Joseph Doherty
167 KiB
Deferment register — new drivers, open issues, deferred work
Scope. A source-verified inventory of what is unfinished in this repo: the status of the recently-added drivers, every open tracker issue, in-code deferrals, open live gates, and the documentation that misstates any of it.
Method. Five parallel agents swept the tree independently; every claim below was checked against source (
src/,tests/,git log), not against documentation. Where a doc and the code disagreed, the code won and the doc is listed in §7. Findings that could not be verified without hardware or a live rig are marked CANNOT VERIFY rather than asserted.Baseline. The audit below was taken against
master@90bdaa44, 2026-07-27, and §1–§8 are preserved as that audit — they are the record of what was found, not a description of the tree today. §9 is the live status.Current tree:
master@4bdce910, 2026-08-04. Items closed since the audit are struck through or marked ✅ in place, so a reader can still see what was found and what became of it.⚠️ The tracker is EMPTY as of 2026-08-04 — 0 open issues. Every issue this register enumerates has been closed. What is left is therefore entirely untracked: live gates that need hardware, one unexecuted plan, three carried-open archreview findings, and a review-coverage gap. See §0.1.
0. The short version
(As audited at 90bdaa44. See §0.1 for what is left.)
The driver runtime is in good shape — no new driver contains a stub, a NotImplementedException,
or an unregistered factory. What is unfinished clusters into four groups, in descending order of
how much they should worry you:
| # | Theme | Why it matters | Now |
|---|---|---|---|
| 1 | Three subsystems are fully authored, persisted, and shipped — and never executed. Node ACLs, IRediscoverable/IHostConnectivityProbe, and DriverTypeRegistry. |
An operator can author a rule, save it, deploy it green, and have it do nothing. §3 | ✅ All three settled: IRediscoverable consumed (#518), IHostConnectivityProbe re-transported to telemetry (#521), DriverTypeRegistry + the tier machinery deleted (#522). Node ACLs are now enforced — #520 shipped through stage 7 (merges fbe7403c stages 1-2/4, 3a6b2a1d stage 3, 1ccc7400/f692f6af stage 5 write/alarms/HistoryRead, d4389f57/00aa4866 stage 6 read/browse/subscribe, 3796c0bf stage 7 authoring; wired at Host/Program.cs:394-398 → DataPlaneAuthorizer). Enforcement is opt-in: Security:Acl:Enabled defaults false |
| 2 | AdminUI authoring-dispatch gaps. Calculation is offered in the driver picker but has no config form; three drivers have no device form; CSV + browse-commit dispatch maps miss the new drivers. | The "registered but unauthorable" class that has now bitten twice. §1.2 | ✅ Closed — G-1…G-6 fixed and guarded; G-7 remains |
| 3 | 17 open issues, all confirmed still open, several broader than filed. | §2 | ◐ 6 resolved + closed, 6 new filed (one since closed) → 17 open, none stale. Two of the six closures (#521, #522) resolved differently from how they were filed — see §3.2/§3.3 |
| 4 | Bookkeeping drift. 8 .tasks.json files show ~140 "pending" tasks for work that shipped; 5 CLAUDE.md status claims are stale. |
Someone follows the tracker and rebuilds a shipped driver. §6, §7 | ✅ Closed — 13 plan files + 11 archreview gates written back |
Nothing here is a data-loss or outage defect. The sharpest edge is §3 — silent non-enforcement.
0.1 What is actually left (re-verified at 4bdce910, 2026-08-04)
Refreshed 2026-10-08. The re-verification below is as of
4bdce910(2026-08-04) and is not current. Since then the #562–#591 issue sweep closed on master (3baa332d), and the work it deferred was filed as #592–#625 — those are the live tracker, not "0 open". Re-derive counts from the Gitea API before relying on any figure in this subsection; the §4.1 rows for telemetry eviction, theTODO(v3 WaveC)set and the/rawBrowse-device placeholder are resolved (struck through below).
Read this subsection, not the table below it. The 2026-07-30 table that follows is preserved as the record of what the remediation left behind; every tracker item in it has since closed. The live picture is here.
The tracker is at 0 open issues. Verified against the API, not inferred: the 14 issues §0.1 listed as open on 2026-07-31 all closed between 2026-07-31 and 2026-08-04 — #520, #525, the eight MQTT follow-ups (#508–#515), #489, #481, #468, #491 — as did the 11 filed after this register's audit (#526–#538).
So everything below is untracked work. Nothing in it is a data-loss or outage defect.
| What | Nature | Where |
|---|---|---|
4 live gates blocked on hardware/licence — DriverCapability.Initialize), Galaxy ScanStateProbeParityTests (licence-gated), v2 GA exit criteria (docs/plans/2026-06-25-focas-pdu-v3-30i-b-support.md, OPC UA CTT pass, Ignition 8.3 cutover) |
Cannot be closed from this box. Not decisions — inputs. (The two archreview gates turned out to be closable from this box after all — §5.) | §5 |
2026-06-14-driver-reconfigure-while-faulted Task 3startedAt byte-identical before and after and RestartCount=0 — no restart. |
§5 | |
Inspect2947a2b9 + 1469fbb4, merge 0695f682). All four now ship a Contracts-side *TagDefinitionFactory.Inspect wrapping the runtime parse, never mirroring the AdminUI model — Sql wraps the pre-existing SqlEquipmentTagParser; the MTConnect / OpcUaClient / Calculation blob readers were moved into their Contracts assemblies (the drivers now call them), so never-stricter-than-runtime is structural. Driver.Calculation.Contracts was created (no Contracts assembly existed). The reflection coverage guard was falsified (map entry removed → red naming SqlTagDefinitionFactory), and TagConfigAuthoringDeployParityTests pins authoring-accepts ⇒ deploy-accepts. Galaxy is now the sole unmapped type, deliberately + symmetrically (no typed authoring editor either). MTConnectTagConfigModel reads dataType leniently (misspelled name → silently String) while the runtime rejects it — authoring weaker than runtime, the opposite direction from G-7; documented inline in the parity tests.b50523b1 + 333ea488, see the 2026-08-10 §9 entry) — their own residuals are #552 (Sql browse-commit emits a config the gate rejects) / #553 (CSV typed-column merge silently rewrites typo'd enums pre-gate). |
§1.2 | |
AddressSpaceApplier.cs:95-97 tallies swallowed removal-pass failures into AddressSpaceApplyOutcome.FailedNodes (comment cites 01/S-1). 03/S4 FIXED — PrimaryGatePolicy.cs default-denies on unknown role when a driver peer exists (doc-comment "Fixes archreview 03/S4"), live-proven R2-04 T15. 06/S-1 PARTIAL — fail-closed advise path + galaxy.writes.unconfirmed meter shipped in GatewayGalaxyDataWriter.cs; residual = gateway-side WriteComplete correlation (cross-repo, mxaccessgw). Update 2026-08-09: the gateway half SHIPPED — mxaccessgw main b948e69 correlates the worker's OnWriteComplete onto the unary WriteSecured reply (statuses[0]; bounded wait default 1.5 s — deliberately under OtOpcUa's 2 s Tier A Write budget, configurable via MxGateway:Worker:WriteCompletionWaitMilliseconds; timeout falls back to today's empty-statuses shape, still metered unconfirmed). Update 2026-08-09 (later): 06/S-1 CLOSED — live-gated end to end, and the gate found + fixed three defects. The user-authorized redeploy exposed (1) the correlation covered WriteSecured only while OtOpcUa's dominant no-login path emits plain Write — fixed gateway-side (worker 53f69cd, all four unary write kinds, redeployed both hosts); (2) OtOpcUa's StatusCodeMap.FromMxStatus truncated the correlated failure row's MxStatus detail code to a byte (1007 & 0xFF = 239 → OPC DA Good band), mapping a REFUSED write to Good — fixed with the not-IsSuccess-never-Good invariant + category routing (SECURITY_ERROR → BadUserAccessDenied); (3) the writer's borrow-from-subscription-registry optimization could never commit (a subscription handle is plain-advised; MXAccess refuses the no-login write SECURITY_ERROR 1008 AND the advise upgrade E_INVALIDARG — one advise per HANDLE, not per attribute) — borrow path REMOVED, writer always owns a supervisory-advised handle. Live legs all PASSED on windev: happy write Good off confirmed statuses[0] + both meters flat; read-only refusal surfaces Bad-family + node-revert input; WriteCompletionWaitMilliseconds=0 control → provisional Good + metered unconfirmed (override removed after). Pinned by Live_correlated_write_statuses_confirm_commit_and_surface_refusal, Live_write_to_subscribed_tag_commits_via_own_handle, GatewayGalaxyWriteMeterLiveTests, and the new StatusCodeMapTests rows. |
§6.3 | |
2026-05-29-adminui-followups, 19 pending / 0 completedDriverConfig are no longer the runtime source of truth — the artifact populates RawTags), and its capability was delivered in the v3 shape (TagConfigEditorMap + DeviceFormMap, both verified reachable, not merely present). WS2/WS3 shipped; WS4's target files were deleted by v3 Batch 2 + #542. Per-task evidence in the .tasks.json. |
§6.2 | |
Phase7Composer/ScriptedAlarmActor deleted, evaluators/SDK sinks/security policies all production-wired), |
Hardware-blocked only. | §6.2, §9 2026-08-10 (sixth) |
findings.md; Wonderware reviews banner-retired to history; README at 65 modules, --check clean. The recorded Opens were themselves resolved 2026-08-10 (eighth round): fleet-wide 0 pending findings |
§9 2026-08-10 (seventh, eighth) | §6.3, §9 2026-08-10 (seventh) |
RawBrowseModal stale-open race (added 2026-08-05) — OnParametersSetAsync never re-checks staleness after its awaits, so a superseded open's late resolve can install the wrong device's browse config. The identical shape was found by review and fixed in RawTagModal/RawManualTagEntryModal (post-await staleness re-check; see docs/plans/2026-08-05-raw-modal-picker-live-config-design.md §6); the browse modal was deliberately left out of that branch's scope.87637e4e, merge 0739f4b9) — the sibling _openGeneration guard ported to every post-await write, plus two departures the siblings did not need: this modal resolves inside try/finally, so the catch (a stale open's failure would paint its error over the live device) and the finally (a stale return still runs the tail, dropping the LIVE open's spinner) are generation-guarded too. Four RawBrowseModalStaleOpenTests facts, each observed red pre-guard and each re-falsified by reverting only its own guard (1-failed/3-passed per revert — no redundant pin). |
design doc §6 |
⚠️ One correction worth carrying forward. archreview 03/S4 — "primary gate default-allows on
unknown role" — is the same shape as a decision deliberately taken on 2026-08-04 in
PrimaryGatePolicy.ShouldRecordHistorizedValues, where an unknown role captures. That is right for
historization (a duplicate sample beats a hole in the trend, and the duplicate is bounded by promotion)
and wrong for a write gate. Closing 03/S4 must not sweep both under one rule. Update 2026-08-07
(truth sweep): it didn't — 03/S4 is closed with exactly this split preserved: PrimaryGatePolicy. ShouldServiceAsPrimary default-denies on unknown role when a driver peer exists, while
ShouldRecordHistorizedValues still captures on unknown.
0.1-prev What the remediation left behind (as at 2a0461a1, 2026-07-30)
The remediation (§9) closed the two mechanical themes outright and converted the two judgement-call themes into tracked decisions. What remains:
| Item | Nature | Where |
|---|---|---|
#520 node ACLs authored + deployed but never enforced ✅ CLOSED 2026-08-01 (truth-sweep note 2026-08-07: shipped through stage 7 — enforcement merges fbe7403c/3a6b2a1d/1ccc7400/d4389f57/3796c0bf; opt-in via Security:Acl:Enabled, default false) |
Decision: wire it or retire the surface. |
§3.1 |
#521 IHostConnectivityProbe / DriverHostStatus dead surface ✅ CLOSED abda6f9e |
Resolved by changing the transport, not by either option as filed — the publisher as designed was unbuildable after Phase 4. Host status now rides DriverHealthChanged to /hosts; table dropped. |
§3.2 |
#522 driver stability tiers inert ✅ CLOSED abda6f9e |
Deleted. The inertness was broader than filed (nothing constructed MemoryTracking either), and the model's premise — an out-of-process Host to recycle — no longer exists. DriverTier kept. |
§3.3 |
| ✅ Done + closed on the tracker. AbCip and FOCAS now have no tag-change signal at all; that is the accepted consequence, not an oversight. | §9 (2026-07-30, #523) | |
G-7 EquipmentTagConfigInspector coverage |
◐ Narrowed + guarded (2026-07-28): MQTT wired (it shipped an Inspect nobody called), and a reflection guard now fails the build if a reachable driver ships one and is not mapped. Residual: Sql / MTConnect / Calculation / OpcUaClient have no Contracts-side Inspect at all, so the deploy gate stays blind for them while the AdminUI validates them — see §1.2. |
§1.2 |
EquipmentTagsDarkBatch4 skipped tests |
✅ Done — 6 revived onto the raw/UNS shape, 3 folded into a widened live parity corpus, 4 deleted as retired. The reason constant is gone. Skips now: Runtime.Tests 13 → 3, OpcUaServer.Tests 4 → 1 — all remaining are deliberate EquipmentDeviceBindingRetired tombstones. |
§9 (2026-07-28, skips) |
| 17 other tracker issues | Driver features + deferred work, unchanged by this remediation. | §2 |
| Open live gates | c2c3c522, #491 e77ea4aa + the #537/#538 gate 4bdce910); |
§5 |
✅ The tracker is now clean of stale-open issues (2026-07-30). #516, #518, #507 and #523 were closed, each with a resolution comment recording what was actually done — which differs from what the issue asked for in three of the four cases, so the comment matters more than the state change:
| Issue | What the comment records |
|---|---|
| #516 | The issue's own survey was incomplete — it named 3 drivers, the defect affected 5, and the load-bearing fix was the spawn seam rather than any driver. |
| #518 | Only half resolved. IRediscoverable is consumed as an operator prompt, never an address-space rebuild; IHostConnectivityProbe is untouched and split to #521. |
| #507 | Superseded, not migrated — the requested migration was impossible, since both of the path's inputs are structurally empty in v3. |
| #523 | Done, with the consequence carried forward: AbCip and FOCAS now have no tag-change signal at all. |
14 issues remain open ✅ ALL 14 CLOSED as at 2026-08-04 — the tracker is empty. Preserved as
found (verified against the tracker API 2026-07-31, not derived): #520 and #525
(the two remaining judgement calls), the eight MQTT follow-ups (#508–#515), #491, #489, #481, #468.
Membership moved across three rounds: #521 and #522 closed, #524 and #525 opened (both residuals
their parent issue's decision did not cover — a second dead table and two consumerless IDriver
members), then #524 closed with the table dropped, then #517 and #519 closed — leaving 14.
What is left is no longer a dead-surface cluster: #520 and #525 are keep-or-delete calls, and the
rest are MQTT follow-ups plus four infrastructure-gated items.
1. New drivers — source-verified status
Cross-cutting facts, verified once: all 12 driver types register in one place
(src/Server/ZB.MOM.WW.OtOpcUa.Host/Drivers/DriverFactoryBootstrap.cs:147-164); all 12 register a
probe (:119-130) via AddOtOpcUaDriverProbes(), called from both the driver path (:93) and
the admin path — no probe is admin-node-missing. DriverTypeNames
(src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverTypeNames.cs) is guarded bidirectionally by
reflection in tests/Core/…Core.Abstractions.Tests/DriverTypeNamesGuardTests.cs.
1.1 Status table
| Driver | Verdict | Merged | Capabilities | Notes |
|---|---|---|---|---|
| MTConnect | Complete-with-gaps | 90bdaa44 (#506) |
IDriver, IReadable, ISubscribable, ITagDiscovery, IHostConnectivityProbe, IRediscoverable (MTConnectDriver.cs:63) |
IWritable by design (:50).IWritable added 2026-08-05 (b29623cf) — observation injection via the Agent's AllowPut surface, off by default at two gates (Write.Enabled + the Agent's own AllowPut); MTConnect Interfaces stays deferred. No device form. |
| MQTT / Sparkplug B | Complete | c3a2b0f7 |
+ IRediscoverable, IAsyncDisposable (MqttDriver.cs:65-66) — and IWritable since 72be1922 |
Cleanest of the five: picker + driver form + device form + tag editor all present. |
| Sql | Complete-with-gaps | 4ad54037, follow-ups 28c28667 |
IDriver, ITagDiscovery, IReadable, ISubscribable, IHostConnectivityProbe (SqlDriver.cs:28-29) |
No device form; no browse-commit branch; stale comments. |
| Modbus RTU-over-TCP | Complete | 0f38f486 (#495) |
transport mode inside Modbus (ModbusTransportMode.cs, ModbusRtuOverTcpTransport.cs) |
Parses transport by name (ModbusDriverFactoryExtensions.cs:77-78) — dodges the systemic numeric-enum authoring bug. |
| Calculation | Partial (authoring gap) | pre-existing | IDriver, IDependencyConsumer, ISubscribable, IReadable (CalculationDriver.cs:38) |
Registered + offered in the picker, but has no config form. See §1.2. |
IWritable is absent from MTConnect, MQTT, Sql and Calculation. In all four this is structural and
documented, not a stub (MTConnectDriver.cs:50, MqttDriver.cs:483, SqlDriver.cs:15).
✅ Two of the four gained it since the audit. As of 2026-08-05 IWritable is absent from Sql and
Calculation only — and in both that absence is still structural and documented (SqlDriver.cs:15).
MQTT gained it 2026-07-31 (72be1922,
#508, live-gated — plain writeTopic
publish + Sparkplug NCMD/DCMD); MTConnect gained it 2026-08-05 (b29623cf — observation injection
through the Agent's AllowPut surface, off by default at two independent gates).
Zero NotImplementedException across all five drivers. Every NotSupportedException is either a
catch filter or a deliberate domain error.
1.2 Gaps found — AdminUI authoring & dispatch layer
Every gap below is in the authoring/dispatch layer, not driver runtime code.
