fix(site-secrets): report every site node's secret mirror failures on the health report (M1)

A DeployedSecretsMirror failure on the STANDBY node (e.g. a master-key mismatch
that stops a deployed secret decrypting there) was only logged on that node:
site health reports are sent by the active node only, so central never saw it.

- New 12th LocalDb-replicated table secret_mirror_status (node_name PK,
  failures_json of {SecretName, Message}, checked_at; no FKs). Each node's
  mirror writes only its own row, and only when its failure set changes plus
  once per start-up (every write replicates via CDC). Best-effort: a failed
  write is a Warning and is retried next pass. Node key = INodeIdentityProvider
  NodeName, falling back to the machine name.
- SecretMirrorStatusReporter (SiteRuntime, every node, 30 s) reads every row
  into ISiteHealthCollector.SetSecretMirrorStatuses -> additive nullable
  SiteHealthReport.SecretMirrorStatuses (null = no data).
- Wire: SiteHealthReportDto.secret_mirror_statuses = 33 (presence wrapper so
  null != empty); vendored CentralControl.cs regenerated; mapper both ways.
- Central UI Health card: 'Secret mirror failing' badge + compact per-node
  node / secret / message list.
- Tests: mirror status write-on-change/first-pass/failure isolation, storage
  round-trip, reporter/collector, DTO mapper round-trip incl. null/empty,
  bUnit, replicated-table set (twelve) + FK guard wording.

src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Pages/Monitoring/Health.razor

@@ -275,6 +275,14 @@
                                     No self-heal
                                 </span>
                             }
+                            @if (HasSecretMirrorFailures(state))
+                            {
+                                <span class="badge bg-warning text-dark"
+                                      data-test="secret-mirror-badge"
+                                      title="A site node could not apply and/or decrypt one or more deployed secrets. A standby node's failures surface here before a failover would expose them — see the details in the card body.">
+                                    Secret mirror failing
+                                </span>
+                            }
                             @if (!state.IsOnline && state.LastStatusChangeAt is { } changedAt)
                             {
                                 <small class="text-muted">offline since @changedAt.ToString("u")</small>
@@ -302,6 +310,26 @@
                     @if (state.LatestReport != null)
                     {
                         var report = state.LatestReport;
+                        @if (HasSecretMirrorFailures(state))
+                        {
+                            @* Review finding M1: every site node's deployed-secrets mirror failures,
+                               the standby's included (carried on the active node's report). *@
+                            <div class="alert alert-warning py-2 px-3 mb-3 small" data-test="secret-mirror-failures" role="alert">
+                                <strong>Deployed secrets failing on a site node</strong>
+                                <ul class="mb-0 ps-3">
+                                    @foreach (var node in report.SecretMirrorStatuses!.Where(n => n.Failures.Count > 0))
+                                    {
+                                        @foreach (var failure in node.Failures)
+                                        {
+                                            <li>
+                                                <span class="font-monospace">@node.NodeName</span> &middot;
+                                                <span class="font-monospace">@failure.SecretName</span>: @failure.Message
+                                            </li>
+                                        }
+                                    }
+                                </ul>
+                            </div>
+                        }
                         <div class="row g-3">
                             @* Each logical group below sits in its own card, with the group's
                                head promoted to a real card-header, instead of h6 rules stacked
@@ -590,6 +618,15 @@
         state.IsOnline
         && state.LatestReport?.StartupReconcilerActive == false;
 
+    // Review finding M1: warn when any site node (the standby included) reports deployed
+    // secrets it cannot apply/decrypt. Null ("no data": central self-report, pre-M1 site) and
+    // nodes with an empty failure list are healthy. Offline sites are skipped like the other
+    // warning badges — the Offline badge is the signal that matters there.
+    private static bool HasSecretMirrorFailures(SiteHealthState state) =>
+        state.IsOnline
+        && state.LatestReport?.SecretMirrorStatuses is { } statuses
+        && statuses.Any(n => n.Failures.Count > 0);
+
     // Online central nodes, from the same ClusterNodes list the Nodes column renders.
     // Fewer than two means no standby, which disables the manual-failover control. This is
     // a display-side guard only — AkkaManualFailoverService re-checks against live cluster

