Merge branch 'fix/standby-secret-mirror-status' (M1: standby mirror failures on the health report)

# Conflicts: # CLAUDE.md # docs/plans/2026-09-28-site-secrets-artifact-deploy-design.md
2026-09-28 21:37:03 -04:00
parent 253939cd5d f5756affef
commit 4e6409184c
29 changed files with 1738 additions and 106 deletions
@@ -559,6 +559,70 @@ public class HealthPageTests : BunitContext
            StartupReconcilerActive = active,
        };

+    // ----- Review finding M1: per-node deployed-secrets mirror failures ------------------
+    //
+    // The standby's failures ride the active node's report; the card must name the node,
+    // the secret and the message. Null ("no data") and all-healthy nodes render nothing.
+
+    [Fact]
+    public void Renders_SecretMirrorFailures_LabelledByNode()
+    {
+        SeedStates(new SiteHealthState
+        {
+            SiteId = "site-a",
+            IsOnline = true,
+            LastHeartbeatAt = DateTimeOffset.UtcNow,
+            LatestReport = ReportWithReconciler("site-a", active: true) with
+            {
+                SecretMirrorStatuses =
+                [
+                    new SecretMirrorNodeStatus("node-a", DateTimeOffset.UtcNow, []),
+                    new SecretMirrorNodeStatus(
+                        "node-b",
+                        DateTimeOffset.UtcNow,
+                        [new SecretMirrorFailure("OPC-PWD", "did not decrypt on this node")]),
+                ],
+            },
+        });
+
+        var cut = RenderHealthPage();
+
+        cut.WaitForAssertion(() =>
+        {
+            Assert.Contains("data-test=\"secret-mirror-badge\"", cut.Markup);
+            var panel = cut.Find("[data-test=secret-mirror-failures]");
+            Assert.Contains("node-b", panel.TextContent);
+            Assert.Contains("OPC-PWD", panel.TextContent);
+            Assert.Contains("did not decrypt on this node", panel.TextContent);
+            Assert.DoesNotContain("node-a", panel.TextContent);
+        });
+    }
+
+    [Theory]
+    [InlineData(false)] // null = "no data" (central self-report, pre-M1 site)
+    [InlineData(true)]  // every node healthy
+    public void DoesNotRender_SecretMirrorWarning_WhenNoNodeIsFailing(bool reported)
+    {
+        SeedStates(new SiteHealthState
+        {
+            SiteId = "site-a",
+            IsOnline = true,
+            LastHeartbeatAt = DateTimeOffset.UtcNow,
+            LatestReport = ReportWithReconciler("site-a", active: true) with
+            {
+                SecretMirrorStatuses = reported
+                    ? [new SecretMirrorNodeStatus("node-a", DateTimeOffset.UtcNow, [])]
+                    : null,
+            },
+        });
+
+        var cut = RenderHealthPage();
+
+        cut.WaitForAssertion(() => Assert.Contains("site-a", cut.Markup));
+        Assert.DoesNotContain("data-test=\"secret-mirror-badge\"", cut.Markup);
+        Assert.DoesNotContain("data-test=\"secret-mirror-failures\"", cut.Markup);
+    }
+
    [Fact]
    public void Renders_OfflineSince_ForOfflineSiteWithStatusChange()
    {
@@ -369,6 +369,7 @@ public class CentralControlDtoMapperTests
        Assert.Null(roundTripped.LocalDbReplicationConnected);
        Assert.Null(roundTripped.LocalDbOplogBacklog);
        Assert.Null(roundTripped.StartupReconcilerActive);
+        Assert.Null(roundTripped.SecretMirrorStatuses);
    }

    [Fact]
@@ -384,10 +385,14 @@ public class CentralControlDtoMapperTests
            DataConnectionEndpoints = new Dictionary<string, string>(),
            DataConnectionTagQuality = new Dictionary<string, TagQualityCounts>(),
            ClusterNodes = [],
+            SecretMirrorStatuses = [],
        };

        var roundTripped = CentralControlDtoMapper.FromDto(Wire(CentralControlDtoMapper.ToDto(original)));

