feat(alarms): thread an additive AckTime through the native-alarm mirror

MES alarm-status API §6.4 (docs/plans/2026-06-30-mes-alarm-status-api.md, Phase 1 task 1). MES needs a real AckDT for a triggered alarm, and the mirror carried acked-vs-unacked but never WHEN. AckTime now rides the whole path: DCL transition -> AlarmStateChanged -> gRPC AlarmStateUpdate -> site SQLite. Stamping rule, identical on both protocols: non-null ONLY while the condition is active AND acknowledged. That single predicate yields all three required behaviours -- null while unacked, cleared on re-raise (a re-raise arrives unacknowledged), and no phantom ack on a return-to-normal. The last one is load-bearing for MxGateway, which maps INACTIVE to Acknowledged = true; without the active check every clear would claim an ack the system never observed. Provenance is honest, never fabricated: - OPC UA A&C supplies a TRUE ack instant, so we now select it: AcknowledgeableConditionType/AckedState/TransitionTime at SelectClause index 18, APPENDED so the positional reads at 0-17 keep their meaning. Servers that omit the field fall back to the event's own Time. - MxAccess Gateway supplies none, so the ack transition's own timestamp is used -- accurate to when the system SAW the ack. An ACTIVE_ACKED re-subscribe snapshot restores one from LastTransitionTimestamp rather than dropping it. The decision lives in pure mappers (Opc/Mx AlarmMapper.DeriveAckTime), so it is unit-tested with no live server or gateway. Additive-only throughout: init-only property on AlarmStateChanged, trailing optional positional on NativeAlarmTransition (all 14-arg call sites untouched), proto field 24 (never reusing a number) regenerated via docker/regen-proto.sh sitestream with the csproj diff verified empty. Persistence rides native_alarm_state's existing metadata_json blob rather than a new column -- deliberately. That table is RegisterReplicated in SiteLocalDbSetup and LocalDb builds its CDC triggers from the column list at registration time, so an additive JSON property changes no schema, no triggers and no replication contract; metadata_json is exactly the extension point UA4 introduced for this. Rows written before the field deserialize it as null. Tests: 4 OPC UA + 6 MxGateway mapper cases, 3 NativeAlarmActor (emit, failover rehydrate, pre-AckTime row), 1 proto round-trip incl. the null case, 4 Commons additive/back-compat. The OPC UA SelectClause count lock-in moves 18 -> 19 with an index-18 assertion -- intended, the clause is appended, which is precisely what that guard exists to make visible.
2026-08-01 13:12:04 -04:00
parent 6dc5d94cb9
commit 01bcca992c
19 changed files with 775 additions and 113 deletions
@@ -455,6 +455,99 @@ public class NativeAlarmActorTests : TestKit, IDisposable
        TestLocalDb.DeleteFiles(path);
    }

+    // ── MES alarm-status API §6.4: AckTime through the mirror ──────────────
+
+    [Fact]
+    public void Emit_CarriesTheAdaptersAckTimeVerbatim()
+    {
+        // The DCL adapter already decided whether an ack instant applies; the mirror must
+        // neither invent one for an unacked raise nor drop the one on an ack transition.
+        var instance = CreateTestProbe();
+        var dcl = CreateTestProbe();
+        var actor = Spawn(instance.Ref, dcl.Ref);
+        dcl.ExpectMsg<SubscribeAlarmsRequest>();
+
+        var raisedAt = DateTimeOffset.UtcNow;
+        actor.Tell(new NativeAlarmTransitionUpdate("Opc", Transition(
+            "T01.Hi", AlarmTransitionKind.Raise,
+            new AlarmConditionState(true, false, null, AlarmShelveState.Unshelved, false, 800), raisedAt)));
+        Assert.Null(instance.ExpectMsg<AlarmStateChanged>().AckTime);
+
+        var ackedAt = raisedAt.AddMinutes(2);
+        actor.Tell(new NativeAlarmTransitionUpdate("Opc", new NativeAlarmTransition(
+            "T01.Hi", "T01", "AnalogLimit.Hi", AlarmTransitionKind.Acknowledge,
+            new AlarmConditionState(true, true, null, AlarmShelveState.Unshelved, false, 800),
+            "Process", "hi", "hi", "op1", "ack", null, ackedAt, "92", "90", AckTime: ackedAt)));
+
+        var acked = instance.ExpectMsg<AlarmStateChanged>();
+        Assert.Equal(ackedAt, acked.AckTime);
+        Assert.True(acked.Condition.Acknowledged);
+    }
+
+    [Fact]
+    public async Task Rehydration_RestoresAckTime_SoItSurvivesFailover()
+    {
+        // A failover must not make an acknowledged alarm look freshly unacknowledged: the
+        // ack instant rides metadata_json (see NativeAlarmMetadata) and comes back on the
+        // rehydration emit of a fresh actor over the SAME site database.
