Merge feat/674-historyupdate-posture: future-skew bound, Primary-only HistoryUpdate, SqlServer v1 accepted with modified trail disabled, QuestDB TTL pin (#674)

2026-10-11 11:21:30 -04:00
parent 69190b14f1 0658d244d0
commit e59ab69398
25 changed files with 802 additions and 55 deletions
@@ -27,4 +27,10 @@ public static class HistorianStatusCodes
    ///     status, or a tag name longer than <see cref="HistorianTagNames.MaxLength"/>.
    /// </summary>
    public const uint BadInvalidArgument = 0x80AB0000u;
+
+    /// <summary>
+    ///     A modified-value read or HistoryUpdate item against a SQL Server schema still at version 1 (no Part 11
+    ///     modification trail, Gitea #674): refused without touching the database.
+    /// </summary>
+    public const uint BadHistoryOperationUnsupported = 0x80720000u;
 }
@@ -154,6 +154,12 @@ public sealed class SqlServerHistorianDataSource : IHistorianDataSource
        var bounded = maxValues > 0 && maxValues < int.MaxValue;
        try
        {
+            // #674: a v1 schema has no SampleModified. NotSupportedException is the interface's "no trail" signal (the
+            // node manager reports BadHistoryOperationUnsupported); it is not a backend failure and sends no query.
+            await _bootstrap.EnsureAsync(cancellationToken).ConfigureAwait(false);
+            if (!_bootstrap.SupportsModifiedTrail)
+                throw new NotSupportedException(
+                    $"Historian schema [{_conn.Schema}] is below version {SqlServerSchemaBootstrapper.ModifiedTrailVersion}: no modified-value history.");
            var values = new List<HistoryModifiedValue>();
            var hasMore = false;
            var tagId = await ResolveAsync(fullReference, cancellationToken).ConfigureAwait(false);
@@ -219,7 +225,7 @@ public sealed class SqlServerHistorianDataSource : IHistorianDataSource
            RecordSuccess();
            return new HistoryModifiedReadResult(values, hasMore);
        }
-        catch (Exception ex)
+        catch (Exception ex) when (ex is not NotSupportedException)
        {
            RecordFailure(ex);
            throw;
@@ -27,21 +27,44 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.Historian.SqlServer;
 ///     value from <c>deleted.*</c> (NULL for an insert), the caller's <see cref="HistoryUpdateContext"/>, the
 ///     <see cref="HistoryModificationType"/> and <c>SYSUTCDATETIME()</c>. One statement means the sample change and its
 ///     audit row commit or roll back together: a failed update leaves no audit row.</para>
+///     <para><b>Schema v1 (Gitea #674).</b> Without the trail (<see cref="SqlServerSchemaBootstrapper.SupportsModifiedTrail"/>
+///     false) a change could not be audited, so every item (and DeleteRaw's single result) reports
+///     <c>BadHistoryOperationUnsupported</c> and nothing is sent to the database beyond the one-time schema check.</para>
 /// </summary>
 internal sealed class SqlServerHistorianDataUpdater : IHistorianDataUpdater
 {
    private readonly SqlHistorianConnection _conn;
    private readonly SqlServerTagCatalog _tags;
+    private readonly SqlServerSchemaBootstrapper _bootstrap;

    /// <summary>Creates the updater.</summary>
    /// <param name="conn">Connection helper.</param>
+    /// <param name="bootstrap">Schema bootstrapper — decides whether the modification trail exists (#674).</param>
    /// <param name="tags">Tag catalog (runs the schema bootstrap itself).</param>
-    public SqlServerHistorianDataUpdater(SqlHistorianConnection conn, SqlServerTagCatalog tags)
+    public SqlServerHistorianDataUpdater(SqlHistorianConnection conn, SqlServerSchemaBootstrapper bootstrap,
+        SqlServerTagCatalog tags)
    {
        _conn = conn;
+        _bootstrap = bootstrap;
        _tags = tags;
    }

