GithubStar/UA-.NETStandard
1
0
Fork 0
mirror of https://github.com/OPCFoundation/UA-.NETStandard.git synced 2026-10-29 15:11:53 +08:00
Code Issues Packages Projects Releases Wiki Activity
2,918 Commits 77 Branches 105 Tags
72073533df862bcccbe294d8d9b105e5e56faed5
Commit Graph
2918 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Marc 72073533df Fix native QUIC NUnit 5 diagnostics 2026-10-19 21:00:20 +02:00
Marc 8f45120608 Await NUnit 5 async assertions 2026-10-19 20:24:13 +02:00
Marc c34300540e Align native workflow with pinned .NET SDK 2026-10-19 19:39:19 +02:00
Marc ad0190c001 Merge origin/master into data-channels-quic-experimental 2026-10-19 19:27:24 +02:00
Marc 3ed28c6037 Quote Linux Go test arguments in PowerShell 2026-10-19 18:22:56 +02:00
romanettandClaude Opus 5.5 d7c2ed6caf Client: smaller per-monitored-item footprint (listener array, lazy pending-change queue, shared logger) (#4847) 
# Description

Every V2 monitored item (`Opc.Ua.Client.Subscriptions`) cost about 3.8
KB of managed heap on a 24-core machine (2.8 KB on 1 core). Most of that
was per-item infrastructure whose size grows with the processor count.
With 100k items, a client limited to 256 MB (container-like) ran out of
memory during subscription setup.

- **`OptionsMonitor<T>`**: `OnChange` listeners are kept in a
`Listener[]` that is replaced as a whole on each add or remove
(`Interlocked.CompareExchange`), instead of a `ConcurrentDictionary`.
That dictionary's default concurrency level allocated one lock object
per processor for every monitored item (~1.4 KB on 24 cores).
Notification, dispose and double-dispose behave as before; listeners are
now called in registration order.
- **`MonitoredItem`**: pending changes are kept in a `Queue<Change>`
guarded by the existing `m_pendingChangesLock` instead of a per-item
`ConcurrentQueue<Change>` (~810 B, 32-slot segment). The queue is
created on enqueue and dropped once the last change completes, so idle
items hold none. `HasPendingChanges`, `TryGetPendingChange` and
`CompleteChange` now take the lock. `TryRequeue` used to enqueue without
the lock and now enqueues under it.
- **`DefaultSubscription`** shares one `ILogger` across its monitored
items instead of creating one per item.

## Measurements

These numbers come from the `ServerLoadHarness` client GC line (harness
changes are in #4844): `run --scenario sub --sessions 25 --nodes 100
--pub 500 --write-interval 100 --duration 10 --warmup 6`. All figures
are client gen2 MB.

| Config | Items | Before | After |
|---|---|---|---|
| 24 cores, `--subs 20` | 50k | 190.0 / 188.7 | 62.9 / 64.0 |
| `--client-cores 2 --client-memory 256`, `--subs 20` | 50k | 142.6 |
54.6 |
| `--client-cores 2 --client-memory 256`, `--subs 40` | 100k | out of
memory | 122.6 (limit 192) |

That saves about 2.6 KB per item on 24 cores and about 1.8 KB on 2
cores. The whole client heap is now about 1.3–1.4 KB per item.

## Related Issues

- None

## Checklist

- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage. (`OptionsMonitorTests`:
order, removal, duplicate callbacks, concurrent add/remove)
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings. (`Opc.Ua.Client` Release build on all targets,
including net48: 0 warnings)
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed. (Only
`Opc.Ua.Client.Tests` on net10.0 was run: 3231 passed, 0 failed, 2
skipped.)
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-19 18:11:11 +02:00
Marc Schier 9bfc780e14 Update NuGet dependencies and migrate tests to NUnit 5 (#4840) 
# Description

Update 55 NuGet dependencies to the latest stable releases available on
2026-10-19, preserving documented compatibility pins and
framework-specific version bands. Existing OpenUSD prereleases remain
unchanged because no newer releases are available.

Migrate existing tests to NUnit 5: await asynchronous assertions,
propagate async through helpers, handle nullable predicates, and replace
obsolete `Order` attributes with sequencing dependencies. Sequencing
dependencies use `AllowFailure = true`; filtering a dependent test also
runs prerequisites. Adjust fixture-level parallelism where NUnit
dependency scheduling requires it.

Keep Roslyn API/runtime pins intact; select newer Immutable/Metadata
runtime packages only for test and profiling hosts requiring them.
Update the approved SDK pin to 10.0.402 across local, CI, and container
builds. Document NUnit 5 conventions.
 2026-10-19 15:23:29 +00:00
Marc cc9f0eecea Fix Linux native verifier path 2026-10-19 17:05:38 +02:00
romanettandClaude Opus 5.5 a07f4eb1ac Aggregates: Average, Count, Delta, StdDev, Variance use Good values only (Mantis 11495) (#4846) 
### Why
The OPC Foundation answered [Mantis
11495](https://mantis.opcfoundation.org/view.php?id=11495) on 2026-10-12
(~0025874), as it had in
[7975](https://mantis.opcfoundation.org/view.php?id=7975) before:
- The general rules of Part 13 §4.2.1.2 apply only where an aggregate
definition says nothing else.
- Count counts only Good values; Bad and Uncertain values are never
counted, but they affect the status.

Average (§5.4.3.3), Delta (§5.4.3.27) and StandardDeviation*/Variance*
(§5.4.3.37–§5.4.3.40) also speak of Good values. With
TreatUncertainAsBad = False the server treated Uncertain values as Good
for these aggregates. That is CTT item U5 in `plans/ctt-issues.md`:
about 34 test cases in Aggregate `003-02/03`, `004-02/03`.

### Change
- `AggregateCalculator.IsGoodValue`: Good only, whatever
TreatUncertainAsBad is. It is used by Average, Count, Delta and
StandardDeviation/Variance.
- `GetValueBasedStatusCode(..., goodValuesOnly: true)` is used by
Average and Count: an Uncertain value counts as non-Good, so 2 Good + 1
Uncertain gives `UncertainDataSubNormal`, not Good.
- Unchanged:
- NumberOfTransitions: its definition compares non-Bad values; U6 is
still open.
- Time-based aggregates, bounds, and Minimum2/Maximum2 still follow
TreatUncertainAsBad as before.

### Tests
- Updated to the answer: `AverageExcludesUncertainValues` and
`DirectAndLiveCountExcludesUncertainValuesAsync`.
- New: `DirectAndLiveGoodValueAggregatesExcludeUncertainValuesAsync`,
which covers Delta, VarianceSample and StandardDeviationPopulation,
direct and live, with both TreatUncertainAsBad values.
- `ProcessedReadUsesAdvertisedNodeAggregateDefaultsAsync` now checks the
advertised TreatUncertainAsBad default through TimeAverage, because
Count no longer depends on it.
- Local runs (net10.0):
  - Opc.Ua.Server.Tests aggregates: 496/496;
  - Opc.Ua.History.Tests: 536 passed, 28 skipped;
  - client Historian tests: 118/118.
- CTT p06 (Aggregates) against this build, with the patched scripts no
longer correcting U5: 1264 pass, 0 errors, 0 warnings.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-19 16:20:36 +02:00
Marc 3788921ffb Update QUIC STOP regression expectations 2026-10-19 16:10:29 +02:00
Marc SchierperfCopilot
 		a10f9e252d Generic runtime continuation, batch lifecycle and readiness (#4759) 
# Description

This pull request extracts and integrates generic server runtime and
continuation-management capabilities for OPC UA NodeManagers.

- **NodeManager lifecycle and routing:** add batch registration and
reload, staged publication and readiness notifications, captured routing
snapshots and reservations, and safe retirement. Wire the lifecycle
through host interfaces, async/sync adapters, `MasterNodeManager`, and
`StandardServer` startup and shutdown.
- **Browse and History continuations:** retain continuation ownership
and manager dependencies across requests and reloads; add atomic claims,
session caching, and cleanup when requests fail or generations retire.
Add historian resume state, tokens, dependency capabilities, and shared
continuation-store support.
- **MonitoredItem lifecycle:** support detaching and reattaching items
across node-manager generations, including event subscriptions shared
across root notifiers and correct defaults for detached-item
modification.
- **Runtime NodeSet references:** track reference additions and
deletions through supported API paths and preserve the tracked
references during reload.
- **Published views and materialization:** add immutable `TypeTable` and
`EncodeableFactory` snapshots with publication-owner lifetime
management, and provide a live node-materialization query for the
existing WoT projection-view consumer.
- **CI trace support and documentation:** add scripts and tests for
staging NUnit internal traces, and document NodeManager lifecycle,
session continuation ownership, and historical-access behavior.

## Related Issues

- Extracts the generic runtime portion of #4511.
- #4757 depends on this pull request; this pull request does not depend
on #4757.

## Checklist

_Put an `x` in the boxes that apply. You can complete these step by step
after opening the PR._

- [ ] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [ ] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [ ] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.

---------

Co-authored-by: perf <perf@local>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-10-19 16:08:37 +02:00
Marc 4a17ecb7a9 Preserve WebTransport reliable prefix on STOP_SENDING 2026-10-19 15:48:24 +02:00
romanettandClaude Opus 5.5 e8c5d800a6 plans/ctt-issues.md: refresh Mantis states and OPC answers, condense (#4843) 
Brings `plans/ctt-issues.md` up to date with Mantis as of 2026-10-19 and
makes it shorter (427 → 347 lines). Documentation only.

### Mantis state
- Resolved issues are marked **(fixed)**: 11097, 11106, 11125/11248,
11144/11269, 11257, 11259, 11262, 11263, 11268, 11347.
- Abstracts were corrected after the Mantis discussions: C10, C11, C13,
C23, C24, C29, C46, 15, 18 and 19.
- New rows:
- C15b ([11476](https://mantis.opcfoundation.org/view.php?id=11476),
View validator);
- [11475](https://mantis.opcfoundation.org/view.php?id=11475) on item
18;
- duplicates [11466](https://mantis.opcfoundation.org/view.php?id=11466)
(C1) and [11509](https://mantis.opcfoundation.org/view.php?id=11509)
(item 14).
- **C64:** Int32 bound truncation, now filed by another reporter as
[11494](https://mantis.opcfoundation.org/view.php?id=11494) (spec clone
[11499](https://mantis.opcfoundation.org/view.php?id=11499)). It
replaces the unfiled "Int32 conversion" text.
- **C21:** the OPC Foundation decided on
[11411](https://mantis.opcfoundation.org/view.php?id=11411) to test
negated Like lists only at the start or end of a string until Part 4 is
clarified.

### OPC Foundation answers
- **U4** is rewritten around the common rule from Paul Hunkar's answers:
*the aggregate definition wins over TreatUncertainAsBad*
([11462](https://mantis.opcfoundation.org/view.php?id=11462),
[11425](https://mantis.opcfoundation.org/view.php?id=11425),
[11426](https://mantis.opcfoundation.org/view.php?id=11426),
[11427](https://mantis.opcfoundation.org/view.php?id=11427),
[11495](https://mantis.opcfoundation.org/view.php?id=11495)).
- It records that 11427 ~0025875 and 11426 ~0025852 conflict for an
Uncertain value below the minimum.
  - The 11462 follow-up (~0025849) is still unanswered.
- **U5** is answered by 11495 ~0025874 (and the earlier 7975): Count
(and by the same rule Average, Delta, StandardDeviation* and Variance*)
excludes Uncertain values also with TreatUncertainAsBad = False. **The
server currently includes them, so a server change is needed.**
- **U6** (new, open): NumberOfTransitions with TreatUncertainAsBad =
True.
- A new **Server follow-ups** section lists what the answers require of
the server: U5, a possible C48/C49 change, C38 diagnostics visibility
(11445 ~0025750), and C64 depending on 11499.

