fix(centralui): close register row 103 — take-once session/timer discipline for TransportImport + Topology (P6-6 lesser instances)

Mirrors the Medium wave's DebugView P6-6 fix (_sessionLock + _disposed,
publish-then-recheck-disposal under one lock) for the two TTL-bounded/
unbounded lesser instances the Medium wave deferred:

- TransportImport.razor.cs: TryLoadAsync awaits IBundleImporter.LoadAsync and
  used to publish the result into _session unconditionally. A circuit torn
  down mid-await left Dispose() with nothing to release (session still null),
  so the freshly-opened server-side BundleSession stayed registered, stranding
  one of MaxConcurrentImportSessions (register row 43) for the full session
  TTL. Now publishes and re-checks disposal atomically under _sessionLock, so
  exactly one side (TryLoadAsync or Dispose) abandons the session.

- Topology.razor: OnInitializedAsync awaits LoadDataAsync before calling
  StartLiveUpdatesTimer. A circuit torn down mid-await left Dispose() with no
  timer to stop yet, so the timer StartLiveUpdatesTimer creates once the await
  resumes was never disposed — it ticked against a torn-down component every
  15s until process restart. StartLiveUpdatesTimer/StopLiveUpdatesTimer/
  Dispose now create/replace/take the timer atomically under _timerLock
  together with a _disposed check, so a late-arriving (re)start refuses to
  create a timer once disposed.

Tests (bUnit, both proven to fail against the unfixed code):
- TransportImportSessionDisposeRaceTests: dispose-during-load abandons the
  just-opened session immediately; dispose-after-successful-load abandons
  exactly once.
- TopologyLiveUpdatesTimerDisposeRaceTests: a late StartLiveUpdatesTimer call
  after Dispose leaves no live timer; Dispose stops the timer exactly once
  (idempotent double-dispose); OnLiveUpdatesToggled(off) + Dispose leaves no
  live timer. All assert on deterministic field/call-order state, no sleeps.

Register row 103 stays open for integration to close per the plan's shared
constraints (register edits happen at integration only).

src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Pages/Deployment/Topology.razor

@@ -160,6 +160,21 @@
     private Timer? _liveUpdatesTimer;
     private static readonly TimeSpan LiveUpdatesInterval = TimeSpan.FromSeconds(15);
 
+    /// <summary>
+    /// Guards <see cref="_liveUpdatesTimer"/> together with <see cref="_disposed"/>
+    /// (register row 103, the P6-6 lesser instance — mirrors <c>DebugView</c>'s
+    /// <c>_sessionLock</c>). <see cref="OnInitializedAsync"/> awaits
+    /// <see cref="LoadDataAsync"/> before calling <see cref="StartLiveUpdatesTimer"/>; the
+    /// circuit can be torn down inside that window, and <c>Dispose</c> may run on a
+    /// non-UI thread, so creating/replacing the timer and observing disposal must be one
+    /// atomic step — otherwise a timer created after <c>Dispose</c> already ran is never
+    /// disposed and ticks forever against a torn-down component.
+    /// </summary>
+    private readonly object _timerLock = new();
+
+    /// <summary>Set once <see cref="Dispose"/> has run; checked under <see cref="_timerLock"/>.</summary>
+    private volatile bool _disposed;
+
     private TreeView<TopoNode> _tree = default!;
     private object? _selectedKey;
     private const string SelectedKeyStorage = "topology-tree-selected";
@@ -194,23 +209,51 @@
         StartLiveUpdatesTimer();
     }
 