+    /// <summary>#674: ensures the schema and reports whether the Part 11 trail exists (no SQL after the first success).</summary>
+    /// <param name="ct">Cancellation.</param>
+    /// <returns>True when the modification trail is available.</returns>
+    private async Task<bool> TrailAvailableAsync(CancellationToken ct)
+    {
+        await _bootstrap.EnsureAsync(ct).ConfigureAwait(false);
+        return _bootstrap.SupportsModifiedTrail;
+    }
+
+    private static uint[] Unsupported(int count)
+    {
+        var codes = new uint[count];
+        Array.Fill(codes, HistorianStatusCodes.BadHistoryOperationUnsupported);
+        return codes;
+    }
+
    /// <inheritdoc/>
    public async Task<IReadOnlyList<uint>> UpdateDataAsync(string tag, HistoryUpdateMode mode,
        IReadOnlyList<HistorizationValue> values, HistoryUpdateContext context, CancellationToken ct)
@@ -49,6 +72,7 @@ internal sealed class SqlServerHistorianDataUpdater : IHistorianDataUpdater
        ArgumentNullException.ThrowIfNull(tag);
        ArgumentNullException.ThrowIfNull(values);
        ArgumentNullException.ThrowIfNull(context);
+        if (!await TrailAvailableAsync(ct).ConfigureAwait(false)) return Unsupported(values.Count);
        var plan = HistoryUpdatePlanner.Plan(tag, mode, values);
        if (plan.Winners.Count == 0) return HistoryUpdatePlanner.Complete(plan, mode, new Dictionary<long, UpsertOutcome>());

@@ -68,6 +92,7 @@ internal sealed class SqlServerHistorianDataUpdater : IHistorianDataUpdater
    {
        ArgumentNullException.ThrowIfNull(tag);
        ArgumentNullException.ThrowIfNull(context);
+        if (!await TrailAvailableAsync(ct).ConfigureAwait(false)) return HistorianStatusCodes.BadHistoryOperationUnsupported;
        if (!HistorianTagNames.IsValid(tag)) return HistorianStatusCodes.BadInvalidArgument;
        var tagId = await _tags.TryGetTagIdAsync(tag, ct).ConfigureAwait(false);
        if (tagId is null) return HistoryUpdatePlanner.DeleteRawResult(tagKnown: false, 0);
@@ -95,6 +120,7 @@ internal sealed class SqlServerHistorianDataUpdater : IHistorianDataUpdater
        ArgumentNullException.ThrowIfNull(tag);
        ArgumentNullException.ThrowIfNull(timesUtc);
        ArgumentNullException.ThrowIfNull(context);
+        if (!await TrailAvailableAsync(ct).ConfigureAwait(false)) return Unsupported(timesUtc.Count);
        if (!HistorianTagNames.IsValid(tag))
        {
            var refused = new uint[timesUtc.Count];
@@ -18,8 +18,10 @@ public sealed partial class SqlServerHistorianOptions

    /// <summary>
    ///     <c>true</c> creates the schema and applies missing scripts on first use; <c>false</c> only verifies
-    ///     that the required schema version (<c>SqlServerSchemaBootstrapper.RequiredVersion</c>, currently 2) exists and
-    ///     fails every historian call with a clear error otherwise.
+    ///     that the base schema version (<c>SqlServerSchemaBootstrapper.RequiredVersion</c>, 1) exists and fails every
+    ///     historian call with a clear error otherwise. A verified v1 schema (no Part 11 modification trail, script 002
+    ///     not applied) is served with modified reads and HistoryUpdate refused <c>BadHistoryOperationUnsupported</c>
+    ///     and one Warning per boot (Gitea #674).
    /// </summary>
    public bool AutoCreateSchema { get; set; } = true;

@@ -99,7 +99,7 @@ public sealed class SqlServerHistorianProvider : IHistorianBackendProvider
    public IHistorianDataUpdater? CreateUpdater(IServiceProvider sp)
    {
        var s = Get(sp);
-        return new SqlServerHistorianDataUpdater(s.Conn, s.Catalog);
+        return new SqlServerHistorianDataUpdater(s.Conn, s.Bootstrap, s.Catalog);
    }

