fix(adminui): snapshot already old at dialog open is stale immediately (#857)

The Controls panel primed its per-node view from the snapshot store with
ReceivedUtc = now, so a node that stopped publishing before the dialog
opened looked live for the first 30 s stale window.

InMemoryDriverStatusSnapshotStore now records each snapshot's LOCAL
receive time (TimeProvider-injectable) and exposes it via
GetAllWithReceiveTime(); the panel primes through the pure seam
DriverStatusByNode.Prime/PrimedReceiveTime, which keeps the store's
receive time (clamped to now; still skew-proof). A store that does not
track one (default interface impl -> null) falls back to the publish
time only when that is already older than the stale window, else now.

Claude-Session: https://claude.ai/code/session_01GT67AD99zQQqpLCVm3p7xk

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/DriverStatusPanel.razor

@@ -274,11 +274,11 @@
         try
         {
             // Subscribe BEFORE priming so a publish racing the read is not missed; a primed copy that lands after
-            // a newer racing live one is dropped by Upsert (it keeps the later PublishedUtc per node).
+            // a newer racing live one is dropped by Upsert (it keeps the later PublishedUtc per node). Primed
+            // copies keep the store's own receive time (#857): stamping them "now" showed a node that stopped
+            // publishing before the dialog opened as live for the first StaleAfter.
             StatusStore.SnapshotChanged += OnSnapshotChanged;
-            var primedUtc = DateTime.UtcNow;
-            foreach (var snap in StatusStore.GetAll())
-                _byNode.Upsert(snap, primedUtc);
+            _byNode.Prime(StatusStore.GetAllWithReceiveTime(), DateTime.UtcNow, StaleAfter);
 
             // Prime + subscribe the resilience store (same in-process read pattern as the health store).
             ResilienceStore.SnapshotChanged += OnResilienceChanged;

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Hosts/DriverStatusByNode.cs

@@ -1,3 +1,4 @@
+using ZB.MOM.WW.OtOpcUa.AdminUI.Hubs;
 using ZB.MOM.WW.OtOpcUa.Commons.Messages.Drivers;
 
 namespace ZB.MOM.WW.OtOpcUa.AdminUI.Hosts;
@@ -67,6 +68,43 @@ public sealed class DriverStatusByNode
         return true;
     }
 
+    /// <summary>
+    ///     Primes the view from the snapshot store's current contents (lmxopcua#857). Each snapshot keeps the
+    ///     store's own receive time (<see cref="PrimedReceiveTime"/>) rather than "now", so a node that stopped
+    ///     publishing before the dialog opened is stale immediately instead of looking live for a full
+    ///     <paramref name="staleAfter"/> window. Returns true when the view changed.
+    /// </summary>
+    /// <param name="stored">The store's entries (<see cref="IDriverStatusSnapshotStore.GetAllWithReceiveTime"/>).</param>
+    /// <param name="nowUtc">The local time the view is primed at.</param>
+    /// <param name="staleAfter">The view's stale window (only used when the store has no receive time).</param>
+    public bool Prime(IEnumerable<StoredDriverHealth> stored, DateTime nowUtc, TimeSpan staleAfter)
+    {
+        var changed = false;
+        foreach (var entry in stored)
+            changed |= Upsert(entry.Snapshot, PrimedReceiveTime(entry, nowUtc, staleAfter));
+        return changed;
+    }
+
+    /// <summary>
+    ///     The receive time a snapshot primed from the store is aged from (lmxopcua#857). Prefers the store's
+    ///     LOCAL receive time — same clock as live updates, so still skew-proof — clamped to
+    ///     <paramref name="nowUtc"/>. A store that does not track receive times falls back to the publisher's
+    ///     <see cref="DriverHealthChanged.PublishedUtc"/> only when that is already older than the stale window
+    ///     (so a long-silent node is stale at once; a peer clock running behind can at worst dim a live row until
+    ///     its next publish), else to <paramref name="nowUtc"/> (the pre-#857 behaviour).
+    /// </summary>
+    /// <param name="stored">The store entry.</param>
+    /// <param name="nowUtc">The local time the view is primed at.</param>
+    /// <param name="staleAfter">The view's stale window.</param>
+    public static DateTime PrimedReceiveTime(StoredDriverHealth stored, DateTime nowUtc, TimeSpan staleAfter)
+    {
+        if (stored.ReceivedUtc is { } received)
+            return received > nowUtc ? nowUtc : received;
+
+        var published = stored.Snapshot.PublishedUtc;
+        return nowUtc - published > staleAfter ? published : nowUtc;
+    }
+
     /// <summary>
     ///     A point-in-time copy of every node's entry, ordered by node id (ordinal, case-insensitive) with the
     ///     unlabelled (pre-#847) entry last.

