Files
b409714731 Client: acknowledgement provider model and subscription acknowledgement fixes (#4899)
# Description

Fixes client subscription acknowledgement defects and replaces the
mutable event-based acknowledgement policy with an injectable,
asynchronous provider model. The latest changes in `7be912614` add
opt-in **whole-message delivery**, harden lifecycle/concurrency
behavior, and simplify acknowledgement state and wire-array
construction. Existing features and all deprecations remain in this PR.

The acknowledgement unit is one OPC UA `NotificationMessage`, not one
data change, event, downstream message, or group of Publish responses
indicated by `MoreNotifications`.

### Protocol and lifecycle fixes

- Ensure acknowledgements make progress when fewer acknowledgements are
queued than there are Publish workers.
- Honor legacy deferral on V2 and preserve deferred/in-flight
acknowledgements across retries. A throwing legacy callback restores the
original lists; a throwing provider defers the batch.
- Validate ownership before sending and after provider decisions,
including subscription removal, recreation, changed IDs and server ID
reuse. Reject detected responses from the previous owner before they
advance the replacement subscription's sequence cursor.
- Prune acknowledgements no longer retained by the server, including
servers without a retransmission queue.
- Retire one subscription's acknowledgement state without quiescing
publishing for the whole session.
- Reserve the classic engine's provider-decision slot before invoking
application code. Concurrent Publish calls cannot overwrite pending
decisions; asynchronous failures are observed and logged.
- Preserve the original outstanding lifecycle when a cancelled queue
attempt can still be queued. Retries do not create an additional
terminal outcome.
- Retire internal confirmation state synchronously, independently of
application observer progress. Observer callbacks remain asynchronous
and outside SDK locks.

### Public API and whole-message delivery

| API | Purpose |
|---|---|
| `AcknowledgementHandle` | Process-local acknowledgement identity
scoped to a subscription lifetime; avoids correlating messages solely by
subscription ID and sequence number. |
| `ISubscriptionAcknowledgementProvider` | Asynchronous, fail-closed
send/defer decisions over `ArrayOf<AcknowledgementHandle>`. |
| `ISubscriptionAcknowledgementObserver` | Terminal outcomes:
`Acknowledged`, `NotRetained`, `OwnerRetired`, or `Abandoned`, subject
to the cross-session limitation below. |
| `AcknowledgementMode.AfterConfirmation` /
`ISessionAcknowledgements.Confirm` | Do not acknowledge until the
application explicitly confirms processing of the complete message. |
| `ISubscriptionNotificationMessageHandler` /
`SubscriptionNotificationMessage` | Opt-in delivery of all typed
payloads in one envelope, preserving payload order, physical-partition
identity, publish time and diagnostic string table. |

- Provider configuration is available through `ManagedSessionOptions`,
fluent builder methods and DI registration.
- Whole-message handlers are registered through the V2 subscription APIs
or `Subscription.NotificationMessageHandler` on the classic engine.
Existing load/restore factories can return handlers implementing both
notification interfaces.
- Whole-message handling replaces data/event callbacks only for the
opted-in subscription; keep-alive and lifecycle handling remain
available. Returning from the handler does not implicitly confirm
delivery.
- Projection arrays do not borrow pooled wire notification containers.
Monitored-item references remain live SDK objects.
- Whole-message handlers receive shutdown cancellation before
subscription retirement waits for their dispatch to finish.
- Managed model-change tracking owns a dedicated whole-message
subscription instead of sharing application streaming acknowledgement
ownership. It confirms only after all events succeed; namespace-refresh,
cache-invalidation and subscriber failures remain logged but do not
produce a success confirmation.

### Compatibility and deprecations

The following deprecations remain, with compatibility behavior
preserved:

- `ISession.PublishSequenceNumbersToAcknowledge`: honored when no
provider is configured; not raised when a provider owns the policy.
- Classic `FastDataChangeCallback`, `FastEventCallback`,
`FastKeepAliveCallback` and their delegate types.
- `ISession.DefaultSubscription` and its implementations.

