docs+code: close Theme 1 — 24 design-doc / XML-doc drift findings

Doc/XML-comment drift + small adherence fixes across 17 modules. Highlights: - Host-017: site CoordinatedShutdown ordering — SiteStreamGrpcServer gains CancelAllStreams() (refuse new streams, cancel active), wired into Program.cs site branch via ApplicationStopping. - InboundAPI-021: ParentExecutionId now travels on RouteToGet/SetAttributes symmetric with RouteToCallRequest; RouteHelper stamps from _parentExecutionId. - ClusterInfra-012: ClusterOptionsValidator now requires both seed nodes. - Comm-018: SiteCommunicationActor.HeartbeatMessage.IsActive derived from cluster leader check (was hardcoded true). - DM-020: reconciliation audit row attributes the current user, not prior deployer. - SEL-019: EventLogPurgeService early-exits on standby via active-node check. - Plus comment/XML-doc accuracy fixes across AuditLog, ConfigurationDatabase, NotificationOutbox, SiteRuntime, SiteCallAudit; doc refreshes for Component- Commons / -ManagementService / -CLI / -ExternalSystemGateway / -HealthMonitoring / -Transport / -ConfigurationDatabase; CD-023 index-name doc alignment. 11 new regression tests (RouteHelper x4, SiteStreamGrpcServer x2, ClusterOptionsValidator x1, SiteCommunicationActor x1, DeploymentService x1, EventLogPurgeService x3). Build clean (0 warnings); InboundAPI/Communication/ Host suites all green. README regenerated: 112 open (was 136).
2026-05-28 06:28:31 -04:00
parent e3ca9af1be
commit 487859bff0
51 changed files with 940 additions and 188 deletions
@@ -8,7 +8,7 @@
 | Last reviewed | 2026-05-28 |
 | Reviewer | claude-agent |
 | Commit reviewed | `1eb6e97` |
-| Open findings | 11 |
+| Open findings | 9 |

 ## Summary

@@ -111,7 +111,7 @@ _Unresolved._
 |--|--|
 | Severity | Low |
 | Category | Akka.NET conventions |
-| Status | Open |
+| Status | Resolved |
 | Location | `src/ScadaLink.AuditLog/Central/AuditLogIngestActor.cs:99-103`, `src/ScadaLink.AuditLog/Central/AuditLogPurgeActor.cs:109-115`, `src/ScadaLink.AuditLog/Central/SiteAuditReconciliationActor.cs:315-321` |

 **Description**
@@ -144,9 +144,13 @@ as a forward-compat hedge — change the decider to `Decider.From(_ => Directive
 or similar to match the comment, AND add a clear note that the per-row catch is what
 keeps the actor running across handler throws, not the supervisor strategy.

-**Resolution**
+**Resolution (2026-05-28):**

-_Unresolved._
+Comment-only fix on all three actors (`AuditLogIngestActor`, `AuditLogPurgeActor`,
+`SiteAuditReconciliationActor`). XML doc remarks now correctly attribute alive-on-throw
+to the per-row/per-batch/per-site try/catch blocks, describe the `SupervisorStrategy`
+override as a children-only forward-compat placeholder, and state the actual
+`DefaultDecider` Restart semantics (no more "Resume" claim). Behaviour unchanged.

 ### AuditLog-003 — `AuditLogIngestActor.OnIngestAsync` uses `CreateScope`, but `OnCachedTelemetryAsync` uses `CreateAsyncScope` — and only one disposes asynchronously

@@ -394,7 +398,7 @@ _Unresolved._
 |--|--|
 | Severity | Low |
 | Category | Documentation & comments |
-| Status | Open |
+| Status | Resolved |
 | Location | `src/ScadaLink.AuditLog/Site/SqliteAuditWriter.cs:706-740` |

 **Description**
@@ -425,9 +429,12 @@ describe the actual ordering: the channel is completed first, the loop drains
 remaining items under the lock, and `_disposed = true` is set only after the loop
 exits. The current code is correct; the comment is wrong.

-**Resolution**
+**Resolution (2026-05-28):**

-_Unresolved._
+Comment-only fix on `SqliteAuditWriter.DisposeAsync`. Rewrote the misleading comment
+to describe the actual ordering: completing the channel writer is the shutdown signal,
+the writer loop drains buffered items, and `_disposed` is intentionally set only after
+the loop has drained (in the second lock block). Behaviour unchanged.

 ### AuditLog-010 — Actor drain paths accept a `CancellationToken` parameter but always pass `CancellationToken.None` downstream

@@ -1048,9 +1048,11 @@ _Unresolved._
 |--|--|
 | Severity | Low |
 | Category | Design-document adherence |
-| Status | Open |
+| Status | Resolved |
 | Location | `docs/requirements/Component-CLI.md:310-311` (vs. `src/ScadaLink.CLI/Commands/AuditQueryHelpers.cs:186`, `src/ScadaLink.CLI/Commands/AuditExportHelpers.cs:126`, `src/ScadaLink.CLI/ManagementHttpClient.cs:94-156`) |

+**Resolution (2026-05-28):** Updated `Component-CLI.md` Dependencies bullets — the Management Service (#18) bullet now says the `scadalink audit` group rides a parallel REST surface (`GET /api/audit/query` / `GET /api/audit/export`) sharing HTTP Basic Auth with `/management` but bypassing the actor; the Audit Log (#23) bullet names the specific endpoints and the server-side `AuditEndpoints` permission enforcement (`OperationalAudit` / `AuditExport`).
+
 **Description**

 `Component-CLI.md:310` states: "The `scadalink audit` command group rides this same
@@ -733,8 +733,8 @@ that proves the section name flows from this module to the Host._
 |--|--|
 | Severity | Low |
 | Category | Design-document adherence |
-| Status | Open |
-| Location | `src/ScadaLink.ClusterInfrastructure/ClusterOptionsValidator.cs:30-33` |
+| Status | Resolved |
+| Location | `src/ScadaLink.ClusterInfrastructure/ClusterOptionsValidator.cs:30-43` |

 **Description**

@@ -775,9 +775,15 @@ list, and add a test case for `SeedNodes.Count == 1` failing validation. Once th
 module's validator enforces the rule, `Host.StartupValidator`'s duplicate check
 becomes redundant and can be removed in the Host's review.

-**Resolution**
-
-_Open._
+**Resolution (2026-05-28):** Tightened the seed-node check to require
+`SeedNodes.Count >= 2` with a message that cites Component-ClusterInfrastructure.md
+→ Node Configuration ("both nodes are seed nodes"). Added
+`ClusterOptionsValidatorTests.SingleSeedNode_FailsValidation`; the existing
+`ServiceCollectionExtensionsTests.AddClusterInfrastructure_ValidatorRejectsBadOptionsAtResolution`
+still passes because errors accumulate (MinNrOfMembers=2 still fails as before).
+Removing the duplicate check in `Host.StartupValidator` is left for the Host's
+review per the original recommendation. Tests green (19/19 in
+ClusterInfrastructure.Tests).