    /// <inheritdoc />
@@ -11,7 +11,8 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.Historian.SqlServer;
 ///     <c>DELETE TOP(n)</c> batches (under the lock-escalation threshold). Samples are purged per tag so each
 ///     delete is a seek on the clustered key <c>(TagId, SourceTimeUtc)</c>; events seek on <c>CX_Event_Time</c>.
 ///     A session <c>sp_getapplock</c> (timeout 0) serialises purgers that share one database; a loser skips.
-///     To purge another table later, add it to <see cref="PurgeAsync"/>.
+///     To purge another table later, add it to <see cref="PurgeAsync"/>. On a v1 schema (no Part 11 trail, Gitea #674)
+///     the <c>SampleModified</c> purge is skipped and absent from the results.
 /// </summary>
 internal sealed class SqlServerHistorianRetention : IHistorianRetention
 {
@@ -72,6 +73,8 @@ internal sealed class SqlServerHistorianRetention : IHistorianRetention
                return [];
            }

+            // #674: a v1 schema has no SampleModified table — skip its purge rather than fail the whole pass.
+            var trail = _bootstrap.SupportsModifiedTrail;
            long samples = 0, modified = 0;
            var tagIds = new List<int>();
            await using (var cmd = _conn.CreateCommand(conn, $"SELECT TagId FROM {_conn.Q("Tag")}"))
@@ -85,21 +88,30 @@ internal sealed class SqlServerHistorianRetention : IHistorianRetention
                    cutoff, id, ct).ConfigureAwait(false);
                // The Part 11 modification trail (#668) ages out on the SAME source-time cutoff as the samples it
                // describes; a purge never writes to it (no trigger, no OUTPUT INTO).
-                modified += await DeleteLoopAsync(conn,
-                    $"DELETE TOP (@n) FROM {_conn.Q("SampleModified")} WHERE TagId = @id AND SourceTimeUtc < @cutoff",
-                    cutoff, id, ct).ConfigureAwait(false);
+                if (trail)
+                {
+                    modified += await DeleteLoopAsync(conn,
+                        $"DELETE TOP (@n) FROM {_conn.Q("SampleModified")} WHERE TagId = @id AND SourceTimeUtc < @cutoff",
+                        cutoff, id, ct).ConfigureAwait(false);
+                }
            }

            var events = await DeleteLoopAsync(conn,
                $"DELETE TOP (@n) FROM {_conn.Q("Event")} WHERE EventTimeUtc < @cutoff",
                cutoff, null, ct).ConfigureAwait(false);

-            return
-            [
-                new RetentionPurgeResult("Sample", samples),
-                new RetentionPurgeResult("SampleModified", modified),
-                new RetentionPurgeResult("Event", events),
-            ];
+            return trail
+                ?
+                [
+                    new RetentionPurgeResult("Sample", samples),
+                    new RetentionPurgeResult("SampleModified", modified),
+                    new RetentionPurgeResult("Event", events),
+                ]
+                :
+                [
+                    new RetentionPurgeResult("Sample", samples),
+                    new RetentionPurgeResult("Event", events),
+                ];
        }
        finally
        {
@@ -15,15 +15,27 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.Historian.SqlServer;
 ///     SQL, so a missing schema (or a SQL outage) does not serialise every write, read and alarm event behind one
 ///     semaphore and one round-trip each.
 ///     With <c>AutoCreateSchema=false</c> it only verifies <c>MAX(Version) &gt;= </c><see cref="RequiredVersion"/>.
+///     <para><b>Schema v1 is accepted (Gitea #674).</b> A database at version 1 (no <c>SampleModified</c>) still serves
+///     live writes, raw / processed / at-time reads, alarm events and retention; only the Part 11 modification trail is
+///     unavailable — <see cref="SupportsModifiedTrail"/> is false, modified reads and HistoryUpdate report
+///     <c>BadHistoryOperationUnsupported</c> without touching SQL, and one Warning is logged per instance (= per boot: the
+///     provider shares one bootstrapper). Before #674 a v1 database refused EVERY historian call, continuous-historization
+///     drains included, until script 002 was applied by hand.</para>
 /// </summary>
 internal sealed partial class SqlServerSchemaBootstrapper
 {
    /// <summary>
-    ///     The schema version this build requires: 2 = <c>002_sample_modified.sql</c> (Part 11 modified-value
-    ///     history, Gitea #668). An existing v1 schema is upgraded in place on the next bootstrap when
-    ///     <c>AutoCreateSchema</c> is on; otherwise the script must be applied by hand.
+    ///     The schema version this build requires to serve at all: 1 = <c>001_initial.sql</c>. Gitea #674 lowered it from
+    ///     2 — a missing modification trail disables only the features that need it (<see cref="ModifiedTrailVersion"/>).
    /// </summary>
-    public const int RequiredVersion = 2;
+    public const int RequiredVersion = 1;
+
+    /// <summary>
+    ///     The schema version that carries the Part 11 modification trail: 2 = <c>002_sample_modified.sql</c> (Gitea #668).
+    ///     An auto-creating bootstrap always upgrades to it; with <c>AutoCreateSchema=false</c> the script must be applied by
+    ///     hand (and the node restarted — the verdict is taken once per instance).
+    /// </summary>
+    public const int ModifiedTrailVersion = 2;