The lifetime proposal from the closed PR #4901 is incorporated through
the provider/handle model rather than additional lifecycle events.

### Simplification and performance scope

- Pending acknowledgements derive owner and generation from their scope
rather than storing redundant copies.
- Wire acknowledgements are projected directly into the final array,
eliminating the intermediate converted list and its extra copy.
- Whole-message envelopes are constructed only for opted-in handlers.
The existing payload-callback path remains available.
- Handles reuse cached subscription-lifetime scopes. Provider callbacks
execute outside SDK locks.

This is not a benchmarked throughput or allocation-parity claim. Broader
lock/contention work, provider-path allocations and benchmark evidence
remain tracked by #4912.

### Known limitations and non-goals

- **#4929 remains open:** classic subscriptions served by the default V2
compatibility bridge do not yet participate in normal acknowledgement
tracking. Supporting the classic engine is not the same as fixing that
bridge.
- **#4930 remains open:** transferring a classic subscription between
different `Session` objects does not yet move tracked
acknowledgements/confirmations between engines. Duplicate terminal
reports or lost confirmations remain possible on that path. In-place
managed-session recreation is a different, supported path.
- Delaying protocol acknowledgement is not itself downstream retry or
durable storage. Applications still own downstream retry/buffering;
server retransmission queues are finite.
- External observer delivery is buffered. Slow observers can grow their
notification backlog, although they no longer retain internal
confirmation state. Disposal waits up to five seconds for callbacks; an
unresponsive observer can outlive disposal.
- HA takeover/session-continuation redesign and server-side
acknowledgement defects are not addressed here.

Documentation: [Subscriptions](docs/Subscriptions.md), [Migration
guide](docs/MigrationGuide.md), and [Model-change
tracking](docs/ModelChangeTracking.md).

### Validation

Local validation of the changes included in `7be912614`:

| Check | Result |
|---|---|
| Expanded net10 client regression selection | **389 passed, 0 failed, 0
skipped** |
| Final API-registration and whole-message-routing selection | **3
passed**; two overlap the regression selection, one is additional (**390
distinct client cases across the runs**) |
| Acknowledgement integration tests | **4 passed**: classic/V2, each
with legacy payload callbacks and whole-message handling |
| `Opc.Ua.Client` net48 build | **0 warnings, 0 errors** |
| Scoped whitespace, style and analyzer verification | Passed, including
informational severity for style/analyzers |
| Negative/revert controls | Tests reproduced the provider race, missing
whole-message routing, observer-dependent cleanup, cancelled-queue
lifecycle loss, shutdown deadlock and false model-change confirmation;
corrections were restored and positive cases passed |

<details>
<summary>Exact local test/build commands and results</summary>

Run from the repository root. Framework-specific assets must be restored
before commands using `--no-restore`; perform the net48 build last
because changing `CustomTestTarget` replaces restored assets.

```powershell
dotnet test tests\Opc.Ua.Client.Tests\Opc.Ua.Client.Tests.csproj -p:CustomTestTarget=net10.0 --framework net10.0 --no-restore --filter "FullyQualifiedName~AcknowledgementProviderTests|FullyQualifiedName~SubscriptionManagerTests|FullyQualifiedName~ClassicSubscriptionEngineTests|FullyQualifiedName~ManagedSessionAcknowledgementForwardingTests|FullyQualifiedName~AcknowledgementOptionsTests|FullyQualifiedName~SubscriptionTests|FullyQualifiedName~ModelChangeTrackerTests|FullyQualifiedName~PartitionForwardingHandlerTests|FullyQualifiedName~SessionEngineContextTests|FullyQualifiedName~DefaultSubscriptionEngineTests|FullyQualifiedName~MonitoredItemManagerTests|FullyQualifiedName~MessageProcessorTests" --logger "console;verbosity=minimal" -v quiet -nologo
# Passed: 389; failed: 0; skipped: 0.

dotnet test tests\Opc.Ua.Client.Tests\Opc.Ua.Client.Tests.csproj -p:CustomTestTarget=net10.0 --framework net10.0 --no-restore --filter "FullyQualifiedName~WholeMessageRegistrationRejectsMissingInputs|FullyQualifiedName~WholeMessageDeliveryPreservesMixedPayloadsAsync" --logger "console;verbosity=minimal" -v quiet -nologo
# Passed: 3; failed: 0; skipped: 0. Two cases overlap the previous selection.

dotnet test tests\Opc.Ua.Subscriptions.Tests\Opc.Ua.Subscriptions.Tests.csproj -p:CustomTestTarget=net10.0 --framework net10.0 --no-restore --filter "FullyQualifiedName~AcknowledgementProviderIntegrationTests" --logger "console;verbosity=minimal" -v quiet -nologo
# Passed: 4; failed: 0; skipped: 0.

dotnet build src\Opc.Ua.Client\Opc.Ua.Client.csproj -p:CustomTestTarget=net48 -p:RestoreSources=https://www.nuget.org/api/v2/ -p:NuGetAudit=false -v quiet -nologo
# Build succeeded: 0 warnings, 0 errors.
```

