2b3e1f1549
docs(plans): R3-01 live gate — PASS on docker-dev with DisableLogin=false (control failed first)
2026-08-20 12:42:06 -04:00
157d01c2c2
Merge branch 'fix/r3-02-stale-good-family' — R3-02: one quality contract at four seams — comms loss marks raw+UNS value variables BadNoCommunication (WriteStatuses sink member, recovery audit), Calculation + VT hold on Bad / worst-of sub-code / (value,status) dedup, MQTT initial push + ConnectionLost stale, Sparkplug birth replay (archreview 03/S15, 05/STAB-19, 05/STAB-18, 02/S14)
2026-08-20 11:49:06 -04:00
886082fec7
fix(review): calc ReadOne reports an inputs-Bad publish; VT inputs-bad counter ticks only on a real report
2026-08-20 11:48:41 -04:00
74794f4365
docs(archreview): R3-02 execution notes — T18 sweep + outstanding live gate
2026-08-20 11:34:18 -04:00
93704f64ab
docs(archreview): R3-02 status
2026-08-20 11:33:56 -04:00
62c5bc3aad
fix(runtime): a stopping driver child announces comms loss so restart/respawn latches its nodes Bad
2026-08-20 11:07:02 -04:00
f1b976f5e2
Merge branch 'fix/r3-04-one-role-authority' — R3-04: EffectiveRoles is the one role authority (Cluster:Roles wins over OTOPCUA_ROLES, normalised, validated, fail-start on unknown/overlay-changed roles); Program.cs + all four validators consume it; case-insensitive gossip predicates; source-scan guard (archreview 01/S-12 = 03/C5, 01/C-9)
2026-08-20 11:05:09 -04:00
e6a36f4ba8
docs: ServiceHosting.md overlay-filename casing note; R3-04 review outcome (both FIX-FIRST items resolved)
2026-08-20 11:03:24 -04:00
1d251cc037
Merge branch 'master' into fix/r3-02-stale-good-family
...
# Conflicts:
# src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DriverHostActor.cs
# tests/Server/ZB.MOM.WW.OtOpcUa.Runtime.Tests/Harness/V3ArtifactSeeder.cs
2026-08-20 11:03:02 -04:00
5dc8d34472
docs: the stale-Good quality contract, stated once (R3-02)
2026-08-20 10:56:16 -04:00
e3a72dc385
fix(runtime): virtual tags hold on Bad inputs and inherit the worst input status (archreview 02/S14)
2026-08-20 10:53:26 -04:00
cc9b845f99
feat(engines): IVirtualTagEvaluator snapshot overload; Roslyn read cache stops fabricating Good (02/S14)
2026-08-20 10:45:11 -04:00
d79d51dd4f
Merge branch 'fix/r3-01-mesh-grpc-allowanonymous' — R3-01: mesh gRPC + LocalDb sync endpoints opt out of the AdminUI cookie FallbackPolicy (PSK interceptors are the gate); real-auth-stack boundary tests + map-convention guard; rig DisableLogin parameterised (archreview 03/S14 Critical)
2026-08-20 10:43:49 -04:00
60e5b40228
fix(calculation): read cache carries real input status + timestamps
2026-08-20 10:40:15 -04:00
851e4cf5e0
Merge branch 'fix/r3-03-restart-resubscribe-watchdog' — R3-03: SpawnChild always sends the desired set (operator Restart + supervision restart re-provision, stale-alarm-set re-subscribe, incarnation check, 10 s backoff); watchdog grace = max(LastSuccessfulRead, connectedSince) (archreview 03/S16, S17, U6)
2026-08-20 10:40:11 -04:00
6d0002889a
docs(archreview): R3-03 review outcome — F1/F2/F3 fixed with red-before evidence
2026-08-20 10:39:47 -04:00
48efdac600
fix(calculation): hold evaluation on Bad inputs and propagate the worst input status; status-keyed dedup (05/STAB-19)
2026-08-20 10:37:29 -04:00
027c423502
docs(plans): R3-04 execution notes — T6-T12 deviations recorded, T13 marked pending (live gate deferred to orchestrator)
2026-08-20 10:33:07 -04:00
985de0b6ad
chore(docker-dev): site-b-2 is Cluster:Roles-only, site-a-2 pins a miscased Cluster:Roles entry (archreview 01/S-12, 01/C-9)
...
T11: site-b-2 drops OTOPCUA_ROLES entirely — Cluster:Roles is its sole role source, the rig's
only node that can exhibit the two-role-authority split (01/S-12). Expected to fail every
deploy on a pre-R3-04 build.
T12: site-a-2 pins Cluster__Roles__0="Driver" (capital D) as the standing 01/C-9 case-mismatch
pin, keeping cluster-SITE-A verbatim. Pre-fix this un-elects the SITE-A Primary.
Combined into one commit (deviation from the plan's two separate T11/T12 commits): the header
comment block documenting all six nodes' role sources interleaves both nodes on adjacent lines,
so a clean split was not practical. Recorded in the plan's Execution notes.
Compose edits only — the rig is NOT brought up as part of this change.
