Phase 4D-C1: add guarded Direct/SBO control semantics - #25

Scope

Start IEC 61850 Control Model parity on top of the completed BRCB R3 software stack. This tranche ports the safety-critical, transport-neutral sequence semantics from the C# ARIEC61850 oracle before adding MMS structure encoding and live IED execution.

Implemented

• exact ctlModel values: status-only, Direct normal, SBO normal, Direct enhanced, SBO enhanced
• public control-object root parser and deterministic LN$FC$DO$leaf reference builder
• origin categories aligned with the C# oracle
• full ControlError and AddCause enum values aligned with the C# oracle
• association-scoped object ownership for SBO
• monotonic ctlNum allocation 1..255 with wrap to 1
• immutable selected sequence fingerprint covering ctlVal, origin, ctlNum, T, operTm, Test, interlock-check and synchrocheck
• selection timeout and association-loss cleanup
• owner-only Cancel semantics
• Direct-normal and SBO-normal completion at accepted service boundary
• enhanced-security Oper remains busy until explicit CommandTermination
• positive/negative CommandTermination state transition
• explicit authorization callback with default-deny behavior
• no automatic command retry

Hard-profile evidence

Adds a dedicated GCC/Clang -fno-exceptions -fno-rtti control profile that proves:

• default-deny authorization
• second-client takeover rejection
• stale selected-value and Check mismatch rejection
• selection timeout
• permission revoked between Select and Oper
• Cancel ownership
• Direct enhanced busy-until-termination
• positive and negative termination
• association-loss cleanup
• ctlNum 255 -> 1 wrap

Deliberately deferred to stacked control tranches

• C2: exact MMS Oper / SBOw / Cancel structure codec using live TypeSpecification, including typed ctlVal, origin, ctlNum, T, Test, two-bit Check and optional operTm
• C3: InformationReport CommandTermination / LastApplError decoder and exact object correlation
• C4: live MmsAssociationRuntime guarded-control session, auto-select, subscribe-before-write, timeouts and physical IED evidence

Sampled Values / ESP32-P4 work is intentionally outside this branch.