+        var instance1 = CreateTestProbe();
+        var dcl1 = CreateTestProbe();
+        var actor1 = SpawnWithFlush(instance1.Ref, dcl1.Ref, TimeSpan.FromMilliseconds(100));
+        dcl1.ExpectMsg<SubscribeAlarmsRequest>();
+
+        var ackedAt = new DateTimeOffset(2026, 8, 1, 12, 0, 0, TimeSpan.Zero);
+        actor1.Tell(new NativeAlarmTransitionUpdate("Opc", new NativeAlarmTransition(
+            "ref-ack", "T01", "HighLevelAlarm", AlarmTransitionKind.Acknowledge,
+            new AlarmConditionState(true, true, null, AlarmShelveState.Unshelved, false, 800),
+            "Process", "desc", "Tank overflow", "op1", "ack", null, DateTimeOffset.UtcNow, "92", "90",
+            AckTime: ackedAt)));
+        instance1.ExpectMsg<AlarmStateChanged>(m => m.AckTime == ackedAt);
+
+        await AwaitAssertAsync(async () =>
+        {
+            var rows = await _storage.GetNativeAlarmsAsync("inst", Source().CanonicalName);
+            Assert.Contains(rows, r => r.MetadataJson != null && r.MetadataJson.Contains("AckTime"));
+        }, TimeSpan.FromSeconds(3));
+
+        var instance2 = CreateTestProbe();
+        var dcl2 = CreateTestProbe();
+        SpawnWithFlush(instance2.Ref, dcl2.Ref, TimeSpan.FromMilliseconds(100));
+
+        var emitted = instance2.FishForMessage<AlarmStateChanged>(
+            m => m.SourceReference == "ref-ack", TimeSpan.FromSeconds(5));
+        Assert.Equal(ackedAt, emitted.AckTime);
+    }
+
+    [Fact]
+    public async Task Rehydration_OfAPreAckTimeRow_LeavesAckTimeNull()
+    {
+        // Rows written before this change carry metadata_json without an AckTime property.
+        // System.Text.Json leaves the missing property at null — "ack time unknown" — rather
+        // than failing the rehydration and discarding the condition.
+        var legacyMetadata = JsonSerializer.Serialize(new
+        {
+            AlarmTypeName = "HighLevelAlarm",
+            Category = "Process",
+            Message = "Tank overflow",
+            CurrentValue = "92",
+            LimitValue = "90"
+        });
+        await _storage.UpsertNativeAlarmAsync(
+            "inst", Source().CanonicalName, "ref-legacy",
+            JsonSerializer.Serialize(
+                new AlarmConditionState(true, true, null, AlarmShelveState.Unshelved, false, 800)),
+            DateTimeOffset.UtcNow, legacyMetadata);
+
+        var instance = CreateTestProbe();
+        var dcl = CreateTestProbe();
+        Spawn(instance.Ref, dcl.Ref);
+
+        var emitted = instance.FishForMessage<AlarmStateChanged>(
+            m => m.SourceReference == "ref-legacy", TimeSpan.FromSeconds(5));
+        Assert.Equal("HighLevelAlarm", emitted.AlarmTypeName); // metadata still restored…
+        Assert.Null(emitted.AckTime);                          // …with no ack time invented
+    }
+
    [Fact]
    public void LostSubscribeResponse_ResendsSubscribe()
    {