    private const string LockResource = "OtOpcUaHistorianSchema";
    private const int LockTimeoutMs = 30_000;
@@ -34,6 +46,13 @@ internal sealed partial class SqlServerSchemaBootstrapper
    private readonly SemaphoreSlim _gate = new(1, 1);
    private readonly BootstrapFailureCache _failure; // guarded by _gate
    private volatile bool _ready;
+    private volatile bool _supportsModifiedTrail;
+
+    /// <summary>
+    ///     Whether the schema carries the Part 11 modification trail (version &gt;= <see cref="ModifiedTrailVersion"/>).
+    ///     Meaningful only after <see cref="EnsureAsync"/> has succeeded (false before). Taken once per instance.
+    /// </summary>
+    public bool SupportsModifiedTrail => _supportsModifiedTrail;

    /// <summary>Creates the bootstrapper.</summary>
    /// <param name="conn">Connection helper.</param>
@@ -99,6 +118,13 @@ internal sealed partial class SqlServerSchemaBootstrapper
            throw new HistorianSchemaMissingException(
                $"Historian schema [{_conn.Schema}] is missing version {RequiredVersion} (found {v}) and AutoCreateSchema is false. " +
                "Apply the docs/historian/sqlserver/NNN_*.sql scripts above version " + v + " in order, or enable AutoCreateSchema.");
+        _supportsModifiedTrail = v >= ModifiedTrailVersion;
+        if (!_supportsModifiedTrail)
+            _log.LogWarning("Historian schema [{Schema}] is at version {Version}, below {TrailVersion}, and AutoCreateSchema is false: " +
+                "the Part 11 modification trail is unavailable, so modified-value history reads and HistoryUpdate report " +
+                "BadHistoryOperationUnsupported and retention skips SampleModified. Live historization, reads, events and retention " +
+                "are unaffected. Apply docs/historian/sqlserver/002_sample_modified.sql and restart the node to enable them.",
+                _conn.Schema, v, ModifiedTrailVersion);
    }

    private async Task ApplyAsync(SqlConnection conn, CancellationToken ct)
@@ -252,13 +252,15 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
        if (_primaryRoleSource is { } primaryRoleSource)
        {
            _server.SetNativeAlarmAckPrimaryGate(() => primaryRoleSource.ShouldActAsPrimary);
+            // Gitea #674: HistoryUpdate is single-writer — only the Primary rewrites history (BadInvalidState elsewhere).
+            _server.SetHistoryUpdatePrimaryGate(() => primaryRoleSource.ShouldActAsPrimary);
        }
        else
        {
            // Every driver node registers one (AddOtOpcUaRuntime), so this is a wiring regression, not a mode:
            // say so rather than let a Secondary silently go back to accepting acks it will revert.
            _logger.LogWarning(
-                "OtOpcUaServerHostedService: no IDriverPrimaryRoleSource registered — native-alarm acknowledges are accepted on every node regardless of redundancy role");
+                "OtOpcUaServerHostedService: no IDriverPrimaryRoleSource registered — native-alarm acknowledges and HistoryUpdate are accepted on every node regardless of redundancy role");
        }

