Merge b626-opcuaclient (batch #626+): #635 subscription tuning, OperationLimits via SDK batching, OTel event counters, CRL options, discovery URL, full aggregate set

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe
2026-10-08 14:58:41 -04:00
parent e6028678b3 1219b7b13e
commit a60279eb92
18 changed files with 1171 additions and 39 deletions
@@ -431,6 +431,17 @@ RetrievalMode.Integral`) — no client-side scaling. (This replaces the retired
 likewise a native gateway mode. Bucket status codes and timestamps are preserved unchanged; empty / null
 buckets surface as `BadNoData`.
 ### Aggregate set and `BadAggregateNotSupported` (#285)
 `HistoryAggregateType` carries the wider Part 13 set (Interpolative, TimeAverage, Start, End, Delta, Range,
 Min/MaxActualTime, Start/EndBound, DeltaBounds, DurationGood/Bad, PercentGood/Bad, WorstQuality,
 NumberOfTransitions, AnnotationCount, StandardDeviationPopulation, VariancePopulation); `OtOpcUaNodeManager.MapAggregate`
 maps each standard aggregate NodeId. The **HistorianGateway** backend only has retrieval modes for the original
 five (Average, Minimum, Maximum, Total, Count): for any other member `AggregateModeMapper` throws
 `HistoryAggregateNotSupportedException`, which the HistoryRead path turns into `BadAggregateNotSupported` for that
 node only (not a generic failure, and not counted as a backend fault). The OPC UA Client driver forwards every
 member upstream. A NodeId outside the mapped set (e.g. `StandardDeviationSample`) is still `BadAggregateNotSupported`.
 ### Known limitations
 - **Processed and AtTime are single-shot** (no continuation points). Unlike Raw, neither
@@ -99,8 +99,11 @@ rather than surfacing as a runtime surprise.
 ### History passthrough
 `IHistoryProvider` forwards `HistoryRead` to the upstream server's own historian.
-Raw, processed (Average / Minimum / Maximum / Total / Count aggregates mapped to
+Raw, processed (the full `HistoryAggregateType` set — Average / Minimum / Maximum / Total / Count plus
-OPC UA Part 13 standard aggregate NodeIds), and at-time reads are supported; each
+Interpolative, TimeAverage, Start, End, Delta, Range, Min/Max ActualTime, Start/EndBound, DeltaBounds,
 DurationGood/Bad, PercentGood/Bad, WorstQuality, NumberOfTransitions, AnnotationCount and the
 population StandardDeviation/Variance — each mapped to its OPC UA Part 13 standard aggregate NodeId; #285),
 and at-time reads are supported; each
 returned `DataValue` keeps its upstream `StatusCode` and timestamps verbatim.
 Event-history (`ReadEventsAsync`) is left at the interface default — the
 interface doesn't yet carry the EventFilter surface needed to forward it.
@@ -109,7 +112,67 @@ interface doesn't yet carry the EventFilter surface needed to forward it.
 `AutoAcceptCertificates` accepts any self-signed / untrusted server certificate.
 It is **dev-only** — leave it `false` in production so a MITM against the
-opc.tcp channel fails closed.
+opc.tcp channel fails closed. The SDK rejects a **revoked** certificate
 (`BadCertificateRevoked` / `BadCertificateIssuerRevoked`) before the auto-accept handler runs, and the handler
 also refuses them explicitly — defence in depth (#277), not a behaviour change.
 `CertificateValidation` (defaults change nothing):
 | Key | Default | Meaning |
 |---|---|---|
 | `rejectUnknownRevocationStatus` | `false` | Reject a server certificate whose revocation status cannot be determined (no CRL for its issuer, or a stale one). Leave `false` for brownfield sites without CRL infrastructure. **Only effective with `autoAcceptCertificates` off** — the auto-accept handler accepts every suppressible error, including revocation-unknown. |
 | `issuerStorePath` | `null` (= `%LocalAppData%/OtOpcUa/pki/issuers`) | Directory used as the trusted-issuer store. The SDK reads issuer CRLs (`*.crl`) from its `crl/` sub-folder, so this is how an operator points the driver at a managed CRL set. |
 ### Subscription tuning (#273)
 The per-subscription parameters that used to be hardcoded are driver options; the defaults are the old values.
 | Key | Default | Notes |
 |---|---|---|
 | `subscriptionPublishingInterval` | `null` | A .NET `TimeSpan` string (`"00:00:02"`), not a number. `null` = the interval the runtime requests per subscribe (floored at 50 ms). When set it overrides that value (floor still applies); monitored-item sampling follows it. |
 | `subscriptionKeepAliveCount` | `10` | `>= 1`. |
 | `subscriptionLifetimeCount` | `1000` | Must be `>= 3 x` keep-alive count (Part 4 §5.13.2). |
 | `subscriptionMaxNotificationsPerPublish` | `0` | `0` = server decides. |
 | `subscriptionPriority` | `0` | `0`-`255`. |
 Out-of-range values (and a non-absolute `discoveryUrl`) are rejected when the options are loaded — driver creation / `InitializeAsync` fails once with a clear message rather than the driver faulting and retrying forever. The alarm subscription uses the same counts.
 *Per-tag* tuning (deadband / sampling interval / queue size, #274) is not implemented — it needs an
 `ISubscribable` signature change on Core.
 ### Server OperationLimits (#275)
 Nothing driver-side: the SDK session already honours the remote server's
 `ServerCapabilities/OperationLimits`. `Opc.Ua.Client.Session` derives from `Opc.Ua.SessionClientBatched`,
 fetches the limits on open (`FetchOperationLimitsAsync`) and splits Read / Write / CreateMonitoredItems / Browse /
 HistoryRead requests that exceed them (a limit of `0` = unlimited). The driver issues one logical call per
 operation and a unit test pins the `Session : SessionClientBatched` relationship so an SDK change that dropped
 it is caught. (A driver-side splitter was tried and removed: it duplicated the SDK and, on a stalled link, held
 the driver gate for chunks x timeout.)
 ### Discovery URL (#278)
 `discoveryUrl` (default `null`, e.g. `opc.tcp://lds:4840`): at `InitializeAsync` the driver runs `FindServers` on it
 and `GetEndpoints` on every returned server, keeping the endpoints matching `securityPolicy` + `securityMode`.
 Discovered URLs are tried **after** `endpointUrls`/`endpointUrl` (case-insensitive de-dup) — discovery can add
 fallbacks but never outranks or replaces the configured server. Because an LDS commonly registers several servers
 (identical line PLCs, a gateway plus a historian) and the first to accept a connection would be bound silently:
 - `discoveryServerUri` set: only endpoints of the server with that ApplicationUri are used.
 - unset and exactly one distinct server discovered: that server is used.
 - unset and more than one: the connect attempt **fails** with an error naming the discovered ApplicationUris and
  telling the operator to set `discoveryServerUri`.
 A discovery *network* failure (LDS down) is logged and non-fatal — the static list is used (note it is retried on
 every `InitializeAsync`, including comms-loss reconnects). The discovery channel itself is always unsecured (spec).
 ### Diagnostics counters (#276)
 Session/publish events are published on the shared OTel meter as the counter
 `otopcua.driver.opcuaclient.events`, tagged `driver_instance` (the driver instance id) and `event` =
 `publish_response`, `notification` (items), `data_change`, `bad_status_value`, `publish_error`,
 `keepalive_miss`, `reconnect_attempt`, `reconnect_success`, `reconnect_exhausted`. A climbing `keepalive_miss` /
 `reconnect_attempt` rate is the signature of a flapping upstream. They are not part of `DriverHealth` or the
 `/hosts` panel.
 ## Testing
@@ -76,6 +76,16 @@ public static class OtOpcUaTelemetry
    /// </summary>
    public const string PollOverrunDriverInstanceTag = "driver_instance";
    /// <summary>
    /// Session/publish-level events of an OPC UA Client driver instance (#276): the operator's view of a
    /// flapping upstream. Tagged <see cref="PollOverrunDriverInstanceTag"/> (<c>driver_instance</c>) +
    /// <c>event</c> = <c>publish_response|notification|data_change|bad_status_value|publish_error|
    /// keepalive_miss|reconnect_attempt|reconnect_success|reconnect_exhausted</c>.
    /// </summary>
    public static readonly Counter<long> OpcUaClientEvents =
        Meter.CreateCounter<long>("otopcua.driver.opcuaclient.events", unit: "{event}",
            description: "OPC UA Client driver session/publish events (event=publish_response|notification|data_change|bad_status_value|publish_error|keepalive_miss|reconnect_attempt|reconnect_success|reconnect_exhausted).");
    // ---------------- VirtualTag / ScriptedAlarm engines ----------------
    public static readonly Counter<long> VirtualTagEval =
@@ -132,6 +132,14 @@ public sealed record HistoryReadResult(
    byte[]? ContinuationPoint);
 /// <summary>Aggregate function for processed history reads. Mirrors OPC UA Part 13 standard aggregates.</summary>
 /// <remarks>
 ///     The first five members are the original set every historian backend serves. The remainder (#285) are
 ///     the further standard Part 13 aggregates a server-side HistoryRead can forward to a backend that
 ///     supports them (the OPC UA Client driver forwards all of them upstream). A backend that cannot serve a
 ///     member must throw <see cref="HistoryAggregateNotSupportedException"/> — the server maps that to
 ///     <c>BadAggregateNotSupported</c> rather than a generic failure. <b>Append only</b>: the numeric values
 ///     are not persisted, but every <c>switch</c> over this enum must keep a total default.
 /// </remarks>
 public enum HistoryAggregateType
 {
    Average,
@@ -139,6 +147,42 @@ public enum HistoryAggregateType
    Maximum,
    Total,
    Count,
    Interpolative,
    TimeAverage,
    Start,
    End,
    Delta,
    Range,
    MinimumActualTime,
    MaximumActualTime,
    StartBound,
    EndBound,
    DeltaBounds,
    DurationGood,
    DurationBad,
    PercentGood,
    PercentBad,
    WorstQuality,
    NumberOfTransitions,
    AnnotationCount,
    StandardDeviationPopulation,
    VariancePopulation,
 }
 /// <summary>
 ///     Thrown by a history backend when it cannot serve the requested <see cref="HistoryAggregateType"/>.
 ///     The Server HistoryRead path translates it to <c>BadAggregateNotSupported</c> for that node only.
 /// </summary>
 public sealed class HistoryAggregateNotSupportedException : NotSupportedException
 {
    /// <summary>The aggregate the backend could not serve.</summary>
    public HistoryAggregateType Aggregate { get; }
    /// <summary>Creates the exception for <paramref name="aggregate"/>.</summary>
    /// <param name="aggregate">The unsupported aggregate.</param>
    public HistoryAggregateNotSupportedException(HistoryAggregateType aggregate)
        : base($"The historian backend does not support the {aggregate} aggregate.")
