[marcschier]

Description

Bound managed-session recovery, preserve Publish workers and recovery ownership, and address the client, server, transport, and certificate audit findings and subsequent concurrency review. Also reduce the memory retained by exhaustive session-test diagnostics.

Recovery and Publish ownership

• Add ManagedSessionOptions.ChannelReconnectTimeout through direct construction, the fluent builder, and DI. The automatic duration is max(3 * KeepAliveInterval, revised SessionTimeout, OperationTimeout), sampled at cycle start. Positive overrides are supported; Timeout.InfiniteTimeSpan explicitly opts out. Raw sessions retain their unlimited default.
• Add CreateReconnectBudget(TimeProvider) as a required IReconnectParticipant member, as agreed in review. Custom participants implement it and may return null for no participant-specific bound.
• Enforce the earliest participant/caller deadline through transport reconnect, activation/recreation, and subscription restoration. Late callers can shorten an active cycle but cannot extend it.
• Cancel and unwind recovery, fence late responses, and release channel recovery ownership before the existing Faulted event hands control to the outer reconnect/failover policy. Preserve session recreate admission through final Publish cleanup and keepalive suppression until shared recovery is complete.
• Treat participant budget creation/evaluation failures, including exceptions at the exact deadline, as terminal shared-recovery failures. Notify participants before exposing Faulted, preserve the original diagnostic, and never silently replace a finite budget with unlimited recovery.
• Keep caller-supplied replacement channels, managed bindings, wrapper event subscriptions, and recovery-owner identities consistent across success, failure, and cancellation. Reject replacement during active recovery and fence retired callbacks so they cannot clear newer ownership or suppress later keepalive recovery.
• Retain eligible Publish workers through temporary subscription-identifier clearing without retaining workers for never-created or removed subscriptions. Preserve cancellation, acknowledgement rollback, and drain-before-replacement ordering.
• Coordinate automatic subscription updates with session recovery: cancel admitted updates, keep them paused across a failed-restoration handoff, and retry only after explicit restoration completes. This prevents competing CreateSubscription requests and updates against a retiring session, while preserving manual recreation, transfer fallback, and pending option changes.
• Exercise the real ManagedSession, V2 subscription engine, and channel ready gate with scripted transports and an injected clock. Cover transfer fallback, deadline handoff, late completions, and resumed notification delivery.

Audit and review corrections

• Correct certificate/trust-list transactions, change-pump lifetimes, validation, peer revalidation, and reset/resource ownership.
• Harden node admission, attribute/range/dimension validation, monitored-item sampling and lifecycle transitions, event fanout, and server shutdown. Run lifecycle readiness and compensation outside shared monitored-item admission, with stale-completion ownership checks.
• Close synchronous node-manager admission before teardown and retain resources until admitted service, lifecycle, and asynchronous method work returns. Dispose the monitored-item manager outside both locks, reject late calls before they can reach it, and forward asynchronous disposal through the adapter so the master awaits the same completion. Preserve reentrant shutdown initiation, cancellation/failure unwinding, and shared cleanup-failure reporting.
• Bound WSS pending-request retention using connection-local wire handles while preserving caller-visible request handles and translating Cancel targets. Safely ignore retired replies and drain admitted send/close users before resource disposal.
• Clarify that the shared ClientBase caller-handle sequence is distinct from the non-wrapping WSS wire allocator. Existing exhaustion/reopen, late-reply, and Cancel-translation regressions verify the connection-local contract; no allocator behavior was changed by this clarification.
• Preserve virtual-node validation and resolver service errors instead of converting them to cached misses. A mismatched NodeId reports BadNodeIdInvalid; callback type mismatches and resolver service errors keep their exact status. Per-item boundaries preserve unaffected reads, writes, history operations, method calls, browse paths, and monitored-item creation/restoration, including permission-validation paths. Caller cancellation still propagates; stored-item validation failures are logged without aborting later restores.
• Correct client file/role/state-machine/streaming APIs, node-cache behavior, redundancy/failover ownership, and session configuration/identity handling.
• Cancel each owned peer-discovery scope before disposing it, including when the bounded wait wins a cancellation-delivery race. Keep late results out of the endpoint cache and preserve single-flight lookup ownership.
• Keep materialized alias Browse results synchronized with the live store by default, preserving explicit startup-only opt-out. Apply HistoryUpdate service results per value while retaining explicit all-or-nothing provider APIs.
• Update the directly related feature documentation and add focused positive, negative, concurrency, and ownership regressions.