+        Assert.NotNull(roundTripped.SecretMirrorStatuses);
+        Assert.Empty(roundTripped.SecretMirrorStatuses);
+
        Assert.NotNull(roundTripped.DataConnectionEndpoints);
        Assert.Empty(roundTripped.DataConnectionEndpoints);
        Assert.NotNull(roundTripped.DataConnectionTagQuality);
@@ -559,6 +564,18 @@ public class CentralControlDtoMapperTests
            DetachedScriptThreads = 2,
            ScriptRunShedCount = 13,
            SiteStreamAlarmDropCount = 41L,
+            // Review finding M1: every node's secret mirror status, standby included.
+            SecretMirrorStatuses =
+            [
+                new SecretMirrorNodeStatus("node-a", SampleInstant, []),
+                new SecretMirrorNodeStatus(
+                    "node-b",
+                    SampleInstant.AddMinutes(-3),
+                    [
+                        new SecretMirrorFailure("OPC-PWD", "did not decrypt on this node"),
+                        new SecretMirrorFailure("MX-KEY", "could not be confirmed applied"),
+                    ]),
+            ],
        };

    /// <summary>
@@ -611,6 +628,17 @@ public class CentralControlDtoMapperTests
        Assert.Equal(expected.DetachedScriptThreads, actual.DetachedScriptThreads);
        Assert.Equal(expected.ScriptRunShedCount, actual.ScriptRunShedCount);
        Assert.Equal(expected.SiteStreamAlarmDropCount, actual.SiteStreamAlarmDropCount);
+        Assert.Equal(expected.SecretMirrorStatuses is null, actual.SecretMirrorStatuses is null);
+        if (expected.SecretMirrorStatuses is not null)
+        {
+            Assert.Equal(expected.SecretMirrorStatuses.Count, actual.SecretMirrorStatuses!.Count);
+            for (var i = 0; i < expected.SecretMirrorStatuses.Count; i++)
+            {
+                Assert.Equal(expected.SecretMirrorStatuses[i].NodeName, actual.SecretMirrorStatuses[i].NodeName);
+                Assert.Equal(expected.SecretMirrorStatuses[i].CheckedAtUtc, actual.SecretMirrorStatuses[i].CheckedAtUtc);
+                Assert.Equal(expected.SecretMirrorStatuses[i].Failures, actual.SecretMirrorStatuses[i].Failures);
+            }
+        }
    }

    /// <summary>
@@ -0,0 +1,45 @@
+using ZB.MOM.WW.ScadaBridge.Commons.Messages.Health;
+
+namespace ZB.MOM.WW.ScadaBridge.HealthMonitoring.Tests;
+
+/// <summary>
+/// Review finding M1 — <c>SiteHealthReport.SecretMirrorStatuses</c> carries every site node's
+/// deployed-secrets mirror failures (the standby's included) on the active node's report.
+/// </summary>
+public class SecretMirrorStatusHealthFieldTests
+{
+    [Fact]
+    public void CollectReport_NeverTold_LeavesTheFieldNull()
+    {
+        Assert.Null(new SiteHealthCollector().CollectReport("TestSite").SecretMirrorStatuses);
+    }
+
+    [Fact]
+    public void CollectReport_CarriesTheLatestSnapshot_AndDoesNotDrainIt()
+    {
+        var collector = new SiteHealthCollector();
+        collector.SetSecretMirrorStatuses(
+        [
+            new SecretMirrorNodeStatus("node-a", DateTimeOffset.UtcNow, []),
+            new SecretMirrorNodeStatus(
+                "node-b", DateTimeOffset.UtcNow, [new SecretMirrorFailure("S1", "did not decrypt")]),
+        ]);
+
+        var first = collector.CollectReport("TestSite").SecretMirrorStatuses!;
+        var second = collector.CollectReport("TestSite").SecretMirrorStatuses!;
+
+        Assert.Equal(["node-a", "node-b"], first.Select(s => s.NodeName));
+        Assert.Equal(2, second.Count); // point-in-time, not interval-drained
+        Assert.Equal("S1", Assert.Single(first[1].Failures).SecretName);
+    }
+
+    [Fact]
+    public void SetNull_ResetsToNoData()
+    {
+        var collector = new SiteHealthCollector();
+        collector.SetSecretMirrorStatuses([]);
+        collector.SetSecretMirrorStatuses(null);
+
+        Assert.Null(collector.CollectReport("TestSite").SecretMirrorStatuses);
+    }
+}
@@ -212,7 +212,7 @@ public class SiteLocalDbCdcRegistrationTests : IDisposable
    // ---- helpers ----------------------------------------------------------------------

