fix(server): enforce browse continuation point limit at capacity

src/Opc.Ua.Server/Session/SessionContinuationPoints.cs

@@ -85,7 +85,7 @@ public void SaveBrowse(ContinuationPoint continuationPoint)
                 m_browse ??= [];
 
                 // remove the first continuation point if too many points.
-                while (m_browse.Count > MaxBrowse)
+                while (m_browse.Count >= MaxBrowse)
                 {
                     ContinuationPoint cp = m_browse[0];
                     m_browse.RemoveAt(0);

tests/Opc.Ua.Server.Tests/SessionContinuationPointsTests.cs

@@ -118,6 +118,30 @@ public void SaveBrowseEvictsOldestAndNotifiesStore()
                 Times.Once);
         }
 
+        [Test]
+        public void SaveBrowseEvictsWhenCountReachesConfiguredLimit()
+        {
+            var store = new Mock<IContinuationPointStore>(MockBehavior.Loose);
+            SessionContinuationPoints holder = NewHolder(maxBrowse: 2, store: store.Object);
+
+            var evicted = new TrackingDisposable();
+            ContinuationPoint cp1 = NewBrowsePoint(data: evicted);
+            ContinuationPoint cp2 = NewBrowsePoint();
+            ContinuationPoint cp3 = NewBrowsePoint();
+
+            holder.SaveBrowse(cp1);
+            holder.SaveBrowse(cp2);
+            holder.SaveBrowse(cp3);
+
+            Assert.That(evicted.Disposed, Is.True);
+            Assert.That(holder.RestoreBrowse(ToByteString(cp1.Id)), Is.Null);
+            Assert.That(holder.RestoreBrowse(ToByteString(cp2.Id)), Is.SameAs(cp2));
+            Assert.That(holder.RestoreBrowse(ToByteString(cp3.Id)), Is.SameAs(cp3));
+            store.Verify(
+                s => s.RemoveContinuationPoint(s_sessionId, ContinuationPointKind.Browse, cp1.Id),
+                Times.Once);
+        }
+
         [Test]
         public void SaveBrowseStoresEnvelopeWithNormalizedNodeIds()
         {