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Hubs/IDriverStatusSnapshotStore.cs

@@ -27,6 +27,17 @@ public interface IDriverStatusSnapshotStore
     /// <returns>One last-known snapshot per driver instance PER reporting node (lmxopcua#847).</returns>
     IReadOnlyCollection<DriverHealthChanged> GetAll();
 
+    /// <summary>
+    ///     <see cref="GetAll"/> plus, per snapshot, when THIS process stored it (local clock — lmxopcua#857). A
+    ///     consumer that primes a view from the store (the Controls dialog's <c>DriverStatusPanel</c>) needs the
+    ///     snapshot's real age: stamping a primed copy "received now" hid a node that had stopped publishing long
+    ///     before the dialog opened behind a full stale window of apparent freshness. The default implementation
+    ///     reports no receive time (<see langword="null"/>) for a store that does not track one.
+    /// </summary>
+    /// <returns>One entry per (driver instance, reporting node), as <see cref="GetAll"/>.</returns>
+    IReadOnlyCollection<StoredDriverHealth> GetAllWithReceiveTime() =>
+        GetAll().Select(s => new StoredDriverHealth(s, null)).ToArray();
+
     /// <summary>
     ///     Evicts every snapshot whose driver instance is not in <paramref name="configuredInstanceIds"/>
     ///     <b>and</b> whose last publish is older than <paramref name="olderThanUtc"/>. The stores have no other
@@ -53,3 +64,9 @@ public interface IDriverStatusSnapshotStore
     /// </summary>
     event Action<DriverHealthChanged>? SnapshotChanged;
 }
+
+/// <summary>A stored driver-health snapshot and when the store received it (lmxopcua#857).</summary>
+/// <param name="Snapshot">The last-known snapshot.</param>
+/// <param name="ReceivedUtc">When this process's store received it (local clock); <see langword="null"/> when the
+///     store does not track receive times.</param>
+public sealed record StoredDriverHealth(DriverHealthChanged Snapshot, DateTime? ReceivedUtc);

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Hubs/InMemoryDriverStatusSnapshotStore.cs

@@ -16,14 +16,23 @@ namespace ZB.MOM.WW.OtOpcUa.AdminUI.Hubs;
 /// </remarks>
 public sealed class InMemoryDriverStatusSnapshotStore : IDriverStatusSnapshotStore
 {
-    private readonly ConcurrentDictionary<(string DriverInstanceId, string NodeId), DriverHealthChanged> _byInstance = new();
+    // Each entry carries the LOCAL receive time (lmxopcua#857) so a view primed from the store can age a snapshot
+    // from when this process actually got it, not from when the view happened to read it.
+    private readonly ConcurrentDictionary<(string DriverInstanceId, string NodeId), StoredDriverHealth> _byInstance = new();
     private readonly ILogger<InMemoryDriverStatusSnapshotStore>? _logger;
+    private readonly TimeProvider _time;
     private readonly FailureLogThrottle _failureLog = new();
 
