);
-        Assert.Contains("RelayIpAddress = RelayIpBox.Text.Trim();", wizard);
+        Assert.Contains("UserPreferenceStore.LoadRecentEndpointDetails()", wizard);
         Assert.Contains("RecordLastDiscoveryEndpoint(RelayIpAddress, MmsPort)", wizard);
-        var validateIp = wizard.IndexOf("System.Net.IPAddress.TryParse", StringComparison.Ordinal);
+        Assert.Contains("TryNormalizeIpv4Octets(", wizard);
+        Assert.Contains("IPAddress.TryParse(submittedAddress", wizard);
+        Assert.Contains("x:Name=\"Octet1Box\"", xaml);
+        Assert.Contains("x:Name=\"Octet4Box\"", xaml);
+        Assert.Contains("x:Name=\"HistoryPopup\"", xaml);
+        Assert.Contains("UpdateSourceTrigger=LostFocus", xaml);
         var validatePort = wizard.IndexOf("port is <= 0 or > 65535", StringComparison.Ordinal);
         var commit = wizard.IndexOf("RecordLastDiscoveryEndpoint(RelayIpAddress, MmsPort)", StringComparison.Ordinal);
-        Assert.True(validateIp >= 0 && validateIp < validatePort && validatePort < commit);
-        Assert.Contains("IsEditable=\"True\" IsTextSearchEnabled=\"False\"", xaml);
-        Assert.Contains("UpdateSourceTrigger=LostFocus", xaml);
+        Assert.True(validatePort >= 0 && validatePort < commit);
+        Assert.DoesNotContain("UserPreferenceStore.RecordSuccessfulEndpoint", wizard);
     }
 
     private static void WithTemporaryPreferences(Action<string> action)
diff --git a/tests/ARSAS.Tests/FastWorkflowRegressionTests.cs b/tests/ARSAS.Tests/FastWorkflowRegressionTests.cs
index 84e26b381..b78a55a6e 100644
--- a/tests/ARSAS.Tests/FastWorkflowRegressionTests.cs
+++ b/tests/ARSAS.Tests/FastWorkflowRegressionTests.cs
@@ -30,7 +30,7 @@ public void VisibleGooseCapabilityPill_OpensCorrectTabAndArmsOneShotAdapterAutoS
         Assert.DoesNotContain("Fast IEC 61850 Control", mainView, StringComparison.Ordinal);
         Assert.DoesNotContain("Operate only the validated control objects selected for this IED.", mainView, StringComparison.Ordinal);
         Assert.DoesNotContain("Click=\"RefreshCommandValues_Click\"", mainView, StringComparison.Ordinal);
-        Assert.Contains("SelectedDevice.CommandSignals", mainView, StringComparison.Ordinal);
+        Assert.Contains("SelectedDevice.OperableCommandSignals", mainView, StringComparison.Ordinal);
     }
 
     [Fact]
diff --git a/tests/ARSAS.Tests/FieldRegressionFixTests.cs b/tests/ARSAS.Tests/FieldRegressionFixTests.cs
index 48812ef4e..45787e921 100644
--- a/tests/ARSAS.Tests/FieldRegressionFixTests.cs
+++ b/tests/ARSAS.Tests/FieldRegressionFixTests.cs
@@ -4,6 +4,7 @@
 
 namespace ARSAS.Tests;
 
+[Collection("WpfStaIsolation")]
 public sealed class FieldRegressionFixTests
 {
     [Fact]
@@ -61,7 +62,11 @@ public void TopBar_ParentContainersCannotClipResponsiveNavigation()
         Assert.Contains("root.ClipToBounds = false", source, StringComparison.Ordinal);
         Assert.Contains("header.ClipToBounds = false", source, StringComparison.Ordinal);
         Assert.Contains("header.MinHeight = 68d", source, StringComparison.Ordinal);
-        Assert.Contains("shell.Height = 64d", source, StringComparison.Ordinal);
+        // NavigationLayoutFix is the sole geometry authority (60px).
+        // The clipping guard may not reassert a competing 64px height.
+        var navigation = File.ReadAllText(FindRepoFile("MainWindow.NavigationLayoutFix.cs"));
+        Assert.Contains("shell.Height = 60;", navigation, StringComparison.Ordinal);
+        Assert.DoesNotContain("shell.Height = 64d", source, StringComparison.Ordinal);
         Assert.Contains("shell.ClipToBounds = false", source, StringComparison.Ordinal);
         Assert.Contains("DispatcherPriority.ContextIdle", source, StringComparison.Ordinal);
     }
diff --git a/tests/ARSAS.Tests/G1ControlCorrectnessRegressionTests.cs b/tests/ARSAS.Tests/G1ControlCorrectnessRegressionTests.cs
index 50141a253..386bb18d3 100644
--- a/tests/ARSAS.Tests/G1ControlCorrectnessRegressionTests.cs
+++ b/tests/ARSAS.Tests/G1ControlCorrectnessRegressionTests.cs
@@ -20,7 +20,8 @@ public void OperateSuccess_DoesNotInjectCommandFeedbackIntoMonitoredProcessState
         Assert.DoesNotContain("FindPointForControlFeedback", runtimeSource, StringComparison.Ordinal);
         Assert.Contains("A real IED report is therefore never suppressed", runtimeSource, StringComparison.Ordinal);
         Assert.DoesNotContain("CurrentValue = result.FeedbackValue", commandWindowSource, StringComparison.Ordinal);
-        Assert.Contains("Waiting for independent IED process feedback", commandWindowSource, StringComparison.Ordinal);
+        Assert.Contains("Iec61850ControlOutcomePresentation.From(result, TestMode)", commandWindowSource, StringComparison.Ordinal);
+        Assert.Contains("result.FeedbackConfirmed", File.ReadAllText(Path.Combine(root, "Models", "Iec61850ControlOutcomePresentation.cs")), StringComparison.Ordinal);
         Assert.Contains("not process-image authority", runtimeSource, StringComparison.Ordinal);
     }
 
@@ -129,7 +130,9 @@ public void G11_FieldRejection_IsExplicitAndManualOriginIsStationControl()
         var runtime = File.ReadAllText(Path.Combine(RepoRoot(), "Services", "Iec61850MonitorRuntime.cs"));
 
         Assert.Contains("OriginCategory { get; init; } = \"StationControl\"", model, StringComparison.Ordinal);
-        Assert.Contains("OriginCategory = \"StationControl\"", dialog, StringComparison.Ordinal);
+        Assert.Contains("_selectedOriginCategory = \"StationControl\"", dialog, StringComparison.Ordinal);
+        Assert.Contains("OriginCategory = SelectedOriginCategory", dialog, StringComparison.Ordinal);
+        Assert.Contains("Originator = OriginatorId.Trim()", dialog, StringComparison.Ordinal);
         Assert.Contains("OriginCategory = \"StationControl\"", main, StringComparison.Ordinal);
         Assert.DoesNotContain("OriginCategory = \"Maintenance\"", dialog, StringComparison.Ordinal);
         Assert.DoesNotContain("OriginCategory = \"Maintenance\"", main, StringComparison.Ordinal);
diff --git a/tests/ARSAS.Tests/Iec61850ValueFormatterTests.cs b/tests/ARSAS.Tests/Iec61850ValueFormatterTests.cs
index c196ad5b6..bb3308120 100644
--- a/tests/ARSAS.Tests/Iec61850ValueFormatterTests.cs
+++ b/tests/ARSAS.Tests/Iec61850ValueFormatterTests.cs
@@ -160,6 +160,45 @@ public void FormatReportProcessValue_DoesNotCollapseIndexedStructureWithoutNumer
                 value, "Structure", string.Empty, "Measurement", "IEDLD/GGIO1.Raw"));
     }
 