        // Wire the reverse-path inbound operator-write gateway: a client write to a writable equipment-tag
@@ -317,6 +319,11 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
        _server.NodeManager.MaxConcurrentHistoryReadBatches = _serverHistorianOptions.MaxConcurrentHistoryReadBatches;
        _server.NodeManager.HistoryReadDeadline = _serverHistorianOptions.HistoryReadDeadline;

+        // Gitea #674: HistoryUpdate refuses a SourceTimestamp beyond now + HistoryUpdateMaxFutureSkew (BadOutOfRange),
+        // judged against the host clock.
+        _server.NodeManager.HistoryUpdateMaxFutureSkew = _serverHistorianOptions.HistoryUpdateMaxFutureSkew;
+        _server.NodeManager.Clock = _time;
+
        // ServiceLevel publisher needs IServerInternal — only available after Start.
        if (_server.CurrentInstance is { } serverInternal)
        {
@@ -382,6 +389,7 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
        // Clear the native-alarm-ack router so a late ack doesn't Tell a stopping DriverHostActor.
        _server?.SetNativeAlarmAckRouter(null);
        _server?.SetNativeAlarmAckPrimaryGate(null);
+        _server?.SetHistoryUpdatePrimaryGate(null);
        // Restore the Null historian so a late HistoryRead doesn't hit a disposed read client.
        _server?.SetHistorianDataSource(null);
        _server?.SetHistorianDataUpdater(null);
@@ -247,6 +247,48 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
    /// </summary>
    public Func<bool>? NativeAlarmAckPrimaryGate { get; set; }

+    /// <summary>
+    ///     Gitea #674 — whether this node may serve an OPC UA HistoryUpdate right now: the redundancy data-plane
+    ///     verdict (<c>PrimaryGatePolicy.ShouldServiceAsPrimary</c>, as published to <c>IDriverPrimaryRoleSource</c>) —
+    ///     the same source as <see cref="NativeAlarmAckPrimaryGate"/>.
+    ///     <para>
+    ///         <c>false</c> ⇒ every node of the request that passed authorization is refused <c>BadInvalidState</c>
+    ///         and nothing reaches the updater. Rewriting history is a single-writer operation: the SQL backends'
+    ///         prior-value capture (and QuestDB's per-process per-tag lock) assume one node serialises a tag's updates,
+    ///         so both pair nodes accepting updates concurrently could record a wrong prior value in the modification
+    ///         trail. HistoryRead is NOT gated — reads are served from any node.
+    ///     </para>
+    ///     <para>
+    ///         Evaluated AFTER authorization (a caller who may not update learns nothing about the node's role). It must
+    ///         be a cheap, non-blocking read (the host passes a volatile-backed property). Null (the default) allows — the
+    ///         single-node posture, the same default <c>UnmanagedDriverPrimaryRoleSource</c> answers with.
+    ///     </para>
+    /// </summary>
+    public Func<bool>? HistoryUpdatePrimaryGate { get; set; }
+
+    /// <summary>
+    ///     Gitea #674 — how far beyond <see cref="Clock"/>'s now a HistoryUpdate (Insert / Replace / Update) item's
+    ///     <c>SourceTimestamp</c> may lie. An item past <c>now + skew</c> is refused <c>BadOutOfRange</c> before it
+    ///     reaches any backend: a far-future row (a 2062 typo) is never a legitimate history edit, and on a backend whose
+    ///     retention is judged against the newest timestamp it could age out every older partition. Mirrors
+    ///     <c>ServerHistorianOptions.HistoryUpdateMaxFutureSkew</c>; the Host sets it at <c>StartAsync</c>. Non-positive
+    ///     disables the bound. Default 1 day. Live recorder writes are not bounded by this.
+    /// </summary>
+    public TimeSpan HistoryUpdateMaxFutureSkew { get; set; } = TimeSpan.FromDays(1);
+
+    /// <summary>
+    ///     The clock the HistoryUpdate future-skew bound (<see cref="HistoryUpdateMaxFutureSkew"/>) reads. The Host
+    ///     assigns its <see cref="TimeProvider"/> at <c>StartAsync</c>; tests inject a fixed clock. Defaults to
+    ///     <see cref="TimeProvider.System"/>; assigning null restores it.
+    /// </summary>
+    public TimeProvider Clock
+    {
+        get => _clock;
+        set => _clock = value ?? TimeProvider.System;
+    }
+
+    private volatile TimeProvider _clock = TimeProvider.System;
+
    private volatile IOpcUaNodeWriteGateway _nodeWriteGateway = NullOpcUaNodeWriteGateway.Instance;

