Merge branch 'fix/standby-secret-mirror-status' (M1: standby mirror failures on the health report)

# Conflicts:
#	CLAUDE.md
#	docs/plans/2026-09-28-site-secrets-artifact-deploy-design.md

tests/ZB.MOM.WW.ScadaBridge.SiteRuntime.Tests/Persistence/DeployedSecretsStorageTests.cs

@@ -1,6 +1,7 @@
 using System.Text.Json;
 using Microsoft.Extensions.Logging.Abstractions;
 using ZB.MOM.WW.ScadaBridge.Commons.Messages.Artifacts;
+using ZB.MOM.WW.ScadaBridge.Commons.Messages.Health;
 using ZB.MOM.WW.ScadaBridge.SiteRuntime.Persistence;
 using ZB.MOM.WW.ScadaBridge.TestSupport;
 
@@ -303,6 +304,54 @@ public class DeployedSecretsStorageTests : IAsyncLifetime, IDisposable
         Assert.Equal("A", mirrored.Name);
     }
 
+    // ── secret_mirror_status (review finding M1) ──
+
+    [Fact]
+    public async Task SecretMirrorStatus_RoundTrips_OneRowPerNode_OrderedByNodeName()
+    {
+        var at = new DateTimeOffset(2026, 9, 28, 6, 0, 0, TimeSpan.Zero);
+        await _storage.SetSecretMirrorStatusAsync(
+            "node-b", [new SecretMirrorFailure("A", "did not decrypt")], at);
+        await _storage.SetSecretMirrorStatusAsync("node-a", [], at.AddMinutes(1));
+
+        var rows = await _storage.GetSecretMirrorStatusesAsync();
+
+        Assert.Equal(["node-a", "node-b"], rows.Select(r => r.NodeName));
+        Assert.Empty(rows[0].Failures);
+        Assert.Equal(at.AddMinutes(1), rows[0].CheckedAtUtc);
+        var failure = Assert.Single(rows[1].Failures);
+        Assert.Equal(new SecretMirrorFailure("A", "did not decrypt"), failure);
+        Assert.Equal(at, rows[1].CheckedAtUtc);
+    }
+
+    [Fact]
+    public async Task SecretMirrorStatus_Set_UpsertsTheNodesRow()
+    {
+        var at = new DateTimeOffset(2026, 9, 28, 6, 0, 0, TimeSpan.Zero);
+        await _storage.SetSecretMirrorStatusAsync("node-a", [new SecretMirrorFailure("A", "x")], at);
+        await _storage.SetSecretMirrorStatusAsync("node-a", [], at.AddHours(1));
+
+        var row = Assert.Single(await _storage.GetSecretMirrorStatusesAsync());
+        Assert.Empty(row.Failures);
+        Assert.Equal(at.AddHours(1), row.CheckedAtUtc);
+    }
+
+    [Fact]
+    public async Task SecretMirrorStatus_UnparseableRow_ReadsAsAFailure_NotAsHealthy()
+    {
+        await using (var connection = _storage.CreateConnection())
+        await using (var insert = connection.CreateCommand())
+        {
+            insert.CommandText =
+                "INSERT INTO secret_mirror_status (node_name, failures_json, checked_at) VALUES ('node-b', '{not json', '2026-09-28T00:00:00.0000000+00:00')";
+            await insert.ExecuteNonQueryAsync();
+        }
+
+        var row = Assert.Single(await _storage.GetSecretMirrorStatusesAsync());
+        Assert.Equal("node-b", row.NodeName);
+        Assert.Single(row.Failures);
+    }
+
     private static SecretArtifact Art(string name, long revision) => new(
         Name: name,
         ContentType: "application/octet-stream",

tests/ZB.MOM.WW.ScadaBridge.SiteRuntime.Tests/Persistence/SiteStorageSchemaTests.cs

@@ -23,14 +23,14 @@ public class SiteStorageSchemaTests
             SiteStorageSchema.Apply(connection);
             SiteStorageSchema.Apply(connection);   // second run must not throw
 
-            // Every table is named explicitly on purpose — a loop asserting "11 tables"
+            // Every table is named explicitly on purpose — a loop asserting "12 tables"
             // would still pass if one were renamed.
             foreach (var table in new[]
                      {
                          "deployed_configurations", "static_attribute_overrides", "shared_scripts",
                          "external_systems", "database_connections", "notification_lists",
                          "data_connection_definitions", "smtp_configurations", "native_alarm_state",
-                         "deployed_secrets", "mirrored_secrets",
+                         "deployed_secrets", "mirrored_secrets", "secret_mirror_status",
                      })
             {
                 Assert.True(TableExists(connection, table), $"missing table: {table}");

tests/ZB.MOM.WW.ScadaBridge.SiteRuntime.Tests/Secrets/DeployedSecretsMirrorTests.cs

