From 4d549571cce86d9c4b0c5110d8df45901466541a Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Mon, 10 Aug 2026 08:29:03 -0400 Subject: [PATCH] =?UTF-8?q?docs(deferment):=20eighth=20round=20=E2=80=94?= =?UTF-8?q?=20all=2032=20recorded-Open=20review=20findings=20resolved,=20f?= =?UTF-8?q?leet-wide=200=20pending?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- deferment.md | 58 +++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 57 insertions(+), 1 deletion(-) diff --git a/deferment.md b/deferment.md index 7243f1f9..42af16c7 100644 --- a/deferment.md +++ b/deferment.md @@ -59,7 +59,7 @@ So everything below is **untracked work**. Nothing in it is a data-loss or outag | ~~**3 carried-open archreview findings** — the failure-visibility trio~~ **Update 2026-08-07 (truth sweep): mostly CLOSED.** 01/S-1 **FIXED** — `AddressSpaceApplier.cs:95-97` tallies swallowed removal-pass failures into `AddressSpaceApplyOutcome.FailedNodes` (comment cites 01/S-1). 03/S4 **FIXED** — `PrimaryGatePolicy.cs` default-denies on unknown role when a driver peer exists (doc-comment "Fixes archreview 03/S4"), live-proven R2-04 T15. 06/S-1 **PARTIAL** — fail-closed advise path + `galaxy.writes.unconfirmed` meter shipped in `GatewayGalaxyDataWriter.cs`; residual = gateway-side WriteComplete correlation (cross-repo, mxaccessgw). **Update 2026-08-09: the gateway half SHIPPED** — mxaccessgw main `b948e69` correlates the worker's `OnWriteComplete` onto the unary `WriteSecured` reply (`statuses[0]`; bounded wait default **1.5 s** — deliberately under OtOpcUa's 2 s Tier A Write budget, configurable via `MxGateway:Worker:WriteCompletionWaitMilliseconds`; timeout falls back to today's empty-statuses shape, still metered unconfirmed). **Update 2026-08-09 (later): 06/S-1 CLOSED — live-gated end to end, and the gate found + fixed three defects.** The user-authorized redeploy exposed (1) the correlation covered `WriteSecured` only while OtOpcUa's dominant no-login path emits plain `Write` — fixed gateway-side (worker `53f69cd`, all four unary write kinds, redeployed both hosts); (2) OtOpcUa's `StatusCodeMap.FromMxStatus` truncated the correlated failure row's MxStatus detail code to a byte (`1007 & 0xFF = 239` → OPC DA Good band), mapping a REFUSED write to Good — fixed with the not-IsSuccess-never-Good invariant + category routing (`SECURITY_ERROR → BadUserAccessDenied`); (3) the writer's borrow-from-subscription-registry optimization could never commit (a subscription handle is plain-advised; MXAccess refuses the no-login write `SECURITY_ERROR 1008` AND the advise upgrade `E_INVALIDARG` — one advise per HANDLE, not per attribute) — borrow path REMOVED, writer always owns a supervisory-advised handle. Live legs all PASSED on windev: happy write Good off confirmed `statuses[0]` + both meters flat; read-only refusal surfaces Bad-family + node-revert input; `WriteCompletionWaitMilliseconds=0` control → provisional Good + metered unconfirmed (override removed after). Pinned by `Live_correlated_write_statuses_confirm_commit_and_surface_refusal`, `Live_write_to_subscribed_tag_commits_via_own_handle`, `GatewayGalaxyWriteMeterLiveTests`, and the new `StatusCodeMapTests` rows. | ~~Residual is only the 06/S-1 live leg~~ **CLOSED 2026-08-09** — nothing remains. | §6.3 | | ~~**1 genuinely unexecuted plan** — `2026-05-29-adminui-followups`, **19 pending / 0 completed**~~ ✅ **CLOSED 2026-08-07 by the overlap audit it asked for — it was bookkeeping drift, not backlog.** All 19 tasks are shipped, superseded by v3, or moot; **no code was needed.** The warning was right and then some: WS1's whole *premise* died with v3 (driver-embedded tag lists in `DriverConfig` are no longer the runtime source of truth — the artifact populates `RawTags`), and its capability was delivered in the v3 shape (`TagConfigEditorMap` + `DeviceFormMap`, both verified **reachable**, not merely present). WS2/WS3 shipped; WS4's target files were deleted by v3 Batch 2 + #542. Per-task evidence in the `.tasks.json`. | §6.2 | | ~~**11 other open plan tasks**~~ **3 as of 2026-08-10** — ~~5 akka-hosting partials (likely v3-superseded)~~ *(verified superseded 2026-08-07 — F8/F9/F10/F13/F14 marked completed; `Phase7Composer`/`ScriptedAlarmActor` deleted, evaluators/SDK sinks/security policies all production-wired)*, ~~4+1 followups-batch (open *by choice*)~~ *(2026-08-10: Tasks 9 + 10 VERIFIED PASS live — Int64 authoring end-to-end on the rebuilt rig; probe E2E 12/12 with the "needs Windows-VM" premise corrected to TCP-reachability gating)*, ~~fixedtree Task 11~~ *(closed 2026-08-10: obsolete — the injection feature it gated was deleted with #507)*, ~~1 manual smoke checklist~~ *(closed 2026-08-10: obsolete — the driver pages it smokes were retired in v3 Batch 2)*. ~~**Remaining 3: F10b + SetSeverity (reconsider gates, decisions already taken — do not build without a fresh go-ahead) and the device-gated proofs (hardware-blocked).