+    /// <summary>
+    /// (Re)creates the live-update timer, or leaves none running when disposed / live
+    /// updates are off. Register row 103: creation and disposal of any timer this method
+    /// is replacing both happen under <see cref="_timerLock"/> together with the
+    /// <see cref="_disposed"/> check, so a call that resumes after <see cref="Dispose"/>
+    /// already ran refuses to create a new timer instead of leaking one.
+    /// </summary>
     private void StartLiveUpdatesTimer()
     {
-        _liveUpdatesTimer?.Dispose();
+        Timer? old;
-        if (!_liveUpdates) return;
+        lock (_timerLock)
-        _liveUpdatesTimer = new Timer(_ =>
         {
-            InvokeAsync(async () =>
+            old = _liveUpdatesTimer;
+            _liveUpdatesTimer = null;
+            if (!_disposed && _liveUpdates)
+            {
+                _liveUpdatesTimer = new Timer(
+                    OnLiveUpdatesTick, null, LiveUpdatesInterval, LiveUpdatesInterval);
+            }
+        }
+        old?.Dispose();
+    }
+
+    private void OnLiveUpdatesTick(object? state)
+    {
+        if (_disposed) return;
+        InvokeAsync(async () =>
+        {
+            if (_disposed || !_liveUpdates) return;
+            try
             {
-                if (!_liveUpdates) return;
                 // Staleness is deliberately OFF the live loop: it only changes when a
                 // template/instance is edited or redeployed, and recomputing it (a
                 // full re-flatten per deployed instance) every 15s is the page's
                 // dominant cost. The poll refreshes only the cheap deployed state.
                 await LoadDeployedStateAsync();
+                if (_disposed) return;
                 StateHasChanged();
-            });
+            }
-        }, null, LiveUpdatesInterval, LiveUpdatesInterval);
+            catch (ObjectDisposedException)
+            {
+                // Component disposed between the guard and the dispatch — ignore
+                // (mirrors DebugView's SafeInvokeAsync / CentralUI-009).
+            }
+        });
     }
 
     private void OnLiveUpdatesToggled(ChangeEventArgs e)
@@ -222,14 +265,37 @@
         }
         else
         {
-            _liveUpdatesTimer?.Dispose();
+            StopLiveUpdatesTimer();
-            _liveUpdatesTimer = null;
         }
     }
 
+    private void StopLiveUpdatesTimer()
+    {
+        Timer? timer;
+        lock (_timerLock)
+        {
+            timer = _liveUpdatesTimer;
+            _liveUpdatesTimer = null;
+        }
+        timer?.Dispose();
+    }
+
+    /// <summary>
+    /// Register row 103: the flag is set and the timer taken under the same lock
+    /// <see cref="StartLiveUpdatesTimer"/> creates through, so a still-pending
+    /// <see cref="OnInitializedAsync"/> either hands its new timer over here (never
+    /// created) or this method has nothing left to dispose — never both create AND leak.
+    /// </summary>
     public void Dispose()
     {
-        _liveUpdatesTimer?.Dispose();
+        Timer? timer;
+        lock (_timerLock)
+        {
+            _disposed = true;
+            timer = _liveUpdatesTimer;
+            _liveUpdatesTimer = null;
+        }
+        timer?.Dispose();
     }
 
     protected override async Task OnAfterRenderAsync(bool firstRender)

src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Pages/Design/TransportImport.razor.cs

@@ -110,6 +110,20 @@ public partial class TransportImport : ComponentBase, IDisposable
     private BundleSession? _session;
     private bool _uploadInProgress;
 
