fix(host): run monitored-item revalidation on a low-frequency timer (archreview 03/S19)

src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/OtOpcUaServerHostedService.cs

@@ -38,6 +38,8 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
     private readonly IDataPlaneAuthoritySource _dataPlaneAuthority;
     private readonly DataPlaneAuthorizer? _dataPlaneAuthorizer;
     private readonly ServerHistorianOptions _serverHistorianOptions;
+    private readonly AclOptions _aclOptions;
+    private readonly TimeProvider _time;
     private readonly Func<ActorSystem> _actorSystemAccessor;
     private readonly ActorRegistry _actorRegistry;
     private readonly ILoggerFactory _loggerFactory;
@@ -45,6 +47,7 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
 
     private OpcUaApplicationHost? _appHost;
     private OtOpcUaSdkServer? _server;
+    private AclRevalidationTimer? _revalidationTimer;
 
     /// <summary>
     /// Initializes a new instance of the OtOpcUaServerHostedService class.
@@ -77,6 +80,13 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
     /// <param name="dataPlaneAuthorizer">#520 stage 5 — the node-scoped ACL gate. Nullable, and null means
     /// "not wired" rather than "deny": an unregistered gate must not lock a node out of writes to protect a
     /// feature that is off by default. Once wired AND enabled, every unresolvable case inside it denies.</param>
+    /// <param name="aclOptions">#520 / arch-review 03/S19 — the <c>Security:Acl</c> options, read for
+    /// <see cref="AclOptions.RevalidationIntervalSeconds"/>. Required, not optional: the built-in DI
+    /// container does not fall back to a default for an unregistered service, the same trap the
+    /// <c>IOpcUaUserAuthenticator</c> and <c>IDataPlaneAuthoritySource</c> parameters carry comments
+    /// about.</param>
+    /// <param name="time">The shared clock — the one instance the authorizer and the API-key store bound
+    /// also read. Its <c>CreateTimer</c> arms the revalidation tick.</param>
     /// <param name="loggerFactory">The logger factory for creating loggers.</param>
     public OtOpcUaServerHostedService(
         IOptions<OpcUaApplicationHostOptions> options,
@@ -89,9 +99,16 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
         Func<ActorSystem> actorSystemAccessor,
         ActorRegistry actorRegistry,
         DataPlaneAuthorizer? dataPlaneAuthorizer,
+        IOptions<AclOptions> aclOptions,
+        TimeProvider time,
         ILoggerFactory loggerFactory)
     {
+        ArgumentNullException.ThrowIfNull(aclOptions);
+        ArgumentNullException.ThrowIfNull(time);
+
         _dataPlaneAuthorizer = dataPlaneAuthorizer;
+        _aclOptions = aclOptions.Value;
+        _time = time;
         _options = options.Value;
         _deferredSink = deferredSink;
         _deferredServiceLevel = deferredServiceLevel;
@@ -269,9 +286,34 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
                 _loggerFactory.CreateLogger<SdkServiceLevelPublisher>()));
         }
 
+        // arch-review 03/S19 — LAST, after the node manager is known non-null and after the ACL gate is
+        // attached, so the first tick cannot land on a half-wired server.
+        StartRevalidationTimer();
+
         _logger.LogInformation("OtOpcUaServerHostedService: SDK started, address-space + ServiceLevel sinks bound");
     }
 
+    /// <summary>
+    ///     Arms the clock-driven monitored-item revalidation tick (arch-review 03/S19).
+    /// </summary>
+    /// <remarks>
+    ///     Created unconditionally: the pass it drives early-returns unless the ACL gate is wired AND
+    ///     <c>Security:Acl:Enabled</c> is on, so it stays inert on the default configuration, and
+    ///     <c>RevalidationIntervalSeconds = 0</c> arms no timer at all.
+    ///     <para>
+    ///         The node manager is resolved <b>per tick</b> rather than captured: <see cref="_server"/> is
+    ///         replaced across a restart, and a captured reference would go on revalidating a dead
+    ///         manager's item map — the same detach hazard the authority-source setter documents.
+    ///     </para>
+    ///     <para>Separate from <see cref="StartAsync"/> so the timer's lifecycle is testable without booting the SDK.</para>
+    /// </remarks>
+    internal void StartRevalidationTimer() =>
+        _revalidationTimer = new AclRevalidationTimer(
+            () => _server?.NodeManager?.RevalidateMonitoredItems(),
+            TimeSpan.FromSeconds(_aclOptions.RevalidationIntervalSeconds),
+            _time,
+            _loggerFactory.CreateLogger<AclRevalidationTimer>());
+
     /// <summary>
     /// Stops the OPC UA server asynchronously.
     /// </summary>
@@ -279,6 +321,12 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
     /// <returns>A task that represents the asynchronous operation.</returns>
     public Task StopAsync(CancellationToken cancellationToken)
     {
+        // FIRST, ahead of every detach below (arch-review 03/S19). A tick landing on a node manager whose
+        // authority and gate have already been cleared is the shape this whole teardown block exists to
+        // prevent — a stopping node sheds the trigger before it sheds what the trigger drives.
+        _revalidationTimer?.Dispose();
+        _revalidationTimer = null;
+
         // Revert to Null adapters so any in-flight writes from a poison-pilled actor don't hit a
         // half-disposed NodeManager.
         _deferredSink.SetSink(null);
@@ -304,6 +352,11 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
     /// <returns>A task that represents the asynchronous operation.</returns>
     public async ValueTask DisposeAsync()
     {
+        // Before the app host, and idempotent with StopAsync — a host that disposes without stopping must
+        // not leave a tick armed against a server that is about to go away.
+        _revalidationTimer?.Dispose();
+        _revalidationTimer = null;
+
         if (_appHost is not null) await _appHost.DisposeAsync();
     }
 }

src/Server/ZB.MOM.WW.OtOpcUa.Host/ZB.MOM.WW.OtOpcUa.Host.csproj

@@ -13,6 +13,13 @@
         <NoWarn>$(NoWarn);NU1608</NoWarn>
     </PropertyGroup>
 
+    <ItemGroup>
+        <!-- OtOpcUaServerHostedService.StartRevalidationTimer is internal: it is a lifecycle seam the
+             tests drive so the ACL revalidation timer (arch-review 03/S19) can be asserted without
+             booting the real OPC UA SDK, not a surface for callers. -->
+        <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Host.Tests"/>
+    </ItemGroup>
+
     <ItemGroup>
         <PackageReference Include="Akka.Hosting"/>
         <PackageReference Include="Serilog.AspNetCore"/>