        => Aggregate = aggregate;
 }
 /// <summary>
@@ -79,11 +79,13 @@ public sealed class GatewayHistorianDataSource : IHistorianDataSource, IAsyncDis
        string fullReference, DateTime startUtc, DateTime endUtc, TimeSpan interval,
        HistoryAggregateType aggregate, CancellationToken cancellationToken)
    {
        // Mapped OUTSIDE the failure-recording try: an aggregate the gateway has no mode for is a client
        // request the server answers BadAggregateNotSupported, not a backend fault to count (#285).
        var mode = AggregateModeMapper.ToRetrievalMode(aggregate);
        try
        {
            // Total/Count are now native gateway retrieval modes — no client-side scaling
            // (unlike the Wonderware path that derived Total as Average × interval-seconds).
            var mode = AggregateModeMapper.ToRetrievalMode(aggregate);
            var buckets = new List<HistorianAggregateSample>();
            await foreach (var bucket in _client
                .ReadAggregateAsync(fullReference, startUtc, endUtc, mode, interval, cancellationToken)
@@ -25,7 +25,8 @@ internal static class AggregateModeMapper
    /// <summary>Maps an aggregate function to the gateway retrieval mode.</summary>
    /// <param name="aggregate">The driver-agnostic aggregate function.</param>
    /// <returns>The matching gateway <see cref="RetrievalMode"/>.</returns>
-    /// <exception cref="ArgumentOutOfRangeException">A future, unmapped enum member (fails the matrix guard).</exception>
+    /// <exception cref="HistoryAggregateNotSupportedException">A defined member the gateway has no retrieval mode for.</exception>
    /// <exception cref="ArgumentOutOfRangeException">An undefined enum value.</exception>
    public static RetrievalMode ToRetrievalMode(HistoryAggregateType aggregate) => aggregate switch
    {
        HistoryAggregateType.Average => RetrievalMode.TimeWeightedAverage,
@@ -33,6 +34,10 @@ internal static class AggregateModeMapper
        HistoryAggregateType.Maximum => RetrievalMode.MaximumWithTime,
        HistoryAggregateType.Total => RetrievalMode.Integral,
        HistoryAggregateType.Count => RetrievalMode.Counter,
        // Part 13 aggregates the gateway has no retrieval mode for (#285) — an UNDEFINED enum value is a
        // programming error, but a defined-yet-unserved member is a normal client request the server
        // answers with BadAggregateNotSupported.
        _ when Enum.IsDefined(aggregate) => throw new HistoryAggregateNotSupportedException(aggregate),
        _ => throw new ArgumentOutOfRangeException(
            nameof(aggregate), aggregate, "Unmapped HistoryAggregateType — add a RetrievalMode mapping."),
    };
@@ -189,6 +189,81 @@ public sealed record OpcUaClientDriverOptions
    /// </summary>
    [Range(1, 60)]
    public int ProbeTimeoutSeconds { get; init; } = 15;
    // ---- #273 per-subscription tuning (defaults are the values that used to be hardcoded) ----
    /// <summary>
    ///     Fixed publishing interval for every data-change subscription this driver creates. <c>null</c>
    ///     (default) keeps the historical behaviour: the interval the runtime asks for per
    ///     <c>SubscribeAsync</c> call, floored at 50 ms. When set it overrides the per-call value (the
    ///     50 ms floor still applies); monitored-item sampling intervals follow it.
    /// </summary>
    public TimeSpan? SubscriptionPublishingInterval { get; init; }
    /// <summary>
    ///     Publish cycles with no data before the server sends a keep-alive (default 10). Must be &gt;= 1.
    /// </summary>
    public uint SubscriptionKeepAliveCount { get; init; } = 10;
    /// <summary>
    ///     Publish cycles with no Publish request before the server drops the subscription (default 1000).
    ///     Must be at least 3x <see cref="SubscriptionKeepAliveCount"/> (OPC UA Part 4 §5.13.2).
    /// </summary>
    public uint SubscriptionLifetimeCount { get; init; } = 1000;
    /// <summary>Max notifications per Publish response; <c>0</c> (default) = server decides.</summary>
    public uint SubscriptionMaxNotificationsPerPublish { get; init; }
    /// <summary>Relative subscription priority 0-255 (default 0).</summary>
    public byte SubscriptionPriority { get; init; }
    // ---- #277 ----
    /// <summary>Certificate-revocation / issuer-store settings. Defaults preserve the SDK behaviour.</summary>
    public OpcUaCertificateValidationOptions CertificateValidation { get; init; } = new();
    // ---- #278 ----
    /// <summary>
    ///     Optional discovery endpoint (a Local Discovery Server or the server itself), e.g.
    ///     <c>opc.tcp://lds.internal:4840</c>. When set, <c>InitializeAsync</c> calls <c>FindServers</c> and
    ///     <c>GetEndpoints</c> on it and tries the discovered URLs that match <see cref="SecurityPolicy"/> +
    ///     <see cref="SecurityMode"/> <i>after</i> the statically configured <see cref="EndpointUrls"/> /
    ///     <see cref="EndpointUrl"/> (pin the server with <see cref="DiscoveryServerUri"/>). A discovery failure is non-fatal: the static list is used. Discovery
    ///     itself always runs over an unsecured channel, as the spec requires. <c>null</c> (default) = off.
    /// </summary>
    public string? DiscoveryUrl { get; init; }
    /// <summary>
    ///     ApplicationUri of the one server discovery may resolve to. An LDS usually registers several servers;
    ///     with this set only that server's endpoints are used. When unset and discovery finds more than one
    ///     server, connect fails with an error listing their ApplicationUris. Discovered endpoints are always
    ///     tried AFTER the configured <see cref="EndpointUrls"/>.
    /// </summary>
    public string? DiscoveryServerUri { get; init; }
 }
 /// <summary>
 ///     Server-certificate revocation handling for the OPC UA Client driver (#277). The SDK reads CRLs from
 ///     the <c>crl</c> sub-folder of the trusted-peer / trusted-issuer stores; these settings only decide how
 ///     a certificate whose revocation status cannot be determined is treated and where the issuer store lives.
 /// </summary>
 public sealed record OpcUaCertificateValidationOptions
 {
    /// <summary>
    ///     When <c>true</c>, a server certificate whose revocation status is unknown (no CRL for its issuer, or a
    ///     stale one) is rejected. Default <c>false</c> keeps brownfield deployments without CRL infrastructure
    ///     connecting. A certificate that IS revoked is always rejected — even with
    ///     <see cref="OpcUaClientDriverOptions.AutoAcceptCertificates"/> set.
    /// </summary>
    public bool RejectUnknownRevocationStatus { get; init; }
    /// <summary>
    ///     Directory used as the trusted-issuer certificate store. Its <c>crl/</c> sub-folder is where the SDK
    ///     looks for issuer CRLs (<c>.crl</c> files), so this is the knob for pointing the driver at an
    ///     operator-managed CRL set. <c>null</c>/empty (default) = <c>%LocalAppData%/OtOpcUa/pki/issuers</c>.
    /// </summary>
    public string? IssuerStorePath { get; init; }
 }
 /// <summary>
@@ -0,0 +1,48 @@
 using ZB.MOM.WW.OtOpcUa.Commons.Observability;
 namespace ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient;
 /// <summary>
 ///     Publishes an OPC UA Client driver instance's session/publish events (#276) on the shared
 ///     <c>otopcua.driver.opcuaclient.events</c> OTel counter, tagged with <c>driver_instance</c> and
 ///     <c>event</c>. The counter is thread-safe, so the SDK's notification / keep-alive threads record
 ///     directly with no locking here.
 /// </summary>
 internal sealed class OpcUaClientDiagnostics
 {
    /// <summary>A NotificationMessage arrived (one per Publish response that carried data).</summary>
    public const string PublishResponse = "publish_response";
    /// <summary>Items carried by notification messages.</summary>
    public const string Notification = "notification";
    /// <summary>One monitored-item data change was delivered.</summary>
    public const string DataChange = "data_change";
    /// <summary>A delivered data change carried a Bad status.</summary>
    public const string BadStatusValue = "bad_status_value";
    /// <summary>A Publish failed (missing publish requests, subscription errors).</summary>
    public const string PublishError = "publish_error";
    /// <summary>A keep-alive came back Bad.</summary>
    public const string KeepAliveMiss = "keepalive_miss";
    /// <summary>The reconnect handler was armed.</summary>
    public const string ReconnectAttempt = "reconnect_attempt";
    /// <summary>A reconnect landed a new session.</summary>
    public const string ReconnectSuccess = "reconnect_success";
    /// <summary>A reconnect handler exhausted its retry window.</summary>
    public const string ReconnectExhausted = "reconnect_exhausted";
    private readonly string _driverInstanceId;
    /// <summary>Creates the recorder for one driver instance.</summary>
    /// <param name="driverInstanceId">Value of the <c>driver_instance</c> tag.</param>
    public OpcUaClientDiagnostics(string driverInstanceId) => _driverInstanceId = driverInstanceId;
    /// <summary>Add <paramref name="count"/> to the counter for <paramref name="evt"/>.</summary>
    /// <param name="evt">One of the event constants.</param>
    /// <param name="count">Amount to add (default 1).</param>
    public void Record(string evt, long count = 1)
    {
        if (count <= 0) return;
        OtOpcUaTelemetry.OpcUaClientEvents.Add(count,
            new KeyValuePair<string, object?>(OtOpcUaTelemetry.PollOverrunDriverInstanceTag, _driverInstanceId),
            new KeyValuePair<string, object?>("event", evt));
    }
 }
@@ -79,6 +79,7 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
    {
        _options = options;
        _driverInstanceId = driverInstanceId;
        _diag = new OpcUaClientDiagnostics(driverInstanceId);
        _logger = logger ?? NullLogger<OpcUaClientDriver>.Instance;
        _secretResolver = secretResolver ?? NullSecretResolver.Instance;
    }
@@ -144,7 +145,16 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
    /// <param name="map">The namespace map to install, or <c>null</c> to clear it.</param>
    internal void SetNamespaceMapForTest(NamespaceMap? map) => _namespaceMap = map;
    /// <summary>Test-only view of the diagnostics counters (#276).</summary>
    internal OpcUaClientDiagnostics DiagnosticsForTest => _diag;
    private DriverHealth _health = new(DriverState.Unknown, null, null);
    /// <summary>Per-instance event counters published as OTel metrics (#276).</summary>
    private readonly OpcUaClientDiagnostics _diag;
    private NotificationEventHandler? _notificationHandler;
    private PublishErrorEventHandler? _publishErrorHandler;
    private bool _disposed;
    /// <summary>URL of the endpoint the driver actually connected to. Exposed via <see cref="HostName"/>.</summary>
    private string? _connectedEndpointUrl;
@@ -212,9 +222,36 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
            // §8 "Namespace Assignment" — a misconfigured remote fails draft validation here,
            // not as a runtime surprise.
