dohertj2/mxaccessgw
1
0
Fork 0
Code Issues 14 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix(alarms): atomic snapshot+truncation read; direct tests for the flag plumbing (review)

Browse Source 
Review found AlarmDispatcher.SnapshotActiveAlarms reading the snapshot and the
truncation verdict through two independent lock acquisitions, defended by a
comment claiming read-order made a race "widen only, never narrow". That claim
was false: a not-truncated -> truncated poll landing between the two reads pairs
a stale false with a capped snapshot, which is exactly the false all-clear the
feature exists to prevent. It was safe only because AlarmCommandHandler
STA-serializes consumer calls — an accident of the call graph, not an invariant.

Made the invariant structural instead of documented. IMxAccessAlarmConsumer now
exposes ONE accessor, `IReadOnlyList<MxAlarmSnapshotRecord> SnapshotActiveAlarms(
out bool truncated)`, which implementations must satisfy from a single
acquisition of the lock guarding the retained snapshot — mirroring the write
side, where FoldFetch already updates snapshot and verdict together. The
separate LastSnapshotTruncated property is gone from every layer, so there is no
second read left to pair badly. `out` over a result struct follows the file's
established idiom (FoldFetch, ParseSnapshotXml).

The same threading applies one level up: IAlarmCommandHandler.QueryActive now
carries `out bool snapshotTruncated`, so MxAccessCommandExecutor stamps the reply
payload from the value the records were stamped with rather than reading the
state a second time.

Direct tests for the three hops that were only covered end-to-end:
- AlarmDispatcherTests: truncated consumer snapshot stamps FromTruncatedSnapshot
  on every mapped record, with a complete-snapshot control, plus an assertion
  that the independent per-record Degraded flag is not dragged along.
- AlarmCommandHandlerTests: the verdict delegates through the dispatcher
  (Theory over both values), and survives a prefix filter that removes every
  record — the case the per-record flag cannot cover.
- AlarmCommandExecutorTests: the reply payload's SnapshotTruncated comes from the
  handler (Theory over both values), including the zero-record case.
The WnWrapAlarmConsumer truncation tests now assert through
SnapshotActiveAlarms(out ...) rather than an internal field, because the pairing
is the contract.

Also: GatewayAlarmMonitor's _snapshotTruncated comment now says "as of the last
full reconcile" rather than implying it tracks the current _alarms contents,
which live transitions keep moving via ApplyTransition between passes.

Detection heuristic still untouched (fetchedRecordCount >= maxAlarmsPerFetch);
no @COUNT parsing, per docs/AlarmProbeFindings.md. Still additive gateway
metadata about our fetch mechanics, not MXAccess behavior — not a parity
deviation, and no event is synthesized.

