Files
b409714731 Client: acknowledgement provider model and subscription acknowledgement fixes (#4899)
# Description

Fixes client subscription acknowledgement defects and replaces the
mutable event-based acknowledgement policy with an injectable,
asynchronous provider model. The latest changes in `7be912614` add
opt-in **whole-message delivery**, harden lifecycle/concurrency
behavior, and simplify acknowledgement state and wire-array
construction. Existing features and all deprecations remain in this PR.

The acknowledgement unit is one OPC UA `NotificationMessage`, not one
data change, event, downstream message, or group of Publish responses
indicated by `MoreNotifications`.

### Protocol and lifecycle fixes

- Ensure acknowledgements make progress when fewer acknowledgements are
queued than there are Publish workers.
- Honor legacy deferral on V2 and preserve deferred/in-flight
acknowledgements across retries. A throwing legacy callback restores the
original lists; a throwing provider defers the batch.
- Validate ownership before sending and after provider decisions,
including subscription removal, recreation, changed IDs and server ID
reuse. Reject detected responses from the previous owner before they
advance the replacement subscription's sequence cursor.
- Prune acknowledgements no longer retained by the server, including
servers without a retransmission queue.
- Retire one subscription's acknowledgement state without quiescing
publishing for the whole session.
- Reserve the classic engine's provider-decision slot before invoking
application code. Concurrent Publish calls cannot overwrite pending
decisions; asynchronous failures are observed and logged.
- Preserve the original outstanding lifecycle when a cancelled queue
attempt can still be queued. Retries do not create an additional
terminal outcome.
- Retire internal confirmation state synchronously, independently of
application observer progress. Observer callbacks remain asynchronous
and outside SDK locks.

### Public API and whole-message delivery

| API | Purpose |
|---|---|
| `AcknowledgementHandle` | Process-local acknowledgement identity
scoped to a subscription lifetime; avoids correlating messages solely by
subscription ID and sequence number. |
| `ISubscriptionAcknowledgementProvider` | Asynchronous, fail-closed
send/defer decisions over `ArrayOf<AcknowledgementHandle>`. |
| `ISubscriptionAcknowledgementObserver` | Terminal outcomes:
`Acknowledged`, `NotRetained`, `OwnerRetired`, or `Abandoned`, subject
to the cross-session limitation below. |
| `AcknowledgementMode.AfterConfirmation` /
`ISessionAcknowledgements.Confirm` | Do not acknowledge until the
application explicitly confirms processing of the complete message. |
| `ISubscriptionNotificationMessageHandler` /
`SubscriptionNotificationMessage` | Opt-in delivery of all typed
payloads in one envelope, preserving payload order, physical-partition
identity, publish time and diagnostic string table. |

- Provider configuration is available through `ManagedSessionOptions`,
fluent builder methods and DI registration.
- Whole-message handlers are registered through the V2 subscription APIs
or `Subscription.NotificationMessageHandler` on the classic engine.
Existing load/restore factories can return handlers implementing both
notification interfaces.
- Whole-message handling replaces data/event callbacks only for the
opted-in subscription; keep-alive and lifecycle handling remain
available. Returning from the handler does not implicitly confirm
delivery.
- Projection arrays do not borrow pooled wire notification containers.
Monitored-item references remain live SDK objects.
- Whole-message handlers receive shutdown cancellation before
subscription retirement waits for their dispatch to finish.
- Managed model-change tracking owns a dedicated whole-message
subscription instead of sharing application streaming acknowledgement
ownership. It confirms only after all events succeed; namespace-refresh,
cache-invalidation and subscriber failures remain logged but do not
produce a success confirmation.

### Compatibility and deprecations

The following deprecations remain, with compatibility behavior
preserved:

- `ISession.PublishSequenceNumbersToAcknowledge`: honored when no
provider is configured; not raised when a provider owns the policy.
- Classic `FastDataChangeCallback`, `FastEventCallback`,
`FastKeepAliveCallback` and their delegate types.
- `ISession.DefaultSubscription` and its implementations.

The lifetime proposal from the closed PR #4901 is incorporated through
the provider/handle model rather than additional lifecycle events.