+    /// <summary>
+    /// Guards <see cref="_session"/> together with <see cref="_disposed"/> (register row
+    /// 103, the P6-6 lesser instance — mirrors <c>DebugView</c>'s <c>_sessionLock</c>).
+    /// <see cref="TryLoadAsync"/> awaits <see cref="IBundleImporter.LoadAsync"/>, and the
+    /// circuit can be torn down inside that window; publishing the freshly-opened session
+    /// and observing disposal must be one atomic step so exactly one side (this method or
+    /// <see cref="Dispose"/>) releases it — otherwise the session is neither published nor
+    /// abandoned and strands one of <c>MaxConcurrentImportSessions</c> for the full TTL.
+    /// </summary>
+    private readonly object _sessionLock = new();
+
+    /// <summary>Set once <see cref="Dispose"/> has run; checked under <see cref="_sessionLock"/>.</summary>
+    private volatile bool _disposed;
+
     // Staging directory for in-flight bundle uploads. Lives under the system
     // temp directory rather than wwwroot/ because the file is never served to
     // a browser — it is only read by the in-process IBundleImporter.
@@ -241,8 +255,25 @@ public partial class TransportImport : ComponentBase, IDisposable
             using var stream = new FileStream(
                 _bundleTempPath, FileMode.Open, FileAccess.Read, FileShare.Read,
                 bufferSize: 81920, useAsync: true);
-            _session = await BundleImporter.LoadAsync(
+            var loaded = await BundleImporter.LoadAsync(
                 stream, passphrase, CancellationToken.None, ClientAddress.ClientAddress);
+
+            // Register row 103 (P6-6 lesser instance): the component may have been
+            // disposed while LoadAsync was in flight (navigation away mid-upload).
+            // Publish and re-check disposal atomically under _sessionLock so exactly
+            // one side tears the freshly-opened session down.
+            bool abandoned;
+            lock (_sessionLock)
+            {
+                abandoned = _disposed;
+                if (!abandoned) _session = loaded;
+            }
+            if (abandoned)
+            {
+                try { BundleImporter.Abandon(loaded.SessionId); } catch { /* best-effort */ }
+                return;
+            }
+
             _errorMessage = null;
         }
         catch (ArgumentException)
@@ -921,8 +952,12 @@ public partial class TransportImport : ComponentBase, IDisposable
     /// </summary>
     private void ReleaseSession()
     {
-        var session = _session;
+        BundleSession? session;
-        _session = null;
+        lock (_sessionLock)
+        {
+            session = _session;
+            _session = null;
+        }
         if (session is null) return;
         try
         {
@@ -938,10 +973,26 @@ public partial class TransportImport : ComponentBase, IDisposable
     /// Ensures neither the staged temp file nor the server-side bundle session
     /// survives circuit teardown. Blazor invokes Dispose when the user navigates
     /// away or the circuit ends, so an abandoned wizard cleans up automatically.
+    /// <para>
+    /// Register row 103: the flag is set and the session taken under the same lock
+    /// <see cref="TryLoadAsync"/> publishes through, so a <see cref="TryLoadAsync"/> still
+    /// awaiting <see cref="IBundleImporter.LoadAsync"/> either hands the session over here
+    /// or abandons it itself — never neither (mirrors <c>DebugView</c>'s P6-6 fix).
+    /// </para>
     /// </summary>
     public void Dispose()
     {
-        ReleaseSession();
+        BundleSession? session;
+        lock (_sessionLock)
+        {
+            _disposed = true;
+            session = _session;
+            _session = null;
+        }
+        if (session is not null)
+        {
+            try { BundleImporter.Abandon(session.SessionId); } catch { /* best-effort */ }
+        }
         DeleteBundleTempFile();
     }
 }

tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/Pages/Design/TransportImportSessionDisposeRaceTests.cs

