namespace ZB.MOM.WW.ScadaBridge.Commons.Types.Enums;

/// <summary>
/// Specific Audit Log event kind within a channel — what action produced the row.
/// Cached variants emit multiple rows per operation (submit → forward → attempt → resolve).
/// The <c>SecuredWrite*</c> kinds emit one row per two-person-write lifecycle event
/// (submit → approve → execute, or submit → reject).
/// See alog.md §4 for the full taxonomy.
/// </summary>
public enum AuditKind
{
    ApiCall,
    ApiCallCached,
    DbWrite,
    DbWriteCached,
    NotifySend,
    NotifyDeliver,
    InboundRequest,
    InboundAuthFailure,
    CachedSubmit,
    CachedResolve,
    SecuredWriteSubmit,
    SecuredWriteApprove,
    SecuredWriteReject,
    SecuredWriteExecute,

    /// <summary>
    /// A Pending secured write aged past its server-side TTL and was transitioned to
    /// <c>Expired</c> without ever executing — the stale setpoint is never relayed to
    /// the site. Emitted best-effort by the system (no verifier) when the approve/reject
    /// path or the opportunistic list sweep observes an overdue Pending row. (arch-review S2)
    /// </summary>
    SecuredWriteExpire,

    /// <summary>
    /// A reconciliation pull row that failed to insert on every retry up to the
    /// permanent-abandon threshold, so central advanced its cursor past it and
    /// the row is permanently lost from the mirror. The reconciliation actor
    /// emits ONE synthetic audit row of this kind (carrying the abandoned
    /// <c>EventId</c>, source site, and final error) so the loss is queryable in
    /// the Audit Log itself, not only in a rotating log file.
    /// </summary>
    ReconciliationAbandoned,

    /// <summary>
    /// An administrator triggered a manual failover of the central pair from the Health page:
    /// the active (oldest Up) node was asked to leave the cluster gracefully so its singletons
    /// hand over and the standby takes over. One row per invocation, written BEFORE the Leave
    /// is issued (the acting node is usually not the one that goes away, but the audit must
    /// survive either outcome). (decision 2026-07-22)
    /// </summary>
    ManualFailover
}