+    [Theory]
+    [InlineData("0", "0")]
+    [InlineData("1", "1")]
+    [InlineData(0, "0")]
+    [InlineData(1, "1")]
+    [InlineData(-3, "-3")]
+    [InlineData(63, "63")]
+    [InlineData("-64", "-64")]
+    public void BscValWithTrans_PosValPreservesActualSignedInteger_NotBoolean(
+        object raw, string expected)
+    {
+        // Even an erroneous older Boolean/SPC discovery hint cannot override
+        // the exact IEC 61850 ValWithTrans.posVal semantic status leaf.
+        Assert.Equal(expected, Iec61850ValueFormatter.FormatReportProcessValue(
+            raw, "Boolean", "", "Status",
+            "ZIVAVRLD1/ATCC1.TapChg.valWTr.posVal"));
+    }
+
+    [Theory]
+    [InlineData(true, "true (BSC INT8 type mismatch)")]
+    [InlineData(false, "false (BSC INT8 type mismatch)")]
+    [InlineData("64", "64")]
+    public void BscStepDisplay_NeverConvertsBooleanEvidenceToInventedPosition(
+        object raw, string expected)
+    {
+        Assert.Equal(expected, Iec61850ValueFormatter.FormatReportProcessValue(
+            raw, "BSC", "", "Status",
+            "ZIVAVRLD1/ATCC1.TapChg.valWTr.posVal"));
+    }
+
+    [Fact]
+    public void NumericNonBscScalar_DoesNotChangeExistingBooleanContract()
+    {
+        Assert.Equal("True [1]", Iec61850ValueFormatter.FormatReportProcessValue(
+            "1", "Boolean", "", "Status", "IED/GGIO1.Ind1.stVal"));
+        Assert.False(Iec61850ValueFormatter.IsBscStepPosition(
+            "IED/CSWI1.Pos.stVal", "DPC"));
+    }
+
     [Fact]
     public void Format_Does_Not_Collapse_NonStVal_Structures()
     {
diff --git a/tests/ARSAS.Tests/IedBrowserBatchWriteEditorTests.cs b/tests/ARSAS.Tests/IedBrowserBatchWriteEditorTests.cs
new file mode 100644
index 000000000..064099e26
--- /dev/null
+++ b/tests/ARSAS.Tests/IedBrowserBatchWriteEditorTests.cs
@@ -0,0 +1,104 @@
+using System.Xml.Linq;
+using AR.Iec61850.Mms;
+using ArIED61850Tester;
+
+namespace ARSAS.Tests;
+
+public sealed class IedBrowserBatchWriteEditorTests
+{
+    [Fact]
+    public void BatchRows_StartUnselected_AndRequireExplicitNewValueEdit()
+    {
+        var row = new BrowserBatchWriteRow(
+            MmsObjectReference.Parse("LD0/LLN0.Mod.sboTimeout", "CF"),
+            "LD0/LLN0.Mod.sboTimeout", "CF", true, "Inspect first");
+        Assert.False(row.Selected);
+        Assert.False(row.HasEdited);
+        Assert.True(row.Eligible);
+        var changed = new List<string?>();
+        row.PropertyChanged += (_, args) => changed.Add(args.PropertyName);
+
+        row.Selected = true;
+        Assert.False(row.HasEdited);
+        row.NewValue = "250";
+        Assert.True(row.HasEdited);
+        Assert.Contains(nameof(BrowserBatchWriteRow.Selected), changed);
+        Assert.Contains(nameof(BrowserBatchWriteRow.NewValue), changed);
+    }
+
+    [Fact]
+    public void BatchWindow_RealXamlKeepsScrolledRowsAndPinnedFooter()
+    {
+        var root = XDocument.Parse(File.ReadAllText(Find("BrowserBatchWriteWindow.xaml")));
+        XNamespace p = "http://schemas.microsoft.com/winfx/2006/xaml/presentation";
+        XNamespace x = "http://schemas.microsoft.com/winfx/2006/xaml";
+
+        var grid = root.Descendants(p + "DataGrid").Single(d =>
+            (string?)d.Attribute(x + "Name") == "RowsGrid");
+        Assert.Equal("2", grid.Attribute("Grid.Row")?.Value);
+        Assert.Equal("Auto", grid.Attribute("ScrollViewer.VerticalScrollBarVisibility")?.Value);
+        Assert.Equal("True", grid.Attribute("VirtualizingPanel.IsVirtualizing")?.Value);
+
+        var footer = root.Descendants(p + "Grid").Single(d =>
+            d.Attribute("Grid.Row")?.Value == "3" && d.Descendants(p + "Button")
+                .Any(b => (string?)b.Attribute(x + "Name") == "WriteButton"));
+        Assert.Contains(footer.Descendants(p + "Button"), b =>
+            (string?)b.Attribute(x + "Name") == "InspectButton");
+        Assert.Contains(footer.Descendants(p + "Button"), b =>
+            (string?)b.Attribute(x + "Name") == "WriteButton" &&
+            (string?)b.Attribute("IsEnabled") == "False");
+
+        var selection = root.Descendants(p + "CheckBox").Single();
+        Assert.Equal("{Binding Eligible}", selection.Attribute("IsEnabled")?.Value);
+        Assert.Contains(root.Descendants(p + "TextBox"), input =>
+            (string?)input.Attribute("Text") ==
+            "{Binding NewValue, Mode=TwoWay, UpdateSourceTrigger=PropertyChanged}");
+    }
+
+    [Fact]
+    public void DoEditor_UsesSameSessionRuntimeAndNeverDispatchesOnFocusOrInspect()
+    {
+        var source = File.ReadAllText(Find("BrowserBatchWriteWindow.xaml.cs"));
+        var click = File.ReadAllText(Find("MainWindow.IedBrowser.TypedDataWrite.cs"));
+        Assert.Contains("BrowserWritableSelectedDo()", click);
+        Assert.Contains("new BrowserBatchWriteWindow(_runtime, device, model, owner)", click);
+        Assert.Contains("IedBrowserTypedWriteBatch.Freeze(pending)", source);
+        Assert.Contains("WriteBrowserDataAttributesAsync(", source);
+        Assert.Contains("PreviewBrowserDataAttributeWriteAsync(", source);
+        Assert.DoesNotContain("MessageBox.Show(", source);
+        Assert.Contains("TryFreezePlan(selected,", source);
+        Assert.Contains("baseline.GvaSignature, preview.GvaSignature", source);
+        Assert.Contains("ReferenceEquals(_device.LiveDiscoveryModel, _model)", source);
+        Assert.DoesNotContain("WriteSingleVariableAsync(", source);
+        Assert.DoesNotContain("OperateAsync(", source);
+
+        var inspect = source.Split("private async void Inspect_Click(")[1]
+            .Split("private static bool TryFreezePlan(")[0];
+        Assert.DoesNotContain("WriteBrowserDataAttributesAsync(", inspect);
+    }
+
+    [Fact]
+    public void StatusDaSelectionRevokesParentWriteAndControlAuthority()
+    {
+        var write = File.ReadAllText(Find("MainWindow.IedBrowser.TypedDataWrite.cs"));
+        var control = File.ReadAllText(Find("MainWindow.IedBrowser.ContextControl.cs"));
+        const string dataLeaf = "Kind: \"Data\", IsDataObject: false";
+        Assert.Contains(dataLeaf, write);
+        Assert.Contains(dataLeaf, control);
+        Assert.Contains("RefreshIedBrowserControlButton();", write);
+        Assert.Contains("var ctlModel = BrowserSelectedControlModelSignal()", write);
+        Assert.DoesNotContain("IedBrowserWriteButton.Content =", write);
+    }
+
+    private static string Find(string relative)
+    {
+        DirectoryInfo? dir = new(AppContext.BaseDirectory);
+        while (dir is not null)
+        {
+            var candidate = Path.Combine(dir.FullName, relative);
+            if (File.Exists(candidate)) return candidate;
+            dir = dir.Parent;
+        }
+        throw new FileNotFoundException("Source file not found: " + relative);
+    }
+}
diff --git a/tests/ARSAS.Tests/IedBrowserCfEvidenceM213JTests.cs b/tests/ARSAS.Tests/IedBrowserCfEvidenceM213JTests.cs
index ff060e2c0..609252365 100644
--- a/tests/ARSAS.Tests/IedBrowserCfEvidenceM213JTests.cs
+++ b/tests/ARSAS.Tests/IedBrowserCfEvidenceM213JTests.cs
@@ -226,7 +226,14 @@ public void BrowserRefreshBindsCfEvidenceWithoutImplicitMmsRequests()
         Assert.NotNull(cursor);
         var source = File.ReadAllText(
             Path.Combine(cursor!.FullName, "MainWindow.IedBrowser.cs"));
-        Assert.Contains("cfEvidence.BuildVerifiedUnits(device.Signals, model)", source);
+        // The semantic bridge must still be used, but no longer rescan all
+        // SG7 signals directly on every WPF value refresh.
+        Assert.Contains("_iedBrowserUnitCache.Resolve(device, model, cfEvidence)", source);
+        var cache = File.ReadAllText(Path.Combine(cursor.FullName,
+            "Models", "IedBrowserUnitProjectionCache.cs"));
+        Assert.Contains("evidence.BuildVerifiedUnits(device.Signals, model)", cache);
+        Assert.Contains("device.LiveValues.ConfigurationVersion", cache);
+        Assert.Contains("SignalDefinition.UnitMetadataRevision", cache);
         Assert.Contains("IedBrowserCfEvidencePresentation.RenderCfValue(", source);
         Assert.Contains("Discovery snapshot", source);
     }
diff --git a/tests/ARSAS.Tests/IedBrowserControlEligibilityTests.cs b/tests/ARSAS.Tests/IedBrowserControlEligibilityTests.cs
new file mode 100644
index 000000000..b971452ee
--- /dev/null
+++ b/tests/ARSAS.Tests/IedBrowserControlEligibilityTests.cs
@@ -0,0 +1,100 @@
+using AR.Iec61850.Discovery;
+using ArIED61850Tester.Models;
+
+namespace ARSAS.Tests;
+
+public sealed class IedBrowserControlEligibilityTests
+{
+    private const string Pos = "SG7_BCULD0/BkrCSWI1.Pos";
+
+    private static LiveIedDataObjectModel DataObject(string reference = Pos, string cdc = "DPC")
+        => new() { Reference = reference, Name = "Pos", InferredCdc = cdc };
+
+    private static Iec61850ControlCapabilities Capability(
+        string reference = Pos, Iec61850ControlModelKind model = Iec61850ControlModelKind.SboEnhanced,
+        string cdc = "DPC", bool ready = true)
+        => new()
+        {
+            ObjectReference = reference,
+            ControlModelReference = reference + ".ctlModel",
+            StatusReference = reference + ".stVal",
+            ControlModel = model,
+            ControlCdc = cdc,
+            CtlValSignature = "oper.ctlVal:BOOLEAN (live GVA verified)",
+            EngineControlServiceAvailable = true,
+            IsOperationallyReady = ready
+        };
+
+    private static IedBrowserControlEligibility Decide(
+        bool focusDo = true, string focus = Pos,
+        LiveIedDataObjectModel? declared = null,
+        Iec61850ControlCapabilities? capability = null,
+        bool association = true, bool authorized = true)
+        => IedBrowserControlEligibility.Check(
+            focusDo, focus, declared ?? DataObject(), capability ?? Capability(),
+            association, authorized);
+
+    [Fact]
+    public void ExactLiveTypedDpcSboEnhanced_IsEnabledWithoutNameBasedShortcuts()
+        => Assert.True(Decide().CanControl);
+
+    [Fact]
+    public void DataAttributeFocus_CannotEnableControl()
+        => Assert.False(Decide(focusDo: false).CanControl);
+
+    [Fact]
+    public void OrdinaryStatusOnlyModel_IsDisabled()
+    {
+        var decision = Decide(capability: Capability(model: Iec61850ControlModelKind.StatusOnly));
+        Assert.False(decision.CanControl);
+        Assert.Contains("StatusOnly", decision.Reason);
+    }
+
+    [Fact]
+    public void UnknownOrUnreadyControl_IsDisabled()
+    {
+        Assert.False(Decide(capability: Capability(model: Iec61850ControlModelKind.Unknown)).CanControl);
+        Assert.False(Decide(capability: Capability(ready: false)).CanControl);
+    }
+
+    [Fact]
+    public void CrossObjectOrStaleAssociation_CannotEnableControl()
+    {
+        Assert.False(Decide(capability: Capability("SG7_BCULD0/BkrCSWI2.Pos")).CanControl);
+        Assert.False(Decide(declared: DataObject("SG7_BCULD0/LLN0.NamPlt")).CanControl);
+        Assert.False(Decide(association: false).CanControl);
+        Assert.False(Decide(authorized: false).CanControl);
+    }
+
+    [Fact]
+    public void UnsupportedOrContradictoryCdc_BlocksWithoutGuessing()
+    {
+        Assert.False(Decide(capability: Capability(cdc: "UNKNOWN")).CanControl);
+        Assert.False(Decide(declared: DataObject(cdc: "SPS")).CanControl);
+    }
+
+    [Fact]
+    public void IncompleteTypedCtlValOrCtlModel_StaysDisabled()
+    {
+        var incomplete = new Iec61850ControlCapabilities
+        {
+            ObjectReference = Pos,
+            ControlModel = Iec61850ControlModelKind.SboEnhanced,
+            ControlCdc = "DPC",
+            EngineControlServiceAvailable = true,
+            IsOperationallyReady = true,
+            StatusReference = Pos + ".stVal"
+        };
+        Assert.False(Decide(capability: incomplete).CanControl);
+    }
+
+    [Fact]
+    public void VendorNeutralTapChangerBsc_UsesLiveTypingNotPosLabel()
+    {
+        const string tap = "ZIVAVRLD1/ATCC1.TapChg";
+        var decision = IedBrowserControlEligibility.Check(
+            true, tap, DataObject(tap, "BSC"),
+            Capability(tap, Iec61850ControlModelKind.SboNormal, "BSC"), true, true);
+        Assert.True(decision.CanControl);
+    }
+}
diff --git a/tests/ARSAS.Tests/IedBrowserLiveControlWriteFatRegressionTests.cs b/tests/ARSAS.Tests/IedBrowserLiveControlWriteFatRegressionTests.cs
new file mode 100644
index 000000000..93137f97d
--- /dev/null
+++ b/tests/ARSAS.Tests/IedBrowserLiveControlWriteFatRegressionTests.cs
@@ -0,0 +1,97 @@
+using System.Xml.Linq;
+using ArIED61850Tester;
+
+namespace ARSAS.Tests;
+
+public sealed class IedBrowserLiveControlWriteFatRegressionTests
+{
+    [Fact]
+    public void ControlPopup_ReadOnlyDisplayBindings_AreOneWayNotWpfTwoWay()
+    {
+        var root = XDocument.Parse(Source("ControlCommandWindow.xaml"));
+        XNamespace p = "http://schemas.microsoft.com/winfx/2006/xaml/presentation";
+        foreach (var binding in new[] { "ControlNumberText", "TerminationText" })
+        {
+            var textBox = root.Descendants(p + "TextBox").Single(x =>
+                ((string?)x.Attribute("Text"))?.Contains(binding, StringComparison.Ordinal) == true);
+            Assert.Contains("Mode=OneWay", textBox.Attribute("Text")!.Value);
+            Assert.Equal("True", (string?)textBox.Attribute("IsReadOnly"));
+        }
+    }
+
+    [Fact]
+    public void ControlLeaf_OnlyExactLiveCoCtlValMayBorrowOwningDoControl()
+    {
+        var src = Source("MainWindow.IedBrowser.ContextControl.cs");
+        Assert.Contains("FunctionalConstraint: \"CO\"", src);
+        Assert.Contains("EndsWith(\"$ctlVal\"", src);
+        Assert.Contains("source.Attributes.Any", src);
+        Assert.Contains("BrowserSelectedLiveControl()", src);
+        Assert.Contains("new ControlCommandWindow(_runtime, device, control.Value.Signal)", src);
+        Assert.Contains("signal.ControlSemanticVerified", src);
+        Assert.Contains("IedBrowserControlEligibility.Check", src);
+    }
+
+    [Fact]
+    public void CtlModelCfLeaf_UsesExistingGuardedWriteEditor_NotGenericMmsOrOperate()
+    {
+        var ctx = Source("MainWindow.IedBrowser.ContextControl.cs");
+        var write = Source("MainWindow.IedBrowser.TypedDataWrite.cs");
+        var safety = Source("Models/IedBrowserTypedWriteAdmission.cs");
+        Assert.Contains("BrowserSelectedControlModelSignal()", ctx);
+        Assert.Contains("FunctionalConstraint: \"CF\"", ctx);
+        Assert.Contains("source.Attributes.Any", ctx);
+        Assert.Contains("new ControlModelWriteWindow(_runtime, device, modelSignal)", write);
+        Assert.Contains("ctlModel requires the existing guarded ConfigureControlModel workflow", safety);
+        Assert.DoesNotContain("IedBrowserWriteButton.Content =", write);
+    }
+
+    [Fact]
+    public void Monitoring_StillAllowsExplicitTypedWriteOnSerializedLiveAssociation()
+    {
+        var ui = Source("MainWindow.IedBrowser.TypedDataWrite.cs");
+        var runtime = Source("Services/Iec61850MonitorRuntime.cs");
+        var batch = Source("BrowserBatchWriteWindow.xaml.cs");
+        Assert.DoesNotContain("IsMonitoring: false, IsBrowserReading: false", ui);
+        Assert.DoesNotContain("device.IsDemo || device.IsMonitoring || device.IsBusy", runtime);
+        Assert.DoesNotContain("device.IsMonitoring || model is null", runtime);
+        Assert.Contains("ReferenceEquals(session.Device, device)", runtime);
+        Assert.Contains("ControlFlightQuarantined", runtime);
+        Assert.Contains("IedBrowserTypedWriteBatch.Freeze(confirmedPlan)", runtime);
+        Assert.DoesNotContain("!_device.IsMonitoring", batch);
+    }
+
+    [Fact]
+    public void StatusStrip_FixedHeight_NoWrapAndNoHistoryExpansion()
+    {
+        var root = XDocument.Parse(Source("MainWindow.xaml"));
+        XNamespace p = "http://schemas.microsoft.com/winfx/2006/xaml/presentation";
+        var status = root.Descendants(p + "Border").Single(x =>
+            ((string?)x.Attribute("Grid.Row")) == "2" &&
+            x.Descendants(p + "TextBlock").Any(t =>
+                ((string?)t.Attribute("Text")) == "{Binding LastStatusText}"));
+        Assert.Equal("34", (string?)status.Attribute("Height"));
+        Assert.Equal("34", (string?)status.Attribute("MaxHeight"));
+        var text = status.Descendants(p + "TextBlock").Single(x =>
+            ((string?)x.Attribute("Text")) == "{Binding LastStatusText}");
+        Assert.Equal("NoWrap", (string?)text.Attribute("TextWrapping"));
+        Assert.Equal("CharacterEllipsis", (string?)text.Attribute("TextTrimming"));
+        Assert.Equal("19", (string?)text.Attribute("MaxHeight"));
+        Assert.Equal("ERROR • UI • System.InvalidOperationException: read-only",
+            MainWindow.FormatSingleLineStatus(
+                "ERROR • UI • System.InvalidOperationException: read-only\n   at WPF stack"));
+        Assert.True(MainWindow.FormatSingleLineStatus(new string('x', 400)).Length <= 180);
+    }
+
+    private static string Source(string relative)
+    {
+        DirectoryInfo? dir = new(AppContext.BaseDirectory);
+        while (dir is not null)
+        {
+            var path = Path.Combine(dir.FullName, relative);
+            if (File.Exists(path)) return File.ReadAllText(path);
+            dir = dir.Parent;
+        }
+        throw new FileNotFoundException(relative);
+    }
+}
diff --git a/tests/ARSAS.Tests/IedBrowserPostWriteSsotRegressionTests.cs b/tests/ARSAS.Tests/IedBrowserPostWriteSsotRegressionTests.cs
new file mode 100644
index 000000000..b888fa7c8
--- /dev/null
+++ b/tests/ARSAS.Tests/IedBrowserPostWriteSsotRegressionTests.cs
@@ -0,0 +1,113 @@
+using System.Xml.Linq;
+
+namespace ARSAS.Tests;
+
+/// <summary>
+/// Locks the operator-visible post-Write contract: editor closes, Browser
+/// independently reads exact live DA(s), and only canonical SSOT projects
+/// the result into the Data Model. Never copy popup previews into UI rows.
+/// </summary>
+public sealed class IedBrowserPostWriteSsotRegressionTests
+{
+    private static string Source(string file)
+    {
+        for (DirectoryInfo? dir = new(AppContext.BaseDirectory); dir is not null; dir = dir.Parent)
+        {
+            var path = Path.Combine(dir.FullName, file);
+            if (File.Exists(path)) return File.ReadAllText(path);
+        }
+        throw new FileNotFoundException(file);
+    }
+
+    [Fact]
+    public void AllWriteEditors_AutoCloseAndHandOffAttemptedExactLeafIdentities()
+    {
+        var single = Source("BrowserDataWriteWindow.xaml.cs");
+        var ctl = Source("ControlModelWriteWindow.xaml.cs");
+        var batch = Source("BrowserBatchWriteWindow.xaml.cs");
+        var legacy = Source("IedBrowserWriteWindow.xaml.cs");
+        Assert.Contains("public bool WriteAttempted", single);
+        Assert.Contains("WriteAssociation = _association", single);
+        Assert.Contains("if (IsLoaded) Close();", single);
+        Assert.Contains("public bool WriteAttempted", ctl);
+        Assert.Contains("WriteAssociation = _inspectedAssociation", ctl);
+        Assert.Contains("if (IsLoaded) Close();", ctl);
+        Assert.Contains("AttemptedLeaves = steps.Select(", batch);
+        Assert.Contains("if (AttemptedLeaves.Count > 0 && IsLoaded) Close();", batch);
+        Assert.Contains("AttemptedLeaves.Add((row.Reference, row.FunctionalConstraint))", legacy);
+        Assert.Contains("if (AttemptedLeaves.Count > 0 && IsLoaded) Close();", legacy);
+        Assert.DoesNotContain("await ReadModelAsync();", ctl.Split("private async void Write_Click(")[1]);
+        Assert.DoesNotContain("PreviewBrowserDataAttributeWriteAsync(",
+            single.Split("private async void Write_Click(")[1]);
+        Assert.DoesNotContain("PreviewBrowserDataAttributeWriteAsync(",
+            batch.Split("private async void Write_Click(")[1].Split("private void Close_Click")[0]
+                .Split("var result = await _runtime.WriteBrowserDataAttributesAsync(")[1]);
+    }
+
+    [Fact]
+    public void BrowserOwner_QueuesScopedReadAfterModalNotAnotherPopupPreview()
+    {
+        var toolbar = Source("MainWindow.IedBrowser.TypedDataWrite.cs");
+        Assert.Contains("QueueIedBrowserPostWriteRead(device, model, dialog.WriteAssociation", toolbar);
+        Assert.Contains("new[] { dialog.AttemptedLeaf }", toolbar);
+        Assert.Contains("dialog.AttemptedLeaves, dialog.WriteStatus", toolbar);
+        Assert.Contains("IedBrowserReadValues_Click(new Button { Tag = request }", toolbar);
+        Assert.Contains("_iedBrowserReadOperation is not null || device.IsBusy", toolbar);
+        Assert.Contains("await Task.Delay(100);", toolbar);
+        Assert.DoesNotContain("device.LiveValues.Publish(", toolbar);
+        var legacy = Source("MainWindow.IedBrowser.Write.cs");
+        Assert.Contains("editor.AttemptedLeaves, editor.WriteStatus", legacy);
+        var pipeline = Source("MainWindow.IedBrowser.cs");
+        Assert.Contains("var postWriteRequest =", pipeline);
+        Assert.Contains("postWriteRequest.Matches(device)", pipeline);
+        Assert.Contains("targets = postWriteRequest.Targets;", pipeline);
+        Assert.Contains("postWriteRequest is null && currentPage is not null", pipeline);
+        Assert.Contains("sourceDevice.LiveValues.PublishForAssociation(", pipeline);
+        Assert.Contains("RefreshIedBrowserVisibleValues();", pipeline);
+    }
+
+    [Fact]
+    public void PostWriteBrowserRead_DemandsNewExactSsotEvidence_NotOldPopupOrCachedData()
+    {
+        var pipeline = Source("MainWindow.IedBrowser.cs");
+        Assert.Contains("var postWriteBaselineRevision = sourceDevice.LiveValues.Version;", pipeline);
+        Assert.Contains("observed.Revision > postWriteBaselineRevision", pipeline);
+        Assert.Contains("observed.Association == readAssociation", pipeline);
+        Assert.Contains("preferReport: false", pipeline);
+        Assert.Contains("string.Equals(observed.Source, \"MMS Read\"", pipeline);
+        Assert.Contains("postWriteRequest.Targets", pipeline);
+        Assert.Contains("RefreshIedBrowserVisibleValues();", pipeline);
+        Assert.Contains("Data Model refreshed from IED", pipeline);
+        Assert.Contains("Data Model Read incomplete", pipeline);
+        Assert.Contains("Data Model not refreshed", pipeline);
+        Assert.Contains("Data Model Read interrupted", pipeline);
+        Assert.Contains("postWriteRequest.WriteStatus", pipeline);
+        Assert.Contains("writeOutcome + \" · \" + readOutcome", pipeline);
+        Assert.Contains("IedBrowserDetailStatus.ToolTip", pipeline);
+        Assert.Contains("device, model, association, attempted, status", Source("MainWindow.IedBrowser.TypedDataWrite.cs"));
+        Assert.Contains("string WriteStatus = \"\"", Source("Models/IedBrowserPostWriteReadRequest.cs"));
+        Assert.Contains("TimeSpan.FromSeconds(30)", pipeline);
+        Assert.DoesNotContain("postWriteRequest.Targets.First().Value", pipeline);
+    }
+
+    [Fact]
+    public void PostWriteReadRequest_FailsClosedAcrossReconnectOrAmbiguousDataModel()
+    {
+        var source = Source("Models/IedBrowserPostWriteReadRequest.cs");
+        Assert.Contains("ReferenceEquals(device.LiveDiscoveryModel, model)", source);
+        Assert.Contains("device.LiveValues.Association != association", source);
+        Assert.Contains("attempted.Count is < 1 or > 64", source);
+        Assert.Contains("if (group.Length != 1) return null;", source);
+        Assert.Contains("IedBrowserLiveValues.CanonicalReference", source);
+        Assert.Contains("new IedBrowserReadTarget(attr.MmsReference", source);
+        Assert.Contains("or \"SG\" or \"SE\"", source);
+        Assert.DoesNotContain("PublishForAssociation(", source);
+        Assert.DoesNotContain("WriteBrowserDataAttributesAsync(", source);
+
+        foreach (var file in new[]
+        {
+            "BrowserDataWriteWindow.xaml", "BrowserBatchWriteWindow.xaml",
+            "ControlModelWriteWindow.xaml", "IedBrowserWriteWindow.xaml"
+        }) XDocument.Parse(Source(file));
+    }
+}
diff --git a/tests/ARSAS.Tests/IedBrowserTypedDataWriteGuardTests.cs b/tests/ARSAS.Tests/IedBrowserTypedDataWriteGuardTests.cs
new file mode 100644
index 000000000..fd05ea2ad
--- /dev/null
+++ b/tests/ARSAS.Tests/IedBrowserTypedDataWriteGuardTests.cs
@@ -0,0 +1,215 @@
+using AR.Iec61850.Mms;
+using ArIED61850Tester.Models;
+using ArIED61850Tester.Services;
+
+namespace ARSAS.Tests;
+
+public sealed class IedBrowserTypedDataWriteGuardTests
+{
+    private static MmsObjectReference Cf(string name = "sboTimeout")
+        => MmsObjectReference.Parse("ZIVAVRLD1/ATCC1.TapChg." + name, "CF");
+
+    private static MmsVariableAccessAttributesResult Gva(
+        MmsObjectReference reference, string type, int? bits = null,
+        MmsTypeSizeConstraintKind sizing = MmsTypeSizeConstraintKind.None)
+        => new()
+        {
+            IsSuccess = true,
+            Reference = reference,
+            TypeSpecification = new MmsTypeSpecificationNode
+            {
+                MmsType = type,
+                Size = bits,
+                SizeConstraintKind = sizing
+            }
+        };
+
+    private static string Finger(string type, int? size = null,
+        MmsTypeSizeConstraintKind constraint = MmsTypeSizeConstraintKind.None)
+        => IedBrowserTypedWriteAdmission.Fingerprint(new MmsTypeSpecificationNode
+        {
+            MmsType = type, Size = size, SizeConstraintKind = constraint
+        });
+
+    [Fact]
+    public void SingleCfSigned32_AcceptsExactLiveTypeAndOriginalFc()
+    {
+        var reference = Cf();
+        Assert.Null(IedBrowserTypedWriteAdmission.RejectReason(
+            reference, Gva(reference, "integer", 32), Finger("integer", 32), MmsDataValue.Integer(3)));
+    }
+
+    [Fact]
+    public void CtlModel_UsesExistingDedicatedConfigurationService()
+    {
+        var r = Cf("ctlModel");
+        Assert.Contains("ConfigureControlModel", IedBrowserTypedWriteAdmission.RejectReason(
+            r, Gva(r, "integer", 32), Finger("integer", 32), MmsDataValue.Integer(1))!);
+    }
+
+    [Fact]
+    public void ControlService_MustNeverUseGenericWriter_EvenWithForgedCf()
+    {
+        var co = MmsObjectReference.Parse("LD/CSWI1.Pos.Oper.ctlVal", "CO");
+        Assert.Contains("Control-service", IedBrowserTypedWriteAdmission.RejectReason(
+            co, Gva(co, "boolean"), Finger("boolean"), MmsDataValue.Boolean(true))!);
+        var forged = MmsObjectReference.Parse("LD/CSWI1.Pos.Oper.ctlVal", "CF");
+        Assert.Contains("Control-service", IedBrowserTypedWriteAdmission.RejectReason(
+            forged, Gva(forged, "boolean"), Finger("boolean"), MmsDataValue.Boolean(true))!);
+    }
+
+    [Theory]
+    [InlineData("ST")]
+    [InlineData("MX")]
+    [InlineData("SG")]
+    [InlineData("SE")]
+    [InlineData("SV")]
+    [InlineData("RP")]
+    public void UnapprovedFunctionalConstraints_FailClosed(string fc)
+    {
+        var r = MmsObjectReference.Parse("LD/XCBR1.Pos.stVal", fc);
+        Assert.Contains("no approved", IedBrowserTypedWriteAdmission.RejectReason(
+            r, Gva(r, "boolean"), Finger("boolean"), MmsDataValue.Boolean(true))!);
+    }
+
+    [Fact]
+    public void FcInWrongMmsSegment_DoesNotGrantAuthority()
+    {
+        var reference = new MmsObjectReference("LD", "CSWI1$ST$Pos$CF$ctlModel", "CF");
+        Assert.Contains("exact requested FC", IedBrowserTypedWriteAdmission.RejectReason(
+            reference, Gva(reference, "integer", 32), Finger("integer", 32), MmsDataValue.Integer(3))!);
+    }
+
+    [Fact]
+    public void StaleGvaSignatureOrReference_RejectsBeforeWrite()
+    {
+        var r = Cf();
+        Assert.Contains("mismatched", IedBrowserTypedWriteAdmission.RejectReason(
+            r, Gva(r, "integer", 32), Finger("boolean"), MmsDataValue.Integer(2))!);
+        Assert.Contains("mismatched", IedBrowserTypedWriteAdmission.RejectReason(
+            r, Gva(Cf("differentAttribute"), "integer", 32), Finger("integer", 32), MmsDataValue.Integer(2))!);
+    }
+
+    [Fact]
+    public void IntegerAndUnsignedWidths_DoNotSilentlyOverflowOrFlipSign()
+    {
+        var r = Cf();
+        var signed = Gva(r, "integer", 8);
+        Assert.Null(IedBrowserTypedWriteAdmission.RejectReason(
+            r, signed, Finger("integer", 8), MmsDataValue.Integer(-128)));
+        Assert.Contains("outside", IedBrowserTypedWriteAdmission.RejectReason(
+            r, signed, Finger("integer", 8), MmsDataValue.Integer(128))!);
+        var unsigned = Gva(r, "unsigned", 16);
+        Assert.Contains("unsigned", IedBrowserTypedWriteAdmission.RejectReason(
+            r, unsigned, Finger("unsigned", 16), MmsDataValue.Integer(-1))!);
+        Assert.Contains("outside", IedBrowserTypedWriteAdmission.RejectReason(
+            r, unsigned, Finger("unsigned", 16), MmsDataValue.Unsigned(65536))!);
+        Assert.Null(IedBrowserTypedWriteAdmission.RejectReason(
+            r, unsigned, Finger("unsigned", 16), MmsDataValue.Unsigned(65535)));
+    }
+
+    [Fact]
+    public void Float64_IsBlockedUntilLosslessEngineCodecExists()
+    {
+        var r = Cf("setMag");
+        Assert.Contains("FLOAT32", IedBrowserTypedWriteAdmission.RejectReason(
+            r, Gva(r, "floating-point", 64), Finger("floating-point", 64),
+            MmsDataValue.FloatingPoint(1.1d))!);
+        Assert.Null(IedBrowserTypedWriteAdmission.RejectReason(
+            r, Gva(r, "floating-point", 32), Finger("floating-point", 32),
+            MmsDataValue.FloatingPoint(1.25f)));
+    }
+
+    [Fact]
+    public void Strings_AreValidatedAgainstLiveWireLengthAndLosslessness()
+    {
+        var r = Cf("d");
+        var type = Gva(r, "visible-string", 5, MmsTypeSizeConstraintKind.Maximum);
+        Assert.Null(IedBrowserTypedWriteAdmission.RejectReason(
+            r, type, Finger("visible-string", 5, MmsTypeSizeConstraintKind.Maximum), MmsDataValue.VisibleString("hello")));
+        Assert.Contains("length", IedBrowserTypedWriteAdmission.RejectReason(
+            r, type, Finger("visible-string", 5, MmsTypeSizeConstraintKind.Maximum), MmsDataValue.VisibleString("longer"))!);
+        Assert.Contains("Non-ASCII", IedBrowserTypedWriteAdmission.RejectReason(
+            r, type, Finger("visible-string", 5, MmsTypeSizeConstraintKind.Maximum), MmsDataValue.VisibleString("é"))!);
+    }
+
+    [Fact]
+    public void BitString_RequiresExactBitsAndZeroUnusedPadding()
+    {
+        var r = Cf("bits");
+        var type = Gva(r, "bit-string", 2, MmsTypeSizeConstraintKind.Fixed);
+        Assert.Null(IedBrowserTypedWriteAdmission.RejectReason(
+            r, type, Finger("bit-string", 2, MmsTypeSizeConstraintKind.Fixed), MmsDataValue.BitString(6, new byte[] { 0b_1000_0000 })));
+        Assert.Contains("padding", IedBrowserTypedWriteAdmission.RejectReason(
+            r, type, Finger("bit-string", 2, MmsTypeSizeConstraintKind.Fixed), MmsDataValue.BitString(6, new byte[] { 0b_1000_0001 }))!);
+    }
+
+    private static IedBrowserTypedWriteStep Step(string attribute) => new(
+        Cf(attribute), Finger("integer", 32), MmsDataValue.Integer(1), MmsDataValue.Integer(2));
+
+    [Fact]
+    public void Plan_RejectsDuplicateAndCrossDo_WithoutDispatch()
+    {
+        Assert.Throws<ArgumentException>(() => IedBrowserTypedWriteBatch.Freeze(
+            new[] { Step("a"), Step("a") }));
+        Assert.Throws<ArgumentException>(() => IedBrowserTypedWriteBatch.Freeze(
+            new[] { Step("a"), new IedBrowserTypedWriteStep(
+                MmsObjectReference.Parse("LD/ATCC1.Other.b", "CF"),
+                Finger("integer", 32), MmsDataValue.Integer(1), MmsDataValue.Integer(2)) }));
+    }
+
+    [Fact]
+    public async Task Batch_OneConfirmedOneRejectedThirdNotAttempted()
+    {
+        var attempts = 0;
+        var plan = IedBrowserTypedWriteBatch.Freeze(
+            new[] { Step("a"), Step("b"), Step("c") });
+        var result = await IedBrowserTypedWriteBatch.ExecuteAsync(
+            plan,
+            (_, _) =>
+            {
+                attempts++;
+                return Task.FromResult(new IedBrowserNativeWriteResult(
+                    attempts == 1 ? IedBrowserNativeWriteState.AcceptedVerified :
+                        IedBrowserNativeWriteState.Rejected, attempts == 1 ? "readback matches" : "access-denied"));
+            }, () => true, CancellationToken.None);
+        Assert.Equal(2, attempts);
+        Assert.Equal(1, result.Verified);
+        Assert.Equal(1, result.Rejected);
+        Assert.Equal(1, result.Unattempted);
+        Assert.Null(result.Rows[2].State);
+    }
+
+    [Fact]
+    public async Task UnknownOutcome_NeverRetriesAndStopsRemainingRequests()
+    {
+        var attempts = 0;
+        var plan = IedBrowserTypedWriteBatch.Freeze(new[] { Step("a"), Step("b") });
+        var result = await IedBrowserTypedWriteBatch.ExecuteAsync(
+            plan,
+            (_, _) =>
+            {
+                attempts++;
+                throw new IOException("association lost after dispatch");
+            }, () => true, CancellationToken.None);
+        Assert.Equal(1, attempts);
+        Assert.Equal(1, result.Unknown);
+        Assert.Equal(1, result.Unattempted);
+    }
+
+    [Fact]
+    public async Task StaleAssociation_FencesEntireBatchBeforeWire()
+    {
+        var attempts = 0;
+        var result = await IedBrowserTypedWriteBatch.ExecuteAsync(
+            IedBrowserTypedWriteBatch.Freeze(new[] { Step("a"), Step("b") }),
+            (_, _) =>
+            {
+                attempts++;
+                return Task.FromResult(new IedBrowserNativeWriteResult(
+                    IedBrowserNativeWriteState.AcceptedVerified, "ok"));
+            }, () => false, CancellationToken.None);
+        Assert.Equal(0, attempts);
+        Assert.Equal(2, result.Unattempted);
+    }
+}
diff --git a/tests/ARSAS.Tests/IedBrowserTypedWriteInputTests.cs b/tests/ARSAS.Tests/IedBrowserTypedWriteInputTests.cs
new file mode 100644
index 000000000..3a8c70d3a
--- /dev/null
+++ b/tests/ARSAS.Tests/IedBrowserTypedWriteInputTests.cs
@@ -0,0 +1,85 @@
+using AR.Iec61850.Mms;
+using ArIED61850Tester.Models;
+
+namespace ARSAS.Tests;
+
+public sealed class IedBrowserTypedWriteInputTests
+{
+    private static MmsTypeSpecificationNode Type(string family, int size = 32)
+        => new() { MmsType = family, Size = size };
+
+    [Theory]
+    [InlineData("true", true)]
+    [InlineData("FALSE", false)]
+    public void BooleanExactText_Accepted(string raw, bool expected)
+    {
+        Assert.True(IedBrowserTypedWriteInput.TryParse(
+            Type("boolean"), raw, out var typed, out _));
+        Assert.Equal(expected, typed!.Value);
+    }
+
+    [Theory]
+    [InlineData("1")]
+    [InlineData("0")]
+    [InlineData("yes")]
+    [InlineData("open")]
+    public void BooleanNumericAndAlias_NeverCoerced(string raw)
+    {
+        Assert.False(IedBrowserTypedWriteInput.TryParse(
+            Type("boolean"), raw, out _, out _));
+    }
+
+    [Fact]
+    public void SignedNegativeAndUnsignedNegative_AreDifferentWireTypes()
+    {
+        Assert.True(IedBrowserTypedWriteInput.TryParse(
+            Type("integer"), "-2", out var signed, out _));
+        Assert.Equal(MmsDataKind.Integer, signed!.Kind);
+        Assert.False(IedBrowserTypedWriteInput.TryParse(
+            Type("unsigned"), "-2", out _, out _));
+    }
+
+    [Fact]
+    public void FloatInvariantDecimal_RejectsLocaleCommaAndNonFinite()
+    {
+        Assert.True(IedBrowserTypedWriteInput.TryParse(
+            Type("floating-point", 32), "1.25", out var typed, out _));
+        Assert.Equal(1.25f, typed!.Value);
+        Assert.False(IedBrowserTypedWriteInput.TryParse(
+            Type("floating-point", 32), "1,25", out _, out _));
+        Assert.False(IedBrowserTypedWriteInput.TryParse(
+            Type("floating-point", 32), "NaN", out _, out _));
+        Assert.False(IedBrowserTypedWriteInput.TryParse(
+            Type("floating-point", 64), "1.25", out _, out _));
+    }
+
+    [Fact]
+    public void Utf8MustNotBypassLiveAsciiWireAdmission()
+    {
+        var wireType = new MmsTypeSpecificationNode
+        {
+            MmsType = "visible-string", Size = 32,
+            SizeConstraintKind = MmsTypeSizeConstraintKind.Maximum
+        };
+        Assert.True(IedBrowserTypedWriteInput.TryParse(
+            wireType, "é", out var typed, out _));
+        var r = MmsObjectReference.Parse("LD/LLN0.NamPlt.d", "DC");
+        var gva = new MmsVariableAccessAttributesResult
+        {
+            IsSuccess = true, Reference = r, TypeSpecification = wireType
+        };
+        Assert.NotNull(IedBrowserTypedWriteAdmission.RejectReason(
+            r, gva, IedBrowserTypedWriteAdmission.Fingerprint(wireType), typed!));
+    }
+
+    [Fact]
+    public void UnsupportedOrMissingLiveType_DoesNotBuildProposedValue()
+    {
+        Assert.False(IedBrowserTypedWriteInput.TryParse(
+            null, "1", out var missing, out _));
+        Assert.Null(missing);
+        Assert.False(IedBrowserTypedWriteInput.TryParse(
+            Type("utc-time"), "2026-10-23", out var utc, out _));
+        Assert.Null(utc);
+    }
+}
diff --git a/tests/ARSAS.Tests/IedBrowserUnifiedWriteUxTests.cs b/tests/ARSAS.Tests/IedBrowserUnifiedWriteUxTests.cs
new file mode 100644
index 000000000..5e6993ff5
--- /dev/null
+++ b/tests/ARSAS.Tests/IedBrowserUnifiedWriteUxTests.cs
@@ -0,0 +1,127 @@
+using System.Xml.Linq;
+using AR.Iec61850.Mms;
+using ArIED61850Tester.Models;
+
+namespace ARSAS.Tests;
+
+public sealed class IedBrowserUnifiedWriteUxTests
+{
+    [Fact]
+    public void WriteRow_RequiresLiveReadAndExplicitUserChange()
+    {
+        var row = new IedBrowserWriteRow("LD0/LLN0.Pos.stVal", "CF", "BOOLEAN");
+        Assert.Equal("stVal", row.ShortName);
+        Assert.True(row.IsBoolean);
+        Assert.False(row.HasVerifiedRead);
+        Assert.False(row.HasEdited);
+        row.ApplyLiveRead(MmsDataValue.Boolean(false));
+        Assert.Equal("false", row.RequestedValue);
+        Assert.Equal("false", row.Current);
+        Assert.False(row.HasEdited);
+        Assert.True(row.HasVerifiedRead);
+        row.RequestedValue = "true";
+        Assert.True(row.HasEdited);
+        row.ExpireLiveRead();
+        Assert.False(row.HasVerifiedRead);
+        Assert.Null(row.LiveBeforeValue);
+    }
+
+    [Fact]
+    public void CtlModel_IsStillEnumeratedNotFreeText()
+    {
+        var row = new IedBrowserWriteRow("LD0/CSWI1.Pos.ctlModel", "CF", "ENUM");
+        Assert.True(row.IsControlModel);
+        row.ApplyLiveRead(MmsDataValue.Integer(2));
+        Assert.Equal("2", row.RequestedValue);
+        Assert.Equal(System.Windows.Visibility.Visible, row.CtlModelEditorVisibility);
+        Assert.Equal(System.Windows.Visibility.Collapsed, row.TextEditorVisibility);
+    }
+
+    [Theory]
+    [InlineData("INT8", "127", "128")]
+    [InlineData("INT8", "-128", "-129")]
+    [InlineData("INT16", "32767", "32768")]
+    [InlineData("INT32", "2147483647", "2147483648")]
+    [InlineData("INT8U", "255", "256")]
+    [InlineData("INT16U", "65535", "65536")]
+    [InlineData("INT24U", "16777215", "16777216")]
+    [InlineData("INT32U", "4294967295", "4294967296")]
+    public void DeclaredIntegerWidths_AreValidatedBeforeAnyNetworkWrite(
+        string declaredType, string accepted, string rejected)
+    {
+        const string reference = "LD0/LLN0.Mod.sboTimeout";
+        Assert.NotNull(IedBrowserWritePlan.EncodeValue(declaredType, accepted, reference));
+        Assert.Throws<OverflowException>(() =>
+            IedBrowserWritePlan.EncodeValue(declaredType, rejected, reference));
+    }
+
+    [Fact]
+    public void UnverifiedDiscreteEnumRemainsVisibleButCannotBecomeEditableOrReachWire()
+    {
+        var row = new IedBrowserWriteRow("LD0/ATCC1.TapChg.oprVal", "CF", "ENUMERATED");
+        row.ApplyLiveRead(MmsDataValue.Integer(2));
+        Assert.True(row.HasVerifiedRead);
+        Assert.True(row.IsUnverifiedEnum);
+        Assert.Equal(System.Windows.Visibility.Collapsed, row.TextEditorVisibility);
+        Assert.Equal(System.Windows.Visibility.Collapsed, row.BooleanEditorVisibility);
+        Assert.Equal(System.Windows.Visibility.Visible, row.PlaceholderVisibility);
+        Assert.Contains("unverified", row.PlaceholderText);
+        Assert.Throws<NotSupportedException>(() =>
+            IedBrowserWritePlan.EncodeValue(row.DataType, "2", row.Reference));
+
+        // Native final boundary also rejects forged Control/ctlModel paths.
+        var native = Read("Services/NativeIec61850Client.BrowserWrite.cs");
+        Assert.Contains("generic MMS Write forbidden.", native);
+        Assert.Contains("segment.Equals(\"ctlModel\"", native);
+        var source = Read("Models/IedBrowserWritePlan.cs");
+        Assert.Contains(".Where(target => !target.Reference.EndsWith(\".ctlModel\"", source);
+    }
+
+    [Fact]
+    public void UnifiedWindow_DoesNotRequestWriteDuringReadOrOpen()
+    {
+        var src = Read("IedBrowserWriteWindow.xaml.cs");
+        var inspect = src.Split("private async Task ReadRowsAsync(")[1]
+            .Split("private async void Write_Click(")[0];
+        Assert.Contains("ReadBrowserConfigurationAsync(", inspect);
+        Assert.DoesNotContain("WriteBrowserConfigurationAsync(", inspect);
+        Assert.Contains("row.ApplyLiveRead(observation.Value)", inspect);
+        Assert.Contains("Take(24)", src);
+        Assert.Contains("!row.HasVerifiedRead || !row.HasEdited", src);
+        Assert.Contains("MmsDataCodec.Encode(row.LiveBeforeValue!)", src);
+        Assert.DoesNotContain("MessageBox.Show(", src);
+        Assert.Contains("row.ExpireLiveRead()", src);
+    }
+
+    [Fact]
+    public void UnifiedWindow_HasStableMaterialWriteAndTypeAwareGrid()
+    {
+        var x = XDocument.Parse(Read("IedBrowserWriteWindow.xaml"));
+        XNamespace p = "http://schemas.microsoft.com/winfx/2006/xaml/presentation";
+        XNamespace xNs = "http://schemas.microsoft.com/winfx/2006/xaml";
+        Assert.Contains(x.Descendants(p + "DataGridTextColumn"), t =>
+            (string?)t.Attribute("Binding") == "{Binding ShortName}");
+        Assert.Contains(x.Descendants(p + "ComboBox"), t =>
+            (string?)t.Attribute(xNs + "Name") == "BooleanPicker");
+        Assert.Contains(x.Descendants(p + "ComboBox"), t =>
+            (string?)t.Attribute(xNs + "Name") == "CtlPicker");
+        var write = x.Descendants(p + "Button").Single(t =>
+            (string?)t.Attribute(xNs + "Name") == "WriteButton");
+        Assert.True(write.Descendants(p + "TextBlock").Any(t =>
+            (string?)t.Attribute("Text") == "Write"));
+        Assert.Contains("Data=\"{StaticResource MaterialEditIcon}\"", Read("IedBrowserWriteWindow.xaml"));
+        Assert.Equal("34", (string?)x.Descendants(p + "DataGrid").Single().Attribute("RowHeight"));
+    }
+
+    private static string Read(string file)
+    {
+        DirectoryInfo? dir = new(AppContext.BaseDirectory);
+        while (dir is not null)
+        {
+            var candidate = Path.Combine(dir.FullName, file);
+            if (File.Exists(candidate)) return File.ReadAllText(candidate);
+            dir = dir.Parent;
+        }
+        throw new FileNotFoundException(file);
+    }
+}
diff --git a/tests/ARSAS.Tests/IedBrowserWriteAndDockViewportRegressionTests.cs b/tests/ARSAS.Tests/IedBrowserWriteAndDockViewportRegressionTests.cs
new file mode 100644
index 000000000..a19a43078
--- /dev/null
+++ b/tests/ARSAS.Tests/IedBrowserWriteAndDockViewportRegressionTests.cs
@@ -0,0 +1,130 @@
+using System.Xml.Linq;
+using AR.Iec61850.Mms;
+using ArIED61850Tester.Models;
+
+namespace ARSAS.Tests;
+
+public sealed class IedBrowserWriteAndDockViewportRegressionTests
+{
+    [Fact]
+    public void CommandDockExpanderUsesFiniteStarViewportRatherThanAutoOverflow()
+    {
+        var app = XDocument.Parse(Read("App.xaml"));
+        XNamespace x = "http://schemas.microsoft.com/winfx/2006/xaml";
+        XNamespace wpf = "http://schemas.microsoft.com/winfx/2006/xaml/presentation";
+        var style = Assert.Single(app.Descendants(wpf + "Style")
+            .Where(s => (string?)s.Attribute(x + "Key") == "CommandDockTransparentHeaderExpander"));
+        var rows = style.Descendants(wpf + "RowDefinition").ToArray();
+        Assert.True(rows.Length >= 2);
+        Assert.Equal("Auto", (string?)rows[0].Attribute("Height"));
+        Assert.Equal("*", (string?)rows[1].Attribute("Height"));
+        var host = Assert.Single(style.Descendants(wpf + "ContentPresenter")
+            .Where(n => (string?)n.Attribute(x + "Name") == "CommandDockContentHost"));
+        Assert.Equal("0", (string?)host.Attribute("MinHeight"));
+        Assert.Equal("Stretch", (string?)host.Attribute("VerticalAlignment"));
+    }
+
+    [Fact]
+    public void ActualCommandDataGridHasVisiblePixelScrollAndBoundedParent()
+    {
+        var xaml = XDocument.Parse(Read("MainWindow.xaml"));
+        XNamespace x = "http://schemas.microsoft.com/winfx/2006/xaml";
+        XNamespace wpf = "http://schemas.microsoft.com/winfx/2006/xaml/presentation";
+        var grid = Assert.Single(xaml.Descendants(wpf + "DataGrid")
+            .Where(n => (string?)n.Attribute(x + "Name") == "EquipmentCommandGrid"));
+        Assert.Equal("Visible",
+            (string?)grid.Attribute("ScrollViewer.VerticalScrollBarVisibility"));
+        Assert.Equal("Pixel",
+            (string?)grid.Attribute("VirtualizingPanel.ScrollUnit"));
+        Assert.Equal("True",
+            (string?)grid.Attribute("VirtualizingPanel.IsVirtualizing"));
+        Assert.Equal("False",
+            (string?)grid.Attribute("ScrollViewer.IsDeferredScrollingEnabled"));
+        Assert.Equal("0", (string?)grid.Parent?.Attribute("MinHeight"));
+        Assert.Equal("True", (string?)grid.Parent?.Attribute("ClipToBounds"));
+    }
+
+    [Fact]
+    public void DockGeometryRecomputesAgainstActualShellNotInventedMinimum()
+    {
+        var source = Read("MainWindow.WorkbenchP1PanelGeometry.cs");
+        Assert.Contains("shell.SizeChanged += P1DockShell_SizeChanged;", source);
+        Assert.Contains("if (state.ApplyingGeometry || state.DockDragging) return;", source);
+        Assert.Contains("var availableHeight = _persistentWorkbench?.Shell.ActualHeight ?? ActualHeight;", source);
+        Assert.Contains("availableHeight - 130d", source);
+        Assert.Contains("state.DockRow.MaxHeight = maxDock;", source);
+        Assert.DoesNotContain("Math.Max(520, _persistentWorkbench", source);
+    }
+
+    [Fact]
+    public void WriteDialogIsAccessibleOnlyFromBrowserAndRequiresExplicitStaging()
+    {
+        var xaml = Read("MainWindow.xaml");
+        Assert.Contains("x:Name=\"IedBrowserWriteButton\"", xaml);
+        Assert.Contains("Click=\"IedBrowserWriteValues_Click\"", xaml);
+        var editor = XDocument.Parse(Read("IedBrowserWriteWindow.xaml"));
+        XNamespace wpf = "http://schemas.microsoft.com/winfx/2006/xaml/presentation";
+        Assert.Contains(editor.Descendants(wpf + "DataGridCheckBoxColumn"),
+            column => (string?)column.Attribute("Binding") == "{Binding Selected, Mode=TwoWay}");
+        Assert.Contains(editor.Descendants(wpf + "ComboBoxItem"),
+            item => (string?)item.Attribute("Tag") == "4");
+        var source = Read("IedBrowserWriteWindow.xaml.cs");
+        Assert.DoesNotContain("MessageBox.Show(", source);
+        Assert.Contains("selected.Length > 16", source);
+        Assert.Contains("if (!result.Succeeded)", source);
+    }
+
+    [Fact]
+    public void TypedEncoderDelegatesCtlModelToNativeServiceAndRefusesUnverifiedEnumsAndFloats()
+    {
+        // ctlModel is never a generic MMS Write, even when the integer is 0–4.
+        Assert.Contains("dedicated verified native ControlModel",
+            Assert.Throws<NotSupportedException>(() =>
+                IedBrowserWritePlan.EncodeValue("Enum", "4",
+                    "ZIVAVRLD1/ATCC1.TapChg.ctlModel")).Message);
+        Assert.Contains("exact verified SCL EnumType metadata",
+            Assert.Throws<NotSupportedException>(() =>
+                IedBrowserWritePlan.EncodeValue("ENUMERATED", "2",
+                    "ZIVAVRLD1/ATCC1.TapChg.oprVal")).Message);
+        Assert.Throws<FormatException>(() =>
+            IedBrowserWritePlan.EncodeValue("FLOAT32", "NaN", "LD1/ATCC1.f"));
+        Assert.Equal(MmsDataKind.Boolean,
+            IedBrowserWritePlan.EncodeValue("BOOLEAN", "true", "LD1/ATCC1.b").Kind);
+        // Native codec encodes FLOAT32 only; writing FLOAT64 or Unicode as
+        // 32-bit float/ASCII would silently mutate an incompatible DA.
+        Assert.False(IedBrowserWritePlan.IsSupported("FLOAT64"));
+        Assert.False(IedBrowserWritePlan.IsSupported("UNICODE255"));
+        Assert.Throws<NotSupportedException>(() =>
+            IedBrowserWritePlan.EncodeValue("FLOAT64", "123.45", "LD1/ATCC1.x"));
+        Assert.False(IedBrowserWritePlan.IsSupported("Quality"));
+        Assert.Empty(IedBrowserWritePlan.Build(null, null));
+    }
+
+    [Fact]
+    public void WriteCannotBypassLiveTypeOrControlFlightAdmission()
+    {
+        var native = Read("Services/NativeIec61850Client.BrowserWrite.cs");
+        var runtime = Read("Services/Iec61850MonitorRuntime.BrowserWrite.cs");
+        Assert.Contains("MmsClientSession", Read("Services/NativeIec61850Client.cs"));
+        Assert.Contains("_session.WriteSingleVariableAsync(target, desired", native);
+        Assert.Contains("ReadSingleVariableAsync(target, cancellationToken)", native);
+        Assert.Contains("No automatic retry", native);
+        Assert.Contains("generic MMS Write forbidden.", native);
+        Assert.Contains("segment.Equals(\"ctlModel\"", native);
+        Assert.Contains("ReferenceEquals(session.Device.LiveDiscoveryModel, model)", runtime);
+        Assert.Contains("Iec61850ControlFlightAdmission.TryEnter(", runtime);
+        Assert.Contains("Iec61850ControlFlightAdmission.Quarantine(", runtime);
+    }
+
+    private static string Read(string path)
+    {
+        DirectoryInfo? folder = new(AppContext.BaseDirectory);
+        while (folder != null)
+        {
+            var full = Path.Combine(folder.FullName, path);
+            if (File.Exists(full)) return File.ReadAllText(full);
+            folder = folder.Parent;
+        }
+        throw new FileNotFoundException(path);
+    }
+}
diff --git a/tests/ARSAS.Tests/IedTaskDialogVisualRegressionTests.cs b/tests/ARSAS.Tests/IedTaskDialogVisualRegressionTests.cs
index a686d9d05..b641cdeeb 100644
--- a/tests/ARSAS.Tests/IedTaskDialogVisualRegressionTests.cs
+++ b/tests/ARSAS.Tests/IedTaskDialogVisualRegressionTests.cs
@@ -8,6 +8,7 @@ namespace ARSAS.Tests;
 /// backgrounds and a fixed-height connect wizard clipping its final panel.
 /// This suite does not simulate IEC 61850 sessions or alter action authority.
 /// </summary>
+[Collection("WpfStaIsolation")]
 public sealed class IedTaskDialogVisualRegressionTests
 {
     private static readonly XNamespace Presentation = "http://schemas.microsoft.com/winfx/2006/xaml/presentation";
@@ -21,11 +22,20 @@ public void BothDialogs_UseIsolatedHighContrastSurfaceAndBoundedNaturalHeight()
             var document = XDocument.Load(Find(file));
             var root = Assert.IsType<XElement>(document.Root);
             Assert.Equal("Window", root.Name.LocalName);
-            Assert.Equal("Height", (string?)root.Attribute("SizeToContent"));
+            Assert.Equal(file == "IpConnectWizardWindow.xaml" ? "Manual" : "Height",
+                (string?)root.Attribute("SizeToContent"));
             Assert.Equal("TaskDialogCanvas", ResourceRef((string?)root.Attribute("Background"), "DynamicResource"));
-            Assert.True(double.TryParse((string?)root.Attribute("MaxHeight"),
-                NumberStyles.Float, CultureInfo.InvariantCulture, out var max) && max <= 700);
-            Assert.Null(root.Attribute("Height"));
+            if (file == "IpConnectWizardWindow.xaml")
+            {
+                Assert.Equal("350", (string?)root.Attribute("Height"));
+                Assert.Equal("CenterOwner", (string?)root.Attribute("WindowStartupLocation"));
+            }
+            else
+            {
+                Assert.True(double.TryParse((string?)root.Attribute("MaxHeight"),
+                    NumberStyles.Float, CultureInfo.InvariantCulture, out var max) && max <= 700);
+                Assert.Null(root.Attribute("Height"));
+            }
             Assert.Contains(root.Descendants(Presentation + "ResourceDictionary"),
                 element => element.Attribute("Source")?.Value == "Styles/IedTaskDialogStyles.xaml");
             Assert.Contains(root.Descendants(Presentation + "ScrollViewer"),
@@ -131,24 +141,33 @@ public void IedActions_RemainsTaskScoped_AndTechnicalNotesAreInTooltips()
     }
 
     [Fact]
-    public void AddIed_PreservesSavedIpBindingValidationFeedbackAndKeyboardActions()
+    public void AddIed_PreservesHistoryValidationFeedbackAndKeyboardActions()
     {
         var xml = File.ReadAllText(Find("IpConnectWizardWindow.xaml"));
         var source = File.ReadAllText(Find("IpConnectWizardWindow.xaml.cs"));
-        Assert.Contains("x:Name=\"RelayIpBox\"", xml, StringComparison.Ordinal);
-        Assert.Contains("RecentRelayIps", xml, StringComparison.Ordinal);
-        Assert.Contains("RelayIpAddress", xml, StringComparison.Ordinal);
-        Assert.Contains("MmsPortText", xml, StringComparison.Ordinal);
-        Assert.Contains("x:Name=\"WizardStatusText\"", xml, StringComparison.Ordinal);
-        Assert.Contains("Style=\"{StaticResource TaskDialogError}\"", xml, StringComparison.Ordinal);
-        Assert.Contains("IsDefault=\"True\"", xml, StringComparison.Ordinal);
-        Assert.Contains("IsCancel=\"True\"", xml, StringComparison.Ordinal);
-        Assert.Contains("Click=\"Connect_Click\"", xml, StringComparison.Ordinal);
-        Assert.Contains("Click=\"Cancel_Click\"", xml, StringComparison.Ordinal);
+        foreach (var required in new[]
+        {
+            "x:Name=\"Octet1Box\"", "x:Name=\"Octet2Box\"",
+            "x:Name=\"Octet3Box\"", "x:Name=\"Octet4Box\"",
+            "x:Name=\"HistoryPopup\"", "x:Name=\"HistorySearchBox\"",
+            "x:Name=\"RawIpBox\"", "RelayIpAddress", "MmsPortText",
+            "x:Name=\"WizardStatusText\"", "Style=\"{StaticResource TaskDialogError}\"",
+            "IsDefault=\"True\"", "IsCancel=\"True\"",
+            "Click=\"Connect_Click\"", "Click=\"Cancel_Click\""
+        })
+            Assert.Contains(required, xml, StringComparison.Ordinal);
+
+        foreach (var required in new[]
+        {
+            "UserPreferenceStore.LoadRecentEndpointDetails()",
+            "TryNormalizeIpv4Octets(", "IPAddress.TryParse",
+            "port is <= 0 or > 65535", "Octet_Pasting",
+            "Octet_PreviewKeyDown", "HistorySearchBox_TextChanged",
+            "CommitHistorySelection()"
+        })
+            Assert.Contains(required, source, StringComparison.Ordinal);
+
         Assert.DoesNotContain("Flow: TCP/TPKT/COTP", xml, StringComparison.Ordinal);
-        Assert.Contains("UserPreferenceStore.LoadRecentEndpoints()", source, StringComparison.Ordinal);
-        Assert.Contains("System.Net.IPAddress.TryParse", source, StringComparison.Ordinal);
-        Assert.Contains("port is <= 0 or > 65535", source, StringComparison.Ordinal);
     }
 
     private static string? ResourceRef(string? value, string extension = "StaticResource")
diff --git a/tests/ARSAS.Tests/M214RioPinnedEngineCompatibilityTests.cs b/tests/ARSAS.Tests/M214RioPinnedEngineCompatibilityTests.cs
index 283615ca6..55ed447b1 100644
--- a/tests/ARSAS.Tests/M214RioPinnedEngineCompatibilityTests.cs
+++ b/tests/ARSAS.Tests/M214RioPinnedEngineCompatibilityTests.cs
@@ -22,7 +22,7 @@ public void ExactRootRio_IsSingleComtradeDisplayRow_AndOneCompleteDownloadPlan()
         };
         var original = Catalog(root);
         var originalRecord = Assert.Single(original.Records);
-        Assert.Equal(2, originalRecord.Files.Count); // pinned engine lacks RIO
+        Assert.Equal(3, originalRecord.Files.Count); // staged engine already owns exact root RIO
         var enriched = IedBrowserRioSidecarBridge.Attach(original, root);
         var index = new IedBrowserFileCatalog(enriched, root);
         var bundle = Assert.Single(index.DisplayRows, row => row.IsBundle);
@@ -38,7 +38,8 @@ public void ExactRootRio_IsSingleComtradeDisplayRow_AndOneCompleteDownloadPlan()
         var orphan = Assert.Single(index.DisplayRows, row => row.Name == "line_2.rio");
         Assert.False(orphan.IsBundle);
         Assert.False(index.TryGetRecord(orphan.RemotePath, out _, out _));
-        Assert.Equal(2, originalRecord.Files.Count); // no mutation of ARIEC source
+        Assert.Equal(3, originalRecord.Files.Count); // no mutation of ARIEC source
+        Assert.Same(original, enriched); // bridge must be idempotent with native RIO support
     }
 