@@ -0,0 +1,227 @@
+using System.Reflection;
+using System.Security.Claims;
+using Bunit;
+using Microsoft.AspNetCore.Components.Authorization;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Diagnostics;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
+using ZB.MOM.WW.ScadaBridge.CentralUI.Auth;
+using ZB.MOM.WW.ScadaBridge.Commons.Entities.Sites;
+using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories;
+using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services;
+using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Transport;
+using ZB.MOM.WW.ScadaBridge.Commons.Types.Transport;
+using ZB.MOM.WW.ScadaBridge.ConfigurationDatabase;
+using ZB.MOM.WW.ScadaBridge.Security;
+using ZB.MOM.WW.ScadaBridge.Transport;
+using ZB.MOM.WW.ScadaBridge.Transport.Import;
+using NSubstitute;
+using TransportImportPage = ZB.MOM.WW.ScadaBridge.CentralUI.Components.Pages.Design.TransportImport;
+
+namespace ZB.MOM.WW.ScadaBridge.CentralUI.Tests.Pages.Design;
+
+/// <summary>
+/// Regression tests for register row 103 (the P6-6 lesser instance in
+/// <c>TransportImport</c>). <c>TryLoadAsync</c> awaits
+/// <see cref="IBundleImporter.LoadAsync"/>, then used to publish the result into
+/// <c>_session</c> unconditionally. If the circuit was torn down inside that await
+/// (user navigates away mid-upload), <c>Dispose</c> would have already run, found
+/// <c>_session</c> still null, and released nothing — so the freshly-opened server-side
+/// <c>BundleSession</c> stayed registered, stranding one of
+/// <c>TransportOptions.MaxConcurrentImportSessions</c> (register row 43) for the full
+/// session TTL. The fix publishes the session and re-checks disposal under one lock
+/// (<c>_sessionLock</c>), mirroring <c>DebugView</c>'s P6-6 fix, so exactly one side
+/// (this method or <c>Dispose</c>) abandons it.
+/// </summary>
+public class TransportImportSessionDisposeRaceTests : BunitContext
+{
+    /// <summary>
+    /// A real <see cref="BundleSessionStore"/>-backed <see cref="IBundleImporter"/> whose
+    /// <see cref="LoadAsync"/> can be held open on demand, so the dispose-during-load
+    /// window is deterministic rather than timing-dependent. Mirrors
+    /// <c>DebugViewConnectDisposeRaceTests.GatedDebugStreamService</c>.
+    /// </summary>
+    private sealed class GatedImporter : IBundleImporter
+    {
+        private readonly TaskCompletionSource _gate = new(TaskCreationOptions.RunContinuationsAsynchronously);
+        private readonly TaskCompletionSource _entered = new(TaskCreationOptions.RunContinuationsAsynchronously);
+        private readonly List<Guid> _abandoned = new();
+
+        public BundleSessionStore Store { get; } = new(
+            Options.Create(new TransportOptions()), TimeProvider.System);
+
+        /// <summary>Completes once <see cref="LoadAsync"/> has been entered.</summary>
+        public Task Entered => _entered.Task;
+
+        /// <summary>Session ids passed to <see cref="Abandon"/>, in call order.</summary>
+        public IReadOnlyList<Guid> Abandoned
+        {
+            get { lock (_abandoned) { return _abandoned.ToList(); } }
+        }
+
+        public void ReleaseLoad() => _gate.TrySetResult();
+
+        public async Task<BundleSession> LoadAsync(
+            Stream bundleStream, string? passphrase, CancellationToken ct = default, string? clientKey = null)
+        {
+            _entered.TrySetResult();
+            await _gate.Task;
+
