R2-01 S7 fault-path hardening (arch-review round 2) #429

2026-07-13T10:13:20-04:00

dohertj2 commented

2026-07-13 10:13:20 -04:00

Round-2 arch-review plan R2-01 (findings 05/STAB-14 High regression, STAB-15, STAB-8 seam note).

STAB-14 (High regression): S7 connect-timeout now surfaces as TimeoutException at the EnsureConnectedAsync/InitializeAsync source instead of an escaping OperationCanceledException that the poll loop's bare catch(OCE){return;} swallowed — which silently killed all S7 subscriptions after an unreachable-host outage. Plus when(token.IsCancellationRequested) filters on both ensure-wrappers and all three poll-loop OCE catches. Subscriptions now survive + recover (T2 regression RED→GREEN).
STAB-15: IsS7ConnectionFatal broadened to the ISO-on-TCP framing surface (TPKT/TPDU/WrongNumberOfBytes/PlcException-WrongNumberReceivedBytes, NOT InvalidDataException); mid-PDU cancel marks handle dead; probe classifies + marks dead under the gate.
STAB-8 (S7 part): EnsureConnectedAsync documented as the R2-09 connect-throttle seam (note-only).

12/13 tasks; T11 deferred-live (env-gated live outage test, skips clean offline — serial live pass). All prod changes in S7Driver.cs. Build clean; Driver.S7.Tests 246/246. (One pre-existing unrelated CLI docs-scan test fails at base — out of scope, see plan deviations.) Plan: archreview/plans/R2-01-s7-fault-hardening-plan.md.

Round-2 arch-review plan **R2-01** (findings 05/STAB-14 High regression, STAB-15, STAB-8 seam note). - **STAB-14** (High regression): S7 connect-timeout now surfaces as `TimeoutException` at the `EnsureConnectedAsync`/`InitializeAsync` source instead of an escaping `OperationCanceledException` that the poll loop's bare `catch(OCE){return;}` swallowed — which silently killed all S7 subscriptions after an unreachable-host outage. Plus `when(token.IsCancellationRequested)` filters on both ensure-wrappers and all three poll-loop OCE catches. Subscriptions now survive + recover (T2 regression RED→GREEN). - **STAB-15**: `IsS7ConnectionFatal` broadened to the ISO-on-TCP framing surface (TPKT/TPDU/WrongNumberOfBytes/PlcException-WrongNumberReceivedBytes, NOT InvalidDataException); mid-PDU cancel marks handle dead; probe classifies + marks dead under the gate. - **STAB-8** (S7 part): EnsureConnectedAsync documented as the R2-09 connect-throttle seam (note-only). 12/13 tasks; **T11 deferred-live** (env-gated live outage test, skips clean offline — serial live pass). All prod changes in S7Driver.cs. Build clean; Driver.S7.Tests 246/246. (One pre-existing unrelated CLI docs-scan test fails at base — out of scope, see plan deviations.) Plan: `archreview/plans/R2-01-s7-fault-hardening-plan.md`.

dohertj2 added 13 commits 2026-07-13 10:13:21 -04:00

fix(r2-01): extend reconnect fakes with token-honouring hang + probe-fault modes (task 0) fcdcf0e2fb

fix(r2-01): RED connect-timeout regression tests T1+T3 (task 1) 9dedb7936b

fix(r2-01): RED poll-loop-survival T2 + caller-cancel pinning T4 (task 2) 7813304199

fix(r2-01): surface connect-timeout as TimeoutException, not OCE — poll loops no longer die on unreachable-host outages (STAB-14, task 3) 4bb25fc039

fix(r2-01): filter OCE catches on the owning token in read/write wrappers + poll loop (STAB-14 defense-in-depth, task 4) 963543a578

docs(r2-01): Finding-1 close gate — S7 unit 238/238 green; record pre-existing out-of-scope CLI comment-test failure (task 5) 066514fed3

fix(r2-01): RED framing-fault classification Theory T5 (STAB-15a, task 6) 8aed9ac365

fix(r2-01): classify ISO-on-TCP framing/desync faults as connection-fatal (STAB-15a, task 7) dab0029add

fix(r2-01): cancellation observed mid-PDU marks the connection dead before propagating (STAB-15a, task 8) 33044061c3

fix(r2-01): probe failures mark the handle dead under the gate so the next tick reopens (STAB-15b, task 9) 8999c722a0

docs(r2-01): mark EnsureConnectedAsync as the R2-09 connect-throttle seam (STAB-8 note, task 10) 92b2ac4891