5 Commits

Include renames

Author	SHA1	Message	Date
Marc Schier	9bfc780e14	Update NuGet dependencies and migrate tests to NUnit 5 (#4840) ... # Description Update 55 NuGet dependencies to the latest stable releases available on 2026-10-19, preserving documented compatibility pins and framework-specific version bands. Existing OpenUSD prereleases remain unchanged because no newer releases are available. Migrate existing tests to NUnit 5: await asynchronous assertions, propagate async through helpers, handle nullable predicates, and replace obsolete `Order` attributes with sequencing dependencies. Sequencing dependencies use `AllowFailure = true`; filtering a dependent test also runs prerequisites. Adjust fixture-level parallelism where NUnit dependency scheduling requires it. Keep Roslyn API/runtime pins intact; select newer Immutable/Metadata runtime packages only for test and profiling hosts requiring them. Update the approved SDK pin to 10.0.402 across local, CI, and container builds. Document NUnit 5 conventions.	2026-10-19 15:23:29 +00:00
4 people	b25429bccc	Client: cut per-request allocation and CPU in the channel and session; measure the client in the load harness (#4720) ... Follows #4707 (replaces #4714, which closed when the #4707 branch was deleted). Profiling the client process under load showed per-request allocation spread over the channel write path, the response wait, per-chunk header encoders and an AES instance per message, plus a stack walk per service call. This PR removes them and extends the load harness to measure the client. ## Results Paired A/B against the #4707 head, the server work now on master (3 alternating rounds, medians, 20 sessions unless noted, workstation GC on both sides, 24-core machine). Client = the harness process, server = the reference server child. | Scenario | Throughput | p50 | p90 | Client CPU / op | Client alloc / op | Server alloc / op | |---|---|---|---|---|---|---| | Read, 1 value | **+21%** (141k → 170k req/s) | −9% | −11% | −13% | −46% (4.5 → 2.4 KB) | −20% | | Read, 1 value, ManagedSession | **+18%** | −9% | −12% | −18% | −44% | −20% | | Read, 1 value, SignAndEncrypt | **+28%** | −14% | −20% | −24% | −52% | −26% | | Read, 1 value, 200 sessions | **+29%** | −11% | −17% | −17% | −46% | −20% | | Read, 100 values | +5% | −2% | −3% | −6% | −44% (15.6 → 8.8 KB) | −2% | | Read, 100 values, SignAndEncrypt | +8% | −7% | −2% | −2% | −46% | −3% | | Write, 100 values | ±0 | ≈ | ≈ | −14% | **−63%** (10.8 → 4.0 KB) | −2% | | Browse (Server object) | **+12%** | −7% | −11% | −19% | −17% | −12% | | Data changes, classic fast callback | ±0 ¹ | ≈ | ≈ | −21% | −10% | −5% | | Data changes, classic item events | ±0 ¹ | ≈ | ≈ | ≈ ² | −7% | −5% | | Data changes, ManagedSession (V2) | ±0 ¹ | ≈ | ≈ | ±0 | −5% | −5% | | Data changes, SignAndEncrypt | ±0 ¹ | ≈ | ≈ | −22% | −14% | −7% | ¹ Throughput is bounded by the writer rate; latency is dominated by the 100 ms publishing interval. Per notification the client uses about 2 µs and 170–260 B. ² The client uses 0.2–0.4 cores in the subscription scenarios; the CPU per notification is within run-to-run noise there. Client GC pause time in the window drops 38–66% in the Read and Write scenarios (17% for Browse). About 70% of the remaining client CPU per small request is kernel time in loopback socket send/receive. ## Changes - **Activity source**: `Session`, `SessionClientBatched`, the classic `Subscription` and `ClassicSubscriptionEngine`, and the TCP/HTTPS client channels resolve their `ActivitySource` once. `TelemetryExtensions.StartActivity` called `Assembly.GetCallingAssembly()` (a stack walk) on every service call, ~8% of client CPU. - **Channel write queue** (`UaSCUaBinaryChannel`, client and server): an ordered queue drained by one thread-pool writer replaces the per-write `ContinueWith`/`Unwrap`/trailing continuation chain. The writer is queued to the issuing thread's local pool queue, like the task continuation was (queuing it globally cost ~15 µs of p50 in a first iteration). Successful writes are reported inline instead of through `Task.Run`; failed writes still go through the pool. The client channel enters its gate only for a failed write instead of on every write completion. - **`TcpByteTransport`**: no linked `CancellationTokenSource` when the caller's token cannot be cancelled (the channel always passes `None`); a single-chunk `BufferCollection` uses the `ReadOnlyMemory` send instead of the vectored `Task<int>` send; `PoolingAsyncValueTaskMethodBuilder` on .NET 6+ for the receive/send state machines; no closure per vectored send. - **`BinaryEncoder.GetNodeIdEncoding`**: `Convert.ToUInt32(uint, IFormatProvider)` bound to the `object` overload and `Convert.ToByte(enum, ...)