dohertj2/lmxopcua
1
0
Fork 0
Code Issues 43 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(mqtt): retry failed SUBSCRIBEs via a pending set; throw on no-verdict subscribe (R06:M-1, M-11)

Browse Source 
A failed SUBSCRIBE (refusal or no broker verdict) used to drop its topic from every
retry set while SubscribeAsync returned a live handle, leaving tags dark behind a
Healthy connection until a redeploy. Failed topics now join a pending set retried by
the next SubscribeAsync and by every reconnect (not counted toward the reconnect's
total-failure verdict, so an ACL-denied topic cannot reconnect-loop). A no-verdict
subscribe degrades its refs then throws so the actor's reconcile re-subscribes. A
subscribe with no transport attached is recorded pending, never established (M-11).
MiniBroker now answers SUBSCRIBE.

Refs #744
Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT
This commit is contained in:
Joseph Doherty
2026-10-22 15:22:17 -04:00
parent 0d49eaf77b
commit 01efd39177
5 changed files with 374 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/MqttSubscriptionManager.cs
+101 -30
View File
@@ -113,6 +113,14 @@ public sealed class MqttSubscriptionManager
/// <summary>Topics already SUBSCRIBEd on the live session — the dedupe set and the re-subscribe set.</summary>
private readonly ConcurrentDictionary<string, byte> _subscribedTopics = new(StringComparer.Ordinal);
/// <summary>
/// Topics a subscribe asked for whose SUBSCRIBE failed (refused, or no verdict at all). Retried by
/// every later <see cref="SubscribeAsync"/> and by <see cref="OnReconnectedAsync"/>; moved to
/// <see cref="_subscribedTopics"/> when granted. Without it a failed topic left every retry set and
/// stayed dark behind a Healthy connection until a redeploy.
/// </summary>
private readonly ConcurrentDictionary<string, byte> _pendingTopics = new(StringComparer.Ordinal);
/// <summary>RawPaths whose extraction failure has already been logged loudly once.</summary>
private readonly ConcurrentDictionary<string, byte> _warnedRefs = new(StringComparer.Ordinal);
@@ -212,8 +220,8 @@ public sealed class MqttSubscriptionManager
/// The manager does not own the connection's lifetime and never detaches — the driver disposes
/// both together. Call once per connection, and <b>before</b> the first
/// <see cref="SubscribeAsync"/>: a subscribe issued with no transport attached records its
/// intent (and warns) but sends nothing to a broker, and would only be established if the
/// connection later dropped and recovered.
/// topics as <i>pending</i> (and warns) but sends nothing to a broker; the next subscribe or
/// reconnect on an attached session retries them.
/// </para>
/// <para>
/// <b>Binding to a session forgets the previous session's established filters</b> — the same
@@ -328,6 +336,14 @@ public sealed class MqttSubscriptionManager
}
}
foreach (var topic in _pendingTopics.Keys)
{
if (!table.ByFilter.ContainsKey(topic))
{
_pendingTopics.TryRemove(topic, out _);
}
}
foreach (var rawPath in _handleByRawPath.Keys)
{
if (!table.ByRawPath.ContainsKey(rawPath))
@@ -356,12 +372,13 @@ public sealed class MqttSubscriptionManager
/// opening SUBSCRIBE itself; <see cref="OnReconnectedAsync"/> only re-establishes it later.
/// </para>
/// <para>
/// <b>Never throws, never hangs.</b> A reference that is not an authored tag is recorded as
/// <c>BadNodeIdUnknown</c>; a SUBACK rejection, transport failure or subscribe deadline
/// degrades exactly the affected references to <c>BadCommunicationError</c>. Either way a
/// handle is returned — the OPC UA server's subscribe call must not fail because one topic
/// is ACL-denied. Recovery for a transient failure comes from the reconnect path;
/// a persistent broker-side refusal is visible as a Bad status on the affected nodes.
/// <b>Never hangs; throws only when the broker gave no verdict.</b> A reference that is not an
/// authored tag is recorded as <c>BadNodeIdUnknown</c>. A SUBACK rejection degrades exactly the
/// affected references to <c>BadCommunicationError</c> and still returns a handle — the OPC UA
/// server's subscribe must not fail because one topic is ACL-denied. A transport failure or
/// subscribe deadline degrades the same way and then <b>throws</b>, so the host holds no handle
/// and its reconcile re-subscribes. Every failed topic also joins a pending set that the next
/// subscribe and every reconnect retry.