Latest review-feedback corrections

• Fence stale failed lease observations with a successful-confirmation generation distinct from the revocation epoch. Snapshot it before each store read, including failed-CAS revalidation, so an old failure cannot revoke or reschedule a newer lease while fresh ownership loss still revokes leadership. Preserve independent overlapping acquisitions, expiry, disposal, and late-success protections.
• Isolate attributable WSS response-decoding errors to their request, including retired handles. Keep admitted socket sends connection-owned so caller timeout/cancellation cannot abort sibling requests; shutdown still cancels and drains those sends.
• Restart keepalive and classic Publish replenishment after successful session reuse. Retire V2 worker demand after intentional deletion/disable without confusing that state with temporary recovery resets.
• Browse virtual directories lazily across continuation pages without the 1,024-entry snapshot cap. Preserve active-page cancellation, bounded metadata retention, pushback, and exactly-once asynchronous cursor cleanup.
• Apply certificate/CRL staging in last-operation order, preflight required issuer storage before writes, select actual policy-compatible RSA keys for None endpoints, frame certificate chains independently of signature OIDs, and preserve admitted validation results during rejected-writer shutdown.
• Preserve base asynchronous disposal when a legacy override omits its base call; avoid double derived disposal in the adapter. Let genuinely admitted nested work finish while rejecting stale captured contexts and returning null from closed lookup APIs.
• Re-park recovered monitored items if AddNodes rolls back. Give event compensation a fresh finite deadline, and preserve healthy Browse/Translate siblings at every reference/path boundary while retaining starting-node errors and caller cancellation.
• Give final reconnect notifications a live, bounded shutdown-linked lifetime. Synchronize child state before parent lifecycle handlers outside the parent transition lock.
• Document the accepted existing policies: direct reverse connections are single-use without a ReverseConnectManager, and multi-node stream capacity is shared rather than reserved per node.

The expanded readiness controls also exposed a real generation-handoff race: an old source could finish draining after activation was deferred but before readiness tasks were collected, causing the wanted replacement to be omitted from the wait set. A deterministic test gates that exact interval; the fix keeps the replacement in the readiness wait. The original race passed 200 repetitions after the fix. A separate control now awaits both producer readiness and iterator entry under the same original deadline, rather than treating those independent signals as equivalent. Temporary logging and repetition are removed.

CI integration contracts

The History and Server CI failures exposed integration tests that still asserted the behavior intentionally changed by the audit fixes. A Windows WoT negative test raced its caller deadline against upstream retries. A subsequent Ubuntu Client failure exposed a real automatic-update versus explicit-restoration race:

• History insertion collisions now verify exact per-value statuses and all persisted timestamps/values, including preservation of the existing conflicting entry. Explicit atomic-provider rollback controls remain.
• Alias materialization tests wait for actual publication and verify the added node plus forward/inverse AliasFor references, instead of racing a startup-only snapshot expectation. Explicit refresh opt-out controls remain.
• The unavailable-upstream WoT test uses an explicit finite retry policy through existing DI configuration, preserving its original four-minute guard and requiring a mapped-value service error before caller cancellation. Production retry defaults remain unchanged.
• The Client fix retains the exact one-create and late-response assertions. Three deterministic real-subscription/real-manager cases cover paused creation, disposal while paused, and cancellation of an admitted create followed by explicit restoration and a pending option update. Both composed restoration-deadline cases also prove automatic updates stay blocked at the outer handoff and resume after restoration.
• The merged-head net48 correction prevents lost peer-resolver cancellation and distinguishes the harness's delayed initial Connected event from actual outer recovery completion. A deterministic timer-order test covers both cooperative and cancellation-ignoring resolvers, cancellation before return, rejection of late cached results, and a fresh subsequent lookup.
• The remaining CodeQL alert was a false content flow through ArrayOf.Count into an integer-only trust-list summary. Projecting the same count through Span.Length keeps cardinality distinct from serialized contents without allocating, dropping diagnostics, suppressing the rule, or dismissing the alert. Five log-contract cases cover null/empty/nonempty results and mixed chain-capable/fallback listeners, asserting the exact count, message, and structured properties.
• Classic transfer acknowledges messages selected for asynchronous Republish only after their responses arrive. The existing locked replay-selection decision returns the immediate-acknowledgement subset to Session, preserving the public transfer API, advertised availability, and immediate acknowledgement of older gapped messages not selected for replay. A callback changing RepublishAfterTransfer cannot change the already-selected acknowledgement ownership.
• Transfer integration tests explicitly control acknowledged versus retained origin messages. Exact assertions distinguish retained replay from requested fresh initial values by sequence number, client handles, values, status, and source timestamp. Atomic counters, observed delivery/keepalive progress, and failure-safe session/file cleanup replace timing assumptions and racy resets.
• Server lifecycle tests verify the documented independent five-second compensation deadline rather than requiring a non-cancellable token. They cancel the actual request, prove compensation and unrelated monitored-item creation still proceed one tick before the deadline, preserve the original failure and ownership assertions, and verify the completed deadline is retired.
• Synchronous and asynchronous directory-browser tests require the exact provider exception instead of an empty-directory success, then verify the failed cursor is not enumerated again. These correct expectations left behind by the intentional, documented provider-error propagation change; production behavior is unchanged.

