Joseph Doherty
fcd36bd53d
STATUS.md + 05 plan banner: crit3 branch 25c0c6f6, IS7Plc seam + lazy reconnect,
4 unit guards + full S7 suite, LIVE snap7 container-bounce proof (recovers with no
redeploy). Next: Critical 4 (TwinCAT ADS re-registration, unit-only — no TC3 fixture).
5.6 KiB
5.6 KiB
Arch-Review Remediation — Status & Handoff
Snapshot: 2026-07-08 · Review baseline: master 9cad9ed0 · this file is the single source of
truth for remediation progress. Update it as work lands.
Branch topology (all LOCAL — nothing pushed, nothing on master)
| Branch | Head | Contains |
|---|---|---|
master |
9cad9ed0 |
untouched baseline |
docs/archreview-plans-and-drift-fixes |
9fadead6 |
the 7 domain plans + 00-INDEX.md + this STATUS.md + the two CLAUDE.md doc-drift fixes. (the plans live ONLY here) |
fix/archreview-crit1-split-brain-resolver |
a81dea10 |
Critical 1 (03/S1) activation + guard test + Redundancy.md |
fix/archreview-crit2-vt-timeout |
7fd44f0f |
Critical 2 (02/U2 + 02/U3) + tests |
fix/archreview-crit3-s7-reconnect |
25c0c6f6 |
Critical 3 (05/STAB-1) IS7Plc seam + lazy reconnect + unit guards + live bounce test |
Decision (user): one branch per Critical, each off master. The plans are only on the docs branch,
so from a critical branch read them via git show docs/archreview-plans-and-drift-fixes:archreview/plans/0X-<name>.md.
Completed
| Item | Finding | Branch @ commit | Verification |
|---|---|---|---|
| Critical 1 — split-brain resolver activated | 03/S1 | fix/archreview-crit1-split-brain-resolver a81dea10 |
BuildClusterOptions sets KeepOldestOption{DownIfAlone=true}; 3 unit guards (Cluster.Tests 29/29); e2e-verified the resolved ActorSystem config carries SplitBrainResolverProvider + stable-after=15s survives the HOCON/Hosting merge (throwaway spike, removed). HOCON cross-ref comment + Redundancy.md corrected. |
| Critical 2a — real VT script timeout | 02/U2 | fix/archreview-crit2-vt-timeout 7fd44f0f |
Routes through TimedScriptEvaluator; infinite-loop test (bounded by WaitAsync) proves no hang. Host.Integration VT 18/18. |
| Critical 2b — ALC-safe compile cache | 02/U3 | same 7fd44f0f |
Swapped raw dict → CompiledScriptCache; new IScriptCacheOwner seam; apply-boundary clear in VirtualTagHostActor; wiring guard test. Runtime VT 12/12. |
| Doc drift — KNOWN LIMITATION 2 stale | 03/U1 = 06/U-1 | docs/… 9fadead6 (CLAUDE.md) |
historized-ref feed IS wired; rewrote to "value-capture code-complete, live-verify pending". |
| Doc drift — ScriptAnalysis policy | theme #5 | same 9fadead6 (CLAUDE.md) |
corrected FleetAdmin → Administrator,Designer roles. |
| Critical 3 — S7 lazy reconnect | 05/STAB-1 | fix/archreview-crit3-s7-reconnect 25c0c6f6 |
New IS7Plc/IS7PlcFactory seam + EnsureConnectedAsync (dispose-dead-handle → reopen on next data call); connection-fatal faults (socket/ErrorCode.ConnectionError) mark the handle dead, data-address errors do NOT; probe loop routes through it as a backstop. 4 unit guards + full S7 suite 234/234; LIVE-verified against real python-snap7 — bounced the container (docker restart), driver observed the outage and resumed Good reads with no redeploy (S7_1500ReconnectTests, double-gated on sim + S7_RECONNECT_BOUNCE_CMD). Also closes the S7 TEST-1 gap. |
Task list (TaskCreate IDs)
| # | Task | Status |
|---|---|---|
| 1 | Critical 1 — split-brain resolver | ✅ completed |
| 2 | Critical 2a — VT timeout | ✅ completed |
| 3 | Critical 2b — CompiledScriptCache | ✅ completed |
| 4 | Critical 3 — S7 reconnect (05/STAB-1) | ✅ completed |
| 5 | Critical 4 — TwinCAT ADS re-registration (05/STAB-2) | ⬜ pending |
| 6 | Guard — DeferredAddressSpaceSink reflection forwarding test (03/U2) | ⬜ pending — must precede 03/P1 surgical-adds + any new sink capability |
| 7 | Guard — wire OTOPCUA0001 analyzer + triage (07/C-1) | ⬜ pending — triage before Warning severity; C-1 triage → C-2 |
| 8 | Guard — CI to all unit suites + fail-on-skip (07/S-1,S-2, pair S-4) | ⬜ pending |
| 9 | Critical 1 follow-up — hard-kill failover integration test (03/S1) | ⬜ pending — the effort-M harness half; activation itself is done+verified |
Suggested next (from 00-INDEX execution order)
- Critical 4 (05/STAB-2) — TwinCAT ADS notification re-registration after reconnect. Store a
replayable registration intent (symbol/type/bitIndex/interval/onChange) per subscribed tag and replay
it on client swap; the fake
ITwinCATClientFactory/ITwinCATClientalready exist, so aTwinCATReconnectReplayTestscan be deterministic. No TwinCAT docker fixture exists (13 integration tests need a real TC3 target), so unit-only — no live gate available like S7 had. New branch off master. (Critical 3 (05/STAB-1) DONE — see Completed table, LIVE-verified against real snap7.) - Systemic guards — task 7 (analyzer) then task 8 (CI); task 6 (forwarding test) before any P1/P2 work.
- Failure-visibility Highs — 01/S-1 (AddressSpaceApplyOutcome failure field), 06/S-1 (Galaxy fail-closed), 03/S4 (primary-gate default-deny).
Key resume facts
- Verification bar met so far: each fix has a deterministic unit guard AND (for SBR) an end-to-end config-resolution check. Follow the same pattern — the review's whole thesis is "unit-green ≠ wired".
- The forwarding-test guard (task 6) is load-bearing: 03/P1 (surgical pure-adds) and 02/P-… batch-write
each add new sink capability methods that ship inert unless forwarded through
DeferredAddressSpaceSink(F10b/PR#423 precedent). Land task 6 first. - Nothing is pushed. When the user asks to integrate: PR each
fix/archreview-crit*branch; the docs branch can merge first (plans + doc fixes are low-risk). - Plans are on the docs branch only — see topology note above for cross-branch reads.