### Simplification and performance scope

- Pending acknowledgements derive owner and generation from their scope
rather than storing redundant copies.
- Wire acknowledgements are projected directly into the final array,
eliminating the intermediate converted list and its extra copy.
- Whole-message envelopes are constructed only for opted-in handlers.
The existing payload-callback path remains available.
- Handles reuse cached subscription-lifetime scopes. Provider callbacks
execute outside SDK locks.

This is not a benchmarked throughput or allocation-parity claim. Broader
lock/contention work, provider-path allocations and benchmark evidence
remain tracked by #4912.

### Known limitations and non-goals

- **#4929 remains open:** classic subscriptions served by the default V2
compatibility bridge do not yet participate in normal acknowledgement
tracking. Supporting the classic engine is not the same as fixing that
bridge.
- **#4930 remains open:** transferring a classic subscription between
different `Session` objects does not yet move tracked
acknowledgements/confirmations between engines. Duplicate terminal
reports or lost confirmations remain possible on that path. In-place
managed-session recreation is a different, supported path.
- Delaying protocol acknowledgement is not itself downstream retry or
durable storage. Applications still own downstream retry/buffering;
server retransmission queues are finite.
- External observer delivery is buffered. Slow observers can grow their
notification backlog, although they no longer retain internal
confirmation state. Disposal waits up to five seconds for callbacks; an
unresponsive observer can outlive disposal.
- HA takeover/session-continuation redesign and server-side
acknowledgement defects are not addressed here.

Documentation: [Subscriptions](docs/Subscriptions.md), [Migration
guide](docs/MigrationGuide.md), and [Model-change
tracking](docs/ModelChangeTracking.md).

### Validation

Local validation of the changes included in `7be912614`:

| Check | Result |
|---|---|
| Expanded net10 client regression selection | **389 passed, 0 failed, 0
skipped** |
| Final API-registration and whole-message-routing selection | **3
passed**; two overlap the regression selection, one is additional (**390
distinct client cases across the runs**) |
| Acknowledgement integration tests | **4 passed**: classic/V2, each
with legacy payload callbacks and whole-message handling |
| `Opc.Ua.Client` net48 build | **0 warnings, 0 errors** |
| Scoped whitespace, style and analyzer verification | Passed, including
informational severity for style/analyzers |
| Negative/revert controls | Tests reproduced the provider race, missing
whole-message routing, observer-dependent cleanup, cancelled-queue
lifecycle loss, shutdown deadlock and false model-change confirmation;
corrections were restored and positive cases passed |

<details>
<summary>Exact local test/build commands and results</summary>

Run from the repository root. Framework-specific assets must be restored
before commands using `--no-restore`; perform the net48 build last
because changing `CustomTestTarget` replaces restored assets.

```powershell
dotnet test tests\Opc.Ua.Client.Tests\Opc.Ua.Client.Tests.csproj -p:CustomTestTarget=net10.0 --framework net10.0 --no-restore --filter "FullyQualifiedName~AcknowledgementProviderTests|FullyQualifiedName~SubscriptionManagerTests|FullyQualifiedName~ClassicSubscriptionEngineTests|FullyQualifiedName~ManagedSessionAcknowledgementForwardingTests|FullyQualifiedName~AcknowledgementOptionsTests|FullyQualifiedName~SubscriptionTests|FullyQualifiedName~ModelChangeTrackerTests|FullyQualifiedName~PartitionForwardingHandlerTests|FullyQualifiedName~SessionEngineContextTests|FullyQualifiedName~DefaultSubscriptionEngineTests|FullyQualifiedName~MonitoredItemManagerTests|FullyQualifiedName~MessageProcessorTests" --logger "console;verbosity=minimal" -v quiet -nologo
# Passed: 389; failed: 0; skipped: 0.

dotnet test tests\Opc.Ua.Client.Tests\Opc.Ua.Client.Tests.csproj -p:CustomTestTarget=net10.0 --framework net10.0 --no-restore --filter "FullyQualifiedName~WholeMessageRegistrationRejectsMissingInputs|FullyQualifiedName~WholeMessageDeliveryPreservesMixedPayloadsAsync" --logger "console;verbosity=minimal" -v quiet -nologo
# Passed: 3; failed: 0; skipped: 0. Two cases overlap the previous selection.

dotnet test tests\Opc.Ua.Subscriptions.Tests\Opc.Ua.Subscriptions.Tests.csproj -p:CustomTestTarget=net10.0 --framework net10.0 --no-restore --filter "FullyQualifiedName~AcknowledgementProviderIntegrationTests" --logger "console;verbosity=minimal" -v quiet -nologo
# Passed: 4; failed: 0; skipped: 0.

dotnet build src\Opc.Ua.Client\Opc.Ua.Client.csproj -p:CustomTestTarget=net48 -p:RestoreSources=https://www.nuget.org/api/v2/ -p:NuGetAudit=false -v quiet -nologo
# Build succeeded: 0 warnings, 0 errors.
```