    /// <summary>
-    /// The eleven replicated tables, plus the two deliberately-unregistered central-only
+    /// The twelve replicated tables, plus the two deliberately-unregistered central-only
    /// notification tables, plus the node-local (also deliberately-unregistered)
    /// <c>mirrored_secrets</c> ledger.
    /// </summary>
@@ -221,7 +221,7 @@ public class SiteLocalDbCdcRegistrationTests : IDisposable
        "OperationTracking", "site_events", "sf_messages", "deployed_configurations",
        "static_attribute_overrides", "shared_scripts", "external_systems",
        "database_connections", "data_connection_definitions", "native_alarm_state",
-        "deployed_secrets",
+        "deployed_secrets", "secret_mirror_status",
        "notification_lists", "smtp_configurations", "mirrored_secrets",
    ];

@@ -230,7 +230,7 @@ public class SiteLocalDbCdcRegistrationTests : IDisposable
        "OperationTracking", "site_events", "sf_messages", "deployed_configurations",
        "static_attribute_overrides", "shared_scripts", "external_systems",
        "database_connections", "data_connection_definitions", "native_alarm_state",
-        "deployed_secrets",
+        "deployed_secrets", "secret_mirror_status",
    ];

    private static void AssertCaptureTriggersCoverTheReplicatedTables(ILocalDb db)
@@ -15,8 +15,9 @@ namespace ZB.MOM.WW.ScadaBridge.Host.Tests;
 /// <c>RegisterReplicated</c> time, which on a site node is a BOOT failure of the replicating
 /// pair. This test moves that discovery from the first replicated boot to the build: it walks
 /// the real site schema (every table <c>SiteLocalDbSetup.OnReady</c> creates) and asserts none
-/// of the eleven <see cref="SiteLocalDbSetup.ReplicatedTables"/> (incl. <c>deployed_secrets</c>,
-/// added for site-secrets artifact deploy) has such an inbound FK.
+/// of the twelve <see cref="SiteLocalDbSetup.ReplicatedTables"/> (incl. <c>deployed_secrets</c>,
+/// added for site-secrets artifact deploy, and <c>secret_mirror_status</c>, added by review
+/// finding M1) has such an inbound FK.
 /// </summary>
 /// <remarks>
 /// The schema is built with an UNREPLICATED config on purpose: a replicated one would make
@@ -254,7 +254,7 @@ public class SiteLocalDbWiringTests : IDisposable
            "deployed_configurations", "static_attribute_overrides", "shared_scripts",
            "external_systems", "database_connections", "notification_lists",
            "data_connection_definitions", "smtp_configurations", "native_alarm_state",
-            "deployed_secrets", "mirrored_secrets",
+            "deployed_secrets", "mirrored_secrets", "secret_mirror_status",
        })
        {
            Assert.Contains(table, tables);
@@ -262,9 +262,10 @@ public class SiteLocalDbWiringTests : IDisposable
    }

    [Fact]
-    public void Site_LocalDb_RegistersExactlyTheElevenReplicatedTables()
+    public void Site_LocalDb_RegistersExactlyTheTwelveReplicatedTables()
    {
-        // The Phase 2 cutover, extended by site-secrets artifact deploy's deployed_secrets.
+        // The Phase 2 cutover, extended by site-secrets artifact deploy's deployed_secrets
+        // and review finding M1's per-node secret_mirror_status.
        // This is an EXACTLY check rather than a Contains in both directions, and both
        // directions are load-bearing.
        //
@@ -285,8 +286,8 @@ public class SiteLocalDbWiringTests : IDisposable
                // data_connection_definitions precedes database_connections.
                "OperationTracking", "data_connection_definitions", "database_connections",
                "deployed_configurations", "deployed_secrets", "external_systems",
-                "native_alarm_state", "sf_messages", "shared_scripts", "site_events",
-                "static_attribute_overrides",
+                "native_alarm_state", "secret_mirror_status", "sf_messages", "shared_scripts",
+                "site_events", "static_attribute_overrides",
            ],
            db.ReplicatedTables.Keys.OrderBy(k => k, StringComparer.Ordinal).ToArray());
    }
@@ -334,6 +335,7 @@ public class SiteLocalDbWiringTests : IDisposable
            ["instance_unique_name", "source_canonical_name", "source_reference"],
            db.ReplicatedTables["native_alarm_state"].PkColumns);
        Assert.Equal(["name"], db.ReplicatedTables["deployed_secrets"].PkColumns);
+        Assert.Equal(["node_name"], db.ReplicatedTables["secret_mirror_status"].PkColumns);
    }

