UA-.NETStandard

mirror of https://github.com/OPCFoundation/UA-.NETStandard.git synced 2026-10-29 07:07:24 +08:00

Author	SHA1	Message	Date
romanettandClaude Opus 5.5	a430239fde	Allow release.yml to promote release-line previews to nuget.org (#4574 ) # Description Adds a way to publish a numbered release-line preview (e.g. `2.0.0-preview.6`) to nuget.org. Since #4513, `nuget-publish.yml` pushes previews only to GitHub Packages, and `release.yml` (the only nuget.org path) refused every non-stable candidate. That left no way to continue the `2.0.0-preview.N` series on nuget.org (last published there: `2.0.0-preview.5`). ## Changes - `release.yml` gains a `channel` input (`stable` \| `preview`, default `stable`). - `stable` behaves exactly as before. - `preview` accepts only a public release-line preview, `M.m.p-preview.N` with no commit id, from the matching canonical `release/M.m` branch. `master` / PR builds (`-preview.N.g<sha>`) are rejected. - The candidate manifest's recorded `channel` must equal the dispatched one, so a stable promotion can never publish a preview by accident, or the reverse. - `package-version-policy.ps1`: new `Test-PromotablePreviewPackageVersion`, and an `-AllowPreview` switch on `Test-CanonicalReleaseBranchForPackageVersion`. Callers without the switch (the stable gate in `nuget-publish.yml`) behave exactly as before. - `docs/ReleaseProcess.md`: new "Preview release" procedure, including how to pick the preview number with `versionHeightOffset`. - Tests: predicate cases, the `-AllowPreview` switch, and a pin that `release.yml` defaults to `stable` and relaxes the gate only for `channel=preview`. ## GitHub Packages preview feed is unchanged - `nuget-publish.yml` is not touched. `master` keeps auto-publishing `2.0.0-preview.<height>.g<sha>` to GitHub Packages, and release-branch builds keep pushing their own `<base>-preview.N` there. - The commit-id suffix means `master` versions can never collide with a bare `2.0.0-preview.N`. - For a preview, `release.yml`'s GitHub Packages push is a verified no-op. The candidate's own `nuget-publish.yml` run already pushed those bytes, and the existing identity preflight and post-push check prove they match. ## Getting `2.0.0-preview.6` after merge 1. Cut `release/2.0` from `master` after this merges. `release.yml` executes the policy script from the candidate commit, so that commit must contain this change. 2. On `release/2.0`, commit a `versionHeightOffset` so the build lands on `.6`. Verified locally with nbgv 3.10.94: at the current `master` tip (height 24), one commit setting `-19` yields `2.0.0-preview.6` and the next yields `.7`. Recompute for the actual cut point with `nbgv get-version -v NuGetPackageVersion`. 3. Dispatch `release.yml --ref release/2.0 -f release_run_id=<run> -f channel=preview`, with a dry run first. `2.0.0-preview.6` is currently free: nuget.org has `.2`–`.5`, and the retired `release/2.0.0` pushed up to `.5` to GitHub Packages. ## Related Issues - Follow-up to #4513. Supersedes the `master` → `release/2.0.0` merge attempts #4566 / #4570; `release/2.0.0` is retired and cannot publish. ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [ ] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. Locally: `PackageVersionPolicyTests` + `NuGetPackageSetValidationTests` on net10.0, 96/96 passed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-29 07:45:30 +02:00
romanettandClaude Opus 5.5	d623007a3f	Remove the Azure Pipelines CI and publishing definitions from master (#4575 ) # Description Removes the Azure Pipelines CI and package-publishing definitions from `master`. GitHub Actions already owns all CI and package publishing for `master`, but pushes to `master` still queued the Azure definitions. They duplicated the Actions work and posted failing checks, for example [`Nuget Preview (Push Nuget Preview Pack Nugets Debug)`](https://github.com/OPCFoundation/UA-.NETStandard/runs/109065914524) on `19dc504c5`. ## Removed - `azure-pipelines.yml`, `azure-pipelines-preview.yml` - `.azurepipelines/` templates: `ci.yml`, `coverage.yml`, `preview.yml`, `sample-ha-longhaul.yml`, `sln.yml`, `test.yml`, `test-aot.yml` - Helpers only those templates used: `get-matrix.ps1`, `get-root.ps1`, `evaluate-test-results.ps1` - `TrxGateScriptTests`: it tested only `evaluate-test-results.ps1`. The Actions equivalent, `.github/scripts/get-test-verdict.ps1`, keeps its own `CiTestVerdictTests`. ## Kept OneFuzz: `.azurepipelines/onefuzz.yml` stays. Submitting to the internal OneFuzz service needs the Azure DevOps-only `onefuzz-task`, which has no GitHub Actions equivalent. The pipeline has no push, PR or schedule trigger, so it never runs on `master` pushes. The public drop build keeps running in the GitHub `fuzz-public-drop` job. Scripts GitHub Actions still invokes: these stay in `.azurepipelines/`, so every workflow path and `release.yml`'s candidate-bound checkout keep working. Only `generate-slnx.ps1` changes, and only its comment. \| Script \| Used by \| \| --- \| --- \| \| `set-version.ps1` \| buildandtest, nightly, nuget-publish, docker-image, stress / stability / long-haul, `run-dotnet-tests` action \| \| `generate-slnx.ps1`, `signlist{Debug,Release}.txt`, `validate-source-generator-packages.ps1` (+ `expected-packages.txt`) \| nuget-publish \| \| `package-version-policy.ps1`, `validate-nuget-package-set.ps1`, `validate-preview-package-ordering.ps1`, `assert-published-packages-match.ps1` \| nuget-publish, release \| \| `check-coverage.ps1` \| buildandtest, nightly \| \| `validate-migration-plugin.ps1` \| buildandtest \| I didn't rename the directory on purpose. `release.yml` checks out the candidate commit and runs `./.azurepipelines/package-version-policy.ps1` from it, so moving the scripts would break promotion of any candidate built before the move. ## Docs and comments - `UA.slnx` drops the deleted files. - `codecov.yml`, `coverage-thresholds.json`, `targets.props`, the Redundancy sample test comments, the `.github` scripts and workflows, `CONTRIBUTING.md`, `docs/` and `fuzzing/` no longer describe Azure as running on `master` (`/azp run`, the `azure` Codecov flag, "the Azure gate", the Azure long-haul and AoT legs). - In the Developer Guide, the "Triggering a pipeline run" and "Migration status" sections are replaced by "Pull requests from outside contributors" and "Azure Pipelines on other branches". - The new section names `onefuzz.yml` as the one remaining Azure definition. - It keeps the warning that the `Release` ruleset's Azure required check must be lifted before cutting a new `release/2.<minor>` branch. - `master` is merged in, including the #4555 docs rewrite. Its new `docs/RedundancySampleTests.md` needed the Azure references removed again. `docs/README.md` already had none. ## Reviewer notes - Azure DevOps side (admin action, not in this PR): the definitions are configured in the Azure DevOps portal. With the YAML gone, `master` pushes give the CI and preview definitions nothing to run. Disabling definition 14's push trigger/schedule, definition 16's build-completion trigger, and the stale definition 13 stops any residual "file not found" runs. Leave the OneFuzz definition enabled. - `master378`, the 1.x `release/` lines and the frozen `release/2.0.0` keep their own `azure-pipelines.yml`. This PR only touches `master`. ## Related Issues - Follow-up to #4513 (GitHub Actions for CI and nightly). ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [ ] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [ ] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all* tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. This PR removes a test and adds none. Locally, at `9b00da817`, the full `Opc.Ua.Tools.Tests` suite passed on net10.0: 884 passed, 1 skipped. The later commits (OneFuzz restore, merge with `master`) touch only YAML and docs. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-29 07:44:36 +02:00
romanettandClaude Opus 5.5	a0d569d756	Fix Server and GDS audit findings, review findings and spec-conformance gaps (#4571 ) ## Summary Fixes the findings of a bug audit of `Opc.Ua.Server`, `Opc.Ua.Gds.Server` and `Opc.Ua.Gds.Client`. Rebased on master after #4516. What went in: - Audit: 93 findings, each checked against the OPC UA specification. - Code review of those fixes: 35 further findings. - Spec grounding of every fix commit: 18 conformance gaps, now closed. Commits are one per finding, named `Fix <ID>`, `Fix review <ID>` or `Fix spec gap <name>`. The IDs refer to the audit report (S = Server areas, G1 = GDS server, G2 = GDS client). Validation: - Each finding was traced in code and checked against OPC 10000 (parts 3, 4, 5, 9, 11, 12, 13, 18, 20). - Every fix commit was checked against the spec text again afterwards: 0 non-conformant, remaining gaps fixed. - Regression tests were added for most fixes. - Suites run on net10.0 before the rebase: Server, GDS, History, Configuration, Features, Core.Security, DI, Redundancy, LDS, InformationModel, PubSub.Server, Client, Sessions and the three Subscriptions suites, all green. The same suites on the rebased branch are still running; results will be posted as a comment. ## Behaviour and user-facing changes ### Secure defaults - `Historize()` / `HistorianBuilder` grant HistoryRead only. History writes need an explicit `historyAccessLevel: HistoryRead \| HistoryWrite`. - File-system mount: - Anonymous sessions can no longer create, delete, move or open files for writing (`Bad_UserAccessDenied`). - UserWritable and UserExecutable now reflect the user. - `AllowAnonymousWrite` restores the old behaviour; the ReferenceServer sample turns it on. - Default PKI root for the hosted server, hosted GDS, hosted LDS and `OpcUaApplicationConfigurationProvider`: - Moved from the shared temp directory to `{LocalApplicationData}/OPC Foundation/{ApplicationName}/pki`, and startup fails if no per-user directory exists. - When certificate stores of an earlier version still exist under temp, a warning names both paths. Existing deployments that relied on the default get a new application certificate (and the hosted GDS a new CA) unless `PkiRoot` is set to the old path. - GDS: - `GdsServerOptions.AutoApprove` defaults to `false`. - The default KeyCredential store grants no roles unless `AuthorizeRoles` allows them. - Certificate requests (StartSigningRequest, StartNewKeyPairRequest, FinishRequest) need an encrypted channel. - Hosted server anonymous logins: - Anonymous is rejected (`Bad_IdentityTokenRejected`) when the default authenticator options disable it. - A custom `AddIdentityAuthenticator<T>()` on its own no longer disables anonymous. - With anonymous disabled and no configured token policies, the endpoint advertises the authenticators' token types instead of Anonymous. - Runtime-added roles: their properties and methods need SecurityAdmin over an encrypted channel, like the well-known roles. - Disabled users: users disabled through Part 18 UserManagement can no longer log in through `RegisterDefaultAuthenticators(IUserDatabase)`. ### GDS server (Part 12) - Certificate requests: - FinishRequest / ReadRequest with another application's RequestId returns `Bad_InvalidArgument`. - Every StartRequest returns a new RequestId. - A CSR without the ApplicationUri is rejected (`Bad_CertificateUriInvalid`). - An abstract or unsupported certificate type is rejected at Start (`Bad_InvalidArgument`). - Private-key password:* no longer persisted in the JSON applications database. A password saved by an earlier version is read into memory once and dropped on the next save. - CheckRevocationStatus: validates offline against the GDS's own trust lists and CRLs. It returns Good for good GDS-issued certificates and `Bad_CertificateInvalid` for input that is not a certificate. - Certificate-group trust lists: - Writes need CertificateAuthorityAdmin; SecurityAdmin and application admins are read-only. - Writes are validated with the Part 4 certificate validation. - AuthorizationService: - The legacy RequestAccessToken applies `AccessControl` and issues the token for the session identity. - StartRequestToken passes the session identity to every identity-aware provider. - Unknown ResourceIds return `Bad_NotFound`. - Expired token requests and refresh tokens are pruned, with at most 10 000 pending requests (`Bad_TooManyOperations`). - KeyCredential: requests with PublicKey + SecurityPolicyUri are rejected with `Bad_SecurityPolicyRejected` (secret encryption is not implemented); a PublicKey without SecurityPolicyUri is rejected with `Bad_InvalidArgument`. - Audit events: access-token audit events no longer contain the password or token data. - RegisterTickets / UnregisterTickets: need the RegistrarAdmin role when called from a session. - Managed application nodes: moved from namespace 0 to their own namespace (`ManagedApplicationsNamespaceUri`); the NodeId is the ApplicationUri, and the mandatory child properties exist. - Hosted GDS: - New `GdsServerOptions.CertificateGroups` (`GdsCertificateGroupOptions`), bindable from configuration. - The mandatory DefaultApplicationGroup is always present. - The default CA subject uses the resolved application name. - JSON applications database: - A corrupt file throws instead of being silently replaced by an empty database. - Saves are atomic and write in place on bind mounts; on net8+ builds they also follow symlinks and keep the Unix file mode. - Issued certificates and trust-list links survive a reload. ### GDS client - Trust-list download: - Reads until an empty chunk (Part 20 short reads). - A size-limit rejection of the final end-of-file read, as sent by released servers, counts as end of file. - Default certificate group: a null group means DefaultApplicationGroup, and vendor groups in other namespaces are no longer mistaken for well-known groups. - Status codes and errors: - Missing directory proxies report `Bad_ServerNotConnected`. - Short or wrongly typed method outputs throw `BadUnexpectedError` / `BadTypeMismatch`. - GdsAccessTokenProvider: no longer caches a failed client task, and one caller's cancellation no longer fails other callers. ### Trust lists, push and ConfigurationFile (Part 12 / Part 20) - AddCertificate: - `IsTrustedCertificate=false` returns `Bad_CertificateInvalid`. - Added certificates are validated (Part 4), and a certificate revoked by a current CRL returns `Bad_CertificateRevoked`. - CloseAndUpdate: validates the uploaded list against its own certificates and CRLs, not the stores it replaces. Validation failures are no longer recorded in the server's Rejected store. - RemoveCertificate: removing a trusted or issuer CA that other certificates still need returns `Bad_CertificateChainIncomplete`. - Handles: - Several read handles may be open at once. - Any open while a write handle exists returns `Bad_NotReadable` / `Bad_NotWritable`. - A write open while any handle is open returns `Bad_NotWritable`. - Handles of closed sessions are released. - Idle handles close after ActivityTimeout (default 60 s). - Status codes: - Read clamps to the remaining bytes and no longer enforces the size limit. - Oversized Write / AddCertificate returns `Bad_RequestTooLarge`. - Unsupported open modes return `Bad_NotSupported`. - ConfigurationFile.CloseAndUpdate: - Empty Targets return `Bad_InvalidArgument`. - The ConfigurationUpdatedAuditEvent is raised with the configuration owner as source. - With the new `IApplicationConfigurationFileTargetProvider`, providers receive the Targets, a bad target returns Uncertain with per-target results, and session-interrupting updates are applied after RestartDelayTime. - Default namespace permissions: namespaces registered after the first permission lookup now get their NamespaceMetadata default RolePermissions and AccessRestrictions (no stale negative cache). ### Sessions, identity and roles (Part 18) - Session timeouts: a failure closing one timed-out session no longer stops the session-timeout monitor. - ChangePassword: an empty old password returns `Bad_IdentityTokenInvalid`. - Removing or disabling a user: closes only that user's UserName-token sessions. - Role configuration changes: roles granted by an `ImpersonateUser` mapping are kept. - X509Subject rules: a certificate subject value containing a quote never matches an X509Subject rule. - `ImpersonateUser` callback: no longer runs under the global session lock. - Session diagnostics: LocaleIds are kept as the client sent them, while null LocaleIds are ignored for translation. ### Subscriptions and monitored items (Part 4) - Acknowledgements: a failing acknowledgement returns a per-entry Bad status instead of failing the whole Publish. - `DiscardedMessageCount`: counts messages dropped from the retransmission queue and unsent overflow messages. - Durable subscriptions: transferring a restored anonymous subscription works (no NullReferenceException). - Transferred subscriptions: sampling and permission checks use the item's current owner session. - Access denied: a monitored item whose user may no longer read the attribute gets a `Bad_UserAccessDenied` notification instead of going silent. Non-Value attributes need Browse permission (RolePermissions needs ReadRolePermissions), and User* attributes are evaluated per subscriber. - ModifyMonitoredItems: a SamplingInterval of -1 uses the subscription's publishing interval. - AggregateFilter priming: needs HistoryRead / ReadHistory permission and is bounded (100 000 values, bounded page size). - Resource leak: event monitored items no longer leak a consumer task per create/delete cycle. ### Node management services (Part 3 / Part 4) - Reference types: AddNodes, AddReferences, DeleteReferences and Browse reject ids that are not ReferenceTypes with `Bad_ReferenceTypeIdInvalid`. AddNodes, AddReferences and DeleteReferences also reject abstract ReferenceTypes; Browse still accepts them (e.g. `HierarchicalReferences` with includeSubtypes). - Concurrent AddNodes: duplicate BrowseNames under one parent get `Bad_BrowseNameDuplicated`. - TranslateBrowsePathsToNodeIds: - Requires Browse permission on intermediate nodes and final targets (RolePermissions and AccessRestrictions). - A long RelativePath no longer rejects the whole request. - SemanticChangeEvent: - Raised once per actual change of a semantic property, whether or not it is monitored. - Also raised for properties with the SemanticChange access-level bit. - Reports the owning node's TypeDefinition as AffectedType. - Localized diagnostics: operation-level text is translated when OperationLocalizedText is requested. ### History and aggregates (Part 11 / Part 13) - DeleteRawModified: an unspecified or reversed range returns `Bad_InvalidTimestampArgument`, and StartTime == EndTime deletes the value at StartTime for every provider. - ReadAtTime fallback: reads only the values around each requested time. A time whose bound is not found within the search limit returns `Bad_BoundNotSupported` instead of failing the request. - ReadProcessed: a ProcessingInterval shorter than one tick returns `Bad_AggregateInvalidInputs`. - Delta / DeltaBounds: widen to the next larger signed type when the result does not fit the source type (e.g. a decreasing unsigned counter, or an Int16 overflow). - Range / Range2: return the source data type. ### Alarms and fluent API (Part 9) - Suppression: an alarm stays suppressed while any suppression group is active, and re-evaluation without a state change does not move TransitionTime. - `MonitorVariable(variable)`: sets SourceNode, SourceName and InputNode to the variable and makes it a ConditionSource (HasCondition to the alarm, HasEventSource from the object). - Fluent input/output arguments: InputArguments / OutputArguments added through the fluent API to a registered method are readable. - Root notifiers: a failed root-notifier registration no longer leaves an orphaned event worker. - State-machine handlers: exceptions are logged at Error. ### File system (Part 20) - Delete / MoveOrCopy: - Only act on direct children of the directory. - A NodeId whose kind does not match the entry returns `Bad_NotFound` (a file NodeId can no longer delete a directory). - Copying a directory into its own subtree returns `Bad_InvalidArgument`. - Locking: - An open file, or a directory containing one, cannot be deleted or moved (`Bad_InvalidState`). - The check is atomic with opens. - While a Delete or Move runs, read opens get `Bad_NotReadable` and write opens `Bad_InvalidState`. - Open: - Reserved mode bits or EraseExisting without Write return `Bad_InvalidArgument`. - Read+Write returns `Bad_NotSupported`. - Read while a writer is open returns `Bad_NotReadable`. - Client `FileSystemErrors`: maps `Bad_NotReadable` to `IOException`. - RuntimeNodeSet: well-formed NodeSets with a stray `Model` element, or two models in one file where one requires the other, now load. ### Server core, hosting and lifecycle - `SessionEstablishmentQueueLimit` > 0: CreateSession/ActivateSession now queue for a permit. The permit is acquired before the request is registered, and a waiting handshake releases its worker through the request-parking policy. - Node manager lifecycle: - Add, reload and remove no longer wait for parked Publish requests. - A Migrate reload racing with CreateMonitoredItems no longer blocks later lifecycle operations. - Late items on retired or removed managers get `Bad_NodeIdUnknown`. - HistoryUpdate: a batch mixing data and event details is bounded by both limits. - Server stop/start: stopping the server disposes the configuration watcher and certificate subscription; starting recreates them. - Monitored-item queue factory: a factory supplied by the caller or the DI container is no longer disposed by the server. - Audit events: each certificate validation error raises its own AuditCertificate event. A failed OpenSecureChannel without a service result is audited as failed. ## New public API (additive) - `IQueuedSessionEstablishmentLimiter` - `StandardServer.OwnsMonitoredItemQueueFactory` (protected virtual) - `DefaultPkiRoot.Get` (Opc.Ua.Configuration) - `TrustList.SetCertificateValidation` - `NamespaceMetadataRegistry.Invalidate` - `IApplicationConfigurationFileTargetProvider` and `ApplicationConfigurationUpdatePlan` - `GdsServerOptions.CertificateGroups` / `GdsCertificateGroupOptions` - `InMemoryKeyCredentialRequestStore.AuthorizeRoles` - `DefaultManagedApplicationsNodeManager.ManagedApplicationsNamespaceUri` - `AuthorizationServiceManager.RequestAccessTokenAsync(..., IUserIdentity?, ...)` - `AllowAnonymousWrite` on the file-system node manager and its factory - `IFileSystemHost.TryBeginMutation` / `EndMutation`, replacing `HasOpenHandles` ## Not fixed / known limitations - KeyCredential: secret encryption with the client's PublicKey (requests needing it are rejected). - CSR SAN restriction: restricting subject / SAN values copied from a CSR (CA policy). - Ticket signatures: ticket signature verification (needs a trusted-signer configuration). - FileType Read+Write open: needs a read/write stream contract in `IFileSystemProvider`. - Custom `IUserDatabase` implementations: the disabled-user check still scans all users per login. The built-in stores do a single lookup. - 64-bit Delta precision: limited by the calculator's double arithmetic. ## Tests with changed expectations Existing tests were updated where they asserted the old behaviour: - File-system status codes - Trust-list handle eviction - `DiscardedMessageCount` - Localized diagnostics bits - Delta on unsigned sources - SourceNode of fluent alarms - ReferenceServer transfer permission test (now expects `Bad_UserAccessDenied` notifications) - `UserDeactivationShutdownReviewTests` (the revoked session is a UserName login) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-29 07:26:05 +02:00
romanettandClaude Opus 5.5	442889cba5	Fix source generator audit findings; conform structure-field matrices and type metadata to OPC UA 1.05 (#4569 ) # Description This PR fixes a bug audit of the source generation projects (`tools/Opc.Ua.SourceGeneration`: model loading, NodeSet import, all emitters, the Roslyn hosts and packaging). It also fixes a max-effort code review of those fixes, and a check of every spec-relevant change against the OPC UA 1.05 text. - Scope:* about 85 audit findings, 48 review findings and 32 spec-grounding items were addressed. Each fix has a regression test that fails without it. - Wire change: it includes one deliberate, stack-wide wire change: structure-field matrices now follow OPC 10000-6 5.2.5 Table 28. Most changes are internal correctness fixes. The sections below list every change a user can observe: wire formats, generated code and API, generated address-space content, diagnostics and runtime behaviour. ## Behaviour / user-facing changes ### Wire format (encoders) - Binary inline matrices (OPC 10000-6 5.2.5 Table 28). - Layout: a multi-dimensional structure field is encoded as `Int32[] Dimensions`, then the values without a length prefix, with at least 2 dimensions. - Empty and null: any dimension <= 0 means no values follow, and a null matrix is `-1`. An empty matrix is written as `[0,0]`. - Compatibility: this is not compatible with earlier builds of this SDK for matrix fields. It applies to generated types, `[DataType]` types, `Structure`, client ComplexTypes and `WriteEncodeableMatrix`. - Unchanged: Variant matrices (5.2.2.16) keep their old encoding. - Declared rank decides matrix vs array. A 1-D `MatrixOf<T>` in an array field or a Variable value is written as an array again. Matrix-declared fields go through the new public `EncoderExtensions.WriteInlineMatrixValue`, which generated code also uses. A non-empty 1-D value in a matrix field throws `BadEncodingError`. - Decoder hardening: - Before allocating, the decoder bounds all matrix dimensions against overflow, `MaxArrayLength` and the remaining message length. - The decoder rejects: - a matrix with fewer than 2 dimensions; - a populated matrix whose rank differs from the field's declared rank; - a union SwitchField greater than the number of fields; - an EncodingMask with unassigned bits set. - Encoder `MaxArrayLength`: the encoder enforces `MaxArrayLength` for inline matrices, as it already did for arrays. - XML structure fields (5.3.1, 5.3.4, 5.3.5). - Fields: `Structure` and client ComplexTypes write fields like typed fields (`<A>1</A>`, array elements directly) instead of a Variant body. - Matrix fields: `Dimensions` and `Elements` go directly inside the field element, with no `<Matrix>` wrapper. - Empty matrices: written as nil, because XML dimensions must be greater than 0. - Compatibility: decoders still accept the old shapes. - Enum fixes: enum array elements with value 0 are no longer dropped, and enum array element names are fixed. - Other encoding fixes: - A null `DiagnosticInfo` structure field writes `0x00` instead of nothing. - A null scalar field in a runtime `Structure` is written as its default instead of zero bytes, which used to shift every following field. - A Variant holding an empty matrix encodes as an empty array instead of throwing. - `Variant.Copy` keeps the matrix identity of null and empty matrices. - NodeSet export and the DataContract surrogate write Variable values with the Variant rules again. A null or empty `MatrixOf` variable no longer produces invalid XML or unreadable NodeSets. - `JsonEncoder.CanOmitFields` is `true` only for Compact encoding. Verbose and RawData JSON include default-valued fields. ### `[DataType]` source-generated types - Default-value handling (OPC 10000-6 5.4.1, Table 1). - Encode: a field is omitted only when its value and its declared default are the type's default (0, false, null). Fields with a non-default initializer or constructor default, and empty strings, are always written, so configuration files get slightly larger. - JSON decode: a field missing from JSON decodes to the type default. - XML decode: a field missing from XML keeps its declared default, which older configuration files rely on. - Why: this fixes silent round-trip loss, for example `SamplingInterval = 0` read back as `-1`. - Nested `[DataType]` types: they are now generated inside their containing types. Without an explicit id, their default TypeId and XmlName are qualified (e.g. `s=Outer.Foo`); wire identity change for nested types. Colliding activator names get a `_2` suffix. - Activators: they are `internal` when the type, or any containing type, is not public (was CS0060). - Matrix properties: - `MatrixOf<T>` properties use the inline matrix encoding. - Matrices of non-sealed structures, or with `StructureHandling.ExtensionObject`, are written as ExtensionObjects. - Their published ValueRank is 2, because the rank can't be known from `MatrixOf<T>`. - Published StructureDefinitions: - They include base-class fields. - Nullable properties are no longer marked optional. - Inline structure fields name their concrete type. - `[Flags]` enums: they are published as plain enumerations with their member values, which matches how they are encoded. - Other generated code: - `Clone` deep-copies arrays and matrices of structures, Variants, ExtensionObjects and DataValues. - `IsEqual` and `GetHashCode` are consistent: EncodingMask, active union member and NaN handling agree. - Pooled `Reuse()` restores the freshly constructed state through the new `protected virtual ResetForReuse()`, and returns an instance to its runtime type's pool. - Enum capture: enum member values are captured culture-invariantly. Negative values were lost on cultures that use U+2212 as the minus sign. ### Model-driven generator: generated code, API and file names - Removed API: generated `_Placeholder` proxy accessors (e.g. `PowerTrainTypeClient.GetMotorIdentifier_PlaceholderAsync`) and fluent `X_Placeholder()` accessors are removed; they could never resolve anything. - Proxy accessors now look children up by BrowseName with the right namespace. - `RoboticsClient` finds motors and gears by type and drives via `IsDrivenBy`. Its topology snapshots used to be empty. - Renamed files:* generated files for a bound `[NodeManager]` are now named `{Namespace}.{Class}.NodeManager.g.cs` (also `.Factory` and `.FluentBuilders`). - Generated NodeState code: - Attributes are set through `baseState`/`nodeState` locals, so children named like base attributes (e.g. `DataType`, `EventNotifier`) compile. - Children that hide base members are declared `public new`, using names reflected from the runtime. - `global::` qualification is used throughout. - Proxies and fluent builders: a proxy whose supertype is excluded (e.g. Draft) derives from the nearest emitted ancestor. Fluent wrappers and NodeState factories fall back the same way; they used to fail with CS0246. - Derived structures: - The optional-field `EncodingMask` continues across inheritance. - A derived structure over a base type from another model no longer relies on `base.ResetForReuse`. - Default values: - NodeId, QualifiedName and ExpandedNodeId defaults resolve by namespace URI (`context.NamespaceUris.GetIndexOrAppend`) and server URI. - StatusCode, negative enum, `double`/`float` (shortest round-trip literal) and escaped string defaults now compile. - Event records: - Vendor event records have `Decoder.GetStandardFields(NamespaceTable)`, and their browse paths use the model's namespace. - A field whose namespace is unknown to the session no longer matches a namespace-0 field. - Companion `StandardFields` is `[Obsolete]`. - Vendor simple subtypes such as `Percent : Double` map to their built-in type. - Other fixes: - `MethodState.CallAsync` passes the real `objectId` to synchronous `OnCallMethod2` handlers; it used to pass `NodeId.Null`. - Enumeration fields with an explicit `Identifier` keep it, instead of taking a trailing `_<digits>`. - Explicit NumericIds are no longer reused by automatic numbering. - Dependencies are loaded in topological order. ### Generated address-space content - Arguments: - Methods without arguments no longer get empty `InputArguments`/`OutputArguments` properties (OPC 10000-3 5.7). - About 2,660 automatically assigned namespace-0 NodeIds of 15000 and above shift. Every NodeId in `StandardTypes.csv` is unchanged. - Permissions: type nodes and method declarations on types now carry the model's `RolePermissions`/`AccessRestrictions`. - Restored nodes: NodeSet import keeps nodes that were silently dropped before: - `NamespaceMetadata` objects and the NodeSet's own TypeDictionary variables; - ISA95 placeholders linked only non-hierarchically; - instances whose parent is in another namespace. - Import details: - ValueRank > 1 without ArrayDimensions keeps its rank. - `svr=` indexes map correctly. - Invalid MinimumSamplingInterval values import as -1, not 0. - Localized texts prefer the invariant or English translation. - StructureDefinitions: - They include inherited fields, including for subtypes without their own fields (e.g. `AnonymousIdentityToken` now publishes PolicyId). - The StructureType kind covers inherited AllowSubTypes fields. - Unions ignore IsOptional. - StructureFields never publish ValueRank 0; a OneOrMoreDimensions field without dimensions becomes rank 2. - Fields with ValueRank -2/-3 are published as scalar BaseDataType, which is what is on the wire. - OptionSets: - Implicit fields get the next free bit. - `OptionSetValues` uses null for undefined bits instead of "Reserved", and structure OptionSets publish all their bits (no 32/96-bit cap). - Numeric OptionSets are limited to their base type's width, and UInt64 bit 63 works. - Schemas: - Structures with inline-matrix fields are left out of the `.bsd` (5.2.5). - In the BSD, Variant-encoded and non-structure subtyped fields are described as `ua:Variant`. - In the `.xsd`, matrix fields are typed `ua:Matrix` with `Dimensions`/`Elements`, and `EncodingMask` is required. ### NodeSet / model input handling - Model selection: - The newest NodeSet of a model is chosen by `ModelVersion` (SemVer 2.0 precedence), then PublicationDate. The `Version` attribute, which Annex F says is not for comparison, is only a tie-break. - The order is total and does not depend on input order; referenced assemblies use the same rule. - Default names: - Invalid default Name/Prefix values are repaired (`201301ISA95` becomes `_201301ISA95`, `class` becomes `class_`). - Valid names are unchanged. - Sanitising no longer depends on the OS. - `ModelUri` metadata that doesn't match the NodeSet raises a warning instead of silently losing the model. - Input detection: - Only XML files whose root is `ModelDesign` or `UANodeSet` are treated as models. - A malformed NodeSet stays a NodeSet input, so it no longer breaks the ModelDesign pass. - `IdentifierFile` paths: they are normalized (`./`, `../`), and the suffix match requires a folder boundary. - Dependency payloads (`ModelDependencyV1`) carry field IsOptional, AllowSubTypes, ArrayDimensions and the producer's namespace tables in skippable trailers, so old and new readers stay compatible. ### Roslyn host, diagnostics, packaging - New diagnostics: - MODELGEN036: `[NodeManager]` target not supported (nested, generic, file-local or global namespace). - MODELGEN037: `[DataType]` target not supported (struct, generic, abstract, file-local or global namespace). - MODELGEN038: the definition of an encodeable base type can't be found. - New validator errors: - a structure with both optional and subtyped fields (OPC 10000-6 F.13); - multi-bit or duplicate OptionSet masks. - Diagnostic locations: `[DataType]`/`[NodeManager]` diagnostics point at real source locations again, so `#pragma` and `.editorconfig` apply. MODELGEN010 is the exception. - Incremental caching: pipeline values compare by value, so unrelated edits no longer regenerate the whole model or all `[DataType]`s. - `ModelSourceGeneratorIgnore` on a ModelDesign input is honoured; the design still resolves as a dependency. - Cancellation: a cancelled generation run propagates `OperationCanceledException` instead of reporting a MODELGEN003 error. - Stack package: the `Stack` NuGet package now ships `build/OPCFoundation.NetStandard.Opc.Ua.SourceGeneration.Stack.props`, so `StackSourceGeneratorMode` and `StackSourceGeneratorExclude` reach the compiler. ## Related Issues - No tracking issue. The audit, review and spec-grounding reports are available on request. Contains the matrix wire-format change discussed for D-5 (OPC 10000-6 5.2.5 Table 28). ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. (`docs/SourceGeneratedDataTypes.md`, `docs/NodeManagers.md`, generator readme) - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. (`UA.slnx` 0 warnings / 0 errors on net48 and net10.0) - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. The affected suites were run on net10.0: SourceGeneration Core/Roslyn/Stack, Types, Core.Encoders, Encoders.Fuzz, Client, Client.ComplexTypes, PubSub, Core, Server, GDS, Configuration, Di, Robotics, ISA95, Positioning, OpenUsd, XRegistry. net48 was built; its test legs, and the post-rebase verification, run in CI. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-29 00:47:40 +02:00
