fix(opcua): replay writes deferred during an off-thread plan; cache-ref and guard fixes (Lane B fix round 1)

C1 (critical): B6 computes the plan off the pinned thread while B1 made writes non-creating, so a value/status/alarm write for a node the in-flight plan adds was skipped, and change-driven drivers never republish it (BadWaitingForInitialData indefinitely; on a full rebuild every re-subscribe value landed on discarded nodes). OpcUaPublishActor now applies writes immediately AND remembers the latest per (realm, id) while a plan is in flight or queued (value+status compose; alarm state/quality coalesce to the latest, which the node's delta gate makes inert on an existing condition), replays it after each apply before answering, and drops it once the pipeline is idle. Bounded (250k keys by default; beyond it new keys are not held, logged once). I2: the data-plane-authority parse runs in its own try inside the plan task; a throw is logged and never degrades the address-space apply. I3: the SDK's DeleteMonitoredItems releases an item's component-cache reference on a Good delete; a tombstoned item's reference was already released, so the delete took one from the re-created node's entry. Released items are remembered and the orphan delete takes one back first. Event items never held a reference (EventManager + SubscribeToEvents), so the three event-item releases are gone. I4: direct tests for the HistoryUpdate override's per-request updater check and the HistoryReadEvents override's source guard (both reached by restoring the bit after a reset - the B7 race window); fixed the false remark. Minors: the MaterialiseAlarmCondition kind-swap tombstones the dropped instance; a bytes-less rebuild arriving mid-plan queues behind it (replies in order); a PlanReady/PlanFailed from a previous actor incarnation is ignored and its requester answered degraded; the tie-cluster end bound of an uncapped read fits against the backend ceiling (defence in depth - guarded by a sweep test); the lock-time benchmark stays in the default run, headroom noted. Refs #732 Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT
2026-10-22 14:30:11 -04:00
parent 7c7ecff974
commit f966efcfad
9 changed files with 977 additions and 30 deletions
@@ -1494,6 +1494,9 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
                // same-key kind-swap ever carries wired notifiers), but this is the one asymmetric teardown
                // path; keep it symmetric with RemoveAlarmConditionNode / RebuildAddressSpace.
                UnwireAlarmNotifiers(conditionKey);
+                // A removal path like any other (review 01 L2): the dropped instance's items are told and its
+                // fan-out forgotten, or a new item on the swapped-in condition would bind to the dead one.
+                TombstoneMonitoredSubtree(existing, UtcNow);
                existing.Parent?.RemoveChild(existing);
                ForgetPredefinedSubtree(existing);
                // The materialise tail raises only the new instance's unit (no full reconcile), so give the
@@ -4413,6 +4416,18 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
                    || current.DataChangeMonitoredItems?.Contains(dataItem) != true))
            {
                OnMonitoredItemDeleted(context, handle, dataItem);
+
+                // Review fix I3 — the SDK's DeleteMonitoredItems releases the item's component-cache reference
+                // whenever this returns Good. A tombstoned item's reference was ALREADY released by the removal, so
+                // that second release would take one from the RE-CREATED node's entry (a new item on the same NodeId)
+                // and evict it while still referenced. Take one back first so the SDK's release nets to zero —
+                // returning a non-Good status instead would fail the client's delete.
+                if (_cacheReferenceReleased.TryGetValue(dataItem, out _))
+                {
+                    _cacheReferenceReleased.Remove(dataItem);
+                    AddNodeToComponentCache(context, handle, handle.Node);
+                }
+
                return ServiceResult.Good;
            }
        }
@@ -4472,11 +4487,10 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2

            if (monitored.EventMonitoredItems is { Count: > 0 } eventItems)
            {
-                foreach (var item in eventItems.ToArray())
-                {
-                    _eventItems.TryRemove(item, out _);
-                    ReleaseComponentCacheReference(item);
-                }
+                // No component-cache release: an event item never took a reference (the master node manager
+                // creates it through the EventManager + SubscribeToEvents, not AddNodeToComponentCache), so a
+                // release here would take one from a DATA item on the same NodeId.
+                foreach (var item in eventItems.ToArray()) _eventItems.TryRemove(item, out _);
            }
        }

