Controllers publish MQTT over TLS to Azure IoT Hub, which authenticates each device with its own revocable identity and routes messages onto Event Hubs by message type. Event Hubs holds every accepted message for 72 hours regardless of whether anything downstream is reading — so a worker restart, a redeploy or a brief database outage costs nothing. The ingestion worker consumes at its own pace from its last checkpoint and catches up.

Every frame is written twice in one pass: once verbatim as JSONB (the contract with the hardware vendor, and the replay source if a mapping bug is ever found) and once parsed into typed, indexed tables for run data, base data and per-device EMS telemetry. Dashboards get indexed numeric columns instead of JSON scans; the business keeps a byte-exact audit record.

Rather than fighting for exactly-once semantics, every insert deduplicates on the vendor's message identifier with a unique constraint and an on-conflict-do-nothing write. Replays after a crash become no-ops by construction. Unparseable frames are diverted to a dead-letter table with the error text, so a single poison message can never block the stream.

Ingestion runs as a headless .NET Worker Service container with no HTTP surface; the REST API runs as a separate container serving web and mobile clients. They deploy, scale and fail independently, sharing one PostgreSQL database through two schemas — one owned by the worker, one managed by Entity Framework for the tenant, site, controller and device hierarchy.

The platform tracks last-seen time and cloud-link status per controller, detects missed heartbeats against a configurable interval, and raises offline and recovery events. Because device clocks proved unreliable in the field, liveness is judged on broker-side sequence and enqueue time rather than on any timestamp the device reports.

Commands move through issue, validate, dispatch, acknowledge and complete as distinct states. A configuration-driven registry whitelists every command code and validates each parameter by type, range and enum before anything leaves the cloud. Acknowledgement and result messages return on a dedicated stream; a timeout monitor forces a deterministic terminal state when they do not. Every transition is written to an append-only event log, with idempotency by request ID and one in-flight command per device.

Physical actuation ships disabled. Only mock commands run until the hardware manufacturer delivers a signed-off contract covering command codes, parameter ranges, safety limits and readback rules. Real commands are then enabled individually — never as a blanket switch — so the message path could be fully proven in production without any risk to live energy equipment.

A dedicated simulator impersonates the controller using raw MQTT rather than the Azure SDK, exercising the exact contract the real hardware implements — including a mock command responder. Scheduled jobs publish realistic run, base and per-device frames, while a parallel reader confirms arrival, so publish and ingest can be watched side by side without any field hardware.