+            var session = new BundleSession
+            {
+                SessionId = Guid.NewGuid(),
+                Manifest = new BundleManifest(
+                    BundleFormatVersion: 1,
+                    SchemaVersion: "1.0",
+                    CreatedAtUtc: DateTimeOffset.UtcNow,
+                    SourceEnvironment: "prod-cluster",
+                    ExportedBy: "bob",
+                    ScadaBridgeVersion: "1.0.0",
+                    ContentHash: "sha256:0000",
+                    Encryption: null,
+                    Summary: new BundleSummary(0, 0, 0, 0, 0, 0, 0, 0),
+                    Contents: Array.Empty<ManifestContentEntry>()),
+                // Non-zero bytes so a zeroing assertion (if ever added) is meaningful.
+                DecryptedContent = new byte[] { 0x11, 0x22, 0x33, 0x44 },
+                ExpiresAt = DateTimeOffset.UtcNow.AddMinutes(30),
+            };
+            return Store.Open(session);
+        }
+
+        public Task<ImportPreview> PreviewAsync(Guid sessionId, CancellationToken ct = default)
+            => throw new NotSupportedException("Not exercised by these tests.");
+
+        public Task<ImportResult> ApplyAsync(
+            Guid sessionId,
+            IReadOnlyList<ImportResolution> resolutions,
+            string user,
+            CancellationToken ct = default,
+            BundleNameMap? nameMap = null)
+            => throw new NotSupportedException("Not exercised by these tests.");
+
+        public void Abandon(Guid sessionId)
+        {
+            lock (_abandoned) { _abandoned.Add(sessionId); }
+            var session = Store.Get(sessionId);
+            if (session is { DecryptedContent.Length: > 0 })
+            {
+                Array.Clear(session.DecryptedContent, 0, session.DecryptedContent.Length);
+            }
+            Store.Remove(sessionId);
+        }
+    }
+
+    private readonly GatedImporter _importer = new();
+    private readonly ISiteRepository _siteRepo = Substitute.For<ISiteRepository>();
+    private const string TestClientIp = "203.0.113.7";
+
+    public TransportImportSessionDisposeRaceTests()
+    {
+        JSInterop.Mode = JSRuntimeMode.Loose;
+
+        Services.AddSingleton<IBundleImporter>(_importer);
+        Services.AddSingleton(Substitute.For<IAuditService>());
+        Services.AddSingleton(new CircuitClientAddressProvider(TestClientIp));
+
+        _siteRepo.GetAllSitesAsync(Arg.Any<CancellationToken>()).Returns(Array.Empty<Site>());
+        Services.AddSingleton(_siteRepo);
+        Services.AddSingleton<IOptions<TransportOptions>>(
+            Options.Create(new TransportOptions
+            {
+                MaxBundleSizeMb = 10,
+                MaxUnlockAttemptsPerSession = 3,
+            }));
+
+        var dbOptions = new DbContextOptionsBuilder<ScadaBridgeDbContext>()
+            .UseSqlite("DataSource=:memory:")
+            .ConfigureWarnings(w => w.Ignore(RelationalEventId.AmbientTransactionWarning))
+            .Options;
+        var dbContext = new ScadaBridgeDbContext(dbOptions);
+        dbContext.Database.OpenConnection();
+        dbContext.Database.EnsureCreated();
+        Services.AddSingleton(dbContext);
+
+        var claims = new List<Claim> { new(JwtTokenService.UsernameClaimType, "alice") };
+        var principal = new ClaimsPrincipal(new ClaimsIdentity(claims, "TestAuth"));
+        Services.AddSingleton<AuthenticationStateProvider>(new TestAuthStateProvider(principal));
