Fix ScadaBridge topology: bldg-5/19, no site-to-site, direct API access

- Warsaw West buildings corrected to 5 and 19 (was generic 3/7)
- Removed site-to-site direct routing (doesn't exist)
- Added external API callers with direct access to any site cluster
- Updated UNS hierarchy examples to use real building numbers
- Fixed current-state.md routing topology description

current-state.md

@@ -105,7 +105,7 @@ SCADA responsibilities are split across two platforms by purpose:
   - _TBD — other databases written to besides batch tracking, and any additional consumers not listed here. **Enumeration of internal Web API endpoints is not tracked here** because ScadaBridge's Web API client is generic/configurable (see Capabilities); specific IT↔OT Web API crossings that need migration live in `current-state/legacy-integrations.md`. **Notification destination teams are similarly not enumerated** because they're contact-list-driven and transport-agnostic (see Capabilities) — the list of actual recipients lives in ScadaBridge's configuration, not in this plan._
 - **Routing topology:**
   - **Hub-and-spoke** — ScadaBridge nodes on the **central cluster (South Bend)** can route to ScadaBridge nodes on other clusters, forming a hub-and-spoke network with the central cluster as the hub.
-  - **Direct access** — site-level ScadaBridge clusters can also be reached directly (not only via the hub), enabling point-to-point integration where appropriate.
+  - **Direct API access** — external API callers can reach site-level ScadaBridge clusters directly (not only via the hub) using ScadaBridge's inbound Web API. **No direct site-to-site routing** exists between ScadaBridge clusters — inter-site traffic routes through the central hub.
 - **Data locality (design principle):** ScadaBridge is designed to **keep local data sources localized** — equipment at a site communicates with the **local ScadaBridge instance** at that site, not with the central cluster. This minimizes cross-site/WAN traffic, reduces latency, and keeps site operations resilient to WAN outages.
 - **Deployment status:** ScadaBridge is **already deployed** across the current cluster footprint. However, **not all legacy API integrations have been migrated onto it yet** — some older point-to-point integrations still run outside ScadaBridge and need to be ported. The authoritative inventory of these integrations (and their retirement tracking against `goal-state.md` pillar 3) lives in [`current-state/legacy-integrations.md`](current-state/legacy-integrations.md).
 - _TBD — resource impact of co-location with System Platform at the largest sites; whether any additional downstream consumers exist beyond those listed above; whether the notification capability will be extended to support Microsoft Teams (not currently implemented)._

goal-state.md

@@ -115,7 +115,7 @@ The plan commits to a **single canonical naming hierarchy** for addressing equip
 |---|---|---|---|
 | 1 | **Enterprise** | Single root for the whole organization. One value for the entire estate. | **`zb`** — confirmed 2026-04-17 (matches the existing `ZB.MOM.WW.*` namespace prefix used in the codebase; short by design since this segment appears in every equipment path) |
 | 2 | **Site** | Physical location. Matches the authoritative site list in [`current-state.md`](current-state.md) → Enterprise Layout. | `south-bend`, `warsaw-west`, `warsaw-north`, `shannon`, `galway`, `tmt`, `ponce`, `berlin`, `winterthur`, `jacksonville`, … |
-| 3 | **Area** | A section of the site — typically a **production building** at the Warsaw campuses (which run one cluster per building), or `_default` at sites that have a single cluster covering the whole site. Always present; uniform path depth is a design goal. | `bldg-3`, `bldg-7`, `_default` |
+| 3 | **Area** | A section of the site — typically a **production building** at the Warsaw campuses (which run one cluster per building), or `_default` at sites that have a single cluster covering the whole site. Always present; uniform path depth is a design goal. | `bldg-5`, `bldg-19`, `_default` |
 | 4 | **Line** | A production line or work cell within an area. One line = one coherent sequence of equipment working together toward a product or sub-assembly. | `line-2`, `assembly-a`, `packout-1` |
 | 5 | **Equipment** | An individual machine instance. Equipment class prefix + instance number or shortname. | `cnc-mill-05`, `injection-molder-02`, `vision-system-01` |
 
@@ -145,8 +145,8 @@ Identical conventions to the existing Redpanda topic naming — one vocabulary,
 
 | Form | Example |
 |---|---|
-| Text (messages, docs, dbt keys) | `zb.warsaw-west.bldg-3.line-2.cnc-mill-05.spindle-speed` |
+| Text (messages, docs, dbt keys) | `zb.warsaw-west.bldg-5.line-2.cnc-mill-05.spindle-speed` |
-| OPC UA browse path | `zb/warsaw-west/bldg-3/line-2/cnc-mill-05/spindle-speed` |
+| OPC UA browse path | `zb/warsaw-west/bldg-5/line-2/cnc-mill-05/spindle-speed` |
 | Same machine at a small site (area placeholder) | `zb.shannon._default.line-1.cnc-mill-03` |
 
 ##### Stable equipment identity — path is navigation, UUID is lineage

outputs/diagrams/scadabridge-topology.mmd

@@ -8,11 +8,11 @@ flowchart TB
 
     subgraph WarsawWest["Warsaw West Campus"]
         direction TB
-        subgraph WW3["Building 3 Cluster"]
+        subgraph WW5["Building 5 Cluster"]
-            WW3N1["Node 1"] <--> WW3N2["Node 2"]
+            WW5N1["Node 1"] <--> WW5N2["Node 2"]
         end
-        subgraph WW7["Building 7 Cluster"]
+        subgraph WW19["Building 19 Cluster"]
-            WW7N1["Node 1"] <--> WW7N2["Node 2"]
+            WW19N1["Node 1"] <--> WW19N2["Node 2"]
         end
     end
 
@@ -46,10 +46,13 @@ flowchart TB
     Central <-->|"hub route"| TMT
     Central <-->|"hub route"| Ponce
 
-    Shannon <-.->|"direct route<br/>(optional)"| Galway
+    API["External API Callers"] -.->|"direct access<br/>(any site cluster)"| Shannon
+    API -.-> WarsawWest
+    API -.-> Ponce
 
     subgraph Notes["Key: 2-node Akka.NET clusters, co-located on System Platform nodes"]
         L1["Hub-and-spoke: central routes to all sites"]
-        L2["Direct site-to-site routing available where needed"]
+        L2["No direct site-to-site routing"]
-        L3["Data locality: equipment talks to LOCAL cluster only"]
+        L3["API callers can reach site clusters directly"]
+        L4["Data locality: equipment talks to LOCAL cluster only"]
     end