     [Fact]
@@ -69,10 +70,12 @@ public void IncompleteCfgAndRio_DoesNotGrantMmsDownloadAuthority()
         var supplemented = IedBrowserRioSidecarBridge.Attach(engine, root);
         var index = new IedBrowserFileCatalog(supplemented, root);
         var bundle = Assert.Single(index.DisplayRows, row => row.IsBundle);
-        Assert.Equal(1, bundle.BundleMemberCount);
+        Assert.Equal(2, bundle.BundleMemberCount); // engine exposes CFG+RIO, still no DAT
         Assert.False(index.TryGetRecord(bundle.RemotePath, out _, out _));
-        var orphan = Assert.Single(index.DisplayRows, row => row.Name == "partial.rio");
-        Assert.False(index.TryGetRecord(orphan.RemotePath, out _, out _));
+        Assert.Contains(index.Files, row => row.Name == "partial.rio");
+        Assert.False(index.TryGetRecord("partial.rio", out _, out _));
+        // One incomplete bundle, no duplicate RIO row / false download authority.
+        Assert.Single(index.DisplayRows);
     }
 
     [Fact]
diff --git a/tests/ARSAS.Tests/M217GDataSetSclSchemaFallbackTests.cs b/tests/ARSAS.Tests/M217GDataSetSclSchemaFallbackTests.cs
index 7a755552a..f96e7461b 100644
--- a/tests/ARSAS.Tests/M217GDataSetSclSchemaFallbackTests.cs
+++ b/tests/ARSAS.Tests/M217GDataSetSclSchemaFallbackTests.cs
@@ -119,7 +119,13 @@ public void BrowserFocusedHydrationIsBoundedAndReusesExistingReadSafetyPath()
         Assert.NotNull(folder);
         var source = File.ReadAllText(Path.Combine(folder!.FullName,
             "MainWindow.IedBrowser.cs"));
-        Assert.Contains("QueueIedBrowserFocusedRead(row)", source);
+        // Focused reads are now scheduled only after the current asynchronous
+        // detail projection passes IED/model/association fencing.
+        var worker = File.ReadAllText(Path.Combine(folder.FullName,
+            "MainWindow.IedBrowser.AsyncDetails.cs"));
+        Assert.Contains("QueueIedBrowserFocusedRead(page)", worker);
+        Assert.Contains("owner?.LiveValues.Association != association", worker);
+        Assert.Contains("generation != _iedBrowserDetailBuildGeneration", worker);
         Assert.Contains("_iedBrowserAutoReadAdmission.TryStart(", source);
         Assert.Contains("QueueIedBrowserFocusedRead(lnPage, detail.ReadObjectReference)", source);
         Assert.Contains("IedBrowserReadPlan.BuildFocused(", source);
diff --git a/tests/ARSAS.Tests/M217KC264TypedStatusReportIntegrationTests.cs b/tests/ARSAS.Tests/M217KC264TypedStatusReportIntegrationTests.cs
index 12111a914..4b1afa625 100644
--- a/tests/ARSAS.Tests/M217KC264TypedStatusReportIntegrationTests.cs
+++ b/tests/ARSAS.Tests/M217KC264TypedStatusReportIntegrationTests.cs
@@ -88,9 +88,24 @@ public void TestProductUsesExplicitlyApprovedEngineCommitNotPreviouslyPinnedDll(
             stageTrial.GetProperty("baseEngineCommit").GetString());
         Assert.Equal("9c7cb40364023a7b217e5ec31ab3105ba90142eb",
             stageTrial.GetProperty("exactCommit").GetString());
+        var typedTrial = lockRoot.GetProperty("globalTypedControlStageTrial");
         Assert.Equal(stageTrial.GetProperty("exactCommit").GetString(),
+            typedTrial.GetProperty("baseEngineCommit").GetString());
+        Assert.Equal("f75e323e9f8443aa20e0a3818a1d5d77255b2c0f",
+            typedTrial.GetProperty("exactCommit").GetString());
+        Assert.Equal(typedTrial.GetProperty("exactCommit").GetString(),
             lockRoot.GetProperty("commit").GetString());
-        Assert.Equal(184, lockRoot.GetProperty("sourcePullRequest").GetInt32());
+        Assert.Equal(192, lockRoot.GetProperty("sourcePullRequest").GetInt32());
+        Assert.Equal(192, typedTrial.GetProperty("enginePullRequest").GetInt32());
+        Assert.Equal(39909260816L, typedTrial.GetProperty("engineCiRun").GetInt64());
+        Assert.Equal("engine-ci-success-consumer-trial-not-physical",
+            typedTrial.GetProperty("status").GetString());
+        foreach (var flag in new[] {
+            "typedStatusReadRequired", "sameDataObjectFeedbackRequired",
+            "ctlModelAndOperShapeRequired", "sbowEnhancedSafetyRequired",
+            "noAutomaticOperate", "physicalQualificationRequired",
+            "mainlinePromotionForbidden" })
+            Assert.True(typedTrial.GetProperty(flag).GetBoolean());
         Assert.Equal(184, stageTrial.GetProperty("enginePullRequest").GetInt32());
         Assert.Equal(185, stageTrial.GetProperty("engineCiOnlyPullRequest").GetInt32());
         Assert.Equal(1182, stageTrial.GetProperty("engineTestsPassed").GetInt32());
diff --git a/tests/ARSAS.Tests/M2QuickStartBrowseTests.cs b/tests/ARSAS.Tests/M2QuickStartBrowseTests.cs
index bbc3610d0..258d25b68 100644
--- a/tests/ARSAS.Tests/M2QuickStartBrowseTests.cs
+++ b/tests/ARSAS.Tests/M2QuickStartBrowseTests.cs
@@ -7,6 +7,7 @@ namespace ARSAS.Tests;
 /// Source-neutral task authority contracts for imported SCL and discovered IEDs.
 /// The actual MMS and report paths remain covered by existing integration suites.
 /// </summary>
+[Collection("WpfStaIsolation")]
 public sealed class M2QuickStartBrowseTests
 {
     private static readonly XNamespace P = "http://schemas.microsoft.com/winfx/2006/xaml/presentation";
diff --git a/tests/ARSAS.Tests/ModelDrivenAutoCommandDockTests.cs b/tests/ARSAS.Tests/ModelDrivenAutoCommandDockTests.cs
new file mode 100644
index 000000000..e325924ee
--- /dev/null
+++ b/tests/ARSAS.Tests/ModelDrivenAutoCommandDockTests.cs
@@ -0,0 +1,212 @@
+using System.Collections.Specialized;
+using AR.Iec61850.Discovery;
+using ArIED61850Tester.Models;
+using ArIED61850Tester.Services;
+
+namespace ARSAS.Tests;
+
+/// <summary>Control service evidence -> read-only typed proof -> stable Dock.
+/// Never generates a physical MMS control request.</summary>
+public sealed class ModelDrivenAutoCommandDockTests
+{
+    private static SignalDefinition Candidate(string reference, string cdc = "DPC",
+        bool withCo = true)
+        => new()
+        {
+            ObjectReference = reference, Name = reference,
+            FunctionalConstraint = "CO", IsControlSignal = true,
+            HasControlServiceEvidence = withCo, IsSelected = false,
+            ControlCdc = cdc, ControlModelText = "Auto-detect"
+        };
+
+    private static void Verify(SignalDefinition signal, string cdc)
+    {
+        signal.ControlModelText = "Select Before Operate (SBO) • Enhanced security";
+        signal.AcceptVerifiedLiveControlCdc(cdc);
+        signal.ControlSemanticVerified = true;
+    }
+
+    [Theory]
+    [InlineData("LD/Bkr0XCBR2.Pos", "DPC")]
+    [InlineData("LD/Disc0XSWI1.Pos", "DPC")]
+    [InlineData("LD/BkrCSWI1.Pos", "DPC")]
+    [InlineData("LD/AnyRelayLNode1.TapChg", "BSC")]
+    [InlineData("LD/GGIO1.Enable", "SPC")]
+    [InlineData("LD/AVCO1.SetV", "APC")]
+    public void ModelEvidenceNotLnNames_SelectsAllClassesForReadOnlyInspection(
+        string reference, string cdc)
+    {
+        var candidate = Candidate(reference, cdc);
+        var selected = Iec61850ControlIdentity.DiscoveredControlInspectionCandidates([candidate]);
+        Assert.Same(candidate, Assert.Single(selected));
+        Assert.False(candidate.ControlSupportsOperate);
+        Assert.Empty(Iec61850ControlIdentity.VerifiedCommandTargets([candidate], true));
+    }
+
+    [Fact]
+    public void LiveControlProbePrioritizesEquipmentBeforeLargeGenericChannelBank()
+    {
+        var bank = Enumerable.Range(1, 900)
+            .Select(i => Candidate($"SG7_BCUMaster/GGIO2.DPCSO{i:000}"))
+            .ToList();
+        var breaker = Candidate("SG7_BCUSystem/Bkr0XCBR1.Pos");
+        var switchController = Candidate("SG7_BCUSystem/BkrCSWI1.Pos");
+        var disconnector = Candidate("SG7_BCUSystem/Disc0XSWI1.Pos");
+        var tap = Candidate("CustomLD/ATCC1.TapChg", "BSC");
+        // Deliberately put hundreds of generic channels first.
+        var candidates = bank.Concat([switchController, tap, disconnector, breaker]).ToArray();
+        var scheduled = Iec61850ControlIdentity.DiscoveredControlInspectionCandidates(candidates);
+        Assert.Equal(new[] { switchController, breaker, disconnector, tap },
+            scheduled.Take(4));
+        Assert.Equal(904, scheduled.Length);
+        Assert.All(scheduled, signal => Assert.False(signal.ControlSupportsOperate));
+        Assert.Empty(Iec61850ControlIdentity.VerifiedCommandTargets(scheduled, true));
+    }
+
+    [Fact]
+    public void NoCoCfProofMeansNoAutomaticCommandEvenWithPosOrTapChgName()
+    {
+        var ghosts = new[]
+        {
+            Candidate("LD/Bkr0XCBR2.Pos", withCo: false),
+            Candidate("LD/ATCC1.TapChg", "BSC", withCo: false),
+            Candidate("LD/CSWI1.Pos", withCo: false)
+        };
+        Assert.Empty(Iec61850ControlIdentity.DiscoveredControlInspectionCandidates(ghosts));
+        foreach (var signal in ghosts) Verify(signal, signal.ControlCdc);
+        Assert.Empty(Iec61850ControlIdentity.VerifiedCommandTargets(ghosts, true));
+    }
+
+    [Fact]
+    public void VerifiedAutomaticDockIncludesTapAndPrefixedSwitch_WithoutUserSelection()
+    {
+        var breaker = Candidate("SG7_BCUSystem/Bkr0XCBR2.Pos");
+        var tap = Candidate("OTHER/UnusualLn1.TapChg", "BSC");
+        var statusOnly = Candidate("SG7_BCUSystem/Disc0XSWI2.Pos");
+        statusOnly.ControlModelText = "Status only";
+        var noProof = Candidate("SG7_BCUSystem/Bkr0XCBR1.Pos", withCo: false);
+        Verify(breaker, "DPC");
+        Verify(tap, "BSC");
+        Verify(noProof, "DPC");
+
+        var device = new Iec61850MonitorDevice { IsConnected = true,
+            LiveDiscoveryModel = new LiveIedModelDiscoveryDocument() };
+        device.Signals.ReplaceAll([breaker, tap, statusOnly, noProof]);
+        device.RecountSelectedSignals();
+
+        Assert.Equal(2, device.OperableCommandSignals.Count);
+        Assert.Contains(breaker, device.OperableCommandSignals);
+        Assert.Contains(tap, device.OperableCommandSignals);
+        Assert.DoesNotContain(statusOnly, device.OperableCommandSignals);
+        Assert.DoesNotContain(noProof, device.OperableCommandSignals);
+        Assert.False(breaker.IsSelected);
+        Assert.False(tap.IsSelected);
+
+        var events = new List<NotifyCollectionChangedAction>();
+        device.OperableCommandSignals.CollectionChanged += (_, e) => events.Add(e.Action);
+        var first = device.OperableCommandSignals.ToArray();
+        for (var i = 0; i < 100; i++)
+        {
+            breaker.ControlCurrentValue = i % 2 == 0 ? "Open" : "Closed";
+            tap.ControlInspectionEvidence = "MMS read-only status refreshed";
+            device.RefreshCommandSignalProjection();
+        }
+        Assert.Empty(events);
+        Assert.True(first.SequenceEqual(device.OperableCommandSignals));
+    }
+
+    [Fact]
+    public void DuplicateControlReference_UsesVerifiedOwnerRegardlessOfSelection()
+    {
+        var staleSelected = Candidate("LD/BkrCSWI1.Pos");
+        staleSelected.IsSelected = true;
+        var live = Candidate("LD/BkrCSWI1.Pos");
+        Verify(live, "DPC");
+        Assert.Same(live, Assert.Single(Iec61850ControlIdentity.VerifiedCommandTargets(
+            [staleSelected, live], true)));
+    }
+
+    [Fact]
+    public void Ed2VerifiedEquipmentAppearsBeforeGenericIoWithoutInventingWiring()
+    {
+        var io = Candidate("SG7_BCUMaster/GGIO2.DPCSO01");
+        var breaker1 = Candidate("SG7_BCUSystem/Bkr0XCBR1.Pos");
+        var breaker2 = Candidate("SG7_BCUSystem/Bkr0XCBR2.Pos");
+        var cswi = Candidate("SG7_BCUSystem/BkrCSWI1.Pos");
+        var cilo = Candidate("SG7_BCUSystem/BkrCILO1.EnaOpn", "SPC", withCo: false);
+        var disconnector = Candidate("SG7_BCUSystem/Disc0XSWI1.Pos");
+        var tap = Candidate("OtherLD/ATCC1.TapChg", "BSC");
+        var unknown = Candidate("OtherLD/OddVendor1.Pos");
+        var statusOnly = Candidate("SG7_BCUSystem/Bkr0XCBR3.Pos");
+        statusOnly.ControlModelText = "Status only";
+        cilo.ControlModelText = "Status only";
+
+        var signals = new[] { io, breaker1, breaker2, cswi, cilo,
+            disconnector, tap, unknown, statusOnly };
+        foreach (var signal in signals.Where(s =>
+            !ReferenceEquals(s, statusOnly) && !ReferenceEquals(s, cilo)))
+            Verify(signal, signal.ControlCdc);
+
+        var device = new Iec61850MonitorDevice
+        {
+            IsConnected = true,
+            LiveDiscoveryModel = new LiveIedModelDiscoveryDocument()
+        };
+        device.Signals.ReplaceAll(signals);
+        device.RecountSelectedSignals();
+
+        var dock = device.OperableCommandSignals.ToArray();
+        Assert.Equal(7, dock.Length);
+        Assert.Equal(new[] { tap, cswi, breaker1, breaker2, disconnector,
+            unknown, io }, dock);
+        Assert.Equal("Circuit breaker · XCBR",
+            Iec61850ControlIdentity.CommandDockRole(breaker1));
+        Assert.Equal("Generic I/O · equipment unlinked",
+            Iec61850ControlIdentity.CommandDockRole(io));
+        Assert.DoesNotContain(statusOnly, dock);
+        Assert.DoesNotContain(cilo, dock);
+        // Status ownership and equipment linkage are not guessed from rank:
+        // the independent CSWI command and breaker remain separate references.
+        Assert.NotEqual(breaker1.ObjectReference, cswi.ObjectReference);
+
+        var events = new List<NotifyCollectionChangedAction>();
+        device.OperableCommandSignals.CollectionChanged += (_, args) => events.Add(args.Action);
+        for (var i = 0; i < 100; i++)
+        {
+            breaker1.ControlCurrentValue = i % 2 == 0 ? "Open" : "Closed";
+            device.RefreshCommandSignalProjection();
+        }
+        Assert.Empty(events);
+        Assert.Equal(dock, device.OperableCommandSignals);
+    }
+
+    [Fact]
+    public void RawMmsNameListCreatesCandidateOnlyForExactCoCfService()
+    {
+        var snapshot = new NativeMmsDiscoverySnapshot
+        {
+            DomainVariables = new Dictionary<string, IReadOnlyList<string>>
+            {
+                ["LD"] = [
+                    "Bkr0XCBR2$ST$Pos$stVal",
+                    "Disc0XSWI1$ST$Pos$stSeld",
+                    "ATCC1$ST$TapChg$valWTr$posVal",
+                    "Bkr0XCBR2$CF$Pos$ctlModel",
+                    "ATCC1$CO$TapChg$Oper$ctlVal",
+                    "GGIO1$CO$SetPoint$SBOw$ctlVal"
+                ]
+            }
+        };
+        var signals = NativeMmsDiscoveryMapper.BuildSignals(snapshot);
+        var controls = signals.Where(s => s.IsControlSignal).ToArray();
+        Assert.Contains(controls, s => s.ObjectReference == "LD/Bkr0XCBR2.Pos" &&
+                                        s.HasControlServiceEvidence);
+        Assert.Contains(controls, s => s.ObjectReference == "LD/ATCC1.TapChg" &&
+                                        s.HasControlServiceEvidence);
+        Assert.Contains(controls, s => s.ObjectReference == "LD/GGIO1.SetPoint" &&
+                                        s.HasControlServiceEvidence);
+        Assert.DoesNotContain(controls, s => s.ObjectReference == "LD/Disc0XSWI1.Pos");
+        Assert.All(controls, s => Assert.False(s.ControlSupportsOperate));
+        Assert.All(controls, s => Assert.True(string.IsNullOrEmpty(s.VerifiedLiveControlCdc)));
+    }
+}
diff --git a/tests/ARSAS.Tests/MultiGridNaturalSortRegressionTests.cs b/tests/ARSAS.Tests/MultiGridNaturalSortRegressionTests.cs
index 164159a12..22c09021d 100644
--- a/tests/ARSAS.Tests/MultiGridNaturalSortRegressionTests.cs
+++ b/tests/ARSAS.Tests/MultiGridNaturalSortRegressionTests.cs
@@ -1,9 +1,14 @@
 using System.Xml.Linq;
+using System.Collections;
+using System.Windows.Controls;
+using System.Windows.Data;
+using AR.Iec61850.Discovery;
 using ArIED61850Tester.Models;
 using ArIED61850Tester.Services;
 
 namespace ARSAS.Tests;
 
+[Collection("WpfStaIsolation")]
 public sealed class MultiGridNaturalSortRegressionTests
 {
     [Fact]
@@ -39,6 +44,107 @@ public void CommandDockSortingOrdersInstanceNumbersWithoutMutatingSource()
         Assert.Same(ten,unordered[0]);
     }
 
+    [Fact]
+    public void ActualWpfCommandGridViewMustDisplayVerifiedSg7BreakerAheadOfGgioBank()
+    {
+        // Reproduces field screenshot: two verified control classes from
+        // distinct logical devices. Data model sorting alone is insufficient,
+        // because ListCollectionView.CustomSort is WPF's actual UI authority.
+        RunInSta(() =>
+        {
+            static SignalDefinition Verified(string reference, string cdc = "DPC")
+            {
+                var signal = new SignalDefinition
+                {
+                    ObjectReference = reference,
+                    Name = reference,
+                    IsControlSignal = true,
+                    IsSelected = true,
+                    HasControlServiceEvidence = true,
+                    FunctionalConstraint = "CO",
+                    ControlCdc = cdc,
+                    ControlModelText = "Select Before Operate (SBO) • Enhanced security"
+                };
+                signal.AcceptVerifiedLiveControlCdc(cdc);
+                signal.ControlSemanticVerified = true;
+                return signal;
+            }
+
+            // Start with a generic IO block, like the actual 04:28 field
+            // trace where GGIO2.DPCSO01 is the first displayed command.
+            var ggios = Enumerable.Range(1, 64)
+                .Select(i => Verified($"SG7_BCUMaster/GGIO2.DPCSO{i:00}"))
+                .ToArray();
+            var breakers = Enumerable.Range(1, 4)
+                .Select(i => Verified($"SG7_BCUSystem/Bkr0XCBR{i}.Pos"))
+                .ToArray();
+            var cswi = Enumerable.Range(1, 4)
+                .Select(i => Verified($"SG7_BCUSystem/BkrCSWI{i}.Pos"))
+                .ToArray();
+            var switches = Enumerable.Range(1, 3)
+                .Select(i => Verified($"SG7_BCUSystem/Disc0XSWI{i}.Pos"))
+                .ToArray();
+            var device = new Iec61850MonitorDevice
+            {
+                IsConnected = true,
+                LiveDiscoveryModel = new LiveIedModelDiscoveryDocument()
+            };
+            device.Signals.ReplaceAll(ggios.Concat(cswi).Concat(switches).Concat(breakers));
+            device.RecountSelectedSignals();
+
+            // Mirror the production Dock: no WPF new-item placeholder in the view.
+            var grid = new DataGrid
+            {
+                CanUserAddRows = false,
+                CanUserDeleteRows = false,
+                ItemsSource = device.OperableCommandSignals
+            };
+            var view = Assert.IsType<ListCollectionView>(
+                CollectionViewSource.GetDefaultView(grid.ItemsSource));
+            view.SortDescriptions.Clear();
+            view.CustomSort = IecNaturalCommandSort.Instance;
+            SignalDefinition[] visual() => view.Cast<SignalDefinition>().ToArray();
+
+            var first = visual();
+            Assert.Equal(75, first.Length);
+            // CSWI is the explicitly requested operator-first IEC switch
+            // control tier; XCBR/XSWI remain discoverable below it.
+            Assert.Equal(cswi.Select(s => s.ObjectReference),
+                first.Take(4).Select(s => s.ObjectReference));
+            Assert.Equal(breakers.Select(s => s.ObjectReference),
+                first.Skip(4).Take(4).Select(s => s.ObjectReference));
+            Assert.Equal(switches.Select(s => s.ObjectReference),
+                first.Skip(8).Take(3).Select(s => s.ObjectReference));
+            Assert.Equal(ggios.Select(s => s.ObjectReference),
+                first.Skip(11).Select(s => s.ObjectReference));
+
+            // Report refresh and WPF re-sort cannot promote GGIO back to top.
+            var selected = breakers[0];
+            selected.ControlInterlockCheck = false;
+            for (var i = 0; i < 10; i++)
+            {
+                selected.ControlCurrentValue = i % 2 == 0 ? "Open" : "Closed";
+                device.RefreshCommandSignalProjection();
+                view.Refresh();
+                Assert.Same(cswi[0], visual()[0]);
+            }
+            Assert.False(selected.ControlInterlockCheck);
+        });
+    }
+
+    [Fact]
+    public void CommandComparatorDoesNotTreatUnverifiedNamesAsOperatePermission()
+    {
+        var gg = new SignalDefinition { ObjectReference = "SG7_BCUMaster/GGIO2.DPCSO01",
+            ControlCdc = "DPC", IsControlSignal = true };
+        var cb = new SignalDefinition { ObjectReference = "SG7_BCUSystem/Bkr0XCBR1.Pos",
+            ControlCdc = "DPC", IsControlSignal = true };
+        Assert.True(IecNaturalCommandSort.Instance.Compare(cb, gg) < 0);
+        Assert.False(cb.ControlSupportsOperate);
+        Assert.False(gg.ControlSupportsOperate);
+        Assert.Empty(Iec61850ControlIdentity.VerifiedCommandTargets([cb, gg], true));
+    }
+
     [Fact]
     public void GlobalMonitorGroupsIEDThenNaturalInstance()
     {
@@ -53,6 +159,21 @@ static Iec61850MonitorPoint Point(string device,string ln) =>
         Assert.Equal(new[]{"CSWI1","CSWI2","CSWI10"},sorted.Skip(2).Select(x=>x.IecTelegram.Split('/').Last().Split('.')[0]));
     }
 
+    private static void RunInSta(Action action)
+    {
+        Exception? thrown = null;
+        var thread = new Thread(() =>
+        {
+            try { action(); }
+            catch (Exception ex) { thrown = ex; }
+        });
+        thread.SetApartmentState(ApartmentState.STA);
+        thread.Start();
+        Assert.True(thread.Join(TimeSpan.FromSeconds(20)), "WPF command-view sort test timed out");
+        if (thrown is not null)
+            System.Runtime.ExceptionServices.ExceptionDispatchInfo.Capture(thrown).Throw();
+    }
+
     private static string Read(string path)
     {
         DirectoryInfo? dir=new(AppContext.BaseDirectory);
diff --git a/tests/ARSAS.Tests/NativeFatFieldEvidenceRegressionTests.cs b/tests/ARSAS.Tests/NativeFatFieldEvidenceRegressionTests.cs
index cd08f82d5..1cd806721 100644
--- a/tests/ARSAS.Tests/NativeFatFieldEvidenceRegressionTests.cs
+++ b/tests/ARSAS.Tests/NativeFatFieldEvidenceRegressionTests.cs
@@ -9,6 +9,7 @@
 
 namespace ARSAS.Tests;
 
+[Collection("WpfStaIsolation")]
 public sealed class NativeFatFieldEvidenceRegressionTests
 {
     [Fact]
diff --git a/tests/ARSAS.Tests/OperatorNavigationSingleGlyphM214Tests.cs b/tests/ARSAS.Tests/OperatorNavigationSingleGlyphM214Tests.cs
index 9c6c708cd..287f07dd1 100644
--- a/tests/ARSAS.Tests/OperatorNavigationSingleGlyphM214Tests.cs
+++ b/tests/ARSAS.Tests/OperatorNavigationSingleGlyphM214Tests.cs
@@ -12,6 +12,7 @@ namespace ARSAS.Tests;
 /// an operator-supplied WPF SVG must not be wrapped in a second old icon.
 /// Exercise the real runtime decorator on STA, not just XAML path counts.
 /// </summary>
+[Collection("WpfStaIsolation")]
 public sealed class OperatorNavigationSingleGlyphM214Tests
 {
     private static readonly XNamespace P = "http://schemas.microsoft.com/winfx/2006/xaml/presentation";
diff --git a/tests/ARSAS.Tests/P0ActionsDirectPortableArtifactTests.cs b/tests/ARSAS.Tests/P0ActionsDirectPortableArtifactTests.cs
new file mode 100644
index 000000000..67c1d92fe
--- /dev/null
+++ b/tests/ARSAS.Tests/P0ActionsDirectPortableArtifactTests.cs
@@ -0,0 +1,37 @@
+namespace ARSAS.Tests;
+
+public sealed class P0ActionsDirectPortableArtifactTests
+{
+    [Fact]
+    public void PortableExeIsDirectDownloadWithNoZipAndKeepsSealedReleasePackage()
+    {
+        // Verifies distribution only; no compiler, IED, engine or release
+        // authority changes. GitHub upload-artifact@v7 supports archive:false
+        // only for ONE file and derives artifact name from its basename.
+        for (DirectoryInfo? dir = new(AppContext.BaseDirectory);
+             dir is not null; dir = dir.Parent)
+        {
+            var path = Path.Combine(dir.FullName, ".github", "workflows", "build.yml");
+            if (!File.Exists(path)) continue;
+            var yaml = File.ReadAllText(path);
+            Assert.Contains("name: ARSAS-windows-package-input", yaml);
+            Assert.Contains("name: Upload sealed Windows package input", yaml);
+            Assert.Contains("name: Upload directly downloadable portable EXE (no ZIP)", yaml);
+            var start = yaml.IndexOf(
+                "      - name: Upload directly downloadable portable EXE (no ZIP)",
+                StringComparison.Ordinal);
+            Assert.True(start >= 0);
+            var tail = yaml[start..];
+            Assert.Contains("uses: actions/upload-artifact@v7", tail);
+            Assert.Contains(@"path: ArIED61850Tester\dist\ARSAS-*-win-x64-portable.exe", tail);
+            Assert.Contains("archive: false", tail);
+            Assert.Contains("if-no-files-found: error", tail);
+            Assert.DoesNotContain("portable-build-identity.json", tail);
+            Assert.DoesNotContain("name: ARSAS-win-x64-portable-single-exe", tail);
+            // No synthetic release asset, side workflow or new build steps.
+            Assert.DoesNotContain("gh release create", tail);
+            return;
+        }
+        throw new FileNotFoundException("Repository build.yml not found.");
+    }
+}
diff --git a/tests/ARSAS.Tests/P0BrowserRcbEnabledTruthTests.cs b/tests/ARSAS.Tests/P0BrowserRcbEnabledTruthTests.cs
index e54867e56..556593089 100644
--- a/tests/ARSAS.Tests/P0BrowserRcbEnabledTruthTests.cs
+++ b/tests/ARSAS.Tests/P0BrowserRcbEnabledTruthTests.cs
@@ -117,6 +117,26 @@ public void ReconnectStopAndModelAmbiguityFailClosed()
         Assert.Empty(IedBrowserRcbEnabledPresentation.VerifiedTargets(null));
     }
 
