[masarray]

D11 — integration rehearsal ONLY; NOT an RC merge or release

Exact base: protected #727/#729 RC 817c3910e8223fa2ac531a4426ada5d2d4bbbe50. Exact head: a0b96118d1ba4f04e108ff1fb9321f81fd653146 (one commit ahead, no behind). Unmerged draft; do not enable auto-merge.

Source parents, each individually green on exact SHA:

• #753 0652f66bed0c72dded20ff547e23e2ef1989341c: exact passive GOOSE frame dataSet, field order, complete FCDA/SGCB initial read admission. Full Windows/native/portable 40308062610 and SCL 40308062583 success.
• #754 2aab054b6cf9eb5500b1dce5ef5957eb8ba0232d: detached command-only request object + association-fenced GUI publication + deterministic late-flight tests. Full Windows/native/portable 40313104906 and SCL 40313104592 success.

Deterministic, non-naive assembly: both PR heads are descended from exact same RC with behind=0; their complete changed-file sets were compared. #753 touches six exact paths; #754 five entirely disjoint paths (overlap 0). This branch was produced by a single Git tree commit atop the protected RC using each source branch's exact HEAD Git blobs and preserving all original source tests. Not a blind cherry-pick, history rewrite, source recomputation or unsafe merge. The 11 exact blobs and corresponding parent PR HEADs are documented in D11 maintenance checkpoint. There is zero modification to either source PR or their branch history.

Purpose: exercise the combined, exact physical-code-compatible consumer build and managed regression contract through one necessary integrated CI wave. In particular MainWindow's IED Browser code and Command Dock partial-class code must compile/run together with original source tests.

Protected frozen lanes: Write/readback #726, Boolean editor #716, SG7 performance #688, IP UI #732, accepted SMV, engine trial lock f75e323e9f8443aa20e0a3818a1d5d77255b2c0f, public stable v1.6.42 unchanged.

Mandatory owner/release gates: a successful build does not mean physical IEC 61850 GOOSE/SGCB/Operate qualification. #606 7-case accepted-GUI/field test matrix, #615 real command owner and #727 RC integration owner review; real R7/R10/IED FAT evidence required. #753 and #754 remain their own reviewable source PRs. Do not merge this rehearsal PR into RC/main until both source PR owners explicitly confirm behavioral integration and one canonical merge plan. It is a disposable branch in purpose only; do not delete source/old branches.

D12 P0 inspected-control late-alias correction (new exact HEAD)

The original integrated D11 head a0b96118d1ba4f04e108ff1fb9321f81fd653146 was full green, but new source audit found a separate read-only inspection hazard: native InspectControlAsync mutated WPF-owned SignalDefinition (ControlCdc, ControlSemanticVerified, ControlCurrentValue, ControlModelText) on the background worker, before the runtime's post-await association check. A late canceled/stale inspection could change current GUI authority despite command-flight snapshot #754.

First correction head 99f68472cad22e8939a39c5fa6906e0eeffe8e6b (child of tested D11 head), 12 files vs frozen RC, still draft and unmerged. This isolated follow-up was intentionally applied ONLY to #755 integration rehearsal, not written into protected #753/#754 source branches, frozen #726 Write branch, main, stable, RC or engine pin.

Design: Iec61850ControlRequestSnapshot.CreateSignal snapshots the non-WPF signal on caller context; inner runtime additionally detaches before native InspectControlAsync; GUI-facing facade awaits serialized background operation and applies resulting typed Iec61850ControlCapabilities synchronously using Iec61850ControlInspectionPublication.TryApply only when the captured GUID association and exact control object still match, and no command is active. StatusOnly/unready revokes live command authority and preserves truthful status; mismatched association/identity fails closed. On current-association errors, authority is revoked only from GUI-facing context. Command-only operation, GOOSE, SMV, Write/CF and native wire protocol unchanged.

Tests: new deterministic DetachedReadOnlyInspectionAndAssociationPublicationCannotReplayOldProof covers detached native late changes, wrong association, wrong object, accepted typed Direct-normal, and StatusOnly downgrade; source-path contract checks native detach and GUI publication fence. CI not yet claimed green at this HEAD: Windows 40321106277, SCL 40321106212. Review the typed-control activation and post-Write reinspection behavior with #615/#727 owner before merging.