src/ZB.MOM.WW.ScadaBridge.Commons/Messages/Health/SecretMirrorNodeStatus.cs

@@ -0,0 +1,26 @@
+namespace ZB.MOM.WW.ScadaBridge.Commons.Messages.Health;
+
+/// <summary>
+/// One site node's latest deployed-secrets mirror outcome, as carried on
+/// <see cref="SiteHealthReport.SecretMirrorStatuses"/> (review finding M1).
+/// </summary>
+/// <remarks>
+/// Every site node runs its own <c>DeployedSecretsMirror</c> and records its current
+/// failure set in the LocalDb-replicated <c>secret_mirror_status</c> table, keyed by node
+/// name; the ACTIVE node reads every row and ships them on its health report, so a
+/// STANDBY node's failures (most importantly a master-key mismatch that stops a deployed
+/// secret decrypting there) reach central before a failover exposes them. Carries names
+/// and human-readable messages only — never a secret value or ciphertext.
+/// </remarks>
+/// <param name="NodeName">The reporting node's semantic name (<c>node-a</c>/<c>node-b</c>), or its host name when unconfigured.</param>
+/// <param name="CheckedAtUtc">When that node last recorded a CHANGE in its failure set (or its first pass after start-up) — not the time of its latest pass.</param>
+/// <param name="Failures">That node's current mirror failures; empty when the node's mirror is healthy.</param>
+public sealed record SecretMirrorNodeStatus(
+    string NodeName,
+    DateTimeOffset CheckedAtUtc,
+    IReadOnlyList<SecretMirrorFailure> Failures);
+
+/// <summary>A single deployed secret that failed to apply and/or decrypt on one site node.</summary>
+/// <param name="SecretName">The secret's name.</param>
+/// <param name="Message">A human-readable failure message — never includes the secret's value.</param>
+public sealed record SecretMirrorFailure(string SecretName, string Message);

src/ZB.MOM.WW.ScadaBridge.Commons/Messages/Health/SiteHealthReport.cs

@@ -173,6 +173,20 @@ public record SiteHealthReport(
     /// </para>
     /// </remarks>
     public bool? StartupReconcilerActive { get; init; }
+
+    /// <summary>
+    /// Every site node's latest deployed-secrets mirror outcome (review finding M1) — one
+    /// entry per node that has recorded a row in the replicated <c>secret_mirror_status</c>
+    /// table, including the STANDBY node, whose own health report is never sent.
+    /// </summary>
+    /// <remarks>
+    /// <b>Null = no data</b>: a central self-report, a pre-M1 site build, a site whose
+    /// reporter has not run yet, or a failed read. An EMPTY list means the feature is wired
+    /// but no node has recorded a status yet. A node entry with an empty
+    /// <see cref="SecretMirrorNodeStatus.Failures"/> list is a healthy mirror. Names and
+    /// messages only — never secret values or ciphertext.
+    /// </remarks>
+    public IReadOnlyList<SecretMirrorNodeStatus>? SecretMirrorStatuses { get; init; }
 }
 
 /// <summary>

src/ZB.MOM.WW.ScadaBridge.Communication/Grpc/CentralControlDtoMapper.cs

@@ -559,6 +559,32 @@ public static class CentralControlDtoMapper
             dto.SiteAuditBacklog = snapshot;
         }
 
+        // Review finding M1: wrapper presence keeps null ("no data") distinct from empty.
+        if (msg.SecretMirrorStatuses is { } mirrorStatuses)
+        {
+            var wrapper = new SecretMirrorStatusListDto();
+            foreach (var node in mirrorStatuses)
+            {
+                var nodeDto = new SecretMirrorNodeStatusDto
+                {
+                    NodeName = node.NodeName,
+                    CheckedAtUtc = Timestamp.FromDateTimeOffset(node.CheckedAtUtc),
+                };
+                foreach (var failure in node.Failures)
+                {
+                    nodeDto.Failures.Add(new SecretMirrorFailureDto
+                    {
+                        SecretName = failure.SecretName,
+                        Message = failure.Message,
+                    });
+                }
+
+                wrapper.Nodes.Add(nodeDto);
+            }
+
+            dto.SecretMirrorStatuses = wrapper;
+        }
+
         return dto;
     }
 
@@ -620,6 +646,19 @@ public static class CentralControlDtoMapper
                 OnDiskBytes: snapshot.OnDiskBytes);
         }
 