Gateway: NonWindows.slnx builds clean (0 warnings); ~Alarm filter 107/107 pass.
Worker + Worker.Tests are windev-gated; the signature change was reviewed by
inspection across all 7 IMxAccessAlarmConsumer implementers, all 3
IAlarmCommandHandler implementers, and every call site.
This commit is contained in:
Joseph Doherty
2026-08-17 04:39:33 -04:00
parent 7ec0b3594c
commit b9fb0dd720
18 changed files with 376 additions and 154 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/WnWrapAlarmConsumerXmlTests.cs
+33 -14
View File
@@ -691,23 +691,29 @@ public sealed class WnWrapAlarmConsumerXmlTests
// -------------------------------------------------------------------------
// Degraded-status signal. The truncation guard above keeps a capped fetch
// from broadcasting phantom Clears, but it does so silently: the retained
// snapshot simply stops shrinking. LastSnapshotTruncated is what makes that
// suppression visible to the QueryActiveAlarms reply and, through it, the
// dashboard banner — so its set/reset behaviour is the contract, not detail.
// snapshot simply stops shrinking. The truncation verdict SnapshotActiveAlarms
// hands back alongside the records is what makes that suppression visible to
// the QueryActiveAlarms reply and, through it, the dashboard banner — so its
// set/reset behaviour is the contract, not detail.
//
// These assert through SnapshotActiveAlarms(out ...) rather than any internal
// field, because the pairing IS the contract: records and verdict must come
// out of one call, produced under one lock acquisition.
// -------------------------------------------------------------------------
/// <summary>
/// A capped fetch sets the retained truncation verdict. Without this the
/// signal never leaves the consumer and the reply builder stamps a
/// complete-looking snapshot over a capped one.
/// A capped fetch sets the truncation verdict handed out with the
/// snapshot. Without this the signal never leaves the consumer and the
/// reply builder stamps a complete-looking snapshot over a capped one.
/// </summary>
[Fact]
public void FoldFetch_WhenFetchTruncated_SetsLastSnapshotTruncated()
public void SnapshotActiveAlarms_AfterTruncatedFetch_ReportsTruncated()
{
const int Cap = 8;
using WnWrapAlarmConsumer consumer = new WnWrapAlarmConsumer(Cap);
Assert.False(consumer.LastSnapshotTruncated);
consumer.SnapshotActiveAlarms(out bool truncatedBeforeAnyFetch);
Assert.False(truncatedBeforeAnyFetch);
Dictionary<Guid, MxAlarmSnapshotRecord> next =
WnWrapAlarmConsumer.ParseSnapshotXml(BuildAlarmXml(Cap), out int fetchedRecordCount);
@@ -715,8 +721,14 @@ public sealed class WnWrapAlarmConsumerXmlTests
consumer.FoldFetch(next, truncated: true, out int retainedCount);
Assert.True(consumer.LastSnapshotTruncated);
IReadOnlyList<MxAlarmSnapshotRecord> snapshot =
consumer.SnapshotActiveAlarms(out bool truncated);
Assert.True(truncated);
Assert.Equal(Cap, retainedCount);
// The verdict describes THIS set — assert they arrive together, not just
// that the boolean flipped somewhere.
Assert.Equal(Cap, snapshot.Count);
}
/// <summary>
@@ -727,7 +739,7 @@ public sealed class WnWrapAlarmConsumerXmlTests
/// it — the opposite of what the signal is for.
/// </summary>
[Fact]
public void FoldFetch_AfterTruncatedFetch_SubCapFetchClearsLastSnapshotTruncated()
public void SnapshotActiveAlarms_AfterSubCapFetchFollowingTruncation_ReportsComplete()
{
const int Cap = 8;
using WnWrapAlarmConsumer consumer = new WnWrapAlarmConsumer(Cap);
@@ -735,7 +747,8 @@ public sealed class WnWrapAlarmConsumerXmlTests
Dictionary<Guid, MxAlarmSnapshotRecord> capped =
WnWrapAlarmConsumer.ParseSnapshotXml(BuildAlarmXml(Cap), out _);
consumer.FoldFetch(capped, truncated: true, out _);
Assert.True(consumer.LastSnapshotTruncated);
consumer.SnapshotActiveAlarms(out bool truncatedAfterCappedFetch);
Assert.True(truncatedAfterCappedFetch);
Dictionary<Guid, MxAlarmSnapshotRecord> complete =
WnWrapAlarmConsumer.ParseSnapshotXml(BuildAlarmXml(Cap - 1), out int fetchedRecordCount);
@@ -743,11 +756,15 @@ public sealed class WnWrapAlarmConsumerXmlTests
consumer.FoldFetch(complete, truncated: false, out int retainedCount);
Assert.False(consumer.LastSnapshotTruncated);
IReadOnlyList<MxAlarmSnapshotRecord> snapshot =
consumer.SnapshotActiveAlarms(out bool truncated);
Assert.False(truncated);
// The complete fetch also replaced the snapshot wholesale, which is what
// makes it authoritative about absence — pinned here so a future change
// cannot clear the verdict while keeping the merge semantics.
Assert.Equal(Cap - 1, retainedCount);
Assert.Equal(Cap - 1, snapshot.Count);
}
/// <summary>
@@ -756,7 +773,7 @@ public sealed class WnWrapAlarmConsumerXmlTests
/// still see the caveat.
/// </summary>
[Fact]
public void FoldFetch_WithConsecutiveTruncatedFetches_KeepsLastSnapshotTruncatedSet()
public void SnapshotActiveAlarms_WithConsecutiveTruncatedFetches_KeepsReportingTruncated()
{
const int Cap = 8;
using WnWrapAlarmConsumer consumer = new WnWrapAlarmConsumer(Cap);
@@ -766,7 +783,9 @@ public sealed class WnWrapAlarmConsumerXmlTests
Dictionary<Guid, MxAlarmSnapshotRecord> capped =
WnWrapAlarmConsumer.ParseSnapshotXml(BuildAlarmXml(Cap), out _);
consumer.FoldFetch(capped, truncated: true, out _);
Assert.True(consumer.LastSnapshotTruncated);
consumer.SnapshotActiveAlarms(out bool truncated);
Assert.True(truncated);
}
}