29ee9176a7
feat(site-runtime): wire ConfigFetchRetryCount into the standby replicated-config fetch (UA2)
2026-07-09 01:26:58 -04:00
c457e8f464
feat(site-runtime): cert-trust reconcile-on-join — singleton pushes trusted certs to (re)joining site nodes (UA1)
2026-07-09 01:22:13 -04:00
39976772d9
feat(site-runtime): CertStoreActor exports trusted certs (thumbprint+DER) for node reconciliation (UA1 groundwork)
2026-07-09 01:15:51 -04:00
2efe1a4202
feat(site-runtime): persist native-alarm display metadata so rehydrated conditions render fully (UA4)
2026-07-09 01:09:13 -04:00
326d945d85
perf(site-runtime): coalesce native-alarm mirror persistence into batched flushes (P4)
2026-07-09 01:05:20 -04:00
d2feb92bfd
fix(site-runtime): site SQLite runs WAL with an explicit busy-timeout floor (S8) — concurrent writers stop serializing on the rollback journal
2026-07-09 01:00:12 -04:00
d124025cc7
perf(site-runtime): per-attribute child routing in InstanceActor — attribute changes reach only interested children (P2)
2026-07-09 00:55:26 -04:00
1673268aee
perf(dcl): tag->instances reverse index replaces per-update all-instances scan (P3)
2026-07-09 00:48:22 -04:00
f294b46263
fix(dcl): capture adapter into locals before background tasks — no off-thread reads of the mutable _adapter field (S7)
2026-07-09 00:44:09 -04:00
957db62df1
fix(site-runtime): deployment whose Instance Actor dies during init reports Failed, exactly-once reply (S6)
...
Success now requires BOTH persistence commit AND an InstanceActorInitialized
readiness signal from the actor's PreStart — persistence can commit before the
actor's async init has run or failed, so persistence alone must not report
Success. An actor that dies during init never signals readiness; the Terminated
fallback fails that deployment and rolls back the optimistic state. The
persisted-row rollback is deferred until the store commits so it cannot race the
optimistic write.
Deviation from plan Task 15: the plan's swallow-only guard did not handle the
persistence-first ordering (empirically the store commits before the Terminated
signal, so Success was reported for a dead actor). Added the readiness handshake
to make the join deterministic.
2026-07-09 00:33:40 -04:00
db5ad02cc9
test(site-runtime): harden scheduler OldestBusyAge gauge assertion — assert non-null, not strictly-positive (TickCount64 ~15ms granularity flakes under load)
2026-07-09 00:33:40 -04:00
9343b4f30f
fix(site-runtime): watch every Instance Actor; unexpected termination evicts the dead ref from routing (S6)
2026-07-09 00:20:12 -04:00
2dabbbdde0
fix(site-runtime): retry the startup deployed-config load on SQLite failure (S5) — no more silent zero-instance node
2026-07-09 00:17:36 -04:00
fa556b4f8d
fix(site-runtime): NativeAlarmActor retries a lost subscribe response, not only a failed one (S4)
2026-07-09 00:05:09 -04:00
feb6f34e90
fix(site-runtime): InstanceActor retries failed/lost tag subscriptions per connection (S4/UA6) — closes the unknown-connection ordering race
2026-07-09 00:03:44 -04:00
bd89c1474e
perf(site-runtime): AlarmActor trigger expressions evaluate on the script scheduler (P1)
2026-07-08 23:59:54 -04:00
5aee90d155
perf(site-runtime): ScriptActor trigger expressions evaluate on the script scheduler, coalesced, edge state actor-confined (P1)
2026-07-08 23:50:21 -04:00
467edd74ac
feat(site-runtime): stuck-script watchdog names the script holding a scheduler thread past timeout (S2)
2026-07-08 23:46:48 -04:00
dddafc025e
feat(site-runtime): periodic scheduler-stats reporter feeding site health (S2/UA5)
2026-07-08 23:43:09 -04:00
7d50555fd3
feat(health): additive script-scheduler stats on ISiteHealthCollector + SiteHealthReport (S2/UA5)
2026-07-08 23:37:50 -04:00
474ec8a221
feat(site-runtime): script scheduler gauges — queue depth, busy threads, oldest-busy age (S2/UA5)
2026-07-08 23:35:09 -04:00
b83d1ed19c
fix(site-runtime): site-side compile failure now rejects the deployment per spec (S3) — synchronous validation gate before actor creation
...
Validation runs on the actor thread (not off-thread as the plan sketched): piping
the verdict back to self reorders concurrent deploys relative to each other and to
delete/disable, breaking the redeploy-supersede FIFO ordering (SR020/SR029). A deploy
is an infrequent admin command, so a brief synchronous Roslyn compile is acceptable.
