feat(scripting): bind the Scripting section node-wide and clamp its knobs

Program.cs binds ScriptingOptions from Scripting:* once, clamps every numeric knob through ScriptingOptions.Sanitized (logging a Warning per adjustment) and registers the one instance. It now reaches all three script seams: RoslynVirtualTagEvaluator, the scripted-alarm engine built in DriverHostActor (new trailing Props parameter, wired in WithOtOpcUaRuntimeActors) and every Calculation driver (node options as the base, per-driver config keys override one knob on a copy). ScriptRunGuard sanitizes again in its ctor and computes the stuck threshold with a saturating multiply, so an absurd StuckOrphanQuarantineFactor can no longer throw OverflowException on a refused run. Refs #731 #734 Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT
2026-10-22 14:24:53 -04:00
parent 7bcb6331ed
commit 4615495f01
9 changed files with 338 additions and 23 deletions
@@ -96,9 +96,11 @@ public sealed class ScriptRunGuard
    /// <param name="logger">Where the quarantine Error line goes; null ⇒ Serilog's global logger.</param>
    public ScriptRunGuard(ScriptingOptions? options = null, ILogger? logger = null)
    {
-        options ??= new ScriptingOptions();
+        // Clamped here as well as at the bind site, because options also arrive from a Calculation driver's own
+        // config and from tests. An unclamped factor made the refusal path's timeout * factor overflow.
+        options = (options ?? new ScriptingOptions()).Sanitized(out _);
        _maxAllocBytesPerRun = options.MaxAllocBytesPerRun;
-        _quarantineThreshold = Math.Max(1, options.QuarantineAfterConsecutiveTimeouts);
+        _quarantineThreshold = options.QuarantineAfterConsecutiveTimeouts;
        _stuckFactor = options.StuckOrphanQuarantineFactor;
        _logger = logger ?? Log.Logger;
    }
@@ -197,7 +199,11 @@ public sealed class ScriptRunGuard
            if (_stuckFactor > 0 && Volatile.Read(ref state.RunStartedTimestamp) is var startedAt and not 0)
            {
                var running = Stopwatch.GetElapsedTime(startedAt);
-                var threshold = timeout * _stuckFactor;
+                // Saturating: even the clamped maximum factor times a huge timeout must not overflow TimeSpan.
+                var thresholdTicks = timeout.Ticks * _stuckFactor;
+                var threshold = thresholdTicks >= TimeSpan.MaxValue.Ticks
+                    ? TimeSpan.MaxValue
+                    : TimeSpan.FromTicks((long)thresholdTicks);
                if (running > threshold)
                {
                    Quarantine(key, state,
@@ -53,4 +53,85 @@ public sealed class ScriptingOptions
    ///     refusal. Zero or negative disables the rule. Default 10.
    /// </summary>
    public double StuckOrphanQuarantineFactor { get; set; } = DefaultStuckOrphanQuarantineFactor;
+
+    /// <summary>Upper bound <see cref="Sanitized"/> applies to <see cref="StuckOrphanQuarantineFactor"/>.</summary>
+    public const double MaxStuckOrphanQuarantineFactor = 1000;
+
+    /// <summary>Upper bound <see cref="Sanitized"/> applies to <see cref="QuarantineAfterConsecutiveTimeouts"/>.</summary>
+    public const int MaxQuarantineAfterConsecutiveTimeouts = 1000;
+
+    /// <summary>
+    ///     Lower bound <see cref="Sanitized"/> applies to a positive <see cref="MaxAllocBytesPerRun"/>: 1 MB. A
+    ///     smaller budget would quarantine practically every script on its first run.
+    /// </summary>
+    public const long MinMaxAllocBytesPerRun = 1024L * 1024;
+
+    /// <summary>
+    ///     Returns a copy with every numeric knob pulled into a sane range. The bind site calls it and logs
+    ///     <paramref name="adjustments"/>. <see cref="ScriptRunGuard"/> calls it again, so options that reach the
+    ///     guard by another route (a Calculation driver's own config, a test) are clamped too.
+    ///     <list type="bullet">
+    ///         <item><see cref="StuckOrphanQuarantineFactor"/>: NaN becomes the default, a negative value becomes 0
+    ///         (disabled), and a value above <see cref="MaxStuckOrphanQuarantineFactor"/> becomes that maximum.
+    ///         Unclamped, an absurd factor made <c>timeout * factor</c> throw <see cref="OverflowException"/> on
+    ///         the first refused run.</item>
+    ///         <item><see cref="QuarantineAfterConsecutiveTimeouts"/>: into [1, <see cref="MaxQuarantineAfterConsecutiveTimeouts"/>].</item>
+    ///         <item><see cref="MaxAllocBytesPerRun"/>: a negative value becomes 0 (disabled), and a positive value
+    ///         below <see cref="MinMaxAllocBytesPerRun"/> becomes that minimum.</item>
+    ///     </list>
+    /// </summary>
+    /// <param name="adjustments">One line per value that was out of range, naming its key. A negative value that
+    /// already meant "disabled" is normalised without a line.</param>
+    /// <returns>A new, clamped instance. This instance is not modified.</returns>
+    public ScriptingOptions Sanitized(out IReadOnlyList<string> adjustments)
+    {
+        var notes = new List<string>();
+
+        var factor = StuckOrphanQuarantineFactor;
+        if (double.IsNaN(factor))
+        {
+            notes.Add($"{SectionName}:{nameof(StuckOrphanQuarantineFactor)} is NaN; using the default {DefaultStuckOrphanQuarantineFactor}.");
+            factor = DefaultStuckOrphanQuarantineFactor;
+        }
+        else if (factor < 0)
+        {
+            factor = 0;
+        }
+        else if (factor > MaxStuckOrphanQuarantineFactor)
+        {
+            notes.Add($"{SectionName}:{nameof(StuckOrphanQuarantineFactor)} {factor} is above the maximum; clamped to {MaxStuckOrphanQuarantineFactor}.");
+            factor = MaxStuckOrphanQuarantineFactor;
+        }
+
+        var threshold = QuarantineAfterConsecutiveTimeouts;
+        if (threshold < 1)
+        {
+            notes.Add($"{SectionName}:{nameof(QuarantineAfterConsecutiveTimeouts)} {threshold} is below 1; clamped to 1.");
+            threshold = 1;
+        }
+        else if (threshold > MaxQuarantineAfterConsecutiveTimeouts)
+        {
+            notes.Add($"{SectionName}:{nameof(QuarantineAfterConsecutiveTimeouts)} {threshold} is above the maximum; clamped to {MaxQuarantineAfterConsecutiveTimeouts}.");
+            threshold = MaxQuarantineAfterConsecutiveTimeouts;
+        }
+
+        var alloc = MaxAllocBytesPerRun;
+        if (alloc < 0)
+        {
+            alloc = 0;
+        }
+        else if (alloc > 0 && alloc < MinMaxAllocBytesPerRun)
+        {
+            notes.Add($"{SectionName}:{nameof(MaxAllocBytesPerRun)} {alloc} is below the minimum; clamped to {MinMaxAllocBytesPerRun}.");
+            alloc = MinMaxAllocBytesPerRun;
+        }
+
+        adjustments = notes;
+        return new ScriptingOptions
+        {
+            MaxAllocBytesPerRun = alloc,
+            QuarantineAfterConsecutiveTimeouts = threshold,
+            StuckOrphanQuarantineFactor = factor,
+        };
+    }
 }