### Not filed
- Added C58–C63: CTT script defects fixed in the patched CTT scripts,
including the C60 publish-thread stall. Also added C65 (the GetBadData
forward read, related to
[11505](https://mantis.opcfoundation.org/view.php?id=11505)) and C66
(non-numeric aggregates; not filed because the CTT's values were not
recorded).
- Removed the inline draft Mantis texts for C54/C55, and condensed the
prose and the configuration notes.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-19 15:19:37 +02:00
Marc 690ea3dddd Fix flaky data channel budget assertions 
Check per-flow DATA reservations instead of the shared message total, which also counts concurrently admitted control frames. Dispose shared Core contexts before asserting that close-control reservations have drained after PubSub stops.
 2026-10-19 13:25:41 +02:00
romanettandClaude Opus 5.5 42bfb709c5 Channel send order: tests for concurrent producers, reconnects and the writer stop (#4838) 
Test-only. Adds tests for the guarantees of the channel writer
introduced in #4782 ("seal in the writer"). The existing tests cover
them for a few producers or one message at a time. No product code
changes.

They come from roadmap item R6 of the o6 benchmark gap analysis, a
lock-free queue for the producers' responses. That queue no longer pays
off once #4805 and #4833 are in: at steady state the send path costs
about 0.5 µs per request, and removing its lock left CPU per request
unchanged. So the queue is not proposed, but its tests check the current
writer and pass on master unchanged.

## Tests

All in `UaSCBinaryChannelSendOrderTests`:

-
**`ManyProducersWithNumberedMessagesAndTokenChangesKeepTheWireOrderAsync`**
(repeated 3×):
- at least 32 producer threads (twice the processor count) send
responses of random size, some split into chunks;
- meanwhile, one producer queues messages numbered under `SendOrder`, as
OpenSecureChannel responses and faults are, and another activates 15 new
tokens.
- Checked: consecutive sequence numbers on the wire, contiguous chunks,
every response exactly once, and no token used after its successor.
- **`ResponsesQueuedWhileTheWriterStopsAreSentAsync`**: one producer
queues each response the moment the previous one reaches the wire, which
is when the writer finds its queue empty and stops. It runs 20,000
times, and every response must be sent.
- The producer waits with `Task.Yield`, not by spinning. The writer is
queued to the producer's local work queue, and a spinning producer would
hold it.
- It uses one producer on purpose: with several, the next producer's
response restarts the writer and carries a stranded one along, which
hides the bug.
- **`AReconnectWhileProducersQueueSendsTheOpenResponseFirstAsync`**
(repeated 3×): eight producers keep sending while the transport is
replaced. The new transport is attached and the OpenSecureChannel
response numbered under one hold of `SendOrder`, as a reconnect does.
Checked:
- the OpenSecureChannel response is the first message on the new
transport, and the transport numbers on without a gap;
  - nothing is sent on both transports;
  - every response queued after the reconnect arrives;
  - every buffer is returned.
- **`ASealFailureInTheMiddleOfABatchStopsTheNumberingAsync`**: six
responses wait in one batch behind a held send. The first fails to
secure after it took its sequence numbers. Checked:
- no message after it is sent, including one queued after the encryption
works again;
  - the channel reports one transport error;
  - every buffer is returned.

Test helpers:
- `OrderServerChannel`: `ReconnectForTest`, `ActivateTokenForTest`;
- `RecordingTransport`: `SendCount`, `SentChunks()`;
- the test class: `AssertContiguous`, for a transport that only carries
part of the messages.

## Mutations

Each test was run against a deliberately broken channel. Each break was
temporary and is not in this PR:

| Change to `UaSCUaBinaryChannel` | Fails |
|---|---|
| A producer reads the writer's running flag before it takes the write
queue lock, so a writer that stops in between strands the response |
`ResponsesQueuedWhileTheWriterStopsAreSentAsync` (3 of 3 runs) |
| The writer takes unsealed responses ahead of producer-numbered writes
|
`ManyProducersWithNumberedMessagesAndTokenChangesKeepTheWireOrderAsync`,
`RandomReceiveSendAndRenewalInterleavingKeepsTheWireOrderAsync` |
| The writer numbers again after a seal failure left a gap |
`ASealFailureInTheMiddleOfABatchStopsTheNumberingAsync`,
`ASealFailureAfterNumberingStopsTheChannelAsync` |

## Testing
- Local, net10.0: `UaSCBinaryChannelSendOrderTests` and
`TcpReconnectKeyAgreementTests`, 61 passed.
- net48 builds without warnings. `dotnet format whitespace
--verify-no-changes` passes on the changed file.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-19 10:59:07 +00:00
romanettandClaude Opus 5.5 33d6d29e12 Server: wake fair queue workers through a LIFO signal, let a looking worker take new requests (#4833) 
Request queue workers of the `FairRequestQueue` waited on a bounded
`Channel<bool>(1)` for the coalesced wake token. With many cores, its
monitor became the server's largest lock contention point, and each wake
cost a channel operation, an allocated wait and a thread-pool hand-off.
This PR replaces that signal and lets a worker that just finished a
request keep looking for the next one for a few microseconds before it
parks.

The concept is unchanged:
- requests are admitted into the fair queue;
- `MinRequestThreadCount`/`MaxRequestThreadCount` workers dequeue and
run them;
- the receive loop is not touched;
- weighted fairness, the per-owner and global limits, leases, admission
and `BadServerTooBusy`, cancellation with an exactly-once lease release,
stop and drain, and parked publish requests behave as before.

There are no wire, public API or configuration changes.

## Results

Paired A/B against `master` fc0687a2d (with #4787, #4788, #4805, #4812),
5 rounds per scenario. The builds alternate per round, starting side
swapped every round. A run during which another test host or load
harness ran was discarded and repeated. Medians, ranges in brackets.

The o6read rows use the o6-automation benchmark's native open62541
client workers against the server configured like the o6 2.0.1 worker:
- `AsyncCustomNodeManager`;
- Server GC;
- queue sized clients × in flight + 3;
- 200 workers unless noted.

They run at steady state: 100,000 warm-up calls per client, then 300,000
measured. See the note on the default run below.

Machine: Ryzen AI 9 HX 370 (4 Zen 5 cores = logical 0–7, 8 Zen 5c
cores), 24 logical processors, Windows 11.

| Scenario | req/s master → this PR | Server CPU µs/req | Contention
events/s |
|---|---|---|---|
| o6read 10×100, 24 cores | 567.8k → **688.6k (+21 %)** | 28.1
[25.6–30.1] → **23.1 [22.3–25.8] (−18 %)** | 883 → 183 |
| o6read 10×1000, 24 cores | 536.2k → **656.0k (+22 %)** | 28.8 → **21.7
(−25 %)** | 264 → 34 |
| o6read 10×100 encrypted, 24 cores | 450.5k → **508.1k (+13 %)** | 32.2
→ **26.0 (−19 %)** | 273 → 68 |
| o6read 10×100, 8 Zen 5 threads (`0xFF`) ¹ | 423.3k → **731.8k (+73
%)** | 18.4 [15.9–18.9] → **10.4 [10.2–10.8] (−43 %)** | 301 → 234 |
| o6read 10×100, 4 Zen 5 threads (`0xF`) ¹ | 394.6k → 427.9k (rounds
overlap) | 9.0 [8.7–13.8] → 8.7 [8.5–10.8] | 68 → 58 |
| same, encrypted ¹ | 375.6k → 400.2k (rounds overlap) | 9.6 [9.4–10.4]
→ 9.4 [9.3–10.9] | 15 → 7 |
| o6read 10×100, `MaxRequestThreadCount` 16 | 593.8k → 705.1k | 26.8 →
22.8 (−15 %) | 693 → 188 |
| same, 64 | 576.6k → 695.1k | 27.9 → 23.5 (−16 %) | 729 → 161 |
| same, 200 | 585.1k → 692.5k | 27.2 → 22.9 (−16 %) | 812 → 186 |
| o6read 10×100, default short run (100k calls) | 312.3k → 335.8k | 60.5
→ 56.7 | 739 → 160 |
| `read --nodes 1`, 20 sessions | 233.0k → 230.9k | 45.4 → 45.0 | 267 →
9 |
| `read --nodes 1`, 200 sessions | 233.5k → 237.2k | 38.9 → 39.5 | 222 →
78 |
| `read --nodes 1`, `--client shared` | 97.7k → 98.0k | 33.9 → **30.4
(−10 %)** | 13 → 6 |
| `browse` | 41.3k → 41.8k | 153.3 → 153.0 | 24,139 → 24,618 |
| `sub` (notifications/s) | 88.3k → 88.0k | 7.6 → 8.0 (noise: 6.2–8.9 /
7.3–8.9) | 1 → 1 |

Latency (`read`, `browse`, `sub`): p50 and p99 unchanged or lower.
Examples:
- `read`, 20 sessions: p99 0.76 → 0.70 ms;
- `read`, 200 sessions: p99 4.70 → 4.55 ms;
- `read`, shared client: p99 0.98 → 0.93 ms.

Allocated bytes per request are unchanged (±1 %).

**What the numbers show.**
- With many cores the wake path was the cost. The configured worker
count no longer matters: 16, 64 and 200 workers cost the same.
- The largest gain is with 8 logical processors. There every hand-off to
a parked worker took one of few cores away from the receive loops.
- At 4 logical processors this PR is neutral. The first version spun
there too and cost about 13 % req/s (measured by the o6 gap analysis:
8.8 → 10.0 µs per request); readers now spin only with at least 8
processors.

¹ Rows marked ¹ are from a later paired run (5 rounds, same method) of
the current head against `master` fc0687a2d. The other rows are from the
head before the last commit, which changed nothing above 8 processors.

**Traces** (o6read 10×100 at 24 cores, same window, one run per side):
- Contention events: 4,313 → 786. On master, 56 % were the wake
channel's monitor (`DequeueAsync` → `BoundedChannel` lock, plus
`Pulse`). After this PR the fair queue accounts for about 1.5 %.
- On-CPU samples: `Monitor.Enter_Slowpath` 2.9 % → 0.2 %, and the
`DequeueAsync` state machine 2.7 % → 0.3 %.
- `TrySpinDequeue` is 9 % of the samples. That is the time workers spend
looking instead of being woken through the pool.

**The default o6read run measures JIT warm-up.** The o6 benchmark's
default parameters (10,000 warm-up and 100,000 measured calls per
client, about 3.5 s) put tier-0 code into the measurement at 24 cores.
The same server runs at about 60 µs per request in the short run and
about 28 µs at steady state; with `DOTNET_TieredCompilation=0` the short
run gives about 30 µs. The steady-state rows above are the ones that
compare the queue. The "24-core cost doubles" observation in the o6 gap
report comes mostly from this warm-up, not from the hand-off.