+        List<SecretMirrorNodeStatus>? mirrorStatuses = null;
+        if (dto.SecretMirrorStatuses is { } mirrorWrapper)
+        {
+            mirrorStatuses = new List<SecretMirrorNodeStatus>(mirrorWrapper.Nodes.Count);
+            foreach (var node in mirrorWrapper.Nodes)
+            {
+                mirrorStatuses.Add(new SecretMirrorNodeStatus(
+                    node.NodeName,
+                    node.CheckedAtUtc?.ToDateTimeOffset() ?? DateTimeOffset.MinValue,
+                    node.Failures.Select(f => new SecretMirrorFailure(f.SecretName, f.Message)).ToList()));
+            }
+        }
+
         return new SiteHealthReport(
             SiteId: dto.SiteId,
             SequenceNumber: dto.SequenceNumber,
@@ -657,6 +696,7 @@ public static class CentralControlDtoMapper
             DetachedScriptThreads = dto.DetachedScriptThreads,
             ScriptRunShedCount = dto.ScriptRunShedCount,
             SiteStreamAlarmDropCount = dto.SiteStreamAlarmDropCount,
+            SecretMirrorStatuses = mirrorStatuses,
         };
     }
 

src/ZB.MOM.WW.ScadaBridge.Communication/Protos/central_control.proto

@@ -193,6 +193,25 @@ message NodeStatusListDto {
   repeated NodeStatusDto nodes = 1;
 }
 
+// Review finding M1: one site node's deployed-secrets mirror failures. Names and
+// human-readable messages only — never a secret value or ciphertext.
+message SecretMirrorFailureDto {
+  string secret_name = 1;
+  string message = 2;
+}
+
+message SecretMirrorNodeStatusDto {
+  string node_name = 1;
+  google.protobuf.Timestamp checked_at_utc = 2;
+  repeated SecretMirrorFailureDto failures = 3;
+}
+
+// Presence wrapper (same reason as NodeStatusListDto): absent = null ("no data"),
+// present-but-empty = the feature is wired and no node has recorded a status yet.
+message SecretMirrorStatusListDto {
+  repeated SecretMirrorNodeStatusDto nodes = 1;
+}
+
 // Site -> Central: periodic site health report. Mirrors Commons SiteHealthReport.
 // Additive-only evolution: field numbers are never reused.
 message SiteHealthReportDto {
@@ -245,6 +264,10 @@ message SiteHealthReportDto {
   // dedicated alarm publish queue because it was at capacity. Point-in-time
   // (not reset on collect), like site_event_log_write_failures.
   int64 site_stream_alarm_drop_count = 32;
+  // Review finding M1: every site node's deployed-secrets mirror status (the standby's
+  // included — it is read from a LocalDb-replicated table on the active node).
+  // Absent means null ("no data": central self-report, pre-M1 site, or not read yet).
+  SecretMirrorStatusListDto secret_mirror_statuses = 33;
 }
 
 // Central -> Site: health report ack, so a lost report is observable.

src/ZB.MOM.WW.ScadaBridge.HealthMonitoring/ISiteHealthCollector.cs

@@ -198,6 +198,19 @@ public interface ISiteHealthCollector
         // Default no-op so test fakes do not need to be updated.
     }
 
+    /// <summary>
+    /// Replace the latest per-node deployed-secrets mirror statuses (review finding M1) used
+    /// by the <c>SecretMirrorStatuses</c> field of the next <see cref="CollectReport"/> call.
+    /// Refreshed periodically by the site-side <c>SecretMirrorStatusReporter</c> from the
+    /// LocalDb-replicated <c>secret_mirror_status</c> table, so the ACTIVE node's report
+    /// carries the STANDBY node's mirror failures too. Point-in-time: NOT reset on collect.
+    /// </summary>
+    /// <param name="statuses">Every node's row, or <see langword="null"/> for "no data".</param>
+    void SetSecretMirrorStatuses(IReadOnlyList<SecretMirrorNodeStatus>? statuses)
+    {
+        // Default no-op so test fakes do not need to be updated.
+    }
+
     /// <summary>
     /// Replace the latest script-execution-scheduler gauges (queue depth, busy
     /// thread count, and age in seconds of the oldest in-flight script) used by

