dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Resolve all 33 medium-severity architecture review findings

Browse Source 
Second slice of the 2026-09-09 whole-system review remediation
(docs/plans/2026-09-09-arch-review.md §10), on top of the High slice 146a1323.

Runtime/devices: SR-2 alarm on-trigger integration scope; SR-3 correlated NativeAlarmActor
subscribe retry; SR-4 immutable audited DB target; SR-5 ordered InstanceActor stop/flush;
SR-12 rehydration fence; SR-13 S&F gate recheck per delivery; DC-4 no OPC UA security
downgrade; DC-5 alarm snapshot for every new subscriber; ORCH-1 sync-dispose joins the pump.

Management/UI: MG-2 site scope on audit tree + Flow Debugger Replay; MG-3 stale-probe memo
removed; MG-4 server-owned bulk-deploy deadline; UI-5 sandbox runs in a killable child
process (new CentralUI.SandboxWorker project); UI-14 bounded sandbox output/IPC.

Edge/audit: EI-1 relay audit ownership; EI-2 SkipBodyCapture suppresses error text; EI-3/EI-11
error-field redaction + caps; EI-4 single relay deadline, pre-execution-only retry; EI-5
authenticated relay provenance; EI-10 body cap before audit read.

Persistence/contracts: DL-1 global Instance.UniqueName unique index + conflict translation;
DL-2 DataConnection protocol config encrypted at rest (migration
20260909203046_EnforceGlobalInstanceNamesAndProtectProtocolConfiguration — coordinated
central upgrade, old binaries cannot read protected rows); DL-3 bounded Replay paging;
DL-6 cross-site Overwrite of a deployed instance rejected; XC-4 proto descriptor contract test.

Config/hygiene: XC-1 central listener isolation by local port; XC-2/XC-3 inert SMTP + cron
keys removed from rig settings; CM-2 env2 bootstrap guard enabled; DC-6 deploy site exit code;
DC-7 notifier retries only explicit standby rejection; XC-5 ClusterClient purged from docs.

