dohertj2/lmxopcua
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

R2-04 Failure-visibility trio (arch-review round 2) #433

Closed
dohertj2 wants to merge 0 commits from r2/04-failure-visibility into master
pull from: r2/04-failure-visibility
merge into: dohertj2:master
Conversation 1 Commits - Files Changed -
+1733 -134
dohertj2 commented 2026-07-13 11:18:35 -04:00
Owner
Copy Link
Copy Source

Round-2 arch-review plan R2-04 (findings 01/S-1, 06/S-1, 03/S4 + scripted-alarm emit gate).

  • 01/S-1: AddressSpaceApplyOutcome gains RebuildFailed/FailedNodes (defaulted trailing params); Materialise passes return failure tallies; OpcUaPublishActor logs Error + otopcua.opcua.apply.failed on a degraded apply instead of optimistic Info.
  • 06/S-1: new IMxWriteOps seam; Galaxy advise-failure now fails closed → BadCommunicationError (fires the #5 node revert) instead of issuing a knowingly-lost raw Write; new galaxy.writes meters.
  • 03/S4: new PrimaryGatePolicy (known role wins; unknown role → allow single-driver, deny multi-driver) wired into all three DriverHostActor gates + ScriptedAlarmHostActor emit gate; distinct 'not primary (role unknown)' reason; otopcua.redundancy.primary_gate_denied meter.

13/15 tasks; T13 (in-process 2-node) + T15 (docker-dev 2-node rig gate) deferred to serial heavy pass. ⚠️ T15 is the behavior-affecting live gate for the S4 slice — MUST run in the heavy pass. Build clean; OpcUaServer.Tests 334, Runtime.Tests 395, Galaxy 304, Commons 57 (all green). Plan: archreview/plans/R2-04-failure-visibility-plan.md.

Round-2 arch-review plan **R2-04** (findings 01/S-1, 06/S-1, 03/S4 + scripted-alarm emit gate). - **01/S-1:** `AddressSpaceApplyOutcome` gains RebuildFailed/FailedNodes (defaulted trailing params); Materialise passes return failure tallies; `OpcUaPublishActor` logs Error + `otopcua.opcua.apply.failed` on a degraded apply instead of optimistic Info. - **06/S-1:** new `IMxWriteOps` seam; Galaxy advise-failure now **fails closed** → BadCommunicationError (fires the #5 node revert) instead of issuing a knowingly-lost raw Write; new galaxy.writes meters. - **03/S4:** new `PrimaryGatePolicy` (known role wins; unknown role → allow single-driver, deny multi-driver) wired into all three DriverHostActor gates + ScriptedAlarmHostActor emit gate; distinct 'not primary (role unknown)' reason; `otopcua.redundancy.primary_gate_denied` meter. 13/15 tasks; **T13 (in-process 2-node) + T15 (docker-dev 2-node rig gate) deferred** to serial heavy pass. ⚠️ T15 is the behavior-affecting live gate for the S4 slice — MUST run in the heavy pass. Build clean; OpcUaServer.Tests 334, Runtime.Tests 395, Galaxy 304, Commons 57 (all green). Plan: `archreview/plans/R2-04-failure-visibility-plan.md`.
dohertj2 added 15 commits 2026-07-13 11:18:36 -04:00
fix(r2-04): AddressSpaceApplyOutcome carries RebuildFailed/FailedNodes; SafeRebuild returns bool (01/S-1) 437f82b145
fix(r2-04): Safe* helpers report failure; Apply tallies removal-pass failures into FailedNodes b3d57ca363
fix(r2-04): Materialise* passes return swallowed-failure tallies (void -> int) e37abf36a0
fix(r2-04): surface degraded address-space applies (Error log + otopcua.opcua.apply.failed) 759125372a
refactor(r2-04): internal IMxWriteOps seam under GatewayGalaxyDataWriter (sealed SDK session untestable) a537d29f44
fix(r2-04): Galaxy fail-closed write when AdviseSupervisory fails - Bad status feeds #5 node revert (06/S-1) 610306734c
feat(r2-04): meter unconfirmed + advise-failed Galaxy writes 084c6e3cee
test(r2-04): live guard - advised write remains Good under fail-closed advise (skip-gated) edbbc0438c
feat(r2-04): PrimaryGatePolicy - membership-aware default-deny + denial meter (03/S4) f2e899aaad
fix(r2-04): primary gates default-DENY on multi-driver clusters while role unknown (03/S4) 72b1600245
test(r2-04): primary-gate boot-window guards (deny-on-unknown multi-node, allow single-node) c6f975b963
fix(r2-04): scripted-alarm alerts emit uses PrimaryGatePolicy (consistency with 03/S4) 1647942414
test(r2-04): 2-node delivery-path guard for the primary write gate (deferred-live) 68588da05f
docs(r2-04): failure-visibility trio semantics (gate table, meters, Galaxy fail-closed) 8da54652c3
docs(r2-04): record execution deviations + mark T13/T15 deferred-live
v2-ci / build (pull_request) Successful in 3m54s
Details
v2-ci / unit-tests (pull_request) Failing after 7m43s
Details
fd3b718892
dohertj2 commented 2026-07-13 11:19:26 -04:00
Author
Owner
Copy Link
Copy Source

Landed on master via merge commit d62b140c (local --no-ff merge, clean build barrier). NOTE: T15 (2-node docker-dev S4 primary-gate live gate) is a behavior-affecting must-run item in the controller's serial heavy pass. Closing as merged.

Landed on `master` via merge commit `d62b140c` (local --no-ff merge, clean build barrier). NOTE: T15 (2-node docker-dev S4 primary-gate live gate) is a behavior-affecting must-run item in the controller's serial heavy pass. Closing as merged.
dohertj2 closed this pull request 2026-07-13 11:19:26 -04:00
Some checks are pending
v2-ci / build (pull_request) Successful in 3m54s
Details
v2-ci / unit-tests (pull_request) Failing after 7m43s
Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
auto-managed
queue management
 cross-driver
queue management
 driver/abcip
queue management
 driver/ablegacy
queue management
 driver/focas
queue management
 driver/opcuaclient
queue management
 driver/s7
queue management
 driver/twincat
queue management
 phase/1
queue management
 phase/2
queue management
 phase/3
queue management
 phase/4
queue management
 phase/5
queue management
 phase/6
queue management
 queue/blocked
queue management
 queue/done
queue management
 queue/failed
queue management
 queue/in-progress
queue management
 queue/queued
queue management
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dohertj2 (dohertj2)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#433
Delete Branch "r2/04-failure-visibility"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?