The v2 feed and disabled NuGet audit above were local restore
workarounds only; repository settings were not changed. CI dependency
auditing remains required.

</details>

The full `UA.slnx` net48/net10 test matrix, NativeAOT publishing/runtime
validation, fresh coverage measurements and performance benchmarks were
**not run locally for this revision**. CI and maintainer API review
remain outstanding. Historical results on `a28c12252` are not presented
as validation of the latest head.

## Related Issues

_If this is a relatively large or complex change, a design must have
been discussed in the related tracking issue and signed off (which
becomes the Architectural Decision Record (ADR))._

- Fixes #4894: acknowledgement progress, deferral/retry behavior and
ownership validation.
- Fixes #4898: injectable fail-closed decision API, with legacy
precedence preserved.
- Fixes #4913: admission of detected old-owner responses after
subscription ID reuse.

Non-closing references:

| Issue | Title / scope | Disposition |
|---|---|---|
| [#4897](https://github.com/OPCFoundation/UA-.NETStandard/issues/4897)
| Stable notification identity and terminal acknowledgement state | Core
functionality is implemented via handles/providers, with whole-message
delivery added. Keep this link non-closing until the cross-session
exception in #4930 is resolved or the issue's accepted scope is
explicitly narrowed. |
| [#4912](https://github.com/OPCFoundation/UA-.NETStandard/issues/4912)
| Reduce acknowledgement-path lock contention and allocations |
Partially advanced by state/projection simplification; broader locking
changes and benchmarks remain. |
| [#4929](https://github.com/OPCFoundation/UA-.NETStandard/issues/4929)
| Classic subscriptions on the V2 compatibility bridge | Not fixed;
separate follow-up. |
| [#4930](https://github.com/OPCFoundation/UA-.NETStandard/issues/4930)
| Cross-session classic acknowledgement handover | Not fixed; separate
follow-up and explicit limitation on terminal-outcome guarantees. |

Design rationale: [maintainer request for injectable providers and
session
facets](https://github.com/OPCFoundation/UA-.NETStandard/pull/4899#discussion_r4366515418).
The new whole-message API is submitted for maintainer review; this
description does not claim that its final API shape or an ADR has been
signed off.

## Checklist

- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.

Regression tests were added and passed; the combined tests/coverage
checkbox is left open because a fresh coverage increase has not yet been
verified.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>
Co-authored-by: Marc <marcschier@hotmail.com>
2026-10-28 13:55:20 +00:00