+        Services.AddAuthorizationCore();
+    }
+
+    private static void SetField(object obj, string name, object? value) =>
+        obj.GetType().GetField(name, BindingFlags.Instance | BindingFlags.NonPublic | BindingFlags.Public)!
+            .SetValue(obj, value);
+
+    private static T GetField<T>(object obj, string name) =>
+        (T)obj.GetType().GetField(name, BindingFlags.Instance | BindingFlags.NonPublic | BindingFlags.Public)!
+            .GetValue(obj)!;
+
+    /// <summary>Stages a temp bundle file and points the wizard's <c>_bundleTempPath</c> at it.</summary>
+    private static string StageBundleFile()
+    {
+        var dir = Path.Combine(Path.GetTempPath(), "scadabridge-transport-staging");
+        Directory.CreateDirectory(dir);
+        var path = Path.Combine(dir, $"test-{Guid.NewGuid():N}.scadabundle");
+        File.WriteAllBytes(path, new byte[] { 0x01, 0x02, 0x03 });
+        return path;
+    }
+
+    /// <summary>
+    /// Starts <c>TryLoadAsync</c> on the renderer's dispatcher (where it really runs) and
+    /// hands back its task without awaiting it, so the test can act inside the load window.
+    /// Mirrors <c>DebugViewConnectDisposeRaceTests.StartConnectAsync</c>.
+    /// </summary>
+    private static async Task<Task> StartTryLoadAsync(IRenderedComponent<TransportImportPage> cut)
+    {
+        var method = typeof(TransportImportPage).GetMethod(
+            "TryLoadAsync", BindingFlags.Instance | BindingFlags.NonPublic)!;
+        Task? task = null;
+        await cut.InvokeAsync(() => { task = (Task)method.Invoke(cut.Instance, new object?[] { null })!; });
+        return task!;
+    }
+
+    [Fact]
+    public async Task TryLoadAsync_DisposedMidLoad_AbandonsTheJustOpenedSession()
+    {
+        var cut = Render<TransportImportPage>();
+        SetField(cut.Instance, "_bundleTempPath", StageBundleFile());
+
+        var tryLoad = await StartTryLoadAsync(cut);
+        await _importer.Entered.WaitAsync(TimeSpan.FromSeconds(5));
+
+        // The user navigates away while LoadAsync is still in flight. Dispose runs off
+        // the renderer's thread, exactly as a circuit teardown can.
+        cut.Instance.Dispose();
+
+        _importer.ReleaseLoad();
+        await tryLoad.WaitAsync(TimeSpan.FromSeconds(10));
+
+        Assert.Single(_importer.Abandoned);
+        Assert.Null(GetField<object?>(cut.Instance, "_session"));
+        // The store must not still hold the session either — Abandon actually released it.
+        Assert.Null(_importer.Store.Get(_importer.Abandoned[0]));
+    }
+
+    [Fact]
+    public async Task TryLoadAsync_ThenDispose_AbandonsTheSessionExactlyOnce()
+    {
+        var cut = Render<TransportImportPage>();
+        SetField(cut.Instance, "_bundleTempPath", StageBundleFile());
+
+        // Normal path: the load completes while the component is very much alive.
+        _importer.ReleaseLoad();
+        var tryLoad = await StartTryLoadAsync(cut);
+        await tryLoad.WaitAsync(TimeSpan.FromSeconds(10));
+
+        Assert.Empty(_importer.Abandoned);
+        Assert.NotNull(GetField<object?>(cut.Instance, "_session"));
+
+        cut.Instance.Dispose();
+        Assert.Single(_importer.Abandoned);
+
+        // A second Dispose (bUnit tears the component down again at test end) must not
+        // abandon an already-released session a second time.
+        cut.Instance.Dispose();
+        Assert.Single(_importer.Abandoned);
+    }
+}

tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/TopologyLiveUpdatesTimerDisposeRaceTests.cs

@@ -0,0 +1,194 @@
+using System.Reflection;
+using System.Security.Claims;
+using Bunit;
+using Microsoft.AspNetCore.Components.Authorization;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Options;
+using NSubstitute;
+using ZB.MOM.WW.ScadaBridge.Commons.Entities.Instances;
+using ZB.MOM.WW.ScadaBridge.Commons.Entities.Sites;
+using ZB.MOM.WW.ScadaBridge.Commons.Entities.Templates;
+using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories;
+using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services;
+using ZB.MOM.WW.ScadaBridge.Commons.Entities.Deployment;
+using ZB.MOM.WW.ScadaBridge.Communication;
+using ZB.MOM.WW.ScadaBridge.DeploymentManager;
+using ZB.MOM.WW.ScadaBridge.Security;
+using ZB.MOM.WW.ScadaBridge.TemplateEngine.Services;
+using TopologyPage = ZB.MOM.WW.ScadaBridge.CentralUI.Components.Pages.Deployment.Topology;
+
+namespace ZB.MOM.WW.ScadaBridge.CentralUI.Tests;
+
+/// <summary>
+/// Regression tests for register row 103 (the P6-6 lesser instance in
+/// <c>Topology</c>). <c>OnInitializedAsync</c> awaits <c>LoadDataAsync</c> and only then
+/// calls <c>StartLiveUpdatesTimer</c>. If the circuit was torn down inside that await
+/// (user navigates away during the initial page load), the pre-fix <c>Dispose</c> would
+/// have already run and found <c>_liveUpdatesTimer</c> still null — a no-op — so the
+/// timer <c>StartLiveUpdatesTimer</c> creates once the await resumes is never disposed:
+/// it ticks against a torn-down component every 15s until process restart. The fix
+/// (mirroring <c>DebugView</c>'s P6-6 fix and <c>TransportImport</c>'s row-103 sibling
+/// fix) creates/replaces the timer and observes disposal atomically under
+/// <c>_timerLock</c>, so a (re)start that resumes after <c>Dispose</c> already ran
+/// refuses to create a new timer instead of leaking one.
+///
+/// <para>
+/// The race is reproduced deterministically by driving the exact call ORDER the async
+/// gap allows — <c>Dispose()</c> then a late-arriving <c>StartLiveUpdatesTimer()</c> —
+/// rather than by gating I/O and sleeping: <c>StartLiveUpdatesTimer</c> itself is
+/// synchronous, so once we control ordering there is nothing left to wait on. This is
+/// the "deterministic observation, never sleep-then-assert" style the shared plan
+/// constraints require: the assertion is a direct field-state check, not a timer tick.
+/// </para>
+/// </summary>
+public class TopologyLiveUpdatesTimerDisposeRaceTests : BunitContext
+{
+    private readonly ITemplateEngineRepository _repo = Substitute.For<ITemplateEngineRepository>();
+    private readonly ISiteRepository _siteRepo = Substitute.For<ISiteRepository>();
+    private readonly IDeploymentManagerRepository _deployRepo = Substitute.For<IDeploymentManagerRepository>();
+    private readonly IAuditService _audit = Substitute.For<IAuditService>();
+
+    public TopologyLiveUpdatesTimerDisposeRaceTests()
+    {
+        Services.AddSingleton(_repo);
+        Services.AddSingleton(_siteRepo);
+        Services.AddSingleton(_deployRepo);
+        Services.AddSingleton(Substitute.For<ZB.MOM.WW.ScadaBridge.DeploymentManager.IFlatteningPipeline>());
+        Services.AddSingleton(_audit);
+
+        var comms = new CommunicationService(
+            Options.Create(new CommunicationOptions()),
+            NullLogger<CommunicationService>.Instance);
+        Services.AddSingleton(comms);
+
+        Services.AddSingleton(new OperationLockManager());
+        Services.AddSingleton(Options.Create(new DeploymentManagerOptions
+        {
+            OperationLockTimeout = TimeSpan.FromSeconds(5)
+        }));
+        Services.AddSingleton(Options.Create(new CommunicationOptions()));
+        Services.AddSingleton<ILogger<DeploymentService>>(NullLogger<DeploymentService>.Instance);
+        Services.AddScoped<ZB.MOM.WW.ScadaBridge.TemplateEngine.Flattening.DiffService>();
+        Services.AddScoped<ZB.MOM.WW.ScadaBridge.TemplateEngine.Flattening.RevisionHashService>();
+        Services.AddSingleton<IDeploymentStatusNotifier>(
+            new DeploymentStatusNotifier(NullLogger<DeploymentStatusNotifier>.Instance));
+        Services.AddScoped<DeploymentService>();
+        Services.AddScoped<AreaService>();
+        Services.AddScoped<InstanceService>();
+
+        AddTestAuth();
+
+        Services.AddScoped<ZB.MOM.WW.ScadaBridge.CentralUI.Components.Shared.IDialogService,
+            ZB.MOM.WW.ScadaBridge.CentralUI.Components.Shared.DialogService>();
+        Services.AddScoped<ZB.MOM.WW.ScadaBridge.CentralUI.Auth.SiteScopeService>();
+
+        JSInterop.Setup<string?>("treeviewStorage.load", _ => true).SetResult(null);
+        JSInterop.SetupVoid("treeviewStorage.save", _ => true);
+
+        SeedEmptyRepos();
+    }
+