✅ G-1 … G-6 are all closed (
6a01358b, live-verified on docker-dev). The two Razor@switchdispatch blocks became testable maps (DriverConfigFormMap,DeviceFormMap) and are now guarded in both directions, so this class cannot recur silently. G-7 is the only one left. See §9.
| # | Gap | Evidence | Impact | Now |
|---|---|---|---|---|
| G-1 | DriverConfigModal.razor has no Calculation case — falls to the default "No typed config form" warning; no CalculationDriverForm.razor exists |
DriverConfigModal.razor:34-72, default arm :69-71 |
CalculationDriverOptions.RunTimeout (CalculationDriverOptions.cs:19) is unauthorable via the UI. Create/rename still work, so degraded — not a hard block. This is the same class as the Sql picker defect, one modal further downstream. |
✅ Fixed — CalculationDriverForm.razor |
| G-2 | DeviceModal.razor is missing Sql, MTConnect, Calculation |
DeviceModal.razor:42-74, default arm :71-73 |
Mitigated: Sql/MTConnect hold connection at the driver level, and Test Connect still works via BuildMergedProbeConfig (:180-184). |
✅ Fixed — declared single-connection rather than given hollow device forms |
| G-3 | DriverConfigModal.razor:77 tells Sql/MTConnect operators the wrong thing — the single-connection branch is hardcoded to Galaxy or Mqtt, so Sql/MTConnect users are told the endpoint lives on the device when they just authored it on the driver |
DriverConfigModal.razor:77, :86-88 |
Actively misleading, compounds G-2. | ✅ Fixed — DeviceFormMap.IsSingleConnection |
| G-4 | No parity test guards DriverConfigModal or DeviceModal — RawDriverTypeDialogCoverageTests/…ParityTests assert DriverTypeNames ↔ picker parity only |
— | This is exactly why G-1 and G-2 survived review. The guard pattern exists and simply was not extended to the two downstream dispatch maps. | ✅ Fixed — DriverFormMapParityTests + DriverDispatchMapParityTests (since #558/7482cf0c the browse-commit fact lives in RawBrowseCommitMapperParityTests; DriverDispatchMapParityTests guards CsvColumnMap only) |
| G-5 | CsvColumnMap has no typed columns for Sql, MQTT, MTConnect |
CsvColumnMap.cs:340-452 |
CSV import/export degrades to the raw TagConfigJson fallback while the 7 older drivers get typed columns. |
✅ Fixed — CSV maps for Sql/Mqtt/MTConnect |
| G-6 | RawBrowseCommitMapper has no Sql branch — falls to the generic WriteSingleKey("address", …) whose comment claims "Browsable drivers are all handled above" |
RawBrowseCommitMapper.cs:121-141, fallback :145 |
Untrue since SqlDriverBrowser was registered (EndpointRouteBuilderExtensions.cs:83). Same failure mode the MTConnect branch (:135-139) was added to avoid: typed editor opens empty, blanks the field on save. |
✅ Fixed — and at the browser end too, which the audit missed |
| G-7 | EquipmentTagConfigInspector covers only 6 driver types |
:24-29 |
Pre-existing (OpcUaClient + Galaxy absent too); no new driver was added. The audit understated it: the AdminUI's TagConfigValidator covers 11 of 12, so the deploy gate is weaker than the authoring gate — and config arriving by CSV import or API only meets the deploy gate. |
✅ CLOSED 2026-08-09 — MQTT wired + reflection guard (2026-07-28), then the four remaining drivers gained Contracts-side Inspect wrapping their runtime parses (merge 0695f682). The gate now covers 11 of 12 — parity with the AdminUI validator; Galaxy is the sole unmapped type on both, symmetrically. See §9 |
1.3 Stale in-code comments (harmless at runtime, misleading to the next reader)
✅ All cleared (
6a01358b,d32d89c3). Listed as found.
DriverTypeNames.cs:22-25— Calculation described as "not-yet-registered"; it registers atDriverFactoryBootstrap.cs:149.TagConfigEditorMap.cs:25-28+TagConfigValidator.cs:27-28— "DriverTypeNames.Sqldeliberately absent until Task 11"; the constant exists (DriverTypeNames.cs:57) and the values are identical, so behaviour is correct.RawDriverTypeDialog.razor:2-4, 59-60— "its factory lands in Wave C".CsvColumnMap.cs:322-324— hardcodesCalculationDriverType = "Calculation""Not yet aDriverTypeNamesconstant"; it has been one sinceDriverTypeNames.cs:54.SqlDriver.cs:218-220— justifies not re-parsing config on the premise "the factory builds a fresh instance", disproved byDriverInstanceActor.cs:316+DriverHostActor.cs:2565.
2. Open tracker issues — all 17 verified against source
No issue was found stale. 11 CONFIRMED, 4 PARTIALLY (core claim holds, a sub-claim is wrong or incomplete), 2 CANNOT VERIFY (correctly filed as hardware/fixture-gated).
Since the audit: three of these were resolved by the remediation and have now been closed on the tracker (2026-07-30) — #516, #518 and #507 (marked ✅ below), each with a resolution comment; #518's records that only its
IRediscoverablehalf was fixed. Four new issues were filed from §3 and §9: #520 (ACL enforcement), #521 (IHostConnectivityProbe), #522 (stability tiers), #523 (remove the periodic re-browse). #523 has since been done and closed too. After closing the four resolved issues on 2026-07-30 the tracker shows 17 open, none stale. Everything not marked below is unchanged.
✅ SUPERSEDED 2026-08-04 — every issue in the table below is CLOSED, as is every issue filed after this audit (#526–#538). The tracker is at 0 open. The table is retained because the verdict column is the durable part: four of these were wider or narrower than filed, and three were resolved differently from how they were asked for. Closure dates, from the API rather than inferred: #489, #481, #508–#515 and #525 on 2026-07-31; #520 and #468 on 2026-08-01; #491 on 2026-08-04. #491's gate then produced #537 (no Primary gate on historization capture) and #538 (one poison tag re-writes every healthy tag) — both filed and closed the same day,
e7fbe977+4bdce910.
| # | Title (abbrev.) | Verdict | Key evidence | Kind |
|---|---|---|---|---|
| 518 ✅ | IRediscoverable + IHostConnectivityProbe have no consumer; CLAUDE.md wrong — RESOLVED 09a401b8: rediscovery consumed as an operator prompt; probe half split to #521. Stale-open on tracker. |
CONFIRMED — worse than filed | Only += in src/ are Galaxy self-wiring (GalaxyDriver.cs:586, :221). GetHostStatuses() has zero call sites outside the interface + implementations; DriverHostStatuses DbSet is referenced only by its declaration and a test. |
Defect + doc error |
| 507 ✅ | Discovered-node injection inert in v3 — RESOLVED adce27e7: not revivable (its two inputs are structurally empty in v3), so the path was DELETED, superseded by /raw browse-commit. Stale-open on tracker. |
CONFIRMED | DriverHostActor.cs:986-1002 hard-return; + #pragma warning disable CS0162 (restored :1077) |
Deferred (deliberate guard) |
| 519 | No Bad/Uncertain sub-code reaches a client | CONFIRMED | Collapse at DriverInstanceActor.cs:1033-1041 (statusCode >> 30), re-expand at OtOpcUaNodeManager.cs:3318-3322. Enum is 3-state at IOpcUaAddressSpaceSink.cs:165. Wider than filed — StatusFromQuality also used at :429/:506/:576/:761, so alarm-condition Quality collapses too. |
Design consequence |
| 517 | Health published AFTER teardown | CONFIRMED, fleet-wide | ModbusDriver.cs:244-250, MTConnectDriver.cs:579-590, S7Driver.cs:292-326 — all Teardown… then WriteHealth(Unknown); GetHealth() is a plain field read |
Defect (race) |
| 516 ✅ | Driver config edits silently discarded — RESOLVED d32d89c3 + 5184a2e1: seam respawn + in-place re-parse; all 12 drivers now honour a changed config. Stale-open on tracker. |
CONFIRMED — survey now complete | DriverInstanceActor.cs:316 (only _driver assignment) + DriverHostActor.cs:2565 (Tell existing child, no respawn) + :653/:660 (green seal). Affected: Modbus, FOCAS, OpcUaClient, + AbLegacy (issue missed it), + Sql (deliberate/documented). AbCip/TwinCAT re-parse ✅; Galaxy fails loud (throws, GalaxyDriver.cs:600-641) |
Defect |
| 515 ✅ | Sparkplug DataSet/Template/PropertySet — RESOLVED c74ccc55: structured metrics flattened to sibling tags; live-gated. |
CONFIRMED | SparkplugCodec.cs:207-210 decode to Unsupported — visible refusal, not silent drop. (PropertySet isn't a ValueOneofCase; it rides metric.Properties) |
Deferred feature |
| 514 ✅ | Rebirth unarmable on a plant that hasn't birthed — RESOLVED 7f53bd96: the browse modal takes a typed group/edgeNode scope when no tree scope is armed (edge node only, never a group broadcast). |
CONFIRMED | RawBrowseModal.razor:119-120 disabled; _rebirthTarget set only by tree-click handlers (:432, :437, :439-451). Empty tree ⇒ permanently disabled |
Defect (chicken-and-egg) |
| 513 ✅ | Meaningless payloadFormat in Sparkplug blob — RESOLVED 7f53bd96. |
CONFIRMED | MqttTagConfigModel.cs:210 unconditional Set, vs. mode-aware :216 |
Defect (cosmetic) |
| 512 ✅ | .Browser → .Driver layering — RESOLVED 7f53bd96. |
CONFIRMED | …Mqtt.Browser.csproj:43 (not :44), boxed "KNOWN, DELIBERATE EXCEPTION" at :16-42 |
Deferred refactor |
| 511 ✅ | ActAsPrimaryHost does nothing — RESOLVED 7f2108dc: Sparkplug primary-host STATE publishing + Will, Primary-gated; live-gated. |
CONFIRMED | Option at MqttDriverOptions.cs:193, round-tripped in the UI, handled only by a warning at MqttDriver.cs:933-948. No STATE publish, no Last Will |
Deferred feature |
| 510 ✅ | _canRebirth captured at browse-open — RESOLVED 7f53bd96. |
CONFIRMED | RawBrowseModal.razor:377 sole true assignment; failure path :516-539 never re-evaluates |
Defect (stale affordance) |
| 509 ✅ | Metric name with / unbrowse-committable — RESOLVED 7f53bd96: RawBrowseCommitMapper.ToRawSegment sanitises the segment and refuses a collision in words. |
CONFIRMED | RawBrowseCommitMapper.cs:63 uses browse name verbatim → RawPaths.cs:39 rejects / → RawTreeService.cs:976 all-or-nothing kills the whole batch |
Defect |
| 508 ✅ | MQTT write-through — RESOLVED 72be1922: IWritable shipped (plain writeTopic publish + Sparkplug NCMD/DCMD), live-gated 2026-07-31. The evidence column is the audit snapshot; MqttDriver.cs:66 now names IWritable. |
CONFIRMED | MqttDriver.cs:66 — no IWritable; consequence at DriverInstanceActor.cs:673-677 |
Deferred feature |
| 507→ see above | ||||
| 491 | Continuous-historization live gate | CANNOT VERIFY (needs VPN'd gateway) | Code is complete: AddressSpaceApplier.cs:238→:540→ActorHistorizedTagSubscriptionSink.cs:27-38→ContinuousHistorizationRecorder.cs:84, wired ServiceCollectionExtensions.cs:435 |
Deferred test |
| 489 | Hot-rebind renamed raw tag | CONFIRMED | No implementation exists | Deferred feature |
| 481 | Comms-loss → scripted-alarm quality (Layer 4) | CONFIRMED | DriverHostActor.cs:1356-1379 iterates _alarmNodeIdByDriverRef only. Issue is wrong that the per-driver ref set is missing — _nodeIdByDriverRef exists at :193; only the fan-out into the mux is absent, so the work is smaller than filed |
Deferred feature |
| 468 | Wave-0 browser tree render | CANNOT VERIFY (fixture) | Code path present (AbCipDriver.cs:1092-1095, LibplctagTagEnumerator.cs:29-37); ab_server returns ErrorUnsupported for CIP Symbol Object enumeration |
Deferred verification |
2.1 Cross-cutting observations
- #518 → #507 are the same failure, stacked. The event has no subscriber and its downstream handler hard-returns. Fixing either alone changes nothing observable — schedule them together.
- #516 is a superset of part of #489. For the five drivers that discard reinit config, the
renamed-tag-never-rebinds symptom follows mechanically (their
_tagsByRawPathstill keys on the old RawPath). Re-scope #489 after #516. - #519 and #481 share the same
statusCode >> 30collapse idiom at three independent sites (DriverInstanceActor.cs:1033,ScriptedAlarmEngine.cs:745,:777). Widening the status path must cover all three.
3. Dead seams — authored, shipped, never executed
The most consequential category in this register, and the one nothing in the code flags. Three subsystems are fully built and reachable by operators, but no production code path executes them.
Since the audit: one of the three is now consumed (§3.2's
IRediscoverablehalf). The other two were not fixed — that was the deliberate call, because each is a keep-or-delete decision rather than a defect. What changed is that they can no longer mislead: the non-enforcement is stated in the docs and, for ACLs, warned about in the authoring UI itself, so an operator cannot save a rule believing it does something. Tracked as #520, #521, #522.
3.1 Node-level ACLs are authorable, deployed — and unenforced
✅ Update 2026-08-07 (truth sweep): NO LONGER TRUE — #520 shipped through stage 7 and is CLOSED (2026-08-01). Enforcement merges:
fbe7403c(stages 1-2, 4: API-key identity + keys/ACLs in the artifact),3a6b2a1d(stage 3: variable-depth scope model),1ccc7400/f692f6af(stage 5: write, alarms, HistoryRead),d4389f57/00aa4866(stage 6: read, browse, subscribe),3796c0bf(stage 7: ACL authoring/scope picker).TriePermissionEvaluatoris now wired atHost/Program.cs:394-398intoDataPlaneAuthorizer, registered on every node. Enforcement is opt-in —Security:Acl:Enableddefaultsfalse; with it off the two coarse server-wide gates remain the whole of data-plane authorization, with it on scopedNodeAclgrants decide every data-plane operation. The section below is preserved as the pre-#520 record.
◐ Still true; now impossible to miss (
53ede679, Gitea #520).docs/security.md,docs/ReadWriteOperations.md,docs/v2/acl-design.mdandv2-release-readiness.mdcorrected, andClusterAcls.razor/AclEdit.razorcarry a warning alert. The audit nameddocs/ReadWriteOperations.mdas the highest-risk doc;docs/security.mdwas worse — it claimed an anonymous session is default-denied any node it has no grant for, when in fact it can read the entire address space. #520 records the four real blockers to a wire-up, of which the Raw-realm scope gap is a design decision rather than wiring.
IPermissionEvaluator,TriePermissionEvaluator,PermissionTrieCache,PermissionTrieBuilderhave zero references outsidesrc/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/and their own tests (independently re-verified for this report: every other grep hit is abin//obj/XML doc artifact).OtOpcUaNodeManagercontains no reference toPermissionorEvaluatorat all.- Meanwhile
ClusterAcls.razor+AclEdit.razorlet operators authorNodeAclrows, andConfigComposer.cs:51snapshots them into every deployment artifact.
Impact: an operator authors a deny rule, deploys it green, and it has no effect. Actual
enforcement is coarse LDAP roles plus the realm-qualified WriteOperate gate in the node manager —
and that is a write gate; reads carry no per-node ACL check.
docs/ReadWriteOperations.md:13,21 states the opposite (see §7.1) — it is the single
highest-risk doc error found.
3.2 IRediscoverable + IHostConnectivityProbe raise into the void
✅
IRediscoverablehalf FIXED (09a401b8) — consumed byDriverInstanceActorand surfaced as a/hostsre-browse prompt. Advisory: the served address space is not rebuilt, because v3 authors raw tags through/rawbrowse-commit. ✅IHostConnectivityProbehalf RESOLVED (abda6f9e, Gitea #521 closed) — but not as this register or the issue framed it. The choice was never "build the publisher or delete it": the publisher as designed — driver nodes upsertingDriverHostStatusrows — is unbuildable, because per-cluster mesh Phase 4 gatesAddOtOpcUaConfigDbon theadminrole, so a driver-only node has no ConfigDb connection to write with. The design predates Phase 4 and nobody revisited it; "deliberately re-created in the v3 initial migration" turned out to mean carried forward mechanically, not intended. So the capability was kept and the transport changed:DriverHealthChanged.HostStatusescarries the probe result to/hostsover the Phase 5 telemetry stream, which needs no DB and survives the mesh split. The table is dropped (DropDriverHostStatusTable). Live-gated on docker-dev, including the cross-mesh gRPC path — site-a first showed—, which is also what a broken mapper produces, so it was rebuilt to prove thehas_host_statusespresence flag round-trips rather than assuming version skew. ✅ A third table, same defect, found en route — now also RESOLVED (d979ac69, Gitea #524):DriverInstanceResilienceStatushad no writer and no reader either — only its DbSet declaration — while the live data rides thedriver-resilience-statustelemetry channel intoIDriverResilienceStatusStore(verified consumed:DriverStatusPanel.razorinjects it, fed by both the DPS bridge and the gRPC dialer). Dropped by migrationDropDriverInstanceResilienceStatusTable. Filed separately rather than folded into #521 so a second schema change was an explicit decision, not a side effect.
Gitea #518/#507. Nine drivers raise; nothing consumes. DriverHostStatus table exists
(OtOpcUaConfigDbContext.cs:48, migration 20260715230637_V3Initial.cs:108) with a doc-comment
claiming a writer — nothing ever writes a row.
Impact: an Agent/PLC/Galaxy restart leaves a stale address space behind a Healthy driver, and the per-host connectivity table is permanently empty.
3.3 DriverTypeRegistry is vestigial
✅ RESOLVED — DELETED (
abda6f9e, Gitea #522 closed).DriverTypeRegistry,MemoryTracking,MemoryRecycle,ScheduledRecycleScheduler,IDriverSupervisorand the operator-authorableRecycleIntervalSecondsknob are gone.⚠️ This register understated the inertness, exactly as the issue did. Both said the Tier-C-only protections were dormant, implying the Tier A/B parts ran. They did not: nothing constructed
MemoryTrackingat all outside its own unit tests, so the wholeCore/Stabilityrecycle layer was dead. That changed the decision — "pass real tiers" was never a flag flip, it meant writing the wiring that never existed and arming it on two live drivers at once. Deletion won because the premise is gone, not merely unused: Tier C meant an out-of-process Host a supervisor could restart, andIDriverSupervisorhad zero implementations because there is nothing left to implement against.
DriverTieritself survives and is load-bearing —GetTierDefaultssupplies the real per-capability timeout/retry/breaker policies. Only the isolation-and-recycle layer above it went.WedgeDetectorshared the folder, is equally dead, and is not recycle machinery — restored rather than swept up in a decision that was not about it.IDriver.GetMemoryFootprint/FlushOptionalCachesAsynclose their only consumer here; documented and filed as Gitea #525 rather than buried in a 12-driver sweep.
Independently verified for this report: src/Core/…Core.Abstractions/DriverTypeRegistry.cs:20 is
referenced only by tests/Core/…/DriverTypeRegistryTests.cs. Nothing registers metadata at
startup; nothing validates DriverInstance.DriverType against it. Its AllowedNamespaceKinds field
was retired with the v3 Namespace entity (DriverTypeRegistry.cs:97).
Knock-on: the driver stability tier does not come from here either. The live source is
DriverFactoryRegistry.cs:46 (DriverTier tier = DriverTier.A) and no factory in src/Drivers/
passes a tier — so all 12 drivers run Tier A, and the Tier-C-only protections are dormant for
every driver: MemoryRecycle.cs:54 (when _tier == DriverTier.C) and
ScheduledRecycleScheduler.cs:43 (refuses unless Tier C). docs/v2/driver-stability.md still
assigns Galaxy and FOCAS to Tier C.