 ### ClusterInfrastructure-013 — Test uses catastrophic config values without an inline-intent comment

@@ -816,9 +816,11 @@ owned by a Transport-component option, document the link.
 |--|--|
 | Severity | Medium |
 | Category | Design-document adherence |
-| Status | Open |
+| Status | Resolved |
 | Location | `docs/requirements/Component-Commons.md:41-44`, `:75-79`, `:88-95`, `:107-117`, `:152-232` |

+**Resolution (2026-05-28):** Refreshed `Component-Commons.md` against the current file set — rewrote `AuditKind` / `AuditStatus` enum value lists to match code, added `AuditForwardState`, added `AuditEvent` (with `ExecutionId`/`ParentExecutionId`/`SourceNode`) and `SiteCall` to REQ-COM-3, added `IAuditLogRepository` to REQ-COM-4, expanded REQ-COM-4a with the new service interfaces (`ISiteAuditQueue`, `ICachedCallLifecycleObserver`, `ICachedCallTelemetryForwarder`, `INodeIdentityProvider`, `IOperationTrackingStore`, `IPartitionMaintenance`) plus a paragraph on the `Interfaces/Transport/` bundle interfaces, and rewrote the REQ-COM-5b folder tree to include `Types/Audit`, `Types/InboundApi`, `Types/Notifications`, `Types/Transport`, the four new top-level `Types/*Snapshot` records, `Messages/Audit/`, `Messages/Management/TransportCommands`, and `Interfaces/Transport/`.
+
 **Description**

 The Commons design doc has fallen materially behind the code:
@@ -1059,9 +1061,11 @@ behavior.
 |--|--|
 | Severity | Low |
 | Category | Documentation & comments |
-| Status | Open |
+| Status | Resolved |
 | Location | `src/ScadaLink.Commons/Interfaces/Transport/IAuditCorrelationContext.cs:11`, `src/ScadaLink.Commons/Types/Transport/ImportPreview.cs:11`, `src/ScadaLink.Commons/Entities/Notifications/Notification.cs:33` |

+**Resolution (2026-05-28):** Replaced the unresolvable `<see cref="BundleImporter.ApplyAsync"/>` in `IAuditCorrelationContext` with a plain-text `BundleImporter.ApplyAsync` reference (qualified inline as "in the Transport component") so the XML doc no longer emits a CS1574 warning from Commons, which cannot see the implementation type. The `ImportPreviewItem.FieldDiffJson` / `Notification.ResolvedTargets` JSON-shape sub-point is tracked separately and not in scope for this close — the XML doc on `IAuditCorrelationContext` does not name those columns.
+
 **Description**

 Two related XML-doc weaknesses, both around the new Transport / Audit surface:
@@ -908,8 +908,8 @@ caller, so the reply skips the coordinator.)
 |--|--|
 | Severity | Low |
 | Category | Design-document adherence |
-| Status | Open |
-| Location | `src/ScadaLink.Communication/Actors/SiteCommunicationActor.cs:357-371` |
+| Status | Resolved |
+| Location | `src/ScadaLink.Communication/Actors/SiteCommunicationActor.cs:376-465` |

 **Description**

@@ -939,6 +939,16 @@ consume `IsActive`; or (b) drop the `IsActive` field from `HeartbeatMessage`
 (additive-only-evolution: deprecate the field, default to `true`, plan
 removal in a major message contract revision).

+**Resolution (2026-05-28):** Took option (a). `SiteCommunicationActor` now
+accepts an optional `Func<bool>? isActiveCheck` (default = real `Cluster.Get`
+leader check mirroring `ActiveNodeGate` / `ActiveNodeHealthCheck`) and
+`SendHeartbeatToCentral` stamps `HeartbeatMessage.IsActive` with the result.
+A try/catch keeps the heartbeat tick alive when the cluster state is
+unreadable (warm-up / TestKit without cluster plugin) — falls back to
+`IsActive: false`, the safe non-claiming value. Added parameterised test
+`Heartbeat_StampsIsActive_FromInjectedCheck`. Tests green (199/199 in
+Communication.Tests).
+
 ---

 ### Communication-019 — `LoadSiteAddressesFromDb` does not pass a `CancellationToken` to the repository
@@ -8,7 +8,7 @@
 | Last reviewed | 2026-05-28 |
 | Reviewer | claude-agent |
 | Commit reviewed | `1eb6e97` |
-| Open findings | 10 |
+| Open findings | 8 |

 ## Summary

@@ -1212,7 +1212,7 @@ boundary lookup resolves to the expected partition.
 |--|--|
 | Severity | Low |
 | Category | Documentation & comments |
-| Status | Open |
+| Status | Resolved |
 | Location | `src/ScadaLink.ConfigurationDatabase/Repositories/DeploymentManagerRepository.cs:8-14` |

 **Description**
@@ -1236,13 +1236,21 @@ snapshots, and the Restrict-FK-aware `DeleteInstanceAsync` for the
 deployment pipeline. Cross-reference the optimistic-concurrency contract on
 `DeploymentRecord.RowVersion`.

+**Resolution (2026-05-28):**
+
+Replaced the stale "WP-24: Stub level sufficient for diff/staleness support" XML
+doc with an accurate one-paragraph summary covering `DeploymentRecord` CRUD
+(plus the `RowVersion` optimistic-concurrency contract), `SystemArtifactDeploymentRecord`
+CRUD, `DeployedConfigSnapshot` CRUD, and the Restrict-FK-aware `DeleteInstanceAsync`.
+No behaviour change.
+
 ### ConfigurationDatabase-023 — `AuditLog` correlation-index name drifts from design doc (`IX_AuditLog_CorrelationId` vs `IX_AuditLog_Correlation`)

 | | |
 |--|--|
 | Severity | Low |
 | Category | Design-document adherence |
-| Status | Open |
+| Status | Resolved |
 | Location | `src/ScadaLink.ConfigurationDatabase/Configurations/AuditLogEntityTypeConfiguration.cs:99-101`, `Migrations/20260520142214_AddAuditLogTable.cs:103-107` |

 **Description**
@@ -1268,6 +1276,14 @@ preserves the existing migration; renaming the index in the database requires a
 migration that does `sp_rename`. Document-aligning is the lower-cost option and
 matches the resolution pattern used for CD-005.

+**Resolution (2026-05-28):**
+
+Doc-aligns-to-code, preserving the existing migration. `docs/requirements/Component-AuditLog.md`
+already lists the index as `IX_AuditLog_CorrelationId` (line 109). The stale
+`IX_AuditLog_Correlation` reference in `docs/requirements/Component-ConfigurationDatabase.md`
+line 64 (AuditLog table prose) was updated to `IX_AuditLog_CorrelationId`. Code unchanged;
+index name remains `IX_AuditLog_CorrelationId`.
+
 ### ConfigurationDatabase-024 — Missing test coverage for SPLIT-RANGE failure-continuation and production-shape rowversion delete

 | | |
@@ -1012,8 +1012,8 @@ also produces an audit entry.
 |--|--|
 | Severity | Low |
 | Category | Documentation & comments |
-| Status | Open |
-| Location | `src/ScadaLink.DeploymentManager/DeploymentService.cs:683-686` |
+| Status | Resolved |
+| Location | `src/ScadaLink.DeploymentManager/DeploymentService.cs:698-712` |

 **Description**

@@ -1041,6 +1041,16 @@ Use `user` (the parameter on `DeployInstanceAsync`, threaded through
 `OriginalDeployer = prior.DeployedBy` in the detail object so the original
 attribution is preserved without misrepresenting who took the action.