## Changes

### `WorkerWakeSignal` (new, internal)
The coalesced wake token, without a channel:
- At most one token is outstanding. `TryIssue` creates it with one
compare-and-swap. It hands the token to the most recently parked worker
(a LIFO stack under a small lock), or leaves it for the next worker,
which then does not park.
- While a woken worker has not run yet, further issues are coalesced, as
before. The token is consumed when the woken worker resumes, and that
worker looks at the queue afterwards, so no change is missed.
- Each worker reuses one waiter (`IValueTaskSource`), so parking
allocates nothing.
- A woken or cancelled waiter resumes on the thread pool
(`IThreadPoolWorkItem`, global queue), never on the thread that issued
the token, so a request is never executed on the receive loop.
- A cancelled waiter leaves the stack. A token handed to a waiter whose
cancellation raced the wake is passed on. `Close` ends every parked
wait.

### `FairRequestQueue`
- **Spin before parking.** `DequeueAsync` looks once more for up to 5 µs
before parking (`SpinWait`, which yields and reaches GC safe points). At
most `ProcessorCount / 8` workers spin at once; with fewer than 8
processors none do, because a spinning worker takes a processor the
receive loops need.
- While a worker is looking, `Pulse` wakes nobody: the looking worker
sees the change through the queue's version.
- A spinning worker leaves the count before its last look, and a change
is published before its `Pulse`. So either the worker sees the change,
or the `Pulse` sees nobody looking and wakes a parked worker.
- A worker that takes a request while spinning pulses afterwards for the
rest of the backlog.
- **Adaptive spinning.** A spin that finds work raises a score; one that
runs out lowers it. At zero, only one parking worker in 16 probes with a
spin. Workers therefore keep spinning while at least about a third of
the spins find work, and moderate loads such as `browse` do not pay for
spins that find nothing.
- With 20 µs spins and no score, `browse` cost +6 % CPU per request.
With 5 µs and the score it costs the same as master.
- **Hot counters on separate cache lines.** The request count,
ready-token count, version, sequence, spinner count and wake statistics
are each on a cache line of their own (`HotCounters`), away from the
queue's read-mostly fields. `IsStopped` uses a full fence and a read
instead of an interlocked operation on the flag, which took the flag's
cache line exclusively on every admission and dispatch. In an
intermediate measurement this was worth 25.4 vs 26.9 µs per request at
24 cores.
- `DequeueAsync(waiter, ct)`: the worker overload. `DequeueAsync(ct)`
remains for callers without a waiter.

### `ServerBase.RequestQueue`
Each worker creates its waiter once and parks without registering on the
shared stop token. Stopping disposes the fair queue, which ends every
parked wait, as the channel completion did before.

## Measured and not kept
- **Spin duration and spinner count:** 2, 5, 20, 50 and 200 µs, with 1,
3, 6 or 12 spinners.
- The o6read gain is the same from 5 to 50 µs; 2 µs loses most of it at
8 processors.
- With 1 spinner the gain is smaller at 24 cores; with 6 or 12, CPU
rises.
- At 4 processors, one spinner cost about 13 % req/s at steady state; no
spinner is neutral against master.
- **Spinning without the channel replacement, and the channel
replacement without spinning:** each gave little alone (o6read 24 cores:
29.7 µs with spinning off vs 26.6 µs with it).
- **No new configuration knob:** the defaults did as well as any setting
tried.

## Testing
- New `WorkerWakeSignalTests`:
  - a token issued without a waiter;
  - coalescing until the token is consumed;
  - LIFO wake order;
  - continuation off the issuing thread;
  - a cancelled waiter leaving the stack;
  - cancellation racing a wake never losing the token (500 rounds);
  - `Close`;
- no lost wake with reused waiters (20,000 items, 3 producers, 6
consumers).
- New and extended `FairRequestQueueTests`:
- the lost-wakeup stress with spinning off, default and forced (1, 2 or
8 spinners, 50 µs), weighted and FIFO, with reused waiters;
  - a spinning reader takes a request without waking a parked one;
  - spins that run out stop spinning without losing wakes;
- a parked reader cancelled while a request arrives strands nothing, and
the lease is released exactly once (300 rounds);
- the configured worker count bounds concurrent execution (1 and 3
workers);
  - stop while workers spin or park.
- Local, net10.0:
  - Opc.Ua.Core.Tests: 6,555 passed, 88 skipped;
  - Opc.Ua.Server.Tests: 8,945 passed;
  - Opc.Ua.Sessions.Tests: 858 passed, 379 skipped;
- Opc.Ua.Redundancy.Server.Tests and .Client.Tests: 884 and 134 passed;
  - Opc.Ua.Stress.Tests Contract + Integration: 45 passed.

These suites ran on the branch before the rebase onto #4812. After the
rebase: Opc.Ua.Core.Tests Stack.Server 1,930 passed, 80 skipped;
Opc.Ua.Server.Tests ResourceIsolation and RequestQueue 185 passed.
- net48 builds; the new code uses `SpinWait` without `Sleep(1)` there.
- The Explicit `LoadTest` fixture fails 12 tests on master too (HTTPS
`BadServerTooBusy`, subscribe receive ratio, ArrayPool diagnostics). On
the branch, one opc.tcp event subscription run also failed (drain cap
reached at 0.91). Reruns: branch 3/3 passed, master 2/3 (0.61 in the
failing run).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-19 12:31:47 +02:00
Klaus LandsdorfMarc SchierCopilot Autofix powered by AI
 		0f85a9f719 AutoID: the OPC UA for AutoID Devices companion SDK (OPC 30010) (#4825) 
# Description

This completes the AutoID contribution proposed in #4824: the model
package for [OPC 30010 OPC UA for AutoID
Devices](https://reference.opcfoundation.org/AutoID/v101/docs/) (1.01)
plus the server, the client, an MCP profile and a sample pair, in one
PR. It follows the newest companion pattern (GMS #4765, MachineTool,
CranesHoists, MachineVision).

## Commits

1. `fix(sourcegen)`: a structure property whose DataType a subtype
refines is redeclared with its own field (the NodeSet needs it;
unchanged from the first slice).
2. `feat(autoid)` model package `Opc.Ua.AutoID` (unchanged from the
first slice). Adds only `AutoIdReaderKind`.
3. `feat(autoid)` server package `Opc.Ua.AutoID.Server`.
4. `feat(autoid)` client package `Opc.Ua.AutoID.Client`.
5. `feat(autoid)` MCP profile `Opc.Ua.Mcp.AutoID`.
6. `feat(autoid)` samples `samples/AutoID`.
7. `build(autoid)` solution, package list and package validation tests.
8. `fix(autoid)` x3, `docs(autoid)` and `test(autoid)`: review fixes,
net48 compatibility, documentation, the native AOT test.
9. `fix(autoid)` x3 and `feat(autoid-client)`: `GetLocation` location
types, the `Client` of access events, the default scan cycle of the
simulated readers, and NodeIds and methods in the device snapshot
(details below).
10. `feat(autoid)`, `test(autoid)`, `docs(autoid)` (`afdd7858b`,
`22bc3b26e`, `ed25fe4ae`, on top of the master merge `1c7948f65`):
AutoID composes into an existing Device Integration owner like Pumps and
Scales (review feedback; see "Composition with other DI-based
companions").
11. `1458af9e9` (marcschier): the `AutoIdReadOptions` remarks state that
`StatusOnly` limits the values read and that each call still browses
(Copilot review).
12. `fix(autoid)` `3ef2f1507`: `GetDeviceLocation` answers with the same
status codes as `GetLocation`; `feat(autoid-mcp)` `f6405152f`:
`autoid_read_device` shows the new snapshot NodeIds and methods (details
below).

## Server: `Opc.Ua.AutoID.Server`

- Reader devices (RFID, OCR, optical, optical verifier, RTLS) on the DI
device model, created by a fluent builder (`AutoIdRuntime.Reader(name,
provider)`) and hosted with `AddAutoId` / `ConfigureAutoId` on
`IServiceCollection`.
- Hardware is behind provider interfaces: `IAutoIdReaderProvider`,
`IAutoIdScanProvider` (Scan), `IAutoIdAsyncScanProvider`
(ScanStart/ScanStop), `IAutoIdRfidProvider` (ReadTag, WriteTag,
WriteTagID, KillTag, LockTag, SetTagPassword, each opt-in by flag),
`IAutoIdRtlsProvider`. Providers push scans, presence, log entries and
access events through `IAutoIdReaderSink`. In-memory providers (an EPC
Gen2 tag model with banks, passwords, locks and kill) are included for
tests and samples.
- Optional children (methods, `LastScanData`, `DeviceLocation`,
`AntennaNames`, location methods) exist only when the provider supports
them. Facet profiles and conformance units are advertised only for what
is implemented (`IConformanceContributor`); the Full facet is withheld.
- `GetLocation` (OPC 30010 6.6.3.2) returns the location in the
requested `LocationType`. An unsupported type is `Bad_InvalidArgument`,
an unknown object `Bad_NotFound`, and a supported type the object's
location is not available in `Bad_InvalidState` (6.6.3.2: "not available
or not allowed e.g. due to special configuration"); a provider result of
another type never reaches the client. `InMemoryRtlsProvider` takes an
optional location converter, for example from the configured local
coordinate system (9.3.4) into WGS84.
- `GetDeviceLocation` (6.1.3.7) uses the same mapping: an undefined
location type is `Bad_InvalidArgument`, a device location that is not
available in the requested type `Bad_InvalidState` (it answered
`Bad_NotSupported` before). 6.1.3.7 lists only "Standard OPC UA status
codes defined for the Call Service in OPC 10000-4"; there
`Bad_NotSupported` means "The Method is not supported for the Object
instance", which is wrong for a published method, and OPC 10000-4
5.12.2.4 allows reusing an existing status code with the same canonical
meaning, so the method follows 6.6.3.2.
- Access events (7.10, 7.11): `Client` is "the name of the client
application which was the originator of the command", so it is the
application name of the session's client description (else its
application URI), not the user identity. The results of a `ScanStart`
scan name the client that started it; scans the device reports on its
own name the device.
- The simulated readers default to one scan cycle per second
(`CycleInterval`, configurable per provider; the length of a cycle is
device specific in OPC 30010), so an unbounded `ScanStart` raises at
most one scan event per second.
- Behaviour: one scan at a time with a generation counter;
ScanStart/ScanStop serialised; a scan started by a session stops when
that session closes; the maximum scan duration, tag read length and
result count are limited by `AutoIdServerOptions`; device status changes
and events are raised outside locks; registration is rolled back on
failure; readers, providers and the runtime are disposed in order and
in-flight operations are drained.

## Composition with other DI-based companions

A server has one Device Integration owner, and AutoID now uses the
existing harmonized composition instead of requiring its own node
manager:

- `AutoIdMachineryModelProvider` adds the AutoID model to the Machinery
owner's model-provider pipeline (dependency-ordered, `Order` 200) and
keeps the DI nodes the owner loaded, so DI and `DeviceSet` exist once.
- `AddAutoIdToMachinery` (after `AddMachinery`) registers it;
`ConfigureAutoIdFor<TNodeManager>` creates readers on any
`DiNodeManager` owner, successive delegates share one `AutoIdRuntime`;
`owner.CreateAutoIdRuntime()` is the path without DI hosting. The owner
disposes the runtime on shutdown.
- Readers are registered in the owner below its `DeviceSet`, NodeIds in
the owner's instance namespace (`AutoIdRuntime.InstanceNamespaceIndex`),
not in the `Machines` folder; the AutoID conformance units and facets
are published by the owner next to the DI and Machinery ones.
- `AddAutoId` remains for the "AutoID is the only DI-based companion"
case and is built from the same provider. Next to another DI owner it is
still rejected; the message names the composition API. (Bypassing that
check gives two `DeviceSet` copies; the server routes `DeviceSet` to the
first owner and readers in the second are not browsable, checked
locally.)
- `Opc.Ua.AutoID.Server` now references `Opc.Ua.Machinery.Server` (a
stable package), as Vision does; a stand-alone server still loads only
DI and AutoID.