3.4 Related dead/dormant code
| Item | Evidence |
|---|---|
IDriverConfigEditor — interface, zero implementors, zero production consumers |
Core.Abstractions/IDriverConfigEditor.cs:9; superseded by TagConfigEditorMap / DriverConfigModal |
GenericDriverNodeManager — explicitly not a production dispatch path |
Core/OpcUa/GenericDriverNodeManager.cs:71 ("verified 07/#10: zero production references") |
IDriverSupervisor — Tier-C recycle machinery has zero implementations, yet the parser still validates RecycleIntervalSeconds |
archreview 01/U-2 |
Build never adds a concurrency limiterarchreview/plans/STATUS.md R2-02 row |
archreview 01/U-6 |
WriteIdempotentAttribute — zero readers; write dispatch hardcodes isIdempotent: trueisIdempotent: false (RED-first on the Runtime wiring test) and the attribute's false claim corrected; see archreview/plans/STATUS.md R2-02 row |
archreview 01/S-8 = 03/S12 |
| ~60 lines of unreachable code retained behind #507's guard | DriverHostActor.cs:1002, #pragma warning disable CS0162 |
Three empty Driver.Historian.Wonderware* directories (0 .cs, no .csproj, absent from .slnx) |
verified for this report — only stale bin/+obj/ remain |
4. In-code deferrals by subsystem
The tree is unusually clean on classic markers: 9 TODOs across 1,812 files; zero
FIXME/HACK/XXX/WORKAROUND; zero #if false; zero [Obsolete] on project code; zero
commented-out DI registrations. Real deferred work lives in prose doc-comments and skipped tests.
4.1 Highest-consequence
| Item | Evidence |
|---|---|
TelemetryLocalHub.Evict drops a removed driver's snapshots (DriverHostActor.StopChild via plan.ToStop, #609); central-side stores are not evicted |
TelemetryLocalHub.cs:40 TODO(mesh-phase5+) — self-declared, bounded, "pre-production, accepted" |
DeviceConfig — 7 of the repo's 9 TODOs are this one item, across 4 driversTODO(v3 WaveC) remains in src/ (re-verified 2026-10-08) |
FocasDriver.cs:137,287; TwinCATDriver.cs:775; AbLegacyDriver.cs:557; AbCipDriver.cs:89,1272 + AbCipDriverOptions.cs:130 — all TODO(v3 WaveC) |
Galaxy writes can never confirm a COM commit — empty status array ⇒ provisional Good, metered galaxy.writes.unconfirmed |
GatewayGalaxyDataWriter.cs:44,328,354 — cross-repo, blocked on mxaccessgw |
Subscription liveness undetectable — ISubscriptionHandle is opaque |
DriverInstanceActor.cs:527 (#488) — well-reasoned, deferred "until a real occurrence" |
/raw "Browse device" is still a placeholder despite the universal discovery browser landingRawTree.razor wires OnBrowseDevice to the discovery modal |
RawTree.razor:15,426 — verify; may be reachable now via DiscoveryDriverBrowser |
4.2 Per-driver
- S7 — array writes unsupported entirely (
S7Driver.cs:1139); several array read types unsupported (:386,404,413,419,428,442,465,807,959) — all fail fast at config-validation; legacy C-area counter reinterpretation live-hardware-gated (:759); Counter BCD on S7-300/400 undecoded. - AbCip — ALMD-only alarm projection, ALMA deferred (
AbCipAlarmProjection.cs:16,324); no CIP Template Object reader, UDT layouts declaration-driven (AbCipDriverOptions.cs:172); whole-UDT writer deferred (LibplctagTagRuntime.cs:190);AckCmdpulse must be wired client-side (:30). - Sql —
SqlTagModel.Querydeferred to P3, enforced end-to-end across parser, validator, planner and editor (SqlProvider.cs:22,37;SqlEquipmentTagParser.cs:24,103;SqlGroupPlanner.cs:44,249;SqlTagConfigModel.cs:114) — exemplary deferral discipline.Postgres/ODBC dialects deferred behind(update 2026-08-07, truth sweep: PostgreSQL and Oracle dialects shipped 2026-08-05, mergeISqlDialectd54f3c83— managed Npgsql / Oracle.ManagedDataAccess.Core, live-gated;MySql/Odbcremain reserved enum names that fail at construction). - MTConnect —
TIME_SERIESvectors deferred to P1.5;DATA_SET/TABLEcodedBadNotSupportedwith a null value rather than approximated (MTConnectObservationIndex.cs:53,272) — deliberately chosen over a Good-coded lie.RawTagEntry.DeviceNameignored for routing (two/rawDevices under one driver share an Agent connection) — "a design change, not a bug fix". No DataType-vs-blob validation at authoring. - MQTT —
MaxPayloadBytesis a constructor knob, not operator-facing (MqttSubscriptionManager.cs:170). - TwinCAT — Flat-mode struct expansion carries a LIVE RISK note, unverified against a real TC3 target (
AdsTwinCATClient.cs:270); VirtualTree-mode browse unverified; TC2 coverage, multi-hop AMS route and lab rig all hardware-blocked (docs/v3/twincat-backlog.md). - FOCAS — forces read-only regardless of authored
writable:true; servo-load semantics inferred from the wire, unconfirmed against a real CNC (FocasWireClient.cs:944);"Backend": "unimplemented"is a deliberate fail-fast stub, not unfinished work. - Historian.Gateway — String/DateTime/Reference writes deferred, gated on the analog SQL write path;
UInt16 → Uint4widening because theUInt2write path is deferred upstream (HistorianTypeMapper.cs:27-51).
4.3 Fleet-wide OPC UA gaps
- Array writes deferred across all drivers; multi-dimensional arrays (
ValueRank>1) unsupported; array historization is an opaque blob with no per-element history (docs/Uns.md:288-292,AddressSpaceApplier.cs:873,OtOpcUaNodeManager.cs:1764). HistoryUpdate— permission bit1<<12shipped but excluded from every composite bundle; no service surface (NodePermissions.cs:34).Utils.Log*is[Obsolete]in SDK 1.5.378, suppressed at 8 sites inOtOpcUaNodeManagerpending anITelemetryContextrewire.
4.4 Skipped tests — 36, from 4 reason constants
| Count | Reason | Assessment |
|---|---|---|
DiscoveryInjectionDormantV3 |
✅ Deleted (adce27e7). The audit's "Real — blocked on #507" was wrong: these were v2 characterization tests asserting an equipment-rooted graft (EquipmentRootNodeId == "EQ-1") that v3 cannot produce, so they could never have unskipped as written. Runtime.Tests skipped went 31 → 13. |
|
EquipmentTagsDarkBatch4 |
✅ Resolved (2026-07-28). The audit's "STALE" call was right and the constant is now deleted. Not by bulk-unskipping: 6 were revived onto the raw/UNS shape that replaced the subject, 3 were folded into a live parity test whose corpus was widened to cover them, 4 were deleted as genuinely retired. See §9. | |
| 4 | EquipmentDeviceBindingRetired |
Intentional tombstones preserving retirement rationale — fine as-is |
Plus 4 whole OpcUaClient test suites that are scaffold-only, awaiting an in-process OPC UA server
fixture that was never built (OpcUaClientSubscribeAndProbeTests, …DiscoveryTests,
…ReadWriteTests, …HistoryTests, all :10).
All env-gated integration suites skip cleanly when their vars are absent. The MTConnect gate is
notably a real /probe reachability + payload-shape check (MTConnectAgentFixture.cs:42), not
mere env-var presence, so it cannot pass vacuously.
5. Open live gates
| Gate | Status | Evidence |
|---|---|---|
e77c8a35) |
✅ CLOSED BY DELETION — removed under Gitea #523 rather than gated. The gate it needed (a device whose tag set actually changes) required exactly the traffic the removal objected to. | §9, 2026-07-28 (#523) |
| Continuous-historization value capture (#491) | ✅ PASSED e77ea4aa (2026-08-04) — and it found a production-fatal defect the code-complete reading missed: ConfigureAwait(false) in the Akka handler destroyed Self, the actor restarted, and the restart discarded the (empty-seeded) ref set. One value captured, then permanent silence. Two follow-ups filed and closed the same day: #537 (capture had no Primary gate — both pair nodes wrote duplicates) and #538 (a poison tag pinned the FIFO head, re-writing every healthy tag forever). |
docs/plans/2026-08-01-continuous-historization-live-gate.md; ad744734, e77ea4aa, e7fbe977, 4bdce910 |
| Wave-0 universal discovery browser full tree render (#468) | ✅ PASSED c2c3c522 (2026-08-01) — unblocked by building the missing sim capability (an ab_server patch) rather than waiting for hardware. The gate then found a decoder defect 350 unit tests agreed with. |
tracking doc §Wave 0 |
| archreview R2-03 (T11 + T12) — VT Good→Bad on a data-fed rig | ✅ PASSED 2026-08-07. The rig is no longer data-less — the Modbus fixture is reachable from inside it — so the VT was staged Good and tripped without a deployment (a register was flipped on the fixture, so the VT child survived and could hold a last value): 42 → 0x80020000 → 42, plus the P7 identical-redeploy spot-check (zero disturbance). ⚠️ Found: the Bad publish's "carrying the last-known value" is unobservable by any client — subscription and raw Read both return NULL. The actor is correct (new regression test pins it); the docs overstate what a client sees. |
docs/plans/2026-08-07-adminui-followups-and-live-gates.md §2–3 |
| archreview R2-10 — force breaker-OPEN live | ✅ PASSED 2026-08-08 — by FIXING the structural gap (feat/wrap-driver-init-in-resilience), the day after the 2026-08-07 run re-diagnosed it. IDriver.InitializeAsync now routes through the invoker as DriverCapability.Initialize (no retry — the actor's timer is the retry loop; breaker threshold 2, because at the 10 s reconnect cadence at most three attempts fit the 30 s sampling window and a Read-sized 5 could literally never open). Live: rtu-gate against dead 10.100.0.35:5021 opened its breaker on both centrals, the /hosts panel showed the red "BREAKER OPEN" chip, and a socat 5021→5020 forwarder recovered it — both breakers closed within 1 s, panel back to "All targets healthy." Control: healthy MAIN-modbus, zero breaker events. Companion fix: a respawn now Invalidates the instance's tracker snapshots with its pipelines, or a deploy mid-outage would strand a false OPEN chip forever. Caveats recorded: the UI is served by the active admin node only (Traefik /health/active 503s the standby — "both-replica chips" means both trackers, one UI), and the staleness-dim leg was not exercised. |
docs/plans/2026-08-07-adminui-followups-and-live-gates.md §7 |
| Driver-reconfigure-while-faulted Task 3 | ✅ PASSED 2026-08-07 (the block indeed no longer held — docker-dev runs DisableLogin). A driver faulted on a bad device config adopted a corrected config while faulted and connected, with the node's startedAt byte-identical before/after and RestartCount=0 — no restart, which is the whole point (pre-fix it retried the stale config forever). |
docs/plans/2026-08-07-adminui-followups-and-live-gates.md §5 |
Galaxy ScanStateProbeParityTests |
OPEN — licence-gated (one $WinPlatform on this box) |
docs/v2/Galaxy.ParityRig.md:180 |
| v2 GA exit criteria — FOCAS live-CNC wire smoke (#54), OPC UA CTT/compliance pass, Ignition 8.3 redundancy cutover | OPEN — manual/hardware/external-tool | docs/v2/v2-release-readiness.md:105-120 |
| mesh Phase 4 | ✅ PASSED 1281aebf |
CLAUDE.md said open — corrected, §7.2 |
| mesh Phase 5 | ✅ PASSED f134935f |
CLAUDE.md said pending — corrected, §7.2 |
| auto-down 1-vs-1 crash-the-oldest | ✅ PASSED — Phase 7 drill D4, c50ebcf7 |
CLAUDE.md said open — corrected, §7.2 |
Note on the 14 archreview deferred-live tasks across 8 plans: archreview/plans/STATUS.md:242-305
records a 2026-07-13 live pass closing several (R2-02, R2-07, R2-11, R2-04, R2-05-partial) and
2026-07-15 closures for R2-01/R2-08/R2-06 — but the .tasks.json files were never updated. Only
R2-03 and R2-10 have no closure record anywhere. (Both now closed with full records: R2-03
2026-08-07, R2-10 2026-08-08 — their .tasks.json files carry the closure notes.)
6. Plan bookkeeping — stale vs. live
59 of 78 docs/plans/*.tasks.json are 100 % complete. Of the remaining 19, most are stale
bookkeeping, not backlog.
6.1 STALE — work shipped, file never updated (~140 phantom "pending" tasks)
✅ Swept (
88ce8df0). 13 files closed — the 8 below plusmesh-phase4, the 4thstillpendingphase file, andhistorian-tcp-transportclosed as OBSOLETE. Each carries aclosureNotenaming the evidence. 11 archreview gates were also written back fromSTATUS.md; R2-03 and R2-10 were deliberately NOT closed —STATUS.md's own per-item detail contradicts its "every gate is GREEN" headline. See §9.
| File | Recorded | Reality |
|---|---|---|
2026-07-24-mtconnect-driver.md.tasks.json |
23 pending | Merged at master tip 90bdaa44, 5-leg live gate PASSED |
2026-07-24-mqtt-sparkplug-driver.md.tasks.json |
27 pending | All 27 done, both phases live-gated |
2026-07-24-sql-poll-driver.md.tasks.json |
22 pending | Merged 4ad54037 + follow-ups 28c28667 |
2026-07-24-modbus-rtu-driver.md.tasks.json |
11 pending | Merged 0f38f486 (#495), live gate PASSED |
2026-06-26-otopcua-historian-gateway-integration.md.tasks.json |
21 pending | Shipped as PR #423, live-validated |
2026-06-15/16-stillpending-phase-{0-1,2,3,4}.md.tasks.json |
12+9+10+8 pending | Shipped — audit §D cites 1e95856b, ada01e1a, fc8121cb, 3e609a2b, 70e6d3d2, c236263e, bd8fee61, 5e27b5f7, fcb38014 |
2026-07-22-per-cluster-mesh-program.md.tasks.json |
Phase 2 in_progress, 3–7 pending | Plan body :331-342 says program COMPLETE |
2026-06-12-historian-tcp-transport.md.tasks.json |
12 pending | OBSOLETE — targets the retired Wonderware sidecar |
6.2 GENUINELY LIVE
✅ Re-counted 2026-08-04 by parsing every
docs/plans/*.tasks.json, not by reading this table. The five rows below are confirmed unchanged, and the sweep found one file this section missed:2026-06-14-driver-reconfigure-while-faulted-plan.md.tasks.json(3 completed / 1 pending — the §5 live gate). Update 2026-08-07: the count is now 11, not 31 — the 19 AdminUI tasks closed by audit and the 1 reconfigure task closed by a passing live gate. Total open plan tasks across the tree:31 — 19 of them in the single AdminUI file. Every other.tasks.jsonis fully closed;2026-07-24-mesh-phase6carries one task markedresolved-no-flip, which is a recorded decision, not an open item.
| File | Open | Note |
|---|---|---|
2026-05-29-adminui-followups.md.tasks.json |
It was never backlog. The overlap audit this row demanded found all 19 tasks shipped, superseded by v3, or moot — no code written. CollectionEditor<TRow> + the OpcUaClient endpoint editor shipped in the plan's own shape; the per-driver editors ×6 arrived as v3's TagConfigEditorMap + DeviceFormMap; WS2/WS3 (resilience form, RoleMapper.Merge, DB LDAP→role, RoleGrants, FleetAdmin) all shipped; WS4's comment targets were deleted with their files. ⚠️ WS1's premise is dead, not merely superseded: driver-embedded tag lists are no longer the runtime source of truth in v3. |
|
2026-06-19-followups-batch.md.tasks.json |
4 pending + 1 partial | B4 F10b surgical DataType/IsArray writes and B5 alarm-severity SetSeverity are OPEN-by-choice, not built |
2026-06-26-otopcua-fixedtree-followups.md.tasks.json |
1 pending | Task 11 build + regression |
2026-05-26-akka-hosting-alignment-plan.md.tasks.json |
5 partial | F8/F9/F10/F13/F14 — oldest open items; likely superseded by v3, verify |
2026-05-28-adminui-driver-pages-plan.md.tasks.json |
1 partial | 10.4 manual smoke checklist |
2026-06-14-driver-reconfigure-while-faulted-plan.md.tasks.json |
Task 3 live /run verify PASSED — see §5. |
docs/plans/2026-07-23-mesh-phase4-…tasks.json Task 9 was the only deferred-flagged mesh task —
it has since landed (3a590a0c), so that file is now stale too.
6.3 Review-directory state
code-reviews/— 51 modules, zero Open findings. One textual "Left Open pending a decision" survives in a finding body (Configuration/findings.md:254, LDAP collation) whose status field reads Deferred — the only index inconsistency.code-reviews/coverage gap — 10 shipped source projects have never been reviewed:Driver.Calculation,Driver.Historian.Gateway,Driver.Mqtt(+.Browser,.Contracts),Driver.MTConnect(+.Contracts),Driver.Sql(+.Browser,.Contracts). Meanwhile three modules review the retired Wonderware backend. ✅ Re-verified 2026-08-04 against the directory listing — unchanged, both halves. The threeDriver.Historian.Wonderware*module directories are still present and still the only historian review coverage, while the gateway backend that actually ships has none. Worth noting which 10 these are: they are exactly the drivers added since the review sweep, i.e. the newest and least-exercised code in the tree carries the least review.archreview/—00-OVERALL.md:60-79carries an explicit "Carried open … no remediation branch targeted them" block. The largest coherent batch is the failure-visibility trio: 01/S-1 (AddressSpaceApplierswallows every sink failure, deploy reports Applied even when broken), 03/S4 (primary gate default-allow on unknown role), 06/S-1 (Galaxy optimistic write success). Update 2026-08-07 (truth sweep): the trio is mostly closed. 01/S-1 fixed (AddressSpaceApplier.cs:95-97→AddressSpaceApplyOutcome.FailedNodes); 03/S4 fixed (PrimaryGatePolicy.csdefault-deny on unknown role with a driver peer, live-proven R2-04 T15); 06/S-1 partial (fail-closed advise path +galaxy.writes.unconfirmedmeter inGatewayGalaxyDataWriter.cs; residual = gateway-side WriteComplete correlation, cross-repo).stillpending.mddoes not exist — the backlog isdocs/plans/2026-06-18-stillpending-backlog-audit.md.