No tests were disabled, assertions loosened, coverage thresholds lowered, or CI checks made optional. Existing platform exclusions and Explicit debug variants remain.

Related Issues

• Fixes Bound the keep-alive suppression window so a stuck channel-manager reconnect hands over to the outer state machine #4514
• Fixes Add a fault-on-demand transport harness and an end-to-end recreate regression test for the #4508 circular wait #4515
• Builds on merged Fix audit findings and review regressions across the OPC UA stack #4503 and retains the V2 subscription recreate deadlocks against a faulted transport #4508 publishing-drain behavior.

Validation

Lease-election review correction (a13afa641182c70983e16bbcfebf507e666a45a5):

The correction is based on the existing upstream merge
43079e2b851fe338a4082066f8d14abfdafb6e32. Three deterministic stale-verdict
cases fail on the original source and pass with separate confirmation fencing.
Six new cases cover the initial foreign-owner verdict, failed-CAS revalidation
in both invocation orders, and fresh ownership loss through both read paths,
including revalidation begun after another successful confirmation.

Target and configuration	Passed	Failed	Skipped
net10.0 Debug	120	0	0
net48 Debug	120	0	0

The selection is the full Opc.Ua.Core.Tests.Redundancy namespace, including
all 38 SharedStoreLeaseElectionTests cases and the existing expiry, clock
rollback, disposal, and overlapping-success regressions. New witnesses are
StaleForeignLeaseReadDoesNotRevokeNewerAcquisitionAsync,
StaleFailedRevalidationDoesNotRevokeNewerAcquisitionAsync, and
FreshForeignLeaseObservationRevokesLeadershipAsync. They assert resulting
leadership, exact transitions, independent progress, and the unchanged expiry
boundary. Retaining the initial generation for the fallback read independently
makes the fresh-loss-after-confirmation control fail; that mutation was removed
before the final rebuilt runs.

The successful scoped command is
dotnet test tests\Opc.Ua.Core.Tests\Opc.Ua.Core.Tests.csproj -c Debug --no-restore --filter "FullyQualifiedName~Opc.Ua.Core.Tests.Redundancy",
with CustomTestTarget and -f matching each row and that framework's assets
restored. Both changed C# files pass formatting and analyzers through
informational severity on both frameworks. These are scoped results, not a
full-solution test or measured coverage-delta claim. CI monitoring is paused
for this feedback-only operation; no current-head CI success is claimed.

Latest CI contract correction (1cd1f2047bb5b50c9bf300b1ff710b0b2e935a29):

All four failing Server shard 23 jobs in
run 36120946740
reported the same six cases. Two local replays reproduced all six failures.
The source changes and documentation from cd43b831a establish both intentional
contracts: independent bounded event compensation and surfaced provider errors.
Only the two test files are corrected; production code and CI policy are unchanged.