` boxed the enum, two boxes per encoded NodeId. 44% of the client allocation of a 100-value Read; the server encodes NodeIds the same way. - **Symmetric chunk headers**: the 24 header bytes are written and read with `BinaryPrimitives` instead of a `MemoryStream` + `BinaryEncoder`/`BinaryWriter` (send) and `BinaryDecoder`/`BinaryReader` (receive) per chunk. A chunk too short for a field still gets the decoder's `BadDecodingError`. - **AES-CBC**: `ChannelToken` keeps one `Aes` per direction, used with the one-shot `EncryptCbc`/`DecryptCbc` on .NET 6+ (net48 reuses the instance and creates the transform). Previously every message created an `Aes`, imported the key (`BCryptImportKey`) and created a transform, ~15% of client CPU with SignAndEncrypt. The instance is taken out of the token while in use, so concurrent callers never share one. The public `CryptoUtils` overloads are unchanged. - **`ChannelAsyncOperation`**: `SendRequestAsync` waits on an internal task-free completion source instead of `EndAsync` (`TaskCompletionSource` + `Task` + `WaitAsync` promise + state machine); `EndAsync` registers cancellation instead of `WaitAsync(ct)`; the timeout timer uses a static callback; completing with `default(T)` shares a box. - **Session keep alive**: every good response called `Timer.Change` under the session lock, taking the timer queue lock. It now records the time; the timer callback defers itself to one interval after the last response, which is when the per-response reset made it fire. ### Behaviour notes - `TcpByteTransport.SendChunkAsync`/`ReceiveChunkAsync` return pooled `ValueTask`s on .NET 6+: like any `ValueTask` they must be awaited once. - A successful write's `HandleWriteComplete` now runs on the writer instead of a separate pool work item. Overrides outside the stack that block in it delay later writes on that channel. - The write itself no longer flows the caller's `ExecutionContext` (`Activity.Current` is not set inside the transport send). ## Harness (`perf/`) - `client-process:` and `client-per-op:` result lines; `--trace-side client` records the harness itself. - `--client managed` (ManagedSession, V2 engine) and `--callback item` (classic per-item events). - Classic fixture sessions no longer request diagnostics in every response (the server otherwise sends a `DiagnosticInfo` per notification). - `ab.sh`: `SCENARIOS`/`ROUNDS`/`OUT`, CRLF tolerant, defaults before the scenario (a `--sessions 200` scenario silently ran with 20 before); `client-scenarios.txt`; `ab-summary.ps1` reports client and server medians. - README notes two profile traps: `Monitor.Enter_Slowpath` in the sampled CPU profile without matching contention events (46 in 10 s here), and allocation ticks over-attributing small objects allocated after large arrays. ## Testing - New: `UaSCBinaryChannelWriteQueueTests` (order, one send at a time, never on the caller's stack, failures reported and later writes still sent, concurrent writers), `ChannelAsyncOperationWaitTests` (late/early completion, faults, cancellation, disposal, continuation off the completing thread, 2000-iteration completion/cancellation race, timeout), `CryptoUtilsAesCacheTests` (cached = fresh cipher text across IVs, round trips, concurrent users, token disposal), `TcpByteTransportTests` single/multi-buffer and cancellable sends, `SessionKeepAliveTests` keep-alive read exactly one interval after the last response. - After merging master: Core Stack 3571 passed, Client 2763 passed, 0 failed. - Before merging master, net10.0: Core Stack+Security 4680 passed; Client 2763; Sessions 849 (379 skipped); Server 