@@ -4534,7 +4548,7 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
            if (!tracked.Suppressed || (nodeId is not null && tracked.Handle.NodeId != nodeId)) continue;
            if (!_eventItems.TryRemove(item, out _)) continue;
            Interlocked.Decrement(ref _suppressedItems);
-            ReleaseComponentCacheReference(item);
+            // Event items hold no component-cache reference (see TombstoneMonitoredNode).
        }
    }

@@ -4555,13 +4569,21 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
        }
    }

-    /// <summary>Gives back the component-cache reference the SDK took for <paramref name="item"/> at create, so
-    /// the cache stops handing out the removed node for that NodeId.</summary>
+    /// <summary>Gives back the component-cache reference the SDK took for the DATA item <paramref name="item"/> at
+    /// create, so the cache stops handing out the removed node for that NodeId — and remembers that it did, so the
+    /// item's later client delete does not give it back a second time (see <see cref="DeleteMonitoredItem"/>).</summary>
    private void ReleaseComponentCacheReference(IMonitoredItem item)
    {
-        if (item.ManagerHandle is NodeHandle handle) RemoveNodeFromComponentCache(SystemContext, handle);
+        if (item.ManagerHandle is not NodeHandle handle) return;
+        RemoveNodeFromComponentCache(SystemContext, handle);
+        _cacheReferenceReleased.AddOrUpdate(item, ReleasedMarker);
    }

+    /// <summary>Data items whose component-cache reference a removal already gave back (review fix I3). Weak, so an
+    /// item the SDK drops without a delete (it always deletes, but a leak here would be silent) is not kept alive.</summary>
+    private readonly System.Runtime.CompilerServices.ConditionalWeakTable<IMonitoredItem, object> _cacheReferenceReleased = new();
+    private static readonly object ReleasedMarker = new();
+
    /// <summary>Test observability: how many NodeIds currently carry a <see cref="MonitoredNode2"/> fan-out.</summary>
    internal int MonitoredNodeCount
    {
@@ -5352,8 +5374,7 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
                {
                    _eventItems.TryRemove(item, out _);
                    Interlocked.Decrement(ref _suppressedItems);
-                    ReleaseComponentCacheReference(item);
-                    continue;
+                    continue; // an event item holds no component-cache reference (see TombstoneMonitoredNode)
                }

                SubscribeToEvents(SystemContext, tracked.Handle.Node, item, unsubscribe: !permitted);
@@ -7065,7 +7086,11 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
                else if (endBound is not null)
                {
                    // The data is drained — the end bound ends this page, or is the next one when this one is full.
-                    clusterCp = await AppendEndBoundAsync(slice, startUtc, readCap).ConfigureAwait(false);
+                    // An uncapped read (readCap 0) on a backend with a row ceiling is still a page of at most that
+                    // ceiling — the MaxReturnDataValues it advertises — so the bound fits against it, not "unbounded".
+                    // (Today the over-fetch bound keeps a cluster slice at most L − 1, so this is defence in depth.)
+                    var clusterAllowance = readCap > 0 ? readCap : pageLimit > 0 ? (uint)pageLimit : 0u;
+                    clusterCp = await AppendEndBoundAsync(slice, startUtc, clusterAllowance).ConfigureAwait(false);
                }