**~~ **Remaining 1 as of 2026-08-10 (later that day): F10b + SetSeverity reconsider gates put to the user and CLOSED decided-against (F10b re-open trigger: operator complaints about rebuild churn on data-type edits; SetSeverity is operationally invisible — engine overwrites on first eval); the device-gated proofs bundle trimmed to its 2 genuinely-gated sub-items (H6 native-ack→AVEVA + AbLegacy/TwinCAT/FOCAS probes).** | Hardware-blocked only. | §6.2, §9 2026-08-10 (sixth) | -| ~~**Review-coverage gap** — 10 shipped projects never reviewed (Calculation, Historian.Gateway, Mqtt +Browser/Contracts, MTConnect +Contracts, Sql +Browser/Contracts) while **3 modules still review the retired Wonderware backend**~~ **CLOSED 2026-08-10**: all 14 unreviewed projects (the 10 + Mqtt.Transport, Sql.Dialect, Calculation.Contracts, OpcUaClient.Session) reviewed by 6 parallel agents — 61 findings, 26 fixed, 35 Open in `findings.md`; Wonderware reviews banner-retired to history; README at 65 modules, `--check` clean | §9 2026-08-10 (seventh) | §6.3, §9 2026-08-10 (seventh) | +| ~~**Review-coverage gap** — 10 shipped projects never reviewed (Calculation, Historian.Gateway, Mqtt +Browser/Contracts, MTConnect +Contracts, Sql +Browser/Contracts) while **3 modules still review the retired Wonderware backend**~~ **CLOSED 2026-08-10**: all 14 unreviewed projects (the 10 + Mqtt.Transport, Sql.Dialect, Calculation.Contracts, OpcUaClient.Session) reviewed by 6 parallel agents — 61 findings, 26 fixed, 35 Open in `findings.md`; Wonderware reviews banner-retired to history; README at 65 modules, `--check` clean. **The recorded Opens were themselves resolved 2026-08-10 (eighth round): fleet-wide 0 pending findings** | §9 2026-08-10 (seventh, eighth) | §6.3, §9 2026-08-10 (seventh) | | ~~**`RawBrowseModal` stale-open race** (added 2026-08-05) — `OnParametersSetAsync` never re-checks staleness after its awaits, so a superseded open's late resolve can install the wrong device's browse config. The identical shape was found by review and **fixed** in `RawTagModal`/`RawManualTagEntryModal` (post-await staleness re-check; see `docs/plans/2026-08-05-raw-modal-picker-live-config-design.md` §6); the browse modal was deliberately left out of that branch's scope.~~ ✅ **CLOSED 2026-08-09** (`87637e4e`, merge `0739f4b9`) — the sibling `_openGeneration` guard ported to every post-await write, **plus two departures the siblings did not need**: this modal resolves inside `try/finally`, so the `catch` (a stale open's failure would paint its error over the live device) and the `finally` (a stale `return` still runs the tail, dropping the LIVE open's spinner) are generation-guarded too. Four `RawBrowseModalStaleOpenTests` facts, each observed red pre-guard and each re-falsified by reverting only its own guard (1-failed/3-passed per revert — no redundant pin). | ~~Lower stakes than the fixed pair… but the fix pattern is proven and cheap to port.~~ Ported. | design doc §6 | ⚠️ **One correction worth carrying forward.** archreview **03/S4** — "primary gate default-allows on @@ -1280,6 +1280,62 @@ drivers), 3 carried-open archreview findings led by 01/S-1 (`AddressSpaceApplier --- +### 2026-08-10 (eighth round) — the seventh round's recorded Opens all resolved: fleet-wide 0 pending findings + +The 32 findings the seventh round left Open (35 minus `Driver.MTConnect-003`→#560 and two closed in +passing) were partitioned along disjoint-file boundaries into **8 parallel isolated-worktree Opus +agents** (MQTT driver+transport / MQTT browser+contracts / SQL driver-health / SQL dialect+chunking / +SQL browser+probe / SQL contracts / MTConnect / Calculation), each verified against only its relevant +suites. All 8 branches merged `--no-ff`; README regenerated, `--check` clean — **0 pending