            ValidateNamespaceKind(_options);
            ValidateTuning(_options);
            var appConfig = await BuildApplicationConfigurationAsync(cancellationToken).ConfigureAwait(false);
-            var candidates = ResolveEndpointCandidates(_options);
+
            // #278: when a DiscoveryUrl is configured, FindServers/GetEndpoints on it first and try the
            // discovered URLs ahead of the static list. Non-fatal — an LDS outage must not block init.
            IReadOnlyList<string> discovered = [];
            if (!string.IsNullOrWhiteSpace(_options.DiscoveryUrl))
            {
                IReadOnlyList<DiscoveredEndpoint> found = [];
                try
                {
                    found = await DiscoverEndpointsAsync(
                        appConfig, _options.DiscoveryUrl!, _options.SecurityPolicy, _options.SecurityMode,
                        cancellationToken).ConfigureAwait(false);
                }
                catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested) { throw; }
                catch (Exception ex)
                {
                    _logger.LogWarning(ex,
                        "OpcUaClientDriver '{DriverInstanceId}': discovery against '{DiscoveryUrl}' failed; " +
                        "using the configured endpoint list only.", _driverInstanceId, _options.DiscoveryUrl);
                }
                // Selection is OUTSIDE the try on purpose: an ambiguous LDS must fail the connect with a
                // clear message, not be swallowed into "discovery unavailable".
                discovered = SelectDiscoveredUrls(found, _options.DiscoveryServerUri);
            }
            var candidates = ResolveEndpointCandidates(_options, discovered);
            // G-2b: resolve any secret:-prefixed Password / UserCertificatePassword through the
            // shared secret store ONCE, here in the async connect flow, just before the credentials
@@ -266,6 +303,7 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
            // via TransferSubscriptions so local MonitoredItem handles stay valid.
            _keepAliveHandler = OnKeepAlive;
            session.KeepAlive += _keepAliveHandler;
            AttachDiagnostics(session);
            // Build the bidirectional namespace map from the freshly negotiated session's
            // NamespaceUris (driver-specs.md §8 "Namespace Remapping"). Stored NodeIds carry
@@ -331,7 +369,11 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
                TrustedIssuerCertificates = new CertificateTrustList
                {
                    StoreType = CertificateStoreType.Directory,
-                    StorePath = Path.Combine(pkiRoot, "issuers"),
+                    // #277: the issuer store's crl/ sub-folder is where the SDK reads issuer CRLs, so an
                    // operator-supplied path is the CRL knob. Unset = the historical default.
                    StorePath = string.IsNullOrWhiteSpace(_options.CertificateValidation.IssuerStorePath)
                        ? Path.Combine(pkiRoot, "issuers")
                        : _options.CertificateValidation.IssuerStorePath,
                },
                RejectedCertificateStore = new CertificateTrustList
                {
@@ -339,6 +381,7 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
                    StorePath = Path.Combine(pkiRoot, "rejected"),
                },
                AutoAcceptUntrustedCertificates = _options.AutoAcceptCertificates,
                RejectUnknownRevocationStatus = _options.CertificateValidation.RejectUnknownRevocationStatus,
            },
            TransportQuotas = new TransportQuotas { OperationTimeout = (int)_options.Timeout.TotalMilliseconds },
            ClientConfiguration = new ClientConfiguration
@@ -364,8 +407,22 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
            // Accept the full set of certificate-validation error codes: a real dev cert can
            // fail with BadCertificateChainIncomplete, BadCertificateTimeInvalid, or
            // BadCertificateHostNameInvalid, not only BadCertificateUntrusted. Only accepting
-            // the latter would silently fail for those certs.
+            // the latter would silently fail for those certs. A REVOKED certificate is the one
-            CertificateValidationEventHandler handler = (_, e) => e.Accept = true;
+            // exception (#277): auto-accept is for dev self-signed certs, never for a cert its issuer
            // has explicitly withdrawn.
            CertificateValidationEventHandler handler = (_, e) =>
            {
                if (IsRevocationFailure(e.Error.StatusCode))
                {
                    _logger.LogWarning(
                        "OpcUaClientDriver '{DriverInstanceId}': REVOKED server certificate rejected " +
                        "(subject={Subject}, status=0x{Status:X8}) — AutoAcceptCertificates does not apply to revoked certs.",
                        _driverInstanceId, e.Certificate?.Subject, e.Error.StatusCode.Code);
                    e.Accept = false;
                    return;
                }
                e.Accept = true;
            };
            config.CertificateValidator.CertificateValidation += handler;
            // Store refs so ShutdownAsync + Dispose can detach the delegate and avoid
            // leaking a closure on a potentially process-shared validator.
@@ -381,6 +438,12 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
        return config;
    }
    /// <summary>True for the two hard "this certificate (or its issuer) is revoked" results (#277).</summary>
    /// <param name="status">The SDK's certificate-validation status.</param>
    /// <returns><c>true</c> when the status is Revoked / IssuerRevoked.</returns>
    internal static bool IsRevocationFailure(StatusCode status) =>
        status.Code == StatusCodes.BadCertificateRevoked || status.Code == StatusCodes.BadCertificateIssuerRevoked;
    /// <summary>
    ///     Resolve the ordered failover candidate list. <c>EndpointUrls</c> wins when
    ///     non-empty; otherwise fall back to <c>EndpointUrl</c> as a single-URL shortcut so
@@ -388,10 +451,173 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
    /// </summary>
    /// <param name="opts">Driver options containing endpoint configuration.</param>
    /// <returns>The ordered list of endpoint URLs to try.</returns>
-    internal static IReadOnlyList<string> ResolveEndpointCandidates(OpcUaClientDriverOptions opts)
+    internal static IReadOnlyList<string> ResolveEndpointCandidates(OpcUaClientDriverOptions opts) =>
        ResolveEndpointCandidates(opts, []);
    /// <summary>
    ///     Resolve the ordered failover list with optional discovery results (#278). The configured
    ///     endpoints always come FIRST — a discovered endpoint can only ever be a fallback, never outrank or
    ///     replace the server the operator named. Discovered URLs follow, de-duplicated case-insensitively.
    ///     With no discovered URLs the result is exactly the pre-discovery behaviour.
    /// </summary>
    /// <param name="opts">Driver options containing endpoint configuration.</param>
    /// <param name="discovered">URLs resolved via <see cref="DiscoverEndpointsAsync"/> (may be empty).</param>
    /// <returns>The ordered list of endpoint URLs to try.</returns>
    internal static IReadOnlyList<string> ResolveEndpointCandidates(
        OpcUaClientDriverOptions opts, IReadOnlyList<string> discovered)
    {
-        if (opts.EndpointUrls is { Count: > 0 }) return opts.EndpointUrls;
+        IReadOnlyList<string> staticList = opts.EndpointUrls is { Count: > 0 } ? opts.EndpointUrls : [opts.EndpointUrl];
-        return [opts.EndpointUrl];
+        if (discovered.Count == 0) return staticList;
        var seen = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
        var merged = new List<string>(discovered.Count + staticList.Count);
        foreach (var u in staticList)
            if (!string.IsNullOrWhiteSpace(u) && seen.Add(u)) merged.Add(u);
        foreach (var u in discovered)
            if (!string.IsNullOrWhiteSpace(u) && seen.Add(u)) merged.Add(u);
        return merged;
    }
    /// <summary>
    ///     <c>FindServers</c> on <paramref name="discoveryUrl"/> (an LDS, or the server itself), then
    ///     <c>GetEndpoints</c> on each returned server's discovery URL, keeping the endpoints whose security
    ///     policy + mode match. One unreachable server in the list is skipped, not fatal. The discovery
    ///     channel is unsecured by design (OPC UA Part 4 §5.4) regardless of the session's security mode.
    /// </summary>
    /// <param name="appConfig">Application configuration (client identity for the discovery channel).</param>
    /// <param name="discoveryUrl">The LDS / server discovery URL.</param>
    /// <param name="policy">Required security policy.</param>
    /// <param name="mode">Required security mode.</param>
    /// <param name="ct">Cancellation token.</param>
    /// <returns>Matching endpoint URLs in discovery order, de-duplicated.</returns>
    internal static async Task<IReadOnlyList<DiscoveredEndpoint>> DiscoverEndpointsAsync(
        ApplicationConfiguration appConfig, string discoveryUrl,
        OpcUaSecurityPolicy policy, OpcUaSecurityMode mode, CancellationToken ct)
    {
        var wantedPolicyUri = MapSecurityPolicy(policy);
        var wantedMode = ToMessageSecurityMode(mode);
        ApplicationDescriptionCollection servers;
        using (var lds = await DiscoveryClient.CreateAsync(
                   appConfig, new Uri(discoveryUrl), Opc.Ua.DiagnosticsMasks.None, ct).ConfigureAwait(false))
        {
            servers = await lds.FindServersAsync(null, ct).ConfigureAwait(false);
        }
        var found = new List<DiscoveredEndpoint>();
        foreach (var server in servers)
        {
            if (server.DiscoveryUrls is null) continue;
            foreach (var serverDiscoveryUrl in server.DiscoveryUrls)
            {
                if (string.IsNullOrWhiteSpace(serverDiscoveryUrl)) continue;
                EndpointDescriptionCollection endpoints;
                try
                {
                    using var ep = await DiscoveryClient.CreateAsync(
                        appConfig, new Uri(serverDiscoveryUrl), Opc.Ua.DiagnosticsMasks.None, ct).ConfigureAwait(false);
                    endpoints = await ep.GetEndpointsAsync(null, ct).ConfigureAwait(false);
                }
                catch (OperationCanceledException) when (ct.IsCancellationRequested) { throw; }
                catch { continue; }
                found.AddRange(FilterEndpointUrls(endpoints, wantedPolicyUri, wantedMode)
                    .Select(u => new DiscoveredEndpoint(server.ApplicationUri ?? string.Empty, u)));
            }
        }
        return found;
    }
    /// <summary>One endpoint URL found by discovery, with the ApplicationUri of the server advertising it.</summary>
    /// <param name="ApplicationUri">The advertising server's ApplicationUri (empty when it published none).</param>
    /// <param name="Url">The endpoint URL.</param>
    internal readonly record struct DiscoveredEndpoint(string ApplicationUri, string Url);
    /// <summary>
    ///     Decide which discovered endpoints may be used (#278). An LDS can register many servers (identical
    ///     line PLCs, a gateway plus a historian), and the first one that accepts a connection would be bound
    ///     silently — mis-attributing every value and write. So: with <paramref name="serverUri"/> set, only
    ///     that ApplicationUri's endpoints; unset and exactly one distinct server, that server; unset and
    ///     several, throw naming them so the operator pins one.
