Driver stability tiers are inert: every driver runs Tier A — pass real tiers or delete the machinery #522

New Issue

2026-07-27T19:54:08-04:00

dohertj2 commented

2026-07-27 19:54:08 -04:00

Split out of deferment.md §3.3 / §8.6. Decision taken 2026-07-27: document the truth now, defer the code decision here — no runtime behaviour was changed, because turning dormant recycle machinery on for two live drivers deserves its own live gate rather than arriving as a side effect of a docs pass.

What is true today

DriverFactoryRegistry takes DriverTier tier = DriverTier.A, and no factory in src/Drivers/ passes a tier. All 12 drivers run Tier A.
The Tier-C-only protections have therefore never engaged:
- MemoryRecycle gates on when _tier == DriverTier.C.
- ScheduledRecycleScheduler refuses unless Tier C.
- IDriverSupervisor has zero implementations — yet the config parser still validates RecycleIntervalSeconds, so an operator can author a recycle interval that does nothing.
DriverTypeRegistry is vestigial: referenced only by DriverTypeRegistryTests. Nothing registers metadata at startup, nothing validates DriverInstance.DriverType against it, and its AllowedNamespaceKinds field was retired with the v3 Namespace entity.
The separate-Windows-service hosting docs/v2/driver-stability.md describes for Tier C does not exist. Galaxy reaches MXAccess over gRPC to the external mxaccessgw sidecar (the Galaxy.Proxy/Host/Shared pattern retired in PR 7.2); FOCAS runs in-process since its managed wire client landed 2026-04-24.

The decision

(a) Pass real tiers. Register Galaxy and FOCAS as Tier C so MemoryRecycle and ScheduledRecycleScheduler engage. This turns on dormant recycle behaviour for two live drivers — a real runtime change that wants its own live gate (a driver being recycled under memory pressure is exactly the kind of thing that is fine in theory and disruptive in practice). Note the tier model also assumes out-of-process isolation that no longer exists, so "Tier C" today would mean the recycle knobs only, not the isolation.

(b) Delete the machinery. Remove the tier gates, IDriverSupervisor, DriverTypeRegistry, and the recycle scheduler. Removes a documented-but-fictional capability, and stops the parser validating a knob with no effect.

Worth resolving either way: today the tier system is documented, operator-authorable, and inert — the same shape as the ACL subsystem in #520.

Already done

docs/v2/driver-stability.md carries a banner stating the tier table is aspirational and naming the dormant gates; docs/drivers/README.md already said Tier A for Galaxy and FOCAS, so the two no longer contradict each other.

Split out of `deferment.md` §3.3 / §8.6. **Decision taken 2026-07-27: document the truth now, defer the code decision here** — no runtime behaviour was changed, because turning dormant recycle machinery on for two live drivers deserves its own live gate rather than arriving as a side effect of a docs pass. ## What is true today - `DriverFactoryRegistry` takes `DriverTier tier = DriverTier.A`, and **no factory in `src/Drivers/` passes a tier**. All 12 drivers run Tier A. - The **Tier-C-only protections have therefore never engaged**: - `MemoryRecycle` gates on `when _tier == DriverTier.C`. - `ScheduledRecycleScheduler` refuses unless Tier C. - `IDriverSupervisor` has **zero implementations** — yet the config parser still validates `RecycleIntervalSeconds`, so an operator can author a recycle interval that does nothing. - `DriverTypeRegistry` is **vestigial**: referenced only by `DriverTypeRegistryTests`. Nothing registers metadata at startup, nothing validates `DriverInstance.DriverType` against it, and its `AllowedNamespaceKinds` field was retired with the v3 `Namespace` entity. - The separate-Windows-service hosting `docs/v2/driver-stability.md` describes for Tier C does not exist. Galaxy reaches MXAccess over gRPC to the external mxaccessgw sidecar (the `Galaxy.Proxy`/`Host`/`Shared` pattern retired in PR 7.2); FOCAS runs in-process since its managed wire client landed 2026-04-24. ## The decision **(a) Pass real tiers.** Register Galaxy and FOCAS as Tier C so `MemoryRecycle` and `ScheduledRecycleScheduler` engage. This turns on dormant recycle behaviour for two live drivers — a real runtime change that wants its own live gate (a driver being recycled under memory pressure is exactly the kind of thing that is fine in theory and disruptive in practice). Note the tier model also assumes out-of-process isolation that no longer exists, so "Tier C" today would mean the recycle knobs only, not the isolation. **(b) Delete the machinery.** Remove the tier gates, `IDriverSupervisor`, `DriverTypeRegistry`, and the recycle scheduler. Removes a documented-but-fictional capability, and stops the parser validating a knob with no effect. Worth resolving either way: today the tier system is documented, operator-authorable, and inert — the same shape as the ACL subsystem in #520. ## Already done `docs/v2/driver-stability.md` carries a banner stating the tier table is aspirational and naming the dormant gates; `docs/drivers/README.md` already said Tier A for Galaxy and FOCAS, so the two no longer contradict each other.

dohertj2 referenced this issue from a commit

2026-07-27 20:03:54 -04:00

docs: close the plan-bookkeeping drift and state the tier truth (§8.5, §8.6, #522)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#522