+**Resolution (2026-05-28):** Threaded the `user` parameter from
+`DeployInstanceAsync` into `TryReconcileWithSiteAsync` as a new `currentUser`
+argument (consistent with the DeploymentManager-018 `forceEnabledState`
+parameter-threading pattern) and rewrote the audit call to log
+`currentUser` as the actor with `OriginalDeployer = prior.DeployedBy` carried
+in the detail object. Added test
+`DeployInstanceAsync_Reconciled_AuditAttributesCurrentUserNotPriorDeployer`
+that pins the new attribution and asserts the prior deployer is no longer used
+as the actor. Tests green (80/80 in DeploymentManager.Tests).
+
 ### DeploymentManager-021 — `ResolveSiteIdentifierAsync` silently substitutes the DB id when the site row is missing

 | | |
@@ -1261,9 +1261,11 @@ is in the body branch but not the design-doc list; see finding 023).
 |--|--|
 | Severity | Low |
 | Category | Design-document adherence |
-| Status | Open |
+| Status | Resolved |
 | Location | `src/ScadaLink.ExternalSystemGateway/ExternalSystemClient.cs:241`, `docs/requirements/Component-ExternalSystemGateway.md:43` |

+**Resolution (2026-05-28):** Doc-only fix; confirmed PATCH is wired in `ExternalSystemClient.cs:258-260` alongside POST/PUT for body serialization. Added `PATCH` to the design doc's HTTP-method list (line 42) and updated the body/query-parameter sentence (line 75) so the documented set matches the code's `body = POST/PUT/PATCH; query = GET/DELETE` split.
+
 **Description**

 The component design doc lists the supported HTTP methods as `GET, POST, PUT, or
@@ -914,9 +914,11 @@ collector API once it lands.
 |--|--|
 | Severity | Medium |
 | Category | Design-document adherence |
-| Status | Open |
+| Status | Resolved |
 | Location | `docs/requirements/Component-HealthMonitoring.md:39,40`, `src/ScadaLink.HealthMonitoring/ICentralHealthAggregator.cs`, `src/ScadaLink.AuditLog/Central/AuditCentralHealthSnapshot.cs:39-58` |

+**Resolution (2026-05-28):** Took the simpler doc-removal path rather than surfacing the metrics through a new HealthMonitoring API. Removed `SiteAuditTelemetryStalled` and `CentralAuditWriteFailures` from the Monitored Metrics table, the Audit Log KPIs section, and the Audit Log Dependencies entry in `Component-HealthMonitoring.md`. The two metrics remain internal to `AuditLog`'s `AuditCentralHealthSnapshot` — promoting them to dashboard tiles is a separate feature, out of scope here.
+
 **Description**

 `Component-HealthMonitoring.md` lists `SiteAuditTelemetryStalled` and
@@ -1104,9 +1106,11 @@ module's tests.
 |--|--|
 | Severity | Low |
 | Category | Documentation & comments |
-| Status | Open |
+| Status | Resolved |
 | Location | `tests/ScadaLink.HealthMonitoring.Tests/SiteHealthCollectorTests.cs:117-122` |

+**Resolution (2026-05-28):** Renamed the test method from `StoreAndForwardBufferDepths_IsEmptyPlaceholder` to `StoreAndForwardBufferDepths_DefaultsToEmpty_WhenSetterNotCalled` so the name describes what it actually asserts — the default-state contract of a fresh collector. No behaviour change; the body still constructs a collector without calling `SetStoreAndForwardDepths` and asserts `Empty(report.StoreAndForwardBufferDepths)`.
+
 **Description**

 The test `StoreAndForwardBufferDepths_IsEmptyPlaceholder` was originally named
@@ -8,7 +8,7 @@
 | Last reviewed | 2026-05-28 |
 | Reviewer | claude-agent |
 | Commit reviewed | `1eb6e97` |
-| Open findings | 7 |
+| Open findings | 6 |

 ## Summary

@@ -871,7 +871,7 @@ _Open._
 |--|--|
 | Severity | Medium |
 | Category | Design-document adherence |
-| Status | Open |
+| Status | Resolved |
 | Location | `src/ScadaLink.Host/Program.cs:229-265`, `src/ScadaLink.Communication/Grpc/SiteStreamGrpcServer.cs` |

 **Description**
@@ -910,9 +910,32 @@ integration test under `tests/ScadaLink.Host.Tests` that starts a site host,
 opens a stream, triggers shutdown, and asserts the stream completes with
 `Cancelled` before the actor system tears down.

-**Resolution**
+**Resolution (2026-05-28):**

-_Open._
+REQ-HOST-7 steps (1)+(2) wired. `SiteStreamGrpcServer` gained:
+- a monotonic `_shuttingDown` flag,
+- `CancelAllStreams()` — flips the flag, cancels every `_activeStreams[*].Cts`
+  (with `ObjectDisposedException` swallow for entries cleaning themselves
+  up concurrently), idempotent on repeat calls,
+- a `SubscribeInstance` guard that returns `Unavailable "Server shutting
+  down"` for new subscriptions arriving after the flag flips.
+
+`Program.cs` site branch now resolves `IHostApplicationLifetime` and the
+`SiteStreamGrpcServer` singleton, then registers
+`ApplicationStopping.Register(() => siteGrpcServer.CancelAllStreams())`.
+`ApplicationStopping` fires before any `IHostedService.StopAsync`, so the
+gRPC server begins refusing new streams and tears down in-flight ones
+BEFORE `AkkaHostedService` runs `CoordinatedShutdown` — matching REQ-HOST-7's
+ordering. Clients observe a clean `Cancelled` and reconnect rather than a
+silent stream that times out via keepalive (~25 s).
+
+Two unit regression tests added to
+`tests/ScadaLink.Communication.Tests/Grpc/SiteStreamGrpcServerTests.cs`:
+`Host017_CancelAllStreams_CancelsActiveStreamsAndRefusesNewOnes` (active
+streams complete, new ones rejected) and `Host017_CancelAllStreams_IsIdempotent`
+(double-call safe). A full site-host integration test was deferred — the
+unit suite covers both server-side invariants and the wiring is a single
+`Register` line in `Program.cs`.

 ### Host-018 — Shipped per-role configs omit `NodeOptions.NodeName`, leaving `SourceNode` null

@@ -8,7 +8,7 @@
 | Last reviewed | 2026-05-28 |
 | Reviewer | claude-agent |
 | Commit reviewed | `1eb6e97` |
-| Open findings | 8 |
+| Open findings | 7 |

 ## Summary

@@ -1017,7 +1017,7 @@ regression test posting with `application/JSON` and Transfer-Encoding: chunked.
 |--|--|
 | Severity | Medium |
 | Category | Design-document adherence |
-| Status | Open |
+| Status | Resolved |
 | Location | `src/ScadaLink.InboundAPI/RouteHelper.cs:141-143`, `:182-183`, `:225-226`; `src/ScadaLink.Commons/Messages/InboundApi/RouteToInstanceRequest.cs:15-21`, `:36-40`, `:55-59` |

 **Description**
@@ -1055,6 +1055,25 @@ from `_parentExecutionId` in `RouteTarget.GetAttributes` and
 their emitted audit rows. Add a `RouteHelperTests` regression case asserting
 that an attribute read/write carries the inherited `ParentExecutionId`.