+    [Fact]
+    public void VerifiedRcbTargets_CacheIsModelScopedAndCannotBeMutatedByConsumer()
+    {
+        var one = Model(Root, Other);
+        var first = IedBrowserRcbEnabledPresentation.VerifiedTargets(one);
+        for (var tick = 0; tick < 100; tick++)
+            Assert.Same(first, IedBrowserRcbEnabledPresentation.VerifiedTargets(one));
+
+        var replacement = Model(Root, Other);
+        var second = IedBrowserRcbEnabledPresentation.VerifiedTargets(replacement);
+        Assert.NotSame(first, second);
+        Assert.Equal(first.Keys.Order(), second.Keys.Order());
+        Assert.Equal(2, first.Count);
+        Assert.False(first is Dictionary<string, IedBrowserReadTarget>);
+
+        // Duplicated vendor RCB references are still not granted enablement evidence.
+        var duplicates = Model(Root, Root);
+        Assert.Empty(IedBrowserRcbEnabledPresentation.VerifiedTargets(duplicates));
+    }
+
     [Fact]
     public void VirtualTreeStartsWithExactlySixCollapsedCategories()
     {
diff --git a/tests/ARSAS.Tests/P0CommandStopRaceAdmissionTests.cs b/tests/ARSAS.Tests/P0CommandStopRaceAdmissionTests.cs
index ad20917fd..306c674bd 100644
--- a/tests/ARSAS.Tests/P0CommandStopRaceAdmissionTests.cs
+++ b/tests/ARSAS.Tests/P0CommandStopRaceAdmissionTests.cs
@@ -114,9 +114,10 @@ public void QuickCommandDock_ClassifiesLocalBusyBeforeGenericFailure()
         var dialog = File.ReadAllText(
             Path.Combine(current!.FullName, "ControlCommandWindow.xaml.cs"));
         var dialogLocal = dialog.IndexOf("CommandStage = \"Command not sent\"", StringComparison.Ordinal);
-        var dialogGeneric = dialog.IndexOf("CommandStage = \"Command failed\"", StringComparison.Ordinal);
-        Assert.True(dialogLocal >= 0 && dialogGeneric > dialogLocal,
-            "The control dialog must also separate local busy from possible wire failure.");
+        var dialogUnresolved = dialog.IndexOf("CommandStage = \"Outcome unresolved\"", StringComparison.Ordinal);
+        Assert.True(dialogLocal >= 0 && dialogUnresolved > dialogLocal,
+            "Local NOT SENT must be distinguished from an unresolved control result that may have reached the wire.");
+        Assert.Contains("Verify IED state before retry.", dialog, StringComparison.Ordinal);
     }
 
     private static object Slot(UiRuntime runtime, string deviceId)
diff --git a/tests/ARSAS.Tests/P0CswiCrossDataSetCommandDiscoveryTests.cs b/tests/ARSAS.Tests/P0CswiCrossDataSetCommandDiscoveryTests.cs
new file mode 100644
index 000000000..47432ace3
--- /dev/null
+++ b/tests/ARSAS.Tests/P0CswiCrossDataSetCommandDiscoveryTests.cs
@@ -0,0 +1,162 @@
+using ArIED61850Tester.Models;
+using ArIED61850Tester.Services;
+
+namespace ARSAS.Tests;
+
+/// <summary>Structural candidates never grant operate permission. Only live
+/// ctlModel + exact CDC/type/semantic proof makes a cross-DataSet CSWI visible.</summary>
+public sealed class P0CswiCrossDataSetCommandDiscoveryTests
+{
+    private static SignalDefinition Control(string path, bool selected = false)
+        => new()
+        {
+            ObjectReference = path,
+            Name = path,
+            FunctionalConstraint = "CO",
+            ControlCdc = "DPC",
+            IsControlSignal = true,
+            IsSelected = selected,
+            ControlModelText = "Auto-detect"
+        };
+
+    [Fact]
+    public void ControlsInOtherLogicalDevicesAreFoundWithoutDataSetMembership()
+    {
+        var cbFeedback = Control("GR_X_7SX85CB1/XCBR1.Pos", selected: true);
+        cbFeedback.ControlModelText = "Status only";
+        var disconnector = Control("GR_X_7SX85Ds1/XSWI1.Pos", selected: true);
+        disconnector.ControlModelText = "Status only";
+        var cswi = Control("GR_X_7SX85CB1/CSWI1.Pos");
+        var other = Control("GR_X_7SX85Ds1/CSWI2.Pos");
+        var nameplate = Control("GR_X_7SX85CB1/CSWI1.Mod");
+        // Genuinely discoverable CSWI may have no CDC yet; native inspection
+        // must establish it, not prefilter this exact DO away as generic.
+        other.ControlCdc = "";
+        var candidates = Iec61850ControlIdentity.IndependentCswiInspectionCandidates(
+            [cbFeedback, disconnector, cswi, other, nameplate]);
+        Assert.Equal(2, candidates.Length);
+        Assert.Contains(cswi, candidates);
+        Assert.Contains(other, candidates);
+        Assert.False(cswi.IsSelected);
+        Assert.Empty(Iec61850ControlIdentity.VerifiedIndependentCswiControls(candidates));
+
+        // StatusOnly or declaration-only never enables a command.
+        cswi.ControlModelText = "Status only";
+        Assert.Empty(Iec61850ControlIdentity.VerifiedIndependentCswiControls(candidates));
+        cswi.ControlModelText = "SBO • Enhanced security";
+        Assert.Empty(Iec61850ControlIdentity.VerifiedIndependentCswiControls(candidates));
+        cswi.AcceptVerifiedLiveControlCdc("DPC");
+        cswi.ControlSemanticVerified = true;
+        Assert.True(cswi.ControlSupportsOperate);
+        Assert.Equal(cswi,
+            Assert.Single(Iec61850ControlIdentity.VerifiedIndependentCswiControls(candidates)));
+        Assert.False(cswi.IsSelected);
+        Assert.False(cbFeedback.ControlSupportsOperate);
+        Assert.False(disconnector.ControlSupportsOperate);
+    }
+
+    [Fact]
+    public void AllServiceBackedControlsAreScheduledRegardlessOfNameOrDataset()
+    {
+        var candidates = Enumerable.Range(1, 2200)
+            .Select(i => Control($"ED2_SYS/Prefix{i}GGIO{i}.Command"))
+            .ToArray();
+        foreach (var item in candidates)
+            item.HasControlServiceEvidence = true;
+        // Neither a hard-coded LN class nor an arbitrary first-2048 cap is
+        // allowed to hide a real service-backed TapChg or vendor control.
+        var selected = Iec61850ControlIdentity.DiscoveredControlInspectionCandidates(candidates);
+        Assert.Equal(2200, selected.Length);
+        Assert.All(selected, item => Assert.False(item.ControlSupportsOperate));
+        Assert.Equal(12, Iec61850ControlIdentity.DiscoveredControlInspectionCandidates(
+            candidates, budget: 12).Length);
+    }
+
+    [Fact]
+    public void VerifiedCommandDockAdmissionsUseControlEvidence_NotLnNameOrDataSetMembership()
+    {
+        SignalDefinition Verified(string reference, string cdc)
+        {
+            var signal = Control(reference);
+            signal.HasControlServiceEvidence = true;
+            signal.ControlCdc = cdc;
+            signal.ControlModelText = "SBO • Enhanced security";
+            signal.AcceptVerifiedLiveControlCdc(cdc);
+            signal.ControlSemanticVerified = true;
+            return signal;
+        }
+
+        var breaker = Verified("SG7_BCUSystem/Bkr0XCBR2.Pos", "DPC");
+        var tap = Verified("LD_ATCC/SomePrefixATCC1.TapChg", "BSC");
+        var vendorCommand = Verified("LD_GEN/CustomGGIO7.FutureSwitch", "SPC");
+        var statusOnly = Control("SG7_BCUSystem/Disc0XSWI1.Pos");
+        statusOnly.HasControlServiceEvidence = true;
+        statusOnly.ControlModelText = "Status only";
+
+        var advisoryOnly = Control("LD_GEN/CustomGGIO8.Signal");
+        advisoryOnly.ControlModelText = "SBO • Enhanced security";
+        advisoryOnly.HasControlServiceEvidence = true;
+        var duplicate = Control(tap.ObjectReference);
+
+        var signals = new[] { breaker, tap, vendorCommand, statusOnly, advisoryOnly, duplicate };
+        Assert.Empty(Iec61850ControlIdentity.VerifiedCommandTargets(signals,
+            admitDiscovered: false));
+        var verified = Iec61850ControlIdentity.VerifiedCommandTargets(signals,
+            admitDiscovered: true);
+        Assert.Equal(3, verified.Length);
+        Assert.Contains(breaker, verified);
+        Assert.Contains(tap, verified);
+        Assert.Contains(vendorCommand, verified);
+        Assert.DoesNotContain(statusOnly, verified);
+        Assert.DoesNotContain(advisoryOnly, verified);
+        Assert.DoesNotContain(duplicate, verified);
+        Assert.All(verified, signal => Assert.False(signal.IsSelected));
+    }
+
+    [Fact]
+    public void CrossDataSetCswiProbeIsBoundedDeduplicatedAndDoesNotChangeUserSelection()
+    {
+        var signals = Enumerable.Range(1, 80)
+            .Select(i => Control($"GR_X_7SX85CB1/CSWI{i}.Pos"))
+            .ToArray();
+        var duplicate = Control(signals[0].ObjectReference);
+        var candidates = Iec61850ControlIdentity.IndependentCswiInspectionCandidates(
+            signals.Append(duplicate), budget: 24);
+        Assert.Equal(24, candidates.Length);
+        Assert.Equal(24, candidates.Select(x => x.ObjectReference)
+            .Distinct(StringComparer.OrdinalIgnoreCase).Count());
+        Assert.Empty(Iec61850ControlIdentity.IndependentCswiInspectionCandidates(signals, 0));
+        Assert.All(signals, x => Assert.False(x.IsSelected));
+    }
+
+    [Fact]
+    public void CommandDockUsesVerifiedLiveCswiAndPreloadsWithoutMmsWrite()
+    {
+        string Source(string file)
+        {
+            for (DirectoryInfo? root = new(AppContext.BaseDirectory);
+                 root is not null; root = root.Parent)
+            {
+                var candidate = Path.Combine(root.FullName,
+                    file.Replace('/', Path.DirectorySeparatorChar));
+                if (File.Exists(candidate)) return File.ReadAllText(candidate);
+            }
+            throw new FileNotFoundException(file);
+        }
+        var monitor = Source("Models/MonitorModels.cs");
+        var preload = Source("MainWindow.CommandPanelUx.cs");
+        Assert.Contains("Iec61850ControlIdentity.VerifiedCommandTargets(", monitor);
+        Assert.Contains("IsConnected && LiveDiscoveryModel is not null", monitor);
+        Assert.Contains("DiscoveredControlInspectionCandidates(device.Signals)", preload);
+        Assert.Contains("_runtime.ProbeControlModelAsync(", preload);
+        Assert.Contains("device.SelectedControlSignalCount > 0 ||", preload);
+        Assert.Contains("device.Signals.Any(", preload);
+        Assert.Contains("_runtime.InspectControlAsync(", preload);
+        var diagnostic = Source("Services/DiagnosticReportBuilder.cs");
+        Assert.Contains("CSWI outside DataSet: live candidates=", diagnostic);
+        Assert.Contains("typed-operable=", diagnostic);
+        Assert.Contains("operable={cswi.ControlSupportsOperate}", diagnostic);
+        Assert.DoesNotContain("ConfigureControlModelAsync(", preload);
+        Assert.DoesNotContain("ExecuteControlAsync(", preload);
+    }
+}
diff --git a/tests/ARSAS.Tests/P0GrxCswiSelectionVisibilityTests.cs b/tests/ARSAS.Tests/P0GrxCswiSelectionVisibilityTests.cs
new file mode 100644
index 000000000..f029fd90d
--- /dev/null
+++ b/tests/ARSAS.Tests/P0GrxCswiSelectionVisibilityTests.cs
@@ -0,0 +1,31 @@
+namespace ARSAS.Tests;
+
+public sealed class P0GrxCswiSelectionVisibilityTests
+{
+    [Fact]
+    public void WizardMustOfferExplicitCswiCatalogFilterRatherThanAssumingXcbrOperability()
+    {
+        var xaml = ReadSource("SignalSelectionWizardWindow.xaml");
+        var code = ReadSource("SignalSelectionWizardWindow.xaml.cs");
+        Assert.Contains("x:Name=\"QuickCswiButton\"", xaml);
+        Assert.Contains("Tag=\"CSWI\"", xaml);
+        Assert.Contains("\"CSWI\" => IsCswiControl(signal)", code);
+        Assert.Contains("QuickCswiButton.Content = $\"CSWI ({cswiCount:N0})\"", code);
+        Assert.Contains("XCBR/XSWI status is not proof of a CSWI command object", code);
+        Assert.Contains("QuickCswiButton, QuickSelectedButton", code);
+        Assert.Contains("QuickCswiButton.IsChecked = false", code);
+        // Safe: selecting an IED object is not authorizing a physical Operate.
+        Assert.DoesNotContain("ExecuteControlAsync(", code);
+    }
+
+    private static string ReadSource(string relative)
+    {
+        for (DirectoryInfo? root = new(AppContext.BaseDirectory);
+             root is not null; root = root.Parent)
+        {
+            var p = Path.Combine(root.FullName, relative);
+            if (File.Exists(p)) return File.ReadAllText(p);
+        }
+        throw new FileNotFoundException(relative);
+    }
+}
diff --git a/tests/ARSAS.Tests/P0GrxSclLiveCswiParityTests.cs b/tests/ARSAS.Tests/P0GrxSclLiveCswiParityTests.cs
new file mode 100644
index 000000000..c5bb28d7b
--- /dev/null
+++ b/tests/ARSAS.Tests/P0GrxSclLiveCswiParityTests.cs
@@ -0,0 +1,158 @@
+using AR.Iec61850.Discovery;
+using AR.Iec61850.Scl.Workspace;
+using ArIED61850Tester.Models;
+using ArIED61850Tester.Services;
+
+namespace ARSAS.Tests;
+
+public sealed class P0GrxSclLiveCswiParityTests
+{
+    private const string Target = "GR_X_7SX85CB1/CSWI1.Pos";
+
+    private static LiveIedDataAttributeModel Field(string path, string fc)
+        => new()
+        {
+            ObjectReference = Target + "." + path,
+            AttributePath = path,
+            FunctionalConstraint = fc,
+            SclBType = path.Equals("ctlModel", StringComparison.Ordinal)
+                ? "Enum" : "Struct"
+        };
+
+    private static LiveIedModelDiscoveryDocument Model(bool includeCswi)
+    {
+        var objects = includeCswi ? new[]
+        {
+            new LiveIedDataObjectModel
+            {
+                Name = "Pos", Reference = Target, InferredCdc = "DPC",
+                Attributes =
+                [
+                    Field("stVal", "ST"),
+                    Field("ctlModel", "CF"),
+                    Field("SBO", "CO"),
+                    Field("SBOw.ctlVal", "CO"),
+                    Field("Oper.ctlVal", "CO"),
+                    Field("Cancel.ctlVal", "CO")
+                ]
+            }
+        } : [];
+        return new LiveIedModelDiscoveryDocument
+        {
+            IedName = "GR_X_7SX85", Source = "synthetic SCL/MMS",
+            LogicalDevices =
+            [
+                new LiveIedLogicalDeviceModel
+                {
+                    MmsDomain = "GR_X_7SX85CB1", Inst = "CB1",
+                    LogicalNodes =
+                    [
+                        new LiveIedLogicalNodeModel
+                        {
+                            Name = "CSWI1", LnClass = "CSWI", LnInst = "1",
+                            DataObjects = objects
+                        },
+                        new LiveIedLogicalNodeModel
+                        {
+                            Name = "XCBR1", LnClass = "XCBR", LnInst = "1",
+                            DataObjects =
+                            [
+                                new LiveIedDataObjectModel
+                                {
+                                    Name = "Pos", Reference = "GR_X_7SX85CB1/XCBR1.Pos",
+                                    InferredCdc = "DPC",
+                                    Attributes =
+                                    [
+                                        new LiveIedDataAttributeModel
+                                        {
+                                            ObjectReference = "GR_X_7SX85CB1/XCBR1.Pos.ctlModel",
+                                            AttributePath = "ctlModel",
+                                            FunctionalConstraint = "CF"
+                                        }
+                                    ]
+                                }
+                            ]
+                        }
+                    ]
+                }
+            ]
+        };
+    }
+
+    [Fact]
+    public void SclDeclaredCswiDoesNotGrantMmsOrOperateAuthority()
+    {
+        var device = new Iec61850MonitorDevice
+        {
+            Name = "GR_X_7SX85",
+            SclWorkspace = new SclIedWorkspace
+            {
+                IedName = "GR_X_7SX85", AccessPointName = "J",
+                DesignModel = Model(true)
+            },
+            LiveDiscoveryModel = Model(false)
+        };
+        var lines = Iec61850SclLiveCswiParityDiagnostic.Summarize(device);
+        Assert.Contains(lines, s => s.Contains(
+            "design=1, live=0, sameExactDO=0", StringComparison.Ordinal));
+        Assert.Contains(lines, s => s.Contains("SCL_ONLY / NOT_LIVE_PROVEN", StringComparison.Ordinal));
+        Assert.DoesNotContain(lines, s => s.Contains("OPERABLE /", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void ExactLiveCswiDeclarationStillDoesNotMeanCtlModelVerified()
+    {
+        var device = new Iec61850MonitorDevice
+        {
+            Name = "GR_X_7SX85",
+            SclWorkspace = new SclIedWorkspace
+            {
+                IedName = "GR_X_7SX85", AccessPointName = "J",
+                DesignModel = Model(true)
+            },
+            LiveDiscoveryModel = Model(true)
+        };
+        var lines = Iec61850SclLiveCswiParityDiagnostic.Summarize(device);
+        Assert.Contains(lines, s => s.Contains(
+            "design=1, live=1, sameExactDO=1, liveCOdeclared=1, liveOperable=0",
+            StringComparison.Ordinal));
+        Assert.Contains(lines, s => s.Contains("SCD_CO=Oper/SBO/SBOw/Cancel",
+            StringComparison.Ordinal));
+        Assert.Contains(lines, s => s.Contains("MMS_CF_ctlModel=True",
+            StringComparison.Ordinal));
+        Assert.Contains(lines, s => s.Contains("MODEL_ONLY / LIVE_COMMAND_UNVERIFIED",
+            StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void WithoutOpenedSclReportAnExplicitProvenanceGap()
+    {
+        var device = new Iec61850MonitorDevice { LiveDiscoveryModel = Model(true) };
+        var lines = Iec61850SclLiveCswiParityDiagnostic.Summarize(device);
+        Assert.Contains(lines, s => s.Contains("NO OPEN SCD", StringComparison.Ordinal));
+        Assert.DoesNotContain(lines, s => s.Contains("liveOperable=", StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void DiagnosticContainsNoBackgroundMmsWriteOrUnboundedModelText()
+    {
+        var code = Find("Services/Iec61850SclLiveCswiParityDiagnostic.cs");
+        var builder = Find("Services/DiagnosticReportBuilder.cs");
+        Assert.Contains("Math.Clamp(sampleBudget, 0, 24)", code);
+        Assert.Contains("Iec61850SclLiveCswiParityDiagnostic.Summarize(device)", builder);
+        Assert.DoesNotContain("ExecuteControlAsync(", code);
+        Assert.DoesNotContain("ReadValueAsync(", code);
+        Assert.DoesNotContain("ConfigureControlModelAsync(", code);
+    }
+
+    private static string Find(string relative)
+    {
+        for (DirectoryInfo? root = new(AppContext.BaseDirectory);
+             root is not null; root = root.Parent)
+        {
+            var path = Path.Combine(root.FullName, relative);
+            if (File.Exists(path)) return File.ReadAllText(path);
+        }
+        throw new FileNotFoundException(relative);
+    }
+}
diff --git a/tests/ARSAS.Tests/P0ReadEvidenceCsvBehaviorTests.cs b/tests/ARSAS.Tests/P0ReadEvidenceCsvBehaviorTests.cs
index 52a83833d..dd6d35df4 100644
--- a/tests/ARSAS.Tests/P0ReadEvidenceCsvBehaviorTests.cs
+++ b/tests/ARSAS.Tests/P0ReadEvidenceCsvBehaviorTests.cs
@@ -6,6 +6,55 @@ namespace ARSAS.Tests;
 public sealed class P0ReadEvidenceCsvBehaviorTests
 {
     private const string Domain = "BCUGEF650";
+    
+    [Fact]
+    public void EmptyBrowserCategory_ReturnsExplicitZeroTargets_NeverSuccessCsv()
+    {
+        var model = new LiveIedModelDiscoveryDocument();
+        var category = new IedBrowserTreeRow("category/reports", "Reports", "Category", 1);
+        var ledger = new IedBrowserLiveValues();
+        Assert.Empty(IedBrowserReadEvidenceCsv.Plan(model, category));
+        var problem = Assert.Throws<InvalidOperationException>(() =>
+            IedBrowserReadEvidenceCsv.Build(model, category, ledger));
+        Assert.Contains("ZERO_TARGETS", problem.Message);
+        Assert.Throws<InvalidOperationException>(() =>
+            IedBrowserReadEvidenceCsv.BuildSelection([], ledger));
+        Assert.Empty(IedBrowserReadEvidenceCsv.Plan(null, category));
+        Assert.Empty(IedBrowserReadEvidenceCsv.Plan(model, category, maxTargets: 0));
+    }
+
+    [Fact]
+    public void ScopedReadEvidence_UsesIdenticalTargetSetForPreflightAndExport()
+    {
+        var attr = Attribute("PIOCEna");
+        var model = new LiveIedModelDiscoveryDocument
+        {
+            LogicalDevices = [new LiveIedLogicalDeviceModel
+            {
+                MmsDomain = Domain,
+                LogicalNodes = [new LiveIedLogicalNodeModel
+                {
+                    Name = "LLN0",
+                    DataObjects = [new LiveIedDataObjectModel
+                    {
+                        Name = "PIOCEna", Reference = Domain + "/LLN0.PIOCEna",
+                        Attributes = [attr]
+                    }]
+                }]
+            }]
+        };
+        var page = new IedBrowserTreeRow("model/ld/LLN0", "LLN0", "LN", 2,
+            model.LogicalDevices[0].LogicalNodes[0]);
+        var targets = IedBrowserReadEvidenceCsv.Plan(model, page);
+        Assert.Single(targets);
+        var ledger = new IedBrowserLiveValues();
+        var csv = IedBrowserReadEvidenceCsv.BuildSelection(targets, ledger);
+        var rows = csv.Split('\n', StringSplitOptions.RemoveEmptyEntries);
+        Assert.Equal(targets.Count + 1, rows.Length);
+        Assert.Contains("\"NOT_OBSERVED_NO_ATTEMPT_EVIDENCE\"", csv);
+        Assert.Equal(csv, IedBrowserReadEvidenceCsv.Build(model, page, ledger));
+    }
+
     private static LiveIedDataAttributeModel Attribute(string name)
         => new()
         {
@@ -48,7 +97,8 @@ public void CsvSeparatesCanonicalObservedMmsReadFromExactFailureAndUninstrumente
         var ledger = new IedBrowserLiveValues();
         var association = ledger.BeginAssociation();
         Assert.True(ledger.PublishForAssociation(association,
-            Domain + "/LLN0.PIOCEna.setVal", "SG", "false", "", "", "MMS Read"));
+            Domain + "/LLN0.PIOCEna.setVal", "SG", "false", "", "", "MMS Read",
+            readWireShapeEvidence: "wireKind=Boolean, category=primitive, clrKind=Boolean, rawOctets=1, childCount=0"));
         var csv = IedBrowserReadEvidenceCsv.Build(model, page, ledger,
             target => target.Reference.Contains("$InMagTyp$", StringComparison.Ordinal)
                 ? new IedBrowserReadFailureSample(target.Reference, "SG",
@@ -56,6 +106,12 @@ public void CsvSeparatesCanonicalObservedMmsReadFromExactFailureAndUninstrumente
                 : null);
         Assert.Contains("\"BCUGEF650/LLN0.PIOCEna.setVal\",\"SG\"", csv);
         Assert.Contains("\"OBSERVED\"", csv);
+        Assert.Contains("DecodedMmsWireShape", csv);
+        Assert.Contains("wireKind=Boolean, category=primitive", csv);
+        // We have decoder evidence, NOT invoke ID or GVA proof. Keeping
+        // those separate prevents synthetic wire-fidelity conclusions.
+        Assert.Contains("\"NOT_CAPTURED\",\"NOT_CAPTURED\"", csv);
+
         Assert.Contains("\"MMS Read\"", csv);
         Assert.Contains("\"READ_FAILED\"", csv);
         Assert.Contains("\"typed root mismatch, refused\"", csv);
diff --git a/tests/ARSAS.Tests/P0Sg7BrowserNavigationCacheTests.cs b/tests/ARSAS.Tests/P0Sg7BrowserNavigationCacheTests.cs
new file mode 100644
index 000000000..0516382be
--- /dev/null
+++ b/tests/ARSAS.Tests/P0Sg7BrowserNavigationCacheTests.cs
@@ -0,0 +1,79 @@
+using ArIED61850Tester.Services;
+
+namespace ARSAS.Tests;
+
+/// <summary>Protect the fast return-to-SG7 navigation path without physical IEC traffic.</summary>
+public sealed class P0Sg7BrowserNavigationCacheTests
+{
+    [Fact]
+    public void CompletedSclFlights_AreReusedAcrossInterleavedIeds_WithinFiniteCapacity()
+    {
+        var parseCalls = 0;
+        var tasks = new BoundedFifoCache<string, Task<int>>(2, StringComparer.Ordinal);
+        Task<int> GetOrParse(string key)
+        {
+            if (!tasks.TryGetValue(key, out var flight))
+            {
+                flight = Task.FromResult(++parseCalls);
+                tasks.Set(key, flight);
+            }
+            return flight;
+        }
+
+        var sg7 = GetOrParse("SG7|SCL-hash|IED|AP");
+        var bcu = GetOrParse("BCUGE|SCL-hash|IED|AP");
+        Assert.Same(sg7, GetOrParse("SG7|SCL-hash|IED|AP"));
+        Assert.Same(bcu, GetOrParse("BCUGE|SCL-hash|IED|AP"));
+        Assert.Equal(2, parseCalls);
+
+        // Capacity is finite: evict one oldest entry rather than pin every SCL forever.
+        GetOrParse("THIRD|SCL-hash|IED|AP");
+        Assert.Equal(2, tasks.Count);
+        Assert.NotSame(sg7, GetOrParse("SG7|SCL-hash|IED|AP"));
+        Assert.Equal(4, parseCalls);
+        Assert.Equal(2, tasks.Count);
+    }
+
+    [Fact]
+    public void BrowserSelectionPath_UsesBoundedSclFlights_AndLatestMetricsHandoff()
+    {
+        var perf = Read("MainWindow.IedBrowser.Performance.cs");
+        var browser = Read("MainWindow.IedBrowser.cs");
+
+        Assert.Contains("new(8, StringComparer.Ordinal)", perf);
+        Assert.Contains("_iedBrowserInventoryFlights.TryGetValue(key, out var task)", perf);
+        Assert.Contains("_iedBrowserInventoryFlights.Set(key, task)", perf);
+        var inventoryMethod = perf.Split("private bool TryResolveIedBrowserSclInventory")[1]
+            .Split("private async Task CompleteIedBrowserInventoryAsync")[0];
+        Assert.DoesNotContain("task.IsFaulted || task.IsCanceled", inventoryMethod);
+        Assert.Contains("Cache failed tasks too", inventoryMethod);
+        Assert.Contains("QueuePendingIedBrowserMetricsAfter(flight, device, model, association)", perf);
+        Assert.Contains("_iedBrowserMetricsStartedUtc = DateTime.MinValue", perf);
+        Assert.Contains("ReferenceEquals(completedDevice, current)", perf);
+        Assert.Contains("device.LiveValues.Association != association", perf);
+        Assert.Contains("_iedBrowserInventoryFlights.Clear()", browser);
+        Assert.DoesNotContain("SclReportControlFilter.InspectFile(", browser);
+    }
+
+    [Fact]
+    public void ExplorerSwitchWithEmptySearch_SkipsRedundantWpfCollectionRefresh()
+    {
+        var source = Read("MainWindow.LiveSearch.cs");
+        Assert.Contains("if (view.Filter is not null)", source);
+        Assert.Contains("view.Filter = item =>", source);
+        Assert.Contains("IedBrowserPerformanceProbe.Measure(", source);
+        Assert.DoesNotContain("view.Refresh();", source);
+        // WPF's Filter setter already RefreshOrDefer's this same CollectionView.
+        // Never change exact IEC reference or selected report membership.
+    }
+
+    private static string Read(string path)
+    {
+        for (DirectoryInfo? dir = new(AppContext.BaseDirectory); dir != null; dir = dir.Parent)
+        {
+            var full = Path.Combine(dir.FullName, path);
+            if (File.Exists(full)) return File.ReadAllText(full);
+        }
+        throw new FileNotFoundException(path);
+    }
+}
diff --git a/tests/ARSAS.Tests/P0Sg7BrowserPerformanceTests.cs b/tests/ARSAS.Tests/P0Sg7BrowserPerformanceTests.cs
new file mode 100644
index 000000000..7a90dfdbd
--- /dev/null
+++ b/tests/ARSAS.Tests/P0Sg7BrowserPerformanceTests.cs
@@ -0,0 +1,103 @@
+using ArIED61850Tester.Models;
+
+namespace ARSAS.Tests;
+
+[CollectionDefinition("SG7-Unit-Metadata-Serial", DisableParallelization = true)]
+public sealed class P0Sg7BrowserPerformanceTestCollection { }
+
+[Collection("SG7-Unit-Metadata-Serial")]
+public sealed class P0Sg7BrowserPerformanceTests
+{
+    [Fact]
+    public void ConfigurationRevision_DoesNotAdvanceForOrdinarySTMXOrDC_ReportValues()
+    {
+        var ledger = new IedBrowserLiveValues();
+        var firstAssociation = ledger.BeginAssociation();
+        var initial = ledger.ConfigurationVersion;
+
+        Assert.True(ledger.PublishForAssociation(firstAssociation,
+            "SG7LD/MMXU1.A.phsA.cVal.mag.f", "MX", "123.4", "", "", "Report"));
+        Assert.True(ledger.PublishForAssociation(firstAssociation,
+            "SG7LD/XCBR1.Pos.stVal", "ST", "Open", "", "", "Report"));
+        Assert.True(ledger.PublishForAssociation(firstAssociation,
+            "SG7LD/LLN0.NamPlt.d", "DC", "BCU", "", "", "Report"));
+        Assert.Equal(initial, ledger.ConfigurationVersion);
+
+        Assert.True(ledger.PublishForAssociation(firstAssociation,
+            "SG7LD/MMXU1.A.phsA.units.SIUnit", "CF", "A", "", "", "Report"));
+        Assert.Equal(initial + 1, ledger.ConfigurationVersion);
+
+        ledger.MarkOffline();
+        Assert.Equal(initial + 2, ledger.ConfigurationVersion);
+        Assert.False(ledger.PublishForAssociation(firstAssociation,
+            "SG7LD/MMXU1.A.phsA.units.multiplier", "CF", "0", "", "", "Report"));
+        Assert.Equal(initial + 2, ledger.ConfigurationVersion);
+        ledger.BeginAssociation();
+        Assert.Equal(initial + 3, ledger.ConfigurationVersion);
+    }
+
+    [Fact]
+    public void EngineeringUnitProjection_ReusesCacheForValueUpdates_ButInvalidatesMetadata()
+    {
+        var device = new Iec61850MonitorDevice();
+        var unit = new SignalDefinition
+        {
+            ObjectReference = "SG7LD/MMXU1.A.phsA.cVal.mag.f",
+            FunctionalConstraint = "MX",
+            Unit = "A"
+        };
+        device.Signals.Add(unit);
+        var cache = new IedBrowserUnitProjectionCache();
+        var evidence = new IedBrowserCfEvidencePresentation(device.LiveValues, null, null);
+
+        var initial = cache.Resolve(device, null, evidence);
+        Assert.Equal("A", initial["SG7LD/MMXU1.A.phsA.cVal.mag.f|MX"]);
+        Assert.Same(initial, cache.Resolve(device, null, evidence));
+
+        var association = device.LiveValues.BeginAssociation();
+        var newAssociation = cache.Resolve(device, null, evidence);
+        Assert.NotSame(initial, newAssociation);
+        Assert.True(device.LiveValues.PublishForAssociation(association,
+            "SG7LD/MMXU1.A.phsA.cVal.mag.f", "MX", "23", "", "", "Report"));
+        Assert.Same(newAssociation, cache.Resolve(device, null, evidence));
+
+        unit.Unit = "kA";
+        var changedUnit = cache.Resolve(device, null, evidence);
+        Assert.NotSame(newAssociation, changedUnit);
+        Assert.Equal("kA", changedUnit["SG7LD/MMXU1.A.phsA.cVal.mag.f|MX"]);
+
+        Assert.True(device.LiveValues.PublishForAssociation(association,
+            "SG7LD/MMXU1.A.phsA.units.SIUnit", "CF", "A", "", "", "Report"));
+        var changedCf = cache.Resolve(device, null, evidence);
+        Assert.NotSame(changedUnit, changedCf);
+
+        device.Signals.Clear();
+        var afterClear = cache.Resolve(device, null, evidence);
+        Assert.NotSame(changedCf, afterClear);
+        Assert.Empty(afterClear);
+    }
+
+    [Fact]
+    public void UnitMetadataRevision_OnlyChangesWhenUnitChanges()
+    {
+        var signal = new SignalDefinition();
+        var before = SignalDefinition.UnitMetadataRevision;
+        signal.Unit = "kV";
+        Assert.True(SignalDefinition.UnitMetadataRevision > before);
+        var after = SignalDefinition.UnitMetadataRevision;
+        signal.Unit = "kV";
+        Assert.Equal(after, SignalDefinition.UnitMetadataRevision);
+    }
+
+    [Fact]
+    public void BrowserPerformanceSource_ExistsWithoutRequiringAUiOrNetworkSession()
+    {
+        var type = typeof(IedBrowserUnitProjectionCache).Assembly.GetType(
+            "ArIED61850Tester.Services.IedBrowserPerformanceEvents");
+        Assert.NotNull(type);
+        var attribute = Assert.Single(type.GetCustomAttributes(
+            typeof(System.Diagnostics.Tracing.EventSourceAttribute), false));
+        Assert.Equal("ARSAS-IEDBrowser-Performance",
+            ((System.Diagnostics.Tracing.EventSourceAttribute)attribute).Name);
+    }
+}
diff --git a/tests/ARSAS.Tests/P0Sg7UiSchedulingRegressionTests.cs b/tests/ARSAS.Tests/P0Sg7UiSchedulingRegressionTests.cs
new file mode 100644
index 000000000..2ba9e004c
--- /dev/null
+++ b/tests/ARSAS.Tests/P0Sg7UiSchedulingRegressionTests.cs
@@ -0,0 +1,102 @@
+namespace ARSAS.Tests;
+
+/// <summary>
+/// Source-path safety checks for the physical SG7 GUI scheduling failure.
+/// WPF benchmarks still require an instrumented Windows/IED FAT; these guards
+/// prevent accidentally restoring unbounded Dispatcher work in future merges.
+/// </summary>
+public sealed class P0Sg7UiSchedulingRegressionTests
+{
+    [Fact]
+    public void SnapshotReportCoalescing_IsLosslessForEdgesAndUsesBoundedUiSlices()
+    {
+        var source = Read("MainWindow.xaml.cs");
+        var ingress = source.Split("private void Runtime_PointUpdated(")[1]
+            .Split("private void Runtime_EventRaised(")[0];
+        Assert.Contains("_pendingPointSnapshots.TryAdd(key,", ingress);
+        Assert.Contains("_pendingPointSnapshots.TryUpdate(key, merged, current)", ingress);
+        Assert.Contains("CanonicalPointSnapshotAuthority.Merge(current, snapshot)", ingress);
+        Assert.Contains("_pendingPointUiKeys.Enqueue(key)", ingress);
+
+        var flush = source.Split("private void UiFlushTimer_Tick(")[1]
+            .Split("private void Signal_PropertyChanged(")[0];
+        Assert.Contains("processedPoints < UiPointBatchLimit", flush);
+        Assert.Contains("Stopwatch.GetTimestamp() < uiDeadlineTicks", flush);
+        Assert.Contains("TryDequeueUiPointKey(processedPoints, out var pointKey)", flush);
+        var viewport = Read("MainWindow.LivePointViewportPriority.cs");
+        Assert.Contains("_priorityPointUiKeys.TryDequeue(out key)", viewport);
+        Assert.Contains("_pendingPointUiKeys.TryDequeue(out key)", viewport);
+        Assert.Contains("(processedPoints & 3) == 3", viewport);
+        Assert.Contains("_pendingPointSnapshots.TryRemove(pointKey, out var pending)", flush);
+        Assert.DoesNotContain("_pendingPointSnapshots.Keys.ToArray()", flush);
+        Assert.Contains("CanonicalPointSnapshotAuthority.Project(", flush);
+        // The receive/runtime lane owns canonical publication. A WPF frame
+        // is presentation only and cannot re-publish evidence on its timer.
+        Assert.DoesNotContain("observedOwner.LiveValues.PublishReport(", flush);
+        Assert.Contains("eventBatch.Count < UiEventBatchLimit", flush);
+        Assert.Contains("diagnosticBatch.Count < UiDiagnosticBatchLimit", flush);
+        Assert.Contains("Events.AddRange(eventBatch)", flush); // FIFO SOE not latest-wins
+        Assert.Contains("Logs.AddRange(diagnosticBatch)", flush);
+        Assert.DoesNotContain("_pendingEvents.Clear()", flush);
+    }
+
+    [Fact]
+    public void ExplorerSearch_HasOneFilterOwner_NoPerRowStringJoinOrDoubleRefresh()
+    {
+        var primary = Read("MainWindow.LiveSearch.cs");
+        var dynamic = Read("MainWindow.LiveSignalSearch.cs");
+        var sorting = Read("MainWindow.IecNaturalSort.cs");
+        Assert.Contains("if (_liveSignalSearchInstalled", primary);
+        Assert.Contains("ApplyLiveSignalSearch();", primary);
+        Assert.Contains("_unifiedExplorerSearchText", dynamic);
+        Assert.Contains("_unifiedLiveSearchTokens", dynamic);
+        Assert.Contains("LiveSignalSearchContains(", dynamic);
+        Assert.DoesNotContain("_liveSignalSearchView.Refresh()", dynamic);
+        Assert.DoesNotContain("string.Join('\\n', new[]", dynamic);
+        Assert.Contains("sourceCollection.Count <= 2048", dynamic);
+        Assert.Contains("Count: > 2048", sorting);
+        Assert.Contains("grid.Name is \"ExplorerLiveValuesGrid\" or \"GlobalLiveGrid\"", sorting);
+    }
+
+    [Fact]
+    public void GooseUiBatch_AvoidsWholeDictionaryAllocation()
+    {
+        var goose = Read("MainWindow.GooseSubscriber.cs");
+        var flush = goose.Split("private void FlushGooseSubscriberUi()")[1]
+            .Split("private GooseBindingCatalog BuildGooseBindingCatalog()")[0];
+        Assert.Contains("foreach (var pair in _pendingGooseFrames)", flush);
+        Assert.DoesNotContain("_pendingGooseFrames.ToArray()", flush);
+        Assert.Contains("processed >= 64", flush);
+    }
+
+    [Fact]
+    public void BrowserSelection_DetailProjectionRunsBehindSingleWorkerGate()
+    {
+        var browser = Read("MainWindow.IedBrowser.cs");
+        var worker = Read("MainWindow.IedBrowser.AsyncDetails.cs");
+        var render = browser.Split("private void RenderIedBrowserSelection(")[1];
+
+        Assert.Contains("++_iedBrowserDetailBuildGeneration", render);
+        Assert.Contains("BuildIedBrowserDetailsAsync(row, model,", render);
+        Assert.DoesNotContain("ReplaceIedBrowserDetails(IedBrowserPresentation.Details(", render);
+        Assert.Contains("SemaphoreSlim _iedBrowserDetailBuildGate = new(1, 1)", worker);
+        Assert.Contains("_iedBrowserDetailBuildGate.WaitAsync(", worker);
+        Assert.Contains("Task.Run(() =>", worker);
+        Assert.Contains("IedBrowserPresentation.Details(page, model, connected, designModel)", worker);
+        Assert.Contains("generation != _iedBrowserDetailBuildGeneration", worker);
+        Assert.Contains("owner?.LiveValues.Association != association", worker);
+        Assert.Contains("ReplaceIedBrowserDetails(rows)", worker);
+        Assert.Contains("QueueIedBrowserFocusedRead(page)", worker);
+    }
+
+    private static string Read(string name)
+    {
+        for (DirectoryInfo? folder = new(AppContext.BaseDirectory);
+             folder is not null; folder = folder.Parent)
+        {
+            var path = Path.Combine(folder.FullName, name);
+            if (File.Exists(path)) return File.ReadAllText(path);
+        }
+        throw new FileNotFoundException(name);
+    }
+}
diff --git a/tests/ARSAS.Tests/P0SiebcuReadAllAndLayoutRegressionTests.cs b/tests/ARSAS.Tests/P0SiebcuReadAllAndLayoutRegressionTests.cs
index 0ccb5e16f..8d7e79ab4 100644
--- a/tests/ARSAS.Tests/P0SiebcuReadAllAndLayoutRegressionTests.cs
+++ b/tests/ARSAS.Tests/P0SiebcuReadAllAndLayoutRegressionTests.cs
@@ -51,11 +51,18 @@ public void RecycledDataSetRowsKeepBoundedSourceColumnIndependentOfScrollExtent(
             (string?)n.Attribute("Text") == "{Binding ObservationSource}"));
         Assert.Equal("1", (string?)source.Attribute("Grid.Column"));
         Assert.Equal("CharacterEllipsis", (string?)source.Attribute("TextTrimming"));
-        var value = Assert.Single(valuePanel.Descendants().Where(n =>
+        var valueSlot = Assert.Single(valuePanel.Descendants().Where(n =>
+            n.Name.LocalName == "StackPanel" &&
+            (string?)n.Attribute("Grid.Column") == "0"));
+        var value = Assert.Single(valueSlot.Descendants().Where(n =>
             n.Name.LocalName == "TextBlock" &&
             (string?)n.Attribute("Text") == "{Binding Value}"));
-        Assert.Equal("0", (string?)value.Attribute("Grid.Column"));
         Assert.Equal("{Binding Value}", (string?)value.Attribute("ToolTip"));
+        var qualityWarning = Assert.Single(valueSlot.Elements().Where(n =>
+            n.Name.LocalName == "Path" &&
+            (string?)n.Attribute("Data") == "{StaticResource InvalidQualityWarningGeometry}"));
+        Assert.Equal("{StaticResource InvalidQualityWarningIconStyle}",
+            (string?)qualityWarning.Attribute("Style"));
     }
 