/// </para>
/// </remarks>
/// <param name="fullReferences">The RawPath references to subscribe.</param>
@@ -414,12 +431,43 @@ public sealed class MqttSubscriptionManager
// One SUBSCRIBE per distinct topic, and only for topics not already live: re-SUBSCRIBEing an
// established filter is legal but pointless, and it re-triggers the retained seed.
var pending = defs.Where(d => !_subscribedTopics.ContainsKey(d.Topic)).ToList();
await EstablishAsync(BuildFilters(pending, _defaultQos), cancellationToken).ConfigureAwait(false);
// Topics an EARLIER subscribe failed to establish ride along: a redeploy's bulk re-subscribe is then a
// retry of a refusal the broker may since have lifted, instead of a no-op that leaves them dark.
var authored = _authored;
var pending = defs.Where(d => !_subscribedTopics.ContainsKey(d.Topic))
.Concat(PendingDefinitions(authored))
.ToList();
var outcome = await EstablishAsync(BuildFilters(pending, _defaultQos), cancellationToken).ConfigureAwait(false);
if (outcome.TransportFailure is { } failure)
{
// No verdict at all (transport throw / SUBSCRIBE deadline): THROW, so the caller holds no handle
// and DriverInstanceActor's health-tick reconcile re-subscribes. Returning a handle here was the
// silent-death case — the actor thought the subscription live and never retried. The refs already
// carry BadCommunicationError (raised under this handle above), so the throw costs no visibility.
_refsByHandle.TryRemove(handle, out _);
foreach (var def in defs)
{
_handleByRawPath.TryRemove(new KeyValuePair<string, ISubscriptionHandle>(def.Name, handle));
}
throw new InvalidOperationException(
$"MQTT driver '{_driverId}': SUBSCRIBE for {pending.Count} tag(s) got no broker verdict "
+ $"({failure.GetType().Name}); the subscription will be retried.",
failure);
}
// A SUBACK refusal (an ACL denial, say) does NOT throw: the broker answered, the refused topics are
// Bad + pending, and failing the whole subscribe would take every other topic in it dark too.
return handle;
}
/// <summary>The authored definitions behind every still-authored pending topic.</summary>
private IEnumerable<MqttTagDefinition> PendingDefinitions(AuthoredTable authored)
=> _pendingTopics.Keys
.Select(topic => authored.ByFilter.TryGetValue(topic, out var defs) ? defs : [])
.SelectMany(defs => defs);
/// <summary>
/// Stops attributing notifications to <paramref name="handle"/>. References another live
/// subscription also covers keep publishing.
@@ -498,8 +546,13 @@ public sealed class MqttSubscriptionManager
.SelectMany(defs => defs)
.ToList();
var filters = BuildFilters(live, _defaultQos);
if (filters.Count == 0)
// Pending topics (a failed earlier SUBSCRIBE) are retried here too — a reconnect re-subscribing
// only the granted set is how a failed topic stayed dark forever. They do NOT count toward the
// total-failure verdict below: re-refusing a topic that was never live loses nothing, and throwing
// for it would turn one ACL-denied topic into a reconnect loop for the whole driver.
