R2-02 ResilienceConfig hardening (arch-review round 2) #431

2026-07-13T10:28:09-04:00

dohertj2 commented

2026-07-13 10:28:09 -04:00

Round-2 arch-review plan R2-02 (findings 01/S-6 High, 01/U-6, 01/S-8=03/S12, 04/C-7, 01/S-7=03/S13).

S-6 (High): parser clamps timeout/retry/breaker overrides (timeout≤0→tier default, breaker==1→2, caps) with diagnostics + belt-and-braces Build clamp so pipeline construction can never throw Polly ValidationException — kills the operator-authorable driver-brick. New ResiliencePolicyRanges (Core.Abstractions) + AdminUI Validate() range warnings.
S-8=S12: parser forces Write/AlarmAck retry→0 (spec invariant); dispatch flips to isIdempotent:false so #13-enabled write retries never retry command writes; WriteIdempotentAttribute false 'reads via reflection' claim corrected; retry cells disabled.
U-6: dead bulkhead knob deleted end-to-end (migration-free; stored keys ignored) + inertness guard.
C-7: ResilienceFormModel JsonObject-bag round-trip preserves unknown keys; malformed JSON → ParseFailed lock + verbatim ToJson + discard button.
S-7=S13: per-Create Interlocked options-generation in the pipeline-cache key kills the respawn stale-pipeline race.

17/19 tasks; T15 (docker-dev live /run) + T18 (full sweep) deferred to serial heavy pass. Build clean, 0 OTOPCUA0001 (pre-existing AbLegacy baseline aside); Core resilience 121/121, AdminUI form 10/10, Analyzers 32/32, Runtime 364/364. Plan: archreview/plans/R2-02-resilience-config-hardening-plan.md.

Round-2 arch-review plan **R2-02** (findings 01/S-6 High, 01/U-6, 01/S-8=03/S12, 04/C-7, 01/S-7=03/S13). - **S-6 (High)**: parser clamps timeout/retry/breaker overrides (timeout≤0→tier default, breaker==1→2, caps) with diagnostics + belt-and-braces Build clamp so pipeline construction can never throw Polly ValidationException — kills the operator-authorable driver-brick. New `ResiliencePolicyRanges` (Core.Abstractions) + AdminUI Validate() range warnings. - **S-8=S12**: parser forces Write/AlarmAck retry→0 (spec invariant); dispatch flips to `isIdempotent:false` so #13-enabled write retries never retry command writes; `WriteIdempotentAttribute` false 'reads via reflection' claim corrected; retry cells disabled. - **U-6**: dead bulkhead knob deleted end-to-end (migration-free; stored keys ignored) + inertness guard. - **C-7**: `ResilienceFormModel` JsonObject-bag round-trip preserves unknown keys; malformed JSON → ParseFailed lock + verbatim ToJson + discard button. - **S-7=S13**: per-Create Interlocked options-generation in the pipeline-cache key kills the respawn stale-pipeline race. 17/19 tasks; **T15 (docker-dev live /run) + T18 (full sweep) deferred** to serial heavy pass. Build clean, 0 OTOPCUA0001 (pre-existing AbLegacy baseline aside); Core resilience 121/121, AdminUI form 10/10, Analyzers 32/32, Runtime 364/364. Plan: `archreview/plans/R2-02-resilience-config-hardening-plan.md`.

dohertj2 added 17 commits 2026-07-13 10:28:10 -04:00

fix(r2-02): add ResiliencePolicyRanges single-source-of-truth to Core.Abstractions (01/S-6 task 1) 4be13429b6

fix(r2-02): range-clamp ResilienceConfig overrides in the parser (01/S-6) — timeout/retry/breaker clamped with diagnostics, never brick 294d74c1de

fix(r2-02): pipeline Build clamps policy values — building a pipeline can never throw Polly ValidationException (01/S-6 belt-and-braces + brick repro) 8d306a1bd2

fix(r2-02): factory-seam guard — hostile ResilienceConfig cannot brick the spawn path (01/S-6 wiring proof) a8af9cc48b

fix(r2-02): range-validation warnings on the resilience override form (01/S-6 authoring layer) 57c224c65a

fix(r2-02): enforce the spec's no-retry invariant for Write/AlarmAcknowledge overrides (01/S-8, 03/S12 layer 1) eab0b6be12

fix(r2-02): write dispatch defaults to non-idempotent — no-retry arm authoritative (03/S12 layer 2) 496f97da20

fix(r2-02): non-idempotent write arm — cache the no-retry snapshot (01/P-4) and record tracker in-flight accounting (S-8 residual) 20ff67bf9a

docs(r2-02): correct WriteIdempotentAttribute's unwired claim; disable Write/Ack retry authoring cells (S-8) 99b424240a

refactor(r2-02): delete the dead bulkhead knob — options + parser (01/U-6); stored JSON keys become ignored unknowns 56854139c9

refactor(r2-02): remove bulkhead fields from the resilience form (01/U-6) 524a0b5606