    private static HashSet<string> TableNames(ILocalDb db)
@@ -1,6 +1,7 @@
 using System.Text.Json;
 using Microsoft.Extensions.Logging.Abstractions;
 using ZB.MOM.WW.ScadaBridge.Commons.Messages.Artifacts;
+using ZB.MOM.WW.ScadaBridge.Commons.Messages.Health;
 using ZB.MOM.WW.ScadaBridge.SiteRuntime.Persistence;
 using ZB.MOM.WW.ScadaBridge.TestSupport;

@@ -303,6 +304,54 @@ public class DeployedSecretsStorageTests : IAsyncLifetime, IDisposable
        Assert.Equal("A", mirrored.Name);
    }

+    // ── secret_mirror_status (review finding M1) ──
+
+    [Fact]
+    public async Task SecretMirrorStatus_RoundTrips_OneRowPerNode_OrderedByNodeName()
+    {
+        var at = new DateTimeOffset(2026, 9, 28, 6, 0, 0, TimeSpan.Zero);
+        await _storage.SetSecretMirrorStatusAsync(
+            "node-b", [new SecretMirrorFailure("A", "did not decrypt")], at);
+        await _storage.SetSecretMirrorStatusAsync("node-a", [], at.AddMinutes(1));
+
+        var rows = await _storage.GetSecretMirrorStatusesAsync();
+
+        Assert.Equal(["node-a", "node-b"], rows.Select(r => r.NodeName));
+        Assert.Empty(rows[0].Failures);
+        Assert.Equal(at.AddMinutes(1), rows[0].CheckedAtUtc);
+        var failure = Assert.Single(rows[1].Failures);
+        Assert.Equal(new SecretMirrorFailure("A", "did not decrypt"), failure);
+        Assert.Equal(at, rows[1].CheckedAtUtc);
+    }
+
+    [Fact]
+    public async Task SecretMirrorStatus_Set_UpsertsTheNodesRow()
+    {
+        var at = new DateTimeOffset(2026, 9, 28, 6, 0, 0, TimeSpan.Zero);
+        await _storage.SetSecretMirrorStatusAsync("node-a", [new SecretMirrorFailure("A", "x")], at);
+        await _storage.SetSecretMirrorStatusAsync("node-a", [], at.AddHours(1));
+
+        var row = Assert.Single(await _storage.GetSecretMirrorStatusesAsync());
+        Assert.Empty(row.Failures);
+        Assert.Equal(at.AddHours(1), row.CheckedAtUtc);
+    }
+
+    [Fact]
+    public async Task SecretMirrorStatus_UnparseableRow_ReadsAsAFailure_NotAsHealthy()
+    {
+        await using (var connection = _storage.CreateConnection())
+        await using (var insert = connection.CreateCommand())
+        {
+            insert.CommandText =
+                "INSERT INTO secret_mirror_status (node_name, failures_json, checked_at) VALUES ('node-b', '{not json', '2026-09-28T00:00:00.0000000+00:00')";
+            await insert.ExecuteNonQueryAsync();
+        }
+
+        var row = Assert.Single(await _storage.GetSecretMirrorStatusesAsync());
+        Assert.Equal("node-b", row.NodeName);
+        Assert.Single(row.Failures);
+    }
+
    private static SecretArtifact Art(string name, long revision) => new(
        Name: name,
        ContentType: "application/octet-stream",
@@ -23,14 +23,14 @@ public class SiteStorageSchemaTests
            SiteStorageSchema.Apply(connection);
            SiteStorageSchema.Apply(connection);   // second run must not throw