    /// <summary>
@@ -5365,6 +5407,8 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
        List<NodeHandle> nodesToProcess,
        IDictionary<NodeId, NodeState> cache)
    {
+        // #674: one "now" per request, so every item of the batch is judged against the same bound.
+        var latest = LatestAcceptedSourceTime();
        ServeHistoryUpdate(context, nodesToProcess, results, errors, handle =>
        {
            var details = nodesToUpdate[handle.Index];
@@ -5378,7 +5422,7 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
            }

            var items = (IList<DataValue>?)details.UpdateValues ?? Array.Empty<DataValue>();
-            return (updater, tagname, who, ct) => UpdateDataAsync(updater, tagname, mode, items, who, ct);
+            return (updater, tagname, who, ct) => UpdateDataAsync(updater, tagname, mode, items, latest, who, ct);
        });
    }

@@ -5440,22 +5484,40 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
        });
    }

+    /// <summary>
+    ///     #674: the latest <c>SourceTimestamp</c> a HistoryUpdate item may carry — <see cref="Clock"/>'s now plus
+    ///     <see cref="HistoryUpdateMaxFutureSkew"/> — or <c>null</c> when the bound is disabled (non-positive skew).
+    ///     Saturates at <see cref="DateTime.MaxValue"/> rather than overflowing for an absurd configured skew.
+    /// </summary>
+    /// <returns>The inclusive upper bound, or null for unbounded.</returns>
+    private DateTime? LatestAcceptedSourceTime()
+    {
+        var skew = HistoryUpdateMaxFutureSkew;
+        if (skew <= TimeSpan.Zero) return null;
+        var now = _clock.GetUtcNow().UtcDateTime;
+        return skew.Ticks > DateTime.MaxValue.Ticks - now.Ticks
+            ? new DateTime(DateTime.MaxValue.Ticks, DateTimeKind.Utc)
+            : now + skew;
+    }
+
    /// <summary>
    ///     Applies one node's UpdateDataDetails: items the server can refuse on its own
-    ///     (<c>SourceTimestamp == DateTime.MinValue</c> ⇒ <c>BadInvalidTimestamp</c>; a value
-    ///     <see cref="HistorianValue.TryFromObject"/> cannot type ⇒ <c>BadTypeMismatch</c>) are answered locally,
-    ///     the rest go to the updater in ONE call, and the per-item codes are stitched back in request order.
+    ///     (<c>SourceTimestamp == DateTime.MinValue</c> ⇒ <c>BadInvalidTimestamp</c>; a <c>SourceTimestamp</c> later than
+    ///     <paramref name="latest"/> ⇒ <c>BadOutOfRange</c>, #674; a value <see cref="HistorianValue.TryFromObject"/>
+    ///     cannot type ⇒ <c>BadTypeMismatch</c>) are answered locally, the rest go to the updater in ONE call, and the
+    ///     per-item codes are stitched back in request order.
    /// </summary>
    /// <param name="updater">The wired updater.</param>
    /// <param name="tagname">The node's historian tagname.</param>
    /// <param name="mode">The update mode.</param>
    /// <param name="items">The request's values, in order.</param>
+    /// <param name="latest">The latest accepted source time (<see cref="LatestAcceptedSourceTime"/>); null = unbounded.</param>
    /// <param name="who">The caller, recorded in the modification trail.</param>
    /// <param name="ct">The request deadline.</param>
    /// <returns>The node's result, carrying one operation result per item.</returns>
    private static async Task<HistoryUpdateResult> UpdateDataAsync(
        IHistorianDataUpdater updater, string tagname, HistoryUpdateMode mode, IList<DataValue> items,
-        HistoryUpdateContext who, CancellationToken ct)
+        DateTime? latest, HistoryUpdateContext who, CancellationToken ct)
    {
        var codes = new uint[items.Count];
        var toSend = new List<HistorizationValue>(items.Count);
@@ -5471,6 +5533,11 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
            {
                codes[i] = StatusCodes.BadInvalidTimestamp;
            }
+            else if (latest is { } bound && item.SourceTimestamp > bound)
+            {
+                // #674: a far-future history edit is refused before any backend sees it (wire timestamps are UTC).
+                codes[i] = StatusCodes.BadOutOfRange;
+            }
            else if (!HistorianValue.TryFromObject(item.Value, out var value))
            {
                codes[i] = StatusCodes.BadTypeMismatch;
@@ -5521,6 +5588,21 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
        nodesToProcess = AuthorizeHistoryUpdate(context, nodesToProcess, results, errors);
        if (nodesToProcess.Count == 0) return;