7. Documentation corrections
7.1 Applied in this pass
| File | Was | Now |
|---|---|---|
CLAUDE.md §Change Detection (:156) |
"The server's DriverHost consumes the signal and rebuilds the address space" |
⚠️ nothing consumes it; names DriverHostActor.cs:986, #518/#507, and the four affected drivers |
CLAUDE.md §Redundancy (:272) |
auto-down "live gate is still open … docker-dev is a single six-node mesh" | gate CLOSED by Phase 7 drill D4 (c50ebcf7); the six-node-mesh claim also contradicted CLAUDE.md's own Phase 6 paragraph |
CLAUDE.md §Telemetry (:383) |
Phase 5 "code-complete on feat/mesh-phase5, live gate pending" |
merged 35552a96; live gate PASSED f134935f |
CLAUDE.md §Phase 4 (:493, :502-503) |
ScriptedAlarmState "dropping it is a deferred follow-up, tracked as Task 9"; "Task 9 and the live gate (Task 10) are still open" |
table dropped (3a590a0c, migration 20260723183050_DropScriptedAlarmStateTable); live gate PASSED 1281aebf |
docs/plans/2026-07-24-driver-expansion-tracking.md |
Modbus RTU "pending merge"; SQL poll "📝 Plan ready (22 tasks)"; an "Executing a plan" table instructing you to rebuild both | both marked ✅ Done with merge SHAs; the two shipped rows struck from the command table; Wave 1/2 headings and §Next actions corrected |
docs/drivers/README.md |
DriverTypeRegistry "registered at startup"; "namespace kinds (Equipment + SystemPlatform)"; no Sql/Calculation rows; "Modbus TCP" only |
registry marked vestigial + tier truth; namespace line corrected to Raw+UNS; Sql + Calculation rows added; Modbus row covers RTU-over-TCP |
docs/drivers/TwinCAT.md (:95, :99-103, :151) |
"so the address space is rebuilt" / "so Core rebuilds the address space" | raises-but-unconsumed caveat, mirroring the wording Mqtt.md/MTConnect.md already use correctly |
docs/drivers/Galaxy.md (:73) |
IRediscoverable row with no caveat |
same caveat added |
docs/v2/Runtime.md (:106) |
"named-pipe IPC to the Wonderware historian sidecar + SqliteStoreAndForwardSink" |
gRPC to HistorianGateway + LocalDbStoreAndForwardSink |
docs/ReadWriteOperations.md (:13, :21 + banner) |
"ACL enforcement (WriteAuthzPolicy + AuthorizationGate) runs before the source branch"; "A denied read never hits the driver" |
Both struck through and corrected; banner states plainly that no per-node ACL gate exists on any operation and that GenericDriverNodeManager is test scaffolding. This was the highest-risk doc error found. |
docs/IncrementalSync.md (banner) |
whole "Rebuild flow" + generation-publish path presented as current | Banner: GenericDriverNodeManager is non-production, rediscovery has no consumer, sp_PublishGeneration/sp_ComputeGenerationDiff RAISERROR, DraftRevisionToken gone; names the one live path (deploy artifact) |
docs/AddressSpace.md (banner) |
"single custom namespace"; Phase7Applier/Phase7Composer/GalaxyTagPlan; SystemPlatform |
Banner: two namespaces w/ V3NodeIds, the AddressSpace* rename (40e8a23e), AddressSpaceComposition as the result type, SystemPlatform retired |
docs/v2/phase-7-status.md, v2-release-readiness.md, redundancy-interop-playbook.md, AdminUI-rebuild-plan.md (banners) |
present-tense claims about types that no longer exist | Dated "⚠️ Historical" banners naming the specific dead types. v2-release-readiness.md's banner also flags that its :41 "ACL enforcement Closed" row is false, while noting its unchecked GA exit criteria are still live. (docs/StatusDashboard.md already self-declares Superseded — left alone.) |
docs/OpcUaServer.md (:14, :51), docs/README.md (:65), docs/drivers/OpcUaClient-Test-Fixture.md (:127) |
WriteAlarmState; LdapUserAuthenticator ×2; RedundancyCoordinator |
WriteAlarmCondition; LdapOpcUaUserAuthenticator; RedundancyStateActor + IRedundancyRoleView |
docs/Historian.md |
no mention of #491 or the provisioning gap | ⚠️ block added: continuous value capture is code-complete but unproven in production, with the wiring chain; plus the EnsureTags-skips-existing-tags gap |
7.2 Recorded, NOT applied — needs a decision or a rewrite, not a line edit
✅ Priorities 1–2 are now done (
53ede679):docs/ReadWriteOperations.mdwas rewritten, not bannered — and it turned out to be fiction well beyond the ACL claims (OnReadValuehas zero occurrences insrc/; reads never reach a driver at all).docs/security.md, which this table did not list, was the highest-risk of the three. Priority 3 and the rest remain open — thePhase7*→AddressSpace*rename,docs/v2/driver-specs.mdcoverage, the missingdocs/drivers/Sql.md/Calculation.md, and theNoOpSecretReplicatorinvestigation.docs/v2/driver-stability.mdmoved to §3.3 / #522.✅ Update 2026-07-30: the
Phase7*→AddressSpace*rename is done (four live docs; historical bannered files deliberately untouched), and the two missing driver docs are written. Still open:docs/v2/driver-specs.mdcoverage, theNoOpSecretReplicatorinvestigation, and the two owed rewrites (IncrementalSync.md,AddressSpace.md) that were bannered rather than rewritten.
The three highest-priority items in this list were bannered rather than rewritten in this pass (cheap, stops the misleading, preserves the record) — the underlying rewrite is still owed. They now appear in §7.1 as well.
| Priority | File | Problem |
|---|---|---|
| 1 (security-relevant) | docs/ReadWriteOperations.md:13,21 |
Bannered + struck through. Claimed ACL enforcement via WriteAuthzPolicy + AuthorizationGate + NodeScopeResolver and that "a denied read never hits the driver". All four names have zero hits in src/; §3.1 shows there is no read-path ACL gate at all. Still owed: a proper §-rewrite against the real node-manager write gate. Same false claim at docs/v2/v2-release-readiness.md:41 (bannered). |
| 2 | docs/IncrementalSync.md |
Bannered. Entire "Rebuild flow" (:37-47) built on non-production GenericDriverNodeManager; :26-34 cites sp_PublishGeneration/sp_ComputeGenerationDiff, both retired stubs that RAISERROR (20260715230637_V3Initial.StoredProcedures.cs:194); :31 cites DraftRevisionToken (0 hits); :49-51 describes a ScopeHint no consumer reads. Still owed: rewrite around the deploy-artifact path, or archive to docs/v1/. |
| 2 | docs/AddressSpace.md |
Bannered. v2-era throughout: :7,42 claim a single namespace (v3 has two); :7,48,70 cite Phase7Applier + GalaxyTagPlan + a nonexistent file path; :62-64 repeats the rediscovery claim. Still owed: rewrite §"Root folder" + §"NodeId scheme" against V3NodeIds / AddressSpaceRealm. |
| 3 | 6 docs, ~20 citations | Phase7* → AddressSpace* rename (40e8a23e). Mostly mechanical, except three that are not renames and need the real member identified first: Phase7CompositionResult → AddressSpaceComposition (AddressSpaceComposer.cs:13, verified for this report); Phase7Composer.ExtractTagFullName → nearest live seam is ScriptTagCatalog.ExtractFullNameFromTagConfig; Phase7EngineComposer.RouteToHistorianAsync is simply gone — the real seam is HistorianAdapterActor → IAlarmHistorianSink. |
| 3 | docs/v2/driver-specs.md |
Covers 8 of 12 drivers (missing MQTT, MTConnect, Sql, Calculation, and the Modbus Transport selector) while docs/drivers/README.md calls it authoritative "for every driver". Either add four sections or downgrade the claim. |
| 3 | docs/v2/driver-stability.md:47-54 |
Puts Galaxy and FOCAS in Tier C; docs/drivers/README.md says Tier A for both. Moot at runtime — see §3.3 — but the two docs contradict each other. |
docs/drivers/Sql.md, docs/drivers/Calculation.md |
||
| — | docs/operations/2026-07-16-secrets-clustered-master-key.md:38 |
NoOpSecretReplicator exists only in a test. Investigate before editing — the sentence makes a security-relevant claim ("no built-in cross-node replication today"), so it needs the real behaviour identified, not a rename. Left untouched deliberately. |
| — | docs/v2/driver-specs.md §2 |
docs/drivers/Modbus.md:10-11 points readers here for the Modbus config shape, and this file omits the Transport selector. Folded into the driver-specs item above. |
8. Recommended sequencing
✅ All six executed, merged as
914d70bf. Each item below is struck through with its outcome; the full account is §9. Two items the sequencing did not anticipate were also completed (Sql/FOCAS in-place re-parse, tag-set drift detection) — the latter is now slated for removal under #523.
§3.1 ACL enforcement — decide: wire✅ Done — decided make non-enforcement explicit; wire-up tracked as Gitea #520. See §9. (IPermissionEvaluatorintoOtOpcUaNodeManager, or remove the authoring UI and say plainly that ACLs are not enforced. Either way fixdocs/ReadWriteOperations.mdfirst; it is the one that could mislead a security review.docs/ReadWriteOperations.mdwas not the sharpest one —docs/security.mdwas.) Update 2026-08-07 (truth sweep): the wire-up itself has since shipped — #520 CLOSED 2026-08-01 through stage 7 (mergesfbe7403c,3a6b2a1d,1ccc7400,d4389f57,3796c0bf); enforcement opt-in viaSecurity:Acl:Enabled(defaultfalse). See §3.1's banner.#518 + #507 together — neither fix is observable alone.✅ Done. The framing was right that they had to be handled together, but wrong about the resolution: #507 was not revivable, so it was deleted rather than fixed. See §9.#516 — silent config discard on 5 drivers; then re-scope #489, which it partly subsumes.✅ Done. See §9. #489 is still open and should now be re-scoped.G-4 — extend the existing picker-parity test to✅ Done, together with G-1, G-2, G-3, G-5 and G-6. See §9.DriverConfigModal+DeviceModal; it would have caught G-1 and G-2 for free, and this class has now recurred twice.Bookkeeping sweep — mark the 8 stale✅ Done. See §9..tasks.jsonfiles complete so the 19-task AdminUI plan (§6.2) is visible as the real backlog it is.§3.3 tier truth — either pass real tiers at factory registration or delete the Tier-C machinery; today it is documented, authorable and dormant.✅ Documented; the keep-or-delete code decision is Gitea #522. See §9.
9. Execution log
Remediation of §8. MERGED to master and pushed 2026-07-28, merge 914d70bf (branch
feat/deferment-remediation, 8 commits, merged --no-ff so each stage stays individually reviewable and
revertable). Status was updated in the same commit as the work, so this register never disagreed with
the tree.
A second round merged 2026-07-30 as 2a0461a1 (branch feat/remove-periodic-rebrowse, 3 commits,
also --no-ff) carrying the items §8 did not cover.
| Round-2 item | Status | Commit |
|---|---|---|
| #523 remove the periodic re-browse | ✅ Done | 5fff5973 |
13 stale EquipmentTagsDarkBatch4 skips |
✅ Done — 6 revived, 3 folded, 4 deleted | 4624141a |
| G-7 deploy-time TagConfig gate | ◐ Narrowed + guarded — MQTT wired; 4 drivers still uncovered | 4624141a |
| 3 silently-broken OpcUaClient integration tests | ✅ Fixed — found by the full-suite run, not by the register | 4624141a |
§7.2 Phase7* → AddressSpace* rename |
✅ Done — 4 live docs | 4624141a |
§7.2 missing Sql.md / Calculation.md |
✅ Done | f3cd685d |
A third round merged 2026-07-30 as abda6f9e (branch fix/521-522-host-status-and-tiers, 3 commits,
--no-ff) closing the two keep-or-delete decisions §8 deliberately left to the user.
| Round-3 item | Status | Commit |
|---|---|---|
#521 IHostConnectivityProbe |
✅ Done — resolved differently from how it was filed. Neither "build the publisher" nor "delete": the publisher as designed was unbuildable after Phase 4, so the capability was kept and the transport changed to the Phase 5 telemetry stream. Table dropped. | 30d0697c |
| #522 driver stability tiers | ✅ Done — deleted. The inertness was broader than either the issue or this register said: nothing constructed MemoryTracking either, so "pass real tiers" was never a flag flip. |
cbb88229 |
| Live gate on docker-dev | ✅ Passed, one fix (1 hosts → 1 host) |
ce589569 |
#524 DriverInstanceResilienceStatus |
✅ Done — deleted. Sibling of #521, dead for the same Phase-4 reason. | d979ac69 |
#525 IDriver memory members |
⏳ OPEN — recommendation withdrawn mid-execution. See below. | — |
⚠️ #525 is a worked example of the register's own recurring failure mode, committed by me. I recommended
deleting IDriver.GetMemoryFootprint/FlushOptionalCachesAsync on the stated evidence that "1 of 12
actually frees memory". That number came from grepping for two specific cache-clear calls and treating
their absence elsewhere as proof of absence. The real inventory: 8 of 12 flushes are no-ops, 3 free real
memory (AbCip's UDT template cache, Calculation's compiled scripts, MTConnect's cached probe model —
which is a designed path with compare-and-swap discipline and tests asserting the footprint drops), and 1
is cosmetic. The sweep had already edited 12 drivers, IDriver and ~15 test files; it was reverted
rather than completed on a justification that no longer held.
What survives of the argument is narrower: GetMemoryFootprint returns 0 in 7 of 12, its computed
constants were invented and never validated against real memory because nothing ever consumed them, and
the two halves are coherent in exactly one driver (MTConnect) — AbCip and Calculation free real memory
while reporting footprint 0; TwinCAT, Galaxy and Mqtt report footprints behind no-op flushes.
The lesson, which is the same one §6 already records about this file: a grep for the shapes you expect is not an inventory. Enumerate the whole set and read each member before drawing a count — especially when the count is the thing your recommendation rests on.
Both closures produced a residual that was filed rather than folded in — a second dead table
(#524 DriverInstanceResilienceStatus) and two now-consumerless IDriver members (#525). Neither was
in scope; both would have widened a schema change or a 12-driver sweep past what was asked.
Three things this round got right by not trusting the register:
- §3.2 recorded that
DriverHostStatuswas "deliberately re-created in the v3 initial migration, so deleting on inference would be wrong." Checking Phase 4 showed the publisher it was waiting for cannot be written at all — a driver-only node has no ConfigDb. "Deliberately re-created" meant carried forward mechanically. - §3.3 (and #522) said the Tier-C protections were dormant, implying Tier A/B ones ran. Nothing constructed the trackers at all.
- The live gate treated an ambiguous observation as ambiguous: site-a showed
—for host status, which is what version skew and a broken cross-mesh mapper both produce. Rebuilding site-a distinguished them rather than assuming the benign reading.
⚠️ This file was destroyed and restored during round 2 — see the 2026-07-30 entry at the end of §9. It is the second time in two rounds that the register's own bookkeeping step damaged the register.
⚠️ The commit column was wrong until 2026-07-28 and is now corrected. Each stage's SHA was captured with
git rev-parse HEADand then written into this file by amending that same commit — which changes the SHA. Every value recorded was therefore the pre-amend one: a dangling object reachable only through the reflog, on no branch, and due to vanish at the nextgc. The register cited commits that effectively did not exist. The SHAs below are verified againstgit log e08855fb..914d70bf.
| §8 item | Status | Commit |
|---|---|---|
| 1. ACL enforcement decision | ✅ Done — decided make non-enforcement explicit; Gitea #520 tracks the wire-up | 53ede679 |
| 2. #518 + #507 | ✅ Done — IRediscoverable consumed as a re-browse prompt; #507's injection path deleted; IHostConnectivityProbe half split to Gitea #521 |
09a401b8, adce27e7 |
| 3. #516 config discard | ✅ Done — seam respawn + in-place re-parse; completed for all 12 drivers by the follow-up below | d32d89c3, 5184a2e1 |
| 4. G-4 dispatch-map parity | ✅ Done — G-1…G-6 all closed, live-verified on docker-dev | 6a01358b |
| 5. Bookkeeping sweep | ✅ Done — 13 plan files closed, 11 archreview gates written back | 88ce8df0 |
| 6. Tier truth | ✅ Done — docs reconciled; keep-or-delete is Gitea #522 | 88ce8df0 |
| follow-up A | ✅ Done — Sql/FOCAS in-place re-parse made atomic | 5184a2e1 |
| follow-up B | ⛔ Shipped, then removed by decision — tag-set drift detection; removal landed, Gitea #523 | e77c8a35, removed below |
2026-07-27 — §8.1 ACL non-enforcement made explicit
Decision: do not wire the evaluator, do not delete it — state plainly that it does not run, and track the wire-up as Gitea #520.
Applied:
docs/security.md— theNodeScope/PermissionTrie/"Dispatch gate" block now leads with a What is enforced today table (the three real checks) before the design material, which is labelled Designed but not wired.docs/ReadWriteOperations.md— rewritten, not bannered.docs/v2/acl-design.md— ⚠️ NEVER WIRED banner.docs/v2/v2-release-readiness.md§"Security — Phase 6.2 dispatch wiring" — the CLOSED claim marked as not holding.ClusterAcls.razor+AclEdit.razor— warning alerts stating rules are stored and deployed but never evaluated.
Four things this pass found that §7 and the original audit missed — all worse than what was already recorded:
docs/security.mdwas the highest-risk doc, notReadWriteOperations.md.:115claimed an anonymous session is "default-denie[d] any node a session has no ACL grant for". The opposite is true: an anonymous session can Browse, Read, Subscribe and HistoryRead the entire address space. It is refused only writes and alarm acks — and only because it carries no roles.- Three of the five documented data-plane role strings do nothing.
OpcUaDataPlaneRolesdeclares exactlyWriteOperateandAlarmAck.ReadOnly,WriteTuneandWriteConfigureare compared against nowhere insrc/, so mapping a group toWriteTunegrants nothing and mapping one toReadOnlyrestricts nothing. The doc called all five "exact, case-insensitive, and code-true". ReadWriteOperations.mdwas fiction well beyond the ACL claims.OnReadValuehas zero occurrences insrc/— the whole documented read path did not exist. Reads never reach a driver at all: the node manager is push-model and the SDK serves a client Read from the cached pushed value.WriteAuthzPolicy,_sourceByFullRef,_writeIdempotentByFullRefandIRoleBearerare likewise zero-hit, andCapabilityInvokeris not referenced by theOpcUaServerproject at all.v2-release-readiness.mdclaimed a whole enforcement layer shipped. Beyond the:41row §7.1 already flagged,:46-50describeFilterBrowseReferences,GateCallMethodRequests,MapCallOperation,AuthorizationBootstrapandNode:Authorization:*config keys as Closed or Partial. None of them exist. Whatever landed on the v2 branch did not survive into the shipped tree.
Also recorded in #520 and not previously known: every existing evaluator unit test runs in
PermissionTrieBuilder's no-scopePaths deterministic test mode, so the production hierarchy path
is effectively untested; and NodeAcl.ScopeId has no FK or existence check, so scope ids dangle
silently.
2026-07-27 — §8.2 rediscovery as a signal; injection deleted
Decision: signal, not mutation.
DriverInstanceActor now consumes IRediscoverable.OnRediscoveryNeeded (attach in PreStart, detach
in PostStop) and carries it on the driver-health snapshot to /hosts as a re-browse chip. It is
advisory — the served address space is unchanged, because v3 authors raw tags through /raw
browse-commit and a runtime graft would materialise nodes nobody approved.
#507's injection path was deleted, not fixed. §2 recorded it as a "deferred (deliberate guard)".
That was too generous: its two inputs — EquipmentNode.DriverInstanceId and EquipmentTags — are
structurally empty in v3, so removing the guard would have changed a log line and injected nothing.