-            // Every table is named explicitly on purpose — a loop asserting "11 tables"
+            // Every table is named explicitly on purpose — a loop asserting "12 tables"
            // would still pass if one were renamed.
            foreach (var table in new[]
                     {
                         "deployed_configurations", "static_attribute_overrides", "shared_scripts",
                         "external_systems", "database_connections", "notification_lists",
                         "data_connection_definitions", "smtp_configurations", "native_alarm_state",
-                         "deployed_secrets", "mirrored_secrets",
+                         "deployed_secrets", "mirrored_secrets", "secret_mirror_status",
                     })
            {
                Assert.True(TableExists(connection, table), $"missing table: {table}");
@@ -2,6 +2,7 @@ using System.Collections.Concurrent;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Logging.Abstractions;
 using Microsoft.Extensions.Options;
+using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services;
 using ZB.MOM.WW.ScadaBridge.Commons.Messages.Artifacts;
 using ZB.MOM.WW.ScadaBridge.SiteRuntime.Persistence;
 using ZB.MOM.WW.ScadaBridge.SiteRuntime.Secrets;
@@ -655,6 +656,132 @@ public class DeployedSecretsMirrorTests : IDisposable
        }
    }

+    // ── Per-node status row for central (review finding M1) ──
+
+    [Fact]
+    public async Task Status_FirstPassAfterStartup_WritesThisNodesRow_EvenWhenHealthy()
+    {
+        var time = new FakeTimeProvider(new DateTimeOffset(2026, 9, 28, 6, 0, 0, TimeSpan.Zero));
+        var (mirror, storage, _, _, _) = await CreateAsync(time: time, nodeIdentity: new FixedNodeIdentity("node-b"));
+
+        await mirror.ReconcileAsync(CancellationToken.None);
+
+        var status = Assert.Single(await storage.GetSecretMirrorStatusesAsync());
+        Assert.Equal("node-b", status.NodeName);
+        Assert.Empty(status.Failures);
+        Assert.Equal(time.Now, status.CheckedAtUtc);
+    }
+
+    [Fact]
+    public async Task Status_UnchangedFailureSet_IsNotRewrittenOnLaterPasses()
+    {
+        var time = new FakeTimeProvider(new DateTimeOffset(2026, 9, 28, 6, 0, 0, TimeSpan.Zero));
+        var (mirror, storage, _, resolver, _) = await CreateAsync(time: time, nodeIdentity: new FixedNodeIdentity("node-b"));
+        resolver.ThrowFor("a");
+        await storage.UpsertDeployedSecretsAsync([Art("a", 1, kek: "kek-central")], "d1");
+
+        await mirror.ReconcileAsync(CancellationToken.None);
+        var firstWrite = Assert.Single(await storage.GetSecretMirrorStatusesAsync());
+
+        // Same failure on every later pass: the row is replicated, so it must not be rewritten.
+        time.Now = time.Now.AddMinutes(5);
+        await mirror.ReconcileAsync(CancellationToken.None);
+        await mirror.ReconcileAsync(CancellationToken.None);
+
+        var after = Assert.Single(await storage.GetSecretMirrorStatusesAsync());
+        Assert.Equal(firstWrite.CheckedAtUtc, after.CheckedAtUtc);
+        var failure = Assert.Single(after.Failures);
+        Assert.Equal("a", failure.SecretName);
+        Assert.Contains("kek-central", failure.Message);
+    }
+
+    [Fact]
+    public async Task Status_FailureSetChange_RewritesTheRow_AndClearsWhenHealed()
+    {
+        var time = new FakeTimeProvider(new DateTimeOffset(2026, 9, 28, 6, 0, 0, TimeSpan.Zero));
+        var (mirror, storage, _, resolver, _) = await CreateAsync(time: time, nodeIdentity: new FixedNodeIdentity("node-a"));
+        await storage.UpsertDeployedSecretsAsync([Art("a", 1)], "d1");
+