Marc SchierandCopilot	c4e0721a29	Add a documentation learning path and fix issues found while verifying it (#4555 ) ## Summary ### Documentation - Stage the documentation index as a learning path: a first application, independent client, server, and PubSub paths, then data and services, companion models, production, advanced integration, and draft or experimental capabilities. - Add Getting started (repository samples or NuGet packages), OPC UA concepts, Your first information model, and a production readiness checklist. - Add Native AOT application publishing, a first PubSub publisher and subscriber exchange, and the UDP transport options. - Add or expand contents navigation throughout `docs/`, and keep contributor documentation separate. - Correct outdated SDK examples and capability guidance, consolidate repeated explanations into canonical guides, and repair local links and heading structure. - Rewrite What's New in 2.0 as a concise feature overview with short linked details; keep migration instructions in the Migration Guide. - Expand the feature catalogue with specification IDs, GDS, LDS, the OPC 10000-21 onboarding registrar, ISA-95, xRegistry, OpenUSD, and sample-local models; distinguish draft status, explain crypto pluggability, and bring performance guidance forward. - Address review feedback on wording, active monitored items during shadow reload, and the `Samples.md` filename and references. - Regenerate the `opcua-v20-migration` plugin's bundled copy of the migration guides so it matches the edited `docs/migrate/2.0.x` guides. - Merge the latest `master`, preserving upstream resource-isolation guidance within the task-based documentation index. - Retain deferred Lingity findings where appropriate; this PR does not claim that every document meets the Lingity score thresholds. ### Fixes found while verifying the guides Each fix has regression tests that fail without it. - Client: V2 subscriptions compared their lifetime with the operation timeout instead of the session timeout, and logged a spurious warning. `ISubscriptionEngineContext`, which is new in 2.0, gains a `SessionTimeout` property; implementations must add it. - PubSub: a subscriber now registers the `DataSetMetaData` configured on its readers (OPC 10000-14 6.2.9.4), and the UADP decoder decodes DataSetMessages that carry no ConfigurationVersion. Before, a secured subscriber of the reference sample received no DataSets. - Source generator: a ModelDesign method that declares its arguments inline, without a method type, produced code that did not compile; it now uses `MethodState`. The generated code of existing models is unchanged. - MinimalClient sample: waits for its first data-change notification before it disconnects. ### Known issues, not addressed here - UDP multicast: the publisher does not send on the interface that the subscriber joins, and `MulticastLoopback` defaults to false. The PubSub guide uses unicast for the exchange on one computer. - The UDP metadata announcement is sent unsecured on secured writer groups; a secured subscriber drops it with a warning. - A server does not start in globalization-invariant mode, because `ResourceManager` creates `CultureInfo("en-US")`. The Native AOT guide cautions against the mode. ## Validation - `git diff --check` and `./.azurepipelines/validate-migration-plugin.ps1` (15 bundled migration docs validated, plugin manifests synchronized). - Local Markdown links, anchors, file-link casing, and contents lists checked across all 87 documents under `docs/`. The index links every top-level guide and every target of the previous index. - Both Getting started routes, Your first information model, the PubSub exchange, and the Native AOT publish of the Getting started client and server were run as documented. The NuGet route and the tutorial use the public `2.0.0-preview.5` packages. - The changed libraries build for all target frameworks in Release without warnings. - Tests on .NET 10: Opc.Ua.SourceGeneration.Tests 199 passed; Opc.Ua.SourceGeneration.Core.Tests 3,977 passed, 8 skipped; Opc.Ua.Server.Tests `Fluent` category 621 passed; Opc.Ua.Client.Tests subscription-engine tests 70 passed; Opc.Ua.PubSub.Tests 1,374 passed, 2 skipped; PubSub fuzz replay 145 passed. The new and affected tests also pass on .NET Framework 4.8. - Earlier merge validation: 174 resource-isolation tests passed on .NET 10. - The full solution suite was not run locally. Review and validation artifacts are maintained outside the repository. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-28 19:19:39 +00:00
Marc Schier	19dc504c56	Release the discovery refusal fixture port before connecting (#4559 ) # Description Release the loopback port reservation immediately before the discovery failure attempt in `DiscoveryFailureDoesNotInterruptHealthyClientAsync`. Keeping a TCP socket bound but non-listening does not guarantee prompt connection refusal on Darwin: the macOS CI attempts remain pending until caller cancellation. The test is intended to exercise refusal and healthy-client isolation, not that platform-specific socket state. The change is confined to the fixture. It retains the exact `BadNotConnected` and inner `SocketException` assertions, the real healthy-client `GetEndpoints` readback, the separate caller-cancellation case and the existing timeout. There is no retry, skipped platform or production-code change. The reservation is kept until the last possible moment, immediately before the attempt. As with ordinary released-ephemeral-port fixtures, another local process could claim that port; the original assertions will still fail rather than hide an unexpected outcome. ## Related Issues Fixes #4558. This focused upstream correction is separate from the UaLens delivery in #4462. ## Validation - Windows net10.0: refusal and cancellation tests passed in three consecutive runs. - Windows net48: the same two tests passed. - The formerly failing macOS Sessions lane now passes in [CI run 36396834698](https://github.com/OPCFoundation/UA-.NETStandard/actions/runs/36396834698/job/108845243883). The other test/build checks and coverage pass; CodeQL was still running at the latest check. No maintainer approval or merge is implied. - Existing tests, assertions and CI policy are unchanged. ## Checklist - [ ] CLA prerequisite confirmed by the contributor/service. - [x] Existing exact behavioral regressions retained and run locally. - [x] Added the explanation at the non-obvious fixture boundary. - [x] Targeted builds introduce no compiler/analyzer warnings. - [ ] All UA.slnx tests run locally on .NET Framework and .NET 10. - [ ] New macOS CI and CodeQL checks confirmed successful. - [ ] Maintainer feedback addressed and current approval obtained. The PR was made ready for review through a separate manual action. No automatic merge was performed. Maintainer acceptance is still required before integration into #4462 under the approved closure sequence.	2026-09-28 16:34:08 +02:00
Klaus LandsdorfandMarc Schier	797ca6fae4	Evaluate ContentFilter elements with null operands to NULL per OPC 10000-4 §7.7.3 (#4564 ) # Description `FilterEvaluator` returned FALSE for comparisons with a null operand, so `Not(…)` over such an element became TRUE and where-clauses selected events that do not have the tested field. OPC 10000-4 1.05.07 §7.7.3 requires that an element with a null operand evaluates to NULL and that a filter ending as NULL is FALSE. Changes: - `FilterEvaluator`: `Equals`, `GreaterThan`, `GreaterThanOrEqual`, `LessThan`, `LessThanOrEqual`, `Between`, `Like`, `BitwiseAnd` and `BitwiseOr` evaluate to NULL when an operand is a null value. `InList` returns TRUE on the first match (unchanged), NULL if the value or an unmatched list operand is null, and FALSE otherwise. - `IsNull` follows the nullable built-in types of OPC 10000-6 Table 1 and treats a null or empty array as null (OPC 10000-6 §5.1.11). - `Between` with operands that have no common type is FALSE (§7.7.3), no longer NULL. - `Variant.IsEmptyArray` (new, public): true for a null or empty array or matrix, implemented through an internal `IElementContainer` on `ArrayOf<T>` and `MatrixOf<T>`, so no boxing. - Tests for every operator with null operands on either side, a missing event field through a `SimpleAttributeOperand`, `IsNull` per built-in type, `InList` with and without a match next to a null operand, and `Variant.IsEmptyArray`. A NULL result is asserted by checking that both the element and its negation are FALSE, which a TRUE or FALSE result cannot satisfy. 14 of the test cases fail on master without the change. - Changed existing tests: `EqualsWithNullOperands` expected `Equals(Null, Null) == TRUE` and now expects NULL; `ContentFilterTests.NonBoolWithBinaryTestCases` checks a NULL result with `IsNull` instead of `Equals(x, Null)`. - `docs/MigrationGuide.md`: new section on the changed NULL handling. ## Related Issues - Fixes #4556 ## Checklist - [x] I have signed the CLA and read the CONTRIBUTING doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [x] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [x] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. Test evidence: - `dotnet build` on all seven target frameworks (net472, net48, netstandard2.0/2.1, net8.0, net9.0, net10.0): 0 warnings, 0 errors. - Locally on net10.0/net9.0/net8.0 (macOS): `Opc.Ua.Core.Tests` ContentFilter/FilterEvaluator suite (228 tests) and `Opc.Ua.Types.Tests` Variant/ArrayOf/MatrixOf suite (10 549 tests) green. - `dotnet format whitespace\|style\|analyzers --verify-no-changes` on every changed file: no new diagnostic beyond what is already present on unmodified `master`. - Fork CI (this branch, full matrix incl. Windows net48/net472, macOS, Linux, AOT, coverage gate): green, 149/149 jobs — https://github.com/biancode/UA-.NETStandard/actions/runs/36329950927 - CodeQL: success — https://github.com/biancode/UA-.NETStandard/actions/runs/36329952444 Full disclosure, AI tooling (Claude Code) was used to investigate this issue, implement the fix and tests, and validate the build/format/tests locally and on the fork CI before opening this PR. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>	2026-09-28 16:30:00 +02:00
Copilot marcschier Marc Schier Copilot Autofix powered by AI	df927cbb85	Honor cancellation during TCP endpoint connection (#4553 ) # Description `SelectEndpointAsync` accepted a cancellation token, but legacy TCP connection attempts could wait for socket timeout. Pending connection cancellation now consistently surfaces as `OperationCanceledException`. - TCP cancellation - Preserve native cancellation-token socket connect on modern targets. - Normalize legacy disposal-triggered `SocketException` / `ObjectDisposedException` to cancellation. ```csharp catch (SocketException) when (ct.IsCancellationRequested) { throw new OperationCanceledException("Connection attempt was cancelled.", ct); } ``` - Coverage - Add transport coverage for a pre-cancelled connection attempt and verify no endpoint is established. ## Related Issues ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [ ] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. <!-- START COPILOT CODING AGENT SUFFIX --> - Fixes #4551 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com> Co-authored-by: Marc Schier <marcschier@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-09-28 09:37:36 +00:00
Marc Schier copilot-swe-agent[bot]marcschier	f9892020a3	Add configurable server resource isolation (#4541 ) # Description Add configurable server resource isolation on top of the merged #4522 foundation. - Coordinate connection, handshake, retained-message, session-establishment, queue, execution, request-cost and parked-request limits through one server-scoped provider. - Keep configured startup, continuity/reconnect, control and trusted-owner reservations inside existing totals. Shared capacity remains usable up to explicit owner ceilings. - Use authoritative Session membership for reassembly continuity capacity without granting unrelated resource or rate privileges. Preserve explicit owner mappings and bounded tracking. - Cache immutable classification evidence while retaining current Session and classifier checks. - Support weighted request ordering or FIFO independently of resource accounting. Installed providers enforce decoded-request limits in both modes. - Preserve fail-fast reassembly, valid Abort handling, fixed deadlines, active-work protection, reverse-connect handoff and bounded OpenAPI processing. - Support custom-handler parking through `IRequestParkingPolicy`, `WithRequestParking(...)`, and `RequestLifetime.ParkSink`. Parking releases execution capacity only, keeping retained-data and parked charges until completion. Built-in Publish and the global opt-out remain unchanged. - Provide direct, fluent and DI configuration, public incoming-request parking support, effective startup limit logs and user-facing documentation. Balanced remains the default. SharedOnly without an explicit provider retains shared behavior for intentionally incompatible/unlimited configurations. Reservations are finite and are not one full-message allowance per Session. ## Related Issues Builds on merged #4522. Fixes #4554. ## Review and CI corrections All three previously missed findings in [review 5326734718](https://github.com/OPCFoundation/UA-.NETStandard/pull/4541#pullrequestreview-5326734718) are addressed in `9e25e4ecc`: 1. A custom FIFO provider receives RequestQueue, RequestQueueBytes, RequestExecution and ParkedRequest accounting. A blocked head cannot be overtaken. 2. `IResourceIsolationReassemblyProvider` replaces the sessionless threshold independently of `UseFairScheduling`. The aggregate byte ceiling remains enforced. 3. Runtime `ReservedReassemblyBytes` includes all configured protected stage floors, including ControlReserved. The review's two already-resolved changes remain intact. The CI collection race was fixed at its source in `e1a994a4b`: `ArrayOf.ToArrayOf` treats a separately read collection count as an initial capacity hint and grows/trims for the actual enumeration. Deterministic tests cover growth, shrinkage and stale-zero counts. The subsequent recovery-test race was fixed in `05753ce77`: fake time advances only after a gated keepalive response has been processed and reset its timer, not merely after request arrival. Recovery-order and timeout assertions remain intact, with additional response-state assertions. Instrumentation reproduced the original failure twice; both fixed variants passed 400 executions per framework. CodeQL alert 388 was verified and dismissed as a false positive. Startup logs contain aggregate numeric capacities, not credentials or caller identities. ## Validation \| Scope \| Result \| \| --- \| --- \| \| Latest automated checks at `05753ce7775a58801b4ba9d8f6d7781b709d0b89` \| 167 successful, one package-publication check skipped, no failures \| \| Remaining external prerequisite \| `license/cla` pending: Contributor License Agreement is not signed yet \| \| FIFO/weighted queues, custom parking and server-channel selection \| 175 passed on each net10.0/net48 \| \| Isolation, configuration and parking-hosting selection \| 259 passed net10.0; 257 passed net48 \| \| ArrayOf conversion tests \| 73 passed on each net10.0/net48 \| \| Recovery-audit and keepalive fixtures \| 40 passed on each net10.0/net48 \| \| NativeAOT smoke from preceding updates \| Published and executed successfully \| No tests, assertions, coverage thresholds, or required checks were weakened. The remaining CLA prerequisite must be completed through [CLA Assistant](https://cla-assistant.io/OPCFoundation/UA-.NETStandard?pullRequest=4541). This is not CTT certification or an unconditional network-DDoS, whole-process-memory or fleet-wide guarantee. ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [ ] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [x] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [x] I have addressed all PR feedback received. --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>	2026-09-27 21:11:52 +02:00
Marc SchierandCopilot	46fa7d364a	Harden recovery, concurrency, and resource lifetimes across the OPC UA stack (#4516 ) # Description Bound managed-session recovery, preserve Publish workers and recovery ownership, and address the client, server, transport, and certificate audit findings and subsequent concurrency review. Also reduce the memory retained by exhaustive session-test diagnostics. ## Recovery and Publish ownership - Add `ManagedSessionOptions.ChannelReconnectTimeout` through direct construction, the fluent builder, and DI. The automatic duration is `max(3 * KeepAliveInterval, revised SessionTimeout, OperationTimeout)`, sampled at cycle start. Positive overrides are supported; `Timeout.InfiniteTimeSpan` explicitly opts out. Raw sessions retain their unlimited default. - Add `CreateReconnectBudget(TimeProvider)` as a required `IReconnectParticipant` member, as agreed in review. Custom participants implement it and may return null for no participant-specific bound. - Enforce the earliest participant/caller deadline through transport reconnect, activation/recreation, and subscription restoration. Late callers can shorten an active cycle but cannot extend it. - Cancel and unwind recovery, fence late responses, and release channel recovery ownership before the existing `Faulted` event hands control to the outer reconnect/failover policy. Preserve session recreate admission through final Publish cleanup and keepalive suppression until shared recovery is complete. - Treat participant budget creation/evaluation failures, including exceptions at the exact deadline, as terminal shared-recovery failures. Notify participants before exposing `Faulted`, preserve the original diagnostic, and never silently replace a finite budget with unlimited recovery. - Keep caller-supplied replacement channels, managed bindings, wrapper event subscriptions, and recovery-owner identities consistent across success, failure, and cancellation. Reject replacement during active recovery and fence retired callbacks so they cannot clear newer ownership or suppress later keepalive recovery. - Retain eligible Publish workers through temporary subscription-identifier clearing without retaining workers for never-created or removed subscriptions. Preserve cancellation, acknowledgement rollback, and drain-before-replacement ordering. - Coordinate automatic subscription updates with session recovery: cancel admitted updates, keep them paused across a failed-restoration handoff, and retry only after explicit restoration completes. This prevents competing CreateSubscription requests and updates against a retiring session, while preserving manual recreation, transfer fallback, and pending option changes. - Exercise the real ManagedSession, V2 subscription engine, and channel ready gate with scripted transports and an injected clock. Cover transfer fallback, deadline handoff, late completions, and resumed notification delivery. ## Audit and review corrections - Correct certificate/trust-list transactions, change-pump lifetimes, validation, peer revalidation, and reset/resource ownership. - Harden node admission, attribute/range/dimension validation, monitored-item sampling and lifecycle transitions, event fanout, and server shutdown. Run lifecycle readiness and compensation outside shared monitored-item admission, with stale-completion ownership checks. - Close synchronous node-manager admission before teardown and retain resources until admitted service, lifecycle, and asynchronous method work returns. Dispose the monitored-item manager outside both locks, reject late calls before they can reach it, and forward asynchronous disposal through the adapter so the master awaits the same completion. Preserve reentrant shutdown initiation, cancellation/failure unwinding, and shared cleanup-failure reporting. - Bound WSS pending-request retention using connection-local wire handles while preserving caller-visible request handles and translating Cancel targets. Safely ignore retired replies and drain admitted send/close users before resource disposal. - Clarify that the shared `ClientBase` caller-handle sequence is distinct from the non-wrapping WSS wire allocator. Existing exhaustion/reopen, late-reply, and Cancel-translation regressions verify the connection-local contract; no allocator behavior was changed by this clarification. - Preserve virtual-node validation and resolver service errors instead of converting them to cached misses. A mismatched NodeId reports `BadNodeIdInvalid`; callback type mismatches and resolver service errors keep their exact status. Per-item boundaries preserve unaffected reads, writes, history operations, method calls, browse paths, and monitored-item creation/restoration, including permission-validation paths. Caller cancellation still propagates; stored-item validation failures are logged without aborting later restores. - Correct client file/role/state-machine/streaming APIs, node-cache behavior, redundancy/failover ownership, and session configuration/identity handling. - Cancel each owned peer-discovery scope before disposing it, including when the bounded wait wins a cancellation-delivery race. Keep late results out of the endpoint cache and preserve single-flight lookup ownership. - Keep materialized alias Browse results synchronized with the live store by default, preserving explicit startup-only opt-out. Apply HistoryUpdate service results per value while retaining explicit all-or-nothing provider APIs. - Update the directly related feature documentation and add focused positive, negative, concurrency, and ownership regressions. ## Latest review-feedback corrections - Fence stale failed lease observations with a successful-confirmation generation distinct from the revocation epoch. Snapshot it before each store read, including failed-CAS revalidation, so an old failure cannot revoke or reschedule a newer lease while fresh ownership loss still revokes leadership. Preserve independent overlapping acquisitions, expiry, disposal, and late-success protections. - Isolate attributable WSS response-decoding errors to their request, including retired handles. Keep admitted socket sends connection-owned so caller timeout/cancellation cannot abort sibling requests; shutdown still cancels and drains those sends. - Restart keepalive and classic Publish replenishment after successful session reuse. Retire V2 worker demand after intentional deletion/disable without confusing that state with temporary recovery resets. - Browse virtual directories lazily across continuation pages without the 1,024-entry snapshot cap. Preserve active-page cancellation, bounded metadata retention, pushback, and exactly-once asynchronous cursor cleanup. - Apply certificate/CRL staging in last-operation order, preflight required issuer storage before writes, select actual policy-compatible RSA keys for None endpoints, frame certificate chains independently of signature OIDs, and preserve admitted validation results during rejected-writer shutdown. - Preserve base asynchronous disposal when a legacy override omits its base call; avoid double derived disposal in the adapter. Let genuinely admitted nested work finish while rejecting stale captured contexts and returning null from closed lookup APIs. - Re-park recovered monitored items if AddNodes rolls back. Give event compensation a fresh finite deadline, and preserve healthy Browse/Translate siblings at every reference/path boundary while retaining starting-node errors and caller cancellation. - Give final reconnect notifications a live, bounded shutdown-linked lifetime. Synchronize child state before parent lifecycle handlers outside the parent transition lock. - Document the accepted existing policies: direct reverse connections are single-use without a ReverseConnectManager, and multi-node stream capacity is shared rather than reserved per node. The expanded readiness controls also exposed a real generation-handoff race: an old source could finish draining after activation was deferred but before readiness tasks were collected, causing the wanted replacement to be omitted from the wait set. A deterministic test gates that exact interval; the fix keeps the replacement in the readiness wait. The original race passed 200 repetitions after the fix. A separate control now awaits both producer readiness and iterator entry under the same original deadline, rather than treating those independent signals as equivalent. Temporary logging and repetition are removed. ## CI integration contracts The History and Server CI failures exposed integration tests that still asserted the behavior intentionally changed by the audit fixes. A Windows WoT negative test raced its caller deadline against upstream retries. A subsequent Ubuntu Client failure exposed a real automatic-update versus explicit-restoration race: - History insertion collisions now verify exact per-value statuses and all persisted timestamps/values, including preservation of the existing conflicting entry. Explicit atomic-provider rollback controls remain. - Alias materialization tests wait for actual publication and verify the added node plus forward/inverse `AliasFor` references, instead of racing a startup-only snapshot expectation. Explicit refresh opt-out controls remain. - The unavailable-upstream WoT test uses an explicit finite retry policy through existing DI configuration, preserving its original four-minute guard and requiring a mapped-value service error before caller cancellation. Production retry defaults remain unchanged. - The Client fix retains the exact one-create and late-response assertions. Three deterministic real-subscription/real-manager cases cover paused creation, disposal while paused, and cancellation of an admitted create followed by explicit restoration and a pending option update. Both composed restoration-deadline cases also prove automatic updates stay blocked at the outer handoff and resume after restoration. - The merged-head net48 correction prevents lost peer-resolver cancellation and distinguishes the harness's delayed initial `Connected` event from actual outer recovery completion. A deterministic timer-order test covers both cooperative and cancellation-ignoring resolvers, cancellation before return, rejection of late cached results, and a fresh subsequent lookup. - The remaining CodeQL alert was a false content flow through `ArrayOf.Count` into an integer-only trust-list summary. Projecting the same count through `Span.Length` keeps cardinality distinct from serialized contents without allocating, dropping diagnostics, suppressing the rule, or dismissing the alert. Five log-contract cases cover null/empty/nonempty results and mixed chain-capable/fallback listeners, asserting the exact count, message, and structured properties. - Classic transfer acknowledges messages selected for asynchronous Republish only after their responses arrive. The existing locked replay-selection decision returns the immediate-acknowledgement subset to Session, preserving the public transfer API, advertised availability, and immediate acknowledgement of older gapped messages not selected for replay. A callback changing `RepublishAfterTransfer` cannot change the already-selected acknowledgement ownership. - Transfer integration tests explicitly control acknowledged versus retained origin messages. Exact assertions distinguish retained replay from requested fresh initial values by sequence number, client handles, values, status, and source timestamp. Atomic counters, observed delivery/keepalive progress, and failure-safe session/file cleanup replace timing assumptions and racy resets. - Server lifecycle tests verify the documented independent five-second compensation deadline rather than requiring a non-cancellable token. They cancel the actual request, prove compensation and unrelated monitored-item creation still proceed one tick before the deadline, preserve the original failure and ownership assertions, and verify the completed deadline is retired. - Synchronous and asynchronous directory-browser tests require the exact provider exception instead of an empty-directory success, then verify the failed cursor is not enumerated again. These correct expectations left behind by the intentional, documented provider-error propagation change; production behavior is unchanged. No tests were disabled, assertions loosened, coverage thresholds lowered, or CI checks made optional. Existing platform exclusions and Explicit debug variants remain. ## Related Issues - Fixes #4514 - Fixes #4515 - Builds on merged #4503 and retains the #4508 publishing-drain behavior. ## Validation Lease-election review correction (`a13afa641182c70983e16bbcfebf507e666a45a5`): The correction is based on the existing upstream merge `43079e2b851fe338a4082066f8d14abfdafb6e32`. Three deterministic stale-verdict cases fail on the original source and pass with separate confirmation fencing. Six new cases cover the initial foreign-owner verdict, failed-CAS revalidation in both invocation orders, and fresh ownership loss through both read paths, including revalidation begun after another successful confirmation. \| Target and configuration \| Passed \| Failed \| Skipped \| \| --- \| ---: \| ---: \| ---: \| \| net10.0 Debug \| 120 \| 0 \| 0 \| \| net48 Debug \| 120 \| 0 \| 0 \| The selection is the full `Opc.Ua.Core.Tests.Redundancy` namespace, including all 38 `SharedStoreLeaseElectionTests` cases and the existing expiry, clock rollback, disposal, and overlapping-success regressions. New witnesses are `StaleForeignLeaseReadDoesNotRevokeNewerAcquisitionAsync`, `StaleFailedRevalidationDoesNotRevokeNewerAcquisitionAsync`, and `FreshForeignLeaseObservationRevokesLeadershipAsync`. They assert resulting leadership, exact transitions, independent progress, and the unchanged expiry boundary. Retaining the initial generation for the fallback read independently makes the fresh-loss-after-confirmation control fail; that mutation was removed before the final rebuilt runs. The successful scoped command is `dotnet test tests\Opc.Ua.Core.Tests\Opc.Ua.Core.Tests.csproj -c Debug --no-restore --filter "FullyQualifiedName~Opc.Ua.Core.Tests.Redundancy"`, with `CustomTestTarget` and `-f` matching each row and that framework's assets restored. Both changed C# files pass formatting and analyzers through informational severity on both frameworks. These are scoped results, not a full-solution test or measured coverage-delta claim. CI monitoring is paused for this feedback-only operation; no current-head CI success is claimed. Latest CI contract correction (`1cd1f2047bb5b50c9bf300b1ff710b0b2e935a29`): All four failing Server shard 23 jobs in [run 36120946740](https://github.com/OPCFoundation/UA-.NETStandard/actions/runs/36120946740) reported the same six cases. Two local replays reproduced all six failures. The source changes and documentation from `cd43b831a` establish both intentional contracts: independent bounded event compensation and surfaced provider errors. Only the two test files are corrected; production code and CI policy are unchanged. \| Target and configuration \| Passed \| Failed \| Skipped \| \| --- \| ---: \| ---: \| ---: \| \| net48 Debug \| 113 \| 0 \| 0 \| \| net10.0 Release, CI Coverlet settings \| 113 \| 0 \| 0 \| The selection contains `MonitoredItemManagerLifecycleTests`, `DirectoryObjectStateTests`, `DirectoryBrowserBoundedEnumerationTests`, and `EventCompensationReadinessHasFiniteDeadlineWithInfiniteSourceTimeoutAsync`. Both changed files pass formatting and analyzers through informational severity on both frameworks. Independent mutations restoring a non-cancellable compensation token and swallowing provider errors fail all four lifecycle cases and both browser cases, respectively. Both mutations were removed before the final passing runs and commit. The scoped command is `dotnet test tests\Opc.Ua.Server.Tests\Opc.Ua.Server.Tests.csproj` with `CustomTestTarget` and `-f` set to the selected framework, `--no-restore`, and `--filter "FullyQualifiedName~MonitoredItemManagerLifecycleTests\|FullyQualifiedName~DirectoryObjectStateTests\|FullyQualifiedName~DirectoryBrowserBoundedEnumerationTests\|FullyQualifiedName~EventCompensationReadinessHasFiniteDeadlineWithInfiniteSourceTimeoutAsync"`. The modern run additionally uses `-c Release /p:CollectCoverage=true --collect "XPlat Code Coverage" --settings tests\coverlet.runsettings.xml`. These are scoped results, not a full-solution test or measured coverage-delta claim. Hosted checks for that commit were pending at publication. The fail-fast CI watch was stopped when the requested operation switched to review feedback; no current-head CI success is claimed. Earlier master merge (`8b15ea6ef9fc2214ac8ec886f373bb3846dd6d6f`, base `b4136d8e9bab0df680f41d9ef985f519160534b1`): The `TcpListenerChannel` conflict preserves both lifetime responsibilities: disposal clears the retained peer-certificate chain and unregisters the quota-scoped message-assembly scheduler. Both fields and all upstream deadline handling remain intact. The only additional manual source adjustment adds the parentheses required by the existing analyzer around the session-count fallback. Master advanced during validation. The initial transport merge `80303c434ce813cf75aa7fe54a6a32fe2aeafc30` was retained, and the newer base was merged normally in `8b15ea6ef9fc2214ac8ec886f373bb3846dd6d6f`, without rewriting history. The additional recovery, fluent-pipeline, and test-framework overlaps were inspected; the branch's cancellation, validation-error, and acknowledgement ownership fixes remain alongside the upstream changes. Full `UA.slnx` builds passed on net10.0 and net48 with 0 warnings and 0 errors. The final scoped tests rebuilt against the committed tree `2074f8efcb61d8d9c6106e7d6f76ee941940e358`: \| Target \| Passed \| Failed \| Skipped \| \| --- \| ---: \| ---: \| ---: \| \| net10.0 \| 2,653 \| 0 \| 0 \| \| net48 \| 2,529 \| 0 \| 7 \| The net48 skips are existing platform exclusions: six RSA_DH_AesGcm nonce cases and one ClientWebSocket certificate-validation case requiring .NET 7 or later. The selection covers transport cleanup, reassembly budgets/deadlines/admission, peer-chain ownership, server session binding, fluent lifecycles and source generation, reconnect and keepalive, transfer acknowledgements, Publish queues, and JSON encoding. Modern-.NET WSS transport and real-server integration cases also pass. The resolved file passed solution-relative formatting and analyzer verification through informational severity on both frameworks. These are scoped test results, not unfiltered full-suite or measured-coverage claims. Hosted CI was not monitored or repaired as part of this merge-only operation. Selected local results below are overlapping validation runs, not distinct-test totals. Earlier review-feedback batch (`cd43b831a8f11de3f7d65c3681712a61e3c669a5`): The final net10.0 scoped selection passed 471 tests, with no failures or skips. The final net48 solution-root selection passed 439 tests, with no failures and one unchanged platform skip (`ValidateServerCertificateFallsBackToTlsPolicyErrors`, which requires newer ClientWebSocket certificate-validation support). Both full nonincremental solution builds completed with 0 warnings and 0 errors, and all 40 changed C# files passed informational-level formatting/analyzer verification. Both frameworks validated the identical final tracked diff. The focused matrix covers every one of the 20 current review threads, including real mid-frame WSS cancellation, stale admission contexts, directory continuation ownership, multi-element Browse/Translate failures, and the readiness drain race. The net10.0 solution-root test command has a separate pre-existing runner conflict: three unrelated AOT projects reject the VSTest target under Microsoft.Testing.Platform 2.4.0 and SDK 10. Per-project net10.0 results are recorded separately; no runner migration, test exclusion, assertion relaxation, or CI-policy change is included. These are bounded selections, not unfiltered full-suite or measured coverage claims. At publication of `cd43b831a`, hosted CI was not green: the `OPCFoundation.UA-.NETStandard` check reported `ACTION_REQUIRED`, AppVeyor reported `FAILURE`, and the two signed-build jobs were in progress. No CI jobs were rerun, cancelled, approved, or repaired as part of that feedback-only operation. Classic transfer correction (`f425376fca045794122e19aaf9cafebc4a717d91`): The preceding head's [macOS net10.0 shard 25/30](https://github.com/OPCFoundation/UA-.NETStandard/actions/runs/35980326299/job/107570512458) failed `TransferSubscriptionTest(DisconnectedRepublish).TransferSubscriptionAsync(True,False)` at the static-node count assertion: expected 10, received 20. The trace contains a successful, explicitly requested republish of retained sequence 1 and a fresh initial-value batch at sequence 3, not duplicate dispatch of one response. Controlled lost origin acknowledgements reproduced that incorrect test expectation on both the preceding PR head and exact master base `a2539cb53dd1666cef856f33812d7a8830d68909`. The maintainer explicitly authorized correcting this existing issue in the PR. Retained replay and requested initial values