src/ZB.MOM.WW.ScadaBridge.HealthMonitoring/SiteHealthCollector.cs

@@ -32,6 +32,10 @@ public class SiteHealthCollector : ISiteHealthCollector
     //  -1 = reconciler SKIPPED (no IDeploymentConfigFetcher)
     // Null must stay distinct from -1: "we don't know" is not "self-heal is missing".
     private volatile int _startupReconcilerActive;
+    // Review finding M1: every site node's deployed-secrets mirror status, refreshed by the
+    // SiteRuntime SecretMirrorStatusReporter. Null = the reporter has not run (or its read
+    // failed before it ever succeeded) — "no data", distinct from an empty list.
+    private volatile IReadOnlyList<SecretMirrorNodeStatus>? _secretMirrorStatuses;
     private readonly ConcurrentDictionary<string, ConnectionHealth> _connectionStatuses = new();
     private readonly ConcurrentDictionary<string, TagResolutionStatus> _tagResolutionCounts = new();
     private readonly ConcurrentDictionary<string, string> _connectionEndpoints = new();
@@ -130,6 +134,12 @@ public class SiteHealthCollector : ISiteHealthCollector
         _startupReconcilerActive = active ? 1 : -1;
     }
 
+    /// <inheritdoc />
+    public void SetSecretMirrorStatuses(IReadOnlyList<SecretMirrorNodeStatus>? statuses)
+    {
+        _secretMirrorStatuses = statuses?.ToList();
+    }
+
     /// <inheritdoc />
     public void UpdateConnectionHealth(string connectionName, ConnectionHealth health)
     {
@@ -333,7 +343,9 @@ public class SiteHealthCollector : ISiteHealthCollector
             SiteStreamAlarmDropCount = Interlocked.Read(ref _siteStreamAlarmDropCount),
             // Tri-state: 0 stays null ("not reported"), which must never collapse into
             // false ("self-heal is missing"). Register row 73.
-            StartupReconcilerActive = startupReconciler == 0 ? null : startupReconciler > 0
+            StartupReconcilerActive = startupReconciler == 0 ? null : startupReconciler > 0,
+            // M1: point-in-time, not drained; null stays null ("no data").
+            SecretMirrorStatuses = _secretMirrorStatuses
         };
     }
 }

src/ZB.MOM.WW.ScadaBridge.Host/SiteLocalDbSetup.cs

@@ -48,7 +48,7 @@ namespace ZB.MOM.WW.ScadaBridge.Host;
 public static class SiteLocalDbSetup
 {
     /// <summary>
-    /// The eleven tables that participate in replication — registered when this node has a peer,
+    /// The twelve tables that participate in replication — registered when this node has a peer,
     /// and deregistered (stale triggers dropped) when it does not.
     /// </summary>
     /// <remarks>
@@ -69,6 +69,13 @@ public static class SiteLocalDbSetup
     /// <c>deployed_secrets</c> row, and replicating the ledger would make one node's progress
     /// masquerade as the other's.
     /// </para>
+    /// <para>
+    /// <c>secret_mirror_status</c> is the twelfth entry (review finding M1). It is per-node
+    /// DATA — one row per node, keyed by <c>node_name</c>, each written only by its own node —
+    /// but it is replicated precisely so the active node can read the standby's row and put
+    /// it on the site health report (only the active node sends one). Explicit primary key,
+    /// no FK, no BLOB columns.
+    /// </para>
     /// </remarks>
     internal static readonly string[] ReplicatedTables =
     [
@@ -83,6 +90,7 @@ public static class SiteLocalDbSetup
         "data_connection_definitions",
         "native_alarm_state",
         "deployed_secrets",
+        "secret_mirror_status",
     ];
 
     /// <summary>
@@ -140,8 +148,9 @@ public static class SiteLocalDbSetup
             // ELEVENTH entry to ReplicatedTables on an already-replicating site streams a
             // snapshot of only that one table, where through 0.2.x the flag was a single
             // per-database bit and the same edit would have re-streamed all eleven in full, in
-            // both directions. Nothing about the first boot changes: enabling replication on a
-            // site that has been running without it seeds all eleven at once, the flagged set is
+            // both directions (the same holds for secret_mirror_status, the twelfth, added by
+            // review finding M1). Nothing about the first boot changes: enabling replication on a
+            // site that has been running without it seeds all twelve at once, the flagged set is
             // therefore every registered table, and the library sends that as an ordinary full
             // snapshot. A hypothetical "register the whole list in one call" API would silently
             // give the coarse behaviour back.

