G2.5-A2.1: command-bound high-speed stimulus witness - #229

Status

G2.5-A2.1 V3 is CODE/CI READY and PHYSICAL RETEST PENDING. It remains stacked on exact physical A2 candidate 6be89d0ead77d8b6cc97665d47e0eb3abe1f6876.

Physical history / why V3 exists

V1 — superseded

Exact candidate f3100b3588cc9da78569ce1a9479b14e4437165b was field-tested. The isolated MMS witness was healthy: pre-command baseline 16/16, 0 read failures, association remained MmsInitiated. However Command captured=False and the 45 s wait timed out.

Root cause: V1 listened to SignalDefinition.ControlCommandBusy, which is used by the fast Command Panel but not by the dedicated ControlCommandWindow.SendCommand_Click path used in the field. This was an observer failure only; it did not indicate an MMS, SBOw, Operate, CommandTermination, feedback, or report failure.

V2 — superseded

Exact candidate 0219b9aa2e2f9ca276018193c17fe7fb3b9b0495 added an observer-only routed Button.Click fallback for the dedicated Control Command dialog while retaining fast-panel ControlCommandBusy observation. Physical retest again produced a healthy MMS baseline 16/16, 0 read failures, association healthy, but neither UI observer captured the command. Therefore UI/WPF event observation is not accepted as command-capture authority for this physical workflow.

V3 corrected exact field candidate

ARSAS: e386f48a70cf111717e6c29027f6e62b1f22529f

ARIEC61850 remains pinned to physical-proven:
26c85400a4da230c4429e6302847f230385b6687

V3 command-capture authority

V3 stops relying on WPF events as authority. It subscribes to the already-existing Iec61850MonitorRuntime.Diagnostic event and parses the existing runtime diagnostic:

Control execution requested: <exact signal> value=<requested value>; ...

That diagnostic is already emitted synchronously by the unchanged runtime immediately before the existing native control call. Therefore every normal caller of Iec61850MonitorRuntime.ExecuteControlAsync passes the same observer point regardless of which ARSAS control UI initiated it.

V3 only observes that existing event and republishes immutable intent into the A2.1 observer bus. It does not add code inside the control transaction.

Legacy V2 UI observers remain only as non-authoritative fallbacks.

New V3 pieces

• MainWindow.A21Witness.cs — read-only exposure of the already-existing runtime instance for commissioning observation only.
• Services/DynamicReportCommandBoundStimulusWitnessServiceV3.cs — subscribes/unsubscribes the existing runtime Diagnostic event, parses exact IED/object/value, and delegates the isolated MMS sampling to the existing V2 witness.
• tests/ARSAS.Tests/DynamicReportCommandRuntimeDiagnosticWitnessTests.cs — exact runtime-diagnostic parsing, IED filtering, non-control rejection, source-boundary and read-only/production-off regressions.

Control source boundaries remain untouched

• Services/Iec61850MonitorRuntime.cs control implementation is unchanged; V3 only subscribes its pre-existing public Diagnostic event.
• ControlCommandWindow.xaml.cs unchanged.
• MainWindow.xaml.cs control executor unchanged.
• Models/SignalDefinition.cs unchanged.
• ARIEC61850 engine unchanged.
• no change to request payload, StationControl origin, SBOw, Operate, CommandTermination, process feedback, timeout, or wire ordering.

The runtime diagnostic call itself is synchronous (Diagnostic?.Invoke(...)) and occurs before session.Client.ExecuteControlAsync(...), so a normal runtime control request while V3 is armed provides a deterministic command-capture boundary without WPF timing assumptions.

Operator flow for physical V3

1. Checkout exact ARSAS e386f48a70cf111717e6c29027f6e62b1f22529f and exact engine 26c85400a4da230c4429e6302847f230385b6687.
2. Connect the exact IED.
3. Ctrl+Shift+F arms A2.1 V3.
4. Wait for G2.5-A2.1 READY — ISSUE ONE ARSAS COMMAND.
5. Issue exactly ONE already-proven safe OPEN/CLOSE using the normal ARSAS control UI (the same dedicated Control Command dialog is valid).
6. Expect G2.5-A2.1 COMMAND CAPTURED.
7. Do not issue another command.
8. If a process/status edge is found, expect G2.5-A2.1 TRANSITION OBSERVED and capture the full evidence window.

Safety

The witness itself performs zero control/report mutation:

• it does not issue, wrap, delay or re-issue a control command;
• no RCB attribute access/write;
• no RptEna/Resv/DatSet/TrgOps/OptFlds mutation;
• no GI;
• no Define/DeleteNamedVariableList;
• no report monitor;
• no profile save/advance;
• no ProductionEligible change;
• production automatic dynamic reporting remains OFF.

CI — exact V3 head e386f48a70cf111717e6c29027f6e62b1f22529f

• Build ARSAS #1399 — run 32685069309 — PASS
  • source/license invariants PASS
  • premium/release invariants PASS
  • exact engine checkout/API verification PASS
  • full solution build PASS
  • full ARSAS regression PASS
  • portable publish PASS
  • portable single-EXE smoke PASS
• Validate SV evidence bundles #511 — run 32685069319 — PASS
  • focused restore/build PASS
  • focused regression PASS

Artifacts

• portable artifact 9505449370, SHA-256 05f1cc910b1a186c82cd18ecc692c20f3d542d726ff5b18ce908e1867b117d30
• test evidence artifact 9505434874, SHA-256 51cff987cb50df31562a14401b702416ce2aed3048e52ebbbded5474c0dd0de9
• source snapshot artifact 9505408620, SHA-256 eaf9fe84824733ba5c2adc8667f2f2b140f61ea157cebaad3d89a4e3bcfefb79

Merge gate

Do not merge yet. Physical A2.1 V3 must first capture the actual runtime command and then prove at least one command-bound MMS status transition with the witness association healthy. If command capture succeeds but no transition occurs, command binding is proven and the next investigation is feedback/status selection or pulse timing—not the command observer. If a valid transition is proven, freeze this exact physical SHA and proceed to G2.5-A3 narrow spontaneous-dchg qualification. G2.5-B physical remains blocked. Production automatic dynamic reporting remains OFF.