P0: repair FAT relay-bench runtime latency

[masarray]

P0 relay-bench recovery — software gate complete / physical bench pending

Golden reference remains Build #1888 / ARSAS commit 712e2c557d5da83d2f02b81f3a58905e985d1e50 with immutable ARIEC61850 pin 11ab2304482600c19ba979f4fc9021ddb46b9af9. This PR is the current-line physical relay-bench candidate; it is not the golden baseline and must not be merged until the bench gate below passes.

Current candidate head: f91abd071a5e14e32fe7fb8c9db7145160e35113.

P0 software behavior now locked

• FAT LIVE VALUE is projected from the same Engineering/runtime process stream; no second acquisition stack is created for FAT.
• SCL opened from Engineering or FAT reuses the shared Engineering model. Static DataSet selection preserves report-only authority; Engineering Play uses the prepared/cached model and does not repeat full discovery.
• FAT V2 schema/templates are installed synchronously during Loaded; the first visible frame uses the final schema and canonical Boolean True / False presentation.
• Normal Value 1 / Value 2 Capture buttons are removed. FatAutoCaptureCoordinator owns normal capture; deliberate Snapshot/Recapture remains the operator correction path.
• Report-backed analog values latch immediately. Polling fallback retains the three-sample stability guard. Repeated automatic transitions keep the latest meaningful Value 1 / Value 2 pair current without overwriting operator evidence.
• Start/Continue paints before preparation work begins. Resume coalesces visible journal flushes. Stop/close detach the evidence state on the Dispatcher and perform durable seal/read-back plus final persistence off the WPF hot path.
• FAT connection/monitoring health follows the shared Engineering device state without new MMS polling.
• FAT Command Panel keeps stable row instances for normal value/result/busy updates and uses the shared Engineering command backend. Only semantic action-layout transitions replace the small action cell.
• Interlock and Synchro initialize ON once per signal; manual operator changes are not timer-forced back on.
• Command-feedback freshness is fenced at the runtime/UI boundary and is bound to the active control transaction. A contradictory stale non-report verification inside the bounded post-command window is withheld from LIVE VALUE and SOE; matching report traffic confirms the command without duplicate SOE; a contradictory real report remains authoritative and is forwarded immediately.
• Command timing diagnostics remain enabled so physical click-to-result and engine timing can be reviewed during relay-bench acceptance.
• ARIEC61850 source remains unchanged at the immutable pin above.

Exact-head CI gate — GREEN on f91abd07

• ✅ Build ARSAS #1990 — source/license/invariant checks, exact ARIEC pin verification, solution build, full regression suite, portable publish, portable smoke test, artifact upload.
• ✅ Validate IO List Testing #863.
• ✅ Validate SV evidence bundles #1088.
• ✅ Full regression evidence: 753 / 753 passed, 0 failed.

Portable candidate:

• Artifact: ARSAS-win-x64-portable-single-exe (9989904684)
• Artifact ZIP SHA-256: c642ce76cf324ddfbd84163d589ba5115faa2fce4b93f723510438c3b8af16bb
• Executable: ARSAS-1.6.33-win-x64-portable.exe
• EXE SHA-256: 6b98c3bb3f081baaf68f30dbb3b017da55e167b277f12b1f69baa067ff6ba87f

Physical relay-bench acceptance still required

• Open the same SCL from Engineering and directly from FAT; choose Static DataSet and confirm the same IED/DataSet/Command Signals authority.
• Engineering Play after FAT SCL import must associate and start Static DataSet reporting only — no live discovery.
• FAT first visible schema must be TEST | SIGNAL | IEC REFERENCE | TYPE | LIVE VALUE | VALUE 1 | VALUE 2 | STATUS | RESULT; no legacy ON/OFF or lower-case Boolean flash.
• LIVE VALUE must follow the physical relay in realtime and match Engineering; repeated scrolling must not transfer stale recycled-row values.
• Report-backed analog Value 1 / Value 2 must auto-capture quickly; repeated transitions must advance the pair correctly; Snapshot/Recapture must remain deliberate and stable.
• Command Panel must remain populated and Open/Close must use the shared Engineering backend. A confirmed command must not visibly flicker Closed → Open → Closed from stale MMS verification and must not create phantom SOE; a genuine contradictory report must still appear immediately.
• Interlock and Synchro must start ON once, while manual OFF remains respected.
• FAT Start/Continue, Resume, Stop, close/return, FAT → Engineering → Diagnostics, scrolling and navigation must remain responsive with no black/blank/freeze or WPF virtualization exception.
• Repeat the gate from both clean-state and restored-state startup.

Do not merge until this physical relay-bench gate passes.

[masarray]

Relay-bench P0 Gate 1 is green at db81148d0f429f6df27c0eea577b6ea8e07164f6.

Passed:

• Build ARSAS #1929
• Validate IO List Testing #802
• Validate SV evidence bundles #1027

Gate 1 repairs report-backed analog Value 1/Value 2 latency and removes per-event physical disk barriers while keeping final journal durability/seal verification. Proceeding to the next isolated gate: fast FAT attach to an already-live shared Engineering Static DataSet/RCB acquisition session. PR remains draft and must not merge before physical relay acceptance.

[masarray]

P0 LIVE VALUE + Command Panel gate completed on c1063c79b9fbc47341542f70695df8be50cd4ccc.