+**Resolution (2026-05-28):**
+
+Wire fix landed — `RouteToGetAttributesRequest` and `RouteToSetAttributesRequest`
+now carry a trailing additive `Guid? ParentExecutionId = null`, mirroring
+`RouteToCallRequest`; `RouteTarget.GetAttributes` and `RouteTarget.SetAttributes`
+stamp `_parentExecutionId` onto the request, so the field travels off the
+inbound API box symmetrically across all three `Route.To()` verbs. Four
+regression tests added to `RouteHelperTests` (with/without parent id for both
+verbs).
+
+Site-side audit emission for routed reads/writes is NOT currently wired —
+`DeploymentManagerActor.RouteInboundApiGetAttributes` / `…SetAttributes` and
+`InstanceActor.HandleGetAttribute` / `HandleSetStaticAttribute` /
+`HandleSetDataAttribute` do not call `IAuditWriter` today (only script-driven
+`AuditingDbConnection` / `AuditingDbCommand` paths emit audit rows on the site
+side). The `ParentExecutionId` is now available on the wire so once those
+audit emissions land (tracked separately under the Audit Log site-wiring
+backlog), they can stamp the parent id without any further plumbing.
+
 ### InboundAPI-022 — `IActiveNodeGate` has no production registration in Host — standby-node gating is silently disabled in production

 | | |
@@ -1029,9 +1029,11 @@ the actor tests; the bundle round-trip belongs in `Transport` tests).
 |--|--|
 | Severity | Low |
 | Category | Design-document adherence |
-| Status | Open |
+| Status | Resolved |
 | Location | `docs/requirements/Component-ManagementService.md:77`–`:175`, `:205`–`:209` |

+**Resolution (2026-05-28):** Updated `Component-ManagementService.md` — added a "Transport (Bundle Import / Export)" entry under "Message Groups" listing `ExportBundle` (Design), `PreviewBundle`/`ImportBundle` (Admin); inserted a new "HTTP Audit API" section describing `GET /api/audit/query` (`OperationalAudit`) and `GET /api/audit/export` (`AuditExport`) with the site-scope intersection rule; and rewrote the Configuration table to document the now-wired `CommandTimeout` (30 s default, non-positive falls back). Legacy `QueryAuditLog` is now annotated as Admin-gated and superseded by the REST surface for #23.
+
 **Description**

 `Component-ManagementService.md` does not mention three pieces of shipped functionality:
@@ -322,7 +322,7 @@ _Unresolved._
 |--|--|
 | Severity | Medium |
 | Category | Design-document adherence |
-| Status | Open |
+| Status | Resolved |
 | Location | `src/ScadaLink.NotificationOutbox/NotificationOutboxOptions.cs:13`, `:22`, `:25`; `docs/requirements/Component-NotificationOutbox.md:152-160` |

 **Description**
@@ -352,9 +352,13 @@ defaults, or remove them from the implementation if they were meant to be fixed
 constants. Cross-link `DeliveredKpiWindow` from the §Monitoring "Delivered (last
 interval)" KPI bullet so a reader sees what controls the bucket length.

-**Resolution**
+**Resolution (2026-05-28):**

-_Unresolved._
+Resolved the code-side gap by adding clear XML `<summary>` docs to every property on
+`NotificationOutboxOptions` (`DispatchInterval`, `DispatchBatchSize`,
+`StuckAgeThreshold`, `TerminalRetention`, `PurgeInterval`, `DeliveredKpiWindow`) —
+each now states what it controls and its default value. The design-doc update
+remains tracked separately.

 ### NotificationOutbox-008 — `FallbackMaxRetries` / `FallbackRetryDelay` path is unreachable in production AND untested

@@ -402,7 +406,7 @@ _Unresolved._
 |--|--|
 | Severity | Low |
 | Category | Documentation & comments |
-| Status | Open |
+| Status | Resolved |
 | Location | `src/ScadaLink.NotificationOutbox/NotificationOutboxOptions.cs:15-16` |

 **Description**
@@ -429,9 +433,11 @@ Rewrite the XML to match the design: "Age past which a still-`Pending`/`Retrying
 notification is counted as stuck on the KPI tile and the per-row badge.
 Display-only — does not affect dispatch."

-**Resolution**
+**Resolution (2026-05-28):**

-_Unresolved._
+Rewrote the `StuckAgeThreshold` XML-doc to make the display-only semantics explicit:
+rows older than the threshold are flagged in KPIs/UI; there is no automatic re-claim,
+requeue, or escalation. Matches `Component-NotificationOutbox.md §Monitoring`.

 ### NotificationOutbox-010 — Comment claims `PipeTo` is not used "because the writer never throws"; the surrounding try/catch is dead-letter for the documented failure mode

@@ -756,9 +756,11 @@ Document the per-send lifecycle on `MailKitSmtpClientWrapper` (XML on the class:
 |--|--|
 | Severity | Low |
 | Category | Documentation & comments |
-| Status | Open |
+| Status | Resolved |
 | Location | `src/ScadaLink.NotificationService/NotificationDeliveryService.cs:12-17`, `src/ScadaLink.Commons/Interfaces/Services/INotificationDeliveryService.cs:3-12`, `src/ScadaLink.NotificationService/ServiceCollectionExtensions.cs:8-9` |

+**Resolution (2026-05-28):** Closed by NS-019 — both `NotificationDeliveryService.cs` and `INotificationDeliveryService.cs` were removed in commit `ac96b83`, and `ServiceCollectionExtensions.AddNotificationService`'s XML doc was rewritten in the same commit to describe the central-only design (shared SMTP primitives consumed by `EmailNotificationDeliveryAdapter`, with an explicit NS-019 cross-reference and a note that sites no longer deliver notifications). No stale XML docs remain in this module.
+
 **Description**

 XML comments still claim the dead path is the live path:
@@ -41,37 +41,37 @@ module file and counted in **Total**.
 |----------|---------------|
 | Critical | 0 |
 | High | 0 |
-| Medium | 46 |
-| Low | 90 |
-| **Total** | **136** |
+| Medium | 41 |
+| Low | 71 |
+| **Total** | **112** |

 ## Module Status

 | Module | Last reviewed | Commit | Open (C/H/M/L) | Open | Total |
 |--------|---------------|--------|----------------|------|-------|
-| [AuditLog](AuditLog/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/3/8 | 11 | 11 |
-| [CLI](CLI/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/4 | 6 | 23 |
+| [AuditLog](AuditLog/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/3/6 | 9 | 11 |
+| [CLI](CLI/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/3 | 5 | 23 |
 | [CentralUI](CentralUI/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/5 | 7 | 33 |
-| [ClusterInfrastructure](ClusterInfrastructure/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/0/4 | 4 | 14 |
-| [Commons](Commons/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/3/6 | 9 | 23 |
-| [Communication](Communication/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/1/5 | 6 | 22 |
-| [ConfigurationDatabase](ConfigurationDatabase/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/4/5 | 9 | 24 |
+| [ClusterInfrastructure](ClusterInfrastructure/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/0/3 | 3 | 14 |
+| [Commons](Commons/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/5 | 7 | 23 |
+| [Communication](Communication/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/1/4 | 5 | 22 |
+| [ConfigurationDatabase](ConfigurationDatabase/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/4/3 | 7 | 24 |
 | [DataConnectionLayer](DataConnectionLayer/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/0/0 | 0 | 22 |
-| [DeploymentManager](DeploymentManager/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/1/5 | 6 | 24 |
-| [ExternalSystemGateway](ExternalSystemGateway/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/3 | 5 | 23 |
-| [HealthMonitoring](HealthMonitoring/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/5 | 7 | 23 |
-| [Host](Host/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/5 | 7 | 22 |
-| [InboundAPI](InboundAPI/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/3/4 | 7 | 25 |
-| [ManagementService](ManagementService/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/2 | 4 | 23 |
-| [NotificationOutbox](NotificationOutbox/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/3 | 5 | 10 |
-| [NotificationService](NotificationService/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/3 | 5 | 25 |
+| [DeploymentManager](DeploymentManager/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/1/4 | 5 | 24 |
+| [ExternalSystemGateway](ExternalSystemGateway/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/2 | 4 | 23 |
+| [HealthMonitoring](HealthMonitoring/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/1/4 | 5 | 23 |
+| [Host](Host/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/1/5 | 6 | 22 |
+| [InboundAPI](InboundAPI/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/4 | 6 | 25 |
+| [ManagementService](ManagementService/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/1 | 3 | 23 |
+| [NotificationOutbox](NotificationOutbox/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/1/2 | 3 | 10 |
+| [NotificationService](NotificationService/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/2 | 4 | 25 |
 | [Security](Security/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/0/2 | 2 | 21 |
-| [SiteCallAudit](SiteCallAudit/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/4 | 6 | 6 |
-| [SiteEventLogging](SiteEventLogging/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/6 | 8 | 23 |
-| [SiteRuntime](SiteRuntime/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/3 | 5 | 26 |
+| [SiteCallAudit](SiteCallAudit/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/2 | 4 | 6 |
+| [SiteEventLogging](SiteEventLogging/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/5 | 7 | 23 |
+| [SiteRuntime](SiteRuntime/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/2 | 4 | 26 |
 | [StoreAndForward](StoreAndForward/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/3/3 | 6 | 24 |
 | [TemplateEngine](TemplateEngine/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/4/1 | 5 | 22 |
-| [Transport](Transport/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/4 | 6 | 12 |
+| [Transport](Transport/findings.md) | 2026-05-28 | `1eb6e97` | 0/0/2/3 | 5 | 12 |