Target and configuration	Passed	Failed	Skipped
net48 Debug	113	0	0
net10.0 Release, CI Coverlet settings	113	0	0

The selection contains MonitoredItemManagerLifecycleTests,
DirectoryObjectStateTests, DirectoryBrowserBoundedEnumerationTests, and
EventCompensationReadinessHasFiniteDeadlineWithInfiniteSourceTimeoutAsync.
Both changed files pass formatting and analyzers through informational severity
on both frameworks. Independent mutations restoring a non-cancellable
compensation token and swallowing provider errors fail all four lifecycle
cases and both browser cases, respectively. Both mutations were removed before
the final passing runs and commit.

The scoped command is dotnet test tests\Opc.Ua.Server.Tests\Opc.Ua.Server.Tests.csproj
with CustomTestTarget and -f set to the selected framework, --no-restore, and
--filter "FullyQualifiedName~MonitoredItemManagerLifecycleTests|FullyQualifiedName~DirectoryObjectStateTests|FullyQualifiedName~DirectoryBrowserBoundedEnumerationTests|FullyQualifiedName~EventCompensationReadinessHasFiniteDeadlineWithInfiniteSourceTimeoutAsync".
The modern run additionally uses -c Release /p:CollectCoverage=true --collect "XPlat Code Coverage" --settings tests\coverlet.runsettings.xml.
These are scoped results, not a full-solution test or measured coverage-delta claim.
Hosted checks for that commit were pending at publication. The fail-fast CI
watch was stopped when the requested operation switched to review feedback;
no current-head CI success is claimed.

Earlier master merge (8b15ea6ef9fc2214ac8ec886f373bb3846dd6d6f, base b4136d8e9bab0df680f41d9ef985f519160534b1):

The TcpListenerChannel conflict preserves both lifetime responsibilities:
disposal clears the retained peer-certificate chain and unregisters the
quota-scoped message-assembly scheduler. Both fields and all upstream deadline
handling remain intact. The only additional manual source adjustment adds the
parentheses required by the existing analyzer around the session-count fallback.

Master advanced during validation. The initial transport merge
80303c434ce813cf75aa7fe54a6a32fe2aeafc30 was retained, and the newer base was
merged normally in 8b15ea6ef9fc2214ac8ec886f373bb3846dd6d6f, without rewriting
history. The additional recovery, fluent-pipeline, and test-framework overlaps
were inspected; the branch's cancellation, validation-error, and acknowledgement
ownership fixes remain alongside the upstream changes.

Full UA.slnx builds passed on net10.0 and net48 with 0 warnings and 0 errors.
The final scoped tests rebuilt against the committed tree
2074f8efcb61d8d9c6106e7d6f76ee941940e358:

Target	Passed	Failed	Skipped
net10.0	2,653	0	0
net48	2,529	0	7

The net48 skips are existing platform exclusions: six RSA_DH_AesGcm nonce cases
and one ClientWebSocket certificate-validation case requiring .NET 7 or later.
The selection covers transport cleanup, reassembly budgets/deadlines/admission,
peer-chain ownership, server session binding, fluent lifecycles and source
generation, reconnect and keepalive, transfer acknowledgements, Publish queues,
and JSON encoding. Modern-.NET WSS transport and real-server integration cases
also pass. The resolved file passed solution-relative formatting and analyzer
verification through informational severity on both frameworks.

These are scoped test results, not unfiltered full-suite or measured-coverage
claims. Hosted CI was not monitored or repaired as part of this merge-only
operation.

Selected local results below are overlapping validation runs, not distinct-test totals.

Earlier review-feedback batch (cd43b831a8f11de3f7d65c3681712a61e3c669a5):
The final net10.0 scoped selection passed 471 tests, with no failures or skips.
The final net48 solution-root selection passed 439 tests, with no failures and
one unchanged platform skip (ValidateServerCertificateFallsBackToTlsPolicyErrors,
which requires newer ClientWebSocket certificate-validation support).
Both full nonincremental solution builds completed with 0 warnings and 0 errors,
and all 40 changed C# files passed informational-level formatting/analyzer
verification. Both frameworks validated the identical final tracked diff.
The focused matrix covers every one of the 20 current review threads, including
real mid-frame WSS cancellation, stale admission contexts, directory continuation
ownership, multi-element Browse/Translate failures, and the readiness drain race.
The net10.0 solution-root test command has a separate pre-existing runner conflict:
three unrelated AOT projects reject the VSTest target under Microsoft.Testing.Platform
2.4.0 and SDK 10. Per-project net10.0 results are recorded separately; no runner
migration, test exclusion, assertion relaxation, or CI-policy change is included.
These are bounded selections, not unfiltered full-suite or measured coverage claims.
At publication of cd43b831a, hosted CI was not green: the
OPCFoundation.UA-.NETStandard check reported ACTION_REQUIRED, AppVeyor reported
FAILURE, and the two signed-build jobs were in progress. No CI jobs were rerun,
cancelled, approved, or repaired as part of that feedback-only operation.