    /// </summary>
    /// <param name="found">Matching endpoints from every server the LDS listed.</param>
    /// <param name="serverUri">Optional <c>DiscoveryServerUri</c> filter.</param>
    /// <returns>The usable URLs, de-duplicated, in discovery order (possibly empty).</returns>
    /// <exception cref="InvalidOperationException">Several servers discovered and no filter configured.</exception>
    internal static IReadOnlyList<string> SelectDiscoveredUrls(
        IReadOnlyList<DiscoveredEndpoint> found, string? serverUri)
    {
        IEnumerable<DiscoveredEndpoint> chosen = found;
        if (!string.IsNullOrWhiteSpace(serverUri))
        {
            chosen = found.Where(e => string.Equals(e.ApplicationUri, serverUri, StringComparison.Ordinal));
        }
        else
        {
            var servers = found.Select(e => e.ApplicationUri).Distinct(StringComparer.Ordinal).ToList();
            if (servers.Count > 1)
                throw new InvalidOperationException(
                    "OpcUaClient discovery found endpoints for more than one server " +
                    $"({string.Join(", ", servers.Select(u => string.IsNullOrEmpty(u) ? "<no ApplicationUri>" : u))}). " +
                    "Set DiscoveryServerUri to the ApplicationUri of the server this driver should use.");
        }
        return chosen.Select(e => e.Url).Distinct(StringComparer.OrdinalIgnoreCase).ToList();
    }
    /// <summary>The endpoint URLs in <paramref name="endpoints"/> matching the wanted policy URI + mode.</summary>
    /// <param name="endpoints">Endpoints advertised by a server.</param>
    /// <param name="wantedPolicyUri">Required <c>SecurityPolicyUri</c>.</param>
    /// <param name="wantedMode">Required message security mode.</param>
    /// <returns>Matching <c>EndpointUrl</c>s, in advertised order.</returns>
    internal static IEnumerable<string> FilterEndpointUrls(
        IEnumerable<EndpointDescription> endpoints, string wantedPolicyUri, MessageSecurityMode wantedMode) =>
        endpoints
            .Where(e => e.SecurityPolicyUri == wantedPolicyUri && e.SecurityMode == wantedMode
                        && !string.IsNullOrWhiteSpace(e.EndpointUrl))
            .Select(e => e.EndpointUrl);
    private static MessageSecurityMode ToMessageSecurityMode(OpcUaSecurityMode mode) => mode switch
    {
        OpcUaSecurityMode.None => MessageSecurityMode.None,
        OpcUaSecurityMode.Sign => MessageSecurityMode.Sign,
        OpcUaSecurityMode.SignAndEncrypt => MessageSecurityMode.SignAndEncrypt,
        _ => throw new ArgumentOutOfRangeException(nameof(mode)),
    };
    /// <summary>
    ///     Range checks for the subscription-tuning and discovery options (#273/#278). Throws at
    ///     <see cref="InitializeAsync"/> so a bad config fails like the namespace-kind check does rather
    ///     than surfacing later as a server-side <c>BadInvalidArgument</c> on every subscribe.
    /// </summary>
    /// <param name="opts">The options to validate.</param>
    internal static void ValidateTuning(OpcUaClientDriverOptions opts)
    {
        if (opts.SubscriptionKeepAliveCount < 1)
            throw new InvalidOperationException("OpcUaClient SubscriptionKeepAliveCount must be >= 1.");
        if (opts.SubscriptionLifetimeCount < 3L * opts.SubscriptionKeepAliveCount)
            throw new InvalidOperationException(
                "OpcUaClient SubscriptionLifetimeCount must be at least 3x SubscriptionKeepAliveCount " +
                $"(got lifetime={opts.SubscriptionLifetimeCount}, keep-alive={opts.SubscriptionKeepAliveCount}).");
        if (opts.SubscriptionPublishingInterval is { } pi && pi <= TimeSpan.Zero)
            throw new InvalidOperationException("OpcUaClient SubscriptionPublishingInterval must be positive when set.");
        if (!string.IsNullOrWhiteSpace(opts.DiscoveryUrl)
            && !Uri.TryCreate(opts.DiscoveryUrl, UriKind.Absolute, out _))
            throw new InvalidOperationException(
                $"OpcUaClient DiscoveryUrl '{opts.DiscoveryUrl}' is not an absolute URI.");
    }
    /// <summary>
    ///     Publishing interval (ms) a new subscription gets: the configured override if set, else the
    ///     interval the runtime requested, floored at 50 ms either way (servers negotiate up anyway, and
    ///     sub-50 ms just wastes negotiation).
    /// </summary>
    /// <param name="opts">Driver options.</param>
    /// <param name="requested">The per-call interval from <c>SubscribeAsync</c>.</param>
    /// <returns>The publishing interval in milliseconds.</returns>
    internal static int ResolvePublishingIntervalMs(OpcUaClientDriverOptions opts, TimeSpan requested)
    {
        var effective = opts.SubscriptionPublishingInterval ?? requested;
        return effective < TimeSpan.FromMilliseconds(50) ? 50 : (int)effective.TotalMilliseconds;
    }
    /// <summary>
@@ -510,13 +736,7 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
        var all = await client.GetEndpointsAsync(null, ct).ConfigureAwait(false);
        var wantedPolicyUri = MapSecurityPolicy(policy);
-        var wantedMode = mode switch
+        var wantedMode = ToMessageSecurityMode(mode);
        {
            OpcUaSecurityMode.None => MessageSecurityMode.None,
            OpcUaSecurityMode.Sign => MessageSecurityMode.Sign,
            OpcUaSecurityMode.SignAndEncrypt => MessageSecurityMode.SignAndEncrypt,
            _ => throw new ArgumentOutOfRangeException(nameof(mode)),
        };
        var match = all.FirstOrDefault(e =>
            e.SecurityPolicyUri == wantedPolicyUri && e.SecurityMode == wantedMode);
@@ -625,6 +845,7 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
                try { sessionToClose.KeepAlive -= _keepAliveHandler; } catch { }
            }
            _keepAliveHandler = null;
            if (sessionToClose is not null) DetachDiagnostics(sessionToClose);
            Session = null;
        }
@@ -1245,20 +1466,18 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
        // Floor the publishing interval at 50ms — OPC UA servers routinely negotiate
        // minimum-supported intervals up anyway, but sending sub-50ms wastes negotiation
-        // bandwidth on every subscription create.
+        // bandwidth on every subscription create. #273: the options may pin the interval.
-        var intervalMs = publishingInterval < TimeSpan.FromMilliseconds(50)
+        var intervalMs = ResolvePublishingIntervalMs(_options, publishingInterval);
            ? 50
            : (int)publishingInterval.TotalMilliseconds;
        var subscription = new Subscription(telemetry: null!, new SubscriptionOptions
        {
            DisplayName = $"opcua-sub-{id}",
            PublishingInterval = intervalMs,
-            KeepAliveCount = 10,
+            KeepAliveCount = _options.SubscriptionKeepAliveCount,
-            LifetimeCount = 1000,
+            LifetimeCount = _options.SubscriptionLifetimeCount,
-            MaxNotificationsPerPublish = 0,
+            MaxNotificationsPerPublish = _options.SubscriptionMaxNotificationsPerPublish,
            PublishingEnabled = true,
-            Priority = 0,
+            Priority = _options.SubscriptionPriority,
            TimestampsToReturn = TimestampsToReturn.Both,
        });
@@ -1351,6 +1570,8 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
        var dv = mn.Value;
        if (dv is null) return;
        var fullRef = (item.Handle as string) ?? item.DisplayName ?? string.Empty;
        _diag.Record(OpcUaClientDiagnostics.DataChange);
        if (StatusCode.IsBad(dv.StatusCode)) _diag.Record(OpcUaClientDiagnostics.BadStatusValue);
        var snapshot = new DataValueSnapshot(
            Value: dv.Value,
            StatusCode: dv.StatusCode.Code,
@@ -1420,9 +1641,9 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
        {
            DisplayName = $"opcua-alarm-sub-{id}",
            PublishingInterval = 500,   // 500ms — alarms don't need fast polling; the server pushes
-            KeepAliveCount = 10,
+            KeepAliveCount = _options.SubscriptionKeepAliveCount,
-            LifetimeCount = 1000,
+            LifetimeCount = _options.SubscriptionLifetimeCount,
-            MaxNotificationsPerPublish = 0,
+            MaxNotificationsPerPublish = _options.SubscriptionMaxNotificationsPerPublish,
            PublishingEnabled = true,
            Priority = 0,
            TimestampsToReturn = TimestampsToReturn.Both,
@@ -1794,6 +2015,26 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
        HistoryAggregateType.Maximum => ObjectIds.AggregateFunction_Maximum,
        HistoryAggregateType.Total   => ObjectIds.AggregateFunction_Total,
        HistoryAggregateType.Count   => ObjectIds.AggregateFunction_Count,
        HistoryAggregateType.Interpolative => ObjectIds.AggregateFunction_Interpolative,
        HistoryAggregateType.TimeAverage => ObjectIds.AggregateFunction_TimeAverage,
        HistoryAggregateType.Start => ObjectIds.AggregateFunction_Start,
        HistoryAggregateType.End => ObjectIds.AggregateFunction_End,
        HistoryAggregateType.Delta => ObjectIds.AggregateFunction_Delta,
        HistoryAggregateType.Range => ObjectIds.AggregateFunction_Range,
        HistoryAggregateType.MinimumActualTime => ObjectIds.AggregateFunction_MinimumActualTime,
        HistoryAggregateType.MaximumActualTime => ObjectIds.AggregateFunction_MaximumActualTime,
        HistoryAggregateType.StartBound => ObjectIds.AggregateFunction_StartBound,
        HistoryAggregateType.EndBound => ObjectIds.AggregateFunction_EndBound,
        HistoryAggregateType.DeltaBounds => ObjectIds.AggregateFunction_DeltaBounds,
        HistoryAggregateType.DurationGood => ObjectIds.AggregateFunction_DurationGood,
        HistoryAggregateType.DurationBad => ObjectIds.AggregateFunction_DurationBad,
        HistoryAggregateType.PercentGood => ObjectIds.AggregateFunction_PercentGood,
        HistoryAggregateType.PercentBad => ObjectIds.AggregateFunction_PercentBad,
        HistoryAggregateType.WorstQuality => ObjectIds.AggregateFunction_WorstQuality,
        HistoryAggregateType.NumberOfTransitions => ObjectIds.AggregateFunction_NumberOfTransitions,
        HistoryAggregateType.AnnotationCount => ObjectIds.AggregateFunction_AnnotationCount,
        HistoryAggregateType.StandardDeviationPopulation => ObjectIds.AggregateFunction_StandardDeviationPopulation,
        HistoryAggregateType.VariancePopulation => ObjectIds.AggregateFunction_VariancePopulation,
        _ => throw new ArgumentOutOfRangeException(nameof(aggregate), aggregate, null),
    };
@@ -1983,6 +2224,43 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
            return [new HostConnectivityStatus(HostName, _hostState, _hostStateChangedUtc)];
    }
    /// <summary>Hook the SDK's publish-side events into the diagnostics counters (#276).</summary>
    /// <param name="session">The session to observe.</param>
    private void AttachDiagnostics(ISession session)
    {
        _notificationHandler ??= (_, e) =>
        {
            _diag.Record(OpcUaClientDiagnostics.PublishResponse);
            var msg = e.NotificationMessage;
            if (msg?.NotificationData is { } data)
                foreach (var nd in data)
                    _diag.Record(OpcUaClientDiagnostics.Notification, CountNotifications(nd));
        };
        _publishErrorHandler ??= (_, _) => _diag.Record(OpcUaClientDiagnostics.PublishError);
        session.Notification -= _notificationHandler;
        session.Notification += _notificationHandler;
        session.PublishError -= _publishErrorHandler;
        session.PublishError += _publishErrorHandler;
    }
    private void DetachDiagnostics(ISession session)
    {
        try
        {
            if (_notificationHandler is not null) session.Notification -= _notificationHandler;
            if (_publishErrorHandler is not null) session.PublishError -= _publishErrorHandler;
        }
        catch { /* best-effort — SDK may have already cleared its invocation lists on session loss */ }
    }
    private static int CountNotifications(ExtensionObject nd) => nd.Body switch
    {
        DataChangeNotification dc => dc.MonitoredItems?.Count ?? 0,
        EventNotificationList ev => ev.Events?.Count ?? 0,
        StatusChangeNotification => 1,
        _ => 1,
    };
    /// <summary>
    ///     Session keep-alive handler. On a healthy ping, bumps HostState back to Running
    ///     (typical bounce after a transient network blip). On a bad ping, starts the SDK's
@@ -1998,6 +2276,7 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
        }
        TransitionTo(HostState.Stopped);
        _diag.Record(OpcUaClientDiagnostics.KeepAliveMiss);
        // Kick off the SDK's reconnect loop exactly once per drop. Keep-alive callbacks fire
        // from the SDK keep-alive timer thread and the SDK can fire this handler repeatedly
@@ -2017,6 +2296,7 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
        // BeginReconnect is started outside the lock — it does no _reconnectHandler mutation
        // and we don't want to hold _probeLock across an SDK call.