8391; Subscriptions 643; all 0 failed. - Stress Contract+Integration: 5 failures, the same 5 on the unchanged #4707 head (`CertRotationContractTests`, `GateAndBypassTests`, `LeaseLifecycleTests`, `RetryBudgetEnforcementTests` reflection seam, `CertRotationLiveTests`), not caused by this PR. - net48 build of `UA.slnx` clean; `dotnet format whitespace` clean. ## Not changed (follow-ups) - Two `recv` calls per chunk (8-byte header, then body). Merging them needs read-ahead with carry-over, which the transport avoids so that idle peers do not hold receive buffers. - `ManagedSession` service wrappers add an async state machine and a reader lock per call (~200 B). - Generated responses allocate a discarded `ResponseHeader` (generator-wide, as noted in #4707). - Decoded `MonitoredItemNotification` objects and the V2 `DataValueChange[]` per message dominate notification allocation (`WithPoolNotifications` pools the latter). - Coalescing queued writes on one channel into one vectored send would cut syscalls under concurrent requests on a shared channel. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Marc <marcschier@hotmail.com> Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>	2026-10-10 20:00:33 +02:00
romanettandClaude Opus 5.5	9b034f8291	Enable nullable reference types centrally; migrate all unset and annotations-only projects (#4700) ... # Description Nullable reference types are now enabled once, in `common.props`, and every project in the repository builds warning-clean with them. **Configuration** - `<Nullable>enable</Nullable>` lives in `common.props`. All per-project `<Nullable>` settings are removed: 178 project files (enable, annotations, and the `disable` in the three Aot test projects). - 419 per-file `#nullable enable`/`restore` directives and the 4 `#nullable disable` directives are removed. - Kept on purpose: - The 5 `<auto-generated>` schema files (`UANodeSet.cs`, `UA Type Dictionary.cs`, `OPCBinarySchema.cs`, `SecuredApplication.cs`, `PInvokeHelper.cs`) keep `#nullable enable`. The compiler ignores the project setting in generated code, so the directive is required there. - `tests/Opc.Ua.Interop.LegacyPeer` keeps `disable`. It builds against the 1.5.378 packages and does not import the repository props. - `docs/DeveloperGuide.md` and `.github/copilot-instructions.md` now describe the central setting. **Migration** (the 43 unset and 13 annotations-only projects, roughly 10k diagnostics) - **Production code: annotated at the declarations.** Covers `tools/Opc.Ua.SourceGeneration.Core`, `src/Opc.Ua.Lds.Server` and the LDS sample. - Members, parameters and returns are nullable where null actually flows. - Null-check helpers carry `[NotNullWhen]` (`IsNull`, `IsValidXmlName`, `IsMethodTypeDesign`). - `CoreUtils.Format`, `Utils.Format`, `ITemplateWriter.WriteLine` take `params object?[]`. `Template.AddReplacement` takes `string?` (rendering already skips null replacements). - `IRegisteredServerStore.RegisterAsync` returns `Task<RegistrationEntry?>`: it returns null when a registration is removed. - Dereferences backed by an invariant (for example, the validated model) use `!`, so runtime behaviour is unchanged. - **Behavioural changes in production code** (small, deliberate): - `NodeSetToModelDesign` throws `InvalidOperationException` when the file is not a NodeSet. Before, it threw a NullReferenceException on the next line. - `ModelDesignValidator` starts its lookup tables empty instead of null. A redundant `if (m_nodes == null) return;` guard is gone. - **Test code: minimal annotations.** - `?` on values that can be null, `!` where the test asserts non-null. - `= null!` for fixture members assigned in SetUp. - `TryGetStructure<T>(out T? x)` where the inferred `T?` broke the `IEncodeable` constraint. - A few redundant `== null` checks on structs (`NodeId`, `ArrayOf<T>`) folded into the adjacent `IsNull`/`Count` checks. **Notes for reviewers** - The diff is large (~1,500 files) but almost entirely mechanical: `?`, `!