[masarray]

P0 #615 — isolate native command alias and association-fence WPF feedback (D10)

Exact current source SHA: 2aab054b6cf9eb5500b1dce5ef5957eb8ba0232d (parent 25cdc1764beaf47a174e8cd0b2244cbd58af2fe5; targeted missing Models namespace import in new regression test)
Base (protected integrated RC): 817c3910e8223fa2ac531a4426ada5d2d4bbbe50 (release/arsas-integrated-rc0-20261024).
State: Draft, unmerged. Isolated corrective PR (five paths), not a change to published stable v1.6.42 or consumer main. Trial engine pin f75e323e9f8443aa20e0a3818a1d5d77255b2c0f retained.

Root cause and design

Previously, MainWindow.xaml.cs sent the same mutable GUI-owned SignalDefinition to native NativeIec61850Client. The client changes CDC/control model/feedback after awaits, even after caller timeout/reconnect. Existing single-flight and UNKNOWN wire-outcome quarantine protect MMS admission, not object ownership.

This patch:

1. Adds Iec61850ControlRequestSnapshot.Create from the historic P0 follow-up: retire unresolved MMS control sessions without blocking reconnect #615 unique code blob 96277fceb3490a778ab0d7113fadc0bb13edee1a. Copies exact authorized command inputs, copies previously verified live CDC only, and does not carry process q/t or a second SSOT ledger.
2. Services/Iec61850MonitorRuntime.ExecuteControlAsync now creates a detached request after existing session-wide single-flight admission and before native dispatch, retaining the original native task lifetime/quarantine and targeted active-command bookkeeping. No modifications to native SBS/SBO/Operate wire protocol.
3. Exposes nonreusable ControlSessionIdentity Guid from inner runtime via UI facade. GUI captures association identity immediately before dispatch; inner runtime rejects any caller whose expected association was replaced; any post-await result or exception from a retired session is only logged as CONTROL_STALE_RESULT_IGNORED, not republished to WPF signal/command shout. A per-claim CompleteControlCommand cleanup still runs.
4. Tests include deterministic simulated late Task completion after cancellation, asserting detached native mutation leaves original GUI-owned signal untouched and UNKNOWN quarantine sticky; source contract checks UI association gate and runtime actual admission. Existing full single-flight tests remain.

Owner safety, integration and acceptance

• MainWindow command path is a narrow, isolated patch requiring review by RC0 INTEGRATED — GUI P0/P1/P2 + SSOT/Write + main SV; physical release gates open #727/P0: reconcile v1.6.42 shipped source + stable docs to main (physical R7/R10 gates pending) #729 RC integrator and existing INTEGRATION GATE ONLY: user-accepted Write onto latest SSOT V2; preserve advanced SMV #726/FAT Write safety: reject unrecognized live Boolean instead of selecting false #716 Command/Write owners before merge. Frozen Write/readback GUI and BrowserDataWriteWindow not changed. No SG7/SMV/IP form files changed.
• This new PR is not physical IED Operate evidence and not an endorsement of any undelivered/stale command. Green managed/native CI is a prerequisite, not R7/R10 FAT acceptance.
• The native command can still have an UNKNOWN wire outcome on deadline/cancellation. Retain quarantine and refuse further Operates on the old MMS association; verify physical state before reconnect.
• Acceptance: (a) NotSame(original.Signal, nativeRequest.Signal), current-association verified CDC only; (b) late old-native mutation after timeout/reconnect cannot change GUI-owned signal; (c) old result cannot be published into new association; (d) same-association second command rejected while native unresolved; (e) legitimate direct/SBOw and readback behavior remains; (f) compile/full Windows/native/portable exact-head CI plus owner physical spot-check.

Related: #615 remains OPEN until actual owner-approved integration, not closed by this draft. #753 GOOSE safety remains independent draft green on its own exact SHA. No automatic merge.

D10 exact-head CI correction

The initial source commit 25cdc1764beaf47a174e8cd0b2244cbd58af2fe5 passed application compile but failed at test compile (CS0246) due to missing using ArIED61850Tester.Models; in the newly added regression test. Exact one-line fix 63434a1f9ea4502771fc2f471b9ea7859450a48f is now the HEAD. Build+test compile succeeded on the intermediate commit, but SCL run 40312555609 then failed one regression assertion because SignalDefinition normalizes Open [01] to Open. Its assertion now compares GUI's captured pre-flight state before and after native late mutation. Only report CI from new Windows run 40312555665 and new SCL run 40312555609 as proving this HEAD; prior failed/old runs are not qualification.

Current exact-head CI — 2aab054b6cf9eb5500b1dce5ef5957eb8ba0232d

• Windows Build 40313104906 and SCL R7 40313104592 are the valid new SHA checks; in progress at update.
• Intermediate 63434a1... compiled and 2988/2989 canonical-export regressions passed, with one test-only formatting assertion failure. The code did not inject process evidence; SignalDefinition itself normalizes the displayed Open status on verified CDC. The corrected test asserts the actual before/after GUI state instead of literal text.

[masarray]

D28 maintainer decision: archive superseded experimental safety candidate — CLOSED, NOT MERGED. The operator has accepted the newer working ARSAS evidence/baseline and explicitly does not authorize or plan another capture cycle for historical PR qualification. This draft was based on an older RC. Its unique code is NOT asserted to be present in the accepted RC; do not claim this safety fix is deployed or turn red safeguards green. Historical source commits, review and discussion remain accessible for engineering traceability. No cherry-pick, engine repin, release or new FAT is authorized by this archival action.