are independent, as specified by [OPC UA Part 4, TransferSubscriptions](https://reference.opcfoundation.org/specs/OPC-10000-4/5.14.7). The reason that the original hosted run retained its particular origin message remains unproved. The expanded full-suite run then exposed a real production race, not just a count assertion: Session queued acknowledgements for all transferred available messages before the asynchronous Republish responses arrived. Publish could delete those messages first, causing `BadMessageNotAvailable`. A gated real-Session/classic-engine regression failed both replay-enabled cases on the original implementation while both no-replay controls passed. The ownership fix passes all 24 combinations of empty/consecutive/unsorted-gapped queues, replay preference, sequential delivery, and a reentrant preference change. All 40 normal real-server transfer cases pass on both frameworks. Independent mutations suppressing actual replay and duplicating observed sequence records each fail the intended assertion; both mutations were removed. The full classic suite passes on both frameworks. Hosted CI was pending when that correction was published; the earlier failed hosted job was not rerun for a lucky pass. Local net48 caveat: the full Client run timed out in the pre-existing fake-clock test `ReconnectAsyncSwapsFaultedLeaseEntryAsync`, which does not exercise subscription transfer. Its unchanged isolated replay passed, but that does not resolve the full-suite timeout. No unrelated code or assertions were changed, and a clean full Client net48 run is not claimed. \| Scope \| net10.0 \| net48 \| \| --- \| --- \| --- \| \| Full Client.Tests after transfer acknowledgement correction \| 2,549 passed \| 2,552 passed, 1 timeout failure noted above, 1 existing platform skip \| \| Full classic-subscription project after transfer correction \| 57 passed, including all 40 normal transfer cases \| 57 passed, including all 40 normal transfer cases \| \| Gated transferred-message acknowledgement ownership \| 24 passed, included above \| 24 passed, included above \| \| Saved-session consumer of the shared subscription helper \| 40 passed \| 16 passed, 24 existing unsupported-security-policy skips \| \| Audit regression matrix \| 2,339 passed \| 1,934 passed, 34 existing skips \| \| Full Client.Tests after review follow-ups \| 2,520 passed \| Focused selections only \| \| Full Client.Tests after CI recovery correction \| 2,523 passed, CI coverage collector \| 2,527 passed, 1 existing platform skip \| \| Latest merged-head recovery/redundancy selection \| 139 passed \| 139 passed \| \| Full Client.Tests after merged-head net48 correction \| Focused selection above \| 2,529 passed, 1 existing platform skip \| \| Lifecycle and actual-dimension regressions \| 146 passed \| 146 passed \| \| Focused recovery follow-ups \| 7 passed \| 7 passed \| \| WSS-related fixtures \| 93 passed \| Not applicable \| \| CI History integration corrections \| 28 passed \| 28 passed \| \| CI alias, dispatcher, and explicit-atomic controls \| 63 passed \| 63 passed \| \| Full WoT sample project with CI coverage collector \| 29 passed \| Not applicable \| \| Trust-list effects and count-only summary contract \| 22 passed \| 22 passed \| \| Virtual-node feedback, node-manager, dispatcher, and lifecycle selections \| 661 passed, 63 existing not-executed cases; all 48 virtual-node cases passed \| 661 passed, 63 existing not-executed cases; all 48 virtual-node cases passed \| \| WSS wire-handle exhaustion, late replies, and Cancel translation \| 9 passed \| Not applicable \| \| Synchronous node-manager disposal and related service/lifecycle suites \| 1,037 passed, 64 not-executed cases from existing fixture assumptions; all 93 sampling/disposal cases passed \| 1,037 passed, 64 not-executed cases from existing fixture assumptions; all 93 sampling/disposal cases passed \| - Full solution builds passed on net10.0 and net48 during the audit work. The subsequent full non-incremental net10.0 build also completed with zero warnings/errors. - Modified source/test formatting and analyzer checks passed through informational severity. - Original composed recovery regressions passed repeated runs on both frameworks. Independent mutations removing Publish cancellation, bypassing the recreate drain call, or ignoring ready-gate cancellation each failed the intended assertion; all mutations were restored before passing runs. - The latest recovery correction passed 100 executions of each original restoration-deadline scenario with unchanged assertions. Restoring premature update admission independently made both strengthened handoff cases fail; the correct retention behavior was restored afterward. - Startup-event and cancellation-delivery timing probes reproduced the subsequent net48 failures, then passed 100 executions of each of the three scenarios with the fixes. All timing probes and repetition were removed. The permanent timeout-order regression also went RED on the original cancellation cleanup without sleeps or scheduling amplification. - Final post-format recovery/subscription/engine checks passed all 151 selected cases on net10.0. The first local full net48 attempt aborted in `clr.dll` with native access violation `0xc0000005`; an unchanged-assembly full diagnostic rerun passed as recorded above. That native host crash has not been attributed or claimed fixed. - A minimal replay with the same CodeQL CLI and query-pack versions reproduced the custom-count alert and confirmed that the standard span-length projection is clean while direct sensitive-value and raw-identifier logging controls remain flagged. The source was already logging only a count; no identifier or certificate disclosure was established at the reported location. - The virtual-node feedback regressions first reproduced five error-preservation/cache failures; expanded service-dispatch cases exposed two additional whole-batch failures before the operation-boundary fixes. The final selections pass on both frameworks. Genuine misses remain cached, successful results remain reusable, failed validation allows same-cache retry, and request cancellation still stops the batch. - Three deterministic synchronous-manager disposal regressions reproduced early resource release and lifecycle calls reaching a manager during disposal. The fix passes direct and adapted calls, a sampling-worker join after the last operation exits, reentrant shutdown, cancellation and failure paths, repeated disposal, and exact rejection across 39 service/lifecycle entry points both during drain and after cleanup. The original outside-node-lock disposal regression remains and now requires the worker to observe closed admission. - Prior-head CI on `c985f8bded77a60449d9cd381c8a004d8590ccf6` completed with 168 passing checks, one expected release-package-publication skip, and no failures or pending checks. All test shards, signed builds, container builds, the coverage check, and the CodeQL PR check passed. Hosted CodeQL analysis `1829262912` completed successfully and marks count-flow alert 385 fixed. This is evidence for that head, not a claim that subsequent review follow-ups have completed hosted CI. ### Session-test diagnostic memory Complete browse listings are streamed to unique NUnit attachments rather than retained in inline NUnit/VSTest output. Detached regression-test results are cleaned up without deleting runner-collected attachments. - Two covered session-suite runs each completed with 782 passed and 379 existing skips. Peak working set fell from 4.86 GiB to 2.44-2.78 GiB. - TRX output shrank from 303.1 MiB to approximately 40.7 MiB, retaining all 46 complete browse attachments. - Seven output regressions cover exact content, empty/single/large listings, disabled/enabled output, bounded inline summaries, and unique filenames. The separate Azure build-18452 VM deprovisioning cause remains unproved without provider logs. The memory measurements do not establish its cause. Unfiltered local `UA.slnx` tests, including the long stress/soak suites, have not been run on both frameworks. A local coverage delta was not collected; builds and focused tests are not substitutes for those claims. ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [ ] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] All checks on the latest review-follow-up head have completed successfully; prior-head CI passed as recorded above. - [x] I have addressed all PR feedback received. Tests have been added and pass as recorded above; the hosted coverage check passed on the prior head identified above. The combined tests/coverage-increase checkbox remains open because no local coverage delta was measured. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 68f26810-22b8-476f-abcd-0a8c82d6e208	2026-09-25 14:59:34 +00:00
Cristi PogaceanandCopilot Autofix powered by AI	9b8a3b1188	Preserve node initialization and copied child ownership (#4544 ) # Description Preserve populated derived node children through optional initialization and give copied children independent ownership by their copied parent. - Track initialization from a source in `NodeState` and guard generated optional-default recreation without removing the optional initialization hook. - Reuse `CloneChild` for dynamic children, generated typed children, and method argument properties. Preserve the clone root's existing external parent. - Add cross-model initialization/copy regressions, method-argument and nested-child ownership tests, and inherited alarm-subtree checks. This PR contains only the six files for this fix group. Certificate-store, runtime-type-loader, publish-queue and transport-exception fixes are separate work. ## Related Issues Fixes #4525. Fixes #4526. ## Validation Fresh focused Release/net10.0 checks on the final base: \| Fixture \| Passed \| Failed \| Skipped \| \| --- \| ---: \| ---: \| ---: \| \| CrossModelInstanceTypeDefinitionGeneratorTests \| 9 \| 0 \| 0 \| \| Types NodeStateTests \| 227 \| 0 \| 0 \| \| Core StateTypesTests \| 13 \| 0 \| 0 \| All three test commands exited 0. `git diff --check` and the changed-file diagnostic check are clean. Regression proof was also executed in the isolated worktree: with the three production changes reversed, six generator cases failed with the missing derived Temperature child while three controls passed; two copy cases failed parent-identity assertions while the external-parent/absent-arguments control passed. The production fix was restored and the focused checks are green. The retained red runs preceded the later upstream synchronization; the affected production paths were unchanged by that synchronization. Windows win-x64 NativeAOT publish and native execution also passed: main 178/178, Historian 2/2, MCP 3/3, no skips, every invocation exit 0. These native runs preceded the final CTT-configuration/notes-only fast-forward; this PR's six files were unchanged. Local validation is intentionally change-scoped for this work, with the full matrix and repository-wide checks left to PR CI. Repository guidance and test assertions/timeouts were not modified. Local commands used a NuGet v2 source override and disabled audit only on the command line; CI feed/audit policy is unchanged. Earlier broad attempts are not claimed as a completed local gate: an unmodified-base durable restart timeout was reproduced before synchronization (the later durable run passed), and the net48 runner stalled after recording passing client tests. A direct client retry subsequently exited 0, but the full net48 matrix was not completed. Those results are not substituted for the focused evidence above. ## Checklist - [x] I have signed the CLA and read the CONTRIBUTING doc. - [x] I have added regression tests and demonstrated failure without the production fix. - [x] The focused tests pass; no new compiler diagnostics were reported by those builds. - [ ] Coverage and the full net48/net10.0 matrix are verified by PR CI. - [ ] All CI, CodeQL, and review feedback is addressed. --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-09-25 12:23:49 +00:00
Cristi Pogacean	5fa272d89a	Fix instance-scoped certificate store resolution and consumers (#4546 ) ## Summary Route certificate operations through the providers registered on the configured manager, so custom stores work consistently during validation, key loading, provisioning and GDS operations. - Add optional `ICertificateStoreResolver`, implemented by `CertificateManager`, without adding members to `ICertificateManager` or removing existing public signatures. - Use scoped resolution for configuration validation, startup and cold-cache private-key lookup, application certificate provisioning/reuse/deletion, existing-key GDS signing requests, and hosted TrustList access. - Preserve built-in lookup when no resolver is available, private-key lookup fallbacks, access checks and transaction behavior. Resolver failures do not silently fall back to Directory. Returned stores remain caller-owned; TrustList retains cached-store disposal. - Add regression coverage for instance isolation, mixed provider types, real private-key reuse, rotation lookup, cancellation/failure disposal, unavailable-key rejection, CSR output and TrustList lifetime. Document the optional capability. Fixes #4527 Fixes #4528 Fixes #4529 Fixes #4530 Fixes #4531 ## Validation Change-scoped Release tests on Windows, on base `5d26f6f43`: \| Fixture selection \| net10.0 \| net48 \| \| --- \| ---: \| ---: \| \| CertificateManagerFactoryTests + CertificateManagerTests \| 71 passed \| 71 passed \| \| ApplicationInstanceTests \| 56 passed \| 56 passed \| \| TrustListTests + ConfigurationNodeManagerPushTests \| 147 passed \| 147 passed \| All six selections exited 0 with zero failures or skips. Changed-file whitespace verification and `git diff --check` passed. Fresh no-fix comparisons retained the new resolver API/manager implementation, but reversed the validation, provisioning and CSR consumer fixes: validation had 2 custom-store failures / 1 built-in control pass; provisioning had 4 custom-store failures / 1 built-in control pass; CSR had 1 custom-store failure / 1 built-in control pass. Failures reported unknown custom store types or invalid custom trust stores. All consumer source changes were restored, rebuilt, and the full focused net10.0 selections passed again. Earlier TrustList regression evidence is recorded in #4531: its before comparison retained the constructor injection boundary while exercising the old store-opening path. It was not a test against an entirely unextended API. The complete platform/framework matrix is left to PR CI; no full local matrix or completed CI qualification is claimed. Local restore used command-line-only NuGet v2/feed-audit overrides; no repository feed, test or contribution guidance was changed.	2026-09-25 12:13:31 +00:00
romanettandClaude Opus 5	d6356766c5	Resolve the open CTT findings: aggregate fixes, de-DE ApplicationName and CTT configuration (#4545 ) # Description Resolves the open items of `plans/ctt-issues.md` (Needs clarification, Open server findings, CTT project configuration notes). Each item was checked against the OPC 10000 spec text. A server change was made only where the server was wrong, and every server change has a regression test. CTT script and oracle defects are filed in Mantis instead. ### Server changes (`Opc.Ua.Server`) - NumberOfTransitions honours TreatUncertainAsBad. - Part 13 §5.4.3.24 does not count Bad values. §4.2.1.2 makes Uncertain values "equivalent to Bad" when TreatUncertainAsBad is True, and the aggregate definition doesn't override that. - Uncertain values are therefore no longer counted, and no longer used as the previous value, when the setting is True. The now unused `TimeSlice.NonBadEarlyBound` is removed. - DurationInStateZero/NonZero status follows the variable's interpolation. - §5.4.3.2.2: "A region is Uncertain if a region ends in a Bad or Uncertain value and SlopedInterpolation is used." - The calculator always built stepped status regions. So on a sloped variable, the last region stayed Good while TimeAverage2 and Total2 over the same interval were already Uncertain. - The duration value doesn't change. - AnnotationCount returns `Bad_NoData` and sets Partial. - Table 68 requires `Bad_NoData` for intervals before the start or after the end of data. §5.3.3.2 requires the Partial bit for incomplete intervals. - `HistorianDispatcher` now derives the start and end of data from the raw history (read with bounds) plus the annotation timestamps. It passes them to a new `CalculateAnnotationCounts` overload; the old overload is unchanged. - Three existing dispatcher tests change their expectations. For example, a node without any data now returns `Bad_NoData` instead of Good zeros. ### Reference server sample and CTT configuration - `de-DE` ApplicationName. The server advertises `de-DE` in LocaleIdArray, but FindServers and GetEndpoints always returned the en-US name. The sample now keys the ApplicationName and registers en-US and de-DE translations (Part 4 §5.5.2.2 / §5.5.4.2 localeIds). - Subscription limit. `Max Supported Subscriptions` in `samples/UAReferenceServer.ctt.xml` and `MaxSubscriptionCount` in `Ctt.ReferenceServer.Config.xml` go from 100 to 200. Subscription Publish Min 05 `003.js` needs 190 subscriptions. - Alarm Cycle Time. The CTT template's Alarm Cycle Time is 30 s. At 60 s it equalled `RequestedSessionTimeout`, so a Limit/Level CU that starts a run finds its session expired (C40). ### Tests only - AddNodes duplicate BrowseName test: `AddNodeAsync_DuplicateBrowseNameUnderParent_ReturnsBadBrowseNameDuplicatedAsync` never ran. Its items had no TypeDefinition, so its `Assume` always made it inconclusive. The finding it belongs to (AddNodes after a rename returning `BadNodeIdExists`) was already fixed by #4477. - RequestHandle echo: a new test covers the ServiceFault for an oversized argument in a chunked request (already fixed by #4488). - Value-based status: a new test covers the aggregate status with TreatUncertainAsBad = false (already fixed by #4503). ### Not changed - GDS QueryApplications/QueryServers still return records with ServerCapability `NA`. OPC 10000-12 §6.5.10/§6.5.11 says they "shall not", but the CTT GDS scripts expect those records. Implementing the exclusion turned 40 GDS test cases from pass to error, so it waits for the script fix ([Mantis 11458](https://mantis.opcfoundation.org/view.php?id=11458)). - Idle SecureChannels are still closed after `ChannelLifetime`. Keeping them open would be security relevant. The CTT configuration's `ChannelLifetime` of 120000 (#4502) covers the CTT case. ### Mantis issues filed \| Id \| Issue \| \| --- \| --- \| \| C51 \| [11458](https://mantis.opcfoundation.org/view.php?id=11458) GDS scripts expect NA records in query results \| \| C52 \| [11459](https://mantis.opcfoundation.org/view.php?id=11459) A & C Refresh scripts leak subscriptions on the shared alarm session \| \| C53 \| [11460](https://mantis.opcfoundation.org/view.php?id=11460) `StartThreadPublish.js` defaults misspelled properties \| \| U2 \| [11461](https://mantis.opcfoundation.org/view.php?id=11461) Minimum2 oracle on reverse reads \| \| U4 \| [11462](https://mantis.opcfoundation.org/view.php?id=11462) Part 13 clarification: TreatUncertainAsBad and simple bounds (DeltaBounds) \| The A & C `BadSubscriptionIdInvalid` failures (Refresh, Refresh2, Shelving) come from CPU load: with other processes at 100 % CPU, all subscriptions of the CTT alarm session expire within one second. This happens with and without this PR (3 of 3 loaded runs, 0 of 2 idle runs). ### CTT verification CTT 1.05.06, scripts 1.05.513, compared at test-case level against a build of the starting commit: \| Group \| Before \| After \| \| --- \| --- \| --- \| \| Aggregates \| 4,562 error messages \| 4,186. NumberOfTransitions: 12 test cases go from error to pass. AnnotationCount `005-01.js`/`005-02.js` pass. NumberOfTransitions `003-02.js`/`004-02.js` now fail because of C1 ([Mantis 11420](https://mantis.opcfoundation.org/view.php?id=11420)): they request TreatUncertainAsBad = false, but the harness makes the server use its default of true. \| \| Discovery \| 10 warnings \| 0. Find Servers Filter `003.js`/`006.js` and Get Endpoints `002.js` pass. \| \| Subscription \| – \| Publish Min 05 `003.js` goes from warning to pass. \| \| Historical Access, GDS, Node Management \| – \| no new failures \| `plans/ctt-issues.md` is updated: resolved items leave the open sections, and the new Mantis issues are recorded. ## Related Issues - Related to #4479 (CTT configuration notes) - Follows #4502 ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [ ] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. Tests run locally on net10.0 after merging master: \| Project \| Filter \| Passed \| \| --- \| --- \| --- \| \| `Opc.Ua.Server.Tests` \| Aggregate, Historian, NodeManagement, Publish, Subscription \| 1,419 \| \| `Opc.Ua.Core.Tests` \| TcpServerChannelBuffer \| 65 \| \| `Opc.Ua.History.Tests` \| Aggregate, Annotation \| 67 \| \| `Opc.Ua.Sessions.Tests` \| discovery locale tests \| 8 \| Before the merge, the whole `Opc.Ua.Sessions.Tests` ClientTest fixture passed (372 passed, 0 failed). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-09-25 12:30:25 +02:00
Cristi PogaceanandCopilot Autofix powered by AI	d2ec51d035	Normalize transport connection failures at the client channel boundary (#4549 ) ## Summary Translate socket and I/O connection failures into `ServiceResultException(BadNotConnected)` at `UaSCUaBinaryClientChannel.ConnectAsync`, so public discovery creation does not leak raw transport exceptions. - Preserve the original exception as `InnerException` for diagnostics. - Keep the existing operation fault, channel shutdown and operation completion paths. - Leave cancellation, existing `ServiceResultException` instances/statuses, and programming errors unchanged. - Do not change the lower-level byte transport contract or reconnect behavior. Fixes #4535 ## Regression Coverage - Deterministic injected HostNotFound, ConnectionRefused, socket timeout and IOException failures assert BadNotConnected, exact inner cause and closed transport/channel. - Separate controls assert caller cancellation and unchanged service/programming exceptions. - Public `DiscoveryClient.CreateAsync` integration uses a bound, non-listening loopback port. It asserts the translated failure and verifies a previously connected discovery client can still retrieve endpoints afterward. A separate public-API cancellation control remains a cancellation. - No live DNS lookup is required in the committed tests; DNS failure is injected deterministically. ## Validation Base `b4136d8e9`, Windows Release: \| Focused selection \| net10.0 \| net48 \| \| --- \| ---: \| ---: \| \| UaSCBinaryClientChannelDeterministicTests + TcpByteTransportTests \| 51 passed \| 51 passed \| \| SessionlessInvocationTests \| 22 passed \| 22 passed \| All four selections exited 0, with zero failures/skips. Changed-file whitespace verification, diagnostics and `git diff --check` passed. Before the fix, the seven new deterministic cases produced 4 raw-transport failures / 3 passing controls. The two new public-API cases produced 1 raw SocketException failure / 1 cancellation-control pass with only the production fix reversed. The source fix was restored, rebuilt, and the full focused selections above passed. The complete framework/platform matrix is left to PR CI. No repository guidance, feed configuration, security policy or unrelated consumer workaround was changed. --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-09-25 12:29:56 +02:00
Cristi Pogacean	996de3ba1b	Preserve partial runtime type loads and complete imported metadata (#4547 ) ## Summary Keep successfully loaded runtime definitions available when some types cannot be resolved, and complete derivable metadata for imported server structures. - In `ComplexTypeSystem.LoadAsync`, report incomplete loading with `false` while still committing successfully staged definitions when dictionary loading is disabled. `LoadNamespaceAsync` is unchanged. - In the server address-space resolver, clone an incomplete `StructureDefinition` and fill missing BaseDataType / DefaultEncodingId from the type tree and Default Binary reference. Keep the imported definition untouched; explicit metadata is not overwritten. - Add regressions for partial enum registration and imported structure/encoding registration, including source-definition immutability. Fixes #4532 Fixes #4533 ## Validation Windows Release, net10.0, base `b4136d8e9`: - Both new regressions failed against unchanged production code: the valid enum and imported structure were absent from their factories (1 failure in each selected test). - With the fixes, `ComplexTypeSystemCoverageTests`: 19 passed; `ServerComplexTypeSystemTests`: 16 passed. Both processes exited 0 with no failures/skips. - The server fixture was rebuilt and rerun after adding binary-encoding and source-immutability assertions: 16 passed again. - Changed-file whitespace verification and `git diff --check` passed. Validation is change-scoped locally; the complete framework/platform matrix is left to PR CI. Local restore overrides are command-line-only, with no feed or repository-guidance changes.	2026-09-25 12:29:11 +02:00
Cristi Pogacean	93abb6a0ed	Keep unsent publish messages ready until drained (#4548 ) ## Summary Keep a publishing-enabled, session-owned subscription ready when its constructed notification-message queue still contains unsent messages, even after the monitored-item queues have drained. The timer now considers `LastSentMessage < SentCount` alongside ready monitored items. Messages retained only for retransmission do not keep the subscription ready. Existing session, publishing-mode, lifetime and keep-alive checks remain in place. This fixes delayed delivery of queued messages until keep-alive expiry; the regression does not establish permanent message loss. Fixes #4534 ## Validation Windows Release, net10.0, base `b4136d8e9`: - Both fake-clock regressions (data changes and events) failed against unchanged production code: expected `NotificationsAvailable`, observed `Idle` with an unsent message tail. - With the fix: 77 `SubscriptionTests` cases and 6 `SentMessageQueueTests` cases passed, exit 0, no failures/skips. - The regression checks three messages delivered in sequence, MoreNotifications until the tail drains, empty monitored-item queues, and return to Idle when only retransmission messages remain. - Changed-file whitespace verification, diagnostics and `git diff --check` passed. The complete framework/platform matrix is left to PR CI. No repository test guidance or restore configuration was changed.	2026-09-25 12:05:50 +02:00
romanettandClaude Opus 5.5	b4136d8e9b	Fail oldest Publish request when the queue limit is exceeded (#4543 ) # Description Aligns the server's Publish request admission in `SessionPublishQueue` with OPC 10000-4 v1.05 §5.14.5.1, which the server previously deviated from in two ways. 1. The oldest request is failed, not the new one. The spec says: "If the Server receives a new Publish request that exceeds its limit it shall de-queue the oldest Publish request and return a response with the result set to Bad_TooManyPublishRequests." Previously `PublishAsync` rejected the new request. Now `FailOldestRequest()` takes the oldest live request off the front of `m_queuedRequests`, fails it with `BadTooManyPublishRequests` (`TrySetException` + `Dispose`) and queues the new request. - Slot accounting stays exact: if the front request already completed on its own (cancellation or timeout), it has already released its slot through `TryRetire` → `RequestCompleted`. It is only disposed, and the next oldest request is tried. - Requeued requests (`requeue: true`, the `AddFirst` path used by `SubscriptionManager` after a false alarm) are the request currently being processed, not new ones. They skip the limit check and never fail another request. The pending count can briefly go one over the limit, but each later new request fails only one oldest request, so the overshoot never grows. 2. The limit must exceed the Subscription count. The spec says "a Server shall accept more queued Publish requests than created Subscriptions." With the default `MaxPublishRequestCount` of 20, a session with ~24 Subscriptions (seen on the CTT A&C alarm session) could not keep one request per Subscription queued. The effective limit is now `Math.Max(MaxPublishRequestCount, subscriptionCount + 1)` per session. ### Notes for reviewers - Behaviour change: a configured `MaxPublishRequestCount` below a session's Subscription count is now raised silently. Nothing is logged when that happens. - Subscriptions currently held by a transfer claim are not counted toward the effective limit. - Client-facing effect: a client that over-issues Publish requests now sees its oldest outstanding request return `Bad_TooManyPublishRequests`. Before, the newest request returned it. ### Tests - New in `SessionPublishQueueTests`: - `PublishAsync_QueueFull_FailsOldestRequestAndQueuesNewRequest`: queues the maximum number of requests, sends one more, and checks that the first request fails with `BadTooManyPublishRequests` while the new one stays pending. One more request fails only the second. - `PublishAsync_RequeueWhenQueueFull_DoesNotFailQueuedRequests` - `PublishAsync_AcceptsMoreRequestsThanSubscriptions` - Replaced `PublishAsync_QueueFull_ThrowsBadTooManyPublishRequests` and updated two `SessionPublishQueueAdmissionTests`, which asserted the old reject-the-new-request behaviour or relied on a limit of 1 with one Subscription. - Verified locally on net10.0: `Opc.Ua.Server.Tests` filtered to SessionPublishQueue/Subscription tests (114/114) and `Opc.Ua.Subscriptions.Tests` SessionPublishQueue concurrency tests (2/2). The full solution has not been run. ## Related Issues - No tracking issue. Found during CTT triage against OPC 10000-4 §5.14.5.1. ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [ ] I have added all necessary documentation. - [ ] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-25 07:51:33 +02:00
romanettandClaude Opus 5.5	2ef6628902	Restrict private key permissions on the netstandard2.1 build (#4542 ) # Description `DirectoryCertificateStore` only restricted private key directories and files (and only checked existing directories for private access) under `NET8_0_OR_GREATER \|\| NET472_OR_GREATER`. The netstandard2.1 asset of `Opc.Ua.Core` — used by .NET Core 3.1–7, Mono and Unity consumers — therefore wrote private keys with default (typically world-readable) permissions, and `HasPrivateAccess` always returned `false`. The first run of the new GitHub nightly ([run 36017168717](https://github.com/OPCFoundation/UA-.NETStandard/actions/runs/36017168717)) surfaced this in `test-windows-netstandard2.1 (3/12)` and `test-linux-netstandard2.1 (3/12)`: - Linux: `ExistingDirectoryPermissionFailureIsAcceptedOnlyForPrivateAccessAsync` — store directory not restricted to `0700`. - Windows: the same test's unsafe-access cases did not throw `UnauthorizedAccessException`, and `NewPrivateKeyPreservesInheritedAccessToExistingKeysAsync` lost access for trusted identities. The tests were correct; this fixes the product code. ## Changes - Windows: reference `System.IO.FileSystem.AccessControl` 5.0.0 for `netstandard2.1` only, so the existing ACL code compiles for every Core target; the `#if` guards around it are removed. ⚠️ New package dependency for the netstandard2.1 target. - Unix: new internal `UnixFileModeShim` (netstandard2.1 only) sets `0700`/`0600` through a libc `chmod` `DllImport` (same pattern as `Opc.Ua.PubSub.Eth`). No reflection, so it stays NativeAOT compatible. - netstandard2.1 cannot read Unix modes portably (the `stat` layout is platform specific), so `HasPrivateAccess` fails closed there. `chmod` only fails for a caller that neither owns the path nor is root, and that caller could not use a `0700` path anyway. ## Testing - `dotnet test tests/Opc.Ua.Core.Tests -c Release -p:CustomTestTarget=netstandard2.1 -f net8.0 --filter FullyQualifiedName~DirectoryCertificateStoreTests` on Windows: 34/34 passed (the 3 CI failures included). - Same filter with `CustomTestTarget=net10.0`: 34/34 passed. - Linux netstandard2.1 not run locally (no WSL); relies on CI. ## Related Issues - Fixes the netstandard2.1 nightly failures introduced with #4503. ## Checklist - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [ ] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [ ] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-25 07:50:53 +02:00
romanettandClaude Opus 5.5	5d26f6f439	Fix JSON encoding fidelity issues found by fuzz crash replay and align with Part 6 (#4540 ) # Description The external crash corpus replayed by `Opc.Ua.Encoders.Fuzz.Tests` still produced several hundred tolerated encoding fidelity findings per run. They came from the 10 BinaryJson conversion targets (binary decode → JSON encode → JSON decode). None of them was a crash or an unexpected exception. Triage reduced them to three JSON encoder defects plus one oracle rule that was stricter than the specification. While checking the fixes against OPC 10000-6, two adjacent deviations turned up and are fixed as well. ### Encoder fixes (`Opc.Ua.Types`) \| Defect \| Before \| After \| Spec \| \|---\|---\|---\|---\| \| LocalizedText with no Text and an empty/null Locale \| `{"Text":null}` (Verbose) / `{}` (Compact). Reads back as null and re-encodes differently \| JSON `null` (Verbose) / omitted (Compact) \| 5.4.2.15 Table 39, 5.1.2 Table 1, 5.4.6 Table 45 \| \| LocalizedText with empty Text \| `"Text":""` written \| Text not encoded; `LocalizedText("")` is the null LocalizedText \| 5.4.2.15 Table 39 ("not encoded if it is null or empty") \| \| Variant/DataValue holding a null array, Compact \| `Value` omitted → decoded as a scalar default (array rank lost) \| `"Value":[]` \| 5.4.2.17 Table 41, 5.1.11 \| \| Variant/DataValue `Value` omission rule \| Omitted for any default value (including null arrays) when `IgnoreDefaultValues`; `IgnoreNullValues` ignored \| Same rules as every other field: a NULL of a nullable built-in type is omitted when `IgnoreNullValues` or `IgnoreDefaultValues` is set (like `WriteNull`); a default of a non-nullable type only when `IgnoreDefaultValues` is set (like `WriteValueProperty`). An array `Value` is never omitted \| 5.4.2.17 Table 41, 5.1.2 Table 1, 5.4.6 Table 45 \| \| `ExpandedNodeId.Format(context)` with a ServerIndex/NamespaceUri and a null identifier \| Returned `null`, so JSON wrote `null` and the server index was lost \| `svr=N;i=0` / `nsu=...;i=0`, consistent with the `IFormatProvider` overload \| 5.1.12 Table 6, 5.4.2.11, 5.1.2 Table 1 (NULL is exactly `i=0`) \| ### Fuzz oracle and harness (`fuzzing/`) - The round-trip oracle now treats null and empty arrays, and null/empty LocalizedText Text/Locale, as equivalent in every mode (5.1.11: "semantically the same for all DataEncodings… applications shall treat null and empty arrays as equal"). Previously this only held when `IgnoreNullValues` was set. - `FuzzCrashAssets` no longer prints a stack trace or an inline base64 reproducer for tolerated fidelity findings. Only the one-line summary entry is reported, and it now names the actual cause instead of `TargetInvocationException`. Before, tolerated findings used up the 60-per-target reproducer budget, so a genuine failure later in the enumeration printed no reproducer. The externally supplied corpus inputs were also written into the pipeline log on passing runs. - Three hand-crafted curated reproducers (9–23 bytes, one per encoder defect) were added under `Assets/Repo/`, which is always enforced strictly. Each one fails on the previous master and passes with this change. ### Reviewer notes: observable JSON output changes - `LocalizedText("")` / `("en","")` now round-trip with `Text == null` instead of `""` (equivalent per 5.1.11). - Verbose and Compact scalar Variant output is unchanged. `IgnoreNullValues` alone now also omits a NULL `Value`, as it does for every other null field. - A null array in a Variant is written as `"Value":[]` in every mode instead of being dropped in Compact, and a null matrix is written as `"Value":[]` instead of failing with `BadEncodingError`. - Variants holding a Variant or DiagnosticInfo still reach the writer and are rejected as before (`WriteBadVariantThrows`). ### Testing (net10.0, locally) - Opc.Ua.Types.Tests 10,542 passed, including new JsonEncoder tests for each rule above - Opc.Ua.Core.Encoders.Tests 2,929 passed (one expectation updated from `"Text":""`) - Opc.Ua.PubSub.Tests 1,369 passed; Opc.Ua.Core.Tests JSON subset 83 passed; Opc.Ua.Aot.Tests 178 passed - Opc.Ua.Encoders.Fuzz.Tests 8,112 passed; crash-asset tests in the Certificates/Network/PubSub fuzz projects and Opc.Ua.Fuzzing.Tests passed - net48: `Opc.Ua.Encoders.Fuzz.Tests` builds with 0 warnings; net48 tests were not run locally ## Related Issues - No tracking issue; found by triaging the fuzz crash-asset replay output of the master pipeline. ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [ ] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-25 07:49:52 +02:00