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/Persistence/SiteStorageSchema.cs

@@ -3,8 +3,8 @@ using Microsoft.Data.Sqlite;
 namespace ZB.MOM.WW.ScadaBridge.SiteRuntime.Persistence;
 
 /// <summary>
-/// DDL for the site's eleven configuration tables (nine original plus
-/// <c>deployed_secrets</c> and <c>mirrored_secrets</c>), extracted from
+/// DDL for the site's twelve configuration tables (nine original plus
+/// <c>deployed_secrets</c>, <c>mirrored_secrets</c> and <c>secret_mirror_status</c>), extracted from
 /// <see cref="SiteStorageService"/> so it can be applied by whoever owns the database
 /// file.
 /// <para>
@@ -23,7 +23,7 @@ namespace ZB.MOM.WW.ScadaBridge.SiteRuntime.Persistence;
 public static class SiteStorageSchema
 {
     /// <summary>
-    /// Creates the eleven site configuration tables when absent, and additively upgrades
+    /// Creates the twelve site configuration tables when absent, and additively upgrades
     /// tables created by an older build. Idempotent — safe to run on every startup.
     /// </summary>
     /// <param name="connection">An open connection to the database that should hold the tables.</param>
@@ -136,6 +136,20 @@ public static class SiteStorageSchema
                 revision       INTEGER NOT NULL,
                 mirrored_at    TEXT NOT NULL
             );
+
+            -- Per-node deployed-secrets mirror status (review finding M1): one row per site
+            -- node, keyed by node name, holding that node's CURRENT mirror failures as a JSON
+            -- array of {SecretName, Message} (names and messages only — never values or
+            -- ciphertext). Unlike mirrored_secrets this IS replicated
+            -- (SiteLocalDbSetup.ReplicatedTables): each node writes only its own row, and the
+            -- replication is exactly what lets the ACTIVE node's health report carry the
+            -- STANDBY node's failures to central. Written only when a node's failure set
+            -- changes (plus once per start-up), never per mirror tick. No foreign keys.
+            CREATE TABLE IF NOT EXISTS secret_mirror_status (
+                node_name      TEXT PRIMARY KEY,
+                failures_json  TEXT NOT NULL,
+                checked_at     TEXT NOT NULL
+            );
         ";
             command.ExecuteNonQuery();
         }

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/Persistence/SiteStorageService.cs

@@ -3,6 +3,7 @@ using Microsoft.Data.Sqlite;
 using Microsoft.Extensions.Logging;
 using ZB.MOM.WW.LocalDb;
 using ZB.MOM.WW.ScadaBridge.Commons.Messages.Artifacts;
+using ZB.MOM.WW.ScadaBridge.Commons.Messages.Health;
 
 namespace ZB.MOM.WW.ScadaBridge.SiteRuntime.Persistence;
 
@@ -924,6 +925,87 @@ public class SiteStorageService
         await command.ExecuteNonQueryAsync();
     }
 
+    // ── Secret mirror status (review finding M1 — LocalDb-replicated, one row per node) ──
+
+    /// <summary>
+    /// Records <paramref name="nodeName"/>'s current deployed-secrets mirror failures in the
+    /// replicated <c>secret_mirror_status</c> table (UPSERT on the node name). An empty
+    /// <paramref name="failures"/> list records a healthy mirror. Every call is a replicated
+    /// write, so callers write only when the failure set changes.
+    /// </summary>
+    /// <param name="nodeName">This node's name — the row key.</param>
+    /// <param name="failures">The node's current failures (names and messages only, never values).</param>
+    /// <param name="checkedAtUtc">When the recorded failure set was observed.</param>
+    /// <returns>A task that completes when the row has been stored.</returns>
+    public async Task SetSecretMirrorStatusAsync(
+        string nodeName, IReadOnlyList<SecretMirrorFailure> failures, DateTimeOffset checkedAtUtc)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(nodeName);
+        ArgumentNullException.ThrowIfNull(failures);
+
+        await using var connection = OpenConnection();
+
+        await using var command = connection.CreateCommand();
+        command.CommandText = @"
+            INSERT INTO secret_mirror_status (node_name, failures_json, checked_at)
+            VALUES (@nodeName, @failures, @checkedAt)
+            ON CONFLICT(node_name) DO UPDATE SET
+                failures_json = excluded.failures_json,
+                checked_at    = excluded.checked_at";
+
+        command.Parameters.AddWithValue("@nodeName", nodeName);
+        command.Parameters.AddWithValue("@failures", JsonSerializer.Serialize(failures));
+        command.Parameters.AddWithValue("@checkedAt", checkedAtUtc.ToUniversalTime().ToString("O"));
+
+        await command.ExecuteNonQueryAsync();
+    }
+
+    /// <summary>
+    /// Returns every node's row from <c>secret_mirror_status</c>, ordered by node name. A row
+    /// whose <c>failures_json</c> cannot be parsed is returned with a single synthetic failure
+    /// saying so, rather than failing the whole read or silently reading as healthy.
+    /// </summary>
+    /// <returns>A task that resolves to every node's recorded mirror status.</returns>
+    public async Task<IReadOnlyList<SecretMirrorNodeStatus>> GetSecretMirrorStatusesAsync()
+    {
+        await using var connection = OpenConnection();
+
+        await using var command = connection.CreateCommand();
+        command.CommandText =
+            "SELECT node_name, failures_json, checked_at FROM secret_mirror_status ORDER BY node_name";
+
+        var results = new List<SecretMirrorNodeStatus>();
+        await using var reader = await command.ExecuteReaderAsync();
+        while (await reader.ReadAsync())
+        {
+            var nodeName = reader.GetString(0);
+            IReadOnlyList<SecretMirrorFailure> failures;
+            try
+            {
+                failures = JsonSerializer.Deserialize<List<SecretMirrorFailure>>(reader.GetString(1))
+                    ?? [];
+            }
+            catch (Exception ex) when (ex is JsonException or NotSupportedException)
+            {
+                failures =
+                [
+                    new SecretMirrorFailure(
+                        "(unreadable)",
+                        $"Mirror status row for node '{nodeName}' could not be parsed ({ex.GetType().Name})"),
+                ];
+            }
+
+            var checkedAt = DateTimeOffset.TryParse(
+                reader.GetString(2), null, System.Globalization.DateTimeStyles.RoundtripKind, out var parsed)
+                ? parsed
+                : DateTimeOffset.MinValue;
+
+            results.Add(new SecretMirrorNodeStatus(nodeName, checkedAt, failures));
+        }
+
+        return results;
+    }
+
     // ── Shared Script CRUD ──
 
