P0 SIEBCU: negotiated-window RCB enrichment without losing exact MMS evidence

.github/workflows/dotnet-ci.yml

@@ -20,7 +20,9 @@ on:
       - "*.slnx"
       - "Directory.Build.props"
   pull_request:
-    branches: [ main ]
+    # The live ARSAS product pins PR #169 until targeted engine changes pass CI.
+    # Stacked engine PRs must run the exact same Windows build/test gate.
+    branches: [ main, feat/495-dataset-type-closure, fix/p10-9l-readonly-ctlmodel-probe, fix/p0-b-target-scoped-rcb-pager-20261019 ]
   workflow_dispatch:
 
 permissions:

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## Control/report isolation trial — 2026-10-20
+
+- Reject non-RCB InformationReport shapes before persistent single-monitor fallback; control termination and LastApplError remain available to independent control subscribers.
+- Include monotonic service duration and post-response wait in each control wire-step detail. UTC marks local service start, not wire send. This separates SBOw/Operate service latency from asynchronous completion wait without changing timeout, checks, or command sequencing.
+- Synthetic regression coverage added; physical latency improvement is not yet established.
+
 All notable public changes to ARIEC61850 are recorded here. The project is still evolving toward stable semantic releases; entries are grouped by engineering milestone until a formal versioning policy is adopted.
 
 ## Unreleased — public wording, provenance and release assurance

src/AR.Iec61850.Simulation/MmsServer/MmsReportingRuntime.cs

@@ -1,4 +1,5 @@
 using System.Globalization;
+using System.Threading.Channels;
 using AR.Iec61850.Asn1;
 using AR.Iec61850.Mms;
 
@@ -192,6 +193,17 @@ public sealed class MmsAssociationReportingRuntime : IMmsAssociationRuntime, IDi
     private readonly Dictionary<string, Timer> _integrityTimers = new(StringComparer.OrdinalIgnoreCase);
     private readonly object _gate = new();
     private readonly CancellationTokenSource _cts = new();
+    // One FIFO per MMS association. A distinct Task.Run per report previously
+    // allowed send delegates to acquire the socket lock in a different order
+    // from the SqNum assignment, manufacturing on-wire discontinuities.
+    private readonly Channel<(MmsRcbRuntimeState State, byte Reason)> _sendQueue =
+        Channel.CreateUnbounded<(MmsRcbRuntimeState, byte)>(
+            new UnboundedChannelOptions
+            {
+                SingleReader = true,
+                SingleWriter = false,
+                AllowSynchronousContinuations = false
+            });
     private bool _disposed;
 
     public MmsAssociationReportingRuntime(
@@ -226,6 +238,12 @@ public MmsAssociationReportingRuntime(
                 IntgPd = (uint)Math.Max(0, rcb.IntegrityPeriodMs)
             };
         }
+
+        // One asynchronous worker is allocated per association, not per report.
+        // Capture the token here: a delayed worker must never access a CTS
+        // after Dispose() has disposed its source.
+        var senderToken = _cts.Token;
+        _ = Task.Run(() => DrainReportQueueAsync(senderToken));
     }
 
     public IReadOnlyCollection<MmsRcbRuntimeState> States => _states.Values;
@@ -414,6 +432,7 @@ public void Dispose()
             return;
 
         _disposed = true;
+        _sendQueue.Writer.TryComplete();
         _cts.Cancel();
         lock (_gate)
         {
@@ -449,21 +468,39 @@ private void QueueReport(MmsRcbRuntimeState state, byte reason)
         if (_disposed)
             return;
 
-        _ = Task.Run(async () =>
+        // Channel FIFO is the report ordering authority. No per-report Task.Run,
+        // no competing asynchronous socket writers and no silent report drop.
+        _sendQueue.Writer.TryWrite((state, reason));
+    }
+
+    private async Task DrainReportQueueAsync(CancellationToken cancellationToken)
+    {
+        try
         {
-            try
-            {
-                await SendReportAsync(state, reason, _cts.Token).ConfigureAwait(false);
-            }
-            catch (OperationCanceledException)
-            {
-                // Association closing.
-            }
-            catch (Exception ex) when (ex is IOException or ObjectDisposedException or System.Net.Sockets.SocketException or InvalidOperationException)
+            await foreach (var request in _sendQueue.Reader.ReadAllAsync(cancellationToken)
+                               .ConfigureAwait(false))
             {
-                _activity?.Invoke(state.MmsReference, false, $"InformationReport send failed: {ex.Message}");
+                try
+                {
+                    await SendReportAsync(request.State, request.Reason, cancellationToken)
+                        .ConfigureAwait(false);
+                }
+                catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+                {
+                    return;
+                }
+                catch (Exception ex) when (ex is IOException or ObjectDisposedException or
+                                           System.Net.Sockets.SocketException or InvalidOperationException)
+                {
+                    _activity?.Invoke(request.State.MmsReference, false,
+                        $"InformationReport send failed: {ex.Message}");
+                }
             }
-        }, CancellationToken.None);
+        }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+            // Association closing: pending reports are not sent on a dead socket.
+        }
     }
 
