[masarray]

Scope

Stacked on Phase 4D-C3. Complete the first end-to-end C# smart-control parity slice on top of the existing live MMS association runtime, without touching the separate ESP32-P4/Sampled Values work.

Live descriptor discovery

• require an active MMS association
• read live ctlModel and reject status-only/unknown
• require exact Oper GVAA / TypeSpecification
• require a named ctlVal; positional guessing is refused
• for SBO enhanced, require exact SBOw TypeSpecification and compatible ctlVal
• probe Cancel TypeSpecification; it is mandatory for models that require Select
• discover domain variables and read CF sboTimeout / operTimeout when exposed, otherwise use 10 s fallbacks
• status reference priority matches the C# oracle: ST stVal, ST posVal, MX mag.f, MX mag.i
• infer SPC/DPC/BSC/APC/INC-ISC/vendor-specific CDC conservatively

Guarded session orchestration

• Direct normal: exactly one Oper Write; MMS acceptance is the normal-security completion boundary
• SBO normal: Read SBO, validate returned object/token, retain one immutable sequence, then exactly one Oper Write
• SBO enhanced: clear stale report queue, exactly one SBOw Write, observe asynchronous LastApplError grace window, retain immutable sequence only on acceptance
• AutoSelect follows the discovered ctlModel
• stale/mismatched selection triggers best-effort Cancel instead of Oper
• Cancel writes the exact retained ctlVal/origin/ctlNum/T/Test/Check sequence and always releases local ownership
• enhanced Oper clears stale reports before the one Write and waits only for a correlated C3 CommandTermination
• ordinary ST/MX reports cannot complete enhanced control
• missing termination returns control timeout while keeping a healthy association intact
• association loss is reported separately
• time-activated Oper is accepted only when live Oper exposes operTm
• no automatic command retry anywhere
• authorization remains default-deny through the C1 guarded policy

MMS association runtime improvement

Adds try_poll_once_for(timeout, ...): transport timeout is an application-level false result and does not fault the association. This is required so a missing CommandTermination does not destroy an otherwise healthy MMS session. Existing poll_once() behavior is unchanged.

Production adapter

MmsAssociationControlTransport maps the control workflow onto existing Read/GVAA/GetNameList/Write codecs and the existing MmsAssociationRuntime InformationReport queue.

Normal core integration

C1-C4 control sources are now part of ARIEC61850::core, not isolated profile-only code. Normal repository CTest also includes:

• live-TypeSpecification/golden-wire control structure tests
• CommandTermination/LastApplError parity tests
• smart-control discovery/session tests

This makes the control path subject to the normal GCC/Clang/MSVC and sanitizer build/test matrix in addition to the dedicated control profiles.

Dedicated validation

Strict GCC/Clang control profiles prove:

• default-deny safety planner, ownership, immutable sequence, timeout, Cancel and enhanced busy-until-termination semantics
• exact Oper/SBOw/Cancel live-TypeSpecification binding and golden MMS Data bytes
• CommandTermination/LastApplError object correlation and full standard AddCause mapping
• descriptor discovery, Direct one-write behavior, SBO Read->Oper, AutoSelect, stale-selection Cancel, SBOw application-error window, enhanced positive/negative completion and non-fatal command timeout
• production association adapter strict compile validation

Remaining acceptance

• complete the repository-wide final-head CI matrix after normal-core integration
• run controlled physical IED interoperability for Direct normal, SBO normal, Direct enhanced and SBO enhanced on a non-operational lab target
• retain PCAP/event evidence proving exactly one command Write per action and no automatic retry

No physical command or IEC 61850 conformance claim is made by hosted CI. Sampled Values / ESP32-P4 work remains intentionally out of scope.

[masarray]

Closing as superseded by #43, which integrated Smart Control C1–C5 onto current main and carried the live association/session behavior forward. This stacked C4 tranche is no longer the active path.