D12 regression correction / current HEAD

Current HEAD b52d4824bbadb04dc0d897b476b38bcf507cda38 (child of 99f68472...), still 12 paths vs protected RC, still DRAFT. The prior SCL 40321106212 compiled and passed 2995/2996 tests, failing only the new GUI ControlLastResult raw-text assertion: SignalDefinition intentionally normalizes a StatusOnly read to operator text Status only — read-only object; commands .... Only one regression test changed to assert normalized Status only + read-only and physical Operate rejection, not raw native prose; no source logic change. Do not use the prior failing SHA as qualification. Exact-current Windows 40321671036 and SCL 40321671103 triggered once by this meaningful test correction; conclusions pending when updated. Source branches #753 and #754 remain untouched; no merge/release/FAT claim.

D13: close secondary post-Write retired-association GUI revoke race (CURRENT HEAD)

Current exact HEAD 7d235554225aa0341561b4e887a852fb6fd8e269 (D12 prior b52d4824bbadb04dc0d897b476b38bcf507cda38; still OPEN DRAFT 12 paths / 5 commits ahead, zero behind immutable RC 817c3910e8223fa2ac531a4426ada5d2d4bbbe50). No modification to #753/#754 source branches, frozen Write/readback #726, engine pin, protected RC, main, stable v1.6.42.

Specific evidence: MainWindow.xaml.cs:ReinspectConfiguredControlAsync could finish after Stop/Reconnect and unconditionally signal.ClearLiveControlAuthority() / overwrite ControlModelText on late cancellation/exception. Worse, even a postawait guard in this method was insufficient: D12 facade could publish typed capabilities to the same GUI model before the invoking method checks its writeAssociation model epoch.

Current solution is single-authority and fail closed:

• Pin nonreusable GetControlAssociationId(deviceId) GUID before awaiting read-only post-Write inspection; new pure Iec61850ControlInspectionPublication.IsCurrentPostWriteTarget requires same current MMS GUID, exact saved device.LiveValues.Association epoch, connected state and current membership of the same signal.
• Pass a caller-context Func<bool>? stillCurrentPublicationTarget into facade InspectControlAsync. The facade tests this pre-dispatch, again before synchronous typed GUI publication, and again before downgrade on a native exception. This prevents old model-snapshot results from enabling/disabling a new control even on the same MMS socket.
• The caller separately guards successful completion, cancellation, errors and post-flight projection refresh; retired flight logs CTL_MODEL_POSTWRITE_STALE_IGNORED and does not reauthorize, clear or overwrite current proof. No new MMS I/O, native engine call, Operate or Write; the legacy duplicated Auto-detect assignment was removed from same-association failure branch.
• Deterministic tests exercise old GUID, changed model epoch, detached/removed row, offline and positive epoch, plus source contract verifying stale guard before publication and fault downgrade. Original 12-path integrated M2.17-D safety: reject incomplete unbound GOOSE and foreign-domain SGCB/GoCB reads #753/P0 Command: detach native request and fence stale GUI association results #754 and D12 regressions retained. No physical IED Operate/GOOSE claim.

Two purposeful successive D13 commits: 139f2f4d64eb4903630050ab0521db11937401b2 (post-Write stale exit/error gate), 7d235554225aa0341561b4e887a852fb6fd8e269 (critical facade pre-publication model-epoch gate). Previous-parent workflow attempts were canceled by GitHub concurrency when superseded; only qualify current SHA Windows run 40325732039 and SCL run 40325732197. Reference Guard 40325732127 and P1 Advisory 40325732341 have passed. Owner Control #615 / RC #727 acceptance and physical R7/R10 FAT remain mandatory; no merge yet.

[masarray]

D11 combined safety integration rehearsal — FULL exact-head CI SUCCESS, draft/unmerged

Exact 11-blob integration head a0b96118d1ba4f04e108ff1fb9321f81fd653146, base RC 817c3910e8223fa2ac531a4426ada5d2d4bbbe50 (one commit ahead, zero behind; 6+5 disjoint original paths). Individual source reviews remain #753 + #754, each independently green, source branches untouched. No blind cherry-pick, no conflict resolutions, no changes to RC/main/stable.

Combined exact-head proof: Windows/native/portable workflow 40318195357 completed SUCCESS — Build solution, app regressions, engine tests, pinned ArdIrec native CTest, managed packaged native bridge tests, real portable publish/smoke, package seal. SCL R7 workflow 40318195452 completed SUCCESS — canonical SCL regressions, engine, portable smoke. reference guard and advisory SUCCESS. Exact #755 portable EXE artifact. Complete D11 maintenance checkpoint.

Not approval to merge/release: #606 7-case UI + real relay GOOSE/SGCB acceptance, #615 direct/SBOw/UNKNOWN native late-flight and reconnect field checks, RC #727/#729 owner review, R7/R10 FAT are not fulfilled by synthetic CI. Rehearsal PR remains DRAFT OPEN; stable v1.6.42, frozen Write #726/#716, SG7 #688, IP GUI #732, accepted SMV, and engine pin unchanged.