## Client: `Opc.Ua.AutoID.Client`

Reader discovery (a failed browse propagates), typed calls for every
published method, a device snapshot with documented `AutoIdReadOptions`,
and an async event stream (`ObserveScan/Access/Presence/LogEntries`) on
`IStreamingSubscription`. Cancellation is honoured throughout.
`AddAutoIdClient` registers it for DI. Because most children of a device
are optional (6.1, 6.5.3, 6.6.3), the snapshot also carries the NodeIds
of `DeviceStatus`, `LastScanData`, `LastScanTimestamp` and
`DeviceLocation` and the browse names of the published methods
(`Methods`, `HasMethod`), taken from the same browse whatever the read
options, so a client can monitor the device and knows what it may call
without browsing again.

## MCP profile: `Opc.Ua.Mcp.AutoID`

`McpToolProfile.AutoId` with nine tools: list readers, read device,
scan, scan start/stop, observe scan events, read tag, get supported
location types, get location. `autoid_read_device` also returns
`deviceStatusId`, `lastScanDataId`, `lastScanTimestampId` and
`deviceLocationId` (NodeId strings, null when the device does not
publish the variable) and `methods` (the browse names of the published
methods), built explicitly without reflection. Registered in the host
builder, the profile switches of the other profiles,
`Test-McpGrade.ps1`, `McpREADME.md` and `.mcp/server.json`.

## Samples

`samples/AutoID/AutoIdServer` (a dock-door reader with a simulated
pallet) and `AutoIdClient` with a README and
`Test-AutoIdSamplePair.ps1`. The default port is not a common one; tests
use port 0.

## Other changes

- `Opc.Ua.Di.Server` gets `InternalsVisibleTo` for
`Opc.Ua.AutoID.Server` (`RegisterRootNotifierAsync`).
- `UA.slnx`, `.azurepipelines/expected-packages.txt`,
`PackageVersionPolicyTests`, `NuGetPackageSetValidationTests`.
- Docs: `docs/AutoID.md`, `docs/McpServer.md`, `docs/Profiles.md`,
`docs/Samples.md`, `docs/DeveloperGuide.md`, `docs/README.md`,
`docs/WhatsNewIn2.0.md`, `README.md`, NugetREADMEs. The "model package
only" statements are removed.
- All packages follow the root version (no preview override).

## Specification notes and questions for the maintainers

- The model is 1.01, published 2020-06-18 (the NodeSet header). OPC
30010 6.1.3.16 prescribes the `AutoIdModelVersion` string `"1.00"`,
which is what the NodeSet carries and what the server publishes.
- **Question:** the NodeSet's optical verifier `Scan` method returns
`WGS84Coordinate`, which looks like a model error. It is not published,
and providers that implement `IAutoIdScanProvider` for a verifier are
rejected. Is that the behaviour you want?
- The stack answers a call to an unpublished optional method with
`BadNotImplemented`.

## Design choices reviewers may want changed

- `Opc.Ua.Di.Server` gets `InternalsVisibleTo` for
`Opc.Ua.AutoID.Server`, so the server can call
`RegisterRootNotifierAsync`.
- `AutoIdReaderKind` (and `AutoIdReaderKinds.TypeIdOf`) lives in the
model package `Opc.Ua.AutoID`, not in the server package, so the client
and the MCP tools share it.
- The MCP profile is read-only/safe: no tools that write, kill or lock
tags.

## Tests

`tests/Opc.Ua.AutoID.Tests` has 306 tests (116 of the model slice, 190
new): reader lifecycle, scan semantics, tag access handlers, limits,
conformance, in-memory providers, hosting, and over-the-wire
client/server tests with result codes, events, concurrency and dispose.
`tests/Opc.Ua.Tools.Tests` has 13 AutoID MCP tests plus the updated
profile-count tests. New behaviour tests fail without the code (for
example a provider's own cancellation, a synchronous scan while a scan
stop is in progress; for the last round: `GetLocation` of a supported
type the object is not located in answered `Bad_NotFound`, access events
named the user "Anonymous" and attributed `ScanStart` results to the
device, and an unbounded `ScanStart` on a default simulated reader
reported 20 times in 400 ms). Composition: `AutoIdCompositionTests`
(stock Machinery owner, providers out of order, DI loaded once, instance
ownership, rollback, cancellation, runtime disposal, an
application-owned DI owner, a second DI owner rejected) and
`AutoIdMachineryCompositionEndToEndTests` (Machinery + Pumps + AutoID in
one hosted server, read back by the AutoID, Machinery and Pumps clients,
including a scan and the published profiles and conformance units).
Mutating the change (no lifetime registration, the DI instance namespace
for browse names, the old ownership message) fails three of them. The
sample pair script passes. `tests/Opc.Ua.Aot.Tests.Mcp` has an AutoID
profile test (`AutoIdMcpAotTests`); the project was published with
Native AOT on osx-arm64 and all 64 tests passed. Publishing it also
found two `JsonArray.Add<T>` uses in the MCP tools (IL2026/IL3050), now
fixed.

## Verification (local, macOS arm64, SDK pinned in `global.json`)

The branch contains the master merges `fc556be7e`, `1c7948f65` and
`af7feb886`; the three composition commits sit between the last two (the
latest merge touches no AutoID, DI or Machinery file). `1458af9e9`
(marcschier) and the two commits of the last round follow `af7feb886`.

- **Last round (`3ef2f1507`, `f6405152f`).** Builds with `-m:2
-nodeReuse:false -p:UseSharedCompilation=false`: `Opc.Ua.AutoID.Tests`
on all target frameworks and with `-p:CustomTestTarget=net48`,
`Opc.Ua.Mcp.AutoID` on net8.0/net9.0/net10.0, `Opc.Ua.Tools.Tests` on
net10.0: 0 warnings, 0 errors. `Opc.Ua.AutoID.Tests` 306/306 on net10.0;
`Opc.Ua.Tools.Tests` AutoID tests 60/60, and the profile, catalogue,
composition and package tests that reference AutoID (2241) pass. The
changed tests fail without the code: `GetDeviceLocation` answered
`Bad_NotSupported` for both cases, and `autoid_read_device` had no
`deviceStatusId`. `tests/Opc.Ua.Aot.Tests.Mcp` published with Native AOT
on osx-arm64 (no IL2026/IL3050 warning): 64/64 passed. `dotnet format`
whitespace, style and analyzers `--verify-no-changes` on the changed
files: no finding on a changed line (line endings aside, which the LF
checkout on macOS reports for every file).

- **Build (composition round).** `Opc.Ua.AutoID.Server` on all target
frameworks, `Opc.Ua.AutoID.Tests` on net10.0 and with
`-p:CustomTestTarget=net48`, and the AutoID server sample: 0 warnings, 0
errors. MCP tools and JSON unchanged, so the native AOT test was not
republished.
- **Build (earlier rounds).** The AutoID packages and
`Opc.Ua.AutoID.Tests` on net10.0 and, with `-p:CustomTestTarget=net48`,
on net48/net8.0/net9.0/net10.0; `Opc.Ua.Tools.Tests` and
`Opc.Ua.SourceGeneration.Core.Tests` on net10.0 (`-m:2 -nodeReuse:false
-p:UseSharedCompilation=false`): 0 warnings, 0 errors.
- **Tests.** `Opc.Ua.AutoID.Tests` 306/306 on net10.0 (composition
round; earlier round 288/288); `Opc.Ua.Tools.Tests` (AutoID, host
builder, profile and package tests) 2438/2438 on net10.0;
`Opc.Ua.SourceGeneration.Core.Tests` 4358 passed, 8 skipped, after the
master merge touched `NodeStateGenerator.cs`. net48 was built, not run
(no Mono on macOS); the fork CI runs it. The MCP tools and their JSON
are unchanged in the last round, so the native AOT test was not
republished.
- **Coverage.** Composition round: the local coverlet collector recorded
zero hits for every module in this environment (also for unchanged
code), so no new local number; the new paths are exercised by the 18
composition tests listed above and the fork CI uploads coverage. Earlier
round: cobertura from the AutoID tests: `Opc.Ua.AutoID.Server` 92.0 %
lines / 86.8 % branches, `Opc.Ua.AutoID.Client` 89.9 % / 80 %; 110 of
the 112 coverable changed lines of the last round are covered (the two
missed lines skip a browse result without NodeId or name). The generated
code of the model package is excluded as in the other model packages.
- **Format.** `dotnet format` whitespace, style and analyzers
(`--severity info`) `--verify-no-changes` on the changed files: clean.

Fork CI (full matrix including macOS): [run
39162077465](https://github.com/biancode/UA-.NETStandard/actions/runs/39162077465)
on `f6405152f`: green. (Previous round: run 39130154771 on `ed25fe4ae`,
90/90 jobs green; the upstream checks on the merge `af7feb886` green,
108 passed, 5 skipped.)
CodeQL: [run
39162079826](https://github.com/biancode/UA-.NETStandard/actions/runs/39162079826)
on `f6405152f`: green, no alert in a file this PR touches. (Previous
round: run 39130156598 on `ed25fe4ae`, green.)

## Related Issues

- Part of #4824 (tracking issue: AutoID companion SDK).

## Checklist

- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [x] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed. (The
solution builds on all TFMs; the AutoID test projects ran on net10.0
locally, net48 runs in the fork CI.)
- [x] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [x] I have addressed **all** PR feedback received.

---------

Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-10-19 12:30:33 +02:00
Marc 0de303cad6 Disambiguate WoT event field lookup 2026-10-19 12:10:28 +02:00
romanettandClaude Opus 5.5 484596c2a8 Server: cheaper per-item event delivery (O(1) dequeue, duplicate index, filter context reuse, no per-read timestamps) (#4837) 
# Description

Low-risk speedups in the server event delivery path. With many event
monitored items on one notifier (750 on the Server object in the
`events` harness scenario), a single `MonitoredNode2` consumer thread
delivers every event to every item and is 100 % busy, which caps the
server at ~770 events/s. This PR makes the per-item work cheaper. There
are no public API or wire changes. Each commit stands alone:

1. **Server: dequeue events in O(1).** `EventMonitoredItemQueue.Dequeue`
used `List.RemoveAt(0)`, which shifted every queued event. It now
advances a head index, compacts the list once the dequeued slots are
half of it, and clears it when it runs empty. Discard oldest/newest, the
`SetQueueSize` truncation and the newest-1000 duplicate range are
unchanged. The mirroring redundancy queue snapshots only the queued
range.
2. **Server: reuse the event filter context of a monitored item.**
`QueueEvent` created a `FilterContext` per event and item. The item now
keeps it until the session replaces its `PreferredLocales`.
`GetEventFields` writes into a `Variant[]` instead of a `List` that was
then copied, and translates with the context's locales instead of
looking up the session per LocalizedText field.
3. **Server: check event duplicates against an index of the newest
entries.** `IsEventContainedInQueue` loaded the handle of up to 1000
queued entries per item and event. A reference-keyed count of the event
instances in the newest 1000 entries, kept current by
`Enqueue`/`Dequeue`/`SetQueueSize`, makes it one lookup. The checked
range is the same, and wrapped filtered-retain handles count as their
instance. If a derived queue changes `m_events` directly, the index is
rebuilt.
4. **Core: evaluate an empty content filter without an evaluator.**
`ContentFilter.Evaluate` created a `FilterEvaluator` and, through the
telemetry context, a new logger for every evaluation, also for the empty
where clause of most event filters (~16 % of the scenario's allocated
bytes). An empty filter now passes directly, and the evaluator creates
its logger only to log a failure.
5. **Core: give the fields of an initialized event a source timestamp.**
`BaseEventState.Initialize` created its field variables without a
timestamp, so `BaseVariableState.ReadValueAttribute` called
`DateTimeUtc.Now` on every read of every field for every monitored item.
The fields now carry the event time (`ReceiveTime` its own value). The
read path is unchanged, so no `ReadChildAttribute`/`ReadValueAttribute`
override is bypassed.