                results[handle.Index] = new SdkHistoryReadResult
@@ -132,16 +132,56 @@ public sealed class OpcUaPublishActor : ReceiveActor, IWithTimers
    ///     which are the only part that must run on this actor's thread. Carries the <see cref="Request"/> and
    ///     the original <see cref="Requester"/> so the <see cref="RebuildCompleted"/> reply reaches whoever asked.
    /// </summary>
+    /// <para><see cref="Incarnation"/> stamps the actor instance that started the plan: a <c>PipeTo(Self)</c>
+    ///     outlives a restart (the ActorRef survives it), and a plan computed against a previous instance's
+    ///     <see cref="_lastApplied"/> must not be applied by the next one. <see cref="AuthorityError"/> carries a
+    ///     data-plane-authority parse failure, which never fails the address-space apply (review fix I2).</para>
+    /// </summary>
    private sealed record PlanReady(
-        RebuildAddressSpace Request, IActorRef Requester, byte[] Artifact, DataPlaneAuthorityProjection? Authority,
+        object Incarnation, RebuildAddressSpace Request, IActorRef Requester, byte[] Artifact,
+        DataPlaneAuthorityProjection? Authority, Exception? AuthorityError,
        AddressSpaceComposition Composition, AddressSpacePlan Plan, IReadOnlyList<string> Inconsistencies);

    /// <summary>The off-thread parse / plan step threw (unreadable bytes, a composer fault).</summary>
-    private sealed record PlanFailed(RebuildAddressSpace Request, IActorRef Requester, Exception Error);
+    private sealed record PlanFailed(object Incarnation, RebuildAddressSpace Request, IActorRef Requester, Exception Error);
+
+    /// <summary>Test seams for the off-thread plan step. Production passes none.</summary>
+    public sealed class TestHooks
+    {
+        /// <summary>Runs on the thread pool at the start of every plan step (a test blocks it to hold a plan in flight).</summary>
+        public Action? BeforePlan { get; init; }
+
+        /// <summary>Replaces <see cref="ParsedDeploymentArtifact.ParseDataPlaneAuthority"/> (a test makes it throw).</summary>
+        internal Func<ParsedDeploymentArtifact, string, DataPlaneAuthorityProjection>? ParseAuthority { get; init; }
+    }
+
+    /// <summary>The default bound on <see cref="_deferred"/>: distinct (realm, id) keys held while a plan is in flight.</summary>
+    public const int DefaultDeferredWriteCapacity = 250_000;
+
+    /// <summary>Identity of THIS actor instance (see <see cref="PlanReady.Incarnation"/>).</summary>
+    private readonly object _incarnation = new();
+    private readonly TestHooks? _hooks;
+
+    /// <summary>
+    ///     Review fix C1 — the latest value / status / alarm write per (realm, id) received while a rebuild's plan is
+    ///     in flight (or queued), replayed through the sink after each apply. Writes are non-creating (review 01 L1),
+    ///     so a driver's first publish for a node the in-flight plan ADDS used to be skipped — and a change-driven
+    ///     driver (or a poll group whose last-value cache already holds it) never sends it again, leaving the node
+    ///     <c>BadWaitingForInitialData</c> indefinitely. On a full rebuild the same holds for every node: the
+    ///     re-subscribe's first values land on old nodes the apply then discards.
+    ///     <para>Writes are still applied IMMEDIATELY (existing nodes keep updating during the plan); the buffer
+    ///     only remembers each key's latest so the replay can land it on a node the apply created. Replaying onto a
+    ///     node that already holds it is inert: the same value/status/timestamp is filtered by every monitored
+    ///     item's data-change filter, and an alarm write is delta-gated against the node's current state. That is
+    ///     also why alarms coalesce to the latest state per id rather than replaying every transition: replaying an
+    ///     older transition onto a live condition would move it backwards and fire spurious events.</para>
+    /// </summary>
+    private readonly DeferredWrites _deferred;

    /// <summary>True while a rebuild's parse / plan step is running off-thread. Rebuilds are applied strictly in
    /// arrival order — the plan is a diff against <see cref="_lastApplied"/>, which only the apply advances — so a
-    /// rebuild arriving meanwhile waits in <see cref="_pendingRebuilds"/>; value and status batches do not.</summary>
+    /// rebuild arriving meanwhile waits in <see cref="_pendingRebuilds"/>; value, status and alarm writes do not — they
+    /// are applied at once AND remembered in <see cref="_deferred"/> for replay after the apply.</summary>
    private bool _planInFlight;
    private readonly Queue<(RebuildAddressSpace Request, IActorRef Requester)> _pendingRebuilds = new();