+        // #674 — PRIMARY GATE, after authorization (a caller who may not update learns nothing about the node's role).
+        // Off-Primary every authorized node is refused BadInvalidState and nothing reaches the updater.
+        if (HistoryUpdatePrimaryGate is { } primary && !primary())
+        {
+            var refusal = new ServiceResult(StatusCodes.BadInvalidState,
+                new LocalizedText("This server is not the redundancy Primary; update history on the Primary (the server with the higher ServiceLevel)."));
+            foreach (var handle in nodesToProcess)
+            {
+                errors[handle.Index] = refusal;
+                results[handle.Index] = new HistoryUpdateResult { StatusCode = StatusCodes.BadInvalidState };
+            }
+
+            return;
+        }
+
        // Who is rewriting history — recorded on every modification-trail row (Part 11 ModificationInfo.UserName, #668).
        var who = HistoryUpdateCallerOf(context);

@@ -83,6 +83,21 @@ public sealed class OtOpcUaSdkServer : StandardServer
        return true;
    }

+    /// <summary>
+    ///     Gitea #674 — wire the redundancy verdict that decides whether this node serves an OPC UA HistoryUpdate
+    ///     (<see cref="OtOpcUaNodeManager.HistoryUpdatePrimaryGate"/>); on any other node every authorized node of a
+    ///     HistoryUpdate is refused <c>BadInvalidState</c>. Passing <c>null</c> clears it (allow). No-op (returns
+    ///     <c>false</c>) when the node manager has not been created yet (mirrors <see cref="SetNativeAlarmAckPrimaryGate"/>).
+    /// </summary>
+    /// <param name="isPrimary">A cheap, non-blocking read of the data-plane Primary verdict; null to allow.</param>
+    /// <returns><c>true</c> when set on a live node manager; <c>false</c> when no node manager exists yet.</returns>
+    public bool SetHistoryUpdatePrimaryGate(Func<bool>? isPrimary)
+    {
+        if (_otOpcUaNodeManager is null) return false;
+        _otOpcUaNodeManager.HistoryUpdatePrimaryGate = isPrimary;
+        return true;
+    }
+
    /// <summary>
    ///     Wire the reverse-path gateway for inbound operator writes to writable equipment-tag nodes onto the
    ///     created <see cref="OtOpcUaNodeManager"/>. The host calls this after start with an
@@ -122,6 +122,16 @@ public sealed class ServerHistorianOptions
    /// </summary>
    public int MaxTimeWeightedRawRows { get; init; } = 1_000_000;

+    /// <summary>
+    ///     Gitea #674: how far into the future an OPC UA HistoryUpdate (Insert / Replace / Update) item's
+    ///     <c>SourceTimestamp</c> may lie, measured from the server clock. An item beyond <c>now + skew</c> is refused
+    ///     <c>BadOutOfRange</c> by the node manager before any backend sees it — a far-future row is never a legitimate
+    ///     history edit, and on a backend that judges retention against the newest timestamp it could age out every
+    ///     older partition. Applies to every backend. The live recorder is not bounded. Non-positive disables the bound.
+    ///     Default 1 day.
+    /// </summary>
+    public TimeSpan HistoryUpdateMaxFutureSkew { get; init; } = TimeSpan.FromDays(1);
+
    /// <summary>Returns operator-facing misconfiguration warnings for an <c>Enabled</c> historian
    /// (empty when disabled or correctly configured). Pure — the registration logs each entry.
    /// <para>