     [Fact]
@@ -70,9 +77,16 @@ public void OpenCloseAndConfirmKeepSameFootprintThroughRepeatedCommandCycles()
         {
             var button = Assert.Single(controls.Where(n =>
                 (string?)n.Attribute("CommandParameter") == action));
-            Assert.Equal("72", (string?)button.Attribute("Width"));
+            var grid = Assert.IsType<XElement>(button.Parent);
+            Assert.Equal("Grid", grid.Name.LocalName);
+            var columns = Assert.Single(grid.Elements().Where(n =>
+                n.Name.LocalName == "Grid.ColumnDefinitions")).Elements()
+                .Select(n => (string?)n.Attribute("Width")).ToArray();
+            Assert.Equal(new[] { "72", "7", "72" }, columns);
+            Assert.Equal(action == "Open [01]" ? "0" : "2",
+                (string?)button.Attribute("Grid.Column"));
             Assert.Equal("72", (string?)button.Attribute("MinWidth"));
-            Assert.Equal("Left", (string?)button.Attribute("HorizontalAlignment"));
+            Assert.Equal("Stretch", (string?)button.Attribute("HorizontalAlignment"));
             Assert.Equal("{Binding ControlCanInspectPosition}",
                 (string?)button.Attribute("IsEnabled"));
         }
diff --git a/tests/ARSAS.Tests/P109KGenericControlSafetyTests.cs b/tests/ARSAS.Tests/P109KGenericControlSafetyTests.cs
index 09cc7f204..6f4c1d83b 100644
--- a/tests/ARSAS.Tests/P109KGenericControlSafetyTests.cs
+++ b/tests/ARSAS.Tests/P109KGenericControlSafetyTests.cs
@@ -28,6 +28,30 @@ public void DistinctCdcOperatorActions(string cdc, bool directional, bool numeri
         Assert.Equal(numeric, signal.IsSetPointControl);
     }
 
+    [Theory]
+    [InlineData("SG7_BCUSystem/Bkr0XCBR2.Pos")]
+    [InlineData("SG7_BCUSystem/Disc0XSWI1.Pos")]
+    [InlineData("SG7_BCUSystem/BkrCSWI1.Pos")]
+    public void PrefixedEd2Position_LooksLikePositionButNeverOverridesUnverifiedEngine(
+        string reference)
+    {
+        var signal = new SignalDefinition
+        {
+            ObjectReference = reference,
+            Name = reference,
+            FunctionalConstraint = "CO",
+            ControlCdc = "DPC",
+            IsControlSignal = true,
+            ControlModelText = "SBO • Enhanced security"
+        };
+        Assert.True(signal.IsValidControlObject);
+        Assert.True(signal.IsPositionControl);
+        Assert.True(signal.ControlModelResolved);
+        Assert.False(signal.ControlSemanticVerified);
+        Assert.False(signal.ControlSupportsOperate);
+        Assert.True(signal.ControlCanInspectPosition);
+    }
+
     [Fact]
     public void ClaimedBscCannotOverrideLiveDpc()
     {
diff --git a/tests/ARSAS.Tests/P109QCommandDockCommissioningRegressionTests.cs b/tests/ARSAS.Tests/P109QCommandDockCommissioningRegressionTests.cs
index 679a87aab..b6fc8360a 100644
--- a/tests/ARSAS.Tests/P109QCommandDockCommissioningRegressionTests.cs
+++ b/tests/ARSAS.Tests/P109QCommandDockCommissioningRegressionTests.cs
@@ -146,7 +146,8 @@ public void ModelButtonOpensSimplePickAndWriteDialog()
         var ui = Read("ControlModelWriteWindow.xaml");
         var handler = Read("ControlModelWriteWindow.xaml.cs");
         Assert.Contains("new ControlModelWriteWindow(", code);
-        Assert.Contains("Content=\"Write\"", ui);
+        Assert.Contains("<TextBlock Text=\"Write\" VerticalAlignment=\"Center\"/>", ui);
+        Assert.Contains("Data=\"{StaticResource MaterialEditIcon}\"", ui);
         Assert.Contains("ItemsSource=\"{Binding Choices}\"", ui);
         Assert.DoesNotContain("Type the exact object reference", ui);
         Assert.DoesNotContain("I am authorized to change", ui);
@@ -163,7 +164,8 @@ public void ModelButtonOpensSimplePickAndWriteDialog()
         Assert.Contains("public Task<AR.Iec61850.Control.Iec61850ControlModelConfigurationResult> ConfigureControlModelAsync(", facade);
         Assert.Contains("_inner.ConfigureControlModelAsync(deviceId, signal, expected, requested, token)", facade);
         Assert.Contains("RunDeviceOperationAsync(", facade);
-        Assert.Contains("Background=\"#F4F7FB\"", ui);
+        Assert.Contains("Background=\"#F5F7FB\"", ui);
+        Assert.Contains("FontFamily=\"{StaticResource AppFontFamily}\"", ui);
         Assert.DoesNotContain("new ControlCommandWindow(", code);
     }
 
diff --git a/tests/ARSAS.Tests/P109SRefreshControlDescriptorRegressionTests.cs b/tests/ARSAS.Tests/P109SRefreshControlDescriptorRegressionTests.cs
index 127fbb332..a8bc4b9c6 100644
--- a/tests/ARSAS.Tests/P109SRefreshControlDescriptorRegressionTests.cs
+++ b/tests/ARSAS.Tests/P109SRefreshControlDescriptorRegressionTests.cs
@@ -52,7 +52,9 @@ public void InspectRebuildsCachedDescriptorBeforeControlModelAndTypedSemanticEva
         var opened=inspect.IndexOf("control = await GetOrOpenControlSessionAsync(",StringComparison.Ordinal);
         var invalidated=inspect.IndexOf("await InvalidateCachedControlSessionAsync(signal.ObjectReference)",StringComparison.Ordinal);
         Assert.True(invalidated>=0 && opened>invalidated);
-        Assert.Contains("ControlSemanticVerified = semantic.IsCommandSafe",inspect);
+        Assert.Contains("ControlSemanticVerified = fullyVerified",inspect);
+        Assert.Contains("HasExactDpcBooleanFeedback(descriptor, effectiveCdc)",inspect);
+        Assert.Contains("IsOperationallyReady = fullyVerified",inspect);
         Assert.Contains("ControlModelText = modelText",inspect);
         var main=File.ReadAllText(Path.Combine(root.FullName,"MainWindow.xaml.cs"));
         Assert.Contains("await RefreshControlValuesAsync(device, force: true);",main);
diff --git a/tests/ARSAS.Tests/P109UStableCommandProjectionTests.cs b/tests/ARSAS.Tests/P109UStableCommandProjectionTests.cs
index bf82700f3..900a09a40 100644
--- a/tests/ARSAS.Tests/P109UStableCommandProjectionTests.cs
+++ b/tests/ARSAS.Tests/P109UStableCommandProjectionTests.cs
@@ -11,7 +11,7 @@ namespace ARSAS.Tests;
 /// </summary>
 public sealed class P109UStableCommandProjectionTests
 {
-    private static SignalDefinition Verified(string reference) 
+    private static SignalDefinition Verified(string reference, string cdc = "DPC") 
     {
         var signal = new SignalDefinition
         {
@@ -20,10 +20,10 @@ private static SignalDefinition Verified(string reference)
             FunctionalConstraint = "CO",
             IsSelected = true,
             IsControlSignal = true,
-            ControlCdc = "DPC",
+            ControlCdc = cdc,
             ControlModelText = "Select Before Operate (SBO) • Enhanced security"
         };
-        signal.AcceptVerifiedLiveControlCdc("DPC");
+        signal.AcceptVerifiedLiveControlCdc(cdc);
         signal.ControlSemanticVerified = true;
         return signal;
     }
@@ -53,6 +53,44 @@ public void IdenticalVerifiedCatalog_NeverEmitsResetOrRecreatesRows()
         Assert.False(first.ControlInterlockCheck);
     }
 
+    [Fact]
+    public void RepeatSemanticAndReportingEvidenceDoesNotFlickerVerifiedCommandAuthority()
+    {
+        var signal = Verified("LD0/Bkr0XCBR2.Pos");
+        var notifications = new List<string>();
+        signal.PropertyChanged += (_, args) =>
+        {
+            if (args.PropertyName is not null)
+                notifications.Add(args.PropertyName);
+        };
+        signal.ControlInterlockCheck = false; // operator-owned choice
+        notifications.Clear();
+
+        for (var repeat = 0; repeat < 100; repeat++)
+        {
+            signal.AcceptVerifiedLiveControlCdc("DPC");
+            signal.ControlSemanticVerified = true;
+            signal.ApplyDataSetAdvisoryControlMetadata("DPC",
+                "LD0/Bkr0XCBR2.Pos.stVal");
+        }
+        Assert.True(signal.ControlSupportsOperate);
+        Assert.Equal("DPC", signal.VerifiedLiveControlCdc);
+        Assert.False(signal.ControlInterlockCheck);
+        Assert.DoesNotContain(nameof(SignalDefinition.VerifiedLiveControlCdc),
+            notifications);
+        Assert.Equal(1, notifications.Count(name =>
+            name == nameof(SignalDefinition.DataSetAdvisoryCdc)));
+
+        notifications.Clear();
+        signal.ClearLiveControlAuthority();
+        Assert.False(signal.ControlSupportsOperate);
+        Assert.Contains(nameof(SignalDefinition.VerifiedLiveControlCdc),
+            notifications);
+        notifications.Clear();
+        signal.ClearLiveControlAuthority(); // duplicate teardown is silent
+        Assert.Empty(notifications);
+    }
+
     [Fact]
     public void GenuineAuthorityRevocation_DisablesOnlyAffectedRowWithoutResettingGrid()
     {
@@ -69,10 +107,14 @@ public void GenuineAuthorityRevocation_DisablesOnlyAffectedRowWithoutResettingGr
         device.RefreshCommandSignalProjection();
 
         Assert.Equal(2, device.CommandSignals.Count);
-        Assert.Same(first, device.CommandSignals[0]);
-        Assert.Same(second, device.CommandSignals[1]);
+        // Lost live authority = disabled, so its row moves BELOW the
+        // still-operable CSWI. Moving it must never rebuild the full grid.
+        Assert.Same(second, device.CommandSignals[0]);
+        Assert.Same(first, device.CommandSignals[1]);
         Assert.False(first.ControlSupportsOperate);
-        Assert.Empty(events);
+        Assert.Contains(NotifyCollectionChangedAction.Move, events);
+        Assert.DoesNotContain(NotifyCollectionChangedAction.Reset, events);
+        events.Clear();
 
         // Fresh live-typed authority is mandatory before the control can return.
         first.AcceptVerifiedLiveControlCdc("DPC");
@@ -80,7 +122,52 @@ public void GenuineAuthorityRevocation_DisablesOnlyAffectedRowWithoutResettingGr
         device.RefreshCommandSignalProjection();
         Assert.Equal(2, device.CommandSignals.Count);
         Assert.True(first.ControlSupportsOperate);
+        Assert.Same(first, device.CommandSignals[0]);
+        Assert.Same(second, device.CommandSignals[1]);
+        Assert.Contains(NotifyCollectionChangedAction.Move, events);
+        Assert.DoesNotContain(NotifyCollectionChangedAction.Reset, events);
+    }
+
+    [Fact]
+    public void ActualDockMembershipNeverResetsDuringReportingAndOnlyChangesForRealAuthority()
+    {
+        var breaker = Verified("LD0/Bkr0XCBR2.Pos");
+        var tap = Verified("LD0/ATCC1.TapChg", "BSC");
+        var statusOnly = Verified("LD0/Disc0XSWI1.Pos");
+        statusOnly.ControlModelText = "Status only";
+        var device = new Iec61850MonitorDevice();
+        device.Signals.ReplaceAll([breaker, tap, statusOnly]);
+        device.RecountSelectedSignals();
+        Assert.Equal(2, device.OperableCommandSignals.Count);
+
+        var events = new List<NotifyCollectionChangedAction>();
+        device.OperableCommandSignals.CollectionChanged += (_, e) => events.Add(e.Action);
+        breaker.ControlInterlockCheck = false;
+        for (var iteration = 0; iteration < 100; iteration++)
+        {
+            breaker.ControlCurrentValue = iteration % 2 == 0 ? "Open" : "Closed";
+            tap.ControlCurrentValue = iteration.ToString();
+            device.RefreshCommandSignalProjection();
+        }
         Assert.Empty(events);
+        Assert.False(breaker.ControlInterlockCheck);
+        Assert.DoesNotContain(statusOnly, device.OperableCommandSignals);
+
+        breaker.ClearLiveControlAuthority();
+        device.RefreshCommandSignalProjection();
+        Assert.Single(device.OperableCommandSignals);
+        Assert.Same(tap, device.OperableCommandSignals[0]);
+        Assert.Equal(NotifyCollectionChangedAction.Remove, Assert.Single(events));
+        events.Clear();
+
+        breaker.AcceptVerifiedLiveControlCdc("DPC");
+        breaker.ControlSemanticVerified = true;
+        device.RefreshCommandSignalProjection();
+        Assert.Equal(2, device.OperableCommandSignals.Count);
+        Assert.Contains(breaker, device.OperableCommandSignals);
+        Assert.Contains(tap, device.OperableCommandSignals);
+        Assert.DoesNotContain(NotifyCollectionChangedAction.Reset, events);
+        Assert.False(breaker.ControlInterlockCheck);
     }
 
     [Fact]
diff --git a/tests/ARSAS.Tests/P109VLiveBscAuthorityRegressionTests.cs b/tests/ARSAS.Tests/P109VLiveBscAuthorityRegressionTests.cs
index b00027830..894cdb68d 100644
--- a/tests/ARSAS.Tests/P109VLiveBscAuthorityRegressionTests.cs
+++ b/tests/ARSAS.Tests/P109VLiveBscAuthorityRegressionTests.cs
@@ -130,6 +130,11 @@ private static Iec61850ControlObjectDescriptor Descriptor(
             Name = "ctlVal", MmsType = wireType, Size = width == 0 ? null : width
         },
         OperSpecification = new MmsTypeSpecificationNode { MmsType = "structure" },
-        StatusReference = feedback
+        StatusReference = feedback,
+        // DPC can expose Boolean CO. A live TWO-BIT status read, not the
+        // CSWI name or a stale SCL label, must corroborate this one fixture.
+        LiveStatusIsDoublePoint =
+            cdc == "SPC" && wireType == "boolean" &&
+            feedback.Equals(reference + ".stVal", StringComparison.Ordinal)
     };
 }
diff --git a/tests/ARSAS.Tests/P109WCommandDockLifecycleArchitectureTests.cs b/tests/ARSAS.Tests/P109WCommandDockLifecycleArchitectureTests.cs
index 50647ca16..7f77b2c0d 100644
--- a/tests/ARSAS.Tests/P109WCommandDockLifecycleArchitectureTests.cs
+++ b/tests/ARSAS.Tests/P109WCommandDockLifecycleArchitectureTests.cs
@@ -130,6 +130,18 @@ public void FirstClickOpenCloseStillUsesReadOnlyModelPreflight()
         Assert.Contains("var enabledBinding = new MultiBinding", source, StringComparison.Ordinal);
     }
 
+    [Fact]
+    public void LargeIEDPublishesVerifiedControlsInBoundedBatchesWithoutCollectionReset()
+    {
+        var source = Source("MainWindow.CommandPanelUx.cs");
+        Assert.Contains("var inspectedSinceProjection = 0;", source, StringComparison.Ordinal);
+        Assert.Contains("hasNewVerifiedControl |= signal.ControlSupportsOperate;", source, StringComparison.Ordinal);
+        Assert.Contains("if (++inspectedSinceProjection >= 16)", source, StringComparison.Ordinal);
+        Assert.Contains("if (hasNewVerifiedControl && device.IsConnected)", source, StringComparison.Ordinal);
+        Assert.Contains("device.RefreshCommandSignalProjection();", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("Task.WhenAll(candidates", source, StringComparison.Ordinal);
+    }
+
     [Fact]
     public void InspectionPublishesTypedAuthorizationOnlyAfterFinalMmsReads()
     {
@@ -141,7 +153,9 @@ public void InspectionPublishesTypedAuthorizationOnlyAfterFinalMmsReads()
         var invalidate = inspect.IndexOf("await InvalidateCachedControlSessionAsync(", StringComparison.Ordinal);
         var typed = inspect.IndexOf("var semantic = ArControl.Iec61850ControlSemanticResolver.Resolve(", StringComparison.Ordinal);
         var finalCommit = inspect.LastIndexOf("signal.ClearLiveControlAuthority();", StringComparison.Ordinal);
-        var authorize = inspect.IndexOf("signal.ControlSemanticVerified = semantic.IsCommandSafe && descriptor.IsOperationallyReady;", StringComparison.Ordinal);
+        var authorize = inspect.IndexOf("signal.ControlSemanticVerified = fullyVerified;", StringComparison.Ordinal);
+        Assert.Contains("exactDpcBooleanFeedback = HasExactDpcBooleanFeedback(descriptor, effectiveCdc)", inspect);
+        Assert.Contains("descriptor.IsOperationallyReady && exactDpcBooleanFeedback", inspect);
         Assert.True(invalidate >= 0 && typed > invalidate && finalCommit > typed && authorize > finalCommit);
         Assert.Contains("signal.ControlModelText = probe.Decoded", inspect, StringComparison.Ordinal);
         Assert.Contains("signal.ControlModelText = modelText;", inspect, StringComparison.Ordinal);
diff --git a/tests/ARSAS.Tests/PremiumSmartIpWizardTests.cs b/tests/ARSAS.Tests/PremiumSmartIpWizardTests.cs
new file mode 100644
index 000000000..86dd91a00
--- /dev/null
+++ b/tests/ARSAS.Tests/PremiumSmartIpWizardTests.cs
@@ -0,0 +1,222 @@
+using System.Reflection;
+using System.Text.Json;
+using System.Windows;
+using System.Windows.Controls;
+using System.Windows.Input;
+using System.Xml.Linq;
+using ArIED61850Tester;
+using ArIED61850Tester.Services;
+
+namespace ARSAS.Tests;
+
+[Collection("WpfStaIsolation")]
+public sealed class PremiumSmartIpWizardTests
+{
+    [Theory]
+    [InlineData("192", "168", "1", "33", "192.168.1.33")]
+    [InlineData("0", "0", "0", "0", "0.0.0.0")]
+    [InlineData("255", "255", "255", "255", "255.255.255.255")]
+    [InlineData("001", "002", "003", "004", "1.2.3.4")]
+    public void SegmentedIpv4_ValidOctets_Canonicalize(
+        string a, string b, string c, string d, string expected)
+    {
+        Assert.True(IpConnectWizardWindow.TryNormalizeIpv4Octets(
+            [a, b, c, d], out var actual));
+        Assert.Equal(expected, actual);
+    }
+
+    [Theory]
+    [InlineData("256", "1", "2", "3")]
+    [InlineData("25x", "1", "2", "3")]
+    [InlineData("", "1", "2", "3")]
+    [InlineData("-1", "1", "2", "3")]
+    [InlineData("999", "1", "2", "3")]
+    [InlineData(" 1", "1", "2", "3")]
+    public void SegmentedIpv4_InvalidOctets_Reject(
+        string a, string b, string c, string d)
+        => Assert.False(IpConnectWizardWindow.TryNormalizeIpv4Octets(
+            [a, b, c, d], out _));
+
+    [Theory]
+    [InlineData("192.168.0.12", true)]
+    [InlineData("10.0.0.256", false)]
+    [InlineData("10.0.0", false)]
+    [InlineData("::1", false)]
+    [InlineData("10.0.0.1:102", false)]
+    [InlineData("10.0..1", false)]
+    public void FullAddressPaste_StrictlyRequiresFourIpv4Octets(string address, bool accepted)
+        => Assert.Equal(accepted, IpConnectWizardWindow.TrySplitIpv4(address, out _));
+
+    [Fact]
+    public void ExistingPreferences_SeparateSubmittedFromVerifiedHistory_WithNoMigrationLoss()
+    {
+        var path = Path.Combine(Path.GetTempPath(), "arsas-smart-ip-" + Guid.NewGuid().ToString("N") + ".json");
+        try
+        {
+            File.WriteAllText(path, """
+                {
+                  "LastDiscoveryIpAddress":"192.0.2.14",
+                  "LastDiscoveryMmsPort":102,
+                  "SuccessfulRelays":[
+                    {"IpAddress":"192.0.2.15","MmsPort":1102,"IedName":"SUB_BCU",
+                     "LastConnectedUtc":"2026-10-22T07:00:00Z","SuccessCount":3}],
+                  "SignalSelectionProfiles":[{"IedName":"SUB_BCU","IpAddress":"192.0.2.15",
+                    "Port":1102,"SelectedObjectReferences":["IEDLD0/LLN0.Mod.stVal"]}],
+                  "RecentRelayIps":["192.0.2.16"]
+                }
+                """);
+            var before = File.ReadAllText(path);
+            var entries = UserPreferenceStore.LoadRecentEndpointDetails(path);
+            Assert.Equal("192.0.2.14", entries[0].IpAddress);
+            Assert.False(entries[0].ConfirmedSuccessful);
+            Assert.Equal("192.0.2.15", entries[1].IpAddress);
+            Assert.True(entries[1].ConfirmedSuccessful);
+            Assert.Equal(1102, entries[1].MmsPort);
+            Assert.Equal("SUB_BCU", entries[1].IedName);
+            Assert.Contains(entries, e => e.IpAddress == "192.0.2.16" && !e.ConfirmedSuccessful);
+            Assert.Equal(before, File.ReadAllText(path));
+        }
+        finally { if (File.Exists(path)) File.Delete(path); }
+    }
+
+    [Fact]
+    public void DefaultDialog_IsCompactUsesAppTypography_AndKeepsExpertControlsCollapsed()
+    {
+        var doc = XDocument.Load(Find("IpConnectWizardWindow.xaml"));
+        XNamespace w = "http://schemas.microsoft.com/winfx/2006/xaml/presentation";
+        XNamespace x = "http://schemas.microsoft.com/winfx/2006/xaml";
+        var root = Assert.IsType<XElement>(doc.Root);
+
+        Assert.InRange(int.Parse(root.Attribute("Width")!.Value), 460, 530);
+        Assert.Equal("350", root.Attribute("Height")?.Value);
+        Assert.Contains("AppFontFamily", root.Attribute("FontFamily")!.Value);
+        Assert.Equal("Manual", root.Attribute("SizeToContent")?.Value);
+
+        var octetStyle = doc.Descendants(w + "Style")
+            .Single(style => style.Attribute(x + "Key")?.Value == "SmartIpOctet");
+        var setters = octetStyle.Elements(w + "Setter")
+            .ToDictionary(e => e.Attribute("Property")!.Value, e => e.Attribute("Value")!.Value);
+        Assert.True(double.Parse(setters["Width"], System.Globalization.CultureInfo.InvariantCulture) <= 46);
+        Assert.True(double.Parse(setters["FontSize"], System.Globalization.CultureInfo.InvariantCulture) <= 13);
+        Assert.True(double.Parse(setters["Height"], System.Globalization.CultureInfo.InvariantCulture) <= 34);
+
+        var options = doc.Descendants(w + "Expander")
+            .Single(e => e.Attribute(x + "Name")?.Value == "MoreOptionsExpander");
+        Assert.NotEqual("True", options.Attribute("IsExpanded")?.Value);
+        Assert.Contains(options.Descendants(w + "TextBox"),
+            box => box.Attribute(x + "Name")?.Value == "MmsPortBox");
+        Assert.DoesNotContain(doc.Descendants(w + "CheckBox"),
+            box => box.Attribute(x + "Name")?.Value == "ManualAddressCheck");
+        Assert.Equal("265", doc.Descendants(w + "Border")
+            .Single(e => e.Attribute(x + "Name")?.Value == "IpEditorHost")
+            .Attribute("Width")?.Value);
+        Assert.Contains("expand_circle_down", File.ReadAllText(Find("IpConnectWizardWindow.xaml")));
+
+        var xaml = File.ReadAllText(Find("IpConnectWizardWindow.xaml"));
+        Assert.DoesNotContain("Smart discovery", xaml, StringComparison.Ordinal);
+        Assert.DoesNotContain("DataSets", xaml, StringComparison.Ordinal);
+        Assert.DoesNotContain("RCBs", xaml, StringComparison.Ordinal);
+        Assert.DoesNotContain("IPv6", xaml, StringComparison.Ordinal);
+        Assert.Contains("x:Name=\"HistoryPopup\"", xaml, StringComparison.Ordinal);
+        Assert.Contains("Content=\"Connect\"", xaml, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void WpfEditor_ConstructsOnSta_AndHasReachableKeyboardFocusAndIPv6Mode()
+    {
+        if (!OperatingSystem.IsWindows()) return;
+        Exception? failure = null;
+        var thread = new Thread(() =>
+        {
+            try
+            {
+                var wizard = new IpConnectWizardWindow("192.168.10.20");
+                try
+                {
+                    var boxes = new[]
+                    {
+                        Assert.IsType<TextBox>(wizard.FindName("Octet1Box")),
+                        Assert.IsType<TextBox>(wizard.FindName("Octet2Box")),
+                        Assert.IsType<TextBox>(wizard.FindName("Octet3Box")),
+                        Assert.IsType<TextBox>(wizard.FindName("Octet4Box"))
+                    };
+                    Assert.Equal(new[] { "192", "168", "10", "20" },
+                        boxes.Select(b => b.Text).ToArray());
+                    Assert.All(boxes, b =>
+                    {
+                        var style = b.Style;
+                        Assert.NotNull(style);
+                        Assert.Contains(style.Setters, setter =>
+                            setter is EventSetter evt && evt.Event == Keyboard.PreviewKeyDownEvent);
+                        Assert.Contains(style.Setters, setter =>
+                            setter is EventSetter evt && evt.Event == TextCompositionManager.PreviewTextInputEvent);
+                    });
+
+                    FocusManager.SetFocusedElement(wizard, boxes[0]);
+                    Assert.Same(boxes[0], FocusManager.GetFocusedElement(wizard));
+
+                    var options = Assert.IsType<Expander>(wizard.FindName("MoreOptionsExpander"));
+                    Assert.False(options.IsExpanded);
+                    var raw = Assert.IsType<TextBox>(wizard.FindName("RawIpBox"));
+                    var host = Assert.IsType<Border>(wizard.FindName("IpEditorHost"));
+                    Assert.Equal(Visibility.Collapsed, raw.Visibility);
+                    Assert.Equal(Visibility.Visible, host.Visibility);
+                    Assert.Null(wizard.FindName("ManualAddressCheck"));
+
+                    // IPv6 has no visible toggle; it activates via the caller's
+                    // initial address or a history recall, without losing data.
+                    var ipv6Wizard = new IpConnectWizardWindow("2001:db8::2");
+                    try
+                    {
+                        Assert.Equal(Visibility.Visible,
+                            Assert.IsType<TextBox>(ipv6Wizard.FindName("RawIpBox")).Visibility);
+                        Assert.Equal(Visibility.Collapsed,
+                            Assert.IsType<Border>(ipv6Wizard.FindName("IpEditorHost")).Visibility);
+                    }
+                    finally { ipv6Wizard.Close(); }
+
+                    Assert.NotNull(wizard.FindName("HistorySearchBox"));
+                    Assert.NotNull(wizard.FindName("HistoryListBox"));
+                }
+                finally { wizard.Close(); }
+            }
+            catch (Exception ex) { failure = ex; }
+        });
+        thread.SetApartmentState(ApartmentState.STA);
+        thread.Start();
+        Assert.True(thread.Join(TimeSpan.FromSeconds(20)), "Smart IP WPF STA test timed out.");
+        Assert.Null(failure);
+    }
+
+    [Fact]
+    public void HistorySelection_AndKeyboardHandlers_DoNotDirectlyInitiateConnections()
+    {
+        var source = File.ReadAllText(Find("IpConnectWizardWindow.xaml.cs"));
+        var historyStart = source.IndexOf("private void CommitHistorySelection()", StringComparison.Ordinal);
+        var connectStart = source.IndexOf("private void Connect_Click(", StringComparison.Ordinal);
+        Assert.True(historyStart >= 0 && connectStart > historyStart);
+        var history = source[historyStart..connectStart];
+        Assert.Contains("ApplyAddress(selection.IpAddress)", history);
+        Assert.DoesNotContain("RecordSuccessfulEndpoint", history);
+        Assert.DoesNotContain("RecordLastDiscoveryEndpoint", history);
+        Assert.DoesNotContain("DialogResult = true", history);
+        Assert.Contains("Key.Back", source);
+        Assert.Contains("Key.Left", source);
+        Assert.Contains("Key.Right", source);
+        Assert.Contains("Key.OemPeriod", source);
+        Assert.Contains("Key.Enter", source);
+        Assert.Contains("Key.Escape", source);
+    }
+
+    private static string Find(string relative)
+    {
+        DirectoryInfo? directory = new(AppContext.BaseDirectory);
+        while (directory is not null)
+        {
+            var path = Path.Combine(directory.FullName, relative);
+            if (File.Exists(path)) return path;
+            directory = directory.Parent;
+        }
+        throw new FileNotFoundException(relative);
+    }
+}
diff --git a/tests/ARSAS.Tests/ProductionFatM2PermanentHostRegressionTests.cs b/tests/ARSAS.Tests/ProductionFatM2PermanentHostRegressionTests.cs
index ffaadedfc..c44078ba0 100644
--- a/tests/ARSAS.Tests/ProductionFatM2PermanentHostRegressionTests.cs
+++ b/tests/ARSAS.Tests/ProductionFatM2PermanentHostRegressionTests.cs
@@ -1,6 +1,6 @@
 namespace ARSAS.Tests;
 