romanettandClaude Opus 5.5	e0c56a7c00	Replay the fuzz crash corpus from the fuzz-corpus orphan branch (#4539 ) # Description Since the move to GitHub Actions, CI replays only the checked-in fuzz corpus. The full crash corpus used to be the Azure DevOps secure file `FuzzingArtifacts.zip`, which `.azurepipelines/test.yml` overlaid onto `Opc.Ua.Encoders.Fuzz.Tests`. The nightly `private-corpus` job that was meant to replace it depended on an Azure storage account, federated credentials and a protected environment. None of these were ever provisioned, so the job never ran. The corpus now lives on the orphan branch [`fuzz-corpus`](https://github.com/OPCFoundation/UA-.NETStandard/tree/fuzz-corpus) (commit `843ba944a7b144a7ae6429151846d9e5ab28d29f`, already pushed): - It contains 22,267 `crash-`, 25 `slow-unit-` and 1 `timeout-` input under `Opc.Ua.Encoders.Fuzz.Tests/Assets/`. - The files are byte-identical to the secure file (SHA-256 `85198e46…fe1d61b`), recovered from the `drop` artifact of Azure build 18397. - The branch shares no history with `master`, so clones of `master` don't get 22k extra files in their checkout. Why the corpus is no longer treated as private:* - The inputs date from April–June 2024. - The `drop` artifacts could be downloaded anonymously. - Every master build printed up to about 7k base64 reproducers into anonymously readable Azure logs. - Current `master` replays every input without a test failure. New, unfixed crashes still go through [SECURITY.md](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/SECURITY.md) and are added to the branch only after the fix ships. ## Changes - `nightly.yml`: `private-corpus` is replaced by `crash-corpus`. The new job: - checks out the commit pinned in `FUZZ_CORPUS_COMMIT` (no secrets, environment or OIDC); - verifies the SHA and copies each top-level folder over `fuzzing/<folder>`; - runs `Opc.Ua.Encoders.Fuzz.Tests` on the 12 non-macOS profiles through the shared `run-dotnet-tests` action and uploads `crash-corpus-results-`. The `run_private_corpus` input and the INCOMPLETE label are removed. The job runs on every scheduled and manual run, and the nightly summary fails if it was skipped. - `fuzzing/CrashCorpus.md` (new):* the Azure history, branch layout, how CI replays the corpus, local replay, and how to add inputs and move the pin. `Fuzzing.md` links to it. - `docs/DeveloperGuide.md`: the private-corpus section and its secrets table are replaced, and the migration to-do list is updated. - `nightly.yml` AOT job (fix for a failure found by the first nightly run): the Linux and macOS legs looked up the published binary by `BaseName`/`Extension`. A NativeAOT executable has no extension on those platforms, so PowerShell splits `Opc.Ua.Aot.Tests` into `Opc.Ua.Aot` + `.Tests`, and every leg reported No NativeAOT executable was produced even though publish succeeded ([run 36017168717](https://github.com/OPCFoundation/UA-.NETStandard/actions/runs/36017168717), `aot-ubuntu-latest`). The lookup now matches the exact file name. A failure now reports the publish errors, a missing publish directory, or which files were produced instead. - `Opc.Ua.Redundancy.Samples.Tests` / `Opc.Ua.WotCon.Samples.Tests` (fix for failures found by the first nightly run): the test runner's framework guard rejected both projects on the nightly net8.0, net9.0, net472 and netstandard2.1 profiles. Redundancy built a net48 placeholder for every target except net10.0, and WotCon was pinned to net10.0. Both now build the requested target on net8.0/9.0/10.0 and use `RestrictForLegacyTfm` to become explicit not-applicable shells on net48, net472, netstandard2.0 and netstandard2.1. The redundancy tests no longer hard-code `bin/<cfg>/net10.0` when locating the sample binaries, and `SampleAppProcess` falls back to an `object` lock below net9.0. The net48 placeholder remains for Azure's plain `dotnet test -f net48` leg. Checked locally by building Redundancy for `CustomTestTarget=net9.0` and WotCon for `netstandard2.1`. - `DefaultServerRedundancyHandler` (fix for a failure found by the first nightly run): `ResolveServerAsync` gave the resolver a token linked to the caller's, but waited on the caller's token directly. On cancellation the wait could finish, and its `using` could dispose the linked source, before the linked source's own callback had run. That unhooks it, so the in-flight peer lookup never saw the cancellation (`PeerDiscoveryPropagatesCallerCancellationAsync`, netstandard2.0 build on net48). The wait now uses the linked token. A timeout is still logged as a discovery failure, as before. A companion test fix makes `PeerTimeoutPreservesOtherEndpointsAndCoalescesPendingDiscoveryAsync(False)` deterministic. The timed-out lookup drains on the thread pool, so the test's retry could join it and then have its own time limit expire before it started a fresh lookup. The test now waits for the second resolver call before advancing the fake clock. - `Session` keep-alive logging (found while investigating the net48 nightly failures): `OnKeepAliveError` and the keep-alive read failure log used `Endpoint?.EndpointUrl`. `ClientBase.Endpoint` dereferences the transport channel, so once the channel was detached it threw a `NullReferenceException` on every keep-alive tick, and `BadNoCommunication` never reached the `KeepAlive` subscribers. Both now log the configured endpoint's URL. Three new `SessionKeepAliveTests` cover a detached channel. - `ClientTestFramework` shared session (fix for 67 `Opc.Ua.Sessions.Tests` failures on the net48 nightly): the fixture-wide shared session used the 10 s default session timeout. A test-host stall of about 11–18 s while other fixtures restarted their servers let the server expire it, and every later test in the `ClientTest("https")` and `ClientTest("opc.https")` fixtures failed with `BadSessionIdInvalid`. The shared session now requests `SharedSessionTimeout` = 120 s; per-test sessions keep 10 s. - `run-dotnet-tests.ps1`: `-QuietOutput` help text only; it no longer names the removed job. The Azure secure file stays in place, because `master378` and the 1.x release pipelines keep their own `test.yml` and still use it. ## Verification - `nightly.yml` parses as valid YAML, and no job, output or summary field still refers to the removed job. - I ran the job's overlay script against a clone of `fuzz-corpus` at the pinned commit. It overlaid all 22,293 files, left the tracked `Assets/Repo` untouched, removed the checkout folder and wrote the summary line. - Not yet run: the workflow itself. It is `schedule`/`workflow_dispatch` only, so it needs a manual `nightly.yml` run on this branch. On master the corpus has so far only been replayed on Windows (net48/net10.0 in Azure), so the Linux legs are new ground. ## Follow-ups (admin) - Add a ruleset for `fuzz-corpus`: require pull requests and block force pushes and deletion, so the pinned commit stays reachable. - The `fuzz-private-corpus` environment, if it was ever created, can be deleted. ## Related Issues - No issue exists yet; this is part of the Azure DevOps → GitHub Actions migration (#4513, #4524). ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [ ] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [ ] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-25 07:49:00 +02:00
romanettandClaude Opus 5.5	96c5ef1623	Run the fluent configure pipeline in FluentNodeManagerBase (#4537 ) (#4538 ) ## Proposed changes Closes #4537. The configure pipeline now lives in `FluentNodeManagerBase`, so a hand-written fluent node manager only overrides `ConfigureAsync` and no longer writes `CreateAddressSpaceAsync` itself. `FluentNodeManagerBase.CreateAddressSpaceAsync` now: 1. loads the predefined nodes (as `AsyncCustomNodeManager` did before), 2. creates a builder for `NamespaceIndex` with `CreateFluentBuilder`, 3. awaits `ConfigureAsync(builder, ct)`, 4. runs `RegisterAuthoredNodesAsync` and then `CompleteConfigureAsync`, 5. finishes with `SealConfigurationAsync`, which seals the builder, replays `NotifyNodeAdded`, then activates behaviors and simulations. ### Breaking change (2.0) Some managers need a different order, for example a post-setup runner before sealing, a builder for another namespace, or work after sealing. They must stop calling `base.CreateAddressSpaceAsync`, because that would now run a second, empty pipeline and seal the manager-owned registries too early. These managers now call `LoadPredefinedNodesAsync(SystemContext, externalReferences, ct)` and keep driving their own pipeline: - the source-generated `NodeManager` template (the ordering test in `NodeManagerGeneratorTests` is updated) - `DiNodeManager`, `Isa95NodeManager`, `PositioningNodeManager`, `RobotIntentNodeManager`, `VisionNodeManager` - `samples/OpenUsd/SiteCompositionServer/SiteNodeManager` These now use the base pipeline: - `samples/FluentApi/BasicFluentApiServer/BasicFluentNodeManager` becomes a single `ConfigureAsync` override. Before this change it never sealed its builder. - the hosting `FluentNodeManager` (from `AddNodeManager(namespaceUri, build)`) becomes a `ConfigureAsync` override. It now seals through `SealConfigurationAsync`, so `OnNodeAdded` handlers wired in the build delegate fire. Before, it called `builder.SealAsync()` directly and they did not. Docs (`NodeManagers.md`, `DeviceIntegration.md`) are updated. `NodeManagers.md` gets a short hand-written `ConfigureAsync` example. ## Types of changes - [x] Breaking change (fix or feature that would cause existing functionality to change) - [x] Enhancement (non-breaking change which adds functionality) ## Checklist - [x] I have read the CONTRIBUTING doc. - [x] I have signed the CLA. - [x] I ran tests locally with my changes, all passed. - [x] I fixed all failing tests in the CI pipelines. - [x] I fixed all introduced issues with CodeQL and LGTM. - [x] I have added tests that prove my fix is effective or that my feature works. - [x] I have added necessary documentation (if appropriate). ## Tests New `FluentNodeManagerBasePipelineTests`: nodes authored in `ConfigureAsync` get registered, the Objects-folder reference is mirrored into `externalReferences`, `OnNodeAdded` fires once, and the builder is sealed afterwards. Local run on net10.0, all passing: - Opc.Ua.Server.Tests (Fluent/Hosting/StateMachine/RuntimeNodeSet filter): 1286 - Opc.Ua.SourceGeneration.Core.Tests (NodeManager filter): 40 - Opc.Ua.Di.Tests 426, ISA95 136, Positioning 69, Robotics 636, Robotics.Intent 22, Vision 484 (+1 skipped), Vision.Intent 14, OpenUsd 921 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-25 07:48:29 +02:00
romanettandClaude Opus 5	13f96fd4ba	Raise ChannelLifetime for the CTT reference server and record the full CTT run of the merged CTT PRs (#4502 ) # Description Findings of a full CTT run (23 parts, 3,752 test cases, CTT 1.05.06 / scripts 1.05.513) against the merge of #4477, #4482, #4485 and #4486, which are all on master now, plus the CTT defects filed in Mantis. No server code changes: the PR changes only the CTT configuration of the reference server sample and the `plans/` documentation. ## CTT configuration: raise `ChannelLifetime` to 120 s CTT Security None `007.js` and Security Basic256Sha256 `005.js` failed (also on master): they keep SecureChannels without a Session idle for about 51 s (60 s token, stretched by the CTT's CloseSession delay, C50) and expect the newest one to close with Good. `TcpTransportListener.DetectInactiveChannels` had already closed it after `ChannelLifetime` (30 s) without traffic (`CloseSecureChannel().Result received BadInvalidState`). `samples/Reference/ConsoleReferenceServer/Ctt.ReferenceServer.Config.xml` now sets `ChannelLifetime` to 120000. The default of 30000 and the server's inactivity cleanup are unchanged. An earlier revision of this PR changed the inactivity cleanup instead, keeping idle Session-less channels open until their token expired (Part 4 §5.6.2.1). That change was withdrawn because it lets an unauthenticated client hold a channel for up to the `SecurityTokenLifetime` (one hour by default) instead of 30 s. The difference to Part 4 §5.6.2.1 is recorded as an open server finding in `plans/ctt-issues.md`. Validated on 2026-09-24 with the reverted code and the new configuration (full run, compared with the run of 2026-09-22 at test-case level): - Security None `007.js` passes and Security Basic256Sha256 `005.js` has only the C50 CloseSession delay warnings (both failed with 30 s). - All other parts have the same error signatures as before; the remaining differences are "Response Timestamp shows a delay" warnings from a loaded machine (a back-to-back Session Services run with 30 s and 120 s on an idle machine is identical). - A & C Refresh2 `Err_003.js`/`Err_004.js` and Shelving `initialize.js` report `BadSubscriptionIdInvalid` in today's runs with both 30 s and 120 s on the same build, so they are unrelated to the configuration (both passed again in a run on the idle machine with 120 s). ## Mantis 32 CTT defects filed on 2026-09-24 (11420–11454, script issues in CTT UA Scripts, native aggregate oracle issues in CTT UA Binary); 12 drafts were already covered by existing reports (including GDS issues 11406–11413 by node-opcua and 11102 for the `opc.https`/`opc.wss` endpoint selection); 5 are held back for further investigation. `plans/ctt-issues.md` links every entry. ## CTT documentation (`plans/ctt-issues.md`, `plans/ctt-testing.md`) - `ctt-issues.md` lists every failing CTT test case with a short abstract and its Mantis issue; the details live in Mantis. It keeps the defects not filed yet, the open questions (U1–U4), the open server findings and the CTT project configuration notes, and no longer lists findings the server has fixed. - Notable CTT findings of this run: the aggregate oracle lacks the Part 13 Uncertain status and Calculated bit rules that #4477 implements (C48/C49, 24 test cases); the CloseSession "delay in excess of 600ms" warnings are a CTT client artifact (C50: the server answers in 2–5 ms, the CTT stops the Session's SessionThread between stamping and sending); the CTT's `FindTokenType` rewrites its cached endpoints, so Security User Name Password 2 `015.js` reports duplicate PolicyIds (C36); A & C Comment passes or skips depending on the date (C39). - Open server finding: AddNodes after a child rename returns `BadNodeIdExists` (#4477 × #4486 interaction, not covered by the CTT). - `ctt-testing.md` is a runbook for agents: setup, headless runs, selection generation, reading and comparing results, triage, recipes per conformance group (A & C, Session/Subscription, Monitored Items, security groups with an isolated PKI) and a full partitioned run of every group (about 80 minutes). It points to `ctt-issues.md` for the failures to expect. ## Related Issues - Follow-up to #4477, #4482, #4485, #4486 ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [ ] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [ ] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. Validated locally with a full partitioned CTT run of the Release net10.0 reference server (reverted code, `ChannelLifetime` 120000). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-09-24 21:52:44 +02:00
Marc Schier	57c0a32ed4	Fix incomplete-message buffering and channel cleanup (#4522 ) # Description Fix incomplete-message buffering, channel cleanup, session resource accounting, and enforcement of existing transport admission settings. - Share a targeted `ChunkReassemblyBudget` across server listeners. The reference default is 64 MiB, with a 32 MiB global occupancy threshold for sessionless intermediate chunks. This is priority headroom for activated sessions, not a guaranteed bootstrap partition. Single/final chunks and unrelated response/client buffers remain outside this budget. - Retain precise incoming/final payload quotas, valid Abort handling without channel teardown, terminal late-final rejection, and exactly-once buffer/reservation cleanup. - Use one assembly timer per quota/clock scope, asynchronous cleanup, a fixed deadline, a 30-second fallback for non-positive lifetimes, and best-effort ERR `BadTimeout` before closure. - Apply negotiated TCP/WebSocket/Pipe receive limits and size pipe rentals to actual chunks. - Add the optional `ISessionBindingProvider` and immutable `SessionBindingContext` seam. Managed membership counts distinct committed sessions, not responses, and handles reactivation, transfer, closure, expiry, restoration and shutdown. Read-only snapshots require token/channel/security validation and never replace service authorization. - Wire default and explicitly injected binding providers through raw TCP, Kestrel and UACP WebSockets; preserve existing callback/manager interfaces and direct construction. - Enforce existing `ConnectionRateLimiter` and channel capacity settings on Kestrel TCP and UACP WebSocket admission, with physical-transport leases surviving reverse handoff and releasing on cancellation, close, failed attachment and stop. HTTP/JSON requests are not treated as UASC channels. - Add regression coverage and documentation. Stabilize the CI cancellation test by waiting for the resolver to enter before canceling. This is the foundation only. New Balanced/FairShare/TrustedReservations policies, tenant isolation and guaranteed bootstrap reserves belong in the separate stacked follow-up, not this PR. ## Related Issues Fixes #4521. ## Validation \| Scope \| Result \| \| --- \| --- \| \| Core transport, budget, binding-context and DI tests, net10.0 \| 717 passed \| \| Core transport, budget, binding-context and DI tests, net48 \| 664 passed, 6 platform-specific skips \| \| Session bindings, transfer/security/expiry/restore and hosted DI, net10.0 \| 69 passed \| \| Same focused Server suite, net48 \| 69 passed \| \| ServerRedundancyHandlerTests, Release/net48 \| 39 passed \| \| ConsoleReferenceServer net10.0 \| Build succeeded, zero warnings/errors \| \| Server and HTTPS binding netstandard2.1 \| Both builds succeeded, zero warnings/errors \| The new admission fixtures also passed five repeated runs after correcting asynchronous connection-context disposal. Full-solution validation, coverage comparison and CI for this update remain pending. ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [ ] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received.	2026-09-24 20:12:55 +02:00
Marc Schier	23be306c65	Update NuGet dependencies (#4536 ) ## Summary - update NuGet dependencies to their latest compatible stable releases while retaining documented compatibility, native, security, and mocking pins - align the nbgv CLI with the central `Nerdbank.GitVersioning` version (3.10.94) and fail explicitly on tool installation/update errors - update the synchronized OpenUSD family to `0.14.0-alpha`; adapt the Vision blank-frame fixture to the new `RenderDiagnosticsState` constructor argument - retain `Microsoft.CodeAnalysis` API packages at the existing 5.0/4.14 host bands: Roslyn 5.9 requires Immutable/Metadata 10.0.1+, while the retained older compiler-host closure is intentionally pinned to 9.0.0 ## Dependency updates - `Dekaf` 1.17.0 → 1.21.1 - legacy ASP.NET Core 2.3 dependencies → 2.3.13; net8/net9 authentication and WebApi test packages → 8.0.31/9.0.20 - `Microsoft.CodeAnalysis.Analyzers` 4.14.0 → 5.9.0 - `TUnit` 1.68.0 → 1.69.0 - `Avalonia` / `Avalonia.Desktop` 12.1.2 → 12.1.3 - schema-test `System.Collections.Immutable` overrides 10.0.11 → 10.0.12 - `AzureSignTool` 3.0.0 → 7.0.1 and `NuGetKeyVaultSignTool` 3.0.45 → 3.2.3 - eight direct OpenUSD packages 0.12.0-alpha → 0.14.0-alpha ## Validation - `dotnet restore UA.slnx --disable-parallel` - clean `UA.slnx` Release build with `CustomTestTarget=net10.0` - `UA.slnx` Release builds with `net48` and `netstandard2.1` - OpenUSD and Vision test suites on net8/net9/net10: 882/882/921 and 484 passed + 1 environment skip on each target - full `Opc.Ua.Tools.Tests` net10.0: 963 passed, 1 skipped - source-generator package validation against a locally packed release package set - updated signing tools installed in an isolated directory; existing `sign` CLI options verified without credentials - nbgv 3.10.94 bootstrap exercised in simulated GitHub CI; disposable committed fixture verified canonical and case-invalid release refs with a four-component version ## Limits No protected signing/publication, Linux/macOS native rendering, or full stress/nightly suites were run locally.	2026-09-24 14:19:09 +00:00
FlatschaandMarc Schier	490d15cb20	Add support for adding input/output arguments to methods using fluent api (#4519 ) # Description Added extensions for adding arguments to method in fluent api style Added BasicFluentApiServer project to samples ## Related Issues Add support for adding input/output arguments to methods using fluent api #4518 ## Checklist - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [x] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. --------- Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>	2026-09-24 14:27:53 +02:00
Marc Schier	2646337446	Move full-scope nightly schedule to GitHub Actions (#4524 ) ## Summary - move the weekly full-scope nightly schedule from Azure Pipelines to `.github/workflows/nightly.yml` - remove the redundant scheduled run from `.github/workflows/buildandtest.yml` - leave Azure Pipelines available for push/manual recovery runs while retiring its YAML weekly full-scope cron - update `docs/DeveloperGuide.md` to describe the new CI ownership and remaining Azure follow-ups ## Validation - Parsed `azure-pipelines.yml` and all GitHub workflow YAML files successfully with `yaml.safe_load`. ## Notes - The Azure service-side schedule for definition 14 still needs to stay disabled in Azure DevOps so the YAML and service schedules do not duplicate the nightly workload.	2026-09-24 08:08:25 +00:00
romanett Claude Opus 5 Marc Schier Copilot Autofix powered by AI copilot-swe-agent[bot]marcschier	a2539cb53d	Fix CI env-file tearing and capture Linux native crash dumps (#4517 ) Two unrelated CI faults in the GitHub Actions build/test matrix. ## Build steps fail after a successful compile — fixes #4458 `version.json` sets `cloudBuild.setVersionVariables`, so Nerdbank.GitVersioning's `SetCloudBuildVersionVars` target runs once per project, and on GitHub Actions the provider implements "set a variable" as an append to the file named by `$GITHUB_ENV`. The `Build` step is deliberately parallel across MSBuild nodes, so several nodes append to that one file concurrently, a line tears, and the runner rejects the fragment after the compile has already succeeded. Reproduced locally — one `GetBuildVersion` with `GITHUB_ACTIONS=true` appends three lines per project: ``` GitAssemblyInformationalVersion=2.0.337-preview+138086863b GitBuildVersion=2.0.337.4992 GitBuildVersionSimple=2.0.337 ``` A stray `7` is exactly what a torn `GitBuildVersion=2.0.3x7.yyyyy` leaves behind. After this change the same command writes 0 bytes, and `Version`, `AssemblyVersion`, `FileVersion` and `PackageVersion` are unchanged (`2.0.337-preview.g138086863b`) — verified on both a sample project and `Opc.Ua.Sessions.Tests`. Nothing reads those three variables. Every workflow and pipeline that consumes version information runs `.azurepipelines/set-version.ps1` first, and `nbgv cloud -c -a` there writes the same `Git` variables plus the `NBGV_` set that `version.props` and `common.props` actually use — once, from a single process. This leaves that script as the only writer. Two notes against the fixes suggested in the issue: - `NerdbankGitVersioningSetCloudBuildVariables` does not exist in NBGV 3.10.94. The real gate is `'$(NBGV_SetCloudBuildVersionVars)' != 'false'`, so the suggested `/p:` would have been silently ignored. - Setting `cloudBuild.setVersionVariables: false` would regress every version number. The version height is the commit count since `version.json` last changed — `git rev-list --count 8d2402c99..HEAD` is exactly 337 — so editing that file at all resets the height. Measured: `nbgv cloud -c -a` with the flag flipped emits `NBGV_Version=2.0.0.4992` instead of `2.0.337.4992`. Hence an MSBuild property in `version.props` rather than a `version.json` edit. ## No dump when the test host dies natively — addresses #4447 (step 1) On [run 34158052372](https://github.com/OPCFoundation/UA-.NETStandard/actions/runs/34158052372/job/101853936251) the Sessions test host was lost to a glibc `double free or corruption (out)` and produced no dump at all, leaving native memory corruption in the security stack with no call stack. Neither dump path the job already configures covers that class of failure: - `--blame-crash-dump-type mini` goes through the runtime's `createdump`, which the runtime invokes only for crashes it handles itself; a raw `SIGABRT` out of glibc's malloc consistency check is not one of them. - `--blame-hang-dump-type mini` asks the test host to dump itself over the diagnostics socket, so it needs a runtime healthy enough to service the request. On that run it answered `Collect dump was enabled but no dump file was generated`. A kernel core depends on neither, so this adds three steps to the Linux legs: 1. Enable native core dumps — point `core_pattern` at `/tmp/coredumps` (outside the workspace, so `Upload test results` cannot sweep a multi-gigabyte file in by accident) and relax `kernel.yama.ptrace_scope` so a follow-up can also attach `gdb -p` or `dotnet-dump collect` to a wedged host. 2. Raise `RLIMIT_CORE` on the shell that launches the test host. The limit is inherited rather than global, so it cannot be raised from the step above. 3. Stage Linux core dumps — on failure, extract a `gdb` backtrace as text and always keep it; keep the compressed core only while it stays under 2 GiB. All three warn rather than fail: losing the ability to collect a core is not a reason to stop the tests from running. Healthy runs write nothing. This makes the next occurrence diagnosable; the double free itself is not fixed here. That is step 2 of the issue and it is explicitly gated on having a dump — guessing at a certificate-lifetime change in the security stack would invert straight into a leak. See the comment on #4447 for a correction to that issue's ECC hypothesis, which the raw job log does not support. ## Verification - YAML parses; both bash blocks pass `bash -n`; the pwsh block parses. - Staging script exercised through every branch: no cores, two cores, oversize drop, and `sudo`/`gdb` unavailable — each exits 0. - `version.props` change verified to emit nothing to `$GITHUB_ENV` while leaving the computed version identical. - CRLF line endings preserved in both files. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Marc Schier <marcschier@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>	2026-09-23 20:12:01 +00:00
Marek LinkaandMarc Schier	4018bfec91	Allow GC to collect the dynamic assembly of complex types (#4520 ) # Description As already discussed in #3173, there is a significant memory leak in the way complex types are handled in the original, reflection-based `ComplexTypeSystem`. Even though there is now a newer version of this code that does not use reflection, the reflection code is still available for consumers, meaning the leak can still impact people out there. With a minimal repro (attached), I managed to isolate the issue a bit further than the original report. The leak was not just kernel handles for events or semaphores but the whole dynamic assembly - with the `AssemblyBuilderAccess.Run` flag set, the GC could never free that assembly. Changing the flag to `RunAndCollect` resolves that problem, allowing the dynamic assembly to be collected once all references to it are lost. My repro code proves that the assembly gets collected and memory no longer accumulates with each `complexTypeSystem.LoadAsync`. ### Repro Simple single-file C# project, should be pointed to a checkout of this repo via a project reference to allow compilation. It runs a loop of opening and closing a session, each session then uses `ComplexTypeBuilderFactory` to build the dynamic assembly of complex types. Each session is then disconnected and disposed. Every 100 iterations, the repro forces full GC and reports several statistics: current GC-managed memory, current proces private memory, number of the generated dynamic assemblies (counted via name), and total number of open handles. [repro.zip](https://github.com/user-attachments/files/32555109/repro.zip) ### Repro output `AssemblyBuilderAccess.Run`: ``` [Start] Memory consumption: [GC] 3641352, [Private] 36499456, [DynamicAssemblies] 0, [Handles] 381 [Step 0] Memory consumption: [GC] 10459408, [Private] 50515968, [DynamicAssemblies] 1, [Handles] 401 [Step 100] Memory consumption: [GC] 10568320, [Private] 75034624, [DynamicAssemblies] 101, [Handles] 614 [Step 200] Memory consumption: [GC] 10539488, [Private] 93138944, [DynamicAssemblies] 201, [Handles] 814 [Step 300] Memory consumption: [GC] 10933536, [Private] 113786880, [DynamicAssemblies] 301, [Handles] 1015 [Step 400] Memory consumption: [GC] 11031496, [Private] 140181504, [DynamicAssemblies] 401, [Handles] 1215 [Step 500] Memory consumption: [GC] 11064296, [Private] 161914880, [DynamicAssemblies] 501, [Handles] 1415 [Step 600] Memory consumption: [GC] 11094168, [Private] 180477952, [DynamicAssemblies] 601, [Handles] 1608 [Step 700] Memory consumption: [GC] 11127368, [Private] 207298560, [DynamicAssemblies] 701, [Handles] 1811 [Step 800] Memory consumption: [GC] 11160168, [Private] 228204544, [DynamicAssemblies] 801, [Handles] 2008 ... ``` As you can see, each iteration leads to a new dynamic assembly being created and they are all being retained, even though the sessions they belong to have been disposed. This also means increase in kernel handles and the process' private memory (about 200 kB per session, not a trivial amount). `AssemblyBuilderAccess.RunAndCollect`: ``` [Start] Memory consumption: [GC] 3641400, [Private] 36446208, [DynamicAssemblies] 0, [Handles] 379 [Step 0] Memory consumption: [GC] 10630800, [Private] 50372608, [DynamicAssemblies] 1, [Handles] 401 [Step 100] Memory consumption: [GC] 10982808, [Private] 53596160, [DynamicAssemblies] 1, [Handles] 410 [Step 200] Memory consumption: [GC] 11048288, [Private] 46280704, [DynamicAssemblies] 1, [Handles] 413 [Step 300] Memory consumption: [GC] 10956664, [Private] 45817856, [DynamicAssemblies] 1, [Handles] 417 [Step 400] Memory consumption: [GC] 10915352, [Private] 47124480, [DynamicAssemblies] 1, [Handles] 410 [Step 500] Memory consumption: [GC] 10914776, [Private] 44843008, [DynamicAssemblies] 1, [Handles] 410 [Step 600] Memory consumption: [GC] 10890776, [Private] 44810240, [DynamicAssemblies] 1, [Handles] 408 [Step 700] Memory consumption: [GC] 10916144, [Private] 46235648, [DynamicAssemblies] 1, [Handles] 408 [Step 800] Memory consumption: [GC] 10901248, [Private] 45531136, [DynamicAssemblies] 1, [Handles] 411 ... ``` This time, we only ever retain a single dynamic assembly, the one being used for the currently open session, which is expected. The memory footprint stays flat, as does the number of open handles. ## Related Issues Fixes #3173 ## Checklist _Put an `x` in the boxes that apply. You can complete these step by step after opening the PR._ - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [ ] I have added all necessary documentation. - [ ] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. --------- Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>	2026-09-23 19:44:53 +00:00
Marc SchierandCopilot Autofix powered by AI	e9313ef957	Only use GitHub action for CI and nightly, establish release-branch-only package publication (#4513 ) ## Description Two related changes to how the 2.0 line is built and shipped. ### 1. Release-branch-only package publication - `master` produces development previews only. - Stable packages can only be built from a canonical `release/<major>.<minor>` branch and are promoted manually from the exact signed candidate artifact. - Core packages use explicit `major.minor.patch` versions (`2.0.0`, `2.0.1`, then `2.1.0`); git height never changes a stable package patch. - XRegistry, WoT Connectivity, Vision, Robotics, Redundancy, Positioning, OpenUSD, ISA95, AI, DI, the relevant MCP extensions, and OpenUSD connector tools remain `-preview.N` while following the core numeric version. - nuget.org receives only non-`.Debug` package IDs; GitHub Packages retains the complete signed Release/Debug candidate. - `docs/ReleaseProcess.md` is a reproducible runbook for developers and agents, with each step stating its completion evidence. Promotion is source-bound and byte-checked: `release.yml` checks out nothing until the candidate SHA is known, and `assert-published-packages-match.ps1` proves that any version already on a feed holds this candidate's content before `--skip-duplicate` is allowed to skip it. Canonical release-branch naming is matched case-sensitively with no leading zeroes, and `version.json`'s `publicReleaseRefSpec`, both policy helpers and the copy `release.yml` inlines are pinned to one expression by tests. ### 2. PR CI moved to GitHub-hosted runners - `.github/workflows/buildandtest.yml` (CI) now owns pull-request validation outright, covering the Windows Debug/Release net48 + net10.0 solution builds and fast tests that only Azure Pipelines ran, alongside the existing Linux/macOS, all-target and NativeAOT legs. `build-and-test summary` remains the stable required check name. - `.github/workflows/nightly.yml` is a new manual-only (`workflow_dispatch`) full-scope workflow covering the Azure nightly workload: all solutions x seven target profiles x Debug/Release, the net472/netstandard profiles, Windows + Linux NativeAOT, and the long-running and durable tiers. - Shared deterministic discovery/batching lives in `.github/scripts/get-ci-matrix.ps1` with a local composite action, so both entry points expand the same workload manifest instead of duplicating a large embedded script. - `azure-pipelines.yml` is set to `pr: none`. - The standalone pump sample image workflow is folded into the consolidated Images CI workflow, which now builds all ten images and publishes an `images summary` rollup suitable as a required check. ## Related Issues No related issue provided. ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [x] I have addressed all PR feedback received. ## Validation - `Opc.Ua.Tools.Tests` full `net10.0` suite: 959 passed, 1 skipped, 0 failed. - Version/package-policy regression subset (`PackageVersionPolicyTests`): 60 passed, 0 failed. - GitHub Actions CI run 35719807620: 149/149 jobs green on GitHub-hosted runners. - Canonical release-branch rule verified against the pinned nbgv 3.7.115 by building throwaway branches: `release/2.0`, `release/0.9`, `release/10.42` -> `PublicRelease=True`; `release/02.0`, `release/2.00`, `Release/2.0` -> `False`. - Package identity gate verified against a live nuget.org package: served packages carry a repository `.signature.p7s`, so equality is decided on content excluding that part. Re-signing and zip reordering produce an identical digest; a one-byte content change does not. - Synthetic Release-only, Debug-only, combined, preview, duplicate, orphaned-symbol, mismatched-root and accidental-stable-family package sets exercise the shared validator. - Stable-release rehearsal in an isolated `release/2.0` clone: `Opc.Ua.Di` packed as `2.0.0-preview.6` depending on stable Core `2.0.0`; `Opc.Ua.Di.Client` likewise against stable Client `2.0.0`. - All workflow YAML, `version.json`, the package-policy PowerShell scripts and the internal release-runbook anchors parse. ## Known validation limits - Full `UA.slnx` `net48` and `net10.0` local validation remains blocked by pre-existing `NETSDK1005` and dependency-version failures in unmodified fuzz/sample projects; the corresponding checklist items intentionally stay open. - The TRX-driven test verdict added for the intermittent at-exit host stall is proven by `CiTestVerdictTests`; the stall itself has not recurred since. - `nightly.yml` has not yet been run against a full-scope Azure run for tuple-level parity — see below. ## Operational follow-up This remains a preparation PR targeting `master`. It does not authorize a release. Release sequence: 1. Merge this PR. 2. Create canonical `release/2.0`, advance `master` to `2.1.0-preview.{height}`, and open a separate `2.0.0` version PR against `release/2.0`. 3. Follow [`docs/ReleaseProcess.md`](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/docs/ReleaseProcess.md) for candidate dry-run, environment approval, promotion, tag/release finalization, and next-patch preview setup. CI migration steps still needing administrator access are tracked in [`docs/DeveloperGuide.md#migration-status`](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/docs/DeveloperGuide.md#migration-status): proving `nightly.yml` parity on a trusted SHA with the private fuzz corpus provisioned, turning off definition 14's service-side PR override, retiring the Azure full-scope schedules and push trigger, and retiring the duplicate `azure-pipelines-preview.yml` publisher. > Before cutting `release/2.0`: the `Release` ruleset requires the Azure context for every `refs/heads/release/*`, but a new 2.x branch inherits `pr: none`, so that context would never report and would block every PR into the new line. Exclude the new ref from that ruleset, or add a 2.x ruleset requiring `build-and-test summary`, as part of creating the branch. --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-09-23 15:47:43 +00:00
