## Proposed changes
Fixes a flaky `SubscriptionTest.PublishRequestCountAsync` in
`Opc.Ua.Subscriptions.Classic.Tests`. It failed on #4574 (run
[36466677911](https://github.com/OPCFoundation/UA-.NETStandard/actions/runs/36466677911),
`test-linux-net10.0 (25/30)`) with `BadSessionIdInvalid`. #4574 did not
touch this code.
**Evidence from the TRX StdOut of the failing test:**
- The per-test session was created with `Revised session timeout value:
10000`. This fixture uses `SingleSession = false`, so each test gets its
own session with the `ClientFixture` default of 10 s.
- Right after the 50 subscriptions were created, the log goes silent for
about 19.6 s (19:00:15.277 → 19:00:34.922).
- After that silence, all outstanding publish requests fail together
with `BadRequestTimeout`. The next request, the cleanup's
`DeleteSubscriptions` (`SubscriptionTest.cs:510`), returns
`BadSessionIdInvalid`, and keep-alives then report the same status.
So the test host stalled for longer than the 10 s session timeout, and
the server expired the session. The test did not close it. This is the
same mechanism #4539 fixed for the fixture-shared session.
**Changes:**
- `SubscriptionTest.OneTimeSetUpAsync` now sets
`ClientFixture.SessionTimeout = SharedSessionTimeout` (120 s, from
#4539). The fixture's per-test sessions carry heavy publish load (50
subscriptions × 50 items, sampling 0, publishing revised to 100 ms). No
test in this fixture depends on the 10 s timeout.
- `PublishRequestCountAsync` now removes its subscriptions in a
`finally` block, best effort, with errors logged. A failure part-way
through can no longer leave 50 publishing subscriptions behind for the
later ordered tests.
## Related Issues
- Follow-up to #4539
## Types of changes
- [x] Bugfix (non-breaking change which fixes an issue)
## Checklist
- [x] I have read the CONTRIBUTING doc.
- [x] Local run of `Opc.Ua.Subscriptions.Classic.Tests` on net10.0:
57/57 passed.
## Further comments
The runner stall could not be reproduced locally. The fix relies on the
same root cause as #4539, where the stall was shown with an injected
keep-alive delay.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>
# Description
`Aes128_Sha256_RsaOaep` was ranked above `Basic256Sha256` despite its
weaker AES-128 symmetric encryption. The calculated levels are swapped
to reflect their relative strength.
- **Security-level ranking**
- `Aes128_Sha256_RsaOaep`: `6`
- `Basic256Sha256`: `8`
```csharp
case SecurityPolicies.Basic256Sha256:
result = 8;
break;
case SecurityPolicies.Aes128_Sha256_RsaOaep:
result = 6;
break;
```
- **Regression coverage**
- Updates the policy-ordering test to assert the corrected relationship.
## Related Issues
## Checklist
- [ ] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [ ] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.
<!-- START COPILOT CODING AGENT SUFFIX -->
- Fixes#4560
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>
romanett