-[Collection("Wpf donor lifecycle")]
+[Collection("WpfStaIsolation")]
 public sealed class ProductionFatM2PermanentHostRegressionTests
 {
     [Fact]
diff --git a/tests/ARSAS.Tests/QualityInvalidAttentionTests.cs b/tests/ARSAS.Tests/QualityInvalidAttentionTests.cs
new file mode 100644
index 000000000..954ca508c
--- /dev/null
+++ b/tests/ARSAS.Tests/QualityInvalidAttentionTests.cs
@@ -0,0 +1,75 @@
+using ArIED61850Tester.Models;
+
+namespace ARSAS.Tests;
+
+public sealed class QualityInvalidAttentionTests
+{
+    [Theory]
+    [InlineData("Invalid", true)]
+    [InlineData("invalid", true)]
+    [InlineData(" INVALID ", true)]
+    [InlineData("Invalid / Overflow", true)]
+    [InlineData("Invalid (Failure)", true)]
+    [InlineData("Good", false)]
+    [InlineData("Questionable", false)]
+    [InlineData("Reserved", false)]
+    [InlineData("Pending / q not supplied", false)]
+    [InlineData("Unknown", false)]
+    [InlineData("Invalidity", false)]
+    [InlineData("", false)]
+    [InlineData(null, false)]
+    public void InvalidValidity_IsStrictlyIdentifiedForUiOnly(string? quality, bool expected)
+        => Assert.Equal(expected, QualityInvalidAttention.IsInvalid(quality));
+
+    [Fact]
+    public void LivePoint_UpdatesAttentionAndPreservesRawQuality()
+    {
+        var point = new Iec61850MonitorPoint();
+        var notifications = new List<string?>();
+        point.PropertyChanged += (_, e) => notifications.Add(e.PropertyName);
+        Assert.False(point.IsInvalidQuality);
+        point.Quality = "Invalid / Overflow";
+        Assert.True(point.IsInvalidQuality);
+        Assert.Equal("Invalid / Overflow", point.Quality);
+        Assert.Contains(nameof(point.IsInvalidQuality), notifications);
+        point.Quality = "Good";
+        Assert.False(point.IsInvalidQuality);
+    }
+
+    [Fact]
+    public void Browser_WarnsOnlyForQualityValidityAndExactQualityLeaves()
+    {
+        var root = new IedBrowserDetailRow("Data", "q [ST]", "Not read")
+        {
+            EvidenceKind = "Quality",
+            FunctionalConstraint = "ST",
+            ValueReference = "LD/PTOC1.Op.q"
+        };
+        var changes = new List<string?>();
+        root.PropertyChanged += (_, e) => changes.Add(e.PropertyName);
+        root.Value = "Invalid";
+        Assert.True(root.IsInvalidQuality);
+        Assert.Equal("Invalid", root.Value);
+        Assert.Contains(nameof(root.IsInvalidQuality), changes);
+
+        var validity = new IedBrowserDetailRow("Data", "Validity", "invalid")
+        {
+            EvidenceKind = "Quality", EvidenceField = "Validity"
+        };
+        Assert.True(validity.IsInvalidQuality);
+        var otherFlag = new IedBrowserDetailRow("Data", "Failure", "invalid")
+        {
+            EvidenceKind = "Quality", EvidenceField = "Failure"
+        };
+        Assert.False(otherFlag.IsInvalidQuality);
+        var processValue = new IedBrowserDetailRow("Data", "general", "Invalid");
+        Assert.False(processValue.IsInvalidQuality);
+        var dataSetLeaf = new IedBrowserDetailRow("Data", "q [ST]", "invalid")
+        {
+            FunctionalConstraint = "ST", ValueReference = "LD/CSWI1.Pos.q"
+        };
+        Assert.True(dataSetLeaf.IsInvalidQuality);
+        root.Value = "Good";
+        Assert.False(root.IsInvalidQuality);
+    }
+}
diff --git a/tests/ARSAS.Tests/RealizedLiveViewportPriorityTests.cs b/tests/ARSAS.Tests/RealizedLiveViewportPriorityTests.cs
new file mode 100644
index 000000000..ce8020a8b
--- /dev/null
+++ b/tests/ARSAS.Tests/RealizedLiveViewportPriorityTests.cs
@@ -0,0 +1,121 @@
+using ArIED61850Tester.Models;
+
+namespace ARSAS.Tests;
+
+/// <summary>
+/// Real data grids own only viewport hints. No acquisition snapshot or event is
+/// discarded: every point retains its normal FIFO key independent of priority.
+/// </summary>
+public sealed class RealizedLiveViewportPriorityTests
+{
+    [Fact]
+    public void ConcurrentTwoGridHints_PreserveSameExactReferenceWithoutCrossGridRemoval()
+    {
+        var viewport = new LivePointViewportPriorityTracker();
+        const string key = "SG7|LD/MMXU1.A.phsA.cVal.mag.f|MX";
+        const string distinctFc = "SG7|LD/MMXU1.A.phsA.cVal.mag.f|ST";
+
+        Assert.False(viewport.IsRealized(key));
+        Assert.True(viewport.Realize(LivePointViewportKind.Explorer, key));
+        Assert.False(viewport.Realize(LivePointViewportKind.Explorer, key));
+        Assert.True(viewport.Realize(LivePointViewportKind.Global, key));
+        Assert.Equal(2, viewport.RealizedCount);
+        viewport.Unrealize(LivePointViewportKind.Explorer, key);
+        Assert.True(viewport.IsRealized(key));
+        Assert.False(viewport.IsRealized(distinctFc));
+        viewport.Clear(LivePointViewportKind.Global);
+        Assert.False(viewport.IsRealized(key));
+        Assert.Equal(0, viewport.RealizedCount);
+    }
+
+    [Fact]
+    public void ScrollRecycling_OnlyActualRowsRemainPriorityHints()
+    {
+        var viewport = new LivePointViewportPriorityTracker();
+        const int modelSize = 32_900;
+        var keys = Enumerable.Range(0, modelSize)
+            .Select(n => $"SG7|LD/MMXU1.Do{n}.stVal|ST").ToArray();
+        foreach (var index in Enumerable.Range(10200, 55))
+            Assert.True(viewport.Realize(LivePointViewportKind.Explorer, keys[index]));
+        Assert.Equal(55, viewport.RealizedCount);
+        Assert.True(viewport.IsRealized(keys[10223]));
+        Assert.False(viewport.IsRealized(keys[0]));
+
+        foreach (var index in Enumerable.Range(10200, 55))
+            viewport.Unrealize(LivePointViewportKind.Explorer, keys[index]);
+        foreach (var index in Enumerable.Range(24000, 42))
+            viewport.Realize(LivePointViewportKind.Explorer, keys[index]);
+        Assert.Equal(42, viewport.RealizedCount);
+        Assert.False(viewport.IsRealized(keys[10223]));
+        Assert.True(viewport.IsRealized(keys[24001]));
+
+        viewport.Clear(LivePointViewportKind.Explorer);
+        Assert.Equal(0, viewport.RealizedCount);
+    }
+
+    [Fact]
+    public void BackgroundAcquisitionThread_CanSafelyInspectVisibleSnapshotHints()
+    {
+        var viewport = new LivePointViewportPriorityTracker();
+        const string key = "SG7|LD/XCBR1.Pos.stVal|ST";
+        var tasks = Enumerable.Range(0, 4).Select(worker => Task.Run(() =>
+        {
+            for (var iteration = 0; iteration < 2000; iteration++)
+            {
+                if (worker == 0)
+                {
+                    viewport.Realize(LivePointViewportKind.Explorer, key);
+                    viewport.Unrealize(LivePointViewportKind.Explorer, key);
+                }
+                else
+                {
+                    _ = viewport.IsRealized(key);
+                }
+            }
+        }));
+        Task.WaitAll(tasks.ToArray());
+        Assert.False(viewport.IsRealized(key));
+    }
+
+    [Fact]
+    public void WpfContract_UsesActuallyRealizedRowsAndStillProjectsEveryQueuedPoint()
+    {
+        var partial = Read("MainWindow.LivePointViewportPriority.cs");
+        var loaded = Read("MainWindow.IecNaturalSort.cs");
+        var main = Read("MainWindow.xaml.cs");
+        var flush = main.Split("private void UiFlushTimer_Tick(")[1]
+            .Split("private void Signal_PropertyChanged(")[0];
+        var ingress = main.Split("private void Runtime_PointUpdated(")[1]
+            .Split("private void Runtime_EventRaised(")[0];
+
+        Assert.Contains("grid.LoadingRow += LivePointViewport_LoadingRow", partial);
+        Assert.Contains("grid.UnloadingRow += LivePointViewport_UnloadingRow", partial);
+        Assert.Contains("_livePointViewport.Realize(", partial);
+        Assert.Contains("_livePointViewport.Unrealize(", partial);
+        Assert.Contains("_livePointViewport.Clear(", partial);
+        Assert.Contains("AttachLivePointViewportPriority(sender as DataGrid)", loaded);
+        Assert.Contains("Devices.CollectionChanged += ", main);
+        Assert.Contains("UiPointOwners()", flush);
+        Assert.DoesNotContain("Devices.GroupBy(", flush);
+        Assert.Contains("_pendingPointUiKeys.Enqueue(key)", ingress);
+        Assert.Contains("_livePointViewport.IsRealized(key)", ingress);
+        Assert.Contains("_priorityPointUiKeys.Enqueue(key)", ingress);
+        Assert.Contains("_pendingPointSnapshots.TryRemove(pointKey, out var pending)", flush);
+        Assert.Contains("CanonicalPointSnapshotAuthority.Project(", flush);
+        Assert.Contains("snapshot.ObservationAssociation != observedOwner.LiveValues.Association", flush);
+        Assert.Contains("Events.AddRange(eventBatch)", flush);
+        Assert.DoesNotContain("priorityDevice.Points.Take(48)", main);
+        Assert.DoesNotContain("_pendingPointSnapshots.Clear()", flush);
+    }
+
+    private static string Read(string name)
+    {
+        for (DirectoryInfo? folder = new(AppContext.BaseDirectory);
+             folder is not null; folder = folder.Parent)
+        {
+            var path = Path.Combine(folder.FullName, name);
+            if (File.Exists(path)) return File.ReadAllText(path);
+        }
+        throw new FileNotFoundException(name);
+    }
+}
diff --git a/tests/ARSAS.Tests/Sg7DpcBooleanExactFeedbackSafetyTests.cs b/tests/ARSAS.Tests/Sg7DpcBooleanExactFeedbackSafetyTests.cs
new file mode 100644
index 000000000..0281b2962
--- /dev/null
+++ b/tests/ARSAS.Tests/Sg7DpcBooleanExactFeedbackSafetyTests.cs
@@ -0,0 +1,121 @@
+using AR.Iec61850.Control;
+using AR.Iec61850.Mms;
+using ArIED61850Tester.Models;
+using ArIED61850Tester.Services;
+
+namespace ARSAS.Tests;
+
+/// <summary>
+/// Offline pinned-ARIEC typed descriptor contract only. Never sends SBO,
+/// Operate, Config Write or any network command.
+/// </summary>
+public sealed class Sg7DpcBooleanExactFeedbackSafetyTests
+{
+    private static Iec61850ControlObjectDescriptor Descriptor(
+        string objectReference, string statusReference,
+        string wireType = "boolean") => new()
+    {
+        ObjectReference = objectReference,
+        StatusReference = statusReference,
+        Cdc = "SPC", // Vendor wire inference may still be SPC for Boolean ctlVal
+        ControlModel = Iec61850ControlModel.DirectNormal,
+        CtlValSpecification = new MmsTypeSpecificationNode
+        {
+            Name = "ctlVal", MmsType = wireType,
+            Size = wireType == "bit-string" ? 2 : null
+        },
+        OperSpecification = new MmsTypeSpecificationNode { MmsType = "structure" }
+    };
+
+    [Theory]
+    [InlineData(1)]
+    [InlineData(2)]
+    [InlineData(3)]
+    [InlineData(4)]
+    public void FourCswiBooleanCtlVal_RequireExactSameObjectLiveStVal(int n)
+    {
+        var reference = $"SG7_BCUSystem/BkrCSWI{n}.Pos";
+        var descriptor = Descriptor(reference, reference + ".stVal");
+        var semantic = Iec61850ControlSemanticResolver.Resolve(
+            descriptor, "DPC", reference + ".stVal");
+        Assert.False(semantic.IsCommandSafe);
+        Assert.Equal("DPC", semantic.Cdc);
+        Assert.True(NativeIec61850Client.HasExactDpcBooleanFeedback(
+            descriptor, semantic.Cdc));
+
+        var unverified = new SignalDefinition
+        {
+            ObjectReference = reference, FunctionalConstraint = "CO",
+            IsControlSignal = true, HasControlServiceEvidence = true,
+            ControlCdc = "DPC"
+        };
+        Assert.False(unverified.ControlSupportsOperate);
+    }
+
+    [Fact]
+    public void OtherCswiStatusMayPassSuffixCheckButMustFailConsumerIdentityFence()
+    {
+        const string own = "SG7_BCUSystem/BkrCSWI1.Pos";
+        const string another = "SG7_BCUSystem/BkrCSWI2.Pos.stVal";
+        var descriptor = Descriptor(own, another);
+        var semantic = Iec61850ControlSemanticResolver.Resolve(
+            descriptor, "DPC");
+        // This intentionally proves the consumer adds a stronger exact object
+        // check without weakening or assuming the engine's suffix-based logic.
+        Assert.False(semantic.IsCommandSafe);
+        Assert.False(NativeIec61850Client.HasExactDpcBooleanFeedback(
+            descriptor, semantic.Cdc));
+    }
+
+    [Theory]
+    [InlineData("SG7_BCUSystem/BkrCSWI1.Pos.q")]
+    [InlineData("SG7_BCUSystem/BkrCSWI1.Pos.stVal.extra")]
+    [InlineData("SG7_BCUSystem/BkrCSWI1.Pos.STVAL")]
+    public void NearMissFeedbackPathsCannotClaimDpcBooleanAuthority(string feedback)
+    {
+        var descriptor = Descriptor("SG7_BCUSystem/BkrCSWI1.Pos", feedback);
+        Assert.False(NativeIec61850Client.HasExactDpcBooleanFeedback(
+            descriptor, "DPC"));
+    }
+
+    [Fact]
+    public void FinalNativeControlCommandGateAlsoRejectsCrossObjectDpcBoolean()
+    {
+        var source = File.ReadAllText(LocateNativeClient());
+        var start = source.IndexOf(
+            "private async Task<Iec61850ControlCommandResult> ExecuteControlCoreAsync(",
+            StringComparison.Ordinal);
+        var stop = source.IndexOf("private ", start + 74, StringComparison.Ordinal);
+        Assert.True(start >= 0 && stop > start);
+        var native = source[start..stop];
+        var gate = native.IndexOf(
+            "exactDpcBooleanFeedback = HasExactDpcBooleanFeedback(descriptor, effectiveCdc)",
+            StringComparison.Ordinal);
+        var rejection = native.IndexOf("if (!exactDpcBooleanFeedback)", StringComparison.Ordinal);
+        var encode = native.IndexOf("TryBuildNativeControlValue(", StringComparison.Ordinal);
+        var wire = native.IndexOf("control.OperateAsync(", StringComparison.Ordinal);
+        Assert.True(gate > 0 && rejection > gate && encode > rejection && wire > encode);
+        Assert.Contains("DPC Boolean control NOT SENT:", native);
+        Assert.Contains("semantic.IsCommandSafe && exactDpcBooleanFeedback", native);
+    }
+
+    private static string LocateNativeClient()
+    {
+        for (DirectoryInfo? dir = new(AppContext.BaseDirectory);
+             dir != null; dir = dir.Parent)
+        {
+            var file = Path.Combine(dir.FullName, "Services", "NativeIec61850Client.cs");
+            if (File.Exists(file)) return file;
+        }
+        throw new FileNotFoundException("NativeIec61850Client.cs");
+    }
+
+    [Fact]
+    public void NonBooleanCodecKeepsExistingEngineVerificationAuthority()
+    {
+        const string own = "SG7_BCUSystem/BkrCSWI1.Pos";
+        var descriptor = Descriptor(own, own + ".stVal", "bit-string");
+        Assert.True(NativeIec61850Client.HasExactDpcBooleanFeedback(
+            descriptor, "DPC"));
+    }
+}
diff --git a/tests/ARSAS.Tests/Sg7IntegratedCommandInventoryMilestoneTests.cs b/tests/ARSAS.Tests/Sg7IntegratedCommandInventoryMilestoneTests.cs
new file mode 100644
index 000000000..91ec19f4c
--- /dev/null
+++ b/tests/ARSAS.Tests/Sg7IntegratedCommandInventoryMilestoneTests.cs
@@ -0,0 +1,111 @@
+using AR.Iec61850.Discovery;
+using ArIED61850Tester.Models;
+using ArIED61850Tester.Services;
+
+namespace ARSAS.Tests;
+
+/// <summary>
+/// SG7_BCU exact command-inventory regression. Visibility/ranking uses typed
+/// engineering-service evidence; command admission requires independent live
+/// semantic proof. Never synthesizes or transmits any physical Operate.
+/// </summary>
+public sealed class Sg7IntegratedCommandInventoryMilestoneTests
+{
+    private static SignalDefinition Candidate(string reference, string cdc,
+        bool coEvidence = true) => new()
+    {
+        ObjectReference = reference,
+        Name = reference,
+        FunctionalConstraint = "CO",
+        IsControlSignal = true,
+        HasControlServiceEvidence = coEvidence,
+        ControlCdc = cdc,
+        ControlModelText = "Auto-detect"
+    };
+
+    [Fact]
+    public void FourSg7CswiRemainVisibleBeforeTypeVerification_WithoutOperate()
+    {
+        var genericBank = Enumerable.Range(1, 200)
+            .Select(i => Candidate($"SG7_BCUMaster/GGIO2.SPCSO{i:000}", "SPC"))
+            .ToArray();
+        var cswi = Enumerable.Range(1, 4)
+            .Select(i => Candidate($"SG7_BCUSystem/BkrCSWI{i}.Pos", i == 2 ? "" : "DPC"))
+            .ToArray();
+        var breakerFeedback = Candidate("SG7_BCUSystem/Bkr0XCBR1.Pos", "DPC");
+        breakerFeedback.ControlModelText = "Status only";
+        var device = new Iec61850MonitorDevice
+        {
+            IsConnected = true,
+            LiveDiscoveryModel = new LiveIedModelDiscoveryDocument()
+        };
+
+        device.Signals.ReplaceAll(genericBank.Concat([breakerFeedback]).Concat(cswi));
+        device.RecountSelectedSignals();
+
+        Assert.Equal(cswi, device.CommandSignals.Take(4));
+        Assert.All(cswi, candidate =>
+        {
+            Assert.Equal(0, Iec61850ControlIdentity.CommandDockPriority(candidate));
+            Assert.Contains("verification required",
+                Iec61850ControlIdentity.CommandDockRole(candidate));
+            Assert.False(candidate.ControlSupportsOperate);
+            Assert.DoesNotContain(candidate, device.OperableCommandSignals);
+        });
+        Assert.All(device.CommandSignals.Skip(4), candidate =>
+            Assert.NotEqual("CSWI", candidate.LogicalNodeClass));
+        Assert.Empty(device.OperableCommandSignals);
+
+        // Read-only status/quality changes cannot cause row collection churn,
+        // fabricate semantic verification or convert a candidate into Operate.
+        var first = device.CommandSignals.ToArray();
+        for (var n = 0; n < 80; n++)
+        {
+            cswi[0].ControlCurrentValue = n % 2 == 0 ? "Open" : "Closed";
+            device.RefreshCommandSignalProjection();
+        }
+        Assert.True(first.SequenceEqual(device.CommandSignals));
+        Assert.All(cswi, candidate => Assert.False(candidate.ControlSupportsOperate));
+    }
+
+    [Fact]
+    public void SameCswiPromotesOnlyAfterVerifiedLiveCdcAndSemanticProof()
+    {
+        var cswi = Candidate("SG7_BCUSystem/BkrCSWI1.Pos", "DPC");
+        Assert.Equal(0, Iec61850ControlIdentity.CommandDockPriority(cswi));
+        Assert.Contains("verification required", Iec61850ControlIdentity.CommandDockRole(cswi));
+        cswi.ControlModelText = "Select Before Operate (SBO) • Enhanced security";
+        Assert.False(cswi.ControlSupportsOperate);
+        cswi.AcceptVerifiedLiveControlCdc("DPC");
+        Assert.False(cswi.ControlSupportsOperate);
+        cswi.ControlSemanticVerified = true;
+        Assert.True(cswi.ControlSupportsOperate);
+        Assert.Equal("Switch controller · CSWI",
+            Iec61850ControlIdentity.CommandDockRole(cswi));
+        Assert.Same(cswi, Assert.Single(
+            Iec61850ControlIdentity.VerifiedCommandTargets([cswi], admitDiscovered: true)));
+    }
+
+    [Fact]
+    public void UnprovenNameOnlyCswiCannotGainCommandDockPriority()
+    {
+        var spoof = Candidate("SG7_BCUSystem/BkrCSWI1.Pos", "DPC", coEvidence: false);
+        Assert.NotEqual(0, Iec61850ControlIdentity.CommandDockPriority(spoof));
+        Assert.False(spoof.ControlSupportsOperate);
+        Assert.Empty(Iec61850ControlIdentity.DiscoveredIndependentCswiControls([spoof]));
+        Assert.Empty(Iec61850ControlIdentity.VerifiedCommandTargets([spoof], true));
+    }
+
+    [Fact]
+    public void ScalarBooleanOperCtlValIsNotSufficientToPromoteDpcAdmission()
+    {
+        var candidate = Candidate("SG7_BCUSystem/BkrCSWI1.Pos", "DPC");
+        candidate.ControlModelText = "Select Before Operate (SBO) • Enhanced security";
+        // A Boolean CO Oper.ctlVal is a payload shape, not a verified DPC CDC.
+        candidate.AcceptVerifiedLiveControlCdc("SPC");
+        Assert.False(candidate.ControlSupportsOperate);
+        Assert.Empty(Iec61850ControlIdentity.VerifiedCommandTargets([candidate], true));
+        Assert.Equal(0, Iec61850ControlIdentity.CommandDockPriority(candidate));
+        Assert.Contains("verification required", Iec61850ControlIdentity.CommandDockRole(candidate));
+    }
+}
diff --git a/tests/ARSAS.Tests/Sg7IntegratedControlSsotRcbTests.cs b/tests/ARSAS.Tests/Sg7IntegratedControlSsotRcbTests.cs
new file mode 100644
index 000000000..ac8d8579b
--- /dev/null
+++ b/tests/ARSAS.Tests/Sg7IntegratedControlSsotRcbTests.cs
@@ -0,0 +1,232 @@
+using AR.Iec61850.Discovery;
+using ArIED61850Tester.Models;
+using ArIED61850Tester.Services;
+
+namespace ARSAS.Tests;
+
+/// <summary>
+/// SG7_BCU one-release-gate P0 contracts: discovered controls are VISIBLE,
+/// but exact typed live evidence remains required for physical authorization.
+/// No fake MMS ingress, SOE, or Operate is generated.
+/// </summary>
+public sealed class Sg7IntegratedControlSsotRcbTests
+{
+    private static SignalDefinition Candidate(int n) => new()
+    {
+        ObjectReference = $"SG7_BCUSystem/BkrCSWI{n}.Pos",
+        Name = $"BkrCSWI{n}.Pos",
+        FunctionalConstraint = "CO",
+        IsControlSignal = true,
+        HasControlServiceEvidence = true,
+        ControlCdc = "DPC",
+        ControlModelText = "SBO • Enhanced security"
+    };
+
+    [Fact]
+    public void FourUnverifiedCswi_RemainVisibleBehindVerifiedCommands_ButNeverOperable()
+    {
+        var cswi = Enumerable.Range(1, 4).Select(Candidate).ToArray();
+        var ggio = new SignalDefinition
+        {
+            ObjectReference = "SG7_BCUMaster/GGIO2.SPCSO001",
+            Name = "SPCSO001",
+            FunctionalConstraint = "CO", IsControlSignal = true,
+            HasControlServiceEvidence = true,
+            ControlCdc = "SPC", IsSelected = true,
+            ControlModelText = "SBO • Enhanced security"
+        };
+        ggio.AcceptVerifiedLiveControlCdc("SPC");
+        ggio.ControlSemanticVerified = true;
+        var device = new Iec61850MonitorDevice
+        {
+            IsConnected = true,
+            LiveDiscoveryModel = new LiveIedModelDiscoveryDocument()
+        };
+        device.Signals.ReplaceAll([ggio, .. cswi]);
+        device.RecountSelectedSignals();
+
+        // Verification/authorization ranks ahead of inspection-only CSWI.
+        // CSWI discovery still cannot manufacture an operating command.
+        Assert.Same(ggio, device.CommandSignals[0]);
+        Assert.Equal(cswi, device.CommandSignals.Skip(1).Take(4));
+        Assert.All(cswi, s =>
+        {
+            Assert.False(s.ControlSupportsOperate);
+            Assert.DoesNotContain(s, device.OperableCommandSignals);
+        });
+        Assert.Contains(ggio, device.OperableCommandSignals);
+        Assert.Empty(Iec61850ControlIdentity.VerifiedIndependentCswiControls(cswi));
+    }
+
+    [Fact]
+    public void NameOnlyCswiWithoutCoProof_IsNotDiscoveredControl()
+    {
+        var nameOnly = Candidate(5);
+        nameOnly.HasControlServiceEvidence = false;
+        Assert.Empty(Iec61850ControlIdentity.DiscoveredIndependentCswiControls([nameOnly]));
+        Assert.Equal(0, Iec61850ControlIdentity.CommandDockPriority(Candidate(1)));
+    }
+
+    [Fact]
+    public void CanonicalReportBridge_IsAssociationFenced_AndCannotReplaceTypedReport()
+    {
+        var store = new IedBrowserLiveValues();
+        var old = store.BeginAssociation();
+        const string reference = "SG7_BCUMaster/GGIO1.Ind002.stVal";
+        Assert.True(store.MirrorRoutedReportIfMissingForAssociation(
+            old, reference, "ST", "true", "", ""));
+        Assert.True(store.TryGet(reference, "ST", out var initial));
+        Assert.Equal("true", initial.Value);
+        Assert.True(store.PublishForAssociation(old, reference, "ST",
+            "false", "questionable", "2026-10-23 12:00 UTC", "Report"));
+        Assert.False(store.MirrorRoutedReportIfMissingForAssociation(
+            old, reference, "ST", "true", "Good", "2020-01-01"));
+        Assert.True(store.TryGet(reference, "ST", out var typed));
+        Assert.Equal("false", typed.Value);
+        Assert.Equal("questionable", typed.Quality);
+        store.BeginAssociation();
+        Assert.False(store.MirrorRoutedReportIfMissingForAssociation(
+            old, reference, "ST", "true", "", ""));
+        Assert.False(store.TryGet(reference, "ST", out _));
+    }
+
+    [Fact]
+    public void NativeMmsRead_PublishesToCanonicalBeforeUi_WithReportPrecedenceAndEpochFence()
+    {
+        var store = new IedBrowserLiveValues();
+        var epoch = store.BeginAssociation();
+        const string exact = "SG7_BCUMeter/ACsrcMMXU1.A.phsA.cVal.mag.f";
+        var read = new ResolvedIecSignalRead(new Iec61850ReadValue
+        {
+            Value = 125.25d, Quality = "Good",
+            DeviceTimestamp = "2026-10-23 12:00 UTC"
+        }, exact);
+        Assert.True(Iec61850MonitorRuntime.PublishVerifiedMmsReadToCanonical(
+            store, epoch, read, "MX", "FLOAT32", "Good", "12:00"));
+        Assert.True(store.TryGet(exact, "MX", out var initial));
+        Assert.Equal("125.25", initial.Value);
+        Assert.Equal("MMS Read", initial.Source);
+        Assert.Equal(epoch, initial.Association);
+        Assert.False(store.TryGet(exact.Replace(".cVal.", ".instCVal."), "MX", out _));
+
+        Assert.True(store.PublishForAssociation(epoch, exact, "MX",
+            "130.5", "questionable", "12:01", "Report"));
+        Assert.True(Iec61850MonitorRuntime.PublishVerifiedMmsReadToCanonical(
+            store, epoch, read, "MX", "FLOAT32", "Good", "12:02"));
+        Assert.True(store.TryGet(exact, "MX", out var reported));
+        Assert.Equal("130.5", reported.Value);
+        Assert.Equal("Report", reported.Source);
+        Assert.Equal("questionable", reported.Quality);
+
+        store.BeginAssociation();
+        Assert.False(Iec61850MonitorRuntime.PublishVerifiedMmsReadToCanonical(
+            store, epoch, read, "MX", "FLOAT32", "Good", "12:03"));
+        Assert.False(store.TryGet(exact, "MX", out _));
+    }
+
+    [Fact]
+    public void NativeMmsRead_DoesNotPublishStructuresOrControlParameters()
+    {
+        var store = new IedBrowserLiveValues();
+        var epoch = store.BeginAssociation();
+        var structure = new ResolvedIecSignalRead(
+            new Iec61850ReadValue { Value = "Structure(3)" },
+            "SG7_BCUSystem/BkrCSWI1.Pos.stVal");
+        Assert.False(Iec61850MonitorRuntime.PublishVerifiedMmsReadToCanonical(
+            store, epoch, structure, "ST", "Dbpos", "", ""));
+        Assert.False(Iec61850MonitorRuntime.PublishVerifiedMmsReadToCanonical(
+            store, epoch, new ResolvedIecSignalRead(true,
+                "SG7_BCUSystem/BkrCSWI1.Pos.Oper.ctlVal"),
+            "CO", "BOOLEAN", "", ""));
+        Assert.False(store.TryGet("SG7_BCUSystem/BkrCSWI1.Pos.stVal", "ST", out _));
+    }
+
+    [Fact]
+    public void StaticInitialImage_UsesActualSameAssociationRead_NotReportOrMissing()
+    {
+        var store = new IedBrowserLiveValues();
+        var epoch = store.BeginAssociation();
+        const string valueRef = "SG7_BCUMeter/ACsrcMMXU1.A.phsA.cVal.mag.f";
+        const string absent = "SG7_BCUMeter/ACsrcMMXU1.A.phsB.cVal.mag.f";
+        Assert.False(Iec61850MonitorRuntime.TryGetStaticInitialRead(
+            store, epoch, absent, "MX", out _));
+        Assert.True(store.PublishForAssociation(epoch, valueRef, "MX",
+            "123.5", "Good", "12:00", "MMS Read"));
+        Assert.True(Iec61850MonitorRuntime.TryGetStaticInitialRead(
+            store, epoch, valueRef, "MX", out var evidence));
+        Assert.Equal("MMS Read", evidence.Source);
+        Assert.Equal("123.5", evidence.Value);
+        Assert.False(Iec61850MonitorRuntime.TryGetStaticInitialRead(
+            store, epoch, valueRef, "CO", out _));
+        Assert.True(store.PublishForAssociation(epoch, valueRef, "MX",
+            "124", "Good", "12:01", "Report"));
+        Assert.False(Iec61850MonitorRuntime.TryGetStaticInitialRead(
+            store, epoch, valueRef, "MX", out _));
+        store.BeginAssociation();
+        Assert.False(Iec61850MonitorRuntime.TryGetStaticInitialRead(
+            store, epoch, valueRef, "MX", out _));
+    }
+
+    [Fact]
+    public void StaticMmsSnapshot_DpcPresentationUsesOperatorDbposWithoutChangingRawEvidence()
+    {
+        var point = new Iec61850MonitorPoint
+        {
+            IecReference = "SG7_BCUSystem/BkrCSWI1.Pos.stVal",
+            FunctionalConstraint = "ST",
+            IecDataType = "Dbpos", Category = "Position"
+        };
+        var store = new IedBrowserLiveValues();
+        var epoch = store.BeginAssociation();
+        Assert.True(store.PublishForAssociation(epoch, point.IecReference,
+            "ST", "2", "Good", "12:01", "MMS Read"));
+        Assert.True(Iec61850MonitorRuntime.TryGetStaticInitialRead(
+            store, epoch, point.IecReference, "ST", out var raw));
+        Assert.Equal("2", raw.Value);
+        Assert.Equal("Close [10]",
+            Iec61850MonitorRuntime.FormatStaticSnapshotRead(point, raw));
+        Assert.Equal("2", raw.Value);
+    }
+
+    [Fact]
+    public void StaticReportReadJournal_IsBounded_ReadOnlyAndNeverSynthesizesSoe()
+    {
+        var runtime = Read("Services/Iec61850MonitorRuntime.cs");
+        Assert.Contains("ConsumeStaticReadJournal(session);", runtime);
+        Assert.Contains("ledger.ReadChanges(session.StaticReadJournalCursor, 32)", runtime);
+        Assert.Contains("change.Kind != CanonicalValueChangeKind.Read", runtime);
+        Assert.Contains("change.Association != association", runtime);
+        Assert.Contains("state.ReportTrafficSeen", runtime);
+        Assert.Contains("TryGetStaticInitialRead(session.Device.LiveValues, association", runtime);
+        Assert.Contains("!string.Equals(sourceMode, \"MMS Snapshot Read\"", runtime);
+        Assert.DoesNotContain("PublishReport(point", runtime);
+    }
+
+    [Fact]
+    public void IntegrationContract_OneIngressWriter_NoWpfPublishOrBypassedOperate()
+    {
+        var runtime = Read("Services/Iec61850MonitorRuntime.cs");
+        var window = Read("MainWindow.xaml.cs");
+        var xaml = Read("MainWindow.xaml");
+        var control = Read("Models/MonitorModels.cs");
+        Assert.Contains("MirrorRoutedReportIfMissingForAssociation(", runtime);
+        Assert.DoesNotContain("observedOwner.LiveValues.PublishReport(point", window);
+        Assert.Contains("SelectedDevice.CommandSignals", xaml);
+        Assert.Contains("IsEnabled=\"{Binding ControlSupportsOperate}\"", xaml);
+        Assert.Contains("DiscoveredIndependentCswiControls(Signals)", control);
+        Assert.Contains("RCB setup accepted:", runtime);
+        Assert.Contains("awaiting first routed InformationReport", runtime);
+        Assert.DoesNotContain("ExecuteControlAsync(", Read("Services/Iec61850ControlIdentity.cs"));
+    }
+
+    private static string Read(string path)
+    {
+        for (DirectoryInfo? dir = new(AppContext.BaseDirectory);
+             dir is not null; dir = dir.Parent)
+        {
+            var full = Path.Combine(dir.FullName, path);
+            if (File.Exists(full)) return File.ReadAllText(full);
+        }
+        throw new FileNotFoundException(path);
+    }
+}
diff --git a/tests/ARSAS.Tests/Sg7StaticReportPendingEvidenceTests.cs b/tests/ARSAS.Tests/Sg7StaticReportPendingEvidenceTests.cs
new file mode 100644
index 000000000..16a5c773b
--- /dev/null
+++ b/tests/ARSAS.Tests/Sg7StaticReportPendingEvidenceTests.cs
@@ -0,0 +1,69 @@
+using ArIED61850Tester.Models;
+using ArIED61850Tester.Services;
+
+namespace ARSAS.Tests;
+
+/// <summary>
+/// An empty process image is not a WPF rendering defect: show exact
+/// DataSet/RCB provenance while never claiming a Report was received.
+/// </summary>
+public sealed class Sg7StaticReportPendingEvidenceTests
+{
+    private static SignalDefinition Meter(string dataset, string rcb) => new()
+    {
+        ObjectReference = "Meter/ACsrcMMXU1.A.phsA.cVal.mag.f",
+        FunctionalConstraint = "MX",
+        DataSetReference = dataset,
+        ReportControlReference = rcb
+    };
+
+    [Fact]
+    public void MissingMeterImageNamesExpectedStaticRcbWithoutFabricatingRptEna()
+    {
+        var reason = Iec61850MonitorRuntime.StaticReportAwaitingReason(
+            Meter("TT6DataSet4", "SG7_BCUMaster/LLN0.BR.BrcbI01"));
+        Assert.Contains("TT6DataSet4", reason);
+        Assert.Contains("BrcbI01", reason);
+        Assert.Contains("awaiting first routed InformationReport", reason);
+        Assert.Contains("RptEna/GI not yet proven", reason);
+        Assert.Contains("polling disabled", reason);
+    }
+
+    [Fact]
+    public void MissingRcbMappingCannotBePresentedAsArmed()
+    {
+        var reason = Iec61850MonitorRuntime.StaticReportAwaitingReason(
+            Meter("TT3DataSet02", ""));
+        Assert.Contains("no matched RCB", reason);
+        Assert.DoesNotContain("receiving", reason, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void MissingDataSetCannotInheritAdjacentIedRcb()
+    {
+        var reason = Iec61850MonitorRuntime.StaticReportAwaitingReason(
+            Meter("", "SG7_BCUMaster/LLN0.BR.BrcbA01"));
+        Assert.Contains("No verified static DataSet member", reason);
+        Assert.DoesNotContain("BrcbA01", reason);
+    }
+
+    [Fact]
+    public void RuntimeCreatesPendingStatusWithoutStartingHiddenMmsPolling()
+    {
+        var source = Read("Services/Iec61850MonitorRuntime.cs");
+        Assert.Contains("StaticReportAwaitingReason(signal)", source);
+        Assert.Contains("Awaiting first static InformationReport", source);
+        Assert.Contains("NextPollUtc = staticDataSetReportOnly ? DateTime.MaxValue", source);
+        Assert.DoesNotContain("RptEna succeeded", source);
+    }
+
+    private static string Read(string path)
+    {
+        for (DirectoryInfo? dir = new(AppContext.BaseDirectory); dir != null; dir = dir.Parent)
+        {
+            var full = Path.Combine(dir.FullName, path);
+            if (File.Exists(full)) return File.ReadAllText(full);
+        }
+        throw new FileNotFoundException(path);
+    }
+}
diff --git a/tests/ARSAS.Tests/SmartInteroperabilityTrialGuardRegressionTests.cs b/tests/ARSAS.Tests/SmartInteroperabilityTrialGuardRegressionTests.cs
index a91176c74..46f9d871c 100644
--- a/tests/ARSAS.Tests/SmartInteroperabilityTrialGuardRegressionTests.cs
+++ b/tests/ARSAS.Tests/SmartInteroperabilityTrialGuardRegressionTests.cs
@@ -139,9 +139,24 @@ public void TrialLock_PreservesHistoricalPhysicalAuthorityAndExplicitlyRequiresP
             stageTrial.GetProperty("baseEngineCommit").GetString());
         Assert.Equal("9c7cb40364023a7b217e5ec31ab3105ba90142eb",
             stageTrial.GetProperty("exactCommit").GetString());
+        var typedTrial = root.GetProperty("globalTypedControlStageTrial");
         Assert.Equal(stageTrial.GetProperty("exactCommit").GetString(),
+            typedTrial.GetProperty("baseEngineCommit").GetString());
+        Assert.Equal("f75e323e9f8443aa20e0a3818a1d5d77255b2c0f",
+            typedTrial.GetProperty("exactCommit").GetString());
+        Assert.Equal(typedTrial.GetProperty("exactCommit").GetString(),
             root.GetProperty("commit").GetString());
-        Assert.Equal(184, root.GetProperty("sourcePullRequest").GetInt32());
+        Assert.Equal(192, root.GetProperty("sourcePullRequest").GetInt32());
+        Assert.Equal(192, typedTrial.GetProperty("enginePullRequest").GetInt32());
+        Assert.Equal(39909260816L, typedTrial.GetProperty("engineCiRun").GetInt64());
+        Assert.Equal("engine-ci-success-consumer-trial-not-physical",
+            typedTrial.GetProperty("status").GetString());
+        foreach (var flag in new[] {
+            "typedStatusReadRequired", "sameDataObjectFeedbackRequired",
+            "ctlModelAndOperShapeRequired", "sbowEnhancedSafetyRequired",
+            "noAutomaticOperate", "physicalQualificationRequired",
+            "mainlinePromotionForbidden" })
+            Assert.True(typedTrial.GetProperty(flag).GetBoolean());
         Assert.Equal(184, stageTrial.GetProperty("enginePullRequest").GetInt32());
         Assert.Equal(185, stageTrial.GetProperty("engineCiOnlyPullRequest").GetInt32());
         Assert.Equal(1182, stageTrial.GetProperty("engineTestsPassed").GetInt32());
diff --git a/tests/ARSAS.Tests/SmvArstackCapturedEthernetInteropTests.cs b/tests/ARSAS.Tests/SmvArstackCapturedEthernetInteropTests.cs
new file mode 100644
index 000000000..6fdc27888
--- /dev/null
+++ b/tests/ARSAS.Tests/SmvArstackCapturedEthernetInteropTests.cs
@@ -0,0 +1,124 @@
+using System.Buffers.Binary;
+using AR.Iec61850.SampledValues;
+using ArIED61850Tester.Services;
+
+namespace ARSAS.Tests;
+
+/// <summary>
+/// Packet prefixes, SV BER, payload and trailing tag 0x89 come from real
+/// ARStack ESP32-P4 Ethernet PCAP ARStack_SV_20261022_020528_781.pcap.
+/// The live replay below varies smpCnt/timestamps/values deterministically
+/// while preserving exactly the captured 802.1Q + 9-2 BER wire shape.
+/// This is not an ARSVIN/KM loopback encoder test.
+/// </summary>
+public sealed class SmvArstackCapturedEthernetInteropTests
+{
+    // Exact 138-byte real frame, smpCnt=0, initial smpSynch=0.
+    private const string CapturedSourceAcquisitionFrame =
+        "010ccd040001e8f60ae0c53f8100800088ba4000007800000000606e800101a2693067800c4152535441434b5f53563031820200008304000000018501008740ffffff7c00000000fffffa2600000000000005850000000000000000000000000000000000000000ffffe3510000000000000e5a0000000000000000000000008908e8f60afffee0c53f";
+
+    // Exact 138-byte real frame after SOURCE phase ACQUIRED, smpSynch=2.
+    private const string CapturedGloballySynchronizedFrame =
+        "010ccd040001e8f60ae0c53f8100800088ba4000007800000000606e800101a2693067800c4152535441434b5f53563031820200008304000000018501028740ffffff7c00000000fffffa260000000000000585000000000000000000000000fffffffa00000000ffffe3510000000000000e5a0000000000000000000000008908e8f60afffee0c53f";
+
+    private static readonly SmvLiveCaptureOptions Settings = new()
+    {
+        AdapterSelector = "captured-arstack-8021q-pcp4-vid0",
+        NominalFrequencyHz = 50,
+        Cycles = 2,
+        MaximumChannels = 8
+    };
+
+    [Theory]
+    [InlineData(false, (byte)0)]
+    [InlineData(true, (byte)2)]
+    public void CapturedArstackRawEthernet_DecodesPriorityVlanGmIdAndOptionalMetadata(
+        bool acquired, byte expectedSync)
+    {
+        var bytes = Convert.FromHexString(acquired
+            ? CapturedGloballySynchronizedFrame : CapturedSourceAcquisitionFrame);
+        Assert.Equal(138, bytes.Length);
+        Assert.Equal(0x8100, BinaryPrimitives.ReadUInt16BigEndian(bytes.AsSpan(12, 2)));
+        Assert.Equal(0x8000, BinaryPrimitives.ReadUInt16BigEndian(bytes.AsSpan(14, 2)));
+        Assert.Equal(0x88BA, BinaryPrimitives.ReadUInt16BigEndian(bytes.AsSpan(16, 2)));
+        Assert.Equal("8908e8f60afffee0c53f",
+            Convert.ToHexString(bytes.AsSpan(bytes.Length - 10)).ToLowerInvariant());
+
+        Assert.True(SampledValuesFrameParser.TryParseEthernetFrame(bytes, out var frame));
+        Assert.Equal(0x4000, frame.AppId);
+        Assert.Equal("0", frame.Vlan?.VlanId.ToString());
+        var asdu = Assert.Single(frame.Pdu.Asdus);
+        Assert.Equal("ARSTACK_SV01", asdu.SvId);
+        Assert.Equal((ushort)0, asdu.SampleCount);
+        Assert.Equal(expectedSync, asdu.SampleSynchronization);
+        Assert.Equal(64, asdu.SamplePayload.Length);
+        Assert.Null(asdu.SampleRate);
+        Assert.Null(asdu.SampleMode);
+    }
+
+    [Fact]
+    public void CapturedArstackWireShape_AutoSync0To2_DoesNotEraseWaveformOrTimebase()
+    {
+        var raw = Convert.FromHexString(CapturedSourceAcquisitionFrame);
+        var catalog = new SmvLiveStreamCatalog(Settings);
+        var start = DateTimeOffset.FromUnixTimeSeconds(1792634731);
+        string? streamKey = null;
+        long snapshotsBeforeLock = 0;
+
+        for (var n = 0; n < 1200; n++)
+        {
+            // Modify only the captured smpCnt, smpSynch, and payload instMag.
+            // Every other byte, including actual 802.1Q, BER and gmIdentity,
+            // is preserved from the captured ARStack ESP32-P4 frame.
+            BinaryPrimitives.WriteUInt16BigEndian(raw.AsSpan(51, 2),
+                (ushort)(n % 4000));
+            raw[61] = n >= 600 ? (byte)2 : (byte)0;
+            for (var channel = 0; channel < 8; channel++)
+                BinaryPrimitives.WriteInt32BigEndian(
+                    raw.AsSpan(64 + 8 * channel, 4),
+                    (int)(2000 * Math.Sin(2 * Math.PI * n / 80.0 +
+                                           channel * Math.PI / 4)));
+
+            Assert.True(SampledValuesFrameParser.TryParseEthernetFrame(raw, out var frame));
+            // 4 kHz observed capture with bounded +-60us NIC arrival jitter.
+            // Never assume the counter rate merely from operator frequency.
+            var jitter = ((n * 37) % 1200) - 600;
+            var timestamp = start.AddTicks(n * 2500L + jitter);
+            catalog.Receive(frame, timestamp);
+            if (n == 599)
+            {
+                var before = catalog.Publish(null, timestamp);
+                streamKey = Assert.Single(before.Streams).Key;
+                Assert.True(Assert.Single(before.Streams).HasCoherentWindow);
+                Assert.NotNull(before.SelectedSnapshot);
+                snapshotsBeforeLock++;
+            }
+        }
+
+        Assert.Equal(1, snapshotsBeforeLock);
+        var result = catalog.Publish(streamKey, start.AddMilliseconds(300));
+        var summary = Assert.Single(result.Streams);
+        Assert.Equal(1200, summary.Frames);
+        Assert.Equal(1200, summary.Asdus);
+        Assert.Equal(0, summary.Gaps);
+        Assert.Equal(0, summary.Missing);
+        Assert.Equal(0, summary.Duplicates);
+        Assert.Equal(0, summary.OutOfOrder);
+        Assert.Equal(0, summary.Restarts); // smpSynch transition is NOT restart
+        Assert.True(summary.HasCoherentWindow);
+        Assert.Equal("0", summary.Vlan);
+
+        var proof = Assert.IsType<SmvSnapshotResult>(result.SelectedSnapshot);
+        Assert.Equal("ARSTACK_SV01", proof.StreamId);
+        Assert.Equal(0x4000, proof.AppId);
+        Assert.Equal(80, proof.SamplesPerCycle);
+        Assert.Equal(160, proof.CapturedSamples);
+        Assert.Equal(8, proof.Channels.Count);
+        Assert.Equal((byte)2, proof.SampleSynchronization);
+        Assert.Null(proof.DeclaredSampleRate);
+        Assert.Null(proof.DeclaredSampleMode);
+        Assert.True(proof.IsCleanProof);
+        Assert.Contains("capture rate", proof.TimebaseReason);
+        Assert.True(proof.Channels[0].Maximum > proof.Channels[0].Minimum);
+    }
+}
diff --git a/tests/ARSAS.Tests/SmvSmartInstallerUpgradeTests.cs b/tests/ARSAS.Tests/SmvSmartInstallerUpgradeTests.cs
index 85b753b03..09e127b63 100644
--- a/tests/ARSAS.Tests/SmvSmartInstallerUpgradeTests.cs
+++ b/tests/ARSAS.Tests/SmvSmartInstallerUpgradeTests.cs
@@ -31,8 +31,8 @@ public void PreviewSupportsSafeLockedFileRebootRecovery_WithoutKillingUnrelatedA
     [Fact]
     public void PreviewReleaseMustTestProtectedFolder_InPlaceDllRepairAndUninstall()
     {
-        var ci = Read(".github/workflows/smv-direct-inno-preview.yml");
-        Assert.Contains("Join-Path $env:ProgramFiles 'ARSAS-SMV-Preview-CI'", ci);
+        var ci = Read(".github/workflows/installer-windows.yml");
+        Assert.Contains("Join-Path $env:ProgramFiles 'ARSAS-FAT-ProtectedFolder-CI'", ci);
         Assert.DoesNotContain("'/CURRENTUSER'", ci);
         Assert.Contains("$dirArgument = '/DIR=\"' + $target + '\"'", ci);
         Assert.Contains("Silent install did not use requested Program Files directory", ci);
diff --git a/tests/ARSAS.Tests/SsotV2LargeGridSearchSortBudgetTests.cs b/tests/ARSAS.Tests/SsotV2LargeGridSearchSortBudgetTests.cs
new file mode 100644
index 000000000..19c13ea39
--- /dev/null
+++ b/tests/ARSAS.Tests/SsotV2LargeGridSearchSortBudgetTests.cs
@@ -0,0 +1,157 @@
+using System.Collections;
+using System.Collections.ObjectModel;
+using System.Reflection;
+using System.Windows.Controls;
+using System.Windows.Data;
+using ArIED61850Tester;
+using ArIED61850Tester.Models;
+using ArIED61850Tester.Services;
+
+namespace ARSAS.Tests;
+
+/// <summary>
+/// Regression gates for SG7-size WPF search/sort scheduling. This is a
+/// presentation test: no MMS acquisition, SOE or command operation is mocked.
+/// </summary>
+[Collection("WpfStaIsolation")]
+public sealed class SsotV2LargeGridSearchSortBudgetTests
+{
+    [Fact]
+    public void FatGlobalLiveGrid_DropsOnlyOurCustomSort_KeepingSourceOrderUnchanged()
+    {
+        RunInSta(() =>
+        {
+            var points = new ObservableCollection<Iec61850MonitorPoint>(
+                Enumerable.Range(0, 2500).Select(n => new Iec61850MonitorPoint
+                {
+                    DeviceId = "SG7",
+                    IecReference = $"SG7LD/MMXU1.A{n}.stVal",
+                    FunctionalConstraint = "ST"
+                }));
+            var expectedFirst = points[0];
+            var grid = new DataGrid { Name = "GlobalLiveGrid", ItemsSource = points, CanUserAddRows = false };
+            var view = Assert.IsType<ListCollectionView>(
+                CollectionViewSource.GetDefaultView(points));
+            view.CustomSort = IecNaturalGlobalMonitorSort.Instance;
+            ApplyNaturalSort(grid, IecNaturalGlobalMonitorSort.Instance);
+
+            Assert.Null(view.CustomSort);
+            Assert.Same(expectedFirst, points[0]);
+            Assert.Equal(2500, view.Count);
+        });
+    }
+
+    [Fact]
+    public void SmallGlobalGrid_KeepsNumericNaturalSort()
+    {
+        RunInSta(() =>
+        {
+            var points = new ObservableCollection<Iec61850MonitorPoint>(
+            [
+                new() { DeviceName = "GE", IecReference = "LD/CSWI10.Pos.stVal" },
+                new() { DeviceName = "GE", IecReference = "LD/CSWI2.Pos.stVal" }
+            ]);
+            var grid = new DataGrid { Name = "GlobalLiveGrid", ItemsSource = points, CanUserAddRows = false };
+            var view = Assert.IsType<ListCollectionView>(
+                CollectionViewSource.GetDefaultView(points));
+
+            ApplyNaturalSort(grid, IecNaturalGlobalMonitorSort.Instance);
+
+            Assert.Same(IecNaturalGlobalMonitorSort.Instance, view.CustomSort);
+            Assert.Same(points[1], view.Cast<Iec61850MonitorPoint>().First());
+        });
+    }
+
+    [Fact]
+    public void FatExplorerGrid_IsProtectedButCommandGridRetainsVerifiedOrder()
+    {
+        RunInSta(() =>
+        {
+            var points = new ObservableCollection<Iec61850MonitorPoint>(
+                Enumerable.Range(0, 2100).Select(n => new Iec61850MonitorPoint
+                {
+                    DeviceId = "SG7",
+                    IecReference = $"SG7LD/MMXU1.Freq{n}.stVal",
+                    FunctionalConstraint = "ST"
+                }));
+            var explorer = new DataGrid
+            {
+                Name = "ExplorerLiveValuesGrid",
+                ItemsSource = points
+            };
+            ApplyNaturalSort(explorer, IecNaturalLiveMonitorSort.Instance);
+            var view = Assert.IsType<ListCollectionView>(
+                CollectionViewSource.GetDefaultView(points));
+            Assert.Null(view.CustomSort);
+
+            var commands = new ObservableCollection<SignalDefinition>(
+            [
+                new() { ObjectReference = "SG7/GGIO1.DPCSO10" },
+                new() { ObjectReference = "SG7/GGIO1.DPCSO2" }
+            ]);
+            var commandGrid = new DataGrid
+            {
+                Name = "EquipmentCommandGrid", ItemsSource = commands
+            };
+            ApplyNaturalSort(commandGrid, IecNaturalCommandSort.Instance);
+            Assert.Same(IecNaturalCommandSort.Instance,
+                CollectionViewSource.GetDefaultView(commands)
+                    is ListCollectionView commandView ? commandView.CustomSort : null);
+        });
+    }
+
+    [Fact]
+    public void ExplorerHeavySearch_IsDebouncedButSwitchClearAndEnterApplyImmediately()
+    {
+        var dynamicSource = Read("MainWindow.LiveSignalSearch.cs");
+        var nativeSource = Read("MainWindow.LiveSearch.cs");
+        var globalSort = Read("MainWindow.IecNaturalSort.cs");
+
+        Assert.Contains("=> ScheduleUnifiedLiveSignalSearch()", nativeSource);
+        Assert.Contains("=> ScheduleUnifiedLiveSignalSearch()", dynamicSource);
+        Assert.Contains("Count: > 2048", dynamicSource);
+        Assert.Contains("TimeSpan.FromMilliseconds(220)", dynamicSource);
+        Assert.Contains("_liveSignalFilterDebounce.Stop();", dynamicSource);
+        Assert.Contains("if (e.Key == Key.Enter)", dynamicSource);
+        Assert.Contains("AttachLiveSignalSearchSource()", dynamicSource);
+        Assert.Contains("ApplyLiveSignalSearch();", dynamicSource);
+        Assert.Contains("GlobalPoints.CollectionChanged +=", globalSort);
+        Assert.Contains("_globalNaturalSortLargeMode", globalSort);
+        Assert.Contains("view.CustomSort = null", globalSort);
+        Assert.Contains("grid.Name is \"ExplorerLiveValuesGrid\" or \"GlobalLiveGrid\"", globalSort);
+        Assert.Contains("IecNaturalCommandSort.Instance", globalSort);
+    }
+
+    private static void ApplyNaturalSort(DataGrid grid, IComparer comparer)
+    {
+        var method = typeof(MainWindow).GetMethod("ApplyIecNaturalSort",
+            BindingFlags.NonPublic | BindingFlags.Static);
+        Assert.NotNull(method);
+        method!.Invoke(null, [grid, comparer]);
+    }
+
+    private static void RunInSta(Action action)
+    {
+        Exception? error = null;
+        var thread = new Thread(() =>
+        {
+            try { action(); } catch (Exception ex) { error = ex; }
+        });
+        thread.SetApartmentState(ApartmentState.STA);
+        thread.Start();
+        Assert.True(thread.Join(TimeSpan.FromSeconds(25)), "WPF sort test timed out");
+        if (error is not null)
+            System.Runtime.ExceptionServices.ExceptionDispatchInfo.Capture(error).Throw();
+    }
+
+    private static string Read(string file)
+    {
+        for (DirectoryInfo? dir = new(AppContext.BaseDirectory);
+             dir is not null; dir = dir.Parent)
+        {
+            var path = Path.Combine(dir.FullName, file);
+            if (File.Exists(path)) return File.ReadAllText(path);
+        }
+        throw new FileNotFoundException(file);
+    }
+}
diff --git a/tests/ARSAS.Tests/StartupVisualStabilityRegressionTests.cs b/tests/ARSAS.Tests/StartupVisualStabilityRegressionTests.cs
new file mode 100644
index 000000000..ee0f54d2c
--- /dev/null
+++ b/tests/ARSAS.Tests/StartupVisualStabilityRegressionTests.cs
@@ -0,0 +1,114 @@
+using System.Xml.Linq;
+
+namespace ARSAS.Tests;
+
+/// <summary>
+/// Source-level ownership checks for the first-paint startup path. These tests
+/// complement, not replace, a physical 100/125/150% DPI visual screenshot check.
+/// </summary>
+public sealed class StartupVisualStabilityRegressionTests
+{
+    [Fact]
+    public void Startup_ThemeAndIndustrialTemplatesPrecedeFirstWindow()
+    {
+        var app = Read("App.xaml.cs");
+        var theme = app.IndexOf("InstallP2BlueSteelGreigeTheme();", StringComparison.Ordinal);
+        var fascia = app.IndexOf("InstallArvrelMiniIedFascia();", StringComparison.Ordinal);
+        var controls = app.IndexOf("P2IndustrialWorkstationUx.PreloadResources();", StringComparison.Ordinal);
+        var registration = app.IndexOf("EventManager.RegisterClassHandler(typeof(Window)", StringComparison.Ordinal);
+        Assert.True(theme >= 0 && fascia > theme && controls > fascia);
+        Assert.True(registration > controls);
+        Assert.Contains("private void AppWindow_Loaded", app, StringComparison.Ordinal);
+        Assert.Contains("_styledWindows.TryGetValue(window", app, StringComparison.Ordinal);
+
+        // Every focus return must not redo the entire WPF visual tree.
+        Assert.DoesNotContain("protected override void OnActivated(", app, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void WindowAdapter_IsOnceOnlyAndNeverOverridesCanonicalInterFont()
+    {
+        var adapter = Read("P2BlueSteelGreigeUx.cs");
+        var controls = Read("P2IndustrialWorkstationUx.cs");
+        var app = Read("App.xaml");
+
+        Assert.Contains("ConditionalWeakTable<Window, object>", adapter, StringComparison.Ordinal);
+        Assert.Contains("AppliedWindows.TryGetValue", adapter, StringComparison.Ordinal);
+        Assert.Contains("AppliedWindows.Add", adapter, StringComparison.Ordinal);
+        Assert.DoesNotContain("window.FontFamily =", adapter, StringComparison.Ordinal);
+        Assert.DoesNotContain("Plus Jakarta Sans", adapter, StringComparison.Ordinal);
+        Assert.Contains("./Assets/Fonts/#Inter", app, StringComparison.Ordinal);
+        Assert.Contains("PreloadResources() => EnsureResources()", controls, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void ResponsiveNavigation_OwnsShellHeight_WithoutLateClobber()
+    {
+        var main = XDocument.Parse(Read("MainWindow.xaml"));
+        Assert.Equal("Maximized", (string?)main.Root?.Attribute("WindowState"));
+
+        var responsive = Read("MainWindow.NavigationLayoutFix.cs");
+        var p2 = Read("P2IndustrialWorkstationUx.cs");
+        var guard = Read("MainWindow.TopBarContainerHardening.cs");
+
+        Assert.Contains("shell.Height = 60;", responsive, StringComparison.Ordinal);
+        Assert.DoesNotContain("navShell.Height = 52;", p2, StringComparison.Ordinal);
+        Assert.DoesNotContain("shell.Height = 64d;", guard, StringComparison.Ordinal);
+        Assert.DoesNotContain("shell.Padding = new Thickness(5, 7, 5, 7);", guard,
+            StringComparison.Ordinal);
+        Assert.Contains("header.MinHeight = 68d;", guard, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public void IpDialog_UsesSingleInputSurfaceAndLowNoiseAdvancedDisclosure()
+    {
+        var source = Read("IpConnectWizardWindow.xaml");
+        var doc = XDocument.Parse(source);
+        XNamespace presentation = "http://schemas.microsoft.com/winfx/2006/xaml/presentation";
+        XNamespace xaml = "http://schemas.microsoft.com/winfx/2006/xaml";
+        Assert.InRange(int.Parse(doc.Root!.Attribute("Width")!.Value), 460, 490);
+
+        var host = doc.Descendants(presentation + "Border")
+            .Single(node => node.Attribute(xaml + "Name")?.Value == "IpEditorHost");
+        Assert.Equal("43", (string?)host.Attribute("Height"));
+        Assert.Equal("265", (string?)host.Attribute("Width"));
+        Assert.Equal("Manual", (string?)doc.Root.Attribute("SizeToContent"));
+        Assert.Equal("350", (string?)doc.Root.Attribute("Height"));
+        Assert.DoesNotContain("ManualAddressCheck", source, StringComparison.Ordinal);
+
+        var editor = doc.Descendants(presentation + "StackPanel")
+            .Single(node => node.Attribute(xaml + "Name")?.Value == "OctetEditor");
+        Assert.Equal("Center", (string?)editor.Attribute("HorizontalAlignment"));
+
+        var popup = doc.Descendants(presentation + "Popup")
+            .Single(node => node.Attribute(xaml + "Name")?.Value == "HistoryPopup");
+        Assert.Contains("ActualWidth", popup.Descendants(presentation + "Border")
+            .First().Attribute("Width")!.Value, StringComparison.Ordinal);
+
+        var disclosure = doc.Descendants(presentation + "Style")
+            .Single(node => node.Attribute(xaml + "Key")?.Value == "SmartIpOptionsExpander");
+        Assert.Contains("ToggleButton", disclosure.ToString(), StringComparison.Ordinal);
+        Assert.Contains("IsExpanded", disclosure.ToString(), StringComparison.Ordinal);
+        Assert.DoesNotContain("Smart discovery", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("TaskDialogCardStyle", source, StringComparison.Ordinal);
+        Assert.DoesNotContain("IPv6", source, StringComparison.Ordinal);
+        Assert.Contains("Content=\"Connect\"", source, StringComparison.Ordinal);
+
+        var behavior = Read("IpConnectWizardWindow.xaml.cs");
+        Assert.Contains("if (selection.MmsPort != 102)", behavior, StringComparison.Ordinal);
+        Assert.Contains("if (selectedPort != 102)", behavior, StringComparison.Ordinal);
+    }
+
+    private static string Read(string relative)
+    {
+        DirectoryInfo? directory = new(AppContext.BaseDirectory);
+        while (directory is not null)
+        {
+            var candidate = Path.Combine(directory.FullName, relative);
+            if (File.Exists(candidate))
+                return File.ReadAllText(candidate);
+            directory = directory.Parent;
+        }
+        throw new FileNotFoundException(relative);
+    }
+}
diff --git a/tests/ARSAS.Tests/StaticDataSetRcbImageTriageTests.cs b/tests/ARSAS.Tests/StaticDataSetRcbImageTriageTests.cs
new file mode 100644
index 000000000..b79c21936
--- /dev/null
+++ b/tests/ARSAS.Tests/StaticDataSetRcbImageTriageTests.cs
@@ -0,0 +1,103 @@
+using ArIED61850Tester.Models;
+using ArIED61850Tester.Services;
+
+namespace ARSAS.Tests;
+
+public sealed class StaticDataSetRcbImageTriageTests
+{
+    private static Iec61850MonitorPoint Point(
+        string suffix, string dataSet, string rcb, string value = "-") => new()
+    {
+        DeviceId = "sg7", IecReference = "SG7_BCUMeter/MMXU1." + suffix,
+        FunctionalConstraint = "MX", Value = value,
+        DataSetReference = dataSet, ReportControlReference = rcb,
+        Quality = "Unknown"
+    };
+
+    [Fact]
+    public void OneActiveRcbNeverClaimsFramesGiOrImageForAnotherRcb()
+    {
+        const string datasetA = "SG7_BCUMaster/LLN0.TT6DataSet1";
+        const string datasetI = "SG7_BCUMaster/LLN0.TT6DataSet4";
+        const string rcbA = "SG7_BCUMaster/LLN0.BR.BrcbA01";
+        const string rcbI = "SG7_BCUMaster/LLN0.BR.BrcbI01";
+        var points = new[]
+        {
+            Point("A.phsA.cVal.mag.f", datasetA, rcbA, "120.0"),
+            Point("A.phsB.cVal.mag.f", datasetI, rcbI),
+            Point("A.phsC.cVal.mag.f", datasetI, rcbI),
+        };
+        var traffic = new Iec61850ReportContinuitySnapshot
+        {
+            Streams = new[]
+            {
+                new Iec61850ReportContinuityStreamSnapshot
+                {
+                    Rcb = rcbA, DataSet = datasetA, Frames = 4,
+                    LastFrameReceivedAtUtc = new DateTimeOffset(
+                        2026, 10, 23, 13, 0, 0, TimeSpan.Zero),
+                    RptEnaWriteAccepted = true, GiWriteAccepted = true,
+                    Overflow = 1
+                }
+            }
+        };
+        var rows = StaticDataSetRcbImageTriage.Evaluate(points, traffic);
+        Assert.Equal(2, rows.Count);
+        var a = Assert.Single(rows, row => row.Rcb == rcbA);
+        var i = Assert.Single(rows, row => row.Rcb == rcbI);
+        Assert.Equal(4, a.Frames);
+        Assert.Equal(1, a.Visible);
+        Assert.True(a.GiWriteAccepted);
+        Assert.Equal(1, a.Overflow);
+        Assert.Equal(0, i.Frames);
+        Assert.Null(i.GiWriteAccepted);
+        Assert.Null(i.RptEnaWriteAccepted);
+        Assert.Equal(2, i.Pending);
+        Assert.False(i.HasActualReportFrames);
+        Assert.Contains("pending=2", i.Summary);
+        Assert.Contains("GiWrite=unverified", i.Summary);
+    }
+
+    [Fact]
+    public void WrongDataSetOrAmbiguousReportStreamsCannotSupplyProof()
+    {
+        const string rcb = "SG7_BCUMaster/LLN0.BR.BrcbI01";
+        const string dataSet = "SG7_BCUMaster/LLN0.TT6DataSet4";
+        var points = new[] { Point("A.phsA.cVal.mag.f", dataSet, rcb) };
+        var wrong = new Iec61850ReportContinuitySnapshot
+        {
+            Streams = new[]
+            {
+                new Iec61850ReportContinuityStreamSnapshot
+                {
+                    Rcb = rcb, DataSet = "OtherDataSet",
+                    Frames = 8, GiWriteAccepted = true
+                }
+            }
+        };
+        Assert.Equal(0, Assert.Single(StaticDataSetRcbImageTriage.Evaluate(
+            points, wrong)).Frames);
+        var ambiguous = new Iec61850ReportContinuitySnapshot
+        {
+            Streams = new[]
+            {
+                new Iec61850ReportContinuityStreamSnapshot
+                {
+                    Rcb = rcb, DataSet = dataSet, Frames = 1,
+                    LastFrameReceivedAtUtc = new DateTimeOffset(
+                        2026, 10, 23, 13, 1, 0, TimeSpan.Zero)
+                },
+                new Iec61850ReportContinuityStreamSnapshot
+                {
+                    Rcb = rcb, DataSet = dataSet, Frames = 2,
+                    LastFrameReceivedAtUtc = new DateTimeOffset(
+                        2026, 10, 23, 13, 2, 0, TimeSpan.Zero)
+                }
+            }
+        };
+        Assert.Equal(0, Assert.Single(StaticDataSetRcbImageTriage.Evaluate(
+            points, ambiguous)).Frames);
+        Assert.Throws<ArgumentOutOfRangeException>(() =>
+            StaticDataSetRcbImageTriage.Evaluate(points, null, maxGroups: 1000));
+    }
+}
diff --git a/tests/ARSAS.Tests/StaticDataSetReportOnlyModeRegressionTests.cs b/tests/ARSAS.Tests/StaticDataSetReportOnlyModeRegressionTests.cs
index dc1870cdc..38b4a4205 100644
--- a/tests/ARSAS.Tests/StaticDataSetReportOnlyModeRegressionTests.cs
+++ b/tests/ARSAS.Tests/StaticDataSetReportOnlyModeRegressionTests.cs
@@ -184,6 +184,10 @@ public void SharedStaticFat_EmitsCausalReportEvidenceWithoutMmsFallback()
         var source = File.ReadAllText(FindRepoFile("MainWindow.IoTesting.AutoConnect.cs"));
 