@@ -2,6 +2,7 @@ using System.Collections.Concurrent;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Logging.Abstractions;
 using Microsoft.Extensions.Options;
+using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services;
 using ZB.MOM.WW.ScadaBridge.Commons.Messages.Artifacts;
 using ZB.MOM.WW.ScadaBridge.SiteRuntime.Persistence;
 using ZB.MOM.WW.ScadaBridge.SiteRuntime.Secrets;
@@ -655,6 +656,132 @@ public class DeployedSecretsMirrorTests : IDisposable
         }
     }
 
+    // ── Per-node status row for central (review finding M1) ──
+
+    [Fact]
+    public async Task Status_FirstPassAfterStartup_WritesThisNodesRow_EvenWhenHealthy()
+    {
+        var time = new FakeTimeProvider(new DateTimeOffset(2026, 9, 28, 6, 0, 0, TimeSpan.Zero));
+        var (mirror, storage, _, _, _) = await CreateAsync(time: time, nodeIdentity: new FixedNodeIdentity("node-b"));
+
+        await mirror.ReconcileAsync(CancellationToken.None);
+
+        var status = Assert.Single(await storage.GetSecretMirrorStatusesAsync());
+        Assert.Equal("node-b", status.NodeName);
+        Assert.Empty(status.Failures);
+        Assert.Equal(time.Now, status.CheckedAtUtc);
+    }
+
+    [Fact]
+    public async Task Status_UnchangedFailureSet_IsNotRewrittenOnLaterPasses()
+    {
+        var time = new FakeTimeProvider(new DateTimeOffset(2026, 9, 28, 6, 0, 0, TimeSpan.Zero));
+        var (mirror, storage, _, resolver, _) = await CreateAsync(time: time, nodeIdentity: new FixedNodeIdentity("node-b"));
+        resolver.ThrowFor("a");
+        await storage.UpsertDeployedSecretsAsync([Art("a", 1, kek: "kek-central")], "d1");
+
+        await mirror.ReconcileAsync(CancellationToken.None);
+        var firstWrite = Assert.Single(await storage.GetSecretMirrorStatusesAsync());
+
+        // Same failure on every later pass: the row is replicated, so it must not be rewritten.
+        time.Now = time.Now.AddMinutes(5);
+        await mirror.ReconcileAsync(CancellationToken.None);
+        await mirror.ReconcileAsync(CancellationToken.None);
+
+        var after = Assert.Single(await storage.GetSecretMirrorStatusesAsync());
+        Assert.Equal(firstWrite.CheckedAtUtc, after.CheckedAtUtc);
+        var failure = Assert.Single(after.Failures);
+        Assert.Equal("a", failure.SecretName);
+        Assert.Contains("kek-central", failure.Message);
+    }
+
+    [Fact]
+    public async Task Status_FailureSetChange_RewritesTheRow_AndClearsWhenHealed()
+    {
+        var time = new FakeTimeProvider(new DateTimeOffset(2026, 9, 28, 6, 0, 0, TimeSpan.Zero));
+        var (mirror, storage, _, resolver, _) = await CreateAsync(time: time, nodeIdentity: new FixedNodeIdentity("node-a"));
+        await storage.UpsertDeployedSecretsAsync([Art("a", 1)], "d1");
+
+        await mirror.ReconcileAsync(CancellationToken.None);
+        Assert.Empty(Assert.Single(await storage.GetSecretMirrorStatusesAsync()).Failures);
+
+        // A decrypt failure appears -> row rewritten with the failure.
+        resolver.ThrowFor("a");
+        time.Now = time.Now.AddMinutes(1);
+        await mirror.ReconcileAsync(CancellationToken.None);
+        var failing = Assert.Single(await storage.GetSecretMirrorStatusesAsync());