Classic transfer correction (f425376fca045794122e19aaf9cafebc4a717d91):
The preceding head's
macOS net10.0 shard 25/30
failed TransferSubscriptionTest(DisconnectedRepublish).TransferSubscriptionAsync(True,False)
at the static-node count assertion: expected 10, received 20. The trace contains a successful,
explicitly requested republish of retained sequence 1 and a fresh initial-value batch at sequence 3,
not duplicate dispatch of one response.

Controlled lost origin acknowledgements reproduced that incorrect test expectation on both the
preceding PR head and exact master base a2539cb53dd1666cef856f33812d7a8830d68909.
The maintainer explicitly authorized correcting this existing issue in the PR. Retained replay
and requested initial values are independent, as specified by
OPC UA Part 4, TransferSubscriptions.
The reason that the original hosted run retained its particular origin message remains unproved.

The expanded full-suite run then exposed a real production race, not just a count assertion:
Session queued acknowledgements for all transferred available messages before the asynchronous
Republish responses arrived. Publish could delete those messages first, causing
BadMessageNotAvailable. A gated real-Session/classic-engine regression failed both replay-enabled
cases on the original implementation while both no-replay controls passed. The ownership fix
passes all 24 combinations of empty/consecutive/unsorted-gapped queues, replay preference,
sequential delivery, and a reentrant preference change.

All 40 normal real-server transfer cases pass on both frameworks. Independent mutations
suppressing actual replay and duplicating observed sequence records each fail the intended
assertion; both mutations were removed. The full classic suite passes on both frameworks.
Hosted CI was pending when that correction was published; the earlier failed hosted job was not
rerun for a lucky pass.

Local net48 caveat: the full Client run timed out in the pre-existing fake-clock test
ReconnectAsyncSwapsFaultedLeaseEntryAsync, which does not exercise subscription transfer.
Its unchanged isolated replay passed, but that does not resolve the full-suite timeout.
No unrelated code or assertions were changed, and a clean full Client net48 run is not claimed.

Scope	net10.0	net48
Full Client.Tests after transfer acknowledgement correction	2,549 passed	2,552 passed, 1 timeout failure noted above, 1 existing platform skip
Full classic-subscription project after transfer correction	57 passed, including all 40 normal transfer cases	57 passed, including all 40 normal transfer cases
Gated transferred-message acknowledgement ownership	24 passed, included above	24 passed, included above
Saved-session consumer of the shared subscription helper	40 passed	16 passed, 24 existing unsupported-security-policy skips
Audit regression matrix	2,339 passed	1,934 passed, 34 existing skips
Full Client.Tests after review follow-ups	2,520 passed	Focused selections only
Full Client.Tests after CI recovery correction	2,523 passed, CI coverage collector	2,527 passed, 1 existing platform skip
Latest merged-head recovery/redundancy selection	139 passed	139 passed
Full Client.Tests after merged-head net48 correction	Focused selection above	2,529 passed, 1 existing platform skip
Lifecycle and actual-dimension regressions	146 passed	146 passed
Focused recovery follow-ups	7 passed	7 passed
WSS-related fixtures	93 passed	Not applicable
CI History integration corrections	28 passed	28 passed
CI alias, dispatcher, and explicit-atomic controls	63 passed	63 passed
Full WoT sample project with CI coverage collector	29 passed	Not applicable
Trust-list effects and count-only summary contract	22 passed	22 passed
Virtual-node feedback, node-manager, dispatcher, and lifecycle selections	661 passed, 63 existing not-executed cases; all 48 virtual-node cases passed	661 passed, 63 existing not-executed cases; all 48 virtual-node cases passed
WSS wire-handle exhaustion, late replies, and Cancel translation	9 passed	Not applicable
Synchronous node-manager disposal and related service/lifecycle suites	1,037 passed, 64 not-executed cases from existing fixture assumptions; all 93 sampling/disposal cases passed	1,037 passed, 64 not-executed cases from existing fixture assumptions; all 93 sampling/disposal cases passed