• LIVE VALUE now prefers the shared Engineering device.Points process image/report-backed state; non-forced MMS inspection remains only for missing values.
• FAT Command Panel retains row instances for normal value/result/busy updates. LIVE VALUE/result/model/enablement are bound in-place; structural synchronization happens only when the command collection changes, and confirmation/semantic transitions replace only the action cell.
• Regression coverage now explicitly rejects RebuildFatCommandRows and forced FAT RefreshControlValuesAsync(..., force: true).
• CI corrections during the gate were limited to completing required IoTestPointPlan fixture fields and updating the old source-text assertion to the new null-safe/shared-collection implementation.

Full CI green:

• Build ARSAS #1945 ✅ (full regressions + portable publish/smoke)
• Validate IO List Testing #818 ✅
• Validate SV evidence bundles #1043 ✅

ARIEC61850 source was not modified; immutable pin remains 11ab2304482600c19ba979f4fc9021ddb46b9af9.

PR intentionally remains draft. Physical relay-bench Start/capture/Recapture/command/LIVE VALUE acceptance is still required before merge.

[masarray]

P0 locked-scope verification — LIVE VALUE + stable Command Panel

Re-verified the current PR head c1063c79b9fbc47341542f70695df8be50cd4ccc against the locked P0 scope.

• LIVE VALUE is genuinely live, not attach-time-only: the FAT bridge seeds values from the shared Engineering device.Points process image, rebuilds the control-feedback index, and the existing runtime point-update path projects matching report-backed point updates into SignalDefinition.ControlCurrentValue through _controlFeedbackIndex.
• No normal full-row rebuild: Command Panel retains row view instances; ControlCurrentValue, ControlLastResult, busy/enabled state, CDC and control-model text are binding-driven. Structural collection changes synchronize rows; confirmation/semantic transitions replace only the action cell.
• No forced FAT MMS refresh regression: fallback refresh remains force: false; shared process-image projection is reapplied afterward.
• ARIEC61850 remains immutable for this P0: pinned engine revision 11ab2304482600c19ba979f4fc9021ddb46b9af9; no engine-source change is needed.

Full CI on this exact head is green:

• Build ARSAS #1945 — success
• Validate IO List Testing #818 — success
• Validate SV evidence bundles #1043 — success

No additional code churn is warranted for this locked P0. PR should remain draft until physical-relay acceptance; P1 remains out of scope until that gate is stable.

[masarray]

Repair status update — current head 478909f

Implemented on this branch:

• ✅ Rolling Value 1 / Value 2 — a completed evidence pair now advances on each new real process condition; repeated identical values do not churn evidence. Example 0 → 1000 → 0 ends at Value1=1000, Value2=0.
• ✅ Start FAT / preparation UI hot-loop removal — the preparation progress layer no longer traverses the full WPF visual tree every 50 ms at Render priority. It now runs at Background priority / 100 ms, returns immediately while idle, and updates cached progress bars only while preparation is active. A regression test locks this behavior.
• ✅ COMTRADE FAT report cleanup — removed the Download column plus OPTIONAL / not a FAT gate wording. FileDirectory evidence now presents the remote file identity, relay-modified timestamp, and evidence source directly. Regression assertions now reject the removed wording.

Previously locked on the same PR:

• ✅ already-live Engineering fast attach for FAT Start
• ✅ event-driven report-backed first/changed value capture
• ✅ no per-event physical disk barrier in evidence journal
• ✅ command-panel routine updates without full-row rebuild
• ✅ LIVE VALUE projected from the shared Engineering process image, with no forced FAT MMS refresh

Still open / not yet claimed fixed:

• ⏳ close-path latency while active evidence journals are synchronously sealed/verified
• ⏳ command Open/Close latency on a physical relay
• ⏳ multi-RCB selection/export workflow
• ⏳ normalized already-downloaded COMTRADE re-download/overwrite selection
• ⏳ one-row FAT header + report sign-off block

Current full CI has been triggered for head 478909f; Build ARSAS, Validate IO List Testing, and Validate SV evidence bundles are still running at the time of this update. ARIEC61850 remains unchanged at immutable pin 11ab2304482600c19ba979f4fc9021ddb46b9af9.

[masarray]

P0 software gate complete — exact head f91abd071a5e14e32fe7fb8c9db7145160e35113

Final software-side P0 checkpoint:

• ✅ Build ARSAS #1990
• ✅ Validate IO List Testing #863
• ✅ Validate SV evidence bundles #1088
• ✅ Full regression evidence: 753 / 753 passed, 0 failed
• ✅ Portable publish + smoke test passed
• ✅ Portable artifact 9989904684, ZIP SHA-256 c642ce76cf324ddfbd84163d589ba5115faa2fce4b93f723510438c3b8af16bb
• ✅ ARSAS-1.6.33-win-x64-portable.exe SHA-256 6b98c3bb3f081baaf68f30dbb3b017da55e167b277f12b1f69baa067ff6ba87f

The command freshness repair is now behavioral, not cosmetic: it is bound to the active control transaction, suppresses only stale contradictory non-report verification/phantom SOE, and keeps genuine report traffic authoritative. Start/Resume/Stop/close responsiveness, shared Engineering/FAT acquisition, rolling Value 1/Value 2 evidence, canonical first-frame Boolean presentation, and stable Command Panel behavior remain locked by regression coverage.

No further software churn is planned for P0 before the physical relay bench. The PR intentionally remains draft and must not merge until the physical acceptance checklist in the PR body passes on clean-state and restored-state runs.