         Assert.Contains("ObserveSharedStaticReportEvidenceAsync", source, StringComparison.Ordinal);
+        Assert.Contains("proofWindow - (DateTime.UtcNow - startedUtc)", source, StringComparison.Ordinal);
+        Assert.Contains("Task.Delay(remaining, _applicationCancellation.Token)", source, StringComparison.Ordinal);
+        Assert.Contains("device.LiveValues.Association != association", source, StringComparison.Ordinal);
+        Assert.Contains("LogStaticRcbImageTriage(device);", source, StringComparison.Ordinal);
         Assert.Contains("waiting for actual InformationReport traffic", source, StringComparison.Ordinal);
         Assert.Contains("actual InformationReport traffic observed", source, StringComparison.Ordinal);
         Assert.Contains("no InformationReport traffic was observed", source, StringComparison.Ordinal);
diff --git a/tests/ARSAS.Tests/StaticDataSetReportProjectionAccumulatorTests.cs b/tests/ARSAS.Tests/StaticDataSetReportProjectionAccumulatorTests.cs
index 474b5c545..d1519ee72 100644
--- a/tests/ARSAS.Tests/StaticDataSetReportProjectionAccumulatorTests.cs
+++ b/tests/ARSAS.Tests/StaticDataSetReportProjectionAccumulatorTests.cs
@@ -148,6 +148,79 @@ public void ExactSelectedChild_IsPreservedAlongsideCompletedParentAggregate()
         Assert.Contains(updates, update => update.Reference.Equals(parent, StringComparison.OrdinalIgnoreCase));
     }
 
+    [Fact]
+    public void StaticReportHotPath_ReusesMembershipSnapshotInsteadOfAllocatingPerFrame()
+    {
+        // Test source contracts must be portable across git LF and Windows CRLF.
+        var source = File.ReadAllText(FindRepoFile("Services/Iec61850MonitorRuntime.cs"))
+            .Replace("\r\n", "\n", StringComparison.Ordinal);
+        Assert.Contains("session.StaticProjectionPoints = staticDataSetReportOnly", source);
+        Assert.Contains("session.StaticReportProjection.Prepare(", source);
+        Assert.Contains("session.StaticReportProjection.ClearPrepared();", source);
+        Assert.Contains("session.StaticProjectionPoints,\n                        sourceUpdate)", source);
+        Assert.Contains("session.StaticProjectionPoints = [];", source);
+        Assert.DoesNotContain("session.Points.Values.ToArray(),\n                        sourceUpdate)", source);
+    }
+
+    [Fact]
+    public void PreparedStaticReportIndex_UsesExactMembershipAndResetsLeafEvidence()
+    {
+        const string parent = "IEDLD0/I_MHAI1.ThdA";
+        var model = Model(DataObject(parent, "ThdA",
+            Attribute(parent + ".phsA.cVal.mag.f", "phsA.cVal.mag.f"),
+            Attribute(parent + ".phsB.cVal.mag.f", "phsB.cVal.mag.f"),
+            Attribute(parent + ".phsC.cVal.mag.f", "phsC.cVal.mag.f")));
+        var points = new[] { Point(parent) };
+        var projection = new StaticDataSetReportProjectionAccumulator();
+        projection.Prepare(model, points);
+
+        Assert.Empty(projection.Project(model, points,
+            Update(parent + ".phsA.instCVal.mag.f", "999")));
+        Assert.Empty(projection.Project(model, points,
+            Update(parent + ".phsA.cVal.mag.f", "1")));
+        Assert.Empty(projection.Project(model, points,
+            Update(parent + ".phsB.cVal.mag.f", "2")));
+        var aggregate = Assert.Single(projection.Project(model, points,
+            Update(parent + ".phsC.cVal.mag.f", "3")));
+        Assert.Equal("A=1, B=2, C=3", aggregate.Value);
+        Assert.Equal(parent, aggregate.Reference);
+
+        // A new MMS association cannot inherit previous partial GI leaves.
+        projection.Reset();
+        Assert.Empty(projection.Project(model, points,
+            Update(parent + ".phsC.cVal.mag.f", "4")));
+        projection.ClearPrepared();
+        projection.Reset();
+        Assert.Empty(projection.Project(model, points,
+            Update(parent + ".phsA.cVal.mag.f", "5")));
+        Assert.Empty(projection.Project(model, points,
+            Update(parent + ".phsB.cVal.mag.f", "6")));
+        var nonIndexed = Assert.Single(projection.Project(model, points,
+            Update(parent + ".phsC.cVal.mag.f", "7")));
+        Assert.Equal("A=5, B=6, C=7", nonIndexed.Value);
+    }
+
+    [Fact]
+    public void PreparedStaticReportIndex_DuplicateParentAndOverdeepLeafFailClosed()
+    {
+        const string parent = "IEDLD0/I_MHAI1.ThdA";
+        const string leaf = parent + ".phsA.cVal.mag.f";
+        var model = Model(DataObject(parent, "ThdA",
+            Attribute(leaf, "phsA.cVal.mag.f")));
+        // A malformed selection containing two claims for one aggregate
+        // must not turn a descendant into an unverified independent value.
+        var duplicated = new[] { Point(parent), Point(parent) };
+        var index = new StaticDataSetReportProjectionAccumulator();
+        index.Prepare(model, duplicated);
+        Assert.Empty(index.Project(model, duplicated, Update(leaf, "42")));
+
+        var normal = new[] { Point(parent) };
+        index.Reset();
+        index.Prepare(model, normal);
+        var suspicious = parent + string.Concat(Enumerable.Repeat(".x", 35));
+        Assert.Empty(index.Project(model, normal, Update(suspicious, "777")));
+    }
+
     [Fact]
     public void RuntimeSource_StaticMode_UsesSchemaSafeReportAuthority_AndNoMmsFallback()
     {
@@ -161,13 +234,17 @@ public void RuntimeSource_StaticMode_UsesSchemaSafeReportAuthority_AndNoMmsFallb
     }
 
