P7.6F #446: canonical CSWI commands and evidence-based rejection shout

[masarray]

P7.6F final exact-head CI / artifact handoff (2026-10-09)

• 11/11 workflows SUCCESS on exact HEAD c08273201542d4372d1f05bc8d4f8d6ef0685add; merge execution guard 1,424/1,424 regression tests PASS, zero failed or skipped.
• Native Windows x64 Build ARSAS: SUCCESS; portable single-EXE artifact.
• Smart Discovery field capture: SUCCESS; field-capture artifact.
• First branch commit 9831760 failed WPF compile because model file was accidentally truncated by a patch application. Fixed safely by rebuilding full Models/MonitorModels.cs from original verified P7.6E base, reapplying only exact scoped command LINQ GroupBy changes; no lost model content. Only final c08273201542d4372d1f05bc8d4f8d6ef0685add is qualified. No tests skipped/relaxed.
• End-user acceptance still pending: GE F650 test Command Dock shows one row per distinct CSWI.Pos, short non-modal 5-second auto-dismiss shout card with real AddCause when available, generic access-denied not misreported as confirmed Local, and no regression to actual control dispatch.
• Separate draft IED dialog UX #486 is NOT merged into this stacked branch; reconcile UX branches before release. CodeCommitted/CIPassed/ArtifactsAvailable = YES; PhysicalVerified/MergeReady/Released = NO. No breaker operation requested.

Field motivation

GE Multilin F650 BCU_GE.iid has 16 distinct CSWI*.Pos controls, but one object (e.g. CSWI1.Pos) is present in multiple DataSets and the Command Dock displays duplicate Open/Close rows. First control attempt returned MMS object-access-denied (3) while BCU was in Local per field operator; later commands accepted after Remote. Because the IED did not supply distinct AddCause/ControlError for the first refusal, MMS access denied cannot by itself prove Local mode.

Fix and UX

• Canonicalize operating surface by normalized full device-scoped IEC 61850 object reference, selecting one stable representative across DataSets without deleting source signals, DataSet members or RCB coverage. Distinct CSWI1 and CSWI10 / distinct LD remain distinct. All commands still use ARIEC control path.
• Honor real ControlError / AddCause; if IED supplies blocked-by-interlocking, blocked-by-synchrocheck, insufficient authority, or blocked mode, display a short descriptive reason.
• Add a single nonmodal WPF Control Shout overlay card near top-right that auto-hides after 5 seconds, reuses one timer for concurrent outcomes, and preserves technical details in Diagnostics. Generic MMS object-access-denied gets a troubleshooting hint to check BCU Local/Remote, permissions and interlocks without fabricated attribution.
• Regression tests: DataSet duplicate collapse without changing model, distinct LD/CSWI separation, denied MMS missing cause, real AddCause, shout label mapping and UI timer contract.
• No engine writes, no actual control requests, no GI or Static Dataset acquisition changes. Runtime/wire authority remains unchanged.

Workstream and CI thrift

Draft stacked on P7.6E #488 exact d9d11ea2a24f09f6a515c3b561daca2a373d69c1, while sibling dialog UX #486 remains separate. Only Models/MonitorModels.cs, MainWindow.xaml, MainWindow.xaml.cs and one new tests file changed. Staged in atomic commits, wait for CI; no merge or public release before Windows screenshot testing, F650 revalidation and reconciliation with #486. Parent #446.