     /// <summary>Creates the store.</summary>
     /// <param name="logger">Optional logger for a subscriber that throws during a raise.</param>
-    public InMemoryDriverStatusSnapshotStore(ILogger<InMemoryDriverStatusSnapshotStore>? logger = null)
-        => _logger = logger;
+    /// <param name="time">Clock that stamps each snapshot's local receive time; <see cref="TimeProvider.System"/>
+    ///     when null.</param>
+    public InMemoryDriverStatusSnapshotStore(
+        ILogger<InMemoryDriverStatusSnapshotStore>? logger = null, TimeProvider? time = null)
+    {
+        _logger = logger;
+        _time = time ?? TimeProvider.System;
+    }
 
     /// <summary>Raised whenever a driver status snapshot is stored or updated.</summary>
     public event Action<DriverHealthChanged>? SnapshotChanged;
@@ -33,7 +42,7 @@ public sealed class InMemoryDriverStatusSnapshotStore : IDriverStatusSnapshotSto
     /// <inheritdoc />
     public void Upsert(DriverHealthChanged snapshot)
     {
-        _byInstance[KeyOf(snapshot)] = snapshot;
+        _byInstance[KeyOf(snapshot)] = new StoredDriverHealth(snapshot, _time.GetUtcNow().UtcDateTime);
         // Capture-then-invoke so a concurrent unsubscribe can't null the delegate mid-raise; one
         // subscriber at a time so a throwing one cannot starve the rest (or escape onto the bridge actor).
         SafeMulticast.Invoke(SnapshotChanged, snapshot,
@@ -44,11 +53,11 @@ public sealed class InMemoryDriverStatusSnapshotStore : IDriverStatusSnapshotSto
     public int EvictUnconfiguredStale(IReadOnlySet<string> configuredInstanceIds, DateTime olderThanUtc)
     {
         var removed = 0;
-        foreach (var (key, snapshot) in _byInstance)
+        foreach (var (key, entry) in _byInstance)
         {
-            if (configuredInstanceIds.Contains(key.DriverInstanceId) || snapshot.PublishedUtc >= olderThanUtc) continue;
-            // Remove only the exact snapshot inspected: a fresh publish that raced in is kept.
-            if (_byInstance.TryRemove(new KeyValuePair<(string, string), DriverHealthChanged>(key, snapshot))) removed++;
+            if (configuredInstanceIds.Contains(key.DriverInstanceId) || entry.Snapshot.PublishedUtc >= olderThanUtc) continue;
+            // Remove only the exact entry inspected: a fresh publish that raced in is kept.
+            if (_byInstance.TryRemove(new KeyValuePair<(string, string), StoredDriverHealth>(key, entry))) removed++;
         }
 
         return removed;
@@ -58,8 +67,9 @@ public sealed class InMemoryDriverStatusSnapshotStore : IDriverStatusSnapshotSto
     public bool TryGet(string driverInstanceId, out DriverHealthChanged snapshot)
     {
         DriverHealthChanged? latest = null;
-        foreach (var (key, s) in _byInstance)
+        foreach (var (key, entry) in _byInstance)
         {
+            var s = entry.Snapshot;
             if (!string.Equals(key.DriverInstanceId, driverInstanceId, StringComparison.Ordinal)) continue;
             if (latest is null || s.PublishedUtc > latest.PublishedUtc) latest = s;
         }
@@ -69,5 +79,8 @@ public sealed class InMemoryDriverStatusSnapshotStore : IDriverStatusSnapshotSto
     }
 
     /// <inheritdoc />
-    public IReadOnlyCollection<DriverHealthChanged> GetAll() => _byInstance.Values.ToArray();
+    public IReadOnlyCollection<DriverHealthChanged> GetAll() => _byInstance.Values.Select(e => e.Snapshot).ToArray();
+
+    /// <inheritdoc />
+    public IReadOnlyCollection<StoredDriverHealth> GetAllWithReceiveTime() => _byInstance.Values.ToArray();
 }