     private async Task SendReportAsync(MmsRcbRuntimeState state, byte reason, CancellationToken cancellationToken)

src/AR.Iec61850/Control/Iec61850ControlModels.cs

@@ -174,7 +174,9 @@ public sealed class Iec61850ControlObjectDescriptor
         ControlModel is not Iec61850ControlModel.StatusOnly and not Iec61850ControlModel.Unknown &&
         !string.IsNullOrWhiteSpace(ObjectReference) &&
         !string.IsNullOrWhiteSpace(CtlValSpecification.MmsType) &&
-        (!RequiresSelect || CancelSpecification != null) &&
+        // Normal SBO Select -> Operate does not depend on optional Cancel.
+        // Enhanced SBO still requires Cancel for sequence recovery.
+        (ControlModel != Iec61850ControlModel.SelectBeforeOperateEnhanced || CancelSpecification != null) &&
         (ControlModel != Iec61850ControlModel.SelectBeforeOperateEnhanced || SelectWithValueSpecification != null) &&
         (!IsEnhanced || SupportsCommandTermination);
 

src/AR.Iec61850/Control/Iec61850ControlObjectSession.cs

@@ -27,6 +27,10 @@ private sealed class AssociationControlState
     private CancellationTokenSource? _selectionLeaseCts;
     private bool _ownsLock;
     private bool _disposed;
+    private DateTimeOffset _serviceStartedUtc;
+    private TimeSpan _serviceElapsed;
+    private long _serviceCompletedTimestamp;
+
 
     internal Iec61850ControlObjectSession(
         IIec61850ControlTransport transport,
@@ -115,7 +119,7 @@ private async Task<Iec61850ControlActionResult> SelectCoreAsync(
         try
         {
             var context = CreateContext(request);
-            var read = await _transport.ReadAsync(Descriptor.References.Sbo, cancellationToken).ConfigureAwait(false);
+            var read = await MeasureServiceAsync(() => _transport.ReadAsync(Descriptor.References.Sbo, cancellationToken)).ConfigureAwait(false);
             if (!read.IsSuccess || !IsPositiveSboSelection(read.Value, Descriptor.References))
             {
                 ReleaseObject();
@@ -172,7 +176,7 @@ private async Task<Iec61850ControlActionResult> SelectWithValueCoreAsync(
                 context,
                 Descriptor.SelectWithValueSpecification,
                 _options.RequireExactNamedControlFields);
-            var write = await _transport.WriteControlAsync(Descriptor.References.SboWithValue, value, cancellationToken).ConfigureAwait(false);
+            var write = await MeasureServiceAsync(() => _transport.WriteControlAsync(Descriptor.References.SboWithValue, value, cancellationToken)).ConfigureAwait(false);
             if (!write.IsSuccess)
             {
                 var appError = await WaitForApplicationErrorAsync(_options.ApplicationErrorGracePeriod, cancellationToken, reports).ConfigureAwait(false);
@@ -289,7 +293,7 @@ private async Task<Iec61850ControlActionResult> OperateCoreAsync(
                 context,
                 Descriptor.OperSpecification,
                 _options.RequireExactNamedControlFields);
-            var write = await _transport.WriteControlAsync(Descriptor.References.Oper, operValue, linked.Token).ConfigureAwait(false);
+            var write = await MeasureServiceAsync(() => _transport.WriteControlAsync(Descriptor.References.Oper, operValue, linked.Token)).ConfigureAwait(false);
             if (!write.IsSuccess)
             {
                 var applicationError = await WaitForApplicationErrorAsync(_options.ApplicationErrorGracePeriod, cancellationToken, reports).ConfigureAwait(false);
@@ -432,7 +436,7 @@ private async Task<Iec61850ControlActionResult> CancelCoreAsync(CancellationToke
                 return Unsupported(Iec61850ControlAction.Cancel, "IED did not expose a decodable Cancel type specification.");
 