+        await mirror.ReconcileAsync(CancellationToken.None);
+        Assert.Empty(Assert.Single(await storage.GetSecretMirrorStatusesAsync()).Failures);
+
+        // A decrypt failure appears -> row rewritten with the failure.
+        resolver.ThrowFor("a");
+        time.Now = time.Now.AddMinutes(1);
+        await mirror.ReconcileAsync(CancellationToken.None);
+        var failing = Assert.Single(await storage.GetSecretMirrorStatusesAsync());
+        Assert.Equal("a", Assert.Single(failing.Failures).SecretName);
+        Assert.Equal(time.Now, failing.CheckedAtUtc);
+
+        // Healed -> row rewritten empty.
+        resolver.ClearFailures();
+        time.Now = time.Now.AddMinutes(1);
+        await mirror.ReconcileAsync(CancellationToken.None);
+        var healed = Assert.Single(await storage.GetSecretMirrorStatusesAsync());
+        Assert.Empty(healed.Failures);
+        Assert.Equal(time.Now, healed.CheckedAtUtc);
+    }
+
+    [Fact]
+    public async Task Status_RowCarriesNamesAndMessagesOnly_NeverCiphertext()
+    {
+        var (mirror, storage, _, resolver, _) = await CreateAsync(nodeIdentity: new FixedNodeIdentity("node-a"));
+        resolver.ThrowFor("a");
+        await storage.UpsertDeployedSecretsAsync([Art("a", 1)], "d1");
+
+        await mirror.ReconcileAsync(CancellationToken.None);
+
+        await using var connection = storage.CreateConnection();
+        await using var command = connection.CreateCommand();
+        command.CommandText = "SELECT failures_json FROM secret_mirror_status WHERE node_name = 'node-a'";
+        var json = (string)(await command.ExecuteScalarAsync())!;
+        Assert.Contains("\"SecretName\":\"a\"", json);
+        Assert.DoesNotContain("Ciphertext", json);
+        Assert.DoesNotContain(Convert.ToBase64String(new byte[] { 1, 2, 3, 4, 5 }), json);
+    }
+
+    [Fact]
+    public async Task Status_WriteFailure_DoesNotBreakThePass_AndIsRetriedNextPass()
+    {
+        var logger = new CapturingLogger<DeployedSecretsMirror>();
+        var (mirror, storage, store, _, _) = await CreateAsync(logger: logger, nodeIdentity: new FixedNodeIdentity("node-a"));
+        await storage.UpsertDeployedSecretsAsync([Art("a", 1)], "d1");
+
+        await using (var connection = storage.CreateConnection())
+        await using (var drop = connection.CreateCommand())
+        {
+            drop.CommandText = "DROP TABLE secret_mirror_status";
+            await drop.ExecuteNonQueryAsync();
+        }
+
+        var r = await mirror.ReconcileAsync(CancellationToken.None);
+
+        Assert.Equal(["a"], r.Applied);
+        Assert.True(store.Contains("a"));
+        Assert.Contains(logger.Entries, e => e.Level == LogLevel.Warning && e.Message.Contains("mirror status"));
+
+        // Table back (e.g. transient fault cleared): the unchanged failure set is still
+        // written, because the earlier write never landed.
+        await storage.InitializeAsync();
+        await mirror.ReconcileAsync(CancellationToken.None);
+        Assert.Equal("node-a", Assert.Single(await storage.GetSecretMirrorStatusesAsync()).NodeName);
+    }
+
+    [Fact]
+    public async Task Status_WithoutNodeIdentity_FallsBackToMachineName()
+    {
+        var (mirror, storage, _, _, _) = await CreateAsync();
+
+        await mirror.ReconcileAsync(CancellationToken.None);
+
+        Assert.Equal(Environment.MachineName, Assert.Single(await storage.GetSecretMirrorStatusesAsync()).NodeName);
+    }
+
+    private sealed class FixedNodeIdentity(string? name) : INodeIdentityProvider
+    {
+        public string? NodeName { get; } = name;
+    }
+
    // ── Harness ──

