6 Commits
Author SHA1 Message Date
romanettandClaude Opus 5.5 484596c2a8 Server: cheaper per-item event delivery (O(1) dequeue, duplicate index, filter context reuse, no per-read timestamps) (#4837)
# Description

Low-risk speedups in the server event delivery path. With many event
monitored items on one notifier (750 on the Server object in the
`events` harness scenario), a single `MonitoredNode2` consumer thread
delivers every event to every item and is 100 % busy, which caps the
server at ~770 events/s. This PR makes the per-item work cheaper. There
are no public API or wire changes. Each commit stands alone:

1. **Server: dequeue events in O(1).** `EventMonitoredItemQueue.Dequeue`
used `List.RemoveAt(0)`, which shifted every queued event. It now
advances a head index, compacts the list once the dequeued slots are
half of it, and clears it when it runs empty. Discard oldest/newest, the
`SetQueueSize` truncation and the newest-1000 duplicate range are
unchanged. The mirroring redundancy queue snapshots only the queued
range.
2. **Server: reuse the event filter context of a monitored item.**
`QueueEvent` created a `FilterContext` per event and item. The item now
keeps it until the session replaces its `PreferredLocales`.
`GetEventFields` writes into a `Variant[]` instead of a `List` that was
then copied, and translates with the context's locales instead of
looking up the session per LocalizedText field.
3. **Server: check event duplicates against an index of the newest
entries.** `IsEventContainedInQueue` loaded the handle of up to 1000
queued entries per item and event. A reference-keyed count of the event
instances in the newest 1000 entries, kept current by
`Enqueue`/`Dequeue`/`SetQueueSize`, makes it one lookup. The checked
range is the same, and wrapped filtered-retain handles count as their
instance. If a derived queue changes `m_events` directly, the index is
rebuilt.
4. **Core: evaluate an empty content filter without an evaluator.**
`ContentFilter.Evaluate` created a `FilterEvaluator` and, through the
telemetry context, a new logger for every evaluation, also for the empty
where clause of most event filters (~16 % of the scenario's allocated
bytes). An empty filter now passes directly, and the evaluator creates
its logger only to log a failure.
5. **Core: give the fields of an initialized event a source timestamp.**
`BaseEventState.Initialize` created its field variables without a
timestamp, so `BaseVariableState.ReadValueAttribute` called
`DateTimeUtc.Now` on every read of every field for every monitored item.
The fields now carry the event time (`ReceiveTime` its own value). The
read path is unchanged, so no `ReadChildAttribute`/`ReadValueAttribute`
override is bypassed.

## Measurements

`perf/ServerLoadHarness run --scenario events --sessions 50 --subs 15
--pub 100 --security encrypt --event-rate 0 --duration 15 --warmup 8`,
with `DOTNET_gcServer=1`, `SERVER_DOTNET_gcServer=1` and
`SERVER_DOTNET_TC_QuickJitForLoops=0`,
`SERVER_DOTNET_TC_OnStackReplacement=0`. Each build is stacked on the
previous one; values are the mean of 2 alternating rounds. Runs where
processes outside the harness used more than 1.5 cores were repeated.

| build | generated events/s | event→notify p50 | KB / generated event |
ms CPU / generated event |
|---|---|---|---|---|
| master | 768 | 69.8 ms | 567 | 2.97 |
| + O(1) dequeue | 791 | 68.4 ms | 566 | 2.78 |
| + filter context reuse | 818 | 68.8 ms | 354 | 2.75 |
| + duplicate index | 854 | 63.7 ms | 356 | 2.96 |
| + empty where clause | 891 | 63.7 ms | 273 | 2.77 |
| + event field timestamps | **1001** | **61.3 ms** | **272** | **2.66**
|

- **`--event-rate 500` (below capacity):** 3.34 → 3.03 ms CPU and 590 →
294 KB per generated event. Latency is unchanged (bound by the
publishing interval).
- **Default JIT, 40 s warm-up:** 804 → 1063 events/s, 568 → 268 KB, 2.69
→ 2.37 ms.
- **CPU traces:** the consumer thread's `ReadValueAttribute` self share
drops from 24 % to 6 % of the samples and `QueueEvent` self from 14 % to
5 %. The thread is still the bottleneck, now in the generic read chain
(`GetAttributeValue` → `ReadChildAttribute` → `FindChild`). The next
step would be to evaluate each event once per distinct filter rather
than per item, which is out of scope here.