             var value = Iec61850ControlStructureBuilder.BuildCancel(context, Descriptor.CancelSpecification, _options.RequireExactNamedControlFields);
-            var write = await _transport.WriteControlAsync(Descriptor.References.Cancel, value, cancellationToken).ConfigureAwait(false);
+            var write = await MeasureServiceAsync(() => _transport.WriteControlAsync(Descriptor.References.Cancel, value, cancellationToken)).ConfigureAwait(false);
             return write.IsSuccess
                 ? Accepted(Iec61850ControlAction.Cancel, context, stopwatch.Elapsed, "Cancel accepted; local SBO ownership released.")
                 : FromWriteFailure(Iec61850ControlAction.Cancel, write, null, context, stopwatch.Elapsed);
@@ -691,7 +695,7 @@ private async Task BestEffortCancelAsync(CancellationToken cancellationToken)
                     context,
                     Descriptor.CancelSpecification,
                     _options.RequireExactNamedControlFields);
-                await _transport.WriteControlAsync(Descriptor.References.Cancel, value, cancellationToken).ConfigureAwait(false);
+                await MeasureServiceAsync(() => _transport.WriteControlAsync(Descriptor.References.Cancel, value, cancellationToken)).ConfigureAwait(false);
             }
         }
         catch
@@ -782,6 +786,20 @@ private Iec61850ControlActionResult FromApplicationRejection(
                 BuildWireStep(action, requestAccepted: true, clientMessage))
         };
 
+    // Serialized by _operationGate. These are local service boundaries, not
+    // packet capture timestamps; elapsed measurement uses the monotonic clock.
+    private async Task<T> MeasureServiceAsync<T>(Func<Task<T>> service)
+    {
+        _serviceStartedUtc = DateTimeOffset.UtcNow;
+        var started = Stopwatch.GetTimestamp();
+        try { return await service().ConfigureAwait(false); }
+        finally
+        {
+            _serviceElapsed = Stopwatch.GetElapsedTime(started);
+            _serviceCompletedTimestamp = Stopwatch.GetTimestamp();
+        }
+    }
+
     private Iec61850ControlWireStep BuildWireStep(
         Iec61850ControlAction action,
         bool requestAccepted,
@@ -796,14 +814,28 @@ private Iec61850ControlWireStep BuildWireStep(
             _ => Descriptor.References.Oper
         };
 
+        // Distinguish protocol service response time from the selection
+        // negative-indication observation gate. The latter dominates the
+        // field sample (~400 ms); it must not be misreported as slow MMS I/O.
+        // This is telemetry only: do not reduce the grace period or bypass
+        // LastApplError and enhanced-security CommandTermination.
+        var postResponseStage = action switch
+        {
+            Iec61850ControlAction.SelectWithValue => "sbo-application-error-observation",
+            Iec61850ControlAction.Operate => "operate-termination-observation",
+            _ => "post-service-completion"
+        };
+        var graceBudget = action == Iec61850ControlAction.SelectWithValue
+            ? _options.ApplicationErrorGracePeriod.TotalMilliseconds : 0d;
         return new Iec61850ControlWireStep
         {
             Action = action,
             Reference = $"{reference.Domain}/{reference.Item}",
             RequestAccepted = requestAccepted,
             RequestHex = _transport.LastRequestHex,
             ResponseHex = _transport.LastResponseHex,
-            Detail = detail
+            Detail = FormattableString.Invariant(
+                $"{detail} serviceStartedUtc={_serviceStartedUtc:O}; serviceMs={_serviceElapsed.TotalMilliseconds:0.###}; postResponseWaitMs={Stopwatch.GetElapsedTime(_serviceCompletedTimestamp).TotalMilliseconds:0.###}; postResponseStage={postResponseStage}; configuredApplicationErrorGraceMs={graceBudget:0.###}; timingScope=local-service-not-wire")
         };
     }
 