     /// <summary>

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/Secrets/DeployedSecretsMirror.cs

@@ -1,7 +1,9 @@
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
+using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services;
 using ZB.MOM.WW.ScadaBridge.Commons.Messages.Artifacts;
+using ZB.MOM.WW.ScadaBridge.Commons.Messages.Health;
 using ZB.MOM.WW.ScadaBridge.SiteRuntime.Persistence;
 using ZB.MOM.WW.Secrets.Abstractions;
 
@@ -153,6 +155,18 @@ public sealed record MirrorResult(
 /// so a LATER failure — even one with an identical fingerprint — logs at Error again. This state
 /// is in-memory only (per node process), which matches the ledger's own node-local scope.
 /// </para>
+/// <para>
+/// <b>Status row for central (review finding M1).</b> A failure on the STANDBY node used to be
+/// visible only in that node's own log — site health reports are sent by the active node only.
+/// After each pass this mirror records its node's current failure set (secret name + message,
+/// never a value) in the LocalDb-replicated <c>secret_mirror_status</c> table, keyed by node
+/// name; <c>SecretMirrorStatusReporter</c> on the active node reads every node's row onto the
+/// health report. Because every write replicates via CDC, the row is written only when the
+/// failure set (compared as sorted name+message pairs) differs from what this process last
+/// wrote — plus once on the first pass after start-up, so a restart refreshes a stale row. The
+/// write is best-effort: a failure logs a Warning (repeats at Debug) and is retried on the next
+/// pass, and never affects the pass's own <see cref="MirrorResult"/>.
+/// </para>
 /// </remarks>
 public sealed class DeployedSecretsMirror : BackgroundService
 {
@@ -165,6 +179,17 @@ public sealed class DeployedSecretsMirror : BackgroundService
     private readonly IOptions<SiteRuntimeOptions> _options;
     private readonly ILogger<DeployedSecretsMirror> _logger;
     private readonly TimeProvider _time;
+    private readonly string _nodeName;
+
+    /// <summary>
+    /// The failure set (sorted name+message pairs) this process last wrote successfully to
+    /// <c>secret_mirror_status</c>, or <see langword="null"/> before the first successful write
+    /// — which is what forces the once-per-start-up write (review finding M1).
+    /// </summary>
+    private IReadOnlyList<SecretMirrorFailure>? _lastWrittenStatus;
+
+    /// <summary>Whether a failed status write has already been logged at Warning (de-spam).</summary>
+    private bool _statusWriteFailureLogged;
 