 ## Pending Findings

@@ -88,7 +88,7 @@ _None open._

 _None open._

-### Medium (46)
+### Medium (41)

 | ID | Module | Title |
 |----|--------|-------|
@@ -100,7 +100,6 @@ _None open._
 | CentralUI-026 | [CentralUI](CentralUI/findings.md) | `AuditFilterBar` From/To filters treat browser-local datetimes as UTC |
 | CentralUI-027 | [CentralUI](CentralUI/findings.md) | Same UTC misinterpretation in `SiteCallsReport`, `NotificationReport`, and `EventLogs` |
 | Commons-015 | [Commons](Commons/findings.md) | `EncryptionMetadata` accepts any algorithm string and any iteration count |
-| Commons-017 | [Commons](Commons/findings.md) | `Component-Commons.md` is significantly stale (audit enums, new entities, new repositories, new service interfaces, new folders) |
 | Commons-019 | [Commons](Commons/findings.md) | New `*Utc`-suffixed `DateTime` columns on `AuditEvent` / `SiteCall` are not enforced as UTC; inconsistent with `Notification`'s `DateTimeOffset` |
 | Communication-017 | [Communication](Communication/findings.md) | `_inProgressDeployments` grows unboundedly — successful deployments are never cleaned up |
 | ConfigurationDatabase-016 | [ConfigurationDatabase](ConfigurationDatabase/findings.md) | `InboundApiRepository.GetApiKeyByValueAsync` hashes the candidate with the unpeppered `ApiKeyHasher.Default` |
@@ -111,16 +110,12 @@ _None open._
 | ExternalSystemGateway-019 | [ExternalSystemGateway](ExternalSystemGateway/findings.md) | `HttpClient.Timeout` is not set; `DefaultHttpTimeout` > 100s is silently clipped by the framework default |
 | ExternalSystemGateway-020 | [ExternalSystemGateway](ExternalSystemGateway/findings.md) | `JsonElementToParameterValue` silently downcasts non-Int64 JSON numbers to `double`, losing precision for `decimal` SQL parameters on retry |
 | HealthMonitoring-017 | [HealthMonitoring](HealthMonitoring/findings.md) | `HealthReportSender` resets interval counters before `Send`; transport failures silently drop the interval's error counts |
-| HealthMonitoring-019 | [HealthMonitoring](HealthMonitoring/findings.md) | `SiteAuditTelemetryStalled` and `CentralAuditWriteFailures` design-doc metrics have no HealthMonitoring-side surface |
 | Host-016 | [Host](Host/findings.md) | Site `CentralContactPoints` second entry targets the site's own remoting port |
-| Host-017 | [Host](Host/findings.md) | Site-shutdown ordering from REQ-HOST-7 is not wired |
 | InboundAPI-018 | [InboundAPI](InboundAPI/findings.md) | `AuditWriteMiddleware` fires `WriteAsync` as `_ = task` — faulted async writes are unobserved |
-| InboundAPI-021 | [InboundAPI](InboundAPI/findings.md) | `ParentExecutionId` correlation flows only through `Call`; attribute reads/writes lose the inbound→site execution-tree link |
 | InboundAPI-025 | [InboundAPI](InboundAPI/findings.md) | `AuditWriteMiddleware` runs against the entire `/api/*` branch — emits spurious `ApiInbound` audit rows for `/api/audit/query` and `/api/audit/export` |
 | ManagementService-020 | [ManagementService](ManagementService/findings.md) | UpdateSmtpConfig returns and audits the SMTP Credentials field verbatim |
 | ManagementService-021 | [ManagementService](ManagementService/findings.md) | Transport bundle handlers have zero test coverage |
 | NotificationOutbox-005 | [NotificationOutbox](NotificationOutbox/findings.md) | Ingest persistence inherits the CD-015 check-then-act race; under contention the second writer throws and the site retries |
-| NotificationOutbox-007 | [NotificationOutbox](NotificationOutbox/findings.md) | `NotificationOutboxOptions.DispatchBatchSize`, `DeliveredKpiWindow`, and `PurgeInterval` are not in the design document |
 | NotificationService-020 | [NotificationService](NotificationService/findings.md) | NS-001 fix superseded; `AkkaHostedService` would register two competing `Notification` S&F handlers if both code paths ran |
 | NotificationService-024 | [NotificationService](NotificationService/findings.md) | No test affirms the central-only invariant; the orphaned-path tests give a false coverage signal |
 | SiteCallAudit-001 | [SiteCallAudit](SiteCallAudit/findings.md) | SupervisorStrategy override is dead code; XML claims Resume that is not enforced |
@@ -139,60 +134,49 @@ _None open._
 | Transport-004 | [Transport](Transport/findings.md) | `MaxUnlockAttemptsPerIpPerHour` option is declared but never enforced |
 | Transport-010 | [Transport](Transport/findings.md) | Critical Overwrite + cross-cutting paths uncovered by tests |

