TEST ONLY: P0-A red behavioral reproduction (expected CI failure)

.github/workflows/dotnet-ci.yml

@@ -20,7 +20,9 @@ on:
       - "*.slnx"
       - "Directory.Build.props"
   pull_request:
-    branches: [ main ]
+    # The live ARSAS product pins PR #169 until targeted engine changes pass CI.
+    # Stacked engine PRs must run the exact same Windows build/test gate.
+    branches: [ main, feat/495-dataset-type-closure, fix/p10-9l-readonly-ctlmodel-probe ]
   workflow_dispatch:
 
 permissions:

src/AR.Iec61850.Simulation/MmsServer/MmsReportingRuntime.cs

@@ -1,4 +1,5 @@
 using System.Globalization;
+using System.Threading.Channels;
 using AR.Iec61850.Asn1;
 using AR.Iec61850.Mms;
 
@@ -192,6 +193,17 @@ public sealed class MmsAssociationReportingRuntime : IMmsAssociationRuntime, IDi
     private readonly Dictionary<string, Timer> _integrityTimers = new(StringComparer.OrdinalIgnoreCase);
     private readonly object _gate = new();
     private readonly CancellationTokenSource _cts = new();
+    // One FIFO per MMS association. A distinct Task.Run per report previously
+    // allowed send delegates to acquire the socket lock in a different order
+    // from the SqNum assignment, manufacturing on-wire discontinuities.
+    private readonly Channel<(MmsRcbRuntimeState State, byte Reason)> _sendQueue =
+        Channel.CreateUnbounded<(MmsRcbRuntimeState, byte)>(
+            new UnboundedChannelOptions
+            {
+                SingleReader = true,
+                SingleWriter = false,
+                AllowSynchronousContinuations = false
+            });
     private bool _disposed;
 
     public MmsAssociationReportingRuntime(
@@ -226,6 +238,12 @@ public MmsAssociationReportingRuntime(
                 IntgPd = (uint)Math.Max(0, rcb.IntegrityPeriodMs)
             };
         }
+
+        // One asynchronous worker is allocated per association, not per report.
+        // Capture the token here: a delayed worker must never access a CTS
+        // after Dispose() has disposed its source.
+        var senderToken = _cts.Token;
+        _ = Task.Run(() => DrainReportQueueAsync(senderToken));
     }
 
     public IReadOnlyCollection<MmsRcbRuntimeState> States => _states.Values;
@@ -414,6 +432,7 @@ public void Dispose()
             return;
 
         _disposed = true;
+        _sendQueue.Writer.TryComplete();
         _cts.Cancel();
         lock (_gate)
         {
@@ -449,21 +468,39 @@ private void QueueReport(MmsRcbRuntimeState state, byte reason)
         if (_disposed)
             return;
 
-        _ = Task.Run(async () =>
+        // Channel FIFO is the report ordering authority. No per-report Task.Run,
+        // no competing asynchronous socket writers and no silent report drop.
+        _sendQueue.Writer.TryWrite((state, reason));
+    }
+
+    private async Task DrainReportQueueAsync(CancellationToken cancellationToken)
+    {
+        try
         {
-            try
-            {
-                await SendReportAsync(state, reason, _cts.Token).ConfigureAwait(false);
-            }
-            catch (OperationCanceledException)
-            {
-                // Association closing.
-            }
-            catch (Exception ex) when (ex is IOException or ObjectDisposedException or System.Net.Sockets.SocketException or InvalidOperationException)
+            await foreach (var request in _sendQueue.Reader.ReadAllAsync(cancellationToken)
+                               .ConfigureAwait(false))
             {
-                _activity?.Invoke(state.MmsReference, false, $"InformationReport send failed: {ex.Message}");
+                try
+                {
+                    await SendReportAsync(request.State, request.Reason, cancellationToken)
+                        .ConfigureAwait(false);
+                }
+                catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+                {
+                    return;
+                }
+                catch (Exception ex) when (ex is IOException or ObjectDisposedException or
+                                           System.Net.Sockets.SocketException or InvalidOperationException)
+                {
+                    _activity?.Invoke(request.State.MmsReference, false,
+                        $"InformationReport send failed: {ex.Message}");
+                }
             }
-        }, CancellationToken.None);
+        }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+            // Association closing: pending reports are not sent on a dead socket.
+        }
     }
 
     private async Task SendReportAsync(MmsRcbRuntimeState state, byte reason, CancellationToken cancellationToken)

src/AR.Iec61850/Control/Iec61850ControlModels.cs

@@ -174,7 +174,9 @@ public sealed class Iec61850ControlObjectDescriptor
         ControlModel is not Iec61850ControlModel.StatusOnly and not Iec61850ControlModel.Unknown &&
         !string.IsNullOrWhiteSpace(ObjectReference) &&
         !string.IsNullOrWhiteSpace(CtlValSpecification.MmsType) &&
-        (!RequiresSelect || CancelSpecification != null) &&
+        // Normal SBO Select -> Operate does not depend on optional Cancel.
+        // Enhanced SBO still requires Cancel for sequence recovery.
+        (ControlModel != Iec61850ControlModel.SelectBeforeOperateEnhanced || CancelSpecification != null) &&
         (ControlModel != Iec61850ControlModel.SelectBeforeOperateEnhanced || SelectWithValueSpecification != null) &&
         (!IsEnhanced || SupportsCommandTermination);
 