## Notes for reviewers

- `EventMonitoredItemQueue.m_events` keeps its protected
`List<EventFieldList>` type, but dequeued slots now stay null at the
front until compaction. The queued events are the last `ItemsInQueue`
entries. Nothing in the repository reads the field outside the class
except the mirroring queue, which uses the new internal
`CopyQueuedEvents()`.
- Event field variables created by `Initialize` now report the event
time as `SourceTimestamp` instead of the time of the read.

## Related Issues

- No issue. Found by the server load investigation of publish-, write-
and event-heavy load.

## Checklist

- [ ] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed. (net10.0
only: Opc.Ua.Server.Tests 8990 passed, Opc.Ua.Core.Tests 6449 passed,
Opc.Ua.Redundancy.Server.Tests 922 passed. In the explicit Sessions
`ServerEventSubscribeLoadTest`, opc.tcp passes; https and opc.https fail
with HTTP 503, the same as on master.)
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-19 09:15:45 +00:00
Marc Schier 15d0ce7bd5 Implement OPC UA Part 10 Programs (#4789)
# Description

Implement OPC UA Part 10 Programs across `Opc.Ua.Core`/`Core.Types`,
`Opc.Ua.Server`, and `Opc.Ua.Client`, reusing the existing
state-machine, source-generation, node-management, auditing, and
streaming-subscription infrastructure.

- Add asynchronous provider-backed execution, standard controls,
internal/autonomous transitions, generation checks, and nested-state
activation/resumption.
- Add checked creation/adoption, vendor Create adapters, deletion,
recycling and instance limits, auto-delete, DI, and direct-construction
paths.
- Maintain ProgramDiagnostic2 and retained final results; publish
captured intermediate results and concrete transition/audit events with
access controls.
- Add generated SDK models/proxies, typed client discovery and reads,
event streams, and subscribe-before-call readiness handling.
- Add unit, connected client/server, generated Annex A-style model, and
NativeAOT coverage. Document usage and migration in `docs/Programs.md`
and related guides.

### Compatibility and design decisions

The linked Part 10 document is v1.05.00; namespace-zero definitions
remain aligned with 1.05.07. Documentation distinguishes normative
requirements from conflicting specification text and SDK conventions.

- Correct state numbers to Halted=11, Ready=12, Running=13,
Suspended=14. Generated subtypes retain inherited namespace-zero
state/transition identifiers.
- Managed Reset is Halted-to-Ready only. Preserve the existing low-level
Reset-from-Suspended behavior for compatibility.
- Preserve UInt32 limit types; use `UInt32.MaxValue` as a documented SDK
unlimited convention. RecycleCount overflow reports BadOutOfRange
without stopping unlimited execution.
- In-memory default with injectable providers. Durable recovery,
distributed execution/failover, and a production Annex A download engine
are excluded.

## Checklist

_Put an `x` in the boxes that apply. You can complete these step by step
after opening the PR._

- [ ] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [ ] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.

Tests and focused coverage evidence are above; the combined
tests/coverage checkbox remains open because a whole-repository coverage
increase has not been established. CLA status, CI/CodeQL results,
tracking-issue approval, and PR feedback are not asserted.
2026-10-15 09:19:25 +02:00
romanettandClaude Opus 5.5 9b034f8291 Enable nullable reference types centrally; migrate all unset and annotations-only projects (#4700)
# Description

Nullable reference types are now enabled once, in `common.props`, and
every project in the repository builds warning-clean with them.