The v2 feed and disabled NuGet audit above were local restore
workarounds only; repository settings were not changed. CI dependency
auditing remains required.

</details>

The full `UA.slnx` net48/net10 test matrix, NativeAOT publishing/runtime
validation, fresh coverage measurements and performance benchmarks were
**not run locally for this revision**. CI and maintainer API review
remain outstanding. Historical results on `a28c12252` are not presented
as validation of the latest head.

## Related Issues

_If this is a relatively large or complex change, a design must have
been discussed in the related tracking issue and signed off (which
becomes the Architectural Decision Record (ADR))._

- Fixes #4894: acknowledgement progress, deferral/retry behavior and
ownership validation.
- Fixes #4898: injectable fail-closed decision API, with legacy
precedence preserved.
- Fixes #4913: admission of detected old-owner responses after
subscription ID reuse.

Non-closing references:

| Issue | Title / scope | Disposition |
|---|---|---|
| [#4897](https://github.com/OPCFoundation/UA-.NETStandard/issues/4897)
| Stable notification identity and terminal acknowledgement state | Core
functionality is implemented via handles/providers, with whole-message
delivery added. Keep this link non-closing until the cross-session
exception in #4930 is resolved or the issue's accepted scope is
explicitly narrowed. |
| [#4912](https://github.com/OPCFoundation/UA-.NETStandard/issues/4912)
| Reduce acknowledgement-path lock contention and allocations |
Partially advanced by state/projection simplification; broader locking
changes and benchmarks remain. |
| [#4929](https://github.com/OPCFoundation/UA-.NETStandard/issues/4929)
| Classic subscriptions on the V2 compatibility bridge | Not fixed;
separate follow-up. |
| [#4930](https://github.com/OPCFoundation/UA-.NETStandard/issues/4930)
| Cross-session classic acknowledgement handover | Not fixed; separate
follow-up and explicit limitation on terminal-outcome guarantees. |

Design rationale: [maintainer request for injectable providers and
session
facets](https://github.com/OPCFoundation/UA-.NETStandard/pull/4899#discussion_r4366515418).
The new whole-message API is submitted for maintainer review; this
description does not claim that its final API shape or an ADR has been
signed off.

## Checklist

- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.

Regression tests were added and passed; the combined tests/coverage
checkbox is left open because a fresh coverage increase has not yet been
verified.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>
Co-authored-by: Marc <marcschier@hotmail.com>
2026-10-28 13:55:20 +00:00