[masarray]

D12 P0 read-only inspection ownership — exact-head fully QUALIFIED by managed/native CI, not physical FAT

Latest OPEN DRAFT #755 source HEAD b52d4824bbadb04dc0d897b476b38bcf507cda38 adds a typed, synchronous GUI publication gate for native read-only control inspection, in addition to previously qualified D11 command-only detached request + GOOSE FCDA validation. No source change after the test-only StatusOnly display expectation correction.

Proven exact-head CI: Windows Build+regression+native CTest+packaged managed bridge+portable EXE smoke+seal #40321671036 COMPLETED SUCCESS; SCL R7 canonical + engine + portable #40321671103 COMPLETED SUCCESS; IEC guard SUCCESS. Portable EXE artifact #12649647222 is a candidate, not the stable v1.6.42 release. Complete D12 source/test checkpoint.

Code contract: background native inspection now receives detached SignalDefinition only. Facade on captured caller GUI context publishes typed capabilities only with current nonreusable association GUID, exact control-root identity, and no in-flight command. Ready direct/SBO model may receive semantic proof only from typed live descriptor; StatusOnly/Unknown fails closed and clears prior verified live CDC. Old/cancelled IED native continuations cannot mutate the new GUI signal. No native Operate protocol change, extra MMS call, or new observation cache. This correction is additional to original D11 union; current #755 is 12-path follow-up, not byte-identical 6+5 overlay anymore.

Release/owner stop: #753/#754 historical candidate branches remain unchanged, RC #727/#729 817c3910..., main/stable, engine pin and frozen Write #726/#716, SG7 #688, IP #732 untouched. #615 Command owner must still accept Direct/SBO post-Write reinspection behavior, #606 owner must validate GOOSE/SGCB 7-case on relay, R7/R10 physical FAT separate. No merge/closure solely on CI.

[masarray]

D13 real P0 correction — post-Write stale inspection dual-epoch publication gate; #755 draft, not merged

Source: draft #755, exact HEAD 7d235554225aa0341561b4e887a852fb6fd8e269 (12 changed paths vs unchanged protected RC 817c3910e8223fa2ac531a4426ada5d2d4bbbe50). Original independently green #753 GOOSE 0652f66b... and #754 detached Control 2aab054b... were not touched.

Previously unchecked GUI ownership leak: even with D12's detached native Inspection, MainWindow.ReinspectConfiguredControlAsync could reset a NEW connection's ControlSemanticVerified/ctlModel in stale cancellation/error paths. A caller-only postawait check of writeAssociation also happens AFTER the facade can already publish capabilities onto the mutable GUI row.

Implemented on isolated #755 with precisely two follow-up commits 139f2f4... → 7d235554225aa0341561b4e887a852fb6fd8e269:

1. Pin current nonreusable MMS association GUID plus device.LiveValues.Association model epoch and live signal membership; pure Iec61850ControlInspectionPublication.IsCurrentPostWriteTarget tests connection/current model. When stale, success, cancellation, and fault branches log CTL_MODEL_POSTWRITE_STALE_IGNORED and do NOT clear/overwrite typed GUI authority/status or project old Control Dock.
2. Pass optional UI-context stillCurrentPublicationTarget predicate to the existing facade InspectControlAsync (all normal three-argument callers unchanged). Check it before sending read, BEFORE TryApply can synchronously publish typed capabilities, and before any native failure can revoke GUI authority. No second MMS connection, native Operate or CF Write; direct/SBO control gate, report and GOOSE unchanged.
3. Added deterministic matrix for invalid/valid GUID, live model epoch, disconnected/unowned signal; source-contract assertions enforce facade pre-publication and fault fences. New code remains candidate pending latest exact-head CI Windows 40325732039, SCL 40325732197. Exact-head reference guard 40325732127 and advisory 40325732341 have completed success.

Full immutable D13 audit and handoff. Owner gates remain: #615 native Command Direct/SBO and post-Write inspect behavioral owner acceptance, #606 GOOSE/SGCB seven cases on real relay, #727/#729 integrated RC, R7/R10 physical FAT. No physical Operate/readback success inferred from CI. Frozen #726 Write/readback, #716 Boolean, #688 SG7, #732 IP, SMV, engine pin and accepted v1.6.42 untouched. Do not merge draft #755 automatically.

