fix(client): failover runs under the subscription gate; ConnectAsync refuses when connected

R08 4.5: every subscription operation that awaits I/O and the failover's
teardown + reconnect + replay share one async gate, and every read/write of the
subscription fields (failover's null-outs included) is under _subscriptionLock.
A subscribe in flight when a failover starts is recorded first and then replayed
onto the new session instead of landing on the dying session's subscription. The
dead session is disposed before the gate is taken so a blocked call fails fast.
A DisconnectAsync during a failover is no longer undone by it. ConnectAsync on a
connected or reconnecting client throws instead of overwriting (and leaking) the
live session.

Refs #747
Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

tests/Client/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests/Fakes/FakeSessionAdapter.cs

@@ -167,15 +167,31 @@ internal sealed class FakeSessionAdapter : ISessionAdapter
         return Task.FromResult<IReadOnlyList<DataValue>>(HistoryReadAggregateResponse);
     }
 
+    /// <summary>
+    /// Optional gate that, when set, holds <see cref="CreateSubscriptionAsync" /> open until completed, so a test can keep
+    /// a subscribe in flight while something else (a failover) happens. Signalled via <see cref="CreateSubscriptionEntered" />.
+    /// </summary>
+    public TaskCompletionSource? CreateSubscriptionGate { get; set; }
+
+    /// <summary>Completed when <see cref="CreateSubscriptionAsync" /> is entered while a gate is set.</summary>
+    public TaskCompletionSource CreateSubscriptionEntered { get; } =
+        new(TaskCreationOptions.RunContinuationsAsynchronously);
+
     /// <inheritdoc />
-    public Task<ISubscriptionAdapter> CreateSubscriptionAsync(int publishingIntervalMs, CancellationToken ct)
+    public async Task<ISubscriptionAdapter> CreateSubscriptionAsync(int publishingIntervalMs, CancellationToken ct)
     {
+        if (CreateSubscriptionGate is { } gate)
+        {
+            CreateSubscriptionEntered.TrySetResult();
+            await gate.Task;
+        }
+
         lock (_createdSubscriptions)
         {
             var sub = NextSubscription ?? new FakeSubscriptionAdapter();
             NextSubscription = null;
             _createdSubscriptions.Add(sub);
-            return Task.FromResult<ISubscriptionAdapter>(sub);
+            return sub;
         }
     }
 

tests/Client/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests/OpcUaClientServiceTests.cs

@@ -1446,6 +1446,97 @@ public class OpcUaClientServiceTests : IDisposable
         _service.CurrentConnectionInfo!.EndpointUrl.ShouldBe("opc.tcp://backup:4840");
     }
 
+    /// <summary>
+    /// R08 4.5: a ConnectAsync on an already-connected client is refused instead of overwriting (and leaking) the live
+    /// session. The positive control: after a disconnect the same client connects again.
+    /// </summary>
+    [Fact]
+    public async Task ConnectAsync_WhenAlreadyConnected_IsRefused_AndKeepsTheLiveSession()
+    {
+        var session1 = new FakeSessionAdapter();
+        _sessionFactory.EnqueueSession(session1);
+        await _service.ConnectAsync(ValidSettings());
+
+        await Should.ThrowAsync<InvalidOperationException>(() => _service.ConnectAsync(ValidSettings()));
+
+        _sessionFactory.CreateCallCount.ShouldBe(1);
+        session1.Disposed.ShouldBeFalse();
+        _service.IsConnected.ShouldBeTrue();
+
+        await _service.DisconnectAsync();
+        await _service.ConnectAsync(ValidSettings());
+        _sessionFactory.CreateCallCount.ShouldBe(2);
+        _service.IsConnected.ShouldBeTrue();
+    }
+
+    /// <summary>
+    /// R08 4.5: a SubscribeAsync in flight when a keep-alive failover starts must not be lost. Failover runs under the
+    /// subscription gate, so it waits for the in-flight subscribe to record its item and then replays it onto the new
+    /// session. Before the fix, failover nulled the subscription state outside the lock and finished first; the subscribe
+    /// then completed onto the dying session's subscription and was never replayed.
+    /// </summary>
+    [Fact]
+    public async Task SubscribeAsync_in_flight_during_failover_is_replayed_onto_the_new_session()
+    {
+        var session1 = new FakeSessionAdapter { EndpointUrl = "opc.tcp://primary:4840" };
+        var session2 = new FakeSessionAdapter { EndpointUrl = "opc.tcp://backup:4840" };
+        _sessionFactory.EnqueueSession(session1);
+        _sessionFactory.EnqueueSession(session2);
+        var settings = ValidSettings("opc.tcp://primary:4840");
+        settings.FailoverUrls = ["opc.tcp://backup:4840"];
+        await _service.ConnectAsync(settings);
+
+        var gate = new TaskCompletionSource();
+        session1.CreateSubscriptionGate = gate;
+        var subscribe = _service.SubscribeAsync(new NodeId("ns=2;s=Racer"), 1000);
+        await session1.CreateSubscriptionEntered.Task.WaitAsync(TimeSpan.FromSeconds(10));
+
+        session1.SimulateKeepAlive(false);
+        var failover = _service.LastFailover.ShouldNotBeNull();
+
+        gate.SetResult();
+        await subscribe.WaitAsync(TimeSpan.FromSeconds(10));
+        await failover.WaitAsync(TimeSpan.FromSeconds(10));
+
+        _service.CurrentConnectionInfo!.EndpointUrl.ShouldBe("opc.tcp://backup:4840");
+        var replayed = session2.CreatedSubscriptions.ShouldHaveSingleItem();
+        replayed.AddDataChangeCount.ShouldBe(1);
+
+        // And it is the live subscription: unsubscribing removes it from session2's subscription, not session1's.
+        await _service.UnsubscribeAsync(new NodeId("ns=2;s=Racer"));
+        replayed.RemoveCount.ShouldBe(1);
+        replayed.ActiveHandles.ShouldBeEmpty();
+    }
+
+    /// <summary>
+    /// A DisconnectAsync issued while a failover is still connecting wins: the failover disposes the session it just
+    /// opened instead of resurrecting the connection. The positive control is the plain failover test above, where the
+    /// same gated attempt ends Connected.
+    /// </summary>
+    [Fact]
+    public async Task DisconnectAsync_during_failover_is_not_undone_by_the_failover()
+    {
+        var session1 = new FakeSessionAdapter { EndpointUrl = "opc.tcp://primary:4840" };
+        var session2 = new FakeSessionAdapter { EndpointUrl = "opc.tcp://backup:4840" };
+        _sessionFactory.EnqueueSession(session1);
+        _sessionFactory.EnqueueSession(session2);
+        var settings = ValidSettings("opc.tcp://primary:4840");
+        settings.FailoverUrls = ["opc.tcp://backup:4840"];
+        await _service.ConnectAsync(settings);
+
+        var gate = new TaskCompletionSource();
+        _sessionFactory.CreateGate = gate;
+        session1.SimulateKeepAlive(false);
+        var failover = _service.LastFailover.ShouldNotBeNull();
+
+        await _service.DisconnectAsync();
+        gate.SetResult();
+        await failover.WaitAsync(TimeSpan.FromSeconds(10));
+
+        _service.IsConnected.ShouldBeFalse();
+        session2.Disposed.ShouldBeTrue();
+    }
+
     /// <summary>
     /// Regression for Client.Shared-005: concurrent subscribe/unsubscribe calls mutating the
     /// active-subscription bookkeeping must not corrupt the dictionary or throw.