318 lines
12 KiB
C#

/* ========================================================================
* Copyright (c) 2005-2025 The OPC Foundation, Inc. All rights reserved.
*
* OPC Foundation MIT License 1.00
*
* Permission is hereby granted, free of charge, to any person
* obtaining a copy of this software and associated documentation
* files (the "Software"), to deal in the Software without
* restriction, including without limitation the rights to use,
* copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the
* Software is furnished to do so, subject to the following
* conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
* OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
* HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
* OTHER DEALINGS IN THE SOFTWARE.
*
* The complete license agreement can be found here:
* http://opcfoundation.org/License/MIT/1.00/
* ======================================================================*/
using System;
using System.Collections.Generic;
using System.Threading;
using System.Threading.Tasks;
namespace Opc.Ua.Client.Subscriptions.Fakes
{
/// <summary>
/// Hand-rolled fake for <see cref="IMessageAckQueue"/>. Records every
/// invocation and lets tests override return behaviour via callback
/// fields. Replaces <c>Mock&lt;IMessageAckQueue&gt;</c>.
/// </summary>
internal sealed class FakeMessageAckQueue : IMessageAckQueue
{
/// <summary>
/// An owned snapshot of queued acknowledgements, captured under the queue's mutation lock.
/// </summary>
public List<SubscriptionAcknowledgement> QueuedAcks
{
get
{
lock (m_lock)
{
return [.. m_queuedAcks];
}
}
}
public List<uint> CompletedSubscriptions { get; } = [];
/// <summary>
/// Instances passed to <see cref="CompleteAsync"/>, so tests can
/// assert the subscription is retired by identity and not only by
/// the server assigned id.
/// </summary>
public List<IMessageProcessor> CompletedProcessors { get; } = [];
public int UpdateCalls { get; private set; }
public int PublishingQuiescenceCalls { get; private set; }
/// <summary>
/// Optional override for <see cref="QueueAsync"/>. If null, returns
/// completed.
/// </summary>
public Func<SubscriptionAcknowledgement, CancellationToken, ValueTask>? OnQueueAsync { get; set; }
/// <summary>
/// Optional override for <see cref="CompleteAsync"/>. If null,
/// returns completed.
/// </summary>
public Func<uint, CancellationToken, ValueTask>? OnCompleteAsync { get; set; }
/// <summary>
/// Records an acknowledgement as if a processor had queued it.
/// </summary>
public ValueTask QueueAsync(SubscriptionAcknowledgement ack,
CancellationToken ct = default)
{
return QueueAsync(null, 0, ack, ct);
}
/// <inheritdoc/>
public ValueTask QueueAsync(IMessageProcessor? owner, long generation,
SubscriptionAcknowledgement ack, CancellationToken ct = default)
{
lock (m_lock)
{
m_queuedAcks.Add(ack);
m_queuedGenerations.Add(generation);
}
return OnQueueAsync?.Invoke(ack, ct) ?? default;
}
/// <summary>
/// The sequence numbers whose acknowledgement was tracked before delivery.
/// </summary>
public List<uint> TrackedSequenceNumbers
{
get
{
lock (m_lock)
{
return [.. m_tracked];
}
}
}
/// <inheritdoc/>
public void TrackAcknowledgement(IMessageProcessor owner, long generation, uint sequenceNumber)
{
lock (m_lock)
{
m_tracked.Add(sequenceNumber);
}
}
/// <summary>
/// The owner generation each entry of <see cref="QueuedAcks"/> was stamped with.
/// </summary>
public List<long> QueuedAckGenerations
{
get
{
lock (m_lock)
{
return [.. m_queuedGenerations];
}
}
}
/// <summary>
/// Removes every queued acknowledgement for <paramref name="subscriptionId"/>.
/// </summary>
/// <returns>The number of removed acknowledgements.</returns>
public int ClearQueuedAcks(uint subscriptionId)
{
lock (m_lock)
{
int removed = 0;
for (int i = m_queuedAcks.Count - 1; i >= 0; i--)
{
if (m_queuedAcks[i].SubscriptionId == subscriptionId)
{
m_queuedAcks.RemoveAt(i);
m_queuedGenerations.RemoveAt(i);
removed++;
}
}
return removed;
}
}
/// <summary>
/// Waits until at least <paramref name="count"/> acknowledgements have
/// been queued. The processor under test dispatches a notification
/// before it queues the acknowledgement for it, so a test that only
/// waits for the dispatch races the enqueue that follows it.
/// </summary>
/// <param name="count">
/// The number of queued acknowledgements to wait for.
/// </param>
/// <param name="timeoutMs">How long to wait before giving up.</param>
/// <exception cref="TimeoutException">