[masarray]

D13 FINAL: post-Write dual-epoch Command GUI fence — current SHA full CI SUCCESS (NOT physical FAT)

Exact #755 HEAD 7d235554225aa0341561b4e887a852fb6fd8e269 (commit), branch still DRAFT OPEN, base/protected RC 817c3910e8223fa2ac531a4426ada5d2d4bbbe50, 12 paths, ahead5/behind0. Original source #753 and #754 unaffected.

Windows 40325732039 COMPLETED SUCCESS: Windows .NET8 solution, pinned engine identity/SCL regression, all ARSAS app tests (D13 dual-epoch invalid/positive tests), pinned ArdIrec native CTest, packaged bridge managed integration, portable EXE publish/smoke/seal. SCL R7 40325732197 SUCCESS, IEC guard 40325732127 and advisory 40325732341 SUCCESS. Exact-HEAD portable candidate artifact #12652020557, named ARSAS-1.6.42-win-x64-portable.exe by pipeline convention only — NOT public stable v1.6.42.

Root cause closed in candidate source: stale post-Write ReinspectConfiguredControlAsync success/cancel/error could previously revoke/overwrite new GUI typed command authority; more importantly D12 facade could already mutate GUI before invoking post-Write's own model epoch check. D13 pinned both MMS-session GUID and LiveValues.Association model epoch, current connection/signal membership; facade validates caller epoch before operation, before typed GUI publication and before fault downgrade. Old/retired results are logged CTL_MODEL_POSTWRITE_STALE_IGNORED and cannot change new typed control proof. No extra MMS calls, native/engine rework, automatic Operate/Write or process-state invention.

D13 historical semantic audit #599 collapsed-by-default and #583 revised Nav+SMV order remain KEEP OPEN, no blind closure. Complete source/test/CI checkpoint.

Still release-blocked pending owner & real IED tests: #615 Direct/SBO post-Write/Stop/reconnect acceptance; #606 seven-case GOOSE/SGCB GUI/IED; #727/#729 RC integration owner, R7/R10 FAT. Do NOT merge #755 just because CI passed. #726 accepted Write, #716 Boolean, SG7 #688, IP form #732, SMV, engine pin, RC/main/stable remain unmodified.

[masarray]

D15 incremental P0 safety fix — routine Command Dock Refresh now honors MMS GUID + live model epoch

Found distinct gap after D13 #755 exact head 7d235554225aa0341561b4e887a852fb6fd8e269: MainWindow.xaml.cs:RefreshControlValuesAsync still called InspectControlAsync(deviceId, signal, token) without a same-live-model publication predicate. D13 post-Write had this guard, but routine Refresh could retain an old selected SignalDefinition after same-socket rebind/rescan and replay typed capabilities or a stale failure into Command Dock. No physical misoperate alleged.

Real narrow candidate: stacked draft #756, SHA 098ec4abdf7ce8681ec97111f12f3f6151eade78; base is exact #755 branch, ahead1/behind0, 2 files only (MainWindow.xaml.cs routine Refresh section and new tests/ARSAS.Tests/M217P0RefreshControlModelEpochTests.cs). This DOES NOT edit the #755 owner head, #753/#754 source, frozen Write, RC, engine pin, main, or stable.

Implementation pins MMS association GUID + device.LiveValues.Association before the first Dispatcher yield; reuses existing IsCurrentPostWriteTarget and checks original device.Signals.Contains(signal) identity, not only IEC object reference; gives callback to facade which already blocks stale dispatch, typed GUI publish, and exception revocation; rechecks before local result/error and suppresses stale batch projection. No additional MMS read or write, native change, queue, timer, or shadow cache. Two deterministic tests cover same-socket model rebind, foreign same-path signal, old association, disconnection and source-level UI/facade seam. Parent CI Windows #40325732039 and SCL #40325732197 passed; new exact HEAD SCL 40331840419 completed SUCCESS, Windows 40331840977 still processing native/portable at writing. Do not claim final Windows qualification until run completion.

D15 full checkpoint. Keep both #755/#756 draft until Control owner #615/RC owner #727 review and physical IED R7/R10 acceptance; GOOSE/SGCB #606 7-case field checks separate. No automatic merge.

[masarray]

D28 maintainer decision: archive superseded experimental safety candidate — CLOSED, NOT MERGED. The operator has accepted the newer working ARSAS evidence/baseline and explicitly does not authorize or plan another capture cycle for historical PR qualification. This draft was based on an older RC. Its unique code is NOT asserted to be present in the accepted RC; do not claim this safety fix is deployed or turn red safeguards green. Historical source commits, review and discussion remain accessible for engineering traceability. No cherry-pick, engine repin, release or new FAT is authorized by this archival action.