Deleted with it: HandleDiscoveredNodes, PartitionDiscoveredByDeviceHost,
ApplyDiscoveredPlansForDriver, the redeploy re-inject tail, DiscoveredNodeMapper,
AddressSpaceApplier.MaterialiseDiscoveredNodes, OpcUaPublishActor.MaterialiseDiscoveredNodes, the
connect-time discovery loop, and 4 files' worth of tests. ITagDiscovery stays — the /raw browse
picker drives it through Commons/Browsing/DiscoveryDriverBrowser, which never went through the actor.
§4.4's "18 DiscoveryInjectionDormantV3 — Real, blocked on #507" was wrong. They were v2
characterization tests asserting an equipment-rooted graft (EquipmentRootNodeId == "EQ-1") that v3
cannot produce. They could never have unskipped as written; they are deleted. Skipped tests in
Runtime.Tests went 31 → 13.
The planned drift detector was deliberately NOT built. The plan proposed diffing each connect-time
discovery pass against the authored raw tags. Reading the drivers killed it: Modbus, S7, MQTT,
AbLegacy and Sql all echo authored config from DiscoverAsync rather than browsing the device, so
the diff is permanently empty for them. It would have been another plausible-looking inert seam —
precisely the class this register exists to remove. That also removed the last consumer of the
connect-time loop, which is why the loop went too: it was browsing real devices up to ~15× per connect
and dropping the result.
Two traps worth keeping:
PublishHealthSnapshotdedups on a health fingerprint, and a rediscovery raise changes none of the four fields it hashed. The timestamp had to join the tuple or the dedup swallows the signal. Verified by reverting the one line — 3 of the 5 new tests go red.- The shared
StubDriver.GetHealth()returnsDateTime.UtcNow, so its fingerprint differs every call and the dedup never engages. A dedup test built on it would pass whether or not the fix is present; the new tests use a stub with stable health.
IHostConnectivityProbe was not resolved — it is a keep-or-delete decision, and the
DriverHostStatus table was re-created deliberately in the v3 initial migration, so deleting on
inference would be wrong. Split to Gitea #521 with both options costed.
2026-07-27 — §8.5 bookkeeping + §8.6 tier truth
13 plan files closed. The 8 the register named, plus mesh-phase4 (Task 9 landed 3a590a0c), the
4th stillpending phase file, and historian-tcp-transport closed as OBSOLETE (it targets the
retired Wonderware sidecar; there is no Wonderware backend in the tree). Each carries a closureNote
naming the evidence, so the next reader can check rather than trust.
11 archreview live gates written back from STATUS.md, which had recorded them passed since
2026-07-13/15 without ever updating the .tasks.json files: R2-01 #11, R2-02 #15/#18, R2-05 T15,
R2-06 T12, R2-07 T5/T6/T12/T14, R2-11 T22/T24.
R2-03 and R2-10 were NOT closed — and reading STATUS.md rather than trusting its own headline
("Every Round-2 live gate is now GREEN") is what kept that honest. Its per-item detail says R2-03 is
"live-blocked on this data-less rig" and R2-10 verified the pipeline but "breaker-OPEN state not
forced". Both now carry an openNote recording the blocker: R2-03 needs a reachable driver fixture
feeding a VT; R2-10 needs a rapid idempotent write to a dead endpoint, because R2-09's
ConnectionBackoff throttles retries so failures never accumulate fast enough to open the Polly breaker.
Net effect (the point of the sweep): ~140 phantom pending tasks are gone, so the genuinely
unexecuted 19-task AdminUI follow-ups plan is now the largest open item in docs/plans/ rather than
being buried. The remaining open plans are 8, and one of those (mesh-phase6 Task 6) is a documented
resolved-no-flip decision rather than work.
Tier truth: docs/v2/driver-stability.md now states plainly that its tier table is aspirational —
every driver runs Tier A, and MemoryRecycle / ScheduledRecycleScheduler have never engaged. It also
corrects a second stale claim the register did not flag: the separate-Windows-service hosting it
describes for Tier C no longer exists (Galaxy went to the mxaccessgw sidecar in PR 7.2; FOCAS went
in-process when its managed wire client landed). No runtime change — turning recycle on for two live
drivers deserves its own live gate, not a docs-pass side effect. Tracked as Gitea #522.
2026-07-28 — the two things §8.3 deliberately did NOT build (1 of 2)
Sql and FOCAS now re-parse in place too. The first pass excluded them for a real reason — each derives
more than options from config, so adopting new options alone would run a new tag set against an old
connection/backend, and a half-applied change is worse than a discarded one because it looks like it
worked. Rather than accept that, the blocker itself is fixed: each factory now exposes a ParseBinding
that returns every config-derived dependency as one value, and the driver adopts them atomically.
| Driver | What one parse now yields | Adopted by |
|---|---|---|
| Sql | options + ISqlDialect + resolved connection string |
ApplyBinding, which also rebuilds the provider factory, Endpoint and the SqlPollReader that captures all three |
| FOCAS | options + the IFocasClientFactory the Backend key selects |
one assignment pair in InitializeAsync |
Details worth keeping:
- Sql adopts BEFORE
BuildTagTable, so the tag table and the connection it will be polled over always come from the same revision. - A test-injected
DbProviderFactorysurvives a rebind (_explicitFactory), so a re-derived dialect cannot silently displace what a test passed in. - Re-resolving the connection string on reinit is a side benefit: a rotated credential is picked up without a process restart.
- A driver constructed directly gets no rebinder and keeps its constructor-supplied binding — every
existing
"{}"-passing lifecycle test is unaffected by construction, not by luck.
The tests pin ATOMICITY, not merely "a re-parse happened" — a test that only checked options would have passed against the broken version. Verified by simulating the half-fix (adopt options, skip the backend): 2 of the 3 FOCAS tests go red. Reverting Sql's rebind turns its connection-string test red. Sql also asserts that a reinit which cannot resolve its new connection leaves the previous binding whole, rather than half-adopting.
All 12 drivers now honour a changed config in place; DriverSpawnPlanner's stop + respawn remains the outer
guarantee. Sql.Tests 226 / FOCAS.Tests 275 pass.
2026-07-28 — the two things §8.3 deliberately did NOT build (2 of 2)
⛔ REMOVED — the periodic re-browse is gone from the tree (owner decision, Gitea #523; removal recorded in the next entry). It shipped in
master(e77c8a35, merged914d70bf) and this entry stays as the record of what was built and why. The objection is the one this entry does not weigh: the check is recurring, unconfigurable (the interval is a constructor parameter with no appsettings key) and never live-gated outbound traffic to real PLCs, CNCs and MTConnect Agents. Frequency of an unsolicited device browse is an operational decision, and the design treated it as an implementation detail.Consequence to carry forward: AbCip and FOCAS browse a live backend but implement no
IRediscoverable, so after removal they have no change signal at all — a PLC re-download is invisible until someone re-browses by hand. TwinCAT and MTConnect keep their native event-driven signals and lose only redundant polling. TheIRediscoverableconsumption itself (09a401b8) is not affected: the driver tells us, we do not poll, and it costs nothing when nothing changes. If AbCip/FOCAS coverage matters later, the shape to reach for is event-driven — or a check that runs only when something else already indicates change (a reconnect, a deploy), not a wall-clock timer.
The discovery-drift detector is built, and gated. The original objection stands and is now encoded
rather than used as a reason not to build: Modbus, S7, MQTT, AbLegacy and Sql echo authored config from
DiscoverAsync, so a diff for them is a tautology. The missing piece was a discriminator — and the
codebase already had one. ITagDiscovery.SupportsOnlineDiscovery is documented as "enumerates the tag set
from the live backend rather than replaying pre-declared/authored tags", and it separates the fleet
cleanly: FOCAS, TwinCAT, MTConnect, AbCip true; the five config-echo drivers explicitly false.
The check runs only for a driver that is SupportsOnlineDiscovery and reports the new
AuthoredDiscoveryRefs (nullable, default null = opt out — an empty collection legitimately means
"nothing authored, everything discovered is new", and conflating the two would report total drift for a
driver that simply never opted in).
Where the value is: AbCip and FOCAS browse a live backend but implement no IRediscoverable, so
before this they had no change signal at all — a periodic compare is the only way to notice a PLC
re-download. TwinCAT and MTConnect already have native signals (symbol-version, agent instanceId); drift
detection is complementary there.
A finding that changed the design. FOCAS, TwinCAT and AbCip all re-emit their authored tags into the
same DiscoverAsync stream as the device-derived ones, so the browse picker can show an operator their
existing tags. That means discovered ⊇ authored always, and a vanished tag can never appear missing
— one whole direction is structurally undetectable for three of the four. Shipping a Vanished list that
is permanently empty for them would have been exactly the half-inert seam this register exists to remove.
So the driver declares DiscoveryStreamIncludesAuthoredTags, the detector does not compute the
undetectable half, and the operator message says "missing-tag detection unavailable for this driver"
rather than letting the absence of a missing-tag clause read as reassurance. MTConnect is the only
driver where both directions work — its stream is purely probe-model-derived.
Behavioural details: a failed browse is not drift (an unreachable device would otherwise report every authored tag as vanished — the health surface already covers unreachability); a truncated capture is skipped for the same reason; an unchanged drift is reported once rather than re-stamping its timestamp every interval; drift that resolves clears the prompt so the next one is not deduped against a stale signature. Interval defaults to 5 minutes — it browses a real device, and a tag set changing is an engineering event, not a runtime one.
The comparison is a pure, separately-tested type (TagSetDriftDetector) rather than actor-inline logic.
14 new tests. The gate was verified load-bearing by deleting the SupportsOnlineDiscovery half — the
tautology-driver test goes red, and it asserts discovery was never invoked rather than merely "no
prompt raised", which would have passed for the wrong reason if the timer simply never fired.
2026-07-28 — #523: the periodic re-browse removed
The feature described in the entry above is gone from the tree. Removed:
| Removed | Where |
|---|---|
TagSetDrift + TagSetDriftDetector |
Runtime/Drivers/TagSetDrift.cs (file deleted) |
The drift timer, DriftCheckTick, DefaultDriftCheckInterval, the driftCheckInterval Props/ctor parameter, QualifiesForDriftCheck, Start/StopDriftCheck, HandleDriftCheckAsync, CollectLeafRefs, _lastDriftSignature |
DriverInstanceActor |
ITagDiscovery.AuthoredDiscoveryRefs + .DiscoveryStreamIncludesAuthoredTags, and their four implementations |
Core.Abstractions; FOCAS, TwinCAT, MTConnect, AbCip |
DriverInstanceActorDriftCheckTests (6), TagSetDriftDetectorTests (8) |
Runtime.Tests |
What survives, deliberately. ITagDiscovery.SupportsOnlineDiscovery stays — it predates drift
detection and is what the universal browse picker dispatches on. The IRediscoverable consumption
(09a401b8) is untouched: the driver tells us, we do not poll, and it costs nothing when nothing
changes. The /hosts re-browse chip stays and is now fed by that one source.
The consequence, stated plainly rather than buried. AbCip and FOCAS now have no tag-change signal
at all. Both browse a live backend, neither implements IRediscoverable, and the periodic compare was
the only thing that would have noticed a PLC re-download or a CNC option install. That is the accepted
trade, not an oversight — it is recorded in CLAUDE.md §Change Detection so the next reader does not
have to rediscover it, together with the shape to reach for if the coverage is wanted back
(event-driven, or triggered by a reconnect/deploy, not a wall-clock timer).
Why the earlier entry's reasoning did not save it. That entry defends the design — the gate is real, the tautology drivers are correctly excluded, the undetectable direction is declared rather than faked. All of that is true and none of it is the objection. The objection is to the feature existing at all in that shape: it browsed real plant equipment on a recurring timer, at a frequency nobody could configure, and that behaviour was never once observed against real hardware. A well-built mechanism for something that should not run is still something that should not run.
Build clean; Runtime.Tests 476 passed / 13 skipped (unchanged skip set — the stale
EquipmentTagsDarkBatch4 group), FOCAS 275, TwinCAT 192, MTConnect 491, AbCip 342,
Core.Abstractions 266, all green.
2026-07-28 — three silently-broken OpcUaClient integration tests (found by the full-suite run)
Not a register item — found because the full-solution run for the work above showed three failing
suites where §9's 2026-07-27 entry had recorded two. Driver.OpcUaClient.IntegrationTests was failing 3
of 4.
It reproduced identically on clean master (verified in a throwaway worktree), so it was not caused
by this work — but it was also not what it first looked like. The chain of wrong guesses is worth
recording, because each one would have closed the investigation early:
- "The fixture is down." —
otopcua-opc-plcwasUp 12 days (unhealthy). Restarted it, waited for healthy. Still 3/4 failing. - "The simulator's node set drifted." — the tests expect
ns=3;s=StepUp. Browsed the live server: all three nodes present at exactly those ids. Readns=3;s=StepUpthrough Client.CLI against the same endpoint:Good, value 1379. - "So the driver has a read defect." — the status code was
2150825984, which I first decoded by hand asBadAttributeIdInvalidand started hunting a wrongAttributeId. The decode was wrong (0x80330000, not0x80350000) — it isBadNodeIdInvalid, and grep found that exact constant on the driver's own local fault path, reached without any wire request.
The actual cause: v3 made the driver resolve every reference through its authored RawTags table
(RawPath → TagConfig.nodeId → live NodeId re-bound against the session's namespace table). A bare
ns=3;s=StepUp is no longer a reference the driver accepts. The smoke tests still passed bare node ids
and constructed the driver with an empty RawTags, so all three failed locally at the resolver — they
had been testing the unresolved-reference guard, against a perfectly healthy simulator.
Fixed by seeding OpcPlcProfile.RawTags with the four nodes in the same {"nodeId": …} TagConfig shape
the deploy artifact delivers, and addressing them by RawPath. 4/4 pass.
Two things this says about the register itself: the 2026-07-27 "only pre-existing environment failures remain" note was measured against an incomplete baseline (this suite was already broken and simply not enumerated); and fixture-gated integration suites rot invisibly — a driver contract can change under them and nothing on the local box notices, because the suite is expected to be red-or-skipped depending on whether a remote container happens to be up.
2026-07-28 — §7.2 priority 3: the Phase7* → AddressSpace* rename
Applied across the four live docs (VirtualTags.md, ScriptedAlarms.md, ScriptEditor.md,
v2/Architecture-v2.md). The already-bannered historical files (v2/phase-7-status.md,
v2/implementation/*) were deliberately left alone — they are records of what existed at the time,
and renaming inside a historical record would falsify it.
§7.2 was right that three of these are not renames, and each was resolved to the real member:
| Cited | Reality |
|---|---|
Phase7CompositionResult |
→ AddressSpaceComposition (and it now also carries the raw subtree, so the doc text was widened, not just renamed) |
Phase7Composer.ExtractTagFullName |
→ ScriptTagCatalog.ExtractFullNameFromTagConfig |
Phase7EngineComposer.RouteToHistorianAsync |
Gone, not renamed — the routing moved into HistorianAdapterActor → the registered IAlarmHistorianSink. Called out inline so the next reader does not go looking for a renamed symbol. |
Found en route — the banner pass missed three files. GenericDriverNodeManager is test scaffolding
(§3.4, its own source says "zero production references"), and the earlier remediation bannered
AddressSpace.md and IncrementalSync.md for it. But VirtualTags.md, OpcUaServer.md and
ScriptedAlarms.md all still presented it as the production dispatch path — VirtualTags.md:3 even
built its opening explanation of driver-vs-virtual dispatch on it. All three now carry the same
correction naming the real chain (OpcUaPublishActor → SdkAddressSpaceSink → OtOpcUaNodeManager, two
namespaces). Banners, not rewrites — the underlying rewrite stays owed, consistent with how §7.2 treats
the other two.
2026-07-28 — G-7, and what the audit missed about it
The register called this "pre-existing (OpcUaClient + Galaxy absent too); no new driver was added" and ranked it last. Reading both maps side by side makes it sharper than that:
- The AdminUI's
TagConfigValidatorcovers 11 of 12 driver types (all but Galaxy). - The deploy-time
EquipmentTagConfigInspectorcovers 6.
So the gate that runs at authoring is stronger than the gate that runs at deploy — and the deploy gate is the only one config sees when it arrives by CSV import or API rather than through the modal. That is the wrong way round.
MQTT was a plain hole: MqttTagDefinitionFactory.Inspect has existed since the driver merged and
nothing ever called it. Now wired. The inspector's own doc-comment also claimed "unmapped drivers
(Galaxy, OpcUaClient) are skipped exactly as in the AdminUI validator" — untrue, OpcUaClient is mapped
there; corrected.
A reflection guard replaces the hand-maintained list, same lesson as G-4: the existing
EquipmentTagConfigInspectorTests enumerates driver-type strings by hand, so it guards renames but can
never notice a gap — a newly-inspectable driver simply never appears in it.
⚠️ The first version of that guard was hollow, and only the falsification step caught it. It
discovered candidates via Assembly.GetReferencedAssemblies(), which is circular: the C# compiler
elides a reference nothing in the IL uses, so removing MQTT from the map also removed its Contracts
assembly from ControlPlane's manifest, and the sweep stopped looking for exactly the driver that had just
gone missing. It passed green with the bug reintroduced. Rewritten to scan the output directory
(MSBuild copies project-referenced assemblies regardless of IL usage) — re-falsified, and it now fails
naming MqttTagDefinitionFactory. It also carries a positive control asserting discovery found more than
one factory, since an empty expected-set is satisfied by an empty map.
Residual, deliberately not papered over. Sql, MTConnect, Calculation and OpcUaClient have no
Inspect in a Contracts assembly — their only checker is the AdminUI *TagConfigModel.Validate(), which
lives in the AdminUI project and cannot be referenced from ControlPlane. Closing that means promoting
those models (or an equivalent parser) into each driver's Contracts assembly — a real piece of work, not
a map entry. Recorded in the inspector's own doc-comment so the next reader finds it at the code.
2026-07-28 — the 13 stale EquipmentTagsDarkBatch4 skips
§4.4 flagged these as stale and it was right: the reason said "dark until Batch 4", Batch 4 shipped as v3.0, and the equipment-tag path was retired rather than lit — so every one of them was waiting on something that had already happened and gone the other way.
Unskipping them in bulk would have failed, and deleting them in bulk would have thrown away live coverage. Each was resolved on its own merits:
| Disposition | Tests | Why |
|---|---|---|
| Revived onto the raw/UNS shape | 4 primary-gate cases (DriverHostActorPrimaryGateTests), the cluster-scoping rebuild (OpcUaPublishActorRebuildTests), the real-SDK materialisation E2E (AddressSpaceApplierHierarchyTests) |
The behaviour never went dark — only the v2 seeding did. Each seeds the v3 chain (RawFolder → Driver → Device → Tag, + UnsTagReference) instead. |
| Folded into a live parity test | array intent, historize intent, native-alarm/writable intent | DeploymentArtifactRawUnsParityTests already compared RawTagPlan record-equal, and RawTagPlan carries all three fields — so widening its corpus by two tags covers what three empty placeholder suites had been promising. Those suites are deleted. |
| Deleted | equipment-namespace EquipmentTags parse, both {{equip}}-token suites |
The subjects are retired. The token tests used the dot-joint {{equip}}.X form, whose resolver (EquipmentScriptPaths.DeriveEquipmentBase) was deleted in Batch 3; the slash-joint form is covered live by DeploymentArtifactEquipRefParityTests (4 tests). |
Three things worth keeping:
- The revivals are the point, not the unskipping.