2026-08-20 10:32:18 -04:00
3f8d5815b3
fix(runtime): mux adapter forwards the dependency's real status code (05/STAB-19)
2026-08-20 10:30:14 -04:00
b8d2d50006
docs: one role authority — precedence, normalization, and the overlay invariant (R3-04)
2026-08-20 10:29:37 -04:00
b725788954
docs(plans): R3-01 execution notes (T1-T9) - filter gotcha, T4/T5 fixture scope, observed cookie-challenge signature
2026-08-20 10:28:55 -04:00
ae97b32c82
test(runtime): comms-loss → identical-value recovery contract + silent-resubscribe control (03/S15)
2026-08-20 10:27:48 -04:00
b8911eaa14
docs(plans): mark R3-01 T9 done; T10 remains pending (live gate, orchestrator-run)
2026-08-20 10:27:45 -04:00
659d5f51e4
test(integration): a Cluster:Roles-only node wires the driver stack
2026-08-20 10:26:34 -04:00
4dde5cb8bf
docs(plans): mark R3-01 T7 and T8 done
2026-08-20 10:25:12 -04:00
e2497c908d
test(cluster): guard that role reads live only in the authority (archreview theme 4)
2026-08-20 10:21:36 -04:00
9bd3366b28
docs(plans): mark R3-01 T6 done
2026-08-20 10:21:01 -04:00
e475f7b4ab
Merge branch 'fix/r3-05-acl-hot-path-expiry' — R3-05: bounded ConfigDb API-key lookup (deadline + TTL) and clock-driven key-expiry revalidation of live monitored items (archreview 03/S18, 03/S19)
2026-08-20 10:19:13 -04:00
62515f3279
fix(security): pin the cached-key expiry guard, meter cache_hit after it, and close two wiring gaps (review fixes)
2026-08-20 10:18:52 -04:00
7d98ef9332
feat(runtime): audit refs still BadNoCommunication after a reconnect (dedup-trap tripwire)
2026-08-20 10:16:01 -04:00
353ed6bb58
docs(plans): mark R3-01 T5 done
2026-08-20 10:15:03 -04:00
4380e2e78a
fix(cluster): fail start when a late config layer changes Cluster:Roles (role overlays may not set it)
2026-08-20 10:11:25 -04:00
c1ad9e24d2
docs(archreview): R3-03 execution notes — final verification + deviation summary
2026-08-20 10:11:16 -04:00
3314a1f98d
feat(host): warn when Cluster:Roles and OTOPCUA_ROLES disagree; boot banner names the winning source
2026-08-20 10:08:03 -04:00
815423bd88
docs(plans): restore literal UTF-8 em-dashes in R3-01 tasks.json (cosmetic)
2026-08-20 10:07:20 -04:00
12c4028474
docs: restart re-provisioning + per-connection watchdog grace (R3-03)
2026-08-20 10:07:20 -04:00
97f4ea0c9e
fix(runtime): comms loss marks raw + UNS value nodes BadNoCommunication, value retained (archreview 03/S15)
2026-08-20 10:07:12 -04:00
af9d3a69ac
docs(plans): mark R3-01 T4 done
2026-08-20 10:06:55 -04:00
14094e3a18
docs(archreview): file R3-05 residuals R1/R2 (Gitea #562/#563); execution notes
2026-08-20 10:06:00 -04:00
5c7e5725a5
test(runtime): first supervision-restart test — child re-initialises + re-subscribes (archreview 03/U6)
...
Crash seam: the planned null-Snapshot OnDataChange (no SupervisorStrategy fallback needed).
Seen RED with T6 reverted: InitializeCount 1, not 2 — with a preceding ShutdownCount>=1
assertion proving the restart really happened, so the red is not ambiguous with 'never crashed'.
2026-08-20 10:05:45 -04:00
e46c1db5e5
fix(cluster): gossiped-role predicates compare case-insensitively — a miscased peer no longer un-elects the Primary
2026-08-20 10:04:16 -04:00
a9b592aeb8
docs(security): correct revocation latency (activation vs open session) + S18/S19 knobs
2026-08-20 10:04:03 -04:00
04019e9414
feat(runtime): publish actor routes status-only batches to the sink
2026-08-20 10:03:25 -04:00
dfab7f614d
test(integration): key expiry stops a live subscription over the wire, with no deploy
2026-08-20 10:00:52 -04:00
ec5b48bfcd
feat(opcua): IOpcUaAddressSpaceSink.WriteStatuses — status-only batch write retaining the node value (03/S15)
2026-08-20 10:00:47 -04:00
2b9a397b2d
fix(runtime): re-provision a driver child after a supervision restart (archreview 03/S6, S16)
2026-08-20 09:56:05 -04:00
6874a562f3
test+docs(mqtt): end-to-end Bad-then-identical-replay recovery
2026-08-20 09:55:11 -04:00
a4f12bccef
fix(host): run monitored-item revalidation on a low-frequency timer (archreview 03/S19)
2026-08-20 09:55:01 -04:00
d97e441979
test(runtime): operator restart re-subscribes the respawned child (archreview 03/S16, U6)
...
Seen RED against a T3-reverted build: all 4 failed, Created[1].SubscribeCount == 0
on the headline case. 20x isolation run green after the fix was restored.
2026-08-20 09:53:38 -04:00
Joseph Doherty