        _diag.Record(OpcUaClientDiagnostics.ReconnectAttempt);
        handler.BeginReconnect(
            sender,
            (int)_options.ReconnectPeriod.TotalMilliseconds,
@@ -2057,6 +2337,10 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
            {
                newSession.KeepAlive += _keepAliveHandler;
            }
            // Detach-then-attach: the SDK may hand back the SAME session object, and -= on a handler that
            // is not attached is a no-op, so this never double-counts.
            if (oldSession is not null) DetachDiagnostics(oldSession);
            if (newSession is not null) AttachDiagnostics(newSession);
            Session = newSession;
@@ -2079,6 +2363,7 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
            RecordSkippedTags(_namespaceMap);
            TransitionTo(HostState.Running);
            _health = new DriverHealth(DriverState.Healthy, DateTime.UtcNow, null);
            _diag.Record(OpcUaClientDiagnostics.ReconnectSuccess);
            return;
        }
@@ -2091,6 +2376,7 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
        // the last-known session for an always-on gateway rather than abandoning recovery
        // entirely.
        TransitionTo(HostState.Faulted);
        _diag.Record(OpcUaClientDiagnostics.ReconnectExhausted);
        _health = new DriverHealth(
            DriverState.Faulted, _health.LastSuccessfulRead,
            "OPC UA session reconnect exhausted its retry window without recovering. " +
@@ -86,8 +86,18 @@ public static class OpcUaClientDriverFactoryExtensions
        ArgumentException.ThrowIfNullOrWhiteSpace(driverInstanceId);
        ArgumentException.ThrowIfNullOrWhiteSpace(driverConfigJson);
-        return JsonSerializer.Deserialize<OpcUaClientDriverOptions>(driverConfigJson, JsonOptions)
+        var options = JsonSerializer.Deserialize<OpcUaClientDriverOptions>(driverConfigJson, JsonOptions)
            ?? throw new InvalidOperationException(
                $"OpcUaClient driver config for '{driverInstanceId}' deserialised to null");
        // #273/#278: nothing runs DataAnnotations on driver options, so range-check here — at options load —
        // and fail with a clear message instead of a driver that faults and retries forever.
        try { OpcUaClientDriver.ValidateTuning(options); }
        catch (InvalidOperationException ex)
        {
            throw new InvalidOperationException(
                $"OpcUaClient driver config for '{driverInstanceId}' is invalid: {ex.Message}", ex);
        }
        return options;
    }
 }
@@ -185,6 +185,61 @@
    </div>
 </section>
@* Subscriptions, limits, revocation, discovery (#273/#275/#277/#278) *@
 <section class="panel rise mt-3" style="animation-delay:.13s">
    <div class="panel-head">Subscriptions, limits &amp; discovery</div>
    <div style="padding:1rem">
        <div class="row g-3">
            <div class="col-md-3">
                <label class="form-label">Publishing interval override (ms)</label>
                <InputNumber @bind-Value="_form.OpcUa.SubscriptionPublishingIntervalMs" @bind-Value:after="EmitAsync" class="form-control form-control-sm" />
                <div class="form-text">Blank = use the interval the runtime requests per subscription.</div>
            </div>
            <div class="col-md-3">
                <label class="form-label">Keep-alive count</label>
                <InputNumber @bind-Value="_form.OpcUa.SubscriptionKeepAliveCount" @bind-Value:after="EmitAsync" class="form-control form-control-sm" />
                <div class="form-text">Default 10.</div>
            </div>
            <div class="col-md-3">
                <label class="form-label">Lifetime count</label>
                <InputNumber @bind-Value="_form.OpcUa.SubscriptionLifetimeCount" @bind-Value:after="EmitAsync" class="form-control form-control-sm" />
                <div class="form-text">Default 1000; at least 3x keep-alive count.</div>
            </div>
            <div class="col-md-3">
                <label class="form-label">Max notifications per publish</label>
                <InputNumber @bind-Value="_form.OpcUa.SubscriptionMaxNotificationsPerPublish" @bind-Value:after="EmitAsync" class="form-control form-control-sm" />
                <div class="form-text">0 = server decides.</div>
            </div>
            <div class="col-md-3">
                <label class="form-label">Subscription priority (0-255)</label>
                <InputNumber @bind-Value="_form.OpcUa.SubscriptionPriority" @bind-Value:after="EmitAsync" class="form-control form-control-sm" />
            </div>
            <div class="col-md-3">
                <div class="form-check form-switch mt-4">
                    <InputCheckbox @bind-Value="_form.OpcUa.RejectUnknownRevocationStatus" @bind-Value:after="EmitAsync" class="form-check-input" id="rejectUnkRevocation" />
                    <label class="form-check-label" for="rejectUnkRevocation">Reject unknown revocation status</label>
                </div>
                <div class="form-text">Revoked certificates are always rejected.</div>
            </div>
            <div class="col-md-6">
                <label class="form-label">Issuer store / CRL directory</label>
                <InputText @bind-Value="_form.OpcUa.IssuerStorePath" @bind-Value:after="EmitAsync" class="form-control form-control-sm mono" />
                <div class="form-text">CRLs are read from its <code>crl/</code> sub-folder. Blank = default PKI store.</div>
            </div>
            <div class="col-md-6">
                <label class="form-label">Discovery URL (FindServers)</label>
                <InputText @bind-Value="_form.OpcUa.DiscoveryUrl" @bind-Value:after="EmitAsync" class="form-control form-control-sm mono" placeholder="opc.tcp://lds:4840" />
                <div class="form-text">Optional. Discovered endpoints are tried after the failover list.</div>
            </div>
            <div class="col-md-6">
                <label class="form-label">Discovery server ApplicationUri</label>
                <InputText @bind-Value="_form.OpcUa.DiscoveryServerUri" @bind-Value:after="EmitAsync" class="form-control form-control-sm mono" />
                <div class="form-text">Required when the discovery server lists more than one server.</div>
            </div>
        </div>
    </div>
 </section>
@* Diagnostics *@
 <section class="panel rise mt-3" style="animation-delay:.14s">
    <div class="panel-head">Diagnostics</div>
@@ -318,6 +373,18 @@
        public int ProbeTimeoutSeconds { get; set; } = 15;
        // #273 / #275 / #277 / #278 — without these the typed form silently drops the keys on save (#576).
        public int? SubscriptionPublishingIntervalMs { get; set; }
        // int, not uint/byte: InputNumber<byte> 500s the page (#505).