242 lines
9.4 KiB
C#

/* ========================================================================
* Copyright (c) 2005-2025 The OPC Foundation, Inc. All rights reserved.
*
* OPC Foundation MIT License 1.00
*
* Permission is hereby granted, free of charge, to any person
* obtaining a copy of this software and associated documentation
* files (the "Software"), to deal in the Software without
* restriction, including without limitation the rights to use,
* copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the
* Software is furnished to do so, subject to the following
* conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
* OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
* HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
* OTHER DEALINGS IN THE SOFTWARE.
*
* The complete license agreement can be found here:
* http://opcfoundation.org/License/MIT/1.00/
* ======================================================================*/
using System;
using System.Collections.Generic;
using System.Threading;
using System.Threading.Tasks;
using Moq;
using Opc.Ua.Client.Subscriptions.MonitoredItems;
namespace Opc.Ua.Client.Subscriptions.Fakes
{
/// <summary>
/// Hand-rolled fake for <see cref="IManagedSubscription"/>. Records
/// every invocation and exposes settable state for ISubscription /
/// IMessageProcessor properties. Replaces
/// <c>Mock&lt;IManagedSubscription&gt;</c>.
/// </summary>
internal sealed class FakeManagedSubscription : IManagedSubscription
{
/// <summary>
/// ISubscription / IMessageProcessor settable state
/// </summary>
public uint Id { get; set; }
/// <inheritdoc/>
public long MessageGeneration { get; set; }
/// <inheritdoc/>
public AcknowledgementScope GetAcknowledgementScope(long generation)
{
return generation == MessageGeneration
? AcknowledgementScope.GetOrCreate(ref m_acknowledgementScope, this, generation, Id)
: new AcknowledgementScope(this, generation, Id);
}
private AcknowledgementScope? m_acknowledgementScope;
public uint ServerId => Id;
public bool Created { get; set; }
public bool IsCreationInProgress
{
get => OnIsCreationInProgress?.Invoke() ?? m_isCreationInProgress;
set => m_isCreationInProgress = value;
}
/// <summary>
/// Optional override for reads of <see cref="IsCreationInProgress"/>,
/// e.g. to complete a creation exactly when the manager checks it.
/// </summary>
public Func<bool>? OnIsCreationInProgress { get; set; }
private bool m_isCreationInProgress;
public bool IsIntentionallyDeleted { get; set; }
public TimeSpan CurrentPublishingInterval { get; set; }
public byte CurrentPriority { get; set; }
public uint CurrentLifetimeCount { get; set; }
public uint CurrentKeepAliveCount { get; set; }
public bool CurrentPublishingEnabled { get; set; }
public uint CurrentMaxNotificationsPerPublish { get; set; }
public IMonitoredItemCollection MonitoredItems { get; set; } = Mock.Of<IMonitoredItemCollection>();
public long MissingMessageCount { get; set; }
public long RepublishMessageCount { get; set; }
/// <summary>
/// Recorded calls
/// </summary>
public int DisposeAsyncCalls { get; private set; }
public int RecreateAsyncCalls { get; private set; }
public int ConditionRefreshAsyncCalls { get; private set; }
public List<bool> NotifySubscriptionManagerPausedCalls { get; } = [];
public List<TryCompleteTransferCall> TryCompleteTransferCalls { get; } = [];
public List<OnPublishReceivedCall> OnPublishReceivedCalls { get; } = [];
/// <summary>
/// Optional overrides for behaviour
/// </summary>
public Func<NotificationMessage, IReadOnlyList<uint>?,
IReadOnlyList<string>, ValueTask>? OnPublishReceivedAsyncFunc
{ get; set; }
public Func<IReadOnlyList<uint>, CancellationToken, ValueTask<bool>>?
OnTryCompleteTransferAsync