    private async Task<(
@@ -665,7 +792,8 @@ public class DeployedSecretsMirrorTests : IDisposable
        FakeSecretCacheInvalidator Invalidator)> CreateAsync(
        CapturingLogger<DeployedSecretsMirror>? logger = null,
        TimeSpan? interval = null,
-        TimeProvider? time = null)
+        TimeProvider? time = null,
+        INodeIdentityProvider? nodeIdentity = null)
    {
        var storage = new SiteStorageService(_localDb.Db, NullLogger<SiteStorageService>.Instance);
        await storage.InitializeAsync();
@@ -685,7 +813,8 @@ public class DeployedSecretsMirrorTests : IDisposable
            invalidator,
            options,
            (ILogger<DeployedSecretsMirror>?)logger ?? NullLogger<DeployedSecretsMirror>.Instance,
-            time ?? TimeProvider.System);
+            time ?? TimeProvider.System,
+            nodeIdentity);

        return (mirror, storage, store, resolver, invalidator);
    }
@@ -0,0 +1,95 @@
+using Microsoft.Extensions.Logging.Abstractions;
+using ZB.MOM.WW.ScadaBridge.Commons.Messages.Health;
+using ZB.MOM.WW.ScadaBridge.HealthMonitoring;
+using ZB.MOM.WW.ScadaBridge.SiteRuntime.Persistence;
+using ZB.MOM.WW.ScadaBridge.SiteRuntime.Secrets;
+using ZB.MOM.WW.ScadaBridge.TestSupport;
+
+namespace ZB.MOM.WW.ScadaBridge.SiteRuntime.Tests.Secrets;
+
+/// <summary>
+/// Review finding M1: <see cref="SecretMirrorStatusReporter"/> forwards every node's
+/// replicated <c>secret_mirror_status</c> row onto the site health report via the collector.
+/// </summary>
+public class SecretMirrorStatusReporterTests : IAsyncLifetime, IDisposable
+{
+    private readonly TestLocalDb _localDb = TestLocalDb.CreateTemp("secret-mirror-status");
+    private SiteStorageService _storage = null!;
+
+    public async Task InitializeAsync()
+    {
+        _storage = new SiteStorageService(_localDb.Db, NullLogger<SiteStorageService>.Instance);
+        await _storage.InitializeAsync();
+    }
+
+    public Task DisposeAsync() => Task.CompletedTask;
+
+    public void Dispose()
+    {
+        var path = _localDb.Path;
+        _localDb.Dispose();
+        TestLocalDb.DeleteFiles(path);
+    }
+
+    [Fact]
+    public async Task Probe_PushesEveryNodesRow_OntoTheNextReport()
+    {
+        var at = new DateTimeOffset(2026, 9, 28, 6, 0, 0, TimeSpan.Zero);
+        await _storage.SetSecretMirrorStatusAsync("node-a", [], at);
+        await _storage.SetSecretMirrorStatusAsync(
+            "node-b", [new SecretMirrorFailure("OPC-PWD", "did not decrypt on this node")], at);
+        var collector = new SiteHealthCollector();
+        var reporter = new SecretMirrorStatusReporter(
+            collector, _storage, NullLogger<SecretMirrorStatusReporter>.Instance);
+
+        await reporter.ProbeAsync();
+        var report = collector.CollectReport("site-a");
+
+        Assert.NotNull(report.SecretMirrorStatuses);
+        Assert.Equal(["node-a", "node-b"], report.SecretMirrorStatuses!.Select(s => s.NodeName));
+        Assert.Equal("OPC-PWD", Assert.Single(report.SecretMirrorStatuses[1].Failures).SecretName);
+    }
+
+    [Fact]
+    public void BeforeAnyProbe_TheReportFieldIsNull()
+    {
+        var report = new SiteHealthCollector().CollectReport("site-a");
+
+        Assert.Null(report.SecretMirrorStatuses);
+    }
+
+    [Fact]
+    public async Task Probe_NoRowsYet_PushesAnEmptyList_NotNull()
+    {
+        var collector = new SiteHealthCollector();
+        var reporter = new SecretMirrorStatusReporter(
+            collector, _storage, NullLogger<SecretMirrorStatusReporter>.Instance);
+
+        await reporter.ProbeAsync();
+
+        Assert.Empty(collector.CollectReport("site-a").SecretMirrorStatuses!);
+    }
+
+    [Fact]
+    public async Task Probe_ReadFailure_KeepsThePreviousSnapshot_AndDoesNotThrow()
+    {
+        await _storage.SetSecretMirrorStatusAsync("node-a", [], DateTimeOffset.UtcNow);
+        var collector = new SiteHealthCollector();
+        var reporter = new SecretMirrorStatusReporter(
+            collector, _storage, NullLogger<SecretMirrorStatusReporter>.Instance);
+        await reporter.ProbeAsync();
+
+        await using (var connection = _storage.CreateConnection())
+        await using (var drop = connection.CreateCommand())
+        {
+            drop.CommandText = "DROP TABLE secret_mirror_status";
+            await drop.ExecuteNonQueryAsync();
+        }
+
+        await reporter.ProbeAsync();
+
+        // Point-in-time: not drained on collect, and not cleared by a failed read.
+        Assert.Single(collector.CollectReport("site-a").SecretMirrorStatuses!);
+        Assert.Single(collector.CollectReport("site-a").SecretMirrorStatuses!);
+    }
+}