        public int SubscriptionKeepAliveCount { get; set; } = 10;
        public int SubscriptionLifetimeCount { get; set; } = 1000;
        public int SubscriptionMaxNotificationsPerPublish { get; set; }
        public int SubscriptionPriority { get; set; }
        public bool RejectUnknownRevocationStatus { get; set; }
        public string? IssuerStorePath { get; set; }
        public string? DiscoveryUrl { get; set; }
        public string? DiscoveryServerUri { get; set; }
        internal IReadOnlyDictionary<string, string> _unsMappingTable = new Dictionary<string, string>();
        public static OpcUaClientFormModel FromRecord(OpcUaClientDriverOptions r) => new()
@@ -343,6 +410,15 @@
            UserCertificatePassword = r.UserCertificatePassword,
            TargetNamespaceKind = r.TargetNamespaceKind,
            ProbeTimeoutSeconds = r.ProbeTimeoutSeconds,
            SubscriptionPublishingIntervalMs = r.SubscriptionPublishingInterval is { } spi ? (int)spi.TotalMilliseconds : null,
            SubscriptionKeepAliveCount = (int)Math.Min(r.SubscriptionKeepAliveCount, int.MaxValue),
            SubscriptionLifetimeCount = (int)Math.Min(r.SubscriptionLifetimeCount, int.MaxValue),
            SubscriptionMaxNotificationsPerPublish = (int)Math.Min(r.SubscriptionMaxNotificationsPerPublish, int.MaxValue),
            SubscriptionPriority = r.SubscriptionPriority,
            RejectUnknownRevocationStatus = r.CertificateValidation.RejectUnknownRevocationStatus,
            IssuerStorePath = r.CertificateValidation.IssuerStorePath,
            DiscoveryUrl = r.DiscoveryUrl,
            DiscoveryServerUri = r.DiscoveryServerUri,
            _unsMappingTable = r.UnsMappingTable,
        };
@@ -371,6 +447,19 @@
            TargetNamespaceKind = TargetNamespaceKind,
            UnsMappingTable = _unsMappingTable,
            ProbeTimeoutSeconds = ProbeTimeoutSeconds,
            SubscriptionPublishingInterval = SubscriptionPublishingIntervalMs is { } ms and > 0
                ? TimeSpan.FromMilliseconds(ms) : null,
            SubscriptionKeepAliveCount = (uint)Math.Max(SubscriptionKeepAliveCount, 0),
            SubscriptionLifetimeCount = (uint)Math.Max(SubscriptionLifetimeCount, 0),
            SubscriptionMaxNotificationsPerPublish = (uint)Math.Max(SubscriptionMaxNotificationsPerPublish, 0),
            SubscriptionPriority = (byte)Math.Clamp(SubscriptionPriority, 0, 255),
            CertificateValidation = new OpcUaCertificateValidationOptions
            {
                RejectUnknownRevocationStatus = RejectUnknownRevocationStatus,
                IssuerStorePath = string.IsNullOrWhiteSpace(IssuerStorePath) ? null : IssuerStorePath,
            },
            DiscoveryUrl = string.IsNullOrWhiteSpace(DiscoveryUrl) ? null : DiscoveryUrl,
            DiscoveryServerUri = string.IsNullOrWhiteSpace(DiscoveryServerUri) ? null : DiscoveryServerUri,
        };
    }
 }
@@ -5169,6 +5169,14 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
            errors[handle.Index] = StatusCodes.BadTimeout;
            results[handle.Index] = new SdkHistoryReadResult { StatusCode = StatusCodes.BadTimeout };
        }
        catch (HistoryAggregateNotSupportedException ex)
        {
            // The backend cannot serve this Part 13 aggregate (#285) — the spec status for THIS node,
            // not a logged server fault.
            _logger.LogDebug(ex, "OtOpcUaNodeManager: backend does not support aggregate for node {NodeId}", handle.NodeId);
            errors[handle.Index] = StatusCodes.BadAggregateNotSupported;
            results[handle.Index] = new SdkHistoryReadResult { StatusCode = StatusCodes.BadAggregateNotSupported };
        }
        catch (Exception ex)
        {
            // One node's backend failure (throw / timeout) must not throw out of the batch — surface a
@@ -5424,6 +5432,26 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
        if (aggregateNodeId == ObjectIds.AggregateFunction_Maximum) return HistoryAggregateType.Maximum;
        if (aggregateNodeId == ObjectIds.AggregateFunction_Total) return HistoryAggregateType.Total;
        if (aggregateNodeId == ObjectIds.AggregateFunction_Count) return HistoryAggregateType.Count;
        if (aggregateNodeId == ObjectIds.AggregateFunction_Interpolative) return HistoryAggregateType.Interpolative;
        if (aggregateNodeId == ObjectIds.AggregateFunction_TimeAverage) return HistoryAggregateType.TimeAverage;
        if (aggregateNodeId == ObjectIds.AggregateFunction_Start) return HistoryAggregateType.Start;
        if (aggregateNodeId == ObjectIds.AggregateFunction_End) return HistoryAggregateType.End;
        if (aggregateNodeId == ObjectIds.AggregateFunction_Delta) return HistoryAggregateType.Delta;
        if (aggregateNodeId == ObjectIds.AggregateFunction_Range) return HistoryAggregateType.Range;
        if (aggregateNodeId == ObjectIds.AggregateFunction_MinimumActualTime) return HistoryAggregateType.MinimumActualTime;
        if (aggregateNodeId == ObjectIds.AggregateFunction_MaximumActualTime) return HistoryAggregateType.MaximumActualTime;
        if (aggregateNodeId == ObjectIds.AggregateFunction_StartBound) return HistoryAggregateType.StartBound;
        if (aggregateNodeId == ObjectIds.AggregateFunction_EndBound) return HistoryAggregateType.EndBound;
        if (aggregateNodeId == ObjectIds.AggregateFunction_DeltaBounds) return HistoryAggregateType.DeltaBounds;
        if (aggregateNodeId == ObjectIds.AggregateFunction_DurationGood) return HistoryAggregateType.DurationGood;
        if (aggregateNodeId == ObjectIds.AggregateFunction_DurationBad) return HistoryAggregateType.DurationBad;
        if (aggregateNodeId == ObjectIds.AggregateFunction_PercentGood) return HistoryAggregateType.PercentGood;
        if (aggregateNodeId == ObjectIds.AggregateFunction_PercentBad) return HistoryAggregateType.PercentBad;
        if (aggregateNodeId == ObjectIds.AggregateFunction_WorstQuality) return HistoryAggregateType.WorstQuality;
        if (aggregateNodeId == ObjectIds.AggregateFunction_NumberOfTransitions) return HistoryAggregateType.NumberOfTransitions;
        if (aggregateNodeId == ObjectIds.AggregateFunction_AnnotationCount) return HistoryAggregateType.AnnotationCount;
        if (aggregateNodeId == ObjectIds.AggregateFunction_StandardDeviationPopulation) return HistoryAggregateType.StandardDeviationPopulation;
        if (aggregateNodeId == ObjectIds.AggregateFunction_VariancePopulation) return HistoryAggregateType.VariancePopulation;
        return null;
    }
@@ -16,10 +16,24 @@ public sealed class AggregateModeMapperTests
    public void Maps_each_aggregate(HistoryAggregateType a, RetrievalMode expected)
        => Assert.Equal(expected, AggregateModeMapper.ToRetrievalMode(a));
-    [Fact] // matrix guard: a new HistoryAggregateType member must fail here
+    [Fact] // matrix guard: every member is either mapped or explicitly reported as not supported
-    public void Every_aggregate_member_is_mapped()
+    public void Every_aggregate_member_is_mapped_or_reports_not_supported()
    {
        var original = new[]
        {
            HistoryAggregateType.Average, HistoryAggregateType.Minimum, HistoryAggregateType.Maximum,
            HistoryAggregateType.Total, HistoryAggregateType.Count,
        };
        foreach (var a in Enum.GetValues<HistoryAggregateType>())
-            _ = AggregateModeMapper.ToRetrievalMode(a); // must not throw for any defined member
+        {
            if (original.Contains(a))
                _ = AggregateModeMapper.ToRetrievalMode(a);
            else
                Assert.Throws<HistoryAggregateNotSupportedException>(() => AggregateModeMapper.ToRetrievalMode(a));
        }
    }
    [Fact]
    public void Undefined_value_is_a_programming_error_not_a_not_supported()
        => Assert.Throws<ArgumentOutOfRangeException>(() => AggregateModeMapper.ToRetrievalMode((HistoryAggregateType)9999));
 }
@@ -0,0 +1,131 @@
 using System.Diagnostics.Metrics;
 using Opc.Ua;
 using Opc.Ua.Client;
 using Shouldly;
 using Xunit;
 namespace ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests;
 /// <summary>
 ///     #276 — session/publish events are published on the <c>otopcua.driver.opcuaclient.events</c> OTel counter.
 ///     The listener filters on a UNIQUE <c>driver_instance</c> tag: the Meter is process-static, so a
 ///     name-only filter would also collect parallel tests' measurements.
 /// </summary>
 [Trait("Category", "Unit")]
 public sealed class OpcUaClientDiagnosticsTests
 {
    private sealed class Capture : IDisposable
    {
        private readonly MeterListener _listener = new();
        private readonly object _gate = new();
        private readonly Dictionary<string, long> _byEvent = new();
        public Capture(string instance)
        {
            _listener.InstrumentPublished = (inst, l) =>
            {
                if (inst.Name == "otopcua.driver.opcuaclient.events") l.EnableMeasurementEvents(inst);
            };
            _listener.SetMeasurementEventCallback<long>((_, value, tags, _) =>
            {
                string? driver = null, evt = null;
                foreach (var t in tags)
                {
                    if (t.Key == "driver_instance") driver = t.Value as string;
                    else if (t.Key == "event") evt = t.Value as string;
                }
                if (driver != instance || evt is null) return;
                lock (_gate) _byEvent[evt] = _byEvent.GetValueOrDefault(evt) + value;
            });
            _listener.Start();
        }
        public long this[string evt] { get { lock (_gate) return _byEvent.GetValueOrDefault(evt); } }
        public void Dispose() => _listener.Dispose();
    }
    [Fact]
    public void Each_event_lands_on_its_own_tagged_series()
    {
        var id = $"diag-{Guid.NewGuid():N}";
        using var cap = new Capture(id);
        var d = new OpcUaClientDiagnostics(id);
        d.Record(OpcUaClientDiagnostics.PublishResponse);
        d.Record(OpcUaClientDiagnostics.Notification, 3);
        d.Record(OpcUaClientDiagnostics.DataChange);
        d.Record(OpcUaClientDiagnostics.BadStatusValue);
        d.Record(OpcUaClientDiagnostics.PublishError);
        d.Record(OpcUaClientDiagnostics.KeepAliveMiss);
        d.Record(OpcUaClientDiagnostics.ReconnectAttempt);
        d.Record(OpcUaClientDiagnostics.ReconnectSuccess);
        d.Record(OpcUaClientDiagnostics.ReconnectExhausted);
        cap[OpcUaClientDiagnostics.PublishResponse].ShouldBe(1);
        cap[OpcUaClientDiagnostics.Notification].ShouldBe(3);
        cap[OpcUaClientDiagnostics.DataChange].ShouldBe(1);
        cap[OpcUaClientDiagnostics.BadStatusValue].ShouldBe(1);
        cap[OpcUaClientDiagnostics.PublishError].ShouldBe(1);
        cap[OpcUaClientDiagnostics.KeepAliveMiss].ShouldBe(1);
        cap[OpcUaClientDiagnostics.ReconnectAttempt].ShouldBe(1);
        cap[OpcUaClientDiagnostics.ReconnectSuccess].ShouldBe(1);
        cap[OpcUaClientDiagnostics.ReconnectExhausted].ShouldBe(1);
    }
    [Fact]
    public void Another_instances_events_are_not_attributed_to_this_one()
    {
        var mine = $"diag-{Guid.NewGuid():N}";
        using var cap = new Capture(mine);
        // Positive control: my own event IS seen; the other instance's identical event is not.
        new OpcUaClientDiagnostics("someone-else").Record(OpcUaClientDiagnostics.KeepAliveMiss);
        new OpcUaClientDiagnostics(mine).Record(OpcUaClientDiagnostics.PublishError);
        cap[OpcUaClientDiagnostics.PublishError].ShouldBe(1);
        cap[OpcUaClientDiagnostics.KeepAliveMiss].ShouldBe(0);
    }
    [Fact]
    public void Concurrent_records_do_not_lose_updates()
    {
        var id = $"diag-{Guid.NewGuid():N}";
        using var cap = new Capture(id);
        var d = new OpcUaClientDiagnostics(id);
        const int threads = 8, each = 2_000;
        Parallel.For(0, threads, _ =>
        {
            for (var i = 0; i < each; i++) d.Record(OpcUaClientDiagnostics.DataChange);
        });
        cap[OpcUaClientDiagnostics.DataChange].ShouldBe(threads * each);
    }
    [Fact]
    public void Zero_or_negative_counts_are_ignored()
    {
        var id = $"diag-{Guid.NewGuid():N}";
        using var cap = new Capture(id);
        var d = new OpcUaClientDiagnostics(id);
        d.Record(OpcUaClientDiagnostics.Notification, 0);
        d.Record(OpcUaClientDiagnostics.Notification, -2);
        d.Record(OpcUaClientDiagnostics.DataChange);   // positive control
        cap[OpcUaClientDiagnostics.Notification].ShouldBe(0);
        cap[OpcUaClientDiagnostics.DataChange].ShouldBe(1);
    }
    /// <summary>
    ///     #275: the driver does not split Read/Write/CreateMonitoredItems itself because the SDK session already
    ///     does — <c>Session</c> derives from <c>SessionClientBatched</c> (which batches by the server's
    ///     OperationLimits, fetched on open). If an SDK bump ever drops that, this goes red and the driver needs
    ///     its own chunking again.