     private readonly SemaphoreSlim _gate = new(1, 1);
     private bool _disposed;
@@ -199,6 +224,11 @@ public sealed class DeployedSecretsMirror : BackgroundService
     /// <param name="options">Supplies <see cref="SiteRuntimeOptions.DeployedSecretsMirrorInterval"/>.</param>
     /// <param name="logger">Logger instance. Never logs secret values — names, revisions, and KEK ids only.</param>
     /// <param name="time">Clock driving the reconcile loop's <see cref="PeriodicTimer"/> and the tombstone-recovery stamp.</param>
+    /// <param name="nodeIdentity">
+    /// Supplies this node's name (<c>node-a</c>/<c>node-b</c>), the key of its
+    /// <c>secret_mirror_status</c> row. Optional: when absent or unconfigured, the machine name
+    /// is used instead.
+    /// </param>
     public DeployedSecretsMirror(
         SiteStorageService storage,
         ISecretStore store,
@@ -206,7 +236,8 @@ public sealed class DeployedSecretsMirror : BackgroundService
         ISecretCacheInvalidator? invalidator,
         IOptions<SiteRuntimeOptions> options,
         ILogger<DeployedSecretsMirror> logger,
-        TimeProvider time)
+        TimeProvider time,
+        INodeIdentityProvider? nodeIdentity = null)
     {
         _storage = storage ?? throw new ArgumentNullException(nameof(storage));
         _store = store ?? throw new ArgumentNullException(nameof(store));
@@ -215,6 +246,7 @@ public sealed class DeployedSecretsMirror : BackgroundService
         _options = options ?? throw new ArgumentNullException(nameof(options));
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
         _time = time ?? throw new ArgumentNullException(nameof(time));
+        _nodeName = nodeIdentity?.NodeName ?? Environment.MachineName;
     }
 
     /// <summary>
@@ -314,6 +346,8 @@ public sealed class DeployedSecretsMirror : BackgroundService
                     rows.Count(r => !r.IsRemoved) + unreadable.Count(u => !u.IsRemoved), failed.Count);
             }
 
+            await RecordStatusIfChangedAsync(failedNames, failed).ConfigureAwait(false);
+
             return result;
         }
         finally
@@ -322,6 +356,42 @@ public sealed class DeployedSecretsMirror : BackgroundService
         }
     }
 
+    /// <summary>
+    /// Writes this node's <c>secret_mirror_status</c> row when the pass's failure set differs
+    /// from the last one this process wrote (or nothing has been written yet since start-up).
+    /// Best-effort: never throws, so the pass result is unaffected by a status-write fault.
+    /// See the class remarks (review finding M1).
+    /// </summary>
+    private async Task RecordStatusIfChangedAsync(IReadOnlyList<string> failedNames, IReadOnlyList<string> failed)
+    {
+        var current = failedNames
+            .Select((name, i) => new SecretMirrorFailure(name, failed[i]))
+            .OrderBy(f => f.SecretName, StringComparer.Ordinal)
+            .ThenBy(f => f.Message, StringComparer.Ordinal)
+            .ToList();
+
+        if (_lastWrittenStatus is not null && _lastWrittenStatus.SequenceEqual(current))
+        {
+            return;
+        }
+
+        try
+        {
+            await _storage.SetSecretMirrorStatusAsync(_nodeName, current, _time.GetUtcNow()).ConfigureAwait(false);
+            _lastWrittenStatus = current;
+            _statusWriteFailureLogged = false;
+        }
+        catch (Exception ex)
+        {
+            _logger.Log(
+                _statusWriteFailureLogged ? LogLevel.Debug : LogLevel.Warning,
+                ex,
+                "Failed to record the deployed secrets mirror status for node {NodeName}; retrying next pass",
+                _nodeName);
+            _statusWriteFailureLogged = true;
+        }
+    }
+
     /// <summary>
     /// Handles a tombstoned <c>deployed_secrets</c> row: deletes it from this node's store, but
     /// only if this node had previously ledgered it as mirrored — an out-of-band, same-named

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/Secrets/SecretMirrorStatusReporter.cs