/// The acknowledgements did not arrive in time. Failing here rather
/// than returning quietly keeps the diagnosis at the right level: a
/// caller that went on to assert the count would only report the
/// mismatch, which cannot distinguish an acknowledgement that was
/// never queued from one that merely arrived late - and if that
/// assertion is ever loosened, a silent return would hide the race
/// this helper exists to close.
/// </exception>
public async Task WaitForQueuedAckAsync(int count, int timeoutMs = 5000)
{
const int kPollIntervalMs = 10;
var timeout = TimeSpan.FromMilliseconds(timeoutMs);
long start = TimeProvider.System.GetTimestamp();
while (true)
{
int queued;
lock (m_lock)
{
queued = m_queuedAcks.Count;
}
if (queued >= count)
{
return;
}
// Measure against a monotonic clock rather than accumulating
// the poll interval: Task.Delay routinely overshoots, so
// counting the requested interval silently stretches the
// effective timeout well past what the caller asked for.
if (TimeProvider.System.GetElapsedTime(start) >= timeout)
{
throw new TimeoutException(
$"Expected at least {count} queued acknowledgement(s) within " +
$"{timeout.TotalSeconds:0.##}s but only {queued} arrived.");
}
await Task.Delay(kPollIntervalMs).ConfigureAwait(false);
}
}
public ValueTask CompleteAsync(IMessageProcessor subscription,
uint subscriptionId,
CancellationToken ct = default)
{
CompletedProcessors.Add(subscription);
CompletedSubscriptions.Add(subscriptionId);
return OnCompleteAsync?.Invoke(subscriptionId, ct) ?? default;
}
public ValueTask RunWithPublishingQuiescedAsync(
Func<CancellationToken, ValueTask> operation,
CancellationToken ct = default)
{
PublishingQuiescenceCalls++;
return operation(ct);
}
/// <summary>
/// Optional override for <see cref="RunWithSessionAvailableAsync"/>,
/// e.g. to simulate a session that is not available. If null, runs
/// the operation.
/// </summary>
public Func<Func<CancellationToken, ValueTask>, CancellationToken, ValueTask>?
OnRunWithSessionAvailableAsync
{ get; set; }
public ValueTask RunWithSessionAvailableAsync(
Func<CancellationToken, ValueTask> operation,
CancellationToken ct = default)
{
return OnRunWithSessionAvailableAsync?.Invoke(operation, ct) ?? operation(ct);
}
/// <summary>
/// Records the subscription ids dropped via
/// <see cref="DropPendingForSubscription"/> so tests can assert
/// stale-ack pruning happened during recovery.
/// </summary>
public List<uint> DroppedSubscriptions { get; } = [];
public int DropPendingForSubscription(IMessageProcessor owner, uint subscriptionId)
{
// Like the manager, queued entries are not scanned: they fail send-time
// validation because their owner's generation advanced.
DroppedSubscriptions.Add(subscriptionId);
return 0;
}
/// <summary>
/// Ids reported through <see cref="OnSubscriptionCreated"/>.
/// </summary>
public List<uint> CreatedSubscriptions { get; } = [];
/// <summary>
/// Creation times reported through <see cref="OnSubscriptionCreated"/>.
/// </summary>
public List<DateTimeUtc> CreatedAt { get; } = [];
/// <inheritdoc/>
public void OnSubscriptionCreated(IMessageProcessor owner, uint subscriptionId,
DateTimeUtc createdAt = default)
{
CreatedSubscriptions.Add(subscriptionId);
CreatedAt.Add(createdAt);
}
/// <summary>
/// Test-controlled answer for
/// <see cref="IMessageAckQueue.OwnsSubscriptionId"/>. Defaults to
/// <c>true</c>, i.e. the caller still owns the id.
/// </summary>
public Func<IMessageProcessor, uint, bool>? OnOwnsSubscriptionId { get; set; }
/// <summary>
/// Ids <see cref="OwnsSubscriptionId"/> was asked about.
/// </summary>
public List<uint> OwnershipChecks { get; } = [];
public bool OwnsSubscriptionId(IMessageProcessor subscription, uint subscriptionId)
{
OwnershipChecks.Add(subscriptionId);
return OnOwnsSubscriptionId?.Invoke(subscription, subscriptionId) ?? true;
}
public void Update()
{
UpdateCalls++;
}
/// <summary>
/// Test-controlled value for the
/// <see cref="IMessageAckQueue.PoolNotifications"/> setter the
/// subscription dispatcher reads to decide whether to perform the
/// pooled-notification reuse walk.
/// </summary>
public bool PoolNotifications { get; set; }
/// <inheritdoc/>
public CancellationToken ShutdownToken { get; set; }
private readonly Lock m_lock = new();
/// <summary>The queue's mutable storage, accessed only under <see cref="m_lock"/>.</summary>
private readonly List<SubscriptionAcknowledgement> m_queuedAcks = [];
private readonly List<long> m_queuedGenerations = [];
private readonly List<uint> m_tracked = [];
}
}