GOOSE and SV are mapped over layer 2 and routable T-profiles; replay protection is implemented by every conforming subscriber regardless of whether the published APDU carries security, through the state machines the part specifies: the GOOSE subscriber keeps the last received state number, sequence number, state-change timestamp and its own internal time-allowed-to-live, moves from non-existent through wait-for-message to security checks on each subscribed message, passes the security check where no key has yet been delivered, transitions to failure where an encrypted message arrives without the key, and raises an alarm and assumes expired keys where key delivery fails before expiry; SV replay protection follows its own state machine.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.