     [Fact]
-    public void IpWizard_DoesNotRunEditableAddressBindingOnEveryKeystroke()
+    public void IpWizard_DoesNotWritePreferencesOrBindWholeAddressOnEveryOctetKeystroke()
     {
         var xaml = File.ReadAllText(FindRepoFile("IpConnectWizardWindow.xaml"));
-
-        Assert.Contains("IsTextSearchEnabled=\"False\"", xaml, StringComparison.Ordinal);
-        Assert.Contains("RelayIpAddress, RelativeSource={RelativeSource AncestorType=Window}, UpdateSourceTrigger=LostFocus", xaml, StringComparison.Ordinal);
-        Assert.DoesNotContain("RelayIpAddress, RelativeSource={RelativeSource AncestorType=Window}, UpdateSourceTrigger=PropertyChanged", xaml, StringComparison.Ordinal);
+        var code = File.ReadAllText(FindRepoFile("IpConnectWizardWindow.xaml.cs"));
+        Assert.Contains("x:Name=\"Octet1Box\"", xaml);
+        Assert.Contains("x:Name=\"Octet4Box\"", xaml);
+        Assert.Contains("UpdateSourceTrigger=LostFocus", xaml);
+        Assert.DoesNotContain("RelayIpAddress, RelativeSource={RelativeSource AncestorType=Window}, UpdateSourceTrigger=PropertyChanged", xaml);
+        Assert.Contains("DataObject.AddPastingHandler", code);
+        Assert.Contains("if (_rememberDiscoveryEndpoint)", code);
+        Assert.DoesNotContain("RecordLastDiscoveryEndpoint", code[..code.IndexOf("private void Connect_Click", StringComparison.Ordinal)]);
     }
 
     private static NativeReportValueUpdate Update(string reference, string value)
diff --git a/tests/ARSAS.Tests/StructuralControlSemanticsTrialTests.cs b/tests/ARSAS.Tests/StructuralControlSemanticsTrialTests.cs
new file mode 100644
index 000000000..7c2d41db6
--- /dev/null
+++ b/tests/ARSAS.Tests/StructuralControlSemanticsTrialTests.cs
@@ -0,0 +1,79 @@
+using AR.Iec61850.Control;
+using AR.Iec61850.Mms;
+using ArIED61850Tester.Services;
+
+namespace ARSAS.Tests;
+
+/// <summary>
+/// Edition-independent typed control proof. The LN name is never permission:
+/// operative ctlModel, typed CO Oper, exact ST double-point and enhanced SBO
+/// prerequisites jointly determine eligibility. No MMS command is emitted.
+/// </summary>
+public sealed class StructuralControlSemanticsTrialTests
+{
+    private static Iec61850ControlObjectDescriptor Candidate(
+        string reference, bool typedTwoBitStatus = true,
+        string? status = null,
+        bool withSbo = true,
+        Iec61850ControlModel model = Iec61850ControlModel.SelectBeforeOperateEnhanced)
+        => new()
+        {
+            ObjectReference = reference,
+            Cdc = typedTwoBitStatus ? "DPC" : "SPC",
+            ControlModel = model,
+            CtlValSpecification = new MmsTypeSpecificationNode
+                { Name = "ctlVal", MmsType = "boolean" },
+            OperSpecification = new MmsTypeSpecificationNode
+                { MmsType = "structure" },
+            StatusReference = status ?? reference + ".stVal",
+            StatusFunctionalConstraint = "ST",
+            LiveStatusIsDoublePoint = typedTwoBitStatus,
+            SelectWithValueSpecification = withSbo
+                ? new MmsTypeSpecificationNode { MmsType = "structure" } : null,
+            CancelSpecification = withSbo
+                ? new MmsTypeSpecificationNode { MmsType = "structure" } : null,
+            SupportsCommandTermination = true
+        };
+
+    [Theory]
+    [InlineData("SG7_BCUSystem/Bkr0XCBR1.Pos")]
+    [InlineData("SG7_BCUSystem/BkrCSWI1.Pos")]
+    [InlineData("SG7_BCUSystem/Disc0XSWI1.Pos")]
+    [InlineData("IED/ArbitraryNode99.SwitchPoint")]
+    public void TypedControl_IsAuthorizedByLiveStructureNotLnName(string reference)
+    {
+        var descriptor = Candidate(reference);
+        var resolution = Iec61850ControlSemanticResolver.Resolve(descriptor, "DPC");
+        Assert.True(resolution.IsCommandSafe, resolution.Reason);
+        Assert.Equal("DPC", resolution.Cdc);
+        Assert.True(NativeIec61850Client.HasExactDpcBooleanFeedback(
+            descriptor, resolution.Cdc));
+    }
+
+    [Fact]
+    public void ControllableNameWithoutTwoBitStatusCannotAuthorizeDpc()
+    {
+        const string reference = "SG7_BCUSystem/BkrCSWI1.Pos";
+        var descriptor = Candidate(reference, typedTwoBitStatus: false);
+        Assert.False(Iec61850ControlSemanticResolver.Resolve(descriptor, "DPC").IsCommandSafe);
+    }
+
+    [Fact]
+    public void EnhancedSboMissingLiveSelectOrCancelNeverOperable()
+    {
+        var descriptor = Candidate("SG7_BCUSystem/Bkr0XCBR1.Pos", withSbo: false);
+        Assert.False(Iec61850ControlSemanticResolver.Resolve(descriptor, "DPC").IsCommandSafe);
+    }
+
+    [Fact]
+    public void CrossObjectStatusAndStatusOnlyRemainBlocked()
+    {
+        var reference = "SG7_BCUSystem/Bkr0XCBR1.Pos";
+        var cross = Candidate(reference,
+            status: "SG7_BCUSystem/Bkr0XCBR2.Pos.stVal");
+        Assert.False(Iec61850ControlSemanticResolver.Resolve(cross, "DPC").IsCommandSafe);
+        Assert.False(NativeIec61850Client.HasExactDpcBooleanFeedback(cross, "DPC"));
+        var readOnly = Candidate(reference, model: Iec61850ControlModel.StatusOnly);
+        Assert.False(Iec61850ControlSemanticResolver.Resolve(readOnly, "DPC").IsCommandSafe);
+    }
+}
diff --git a/tests/ARSAS.Tests/TypedWriteEditorUxRegressionTests.cs b/tests/ARSAS.Tests/TypedWriteEditorUxRegressionTests.cs
new file mode 100644
index 000000000..d86ea1031
--- /dev/null
+++ b/tests/ARSAS.Tests/TypedWriteEditorUxRegressionTests.cs
@@ -0,0 +1,143 @@
+using System.Xml.Linq;
+
+namespace ARSAS.Tests;
+
+public sealed class TypedWriteEditorUxRegressionTests
+{
+    [Fact]
+    public void ToolbarWrite_IsStableAndHasRequestedMaterialPencilVector()
+    {
+        var xaml = Source("MainWindow.xaml");
+        Assert.Contains("x:Name=\"IedBrowserWriteButton\"", xaml);
+        Assert.Contains("Text=\"Write\"", xaml);
+        Assert.Contains("M167,840", xaml);
+        var route = Source("MainWindow.IedBrowser.TypedDataWrite.cs");
+        Assert.DoesNotContain("IedBrowserWriteButton.Content =", route);
+        Assert.DoesNotContain("Write ctlModel…\" :", route);
+    }
+
+    [Theory]
+    [InlineData("BrowserDataWriteWindow.xaml")]
+    [InlineData("BrowserBatchWriteWindow.xaml")]
+    public void MaterialPencilInWriteFooter_RetainsFixedLabelAndWidth(string file)
+    {
+        var doc = XDocument.Parse(Source(file));
+        XNamespace presentation = "http://schemas.microsoft.com/winfx/2006/xaml/presentation";
+        XNamespace x = "http://schemas.microsoft.com/winfx/2006/xaml";
+        var button = Assert.Single(doc.Descendants(presentation + "Button").Where(
+            element => (string?)element.Attribute(x + "Name") == "WriteButton"));
+        Assert.Equal("Write", (string?)button.Attribute("Content"));
+        Assert.Equal("94", (string?)button.Attribute("Width"));
+        Assert.Equal("{StaticResource MaterialEditIcon}",
+            (string?)Assert.Single(button.Descendants(presentation + "Path")).Attribute("Data"));
+        Assert.Contains(button.Descendants(presentation + "TextBlock"),
+            child => (string?)child.Attribute("Text") == "{Binding}");
+        var footer = Assert.Single(doc.Descendants(presentation + "Grid").Where(grid =>
+            grid.Descendants(presentation + "Button").Contains(button) &&
+            (string?)grid.Attribute("Grid.Row") is "2" or "3"));
+        Assert.NotNull(footer);
+    }
+
+    [Fact]
+    public void SingleDaEditor_HasInlineTypedDropdownAndNoEmptyBooleanInput()
+    {
+        var xaml = Source("BrowserDataWriteWindow.xaml");
+        XDocument.Parse(xaml);
+        Assert.Contains("x:Name=\"BoolPicker\"", xaml);
+        Assert.Contains("Content=\"true\"", xaml);
+        Assert.Contains("Content=\"false\"", xaml);
+        Assert.Contains("x:Name=\"NewValueBox\"", xaml);
+        Assert.Contains("Text=\"Name\"", xaml);
+        Assert.Contains("Text=\"Value\"", xaml);
+        Assert.Contains("Content=\"Write\"", xaml);
+        Assert.DoesNotContain("Wire preview", xaml);
+        var code = Source("BrowserDataWriteWindow.xaml.cs");
+        Assert.Contains("NewValueBox.Text = p.CurrentText", code);
+        Assert.Contains("BoolPicker.SelectedIndex", code);
+        Assert.Contains("SelectedInput()", code);
+        Assert.Contains("IedBrowserTypedWriteAdmission.RejectReason", code);
+        Assert.Contains("WriteBrowserDataAttributesAsync", code);
+    }
+
+    [Fact]
+    public void BatchEditor_BooleanPickerIsLiveGvaDriven_AndWriteHasNoAutomaticRetry()
+    {
+        var xaml = Source("BrowserBatchWriteWindow.xaml");
+        XDocument.Parse(xaml);
+        Assert.Contains("BooleanEditorVisibility", xaml);
+        Assert.Contains("IsEnabled=\"{Binding CanEdit}\"", xaml);
+        Assert.Contains("TextEditorVisibility", xaml);
+        Assert.Contains("DisplayName", xaml);
+        Assert.Contains("Content=\"Write\"", xaml);
+        Assert.DoesNotContain("Write selected…", xaml);
+        var code = Source("BrowserBatchWriteWindow.xaml.cs");
+        Assert.Contains("ApplyLiveEditor(preview.Type?.MmsType == \"boolean\"", code);
+        Assert.Contains("if (!HasEdited", code);
+        Assert.Contains("IedBrowserTypedWriteBatch.Freeze", code);
+        Assert.Contains("WriteBrowserDataAttributesAsync", code);
+    }
+
+    [Fact]
+    public void BrowserWrite_ProvidesSingleAndMultiLeafWithoutSecondModalConfirmation()
+    {
+        var main = Source("MainWindow.xaml");
+        XDocument.Parse(main);
+        Assert.Contains("x:Name=\"IedBrowserWriteDoButton\"", main);
+        Assert.Contains("Click=\"IedBrowserWriteDo_Click\"", main);
+        var route = Source("MainWindow.IedBrowser.TypedDataWrite.cs");
+        Assert.Contains("BrowserWritableSelectedDo(allowLeafSelection: true)", route);
+        Assert.Contains("dialog.VerifiedWriteOccurred", route);
+        Assert.Contains("new BrowserBatchWriteWindow(", route);
+        foreach (var file in new[]
+        {
+            "ControlModelWriteWindow.xaml.cs",
+            "BrowserDataWriteWindow.xaml.cs",
+            "BrowserBatchWriteWindow.xaml.cs"
+        })
+        {
+            var code = Source(file);
+            Assert.DoesNotContain("MessageBox.Show(", code);
+            Assert.Contains("Write_Click(", code);
+        }
+        Assert.Contains("await ReadModelAsync();", Source("ControlModelWriteWindow.xaml.cs"));
+        Assert.Contains("PreviewBrowserDataAttributeWriteAsync(", Source("BrowserDataWriteWindow.xaml.cs"));
+        var batch = Source("BrowserBatchWriteWindow.xaml.cs");
+        Assert.Contains("await PrimeLiveEditorsAsync();", batch);
+        Assert.Contains("AttemptedLeaves = steps.Select(", batch);
+        Assert.Contains("if (AttemptedLeaves.Count > 0 && IsLoaded) Close();", batch);
+        Assert.DoesNotContain("row.ResetToReadback(actual.CurrentText);", batch);
+        Assert.Contains("baseline.GvaSignature, preview.GvaSignature", batch);
+        Assert.Contains("MmsDataCodec.Encode(baseline.OldValue)", batch);
+        Assert.Contains("WriteBrowserDataAttributesAsync(", batch);
+        Assert.Contains("TryFreezePlan(selected,", batch);
+        Assert.Contains("No automatic retry", batch, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void EmbeddedInter_AlsoUsedForReferenceAndCodeTypography()
+    {
+        var xaml = Source("App.xaml");
+        Assert.Contains("<FontFamily x:Key=\"AppFontFamily\">./Assets/Fonts/#Inter</FontFamily>", xaml);
+        Assert.Contains("<FontFamily x:Key=\"AppCodeFontFamily\">./Assets/Fonts/#Inter</FontFamily>", xaml);
+        Assert.DoesNotContain("Cascadia Mono, Consolas</FontFamily>", xaml);
+        foreach (var file in new[]
+        {
+            "ControlModelWriteWindow.xaml",
+            "BrowserDataWriteWindow.xaml",
+            "BrowserBatchWriteWindow.xaml"
+        })
+            XDocument.Parse(Source(file));
+    }
+
+    private static string Source(string filename)
+    {
+        var dir = new DirectoryInfo(AppContext.BaseDirectory);
+        while (dir != null)
+        {
+            var p = Path.Combine(dir.FullName, filename);
+            if (File.Exists(p)) return File.ReadAllText(p);
+            dir = dir.Parent;
+        }
+        throw new FileNotFoundException(filename);
+    }
+}
diff --git a/tests/ARSAS.Tests/UnifiedSsotV2Phase1Tests.cs b/tests/ARSAS.Tests/UnifiedSsotV2Phase1Tests.cs
new file mode 100644
index 000000000..ca4ce7f0b
--- /dev/null
+++ b/tests/ARSAS.Tests/UnifiedSsotV2Phase1Tests.cs
@@ -0,0 +1,135 @@
+using AR.Iec61850.Discovery;
+using ArIED61850Tester.Models;
+
+namespace ARSAS.Tests;
+
+/// <summary>
+/// Foundation contracts for multiple workspaces observing one canonical value
+/// owner and one immutable engineering schema. No physical IED is required.
+/// </summary>
+public sealed class UnifiedSsotV2Phase1Tests
+{
+    [Fact]
+    public async Task ModelSchema_IsOneFlightAcrossBrowserAndReadBindings()
+    {
+        var one = new LiveIedModelDiscoveryDocument();
+        var another = new LiveIedModelDiscoveryDocument();
+        var builds = Enumerable.Range(0, 48)
+            .Select(_ => SharedIedSchemaIndex.PrepareAsync(one))
+            .ToArray();
+
+        Assert.All(builds, build => Assert.Same(builds[0], build));
+        var index = await builds[0];
+        Assert.Same(one, index.SourceModel);
+        Assert.True(SharedIedSchemaIndex.TryGetPrepared(one, out var prepared));
+        Assert.Same(index, prepared);
+        Assert.Same(index, SharedIedSchemaIndex.GetForBinding(one));
+        Assert.NotSame(index, await SharedIedSchemaIndex.PrepareAsync(another));
+        SharedIedSchemaIndex.ForgetFaulted(one);
+        Assert.Same(index, await SharedIedSchemaIndex.PrepareAsync(one));
+    }
+
+    [Fact]
+    public void CanonicalDirtyKeys_AreIndependentForTwoWorkspaceCursors()
+    {
+        var store = new IedBrowserLiveValues();
+        var association = store.BeginAssociation();
+        var initial = store.ReadChanges(0);
+        Assert.True(initial.RequiresFullRefresh);
+        Assert.Contains(initial.Changes, c =>
+            c.Kind == CanonicalValueChangeKind.AssociationInvalidated);
+        var cursor = store.Version;
+
+        const string point = "SG7LD/MMXU1.A.phsA.cVal.mag.f";
+        Assert.True(store.PublishForAssociation(association,
+            point, "mx", "123.4", "Good", "12:01", "Report"));
+        Assert.True(store.PublishForAssociation(association,
+            "SG7LD/XCBR1.Pos.stVal", "ST", "true", "Good", "12:01", "Report"));
+        Assert.True(store.PublishForAssociation(association,
+            "SG7LD/LLN0.Mod.stVal", "ST", "1", "", "", "MMS Read"));
+
+        // No drain: the same publication is independently readable by Browser
+        // and Live Monitor without copying a second authoritative value store.
+        var browser = store.ReadChanges(cursor, 2);
+        var explorer = store.ReadChanges(cursor, 2);
+        Assert.False(browser.RequiresFullRefresh);
+        Assert.Equal(browser.ThroughRevision, explorer.ThroughRevision);
+        Assert.Equal(browser.LatestRevision, explorer.LatestRevision);
+        Assert.Equal(browser.Changes.ToArray(), explorer.Changes.ToArray());
+        Assert.Equal(2, browser.Changes.Count);
+        Assert.Equal(cursor + 2, browser.ThroughRevision);
+        Assert.Equal(store.Version, browser.LatestRevision);
+        Assert.Equal(point, browser.Changes[0].Reference);
+        Assert.Equal("MX", browser.Changes[0].FunctionalConstraint);
+        Assert.Equal(CanonicalValueChangeKind.Report, browser.Changes[0].Kind);
+
+        var continuation = store.ReadChanges(browser.ThroughRevision, 2);
+        Assert.Single(continuation.Changes);
+        Assert.Equal(CanonicalValueChangeKind.Read, continuation.Changes[0].Kind);
+        Assert.True(store.TryGet(point, "MX", out var evidence));
+        Assert.Equal("123.4", evidence.Value);
+        Assert.Equal(association, evidence.Association);
+    }
+
+    [Fact]
+    public void ChangeJournal_RejectsStaleAssociationAndSignalsReset()
+    {
+        var store = new IedBrowserLiveValues();
+        var first = store.BeginAssociation();
+        var cursor = store.Version;
+        Assert.True(store.PublishForAssociation(first, "LD/XCBR1.Pos.stVal",
+            "ST", "true", "", "", "Report"));
+        store.MarkOffline();
+        var delta = store.ReadChanges(cursor);
+        Assert.True(delta.RequiresFullRefresh);
+        Assert.Equal(CanonicalValueChangeKind.AssociationInvalidated,
+            delta.Changes[^1].Kind);
+        Assert.False(store.PublishForAssociation(first, "LD/XCBR1.Pos.stVal",
+            "ST", "false", "", "", "Report"));
+        var next = store.BeginAssociation();
+        Assert.True(next > first);
+        Assert.False(store.TryGet("LD/XCBR1.Pos.stVal", "ST", out _));
+        Assert.True(store.ReadChanges(cursor).RequiresFullRefresh);
+    }
+
+    [Fact]
+    public void BoundedJournal_DetectsMissedRevisionsRatherThanHidingChanges()
+    {
+        var store = new IedBrowserLiveValues();
+        var association = store.BeginAssociation();
+        var veryOldCursor = store.Version;
+        for (var i = 0; i < 4300; i++)
+            Assert.True(store.PublishForAssociation(association,
+                "LD/MMXU1.A.phsA.cVal.mag.f", "MX", i.ToString(), "", "", "Report"));
+        var result = store.ReadChanges(veryOldCursor, 32);
+        Assert.True(result.RequiresFullRefresh);
+        Assert.Empty(result.Changes);
+        Assert.Equal(store.Version, result.ThroughRevision);
+        Assert.Empty(store.ReadChanges(store.Version).Changes);
+    }
+
+    [Fact]
+    public void ReadAndBrowser_UseSharedSchemaFactoryAndCanonicalMutationJournal()
+    {
+        var binding = Read("Models/IedBrowserReadBindingIndex.cs");
+        var browser = Read("MainWindow.IedBrowser.Performance.cs");
+        var ledger = Read("Models/IedBrowserLiveValues.cs");
+        Assert.Contains("SharedIedSchemaIndex.GetForBinding(model)", binding);
+        Assert.Contains("SharedIedSchemaIndex.PrepareAsync(model)", browser);
+        Assert.DoesNotContain("new IedBrowserSchemaIndex(model)", binding);
+        Assert.Contains("RecordChange(reference, fc, isReport", ledger);
+        Assert.Contains("CanonicalValueChangeKind.ReportCompanion", ledger);
+        Assert.Contains("CanonicalValueChangeKind.AssociationInvalidated", ledger);
+    }
+
+    private static string Read(string filename)
+    {
+        for (DirectoryInfo? dir = new(AppContext.BaseDirectory);
+             dir is not null; dir = dir.Parent)
+        {
+            var path = Path.Combine(dir.FullName, filename);
+            if (File.Exists(path)) return File.ReadAllText(path);
+        }
+        throw new FileNotFoundException(filename);
+    }
+}
diff --git a/tests/ARSAS.Tests/UnifiedSsotV2ReactiveViewportTests.cs b/tests/ARSAS.Tests/UnifiedSsotV2ReactiveViewportTests.cs
new file mode 100644
index 000000000..2398baddb
--- /dev/null
+++ b/tests/ARSAS.Tests/UnifiedSsotV2ReactiveViewportTests.cs
@@ -0,0 +1,162 @@
+using ArIED61850Tester.Models;
+
+namespace ARSAS.Tests;
+
+/// <summary>
+/// No network or WPF dispatcher required. Both consumer cursors see the same
+/// atomic canonical evidence, while unrelated page row objects are untouched.
+/// </summary>
+public sealed class UnifiedSsotV2ReactiveViewportTests
+{
+    private const string Current = "SG7LD/MMXU1.A.phsA.cVal.mag.f";
+    private const string SameDoQ = "SG7LD/MMXU1.A.phsA.q";
+    private const string OtherDo = "SG7LD/MMXU1.Hz.mag.f";
+    private const string OtherLn = "SG7LD/XCBR1.Pos.stVal";
+
+    private static IedBrowserDetailRow Row(string reference, string fc = "MX")
+        => new("Data", reference, "-") { ValueReference = reference, FunctionalConstraint = fc };
+
+    [Fact]
+    public void OnlyChangedDataObjectScopeUpdatesItsCurrentPageRows()
+    {
+        var a = Row(Current);
+        var q = Row(SameDoQ);
+        var hz = Row(OtherDo);
+        var status = Row(OtherLn, "ST");
+        var index = new CanonicalBrowserViewportIndex([a, q, hz, status]);
+
+        var store = new IedBrowserLiveValues();
+        var association = store.BeginAssociation();
+        var before = store.Version;
+        Assert.True(store.PublishForAssociation(association, Current, "MX",
+            "123.4", "Good", "12:30", "Report"));
+        var batch = store.ReadChanges(before);
+        Assert.True(index.TryFindDirtyRows(batch, store.Version, out var dirty));
+        Assert.Equal(2, dirty.Count);
+        Assert.Contains(a, dirty);
+        Assert.Contains(q, dirty); // typed q/t siblings within the same IEC DO
+        Assert.DoesNotContain(hz, dirty);
+        Assert.DoesNotContain(status, dirty);
+        Assert.True(store.TryGet(Current, "MX", out var canonical));
+        Assert.Equal("123.4", canonical.Value);
+    }
+
+    [Fact]
+    public void OffscreenReportChanges_DoNotTouchUnrelatedDetailRows()
+    {
+        var rendered = Row(Current);
+        var index = new CanonicalBrowserViewportIndex([rendered]);
+        var store = new IedBrowserLiveValues();
+        var association = store.BeginAssociation();
+        var before = store.Version;
+
+        Assert.True(store.PublishForAssociation(association, OtherLn, "ST",
+            "true", "Good", "", "Report"));
+        Assert.True(index.TryFindDirtyRows(store.ReadChanges(before), store.Version,
+            out var dirty));
+        Assert.Empty(dirty); // existing Browser loop skips all presentation setters
+        Assert.Equal("-", rendered.Value);
+        Assert.True(store.TryGet(OtherLn, "ST", out var canonical));
+        Assert.Equal("true", canonical.Value);
+    }
+
+    [Fact]
+    public void ExplicitVectorAndAggregateDependencies_RefreshSelectedRow()
+    {
+        var composite = new IedBrowserDetailRow("Data", "A vector")
+        {
+            ValueReference = "SG7LD/MMXU1.A",
+            PhasePlans = [new IedBrowserPolarPlan(Current,
+                "SG7LD/MMXU1.A.phsA.cVal.ang.f", "MX")],
+            ScalarComponents =
+            [
+                new IedBrowserScalarComponent("stVal",
+                    "SG7LD/XCBR1.Pos.stVal", "ST")
+            ]
+        };
+        var index = new CanonicalBrowserViewportIndex([composite]);
+        var store = new IedBrowserLiveValues();
+        var association = store.BeginAssociation();
+        var cursor = store.Version;
+
+        Assert.True(store.PublishForAssociation(association, OtherLn, "ST",
+            "1", "", "", "Report"));
+        Assert.True(index.TryFindDirtyRows(store.ReadChanges(cursor), store.Version,
+            out var dirty));
+        Assert.Single(dirty);
+        Assert.Contains(composite, dirty);
+    }
+
+    [Fact]
+    public void AssociationResetAndConfigurationMetadata_AlwaysForceFullProjection()
+    {
+        var row = Row(Current);
+        var index = new CanonicalBrowserViewportIndex([row]);
+        var store = new IedBrowserLiveValues();
+        var assoc = store.BeginAssociation();
+        var cursor = store.Version;
+
+        Assert.True(store.PublishForAssociation(assoc,
+            "SG7LD/MMXU1.A.phsA.units.SIUnit", "CF",
+            "A", "", "", "MMS Read"));
+        Assert.False(index.TryFindDirtyRows(store.ReadChanges(cursor),
+            store.Version, out _));
+        cursor = store.Version;
+
+        store.MarkOffline();
+        Assert.False(index.TryFindDirtyRows(store.ReadChanges(cursor),
+            store.Version, out _));
+        store.BeginAssociation();
+        Assert.False(index.TryFindDirtyRows(store.ReadChanges(cursor),
+            store.Version, out _));
+    }
+
+    [Fact]
+    public void MissingCursorPageOrJournalOverflow_FallsBackToOriginalProjection()
+    {
+        var row = Row(Current);
+        var index = new CanonicalBrowserViewportIndex([row]);
+        var store = new IedBrowserLiveValues();
+        var association = store.BeginAssociation();
+        var old = store.Version;
+        for (var i = 0; i < 4200; ++i)
+            Assert.True(store.PublishForAssociation(association, OtherDo,
+                "MX", i.ToString(), "", "", "Report"));
+        Assert.False(index.TryFindDirtyRows(store.ReadChanges(old),
+            store.Version, out _));
+        Assert.False(index.TryFindDirtyRows(store.ReadChanges(store.Version),
+            store.Version - 1, out _));
+        // Unbound opaque rows cannot be proven irrelevant.
+        var opaque = new CanonicalBrowserViewportIndex(
+            [new IedBrowserDetailRow("Data", "Vendor computed field")]);
+        Assert.False(opaque.TryFindDirtyRows(store.ReadChanges(store.Version),
+            store.Version, out _));
+    }
+
+    [Fact]
+    public void WpfIntegration_RemainsPageScopedAndNeverWritesCanonicalOrCommand()
+    {
+        var browser = Read("MainWindow.IedBrowser.cs");
+        var adapter = Read("MainWindow.IedBrowser.ReactiveSsot.cs");
+        Assert.Contains("SelectIedBrowserReactiveRows(device, version)", browser);
+        Assert.Contains("reactiveRows is not null && !reactiveRows.Contains(row)", browser);
+        Assert.Contains("RebuildIedBrowserViewportIndex()", browser);
+        Assert.Contains("device.LiveValues.ReadChanges(", adapter);
+        Assert.Contains("maxChanges: 4096", adapter);
+        Assert.Contains("_iedBrowserRenderedPage?.Kind is \"RCB\" or \"GoCB\" or \"SGCB\"", adapter);
+        Assert.DoesNotContain("PublishForAssociation(", adapter);
+        Assert.DoesNotContain("MmsWrite", adapter);
+        Assert.DoesNotContain("StartMonitoringAsync", adapter);
+    }
+
+    private static string Read(string path)
+    {
+        for (DirectoryInfo? dir = new(AppContext.BaseDirectory);
+             dir is not null; dir = dir.Parent)
+        {
+            var full = Path.Combine(dir.FullName, path);
+            if (File.Exists(full)) return File.ReadAllText(full);
+        }
+        throw new FileNotFoundException(path);
+    }
+}
diff --git a/tests/ARSAS.Tests/WindowsPackagingReproducibilityContractTests.cs b/tests/ARSAS.Tests/WindowsPackagingReproducibilityContractTests.cs
index 926ee98e9..1dd2dd504 100644
--- a/tests/ARSAS.Tests/WindowsPackagingReproducibilityContractTests.cs
+++ b/tests/ARSAS.Tests/WindowsPackagingReproducibilityContractTests.cs
@@ -50,7 +50,13 @@ public void CanonicalAndFieldCaptureArtifacts_BothCarryBuildIdentity()
         const string identity =
             "ArIED61850Tester\\dist\\ARSAS-*-win-x64-portable-build-identity.json";
 
-        Assert.Contains(identity, canonical, StringComparison.Ordinal);
+        // The one-click portable Actions artifact is now a SINGLE unzipped
+        // .exe. The immutable sealed package still contains the complete
+        // versioned identity and all original release/provenance evidence.
+        Assert.Contains("portable-build-identity.json", canonical, StringComparison.Ordinal);
+        Assert.Contains("name: ARSAS-windows-package-input", canonical, StringComparison.Ordinal);
+        Assert.Contains("--portable-identity", canonical, StringComparison.Ordinal);
+        Assert.Contains("archive: false", canonical, StringComparison.Ordinal);
         Assert.Contains(identity, capture, StringComparison.Ordinal);
         Assert.Contains(
             "--portable-identity",
diff --git a/tests/ARSAS.Tests/WpfStaIsolationCollection.cs b/tests/ARSAS.Tests/WpfStaIsolationCollection.cs
new file mode 100644
index 000000000..b48996f91
--- /dev/null
+++ b/tests/ARSAS.Tests/WpfStaIsolationCollection.cs
@@ -0,0 +1,11 @@
+namespace ARSAS.Tests;
+
+/// <summary>
+/// WPF uses process-wide font, theme, Dispatcher and PresentationFramework
+/// initialization. The real WPF/STA regression cases retain every assertion
+/// but execute exclusively; protocol/data regressions remain parallel.
+/// </summary>
+[CollectionDefinition("WpfStaIsolation", DisableParallelization = true)]
+public sealed class WpfStaIsolationCollection
+{
+}
diff --git a/tests/ARSAS.Tests/WpfStaIsolationContractTests.cs b/tests/ARSAS.Tests/WpfStaIsolationContractTests.cs
new file mode 100644
index 000000000..56df8f3c9
--- /dev/null
+++ b/tests/ARSAS.Tests/WpfStaIsolationContractTests.cs
@@ -0,0 +1,45 @@
+namespace ARSAS.Tests;
+
+public sealed class WpfStaIsolationContractTests
+{
+    [Fact]
+    public void AllHistoricallyTimingOutWpfSuitesUseOneExclusiveCollection()
+    {
+        var definition = (CollectionDefinitionAttribute)Assert.Single(
+            typeof(WpfStaIsolationCollection).GetCustomAttributes(
+                typeof(CollectionDefinitionAttribute), inherit: false));
+        Assert.Equal("WpfStaIsolation",
+            typeof(WpfStaIsolationCollection).GetCustomAttributesData()
+                .Single(attribute => attribute.AttributeType ==
+                    typeof(CollectionDefinitionAttribute))
+                .ConstructorArguments[0].Value?.ToString());
+        Assert.True(definition.DisableParallelization);
+
+        string[] suites =
+        [
+            "FieldRegressionFixTests",
+            "OperatorNavigationSingleGlyphM214Tests",
+            "M2QuickStartBrowseTests",
+            "IedTaskDialogVisualRegressionTests",
+            "NativeFatFieldEvidenceRegressionTests",
+            "PremiumSmartIpWizardTests",
+            "SsotV2LargeGridSearchSortBudgetTests",
+            "MultiGridNaturalSortRegressionTests",
+            "ProductionFatM2PermanentHostRegressionTests"
+        ];
+        foreach (var name in suites)
+        {
+            var type = typeof(WpfStaIsolationCollection).Assembly.GetType(
+                "ARSAS.Tests." + name);
+            Assert.NotNull(type);
+            var assigned = (CollectionAttribute)Assert.Single(
+                type.GetCustomAttributes(typeof(CollectionAttribute),
+                    inherit: false));
+            Assert.Equal("WpfStaIsolation",
+                type.GetCustomAttributesData()
+                    .Single(attribute => attribute.AttributeType ==
+                        typeof(CollectionAttribute))
+                    .ConstructorArguments[0].Value?.ToString());
+        }
+    }
+}
diff --git a/tests/ARSAS.Tests/ZivBscStepControlRegressionTests.cs b/tests/ARSAS.Tests/ZivBscStepControlRegressionTests.cs
index 602afeaaf..6b74691a2 100644
--- a/tests/ARSAS.Tests/ZivBscStepControlRegressionTests.cs
+++ b/tests/ARSAS.Tests/ZivBscStepControlRegressionTests.cs
@@ -59,6 +59,26 @@ public void FeedbackRequiresExactDirectionalNumericMovement()
         Assert.False(Iec61850BscStepControlPolicy.MovementConfirmed("Lower", "12", "13"));
     }
 
+    [Theory]
+    [InlineData("0", "0")]
+    [InlineData("1", "1")]
+    [InlineData("-2", "-2")]
+    public void CommandDock_UsesLiveBscStepStatusNotSavedBooleanHint(
+        string actual, string expected)
+    {
+        var signal = new SignalDefinition
+        {
+            ObjectReference = "ZIVAVRLD1/ATCC1.TapChg",
+            FunctionalConstraint = "CO",
+            IsControlSignal = true,
+            ControlCdc = "BSC",
+            ControlStatusReference = "ZIVAVRLD1/ATCC1.TapChg.valWTr.posVal",
+            ControlValueType = "Boolean", // deliberately stale discovery type
+            ControlCurrentValue = actual
+        };
+        Assert.Equal(expected, signal.ControlProcessValue.DisplayValue);
+    }
+
     [Fact]
     public void BscShowsRaiseLowerNotSwitchNorSetpoint()
     {