@@ -309,6 +349,18 @@ public sealed class OpcUaPublishActor : ReceiveActor, IWithTimers
            dataPlaneAuthority,
            utcNow));

+    /// <summary>Test-only Props exposing the deferred-write bound and the plan-step seams.</summary>
+    internal static Props PropsForTests(
+        IOpcUaAddressSpaceSink sink,
+        AddressSpaceApplier? applier,
+        TestHooks? hooks,
+        int deferredWriteCapacity = DefaultDeferredWriteCapacity,
+        NodeId? localNode = null,
+        IDataPlaneAuthoritySink? dataPlaneAuthority = null) =>
+        Akka.Actor.Props.Create(() => new OpcUaPublishActor(
+            sink, NullServiceLevelPublisher.Instance, false, localNode, null, applier, null, null, null, null,
+            false, dataPlaneAuthority, null, deferredWriteCapacity, hooks));
+
    /// <summary>Initializes a new instance of the <see cref="OpcUaPublishActor"/> class.</summary>
    /// <param name="sink">The OPC UA address space sink.</param>
    /// <param name="serviceLevel">The service level publisher.</param>
@@ -331,6 +383,8 @@ public sealed class OpcUaPublishActor : ReceiveActor, IWithTimers
    /// ServiceLevel DB-reachability input is retired (<c>DbReachable</c> treated constant-true, only
    /// staleness demotes). No <paramref name="dbHealthProbe"/> is wired on such a node.</param>
    /// <param name="dataPlaneAuthority">The optional sink that receives the API keys and ACL grants carried by each applied artifact.</param>
+    /// <param name="deferredWriteCapacity">The bound on distinct nodes whose writes are held for replay while a rebuild plan is in flight.</param>
+    /// <param name="hooks">Test seams for the off-thread plan step; null in production.</param>
    public OpcUaPublishActor(
        IOpcUaAddressSpaceSink sink,
        IServiceLevelPublisher serviceLevel,
@@ -344,8 +398,12 @@ public sealed class OpcUaPublishActor : ReceiveActor, IWithTimers
        TimeSpan? healthTickInterval = null,
        bool dbLess = false,
        IDataPlaneAuthoritySink? dataPlaneAuthority = null,
-        Func<DateTime>? utcNow = null)
+        Func<DateTime>? utcNow = null,
+        int deferredWriteCapacity = DefaultDeferredWriteCapacity,
+        TestHooks? hooks = null)
    {
+        _deferred = new DeferredWrites(Math.Max(1, deferredWriteCapacity));
+        _hooks = hooks;
        _sink = sink;
        _dataPlaneAuthority = dataPlaneAuthority;
        _serviceLevel = serviceLevel;
@@ -400,6 +458,7 @@ public sealed class OpcUaPublishActor : ReceiveActor, IWithTimers
    {
        try
        {
+            if (PlanPipelineBusy) DeferValue(new ValueWrite(msg.NodeId, msg.Value, msg.StatusCode, msg.TimestampUtc, msg.Realm));
            _sink.WriteValue(msg.NodeId, msg.Value, msg.StatusCode, msg.TimestampUtc, msg.Realm);
            Interlocked.Increment(ref _writes);
            OtOpcUaTelemetry.OpcUaSinkWrite.Add(1, new KeyValuePair<string, object?>("kind", "value"));
@@ -421,6 +480,8 @@ public sealed class OpcUaPublishActor : ReceiveActor, IWithTimers
    /// a whole batch because one item was bad.</para></summary>
    private void HandleAttributeBatchUpdate(AttributeValueBatchUpdate msg)
    {
+        if (PlanPipelineBusy)
+            foreach (var item in msg.Items) DeferValue(item);
        try
        {
            _sink.WriteValues(msg.Items);
@@ -451,6 +512,8 @@ public sealed class OpcUaPublishActor : ReceiveActor, IWithTimers
    /// value write on the same counter.</summary>
    private void HandleAttributeStatusBatchUpdate(AttributeStatusBatchUpdate msg)
    {
+        if (PlanPipelineBusy)
+            foreach (var item in msg.Items) DeferStatus(item);
        try
        {
            _sink.WriteStatuses(msg.Items);
@@ -474,6 +537,7 @@ public sealed class OpcUaPublishActor : ReceiveActor, IWithTimers