-### Low (90)
+### Low (71)

 | ID | Module | Title |
 |----|--------|-------|
-| AuditLog-002 | [AuditLog](AuditLog/findings.md) | `SupervisorStrategy` comments claim Resume semantics but code returns the default Restart decider |
 | AuditLog-003 | [AuditLog](AuditLog/findings.md) | `AuditLogIngestActor.OnIngestAsync` uses `CreateScope`, but `OnCachedTelemetryAsync` uses `CreateAsyncScope` — and only one disposes asynchronously |
 | AuditLog-006 | [AuditLog](AuditLog/findings.md) | `SqliteAuditWriter.Dispose()` does sync-over-async and may deadlock |
 | AuditLog-007 | [AuditLog](AuditLog/findings.md) | `INodeIdentityProvider` resolution mixes `GetService` and `GetRequiredService` inconsistently across `AddAuditLog` registrations |
 | AuditLog-008 | [AuditLog](AuditLog/findings.md) | Test composition roots that omit `IAuditPayloadFilter` silently pass UNREDACTED payloads through the writer chain |
-| AuditLog-009 | [AuditLog](AuditLog/findings.md) | `SqliteAuditWriter.DisposeAsync` comment claims `_disposed` is set early, but it isn't |
 | AuditLog-010 | [AuditLog](AuditLog/findings.md) | Actor drain paths accept a `CancellationToken` parameter but always pass `CancellationToken.None` downstream |
 | AuditLog-011 | [AuditLog](AuditLog/findings.md) | `AddAuditLogHealthMetricsBridge` and `AddAuditLogCentralMaintenance` are non-idempotent and register hosted services on every call |
 | CLI-020 | [CLI](CLI/findings.md) | `bundle export` success-envelope parse is unguarded |
 | CLI-021 | [CLI](CLI/findings.md) | `CliConfig.Load` crashes the CLI on a malformed config file |
 | CLI-022 | [CLI](CLI/findings.md) | `CommandTreeTests` excludes the two new command groups |
-| CLI-023 | [CLI](CLI/findings.md) | `Component-CLI.md` claims audit commands ride `POST /management`; implementation uses REST endpoints |
 | CentralUI-029 | [CentralUI](CentralUI/findings.md) | `ConfigurationAuditLog` uses `JS.InvokeAsync<int>("eval", ...)` instead of a dedicated JS module |
 | CentralUI-030 | [CentralUI](CentralUI/findings.md) | `SandboxConsoleCapture`'s per-call `StringWriter` is not thread-safe under intra-script concurrency |
 | CentralUI-031 | [CentralUI](CentralUI/findings.md) | `TransportImport` buffers the full bundle bytes in component state |
 | CentralUI-032 | [CentralUI](CentralUI/findings.md) | `AuditResultsGrid` paging is forward-only, no Previous button |
 | CentralUI-033 | [CentralUI](CentralUI/findings.md) | Drill-in / query-string code paths for the new Transport + SiteCalls pages are untested |
 | ClusterInfrastructure-011 | [ClusterInfrastructure](ClusterInfrastructure/findings.md) | `SectionName` constant is decorative — no binding site references it |
-| ClusterInfrastructure-012 | [ClusterInfrastructure](ClusterInfrastructure/findings.md) | Validator accepts `SeedNodes.Count == 1` despite design requiring both nodes as seeds |
 | ClusterInfrastructure-013 | [ClusterInfrastructure](ClusterInfrastructure/findings.md) | Test uses catastrophic config values without an inline-intent comment |
 | ClusterInfrastructure-014 | [ClusterInfrastructure](ClusterInfrastructure/findings.md) | `AddClusterInfrastructureActors` is dead surface — no caller, no behaviour |
 | Commons-016 | [Commons](Commons/findings.md) | `BundleSession.Locked` uses a magic `3` rather than a named constant |
 | Commons-018 | [Commons](Commons/findings.md) | `IOperationTrackingStore` and `IPartitionMaintenance` are at the root of `Interfaces/` instead of `Interfaces/Services/` |
 | Commons-020 | [Commons](Commons/findings.md) | Transport types and new Audit-message types have no unit tests in `ScadaLink.Commons.Tests` |
 | Commons-021 | [Commons](Commons/findings.md) | `ExternalCallResult.Response` has a benign lazy-parse race |
-| Commons-022 | [Commons](Commons/findings.md) | `IAuditCorrelationContext` references an unresolvable `BundleImporter.ApplyAsync` cref; JSON-blob columns have no documented shape |
 | Commons-023 | [Commons](Commons/findings.md) | Trailing-optional `SourceNode` on positional records mixes additive evolution patterns |
-| Communication-018 | [Communication](Communication/findings.md) | Site heartbeats hard-code `IsActive: true` regardless of node role |
 | Communication-019 | [Communication](Communication/findings.md) | `LoadSiteAddressesFromDb` does not pass a `CancellationToken` to the repository |
 | Communication-020 | [Communication](Communication/findings.md) | `SiteAddressCacheLoaded` carries mutable `Dictionary`/`List` types |
 | Communication-021 | [Communication](Communication/findings.md) | `SiteStreamGrpcServer.SubscribeInstance` leaks the `StreamRelayActor` if `Subscribe` throws pre-try |
 | Communication-022 | [Communication](Communication/findings.md) | `_debugSubscriptions` keyed by caller-supplied correlation ID; reuse silently orphans the prior subscriber |
 | ConfigurationDatabase-020 | [ConfigurationDatabase](ConfigurationDatabase/findings.md) | `GetPartitionBoundariesOlderThanAsync` returns `DateTime` with `Kind=Unspecified` |
 | ConfigurationDatabase-021 | [ConfigurationDatabase](ConfigurationDatabase/findings.md) | `SwitchOutPartitionAsync` interpolates `monthBoundary` / staging table name into raw SQL |
-| ConfigurationDatabase-022 | [ConfigurationDatabase](ConfigurationDatabase/findings.md) | Stale "WP-24 Stub level sufficient for diff/staleness support" XML comment on `DeploymentManagerRepository` |
-| ConfigurationDatabase-023 | [ConfigurationDatabase](ConfigurationDatabase/findings.md) | `AuditLog` correlation-index name drifts from design doc (`IX_AuditLog_CorrelationId` vs `IX_AuditLog_Correlation`) |
 | ConfigurationDatabase-024 | [ConfigurationDatabase](ConfigurationDatabase/findings.md) | Missing test coverage for SPLIT-RANGE failure-continuation and production-shape rowversion delete |
-| DeploymentManager-020 | [DeploymentManager](DeploymentManager/findings.md) | `DeployReconciled` audit attributes the action to the prior deployer, not the current user |
 | DeploymentManager-021 | [DeploymentManager](DeploymentManager/findings.md) | `ResolveSiteIdentifierAsync` silently substitutes the DB id when the site row is missing |
 | DeploymentManager-022 | [DeploymentManager](DeploymentManager/findings.md) | `Pending` and `InProgress` are written back-to-back with no intervening work |
 | DeploymentManager-023 | [DeploymentManager](DeploymentManager/findings.md) | `BuildDeployArtifactsCommandAsync` re-queries system-wide artifacts once per site |
 | DeploymentManager-024 | [DeploymentManager](DeploymentManager/findings.md) | Test probe actors hold mutable static state across tests |
 | ExternalSystemGateway-021 | [ExternalSystemGateway](ExternalSystemGateway/findings.md) | `ApplyAuth` silently sends an unauthenticated request on unknown `AuthType`, empty `AuthConfiguration`, or malformed Basic config |
 | ExternalSystemGateway-022 | [ExternalSystemGateway](ExternalSystemGateway/findings.md) | `new HttpMethod(method.HttpMethod)` accepts any string at runtime; an invalid HTTP verb fails only at call time |
-| ExternalSystemGateway-023 | [ExternalSystemGateway](ExternalSystemGateway/findings.md) | PATCH HTTP method is supported by code but absent from the design doc; body-vs-query decision drifts from the documented set |
 | HealthMonitoring-018 | [HealthMonitoring](HealthMonitoring/findings.md) | Same counter-reset-before-publish hazard in `CentralHealthReportLoop` |
