feat(runtime): ServerHistorian HistoryRead parallelism/limiter/deadline knobs + node-manager wiring (03/S3)

src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/OtOpcUaServerHostedService.cs

@@ -222,6 +222,13 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
         // section is absent; NodeManager is non-null here (guarded above).
         _server.NodeManager.MaxTieClusterOverfetch = _serverHistorianOptions.MaxTieClusterOverfetch;
 
+        // Propagate the S3 HistoryRead concurrency bounds (arch-review 03/S3): bounded per-node fan-out
+        // within a batch, the process-wide concurrent-batch limiter, and the per-request deadline. Defaults
+        // (4 / 16 / 60 s) survive when the ServerHistorian section is absent.
+        _server.NodeManager.HistoryReadBatchParallelism = _serverHistorianOptions.HistoryReadBatchParallelism;
+        _server.NodeManager.MaxConcurrentHistoryReadBatches = _serverHistorianOptions.MaxConcurrentHistoryReadBatches;
+        _server.NodeManager.HistoryReadDeadline = _serverHistorianOptions.HistoryReadDeadline;
+
         // ServiceLevel publisher needs IServerInternal — only available after Start.
         if (_server.CurrentInstance is { } serverInternal)
         {

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaNodeManager.cs

@@ -197,6 +197,30 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
     /// </summary>
     public int MaxTieClusterOverfetch { get; set; } = 65536;
 
+    /// <summary>
+    ///     Maximum historized nodes served concurrently within one HistoryRead batch (arch-review 03/S3).
+    ///     Mirrors <c>ServerHistorianOptions.HistoryReadBatchParallelism</c>; the Host sets it at
+    ///     <c>StartAsync</c>. <c>≤ 1</c> falls back to sequential serving. The default (4) survives when the
+    ///     ServerHistorian section is absent.
+    /// </summary>
+    public int HistoryReadBatchParallelism { get; set; } = 4;
+
+    /// <summary>
+    ///     Process-wide cap on concurrently-served HistoryRead batches (arch-review 03/S3). A batch that
+    ///     cannot acquire a slot within its (bounded) wait budget fast-fails every handle with
+    ///     <c>BadTooManyOperations</c>. Mirrors <c>ServerHistorianOptions.MaxConcurrentHistoryReadBatches</c>;
+    ///     the Host sets it at <c>StartAsync</c>. The default (16) survives when the section is absent.
+    /// </summary>
+    public int MaxConcurrentHistoryReadBatches { get; set; } = 16;
+
+    /// <summary>
+    ///     Per-request wall-clock deadline for a HistoryRead batch (arch-review 03/S3). A node still in
+    ///     flight at the deadline surfaces <c>BadTimeout</c>. Non-positive = unbounded. Mirrors
+    ///     <c>ServerHistorianOptions.HistoryReadDeadline</c>; the Host sets it at <c>StartAsync</c>. The
+    ///     default (60 s) survives when the section is absent.
+    /// </summary>
+    public TimeSpan HistoryReadDeadline { get; set; } = TimeSpan.FromSeconds(60);
+
     private volatile IHistoryContinuationStore _historyContinuationStore = new SessionHistoryContinuationStore();
 
     /// <summary>

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Historian/ServerHistorianOptions.cs

@@ -68,6 +68,32 @@ public sealed class ServerHistorianOptions
     /// </summary>
     public int MaxTieClusterOverfetch { get; init; } = 65536;
 
+    /// <summary>
+    ///     Maximum number of historized nodes served CONCURRENTLY within one HistoryRead batch (arch-review
+    ///     03/S3). The SDK's <c>HistoryRead*</c> override surface is synchronous, so each arm block-bridges
+    ///     once at its boundary; this bound turns the per-node fan-out inside that boundary from sequential
+    ///     (worst case <c>N × CallTimeout</c>) into <c>⌈N / P⌉ × CallTimeout</c>. It also caps the gateway-load
+    ///     multiplication a single client can command. Default 4.
+    /// </summary>
+    public int HistoryReadBatchParallelism { get; init; } = 4;
+
+    /// <summary>
+    ///     Process-wide limit on the number of HistoryRead batches served CONCURRENTLY (arch-review 03/S3).
+    ///     A flood of history clients degrades to <c>BadTooManyOperations</c> rather than exhausting the SDK
+    ///     request-thread pool. Together with <see cref="HistoryReadBatchParallelism"/> this caps total
+    ///     in-flight gateway reads at <c>MaxConcurrentHistoryReadBatches × HistoryReadBatchParallelism</c>
+    ///     (default 16 × 4 = 64). Default 16.
+    /// </summary>
+    public int MaxConcurrentHistoryReadBatches { get; init; } = 16;
+
+    /// <summary>
+    ///     Per-request wall-clock deadline for a HistoryRead batch (arch-review 03/S3). A single request can
+    ///     no longer hold an SDK request thread longer than this regardless of node count; a node still
+    ///     in flight at the deadline surfaces <c>BadTimeout</c>. Non-positive = unbounded (a
+    ///     <see cref="Validate"/> warning). Default 60 seconds.
+    /// </summary>
+    public TimeSpan HistoryReadDeadline { get; init; } = TimeSpan.FromSeconds(60);
+
     /// <summary>Returns operator-facing misconfiguration warnings for an <c>Enabled</c> historian
     /// (empty when disabled or correctly configured). Pure — the registration logs each entry.
     /// <para>
@@ -100,6 +126,14 @@ public sealed class ServerHistorianOptions
         // so a zero/negative value is harmless (and noise-free) when the historian is disabled.
         if (MaxTieClusterOverfetch <= 0)
             warnings.Add($"ServerHistorian:MaxTieClusterOverfetch is {MaxTieClusterOverfetch} — must be > 0; HistoryRead-Raw cannot page within an oversized tie cluster and will surface BadHistoryOperationUnsupported for those reads.");
+        // S3 HistoryRead concurrency knobs — a non-positive value disables the corresponding bound, so warn
+        // (these gate the per-node fan-out / batch limiter that only run when a real data source is wired).
+        if (HistoryReadBatchParallelism <= 0)
+            warnings.Add($"ServerHistorian:HistoryReadBatchParallelism is {HistoryReadBatchParallelism} — must be > 0; HistoryRead falls back to serving each node sequentially.");
+        if (MaxConcurrentHistoryReadBatches <= 0)
+            warnings.Add($"ServerHistorian:MaxConcurrentHistoryReadBatches is {MaxConcurrentHistoryReadBatches} — must be > 0; the process-wide HistoryRead batch limiter is disabled.");
+        if (HistoryReadDeadline <= TimeSpan.Zero)
+            warnings.Add($"ServerHistorian:HistoryReadDeadline is {HistoryReadDeadline} — must be > 0; HistoryRead requests run unbounded (no per-request deadline).");
         return warnings;
     }
 }