Merge branch 'worktree-agent-aaec6546913f0beae' into arch-review-remediation

src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/Repositories/SiteRepository.cs

@@ -2,6 +2,7 @@ using Microsoft.EntityFrameworkCore;
 using ZB.MOM.WW.ScadaBridge.Commons.Entities.Instances;
 using ZB.MOM.WW.ScadaBridge.Commons.Entities.Sites;
 using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories;
+using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services;
 
 namespace ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Repositories;
 
@@ -11,14 +12,23 @@ namespace ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Repositories;
 public class SiteRepository : ISiteRepository
 {
     private readonly ScadaBridgeDbContext _dbContext;
+    private readonly ITemplateGraphWatermark? _watermark;
 
     /// <summary>
     /// Initializes a new instance of the SiteRepository.
     /// </summary>
     /// <param name="dbContext">The database context.</param>
-    public SiteRepository(ScadaBridgeDbContext dbContext)
+    /// <param name="watermark">
+    /// Graph version watermark bumped when a committed change alters a flattening
+    /// input this repository owns (see <see cref="SaveChangesAsync"/>). Optional so
+    /// existing single-argument construction (tests, ad-hoc tooling) keeps
+    /// compiling; when absent the caches simply never get the invalidation signal
+    /// from this repository, which is the pre-existing behaviour.
+    /// </param>
+    public SiteRepository(ScadaBridgeDbContext dbContext, ITemplateGraphWatermark? watermark = null)
     {
         _dbContext = dbContext ?? throw new ArgumentNullException(nameof(dbContext));
+        _watermark = watermark;
     }
 
     // --- Sites ---
@@ -166,8 +176,58 @@ public class SiteRepository : ISiteRepository
     }
 
     /// <inheritdoc />
+    /// <remarks>
+    /// Bumps the <see cref="ITemplateGraphWatermark"/> after a successful commit
+    /// that touched a <see cref="DataConnection"/>.
+    ///
+    /// <para>
+    /// A data connection's <c>Protocol</c>, primary/backup configuration and
+    /// failover retry count are flattening inputs — <c>FlatteningService</c>
+    /// packages them into the flattened config's <c>Connections</c> map and
+    /// <c>RevisionHashService</c> folds them into the revision hash. Without a bump,
+    /// the process-wide <c>StaleInstanceProbe</c> memo and the flatten-session
+    /// caches keep reporting the pre-edit hash for every instance bound to the
+    /// connection, so an instance whose deployed config genuinely drifted reads as
+    /// up to date.
+    /// </para>
+    ///
+    /// <para>
+    /// The bump is <see cref="ITemplateGraphWatermark.BumpAll"/> rather than a
+    /// per-template one because a connection has no owning template: the affected
+    /// set is "every instance at the site bound to it", which is exactly what the
+    /// unattributed fallback is for. Applied only AFTER a successful commit, so a
+    /// failed save does not invalidate caches for a change that never landed.
+    /// Sites, areas and instances saved here are left alone — only the connection
+    /// rows feed the flattener.
+    /// </para>
+    /// </remarks>
     public async Task<int> SaveChangesAsync(CancellationToken cancellationToken = default)
     {
-        return await _dbContext.SaveChangesAsync(cancellationToken);
+        // Inspect BEFORE committing: afterwards every entry is Unchanged and the
+        // attribution is lost.
+        var connectionsChanged = _watermark is not null && HasPendingDataConnectionChange();
+
+        var written = await _dbContext.SaveChangesAsync(cancellationToken);
+
+        if (connectionsChanged)
+            _watermark!.BumpAll();
+
+        return written;
+    }
+
+    /// <summary>
+    /// True when the change tracker holds an added, modified or deleted
+    /// <see cref="DataConnection"/>.
+    /// </summary>
+    /// <returns>Whether a data-connection mutation is about to be committed.</returns>
+    private bool HasPendingDataConnectionChange()
+    {
+        foreach (var entry in _dbContext.ChangeTracker.Entries<DataConnection>())
+        {
+            if (entry.State is EntityState.Added or EntityState.Modified or EntityState.Deleted)
+                return true;
+        }
+
+        return false;
     }
 }

src/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase/Repositories/TemplateEngineRepository.cs

@@ -865,7 +865,18 @@ public class TemplateEngineRepository : ITemplateEngineRepository
                     unattributed = true;
                     break;
                 default:
-                    // Areas, folders and anything else do not feed the flattener.
+                    // Anything this switch does not recognise is invalidated
+                    // conservatively, as the doc comment above promises. The
+                    // previous "areas, folders and anything else do not feed the
+                    // flattener" no-op was wrong in at least one shipped case:
+                    // DataConnection rows land here, and their Protocol /
+                    // Primary+Backup configuration / FailoverRetryCount ARE hash
+                    // inputs (FlatteningService packages them as ConnectionConfig,
+                    // RevisionHashService hashes them as HashableConnection). A
+                    // silent no-op on an unrecognised entity is the one failure
+                    // mode this watermark must not have: it produces STALE work,
+                    // whereas an over-broad bump only ever produces extra work.
+                    unattributed = true;
                     break;
             }
         }