src/AR.Iec61850/Control/Iec61850ControlSemanticResolver.cs

@@ -0,0 +1,106 @@
+using AR.Iec61850.Mms;
+
+namespace AR.Iec61850.Control;
+
+/// <summary>
+/// Resolves *command* semantics from a declared CDC and corroborating live MMS
+/// evidence. A primitive MMS type is an encoding, not permission to Operate.
+/// This is vendor-independent and never sends an MMS request.
+/// </summary>
+public static class Iec61850ControlSemanticResolver
+{
+    public static Iec61850ControlSemanticResolution Resolve(
+        Iec61850ControlObjectDescriptor descriptor,
+        string? declaredCdc,
+        string? declaredStatusReference = null)
+    {
+        ArgumentNullException.ThrowIfNull(descriptor);
+        var declared = (declaredCdc ?? string.Empty).Trim().ToUpperInvariant();
+        var inferred = (descriptor.Cdc ?? string.Empty).Trim().ToUpperInvariant();
+        var status = descriptor.StatusReference ?? string.Empty;
+        var mmsType = (descriptor.CtlValSpecification.MmsType ?? string.Empty).Trim().ToLowerInvariant();
+        var size = descriptor.CtlValSpecification.Size;
+        // A saved SCL/DataSet SPC can describe a process projection, not the
+        // command payload. Only an EXACT same-object ST step status plus a
+        // typed two-bit MMS ctlVal establishes live directional BSC authority.
+        // A bit-string alone (or a similarly named object) proves nothing.
+        var exactLiveBsc =
+            inferred == "BSC" &&
+            mmsType == "bit-string" && size == 2 &&
+            status.Equals(descriptor.ObjectReference + ".valWTr.posVal",
+                StringComparison.OrdinalIgnoreCase);
+        var supersededAdvisorySpc = declared == "SPC" && exactLiveBsc;
+        var cdc = supersededAdvisorySpc
+            ? "BSC"
+            : string.IsNullOrWhiteSpace(declared) ? inferred : declared;
+
+        Iec61850ControlSemanticResolution Deny(string reason)
+            => new(false, cdc, reason);
+
+        if (!descriptor.IsOperationallyReady)
+            return Deny("The live control descriptor or ctlModel is not operationally ready.");
+        if (string.IsNullOrWhiteSpace(status))
+            return Deny("No live status reference corroborates the control semantics.");
+
+        // A stale persisted feedback reference must not silently override a
+        // different live BSC status object when commands are involved.
+        if (cdc == "BSC" && !string.IsNullOrWhiteSpace(declaredStatusReference) &&
+            !string.Equals(declaredStatusReference.Trim(), status, StringComparison.OrdinalIgnoreCase))
+            return Deny("Declared BSC feedback reference disagrees with the live control descriptor.");
+
+        if (cdc != inferred &&
+            !(inferred == "INC/ISC" && cdc is "INC" or "ISC") &&
+            !(cdc == "DPC" && inferred == "SPC" && IsStandardPosition(descriptor.ObjectReference)))
+            return Deny($"Declared CDC '{cdc}' conflicts with live CDC evidence '{inferred}'.");
+
+        var statusIsStep = status.EndsWith(".valWTr.posVal", StringComparison.OrdinalIgnoreCase);
+        var statusIsState = status.EndsWith(".stVal", StringComparison.OrdinalIgnoreCase);
+        var supported = cdc switch
+        {
+            "BSC" => statusIsStep &&
+                     (mmsType is "integer" or "unsigned" ||
+                      (mmsType == "bit-string" && size == 2)),
+            "DPC" => statusIsState &&
+                     ((mmsType == "bit-string" && size == 2) ||
+                      (mmsType == "boolean" && IsStandardPosition(descriptor.ObjectReference))),
+            "SPC" => statusIsState && mmsType == "boolean",
+            "INC" or "ISC" => declared == cdc && statusIsState &&
+                               mmsType is "integer" or "unsigned" or "bcd",
+            "APC" => declared == "APC" &&
+                     (mmsType == "floating-point" || IsAnalogStructure(descriptor.CtlValSpecification)),
+            _ => false // Other CDCs require an independently audited typed codec.
+        };
+
+        if (!supported)
+            return Deny($"CDC '{cdc}' cannot be safely bound to live ctlVal '{descriptor.CtlValSpecification.Signature}' and status '{status}'.");
+
+        var provenance = supersededAdvisorySpc
+            ? " Saved/DataSet CDC=SPC was advisory and superseded by exact live BSC control evidence."
+            : string.Empty;
+        return new(true, cdc,
+            $"Verified CDC={cdc}; live ctlModel={descriptor.ControlModel}; ctlVal={descriptor.CtlValSpecification.Signature}; status={status}.{provenance}");
+    }
+
+    internal static bool IsStandardPosition(string reference)
+    {
+        var suffix = reference[(reference.LastIndexOf('/') + 1)..];
+        var dot = suffix.IndexOf('.');
+        if (dot <= 0 || !suffix[(dot + 1)..].Equals("Pos", StringComparison.OrdinalIgnoreCase))
+            return false;
+        var ln = suffix[..dot].ToUpperInvariant();
+        return ln.StartsWith("CSWI", StringComparison.Ordinal) ||
+               ln.StartsWith("XCBR", StringComparison.Ordinal) ||
+               ln.StartsWith("XSWI", StringComparison.Ordinal);
+    }
+
+    private static bool IsAnalogStructure(MmsTypeSpecificationNode ctlVal)
+    {
+        if (!ctlVal.MmsType.Equals("structure", StringComparison.OrdinalIgnoreCase))
+            return false;
+        var numeric = ctlVal.Children.Where(child =>
+            child.MmsType is "integer" or "unsigned" or "floating-point").ToArray();
+        return numeric.Length == 1 && ctlVal.Children.Count == 1;
+    }
+}
+
+public sealed record Iec61850ControlSemanticResolution(bool IsCommandSafe, string Cdc, string Reason);