fix(historian): #694 R2 cap the crowding re-read room at MaxTieClusterOverfetch

The #687/F4 crowding re-read doubled its room up to 8 re-reads with no cap, so a pathological single-ms
cluster on a streaming gateway was streamed several times over for one page. The room is now capped at
ServerHistorian:MaxTieClusterOverfetch (plumbed into GatewayHistorianDataSource as maxPreWindowRows,
default 65536); past it, or once a read has already seen more, the read is BadTooManyOperations with
PreWindowRows set.

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway/GatewayHistorianDataSource.cs

@@ -54,6 +54,19 @@ public sealed class GatewayHistorianDataSource : IHistorianDataSource, IAsyncDis
     /// <summary>The most #687 crowding re-reads one raw read makes (#694 F4): each at least doubles the pre-window room.</summary>
     private const int MaxCrowdedReReads = 8;
 
+    /// <summary>The default of <c>maxPreWindowRows</c>: <c>ServerHistorian:MaxTieClusterOverfetch</c>'s default.</summary>
+    public const int DefaultMaxPreWindowRows = 65536;
+
+    /// <summary>
+    ///     The most rows before a raw window (inside the 1 ms look-back) a crowding re-read makes room for (#694 R2) — the
+    ///     server's tie-cluster limit (<c>ServerHistorian:MaxTieClusterOverfetch</c>), which every other tie path treats as
+    ///     the limit. More ⇒ <see cref="HistoryReadLimitExceededException"/> with <c>PreWindowRows</c> set.
+    /// </summary>
+    private readonly int _maxPreWindowRows;
+
+    /// <summary>The tie-cluster limit the crowding re-reads honour (#694 R2) — exposed so the factory wiring is testable.</summary>
+    internal int MaxPreWindowRows => _maxPreWindowRows;
+
     /// <summary>A strict gateway's row ceiling, learned from its first refusal (#691.3).</summary>
     private readonly GatewayRowCeiling _ceiling = new();
 
@@ -78,10 +91,15 @@ public sealed class GatewayHistorianDataSource : IHistorianDataSource, IAsyncDis
     ///     #693: serve AtTime from raw reads with the shared AtTime rules (<see cref="GatewayAtTimeReader"/>; default);
     ///     <c>false</c> = AVEVA's own interpolation passed through (<c>ServerHistorian:GatewayAtTimeFromRaw</c> kill switch).
     /// </param>
+    /// <param name="maxPreWindowRows">
+    ///     The most rows before a raw window a crowding re-read makes room for (#694 R2; <c>ServerHistorian:MaxTieClusterOverfetch</c>,
+    ///     values below 1 count as 1). More ⇒ <see cref="HistoryReadLimitExceededException"/> (<c>BadTooManyOperations</c>).
+    /// </param>
     public GatewayHistorianDataSource(IHistorianGatewayClient client, ILogger<GatewayHistorianDataSource> logger,
         int maxRawRows = TimeWeightedAggregator.DefaultMaxWindowRows, TimeProvider? timeProvider = null,
-        bool atTimeFromRaw = true)
+        bool atTimeFromRaw = true, int maxPreWindowRows = DefaultMaxPreWindowRows)
     {
+        _maxPreWindowRows = Math.Max(1, maxPreWindowRows);
         _atTimeFromRaw = atTimeFromRaw;
         ArgumentNullException.ThrowIfNull(client);
         ArgumentNullException.ThrowIfNull(logger);
@@ -214,9 +232,11 @@ public sealed class GatewayHistorianDataSource : IHistorianDataSource, IAsyncDis
         // The margin crowded the window out: re-read with room for the pre-window rows. A read that was itself cut short saw
         // only some of them (#694 F4: a tie cluster of hundreds just before a resume point used to fail even with no
         // ceiling), so the room at least doubles per re-read — bounded by MaxCrowdedReReads, and never past a known ceiling.
+        // #694 R2: the room is capped at the tie-cluster limit (MaxTieClusterOverfetch) — a pathological single-millisecond
+        // cluster on a streaming gateway would otherwise be streamed several times over for one page.
         var preWindow = pass.Result.PreWindowRows;
-        var room = Math.Max(1, preWindow);
-        for (var attempt = 0; attempt < MaxCrowdedReReads; attempt++)
+        var room = Math.Min(Math.Max(1, preWindow), _maxPreWindowRows);
+        for (var attempt = 0; attempt < MaxCrowdedReReads && preWindow <= _maxPreWindowRows; attempt++)
         {
             var budget = (int)Math.Min(int.MaxValue, (long)cap + room + RawAggregateReader.PreWindowAllowance);
             if (_ceiling.Learned is var known and > 0 && budget > known) break; // over a strict ceiling: refused anyway
@@ -224,7 +244,8 @@ public sealed class GatewayHistorianDataSource : IHistorianDataSource, IAsyncDis
             if (pass.Result.Complete) return pass.Result.Samples;
             preWindow = Math.Max(preWindow, pass.Result.PreWindowRows);
             if (pass.Budget < budget) break; // bounded by a ceiling learned meanwhile
-            room = (int)Math.Min(int.MaxValue / 2, Math.Max(preWindow, 2L * room));
+            if (room >= _maxPreWindowRows) break; // the limit's worth of room did not suffice
+            room = (int)Math.Min(_maxPreWindowRows, Math.Max(preWindow, 2L * room));
         }
 
         throw new HistoryReadLimitExceededException(cap,

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway/GatewayHistorianServiceCollectionExtensions.cs

@@ -42,7 +42,9 @@ public static class GatewayHistorian
             // #681: the raw-evaluated per-sample aggregates share the SQL backends' raw-row cap.
             maxRawRows: options.MaxTimeWeightedRawRows,
             // #693: AtTime from raw reads + the shared evaluator; false = AVEVA's own interpolation (kill switch).
-            atTimeFromRaw: options.GatewayAtTimeFromRaw);
+            atTimeFromRaw: options.GatewayAtTimeFromRaw,
+            // #694 R2: a crowding re-read never makes room for more pre-window rows than the tie-cluster limit.
+            maxPreWindowRows: options.MaxTieClusterOverfetch);
     }
 
     /// <summary>