P0: reject orphan confirmed MMS results before negotiated pipelining

[masarray]

Baseline and evidence

• Exact base 8fba05d19e02d94af333fae02313f7430a6696e1 (merged P0: surface measured discovery wire budget in native Workbench diagnostics #185; measured wire budgets in Workbench).
• Source audit: MmsAssociationRuntime::exchange_confirmed implements one synchronous send/receive owner. The invoke router could retain a confirmed response for an unexpected invoke ID while a different request was active, then return that old response before a later request was ever sent.
• A confirmed response observed by idle try_poll_once_for could likewise satisfy a not-yet-transmitted confirmed request. No existing negotiated-outstanding receive dispatcher safely assigns that response to an actual in-flight request.

Smallest safe change

• Remove the pre-send dequeue shortcut.
• Reject any pre-existing queued confirmed result before sending; fault and close the association rather than misrepresenting an unsent operation as successful.
• Reject any unexpected confirmed invoke ID during the serial exchange immediately, close the association, and preserve the per-exchange send receipt semantics.
• Document the existing single-flight association-owner contract; do not introduce naive parallel sends, new timers, polling, protocol writes, or competing receive paths.
• Existing InformationReport interleaving/TPKT buffered-frame tests remain in place.

Negative regression

• During an exchange: an unmatched confirmed response followed by the matching response must fault rather than caching a future false acknowledgement; transmitted request receipt stays true.
• Idle polling: an orphan confirmed response must not acknowledge a future unsent request; send receipt stays false and no new request appears on the wire.
• Existing report interleaving, timeout fault/reconnect, and association lifecycle regression must remain green.

Scope and acceptance

Portable MMS runtime + focused unit test only. No changes to Workbench GUI, ARStack Studio, firmware, or physical IED tests. This is a precondition for future negotiated-outstanding pipeline design, not a concurrent pipeline implementation or a measured speedup. Require exact-head C++ CI, native regression where path-scoped, Product Naming Guard, and review/merge gate before integration.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T00:40:31.780262Z	882dd30	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[masarray]

Runtime ownership audit — exact head 882dd307a2452ca3c0d62f9d3779e8588a5dc7db

Checked src/mms/association_runtime.cpp, src/mms/association_runtime_control_wait.cpp, src/mms/invoke_router.cpp, src/mms/live_discovery.cpp, and tests/test_mms_runtime.cpp:

• Socket receive is executed inline by receive_application_payload, called from association setup, synchronous exchange_confirmed, blocking poll_once, and bounded try_poll_once_for. No single independent receive dispatcher or concurrent confirmed request writer exists.
• The MmsInvokeRouter is mutex-protected as a queue but does not make the surrounding socket, TPKT decoder, COTP reassembly, or association state thread-safe. Naive std::async discovery is unsafe.
• The negotiated maximum_outstanding_calling is recorded from MMS Initiate-Response, but current serial discovery does not operate a dispatcher/window limited to that number.
• InformationReport is queued in its own bounded queue and allowed to interleave with a synchronous confirmed exchange; existing tests cover this and coalesced TPKT frames.
• exchange_confirmed cancellation/timeout faults and closes association; try_poll_once_for treats application timeout as nonfatal and propagates cancellation. These semantics should be preserved.
• Before this fix, a confirmed response for another invoke ID could accumulate and satisfy a later unsent request. This slice rejects such orphan responses rather than enabling unsafe concurrency.

Next architectural prerequisite (not implemented in this PR): an association-owned receive/send dispatcher, exact registered invoke-ID lifecycle, negotiated bounded outstanding window, serialized complete-frame writes, per-continuation pagination ordering, report routing, cancellation/reconnect generation fences, and model parity + wire-budget benchmark.

Merge gate: Only exact-head completed, successful path-relevant checks; preserve existing installer/physical IED acceptance as independent and not yet verified. No speedup claimed.