findings +across all 65 modules** for the first time since the review system started counting. + +**Dispositions: 31 Resolved (27 code fixes TDD-red-first, 4 doc/constants resolutions), 1 documented +Won't Fix** — `Driver.Sql.Browser-003` (the ad-hoc connection-string browse literal): verified rather +than assumed that both reaching surfaces are `ConfigEditor`-gated with no HTTP endpoint, recorded as a +trust boundary in `docs/security.md`. The fixes most worth knowing about: + +- **Fleet-wide numeric-enum rejection** (`Driver.Sql.Contracts-002`): `TagConfigJson.ClassifyEnumText` + in Core.Abstractions now refuses digit/sign-leading spellings before `Enum.TryParse` and requires + `IsDefined` after (catches non-`[Flags]` comma-OR too). Three AdminUI restatements routed to the + shared classifier in the same commit — left alone they'd have reopened the #549 drift direction. +- **SqlGroupPlanner chunking** (`Driver.Sql-002` + `Dialect-002`, one design): `ISqlDialect` gained + `MaxBindParameters` (SqlServer 2098 — `sp_executesql` spends two; Oracle 1000 — the `IN`-list limit, + deliberately not its 64k bind count) and the planner chunks key-value groups at the ceiling, members + following their key. Byte-measured identifier ceilings for Postgres/Oracle (`Dialect-001`). +- **Sql evidence clock aligned with the #527 watchdog** (`Sql-004/-005/-006/-010`): `LastSuccessfulRead` + now advances on any proof the database answered (`BadNoData`, `Uncertain`…), connection-class is + `BadTimeout` only, poll-error classification is per-exception-instance not per-type, and all health + transitions ride one CAS loop (monotonicity of the evidence clock was the RED observable). +- **Calculation pump split** (`Driver.Calculation-005`): scripts no longer run on the mux actor thread + or under `_lock` — trigger-time snapshots queue to a single serialized pump (`_evalGate` → `_lock` + order, at-most-one evaluation); a slow script blocked the dependency callback 1.21 s before. +- **MTConnect write-back became authorable** (`Driver.MTConnect-004`): the driver form gained the + Write-back switch; the block is written in BOTH states (an omitted block could never turn writing + off — pinned by a falsification control). Razor markup itself remains a rig live-verify residual. +- **MQTT**: reconnects that re-establish nothing now tear down instead of reporting success + (`Mqtt-007`, reachable when a deploy lands inside a subscribe round-trip); `SparkplugPrimaryHost` + stops disposing a gate a live reconcile still holds (`-006`); password-without-username warns + instead of silently connecting anonymous (`Transport-002`); strict `retainSeed` read through the + same parse the authoring gate consults (`Contracts-004`); dead `[Range]`s deleted because two + contradicted `Normalize`, the real authority (`Contracts-005`); pre-epoch DateTime writes and + wildcard-forming `SparkplugTopic.Format` closed (`-006`/`-007`); browse label-guard convergence, + atomic node cap, Path-keyed sibling sort (`Browser-002/-003/-004`). + +Process notes, both carryable: (1) **agent worktrees base on `origin/master`, not local HEAD** — two +agents independently measured the AdminUI baseline at 1,466 against a brief claiming 1,474, because the +unpushed #560 arc wasn't in their base; harmless here, but base-verify matters when local is ahead. +(2) **The one cross-branch composition break was exactly the predicted shape**: the browser agent's new +`OracleFlavouredSqliteDialect` predated the dialect agent's `ISqlDialect.MaxBindParameters` member — +caught only by the consolidated full-solution build (the per-agent suites were green in both +worktrees), fixed by one delegating property. Shared `Driver.Sql/findings.md` header reconciled 7→0 by +the orchestrator after the three parallel SQL merges, per the briefs' carve-out. + +Consolidated verification on the merged tree (relevant suites only, per request): build 0 errors; +Mqtt 782, Sql 417, Sql.Browser 84, MTConnect 546, Calculation 53, Core.Abstractions 298, Runtime 558 +(+3 pre-existing skips), AdminUI 1,499 — **3,337 passed, 0 failed** (+305 new tests over the bases). + +--- + ### 2026-08-10 (seventh round) — review-coverage gap CLOSED: 14 modules reviewed, Wonderware reviews retired to history The §0.1 "Review-coverage gap" row is done. Six parallel isolated-worktree agents (4 Opus on the big