• Full solution builds passed on net10.0 and net48 during the audit work. The subsequent full non-incremental net10.0 build also completed with zero warnings/errors.
• Modified source/test formatting and analyzer checks passed through informational severity.
• Original composed recovery regressions passed repeated runs on both frameworks. Independent mutations removing Publish cancellation, bypassing the recreate drain call, or ignoring ready-gate cancellation each failed the intended assertion; all mutations were restored before passing runs.
• The latest recovery correction passed 100 executions of each original restoration-deadline scenario with unchanged assertions. Restoring premature update admission independently made both strengthened handoff cases fail; the correct retention behavior was restored afterward.
• Startup-event and cancellation-delivery timing probes reproduced the subsequent net48 failures, then passed 100 executions of each of the three scenarios with the fixes. All timing probes and repetition were removed. The permanent timeout-order regression also went RED on the original cancellation cleanup without sleeps or scheduling amplification.
• Final post-format recovery/subscription/engine checks passed all 151 selected cases on net10.0. The first local full net48 attempt aborted in clr.dll with native access violation 0xc0000005; an unchanged-assembly full diagnostic rerun passed as recorded above. That native host crash has not been attributed or claimed fixed.
• A minimal replay with the same CodeQL CLI and query-pack versions reproduced the custom-count alert and confirmed that the standard span-length projection is clean while direct sensitive-value and raw-identifier logging controls remain flagged. The source was already logging only a count; no identifier or certificate disclosure was established at the reported location.
• The virtual-node feedback regressions first reproduced five error-preservation/cache failures; expanded service-dispatch cases exposed two additional whole-batch failures before the operation-boundary fixes. The final selections pass on both frameworks. Genuine misses remain cached, successful results remain reusable, failed validation allows same-cache retry, and request cancellation still stops the batch.
• Three deterministic synchronous-manager disposal regressions reproduced early resource release and lifecycle calls reaching a manager during disposal. The fix passes direct and adapted calls, a sampling-worker join after the last operation exits, reentrant shutdown, cancellation and failure paths, repeated disposal, and exact rejection across 39 service/lifecycle entry points both during drain and after cleanup. The original outside-node-lock disposal regression remains and now requires the worker to observe closed admission.
• Prior-head CI on c985f8bded77a60449d9cd381c8a004d8590ccf6 completed with 168 passing checks, one expected release-package-publication skip, and no failures or pending checks. All test shards, signed builds, container builds, the coverage check, and the CodeQL PR check passed. Hosted CodeQL analysis 1829262912 completed successfully and marks count-flow alert 385 fixed. This is evidence for that head, not a claim that subsequent review follow-ups have completed hosted CI.

Session-test diagnostic memory

Complete browse listings are streamed to unique NUnit attachments rather than retained in inline NUnit/VSTest output. Detached regression-test results are cleaned up without deleting runner-collected attachments.

• Two covered session-suite runs each completed with 782 passed and 379 existing skips. Peak working set fell from 4.86 GiB to 2.44-2.78 GiB.
• TRX output shrank from 303.1 MiB to approximately 40.7 MiB, retaining all 46 complete browse attachments.
• Seven output regressions cover exact content, empty/single/large listings, disabled/enabled output, bounded inline summaries, and unique filenames.

The separate Azure build-18452 VM deprovisioning cause remains unproved without provider logs. The memory measurements do not establish its cause.

Unfiltered local UA.slnx tests, including the long stress/soak suites, have not been run on both frameworks. A local coverage delta was not collected; builds and focused tests are not substitutes for those claims.

Checklist

• I have signed the CLA and read the CONTRIBUTING doc.
• I have added tests that prove my fix is effective or that my feature works and increased code coverage.
• I have added all necessary documentation.
• I have verified that my changes do not introduce (new) build or analyzer warnings.
• I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed.
• All checks on the latest review-follow-up head have completed successfully; prior-head CI passed as recorded above.
• I have addressed all PR feedback received.