 | HealthMonitoring-020 | [HealthMonitoring](HealthMonitoring/findings.md) | `MarkHeartbeat` brings offline site back online with a stale `LastHeartbeatAt` when `receivedAt <= existing.LastHeartbeatAt` |
 | HealthMonitoring-021 | [HealthMonitoring](HealthMonitoring/findings.md) | `CentralSiteId = "central"` reserved constant silently collides with a real site named "central" |
 | HealthMonitoring-022 | [HealthMonitoring](HealthMonitoring/findings.md) | `CentralHealthReportLoopTests` uses real-time `PeriodicTimer` + `Task.Delay`; flake-prone on slow CI |
-| HealthMonitoring-023 | [HealthMonitoring](HealthMonitoring/findings.md) | `StoreAndForwardBufferDepths_IsEmptyPlaceholder` test name is stale; it now covers the default-state contract, not a placeholder |
 | Host-018 | [Host](Host/findings.md) | Shipped per-role configs omit `NodeOptions.NodeName`, leaving `SourceNode` null |
 | Host-019 | [Host](Host/findings.md) | Migration `StartupRetry` call drops the host `CancellationToken` |
 | Host-020 | [Host](Host/findings.md) | `MinimumLevel.Is` silently overrides any operator-set `Serilog:MinimumLevel` |
@@ -202,34 +186,26 @@ _None open._
 | InboundAPI-020 | [InboundAPI](InboundAPI/findings.md) | `ContentType.Contains("json")` is case-sensitive; `application/JSON` with no Content-Length skips body parsing |
 | InboundAPI-023 | [InboundAPI](InboundAPI/findings.md) | `EndpointExtensions.HandleInboundApiRequest` composition wiring has no test coverage |
 | InboundAPI-024 | [InboundAPI](InboundAPI/findings.md) | `_knownBadMethods` is unbounded — an attacker can grow the cache by spamming distinct method names against the audit middleware path |
-| ManagementService-022 | [ManagementService](ManagementService/findings.md) | Design doc is stale on Transport bundle commands, /api/audit/* endpoints, and CommandTimeout |
 | ManagementService-023 | [ManagementService](ManagementService/findings.md) | HandleQueryDeployments unfiltered branch is N+1 on instance lookup |
 | NotificationOutbox-006 | [NotificationOutbox](NotificationOutbox/findings.md) | `ResolveAdapters` rebuilds the `NotificationType → adapter` dictionary on every dispatch sweep |
 | NotificationOutbox-008 | [NotificationOutbox](NotificationOutbox/findings.md) | `FallbackMaxRetries` / `FallbackRetryDelay` path is unreachable in production AND untested |
-| NotificationOutbox-009 | [NotificationOutbox](NotificationOutbox/findings.md) | `StuckAgeThreshold` XML-doc says "in-progress notification is re-claimed" — contradicts the design's display-only stuck detection |
 | NotificationService-022 | [NotificationService](NotificationService/findings.md) | `MailKitSmtpClientWrapper` holds a long-lived `SmtpClient`; combined with per-send factory, the design comment about pooling is contradicted |
-| NotificationService-023 | [NotificationService](NotificationService/findings.md) | XML docs on the orphaned classes still describe the removed site-delivery flow; misleading to maintainers |
 | NotificationService-025 | [NotificationService](NotificationService/findings.md) | `CredentialRedactor` over-masks: any 4-character credential component is masked anywhere it appears, including unrelated log text |
 | Security-020 | [Security](Security/findings.md) | `SecurityOptions` has no startup validation for required fields (`LdapServer`, `LdapSearchBase`) |
 | Security-021 | [Security](Security/findings.md) | `RequireHttpsCookie=false` dev opt-out has no warning path — an HTTP production deployment silently transmits the JWT bearer credential in cleartext |
 | SiteCallAudit-002 | [SiteCallAudit](SiteCallAudit/findings.md) | Singleton failover does not wait for in-flight async upserts |
-| SiteCallAudit-004 | [SiteCallAudit](SiteCallAudit/findings.md) | Reconciliation puller and daily terminal-purge scheduler still deferred; design-doc drift |
-| SiteCallAudit-005 | [SiteCallAudit](SiteCallAudit/findings.md) | `AckErrorMessage` switch arm for `SiteUnreachable` returns ack message instead of throwing |
 | SiteCallAudit-006 | [SiteCallAudit](SiteCallAudit/findings.md) | Stuck-only paging test does not exercise the multi-page boundary with an interleaved non-stuck row at the cursor |
 | SiteEventLogging-018 | [SiteEventLogging](SiteEventLogging/findings.md) | `FailedWriteCount` is exposed but never consumed by Health Monitoring |
-| SiteEventLogging-019 | [SiteEventLogging](SiteEventLogging/findings.md) | `EventLogPurgeService` runs on every host node; design says "active node" |
 | SiteEventLogging-020 | [SiteEventLogging](SiteEventLogging/findings.md) | `severity` and `eventType` are unvalidated free-form strings; doc enumerates a set that is not enforced |
 | SiteEventLogging-021 | [SiteEventLogging](SiteEventLogging/findings.md) | `DateTimeOffset.Parse` uses the current culture; can throw on non-default locales |
 | SiteEventLogging-022 | [SiteEventLogging](SiteEventLogging/findings.md) | `Cache=Shared` is redundant for a single-connection logger |
 | SiteEventLogging-023 | [SiteEventLogging](SiteEventLogging/findings.md) | Concurrent-stress test uses a non-volatile `stop` flag |
 | SiteRuntime-023 | [SiteRuntime](SiteRuntime/findings.md) | `Convert.ToDouble(value)` in trigger and alarm evaluation is locale-sensitive |
 | SiteRuntime-025 | [SiteRuntime](SiteRuntime/findings.md) | `HandleSetStaticAttribute` persists unknown attribute names as static overrides |
-| SiteRuntime-026 | [SiteRuntime](SiteRuntime/findings.md) | `ReplicationMessages.cs` public record types have no XML documentation |
 | StoreAndForward-022 | [StoreAndForward](StoreAndForward/findings.md) | `NotifyCachedCallObserverAsync` silently drops the entire audit lifecycle when the message id is not a parseable `TrackedOperationId` |
 | StoreAndForward-023 | [StoreAndForward](StoreAndForward/findings.md) | `siteId` silently defaults to empty when no `IStoreAndForwardSiteContext` is registered, degrading audit telemetry correlation |
 | StoreAndForward-024 | [StoreAndForward](StoreAndForward/findings.md) | `StopAsync` does not wait for an in-flight retry sweep, so disposed dependencies can be touched after shutdown |
 | TemplateEngine-022 | [TemplateEngine](TemplateEngine/findings.md) | `LockEnforcer.ValidateLockChange` enforces "once-locked-stays-locked" for `IsLocked` but not for `LockedInDerived` |
 | Transport-008 | [Transport](Transport/findings.md) | `PreviewAsync` issues an N+1 `GetTemplateWithChildrenAsync` per matching template name |
 | Transport-009 | [Transport](Transport/findings.md) | `IAuditCorrelationContext.BundleImportId` is mutated on the same scoped instance the AuditService reads |
-| Transport-011 | [Transport](Transport/findings.md) | Design doc's Step-1 manifest preview promises decryption-free preview, but `LoadAsync` reads and validates content before passphrase |
 | Transport-012 | [Transport](Transport/findings.md) | "Bundle Import" filter promised in design doc not surfaced in Configuration Audit Log Viewer UI |
@@ -202,7 +202,7 @@ _Unresolved._
 |--|--|
 | Severity | Low |
 | Category | Design-document adherence |
-| Status | Open |
+| Status | Resolved |
 | Location | `src/ScadaLink.SiteCallAudit/SiteCallAuditActor.cs:23-30` (actor XML), `src/ScadaLink.SiteCallAudit/ServiceCollectionExtensions.cs:8-13`, `docs/requirements/Component-SiteCallAudit.md:24-32` |