    /// </summary>
    [Fact]
    public void The_sdk_session_is_the_batching_session_type()
    {
        typeof(SessionClientBatched).IsAssignableFrom(typeof(Session)).ShouldBeTrue();
    }
 }
@@ -8,14 +8,23 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests;
 [Trait("Category", "Unit")]
 public sealed class OpcUaClientHistoryTests
 {
    /// <summary>Every <see cref="HistoryAggregateType"/> member (#285: the full Part 13 set, not just five).</summary>
    public static IEnumerable<object[]> AllAggregates() =>
        Enum.GetValues<HistoryAggregateType>().Select(a => new object[] { a });
    /// <summary>Every member maps to a DISTINCT aggregate NodeId (a copy/paste mapping would collide).</summary>
    [Fact]
    public void MapAggregateToNodeId_is_injective_over_the_whole_enum()
    {
        var ids = Enum.GetValues<HistoryAggregateType>().Select(OpcUaClientDriver.MapAggregateToNodeId).ToList();
        ids.Distinct().Count().ShouldBe(ids.Count);
        Enum.GetValues<HistoryAggregateType>().Length.ShouldBeGreaterThan(5);
    }
    /// <summary>Verifies MapAggregateToNodeId returns standard Part 13 aggregate for every enum.</summary>
    /// <param name="agg">The history aggregate type to test.</param>
    [Theory]
-    [InlineData(HistoryAggregateType.Average)]
+    [MemberData(nameof(AllAggregates))]
    [InlineData(HistoryAggregateType.Minimum)]
    [InlineData(HistoryAggregateType.Maximum)]
    [InlineData(HistoryAggregateType.Total)]
    [InlineData(HistoryAggregateType.Count)]
    public void MapAggregateToNodeId_returns_standard_Part13_aggregate_for_every_enum(HistoryAggregateType agg)
    {
        var nodeId = OpcUaClientDriver.MapAggregateToNodeId(agg);
@@ -0,0 +1,216 @@
 using Opc.Ua;
 using Shouldly;
 using Xunit;
 namespace ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests;
 /// <summary>#273 subscription tuning, #277 revocation options, #278 discovery URL.</summary>
 [Trait("Category", "Unit")]
 public sealed class OpcUaClientTuningAndDiscoveryTests
 {
    // ---- #273 ----
    [Fact]
    public void Defaults_equal_the_values_that_used_to_be_hardcoded()
    {
        var o = new OpcUaClientDriverOptions();
        o.SubscriptionKeepAliveCount.ShouldBe(10u);
        o.SubscriptionLifetimeCount.ShouldBe(1000u);
        o.SubscriptionMaxNotificationsPerPublish.ShouldBe(0u);
        o.SubscriptionPriority.ShouldBe((byte)0);
        o.SubscriptionPublishingInterval.ShouldBeNull();
        o.DiscoveryUrl.ShouldBeNull();
        o.CertificateValidation.RejectUnknownRevocationStatus.ShouldBeFalse();
        o.CertificateValidation.IssuerStorePath.ShouldBeNull();
        Should.NotThrow(() => OpcUaClientDriver.ValidateTuning(o));
    }
    [Fact]
    public void Factory_json_binds_the_new_keys_and_old_json_keeps_defaults()
    {
        var o = OpcUaClientDriverFactoryExtensions.ParseOptions("d", """
            {"subscriptionPublishingInterval":"00:00:02","subscriptionKeepAliveCount":20,
             "subscriptionLifetimeCount":600,"subscriptionMaxNotificationsPerPublish":500,
             "subscriptionPriority":9,             "discoveryUrl":"opc.tcp://lds:4840","discoveryServerUri":"urn:plant:l1",
             "certificateValidation":{"rejectUnknownRevocationStatus":true,"issuerStorePath":"/pki/issuers"}}
            """);
        o.SubscriptionPublishingInterval.ShouldBe(TimeSpan.FromSeconds(2));
        o.SubscriptionKeepAliveCount.ShouldBe(20u);
        o.SubscriptionLifetimeCount.ShouldBe(600u);
        o.SubscriptionMaxNotificationsPerPublish.ShouldBe(500u);
        o.SubscriptionPriority.ShouldBe((byte)9);
        o.DiscoveryUrl.ShouldBe("opc.tcp://lds:4840");
        o.DiscoveryServerUri.ShouldBe("urn:plant:l1");
        o.CertificateValidation.RejectUnknownRevocationStatus.ShouldBeTrue();
        o.CertificateValidation.IssuerStorePath.ShouldBe("/pki/issuers");
        var legacy = OpcUaClientDriverFactoryExtensions.ParseOptions("d", """{"endpointUrl":"opc.tcp://x:1"}""");
        legacy.SubscriptionKeepAliveCount.ShouldBe(10u);
        legacy.SubscriptionLifetimeCount.ShouldBe(1000u);
    }
    [Theory]
    [InlineData(0u, 1000u)]     // keep-alive must be >= 1
    [InlineData(10u, 29u)]      // lifetime < 3x keep-alive
    [InlineData(500u, 1000u)]
    public void ValidateTuning_rejects_out_of_range_counts(uint keepAlive, uint lifetime)
    {
        var o = new OpcUaClientDriverOptions { SubscriptionKeepAliveCount = keepAlive, SubscriptionLifetimeCount = lifetime };
        Should.Throw<InvalidOperationException>(() => OpcUaClientDriver.ValidateTuning(o));
    }
    [Fact]
    public void ValidateTuning_accepts_the_3x_boundary_and_rejects_bad_interval_or_discovery_url()
    {
        Should.NotThrow(() => OpcUaClientDriver.ValidateTuning(
            new OpcUaClientDriverOptions { SubscriptionKeepAliveCount = 10, SubscriptionLifetimeCount = 30 }));
        Should.Throw<InvalidOperationException>(() => OpcUaClientDriver.ValidateTuning(
            new OpcUaClientDriverOptions { SubscriptionPublishingInterval = TimeSpan.Zero }));
        Should.Throw<InvalidOperationException>(() => OpcUaClientDriver.ValidateTuning(
            new OpcUaClientDriverOptions { DiscoveryUrl = "not a uri" }));
    }
    [Theory]
    [InlineData(null, 1000, 1000)]     // no override: the per-call value
    [InlineData(null, 10, 50)]         // floor still applies to the per-call value
    [InlineData(2000, 250, 2000)]      // override wins over the per-call value
    [InlineData(5, 250, 50)]           // ... and is floored too
    public void ResolvePublishingIntervalMs_prefers_the_override_and_floors_at_50(int? overrideMs, int requestedMs, int expected)
    {
        var o = new OpcUaClientDriverOptions
        {
            SubscriptionPublishingInterval = overrideMs is { } ms ? TimeSpan.FromMilliseconds(ms) : null,
        };
        OpcUaClientDriver.ResolvePublishingIntervalMs(o, TimeSpan.FromMilliseconds(requestedMs)).ShouldBe(expected);
    }
    // ---- #277 ----
    [Fact]
    public void Revocation_failures_are_exactly_Revoked_and_IssuerRevoked()
    {
        OpcUaClientDriver.IsRevocationFailure(StatusCodes.BadCertificateRevoked).ShouldBeTrue();
        OpcUaClientDriver.IsRevocationFailure(StatusCodes.BadCertificateIssuerRevoked).ShouldBeTrue();
        // "unknown" is governed by RejectUnknownRevocationStatus, not auto-accept's hard exception;
        // untrusted is what auto-accept exists to wave through.