**Configuration**
- `<Nullable>enable</Nullable>` lives in `common.props`. All per-project
`<Nullable>` settings are removed: 178 project files (enable,
annotations, and the `disable` in the three Aot test projects).
- 419 per-file `#nullable enable`/`restore` directives and the 4
`#nullable disable` directives are removed.
- Kept on purpose:
- The 5 `<auto-generated>` schema files (`UANodeSet.cs`, `UA Type
Dictionary.cs`, `OPCBinarySchema.cs`, `SecuredApplication.cs`,
`PInvokeHelper.cs`) keep `#nullable enable`. The compiler ignores the
project setting in generated code, so the directive is required there.
- `tests/Opc.Ua.Interop.LegacyPeer` keeps `disable`. It builds against
the 1.5.378 packages and does not import the repository props.
- `docs/DeveloperGuide.md` and `.github/copilot-instructions.md` now
describe the central setting.

**Migration** (the 43 unset and 13 annotations-only projects, roughly
10k diagnostics)
- **Production code: annotated at the declarations.** Covers
`tools/Opc.Ua.SourceGeneration.Core`, `src/Opc.Ua.Lds.Server` and the
LDS sample.
- Members, parameters and returns are nullable where null actually
flows.
- Null-check helpers carry `[NotNullWhen]` (`IsNull`, `IsValidXmlName`,
`IsMethodTypeDesign`).
- `CoreUtils.Format`, `Utils.Format`, `ITemplateWriter.WriteLine` take
`params object?[]`. `Template.AddReplacement` takes `string?` (rendering
already skips null replacements).
- `IRegisteredServerStore.RegisterAsync` returns
`Task<RegistrationEntry?>`: it returns null when a registration is
removed.
- Dereferences backed by an invariant (for example, the validated model)
use `!`, so runtime behaviour is unchanged.
- **Behavioural changes in production code** (small, deliberate):
- `NodeSetToModelDesign` throws `InvalidOperationException` when the
file is not a NodeSet. Before, it threw a NullReferenceException on the
next line.
- `ModelDesignValidator` starts its lookup tables empty instead of null.
A redundant `if (m_nodes == null) return;` guard is gone.
- **Test code: minimal annotations.**
  - `?` on values that can be null, `!` where the test asserts non-null.
  - `= null!` for fixture members assigned in SetUp.
- `TryGetStructure<T>(out T? x)` where the inferred `T?` broke the
`IEncodeable` constraint.
- A few redundant `== null` checks on structs (`NodeId`, `ArrayOf<T>`)
folded into the adjacent `IsNull`/`Count` checks.

**Notes for reviewers**
- The diff is large (~1,500 files) but almost entirely mechanical: `?`,
`!` and directive removal. The non-annotation changes are listed above.
- Known follow-up, not done here:
`IModelDesign.Namespaces/TargetNamespace/NamespaceUris` stay
non-nullable even though the validator returns null before it loads a
dictionary. Making them nullable would ripple through every generator
call site.

## Related Issues

- Fixes #4439

## Checklist

- [ ] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [ ] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.

The "no new warnings" box covers net10.0 and net48: full non-incremental
builds of `UA.slnx`, `tools/SourceGeneration.slnx`,
`tools/MigrationAnalyzer.slnx` and the Aot test projects finished with 0
warnings and 0 errors under the repository's warnings-as-errors
settings. net9.0 and net8.0 also had no nullable diagnostics, but they
were not rebuilt after the final fixes. Tests have not been run locally
yet.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-08 08:48:13 +02:00
Cristi PogaceanandCopilot Autofix powered by AI 9b8a3b1188 Preserve node initialization and copied child ownership (#4544)
# Description

Preserve populated derived node children through optional initialization
and give copied children independent ownership by their copied parent.