Unknown_role_single_driver_services_writeassertsrecorder.Writes.ShouldNotBeEmpty()— it needs the write to actually reach a driver, which needs a routable tag. Verified by deleting theUnsTagReferencefrom the seed: it andKnown_role_wins_over_member_countgo red. Same check on the cluster-scoping test (re-home the SITE-A node to MAIN ⇒ red). The three denial cases in that file were passing all along — they deny before routing — which is exactly why the gap was invisible. - Widening a parity corpus needed a non-parity assertion to go with it. A composer that dropped array
intent entirely would still satisfy
decoded.RawTags.ShouldBe(composed.RawTags), because the artifact decode would drop it too and the two empties compare equal. Parity cannot distinguish "both right" from "both blind", so the widened test also asserts the composed values directly. - The reason constant is deleted, replaced by a note explaining why. A skip reason is a claim with an
expiry date, and this one outlived its own condition by a release. Both
DarkAddressSpaceReasonsfiles now say so, so the next person writing one states a condition a reader can actually check.
Skipped counts: Runtime.Tests 13 → 3, OpcUaServer.Tests 4 → 1. Every remaining skip is an
EquipmentDeviceBindingRetired tombstone — deliberate, and §4.4 already calls those fine as-is.
2026-07-27 — §8.4 dispatch-map parity (G-1 … G-6)
The maps had to become data before they could be guarded. A Razor @switch compiles into
BuildRenderTree's IL, so nothing can enumerate its cases — that is the whole reason G-1 and G-2
survived review while the sibling picker guard stayed green (the picker test works only because
RawDriverTypeDialog keeps its data in a field the markup enumerates). Both modals now render from
DriverConfigFormMap / DeviceFormMap via <DynamicComponent>, and being public those maps need
none of the picker test's BindingFlags.NonPublic fragility.
| Gap | Resolution |
|---|---|
| G-1 | CalculationDriverForm.razor added — RunTimeout was unauthorable through the UI. |
| G-2 | Sql / MTConnect / Calculation are declared single-connection rather than given hollow device forms — each holds one connection at the driver level, so a per-device endpoint editor would be meaningless. |
| G-3 | DriverConfigModal's hardcoded Galaxy or Mqtt replaced by DeviceFormMap.IsSingleConnection. |
| G-4 | DriverFormMapParityTests (5 cases, both directions) + DriverDispatchMapParityTests (3). |
| G-5 | CsvColumnMap entries for Sql, Mqtt, MTConnect. |
| G-6 | RawBrowseCommitMapper Sql branch — and the browser end too, which the register missed. |
G-6 was bigger than filed. The register said the mapper lacked a Sql branch. It also turned out that
SqlBrowseSession emitted no AddressFields at all, so a browsed leaf carried only a column name —
and a column name alone cannot address a Sql tag, which needs its table. The browser now travels
schema/table/column and the mapper builds a WideRow SqlTagConfigModel from them. A branch alone
would have produced a half-built blob.
Two extra findings while writing the guards:
- The G-6 test found Modbus and Calculation also fall through to the generic
{"address": …}key. Both are correct — neither is browsable — so the test asserts the fall-through set equals a documented non-browsable list, in both directions. A one-way check would let a newly-browsable driver be quietly added to the exclusion list instead of getting a branch. TagConfigDriverTypeNameGuardTestswas hollow: it enumerated a hand-writtenTheoryDatathat had already drifted (omitting Galaxy, Sql and Mqtt), so it guarded against renames but not gaps — a newDriverTypeNamesconstant would simply never appear. Now enumerated from the map, paired with a coverage test in the other direction.
Live-verified on docker-dev (localhost:9200, central pair rebuilt), because this repo has no bUnit
and no unit test can cover Blazor parameter binding: opened Calculation's config — the form renders where
it previously showed "No typed config form" — typed 3500, saved, reopened, and the value persisted,
proving the DynamicComponent two-way binding round-trips. Sql's form renders fully (regression check on
the conversion) and now reads "This driver holds a single connection, authored above" (G-3). The rebuilt
image also showed RediscoveryNeededUtc/RediscoveryReason on the wire, confirming §8.2 end-to-end.
2026-07-27 — §8.3 #516 driver config edits silently discarded
Decision: both — per-driver re-parse and the seam respawn. Reading the drivers split the "per-driver" half in two, which the register did not anticipate:
- Re-parse in place (
Modbus,AbLegacy,OpcUaClient) —ParseOptionsextracted from each factory, called fromInitializeAsyncbehind aHasConfigBodyguard so"{}"still keeps the constructor options. - Respawn-only, deliberately NOT re-parsed (
Sql,FOCAS) — each builds more than options from config: Sql'sISqlDialect+ resolved connection string, FOCAS's client-factory backend, both injected at construction. Adopting new options alone would run a new tag set against an old connection. Half a re-parse is worse than none. Their doc-comments now say so.
The seam respawn is the load-bearing half. DriverSpawnPlanner now routes a changed
DriverConfig to ToStop + ToSpawn, making the factory the single parse authority.
ToApplyDelta is consequently always empty from the reconcile path. This reverses the deliberate
decision documented at DriverSpawnPlan.cs:49-50 ("a pure DriverConfig change stays an in-place
delta — no reconnect"). That reasoning was right about resilience and wrong about the driver; the
accepted price is a reconnect on every config edit.
Two seals removed from ApplyChildDelta: it overwrote the cached Spec synchronously, before the
child had dequeued the message, so the host immediately believed the new config was live and the
next reconcile computed no delta — sealing the drift permanently; and it Telld with no
Receive<ApplyResult> registered, so a failed reinit (including Galaxy's deliberate
NotSupportedException) dead-lettered.
A new visibility gap this change exposed, not created: a factory throw is a config error
(TryCreate is pure parsing; device I/O happens later), and SpawnChild catches it and silently
substitutes a stub. Previously only a brand-new driver could hit it; now an ordinary config edit can.
Raised from Warning to Error with an actionable message. It still does not fail the
deployment — making it do so would let one malformed driver block a fleet deploy, so that is a
deliberate follow-up rather than a drive-by change.
Tests. Every pre-existing reinit test in the five suites passes "{}" — precisely the input a
guarded re-parser treats as "keep the constructor options", so they were blind to this defect by
construction. The new tests pass changed JSON. The Modbus one was verified falsifiable by
deleting the re-parse line (goes red). Two existing tests asserted the old behaviour and were
rewritten: DriverSpawnPlannerTests (two cases), and
DriverHostActorUnreadableArtifactTests.Dropping_a_drivers_last_tag_does_clear_its_subscription —
a positive control for a sibling absence assertion, whose observable moved from UnsubscribeAsync
to ShutdownAsync because the teardown now happens by stopping the child rather than emptying its
desired set. Same event, different route; the control still calibrates the settle window.
Full-solution run: only pre-existing environment failures remain — Host.IntegrationTests (3,
verified identical on the pre-change tree) and Driver.AbLegacy.IntegrationTests (4, docker
fixture-gated, and notably these fail rather than skip, unlike every other fixture-gated suite).
2026-07-30 — I emptied this file and committed it
f3cd685d deleted all 941 lines of deferment.md. The file sat at 0 bytes through the merge to
master and was only noticed when a follow-up edit's grep matched nothing. Restored from
4624141a; the two edits that commit was supposed to make have been re-applied.
Cause — a Python evaluation-order trap, not a merge conflict. The edit script ended with:
open(p, 'w').write(open(p).read().replace(a2, b2))
Python evaluates open(p, 'w').write before its argument. Opening for write truncates the file
immediately, so by the time open(p).read() ran there was nothing left to read — it returned "",
and "" was written back. The assert guarding the edit had already passed against the in-memory
copy, so nothing failed. dotnet build cannot notice an empty Markdown file, and git add -A staged
the deletion silently.
Why it survived to a merge. Every check I ran was capable of passing on an empty file: the build,
the test suite, and git status --short (which showed M deferment.md — a modification, which is
exactly what I expected to see). Nothing I ran asserted the file still had content.
What this says about the process. This is the second time in two rounds that the register's own
bookkeeping step damaged the register — round 1 recorded eight SHAs that pointed at dangling pre-amend
objects. Both failures share a shape: the verification step and the mutation step were the same
action, so a broken mutation produced a clean-looking verification. The cheap guard is to check the
artifact rather than the exit code — wc -l deferment.md after an edit, git rev-parse after the
commit is final rather than before.
2026-07-31 — #517 driver health ordering + #519 status sub-codes
Both closed. Each issue's symptom held up; each issue's stated mechanism was partly wrong, and in one case its suggested fix would have made things worse.
#519 — the sub-code collapse. Exactly as filed: DriverInstanceActor.QualityFromStatus projected
the driver's uint onto a 3-state enum, OtOpcUaNodeManager.StatusFromQuality re-expanded Bad to
0x80000000, and no driver's sub-code ever reached a client. Resolved by option (b) — the raw
uint now rides the whole value path — chosen by the user over "accept and document".
The issue costed option (b) as "the sink interface and its three implementations". The real surface
was 41 files / ~205 references, because OpcUaQuality had producers that are not drivers and
therefore had no uint to carry: AddressSpaceApplier's four removal writes, VirtualTagActor,
AlarmConditionSnapshot, and the alarm-quality path. Most had a natural code (BadInternalError for
a failed script, BadNoCommunication for comms loss) and two already computed one and threw it
away — ScriptedAlarmHostActor held a pair of mutually-inverse mappers converting uint→enum→uint
around the engine, both now deleted.
Two behaviour changes worth knowing, both deliberate:
WriteAlarmQualityfires its Part 9 event on a status-code change, where it used to fire on a severity-bucket change. While the annotation was 3-state those were the same predicate; now a move between two Bad reasons genuinely changes what a subscriber reads, so suppressing it would leave clients holding a stale reason.AddressSpaceApplier's removal writes kept the genericBad. A removed node could say something truer (BadNodeIdUnknown), but #519 was about not losing a code the driver already had; inventing a new one for the deploy path is a separate call, so that stayed behaviour-identical.
#517 — health published after teardown. The symptom is real but the issue named the wrong path, and its fix was unsafe:
ShutdownAsynccannot race.DriverInstanceActorcalls it fromPostStop— actor thread, after the mailbox drains — so the health poll is serialised against it. The one class with a lock-protected concurrentGetHealth,Core/Hosting/DriverHost, has no production call site at all and removes the driver from its registry before shutting it down anyway.InitializeAsynccan. It runs on a fire-and-forgetTask.Run(DriverInstanceActor.cs:567), so the health tick keeps firing throughout.MTConnectDriverwritesHealthy, then starts its stream and probe loops — either can throw into acatchthat disposes the client and only then writesFaulted. That window is the issue's claim, made concrete, and it is the only reachable one.- The suggested fix — "write the transitional value before disposing" — inverts the terminal state
if applied as a move. Teardown drains in-flight loops that write health as they unwind, so a
late loop can overwrite the shutdown value with
Healthyand leave that at rest, connections closed. The correct shape is a bracket: conservative before, terminal after. Applied to MTConnect's init-failure path; the shutdown paths keep their single trailing write, and the rule + the reachability table are documented onIDriver.ShutdownAsyncso nobody "fixes" the ordering on the wrong premise later. - One unambiguous defect, deterministic rather than racy:
CalculationDriver.GetHealth()returned a hard-codedHealthythat consulted nothing — Healthy before initialize, after shutdown, and after dispose. Its existing test was literally namedHealth_is_always_Connectedand asserted the defect; removed, and replaced with a lifecycle test.
Falsification. Every new guard was proved capable of failing by breaking the production code and watching it go red: the Commons parity guard (corrupt a constant), the node-manager verbatim write (restore the collapse), and the MTConnect ordering test (delete the pre-teardown write). The two sub-code tests each assert two different Bad codes, because under the old projection a single-code assertion could pass against a hard-coded constant.
One self-inflicted defect, caught by the suite. The bulk .Quality → .StatusCode rename ran with
a negative lookbehind for condition to protect the SDK's condition.Quality, which missed
BrowseNames.Quality — an SDK browse-name constant. The event filter then selected a field that does
not exist, and the wire test failed with an NullReferenceException on the cast rather than a readable
assertion. Same lesson as the round-3 entries above: a mechanical rewrite needs its output audited by
receiver, not just compiled — git diff | grep -o '[A-Za-z_]*\.StatusCode' | sort -u would have shown
it in one line. It hit twice: BrowseNames.Quality (caught by the wire test) and a .Quality
inside a script-source string literal in EquipmentScriptPathsTests' InlineData — which compiled
and passed, so only reading the diff by hand found it.
Pre-existing, not chased: the four Driver.AbLegacy.IntegrationTests failures need the
slc500/micrologix/plc5 compose profiles, which are not up on 10.100.0.35 (only the AbCip
controllogix fixture is). Reproduced on a stashed tree before dismissing them.
2026-08-04 — reconciled against reality; the tracker is empty
No code changed. This entry records a re-verification pass and the drift it corrected, prompted by the question "what's left" — which this file existed to answer and, at the time it was asked, answered wrongly.
The drift. §0.1 asserted "14 issues remain open" and §5 recorded #491 as OPEN — code complete, unproven in production; no gate-passed commit exists. Both were false: the tracker had been at 0 open
since 2026-08-04, and #491's gate had passed that morning — after finding a production-fatal defect
that the "code complete" reading had specifically failed to anticipate. §2's row for 491 still read
CANNOT VERIFY (needs VPN'd gateway).
⚠️ This is the third round in which this file's bookkeeping was the thing that broke — after the dangling pre-amend SHAs (round 1) and the truncation (round 2). The failure mode differs, but the shape does not: the register is only updated by the work it describes, so work that closes an item elsewhere leaves the register asserting the item is open. The two previous failures were mechanical and were fixed with mechanical guards; this one is structural, and the honest guard is to re-derive rather than re-read. Which is what this pass did.
Everything below was re-derived from the source of truth, not from this file:
| Claim | How re-derived | Result |
|---|---|---|
| Open issue count | Gitea API, state=open |
0 — corrected from 14 |
| Closure dates for the 14 | Gitea API per issue | #489/#481/#508–#515/#525 on 07-31; #520/#468 on 08-01; #491 on 08-04 |
| Open plan tasks | parsed every docs/plans/*.tasks.json |
31 across 6 files — and found a 6th file §6.2 had missed |
| Review coverage | listed code-reviews/ |
10 projects unreviewed, 3 Wonderware modules retained — unchanged |
What the re-derivation found that reading the file would not have:
- §6.2 was missing a file.
2026-06-14-driver-reconfigure-while-faulted-plan.md.tasks.json(1 pending) appears in §5 as a live gate but never in §6.2's inventory of live plans, so the two sections disagreed on whether it existed as work. - §5 cited that file at the wrong date —
2026-07-14-…, which does not exist indocs/plans/. Anyone following the reference would have found nothing and concluded the gate was already closed. - That gate's stated blocker has expired. Task 3 is a live
/runverification, deferred when it needed an operator to sign in. docker-dev has since run the AdminUI with login disabled, so it is runnable unattended — the only item on §5's list that is.
One substantive correction carried into §0.1, not merely a status flip. archreview 03/S4 —
"primary gate default-allows on unknown role" — describes the same shape as a decision deliberately
taken on 2026-08-04 in PrimaryGatePolicy.ShouldRecordHistorizedValues, where an unknown role
captures. Both readings are defensible in their own context (a duplicate historian sample is bounded
and self-correcting; an unauthorized write is not), so whoever closes 03/S4 must not generalise one rule
across both. Recorded now, while the reasoning is fresh, rather than left for a future reader to
rediscover from two files that never reference each other.
What is left is now entirely untracked, which is itself the finding: 4 hardware/licence-gated live
gates, 1 runnable deferred gate, the G-7 residual (deploy gate weaker than the authoring gate for 4
drivers), 3 carried-open archreview findings led by 01/S-1 (AddressSpaceApplier swallows sink failures
— a deploy reports Applied while broken), the 19-task AdminUI plan, and the review-coverage gap. See
§0.1 for the table.
2026-08-10 (eighth round) — the seventh round's recorded Opens all resolved: fleet-wide 0 pending findings
The 32 findings the seventh round left Open (35 minus Driver.MTConnect-003→#560 and two closed in
passing) were partitioned along disjoint-file boundaries into 8 parallel isolated-worktree Opus
agents (MQTT driver+transport / MQTT browser+contracts / SQL driver-health / SQL dialect+chunking /
SQL browser+probe / SQL contracts / MTConnect / Calculation), each verified against only its relevant
suites. All 8 branches merged --no-ff; README regenerated, --check clean — 0 pending findings
across all 65 modules for the first time since the review system started counting.
Dispositions: 31 Resolved (27 code fixes TDD-red-first, 4 doc/constants resolutions), 1 documented
Won't Fix — Driver.Sql.Browser-003 (the ad-hoc connection-string browse literal): verified rather
than assumed that both reaching surfaces are ConfigEditor-gated with no HTTP endpoint, recorded as a
trust boundary in docs/security.md. The fixes most worth knowing about:
- Fleet-wide numeric-enum rejection (
Driver.Sql.Contracts-002):TagConfigJson.ClassifyEnumTextin Core.Abstractions now refuses digit/sign-leading spellings beforeEnum.TryParseand requiresIsDefinedafter (catches non-[Flags]comma-OR too). Three AdminUI restatements routed to the shared classifier in the same commit — left alone they'd have reopened the #549 drift direction. - SqlGroupPlanner chunking (
Driver.Sql-002+Dialect-002, one design):ISqlDialectgainedMaxBindParameters(SqlServer 2098 —sp_executesqlspends two; Oracle 1000 — theIN-list limit, deliberately not its 64k bind count) and the planner chunks key-value groups at the ceiling, members following their key. Byte-measured identifier ceilings for Postgres/Oracle (Dialect-001). - Sql evidence clock aligned with the #527 watchdog (
Sql-004/-005/-006/-010):LastSuccessfulReadnow advances on any proof the database answered (BadNoData,Uncertain…), connection-class isBadTimeoutonly, poll-error classification is per-exception-instance not per-type, and all health transitions ride one CAS loop (monotonicity of the evidence clock was the RED observable). - Calculation pump split (
Driver.Calculation-005): scripts no longer run on the mux actor thread or under_lock— trigger-time snapshots queue to a single serialized pump (_evalGate→_lockorder, at-most-one evaluation); a slow script blocked the dependency callback 1.21 s before. - MTConnect write-back became authorable (
Driver.MTConnect-004): the driver form gained the Write-back switch; the block is written in BOTH states (an omitted block could never turn writing off — pinned by a falsification control). Razor markup itself remains a rig live-verify residual. - MQTT: reconnects that re-establish nothing now tear down instead of reporting success
(
Mqtt-007, reachable when a deploy lands inside a subscribe round-trip);SparkplugPrimaryHoststops disposing a gate a live reconcile still holds (-006); password-without-username warns instead of silently connecting anonymous (Transport-002); strictretainSeedread through the same parse the authoring gate consults (Contracts-004); dead[Range]s deleted because two contradictedNormalize, the real authority (Contracts-005); pre-epoch DateTime writes and wildcard-formingSparkplugTopic.Formatclosed (-006/-007); browse label-guard convergence, atomic node cap, Path-keyed sibling sort (Browser-002/-003/-004).
