- N-1 (Important): m3's BadNodeIdUnknown throw for an ack with no resolvable
condition counted toward the host's AlarmAcknowledge breaker (threshold 5), so
re-acks of one unresolvable condition blocked every genuine ack. It now logs a
Warning and returns; only a no-reply transport failure throws. Test through the
real CapabilityInvoker: six unresolvable acks, then a genuine ack that is still
delivered (red with the throw restored).
- N-2: ShutdownAsync holds _subscriptionGate for the whole teardown (in-flight
subscribes finish first, bounded by the budget), so a subscribe arriving during
the delete phase finds the session released instead of creating a subscription
on the closing session. Red-tested.
- N-3: the shutdown-side cert-validation detach is generation-checked under
_probeLock with the map / endpoint clear.
Refs #743
Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT
- m1: the form hint now says ProbeTimeoutSeconds can only shorten Test Connect's
10 s budget (passing the configured value as the button's budget is shared code -
follow-up).
- m2: a superseded init no longer overwrites _options (generation-checked under
_probeLock) or the cert-validation handler (handed back and published with the
session; detached when not installed; a previous one detached on replace).
- m3: an ack none of whose condition ids resolves throws BadNodeIdUnknown + Warning.
- m4: an ack with no reply (transport failure / non-caller timeout) degrades.
- m5: no session before the gate is the same ServiceResultException(BadNotConnected).
- m6: the caller-cancelled-write deviation is documented.
- m7: a reply during a published outage advances the stamp but does not write
Healthy; the keep-alive recovery ends the outage.
- m8: test for a non-caller OperationCanceledException write -> Degraded.
- m9: the browse session owns and disposes the user certificate it loaded
(OpcUaUserIdentityFactory.LoadCertificate; a key-less cert is disposed before the
throw); AdminUI-host certificate path documented.
- m10: a subscribe overtaken by a shutdown / re-init removes its half-built
subscription instead of registering it (data and alarm).
- Sync Dispose drains each gate for 500 ms (was 2 s).
Refs #743
Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT
AcknowledgeAsync swallowed every non-cancellation transport failure (and returned
normally when the session was lost while the ack queued), so the host logged the
Part 9 ack as applied while upstream still showed it unacknowledged. Both now throw
(ServiceResultException with the transport status / BadNotConnected). A reply,
including per-ack refusals, still returns normally and counts as the server answering.
Refs #743
Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT
Joseph Doherty