{ get; set; }
public Func<CancellationToken, ValueTask>? OnRecreateAsync { get; set; }
public Func<CancellationToken, ValueTask>? OnConditionRefreshAsync { get; set; }
public Func<ValueTask>? OnDisposeAsync { get; set; }
public ValueTask OnPublishReceivedAsync(NotificationMessage message,
IReadOnlyList<uint>? availableSequenceNumbers,
IReadOnlyList<string> stringTable)
{
OnPublishReceivedCalls.Add(new OnPublishReceivedCall(message,
availableSequenceNumbers, stringTable));
return OnPublishReceivedAsyncFunc?.Invoke(message,
availableSequenceNumbers, stringTable) ??
default;
}
public ValueTask<bool> TryCompleteTransferAsync(
IReadOnlyList<uint> availableSequenceNumbers,
CancellationToken ct = default)
{
TryCompleteTransferCalls.Add(new TryCompleteTransferCall(
availableSequenceNumbers));
return OnTryCompleteTransferAsync?.Invoke(availableSequenceNumbers, ct)
?? new ValueTask<bool>(true);
}
public ValueTask RecreateAsync(CancellationToken ct = default)
{
RecreateAsyncCalls++;
return OnRecreateAsync?.Invoke(ct) ?? default;
}
public void NotifySubscriptionManagerPaused(bool paused)
{
NotifySubscriptionManagerPausedCalls.Add(paused);
}
public ValueTask ConditionRefreshAsync(CancellationToken ct = default)
{
ConditionRefreshAsyncCalls++;
return OnConditionRefreshAsync?.Invoke(ct) ?? default;
}
public Func<SubscriptionStateSnapshot>? OnSnapshot { get; set; }
public SubscriptionStateSnapshot Snapshot()
{
return OnSnapshot?.Invoke() ??
SubscriptionStateSnapshot.AsOptions(
new SubscriptionOptions(),
Id,
Array.Empty<uint>().ToArrayOf(),
Array.Empty<MonitoredItemStateSnapshot>().ToArrayOf());
}
public List<SetAsDurableCall> SetAsDurableCalls { get; } = [];
public Func<TimeSpan, CancellationToken, ValueTask<TimeSpan>>? OnSetAsDurableAsync
{ get; set; }
public ValueTask<TimeSpan> SetAsDurableAsync(
TimeSpan lifetime,
CancellationToken ct = default)
{
SetAsDurableCalls.Add(new SetAsDurableCall(lifetime));
return OnSetAsDurableAsync?.Invoke(lifetime, ct)
?? new ValueTask<TimeSpan>(lifetime);
}
public ValueTask<TimeSpan> SetAsDurableAsync(
Func<TimeSpan?> lifetime,
CancellationToken ct = default)
{
TimeSpan? current = lifetime();
return current == null
? new ValueTask<TimeSpan>(TimeSpan.Zero)
: SetAsDurableAsync(current.Value, ct);
}
public List<SetTriggeringCall> SetTriggeringCalls { get; } = [];
public Func<IMonitoredItem, IReadOnlyCollection<IMonitoredItem>?,
IReadOnlyCollection<IMonitoredItem>?, CancellationToken,
ValueTask<SetTriggeringResult>>? OnSetTriggeringAsync
{ get; set; }
public ValueTask<SetTriggeringResult> SetTriggeringAsync(
IMonitoredItem triggeringItem,
IReadOnlyCollection<IMonitoredItem>? linksToAdd = null,
IReadOnlyCollection<IMonitoredItem>? linksToRemove = null,
CancellationToken ct = default)
{
SetTriggeringCalls.Add(new SetTriggeringCall(
triggeringItem, linksToAdd, linksToRemove));
if (OnSetTriggeringAsync != null)
{
return OnSetTriggeringAsync(triggeringItem,
linksToAdd, linksToRemove, ct);
}
return new ValueTask<SetTriggeringResult>(new SetTriggeringResult(
triggeringItem,
[],
[],
StatusCodes.Good));
}
public ValueTask DisposeAsync()
{
DisposeAsyncCalls++;
return OnDisposeAsync?.Invoke() ?? default;
}
internal readonly record struct OnPublishReceivedCall(
NotificationMessage Message,
IReadOnlyList<uint>? AvailableSequenceNumbers,
IReadOnlyList<string> StringTable);
internal readonly record struct TryCompleteTransferCall(
IReadOnlyList<uint> AvailableSequenceNumbers);
internal readonly record struct SetTriggeringCall(
IMonitoredItem TriggeringItem,
IReadOnlyCollection<IMonitoredItem>? LinksToAdd,
IReadOnlyCollection<IMonitoredItem>? LinksToRemove);
internal readonly record struct SetAsDurableCall(
TimeSpan Lifetime);
}
}