## Measurements

`perf/ServerLoadHarness run --scenario events --sessions 50 --subs 15
--pub 100 --security encrypt --event-rate 0 --duration 15 --warmup 8`,
with `DOTNET_gcServer=1`, `SERVER_DOTNET_gcServer=1` and
`SERVER_DOTNET_TC_QuickJitForLoops=0`,
`SERVER_DOTNET_TC_OnStackReplacement=0`. Each build is stacked on the
previous one; values are the mean of 2 alternating rounds. Runs where
processes outside the harness used more than 1.5 cores were repeated.

| build | generated events/s | event→notify p50 | KB / generated event |
ms CPU / generated event |
|---|---|---|---|---|
| master | 768 | 69.8 ms | 567 | 2.97 |
| + O(1) dequeue | 791 | 68.4 ms | 566 | 2.78 |
| + filter context reuse | 818 | 68.8 ms | 354 | 2.75 |
| + duplicate index | 854 | 63.7 ms | 356 | 2.96 |
| + empty where clause | 891 | 63.7 ms | 273 | 2.77 |
| + event field timestamps | **1001** | **61.3 ms** | **272** | **2.66**
|

- **`--event-rate 500` (below capacity):** 3.34 → 3.03 ms CPU and 590 →
294 KB per generated event. Latency is unchanged (bound by the
publishing interval).
- **Default JIT, 40 s warm-up:** 804 → 1063 events/s, 568 → 268 KB, 2.69
→ 2.37 ms.
- **CPU traces:** the consumer thread's `ReadValueAttribute` self share
drops from 24 % to 6 % of the samples and `QueueEvent` self from 14 % to
5 %. The thread is still the bottleneck, now in the generic read chain
(`GetAttributeValue` → `ReadChildAttribute` → `FindChild`). The next
step would be to evaluate each event once per distinct filter rather
than per item, which is out of scope here.

## Notes for reviewers

- `EventMonitoredItemQueue.m_events` keeps its protected
`List<EventFieldList>` type, but dequeued slots now stay null at the
front until compaction. The queued events are the last `ItemsInQueue`
entries. Nothing in the repository reads the field outside the class
except the mirroring queue, which uses the new internal
`CopyQueuedEvents()`.
- Event field variables created by `Initialize` now report the event
time as `SourceTimestamp` instead of the time of the read.

## Related Issues

- No issue. Found by the server load investigation of publish-, write-
and event-heavy load.

## Checklist

- [ ] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed. (net10.0
only: Opc.Ua.Server.Tests 8990 passed, Opc.Ua.Core.Tests 6449 passed,
Opc.Ua.Redundancy.Server.Tests 922 passed. In the explicit Sessions
`ServerEventSubscribeLoadTest`, opc.tcp passes; https and opc.https fail
with HTTP 503, the same as on master.)
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-19 09:15:45 +00:00
Marc e873bbbc01 Add native lane failure diagnostics 2026-10-19 09:56:51 +02:00
Marc e08befd869 Correct pinned MSVC runtime hash 2026-10-19 09:21:39 +02:00
Marc ee504fb90b Update native Windows CRT pins for runner image 2026-10-19 09:13:08 +02:00
Marc 09fd4dda1f Report all native tool pin mismatches 2026-10-19 09:04:22 +02:00
Marc 1648ccf96e Report actual native tool pin mismatches 2026-10-19 08:57:41 +02:00
Marc 99dca35158 Keep native validation packages out of standard publish 2026-10-19 08:47:02 +02:00
Marc 60ad14f786 Merge master into data-channels-quic-experimental 2026-10-19 08:46:58 +02:00
romanettandClaude Opus 5.5 37a2a831f3 Server: keep the publish timer on a fixed cadence and parallelize the sweep by work (#4829) 
The publish timer loop ran a pass over all session publish queues and
then
waited a full PublishingResolution, so the cycle period was pass time +
resolution and a slow pass delayed every following cycle. Whether the
pass
ran in parallel depended only on the session count (256 or more).

Fixed cadence: the loop now waits only for what is left of the period
(RunAtFixedPeriodAsync on the server TimeProvider). A pass that overruns
the period is followed by the next pass at once and the cadence restarts
from there; missed periods are not caught up with extra passes.
Shutdown, cancellation and abandoned subscription handling are
unchanged.

Parallelism by work: a pass checks the queues on the sweep thread until
it
has used a quarter of the publishing resolution (25 ms at 100 ms), then
checks the remaining queues with Parallel.For (CheckPublishTimers). The
session count no longer decides.

Why the budget:
- The pass cost is real per-item work. In the LoadTest subscribe shape
  (50 sessions x 15 subscriptions x 600 items, all 600 written every
  150 ms, publish 100 ms) every pass promotes up to 450k items; the
sequential pass takes 85-125 ms (~0.28 us per promoted item: ready list,
IsReadyToReport, LinkedList move, trigger check, ready signal release).
  Ready-list promotion already skips items without pending values and
  subscriptions whose timer is not due, so there is no idle work left to
  skip; only parallelism makes the pass fit the period.
- Fixed cadence alone lifts delivery from 64 % to 91 % (pass ~85 ms in a
  100 ms period, no headroom); with the parallel remainder 97-98 %.
- Parallel sweeps cost CPU when the pass fits anyway: at 10 sessions the
sequential pass takes ~15 ms; a 2 ms budget made it parallel and raised
  server CPU per notification from 5.0 to 8.9 us. With the 25 ms budget
  it stays sequential.
- Idle servers stay sequential: 1000 sessions x 1 slow subscription pass
  in ~2 ms sequential (was always parallel above 256 sessions); 2
  sessions in 0.05 ms.

Diagnostic probes (one build with temporary switches, one run each,
50x15x600 shape):

| loop / sweep            | delivered | us/notif | pass avg | cycle  |
|-------------------------|-----------|----------|----------|--------|
| old loop, sequential    | 63.9 %    | 5.1      | ~125 ms  | ~225 ms|
| fixed, sequential       | 91.2 %    | 5.1      | ~85 ms   | ~110 ms|
| old loop, all parallel  | 96.9 %    | 3.9      | ~24 ms   | ~132 ms|
| fixed, all parallel     | 97.0 %    | 4.1      | ~21 ms   | 100 ms |
| fixed, 25 ms budget     | 97.8 %    | 4.4      | ~44 ms   | 100 ms |

Paired A/B against master (perf/ServerLoadHarness, Server GC, encrypted,
alternating rounds, medians; runs repeated when processes outside the
harness used more than 1.5 cores):

| shape (sessions x subs x items) | n | delivered | us/notif | server
cores |

|-----------------------------------|---|--------------|-------------|--------------|
| 50 x 15 x 600, pub 100, write 150 | 3 | 67.7 -> 97.8 | 5.5 -> 4.4 |
11.3 -> 13.3 |
| 10 x 15 x 600, pub 100, write 150 | 3 | 100.4 -> 99.9| 5.5 -> 5.1 |
3.32 -> 3.11 |
| 1000 x 1 x 1, pub 1000, write 500 | 7 | 50 -> 50 (*) | 216 -> 201 |
0.21 -> 0.20 |
| 2 x 1 x 100, pub 100, write 150 | 3 | 100 -> 100 | 48.5 -> 46.1| 0.06
-> 0.06 |

(*) two writes per publishing interval with queue size 1, by design.

Side effect at 50 sessions: server allocation per notification rises
from ~54 to ~96 B. An allocation trace attributes it to
MonitoredItemNotification: the parallel remainder makes all
subscriptions publish within a few ms, the in-flight burst exceeds the
notification pool bound (kMaxPooledNotifications = 65536) and the pool
misses; the slow sequential sweep spread gets and returns. Gen0 GCs in
the 15 s window 3-5 -> 8, pause 20-50 -> ~60 ms; CPU per notification
still drops. Addressed by the stacked #4830, which allocates these
notifications instead of pooling them (tracking issue #4819).



### Follow-up commits

- **Late wake / exact deadline** (review): a wait that ends a whole
period late restarts the cadence from the late pass (no catch-up pass),
and a sweep exactly at a subscription's deadline counts as due.
- **Phase aliasing with equal periods** (f33893b7c): with the sweep at
the publishing interval, a subscription's deadline keeps one phase
relative to the sweep for the whole session. If it falls inside the ~16
ms timer jitter, a late sweep followed by an on-time one dropped a
publishing cycle. The 2-session shape (write = publish = 100 ms, queue
size 1) was bimodal: 6 of 24 runs at 56-85 %. The deadline now advances
by one interval per expiry and skips missed expiries only when a whole
interval behind after that. Result: 24 of 24 runs at 97-101 % (master:
steady 88-98 %); write 150 ms gave 98.5-100 %, and the 50 x 15 x 600
shape stayed at 99.3-100.7 %.
🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-19 06:48:41 +02:00
romanettandClaude Opus 5.5 014f99a53a WebSocket transport: a sender queued across Close fails as closed (#4832) 
## Problem


`WebSocketByteTransportTests.CloseFailsQueuedSendInsteadOfOrphaningItAsync`
fails intermittently. One example is test-linux-net10.0 (3/16) in run
39114639155 on #4831, an unrelated MachineTool change. The queued send
failed with a raw `WebSocketException` ("…transitioned into an invalid
state") instead of `ServiceResultException` with `BadConnectionClosed`.

## Cause

This is a product race in `WebSocketByteTransportBase`.

- `Close()` cancels the shared send token. That wakes both the in-flight
send and the queued `SemaphoreSlim.WaitAsync`.
- `SemaphoreSlim` removes a cancelled waiter on a later continuation. If
the in-flight sender's `finally` releases the lock first, the release
*grants* the queued waiter despite its cancelled token.
- `EnterSendAsync` then returned normally, and the queued sender called
`SendAsync` on the already aborted socket.
- That socket error is not an `OperationCanceledException`, so it
reached the caller untranslated.

## Fix

After acquiring the lock, `EnterSendAsync` checks whether the transport
closed. If it did, it gives the lock back and throws
`BadConnectionClosed`. `Close()` sets the closed flag before it cancels,
so every waiter woken by `Close()` sees it.

