Resolve all high-severity architecture review findings

This commit is contained in:
Joseph Doherty
2026-09-09 16:13:58 -04:00
parent 8bfe65512e
commit 146a13238f
192 changed files with 3160 additions and 753 deletions
@@ -199,3 +199,12 @@ Delivery max-retry-count and retry interval are not part of `NotificationOutboxO
- **Central UI**: Queries the `Notifications` table for the Notification Outbox page and issues operator Retry/Discard actions on parked notifications.
- **Health Monitoring**: Polls the outbox for KPI tiles on the health dashboard.
- **KPI History (#26)**: Emits `IKpiSampleSource` (`NotificationOutboxKpiSampleSource`, Global + per-Site + per-Node) consumed by the KpiHistory recorder (#26), reusing the existing `Compute…KpisAsync` reads; the resulting `queueDepth` / `stuckCount` / `parkedCount` / `deliveredLastInterval` / `oldestPendingAgeSeconds` series render as trends on the Notification Outbox page via `KpiTrendChart`. See [Component-KpiHistory.md](Component-KpiHistory.md).
### Site-scoped delivery-status queries (2026-09-09)
The central gRPC ingress adds its credential-verified site identity to the internal status
query; the site cannot supply or override this field on the wire. The outbox compares it to
the stored notification's `SourceSiteId` before returning delivery state or error details.
A foreign or unknown notification returns the same `Found = false` response. Existing trusted
in-process central callers may omit the site constraint. Notification ingest remains
idempotent on `NotificationId`; this does not imply row-level dispatch claiming.