fix(communication): cancel-only CTS replacement, deferred channel disposal, single-endpoint debug stream (arch-review 2026-08-19 P3-1 + P3-2 + P3-3)

tests/ZB.MOM.WW.ScadaBridge.Communication.Tests/Grpc/SiteStreamGrpcClientTests.cs

@@ -677,26 +677,91 @@ public class SiteStreamGrpcClientTests
     // --- Communication-003 regression tests ---
 
     [Fact]
-    public void RegisterSubscription_ReusedCorrelationId_CancelsAndDisposesPriorCts()
+    public void RegisterSubscription_ReusedCorrelationId_CancelsPriorCts_WithoutDisposingIt()
     {
         // Two SubscribeAsync calls briefly sharing a correlation ID (reconnect race).
-        // Inserting the second must cancel + dispose the first so it does not leak.
+        // Inserting the second must CANCEL the first — and must NOT dispose it (arch-review
+        // 2026-08-19 P3-1, re-pinning the earlier cancel-AND-dispose contract): the prior
+        // handler's ConsumeStreamAsync is still running and still reads prior.Token, so
+        // disposing from the replacing path throws ObjectDisposedException inside that loop.
+        // The owning SubscribeAsync/SubscribeSiteAsync disposes it as its loop unwinds.
         var client = SiteStreamGrpcClient.CreateForTesting();
 
-        var first = new CancellationTokenSource();
-        var second = new CancellationTokenSource();
+        using var first = new CancellationTokenSource();
+        using var second = new CancellationTokenSource();
 
         client.RegisterSubscription("corr-shared", first);
         client.RegisterSubscription("corr-shared", second);
 
         Assert.True(first.IsCancellationRequested);
-        // Disposed CTS throws ObjectDisposedException when its token is touched.
-        Assert.Throws<ObjectDisposedException>(() => _ = first.Token);
+        // Still usable by the prior handler that owns it — no ObjectDisposedException.
+        Assert.True(first.Token.IsCancellationRequested);
 
         // The second (live) CTS must remain intact.
         Assert.False(second.IsCancellationRequested);
     }
 
+    [Fact]
+    public void RegisterSubscription_ReplacingAnAlreadyDisposedPriorCts_DoesNotThrowIntoTheNewSubscription()
+    {
+        // The prior handler's loop already unwound and disposed its own CTS while a replacement
+        // subscription is registering. The unguarded prior.Cancel() threw ObjectDisposedException
+        // straight out of the NEW SubscribeAsync, which reads it as a fault of the CURRENT
+        // generation and burns a reconnect on a phantom failure.
+        var client = SiteStreamGrpcClient.CreateForTesting();
+
+        var prior = new CancellationTokenSource();
+        client.RegisterSubscription("corr-shared", prior);
+        prior.Dispose();
+
+        using var replacement = new CancellationTokenSource();
+        client.RegisterSubscription("corr-shared", replacement);
+
+        // The replacement owns the slot and is untouched.
+        Assert.False(replacement.IsCancellationRequested);
+        client.Unsubscribe("corr-shared");
+        Assert.True(replacement.IsCancellationRequested);
+    }
+
+    [Fact]
+    public void Unsubscribe_AfterClientDisposal_IsANoOp()
+    {
+        // Disposal cancels every live subscription and clears the map; a late Unsubscribe from
+        // the consuming actor's teardown must not throw (an ObjectDisposedException here used to
+        // escape into the caller's cleanup path).
+        var client = SiteStreamGrpcClient.CreateForTesting();
+        using var cts = new CancellationTokenSource();
+        client.AddSubscriptionForTesting("corr-1", cts);
+
+        client.Dispose();
+        Assert.True(cts.IsCancellationRequested);
+
+        client.Unsubscribe("corr-1");
+        client.Unsubscribe("never-registered");
+    }
+
+    [Fact]
+    public void Dispose_WithAnAlreadyDisposedSubscriptionCts_StillCancelsTheRest()
+    {
+        // ReleaseResources iterated the live CTSes unguarded, so one already-disposed entry
+        // aborted the whole loop — leaving later subscriptions uncancelled AND (via the
+        // exception escaping into SiteStreamGrpcClientFactory's disposal loop) later clients'
+        // channels undisposed.
+        var client = SiteStreamGrpcClient.CreateForTesting();
+
+        var disposedEarly = new CancellationTokenSource();
+        using var live = new CancellationTokenSource();
+        client.AddSubscriptionForTesting("corr-disposed", disposedEarly);
+        client.AddSubscriptionForTesting("corr-live", live);
+        disposedEarly.Dispose();
+
+        // Deterministic regardless of dictionary iteration order: the disposed entry is always
+        // visited, so the unguarded loop always threw out of Dispose().
+        Assert.Null(Record.Exception(client.Dispose));
+
+        Assert.True(live.IsCancellationRequested);
+    }
+
     [Fact]
     public void RemoveSubscription_OnlyRemovesOwnCts_NotAReplacement()
     {