2026-07-08 23:33:48 -04:00
e20c329cad
feat(site-runtime): pure deploy-time compile validator for flattened configs (S3 groundwork)
2026-07-08 23:21:42 -04:00
a8a01f026b
fix(dcl): cancel old event loop + dispose old MxGateway client on reconnect (S1)
2026-07-08 23:19:11 -04:00
11eb5157e6
fix(dcl): dispose+detach previous OPC UA client on reconnect (S1) — stops session leak and stale ConnectionLost flapping
2026-07-08 23:16:27 -04:00
ae94b22d7d
test(reconciliation): pin inclusive (>=) cursor reads at the site (audit + site-calls); EventId/upsert dedup absorbs boundary duplicates
2026-07-08 21:58:57 -04:00
846279f6a8
chore(communication): low-severity cleanup — eviction counting, shared ingest timeout, split app heartbeat interval, doc notes
2026-07-08 21:54:42 -04:00
11c72ecf0f
feat(health): oldest-parked-message age on the site health report (parked-retention aging signal)
2026-07-08 21:49:29 -04:00
0321ad0c20
feat(store-and-forward): peer-join full-buffer resync — standby anti-entropy for the S&F buffer
2026-07-08 21:43:11 -04:00
3eef9d1077
feat(store-and-forward): GetAllMessagesAsync/ReplaceAllAsync storage primitives for standby buffer resync
2026-07-08 21:22:25 -04:00
c6ea332c94
perf(store-and-forward): post audit-observer notifications to an ordered single-reader channel, latency-isolating the sweep
2026-07-08 21:19:59 -04:00
5fe1b9747b
perf(store-and-forward): epoch-ms due-check with additive column, backfill, and (status, due) index
2026-07-08 21:14:26 -04:00
499a37ac78
perf(store-and-forward): enable WAL + per-connection busy_timeout on the S&F SQLite store
2026-07-08 21:01:53 -04:00
7626d5ba34
test(communication): pin wire round-trip + type identity of cross-cluster message contracts
2026-07-08 21:00:02 -04:00
4bdd5f0e4a
fix(notifications): Notify.Send enqueues unbounded (maxRetries 0) and defers to sweep — no 30s script-thread block, no stranding
2026-07-08 20:56:09 -04:00
c3a8576863
fix(notifications): park corrupt buffered notification payloads instead of silently discarding as delivered (supersedes StoreAndForward-018)
2026-07-08 20:48:16 -04:00
05a71a0260
feat(store-and-forward): deferToSweep enqueue mode with immediate sweep kick for latency-sensitive callers
2026-07-08 20:46:08 -04:00
283ce0647c
fix(store-and-forward): standby applies Add/Park/Requeue as upserts so a lost Add self-heals
2026-07-08 20:42:39 -04:00
66cb0febad
fix(communication): replicate heartbeat marks to the peer central node (closes post-failover offline blind window)
2026-07-08 20:11:54 -04:00
59d9cba621
perf(store-and-forward): parallel per-target sweep lanes (cap 4), sequential within lane
2026-07-08 20:07:30 -04:00
1459f9407f
perf(store-and-forward): short-circuit a (category,target) lane after its first transient failure per sweep
2026-07-08 20:06:06 -04:00
1a53b8082a
perf(store-and-forward): bound retry sweep with SweepBatchLimit (default 500) on the due-rows query
2026-07-08 17:45:11 -04:00
e75cd6f3d8
fix(communication): debug-stream teardown/failover unsubscribes via TryGet, never creates or disposes shared channels
2026-07-08 17:43:40 -04:00
70e7dfd7b9
fix(store-and-forward): inline ordered replication dispatch; Warning + counter on replication failures
2026-07-08 17:35:29 -04:00
ca5e79e922
fix(communication): key gRPC client cache by (site, endpoint) so per-session failover cannot dispose shared channels
2026-07-08 17:33:03 -04:00
76c10c5de6
fix(store-and-forward): gate the retry sweep behind an active-node delivery gate (standby must be passive)
2026-07-08 17:30:21 -04:00
48e97fee01
feat(host): exit process on unexpected ActorSystem termination — completes the down-if-alone recovery loop
...
WhenTerminated watchdog calls IHostApplicationLifetime.StopApplication() when
the ActorSystem dies outside StopAsync (SBR self-down + run-coordinated-shutdown-when-down),
so the service supervisor restarts the node as a fresh incarnation. Optional
ctor param keeps every existing construction site compiling.
Plan's deploy/wonder-app-vd03/install.ps1 service-recovery-actions edit is
skipped: that production deploy artifact is not tracked in this repo (Task 16
skipped its appsettings.Central.json for the same reason).
2026-07-08 16:56:24 -04:00
dea69842d5
fix(host): rate-limit dead-letter warnings (10/min + suppression summary); metric counting unchanged
2026-07-08 16:52:25 -04:00
ce66e194a8
feat(cluster): AllowSingleNodeCluster flag — single-seed installs drop the phantom seed
...
Validator lowers the seed-count floor to 1 when AllowSingleNodeCluster is set,
otherwise still requires 2 and points operators at the flag. The plan's
deploy/wonder-app-vd03/appsettings.Central.json edit is skipped: that production
deploy artifact is not tracked in this repo (only its deployment record doc is).
2026-07-08 16:39:12 -04:00
0e3c1df1a7
fix(host): dev site seed no longer targets the metrics port; validator rejects seed-vs-MetricsPort
2026-07-08 16:37:43 -04:00
Joseph Doherty