Marc SchierandCopilot	138086863b	Fix audit findings and review regressions across the OPC UA stack (#4503 ) ## Scope Audit fixes and review follow-ups across the OPC UA Core, Client, Server, transport, and redundancy components. This includes implemented Tier 1, Tier 2, and Tier 3 work; it does not claim that every item in the 244-finding audit backlog is complete. The review batch fixes mandatory full-key record protection and owned plaintext buffers; transactional pending-certificate claims; shared-channel nonce and certificate ownership; discovery and token-policy validation; reconnect/callback ordering without changing unbounded buffering defaults; server permissions, filters, monitored-item lifetime, and alarm topology; historian paging, retention, and annotations; atomic user/password metadata; and canonical file identities with bounded alias and role refresh workers. ## Review-batch verification at `ab686ccae` The following results come from fresh test builds using `dotnet test`, `--no-restore`, `-m:1`, and an explicit `CustomTestTarget`. They replace the earlier description's library-build/`--no-build` totals, which did not establish the state of the merged test sources. \| Scope \| Target \| Passed \| Skipped \| \|---\|---\|---:\|---:\| \| Core review regressions \| net10.0 \| 827 \| 0 \| \| Client and lifecycle regressions \| net10.0 \| 630 \| 0 \| \| Server review regressions \| net10.0 \| 1970 \| 0 \| \| Redundancy Server / Client / PubSub \| net10.0 \| 276 / 10 / 11 \| 0 \| \| Sessions / file-and-alias / streaming / HTTPS-WSS integration \| net10.0 \| 8 / 21 / 30 / 20 \| 0 \| \| Core review regressions \| net48 \| 786 \| 39 \| \| Client recovery and policy regressions \| net48 \| 54 \| 0 \| \| Server ownership, aliases, queues, and user-state regressions \| net48 \| 137 \| 0 \| Every listed run exited successfully. The 39 net48 skips are existing platform/capability cases. New key-agreement tests assert unavailable-policy behavior on unsupported targets rather than adding skips or pretending those targets performed an unsupported handshake. Additional exact node/permission/filter/alarm checks passed 13 Core and 46 Server cases. The PR-scoped formatter verification covers 26 projects and 389 non-generated C# files. A Roslyn syntax audit covers 53 changed interfaces and 263 members, with no missing parameter/type-parameter/return contracts and a 120-column limit for their declarations and documentation. No full-solution, all-target-framework, or NativeAOT matrix is claimed from these local runs; the new CI run must establish its own result. ## CI follow-up at `e1bc3ac3b` The follow-up fixes the failures reported by Azure build 18400. TLS certificates retain configured DNS names, including mixed-case URI schemes, without relaxing hostname validation. Reverse-WSS fixtures use the DNS identity in the client certificate. Reconnect completion is published only after cycle cleanup, so a subsequent reconnect cannot join an old completed cycle and retain old certificates. Certificate-alarm roots now support event subscriptions. The pump sample has one continuous notifier path, with no duplicate shortcut. Historian and aggregate fixtures share the provider's retention clock. Alarm collection lets the server expire idle Publish requests rather than canceling only the client wait. The corrected server, WoT, and managed-session fixtures exercise valid requests and initialized lifecycle contracts. Downlevel crypto tests preserve real credential and key-ownership assertions without enabling unsupported raw-ECDH policies or adding skips. Fresh local evidence after integration includes: \| Scope \| Target \| Passed \| Skipped \| \|---\|---\|---:\|---:\| \| Client lifecycle / channel ownership / builder fixtures \| net10.0 and net48, each \| 96 / 103 / 123 \| 0 \| \| Combined server lifecycle, events, aggregates, crypto, and contracts \| net48 \| 358 \| 0 \| \| Full lifecycle plus certificate-alarm and aggregate fixtures \| net10.0 \| 116 \| 0 \| \| Final server-contract and history-routing delta \| net10.0 and net48, each \| 84 \| 0 \| \| Subscription / XRegistry / WoT event regressions \| net10.0 \| 7 / 2 / 3 \| 0 \| \| Full Sessions project \| net10.0 \| 780 \| 379 \| \| Full ComplexTypes project / downlevel resolver fixtures \| net10.0 / net48 \| 2854 / 15 \| 0 \| \| Full WoT project / downlevel structured-write fixtures \| net10.0 / net48 \| 1496 / 27 \| 0 \| \| TLS domain-name regressions \| net10.0 and net48, each \| 21 \| 0 \| All listed runs exited 0. The Sessions skips come from existing endpoint and policy capability guards; they are not counted as passes. No skip was added. Worker validation also covered full DI (426 passes), full History (540 passes, 21 existing skips), 38 exact downlevel event/history failures, and 60 repeated certificate-rotation race cases. The final crypto fixtures passed 73 cases on each target with the unchanged leak detector; a temporary premature-disposal mutation made all three borrower tests fail and was then removed. All 29 C# files in this follow-up pass included-file formatting at info severity across 12 projects. The complete PR interface audit now covers 54 interfaces and 271 members with zero missing contracts or line-width findings. No full-solution or NativeAOT matrix is claimed. New-head CI has started and remains authoritative for the remote result. ## Test-result gate follow-up at `4b6e1203a` Azure build 18401 reported the net48 Client job as successful despite a test-host crash after only 264 passing tests. Its old evaluator counted per-test failures but ignored the failed run verdict. This was a partial run, not a benign exit after the suite had completed. The shared result evaluator now rejects aborted, errored, incomplete, malformed, or inconsistent TRX reports. Each file must describe a completed run, so a passing file cannot mask another file's failure. It retains support for completed runs followed by a benign nonzero host exit, existing skipped-result conventions, and no-TRX MTP jobs. All 78 regression cases pass after integration using Windows PowerShell 5.1. Real completed Sessions and Client reports also pass. The process-test fixture follows the existing NET10_0-only tools-test pattern; its net48 build is not counted as a test run. Formatting passes for the added test file. The Client host crash itself has not reproduced locally. The isolated fixture passed 59 tests, and two fresh full fast-CI selections each completed with 2,392 passes and three existing skips, including a run with crash collection enabled. The CI merge tree is identical to the tested source tree. No speculative runtime change was made, and the original partial CI run is not claimed as a full-suite pass. Azure build 18402 has now completed the full net48 Client run: 2,392 passed, three existing console skips, and a successful test-host exit. The corrected evaluator independently validated outcome=Completed. Across the matrix, 119 test-project jobs succeeded; Sessions net10.0 was canceled when the remote provider deprovisioned its runner, so the overall Azure pipeline was canceled. That cancellation is not claimed as a code failure or a successful run. CodeQL and three Docker image jobs were still running at the latest check. The migration discovery failure remains separate. ## Documentation follow-up at `57ed02bea` The environment blocker has been removed by the maintainer. The three bundled migration references now exactly match the canonical documents after deterministic link rewriting; all 15 bundled documents pass `validate-migration-plugin.ps1`. The canonical migration prose was not rewritten. `FileSystemClient.md` now documents that extended Windows roots preserve literal trailing-dot names, completing the filesystem review follow-up. The filesystem thread has been replied to and resolved after publication. The review pass now has 108 of 110 threads resolved. The two explanation-only threads remain open as requested; no unfinished change request is being represented as resolved. ## Cross-platform follow-up at `0d9d936a8` With migration discovery restored, the Linux and macOS test matrix exposed two stale durable-subscription expectations. The expected value 83,442 encoded the old 32-bit overflow when converting 3,600 hours to milliseconds. The existing overflow-safe server correctly returns 14,400,000 lifetime intervals at a 900 ms publishing interval. Only those two expected constants changed; production behavior, negotiated-hour checks, and all other assertions remain unchanged. The exact local lifetime selection reproduced both failures before the correction. The full durable suite now passes 36 cases with 11 existing skips on each of net10.0 and net48. All four lifetime cases executed and passed on both targets, and included-file info-severity formatting passes. ## Session shutdown follow-up at `8daf7f091` A late net48 Sessions failure exposed a shutdown race. Canceling an in-flight keepalive read can produce a transport `ServiceResultException`. The retiring worker treated its own cancellation as proof that the peer was unavailable, so `CloseAsync` or `DisposeAsync` could skip the server-side `CloseSession` request. The worker now ignores that service error only when its own token is canceled; genuine peer errors still update liveness. The full integration fixture reproduced the original error-code mismatch. Four deterministic mock-transport cases then produced three failures and one passing genuine-error control before the fix. They verify successful close, returned server error, asynchronous disposal, and unchanged behavior for a real keepalive failure. Fresh related runs pass 75 client and 101 integration cases on each of net48 and net10.0, with no skips. Ten repetitions of the formerly flaky full net48 fixture pass all 1,010 cases. All three changed files pass info-severity formatting, and temporary diagnostic instrumentation was removed. ## Atomic listener snapshot follow-up at `82dc22b5d` Ubuntu Core CI exposed an unsafe formatter rewrite in TCP listener disposal: `ConcurrentDictionary.ToArray()` had become a collection spread. A concurrent channel removal between the spread's count and copy operations could leave a default entry, causing a null dereference during disposal. The listener now uses the dictionary's atomic `Values` snapshot and disposes those channels outside the listener lock. Deterministic regressions close zero, one, or all channels at the copy boundary. Before the fix, the one/all-removal cases reproduced the exact null dereference; the unchanged-count control passed. All 23 admission/listener cases now pass on net10.0 and net48, and the full fast Core net10.0 suite passes 5,267 cases with 88 existing platform skips. Both changed files pass info-severity formatting. A bounded audit of the formatter's other snapshot rewrites found no further verified unsafe concurrent-registry copies. ## Shutdown-test observation follow-up at `58403ee8b` The net48 shutdown-order test raced its own observation: it read `m_publishWorkerTask` after starting shutdown, which can legitimately drain the worker and clear that field immediately. The test now captures the worker before shutdown starts and confirms it is initially running. It still requires the worker to finish while shutdown remains blocked by the held manager semaphore. Production behavior is unchanged. A temporary scheduling perturbation reproduced the exact null-field failure. The corrected capture passed 100 perturbed iterations; both the temporary repeat and yield were then removed. The final 126 subscription/lifecycle cases pass on each of net48 and net10.0, and formatting passes. A complete local Sessions net10.0 run also passed 780 cases with 379 existing capability skips in 7m20s after the earlier keepalive correction. ## Retirement and alias-startup follow-up at `1a048ff39` The shadow-generation test now observes its documented asynchronous cleanup through the existing bounded helper. Removing the replacement does not join a background drain that already claimed the retired generation. The test still checks live-registration removal immediately and requires the old node to disappear; no timeout or production lifecycle behavior changed. All 81 lifecycle cases pass on each of net10.0 and net48. Initial alias-node materialization now retries one timed-out, read-only snapshot query before creating nodes for that root. The retry is logged through source-generated logging. Each query retains the original shared 100 ms deadline; repeated timeouts, other errors, and cancellation still abort startup. Client searches and live refresh do not gain this immediate retry. Fault-injection tests cover success after one timeout, a persistent timeout, a different store failure, and cancellation. All 187 related alias/hosting cases and the original certificate-rotation integration case pass on each target; the positive test records exactly one retry warning. The alias documentation now accurately describes the shared request budget. All changed C# files pass formatter checks, and the complete 54-interface/271-member documentation audit passes. Fresh CI is running on `1a048ff39`; the previous completed matrix exposed only the two failures corrected in this batch and their dependent summaries. ## Sample endpoint allocation follow-up at `d08a94925` The strong-cluster test harness allocated OPC UA and Raft endpoints in separate released-port batches. Uniqueness was enforced only inside each batch, so the same OS-assigned port could appear in both protocol groups. The harness now requests one distinct batch for both groups and splits it before launching any replicas. Deterministic one- and three-replica allocation cases reproduced overlapping groups with the old plan and pass with the corrected plan. The complete 17-case short-haul sample suite passes without skips; all failover, historian-continuation, and service assertions remain unchanged. Both changed files pass info-severity formatting. This prevents intra-cluster self-collisions but does not claim to reserve released ports against unrelated external processes. ## Code-review follow-up at `085fd9636` A review of the complete branch diff found five defects this PR introduced. All are now fixed, each in its own commit. `RelatedTo`'s recursive-to-iterative rewrite defaulted the optional `includeTypeDefinitionSubtypes` and `includeReferenceTypeSubtypes` operands to `false`. Part 4 §7.7.4 specifies both default to `true`, so a filter that omitted them silently stopped matching subtypes. Dynamically created key-credential nodes derived their namespace from the containing folder, which is the standard `i=18155` node in namespace 0 — the namespace reserved for the OPC UA standard address space; they now resolve the server-owned namespace and fail with `BadInternalError` rather than guessing index 1. The retained audience-less `CreateTokenData` overload produced tokens that verification always rejects, so it is now `[Obsolete]` and throws instead. A failed reference to a remote parent left the new node registered with a one-sided inverse reference, and is now rolled back. An existing `.pfx` is restricted before it is rewritten, rather than after its new key bytes are on disk. One further reported finding was rejected after investigation. `JwksIssuerKeyResolver` deliberately does not dispose retired key snapshots: `RetiredKeysAreCollectibleWhileResolverRemainsAliveAsync` proves the resolver retains no retired snapshot, and `ReturnedKeysSurviveRepeatedRefreshAndResolverDisposalAsync` requires already-returned keys to keep verifying across refreshes and resolver disposal. Adding disposal would have broken that tested contract, so the exploratory change was reverted. Validated on net10.0 and net48: 256 Core and 633 Server cases pass, with one pre-existing net48 skip. The build reports zero compiler and analyzer diagnostics, all eight included-file info-format checks pass, the contract audit covers 58 interfaces and 310 members with no findings, and the 15 bundled migration documents validate. All 122 review threads are resolved; the key-credential namespace thread was reopened to retract an earlier incorrect answer and then resolved against the real fix. ## Review-body follow-up at `da0d59cfb` The re-review at `8daf7f091 + 82dc22b5d` listed four items in its summary that had no inline thread of their own, so they had not been picked up. All four are now fixed. Both event-dispatch permission gates had been tightened from not-Bad to `IsGood`, which silently dropped events whose permission verdict is Uncertain; the data-change path in the same file still treated Uncertain as deliverable, so the two had diverged. `EventSourceRegistry` only cleared `ConsecutiveFailures` when a source was deactivated, so a source that had backed off to the 30-second cap kept that delay for the rest of the process even after starting successfully. `UserNameIdentityTokenHandler` built a temporary issuer chain whose `Add` calls take independent certificate references, and never released them. The fourth was the receiver-side sequence rollover, which the reviewer had correctly re-flagged as still open despite its thread being resolved. `m_sequenceRollover` was set permanently, so the second legal wrap on a long-lived channel was rejected and faulted the channel along with the transport-reconnect OPN. OPC 10000-6 does not cap a SecureChannel at one wrap. The flag is now cleared once an accepted number has traversed the normal range, which keeps rejecting a replayed low number that never left the rollover window. Validated on net10.0 and net48: 636 / 593 Core cases and 135 / 134 Server cases pass, including the new `UaSCBinaryChannelSequenceRolloverTests` and the Uncertain-permission delivery cases. The build reports zero compiler and analyzer diagnostics and the changed files pass included-file info-format checks on both targets. The previous head `085fd9636` was fully green: 279 checks passed and Azure build 18414 succeeded with 137 of 137 jobs, after the platform automatically retried a job whose NuGet tool download had hit a transient TLS error. ## Reported issues #4508 and #4509 at `6ad1ecf16` #4508 (V2 subscription recreate deadlocks against a faulted transport) was not yet fixed and is now closed by `bac260a06`. Both drain sites the report identifies were still unbounded. A publish worker that started its request before the quiesce parks inside the service call on the channel ready gate while holding an active publish request; the recreate that would make the channel ready is the very operation awaiting the drain, so the wait never ends. The drain now cancels in-flight attempts through a per-attempt token linked to the worker token. An aborted worker rolls its acknowledgements back, releases the request and returns to the paused park instead of terminating, so it resumes when the caller leaves the quiesce. Publish ingress stays quiesced for the caller's operation, so `DropPendingForSubscription` keeps the guarantee the report asks to preserve and no blind timeout is added. The new regression parks a worker on a cancellable gate that never completes on its own: it reproduces the hang for the full 30-second budget before the change and passes after it. #4509 (identity provider fails the initial connect) was already fixed for its primary symptom. `HandleConnectAsync` materializes the provider's identity through `CreateIdentitySelectionContext` before the first `CreateAsync`, so Anonymous is no longer substituted against a UserName-only endpoint. `6ad1ecf16` adds the two remaining details from the report: the enabled-policy set now includes the negotiated channel policy, so a client cannot reject the policy it already accepted as `NotEnabledByClient`; and when discovery has not populated the endpoint's token policies the connect keeps the configured identity so the attempt fails at the transport layer for the reconnect policy to retry, instead of failing at the identity layer. Validated on net10.0 and net48: 477 / 473 client session and subscription cases pass, the build is free of compiler and analyzer diagnostics, and the changed files pass included-file info-format checks on both targets. The full `Opc.Ua.Sessions.Tests` suite also passes locally on net10.0 with 782 passed and 379 pre-existing capability skips. GitHub checks are green on this head: Build and Test .NET 10.0, Docker Sample Images CI, and NuGet Publish all succeeded. Azure build 18417 completed 134 of its 135 jobs successfully; its net10.0 Sessions job was cancelled by the hosted-agent provider ("Received request to deprovision"), the same infrastructure flake that hit build 18409 earlier on a head predating these changes. That job is not claimed as passing, and the local full-suite run above covers the same project. The previous head `da0d59cfb` completed Azure build 18415 with every job succeeded. ## Review follow-up at `a08f0c12b` Eleven new review threads arrived, nearly all documentation. Before acting on each "this is new in 2.0" remark I checked the API against `master378` rather than assuming, because a genuine 1.5 API still needs its migration entry. `ManagedSession`'s server-redundancy refresh had two hard-coded two-second bounds. The new `ServerRedundancyOptions` exposes `RefreshTimeout` for the metadata read and `PeerDiscoveryTimeout` for each peer lookup, defaults both to the previous two seconds, validates that a bound is positive or `Timeout.InfiniteTimeSpan`, and flows through `ManagedSessionOptions`, `ManagedSession.CreateAsync`, the fluent builder, and `DefaultServerRedundancyHandler`. `AsyncCustomNodeManager` and `KeyCredentialBridgeAuthenticator` are both absent from `master378`, so their obsolete members had no compatibility constraint and are removed rather than carried: `AsyncCustomNodeManager.ReadInitialValue`, the audience-less `CreateTokenData` that only threw, and the audience-less `CreateProof` that produced a proof no server accepts. `CustomNodeManager2.ReadInitialValue` and the `MonitoredNode2` migration section are genuine 1.5 APIs and are untouched. The documentation now states master's behaviour instead of the delta from 1.5.378, with each moved item already covered under `docs/migrate/2.0.x/`. `IHistorianAnnotationProvider` is described by its annotation-time key rather than as "legacy" — it is new in 2.0, so the label implied a compatibility constraint that does not exist. The KeyCredential bridge payload's `"version"` field is explained as a vendor-extension format version with no OPC UA counterpart, and its version-1 upgrade narrative is gone. `CertificateManager.md`'s migration walkthrough is replaced by the resolver API it targets. `NodeManagers.md`, `Sessions.md`, `AsyncServerSupport.md`, `Certificates.md`, and `Profiles.md` no longer announce features relative to 1.5. `Benchmarks.md`, `WhatsNewIn2.0.md`, `DeveloperGuide.md`, and `docs/migrate/` keep their 1.5.378 references, which are their subject. CI then exposed a defect this batch introduced: five fixtures resolve `ManagedSession`'s private constructor by its exact positional parameter types, so the added parameter compiled cleanly but made `GetConstructor` return `null` at run time. `7df1d5c40` updates every site; `Redundancy.Client` passes 126 of 126 and the affected client fixtures 112 of 112. The BouncyCastle question is answered and tracked in #4510: `Opc.Ua.Core` already project-references `Opc.Ua.Security.Certificates`, which already carries the conditional BouncyCastle reference, so the raw-ECDH polyfill belongs there rather than as a new Core dependency. The `IUserDatabase` metadata question is addressed to another maintainer and is deliberately left open. ## Reported issue #4509 follow-up at `5d4d13d63` The reporter verified `6ad1ecf16` and found one case still failing, correctly. The empty-token-policies branch kept the configured identity so a server that is down surfaces a transport failure rather than an identity error. A provider-only configuration has no configured identity, so it kept `null`: `OpenCoreAsync` turned that into Anonymous and `OpenValidateIdentity` rejected it with `BadIdentityTokenInvalid`, silently ignoring the configured provider. The branch now requires a configured identity to defer to. Without one the provider is consulted, so its own `BadIdentityTokenRejected` names the offered and rejected policy set instead. Two regression tests cover both configurations; the first fails against the previous behaviour by reaching the session factory with a `null` identity, which is the exact step that produced the reported error. That branch had shipped without a test, which is why the case was missed. ## Review and CI status at `5d4d13d63` All actionable review threads are resolved: 132 of 133. The single open thread is a question the reviewer addressed to another maintainer about moving user metadata into `IUserDatabase`; it is left open for them rather than resolved silently. Every resolved thread carries a reply naming its fix commit. Latest-head CI is green on `5d4d13d63`: 279 checks passed, zero failed, zero pending, with one conditional signed-package publishing job skipped. Local validation for this batch: the full `Opc.Ua.Client.Tests` suite passes 2,430 of 2,430 on net10.0, `Opc.Ua.Redundancy.Client.Tests` 126 of 126, and `Opc.Ua.Server.Tests` 590 of 590 for the affected selections. Both net10.0 and net48 build clean for `Opc.Ua.Client`, `Opc.Ua.Server`, and the changed test projects, and all changed files pass included-file info-severity formatting on both targets. The PR remains open; no merge was performed. As stated at the top, this does not claim that every item in the 244-finding audit backlog is complete. ## Latest CI follow-up at `b6f2dfa43` Azure build 18442 exposed a net48 compile regression in the Kafka adapter: `RuntimeHelpers.GetUninitializedObject` is unavailable on .NET Framework. Commit `2cf1e0eed` now uses normal `ProducerMessage` construction on `NETFRAMEWORK` while retaining reflection-based construction for modern targets that can load a different Dekaf runtime asset. The exact net48 CI selection passes 92 of 92 tests, and the netstandard2.1 adapter guard selection passes 11 of 11. After merging the latest `master`, GitHub Actions run 35643592139 is green. The initial Ubuntu Core.Schema job built successfully and passed 160 of 160 tests, then hit an external 403 while finalizing its test-result artifact; its failed-job rerun completed successfully. Azure build 18451 was canceled when its remote provider deprovisioned the net10.0 Sessions runner (`Received request to deprovision: The request was cancelled by the remote provider`). Azure attached no test task log or source error, and the canceled parent left that child check stale as in-progress. No source workaround, test skip, or check relaxation was made for either infrastructure failure. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 68f26810-22b8-476f-abcd-0a8c82d6e208	2026-09-22 09:10:58 +02:00
Marc Schier	331a71ac2c	Fix AI model version and inference argument handling (#4512 ) ## Summary - Derive the AI server''s advertised specification version from generated NodeSet metadata (new source-generated `ModelVersions.Target` constant), so `AINodeManager.SpecificationVersion` can no longer drift from the shipped model. - Preserve inference parameters through inline, asynchronous, fallback, and oversized-transfer execution instead of silently discarding them. - Reject unsupported `PayloadUri` input explicitly with `BadNotSupported` before any backend call, job creation, or transfer allocation. - Apply the supported `temperature` / `max_tokens` / `top_p` parameters in both built-in backends via a shared parser. Fixes #4505 Fixes #4506 ## Review follow-ups (`f8754f618`) - REST backend: a JSON body field is dropped only when its matching call parameter was actually supplied, so an explicit `temperature` no longer erases payload-supplied `max_tokens` / `top_p`. - Call parameters accept every built-in integer encoding (`Int64`, `UInt64`, `Int16`, `UInt16`, `Byte`, `SByte`) and booleans, instead of failing the whole `Invoke` when a client encodes `max_tokens` as `Int64`. - A null `String` Variant is rejected rather than inserted into the non-nullable backend parameter dictionary. - The invariant-formatting regression now runs under a comma-decimal culture so it genuinely discriminates. ## Testing - `dotnet test tests\Opc.Ua.AI.Tests\Opc.Ua.AI.Tests.csproj -f net10.0 --no-restore` — 186 passed, 0 failed - `dotnet test tests\Opc.Ua.SourceGeneration.Core.Tests\Opc.Ua.SourceGeneration.Core.Tests.csproj -f net10.0 --no-restore` — 3962 passed, 8 skipped - `dotnet format whitespace --verify-no-changes` clean on the changed files; build emits no warnings.	2026-09-21 17:35:46 +00:00
Copilot marcschier Marc Schier Copilot Autofix powered by AI	02fb72e2d3	Support guid/opaque nodeids in NodeSet import (#4507 ) # Description `NodeSetToModelDesign.ImportNode` only stored Numeric and String NodeId identifiers. Guid and Opaque identifiers (both valid per OPC 10000-3 5.2.2) fell through to an `Information` log line, so the node was registered in `NodesByQName`/`NodesById` with no identifier at all and code generation continued against a node whose identity had been discarded. The `ModelDesign` schema has no representation for Guid/Opaque identifiers (`NodeDesign` exposes only `NumericId`/`StringId`), so the import now fails loudly instead of emitting output that looks correct. - Importer: the fall-through branches in `ImportNode` are replaced with an `InvalidDataException` naming the NodeId, browse name and identifier type. This matches the existing unsupported-input handling in the file and surfaces through `ModelCompilation` as a generator diagnostic. - Logger removal: `m_logger` had no remaining use in `NodeSetToModelDesign` and was removed along with its `Microsoft.Extensions.Logging` import. - Tests: `ImportUnsupportedNodeIdTypeThrowsInvalidDataException` covers Guid, empty Guid and Opaque identifiers via an in-memory NodeSet. - Docs: the source generator readme states the NodeSet2 identifier restriction. ```csharp else { // The model design can only carry numeric and string identifiers. // Guid and Opaque identifiers (OPC 10000-3 5.2.2) would be dropped // and code would be generated for a node without any identity, so // the import fails instead of silently producing wrong output. throw new InvalidDataException( $"NodeId ({input.NodeId}) of node '{input.BrowseName}' uses the " + $"{nodeId.IdType} identifier type which is not supported by the model " + "design. Only Numeric and String identifiers can be imported."); } ``` Note on behaviour: a null/unspecified NodeId parses as a Numeric identifier (`i=0`) and is still handled by the numeric branch, so the removed `IsNull` branch was only ever reachable for an empty Guid or Opaque identifier, which is now reported as unsupported. ## Related Issues ## Checklist _Put an `x` in the boxes that apply. You can complete these step by step after opening the PR._ - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. <!-- START COPILOT CODING AGENT SUFFIX --> - Fixes #4504 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com> Co-authored-by: Marc Schier <marcschier@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-09-21 14:52:55 +02:00
Copilotandmarcschier	37b552254e	Recover transferred notifications immediately after a subscription transfer (#4500 ) # Description The V2 (managed) subscription engine republishes retransmission-queue entries only while gap-walking sequence numbers in `MessageProcessor.ProcessMessageCoreAsync`, which requires a new data message to arrive. `Subscription.TryCompleteTransferAsync` merely stored the `AvailableSequenceNumbers` returned by `TransferSubscriptions`, so a subscription that stayed quiet — or that only emitted keep-alives, which deliberately do not advance the data dedup gate — never recovered the notifications the previous session left behind. The V2 engine therefore did not deliver the classic `RepublishAfterTransfer` guarantee that `docs/Subscriptions.md` claimed it did implicitly. Changes: - `MessageProcessor.RecoverTransferredMessagesAsync` (new, protected) — republishes every sequence number reported available by `TransferSubscriptions`, oldest-first with wrap-aware ordering (Part 4 §7.30.5), serialized on the message dispatch gate and marked as dispatch context. Afterwards it advances `LastDataSequenceNumberProcessed` / `LastSequenceNumberProcessed` past the whole set — the server already sent those messages, so the next publish must not be treated as the first message after create — and clears the recovered entries from `AvailableInRetransmissionQueue`. Empty input short-circuits before taking the gate. - `Subscription.TryCompleteTransferAsync` — calls the recovery after releasing the state lock, so a notification handler may re-enter the subscription. The transfer has already succeeded at that point, so recovery errors are logged (`SubscriptionFailedToRecoverTransferredMessages`) rather than reported as a failed transfer; caller-requested cancellation still propagates. - Docs — the `s.RepublishAfterTransfer` row in the classic→V2 mapping table now describes the actual (always-on, transfer-driven) behavior. - Tests — `MessageProcessorTests`: ordered recovery with no subsequent publish and no duplicate republish afterwards, empty-input no-op, ordering across the `uint.MaxValue → 1` wrap, and a failed republish that still advances the gate. Notes for review: - The helper takes `IReadOnlyList<uint>` rather than `ArrayOf<uint>` to match the surrounding transfer surface (`IManagedSubscription.TryCompleteTransferAsync`, `MessageProcessor.OnPublishReceivedAsync`, the internal `AvailableInRetransmissionQueue` field); wrapping only this member would add conversions without changing public API. - Unlike classic, only consecutive top-of-queue entries are not special-cased — the whole available set is recovered, matching the existing V2 first-message-after-create path. ## Related Issues The managed engine's transfer path did not recover pending notifications on quiet subscriptions; see the classic-engine counterpart discussion referenced in the issue. ## Checklist _Put an `x` in the boxes that apply. You can complete these step by step after opening the PR._ - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. <!-- START COPILOT CODING AGENT SUFFIX --> - Fixes #4498 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>	2026-09-18 09:12:40 +02:00
Cristi Pogacean Copilot Autofix powered by AI copilot-swe-agent[bot]marcschier	8889ffee0e	Fix connector migration type handling and transfer recovery (#4496 ) Preserve null enumeration arrays while restoring enum metadata, reconstruct concrete structure collections, and schedule transferred notifications for immediate republish. Add regression coverage for issue #4494. # Description _Describe the changes here to communicate to the maintainers why they should accept this pull request. By default - this will become the Commit message after merging and thus define history._ ## Related Issues _Reference all GitHub issues this PR addresses. If there is no issue yet, open one and link it here._ _If this is a relatively large or complex change, a design must have been discussed in the related tracking issue and signed off (which becomes the Architectural Decision Record (ADR))._ - Fixes #github-issue-number, ... ## Checklist _Put an `x` in the boxes that apply. You can complete these step by step after opening the PR._ - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [ ] I have added all necessary documentation. - [ ] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>	2026-09-18 04:15:34 +00:00