` and directive removal. The non-annotation changes are listed above. - Known follow-up, not done here: `IModelDesign.Namespaces/TargetNamespace/NamespaceUris` stay non-nullable even though the validator returns null before it loads a dictionary. Making them nullable would ripple through every generator call site. ## Related Issues - Fixes #4439 ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [ ] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [ ] I have addressed **all** PR feedback received. The "no new warnings" box covers net10.0 and net48: full non-incremental builds of `UA.slnx`, `tools/SourceGeneration.slnx`, `tools/MigrationAnalyzer.slnx` and the Aot test projects finished with 0 warnings and 0 errors under the repository's warnings-as-errors settings. net9.0 and net8.0 also had no nullable diagnostics, but they were not rebuilt after the final fixes. Tests have not been run locally yet. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 08:48:13 +02:00
romanettandClaude Opus 5.5	e0c56a7c00	Replay the fuzz crash corpus from the fuzz-corpus orphan branch (#4539) ... # Description Since the move to GitHub Actions, CI replays only the checked-in fuzz corpus. The full crash corpus used to be the Azure DevOps secure file `FuzzingArtifacts.zip`, which `.azurepipelines/test.yml` overlaid onto `Opc.Ua.Encoders.Fuzz.Tests`. The nightly `private-corpus` job that was meant to replace it depended on an Azure storage account, federated credentials and a protected environment. None of these were ever provisioned, so the job never ran. **The corpus now lives on the orphan branch [`fuzz-corpus`](https://github.com/OPCFoundation/UA-.NETStandard/tree/fuzz-corpus)** (commit `843ba944a7b144a7ae6429151846d9e5ab28d29f`, already pushed): - It contains 22,267 `crash-*`, 25 `slow-unit-*` and 1 `timeout-*` input under `Opc.Ua.Encoders.Fuzz.Tests/Assets/`. - The files are byte-identical to the secure file (SHA-256 `85198e46…fe1d61b`), recovered from the `drop` artifact of Azure build 18397. - The branch shares no history with `master`, so clones of `master` don't get 22k extra files in their checkout. **Why the corpus is no longer treated as private:** - The inputs date from April–June 2024. - The `drop` artifacts could be downloaded anonymously. - Every master build printed up to about 7k base64 reproducers into anonymously readable Azure logs. - Current `master` replays every input without a test failure. New, unfixed crashes still go through [SECURITY.md](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/SECURITY.md) and are added to the branch only after the fix ships. ## Changes - **`nightly.yml`:** `private-corpus` is replaced by `crash-corpus`. The new job: - checks out the commit pinned in `FUZZ_CORPUS_COMMIT` (no secrets, environment or OIDC); - verifies the SHA and copies each top-level folder over `fuzzing/<folder>`; - runs `Opc.Ua.Encoders.Fuzz.Tests` on the 12 non-macOS profiles through the shared `run-dotnet-tests` action and uploads `crash-corpus-results-*`. The `run_private_corpus` input and the INCOMPLETE label are removed. The job runs on every scheduled and manual run, and the nightly summary fails if it was skipped. - **`fuzzing/CrashCorpus.md` (new):** the Azure history, branch layout, how CI replays the corpus, local replay, and how to add inputs and move the pin. `Fuzzing.md` links to it. - **`docs/DeveloperGuide.md`:** the private-corpus section and its secrets table are replaced, and the migration to-do list is updated. - **`nightly.yml` AOT job (fix for a failure found by the first nightly run):** the Linux and macOS legs looked up the published binary by `BaseName`/`Extension`. A NativeAOT executable has no extension on those platforms, so PowerShell splits `Opc.Ua.Aot.Tests` into `Opc.Ua.Aot` + `.Tests`, and every leg reported *No NativeAOT executable was produced* even though publish succeeded ([run 36017168717](https://github.com/OPCFoundation/UA-.NETStandard/actions/runs/36017168717), `aot-ubuntu-latest`). The lookup now matches the exact file name. A failure now reports the publish errors, a missing publish directory, or which files were produced instead. - **`Opc.Ua.Redundancy.Samples.Tests` / `Opc.Ua.WotCon.Samples.Tests` (fix for failures found by the first nightly run):** the test runner's framework guard rejected both projects on the nightly net8.0, net9.0, net472 