## Tests

- The existing test body moved into a helper. New
`CloseFailsQueuedSendEvenWhenTheLockIsGrantedAsync` repeats the
interleaving 2000 times (about 140 ms).
- Without the fix it fails 3/3 runs within about 100 ms, with the CI
exception. With the fix it passes 3/3.
- `Opc.Ua.Core.Tests` `~WebSocket` (net10.0): 39/39 passed.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-18 12:37:56 +00:00
Marc 7c8c7e73db Fix Data Channels XML summary formatting 2026-10-18 14:00:56 +02:00
romanettandClaude Opus 5.5 0005b0d5e6 WMTP: callers wait for the freshness tick instead of BadServerTooBusy (#4831) 
## Problem


`WmtpMcpIntegrationTests.ReportsCopyExactWholeSelectionsWithoutConsumingEitherStore`
failed intermittently (test-linux-net10.0 13/16, run 38897795750, on
#4815, which only changes `perf/`). The `wmtp_count_records` call came
back with `BadServerTooBusy`.

## Cause

This is a product race. The UA request queue (MaxQueuedRequestCount /
MaxRequestThreadCount) is not involved, and the test makes no parallel
calls.

- `WmtpOperationCoordinator` admits one operation per peripheral and
refuses a second one with `BadServerTooBusy`.
- `WmtpPeripheral.StartMaintenance` starts a 1 s age timer (`AgeTick` →
`RefreshQualityAsync`) that takes the same gate.
- The Tools.Tests fixture clock does not override `CreateTimer`, so the
timer is a real system timer. A client call that arrived while a tick
was running was refused. On a loaded runner each tick takes longer, so
collisions become more likely.
- On a production server, any WMTP client call could randomly hit this,
and the client cannot tell it apart from a real concurrent operation.
- It did not start with #4812 or #4808. The code came in with #4765.

## Fix

- The active operation now records whether it is maintenance.
- Other operations wait up to one second for a running freshness tick
instead of being refused. A regular tick makes no equipment calls and
takes milliseconds.
- A stalled tick, for example one blocked in a state-changed sink, still
refuses the caller with `BadServerTooBusy` after that second. This keeps
`ControlledQualityMaintenanceStillExcludesOverlappingReportsAsync`
valid.
- A tick is still refused while any operation is active, and it retries
on the next tick, as before.
- Two client operations still conflict with `BadServerTooBusy`.
- The callback marker is now a chain of the peripherals a call passed
through. Re-entering a ticking peripheral through another peripheral's
callback (A → B → A) is refused instead of waiting for itself (review
feedback).

## Tests

-
`WmtpRuntimeTests.CallerArrivingDuringFreshnessTickWaitsInsteadOfBusyAsync`
holds a tick open through a `StateChangedAsync` sink. Without the fix it
fails with the CI error.
-
`WmtpRuntimeTests.IndirectReentryIntoTickingPeripheralIsRefusedInsteadOfDeadlockingAsync`
covers the A → B → A case. With the innermost-only check it times out.
- Local net10.0 runs:
  - `Opc.Ua.MachineTool.Tests` `~Wmtp`: 124/124 passed.
  - `Opc.Ua.Tools.Tests` `~WmtpMcp`: 176/176 passed.
  - `Opc.Ua.Machinery.Tests` `~CompanionSuiteWmtp`: 2/2 passed.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-18 13:42:46 +02:00
Marc 526f8765b9 Implement OPC UA Data Channels 2026-10-18 12:09:16 +02:00
Wolfgang ColsmanCopilotMarc Schier
 		fc0687a2dc Source generator: a NodeSet2 Variable without a Value has a null Value (#4798) 
# Description

A Variable or VariableType in a NodeSet2 that has no Value element has a
null Value (OPC 10000-6 F.5); the runtime NodeSet2 importer loads it
that
way. The source generator initialized such a node with the default value
of its DataType instead ((int)0, (double)0, ...), so a server built from
the generated code reported values the model never declared.

The NodeSet2 importer now records that the node declares no Value
(NodeSetValueIsNull), the flag follows the node into the merged instance
hierarchy, and the node state generator emits Variant.Null for it when
no
value was merged in from elsewhere. ModelDesign inputs, where a missing
DefaultValue implies the DataType default, are unchanged.

The tests generate a DI-style NodeSet2 together with the DI NodeSet2 and
check the generated values of a type's InstanceDeclaration, of an
instance's children with and without a Value, and of a VariableType.

## Related Issues

None.

## Checklist

- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [x] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [x] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [x] I have addressed **all** PR feedback received.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>
 2026-10-18 09:16:26 +02:00
Wolfgang ColsmanandCopilot 4a7dfe7411 Server: release a restored event item that its node manager rejects (#4828) 
# Description

Follow-up to #4795. When a node manager returns a Bad result from
`SubscribeToEventsAsync` for an event monitored item while durable
subscriptions are restored,
`NodeManagerServiceDispatcher.RestoreMonitoredItemsAsync` removes the
item from the event manager and from the result list, but nothing
disposes it, so its queues stay alive. The item is now disposed there.

A queue that was staged for the restore
(`IRestorableMonitoredItemQueue.BeginRestore`) keeps its stored contents
when it is disposed, as for any aborted restore, so a later restore
still finds them. The data-change restore path already disposes an item
it fails to restore, and the `Objects.Server` path keeps every item, so
neither needs a change.

A test in `SubscriptionRestoreFailureTests` restores an event item that
its node manager rejects and checks that the item is unregistered and
its queue disposed; it fails without the change.

## Related Issues

Follow-up to #4795.

## Checklist

- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed. (The
subscription restore tests of Opc.Ua.Server.Tests on .NET 10, 35 passed;
Opc.Ua.Server.Tests builds for net48.)
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [x] I have addressed **all** PR feedback received.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-10-18 08:43:33 +02:00
Wolfgang ColsmanCopilotMarc Schier
 		8441351902 Client: let ManagedSession validate a rediscovered endpoint (#4791) 
# Description

When a reconnect is rejected with a status that requires the endpoint to
be refreshed, ManagedSession reads the endpoint again from the server's
discovery endpoint and ConfiguredEndpoint.Update replaces the endpoint
in
use with whatever discovery returned. The application had no say: a
discovery answer that, for example, drops the security mode or presents
a
different server certificate was taken over as it was.

ManagedSession.ValidateRediscoveredEndpoint (a
RediscoveredEndpointValidator)
receives the endpoint in use and the rediscovered one before the session
is
recreated against it. A Bad result keeps the endpoint in use and fails
the
reconnect attempt with that result, so the reconnect policy decides what
happens next. Without a validator the behaviour is unchanged.

## Related Issues

None.

## Checklist

- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [x] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [x] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [x] I have addressed **all** PR feedback received.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>
 2026-10-18 07:03:11 +02:00
Marc Schier 55bd944609 WoT: Types-side TD/TM-NodeSet conversion with consolidated corpus and minimal consumer compat (#4758) 
# Description

Adds the pure Types-side WoT Thing Description / Thing Model to NodeSet
conversion: resolution, context, declarations, types, values,
localization, URI/format handling, bounded hashing, plus supporting
native XML codec, NodeSet alias/value helpers, RelativePathFormatter and
a JsonElement equality polyfill.

- Carrier-witness fix: a missing native event is accepted only when the
owning preserved type declares it through a `GeneratesEvent` reference
(directly or via its type/supertype chain) AND a bounded, validated
selected EventType carrier identity equals the normalized authored
native target. Native-present events get a full compare; an ambiguous
native key and a missing map stay strict; a readable document is never
archive authority.
- Support-only dependencies: additive per-instance, non-serialized
`WotDocument.IsSupportOnly(kind, name)` (ArgumentNullException guard).
The resolver marks support-only after closure; explicit selection wins;
the View builder excludes only true support-only members, so unit/actsOn
dependencies stay in the JSON. Nested controls cover inner value-only
projection under an outer value-only selection (unit kept, support-only)
versus an outer explicit SelectAll (explicit, not support-only).
- Documentation/XML comments and member-order only in commit 5c368d3a;
no logic change.
- Timeout repair on current head 6957dd46: invocation-scoped
`ArchiveDerivations` reuse removes repeated document-set derivation work
without a global cache (functional files
`WotNodeSetConverter.{Archive,ArchiveDerivations,Partitions,WoT}.cs`,
plus `WotArchiveDerivationsTests` and
`WotDocumentSetSharedValidationTests`). The original local full29
reproduction changed from 27 passed / 2 Refresh timeouts to 29 passed
with unchanged limits; official CI on this head FAILED at three
per-project time ceilings (see the evidence ledger). Temporary RF1
diagnostics were fully removed; the final tree differs from 0f7b9a09
only in the six functional files.
- Test-only net48 compile repair in commit b838907 (earlier head):
official CI on 5c368d3a was RED on the net48 build with CS1061 (see
ledger); the fix adds `using System.Threading;` and an unqualified
`CancellationTokenSource` in one test file. No production change.

Defaults: DI default document budget 256 versus the sample's explicit
1024. Corpus: canonical 540-JSON inventory; the actual manifest is 535
entries = 394 TD + 141 TM (the roles of the other 5 are not claimed).
Native Pumps assertions (9624 nodes / 339 partitions) are unchanged.
 2026-10-17 20:43:25 +02:00
Wolfgang ColsmanCopilotMarc Schier
 		768b39e1be Server: surface failures to restore durable subscriptions (#4795) 
# Description

SubscriptionManager.RestoreSubscriptionsAsync logged and swallowed every
restore failure: a subscription store that threw, a store that reported
an unsuccessful restore, and a stored subscription that could not be
recreated. The server then started without those subscriptions, the
store was told the restore had completed (so it cleaned up what it
held),
and nothing but a log line showed that subscriptions had been lost.

A failed restore now fails the restore, and with it the startup:
- a store that throws fails with BadInternalError and the store's
  exception as the inner exception;
- a store that reports Success = false fails with BadInternalError;
- stored subscriptions that cannot be recreated are collected and
  reported as an AggregateException, before the store is told that the
  restore completed, so the store keeps what it holds.

SubscriptionManager.ContinueOnRestoreFailure (default false) restores
the
previous behaviour for applications that prefer to start without the
subscriptions. Cancellation is no longer swallowed unless that option is
set.

The Quickstarts durable subscription store reported Success = false when
it had nothing stored; it now reports a successful restore of no
subscriptions, and keeps reporting a failure when its file cannot be
read.

## Related Issues

None.

## Checklist

- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [x] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [x] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [x] I have addressed **all** PR feedback received.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>
 2026-10-17 20:40:45 +02:00
Marc SchierandCopilot Autofix powered by AI 7fb986bd0d Add recycling operator console and sample container images (#4810) 
# Description

Add a local browser-based operator console for the synthetic recycling
line, using direct, encrypted OPC UA connections and the existing typed
coordination interface.