Marc Schier	a22fac4974	Fix flaky GeneratorOpenUsdE2eTests timeout on net48 CI (#4501 ) ## Description Fixes a reproducible failure of `GeneratorOpenUsdE2eTests` on the net48 CI job, observed in master build [18363](https://opcfoundation.visualstudio.com/865bd736-d0a6-4260-a336-d09d3eb39375/_build/results?buildId=18363) (and reproduced identically in build 18361): all 4 tests in the fixture failed with `OneTimeSetUp: Server endpoint did not become available.` Root cause: the fixture polled for the hosted OPC UA endpoint for 40 attempts at 500ms (~20s). This budget is shared with several other OpenUsd/DI end-to-end fixtures, but `GeneratorOpenUsdE2eTests` materialises two full generator sets (state machines, protection alarms, OpenUsd bindings) before the endpoint opens, and that start-up cost — combined with slower JIT/crypto on .NET Framework — was consistently exceeding the 20s budget on net48 CI agents even though the server was healthy and became ready shortly after. `Opc.Ua.Di.Tests` (which contains `PumpOpenUsdE2eTests`, `RobotOpenUsdE2eTests`, `SiteFederationE2eTests` with the same pattern) passed in the same run, and `RobotOpenUsdE2eTests` — a similarly complex fixture — already uses a larger 90-attempt (~45s) budget for the same reason. This PR raises the retry budget for `GeneratorOpenUsdE2eTests` from 40 to 90 attempts, matching the precedent set by `RobotOpenUsdE2eTests`. No assertions were changed or loosened; only the operational start-up timeout was adjusted to accommodate genuine (not indefinite) start-up latency. ## Related Issues - Fixes flaky/failing `GeneratorOpenUsdE2eTests` on the net48 CI job (observed in builds 18361 and 18363 on `master`; not caused by any pending PR). ## Validation - `dotnet build tests/Opc.Ua.OpenUsd.Tests/Opc.Ua.OpenUsd.Tests.csproj` for `net48` and `net10.0`: passed - `dotnet test ... --framework net48 --filter FullyQualifiedName~GeneratorOpenUsdE2eTests`: 4/4 passed (previously 0/4) - `dotnet test ... --framework net48` (full `Opc.Ua.OpenUsd.Tests` suite): 882/882 passed (previously 878/882) - `dotnet format ... --verify-no-changes` on the changed file: no issues ## Checklist - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [ ] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [ ] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [x] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received.	2026-09-17 13:36:09 +00:00
Marc Schier copilot-swe-agent[bot]marcschier	7bd90d1ed7	Update dependencies and re-enable macOS NativeAOT (#4493 ) ## Description Updates unpinned NuGet dependencies to current compatible stable versions, pins the repository and CI to .NET SDK 10.0.401 (.NET 10.0.12), and re-enables the macOS ARM64 NativeAOT lane. The existing intentional pins remain unchanged, including Moq, compatibility/security remediation pins, Roslyn compatibility versions, coordinated OpenUSD packages, and per-TFM MQTTnet/ASP.NET Core bands. The .NET 10.0.12 `Microsoft.DotNet.ILCompiler` package provenance was verified against the runtime relocation-anchor fix required for the Apple linker failure. ## Related Issues - Fixes #4443 ## Validation - `dotnet restore UA.slnx`: passed - Targeted .NET 10 build: passed - Core schema tests: 160 passed - Main NativeAOT tests: 178 passed - Historian NativeAOT tests: 2 passed - MCP NativeAOT tests: 3 passed - `git diff --check`: passed ## Checklist - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [ ] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .NET Framework and .NET 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>	2026-09-17 15:15:38 +02:00
Copilot marcschier Marc Schier	d7dd1b0369	Fix telemetry component assembly identification (#4490 ) # Description Telemetry extensions resolved meters and activity sources as `Opc.Ua.Types`, with results dependent on helper inlining. This prevented reliable attribution to the emitting component. - Existing telemetry contract: Add `CreateMeter(Assembly)` and `GetActivitySource(Assembly)` directly to `ITelemetryContext`. The separate `IAssemblyTelemetryContext` interface has been removed. - Reliable component attribution: Capture the caller assembly in non-inlined `CreateMeter`, `GetActivitySource`, and `StartActivity` extensions, then forward it to the existing telemetry context. - Call-site routing and fallback: Keep non-null meter calls on `telemetry.CreateMeter()`. Use explicit `TelemetryExtensions.CreateMeter(telemetry)` for nullable-context fallback. Preserve default meter/activity-source fallback when a context returns null. - Coverage and documentation: Cover caller-assembly naming, direct-context and extension routing, activity creation, and null-result fallback. Update diagnostics examples, OpenTelemetry filters, and migration guidance. Compatibility: Direct implementations of `ITelemetryContext` must implement the two new assembly-aware members. `TelemetryContextBase` supplies both. This interface addition is documented in the 2.0 migration guide; legacy implementer compatibility is not claimed. ## Local validation The Release build and focused `TelemetryExtensionsTests` fixture pass on both target frameworks: \| Target \| Result \| \| --- \| --- \| \| net10.0 \| Passed: 6, Failed: 0, Skipped: 0 \| \| net48 \| Passed: 6, Failed: 0, Skipped: 0 \| Both builds emit existing CA5394 warnings in `NodeStateChildNameIndexTests.cs`, which is unchanged by this PR. The full solution test suite was not run during this feedback pass. ## Related Issues ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [x] I have addressed all PR feedback received. <!-- START COPILOT CODING AGENT SUFFIX --> - Fixes #4483 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com> Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>	2026-09-16 11:07:17 +02:00
Marc Schier	fa8d45f2cf	Fix server/core validation, lifecycle and protocol regressions (#4477 ) # Description Server/core audit fixes with regression tests. Latest review-fix validation, merge validation and earlier acceptance results are distinguished below. This addresses a 95-finding server/core report. Every finding was reviewed with the OPC UA specification knowledge base or, where the standard does not prescribe a C# implementation, the corresponding ownership/configuration contract. Incorrect or withdrawn subclaims remain qualified rather than being presented as additional fixes. The original checkpoint covers session identity/certificate validation and revocation; certificate/key ownership and transactional updates; TCP reconnect, receive/admission and buffer lifetime; HTTP quotas; subscription admission, durability and pooled payloads; file-operation lifecycle; historian aggregates; fluent/state-machine behavior; and related utilities. It includes targeted regressions and directly related documentation. The approved acceptance cleanup is separate in the commit history: \| Cleanup \| Verified result \| \| --- \| --- \| \| Invalid identity-policy and KeyCredential fixture inputs \| Fixtures explicitly advertise Username and use its generated policy ID. Credential persistence uses valid clear mode inside the existing encrypted admin context. Original permission, lockout and negative encryption assertions remain. \| \| Native GDS lifetime and concurrent connection failures \| Retain ApplicationInstance until client teardown. A deterministic native reproducer proved the test-only channel cap of 10 was exhausted; removing that override restores the existing bounded default of 1000. No global serialization or production quota change. \| \| Stress certificate ownership and close accounting \| Balance two helper references and the fake transport's server-certificate ownership. Replace the invalid event-count bound with exactly-once physical disposal, opens = closes, zero active entries and one logical entry lifetime. \| \| Participant deadlines \| Use the injected TimeProvider with the existing cross-framework WaitAsync overload. Tests pin one tick before, exact expiry, terminal notification, recovery and timely completion. \| \| Reproducibility and platform assertions \| Preserve canonical WoT bytes/hashes, explicit display-culture contracts and exact numeric-vector assertions. Accept Apple's CryptographicException subtype without weakening disposal balance. \| \| Missing user-signature proof \| Reject null/empty proofs before OS crypto. Return BadUserSignatureInvalid per Part 4, 5.7.3.3. None-policy and valid-signature controls remain. A CI-only test nullable-context error was corrected without changing production behavior. \| \| Durable sample restore and shared test storage \| Dequeue waits for actual batch residency instead of treating failed restore completion as success, and restored files close before deletion. Five deterministic regressions failed before the fix. The two fixtures that clear the shared batch directory are isolated; all original 3,000-item assertions remain unchanged. \| ## Latest review follow-up Commit `828856850219518970e8e2f580b8f94b3c1fc748` fixes the deferred robotics disposal reported in the latest review. `RobotIntentNodeManager.DisposeAsync` now joins a shared controller-host drain and then explicitly awaits base node-manager disposal. A controller's bounded shutdown wait may defer its cleanup, but no longer lets the node-manager override finish early. Concurrent callers, including an asynchronous call after synchronous `Dispose`, cannot bypass the drain after the host list has been detached. Synchronous disposal remains nonblocking for deferred work. Deferred initialization failures are logged and retained, and base cleanup failures propagate to asynchronous callers. The existing controller-level bounded disposal contract is unchanged; the node-manager contract is documented in `docs/Robotics.md`. \| Regression requirement \| Evidence \| \| --- \| --- \| \| Wait for deferred hosts; preserve synchronous compatibility and concurrent joins \| `NodeManagerAsyncDisposalWaitsForDeferredHostsAsync`: four cases covering both entry-point orders and zero/positive host shutdown waits. All four failed before the fix. \| \| Wait through base cleanup and observe failures \| `NodeManagerDisposalWaitsForBaseCleanupAndReportsItsFailureAsync`: four cases hold the actual base-resource semaphore, verify pending callers after the host finishes, then check success or the same propagated exception and exactly-once cleanup. \| The focused `IntentHostingCoverageTests` and `IntentControllerHostTests.Dispose` selection passed 30/30 on net10.0 and 30/30 on net48, with no failures or skips. The final net10 solution build passed with zero errors and only the four previously documented CA2249 warnings in unchanged fuzz-test code. No new warnings, analyzer suppressions, dependencies, or weakened assertions were added. The review thread received a commit-specific reply and was explicitly resolved. This verification is scoped to the robotics feedback; the earlier full Subscriptions-run limitation remains recorded in the merge section below. ## Documentation review follow-up (2026-09-14) Commit `f9a9686fcc5d3cfd19cbbc8c2d826e20f5c7e72f` addresses the six follow-up threads on documentation and implementation rationale. Each has an in-thread reply citing the commit and an explicit resolution. Multiline XML documentation now covers the declarations introduced or modified throughout the entire PR, including internal contracts, samples, tests, and public members of related private helpers. A syntax-aware inventory checked 2,031 declarations across all 256 PR C# paths with zero documentation gaps. A supplementary check also covers 75 previously unchanged public members of private helpers involved in the changed code. Token comparison across the conditional-compilation branches proves this follow-up changes no executable C# or test assertions. Project-file changes are rationale comments only. The implementation questions are documented at their source: \| Question \| Resolution \| \| --- \| --- \| \| Certificate assembly friendship \| Server Push configuration reuses the internal explicit-subject CSR helper with the existing key; no public crypto API was added. \| \| Core.Types assembly friendship \| Server builders use internal transition callbacks/revision guards; Server.Tests checks the revision deterministically without creating a public compatibility contract. \| \| Always-single-reader notifications \| One dequeuer preserves event order; optional concurrency fans out within one event and joins before the next event. \| \| Asynchronous disposal completion \| `DisposeAsync` already joins the completion published after admitted operations and all cleanup attempts. The compatibility `Dispose` remains nonblocking to avoid deadlocking an admitted callback against its own drain. \| The requested detailed review disposition follows. It distinguishes actual fixes from confirmed policies and incorrect subclaims rather than counting every comment as a new runtime change. ### Detailed disposition of review 5191795284 The [SDK review](https://github.com/OPCFoundation/UA-.NETStandard/pull/4477#pullrequestreview-5191795284) was submitted against `1c4a9df6c`, before the subsequent merge and feedback fixes. Its 15 inline threads have each received an action-specific reply and an explicit resolution. A fresh GraphQL query verified those replies and resolution states; the fixes in `b8a59990f` remain ancestors of the current branch. \| Review concern \| Action and disposition \| Concrete regression evidence \| \| --- \| --- \| --- \| \| Injected certificate-store providers bypassed \| Fixed. Registration, configuration snapshots, and validation use the injected providers. Explicit custom types remain authoritative; the built-in Directory catch-all is deferred so native X509 paths and later custom providers are not captured. Failed store opens dispose the created store. \| `InjectedProviderResolvesRegisteredAndConfiguredTrustStores` covers default-provider ordering and both registration paths; provider validation/open-failure cases and the unchanged `TrustedCertificateInjectedViaIndependentX509StoreIsObservedAsync` cover real use and independent-store visibility. \| \| Unguarded timer-thread leadership callbacks \| Fixed. Each subscriber's exception is logged independently and cannot suppress subsequent subscribers or fail lease operations. `IsLeader` reads the deadline without invoking application callbacks. \| `ThrowingLeadershipSubscriberDoesNotFailAcquireOrDisposeAsync`, `ExpiryNotifiesOtherSubscribersWhenOneThrowsAsync`, and `IsLeaderDoesNotDispatchExpiryNotificationsAsync` were all demonstrated failing before the fix. \| \| Legacy pending-key provider accepts an unfinishable regenerated CSR \| Fixed by explicit capability validation. A provider implementing only `IPendingCertificateKeyStore` receives `BadNotSupported` before key generation or persistence when regeneration is requested. Existing-key CSR/update remains supported. Regeneration requires matching-only consumption; no unsafe destructive probing was introduced. \| `LegacyPendingProviderRejectsRegenerationBeforeCreatingOrSavingAKeyAsync` checks no key or store mutation; `LegacyPendingProviderCompletesExistingKeySigningAndUpdateAsync` proves the supported flow completes. \| \| Shutdown waits behind user deactivation \| Fixed. Accepted deactivations drain before the master's lifecycle gate is taken. Configuration retains its binding until the shared drain completes, including concurrent shutdown callers and direct master disposal. \| Four cases of `ShutdownDrainsDeactivationOutsideTheSessionClosingGateAsync` exercise real configuration/binding/ServerInternalData/master reentry, retained address space, exact session/subscription closure, and no production cancellation shortcut. \| \| Subclass cleanup runs under the operation-lifetime lock \| Fixed. Cleanup starts outside that lock. A pre-published completion joins all disposers, and only the active asynchronous teardown context may use guarded helpers. Captured contexts lose that privilege when the callback exits. \| `SynchronousOwnedCleanupLetsSamplingWorkerReachClosedAdmissionAsync`, `DisposeCoreCanUseGuardedMembersWithoutReopeningCallerAdmissionAsync`, captured-context rejection, and exact cleanup-failure/ownership assertions cover both synchronous and suspended cleanup. \| \| Discovery requestId-zero chunk read after pool return \| Fixed by the earlier merge. Discovery validation precedes `SaveIntermediateChunk`; no read occurs after that path can return the buffer. The ordering is retained. \| `DiscoveryChannelReadsTheFirstChunkBeforeItIsReturnedAsync` uses a poisoning pool and the requestId-zero path. \| \| T1.8 OPN cleanup misses post-decryption throws \| Fixed by the earlier merge and pinned with new regressions. Both sequence rejection and certificate mismatch release the decrypted body and input ownership. \| `OpenSecureChannelRejectionAfterDecryptionReturnsEveryRentalAsync` checks the exact audit status and pool conservation. Omitting either corresponding release in an isolated snapshot made its case fail; no mutation remains. \| \| T1.2 mount-root protection depends on the provider \| Fixed at the host boundary. Separator-only aliases resolve to the protected root. Traversal, empty/whitespace segments, backslashes, and drive/stream qualifiers are rejected before arbitrary providers are invoked. Valid nested paths and root destinations remain supported. \| A deliberately permissive provider is used by `NonCanonicalObjectPathsCannotDeleteMoveOrCopyAsync` and invalid-target cases; exact zero-call checks are paired with legitimate nested-path/root-destination controls. \| \| Inline trusted/issuer entries now face CRL checks \| Intentional strict behavior, documented and tested. A configured backing store with strict unknown-status rejection requires current revocation information. Explicit-only lists without a store retain their no-store behavior. Actual revocation cannot be suppressed; a matching store entry's policy takes precedence. \| `InlineIssuerWithStoreHonorsStrictUnknownRevocationPolicyAsync`, `InlineIssuerRevocationIsNeverSuppressedAsync`, store-precedence cases, and explicit-only controls preserve the missing-information versus actual-revocation distinction in Part 4 6.1.3. \| \| RSA minimum applied to unspecified ECC identifiers \| Fixed at the application-certificate check. The RSA minimum is compared only with an actual RSA public key. An unspecified ECC identity is not replaced simply because its key size is below an RSA threshold. \| `SilentCertificateCheckPreservesUnspecifiedEccIdentityAsync` checks DER, thumbprint, store contents, and private-key retention; explicit RSA and HTTPS minimum controls remain. \| \| Failed directory refresh wedges corrective mutations \| Fixed. Recoverable automatic pre-refresh failures are logged and leave reconciliation pending, but do not block corrective provider mutations. Explicit refresh errors, capacity admission, caller cancellation, and actual provider denials remain enforced. \| `CorrectiveDeleteRecoversAfterPersistentOverLimitRefreshFailureAsync` converges an externally over-limit directory back to its exact allowed contents. Capacity, cancellation/token, and six refresh-error controls check negative paths. \| \| Timed-transition rejection logs at 10 Hz \| Fixed. Repeated `(state, revision, status)` warnings are deduplicated without changing the retry cadence. A different status or state entry permits another warning. \| `RepeatedTimedRejectionLogsOnceAndRecoversAsync` checks one warning over eleven rejections and success on the next attempt. Status-change and same/different-state reentry controls pin reset behavior. \| \| Bad unsubscribe strands retired-generation bookkeeping \| Fixed. Retired all-event bookkeeping completes even when unsubscribe reports Bad; the first Bad is still returned to the caller. \| Good and BadCommunicationError cases of `RetiredAllEventsDeletionCompletesBookkeepingAndReleasesGenerationAsync` check event/snapshot removal, generation release, and exactly one unsubscribe without finalization replay. \| \| CSR subject parsing and fallback \| Fixed for existing and regenerated keys. Omitted subjects fall back to the actual stored certificate. Regeneration resolves the public certificate's subject before creating a key. Malformed or unresolvable subjects return `BadInvalidArgument` before pending-key mutation. \| Store-only fallback, real-generator null/empty cases, and missing-subject/malformed-DN controls verify the signed CSR, matching fresh pending key, unchanged active identity, and no destructive side effects. \| \| Committed RemoveUser change reported as failed \| Fixed for RemoveUser and ModifyUser. Accepted cleanup is still awaited and close failures remain logged, but cannot replace the committed mutation result. Precommit failures retain their original result and side effects. \| `CommittedUserChangeKeepsResultAndPublishedUsersWhenCloseFailsAsync` checks published Users, Good result, logging, and continued closes. `FailedUserChangeKeepsPublishedUsersAndDoesNotCloseSessionsAsync` checks BadNotFound with no publication or close. \| \| Alleged pooled decoded-request aliasing \| No runtime redesign needed; reviewer rebuttal confirmed. The decoder copies the relevant input data. Misleading ownership comments were corrected rather than introducing a new dispatch model. \| `DecodedRequestRetainsValuesAfterInputBuffersAreReturnedAsync` checks the exact decoded NodeId and ByteString after returned arrays are poisoned. \| The current documentation-only follow-up rechecked 104 Core, 473 Server, and 4 Configuration cases covering these concerns: 581 passed, zero failed or skipped. The final net10 solution build also passed with zero warnings and errors. The complete earlier Core/Server/Configuration and net48 results remain listed separately rather than being presented as rerun current-head acceptance. ## Earlier review follow-up Commit `b8a59990fe2e8e967a12ffd5d9158beed7831143` addresses all 19 review threads. Each thread has an in-thread reply naming this commit and was explicitly resolved after verification; the final paginated query found 19 resolved and zero unresolved threads. The follow-up fixes injected certificate-store selection (including default provider ordering and native X509 paths), actual-RSA minimum enforcement, and CSR capability/subject validation before key mutation. Node-manager teardown uses simpler scoped ownership and drains accepted user revocation outside the master gate; committed user results and retired-event cleanup remain correct when cleanup reports failure. File mutations can recover after failed refresh without bypassing capacity or cancellation, provider paths protect mount roots, and repeated timed rejections no longer flood logs. Leadership subscriber failures are isolated without callbacks from `IsLeader`. Regressions also pin the already-merged OPN/discovery buffer fixes and prove decoded request values do not borrow returned input buffers. The strict inline issuer revocation policy is documented and tested, not weakened. Existing tests were changed only for the reviewed behavior: the incorrect committed-user result was corrected, and inline-issuer/root-alias controls were expanded. ### Review-fix validation \| Suite \| Scope \| Framework \| Passed \| Existing TRX NotExecuted \| \| --- \| --- \| --- \| ---: \| ---: \| \| Core \| Complete project \| net10.0 \| 4,970 \| 88 \| \| Server \| Complete project \| net10.0 \| 6,414 \| 69 \| \| Configuration \| Complete project \| net10.0 \| 231 \| 0 \| \| Core \| Certificate, lease and buffer compatibility slice \| net48 \| 153 \| 0 \| \| Server \| Reviewed lifecycle, user, file, timer and CSR compatibility slice \| net48 \| 692 \| 0 \| \| Configuration \| Complete project \| net48 \| 231 \| 0 \| \| CSR provider regressions \| Final portable-mock follow-up \| net10.0 \| 11 \| 0 \| All runs exited successfully with normal concurrency and leak detection. The Server console reports 5 skips; its TRX additionally records existing assumption/explicit cases, hence the 69-record count above. The Framework build caught two modern-only `ValueTask.CompletedTask` usages in new mock setup; only those expressions changed to the equivalent portable `default(ValueTask)`. The complete modern suites precede that test-only correction; all production files remained byte-identical, and the corrected fixture passed on both targets. The final net10 solution build succeeded with 0 errors and the same 4 CA2249 warnings in unchanged fuzz-test code. Diff checks and changed-line whitespace checks are clean; whole-file formatting still identifies 10 unchanged baseline lines, which were not reformatted outside the feedback scope. The committed 35-file tree was hash-verified against the validation inputs. This is the review-feedback verification scope, not a rerun or sign-off of the historical complete platform/native/soak acceptance campaign below. ## Latest upstream merge Merge `9d9bf679f317164c5b2b90924cd3cdc27a86d451` integrates `master` through `162fc5ebb` (#4486), including the AddNodes child-name index, shared certificate-error reporting, CTT sample-data corrections, and the accompanying regressions and documentation. The CreateSession conflict preserves this branch's certificate ownership, required certificate, application-URI, and channel-certificate checks. The validation result now retains nested errors through `ThrowIfInvalid`, allowing the upstream shared reporting helper to mask trust, policy, and revocation failures consistently without losing audit detail. The new indexed AddNodes regression initially attempted to reuse a deterministic NodeId after renaming its existing node. Renaming frees the BrowseName, not that NodeId. `IndexedBrowseNameReusePreservesExistingNodeIdentityAsync` now proves both contracts: the derived-ID collision leaves the original node intact, then a fresh explicitly requested ID can reuse the old name while the new name remains protected against duplicates. No production identity rule was relaxed. The incoming seeded random-index test uses the existing `UnsecureRandom` wrapper with the same seed and sequence; no new analyzer suppression was added. \| Local merge validation \| Framework \| Passed \| Existing exclusions \| \| --- \| --- \| ---: \| ---: \| \| Core, complete project \| net10.0 \| 5,081 \| 88 \| \| NodeState / BaseInstanceState \| net10.0 \| 579 \| 0 \| \| Server node management, certificate and session-security selection \| net10.0 \| 112 \| 0 \| \| InformationModel node-management services \| net10.0 \| 29 \| 1 \| \| NodeState / BaseInstanceState \| net48 \| 578 \| 0 \| \| Core certificate validation, error reporting and TCP buffers \| net48 \| 111 \| 0 \| \| Server node management, certificate and session-security selection \| net48 \| 112 \| 0 \| All selected runs exited successfully at normal concurrency: 6,602 passing test executions. Modified test assemblies were explicitly rebuilt, and the combined name/identity regression was verified by name in both net10 and net48 results. No skips or weakened assertions were introduced. The final `dotnet build UA.slnx -c Release --no-restore -m:1` with `CustomTestTarget=net10.0` succeeded with zero warnings and zero errors. The resolved source and adjusted tests pass whitespace verification, and their source hashes match the validation inputs. This is merge-specific verification. Earlier review results and the previously reported incomplete full Subscriptions runs below remain scoped to their own commits; they were not reopened or relabeled as passing by this operation. ## Previous upstream merge (2026-09-15 morning) Merge `c4694e20ab089c555af233642042133ff3a03ac8` integrates `master` through `484d6c887`, retaining #4481's shared Like parser/GDS query fixes, #4488's RequestHandle recovery in ServiceFaults, and #4487's expired-session and durable-transfer corrections. Three conflict resolutions preserve both sides: - Alias searches now use the shared `LikePattern` implementation, including upstream malformed-list validation. A timeout overload retains this branch's 100 ms per-alias deadline and `BadTimeout` reporting without keeping a second wildcard translator. The shared matcher's original unlimited overload remains unchanged for existing GDS/ContentFilter callers. New regressions cover bounded prefix/list scans, reuse after timeout, and the alias service result. - Expired activation closes outside the session-manager gate using upstream's once-only timeout claim, audit, and diagnostic accounting. This branch's original-channel and security-policy checks remain in place. - TCP buffer tests retain this branch's ownership, poisoning-pool and post-decryption checks alongside the upstream RequestHandle/fault overload tests; neither set was discarded. The upstream HTTPS binary behavior is intentionally retained: a decoder `ServiceResultException` produces HTTP 200 with an OPC UA ServiceFault carrying the decoder status, response timestamp, and recoverable RequestHandle, rather than the previous HTTP 500 text response. Other exceptions retain their existing HTTP error handling. \| Local validation \| Framework \| Passed \| TRX NotExecuted \| \| --- \| --- \| ---: \| ---: \| \| Core, complete project \| net10.0 \| 5,054 \| 88 \| \| Sessions, complete project \| net10.0 \| 780 \| 610 \| \| Server aliases, expiry/security and subscriptions \| net10.0 \| 288 \| 0 \| \| GDS database, paging and live directory calls \| net10.0 \| 263 \| 0 \| \| Shared Like patterns and bounded evaluation \| net10.0 \| 109 \| 0 \| \| Subscriptions transfer/durability/service selection \| net10.0 \| 23 \| 1 \| \| HTTPS WebApi, complete project \| net10.0 \| 346 \| 0 \| \| InformationModel aliases \| net10.0 \| 54 \| 5 \| \| Shared Like patterns and bounded evaluation \| net48 \| 109 \| 0 \| \| Core fault handles, TCP/HTTPS and filters \| net48 \| 268 \| 0 \| \| Server aliases, expiry/security and subscriptions \| net48 \| 288 \| 0 \| These selected runs exited successfully with normal test concurrency: 7,582 passing test executions. Sessions' console reports 379 skips; the TRX also contains conditional/assumption exclusions, so the table uses the actual 610 NotExecuted records. No skips or weakened assertions were added. The new `EvaluationTimeoutBoundsWorkAndPreservesPatternReuse` and `SharedPatternTimeoutRemainsAnAliasServiceError` tests passed on both targets. Validation limitation: two unfiltered Subscriptions runs did not produce a final result and were stopped, including a retry with a hang guard. They are not counted as passing. The isolated failover fixture passed 2/2, and the transfer/durability/service selection above passed. The stall's cause was not established; no unrelated code or test was changed to conceal it. The final `dotnet build UA.slnx -c Release --no-restore -m:1` with `CustomTestTarget=net10.0` succeeded with 0 warnings and 0 errors. Whitespace verification passed for all hand-reconciled files, and staged source hashes match the validation inputs. These are merge-specific checks, not a new full platform/native/soak acceptance sign-off. Earlier review and acceptance evidence below remains dated to its own commit. ## Previous upstream merge (2026-09-14) Merge `c3e09553e4d1509502d4ba751960d58491bea2cf` integrates `master` through `6313e38a0` (#4478), including the CTT-driven Part 13 aggregate corrections and FindAlias argument validation. The upstream tests and CTT documentation are retained. The single conflict in `AliasNameWildcardMatcher` is reconciled through the branch's shared regex compiler: upstream malformed-pattern rejection and `IsValidPattern` coexist with OPC UA character escaping, whole-string/newline matching, the 100 ms timeout, and service-level error reporting. The upstream ReferenceTypeFilter checks and chronological aggregate behavior are preserved. Local merge verification: \| Suite / selection \| Framework \| Passed \| Existing skips \| \| --- \| --- \| ---: \| ---: \| \| Server aliases, aggregates and historian \| net10.0 \| 1,011 \| 0 \| \| Server aliases, aggregates and historian \| net48 \| 1,011 \| 0 \| \| InformationModel aliases \| net10.0 \| 54 \| 5 \| \| Features aliases \| net10.0 \| 11 \| 0 \| \| Client aliases \| net10.0 \| 28 \| 0 \| \| History aggregate/historical-access consumers \| net10.0 \| 265 \| 0 \| All selected tests passed at normal concurrency. The final net10 solution build passed with 0 errors and 0 warnings. The resolved file's whitespace check and the staged diff check passed. These are merge-specific checks, not a new full platform/native/soak acceptance claim. ## Previous upstream merges Integrates `master` through `8e874d073`, including the Client, Types, Core and source-generator audit fixes in #4471, #4473, #4474 and #4475, plus the event queue-size revision from #4480. The merge commits are `150ea0439` (26 conflict resolutions) and `a0e17c07c` (the base update that arrived during validation). The overlapping fixes are reconciled rather than replacing either branch: - Rejected-certificate retention follows this branch, as explicitly requested: zero means unlimited history; negative values disable new storage while preserving existing backend trimming behavior (Directory clears prior history; shared key/value leaves it intact). The processor and manager policy are not redefined, and documentation/tests describe the distinction. - Preserve owned certificate snapshots and borrowed validation-core lifetimes alongside upstream cache invalidation, store-first CRL checks and `BadCertificateRevocationUnknown` for unsupported revocation lookup. - Combine exactly-once chunk ownership, receive-loop cancellation, stale-epoch rejection and detach-before-adoption with upstream signature-before-padding verification and secret cleanup. - Preserve pooled `HttpClient` per-request configuration together with bounded response reads and deadlines that remain active through body consumption. Regression cases exercise already-used clients and both timeout precedence cases. - Retain the binary-compatible channel-key constructor and normalize omitted profiles; preserve exact profile filtering and upstream binary-first HTTPS/WSS endpoint ordering. - Preserve monotonic lease expiry and stale-confirmation fencing while adding ordered, non-reentrant leadership notifications outside the state lock. ## Validation Local validation of the conflict-resolution merge: \| Suite \| Framework \| Passed \| Existing skips \| \| --- \| --- \| ---: \| ---: \| \| Core \| net10.0 \| 4,940 \| 88 \| \| Client \| net10.0 \| 2,278 \| 0 \| \| Server \| net10.0 \| 6,088 \| 5 \| \| Types \| net10.0 \| 10,394 \| 1 \| \| SourceGeneration.Core \| net10.0 \| 3,940 \| 8 \| \| SourceGeneration \| net10.0 \| 185 \| 0 \| \| Core \| net48 \| 4,855 \| 104 \| After the subsequent four-file #4480 update, the related Server slice passed 811 tests with 5 existing skips, the real durable queue-size cases passed 6/6, and EventManager's 21 cases passed again after analyzer-only expected-array cleanup. The final `dotnet build UA.slnx -c Release` with `CustomTestTarget=net10.0` succeeded: 0 errors and 4 pre-existing CA2249 warnings in unchanged fuzz-test code. Whitespace verification passed for the resolved files and the follow-up. Merge-specific proof includes `RequestTimeoutRemainsActiveWhileReadingTheOpenApiBodyAsync` on already-used shared clients with either the request or HttpClient timeout shorter, the existing ownership/expiry regressions from both branches, and both branches' retention tests adjusted only to the explicitly chosen zero/negative contract. Earlier acceptance at `1c4a9df6c` passed hosted Linux/macOS CI, CodeQL, image builds and the canonical coverage gate (87.15% line, 77.27% branch, 92.14% patch). Both Framework project matrices, all three Windows native suites (183 cases), and the unfiltered net10 stress project (230 cases, including full 60-minute chaos and 30-minute memory soaks) also passed. Those are pre-merge results, not a claim that the full framework/platform/native/soak matrix has been rerun on this merge. The previous acceptance workflow remains separate from this review-feedback operation. Security checks, meaningful assertions, leak detection, default native concurrency, full soak durations and coverage thresholds remain intact. The user-set ready-for-review state is unchanged. No architectural or complete merged-head acceptance sign-off is claimed. ## Related Issues - Fixes #4476 ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [x] I have addressed all PR feedback received.	2026-09-16 04:42:09 +00:00