var pendingDefs = PendingDefinitions(authored).ToList();
var filters = BuildFilters(live.Concat(pendingDefs), _defaultQos);
if (live.Count == 0 && pendingDefs.Count == 0)
{
// Silence here is how the wildcard defect hid: no exception, no log, no SUBSCRIBE. Live
// topics resolving to zero filters re-establishes nothing, which is the total-failure case
@@ -519,13 +572,17 @@ public sealed class MqttSubscriptionManager
return;
}
var granted = await EstablishAsync(filters, cancellationToken).ConfigureAwait(false);
if (granted == 0)
var outcome = await EstablishAsync(filters, cancellationToken).ConfigureAwait(false);
var liveTopics = live.Select(d => d.Topic).Distinct(StringComparer.Ordinal).ToList();
var liveLost = outcome.TransportFailure is not null
|| (subscribed.Count > 0 && (liveTopics.Count == 0 || !liveTopics.Any(outcome.Granted.Contains)));
if (liveLost)
{
throw new InvalidOperationException(
$"MQTT driver '{_driverId}': no subscription could be re-established after reconnect "
+ $"({filters.Count} filter(s) requested); tearing the session down rather than serving a "
+ "connection that receives nothing.");
+ "connection that receives nothing.",
outcome.TransportFailure);
}
}
@@ -633,35 +690,35 @@ public sealed class MqttSubscriptionManager
/// </summary>
/// <param name="filters">The filters to establish; an empty list is a no-op.</param>
/// <param name="cancellationToken">Cancellation for the round-trip.</param>
/// <returns>How many filters the broker granted.</returns>
private async Task<int> EstablishAsync(
/// <returns>The granted topics, plus the transport failure when the broker gave no verdict at all.</returns>
private async Task<EstablishOutcome> EstablishAsync(
IReadOnlyList<MqttTopicSubscription> filters,
CancellationToken cancellationToken)
{
if (filters.Count == 0)
{
return 0;
return EstablishOutcome.Nothing;
}
var transport = _transport;
if (transport is null)
{
// No transport: the intent is recorded so the reconnect path establishes it, but NOTHING
// reaches a broker now. Loud, because outside tests this means the composition order is
// wrong — AttachTo must run before the OPC UA server's first subscribe, or these topics
// stay unestablished until the connection happens to drop and recover.
// No transport: NOTHING reaches a broker, so nothing is recorded as subscribed — recording it
// was a silent "subscribed, receives nothing" if the AttachTo-before-subscribe ordering ever
// changed. The topics wait in the pending set, which the next subscribe and every reconnect
// retry. Loud, because outside tests this means the composition order is wrong.
foreach (var filter in filters)
{
_subscribedTopics[filter.Topic] = 0;
_pendingTopics[filter.Topic] = 0;
}
_logger?.LogWarning(
"MQTT driver '{DriverId}': {FilterCount} subscription(s) recorded with no connection attached; "
+ "nothing was sent to a broker. Call AttachTo before subscribing.",
"MQTT driver '{DriverId}': {FilterCount} subscription(s) requested with no connection attached; "
+ "nothing was sent to a broker and they stay pending. Call AttachTo before subscribing.",
_driverId,
filters.Count);
return filters.Count;
return EstablishOutcome.Nothing;
}
IReadOnlyList<MqttSubscribeOutcome> outcomes;
@@ -681,16 +738,17 @@ public sealed class MqttSubscriptionManager
DegradeTopic(filter.Topic, ex.GetType().Name);
}
return 0;
return new EstablishOutcome(new HashSet<string>(StringComparer.Ordinal), ex);
}
var granted = 0;
var granted = new HashSet<string>(StringComparer.Ordinal);
foreach (var outcome in outcomes)
{
if (outcome.Granted)
{
_subscribedTopics[outcome.Topic] = 0;
granted++;
_pendingTopics.TryRemove(outcome.Topic, out _);
granted.Add(outcome.Topic);
}
else
{
@@ -703,7 +761,16 @@ public sealed class MqttSubscriptionManager
}
}
return granted;
return new EstablishOutcome(granted, null);
}
/// <summary>One SUBSCRIBE round-trip's verdict.</summary>
/// <param name="Granted">The filters the broker granted.</param>
/// <param name="TransportFailure">Set when the call produced no verdict at all (throw / deadline).</param>
private sealed record EstablishOutcome(IReadOnlySet<string> Granted, Exception? TransportFailure)
{
public static readonly EstablishOutcome Nothing =
new(new HashSet<string>(StringComparer.Ordinal), null);
}
/// <summary>Marks every authored reference on <paramref name="topic"/> as unreachable.</summary>
@@ -722,6 +789,7 @@ public sealed class MqttSubscriptionManager
if (!_authored.ByFilter.TryGetValue(topic, out var defs))
{
_pendingTopics.TryRemove(topic, out _);
_logger?.LogWarning(
"MQTT driver '{DriverId}': cannot degrade tags for unestablished filter '{Topic}' ({Reason}) — "
+ "no authored tag resolves to it.",
@@ -731,6 +799,9 @@ public sealed class MqttSubscriptionManager
return;
}
// Still authored, so it must be retried — see _pendingTopics.
_pendingTopics[topic] = 0;
var now = DateTime.UtcNow;
var snapshot = new DataValueSnapshot(null, StatusBadCommunicationError, null, now);
foreach (var def in defs)