    private void HandleAlarmUpdate(AlarmStateUpdate msg)
    {
+        if (PlanPipelineBusy) DeferAlarm(msg);
        try
        {
            _sink.WriteAlarmCondition(msg.AlarmNodeId, msg.State, msg.TimestampUtc, msg.Realm);
@@ -488,6 +552,7 @@ public sealed class OpcUaPublishActor : ReceiveActor, IWithTimers

    private void HandleAlarmQualityUpdate(AlarmQualityUpdate msg)
    {
+        if (PlanPipelineBusy) DeferAlarmQuality(msg);
        try
        {
            _sink.WriteAlarmQuality(msg.AlarmNodeId, msg.StatusCode, msg.TimestampUtc, msg.Realm);
@@ -511,6 +576,16 @@ public sealed class OpcUaPublishActor : ReceiveActor, IWithTimers
    /// </summary>
    private void StartRebuild(RebuildAddressSpace msg, IActorRef requester)
    {
+        // Strict arrival order for EVERY rebuild, including the ones that complete synchronously (no applier, no
+        // bytes): a bytes-less request arriving mid-plan used to answer before the plan ahead of it, so replies went
+        // out of order. HandleRebuild is the only entry that can find the pipeline busy; the drain calls this only
+        // when it is idle.
+        if (_planInFlight)
+        {
+            _pendingRebuilds.Enqueue((msg, requester));
+            return;
+        }
+
        // Only a node with NO applier at all (the F10b/dev seam) falls back to the raw-sink rebuild — and that
        // fallback WIPES the served address space without re-materialising, so it must NEVER be reached by a
        // real driver node that has an applier (that node diff-and-applies from its in-hand bytes below).
@@ -559,36 +634,58 @@ public sealed class OpcUaPublishActor : ReceiveActor, IWithTimers
            return;
        }

-        if (_planInFlight)
-        {
-            _pendingRebuilds.Enqueue((msg, requester));
-            return;
-        }
-
        _planInFlight = true;
        var artifact = msg.Artifact;
        var baseComposition = _lastApplied;
        var nodeId = _localNode?.Value;
        var wantAuthority = _dataPlaneAuthority is not null;
+        var incarnation = _incarnation;
+        var hooks = _hooks;
        Task.Run(() =>
            {
+                hooks?.BeforePlan?.Invoke();
                // Open() throws on bytes that are not valid JSON, where the static wrappers swallowed to an EMPTY
                // result — and an empty composition is not a benign no-op here (see the no-bytes guard above). The
                // throw lands in PlanFailed: logged at Error, _lastApplied untouched, last-known-good still served.
                using var parsed = DeploymentArtifact.Open(artifact);
-                var authority = wantAuthority ? parsed.ParseDataPlaneAuthority(nodeId ?? string.Empty) : null;
+                // The authority parse is isolated from the address-space plan (review fix I2): before the plan moved
+                // off-thread a throw here was contained by FeedDataPlaneAuthority's own catch; it must not now
+                // become PlanFailed and degrade an apply whose topology is perfectly readable.
+                DataPlaneAuthorityProjection? authority = null;
+                Exception? authorityError = null;
+                if (wantAuthority)
+                {
+                    try
+                    {
+                        authority = hooks?.ParseAuthority is { } parse
+                            ? parse(parsed, nodeId ?? string.Empty)
+                            : parsed.ParseDataPlaneAuthority(nodeId ?? string.Empty);
+                    }
+                    catch (Exception ex)
+                    {
+                        authorityError = ex;
+                    }
+                }
+
                var inconsistencies = new List<string>();
                var composition = nodeId is not null
                    ? parsed.ParseComposition(nodeId, inconsistencies.Add)
                    : parsed.ParseComposition();
                var plan = AddressSpacePlanner.Compute(baseComposition, composition);
-                return new PlanReady(msg, requester, artifact, authority, composition, plan, inconsistencies);
+                return new PlanReady(incarnation, msg, requester, artifact, authority, authorityError, composition, plan, inconsistencies);
            })
-            .PipeTo(Self, failure: ex => new PlanFailed(msg, requester, ex));
+            .PipeTo(Self, failure: ex => new PlanFailed(incarnation, msg, requester, ex));
    }