romanett Claude Opus 5 copilot-swe-agent[bot]romanett	2415503ab9	Close CTT skips in the reference server sample address space, diagnostics EnabledFlag and project settings (#4485 ) Closes #4479 The CTT skipped a number of reference-server test cases because the sample address space, the diagnostics EnabledFlag or the CTT project settings did not provide what the scripts need. This PR fixes the sample data and the server behaviour behind those skips, updates `samples/UAReferenceServer.ctt.xml`, and records the CTT script defects that the newly running cases expose. ## Changes ### Sample address space (`ReferenceServer.NodeSet2.xml`, `ReferenceNodeManager`) \| # \| Skip \| Fix \| \| --- \| --- \| --- \| \| 1 \| Base Info Engineering Units `004.js`: ArrayItemType `EngineeringUnits` have an empty NamespaceUri \| UNECE `mV` (12890) EUInformation, and the axis definitions use `s` (5457219) instead of UnitId 0. \| \| 2 \| Data Access PercentDeadband `006/016/017`: `DataAccess_AnalogType_Float` EURange 0..0 \| EURange 0..100 like the other analog items. \| \| 3 \| Attribute Read `033.js` (19 nodes): second dimension of 3 \| All `Scalar_Static_Arrays2D_` are 5x5 (generated values; the Variant matrix holds scalar Int32 elements). The code-seeded Integer/Number/UInteger matrices are 5x5 too. \| \| 4 \| View Minimum Continuation Point 01 `012.js`, View Basic 2 `018.js`: Method/View nodes need two references of their own NodeClass \| `Methods_Void` HasCause/HasEffect to two methods, `Views_Operations` HasCause/HasEffect to `Views_Engineering`. \| \| 5 \| Base Info Server Capabilities 2 `002.js`: no node without MinimumSamplingInterval \| `DataAccess_DataItem_String` reports `Bad_AttributeIdInvalid` for the optional attribute (Part 3 §5.6.2). A DA item is used because Address Space WriteMask writes every attribute of the static scalars back. \| \| 6 \| Historical Access Read Raw `Err-025.js`: no non-historizing Static Scalar \| New `Scalar_Static_NonHistorizing_Boolean` (HistoryRead access, Historizing = false). See the historian change below. \| \| 10 \| Address Space Atomicity `001.js`: no NonatomicRead node found \| New `AccessRights_AccessAll_NonatomicReadWrite`. The script examines only the first 10000 variables sorted by NodeId string; the 5000 mass variables sort before `Scalar_Static_NonatomicReadWrite`. \| ### Server library - Diagnostics EnabledFlag (item 7, Base Info Diagnostics `018-1/2/3`).* `Server.ServerDiagnostics.EnabledFlag` is writable for SecurityAdmin or ConfigureAdmin over SignAndEncrypt (UserAccessLevel hook, asynchronous write handler); other users get `Bad_UserAccessDenied`. Transitions are serialized, including the node removal. Disabling returns `Bad_NotReadable` for ServerDiagnosticsSummary, its children and the diagnostics arrays, and removes the session and subscription diagnostics nodes (Part 5 §6.3.3). The server keeps the registrations: enabling restores the nodes of the live sessions and subscriptions with the same NodeIds (sessions created while disabled included) and resets the arrays to Good. Counters stay cumulative (required by `018-1.js`). Subscriptions created while diagnostics are disabled still get no diagnostics node. - `DiagnosticsNodeManager.IsDiagnosticsStructureNode` had an inverted NodeId check, so monitored diagnostics nodes never started the scan timer; `OnMonitoringModeChangedAsync` counted every node and replaced a running timer. Both fixed. - Non-historized nodes (item 6). `HistorianDispatcher` raw/modified, processed and at-time reads ask the resolved provider `IsHistorizingAsync` and return `Bad_HistoryOperationUnsupported` for a node it does not historize, instead of the empty result the in-memory historian gave for any node. - Browse order (item 8). `ReferenceDictionary.Find` returned references of a type from hash-based target maps, so a Browse filtered by ReferenceType returned references in a different order than an unfiltered Browse. It now returns them in insertion order (no extra allocation; a single match keeps the fast path). View Basic 2 `015.js` compares both lists by index. The characterization test in `NodeStateReferenceStorageTests` is updated accordingly. ### CTT project settings (`samples/UAReferenceServer.ctt.xml`) \| Setting \| Old \| New \| \| --- \| --- \| --- \| \| `/Server Test/NodeIds/Static/All Profiles/Scalar/Bool` \| `ns=2;s=Scalar_Static_Boolean` \| `ns=2;s=Scalar_Static_NonHistorizing_Boolean` \| \| `/Server Test/NodeIds/References/Has References of a ReferenceType and SubType` \| `ns=2;s=References_HasReferenceTypeAndSubType` \| `i=2253` \| \| `/Server Test/NodeIds/NodeClasses/Object` \| `ns=2;s=Scalar` \| `i=2253` \| `References_HasReferenceTypeAndSubType` loses its HasComponent/HasOrderedComponent references in the source generator; that is tracked in #4484 and not changed here. The Server object has HasComponent and HasAddIn references. ### Decisions - Item 11, Attribute Write StatusCode & Timestamp `003/006/008` (writing ServerTimestamp): unchanged. The stack rejects writes that contain a ServerTimestamp (`NodeState`/`BaseVariableState`), which Part 4 §5.11.4.2 allows (`Bad_WriteNotSupported`); the CTT reports it as "Not Supported", not as an error. Side finding, not changed: the StatusWrite/TimestampWrite AccessLevel bits are not enforced. - Item 6: Part 4 §5.11.3.4 (Table 52) specifies `Bad_HistoryOperationUnsupported`; `Err-025.js` accepts only `Bad_NotSupported`, so the case now runs and reports that as an error. Recorded as a CTT defect in `plans/ctt-issues.md`. - Item 12: removed the stale Historical Access `Err-012.js` entry (fixed by #4026). `plans/ctt-issues.md` adds C32 (`Err-025.js` status code), C33 (Atomicity `001.js`: 10000 cap, operator precedence, substring matching of `UaNodesToIgnore`) and C34 (View Basic 2 `015.js` index comparison), and replaces the Err-025/Err-012 configuration notes with the new settings and the EnabledFlag access requirement. Monitor Basic `039.js` is already C17. The run procedure in `plans/ctt-testing.md` is unchanged. ## Verification CTT 1.05.06, scripts 1.05.513, `ConsoleReferenceServer --ctt -a`, fresh server per conformance unit/group. "master" = `5362ec5e5` with the unchanged project settings. Targeted CUs (skips before → after): Attribute Read `033` Pass; Base Info Diagnostics `018-2`, `018-3` Pass, `018-1` Warning ("Session diagnostics not available" for the session the script creates while diagnostics are disabled); Base Info Engineering Units `001` Inconclusive→Pass, `004` Pass; Base Info Server Capabilities 2 `002` Pass; Data Access PercentDeadband `016`, `017` Warning→Pass; View Basic 2 `005`, `015`, `016`, `018`, `020` Pass; View Minimum Continuation Point 01 `010`, `011` Pass, `012` Warning→Pass; Address Space Atomicity `001` Pass; Monitor Value Change V2 `042` Error→Pass; Historical Access Read Raw `Err-025` runs (CTT status-code defect above); `013` fails on a varying number of results per run (1–12, also 11 on master), the documented continuation-point defect #16. Unchanged: Monitor Basic `039` (CTT script error), Monitor Value Change V2 `020` skip (`Arrays/ByteString` elements shorter than 4 bytes, not part of #4479), Historical Access Delete Value all pass. Saved selection (1,882 cases) per group, errors: Address Space Model 0 → 0, Aggregates 4558 → 4558 and Base Information 19 → 19 (identical messages) measured master (`5362ec5e5`) → this PR; after merging master (#4478) and the review fixes, Aggregates 4210 and Base Information 19; Attribute Services, Base Services, Data Access, Method Services and View Services 0 errors with this PR (0 in the recorded baseline). Tests (net10.0): Opc.Ua.Types.Tests 10395 passed, Opc.Ua.Server.Tests 5561 passed, Opc.Ua.InformationModel.Tests 1082 passed, Opc.Ua.History.Tests 519 passed, Opc.Ua.Client.Tests 2266 passed; no failures. New regression tests: `ReferenceServerTests` (units/ranges, 5x5 matrices, missing MinimumSamplingInterval, non-historizing HistoryRead, NodeClass references, Server object reference subtypes, both nonatomic nodes), `DiagnosticsNodeManagerTests.SetDiagnosticsEnabledAsync_Toggle_HidesAndRestoresDiagnosticsAsync`, `BaseInfoEnabledFlagToggleTests` (admin-only write, Bad_NotReadable while disabled, restore after enable), `ReferenceTableTests.FindReturnsReferencesInInsertionOrder`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>	2026-09-15 16:59:04 +00:00
romanettandClaude Opus 5	89a86095ce	Release managed channel lease refcount synchronously on Dispose (fixes flaky failover lease test) (#4489 ) ## Summary Fixes the intermittent CI failure of `ChannelManagerSessionLifecycleIntegrationTests.FailoverSwapsOnlyOneLeaseWhenChannelsAreSharedAsync` (`Assert.That(diagnosticA.Refcount, Is.EqualTo(1))` — Expected: 1 But was: 2, seen on `test-ubuntu-latest-Sessions`, run 34942309083). The bug was in the product, not the test. `ManagedTransportChannelLease.Dispose()` handed the whole release off to a background task, including the entry's refcount decrement. During failover, `Session.RecreateInPlaceCoreAsync` releases the old lease with a synchronous `Dispose()` and then reports `Failover -> Connected` right away. So until the thread pool got to that task, the shared channel still counted the released lease. Any consumer reading `GetChannelDiagnostics()` / refcount metrics after failover could see it, not just the test. ## Change - `ChannelEntry.ReleaseLease` (new, sync): removes the lease and decrements the refcount under the entry lock before returning. Only the teardown of a channel nobody uses any more (network close, state-change events) runs on `BackgroundWork`. `Dispose()` still never blocks on network I/O. - `ReleaseLeaseAsync` and `ReleaseLease` now share one `DetachLease` helper. - `TearDownAsync(reason, onlyIfUnused: true)` checks again under the lock that the refcount and operation count are still zero. If a lease was acquired between the release and the deferred teardown, the channel stays open instead of being closed under the new lease. This gap already existed, but the fix would have made it wider. The integration test is unchanged: with this fix, the state it asserts is guaranteed when it asserts it, so no polling is needed. ## Verification - New unit test `ClientChannelManagerManagedTests.SyncDisposeReleasesLeaseRefcountBeforeReturningAsync`: fails on master at the first iteration (Refcount 2 right after `Dispose()`) and passes with the fix. - Could not reproduce the integration failure on Windows: 12/12 passes under full CPU load, because the thread pool usually wins the race. Adding a 200 ms delay to the old deferred release reproduced the exact CI failure (line 257, Expected 1 / But was 2). Adding the same 200 ms delay to the new background teardown instead: the lifecycle tests and all `ClientChannelManager*` unit tests passed, so the fix does not depend on timing. - net10.0: Core `Stack.Client` 236/236, Sessions full suite 778 passed / 0 failed, Client ChannelManager+ManagedSession 279/279, Stress `Channels.Contract` + `FailoverLeaseSwap` 35/35. - `dotnet format whitespace --verify-no-changes` clean on changed files. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-09-15 18:22:39 +02:00
romanett Claude Opus 5 copilot-swe-agent[bot]romanett	93559d06d3	Fix sample A&C refresh and alarm timing found by slow CTT Alarms and Conditions runs (#4482 ) ## Why the CTT Alarms and Conditions group was so slow I measured every A&C CU with a fresh `ConsoleReferenceServer --ctt` (CTT 1.05.06, scripts 1.05.513), read the per-test `ResultNode` timestamps, and added `addLog` timing/counter instrumentation to a copy of the CTT project. \| Cause \| Effect \| \| --- \| --- \| \| CertificateExpiration opens a modal dialog in `initialize.js` ("adjust the clock on the server"), and it also appears in `--hidden` runs \| The CTT never exits. This is why the whole group "did not finish in 40 minutes". \| \| Limit/Level CUs: `initialize.js` idles the CU session for one Alarm Cycle Time (60 s) during the initial capture. `RequestedSessionTimeout` is also 60 s. \| The server correctly closes the session. `LimitHelper` then gets `BadSessionIdInvalid` for its 5 filter subscriptions, and Test_003–006 each run 180 s, about 14 min per CU. \| \| Alarm `Test_002` never gives the AcknowledgeableCondition type a result \| Always runs 3 × cycle (180 s). \| \| Enable `Test_003` needs every alarm type to go active within cycle/10 \| Timed out in 6 of 7 runs, because boolean and analog alarms changed state on different ticks. \| \| Enable `Err_004` answers each event with Disable/Disable/Enable \| Feedback burst, after which the CTT alarm thread sometimes returns no events. Details below. \| \| Comment `Test_001`–`004` compare against `CallHelper.ServerTimeOfCall`, which the CTT never sets (`0001-01-01`) \| Every comment event counts as unrelated, and the tests skip after 3 retries. The server's events carry the expected comment. \| Measured CU by CU, the group took about 87 min plus the hang. With the fixes below, running the whole group in one CTT process without CertificateExpiration takes 18:45 at Alarm Cycle Time 30. The per-CU table is in `plans/ctt-testing.md` §6. ## Server changes - Refresh one subscription per request, not one per Call (`AlarmNodeManager.CallAsync`). The sample answered every ConditionRefresh/ConditionRefresh2 after the first one in a Call with `Bad_RefreshInProgress`, even for other subscriptions, and never forwarded them. So CTT Refresh `Err_004` (10 subscriptions per Call) only ever refreshed one of them. The check is now keyed by SubscriptionId and MonitoredItemId. - Regression tests: `AlarmsAndConditionsRefreshTests.ConditionRefresh[2]OfDifferentSubscriptionsInOneCallSucceedsAsync`. Both fail without the fix. - Boolean alarm source now uses the analog source's steps and limits (`AlarmController`, `ConditionTypeHolder.GetSeverity`). OffNormal, Discrete and SystemOffNormal alarms now change state on the same tick as the limit alarms (5 per second, 70/90/30/10), and the shortest state still lasts 4 s. - With this, Enable `Test_003` passed in 4 s instead of a timeout. Confirm `Test_001` for the boolean types also stopped failing in both group runs. - Test: `AlarmControllerTests.BooleanAndAnalogSourcesChangeStateOnTheSameStep` (fails without the change). - Alarm controllers step on shared interval boundaries (`AlarmController.SetNextInterval`). Scheduling relative to the last step let the two controllers drift up to one 100 ms simulation tick apart, so the boolean events sometimes landed in a later publish and Enable `Test_003` still timed out in 3 of 5 runs. With shared boundaries it passed in 6 of 6 runs. - Test: `AlarmControllerTests.ControllersScheduleTheirStepsOnSharedIntervalBoundaries`. I did not make the simulation faster. Acknowledge, Confirm and Comment tests call methods with the EventId of the event they just received, and a shorter state would make them race the next transition. ## Not reproduced / not a server defect - Refresh `Err_004` `BadSubscriptionIdInvalid` cascade. In the original run the alarm-thread session's subscriptions (15.5 s lifetime) were gone after the script's 30 s wait. Nine further CTT runs passed all 28 Refresh/Refresh2 cases. An in-process replay with a sequential publisher kept every subscription; that replay is what exposed the refresh defect above. - Enable event stall (C43) is inside the CTT. A server build that logs every returned notification message showed that during a stall the server sent 435 and 420 events to the two CTT event items in 173 messages, and the CTT acknowledged all of them, while its alarm-thread buffers returned nothing. It only happens after `Err_004`'s Disable/Enable feedback burst, in 8 of 28 runs. ## Docs - `plans/ctt-testing.md`: new §6 Alarms and Conditions, covering the recommended run, where the time goes, how to instrument a run and the expected result. Also a note that a hidden CTT run can block on dialogs, so always use a timeout. - `plans/ctt-issues.md`: the A&C "open server findings" are replaced with these results, and there are new CTT script defects C39–C44 plus configuration notes (Shelving chattering alarms, Alarm Cycle Time vs session timeout). ## Tests - `Opc.Ua.History.Tests` A&C + AlarmClient: 155 passed. - `Opc.Ua.Server.Tests` `AlarmControllerTests` / `QuickstartsServerUtilitiesTests`: 4 passed. - CTT whole-group runs (27 CUs, 128 cases): 18:45 at cycle 30 and 29:23 at cycle 60 on this branch; 23:43 and 24:21 with only the refresh fix. The spread comes from the Enable stall (C43). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>	2026-09-15 14:44:36 +00:00
Marc Schier	9f14ddf5de	Preserve non-child hierarchical references during NodeSet import (#4491 ) # Description Preserve forward and inverse same-namespace hierarchical references that are not already represented by the NodeSet importer's parent/child relationship. A reference is implicit only when both its endpoints and its exact reference type match the selected ownership relationship; additional links do not reparent their targets. Also fix the generated-reference duplication that blocked the previous attempt in #4473. Inherited and declared `NodeDesign` objects can differ structurally while resolving to the same runtime reference. Deduplicating by the emitted reference-type ID, direction, and target ID prevents identical `AddReference` calls from throwing during Robotics/OpenUSD startup. - Add 21 importer/generator regression cases, including a minimized recursive-placeholder reproduction of the startup failure. - Strengthen the reference-server test to check the original missing forward links, inverse counterparts, subtype filtering, and unchanged ownership. - Document ownership versus graph references in `docs/NodeManagers.md`. ## Validation Confirmed the missing-reference cases fail before the importer fix, and the minimized duplicate-reference case fails before the generator fix. The original Robotics/OpenUSD fixture passed before the changes, failed with the importer-only candidate, and passes with both fixes. \| Suite \| net10.0 \| net48 \| \| --- \| --- \| --- \| \| SourceGeneration.Core.Tests \| 3,961 passed; 8 existing skips \| 3,961 passed; 8 existing skips \| \| SourceGeneration.Stack.Tests \| 94 passed \| 91 passed \| \| SourceGeneration.Tests \| 185 passed \| 185 passed \| \| Di.Tests, including all 17 RobotOpenUsdE2eTests \| 425 passed \| 425 passed \| \| ReferenceServerTests \| 45 passed \| 45 passed \| Executed using `CustomTestTarget` with `dotnet test tools/SourceGeneration.slnx`, the Di test project, and the `ReferenceServerTests` filter in the Server test project. Scoped whitespace/style checks and `git diff --check` also passed for the changed code. Pre-existing analyzer diagnostics outside the changes were left untouched. The full `UA.slnx` test suite has not been run locally. CI and CodeQL results remain pending. ## Related Issues - Fixes #4484. - Addresses the hierarchical-reference limitation deliberately deferred in #4473. ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received.	2026-09-15 13:06:47 +00:00
romanett Claude Opus 5 copilot-swe-agent[bot]romanett	162fc5ebb3	Fix AddNodes scaling and OpenSecureChannel revocation errors found by CTT Monitored Item, Node Management and security runs (#4486 ) # Description Findings from running the CTT conformance groups Monitored Item Services, Node Management Services, Security General and Security User Token against `ConsoleReferenceServer --ctt` (CTT 1.05.06, scripts 1.05.513). The security groups ran without `-a`, against an isolated server PKI built from the CTT's `copyToServer` folders, so the negative certificate tests are meaningful. ## Server fixes ### AddNodes below one parent was quadratic (Node Management Delete Node `Err-002.js`) The CTT adds 15,000 variables below `ns=2;s=CTT` in batches of 5,000 and warned that AddNodes responses took 400–800 ms. For every added node the server searched all children of the parent twice: once in the BrowseName duplicate check in `AsyncCustomNodeManager.AddNodeCoreAsync`, which also copied the children list, and once in the NodeVersion lookup of `FilterChangesByNodeVersion`. - `NodeState.FindChild` now searches children lists with ≥ 64 entries through a BrowseName index kept in a `ConditionalWeakTable`, so nodes with few children get no extra field. - It keeps first-match semantics and is maintained by `AddChild`/`RemoveChild`. - It is dropped on replacement and invalidated when a child is renamed or moves to another parent. - Lists whose children point at another parent (clones) are still searched linearly. - The duplicate check uses `FindChild` instead of copying the list. \| 5,000-node AddNodes batch (in-process, Debug) \| 1st \| 2nd \| 3rd \| \| --- \| --- \| --- \| --- \| \| before \| 769 ms \| 2,083 ms \| 4,011 ms \| \| after \| 141 ms \| 166 ms \| 172 ms \| In the CTT, AddNodes of 5,000 items now answers in 51–72 ms and the warning is gone. ### OpenSecureChannel leaked revocation errors (Security Certificate Validation `002.js`) Part 4 §6.1.3, Table 106: - For the revocation check (`Bad_CertificateRevoked`, `Bad_CertificateIssuerRevoked`), `Bad_SecurityChecksFailed` shall be reported to the client. - For a missing revocation list (`Bad_CertificateRevocationUnknown`, `Bad_CertificateIssuerRevocationUnknown`), it should be. `TcpServerChannel` masked only `Bad_CertificateRevoked`, and `StandardServer.OnApplicationCertificateError` (CreateSession) had its own list that missed `Bad_CertificatePolicyCheckFailed`. Both now use one helper, `CertificateErrorReporting` in Opc.Ua.Core, which also inspects the nested errors of the certificate validator (both paths now throw the validation result with `ThrowIfInvalid`). Only validity period, host name, URI and usage errors keep their own code, and audit events still carry the specific result. The CTT warning is gone. ### Sample data - Monitor Value Change V2 `020.js` skipped because `Scalar_Static_Arrays_ByteString` had a 1-byte and a 3-byte element. The script checks every element, and the simulation only padded elements 0–2. The seed value now has no element shorter than four bytes, and the simulation pads every element. - Monitor Value Change V2 `042.js` got 18 of 19 notifications. The missing item is the Float matrix: its element [1,1] was `-1.03179664E+33`, where adding 1 is below Float precision, so the value really did not change. The server did not drop a notification. The element is now `-1031.79664`. ## CTT results after the fixes \| Group \| Result \| \| --- \| --- \| \| Monitored Item Services (208) \| Monitor Value Change V2 44/44. Remaining: Monitor Basic `039.js` (C17, missing include), `038.js` warning (C32), and 1–2 sporadic timestamp-tolerance warnings that move between test cases from run to run. \| \| Node Management Services (15) \| Only Add Node `Err-008.js` (Mantis 11266). \| \| Security General (314) \| Certificate Validation: 23 pass, 24 not implemented, 3 not-applicable skips. None CreateSession/ActivateSession: all pass. The other 50 CUs are Not Implemented in scripts 1.05.513. \| \| Security User Token (66) \| Anonymous `002.js` (C35) and User Name Password 2 `015.js` (C36) fail because of CTT defects. X509: 18/18 automated cases pass. \| ## CTT defects documented (`plans/ctt-issues.md`) - C32 `038.js` compares a RevisedSamplingInterval of 0 with a project setting instead of the node's MinimumSamplingInterval or the server's MinSupportedSampleRate. - C33 `020.js` requires every ByteString element to be ≥ 4 bytes, but its message says elements 0–2. - C34 `RequestedNewNodeId()` always sends `ns=1`, regardless of `RequestedNodeId_Namespace`, so client NodeIds can't be enabled. - C35 Security User Anonymous picks the `opc.wss` endpoint, which the CTT cannot open (`BadNotSupported`). - C36 `UaEndpointDescription.FindTokenType` rewrites the cached endpoints' token policies, so `015.js` reports PolicyIds as reused. The server's GetEndpoints output was verified compliant (PolicyIds unique per configuration, Mantis 11258). - Evidence added to C9 (042.js) and issue 17 (015.js). `plans/ctt-testing.md` gains how to run the Monitored Item/Node Management groups and a recommended setup for the security groups: isolated PKI from `copyToServer`, no `-a`, PKI restore per part, and waiting for `Server started`. Other findings recorded there: - the Create/DeleteMonitoredItems timing warnings are jitter; - `LoginNameAccessDenied` is not a real user; - `samples\UAReferenceServer.ctt.xml` needs no change (enabling `RequestedNodeId` breaks six Add Node cases because of C34). Note: `plans/ctt-testing.md` and the refreshed `plans/ctt-issues.md` are introduced by #4482. The plans files here are based on #4482's versions, and new entries start at C32 because #4481 uses C19–C31. Please merge after #4482 (or rebase the plans files onto it). ## Tests - `NodeStateChildNameIndexTests` (Opc.Ua.Types.Tests): index semantics (duplicates, remove, rename, replace, re-parent, clone, shrink/grow, 2,000 random operations against a linear search). Also a scan guard: 5,000 misses against 50,000 children take 97 ms with the index and 7,083 ms with it disabled. - `AsyncCustomNodeManagerNodeManagementTests.AddNodeAsync_DuplicateBrowseNameUnderParentWithManyChildren…` - `TcpServerChannelCertificateErrorTests` (Opc.Ua.Core.Tests): masked vs reported certificate errors. - Opc.Ua.Server.Tests 5,553 passed, Opc.Ua.Core.Security.Tests 556 passed, Opc.Ua.Core.Tests (Security + Stack) 3,561 passed, InformationModel NodeManagement 26 passed (net10.0). - Opc.Ua.Types.Tests 10,404 passed and 1 failed: `WotSpecFixtureManifestTests.EveryEmbeddedExampleMatchesItsRecordedHash`. That test hashes WoT assets which are `eol=lf` in the index but CRLF in this worktree's checkout; no WoT file is touched by this PR. ## Checklist - [x] I have signed the CLA and read the CONTRIBUTING doc. - [x] I have added tests that prove my fix is effective or that my feature works. - [x] I have added all necessary documentation. - [ ] I ran all tests locally using UA.slnx against .NET Framework and .NET 10 (net10.0 suites listed above only). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>	2026-09-15 10:08:30 +00:00
romanettandClaude Opus 5	484d6c8870	Fix ActivateSession deadlock on expired sessions and keep-alive after durable subscription transfer found by CTT Session/Subscription runs (#4487 ) Fixes two server defects found by running the CTT (UA 1.05.06, scripts 1.05.513) conformance groups Session Services and Subscription Services against `ConsoleReferenceServer --ctt -a`, and documents every remaining failure. ## Server fixes ### ActivateSession on an expired session deadlocked the session manager `SessionManager.ActivateSessionAsync` detected `session.HasExpired` while holding the session-manager `SemaphoreSlim` and then called `IServerInternal.CloseSessionAsync`, which ends in `SessionManager.CloseSessionAsync` waiting for the same non-reentrant semaphore. The activation never returned and every later CreateSession/ActivateSession blocked, so the server stopped accepting sessions. - CTT: Session Base `002.js` (stall a session past its timeout, then activate it) hung for the CTT's 20 s request timeout. After it, 19 Session Base test cases, all of Session Change User, and the `initialize.js` of Session Cancel and Session Multiple failed with `BadTimeout` on CreateSession. The group took 9:03. - Fix: detect expiry under the lock, release it, then count `SessionTimeoutCount`, report the audit event, close the session and return `Bad_SessionClosed` (Part 4 §5.7.2). - Test: `SessionManagerExpiryTests` uses a `SessionManager` without the monitor loop and a `FakeTimeProvider`, so the expired-session path is deterministic. It fails without the fix (the 30 s deadlock guard trips). ### First Publish after TransferSubscriptions of an abandoned subscription returned a keep-alive While a (durable) subscription has no Session, the publish timer keeps counting its keep-alive but moves ready monitored items to the publish list only when `Session != null`. After the transfer, the first Publish found the keep-alive due and nothing scheduled, and returned an empty keep-alive although buffered values were ready (Part 4 §5.14.1.1). The data only arrived one Publish later. - CTT: Subscription Durable `004.js`, "Didn't receive the data from the transferred subscription". It passed when the CU ran alone and failed in the whole-group run. - Fix: `Subscription.InnerPublish` moves ready items from the check list to the publish list before it would send a keep-alive. - Test: `SubscriptionTests.FirstPublishAfterTransferOfAbandonedSubscriptionReturnsQueuedDataAsync` fails without the fix (empty `NotificationData`). ## CTT results (fresh server per run) \| Group \| Before \| After \| \| --- \| --- \| --- \| \| Session Services (4 CUs, 32 cases) \| ~25 errors (deadlock cascade), 9:03 \| 3 errors, all C32 (CTT defect), 0:45 \| \| Subscription Services (14 CUs, 215 cases) \| `020.js` (known, Mantis 11260), `012.js`, and `004.js` intermittently \| `020.js` + `012.js` (C33, CTT defect); `004.js` passed 3 of 3 runs \| Transfer, Minimum 05, Publish Min 10 and Basic have no errors. Warnings and skips are classified in `plans/ctt-issues.md`. ## Documentation (`plans/`) - The first docs commit takes `plans/ctt-testing.md` and `plans/ctt-issues.md` unchanged from #4482, so identical content merges cleanly with the open CTT PRs. The second docs commit contains only this PR's additions. - C32: Session Base `Err-002.js`/`Err-005.js`/`Err-022.js` pick the `opc.wss` SignAndEncrypt endpoint in `initialize.js` and send it as the EndpointUrl over a UA TCP channel; `HostnameFromUrl` (`UaH.js:64`) cannot parse `opc.wss`. - C33: Subscription Durable `012.js` ignores `Bad_UserAccessDenied` when browsing `SubscriptionDiagnosticsArray`. The server restricts it to SecurityAdmin over SignAndEncrypt. The script then reads an empty list (`Bad_NothingToDo`), and line 37 is missing braces. - Issue 18 (`008.js`) is still misspelled in 1.05.513 but passes against this server. - CloseSession latency warning (600–700 ms in the CTT; 0–19 ms in-process), Publish Min 05 `003.js` subscription-limit configuration note, Session/Subscription coverage (manual and no-test-case CUs). - `ctt-testing.md` section 7: how to run both groups (one CTT process each, 20 min timeout, short project path — a deep project copy breaks the CTT's relative certificate paths), per-CU timings and expected results; pitfall about several automated CTT runs sharing port 62541. C-entry numbers start at C32 because #4481 already uses C19–C31. ## Tests - `Opc.Ua.Server.Tests`: 5554 passed, 0 failed - `Opc.Ua.Sessions.Tests`: 778 passed, 0 failed, 379 skipped (same counts as a clean tree) - `Opc.Ua.Subscriptions.Tests`: 619 passed, 0 failed, 6 skipped 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-09-14 20:31:52 +00:00
romanettandClaude Opus 5	aee30e9bf6	Echo the RequestHandle in ServiceFaults for requests that cannot be decoded (#4488 ) # Description OPC 10000-4 §7.33 (ServiceFault): "The requestHandle in the ResponseHeader should be set to what was provided in the RequestHeader even if these values were not valid." When the decoder rejects a request, for example a string argument above `MaxStringLength` (`BadEncodingLimitsExceeded`), the server answered with a ServiceFault carrying RequestHandle 0 and no Timestamp. The OPC Foundation CTT reports this: "CallResponseHeader.RequestHandle does not match expected RequestHandle. Expected: 18 Received: 0". It was seen during the CTT GDS triage of #4481, with a FindApplications ApplicationUri of MaxStringLength + 10 % characters. ### Changes - `RequestHandleReader` (new, internal, `Opc.Ua.Core`) reads the RequestHandle best effort from a message that could not be decoded: - binary: the encoding NodeId, then the leading RequestHeader fields AuthenticationToken (NodeId), Timestamp (UtcTime) and RequestHandle (UInt32); - JSON: `UaBody.RequestHeader.RequestHandle`, ignoring same-named members anywhere else. It returns 0 when the handle cannot be read. - `TcpServerChannel` / `TcpListenerChannel`: new `SendServiceFault` overloads take the RequestHandle, and faults now carry a response Timestamp. `ProcessRequestMessage` (decode failure, null request, discovery-only rejection) and the OpenSecureChannel error path pass the handle. This covers `opc.tcp`, the Kestrel TCP listener and UA-SC over WebSocket, which all use `TcpServerChannel`. - `EndpointBase.CreateFault`: - new internal overload with a fallback RequestHandle for a request that was not decoded; - the Timestamp is always set; - no longer dereferences a null RequestHeader. - `HttpsTransportListener`: - The JSON path and both JSON-over-WebSocket loops (`opcua+uajson`, OpenAPI) now echo the handle read from the payload. - Discovery-only faults use the handle of the decoded request. ### ⚠️ Behaviour change for reviewers: HTTPS binary A binary HTTPS request the decoder rejects used to get HTTP 500 with a text body and no ServiceFault. It now gets HTTP 200 with a ServiceFault carrying the decoder status and the echoed RequestHandle, the same as the JSON path in the same listener. Other exceptions in that path still return HTTP 500. OPC 10000-6 §7.4 does not specify how an HTTPS server reports an undecodable request. The existing test `SendAsyncReturnsInternalServerErrorForInvalidBodyAsync` was replaced by `SendAsyncRespondsWithServiceFaultForInvalidBodyAsync`. If HTTP 500 should be kept, that hunk can be reverted independently. WebApi REST (`WebApiServer`) already echoed the handle and is unchanged. ### Tests - `RequestHandleReaderTests`: - binary messages above MaxStringLength, with numeric and string authentication tokens, from a byte array and from a stream; - truncated and null input; - JSON field order, decoy `RequestHandle` members, wrong types and malformed JSON; - `CreateFault` fallback and precedence. - `TcpServerChannelBufferTests.UndecodableRequestServiceFaultEchoesRequestHandleAsync`: feeds a ReadRequest with a 640-character NodeId (MaxStringLength 64) through `TcpServerChannel`. It asserts that the sent ServiceFault has `BadEncodingLimitsExceeded`, RequestHandle 4711, the request id and a Timestamp. - `HttpsTransportListenerTests`: the binary ServiceFault for an invalid body, the echoed handle for an oversized binary request, and the echoed handle for an undecodable JSON request. - No unit test covers the two JSON-over-WebSocket loops; the test infrastructure has no WebSocket driver, and the change there is mechanical. Local results (net10.0): - `Opc.Ua.Core.Tests`: 4,669 passed, 0 failed, 88 skipped. - `Opc.Ua.Bindings.Https.WebApi.Tests`: 346 passed. - `Opc.Ua.Client.Tests`: 2,266 passed. `Opc.Ua.Core.Tests` also builds for net48. `dotnet format whitespace --verify-no-changes` passes on the changed files. ## Related Issues - Found while triaging the CTT GDS group in #4481 (`plans/ctt-issues.md` there, "Open server findings"). ## Checklist - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-09-14 18:51:49 +00:00