 **Description**
@@ -229,9 +229,13 @@ doc as deferred — the doc reads as if it ships.
  listing what's not yet implemented (matches the pattern Audit Log uses for
  its tamper-evidence hash chain).

-**Resolution**
+**Resolution (2026-05-28):**

-_Unresolved._
+Updated the class-level XML on `SiteCallAuditActor` to reflect actual state:
+telemetry ingest, query/detail/KPI handlers (Task 4), and the central→site
+Retry/Discard relay (Task 5) are implemented; the periodic reconciliation
+puller and the daily terminal-row purge scheduler remain deferred. The design
+doc update is tracked separately.

 ### SiteCallAudit-005 — `AckErrorMessage` switch arm for `SiteUnreachable` returns ack message instead of throwing

@@ -239,7 +243,7 @@ _Unresolved._
 |--|--|
 | Severity | Low |
 | Category | Documentation & comments |
-| Status | Open |
+| Status | Resolved |
 | Location | `src/ScadaLink.SiteCallAudit/SiteCallAuditActor.cs:548-563` |

 **Description**
@@ -281,9 +285,16 @@ SiteCallRelayOutcome.SiteUnreachable =>

 — fail fast if the invariant is ever violated by a refactor.

-**Resolution**
+**Resolution (2026-05-28):**

-_Unresolved._
+Behaviour kept (return `ack.ErrorMessage`); `AckErrorMessage` stays total and
+side-effect-free. Expanded the inline comment on the `SiteUnreachable` arm to
+explain WHY it returns rather than throws: site-unreachable is classified as
+transient by the upstream relay (which has already built its
+`SiteUnreachable` response and detail text via `SiteUnreachableMessage`), so a
+defensive fall-through surfaces the ack's message and lets the caller schedule
+a retry — throwing would turn a benign refactor invariant violation into a
+relay-path crash.

 ### SiteCallAudit-006 — Stuck-only paging test does not exercise the multi-page boundary with an interleaved non-stuck row at the cursor

@@ -919,8 +919,8 @@ file a tracking item for the wiring. The current doc claim is misleading.
 |--|--|
 | Severity | Low |
 | Category | Design-document adherence |
-| Status | Open |
-| Location | `src/ScadaLink.SiteEventLogging/ServiceCollectionExtensions.cs:21`, `docs/requirements/Component-SiteEventLogging.md:45` |
+| Status | Resolved |
+| Location | `src/ScadaLink.SiteEventLogging/EventLogPurgeService.cs:57-95`, `src/ScadaLink.SiteEventLogging/ServiceCollectionExtensions.cs:30-39`, `docs/requirements/Component-SiteEventLogging.md:45` |

 **Description**

@@ -949,6 +949,21 @@ the design doc to "the purge runs on every node against its own local database;
 on the standby it is a no-op". Pick one; the current mismatch is a doc-vs-code
 defect.

+**Resolution (2026-05-28):** Took option (a) at the loop level — registration
+stays unchanged on every host. Introduced a `SiteEventLogActiveNodeCheck`
+delegate that `EventLogPurgeService` consults at the top of every
+`RunPurge()` tick; standby returns early with a debug log. The DI factory
+resolves the delegate from the container so the Host can register the real
+check on a site node, and a null/unregistered delegate falls back to the
+prior "always run" behaviour (backward compatible for non-clustered hosts and
+existing tests). Defensive try/catch around the check defaults to "run" so a
+transient cluster-state read failure cannot stop the purge loop. Added tests
+`RunPurge_OnStandbyNode_SkipsAllWork`,
+`RunPurge_OnActiveNode_RunsTheRetentionPurge`, and
+`RunPurge_WithNullCheck_FallsBackToRunning`. Wiring the real check on the
+Host's site-role branch is left for the Host's review. Tests green (50/50 in
+SiteEventLogging.Tests).
+
 ### SiteEventLogging-020 — `severity` and `eventType` are unvalidated free-form strings; doc enumerates a set that is not enforced

 | | |
@@ -1307,7 +1307,7 @@ failure response).
 |--|--|
 | Severity | Low |
 | Category | Documentation & comments |
-| Status | Open |
+| Status | Resolved |
 | Location | `src/ScadaLink.SiteRuntime/Messages/ReplicationMessages.cs:10`, `src/ScadaLink.SiteRuntime/Messages/ReplicationMessages.cs:13`, `src/ScadaLink.SiteRuntime/Messages/ReplicationMessages.cs:15`, `src/ScadaLink.SiteRuntime/Messages/ReplicationMessages.cs:17`, `src/ScadaLink.SiteRuntime/Messages/ReplicationMessages.cs:19`, `src/ScadaLink.SiteRuntime/Messages/ReplicationMessages.cs:25`, `src/ScadaLink.SiteRuntime/Messages/ReplicationMessages.cs:28`, `src/ScadaLink.SiteRuntime/Messages/ReplicationMessages.cs:30`, `src/ScadaLink.SiteRuntime/Messages/ReplicationMessages.cs:32`, `src/ScadaLink.SiteRuntime/Messages/ReplicationMessages.cs:34` |

 **Description**
@@ -1334,3 +1334,13 @@ inbound vs outbound split with a marker base type (currently they're just
 named conventionally) so `Receive<ReplicateXxx>` vs `Receive<ApplyXxx>` is
 expressed at the type level — but that's optional and out of scope for a
 docs-only finding.
+
+**Resolution (2026-05-28):**
+
+Added a one-line `<summary>` to each of the ten records
+(`ReplicateConfigDeploy`/`Remove`/`SetEnabled`/`Artifacts`/`StoreAndForward` and
+`ApplyConfigDeploy`/`Remove`/`SetEnabled`/`Artifacts`/`StoreAndForward`) naming
+the direction (outbound to peer / inbound from peer) and what is replicated.
+The two pre-existing group-header XML blocks were converted to plain `//`
+comments to avoid orphaned doc-summaries above the first record in each group.
+Marker-base-type idea left out of scope.
@@ -8,7 +8,7 @@
 | Last reviewed | 2026-05-28 |
 | Reviewer | claude-agent |
 | Commit reviewed | `1eb6e97` |
-| Open findings | 12 |
+| Open findings | 11 |

 ## Summary

@@ -412,7 +412,7 @@ _Unresolved._
 |--|--|
 | Severity | Low |
 | Category | Documentation & comments |
-| Status | Open |
+| Status | Resolved |
 | Location | `docs/requirements/Component-Transport.md` Import Flow Step 1, `src/ScadaLink.Transport/Import/BundleImporter.cs:124-203` |

 **Description**
@@ -437,9 +437,14 @@ skips the content read for the pure preview case, or (b) update the design
 doc to clarify the full envelope is read on every `LoadAsync` and the cheap
 "peek" is conceptual rather than runtime.

-**Resolution**
+**Resolution (2026-05-28):**

-_Unresolved._
+Took option (b) — `docs/requirements/Component-Transport.md` (§"`manifest.json`
+(plaintext)") now carries an explicit implementation note clarifying that
+`BundleImporter.LoadAsync` reads the full envelope and verifies the content
+hash on every call regardless of passphrase availability, that the encrypted-
+bundle prompt is surfaced AFTER the manifest+hash check, and that a dedicated
+`ReadManifestAsync(Stream)` is a deferred optimisation. Code unchanged.

 ### Transport-012 — "Bundle Import" filter promised in design doc not surfaced in Configuration Audit Log Viewer UI