    private void HandlePlanReady(PlanReady ready)
    {
+        if (IsFromAnotherIncarnation(ready.Incarnation, ready.Request, ready.Requester)) return;
+
+        if (ready.AuthorityError is { } authorityError)
+            _log.Error(authorityError,
+                "OpcUaPublish: data-plane authority parse threw (correlation={Correlation}) — the address space is applied; the previously installed keys and grants stay in force",
+                ready.Request.Correlation);
+
        (bool Degraded, string? Reason) outcome;
        try
        {
@@ -600,20 +697,211 @@ public sealed class OpcUaPublishActor : ReceiveActor, IWithTimers
        }

        FinishRebuild(ready.Request, ready.Requester, outcome);
-        StartNextPendingRebuild();
+        AfterPlanSettled();
    }

    private void HandlePlanFailed(PlanFailed failed)
    {
+        if (IsFromAnotherIncarnation(failed.Incarnation, failed.Request, failed.Requester)) return;
+
        _planInFlight = false;
        _log.Error(failed.Error, "OpcUaPublish: rebuild pipeline threw (correlation={Correlation})", failed.Request.Correlation);
        FinishRebuild(failed.Request, failed.Requester, (true, $"address-space apply threw: {failed.Error.Message}"));
-        StartNextPendingRebuild();
+        AfterPlanSettled();
    }

