[masarray]

D15 — P0 routine Command Dock Refresh inspection epoch/association fence (stacked, draft)

Exactly one commit: 098ec4abdf7ce8681ec97111f12f3f6151eade78 above currently-green draft #755 HEAD 7d235554225aa0341561b4e887a852fb6fd8e269 (ahead1/behind0, two changed files only). This stacked PR targets #755's dedicated branch, NOT the protected release RC/main/stable. Source #753, #754, #755, frozen #726 Write/readback, #716 Boolean, SG7 #688, IP #732, SMV and trial engine pin untouched. There is no cherry-pick, merge or release.

Root cause confirmed from exact #755 source

D13 guarded ReinspectConfiguredControlAsync (post-Write) with both immutable MMS GUID and device.LiveValues.Association model epoch, but MainWindow.xaml.cs:RefreshControlValuesAsync routine Command Dock refresh still called facade InspectControlAsync(deviceId, signal, token) without stillCurrentPublicationTarget. Native response could arrive after same-socket live-model replacement or signal rebind; facade's existing MMS GUID/exact root check alone does not attest identity of the live UI model. A stale failure could also publish old fault text. The operation is read-only, but GUI ControlSemanticVerified/CDCs influence operator decision. No physical misoperate alleged.

Implementation

• Capture exact GetControlAssociationId(deviceId) GUID and device.LiveValues.Association before the first UI await; fail closed on no current MMS association.
• Reuse existing pure Iec61850ControlInspectionPublication.IsCurrentPostWriteTarget to check MMS GUID, live model epoch, connected state; require original device.Signals.Contains(candidate) object identity as well. No extra subscription, native request, cache, queue, mutex or shadow ledger.
• Check after Dispatcher.Yield, before dispatch, and pass () => IsCurrentRefreshTarget(signal) into existing UI facade (which already checks before native dispatch, before typed publication and before fault revocation). Recheck before UI feedback; stale exception cannot overwrite current evidence. Suppress stale batch projection/status after model or association replacement.
• A normal same-association, unchanged-model refresh keeps the same typed native results and preexisting Command Dock user workflow.

Tests and gates

New deterministic M217P0RefreshControlModelEpochTests: accepts exact association + model + signal object; rejects same-socket model epoch replacement, identical-reference foreign signal object, retired MMS GUID and disconnection; source seam asserts exact callback passed into facade, stale fault guard before UI mutation, and batch projection guarded. The existing #755 12 paths and tests remain untouched. This is not actual IEC relay Operate.

Safety/release: keep OPEN DRAFT pending fresh exact-head Windows managed/native/portable CI and SCL R7, plus #615 Control owner and #727 RC owner review; #606 GOOSE/SGCB 7-case physical acceptance remains independent. A green CI does not authorize automated merge, live Operate or R7/R10 FAT. The branch is intentionally narrow so it may be integrated by the #755 owner without overwriting parallel work.

[masarray]

D15 exact-head integration-ready candidate — routine Command Dock Refresh model-epoch guard

Stacked draft #756 exact commit 098ec4abdf7ce8681ec97111f12f3f6151eade78 is one commit / 2 paths ahead of unchanged #755 HEAD 7d235554225aa0341561b4e887a852fb6fd8e269, base #755 branch, no behind. It remedies the remaining normal RefreshControlValuesAsync publication gap: preserve nonreusable MMS GUID + device.LiveValues.Association model epoch + exact device.Signals.Contains(signal) instance identity, and supply stillCurrentPublicationTarget callback to existing facade. Same-socket model rebind/rescan and late native inspection fault cannot publish typed Command Dock authority or stale text. The D13 post-Write path is unchanged and reuses exactly the same predicate. Adds two deterministic regression tests; no extra MMS traffic, native code changes, Write, GOOSE/SGCB or queue/caches.

FULL exact-head CI now VERIFIED: Windows build/app regression/pinned native CTest/managed packaged bridge/portable publish+smoke/seal run #40331840977 SUCCESS, SCL R7 canonical/engine/portable run #40331840419 SUCCESS, reference guard and P1 advisory SUCCESS. Exact tested portable EXE artifact #12654339747, only engineering candidate; D15 checkpoint.

Owner integration gate: #756 MUST be reviewed and integrated in order with #755 by Control owner #615 / integrated RC owner #727, preserving #753 GOOSE and original #754 snapshot, frozen #726 Write/#716 Boolean, SG7 #688, IP #732, SMV, engine lock, stable v1.6.42 and protected RC. Do not merge stacked #756 separately into RC or mark #755 automatically done. #606 seven-case GOOSE/SGCB physical acceptance, Direct/SBOw timeout/reconnect IED checks, R7/R10 FAT still OPEN.

[masarray]

D28 maintainer decision: archive superseded experimental safety candidate — CLOSED, NOT MERGED. The operator has accepted the newer working ARSAS evidence/baseline and explicitly does not authorize or plan another capture cycle for historical PR qualification. This draft was based on an older RC. Its unique code is NOT asserted to be present in the accepted RC; do not claim this safety fix is deployed or turn red safeguards green. Historical source commits, review and discussion remain accessible for engineering traceability. No cherry-pick, engine repin, release or new FAT is authorized by this archival action.