- Extract a sample-local, non-packable `Recycling.Client` library shared
by the server and console. Preserve the model XML bytes, namespace/type
identifiers, resource identity, wire format and journal schema; the
server retains its .NET 8/9/10 targets.
- Add a .NET 10 ASP.NET Core workstation host with bounded SSE
state/trend delivery, native companion inspection, paged
material/genealogy reads, and role-limited coordinator commands. Exact
command envelopes are retained for explicit retries; uncertain outcomes
are not automatically reissued.
- Add the operator interface using local HTML/SVG, CSS and JavaScript
modules: ten process groups, substep inspection, faults/constraints,
persistent quality holds, trends, material tracing and simulator
administration. Show raw quality/provenance and handle stale data, run
changes, browser expiry and large identifiers explicitly. No
browser-generated plant telemetry or frontend framework/npm build is
introduced.
- Keep application/user credentials in external certificate stores. Use
strict X.509 trust, signed/encrypted UA sessions, local browser
bootstrap sessions, same-origin/CSRF checks, and a conservative
configured control ceiling. This is a local synthetic sample, not a
physical emergency-stop or shared remote-user system.
- Register `recyclingserver` and `recyclingclient` in the existing
Images CI matrix, using source/prebuilt Dockerfile stages and the
existing portable-IL/multiarchitecture packaging flow. Add an optional
loopback-published Compose console service. No new schedules or NuGet
publication entries are added.
- Add managed, real-UA, Chromium, NativeAOT and image-contract
qualification, with Microsoft.Playwright as a test-only centrally
managed dependency, and update usage/deployment documentation.

## Checklist

_Put an `x` in the boxes that apply. You can complete these step by step
after opening the PR._

- [ ] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [ ] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-10-17 16:16:29 +02:00
romanettandClaude Opus 5.5 44a8cb277d plans/ctt-issues.md: record C60 (CTT publish thread stall in the A&C Limit/Level CUs) (#4820) 
The CTT regression run on master (716858aa7) reported 6 Pass → Error
regressions in the A&C part:
A & C Exclusive Limit `Test_003.js`–`Test_006.js` and A & C
Non-Exclusive Level `Test_003.js`/`Test_004.js`.

They are not a server regression:

- On the GitHub runner, the A&C part failed in 6 of 9 runs: master 3 of
6, and a14b23e7d (the last build that had passed) 3 of 3.
- A traced server answered every Publish request of the affected session
(413 requests, 413 responses). After that, the CTT sent only Read
requests on the same channel, and the session's Subscriptions expired.
- Locally (13 runs, also pinned to 4 cores) the A&C part never failed.

The trigger is the CTT CI's default publishing interval of 150 ms, which
keeps the five Subscriptions of the Limit/Level CUs permanently due for
a keep-alive. The CTT CI now uses 250 ms for the A&C part: 3 of 3 A&C
runs and one full run passed, with 0 regressions against the baseline.

This PR only records the defect as C60 in `plans/ctt-issues.md`. There
is no code change.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-17 07:57:07 +02:00
romanettClaude Opus 5.5Marc Schier
 		849840be5d perf: publish/write/event load scenarios for the server load harness (#4817) 
Builds on #4815 (merged); rebased onto master. Two commits, touching
only `perf/`.

Extends `perf/ServerLoadHarness` and `perf/TraceAnalyzer` to profile
publish-, write- and event-heavy server load that mirrors the explicit
Sessions `LoadTest`. Built for the publish/write load investigation:
[findings report](https://claude.ai/artifact/BWuEEPcvvbTAbjY44mJFsa).

## New options

| Option | Scenario | Meaning |
|---|---|---|
| `--scenario events` | | Event subscriptions on the Server object; a
server-side `EventGenerator` (in `EventWorkload.cs`) reports events,
driven by the server child's new `events <rate>` / `events stop` stdin
commands. |
| `--event-rate` | `events` | Events/s the server reports; 0 = as fast
as one thread can. |
| `--writers N` | `sub` | Dedicated writer sessions in addition to
`--sessions` (0: the first subscriber session writes, as before). |
| `--write-interval 0` | `sub` | Closed-loop writers instead of a timer.
|
| `--write-batch` | `sub` | Values per Write; writers rotate through the
nodes in slices. |
| `--node-type all` | `sub` | The LoadTest's Int16…UInt64 mass node set
(up to 600 nodes). |
| `--queue-size` | `sub`, `events` | Monitored item queue size (default
1 / 10000). |
| `--publish-requests` | all classic | Minimum outstanding Publish
requests per session. |

Also:
- `Workload.Secondary` / `OnServerReport` hooks and a `per-op2:` result
line: server cost per written value (`sub`) or per generated event
(`events`).
- TraceAnalyzer `threads` mode: busy share of each thread with its main
roles (finds serialized stages).
- TraceAnalyzer `cpu <trace> <top> <focus>` additionally lists the focus
frame's direct callees.
- README rows and paragraphs for all of the above.

Conflicts with #4815's rewrite (native workers, `suspend`/`samples`
modes) were resolved so #4815's code and text stay and these additions
are layered on top.

## Verification

Builds: `CustomTestTarget=net10.0 dotnet build perf/ServerLoadHarness -c
Release` and `dotnet build perf/TraceAnalyzer -c Release`: 0 warnings, 0
errors.

Smoke tests (`--duration 5 --warmup 3`, `DOTNET_gcServer=1
SERVER_DOTNET_gcServer=1`), each run only once foreign CPU was below 1.5
cores, with foreign CPU measured during the run (avg 0.5–0.6 cores):

| Run | Result |
|---|---|
| `events --sessions 5 --subs 3 --event-rate 2000` | generated/s=2009,
events/s=30413, received/expected=100.9 %; `per-op2` 588.9 µs CPU / 31.5
KB per generated event |
| `sub --sessions 5 --subs 3 --nodes 600 --node-type all --writers 4
--write-interval 0 --write-batch 100` | 131k values/s written, 77k
notif/s, writeErrors=0; received/expected=3.9 % (queue size 1 with
closed-loop writers: values are overwritten before publishing, as
intended); `per-op2` 50.5 µs / 1680 B per written value |
| `sub --sessions 2 --subs 1 --nodes 100 --queue-size 2
--publish-requests 4` | received/expected=98.0 %, writeErrors=0 |
| same as the second run with `--trace` | 23 MB trace; `TraceAnalyzer
threads` lists 58 threads with busy shares and roles; `cpu … 10
MonitoredItem.Publish` prints callers, first Opc.Ua frame and the new
"direct callees of" section |

#4815's own scenarios still parse: `counters` passes; `native-read`
(with `--server-affinity`, `--thread-states`) and `native-counters`
start the contract server and fail only at launching the (absent) native
worker executable, as expected without the workers.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>
 2026-10-17 07:56:43 +02:00
Marc Schier 7e25e1a3d7 Extract remaining shared companion, rendering and packaging changes (#4806) 
# Description

The shared AI deployment contracts and instance registration; DI
software-upload outcomes, digest handling and simulator; bounded
Positioning/Pumps reads; PubSub raw-data/matrix and security-provider
handling; Vision read-quality contracts; xRegistry resource writes and
instance projection; OpenUSD authoring, embedded viewport and
retained-frame capture APIs; standalone sample CLI controls; and the
generic Debug/RID package-policy and fork/Dependabot coverage-comment
fixes. The Linux native prerequisite step is retained for **Vision tests
only**.

## Related Issues

- Related tracking issue:
[#4461](https://github.com/OPCFoundation/UA-.NETStandard/issues/4461),
without automatic closure.
- Source work:
[#4462](https://github.com/OPCFoundation/UA-.NETStandard/pull/4462),
which remains intact for the coordinator's later integration.
- Immediate stacked predecessor:
[#4804](https://github.com/OPCFoundation/UA-.NETStandard/pull/4804).

## Checklist

_Put an `x` in the boxes that apply. You can complete these step by step
after opening the PR._

- [ ] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [ ] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [ ] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.
 2026-10-17 07:52:02 +02:00
Wolfgang ColsmanCopilotMarc Schier
 		4e77ba3f84 Redundancy: snapshot and restore for RaftSharedKeyValueStore (#4794) 
# Description

RaftSharedKeyValueStore applies every committed command but offers no
way
to capture its state. An application that wants to bound the Raft log
cannot snapshot the store before compacting its consensus log, and after
a
restart it cannot restore the state without replaying the whole log.

Add CreateSnapshotAsync, which commits a barrier through the consensus
and
encodes the state in a versioned format, and RestoreSnapshot, which
replaces the state before the store starts applying the log. A malformed
snapshot raises FormatException; restoring after start raises
InvalidOperationException.

Tests: RaftSharedKeyValueStoreSnapshotTests (round trip, log applied
after
restore, restore after start rejected, corrupt snapshot rejected).

## Related Issues

None.

## Checklist

- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [x] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [x] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>
 2026-10-16 20:10:13 +02:00
Wolfgang ColsmanCopilotMarc Schier
 		2de64d7d93 Source generator: keep NodeSet2 references to nodes of referenced models (#4796) 
# Description

A reference in a NodeSet2 input whose target is a node of another model
was
dropped without a diagnostic when that model is supplied by a referenced
assembly rather than by an AdditionalFiles input. The dependency
metadata
of a referenced assembly carries types only, so the importer could not
resolve an instance such as DI's DeviceSet and skipped every reference
to
it: a device organized by DeviceSet (inverse Organizes) lost that
reference, and so did any non-hierarchical reference to such a node.

When the target of a reference is in another, non-zero namespace and no
loaded design defines it, the importer now creates a stand-in that
carries
only the NodeId the generated AddReference call needs. The stand-in is
not
generated. References whose reference type is unknown are still skipped.

Tests generate a DI-style NodeSet2 whose device is organized by
DeviceSet
against DI supplied as a referenced assembly and as an AdditionalFile,
and
compile the result against the stack.

## Related Issues

None.

## Checklist

- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [x] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [x] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>
 2026-10-16 20:09:14 +02:00
Marc Schier b1c0cd20fd Fix classic browse-path subscription restoration (#4814) 
# Description

Persisted classic subscriptions retain their server/client handles but
previously lost relative-path resolution metadata. Transfer could
succeed, yet a later `ApplyChangesAsync` attempted to resolve an
already-created item and failed. The SDK now owns this restoration
lifecycle without exposing a public resolution-state setter.

- Preserve the originally monitored target in internal snapshot state
and restore both `ResolvedNodeId` and `Status.NodeId`.
Transfer/reactivation use handles without re-browsing; fresh creation
resolves paths again.
- Version classic subscription/configuration files and read existing
unversioned 2.0 files using frozen legacy wire layouts. Legacy missing
targets remain unknown rather than being guessed.
- Exclude existing items from creation-time resolution, reserve creation
before asynchronous translation, and reject stale translation results.
Failed deletion retains identity and pending retry state.
- Support forward-only snapshot input using position tracking and
bounded, per-ExtensionObject buffering in the binary decoder, including
short reads. No whole-file buffering or reflection-based serialization
is introduced.
- Add unit/integration regressions and document the supported lifecycle
and migration implications.

**Compatibility:** Newly written files require the updated SDK. Existing
2.0 files remain readable. Assigning a different `StartNodeId` or
`RelativePath` to a created/in-flight item now immediately throws
`BadInvalidState`; unchanged assignments remain allowed. No V2
subscription-engine changes or 1.5 XML import are included.

## Checklist

_Put an `x` in the boxes that apply. You can complete these step by step
after opening the PR._

- [ ] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [ ] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.
 2026-10-16 20:06:51 +02:00
romanettandClaude Opus 5.5 8e96408b2a Fuzz oracles: confirm net48 allocation findings by re-running the target (#4818) 
## Problem

`FuzzCrashAssets(AflfuzzBinaryDecoder)` failed intermittently on net48
(run 38897795750, test-windows-net48 1/16, on #4815, which changes only
`perf/`):

> 10562496 bytes allocated for 42 input bytes, budget 8391296 bytes

On .NET Framework, `FuzzOracles` measures allocations with
`AppDomain.MonitoringTotalAllocatedMemorySize`. That counter covers the
whole AppDomain, so it also counts other threads in the test host.