and netstandard2.1 profiles. Redundancy built a net48 placeholder for every target except net10.0, and WotCon was pinned to net10.0. Both now build the requested target on net8.0/9.0/10.0 and use `RestrictForLegacyTfm` to become explicit not-applicable shells on net48, net472, netstandard2.0 and netstandard2.1. The redundancy tests no longer hard-code `bin/<cfg>/net10.0` when locating the sample binaries, and `SampleAppProcess` falls back to an `object` lock below net9.0. The net48 placeholder remains for Azure's plain `dotnet test -f net48` leg. Checked locally by building Redundancy for `CustomTestTarget=net9.0` and WotCon for `netstandard2.1`. - **`DefaultServerRedundancyHandler` (fix for a failure found by the first nightly run):** `ResolveServerAsync` gave the resolver a token linked to the caller's, but waited on the caller's token directly. On cancellation the wait could finish, and its `using` could dispose the linked source, before the linked source's own callback had run. That unhooks it, so the in-flight peer lookup never saw the cancellation (`PeerDiscoveryPropagatesCallerCancellationAsync`, netstandard2.0 build on net48). The wait now uses the linked token. A timeout is still logged as a discovery failure, as before. A companion test fix makes `PeerTimeoutPreservesOtherEndpointsAndCoalescesPendingDiscoveryAsync(False)` deterministic. The timed-out lookup drains on the thread pool, so the test's retry could join it and then have its own time limit expire before it started a fresh lookup. The test now waits for the second resolver call before advancing the fake clock. - **`Session` keep-alive logging (found while investigating the net48 nightly failures):** `OnKeepAliveError` and the keep-alive read failure log used `Endpoint?.EndpointUrl`. `ClientBase.Endpoint` dereferences the transport channel, so once the channel was detached it threw a `NullReferenceException` on every keep-alive tick, and `BadNoCommunication` never reached the `KeepAlive` subscribers. Both now log the configured endpoint's URL. Three new `SessionKeepAliveTests` cover a detached channel. - **`ClientTestFramework` shared session (fix for 67 `Opc.Ua.Sessions.Tests` failures on the net48 nightly):** the fixture-wide shared session used the 10 s default session timeout. A test-host stall of about 11–18 s while other fixtures restarted their servers let the server expire it, and every later test in the `ClientTest("https")` and `ClientTest("opc.https")` fixtures failed with `BadSessionIdInvalid`. The shared session now requests `SharedSessionTimeout` = 120 s; per-test sessions keep 10 s. - **`run-dotnet-tests.ps1`:** `-QuietOutput` help text only; it no longer names the removed job. The Azure secure file stays in place, because `master378` and the 1.x release pipelines keep their own `test.yml` and still use it. ## Verification - `nightly.yml` parses as valid YAML, and no job, output or summary field still refers to the removed job. - I ran the job's overlay script against a clone of `fuzz-corpus` at the pinned commit. It overlaid all 22,293 files, left the tracked `Assets/Repo` untouched, removed the checkout folder and wrote the summary line. - **Not yet run:** the workflow itself. It is `schedule`/`workflow_dispatch` only, so it needs a manual `nightly.yml` run on this branch. On master the corpus has so far only been replayed on Windows (net48/net10.0 in Azure), so the Linux legs are new ground. ## Follow-ups (admin) - Add a ruleset for `fuzz-corpus`: require pull requests and block force pushes and deletion, so the pinned commit stays reachable. - The `fuzz-private-corpus` environment, if it was ever created, can be deleted. ## Related Issues - No issue exists yet; this is part of the Azure DevOps → GitHub Actions migration (#4513, #4524). ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [ ] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [ ] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [ ] I have addressed **all** PR feedback received. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-25 07:49:00 +02:00