Process notes, both carryable: (1) agent worktrees base on origin/master, not local HEAD — two
agents independently measured the AdminUI baseline at 1,466 against a brief claiming 1,474, because the
unpushed #560 arc wasn't in their base; harmless here, but base-verify matters when local is ahead.
(2) The one cross-branch composition break was exactly the predicted shape: the browser agent's new
OracleFlavouredSqliteDialect predated the dialect agent's ISqlDialect.MaxBindParameters member —
caught only by the consolidated full-solution build (the per-agent suites were green in both
worktrees), fixed by one delegating property. Shared Driver.Sql/findings.md header reconciled 7→0 by
the orchestrator after the three parallel SQL merges, per the briefs' carve-out.
Consolidated verification on the merged tree (relevant suites only, per request): build 0 errors; Mqtt 782, Sql 417, Sql.Browser 84, MTConnect 546, Calculation 53, Core.Abstractions 298, Runtime 558 (+3 pre-existing skips), AdminUI 1,499 — 3,337 passed, 0 failed (+305 new tests over the bases).
2026-08-10 (seventh round) — review-coverage gap CLOSED: 14 modules reviewed, Wonderware reviews retired to history
The §0.1 "Review-coverage gap" row is done. Six parallel isolated-worktree agents (4 Opus on the big
families, 2 Sonnet on the small ones) reviewed every never-reviewed project — the row's 10 plus
Mqtt.Transport, Sql.Dialect, Calculation.Contracts and OpcUaClient.Session (the last absent
from both the row and the request; found by listing src/ against code-reviews/). All six branches
merged --no-ff; consolidated verification on the merged tree: build clean, 11 suites / 4,033
tests green, 0 failed (Mqtt 729 proves the two Mqtt branches compose: 708 base + 16 + 5). README
regenerated — 65 modules, --check clean.
61 findings recorded; 26 fixed TDD-red-first on the branches; 35 recorded Open (cross-module, design-decision, or Low record-only — the same disposition split as the 2026-06-19 sweep). The fixed Highs, all previously invisible to every suite:
- Historian.Gateway: alarm severity written as enum NAME while the read side
int.TryParses it — every read-back collapsed to severity 1, and an existing test asserted the wrong value as correct. - Mqtt.Contracts: a write to a wildcard
writeTopicpublished an MQTT-3.3.2-2 protocol violation — a conformant broker closes the connection, taking the whole driver (every subscription) dark. - Mqtt runtime ×2, same class — "state that outlives the session it describes": the plain-path
subscription manager never cleared
_subscribedTopicsacross a session rebuild, so the #527 watchdog's automatic reconnect came back deaf (Connected/Healthy, zero subscriptions, values frozen); andInitializeCoreAsyncoverwrote live_connection/_primaryHostwithout teardown, stranding a connected broker session (reachable viaAdoptConfigDuringInitracing a reconnect). The Sparkplug siblings had both hardened already — worth re-checking other drivers keeping per-session bookkeeping across Shutdown/Initialize. - Calculation: multi-dep tags evaluated against partial snapshots during warm-up — a spurious "script threw" Warning on every ordinary deploy for the standard calc-tag shape.
Notable Open (recorded in findings.md, fix sites named): Driver.MTConnect-003 (High,
cross-module) — browse-committed MTConnect tags coerce to filed as Gitea
#560 and CLOSED same day (merge String at runtime while their nodes are
typed from the same probe inference (the #536 class; fix in AdminUI RawBrowseCommitMapper, which got
the typed-model branch without the native-type forwarding its 3 siblings have)5226f7fd): MapLeaf threads the leaf's DriverDataType into
BuildTagConfig — a threaded param, NOT a fabricated addressFields entry, because MTConnect's
coercion type IS the agnostic enum and NativeType's contract is read-never-derive; stated field
still wins; pair-asserting tests (row type AND blob type), red-first; AdminUI 1,474 + MTConnect 538
green; finding Resolved, module open count 5→4; Driver.Sql-002
(unchunked IN list vs. the 2100-param SqlClient cap); Driver.Sql.Contracts-002 (cross-module:
Enum.TryParse accepts numeric strings, so "type":"99" deploys an undefined DriverDataType —
belongs in Core.Abstractions); Driver.Calculation-005 (evaluation runs under _lock on the mux
actor thread, up to RunTimeout).
Also this round: the three Historian.Wonderware* review modules got retired-module banners
(backend deleted in the gateway cutover, zero slnx references; Server/Admin deleted-module precedent)
and the untracked bin/obj litter dirs under src/Drivers/ were removed. Process traps for next
time: (1) my brief's regen-readme gotcha was worded over-broadly and one agent made its finding
headings #### — invisible to the generator's ^###\s+ split; --check catches it only when the
header claims Open findings, so a 0-open file fails silently — audit grep -c '^### ' per new file;
(2) the harness Write tool refuses subagent-written findings.md (pattern-matches "report files") —
agents worked around via scratchpad-copy or heredoc, legitimately.
2026-08-10 (sixth round) — open-plan-task sweep: 2 verified live, 2 closed obsolete; 7 → 3
A freshness audit of the 7 open plan tasks (parsed from *.tasks.json, per the re-derive rule)
against the current tree, then one Opus agent ran the two runnable verifies. No code changed.
- followups-batch Task 9 (Modbus-Int64 live authoring) — VERIFIED PASS. Rig rebuilt to master
481f4343first (the running image was 2 days stale; parity asserted across all 6 nodes — the round-robin trap). AuthoredTASK9-INT64(RawPathpymodbus/plc/Task9Int64, HoldingRegisters address 200, Int64 BigEndian) via ConfigDb + the headless deploy API; deployment sealed. The node advertises DataTypei=8(Int64), scalar, Good, identically on :4840 and :4841, and the value is the exact BigEndian decode of HR200–203 — four distinct non-zero words, so a byte-order or span bug could not coincidentally match. Change propagation proven by driving HR203 via FC06 and watching the subscribe on both centrals (registers restored after). Fixture caveat recorded: the standard profile has no naturally-churning 4-register span (HR100 is isolated; any span over it returns ILLEGAL DATA ADDRESS), so churn must be externally driven. Tag row left deployed and serving, consistent with prior gate rows. - followups-batch Task 10 (S7 + AbCip Test-Connect probe E2E) — VERIFIED PASS.
DriverProbeHandshakeE2eTests12/12, 0 skipped — S7 green, AbCip green with"CIP session OK"(a real authored-tag read, not the fallback), AbCip no-authored-tags reachability, plus the Modbus/OpcUaClient/local-rig/Galaxy legs (mxaccessgw on10.100.0.48happened to be up). Premise correction: the skip-gating is pure TCP reachability (DockerFixtureAvailability), not env vars, and the checked-in defaults already point at10.100.0.35— the task's "needs Windows-VM fixtures" note had been stale since the Mac migration. S7 fixture started and removed (net zero); AbCip was already up and left as found. - fixedtree Task 11 — CLOSED OBSOLETE. The FixedTree-under-Equipment injection feature it
gated was deleted wholesale when #507 closed as superseded (
DiscoveredNodesReady,DiscoveredNodeMapper, the 18DiscoveryInjectionDormantV3tests — all gone). A verification gate for deleted code verifies nothing. - adminui-driver-pages 10.4 (manual smoke checklist) — CLOSED OBSOLETE. The routed
/clusters/{id}/driversflow it smokes (the 8*DriverPageshells) was retired in v3 Batch 2; no driver pages exist underComponents/Pages/. The form bodies live on inside the/rawmodals, live-gated repeatedly across the 2026-07/08 rounds.
Open plan tasks are now 3 now 1 (updated later 2026-08-10), all deliberate: F10b
surgical DataType/IsArray + alarm-severity both reconsider gates were put to the
user later that day and CLOSED decided-against — F10b: the rebuild path is correct and the surgical
swap buys a rare edit at the cost of a client-visible atomicity window + ModelChangeEvent surface +
a mandatory live gate (re-open trigger: operator complaints about rebuild churn on data-type edits);
SetSeverity: operationally invisible, the engine overwrites authored severity on first eval — and
the device-gated proofs (hardware-blocked; SetSeverity (reconsider gates — premises re-verified
still true on the current tree: TagDeltaIsSurgicalEligible still rebuild-forces DataType/IsArray;
the node manager still projects engine-computed severity)two sub-items possibly part-covered by the 2026-06-27
historian gate and trimmed 2026-08-10: Phase C T7
(backend retired; HistoryRead-vs-AVEVA proven by the cutover gate + #491 read-back) and Phase B T9
(equivalent proof live via dcb0be65, worth trimming when next toucheddcb0be65) both removed — the bundle is now H6 native-ack→AVEVA + the
AbLegacy/TwinCAT/FOCAS probe happy-paths, all genuinely gated).
Side effect worth knowing: the docker-dev rig now runs current master (6e7028e0856f).
2026-08-10 (fifth round) — #559 closed: MQTT joins the fleet's framing contract; the drift arc ends
The fourth round's sole residual, one isolated-worktree Opus agent, fix 621a9e5d merged to master.
Verification on the merged tree: clean build; 4 affected suites / 2,790 tests green (Mqtt 708,
AdminUI 1466, ControlPlane 261, FOCAS 355).
- #559 CLOSED — both MQTT runtime mappers (
FromTagConfig,FromSparkplugTagConfig) dropped their untrimmed|| tagConfig[0] != '{'clause;JsonDocument.Parse+ the root-ValueKindcheck are the single framing authority, as in the six sibling drivers. The verdict changes ONLY for whitespace-padded JSON objects (now earning their content's verdict); bare names, arrays, numbers, strings and blanks are refused by the same mechanisms as before, and a caller sweep confirmed nothing relied on the first byte (no name-vs-blob fallback exists in v3).Inspectneeded no logic change — since #556 it trims its own pre-filter and hands the RAW blob to the mappers — but four comment sites claiming the padded-blob refusal was real were rewritten. - The #556 backstop lost its only vehicle, by design. The padded blob was the one
production-reachable shape for "refused, but no DescribeRejection branch can name why"; after
the fix no vehicle exists (a union refusal with a topic requires a named strict-field failure;
without topic and without the Sparkplug tuple the no-address branch fires). The backstop stays
as defence-in-depth, re-pinned FOCAS-style as a count relation
(
A_rejected_config_always_draws_more_than_its_advisories_alone), and the old flipped test was replaced by the stronger parity formLeading_whitespace_changes_neither_the_verdict_nor_the_inspectionover the accepted AND rejected corpus with an anti-vacuity control proving the corpus carries both verdicts. New runtime tests assert padded-vs-unpadded definition equality, not just the accept bool. Falsification: each mapper sabotaged separately — exactly 5 (Plain) / 4 (Sparkplug) tests reddened, all specific to the sabotaged mapper, nothing unrelated. - Honest coverage note: the three padded entries added to the AdminUI parity corpus stayed
green under BOTH sabotages —
MqttTagConfigModelconsults the same union parse viaTagConfigParseGate, so authoring moves with runtime by construction. They pin a future divergence (unwiring the parse-gate consult), not this defect; the load-bearing coverage is driver-side. A parity test cannot detect a defect both sides share.
No residual filed. The authoring-vs-deploy-gate drift arc (#549 → #550/#551 → #552/#553 → #554/#555 → #556/#557/#558 → #559) is closed end to end.
2026-08-10 (fourth round) — #556 + #557 + #558 closed: Inspect trims and classifies; the last alias and the last hand-list fall
The three residuals of the #554/#555 round, three isolated-worktree Opus agents, merged 7482cf0c
(#558), 93a05828 (#557 OpcUaClient half), be15ed16 (#556 + #557 Mqtt half). Consolidated
verification on the merged tree: full build clean; 14 suites / 4,583 tests green (AdminUI 1460,
ControlPlane 261, Modbus 395, S7 302, AbCip 409, AbLegacy 243, TwinCAT 219, FOCAS 355, Mqtt 686,
OpcUaClient 143, OpcUaClient.Browser 10, Galaxy.Browser 21, Sql.Browser 79).
- #556 CLOSED — all seven Contracts factory
InspectsTrimStart()before the[0] != '{'framing check, and each classifies its findings structurally into two lists —rejections(the parse would refuse) andadvisories(accepted, worth flagging) — with the "rejected blob never draws zero warnings" backstop gating onrejections.Count == 0, not the combined count (an advisory can no longer satisfy the backstop vacuously; no string matching anywhere). The fix surfaced a discovery: MQTT's runtime mappers uniquely also carry the framing gate, so for MQTT a leading-whitespace blob is genuinely refused at runtime and its trimmed Inspect reports a real rejection — accept-gate-first symmetry holds. The other six runtimes tolerate the whitespace (JsonDocument.Parseskips it), a cross-driver served-behavior inconsistency deliberately NOT changed here (an Inspect-wording issue must not change served behavior) — filed as #559. FOCAS's backstop is unreachable today (no unnamed refusal exists); pinned as a count relation so it fails the day one appears, rather than deleted. - #557 CLOSED, both halves. OpcUaClient: legacy
NodeIdwas readable at runtime but the editor dropped it —OpcUaClientTagConfigModelgainedNodeIdKeys+ReadNodeIdimplementing the runtime's presence-shadows semantics (TryGetProperty("nodeId") || TryGetProperty("NodeId"), then one ValueKind/non-blank check) — deliberately NOT MTConnect'sFirstNonBlank: a present-but-blanknodeIdshort-circuits the||, blocks fallback, and the blob is REJECTED — blank-beside-valid-legacy must refuse, and now does in both layers.ToJsondrops aliases keyed off the SAME array (#550 pattern). TheTagConfigNonEnumParityTestsOpcUaClient exemption is removed — the anti-vacuity control (Every_deliberately_stricter_entry_is_still_exactly_that) is what would have caught it going stale. Mqtt: the union parse verdict is the decided contract, not a bug —FromSparkplugTagConfighardcodesPayloadFormat.Jsonand never reads thepayloadFormatkey, so a typo'd value on a sparkplug-shaped blob is genuinely servable and refusing it would be stricter than runtime. Mitigation: a mode-dependency advisory on the accepted blob (advisories ride accepted blobs by design, so the rejection backstop never trips). - #558 CLOSED — one guard per seam: the browse-commit dispatch fact moved out of
DriverDispatchMapParityTests(now CsvColumnMap-only) intoRawBrowseCommitMapperParityTests(now 6 facts, the sole guard for that seam; subsumption proven under the same neuters before the old fact was deleted). The hand-maintainedNonBrowsableDriverTypeslist is gone — the browsable set derives from the real productionAddAdminUI()registration, the non-derivable universal arm covered byDriverTypeNames.Allenumeration +GenericKeyExemptions+ a contradiction-refuting fact. Ordinal (not IgnoreCase) membership compare is load-bearing — a case-only typo in a browser key is exactly the drift the guard exists to catch. Galaxy/OpcUaClient browserDriverTypeliterals becameDriverTypeNamesconstants (Galaxy's "GalaxyMxGateway" exact-matched before substitution), closing the last string-literal channel into the derived guard.
Residual filed: #559 — align MQTT's runtime whitespace handling with the fleet (or declare the framing gate the contract). The authoring-vs-deploy-gate drift arc (#549 → #550/#551 → #552/#553 → #554/#555 → #556/#557/#558) is otherwise closed end to end.
2026-08-10 (third round) — #554 + #555 closed: authoring consults the parse; the cited guard now exists
The two residuals of the #552/#553 round, again two isolated-worktree Opus agents, merged 7cfe7b4a
(#554) + 4f1c83a7 (#555). Consolidated verification on the merged tree: full build clean; 14
suites / 5,251 tests green (AdminUI 1430, ControlPlane 261, Modbus 373, S7 285, AbCip 390, AbLegacy
230, TwinCAT 205, FOCAS 341, Mqtt 673, Sql 363, MTConnect 534, OpcUaClient 143, Calculation 23).
- #554 CLOSED — every mapped
*TagConfigModel.Validate()consults the driver's own runtime parse on the AS-LOADED blob via the newTagConfigParseGate(AdminUI-side, no factory touched): verdict from the parse, wording fromInspectonly after refusal. The two design points are pinned: gating on "Inspect said something" would be stricter than runtime (FOCAS/MQTT/Calculation advisories ride ACCEPTED blobs), and judging typed fields instead of the source blob would accept exactly what the lenient load hides. Survey closed real gaps in 5 of 11 drivers: Modbus (absentregion, address shapes,stringLength<1,bitIndex>15, and{}itself), S7 (stringLength0–254), TwinCAT (dataType:"Structure"— valid enum NAME the reader refuses; no spelling gate can see it), Sql (the recognition rule), Mqtt ("qos":null). Deliberately-stricter editor rules KEPT and pinned by name, incl. AbLegacy'sarrayLength>256(the runtime clamps but the materialiser advertises the RAW number inArrayDimensions— the authored value is silently not honoured, so author-time refusal is the honest treatment). ⚠️ Behaviour change: an untouched{}Modbus config is now refused at save — it was the only editor with no required field, and a{}tag reads BadNodeIdUnknown forever under a green deployment. Anti-vacuity guards: the parity corpus must exercise BOTH verdicts per driver; an exemption that stops being deliberately-stricter FAILS instead of silently excusing. - #555 CLOSED —
RawBrowseCommitMapperParityTestsnow exists, holding the mapper to what its comment merely claimed. The browsable set is DERIVED: the test runs the productionAddAdminUI()registration and reads back everyIDriverBrowser.DriverType(the setBrowserSessionServiceindexes). The universalDiscoveryDriverBrowserarm is NOT derivable from the AdminUI assembly (needs runtime drivers + Host'sIDriverFactory; the #526 cut is deliberate) — covered by enumeratingDriverTypeNames.Allwith a reasonedGenericKeyExemptionslist (Modbus, Calculation) plus a fact that mechanically refutes any exemption the derived arm contradicts. Falsified three ways (disabled Sql branch → red naming Sql; disabled MTConnect branch → red via the enumeration half that DI derivation cannot reach; bogus exemption → the contradiction fact red quoting it). The mapper comment now states the two real claims and the residual trust. - Residuals filed, not folded in: #556 (Inspect polish — the
reference[0] != '{'pre-filter has noTrimStart()so" {…}"draws zero warnings in 7 factories; FOCAS/MQTT advisories can swallow the rejection backstop viawarnings.Count == 0), #557 (reader asymmetries — OpcUaClient's legacy PascalCaseNodeIdis readable but unsaveable untouched; Mqtt Sparkplug parse accepts apayloadFormatthe Plain parse rejects and the union admits it), #558 (test hygiene — the pre-existingDriverDispatchMapParityTestsbrowse-commit fact overlaps the new guard and itsNonBrowsableDriverTypeslist is hand-authored AND misnamed; two browser classes returnDriverTypestring literals instead ofDriverTypeNamesconstants, unguarded).