+        Assert.Equal("a", Assert.Single(failing.Failures).SecretName);
+        Assert.Equal(time.Now, failing.CheckedAtUtc);
+
+        // Healed -> row rewritten empty.
+        resolver.ClearFailures();
+        time.Now = time.Now.AddMinutes(1);
+        await mirror.ReconcileAsync(CancellationToken.None);
+        var healed = Assert.Single(await storage.GetSecretMirrorStatusesAsync());
+        Assert.Empty(healed.Failures);
+        Assert.Equal(time.Now, healed.CheckedAtUtc);
+    }
+
+    [Fact]
+    public async Task Status_RowCarriesNamesAndMessagesOnly_NeverCiphertext()
+    {
+        var (mirror, storage, _, resolver, _) = await CreateAsync(nodeIdentity: new FixedNodeIdentity("node-a"));
+        resolver.ThrowFor("a");
+        await storage.UpsertDeployedSecretsAsync([Art("a", 1)], "d1");
+
+        await mirror.ReconcileAsync(CancellationToken.None);
+
+        await using var connection = storage.CreateConnection();
+        await using var command = connection.CreateCommand();
+        command.CommandText = "SELECT failures_json FROM secret_mirror_status WHERE node_name = 'node-a'";
+        var json = (string)(await command.ExecuteScalarAsync())!;
+        Assert.Contains("\"SecretName\":\"a\"", json);
+        Assert.DoesNotContain("Ciphertext", json);
+        Assert.DoesNotContain(Convert.ToBase64String(new byte[] { 1, 2, 3, 4, 5 }), json);
+    }
+
+    [Fact]
+    public async Task Status_WriteFailure_DoesNotBreakThePass_AndIsRetriedNextPass()
+    {
+        var logger = new CapturingLogger<DeployedSecretsMirror>();
+        var (mirror, storage, store, _, _) = await CreateAsync(logger: logger, nodeIdentity: new FixedNodeIdentity("node-a"));
+        await storage.UpsertDeployedSecretsAsync([Art("a", 1)], "d1");
+
+        await using (var connection = storage.CreateConnection())
+        await using (var drop = connection.CreateCommand())
+        {
+            drop.CommandText = "DROP TABLE secret_mirror_status";
+            await drop.ExecuteNonQueryAsync();
+        }
+
+        var r = await mirror.ReconcileAsync(CancellationToken.None);
+
+        Assert.Equal(["a"], r.Applied);
+        Assert.True(store.Contains("a"));
+        Assert.Contains(logger.Entries, e => e.Level == LogLevel.Warning && e.Message.Contains("mirror status"));
+
+        // Table back (e.g. transient fault cleared): the unchanged failure set is still
+        // written, because the earlier write never landed.
+        await storage.InitializeAsync();
+        await mirror.ReconcileAsync(CancellationToken.None);
+        Assert.Equal("node-a", Assert.Single(await storage.GetSecretMirrorStatusesAsync()).NodeName);
+    }
+
+    [Fact]
+    public async Task Status_WithoutNodeIdentity_FallsBackToMachineName()
+    {
+        var (mirror, storage, _, _, _) = await CreateAsync();
+
+        await mirror.ReconcileAsync(CancellationToken.None);
+
+        Assert.Equal(Environment.MachineName, Assert.Single(await storage.GetSecretMirrorStatusesAsync()).NodeName);
+    }
+
+    private sealed class FixedNodeIdentity(string? name) : INodeIdentityProvider
+    {
+        public string? NodeName { get; } = name;
+    }
+
     // ── Harness ──
 