Gates recorded in the report: build 0/0, 9 397 passed / 0 failed, rig redeployed on all
eight nodes with the migration applied. 46 Low findings remain open.
This commit is contained in:
Joseph Doherty
2026-09-09 22:05:30 -04:00
parent 146a13238f
commit 9a87d7a328
136 changed files with 5441 additions and 648 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/ZB.MOM.WW.ScadaBridge.SiteRuntime/Actors/InstanceActor.cs
+29 -50
View File
@@ -120,15 +120,9 @@ public class InstanceActor : ReceiveActor
/// </summary>
private readonly Task? _staticStateResetGate;
/// <summary>
/// How long <see cref="PostStop"/> waits for the final coalesced static-override flush to
/// commit. The wait exists so a redeploy's clear is ordered AFTER this actor's last write
/// (arch-review 2026-08-19 P1-2 leg 2) — the Deployment Manager gates the clear on the
/// Terminated signal, which a fire-and-forget flush could outlive and durably resurrect
/// overrides the redeploy had just cleared. Bounded so a wedged SQLite write cannot stall
/// the redeploy indefinitely; exceeding it is logged and the stop proceeds.
/// </summary>
private static readonly TimeSpan FinalStaticOverrideFlushTimeout = TimeSpan.FromSeconds(5);
private Task _staticOverridePersistTail = Task.CompletedTask;
internal sealed record StaticOverridesFlushed(IActorRef Actor, Exception? Error);
/// <summary>
/// Cached string forms of <see cref="QualityCode"/> (perf remediation, arch-review
@@ -437,15 +431,13 @@ public class InstanceActor : ReceiveActor
state.Timer?.Cancel();
_tagSubscribeStates.Clear();
// Final flush of any coalesced static-override writes so a graceful stop does not lose
// the last <= flush-interval of writes (P4 pattern, mirrors NativeAlarmActor.PostStop).
// AWAITED, not fire-and-forget (arch-review 2026-08-19 P1-2 leg 2): a redeploy stops
// this actor, waits for Terminated, and only then clears the static overrides — so a
// detached final flush could commit up to one flush interval of the PREDECESSOR's dirty
// writes AFTER that clear and durably resurrect them. Blocking here is what puts the
// write provably before the Terminated signal the clear is gated on.
// SQLite's async APIs may block synchronously. Persist on the ordered
// thread-pool chain and acknowledge completion separately from Terminated.
_staticOverrideFlushTimer?.Cancel();
WaitForFinalStaticOverrideFlush();
var stoppedActor = Self;
FlushDirtyStaticOverrides(final: true).PipeTo(Context.Parent, Self,
success: () => new StaticOverridesFlushed(stoppedActor, null),
failure: error => new StaticOverridesFlushed(stoppedActor, error));
// Operational `instance_lifecycle` event — instance stopped. An
// instance stops on disable, delete, redeployment, and graceful shutdown;
@@ -659,15 +651,23 @@ public class InstanceActor : ReceiveActor
/// applied) remains authoritative.
/// </summary>
/// <returns>
/// The persist task, so the stop path can order the FINAL flush before termination
/// (<see cref="WaitForFinalStaticOverrideFlush"/>). Every other caller ignores it, keeping
/// The ordered persist task, acknowledged separately from termination so a redeploy
/// can wait for the final commit. Every other caller ignores it, keeping
/// the fire-and-forget semantics unchanged. Completed when there was nothing dirty.
/// </returns>
private Task FlushDirtyStaticOverrides()
private Task FlushDirtyStaticOverrides(bool final = false)
{
_staticOverrideFlushTimer = null;
if (_dirtyStaticOverrides.Count == 0)
return Task.CompletedTask;
return _staticOverridePersistTail;
if (!final && !_staticOverridePersistTail.IsCompleted)
{
// Keep coalescing while SQLite is busy instead of accumulating an
// unbounded task/batch queue behind a stalled transaction.
_staticOverrideFlushTimer = Context.System.Scheduler.ScheduleTellOnceCancelable(
_staticOverrideFlushInterval, Self, FlushStaticOverrides.Instance, Self);
return _staticOverridePersistTail;
}
var batch = _dirtyStaticOverrides
.Select(kv => (AttributeName: kv.Key, Value: kv.Value))
@@ -676,7 +676,14 @@ public class InstanceActor : ReceiveActor
var instanceName = _instanceUniqueName;
var logger = _logger;
var persist = _storage.SetStaticOverridesAsync(instanceName, batch);
var previous = _staticOverridePersistTail;
var persist = Task.Run(async () =>
{
try { await previous.ConfigureAwait(false); }
catch { /* The prior batch was logged; a transient failure must not poison future writes. */ }
await _storage.SetStaticOverridesAsync(instanceName, batch).ConfigureAwait(false);
});
_staticOverridePersistTail = persist;
persist.ContinueWith(t => logger.LogWarning(
t.Exception?.GetBaseException(),
"Failed to persist {Count} static overrides for {Instance}; in-memory state is authoritative",
@@ -685,34 +692,6 @@ public class InstanceActor : ReceiveActor
return persist;
}
/// <summary>
/// Runs the stop-path static-override flush and waits for it to commit, bounded by
/// <see cref="FinalStaticOverrideFlushTimeout"/>. A fault is swallowed — the
/// OnlyOnFaulted continuation inside <see cref="FlushDirtyStaticOverrides"/> has already
/// logged it, and a persist failure must never turn a graceful stop into a crash.
/// </summary>
private void WaitForFinalStaticOverrideFlush()
{
var flush = FlushDirtyStaticOverrides();
if (flush.IsCompleted)
return;
try
{
if (!flush.Wait(FinalStaticOverrideFlushTimeout))
{
_logger.LogWarning(
"Final static-override flush for {Instance} did not complete within {Timeout}; "
+ "stopping anyway — a redeploy's override reset may race it",
_instanceUniqueName, FinalStaticOverrideFlushTimeout);
}
}
catch (Exception)
{
// Already logged by the flush's OnlyOnFaulted continuation.
}
}
/// <summary>
/// Data-sourced attribute write: forwards a write request to the DCL and pipes
/// the device write result back to the caller. The in-memory value is left