2026-08-10 (later) — #552 + #553 closed: the browse states, the merge preserves
The two residuals the #550/#551 round exposed, again two isolated-worktree Opus agents, merged
1f351250 (#552) + 62fe6c83 (#553). Consolidated verification on the merged tree: full build
clean; 8 suites / 3,362 tests green (AdminUI 1262, ControlPlane 261, Sql 363, Sql.Browser 79,
MTConnect 534, Modbus 373, S7 285, TwinCAT 205).
- #552 CLOSED — Sql browse-commit emits a valid
rowSelector. The session states, the mapper never infers (the MQTT Sparkplug rule):SqlBrowseSessionnames atopByTimestampcandidate from the columnDATA_TYPEmetadata it already reads (MapColumnType == DateTime— type only, never a name heuristic; the fixture pins asample_ts TEXTtrap column), tie-break = first in catalog order (every dialect'sListColumnsSqlalready orders by ordinal), zero extra queries (pinned by a command-count test). NewSqlBrowseAddressFieldsconstants inDriver.Sql.Contractsend the producer/consumer agree-by-coincidence on field names. No-candidate tables are refused in words at the modal (DescribeUncommittableLeaf— names leaf, table, and the whereColumn/whereValue fix, whose value is data no browse can supply); the emitted blob keeps the wide-row shape so table/column survive into the typed editor. The blob's top-leveltimestampColumn(source-timestamp) is deliberately NOT set — ordering by a column is not a claim it timestamps the value. Emitted blobs are double-accepted (model validator AND the realSqlEquipmentTagParser) with a pre-#552-bytes-refused control; theRawTagConfigGateTestsSql leg flipped from records-the-gap to passes-the-gate. - #553 CLOSED — and characterization first shrank it. On the current tree (post-#550/#551)
MTConnect's invalid-alias/invalid-cell legs were ALREADY caught (raw-key maps never round-trip);
the real defects were the model-backed maps' laundering (Modbus/S7
"dataType":"Intt16"→ silentInt16) and the export side actively setting the re-import trap (ReadTypedColumnsread only the canonical key → the typed column printed the ignored value, the residual kept the winning alias). Fix is evidence preservation, not a second validator:ApplyTypedColumnsrestores the base cell's own tokens over the model serialisation for every key no non-blank column overrode (fragments compose byte-identically; the #551 gate stays the one authority, now judging unlaundered evidence);CsvTypedColumn.ReadKeys/OwnedJsonKeysdeclare the runtime's full spelling precedence once (MTConnect pairs), so firing columns clear out-ranking aliases, the export residual strips them, and export cells show the effective value. Override-contradiction semantics: column wins, OPENLY (review grid names each override) — #549's doctrine is against silent rewrites. Falsification: guard neutered → exactly the 7 defect-closers red while the #551 gate suites stayed 53/53 green (a layer in front of the gate, not a replacement). - The deliberate-trap discipline in the #552 fixtures is worth copying: the multi-candidate
table's column names are asserted to DISAGREE with alphabetical order (the tie-break test cannot
pass by luck), and the no-candidate table carries the exact
sample_ts TEXTcolumn a name heuristic would have bound to. - Residuals filed, not folded in: #554 — authoring models validate only enum keys; non-enum
rules (Modbus address shapes, S7 stringLength bounds…) meet no gate until deploy, where the #551
accept-gate-first Inspect names them — feedback latency, not silent death; closing it means the
models consult the same runtime parse the Inspects wrap, after a fleet survey (N-1 rule).
#555 —
RawBrowseCommitMapper's fallback comment cites aRawBrowseCommitMapperParityTestsguard that DOES NOT EXIST; the "every browsable driver handled" invariant is unguarded (9 types covered by hand-written InlineData) — write theDriverTypeNames.All-driven parity test the comment already describes.
2026-08-10 — #550 + #551 closed: the accept-gate-first fleet conversion
The two #549-survey residuals, again two isolated-worktree Opus agents, merged b50523b1 (#550) +
333ea488 (#551). Consolidated verification on the merged tree: full build clean; 12 suites /
5,098 tests green (AdminUI 1233, ControlPlane 261, Runtime 558, Modbus 373, S7 285, AbCip 390,
AbLegacy 230, TwinCAT 205, FOCAS 341, Mqtt 673, MTConnect 534 + 15 integration).
- #550 CLOSED —
MTConnectTagConfigModelreadsDataTypeKeys = ["driverDataType", "dataType"]with the runtime's exactFirstNonBlankper-key semantics (blank falls through; a NON-string token STOPS, because the runtime'sstring?DTO deserialise throws and can never fall through) andToJsondrops every non-canonical entry of the same array — read and drop are keyed off one list so a third spelling can never be read-but-not-dropped. Both half-fixes were falsified separately (read-only → 9 red; drop-only → 14 red incl. the Int32-blob-retypes-to-String test). - #551 CLOSED, structurally — instead of three more hand-mirrored checks, all seven pre-#549
Inspects (Modbus/S7/AbCip/AbLegacy/TwinCAT/FOCAS + Mqtt, an unnamed sibling the re-derive found) converted to accept-gate-first (the G-7/MTConnect shape): parse accepts ⇒ silent, parse rejects ⇒ a warning must name why, pinned per-factory by a structural invariant test (rejected blob can never draw zero warnings). That closed the named gaps (S7 absent-dataType, AbCipmembers[], ModbusstringByteOrder) AND the unnamed ones (absent/blank address keys fleet-wide; TwinCAT's valid-enum-name-but-refusedStructure; Mqtt's gate is the union of both payload mappers or every Sparkplug tag false-warns). Authoring is now enforced in the service:RawTreeService.CreateTagAsync/UpdateTagAsync/ImportTagsAsyncall runTagConfigValidator(the issue's premise that manual entry rides the import was wrong — it commits viaCreateTagAsync), with the CSV review grid keeping the early per-row message; a rejected import row is a named ERROR in the all-or-nothing result. S7 authoring rejects an absentdataTypevia a source-shape capture (_dataTypeMissingInSource, judged on the KEY like the runtime'sDeclaresDataType— browse-commit-built models and load→save round-trips stay clean). Doc sweep done: every "silently defaulted by the lenient runtime" comment now states the strict reality. - Never-stricter preserved deliberately where it bites: Modbus's narrowing casts are mirrored
(
bitIndex:256is bit 0 and accepted), AbLegacy'sarrayLengthclamp is not warned, FOCAS's two accepted-blob advisories stay a distinct warning class (promoting warnings to errors must not block a deploy the driver would serve). - Residuals filed, not folded in: #552 — Sql browse-commit emits a
rowSelector-less WideRow config both gates refuse (verified live; the tag was NEVER readable, so the #551 gate correctly moved the failure from silent-dead-tag to a named commit error — but Sql browse-commit now always fails and needs arowSelectorsource in the browse UI). #553 — the CSV typed-column merge (CsvDriverTagMap.ApplyTypedColumns) round-trips the free-form cell through the lenient model load, silently rewriting a typo'd enum to its default BEFORE any gate can see it (the CSV analogue of #549), and MTConnect's exporteddriverDataTyperesidual still shadows theMtDataTypecolumn on re-import.
2026-08-09 (later) — #549 authoring strictness (6 models); NamespaceMap out of Contracts
Follow-ups from the round below, again two isolated-worktree agents, merged 3a70a4e6 + 10c7a0e8.
Consolidated verification on the merged tree: full build clean; 12 suites / 4,119 tests green
(AdminUI 1175, ControlPlane 261, Core.Abstractions 284, MTConnect 534, AbLegacy 219, TwinCAT 192,
FOCAS 327, OpcUaClient 143 + Browser 10, Modbus 346, S7 264, AbCip 364).
- #549 CLOSED — and the survey it demanded found the defect was 6 models wide, not 1. The G-7
round's "MTConnect authoring accepts a dataType the runtime rejects" generalised: R2-11 Phase C
made every runtime TagConfig enum read strict (
TagConfigJson.TryReadEnumStrictrejects the tag), so every lenientGetEnumauthoring model was authoring-weaker-than-runtime — MTConnect, Modbus (region/dataType/byteOrder), S7, AbCip, AbLegacy, TwinCAT, FOCAS. Mqtt and Sql were already strict on both sides. Fixed one-authority: MTConnect'sValidateconsults the factory's exposedIsAcceptedDataTypeName; the other five consultTagConfigJson.DescribeInvalidEnum, which delegates to the runtime's ownClassifyEnumText(verdict AND wording from one implementation). Deliberately not stricter than runtime: absent keys / non-string tokens stay accepted where the runtime accepts them, each pinned. MTConnect also captures the raw JSON token — an unquoted"dataType": 8throws in the runtime DTO deserialise, so authoring now rejects it too. - Survey residuals filed, not folded in: #550 (MTConnect
driverDataTypeis a second, runtime-preferred spelling the editor neither reads nor writes — a valid one silently overrides what the editor displays; fixing needs both read-both-spellings AND normalise-on-save together) and #551 (4 gate-coverage gaps:RawCsvImportModal's free-form TagConfigJson column meets only the deploy gate; S7's unique absent-dataTypehard-requirement warns nowhere; AbCip memberdataType- Modbus
stringByteOrderchecked by neither gate; the seven pre-#549Inspectdoc summaries still claim "silently defaulted by the lenient runtime" — stale since R2-11).
- Modbus
- NamespaceMap moved out of
OpcUaClient.Contractsinto a newDriver.OpcUaClient.Sessionleaf (merge10c7a0e8), so ControlPlane's G-7 reference no longer drags the OPC UA client SDK into its dependency graph (before: fiveOPCFoundation.*packages transitively; after: none). The alternative — Browser referencing the driver, the Mqtt #512 shape — lost on a measurement: AdminUI references.Browser, so it would have pulled the driver runtime into the AdminUI graph, exactly what #512 spent two extractions removing. The G-7 one-authority seam survives (BuildRawPathTablestill callsOpcUaClientTagDefinitionFactory.TryReadNodeId, now.Session → .Contracts).ContractsIsDependencyLightTestspins it from both directions (Contracts manifest names noOpc.Ua*;.Session's must — so "none anywhere" cannot read as a pass), falsified red before trust.
2026-08-09 — G-7 closed; RawBrowseModal race ported
The two items §0.1 flagged as "highest-leverage runnable from here", executed in parallel by two
isolated-worktree agents and merged (0739f4b9 RawBrowseModal, 0695f682 G-7). Consolidated
verification ran on the merged tree, not just each branch: full-solution build clean; AdminUI.Tests
1127, ControlPlane.Tests 260, MTConnect 534, Sql 363, OpcUaClient 141, Calculation 23 — all green.
- G-7 — the load-bearing design choice is that all four new
Inspects wrap the runtime parse rather than mirroring the AdminUI model: Sql wraps the pre-existingSqlEquipmentTagParser; the MTConnect (MTConnectDriver.TryReadRawTag), OpcUaClient (NamespaceMap's private node-id reader) and Calculation blob readers were moved into their Contracts assemblies and the drivers now call them — so "the deploy gate is never stricter than the runtime" is structural, not a convention that can drift. Two deliberate narrowings: Calculation'sInspectdoes not flag a trigger-less tag or a sub-50 ms timer even though the AdminUI editor refuses both, because the runtime accepts both andTagConfigValidationMode.Errorturns warnings into deploy blockers (pinned by a falsification control); and Galaxy stays unmapped on both gates, symmetrically.Driver.Calculation.Contractsis a new project. ControlPlane now pulls the OPC UA client stack transitively via OpcUaClient.Contracts — assessed: every host loading ControlPlane already carries it. - Found en route, left open (the reverse of G-7):
MTConnectTagConfigModelreadsdataTypeleniently — a misspelled enum name is accepted at authoring and silently rewritten toString, while the strict runtime parse rejects it. Authoring weaker than runtime. Documented inline inTagConfigAuthoringDeployParityTests; worth a tracker issue when one is next filed. - RawBrowseModal — the sibling
_openGenerationport needed two extensions the siblings did not: generation-guarding thecatchand thefinally(this modal resolves insidetry/finally, so a stalereturnstill runs the tail and would clobber the LIVE open's state). Each of the four guards is pinned by its own test — per-guard reverts produced exactly 1-failed/3-passed each time.
2026-08-08 — R2-10 closed by fixing the structural gap (DriverCapability.Initialize)
The 2026-08-07 entry below left R2-10 T10 "still open — structural." The user chose the fix over the
other three options (gate through a different driver / drivers reporting out-of-band / retire the gate),
and the gate then PASSED against the fixed build. Branch feat/wrap-driver-init-in-resilience;
evidence in docs/plans/2026-08-07-adminui-followups-and-live-gates.md §7.
IDriver.InitializeAsyncnow routes through the invoker asDriverCapability.Initialize— the one capability call the pipeline never saw, which is why a dead endpoint produced a quiet panel. No pipeline retry (the actor'sRetryConnecttimer is the retry loop; parser-enforced), and breaker threshold 2 — at the 10 s reconnect cadence at most three attempts fit the 30 s sampling window, so the Read-sized 5 could literally never open. That threshold arithmetic is the load-bearing detail and is pinned by its own test.- Live:
rtu-gateagainst dead:5021→ breaker OPEN on both centrals + the red panel chip; socat forwarder up → both breakers closed within 1 s, panel cleared. HealthyMAIN-modbus: zero breaker events (control). Bonus: a config-invalid OpcUaClient driver also now trips — equally invisible before. - Companion fix found by asking "what clears the flag": a respawn (
Create) nowInvalidates the instance's tracker snapshots along with its pipelines — a deploy mid-outage discards the only breaker whoseOnClosedcould clear the OPEN flag, so the old behaviour would have stranded a false OPEN chip forever. Unreachable until this change made breaker-open reachable at all. - Two honest narrowings of the original T10 wording: "both-replica chips" = both trackers (one
active AdminUI — Traefik's
/health/activedeliberately 503s the standby, discovered fighting the sticky cookie); the staleness-dim leg was not exercised (needs every publisher for a key to stop).
2026-08-07 — adminui-followups closed by audit; three of four runnable gates PASSED
Took the two items §0.1 named as the remaining untracked engineering. Full evidence:
docs/plans/2026-08-07-adminui-followups-and-live-gates.md.
2026-05-29-adminui-followups— CLOSED, no code written. §0.1 called it "the only substantial engineering left"; the overlap audit it demanded shows all 19 tasks shipped, superseded, or moot. The lesson is the one this register keeps re-learning: a.tasks.jsonis not evidence. The plan's premise had also expired — WS1 assumed driver-embedded tag lists are the runtime source of truth, which v3 ended. Supersession claims were checked for reachability (TagConfigEditorMapis dispatched fromRawTagModal.razor:79), because "superseded by X" where X is dead surface is this repo's signature failure.- R2-03 T11 ✅ / T12 ✅. Both blockers the previous pass recorded are gone — the Modbus fixture is
now reachable from inside the rig. The trip had to be staged without a deployment (flip a
register on the fixture) because a deploy creates a fresh VT child with no last value, which is
correct-by-design and had masked the result twice.
⚠️ Finding: "Bad carrying the last-known value" is unobservable by any client — subscription
and raw Read both return NULL. The actor is right; no test asserted that half, so one was added
(
The_Bad_result_carries_the_last_known_value). The documentation is what is wrong. - R2-10 T10 ❌ still open — recorded cause was wrong. Not retry throttling. The dead-endpoint
failure mode never enters the resilience pipeline:
InitializeAsyncis not invoker-wrapped andModbusDriverswallows per-tag failures in both directions. Operator consequence: the panel reads "All targets healthy." for a driver timing out every read against a blackhole. - driver-reconfigure Task 3 ✅ — corrected config adopted while faulted,
RestartCount=0. - Method note: the rig image was 3 h older than the last code commit. Rebuilt, then asserted image parity per container and that the specific symbols under test were in the shipped DLLs.
2026-08-05 — MTConnect write-back; the MQTT closure records reconciled
Recorded from branch feature/mqtt-mtconnect-write. This is exactly the drift shape the 2026-08-04
entry named — work that closes an item elsewhere leaves the register asserting the item is open —
so it is written back here in the same change as the work.
§1.1 corrected on two rows. IWritable is no longer absent from four drivers; after this branch
it is absent from Sql and Calculation only, and in both that is still structural.
| Driver | Gained IWritable |
Commit | Shape |
|---|---|---|---|
| MQTT / Sparkplug B | 2026-07-31 (#508, live-gated) | 72be1922 |
Plain writeTopic publish + Sparkplug NCMD/DCMD |
| MTConnect | 2026-08-05 | b29623cf |
Observation injection through the Agent's optional AllowPut surface — off by default at two independent gates (Write.Enabled and the Agent's own AllowPut), CONDITION items refused |
⚠️ MTConnect write-back is not a machine command, and the register should not be read as saying the
driver can now command a CNC. A write sets what the Agent reports for a DataItem; the next
adapter/SHDR update overwrites it. MTConnect Interfaces — the mechanism the original deferral
(2026-07-15-mtconnect-driver-design.md §3.6) assumed write-back would need — remains deferred, and
§3.6 now carries a superseded note saying so. Design:
docs/plans/2026-08-05-mtconnect-writeback-design.md.
⚠️ It also does not make any existing node writable. The OPC UA CurrentWrite bit is composed from
the authored Tag.AccessLevel alone; driver capability is never consulted at compose time. An operator
must author the raw tag ReadWrite. Browse's new Operate stamp on writable leaves is honest
labelling only — nothing persists SecurityClass.
§2's eight MQTT rows (#508–#515) marked ✅ in place with the commit that resolved each (72be1922,
7f53bd96, 7f2108dc, c74ccc55), following the register's existing convention. Their evidence
columns are left as the audit snapshot — #508's MqttDriver.cs:66 — no IWritable in particular is now
false of the tree, and is annotated as such rather than rewritten.
Docs reconciled in the same change (they contradicted the code, and each other):
docs/drivers/MTConnect.md (capability surface, new §Write-back, Deferred, the DeviceName
double-duty note), docs/drivers/Mqtt.md (deleted the #514 "empty tree cannot arm a rebirth" known-gap
block and the "Read-only. No writes reach the broker" operational note — both contradicted by that
file's own closure line), and docs/plans/2026-07-24-driver-expansion-tracking.md (P2 gap bullets +
§Next actions, which still listed MQTT P3 and both browse gaps as remaining work).
§1–§8 generated 2026-07-27 against master @ 90bdaa44 by five parallel source-verification agents.
Every path:line reference was read from source. Items marked CANNOT VERIFY require hardware, a
VPN'd gateway, or a live rig and are listed as unproven rather than assumed.
Remediated 2026-07-27/28 (merge 914d70bf), 2026-07-30 (merge 2a0461a1), and reconciled against the
tracker + docs/plans/ on 2026-08-04 at 4bdce910. §9 is the execution record and the live status —
where §1–§8 and §9 disagree, §9 is current. Path/line references in §1–§8 are as at 90bdaa44 and
several no longer resolve, by design: the code they pointed at was deleted.
⚠️ Counts in this file go stale silently. Three rounds running, the register's own bookkeeping was
what broke. Before trusting any number here — open issues, pending tasks, unreviewed modules — re-derive
it: curl the tracker API, parse docs/plans/*.tasks.json, list code-reviews/. Each is one command,
and each has caught this file being wrong.