+    private void AddTestAuth()
+    {
+        var claims = new[]
+        {
+            new Claim(JwtTokenService.UsernameClaimType, "tester"),
+            new Claim(JwtTokenService.RoleClaimType, "Deployer")
+        };
+        var user = new ClaimsPrincipal(new ClaimsIdentity(claims, "TestAuth"));
+        Services.AddSingleton<AuthenticationStateProvider>(new TestAuthStateProvider(user));
+        Services.AddAuthorizationCore();
+    }
+
+    private void SeedEmptyRepos()
+    {
+        _siteRepo.GetAllSitesAsync(Arg.Any<CancellationToken>())
+            .Returns(Task.FromResult<IReadOnlyList<Site>>(new List<Site>()));
+        _repo.GetAllTemplatesAsync(Arg.Any<CancellationToken>())
+            .Returns(Task.FromResult<IReadOnlyList<Template>>(new List<Template>()));
+        _repo.GetAllInstancesAsync(Arg.Any<CancellationToken>())
+            .Returns(Task.FromResult<IReadOnlyList<Instance>>(new List<Instance>()));
+        _repo.GetAreasBySiteIdAsync(Arg.Any<int>(), Arg.Any<CancellationToken>())
+            .Returns(Task.FromResult<IReadOnlyList<Area>>(new List<Area>()));
+    }
+
+    private static void InvokePrivate(object obj, string name) =>
+        obj.GetType().GetMethod(name, BindingFlags.Instance | BindingFlags.NonPublic)!
+            .Invoke(obj, null);
+
+    private static T? GetField<T>(object obj, string name) =>
+        (T?)obj.GetType().GetField(name, BindingFlags.Instance | BindingFlags.NonPublic)!.GetValue(obj);
+
+    [Fact]
+    public void Render_StartsALiveTimer_Sanity()
+    {
+        // Baseline: the normal init path (fast/empty repos complete synchronously) leaves
+        // a running timer, so the race tests below start from a known non-null state.
+        var cut = Render<TopologyPage>();
+        Assert.NotNull(GetField<Timer?>(cut.Instance, "_liveUpdatesTimer"));
+        cut.Instance.Dispose();
+    }
+
+    [Fact]
+    public void StartLiveUpdatesTimer_ResumingAfterDispose_LeavesNoLiveTimer()
+    {
+        // Simulates: OnInitializedAsync is suspended awaiting LoadDataAsync; the user
+        // navigates away, so Dispose() runs (and, since no timer exists yet, has nothing
+        // to stop); the await then resumes and calls StartLiveUpdatesTimer() — the exact
+        // shape register row 103 flags for Topology (the P6-6 lesser instance).
+        var cut = Render<TopologyPage>();
+
+        // The normal init path already started a timer; dispose it first so the field is
+        // null going into the race exactly as it would be if OnInitializedAsync's await
+        // was still pending when Dispose ran (no timer created yet).
+        cut.Instance.Dispose();
+        Assert.Null(GetField<Timer?>(cut.Instance, "_liveUpdatesTimer"));
+
+        // The late-arriving continuation's call, happening strictly AFTER Dispose().
+        InvokePrivate(cut.Instance, "StartLiveUpdatesTimer");
+
+        // Post-fix: refuses to create a timer once disposed — nothing is leaked.
+        // Pre-fix: this assignment is unconditional, so the field would be non-null here
+        // (a live Timer nothing will ever dispose).
+        Assert.Null(GetField<Timer?>(cut.Instance, "_liveUpdatesTimer"));
+    }
+
+    [Fact]
+    public void Dispose_StopsTheLiveTimer_ExactlyOnce()
+    {
+        var cut = Render<TopologyPage>();
+        Assert.NotNull(GetField<Timer?>(cut.Instance, "_liveUpdatesTimer"));
+
+        cut.Instance.Dispose();
+        Assert.Null(GetField<Timer?>(cut.Instance, "_liveUpdatesTimer"));
+
+        // A second Dispose (bUnit tears the component down again at test end) must not
+        // throw (e.g. from double-disposing the same Timer) and must leave the slot null.
+        var ex = Record.Exception(() => cut.Instance.Dispose());
+        Assert.Null(ex);
+        Assert.Null(GetField<Timer?>(cut.Instance, "_liveUpdatesTimer"));
+    }
+
+    [Fact]
+    public void OnLiveUpdatesToggled_Off_ThenDispose_LeavesNoLiveTimer()
+    {
+        var cut = Render<TopologyPage>();
+        Assert.NotNull(GetField<Timer?>(cut.Instance, "_liveUpdatesTimer"));
+
+        // Turn live updates off via the toolbar handler (StopLiveUpdatesTimer path).
+        var toggleMethod = typeof(TopologyPage).GetMethod(
+            "OnLiveUpdatesToggled", BindingFlags.Instance | BindingFlags.NonPublic)!;
+        var changeArgsType = typeof(Microsoft.AspNetCore.Components.ChangeEventArgs);
+        var changeArgs = (Microsoft.AspNetCore.Components.ChangeEventArgs)Activator.CreateInstance(changeArgsType)!;
+        changeArgs.Value = false;
+        toggleMethod.Invoke(cut.Instance, new object?[] { changeArgs });
+
+        Assert.Null(GetField<Timer?>(cut.Instance, "_liveUpdatesTimer"));
+
+        var ex = Record.Exception(() => cut.Instance.Dispose());
+        Assert.Null(ex);
+        Assert.Null(GetField<Timer?>(cut.Instance, "_liveUpdatesTimer"));
+    }
+}