- Track initialization from a source in `NodeState` and guard generated
optional-default recreation without removing the optional initialization
hook.
- Reuse `CloneChild` for dynamic children, generated typed children, and
method argument properties. Preserve the clone root's existing external
parent.
- Add cross-model initialization/copy regressions, method-argument and
nested-child ownership tests, and inherited alarm-subtree checks.

This PR contains only the six files for this fix group.
Certificate-store, runtime-type-loader, publish-queue and
transport-exception fixes are separate work.

## Related Issues

Fixes #4525.
Fixes #4526.

## Validation

Fresh focused Release/net10.0 checks on the final base:

| Fixture | Passed | Failed | Skipped |
| --- | ---: | ---: | ---: |
| CrossModelInstanceTypeDefinitionGeneratorTests | 9 | 0 | 0 |
| Types NodeStateTests | 227 | 0 | 0 |
| Core StateTypesTests | 13 | 0 | 0 |

All three test commands exited 0. `git diff --check` and the
changed-file diagnostic check are clean.

Regression proof was also executed in the isolated worktree: with the
three production changes reversed, six generator cases failed with the
missing derived Temperature child while three controls passed; two copy
cases failed parent-identity assertions while the
external-parent/absent-arguments control passed. The production fix was
restored and the focused checks are green. The retained red runs
preceded the later upstream synchronization; the affected production
paths were unchanged by that synchronization.

Windows win-x64 NativeAOT publish and native execution also passed: main
178/178, Historian 2/2, MCP 3/3, no skips, every invocation exit 0.
These native runs preceded the final CTT-configuration/notes-only
fast-forward; this PR's six files were unchanged.

Local validation is intentionally change-scoped for this work, with the
full matrix and repository-wide checks left to PR CI. Repository
guidance and test assertions/timeouts were not modified. Local commands
used a NuGet v2 source override and disabled audit only on the command
line; CI feed/audit policy is unchanged.

Earlier broad attempts are not claimed as a completed local gate: an
unmodified-base durable restart timeout was reproduced before
synchronization (the later durable run passed), and the net48 runner
stalled after recording passing client tests. A direct client retry
subsequently exited 0, but the full net48 matrix was not completed.
Those results are not substituted for the focused evidence above.

## Checklist

- [x] I have signed the CLA and read the CONTRIBUTING doc.
- [x] I have added regression tests and demonstrated failure without the
production fix.
- [x] The focused tests pass; no new compiler diagnostics were reported
by those builds.
- [ ] Coverage and the full net48/net10.0 matrix are verified by PR CI.
- [ ] All CI, CodeQL, and review feedback is addressed.

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-09-25 12:23:49 +00:00
Marc SchierandCopilot da7412c429 Add native xRegistry events and distinct Resource versions (#4396)
## Summary

- support the xRegistry 0.6.0 distinct Resource/Version hierarchy:
  `Registry -> Group -> Resource -> Versions -> Version`
- instantiate stable logical Resource nodes separately from exact
Version nodes
  while preserving existing Version NodeIds
- delegate logical Resource FileType operations and Version-view
metadata to the
selected default Version with handle pinning and shared writer
reservations
- make Resource and Version delete behavior role-stable and use
`MetaEpoch` /
  `Epoch` respectively
- use stable Resource SourceNodes, exact Version SourceNodes and the
  `Server -> Registry -> Group -> Resource -> Version` notifier chain
- keep a model-metadata-gated client fallback for 0.5 flat Servers; 0.6
Servers
  expose no legacy aliases
- target `HasWoTProjection` at the real stable logical Resource node
- use `AsyncCustomNodeManager` for the registration, fast-path, and
federation managers,
  with awaited lifecycle, node mutations, event delivery, and cleanup
- handle startup rollback, reentrant deletion callbacks, undisclosed
file handles,
  and retryable cleanup without blocking unrelated file operations