     private async Task<(
@@ -665,7 +792,8 @@ public class DeployedSecretsMirrorTests : IDisposable
         FakeSecretCacheInvalidator Invalidator)> CreateAsync(
         CapturingLogger<DeployedSecretsMirror>? logger = null,
         TimeSpan? interval = null,
-        TimeProvider? time = null)
+        TimeProvider? time = null,
+        INodeIdentityProvider? nodeIdentity = null)
     {
         var storage = new SiteStorageService(_localDb.Db, NullLogger<SiteStorageService>.Instance);
         await storage.InitializeAsync();
@@ -685,7 +813,8 @@ public class DeployedSecretsMirrorTests : IDisposable
             invalidator,
             options,
             (ILogger<DeployedSecretsMirror>?)logger ?? NullLogger<DeployedSecretsMirror>.Instance,
-            time ?? TimeProvider.System);
+            time ?? TimeProvider.System,
+            nodeIdentity);
 
         return (mirror, storage, store, resolver, invalidator);
     }

tests/ZB.MOM.WW.ScadaBridge.SiteRuntime.Tests/Secrets/SecretMirrorStatusReporterTests.cs

@@ -0,0 +1,95 @@
+using Microsoft.Extensions.Logging.Abstractions;
+using ZB.MOM.WW.ScadaBridge.Commons.Messages.Health;
+using ZB.MOM.WW.ScadaBridge.HealthMonitoring;
+using ZB.MOM.WW.ScadaBridge.SiteRuntime.Persistence;
+using ZB.MOM.WW.ScadaBridge.SiteRuntime.Secrets;
+using ZB.MOM.WW.ScadaBridge.TestSupport;
+
+namespace ZB.MOM.WW.ScadaBridge.SiteRuntime.Tests.Secrets;
+
+/// <summary>
+/// Review finding M1: <see cref="SecretMirrorStatusReporter"/> forwards every node's
+/// replicated <c>secret_mirror_status</c> row onto the site health report via the collector.
+/// </summary>
+public class SecretMirrorStatusReporterTests : IAsyncLifetime, IDisposable
+{
+    private readonly TestLocalDb _localDb = TestLocalDb.CreateTemp("secret-mirror-status");
+    private SiteStorageService _storage = null!;
+
+    public async Task InitializeAsync()
+    {
+        _storage = new SiteStorageService(_localDb.Db, NullLogger<SiteStorageService>.Instance);
+        await _storage.InitializeAsync();
+    }
+
+    public Task DisposeAsync() => Task.CompletedTask;
+
+    public void Dispose()
+    {
+        var path = _localDb.Path;
+        _localDb.Dispose();
+        TestLocalDb.DeleteFiles(path);
+    }
+
+    [Fact]
+    public async Task Probe_PushesEveryNodesRow_OntoTheNextReport()
+    {
+        var at = new DateTimeOffset(2026, 9, 28, 6, 0, 0, TimeSpan.Zero);
+        await _storage.SetSecretMirrorStatusAsync("node-a", [], at);
+        await _storage.SetSecretMirrorStatusAsync(
+            "node-b", [new SecretMirrorFailure("OPC-PWD", "did not decrypt on this node")], at);
+        var collector = new SiteHealthCollector();
+        var reporter = new SecretMirrorStatusReporter(
+            collector, _storage, NullLogger<SecretMirrorStatusReporter>.Instance);
+
+        await reporter.ProbeAsync();
+        var report = collector.CollectReport("site-a");
+
+        Assert.NotNull(report.SecretMirrorStatuses);
+        Assert.Equal(["node-a", "node-b"], report.SecretMirrorStatuses!.Select(s => s.NodeName));
+        Assert.Equal("OPC-PWD", Assert.Single(report.SecretMirrorStatuses[1].Failures).SecretName);
+    }
+
+    [Fact]
+    public void BeforeAnyProbe_TheReportFieldIsNull()
+    {
+        var report = new SiteHealthCollector().CollectReport("site-a");
+
+        Assert.Null(report.SecretMirrorStatuses);
+    }
+
+    [Fact]
+    public async Task Probe_NoRowsYet_PushesAnEmptyList_NotNull()
+    {
+        var collector = new SiteHealthCollector();
+        var reporter = new SecretMirrorStatusReporter(
+            collector, _storage, NullLogger<SecretMirrorStatusReporter>.Instance);
+
+        await reporter.ProbeAsync();
+
+        Assert.Empty(collector.CollectReport("site-a").SecretMirrorStatuses!);
+    }
+
+    [Fact]
+    public async Task Probe_ReadFailure_KeepsThePreviousSnapshot_AndDoesNotThrow()
+    {
+        await _storage.SetSecretMirrorStatusAsync("node-a", [], DateTimeOffset.UtcNow);
+        var collector = new SiteHealthCollector();
+        var reporter = new SecretMirrorStatusReporter(
+            collector, _storage, NullLogger<SecretMirrorStatusReporter>.Instance);
+        await reporter.ProbeAsync();
+
+        await using (var connection = _storage.CreateConnection())
+        await using (var drop = connection.CreateCommand())
+        {
+            drop.CommandText = "DROP TABLE secret_mirror_status";
+            await drop.ExecuteNonQueryAsync();
+        }
+
+        await reporter.ProbeAsync();
+
+        // Point-in-time: not drained on collect, and not cleared by a failed read.
+        Assert.Single(collector.CollectReport("site-a").SecretMirrorStatuses!);
+        Assert.Single(collector.CollectReport("site-a").SecretMirrorStatuses!);
+    }
+}