src/AR.Iec61850/Control/Iec61850ControlSemanticResolver.cs

@@ -0,0 +1,106 @@
+using AR.Iec61850.Mms;
+
+namespace AR.Iec61850.Control;
+
+/// <summary>
+/// Resolves *command* semantics from a declared CDC and corroborating live MMS
+/// evidence. A primitive MMS type is an encoding, not permission to Operate.
+/// This is vendor-independent and never sends an MMS request.
+/// </summary>
+public static class Iec61850ControlSemanticResolver
+{
+    public static Iec61850ControlSemanticResolution Resolve(
+        Iec61850ControlObjectDescriptor descriptor,
+        string? declaredCdc,
+        string? declaredStatusReference = null)
+    {
+        ArgumentNullException.ThrowIfNull(descriptor);
+        var declared = (declaredCdc ?? string.Empty).Trim().ToUpperInvariant();
+        var inferred = (descriptor.Cdc ?? string.Empty).Trim().ToUpperInvariant();
+        var status = descriptor.StatusReference ?? string.Empty;
+        var mmsType = (descriptor.CtlValSpecification.MmsType ?? string.Empty).Trim().ToLowerInvariant();
+        var size = descriptor.CtlValSpecification.Size;
+        // A saved SCL/DataSet SPC can describe a process projection, not the
+        // command payload. Only an EXACT same-object ST step status plus a
+        // typed two-bit MMS ctlVal establishes live directional BSC authority.
+        // A bit-string alone (or a similarly named object) proves nothing.
+        var exactLiveBsc =
+            inferred == "BSC" &&
+            mmsType == "bit-string" && size == 2 &&
+            status.Equals(descriptor.ObjectReference + ".valWTr.posVal",
+                StringComparison.OrdinalIgnoreCase);
+        var supersededAdvisorySpc = declared == "SPC" && exactLiveBsc;
+        var cdc = supersededAdvisorySpc
+            ? "BSC"
+            : string.IsNullOrWhiteSpace(declared) ? inferred : declared;
+
+        Iec61850ControlSemanticResolution Deny(string reason)
+            => new(false, cdc, reason);
+
+        if (!descriptor.IsOperationallyReady)
+            return Deny("The live control descriptor or ctlModel is not operationally ready.");
+        if (string.IsNullOrWhiteSpace(status))
+            return Deny("No live status reference corroborates the control semantics.");
+
+        // A stale persisted feedback reference must not silently override a
+        // different live BSC status object when commands are involved.
+        if (cdc == "BSC" && !string.IsNullOrWhiteSpace(declaredStatusReference) &&
+            !string.Equals(declaredStatusReference.Trim(), status, StringComparison.OrdinalIgnoreCase))
+            return Deny("Declared BSC feedback reference disagrees with the live control descriptor.");
+
+        if (cdc != inferred &&
+            !(inferred == "INC/ISC" && cdc is "INC" or "ISC") &&
+            !(cdc == "DPC" && inferred == "SPC" && IsStandardPosition(descriptor.ObjectReference)))
+            return Deny($"Declared CDC '{cdc}' conflicts with live CDC evidence '{inferred}'.");
+
+        var statusIsStep = status.EndsWith(".valWTr.posVal", StringComparison.OrdinalIgnoreCase);
+        var statusIsState = status.EndsWith(".stVal", StringComparison.OrdinalIgnoreCase);
+        var supported = cdc switch
+        {
+            "BSC" => statusIsStep &&
+                     (mmsType is "integer" or "unsigned" ||
+                      (mmsType == "bit-string" && size == 2)),
+            "DPC" => statusIsState &&
+                     ((mmsType == "bit-string" && size == 2) ||
+                      (mmsType == "boolean" && IsStandardPosition(descriptor.ObjectReference))),
+            "SPC" => statusIsState && mmsType == "boolean",
+            "INC" or "ISC" => declared == cdc && statusIsState &&
+                               mmsType is "integer" or "unsigned" or "bcd",
+            "APC" => declared == "APC" &&
+                     (mmsType == "floating-point" || IsAnalogStructure(descriptor.CtlValSpecification)),
+            _ => false // Other CDCs require an independently audited typed codec.
+        };
+
+        if (!supported)
+            return Deny($"CDC '{cdc}' cannot be safely bound to live ctlVal '{descriptor.CtlValSpecification.Signature}' and status '{status}'.");
+
+        var provenance = supersededAdvisorySpc
+            ? " Saved/DataSet CDC=SPC was advisory and superseded by exact live BSC control evidence."
+            : string.Empty;
+        return new(true, cdc,
+            $"Verified CDC={cdc}; live ctlModel={descriptor.ControlModel}; ctlVal={descriptor.CtlValSpecification.Signature}; status={status}.{provenance}");
+    }
+
+    internal static bool IsStandardPosition(string reference)
+    {
+        var suffix = reference[(reference.LastIndexOf('/') + 1)..];
+        var dot = suffix.IndexOf('.');
+        if (dot <= 0 || !suffix[(dot + 1)..].Equals("Pos", StringComparison.OrdinalIgnoreCase))
+            return false;
+        var ln = suffix[..dot].ToUpperInvariant();
+        return ln.StartsWith("CSWI", StringComparison.Ordinal) ||
+               ln.StartsWith("XCBR", StringComparison.Ordinal) ||
+               ln.StartsWith("XSWI", StringComparison.Ordinal);
+    }
+
+    private static bool IsAnalogStructure(MmsTypeSpecificationNode ctlVal)
+    {
+        if (!ctlVal.MmsType.Equals("structure", StringComparison.OrdinalIgnoreCase))
+            return false;
+        var numeric = ctlVal.Children.Where(child =>
+            child.MmsType is "integer" or "unsigned" or "floating-point").ToArray();
+        return numeric.Length == 1 && ctlVal.Children.Count == 1;
+    }
+}
+
+public sealed record Iec61850ControlSemanticResolution(bool IsCommandSafe, string Cdc, string Reason);