infra(docker)+test(siteeventlog): close register tripwires 79 + 93 — rig data to named volumes; pin site_events schema to the cap-model calibration

Row 79 executed its own prescribed remedy without waiting for a second
corruption: all ten rig data dirs (8 docker/ nodes + 2 docker-env2/ site
nodes) move from virtiofs bind mounts to named docker volumes
(scadabridge-<node>-data), seeded in place with both rigs stopped and
live-verified (site-a localDbReplicationConnected=true / backlog 0 over
the migrated files; env2 stable, 0 restarts). The feared inspectability
loss is moot — OrbStack exposes volumes at ~/OrbStack/docker/volumes/.
The rebuild surfaced latent env2 drift (pre-Secrets-0.6.2 image): env2
now carries the x-secrets-store-env posture + central data volumes.

Row 93's silent maintenance trap is now loud: SiteEventsSchemaCalibrationTests
pins the site_events columns/indexes the EventLogPurgeService size model is
calibrated against, failing with a pointer to the memo §4 recalibration on
any schema drift. Rows 92 (accepted by design) and 94 (standing tripwire)
annotated accordingly.

docker-env2/docker-compose.yml

@@ -1,3 +1,13 @@
+# Secrets 0.6.2 requires Secrets:SqlitePath to be absolute AND outside the content root
+# (/app) — mirrors docker/docker-compose.yml's x-secrets-store-env anchor, including the
+# trap documented there: DELETING the key does not fall back to the per-user default, it
+# yields the RELATIVE "secrets.db", which fails both rules and the node refuses to boot.
+# (env2 ran a stale pre-0.6.2 image until the 2026-08-18 rebuild, which surfaced this.)
+# /data is the node's own data volume mounted a second time outside /app, so the store
+# shares the durable volume without living under the content root.
+x-secrets-store-env: &secrets-store-env
+  Secrets__SqlitePath: "/data/scadabridge-secrets.db"
+
 services:
   central-a:
     image: scadabridge:latest
@@ -7,6 +17,7 @@ services:
     stop_grace_period: 30s
     container_name: scadabridge-env2-central-a
     environment:
+      <<: *secrets-store-env
       SCADABRIDGE_CONFIG: Central
       ASPNETCORE_ENVIRONMENT: Development
       ASPNETCORE_URLS: "http://+:5000"
@@ -25,6 +36,10 @@ services:
       - "9111:8081"   # Akka remoting
     volumes:
       - ./central-node-a/appsettings.Central.json:/app/appsettings.Central.json:ro
+      - central-node-a-data:/app/data
+      # Same named volume, mounted a second time OUTSIDE the content root (/app) for the
+      # secrets store — see the x-secrets-store-env anchor above.
+      - central-node-a-data:/data
       - ./central-node-a/logs:/app/logs
     networks:
       - scadabridge-net
@@ -38,6 +53,7 @@ services:
     stop_grace_period: 30s
     container_name: scadabridge-env2-central-b
     environment:
+      <<: *secrets-store-env
       SCADABRIDGE_CONFIG: Central
       ASPNETCORE_ENVIRONMENT: Development
       ASPNETCORE_URLS: "http://+:5000"
@@ -56,6 +72,10 @@ services:
       - "9112:8081"   # Akka remoting
     volumes:
       - ./central-node-b/appsettings.Central.json:/app/appsettings.Central.json:ro
+      - central-node-b-data:/app/data
+      # Same named volume, mounted a second time OUTSIDE the content root (/app) for the
+      # secrets store — see the x-secrets-store-env anchor above.
+      - central-node-b-data:/data
       - ./central-node-b/logs:/app/logs
     networks:
       - scadabridge-net
@@ -69,6 +89,7 @@ services:
     stop_grace_period: 30s
     container_name: scadabridge-env2-site-x-a
     environment:
+      <<: *secrets-store-env
       SCADABRIDGE_CONFIG: Site
       # Register row 63 — mirrors docker/docker-compose.yml. Enables the Development-only
       # DI scope validation (register row 50) on the site nodes, which previously ran
@@ -79,7 +100,10 @@ services:
       - "9123:8083"   # gRPC streaming
     volumes:
       - ./site-x-node-a/appsettings.Site.json:/app/appsettings.Site.json:ro
-      - ./site-x-node-a/data:/app/data
+      - site-x-node-a-data:/app/data
+      # Same named volume, mounted a second time OUTSIDE the content root (/app) for the
+      # secrets store — see the x-secrets-store-env anchor above.
+      - site-x-node-a-data:/data
       - ./site-x-node-a/logs:/app/logs
     networks:
       - scadabridge-net
@@ -93,6 +117,7 @@ services:
     stop_grace_period: 30s
     container_name: scadabridge-env2-site-x-b
     environment:
+      <<: *secrets-store-env
       SCADABRIDGE_CONFIG: Site
       # Register row 63 — mirrors docker/docker-compose.yml. Enables the Development-only
       # DI scope validation (register row 50) on the site nodes, which previously ran
@@ -103,7 +128,10 @@ services:
       - "9124:8083"   # gRPC streaming
     volumes:
       - ./site-x-node-b/appsettings.Site.json:/app/appsettings.Site.json:ro
-      - ./site-x-node-b/data:/app/data
+      - site-x-node-b-data:/app/data
+      # Same named volume, mounted a second time OUTSIDE the content root (/app) for the
+      # secrets store — see the x-secrets-store-env anchor above.
+      - site-x-node-b-data:/data
       - ./site-x-node-b/logs:/app/logs
     networks:
       - scadabridge-net
@@ -125,3 +153,19 @@ services:
 networks:
   scadabridge-net:
     external: true
+
+# Named volumes for the nodes' SQLite data dirs — mirrors docker/docker-compose.yml
+# (register row 79: bind mounts cross OrbStack's virtiofs, which does not give SQLite
+# true fsync durability). Host-side inspection via ~/OrbStack/docker/volumes/<name>.
+# The central volumes are NEW with the Secrets 0.6.2 posture — env2 centrals previously
+# kept data on the container overlay (lost on recreate), which 0.6.2's store-path guard
+# exists to prevent.
+volumes:
+  central-node-a-data:
+    name: scadabridge-env2-central-node-a-data
+  central-node-b-data:
+    name: scadabridge-env2-central-node-b-data
+  site-x-node-a-data:
+    name: scadabridge-env2-site-x-node-a-data
+  site-x-node-b-data:
+    name: scadabridge-env2-site-x-node-b-data