## Authoritative dependencies

- companion specification: OPCF-Members/spec-drafts#32 at
  `d3399fca025025a73e5a6b599f850a81d985c060`
- OPC UA binding: xregistry/spec#568
- xRegistry event semantics: xregistry/spec#563, merged as
  `66ee31e47fbadff6ab982ae1516f7d9065e46b64`
- companion NodeSet SHA-256:
  `369f5f3f1814b333e4eeb52bfb4b6a730cdff372505a5f91a54c94f0016ac4cf`

## Review feedback

- keep the WoT Connectivity information-model designation at `1.1`;
draft revisions update the publication date without changing the model
version
- eliminate all 198 unique CA1861 diagnostics across 54 files and remove
seven obsolete project suppressions
- fix the analyzer-clean touched-path CA1307 and the hierarchy follow-up
CA1846/CA1851 diagnostics without dropping legacy-TFM compatibility

- recover the reconcile queue after callback faults/cancellation and
continue accepted pending changes
- remove migration guidance for the xRegistry managers, which are new in
2.0

## Compatibility

- public WoT Connectivity model designation remains `1.1`
- generated event-record ABI, constructors, options, NodeIds, and stored
documents remain compatible
- the generic xRegistry managers are new in 2.0 and implement
`IAsyncNodeManager`;
use `IAsyncNodeManagerFactory` and the async lifecycle hooks (see
`docs\XRegistry.md`)
- persistence schema and document blobs remain compatible unless noted
below

## Validation

- merge validation at `980422f76` with upstream `e8bec27d5`: 454
targeted WoT/materialization/model/registry cases and all 327 XRegistry
cases passed on both net10.0 and net48; all 29 net10 aggregation sample
cases passed
- feedback regressions at `308e8ba74`: 55 targeted queue and live
registry event/projection/lifecycle cases passed on each of net10.0 and
net48
- prior CI: all 266 checks passed at `6489a0908`; the unchanged Ubuntu
Core certificate-counter test and dependent jobs passed on the one-time
retry ([run 34117304035, attempt
2](https://github.com/OPCFoundation/UA-.NETStandard/actions/runs/34117304035/attempts/2))
- `Opc.Ua.XRegistry.Tests` — 327 passed on net10.0 and net48 for
migration commit `32c914aaf`
- `Opc.Ua.WotCon.Tests` net10.0 — 1348 passed
- `Opc.Ua.WotCon.Bindings.Tests` net10.0 — 683 passed
- `Opc.Ua.SourceGeneration.Core.Tests` net10.0 — 3807 passed, 8 skipped
- `Opc.Ua.SourceGeneration.Tests` net10.0 — 145 passed
- `Opc.Ua.SourceGeneration.Stack.Tests` net10.0 — 94 passed
- affected XRegistry and WoT client/server projects build successfully
- xRegistry NodeSet is byte-identical to the companion artifact
- repository-wide CA1861 inventory — 198 unique diagnostics across 54
files reduced to zero
- targeted changed-fixture validation — 1,098 passed, 3 skipped, 0
failed
- constrained full `UA.slnx` net10.0 Release build — CA1861 = 0
- `Opc.Ua.XRegistry.Client` net472 and netstandard2.1 builds — 0
warnings, 0 errors
- independent shared-array safety review — no significant issues
- `git diff --check`

The final review regressions cover concurrent reconcile/open, synthetic
logical
handle collisions across default switches, cross-session Close
isolation,
shared writer reservations, logical FileType property/change
propagation,
logical Labels delegation, role-fixed deletion, event sources,
model-version
gating, and stable `HasWoTProjection` targets.

The companion specification and protocol binding are reviewed in the
linked PRs above.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 5c79a1ed-6dab-4522-a9fc-6548caa78ad5
Copilot-Session: b605797f-a97a-4cd0-8f12-016d33c2fd88
Copilot-Session: 7ef369a5-2307-4f71-8a11-15af0e72f240
Copilot-Session: e716d455-8397-4d22-9c5a-398847ab7317
2026-09-08 04:46:40 +00:00
Marc Schier 7cec2d614d Move repository files to the consolidated layout 2026-07-16 06:25:54 +02:00