+    /// <summary>A plan piped back to a RESTARTED instance (the ActorRef survives a restart) was computed against the
+    /// previous instance's <see cref="_lastApplied"/>: never applied. Its requester is still owed an answer.</summary>
+    private bool IsFromAnotherIncarnation(object incarnation, RebuildAddressSpace request, IActorRef requester)
+    {
+        if (ReferenceEquals(incarnation, _incarnation)) return false;
+        _log.Warning(
+            "OpcUaPublish: ignoring a rebuild plan started by a previous incarnation of this actor (correlation={Correlation})",
+            request.Correlation);
+        if (request.ReportOutcome)
+            requester.Tell(new RebuildCompleted(request.Correlation, request.DeploymentId, true,
+                "the address-space publisher restarted while this rebuild was being planned; it was not applied"));
+        return true;
+    }
+
+    /// <summary>After an apply (or a failed plan) has been answered — its deferred writes already replayed by
+    /// <see cref="FinishRebuild"/> — start what queued behind it, and drop the buffer once nothing is in flight or
+    /// queued (a queued plan may add nodes the buffer names, so it is replayed again after that apply).</summary>
+    private void AfterPlanSettled()
+    {
+        StartNextPendingRebuild();
+        if (!PlanPipelineBusy) _deferred.Clear();
+    }
+
+    /// <summary>Starts queued rebuilds in arrival order until one goes off-thread (or the queue empties) — the
+    /// synchronous completions (no bytes) answer in their turn.</summary>
    private void StartNextPendingRebuild()
    {
-        if (_pendingRebuilds.TryDequeue(out var next)) StartRebuild(next.Request, next.Requester);
+        while (!_planInFlight && _pendingRebuilds.TryDequeue(out var next))
+            StartRebuild(next.Request, next.Requester);
+    }
+
+    /// <summary>True while a plan is computing or a rebuild is queued behind one.</summary>
+    private bool PlanPipelineBusy => _planInFlight || _pendingRebuilds.Count > 0;
+
+    private void DeferValue(in ValueWrite write)
+    {
+        if (!_deferred.Value(write)) WarnDeferredOverflow();
+    }
+
+    private void DeferStatus(in StatusWrite write)
+    {
+        if (!_deferred.Status(write)) WarnDeferredOverflow();
+    }
+
+    private void DeferAlarm(AlarmStateUpdate msg)
+    {
+        if (!_deferred.Alarm(msg)) WarnDeferredOverflow();
+    }
+
+    private void DeferAlarmQuality(AlarmQualityUpdate msg)
+    {
+        if (!_deferred.AlarmQuality(msg)) WarnDeferredOverflow();
+    }
+
+    private void WarnDeferredOverflow()
+    {
+        if (_deferred.Dropped == 1)
+            _log.Warning(
+                "OpcUaPublish: more than {Capacity} distinct nodes written while a rebuild plan is in flight — later new nodes are not held for replay (their first value lands only if the driver republishes it)",
+                _deferred.Capacity);
+    }
+
+    /// <summary>Re-applies the deferred writes through the sink: values, then status-only annotations, then alarm
+    /// states and alarm qualities. Each pass isolated like the live handlers; not re-metered (counted on arrival).</summary>
+    private void ReplayDeferredWrites()
+    {
+        if (_deferred.IsEmpty) return;
+        var (values, statuses) = _deferred.VariableWrites();
+        if (values.Count > 0)
+        {
+            try { _sink.WriteValues(values); }
+            catch (Exception ex) { _log.Warning(ex, "OpcUaPublish: replaying {Count} deferred value writes threw", values.Count); }
+        }
+
+        if (statuses.Count > 0)
+        {
+            try { _sink.WriteStatuses(statuses); }
+            catch (Exception ex) { _log.Warning(ex, "OpcUaPublish: replaying {Count} deferred status writes threw", statuses.Count); }
+        }
+
+        foreach (var alarm in _deferred.Alarms)
+        {
+            try { _sink.WriteAlarmCondition(alarm.AlarmNodeId, alarm.State, alarm.TimestampUtc, alarm.Realm); }
+            catch (Exception ex) { _log.Warning(ex, "OpcUaPublish: replaying a deferred alarm write threw for {Node}", alarm.AlarmNodeId); }
+        }
+
+        foreach (var quality in _deferred.AlarmQualities)
+        {
+            try { _sink.WriteAlarmQuality(quality.AlarmNodeId, quality.StatusCode, quality.TimestampUtc, quality.Realm); }
+            catch (Exception ex) { _log.Warning(ex, "OpcUaPublish: replaying a deferred alarm-quality write threw for {Node}", quality.AlarmNodeId); }
+        }
+
+        _log.Debug("OpcUaPublish: replayed {Values} value, {Statuses} status and {Alarms} alarm writes deferred during a rebuild plan",
+            values.Count, statuses.Count, _deferred.AlarmCount);
+    }
+
+    /// <summary>