4 people	d0d048dbb3	Fix spurious BadNoCommunication reconnect loop on sessions with steady traffic (#4318) ... # Description A session with steady request traffic that then goes quiet for one `KeepAliveInterval` was flagged `BadNoCommunication` and driven `Connected -> Reconnecting` by the `ConnectionStateMachine`, even though the connection was perfectly healthy. Two parts of the keep-alive logic disagreed about what counts as proof of liveness: - `Session.RequestCompleted` treats **any** good service response as proof the server is alive and postpones the keep-alive Read by a full `KeepAliveInterval`. - The freshness timestamp `KeepAliveStopped` is judged against (`m_lastKeepAliveTimestamp`) was refreshed **only** by an actual keep-alive Read response in `OnKeepAlive` (and at timer start). So under steady traffic the keep-alive Read was perpetually deferred (the stated intent) while its freshness timestamp went arbitrarily stale. The moment traffic paused, the timer finally fired, `OnSendKeepAliveAsync` evaluated `KeepAliveStopped` against the stale timestamp and raised `OnKeepAliveError(BadNoCommunication)` **before attempting the Read**. `ManagedSession.OnInnerKeepAlive` then routed that straight to `StateMachine.TriggerReconnect()`, producing a dead-regular Connected -> Reconnecting -> Connected loop on an idle-but-healthy session. ## What changed `src/Opc.Ua.Client/Session/Session.cs`: - `RequestCompleted` now refreshes the liveness timestamp alongside the timer reset, so the same response that defers the Read also counts as proof for the `KeepAliveStopped` freshness check. Extracted into a small `UpdateLastKeepAliveTime()` helper that the three existing refresh sites (`StartKeepAliveTimerAsync`, both branches of `OnKeepAlive`) now share. - The refresh is guarded by `if (!KeepAliveStopped)`, so a **latched** keep-alive error is still only cleared by an actual keep-alive response in `OnKeepAlive`. This matters: the keep-alive Read's own `RequestCompleted` runs *before* `OnKeepAlive`, so an unconditional refresh would have made `OnKeepAlive` take the `else` branch and silently skip the recovery path (`StartPublishing`, defuncting stale publish requests) after a `BadNoCommunication`. - `m_lastKeepAliveTimestamp` is now read and written through `Interlocked`, since it is written from arbitrary response threads rather than only from the keep-alive worker. `LastKeepAliveTime` / `LastKeepAliveTimestamp` therefore now mean "last time the server proved it is alive" rather than "last keep-alive Read". That is what both existing consumers already want: `ClassicSubscriptionEngine` only logs it next to `KeepAliveStopped`, and `SessionReconnectHandler` uses it to compute the remaining session-timeout budget, which becomes more accurate. ## Test plan New `tests/Opc.Ua.Client.Tests/Session/SessionKeepAliveTests.cs` (5 tests, driven by `FakeTimeProvider`, no server needed): - `GoodResponsesKeepTheSessionAliveWhileTheKeepAliveReadIsDeferred` — the reported repro: a good response every 2 s for 20 s with a 5 s `KeepAliveInterval`. Confirmed this **fails on the unpatched code** (trips at iteration 2, i.e. 6 s in) and passes with the fix. It also asserts that once traffic stops, silence is still detected. - `KeepAliveStoppedTripsWhenNothingIsHeardFromTheServer` — negative control, the detector still works. - `BadResponsesDoNotRefreshTheKeepAliveTimestamp` — only good responses count. - `LatchedKeepAliveErrorIsNotClearedByAGoodResponse` — unrelated traffic cannot clear a latched keep-alive error. - `RecoveryAfterBadNoCommunicationIsHandledByTheKeepAliveResponse` — after `BadNoCommunication`, `OnKeepAlive` still enters the recovery branch even though the keep-alive Read's own response passed through `RequestCompleted` first. Local runs: `Opc.Ua.Client.Tests` on net10.0 fully green (2133/2133). `Opc.Ua.Sessions.Tests` (live in-proc reference server) was still running when this PR was opened; I will follow up if it reports anything. ## Related Issues - Fixes #4317 ## Checklist - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [ ] I have addressed **all** PR feedback received. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Marc Schier <marcschier@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-08-26 19:19:34 +00:00