Measured on net48 Release for
`crash-0bdcbfafc13981ae6f665ad52cabc1cbe21b0238`:

| Scenario | Bytes |
|---|---|
| First decode in the process (one-time XML setup) | 1,083,232 |
| Later decodes, same thread or a fresh thread | 16,440 |
| Same decode with one concurrent thread allocating | 10.7 to 23.8 MB
(over budget) |

The decoder does not have a per-thread cost, and #4812 did not regress
it. The CI TRX shows that tests ran one at a time. The failure came
about 2 s into the run, right after a burst of about 100 fast test
cases, which fits vstest serializing results on a background thread.

## Fix

`FuzzOracles.RunTarget` re-runs a target when the allocation finding
comes from a counter that is not per thread (`AllocationConfirmationRuns
= 2`). It reports the finding only if every run confirms it. A real
over-budget decode allocates the same amount every time, while a burst
on another thread rarely lines up with all three runs. This is the same
approach the time oracle already uses (`TimeConfirmationRuns`). Runtimes
with a per-thread counter (net8+) behave as before. `FuzzMethods`
playback goes through `RunTarget` too, so it also gets the confirmation
runs.

## Tests

- New tests in `FuzzOraclesTests`:
- A finding that every run confirms is still reported, after 3 runs on
net48 and 1 run on net8+.
- A finding inflated by another thread is ignored (net48 only). This
test fails when the confirmation runs are set to 0.
- net48 Release: Opc.Ua.Fuzzing.Tests 156/156,
Opc.Ua.Encoders.Fuzz.Tests 8130/8130.
- net10.0: FuzzOraclesTests pass.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-16 17:21:59 +02:00
romanettandClaude Opus 5.5 8b56937fdf perf: drive the server with external native benchmark workers; TraceAnalyzer GC modes (#4815) 
## What this adds

Harness-only changes under `perf/` (not part of `UA.slnx`, `net10.0`).
No product code changes.

### External native worker scenarios (`ServerLoadHarness`)

Two new scenarios run the native open62541 workers of the

[o6-automation/opcua-benchmarks](https://github.com/o6-automation/opcua-benchmarks)
project
against a server, so the .NET server and other OPC UA stacks are
measured with the same client
as that project's published comparison:

| Scenario | What it measures |
|---|---|
| `native-read` | Fixed-load scalar Read throughput
(`throughput/open62541/client.c --worker async`): `--clients` worker
processes, each with `--inflight` single-value Reads of
ns=1;i=1001..1100 in flight, starting together. Reports aggregate req/s,
and server CPU and allocated bytes per request. |
| `native-counters` | Subscription capacity
(`subscription/native/client.c`): one subscription with `--nodes` UInt64
counters at `--sampling` 10 ms / `--pub` 1000 ms, queue size 1. Passes
when every item gets 99 % of the samples its sampling interval calls
for. |

The result block has the same lines as the other scenarios, and the CPU
time of the native
workers goes in `client-per-op:`.

The server is either the harness child in **contract mode** (`server
--contract 1`) or any
external executable (`--server-exe`, `--server-args` with `{port}`,
`{items}`, `{sampling}` and
`{pki}` placeholders), for example the benchmark's open62541 server or
one of its .NET workers.

By default the harness child is configured like the benchmark's .NET
worker for
UA-.NETStandard 2.0.1:

| Setting | Default | Override |
|---|---|---|
| Node managers | `AsyncCustomNodeManager` | `--async-node-manager 0`
(`CustomNodeManager2`) |
| Counter increment | under a lock owned by the counters |
`--counter-lock 0` (interlocked) |
| Garbage collector | Server GC | `SERVER_DOTNET_gcServer=0` |
| `MaxQueuedRequestCount` | clients × in flight + 3 (minimum 200) |
`--queue` |

Other options: `--native-client`, `--clients`, `--inflight`,
`--iterations`, `--warmup-calls`,
`--server-affinity` (processor mask; combine it with
`SERVER_DOTNET_PROCESSOR_COUNT`, because the
mask is applied after the runtime has sized itself),
`--client-affinity`, `--server-priority`,
`--thread-states 1` (samples Running/Ready server threads and appends a
`sched:` line), `--security encrypt`
(Basic256Sha256 SignAndEncrypt with generated DER identities) and
`--verbose`. Also, the
`MinRequestThreadCount` of the server child is now the smaller of 50 and
`--threads`, so
`--threads` below 50 takes effect.

**Worker protocol.** The workers define a few names that are kept as
string literals in named
constants: the environment variables `O6_BENCHMARK_SECURITY_POLICY`,
`O6_BENCHMARK_CERTIFICATE`
and `O6_BENCHMARK_PRIVATE_KEY`, the `O6_BENCHMARK_READY` stdout token,
the identity
application URI / subject prefixes, and the server URI
`urn:o6:benchmark:server`. The workers
need that server URI because the contract puts its nodes in the
namespace of the server URI and
the workers address them as ns=1. Identifiers, file names, scenario and
option names are neutral.

### TraceAnalyzer

- `cpu` with a focus frame also reports the first `Opc.Ua` frame above
it, past framework
  wrappers such as `Monitor.Enter` or `SemaphoreSlim`.
- **GC-poll attribution:** the thread-time sampler suspends running
threads at their next GC
poll, so many on-CPU samples have `Thread.PollGCWorker` as their leaf.
`cpu` used to drop
them as waits (in one trace only 3.5k of 20k on-CPU samples were kept);
it now attributes them
  to the caller.
- `gc` mode (for `--trace-profile gc`): collections by generation, type
and reason; the
suspension time and the whole pause, each with count, total and
percentiles.
- `samples` mode: all samples by type (managed/external) and by leaf and
first `Opc.Ua` frame,
  including the ones `cpu` leaves out.
- `suspend <trace> [thresholdMs]` mode: every SuspendEE longer than the
threshold, with the
events recorded inside it by thread (an `AllocationTick` there means a
thread that had not
reached a safe point yet); event counts including the heap count DATAS
chose and GC handle
  churn by kind.

## Building the workers

The benchmark repository is AGPL-3.0, so nothing of it is vendored here.
Clone it and build the
workers separately. On Windows they build with `zig cc` and CMake
against the open62541 commit
the benchmark pins (OpenSSL backend, `UA_ENABLE_DEBUG_SANITIZER=OFF`,
Release). The
subscription workers also need `poll()` on stdin replaced by
`PeekNamedPipe`, plus unbuffered
control output. `perf/README.md` describes all of this.

## Commits

1. `perf: drive the server with external native benchmark workers`
2. `perf: configure the contract server like the benchmark's 2.0.1 .NET
worker`
3. `perf: TraceAnalyzer gc and samples modes, samples taken at GC polls`
4. `perf: scheduling and GC-suspension diagnostics for the native worker
runs`

Each commit builds with 0 warnings
(`CustomTestTarget=net10.0 dotnet build perf/ServerLoadHarness -c
Release`,
`dotnet build perf/TraceAnalyzer -c Release`), and `dotnet format
whitespace` makes no changes.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-16 14:35:16 +00:00
romanettandClaude Opus 5.5 c3701e5804 CI CTT: call the private repository through Actions REST endpoints only (#4816) 
The first run after configuring the GitHub App
([run](https://github.com/OPCFoundation/UA-.NETStandard/actions/runs/38895888727))
minted its token correctly but failed on the dispatch:

> unable to determine default branch for
OPCFoundation/UA-.NETStandard-CTT: GraphQL: Resource not accessible by
integration (repository.defaultBranchRef)

`gh workflow run` (and other `gh` commands) make GraphQL calls that need
Contents access, but the App only has Actions read/write. Dispatch, run
lookup, polling and the summary download now use `curl` on the Actions
REST API, so the App needs no more than Actions read/write.

## Test plan
- [x] `bash -n` on the step script
- [x] Run-list filter, run status and `ctt-public-summary` artifact
download checked with `curl` against the private repository (earlier run
`repeat-1`)
- [ ] After merge: Actions → CTT regression → Run workflow on master

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-16 13:01:59 +00:00
Marc a2e47f0c2e Merge master exact-NodeSet source generation option 
Include master 716858aa7 without conflicts. The full source-generator suite and exact-NodeSet address-space cases pass on net10.0 and net48 (306 + 5 tests per framework). Combined targeted validation across the merged changes: 2018 passed on net10.0, 2083 passed on net48, two expected anonymous-session diagnostics skips, and no fixture failures.
 2026-10-16 13:15:13 +02:00
Marc 5ffb6f95ac Merge master Machinery inspection and transfer updates 
Integrate master 87012a147 without conflicts. Targeted net10.0 validation: 1707 passed, 1 expected diagnostics-access skip. Net48 validation: 1772 passed, 1 expected diagnostics-access skip. Includes full legacy Machinery tests, modern strict-read/result-transfer/ownership cases, and the updated JWT subscription-transfer regression. No fixture setup or teardown failures.
 2026-10-16 13:01:24 +02:00
Marc aae0a26bf8 Merge master ordered-writer changes into data channels and QUIC 
Preserve lazy response sealing, pooled request completion and packed diagnostics while integrating STR frames with the shared ordered writer. Keep client numbering and queue admission atomic, retain request-local OpenDataChannel callbacks, and preserve cancellation buffer ownership.

Targeted Windows validation: net10.0 1365 passed / 1 skipped; net48 1197 passed / 1 skipped; no fixture failures. The unchanged legacy downgrade fixture exposed a proxy-counter timing race once; isolated and full reruns passed. Added regressions for client/service/stream wire ordering, queued cancellation, response callback isolation and oversized-frame refusal.
 2026-10-16 12:39:55 +02:00
Wolfgang ColsmanCopilotMarc Schier
 		716858aa7d Source generator: option to emit exactly the nodes of a NodeSet2 (#4797) 
# Description

For a NodeSet2 input the generator built the predefined nodes from the
merged instance hierarchy. A subtype therefore got a copy of every
Mandatory InstanceDeclaration of its supertypes as a new child node,
with
a NodeId the NodeSet2 never assigned (the supertype's numeric identifier
in the subtype's namespace, or a string identifier derived from the path
when the supertype comes from a referenced assembly). A DeviceType
subtype got eight such children from DI's DeviceType, so the address
space
a server loads from the generated code differs from the NodeSet2 it was
generated from.

ModelSourceGeneratorEmitNodeSetNodesOnly (GeneratorOptions
.EmitNodeSetNodesOnly), off by default, makes the predefined nodes of a
NodeSet2 input exactly the nodes the NodeSet2 declares: a child the
generator derives from a supertype or type definition is not added to a
predefined node. The typed state classes are unchanged and still reach
inherited members through the state classes of their supertypes, and the
CreateInstanceOf* factories still create every Mandatory child of the
type. ModelDesign inputs are not affected. IModelDesign.IsSourceNodeSet
tells the generator whether the target model was read from a NodeSet2.

A test in Opc.Ua.Di.Tests generates a DI-style NodeSet2 with the option
on, exports the generated predefined nodes as a NodeSet2 and compares it
with the input, node for node and reference for reference.

## Related Issues

None.

## Checklist

- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [x] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [x] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>
 2026-10-16 12:38:19 +02:00