+    ///     The latest write per (realm, id) received while a plan is in flight — see <see cref="_deferred"/>. A value
+    ///     followed by a status-only write for the same node composes to the value under the new status (exactly what
+    ///     the two live writes leave on the node). Bounded by <see cref="Capacity"/> distinct keys across all kinds;
+    ///     beyond it a NEW key is not held (an existing key still updates), counted in <see cref="Dropped"/>.
+    /// </summary>
+    private sealed class DeferredWrites(int capacity)
+    {
+        private struct VariableEntry
+        {
+            public bool HasValue;
+            public object? Value;
+            public uint Status;
+            public DateTime TimestampUtc;
+        }
+
+        private readonly Dictionary<(AddressSpaceRealm, string), VariableEntry> _variables = new();
+        private readonly Dictionary<(AddressSpaceRealm, string), AlarmStateUpdate> _alarms = new();
+        private readonly Dictionary<(AddressSpaceRealm, string), AlarmQualityUpdate> _qualities = new();
+
+        public int Capacity { get; } = capacity;
+        public long Dropped { get; private set; }
+        public int Count => _variables.Count + _alarms.Count + _qualities.Count;
+        public bool IsEmpty => Count == 0;
+        public int AlarmCount => _alarms.Count + _qualities.Count;
+        public IEnumerable<AlarmStateUpdate> Alarms => _alarms.Values;
+        public IEnumerable<AlarmQualityUpdate> AlarmQualities => _qualities.Values;
+
+        public bool Value(in ValueWrite write)
+        {
+            if (string.IsNullOrEmpty(write.NodeId)) return true;
+            var key = (write.Realm, write.NodeId);
+            if (!_variables.ContainsKey(key) && !HasRoom()) return false;
+            _variables[key] = new VariableEntry
+            {
+                HasValue = true, Value = write.Value, Status = write.StatusCode, TimestampUtc = write.SourceTimestampUtc,
+            };
+            return true;
+        }
+
+        public bool Status(in StatusWrite write)
+        {
+            if (string.IsNullOrEmpty(write.NodeId)) return true;
+            var key = (write.Realm, write.NodeId);
+            if (_variables.TryGetValue(key, out var entry))
+            {
+                entry.Status = write.StatusCode;
+                entry.TimestampUtc = write.SourceTimestampUtc;
+                _variables[key] = entry;
+                return true;
+            }
+
+            if (!HasRoom()) return false;
+            _variables[key] = new VariableEntry { Status = write.StatusCode, TimestampUtc = write.SourceTimestampUtc };
+            return true;
+        }
+
+        public bool Alarm(AlarmStateUpdate msg) => Put(_alarms, (msg.Realm, msg.AlarmNodeId), msg);
+
+        public bool AlarmQuality(AlarmQualityUpdate msg) => Put(_qualities, (msg.Realm, msg.AlarmNodeId), msg);
+
+        public (List<ValueWrite> Values, List<StatusWrite> Statuses) VariableWrites()
+        {
+            var values = new List<ValueWrite>();
+            var statuses = new List<StatusWrite>();
+            foreach (var ((realm, id), e) in _variables)
+            {
+                if (e.HasValue) values.Add(new ValueWrite(id, e.Value, e.Status, e.TimestampUtc, realm));
+                else statuses.Add(new StatusWrite(id, e.Status, e.TimestampUtc, realm));
+            }
+
+            return (values, statuses);
+        }
+
+        public void Clear()
+        {
+            _variables.Clear();
+            _alarms.Clear();
+            _qualities.Clear();
+            Dropped = 0;
+        }
+
+        private bool Put<T>(Dictionary<(AddressSpaceRealm, string), T> map, (AddressSpaceRealm, string) key, T value)
+        {
+            if (string.IsNullOrEmpty(key.Item2)) return true;
+            if (!map.ContainsKey(key) && !HasRoom()) return false;
+            map[key] = value;
+            return true;
+        }
+
+        private bool HasRoom()
+        {
+            if (Count < Capacity) return true;
+            Dropped++;
+            return false;
+        }
    }

    /// <summary>
@@ -631,6 +919,10 @@ public sealed class OpcUaPublishActor : ReceiveActor, IWithTimers
            _log.Error(ex, "OpcUaPublish: sink.CompleteAddressSpaceApply threw (correlation={Correlation})", msg.Correlation);
        }

+        // Land what arrived while the plan was in flight on the nodes the apply just created — before the answer,
+        // so "applied" means the deferred first values are on the address space too (review fix C1).
+        ReplayDeferredWrites();
+
        if (msg.ReportOutcome)
            requester.Tell(new RebuildCompleted(msg.Correlation, msg.DeploymentId, outcome.Degraded, outcome.Reason));
    }