@@ -0,0 +1,95 @@
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.ScadaBridge.HealthMonitoring;
+using ZB.MOM.WW.ScadaBridge.SiteRuntime.Persistence;
+
+namespace ZB.MOM.WW.ScadaBridge.SiteRuntime.Secrets;
+
+/// <summary>
+/// Review finding M1: site-side hosted service that periodically reads EVERY node's row from
+/// the LocalDb-replicated <c>secret_mirror_status</c> table and pushes the list into
+/// <see cref="ISiteHealthCollector.SetSecretMirrorStatuses"/>, so the next health report
+/// carries each site node's deployed-secrets mirror failures — the standby's included.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Runs on every site node (the read is a cheap local SELECT), but only the active node's
+/// report is ever sent (<c>HealthReportSender</c>), which is exactly why the status lives in a
+/// REPLICATED table: the standby writes its row, CDC carries it to the active node, and this
+/// reporter on the active node forwards it. A site pair WITHOUT LocalDb replication reports
+/// only the active node's row — the same prerequisite the deployed secrets themselves have.
+/// </para>
+/// <para>
+/// Lives in SiteRuntime (which already references HealthMonitoring and owns
+/// <see cref="SiteStorageService"/>), following <c>SiteStreamAlarmDropReporter</c>: immediate
+/// first probe, fixed cadence, exceptions logged and swallowed. A failed read leaves the
+/// previous snapshot on the collector rather than clearing it.
+/// </para>
+/// </remarks>
+public sealed class SecretMirrorStatusReporter : BackgroundService
+{
+    /// <summary>Default poll cadence (30 s), matching the site health report interval.</summary>
+    internal static readonly TimeSpan DefaultPollInterval = TimeSpan.FromSeconds(30);
+
+    private readonly ISiteHealthCollector _collector;
+    private readonly SiteStorageService _storage;
+    private readonly ILogger<SecretMirrorStatusReporter> _logger;
+    private readonly TimeSpan _pollInterval;
+
+    /// <summary>Initializes a new instance of <see cref="SecretMirrorStatusReporter"/>.</summary>
+    /// <param name="collector">The site health collector receiving the statuses.</param>
+    /// <param name="storage">Site storage exposing <c>secret_mirror_status</c>.</param>
+    /// <param name="logger">Logger instance.</param>
+    /// <param name="pollInterval">Poll interval override; defaults to <see cref="DefaultPollInterval"/> (30 s).</param>
+    public SecretMirrorStatusReporter(
+        ISiteHealthCollector collector,
+        SiteStorageService storage,
+        ILogger<SecretMirrorStatusReporter> logger,
+        TimeSpan? pollInterval = null)
+    {
+        _collector = collector ?? throw new ArgumentNullException(nameof(collector));
+        _storage = storage ?? throw new ArgumentNullException(nameof(storage));
+        _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+        _pollInterval = pollInterval ?? DefaultPollInterval;
+    }
+
+    /// <inheritdoc />
+    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
+    {
+        await ProbeAsync().ConfigureAwait(false);
+
+        while (!stoppingToken.IsCancellationRequested)
+        {
+            try
+            {
+                await Task.Delay(_pollInterval, stoppingToken).ConfigureAwait(false);
+            }
+            catch (OperationCanceledException)
+            {
+                break;
+            }
+
+            await ProbeAsync().ConfigureAwait(false);
+        }
+    }
+
+    /// <summary>
+    /// Reads every node's mirror status and pushes it onto the collector; never throws.
+    /// Public so a test can drive one deterministic probe.
+    /// </summary>
+    /// <returns>A task that completes when the probe has finished.</returns>
+    public async Task ProbeAsync()
+    {
+        try
+        {
+            var statuses = await _storage.GetSecretMirrorStatusesAsync().ConfigureAwait(false);
+            _collector.SetSecretMirrorStatuses(statuses);
+        }
+        catch (Exception ex)
+        {
+            // Catch-all is deliberate: health reporting must never take the node down, and
+            // the loop must survive so the next tick retries.
+            _logger.LogWarning(ex, "SecretMirrorStatusReporter probe failed; next tick will retry.");
+        }
+    }
+}

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/ServiceCollectionExtensions.cs

@@ -140,6 +140,13 @@ public static class ServiceCollectionExtensions
         services.AddSingleton<DeployedSecretsMirror>();
         services.AddHostedService(sp => sp.GetRequiredService<DeployedSecretsMirror>());
 
+        // Review finding M1: forward every node's replicated secret_mirror_status row onto the
+        // site health report, so the ACTIVE node's report carries the STANDBY's mirror failures.
+        services.AddHostedService(sp => new SecretMirrorStatusReporter(
+            sp.GetRequiredService<HealthMonitoring.ISiteHealthCollector>(),
+            sp.GetRequiredService<SiteStorageService>(),
+            sp.GetRequiredService<ILogger<SecretMirrorStatusReporter>>()));
+
         return services;
     }