Tests have been added and pass as recorded above; the hosted coverage check passed on the prior head identified above. The combined tests/coverage-increase checkbox remains open because no local coverage delta was measured.

[romanett]

Review at head c5186d97, covering the source diff plus a re-check of every finding that the bug audit still listed as open or partial after #4503 (59 findings: 43 open and 16 partial).

Audit status at this head

Result	Count	Findings
fixed, with a regression test	52	C2-4, C3-1, C3-3, C3-5, C3-6, C4-6, C4-7, C5-1, C5-13, C7-2, C7-4, L1-3, L1-5, L1-6, L1-7, L1-10, L1-11, L2-9, L2-11, L2-12, L2-14, L3-2, L3-3, L5-5, L5-15, L6-6, L6-7, L6-8, L6-9, S1-6, S1-7, S1-8, S1-9, S2-5, S2-8, S2-9, S2-11, S3-3, S3-7, S3-8, S5-1, S5-5, S5-8, S6-3, S6-5, S6-6, S7-4, S7-5, S8-4, S8-10, S10-2, S12-3
fixed, but the fix introduces a new issue	5	L2-7 (keep-alive not restarted), C3-8 (staging order), C6-5 (Rsa-typed certificate), C7-5 (PSS certificates rejected), S4-8 (1024-entry Browse failure). See inline comments.
partial	2	C3-2 (below), S5-6 (inline at AsyncCustomNodeManager.cs:985)

Good work overall: every remaining Tier 2 item is closed or nearly closed, and nearly every fix has a focused test.

C3-2 (partial, file not in the diff): X509CertificateStore.Open now strips the X509Store: prefix, and trust lists work because the manager re-resolves their store type. Application certificate stores still fail. CertificateStoreIdentifier.DetermineStoreType (CertificateStoreIdentifier.cs:149-181) does not recognise the prefix, so an app-cert StorePath of X509Store:CurrentUser\My is typed as a Directory store and opened as a literal folder. X509StoreAcceptsPrefixedAndLegacyPaths covers only Open.

Smaller gaps, no inline comment:

• C4-6: no test covers the Session.cs change that maps every token-decrypt failure to Bad_IdentityTokenInvalid.
• C3-1: CertificateChangeEvent still does not document that its certificate fields are valid only during OnNext. The public ApplicationCertificateChanged event forwards the same object, so a handler that keeps it can read disposed handles.
• S2-8: items restored from a durable store written by an older build keep their creation-time interval clamp.
• C2-4: a fresh reverse connection handed to an entry that is closing, or superseded, or never consumed before the cycle ends, is never closed. Each case leaves one accepted socket open.

Must fix before merge

1. WebApiWssTransportChannel.cs:826: one response that fails to decode tears down the whole WSS connection and every pending request (regression from master).
2. Session.cs:3429: network-path failover that reuses the session leaves it without a keep-alive, so a silent loss of the alternate path is never detected.
3. DirectoryBrowser.cs:167: directories with more than 1024 entries can no longer be browsed. The limit is hard-coded, and clients can push a directory over it with CreateFile.
4. TrustListTransaction.cs:200: "add X, then remove X" in one transaction now commits X as trusted.
5. CustomNodeManager.cs:209: DisposeAsync hangs server shutdown if a legacy subclass's Dispose(bool) does not call base.

The other inline comments are minor.

CI

The latest head is red on test-macos-net10.0 (25/30): Opc.Ua.Subscriptions.Classic.Tests.TransferSubscriptionTest.TransferSubscriptionAsync(True,False) fails at TransferSubscriptionTest.cs:522 (subscription 0 target count expected 10, was 20, i.e. the initial values were delivered twice after transfer). The previous head 3c00b4a5f was green, and the only change since then is the synchronous node-manager drain in CustomNodeManager, which the ReferenceServer uses. Please confirm whether this is a flake or a regression before merging. A rerun alone does not settle it.

[Copilot]

Copilot review overview

🟡 Changes recommended

The critical concurrent lease-generation issue and moderate virtual-node error-swallowing issue remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Stale failed read can revoke a newer successful lease · New

Resolved since last review (1)

• Prevent concurrent manager use during disposal