fix: clarify closed-loop timing and frozen capture semantics

[masarray]

Summary

Tightens operator/evidence semantics on top of the metrology-grade timing engine and fixes the closed-loop RESET/re-arm lifecycle found during manual desktop validation.

Timing / operator clarity

• observes the closed loop one 250 µs relay quantum at a time inside each 40 ms WPF presentation slice so the desktop can capture the exact protection frame that first asserts generic ANY-PICKUP/BO2;
• records and displays the first ANY-pickup source separately from the eventual operated element;
• uses one unified ANY protection pickup definition for 50P/51P/50N/51N plus 67P/67N/27/59/59N;
• keeps BI1 as the TESTSET timer/auto-stop authority while waveform/phasor freeze is explicitly a later causal relay processing frame;
• builds the timing rail from timestamped events and sorts it chronologically;
• separates RELAY ANY PU [source] from TESTSET BI2 ACCEPT;
• makes OUTPUT OFF · FROZEN CAPTURE, PICKUP LIVE, and TRIP LATCH semantics explicit;
• evidence schema 8 → 9 includes first-any pickup and BI1-vs-capture-frame timing.

P0 one-click relay RESET / re-arm correctness

Manual testing exposed a second issue: after BI1 auto-stop, the simulation can be frozen while the causal relay acquisition/DFT still contains fault-window samples. The old reset path advanced only a fixed FeedbackSettleTime, which could be shorter than the acquisition dropout time and made repeated RESET clicks appear necessary.

This PR now:

• adds ClosedLoopRelayResetTransaction as the single deterministic reset transaction;
• when output is already OFF, advances the causal acquisition in 250 µs quanta until stale fault pickup drops out, then clears the relay latch/timers once;
• continues advancing the modeled feedback path until the postcondition is satisfied: relay trip latch clear, no protection pickup, BO1/BO2 raw LOW, and TESTSET BI1/BI2 LOW;
• reports READY TO RE-ARM only after that postcondition is true, with a bounded 100 ms simulated timeout and diagnostic state on failure;
• preserves completed TESTSET timing and frozen trip/evidence history across relay RESET;
• never restarts or mutates the virtual source as a side effect of relay RESET;
• if RESET is pressed while the source remains energized, the source stays energized and protection may legitimately reassert;
• routes the P6 hardware RESET directly through ExecuteRelayResetCommand() instead of legacy Reset_Click, removing the former dual reset authority.

Regression coverage

OneResetTransactionFullyReleasesFrozenDesktopFeedbackAndRearms reproduces the desktop path with:

• VirtualRelayFrontEndProfile.NumericalRelayDefault
• VirtualRelayContactProfile.RealisticNumericalRelay
• MetrologyTimingProfile.CmcStyle

It performs trip → BI1 auto-stop → one RESET command only and requires:

• TripLatched == false
• BO1/BO2 raw LOW
• TESTSET BI1/BI2 LOW
• source remains OFF
• trip capture retained
• next TryStartInjection succeeds and creates a new run.

The regression also proves the required reset settling is longer than the old fixed FeedbackSettleTime, directly covering the former multi-click symptom.

Invariants

• TESTSET measured trip and auto-stop authority remain wired TESTSET.BI1 only;
• no relay-internal shortcut is introduced into trip measurement;
• WPF remains presentation cadence only; metrology clock and relay processing grids remain authoritative;
• generic BI2 pickup remains distinct from the pickup of the element that ultimately trips;
• relay RESET remains separate from alarm ACK/CLEAR and from stored trip/event evidence;
• relay RESET is separate equipment authority from the virtual test-set source.

Manual timing examples

51N-operated case:

T0 → RELAY ANY PU [51N] 2.500 → TESTSET BI2 ACCEPT 5.050 → 51N TRIP 402.000 → TESTSET BI1 ACCEPT 406.550 ms

Case where 51N picks up first but 50P-1 operates later:

T0 → RELAY ANY PU [51N] … → TESTSET BI2 ACCEPT 4.550 → 50P-1 PU 11.250 → 50P-1 TRIP 71.250 → TESTSET BI1 ACCEPT 75.750 ms

Validation — final head 3f37c97f8e

.NET CI run 31316875569:

• Release build: 0 warnings / 0 errors
• Capture: 5 / 5
• Protection: 276 / 276
• Application: 71 / 71
• ProcessBus: 51 / 51
• total: 403 / 403 passed
• NuGet vulnerability audit: clean
• older/pre-control ARIEC61850 compatibility compile: passed

CodeQL run 31316875589:

• C# build/analyze: passed

Desktop release run 31316875594:

• protection core Windows: passed
• protection core macOS: passed
• protection core Ubuntu: passed
• Windows restore/build/tests/audit: passed
• installer + portable packages: passed
• no-admin + single-file contract: passed
• release-candidate upload: passed
• validation-only build: passed

All existing inline review threads are resolved; no current requested-changes review is present.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ececea6346

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".