        OpcUaClientDriver.IsRevocationFailure(StatusCodes.BadCertificateRevocationUnknown).ShouldBeFalse();
        OpcUaClientDriver.IsRevocationFailure(StatusCodes.BadCertificateUntrusted).ShouldBeFalse();
        OpcUaClientDriver.IsRevocationFailure(StatusCodes.Good).ShouldBeFalse();
    }
    // ---- #278 ----
    private static EndpointDescription Ep(string url, string policyUri, MessageSecurityMode mode) =>
        new() { EndpointUrl = url, SecurityPolicyUri = policyUri, SecurityMode = mode };
    [Fact]
    public void ResolveEndpointCandidates_without_discovery_is_unchanged()
    {
        var o = new OpcUaClientDriverOptions { EndpointUrls = ["opc.tcp://a:1", "opc.tcp://b:2"] };
        OpcUaClientDriver.ResolveEndpointCandidates(o, []).ShouldBe(["opc.tcp://a:1", "opc.tcp://b:2"]);
        OpcUaClientDriver.ResolveEndpointCandidates(o).ShouldBe(["opc.tcp://a:1", "opc.tcp://b:2"]);
    }
    [Fact]
    public void ResolveEndpointCandidates_puts_configured_endpoints_before_discovered_and_dedups()
    {
        var o = new OpcUaClientDriverOptions { EndpointUrls = ["opc.tcp://Static:1", "opc.tcp://found:2"] };
        var merged = OpcUaClientDriver.ResolveEndpointCandidates(o, ["opc.tcp://found:2", "opc.tcp://new:3"]);
        merged.ShouldBe(["opc.tcp://Static:1", "opc.tcp://found:2", "opc.tcp://new:3"]);
    }
    [Fact]
    public void ResolveEndpointCandidates_uses_the_single_EndpointUrl_before_discovered_when_no_list()
    {
        var o = new OpcUaClientDriverOptions { EndpointUrl = "opc.tcp://only:9" };
        OpcUaClientDriver.ResolveEndpointCandidates(o, ["opc.tcp://d:1"]).ShouldBe(["opc.tcp://only:9", "opc.tcp://d:1"]);
    }
    private static OpcUaClientDriver.DiscoveredEndpoint De(string appUri, string url) => new(appUri, url);
    [Fact]
    public void SelectDiscoveredUrls_with_one_distinct_server_uses_it_and_dedups()
    {
        var urls = OpcUaClientDriver.SelectDiscoveredUrls(
            [De("urn:a", "opc.tcp://a:1"), De("urn:a", "opc.tcp://A:1"), De("urn:a", "opc.tcp://a:2")], null);
        urls.ShouldBe(["opc.tcp://a:1", "opc.tcp://a:2"]);
    }
    [Fact]
    public void SelectDiscoveredUrls_with_several_servers_and_no_filter_fails_naming_them()
    {
        var ex = Should.Throw<InvalidOperationException>(() => OpcUaClientDriver.SelectDiscoveredUrls(
            [De("urn:line1", "opc.tcp://l1:1"), De("urn:line2", "opc.tcp://l2:1")], null));
        ex.Message.ShouldContain("urn:line1");
        ex.Message.ShouldContain("urn:line2");
        ex.Message.ShouldContain("DiscoveryServerUri");
    }
    [Fact]
    public void SelectDiscoveredUrls_filter_picks_only_that_server_even_when_several_are_listed()
    {
        var urls = OpcUaClientDriver.SelectDiscoveredUrls(
            [De("urn:line1", "opc.tcp://l1:1"), De("urn:line2", "opc.tcp://l2:1"), De("urn:line2", "opc.tcp://l2:2")],
            "urn:line2");
        urls.ShouldBe(["opc.tcp://l2:1", "opc.tcp://l2:2"]);
    }
    [Fact]
    public void SelectDiscoveredUrls_filter_matching_nothing_yields_empty_not_another_server()
    {
        OpcUaClientDriver.SelectDiscoveredUrls([De("urn:line1", "opc.tcp://l1:1")], "urn:other").ShouldBeEmpty();
        OpcUaClientDriver.SelectDiscoveredUrls([], null).ShouldBeEmpty();
    }
    // ---- #273: validation at options load ----
    [Theory]
    [InlineData("""{"subscriptionKeepAliveCount":0}""")]
    [InlineData("""{"subscriptionKeepAliveCount":10,"subscriptionLifetimeCount":29}""")]
    [InlineData("""{"discoveryUrl":"not a uri"}""")]
    public void ParseOptions_rejects_out_of_range_tuning_with_a_clear_message(string json)
    {
        var ex = Should.Throw<InvalidOperationException>(
            () => OpcUaClientDriverFactoryExtensions.ParseOptions("drv-bad", json));
        ex.Message.ShouldContain("drv-bad");
        ex.Message.ShouldContain("invalid");
    }
    [Fact]
    public void Factory_CreateInstance_fails_fast_on_a_bad_tuning_config()
    {
        Should.Throw<InvalidOperationException>(() => OpcUaClientDriverFactoryExtensions.CreateInstance(
            "drv-bad", """{"subscriptionLifetimeCount":5}"""));
    }
    [Fact]
    public void FilterEndpointUrls_keeps_only_the_wanted_policy_and_mode()
    {
        const string b256 = "http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256";
        const string none = "http://opcfoundation.org/UA/SecurityPolicy#None";
        var endpoints = new[]
        {
            Ep("opc.tcp://h:1/none", none, MessageSecurityMode.None),
            Ep("opc.tcp://h:1/sign", b256, MessageSecurityMode.Sign),
            Ep("opc.tcp://h:1/enc", b256, MessageSecurityMode.SignAndEncrypt),
            Ep("", b256, MessageSecurityMode.SignAndEncrypt),
        };
        OpcUaClientDriver.FilterEndpointUrls(endpoints, b256, MessageSecurityMode.SignAndEncrypt)
            .ShouldBe(["opc.tcp://h:1/enc"]);
        OpcUaClientDriver.FilterEndpointUrls(endpoints, none, MessageSecurityMode.None)
            .ShouldBe(["opc.tcp://h:1/none"]);
    }
 }
@@ -156,6 +156,49 @@ public sealed class OpcUaClientDriverPageFormSerializationTests
        result.ProbeTimeoutSeconds.ShouldBe(25);
    }
    /// <summary>
    ///     #273/#275/#277/#278: the typed form rewrites the whole record on save, so a key it does not model
    ///     is silently dropped (#576). Every new option must survive FromRecord -> ToRecord.
    /// </summary>
    [Fact]
    public void FormModel_RoundTrip_PreservesTuningLimitsRevocationAndDiscovery()
    {
        var original = new OpcUaClientDriverOptions
        {
            SubscriptionPublishingInterval = TimeSpan.FromMilliseconds(2500),
            SubscriptionKeepAliveCount = 20,
            SubscriptionLifetimeCount = 600,
            SubscriptionMaxNotificationsPerPublish = 500,
            SubscriptionPriority = 9,
            CertificateValidation = new OpcUaCertificateValidationOptions
            {
                RejectUnknownRevocationStatus = true,
                IssuerStorePath = "/pki/issuers",
            },
            DiscoveryUrl = "opc.tcp://lds:4840",
            DiscoveryServerUri = "urn:plant:line1",
        };
        var back = OpcUaClientDriverForm.OpcUaClientFormModel.FromRecord(original).ToRecord([]);
        back.SubscriptionPublishingInterval.ShouldBe(TimeSpan.FromMilliseconds(2500));
        back.SubscriptionKeepAliveCount.ShouldBe(20u);
        back.SubscriptionLifetimeCount.ShouldBe(600u);
        back.SubscriptionMaxNotificationsPerPublish.ShouldBe(500u);
        back.SubscriptionPriority.ShouldBe((byte)9);
        back.DiscoveryServerUri.ShouldBe("urn:plant:line1");
        back.CertificateValidation.RejectUnknownRevocationStatus.ShouldBeTrue();
        back.CertificateValidation.IssuerStorePath.ShouldBe("/pki/issuers");
        back.DiscoveryUrl.ShouldBe("opc.tcp://lds:4840");
        // Defaults round-trip as defaults (blank override stays null, not 0 ms).
        var def = OpcUaClientDriverForm.OpcUaClientFormModel.FromRecord(new OpcUaClientDriverOptions()).ToRecord([]);
        def.SubscriptionPublishingInterval.ShouldBeNull();
        def.SubscriptionKeepAliveCount.ShouldBe(10u);
        def.SubscriptionLifetimeCount.ShouldBe(1000u);
        def.DiscoveryUrl.ShouldBeNull();
    }
    [Fact]
    public void EndpointUrlRow_FromUrl_ToUrl_Trims()
    {
@@ -268,6 +268,52 @@ public sealed class NodeManagerHistoryReadTests : IDisposable
        await host.DisposeAsync();
    }
    /// <summary>#285: a Part 13 aggregate beyond the original five (Interpolative) is forwarded to the
    /// backend as its own <see cref="HistoryAggregateType"/> member.</summary>
    [Fact]
    public async Task Processed_extended_aggregate_dispatches_to_the_source()
    {
        var (host, server) = await BootAsync();
        var nm = server.NodeManager!;
        var fake = new RecordingHistorianDataSource { ProcessedResult = Empty() };
        nm.HistorianDataSource = fake;
        nm.EnsureVariable("eq-1/interp", parentFolderNodeId: null, displayName: "I", dataType: "Float",
            writable: false, historianTagname: "WW.Interp", realm: AddressSpaceRealm.Uns);
        var nodeId = nm.TryGetVariable("eq-1/interp")!.NodeId;
        InvokeHistoryRead(server, nm, new ReadProcessedDetails
        {
            StartTime = DateTime.UtcNow.AddHours(-1), EndTime = DateTime.UtcNow, ProcessingInterval = 10_000.0,
            AggregateType = new NodeIdCollection { ObjectIds.AggregateFunction_Interpolative },
        }, nodeId);
        fake.LastCall.ShouldBe("Processed");
        fake.LastAggregate.ShouldBe(HistoryAggregateType.Interpolative);
        await host.DisposeAsync();
    }
    /// <summary>#285: a backend that cannot serve a mapped aggregate answers BadAggregateNotSupported
    /// (not the generic BadHistoryOperationUnsupported a plain throw produces).</summary>
    [Fact]
    public async Task Processed_backend_unsupported_aggregate_yields_BadAggregateNotSupported()
    {
        var (host, server) = await BootAsync();
        var nm = server.NodeManager!;
        nm.HistorianDataSource = new RecordingHistorianDataSource { AggregateNotSupported = true };
        nm.EnsureVariable("eq-1/ns", parentFolderNodeId: null, displayName: "N", dataType: "Float",
            writable: false, historianTagname: "WW.Ns", realm: AddressSpaceRealm.Uns);
        var nodeId = nm.TryGetVariable("eq-1/ns")!.NodeId;
        var (_, errors) = InvokeHistoryRead(server, nm, new ReadProcessedDetails
        {
            StartTime = DateTime.UtcNow.AddHours(-1), EndTime = DateTime.UtcNow, ProcessingInterval = 10_000.0,
            AggregateType = new NodeIdCollection { ObjectIds.AggregateFunction_PercentGood },
        }, nodeId);
        errors[0].StatusCode.Code.ShouldBe(StatusCodes.BadAggregateNotSupported);
        await host.DisposeAsync();
    }
    /// <summary>AtTime read: the requested timestamps reach ReadAtTimeAsync in order.</summary>
    [Fact]
    public async Task AtTime_dispatches_requested_timestamps()
@@ -430,6 +476,7 @@ public sealed class NodeManagerHistoryReadTests : IDisposable
    private sealed class RecordingHistorianDataSource : IHistorianDataSource
    {
        public bool ThrowOnRead { get; init; }
        public bool AggregateNotSupported { get; init; }
        public HistorianRead RawResult { get; set; } = new(Array.Empty<DataValueSnapshot>(), null);
        public HistorianRead ProcessedResult { get; set; } = new(Array.Empty<DataValueSnapshot>(), null);
        public HistorianRead AtTimeResult { get; set; } = new(Array.Empty<DataValueSnapshot>(), null);
@@ -461,6 +508,7 @@ public sealed class NodeManagerHistoryReadTests : IDisposable
            HistoryAggregateType aggregate, CancellationToken cancellationToken)
        {
            if (ThrowOnRead) throw new InvalidOperationException("backend boom");
            if (AggregateNotSupported) throw new HistoryAggregateNotSupportedException(aggregate);
            LastCall = "Processed";
            LastTagname = fullReference;
            LastStart = startUtc;