romanettandClaude Opus 5	37d8716a9b	Fix Like filtering (GDS queries, ContentFilter), QueryServers paging and FindApplications found by the CTT GDS run (#4481 ) Triage of the CTT GDS conformance group (CTT 1.05.06, scripts 1.05.513) against `ConsoleReferenceServer --ctt -a`, which hosts the GDS node manager. The baseline run had 60 errors in 4 CUs. This PR fixes the three server defects behind them and documents the rest in `plans/ctt-issues.md`. ## Server defects fixed \| Defect \| Spec \| CTT tests fixed \| \| --- \| --- \| --- \| \| QueryServers/QueryApplications Like filters: the hand-written tokenizer in `ApplicationsDatabaseBase.Match` returned no records or all records for `%_erver%`, `%e_`, `%\_%`, `%\%%`, `%[q-s]`, `%[^q-s]`, `%_ompliance%`, and accepted the malformed `%[a^j-l]%` \| Part 4 §7.7.3 Table 120 (whole-string match; "The ^ shall be the first character inside on the []"), Part 12 §6.5.10/§6.5.11 \| Application Directory 062, 066, 068, 071, 073 (078 now returns `Bad_InvalidArgument`, see C22); Query Applications 013, 017, 018, 019, 022, 024 \| \| QueryServers used the application id as the `RecordId` of every DiscoveryUrl record, so `StartingRecordId` paging skipped the remaining DiscoveryUrls of an application \| Part 12 §6.5.11 Table 15: one record per DiscoveryUrl \| Application Directory 045, 075 \| \| FindApplications with an empty ApplicationUri returned every registered application \| Part 12 §6.5.4: result size 0 or 1; `Bad_InvalidArgument` for an invalid URI \| Application Directory 004 \| Changes: - `Opc.Ua.LikePattern` (new, `Opc.Ua.Types`) parses, validates and matches Like patterns: `%`, `_`, `\`, `[list]`, ranges, `[^list]` and the legacy `[!list]`. The GDS database and `AliasNameWildcardMatcher` (FindAlias) both use it now. The alias matcher's previous regex translation also accepted `[a^j-l]`. - QueryServers/QueryApplications reject a malformed filter with `Bad_InvalidArgument` and parse each filter once per call (`ValidateQueryServersArguments` / `ValidateQueryApplicationsArguments`). - FindApplications returns `Bad_InvalidArgument` for an empty or blank ApplicationUri. Other unknown strings, including non-URIs, return an empty array: CTT `003.js` calls it with up to MaxStringLength `X` characters and expects Good, and §6.5.4 allows both readings. - `QueryApplications` compared `(int)startingRecordId`, so a StartingRecordId above `int.MaxValue` returned every record. - Every DiscoveryUrl record (`ServerEndpoint`) now has its own monotonically increasing ID, persisted in the JSON database. `JsonApplicationsDatabase.Load` assigns and saves IDs for databases written before this change. A note on 074.js and Query Applications 025.js: both passed before and fail now. Their patterns `%[^f-h]%` / `%[^w-y]%` expect "contains none of f–h", which no Like pattern can express. The old matcher special-cased `[^`, and that quirk is why they passed (C21). ## ContentFilter Like operator `FilterEvaluator` had its own regex translation of Like patterns with the same class of defects: the regex was not anchored (`abc` matched `xxabcxx`), `^` was escaped so the 1.05 negated list `[^13-5]` never worked, and malformed patterns threw from `Regex`. - The Like operator now uses `LikePattern`. An invalid search string matches nothing, so Like resolves to FALSE, as Part 4 §7.7.3 specifies for an operand that cannot be resolved to a string. - `ContentFilterElement.Validate` rejects a malformed literal Like pattern with `Bad_FilterOperandInvalid` for that operand (`Bad_ContentFilterInvalid` for the element), so an event filter with such a pattern is refused when the monitored item is created. Patterns from other operands (for example an AttributeOperand) are only known at evaluation time and evaluate to FALSE. - The regex helpers are removed. No other code in the repository uses `FilterOperator.Like`, and the existing Like tests already assumed whole-string matching. ## Classification of the remaining failures \| Test \| Classification \| Entry \| \| --- \| --- \| --- \| \| Application Directory 060, 067, 069 \| CTT: registers an ApplicationUri containing a raw `%` / `\`, which is not a valid URI \| C19 \| \| Application Directory 065, 060; Query Applications 011, 016 \| CTT: `[_]` / `[%]` evaluated as "contains" \| C20 \| \| Application Directory 074; Query Applications 025 \| CTT: `%[^x-y]%` evaluated as "contains none of" \| C21 \| \| Application Directory 079, 078 \| CTT: `MethodCalls.js:286` reads the output arguments of a failed call (078 now gets the correct `Bad_InvalidArgument` and hits this) \| C22 \| \| Application Directory 018 \| CTT: selects `ActionTimestamp` (BrowseName is `ActionTimeStamp`); the missing event is the queue size issue fixed by #4480 \| C23 \| \| Application Directory 019 \| CTT client: the batched RegisterApplication Call never reaches the server (no server log entry, no service fault); new test shows the server handles the batch \| C24 \| \| Application Directory 010 \| CTT: dereferences the ApplicationId of a `Bad_EntryExists` result \| C25 \| \| Application Directory 012 step 5, 032 \| CTT: requires ServerCapabilities for a Server; Part 12 has no such rule \| C26 \| \| Application Directory 027 \| CTT: updates a Server with an `opc.tcp` DiscoveryUrl to a Client (invalid per Part 12 §6.5.5, Part 4 §7.2) \| C27 \| \| Application Directory 029, 038, 039 \| CTT: expects `Bad_InvalidArgument` where Part 12 defines `Bad_NotFound` \| C28 \| \| Application Directory 005 \| CTT: expects `Bad_InvalidArgument` for a string above MaxStringLength, which cannot be decoded \| C29 \| \| Query Applications 036 \| CTT: expects `rcp+` URLs it never registered \| C30 \| \| Query Applications 038 step 5 \| CTT: applicationType is a mask, `3` = Servers \\| Clients is valid (step 6, max UInt32, already returns `Bad_InvalidArgument`) \| C31 \| \| AliasName Discovery 001, 002, 004 \| Not applicable: GDS AliasName Server Facet (Part 17 Annex C) is not implemented; 001 also sees the reference server's own aliases \| config notes \| \| AliasName Discovery 005–015, LDS-ME Connectivity \| Configuration (AliasName sources / registered LDS) \| config notes \| Which server to target: Application Directory and Query Applications run the same `Opc.Ua.Gds.Server` code on the reference server (in-memory database, clean on every start) and on a dedicated GDS. The dedicated GDS sample keeps a JSON database, and leftover records of earlier runs change every expected record count. The GDS AliasName Discovery CU needs a GDS that implements the facet and should be deselected on both. Spec conflict, server unchanged: Part 12 §6.5.10/§6.5.11 say QueryApplications/QueryServers "shall not return records with a ServerCapabilities that includes NA", but the CTT registers its reference Servers with `NA` and expects them in the results. ## Tests - `LikePatternTests` (Types): Part 4 Table 120 examples, CTT patterns, invalid patterns (93 cases). - `LinqApplicationsDatabaseTests`: paging over multi-URL applications, RecordId after update, JSON reload and legacy databases, CTT filters for QueryServers and QueryApplications, StartingRecordId above `int.MaxValue`, empty FindApplications. - `ApplicationsDatabaseBaseTests`: CTT patterns, invalid filters rejected. - `GdsApplicationDirectoryTests` (live): invalid pattern → `Bad_InvalidArgument` with no output arguments; four RegisterApplication operations in one Call. - `GdsDepthTests.AppDirFindApplicationsEmptyUriAsync` expects `Bad_InvalidArgument`; `AppDirFindApplicationsUnknownNonUriReturnsEmptyAsync` covers the 003.js strings. - `FilterEvaluatorTests` (Core): the Part 4 Table 120 examples through the ContentFilter, whole-string and case-sensitive matching, invalid patterns evaluating to FALSE, and validation of literal patterns (44 cases). ## CTT rerun Same GDS selection, fresh `ConsoleReferenceServer --ctt -a` built from this branch: 47 errors (baseline 60). - Now pass: Application Directory 004, 045, 062, 066, 068, 071, 073, 075; Query Applications 013, 017, 018, 019, 022, 024 (15 errors gone). - Newly fail as expected: Application Directory 074 and Query Applications 025 (C21). - 078 changed from "Good instead of BadInvalidArgument" to the C22 helper abort. - All remaining errors match C19–C31 or the AliasName Discovery note. - Rerun on `4e4fb7f7c` (review fixes, ContentFilter change, lenient FindApplications for non-URI strings): 48 errors. It matches the 47-error run exactly, plus `028.js` missing its audit event (QueueSize 1 flakiness, see C23 / #4480). An intermediate build that rejected every non-URI in FindApplications broke `003.js`, which is why that check was relaxed again. - Patched-script run (recommended fixes of C19, C20, C22, C23, C25, C29 applied to a scratch copy of the CTT project): 41 errors. `010`, `060`, `065`, `067`, `078`, `079`, QA `011`, `016` pass; `018` receives a correct audit event (the validator then trips over another script bug); `005` gets the expected `Bad_EncodingLimitsExceeded` ServiceFault. No further GDS server defect showed up. That ServiceFault carries RequestHandle 0 (Part 4 §7.33 says it should be echoed), a transport-level item left for a separate change. - AliasName group (FindAlias uses `LikePattern` now): 1 error, the known CTT defect in `AliasName Hierarchy/002.js`, unchanged. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-09-14 15:41:13 +00:00
romanettandClaude Opus 5	6313e38a06	Fix Part 13 aggregate status and FindAlias validation defects found by CTT runs (#4478 ) # Description Headless CTT runs (UA 1.05.06, scripts 1.05.513) against `ConsoleReferenceServer --ctt` surfaced server-side defects in the Part 13 aggregate calculators and in the Part 17 FindAlias argument validation. This PR fixes them and documents the CTT workflow and findings. ## Aggregate fixes (`src/Opc.Ua.Server/Aggregates`) - Partial bit on reverse reads. `m_startOfData`/`m_endOfData` followed queue order, which is newest-first when `StartTime > EndTime`, so the start-of-data check tested the wrong end. - Both are now tracked chronologically, and only for values that pass the queue-order check. - The end-of-data check, previously disabled for backward reads for the same reason, now applies in both directions (Part 13 §5.3.3.2). - Time-based status with TreatUncertainAsBad. `GetTimeBasedStatusCode` counted Uncertain regions as neither Good nor Bad when `TreatUncertainAsBad = true`. - They now count as Bad, and the Bad ratio is evaluated before the Good ratio. - A Bad result keeps its aggregate bits, like the Good and Uncertain results (§5.4.3.2.1). - Affects TimeAverage2, Total2, Minimum2, Maximum2, Range2 and the ActualTime2 variants. - DurationGood / DurationBad / PercentGood / PercentBad first region. The first region inherited the status of the interpolated simple bound (e.g. Uncertain when Bad data follows). It now takes the status of the raw value at or before the interval start, or Bad if there is none (§5.4.3.31/32). - WorstQuality2 on backward reads. The start bound was taken at the late time and values were scanned newest-first. A backward interval is now calculated like the forward interval over the same range, with the start bound at the early time (§5.4.2.2, §5.4.3.36). - Behavior change: this reverses the reverse-direction semantics added in #3978. Part 11 §6.5.4.2 can be read as making the late time the interval start, but Part 13 §5.4.2.2 and the CTT oracle agree on the forward-equivalent calculation. The two `StatusAggregateCalculatorTests` cases that encoded the old behavior were updated. - The WorstQuality and WorstQuality2 loop is shared, so backward WorstQuality now also reports the chronologically first of equally severe statuses, like the forward calculation. This is covered by `DirectAndLiveWorstQualityBackwardSelectsChronologicallyFirstStatusAsync`. ## FindAlias argument validation (`src/Opc.Ua.Server/AliasNames`) - Found by: CTT AliasName Base `Err-001.js`–`Err-004.js`. FindAlias returned Good for malformed search strings (`A[`, `A\`, `A\\\`) and for a `HasComponent` ReferenceTypeFilter. - Spec: Part 17 §6.3.2 Table 4 requires `Bad_InvalidArgument` for an invalid search string, and the ReferenceTypeFilter shall be `AliasFor` or one of its subtypes. - Matcher: `AliasNameWildcardMatcher.IsValidPattern` rejects a trailing escape character, an unterminated or empty `[..]` list, and list contents that are not a valid character class (these previously threw). `IsMatch` no longer matches malformed patterns. - Dispatcher: `AliasNameMethodDispatcher` returns `Bad_InvalidArgument` for FindAlias and FindAliasVerbose on an invalid pattern or a non-AliasFor filter. A null filter and `References` still match every alias. ## Tests - Aggregates: - `AggregateCttRegressionTests` gains 18 cases. Each runs the calculator directly and through `HistorianDispatcher` with the in-memory historian. - Covered: the Partial bit forward and backward at the start and end of data; rejected out-of-order values; Minimum2 status with TreatUncertainAsBad true and false; the Duration and Percent first-region case; WorstQuality2 and WorstQuality backward vs forward. - With the aggregate source fixes reverted, every bug-targeted case fails and the controls pass. - FindAlias: new matcher and dispatcher unit tests. The InformationModel integration tests for these cases now require `Bad_InvalidArgument` instead of accepting an empty result. - Local results (net10.0): - `Opc.Ua.Server.Tests` aggregate/historian filter: 848/848. - `Opc.Ua.Server.Tests` AliasName: 147/147. - `Opc.Ua.History.Tests` aggregate/historical access/history client: 263/263. - `Opc.Ua.InformationModel.Tests` Alias: 54 passed, 5 skipped. - `Opc.Ua.Features.Tests` Alias: 11/11. - `Opc.Ua.Client.Tests` AliasName: 28/28. - CTT reruns against the fixed server: - Aggregate errors: 4,560 → 4,226. Server-vs-oracle DataValue mismatches: 10,067 → 9,415. - Every targeted aggregate mismatch pattern is gone, except the new DurationGood/PercentGood rows. Those are a CTT oracle defect, documented as C6. - AliasName Base `Err-001.js`–`Err-004.js` now pass. The remaining Hierarchy `002.js` error is a known CTT defect, Mantis 11262. ## Documentation (`plans/`) - `ctt-testing.md` (new): running the CTT headless against the reference server, generating selection files, reading results, capturing the aggregate values behind failures, and triaging CTT vs server defects. - `ctt-issues.md`: an issue register with the current Mantis status of every filed issue. It adds: - the not-yet-filed CTT defects (C1–C18); - clarification items; - open server findings to investigate (Auditing, A&C Refresh and Comment, GDS Like filters and AliasName Discovery); - CTT project configuration and coverage notes. - Skipped tests caused by sample-data gaps are tracked in #4479. ## Related Issues - Relates to #3978 (earlier CTT aggregate conformance work) and #4479 (CTT coverage gaps). ## Checklist - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [ ] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-09-14 11:26:38 +00:00
romanettandClaude Opus 5	8e874d073b	Revise event monitored item queueSize 0/1 per Part 4 §7.21 (fixes CTT Auditing Connections) (#4480 ) ## Problem CTT Auditing Connections (CTT 1.05.06, scripts 1.05.513, `ConsoleReferenceServer --ctt -a`) fails nondeterministically: - `TestFindActualFromExpected - Unable to Find Entry for ClientAuditEntryId <id>` (011.js, 012.js, 007.js, 020.js, varying by run) - `TestFindActualFromExpected - Unable to Find an Entry for AuditEventType: i=2060` (and i=2069/i=2071), reported as Not Supported ## Root cause The CTT audit subscription (`library/Base/auditThread.js`) monitors `Server.EventNotifier` with the CTT's default `QueueSize = 1` and a 250 ms publishing interval. For event monitored items Part 4 §7.21 defines queueSize 0 as "the Server default" and 1 as "the minimum queue size the Server requires for Event Notifications". `EventManager` only clamped the maximum and `MonitoredItem.InitializeQueue` mapped only 0 to 1000, so 1 became a literal one-entry discard-oldest queue (`RevisedQueueSize = 1`). A single connect raises OpenSecureChannel, CreateSession, ActivateSession and CloseSession audit events within milliseconds, and in `--ctt` mode alarm events share the queue. Every event except the last one raised between two publishes was dropped and replaced by an `EventQueueOverflowEventType`. The audit event content itself was correct. The events that survived carried exactly the `ClientAuditEntryId` the CTT put in `RequestHeader.AuditEntryId`. ## Evidence (instrumented CTT copy logging `Test.Audit.GetBuffer()`) \| Server \| RevisedQueueSize \| CTT buffer \| Auditing group result \| \| --- \| --- \| --- \| --- \| \| master \| 1 \| 16 events, 7 × i=3035 EventQueueOverflow, 0 × OpenSecureChannel (2060), 0 × CloseSession (2069) \| 18 pass, 2 Error + 1 NotSupported (007/020/001) \| \| this PR \| 1000 \| 42 events, no overflow, every expected audit type present \| 21 pass, 0 errors (official project, uninstrumented) \| Each gap in the master buffer is followed by an overflow event. For example, OpenSecureChannel at .553 is overwritten by CreateSession at .617, and CloseSession at 08.307 by CloseSecureChannel at 08.312. ## Fix - `EventManager.CalculateRevisedQueueSize`: requested queueSize 0 and 1 are revised to the new `EventManager.DefaultEventQueueSize` (1000), then limited by `MaxEventQueueSize`/`MaxDurableEventQueueSize`. This applies on create, modify and restore, so `RevisedQueueSize` reports the real size. - `MonitoredItem.InitializeQueue`/`RestoreQueue`: event items with queueSize ≤ 1 use the same default. Previously only 0 did; data change behaviour is unchanged. ## Tests - New `EventManagerTests`: revision of 0/1, clamping to max, modify with 1, and a behavioural test that a 3-event burst on a `QueueSize = 1` item publishes all 3. Before the fix it published 2: the last event plus the overflow event. - `Opc.Ua.Server.Tests`: 5558 passed / 0 failed (net10.0) - `Opc.Ua.Subscriptions.Tests`: 619 passed / 0 failed / 6 skipped (net10.0) - `Opc.Ua.Core.Security.Tests` (Audit filter): 88 passed / 0 failed / 3 skipped 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-09-14 10:15:21 +02:00
romanett Claude Opus 5 Marc Schier	5362ec5e5f	Fix the Opc.Ua.Types defects found by the read-only audit (#4474 ) # Description Fixes the defects a read-only audit reported against `Opc.Ua.Types` at `a05a36055`: 98 of its 99 findings for `Variant`/`TypeInfo`, the identifier types, the four codecs, `NodeState`/`Nodes`, `Schema`/`Utils`/`Polyfills` and the WoT binding, plus 21 further defects found while reviewing those fixes — several of which were regressions the first pass introduced. Every fix carries a regression test that fails without it. `Opc.Ua.Types` is the lowest-level assembly in the stack, so most of these are silent wrong answers in code every other project sits on rather than crashes. ## The higher-impact ones `Variant` equality, hashing and ordering. `ValueEquals` and `CompareTo` — the ContentFilter comparison surface, whose only consumer is `FilterEvaluator` — now convert between numeric built-in types as Part 4 §7.7.3's implicit-conversion and data-precedence rules require. `Variant.Equals` deliberately does not: it stays strict on `BuiltInType`, so it remains consistent with `GetHashCode` and safe as a `Dictionary`/`HashSet` key. `GetHashCode` read `Float`/`Double`/`Enumeration`/`DateTime` through the wrong union field and hashed byte arrays by reference, so equal values hashed apart. Comparing a null variant against a typed one gave a different answer depending on which side it was written on; that is now decided once and symmetrically, and a numeric or boolean zero stays unequal to a null variant — letting it compare equal collapsed both into one bucket of every `Dictionary`/`HashSet` keyed on `Variant`, made `Equals` intransitive, and made a `HashSet`'s count depend on insertion order. `CompareTo` reports an unrelated pair as not comparable instead of ordering it by raw union bits, and the comparison operators now reject that sentinel — reading `int.MinValue` as an ordinary negative result made both `a < b` and `b < a` true, which `OrderBy` detects and throws on. `NodeId.CompareTo` was not transitive. The null case reported "less than" in both directions for every identifier shape except a namespace-zero numeric id, so a `SortedSet<NodeId>` could not find a `NodeId.Null` it had just inserted. Encoding limits. `MaxStringLength` counts the bytes of the encoded string (Part 3 §5.6.4, Part 5 §6.3.2). The XML codecs counted UTF-16 code units, so one message context gave two answers and a string a binary peer rejects survived an XML round trip. The measurement now lives in a single `EncodingLimits` helper, replacing three separate copies across the codecs. The JSON decoder additionally enforces the array, byte-string and string limits it never had — including on the base64 and shorthand spellings that bypassed the checks entirely, so a peer could opt out of a limit just by choosing the other legal encoding. An encoding-limit breach is also no longer downgraded into a successful decode that keeps the raw over-limit body. `Node.Write` threw out of a status-code API. The attribute type gate compared built-in types only, which does not separate a scalar from an array, so an array value passed and the unconditional cast behind it threw `InvalidCastException` out of a method contracted to return a `ServiceResult`. It now compares the value rank too, and the structured permission attributes became writable at all (their data type has no built-in type, so the gate had rejected every value). `CoreUtils.Match`. Rejects an unmatched trailing character without breaking the single-character wildcard — an earlier version of this fix made every pattern ending in `?` return false, which no existing test covered. Spec conformance was checked against Part 3, 4, 5 and 6 for each behavioural change: implicit conversion and data precedence (4 §7.7.3), `NumericRange` BNF (4 §7.27/A.3), `returnDiagnostics` bits (4 §7.32), `MinimumSamplingInterval` as a `Duration` (3 §5.6.2), `ServerIndex` as UInt32 (6 §5.2.2.10), DateTime UTC (6 §5.3.1.6), Union `SwitchField` (6 §5.2.8, §5.3.7, H.10), and the verbose JSON Enumeration form (6 §5.4.4.2). ## Reviewer notes - One deliberate behaviour tightening. XML with more than `MaxStringLength` non-ASCII bytes is now rejected where it previously passed on character count. Nothing in the repo's fixtures trips it, but it is a real narrowing for a deployment with a low `MaxStringLength` and non-ASCII display names. - One finding deliberately left open. `NodeState.Initialize` still does not carry over the optional storage that `CopyTo` copies. It instantiates a node from a prototype rather than cloning it, and propagating the prototype's `RolePermissions` makes the GDS certificate-group nodes unreadable for users that could read them before (`CustomCertificateGroupNodeExistsInAddressSpaceAsync` fails with `BadUserAccessDenied`). Whether an instance inherits its prototype's permissions is a security decision for the address space, so the omission is now documented in place rather than quietly closed. Happy to split it into its own issue. - Nine existing tests were updated because they pinned the buggy behaviour. Each is worth a look: `EqualsWithDifferentNumericTypesReturnsFalse` asserted the opposite of Part 4 §7.7.3 and was renamed with a replacement negative case; `XmlElementGetHashCodeShouldReturnCorrectHashCode` pinned the textual hash that broke the `Equals` contract; the `CompareTo`-versus-null cases in `NodeIdTests`/`ExpandedNodeIdTests` asserted the non-antisymmetric answers; three `DateTimeUtcTests` parse cases depended on the local time zone. - 21 of the fixes (5,558 insertions across 74 files) came out of an adversarial review of the first pass, with each candidate independently verified against the built assembly rather than by inspection — the `Variant` null-equality, `NodeId.CompareTo`, `Node.Write`, `CoreUtils.Match` and JSON-limit items above are all in that group. ## Related Issues No tracking issue exists — this came from an internal read-only audit rather than a reported defect. Happy to open one, or to split the WoT, encoder and `Variant` groups into separate issues if the maintainers prefer that shape for a change this size. - Fixes # ## Checklist _Put an `x` in the boxes that apply. You can complete these step by step after opening the PR._ - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [ ] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. ### Notes on the checklist - Tests: every fix has a regression test; 9 new test files, ~130 new test cases. Several were verified discriminating by temporarily reverting the production line and confirming the test fails. - Warnings: full `UA.slnx` build is clean, and `dotnet format whitespace --verify-no-changes` reports the same 101 pre-existing findings in the same file set as an unmodified worktree at the same commit — none in changed files. - Test runs: all suites were run on net10.0 only, so that box is left unchecked pending a .NET Framework run: Types 10374, Core 4490, Core.Encoders 2929, Core.Schema 157, Configuration 227, Server 5540, Client 2217, Gds 1117, PubSub 1369, WotCon 1496, ComplexTypes 2773, InformationModel 1080, Di 425 — all passing, 0 failures. Two failures in `Core.Diagnostics.Tests` and `OpenUsd.Tests` are pre-existing on master and caused by a German locale decimal separator, confirmed against a clean baseline worktree at the same commit. - Documentation: no separate docs; the new and changed members carry XML doc comments explaining the spec clause behind each behavioural decision. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>	2026-09-14 08:25:02 +02:00
romanettandClaude Opus 5	747f635518	Fix the Opc.Ua.Core defects from the server/core audit (#4475 ) # Description Fixes every `src/Opc.Ua.Core` item found by a twelve-reviewer audit of `src/Opc.Ua.Server` + `src/Opc.Ua.Core` taken at `0e600c0f0`, across all three tiers of that report (security/data-loss/crash, confirmed functional, and reviewer-traced). The `src/Opc.Ua.Server` half of the audit is deliberately out of scope here and remains open. ## Security and resource safety - Explicitly configured trusted certificates were ignored. `CertificateTrustList.TrustedCertificates` (the `<TrustedCertificates>` config element, `SecurityConfiguration.AddTrustedPeer`) never reached the validator, so a peer trusted only that way was rejected with `BadCertificateUntrusted`. The list now travels from configuration through `TrustListEntry` into `TrustListState`, and is consulted both when deciding trust and when completing a chain — OPC 10000-4 6.1.3: "The list of trusted Certificates may contain a Certificate issued to another Application or it may be a Certificate belonging to a CA". The store is still consulted first, so a CA configured both ways keeps its CRL check. Cached validation cores are evicted when a trust list is re-registered, so a reconfiguration actually takes effect. - Unauthenticated receive-buffer leak. `SaveIntermediateChunk` now always takes ownership of the chunk: it either stores it or returns it to the `BufferManager`. A server without a `None` endpoint gives every TCP client a discovery-only channel, and each non-discovery request leaked one `ReceiveBufferSize` buffer. Added `TakeSavedChunks` for the "body already saved" case; passing the chunk again would have queued the same buffer twice. A channel torn down while a multi-chunk message is still arriving now releases what it had buffered, which nothing did before. - Decrypted OpenSecureChannel buffers are returned when verification fails, including the sibling paths where the sequence-number or certificate check rejects the message after the body was handed back. - RSA Diffie-Hellman peer values are validated against `2 <= y <= p-2` (RFC 7919 5.1), so the shared secret can no longer be forced to a known constant by sending 0, 1 or p-1. - `RemovePadding` verified no padding at all for channel messages: the loop started at `data.Offset` and stopped at `paddingSize`, so on any message with a header it ran zero times. The filler loop is corrected — OPC 10000-6 6.7.2.5.1: "The value of each byte of the padding is equal to PaddingSize" — and the signature is now checked before the padding is inspected so the two failures cannot be told apart. - Key material zeroing on the ECC secret path: the plain text, the derived key and IV, and the ECDH shared secret, on both sides. The decrypt wipe covers the failure path too, which is the one that matters — the body is decrypted in place before the signature is verified. - HTTPS responses are read with `ResponseHeadersRead` and bounded by `MaxMessageSize`, instead of the whole body being allocated before the limit was applied. - `X509CertificateStore.IsRevokedAsync` reports an unanswerable revocation check as `BadCertificateRevocationUnknown` instead of throwing. The throw surfaced as an unsuppressible `BadCertificateInvalid` and failed every CA-issued certificate on Linux and macOS. See reviewer note 2. - Certificate handle ownership: `ClientChannelManager` AddRefs what it hands to a transport that disposes it (and releases it again when the channel never opens), `CertificateTrustList` releases the handle `Add` took its own reference to, and `X509CertificateStore` disposes the platform handles nothing else owns. ## Transport - The receive loop is now one atomically swapped epoch of (transport, token), so a reconnect that binds a new socket to an existing channel supersedes the old loop rather than racing it. Previously the supersede path was unguarded and could start two readers on one socket, dispose an in-use `CancellationTokenSource`, and leak one per reconnect. - A reconnect hand-over detaches the transport before closing anything, so the socket the adopted channel now answers on is not closed underneath it. Previously the queued `OpenSecureChannelResponse` failed with `BadConnectionClosed` and reconnect to a dropped channel could never succeed. - A blocked or unservable accepted socket is closed rather than left open until process exit. - An invalid response sequence number reconnects the channel instead of throwing into a handler that did nothing, which left the pending request hanging until timeout. OPC 10000-6 6.7.7 requires the receiver to close the channel, and the same section requires the error to be logged — which `HandleMessageProcessingError` now does instead of discarding it silently. - The abort chunk is encoded against the room the chunk has rather than what it currently holds, so a short offending chunk can still carry the error body (OPC 10000-6 6.7.3). ## Discovery and endpoints - `GetEndpoints` no longer drops the HTTPS and WSS JSON/OpenAPI endpoints, and no longer collapses them onto the binary one (the dedup ignored `TransportProfileUri`). `profileUris` filtering matches them too — OPC 10000-4 5.5.4.2 defines it as the "List of Transport Profile that the returned Endpoints shall support", and a client asking for the JSON profile previously got an empty list back. Results are ordered deterministically with binary first, so a client that takes the first endpoint that fits keeps getting the one it got before these twins were published. ## Smaller confirmed defects `FilterEvaluator.InList` returned after the first string operand; `SelectedUserTokenPolicy` setter always ended at `-1`; `Utils.UpdateExtension` could not delete; a lease holder never stepped down while the shared store was unreachable or hanging; `IsUriHttpRelatedScheme` never matched `http`; `SessionLessServiceMessage` dropped a single `LocaleId`; `GetRandomDouble` used `ToSingle` and typed variant arrays ignored the requested `builtInType`; source-generated log calls never reached the trace file. ## Related Issues - No tracking issue was opened for this work; it derives from an audit report rather than a filed issue. Happy to open one and link it if maintainers prefer. ## Notes for reviewers 1. `MaxRejectedCertificates` semantics. `ICertificateStore.AddRejectedAsync` documented "0 is unlimited", but `DirectoryCertificateStore` wrote every certificate and then deleted all of them at 0 (net effect: store nothing), and `CertificateManager` clamped a negative value onto 0 and depended on that to implement "clear the store". `SharedKeyValueCertificateStore` meanwhile treated 0 as genuinely unlimited, so the two store types did opposite things at the same setting. This PR keeps the existing observable behaviour (0 or less keeps no history and clears what is stored), removes the write-then-delete-all churn, aligns the KV store, and corrects the interface doc and `docs/DependencyInjection.md`. The KV store is the one place whose behaviour changes relative to master. 2. Revocation status where X509Store has no CRLs. `IsRevokedAsync` used to throw there, which surfaced as an unsuppressible `BadCertificateInvalid` and failed every CA-issued certificate on Linux and macOS - the outage the audit flagged. It now returns `BadCertificateRevocationUnknown`, which is what the Windows branch of the same method and a directory store without a CRL already return, and the status `RejectUnknownRevocationStatus` decides on (OPC 10000-4 6.1.3, Find Revocation List). With the default policy the certificate is accepted; an operator who opted into strict mode gets a rejection, as before on master. An earlier revision returned `BadNotSupported`, which the validator discards outright and which made revocation fail open even in strict mode; review caught it. 3. `ManagedChannelKey` gained a `TransportProfileUri` property and an optional trailing constructor parameter. Source-compatible, but it is public API. ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [ ] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. ### Regression test coverage Each of these fails against `master`'s source and passes with the fix. \| Fix \| Test \| \|---\|---\| \| Padding filler bytes were never verified \| `CryptoUtilsSymmetricPaddingTests` — forged filler rejected, plus a round trip over every padding length \| \| Padding removed before the signature was checked \| `CryptoUtilsSymmetricPaddingTests.SymmetricDecryptReportsSignatureFailureAheadOfPadding` \| \| RSA-DH peer value not range checked \| `RsaDiffieHellmanPeerValueTests` — 0, 1, p-1, p, above p, both range boundaries, group mismatch \| \| A degenerate DH nonce threw instead of being rejected \| `UaSCBinaryChannelNonceTests` \| \| `<TrustedCertificates>` never reached the validator \| `CertificateValidationCoreTests` (peer, issuer, and the negative control), `CertificateManagerTests.ExplicitlyTrustedPeerFromConfigurationIsAcceptedAsync` \| \| Cached validation cores survived a trust-list change \| `CertificateManagerTests` — registration after a failed validation, and `UpdateAsync` onto a different store \| \| `MaxRejectedCertificates` normalisation \| `CertificateManagerTests.MaxRejectedCertificatesNormalisesNegativeValues` \| \| `AddRejectedAsync` retention contract \| `RejectedCertificateRetentionTests` — both store types, at zero, negative and a positive cap \| \| PEM rewrite left the old tail behind \| `DirectoryCertificateStoreTests.DeleteFromAMultiCertificatePemFileTruncatesTheFileAsync` \| \| `IsRevokedAsync` threw where CRLs are unsupported \| `CertificateStoreTest.IsRevokedAsyncReportsNotSupportedWithoutCrlSupportAsync` (runs on Linux/macOS, ignored on Windows) \| \| ECC secret left in the caller's buffer \| `EncryptedSecretTests.EccDecryptWipesThePlainTextFromTheCallersBufferOnFailure` \| \| Trust-list read leaked a handle per entry \| `CertificateTrustListHandleTests` \| \| A channel that never opened leaked its certificate \| `ClientChannelManagerHandleTests` \| \| Chunk ownership, CLO double free, chunk-limit teardown \| `TcpServerChannelBufferTests` (4 new) \| \| Receive loop did not follow a replaced transport \| `TcpServerChannelDeterministicTests` (3 new) \| \| HTTPS body unbounded, failures unmapped \| `HttpsTransportChannelResponseTests` (5) \| \| JSON/OpenAPI endpoints dropped, collapsed, or unordered \| `ServerBaseTransportProfileTests` (12) \| \| Channel key ignored the transport profile \| `ClientChannelManagerManagedTests` (2 new) \| \| `SelectedUserTokenPolicy` setter always ended at -1 \| `ConfiguredEndpointTests` (4 new) \| \| `UpdateExtension` could not delete \| `UtilsAdditionalTests` (3 new) \| \| A single `LocaleId` was dropped \| `SessionLessServiceMessageTests` (2 new) \| \| `GetRandomDouble` / typed variant arrays \| `DataGeneratorTests` (4 new) \| \| `TraceLoggerProvider.IsEnabled` short-circuited every log call \| `TraceLoggerProviderTests` (3 new) \| \| A leader never stepped down on an expired lease \| `SharedStoreLeaseElectionTests` (3 new) \| \| `FilterEvaluator.InList`, `IsUriHttpRelatedScheme` \| existing tests corrected in the first commit \| Not covered. The reconnect hand-over ordering, the OpenSecureChannel decrypted-buffer returns, the client-side bad-sequence reconnect, the abort-chunk sizing and the listener closing a blocked socket all need a two-socket reconnect or a full asymmetric OpenSecureChannel exchange, which the deterministic channel harness does not model. They are exercised by the integration suites but not asserted on directly. ## Spec conformance Where a fix has a normative basis I checked it against the published specification rather than only against the audit report: \| Change \| Reference \| \|---\|---\| \| Every padding filler byte is verified \| OPC 10000-6 6.7.2.5.1 — "The value of each byte of the padding is equal to PaddingSize". The loop started at `data.Offset` and stopped at `paddingSize`, so on any message with a header it ran zero times and no filler byte was ever checked. \| \| Signature verified before the padding is inspected \| OPC 10000-6 6.7.2.5.1 — the signature "includes the headers, all Message data, the PaddingSize and the Padding"; 6.7.7 — the chunk "shall not be interpreted until the Message is decrypted and the signature and sequence number verified". \| \| Message-processing errors are logged \| OPC 10000-6 6.7.7 — "the receiver shall log a Bad_SequenceNumberInvalid error", and stacks "shall have a mechanism to log errors when invalid Messages are discarded". The handler was an empty method. \| \| A bad response sequence number reconnects the channel \| OPC 10000-6 6.7.7 — "the receiver shall close the communication channel". It previously threw into that empty handler and the pending request hung until timeout. \| \| The trust list's own certificates are honoured as peers and as issuers \| OPC 10000-4 6.1.3 — "The list of trusted Certificates may contain a Certificate issued to another Application or it may be a Certificate belonging to a CA". \| \| The abort chunk is sized by the chunk's capacity \| OPC 10000-6 6.7.3 — the abort body is `Error` plus a `Reason` string, so a chunk shorter than the error body could not carry it. \| \| JSON/OpenAPI endpoints are published and match `profileUris` \| OPC 10000-4 5.5.4.2 — `profileUris` is the "List of Transport Profile that the returned Endpoints shall support"; a client asking for the JSON profile previously got an empty list. \| \| RSA-DH peer value restricted to `2 <= y <= p-2` \| RFC 7919 5.1, which the finite-field policies are built on. I found no OPC-specific wording for this. \| One point where the spec argues against the current shape is called out in reviewer note 2 below. ### Test runs On net10.0, with `Opc.Ua.Core.Tests` and `Opc.Ua.Security.Certificates.Tests` also run on net48. The remaining suites were not run on the .NET Framework targets locally, so that checklist box stays unchecked. \| Suite \| Result \| \|---\|---\| \| Opc.Ua.Core.Tests (net10.0) \| 4630 passed, 0 failed, 88 skipped \| \| Opc.Ua.Core.Tests (net48) \| 4545 passed, 0 failed, 104 skipped \| \| Opc.Ua.Core.Security.Tests \| 556 passed, 0 failed \| \| Opc.Ua.Security.Certificates.Tests (net10.0) \| 355 passed, 0 failed \| \| Opc.Ua.Security.Certificates.Tests (net48) \| 353 passed, 0 failed \| \| Opc.Ua.Configuration.Tests \| 227 passed, 0 failed \| \| Opc.Ua.Core.Encoders.Tests \| 2929 passed, 0 failed \| \| Opc.Ua.Bindings.Https.WebApi.Tests \| 346 passed, 0 failed \| \| Opc.Ua.Redundancy.Server.Tests \| 783 passed, 0 failed \| \| Opc.Ua.Client.Tests \| 2217 passed, 0 failed \| \| Opc.Ua.Server.Tests \| 5552 passed, 0 failed \| \| Opc.Ua.Sessions.Tests \| 778 passed, 0 failed, 379 skipped \| \| Opc.Ua.Gds.Tests \| 1117 passed, 0 failed \| `Opc.Ua.Sessions.Tests` reports 379 skipped; that is identical to a `master` baseline run in a separate worktree (security policies the platform does not advertise), not a regression from this change. `dotnet format whitespace --verify-no-changes` reports no violations in any file this PR touches. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-09-14 08:22:41 +02:00

1 2 3 4 5 ...