chore(config): retire ReplicationEnabled, make legacy db paths migration-only

LocalDb Phase 2 deleted the bespoke replicators, so three config keys changed
meaning or died outright:

- ScadaBridge:StoreAndForward:ReplicationEnabled is fully dead. Deleted the
  property, its 10 config entries, and the 5 test references.
- SqliteDbPath / SiteDbPath are now migration-only: they name the legacy files
  SiteLocalDbLegacyMigrator drains at boot, not live databases. Both mandatory
  rules are relaxed accordingly (StartupValidator's Site-only Require, and the
  S&F validator's non-empty rule) — an absent value now means "nothing to
  migrate", so an already-migrated node can drop the key. DatabaseOptions-
  Validator still rejects a present-but-blank value.
- SiteRuntime:ConfigFetchRetryCount's only reader was SiteReplicationActor.
  Deleted with its validator rule.

The two path keys stay present in every config, now with a comment explaining
why: removing them would strand un-migrated data on a node that has not yet
started once.

Both relaxations are pinned by the inverse of the test they replace
(Site_MissingSiteDbPath_IsAccepted..., EmptySqliteDbPath_IsAccepted...), each
verified to fail with the old rule restored.

Note: deploy/wonder-app-vd03/appsettings.Site.json is under a gitignored
deploy/ tree, so its edit is local-only and must be repeated on the box.

Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts

docker-env2/site-x-node-a/appsettings.Site.json

@@ -20,6 +20,10 @@
       "MinNrOfMembers": 1
     },
     "Database": {
+      // Migration-only as of LocalDb Phase 2. The site config tables now live in the
+      // consolidated LocalDb database (LocalDb:Path). SiteDbPath is read once at boot to drain
+      // a pre-Phase-2 scadabridge.db, and is unused after that - keep it until this node has
+      // started once.
       "SiteDbPath": "/app/data/scadabridge.db"
     },
     "DataConnection": {
@@ -29,8 +33,11 @@
       "SeedReadTimeout": "00:00:30"
     },
     "StoreAndForward": {
-      "SqliteDbPath": "/app/data/store-and-forward.db",
+      // Migration-only as of LocalDb Phase 2. The store-and-forward buffer now lives in the
-      "ReplicationEnabled": true
+      // consolidated LocalDb database (LocalDb:Path) as the replicated sf_messages table.
+      // SqliteDbPath is read once at boot by SiteLocalDbLegacyMigrator to drain a pre-Phase-2
+      // file, and is unused after that - keep it until this node has started once.
+      "SqliteDbPath": "/app/data/store-and-forward.db"
     },
     "Communication": {
       "CentralContactPoints": [

docker-env2/site-x-node-b/appsettings.Site.json

@@ -20,6 +20,10 @@
       "MinNrOfMembers": 1
     },
     "Database": {
+      // Migration-only as of LocalDb Phase 2. The site config tables now live in the
+      // consolidated LocalDb database (LocalDb:Path). SiteDbPath is read once at boot to drain
+      // a pre-Phase-2 scadabridge.db, and is unused after that - keep it until this node has
+      // started once.
       "SiteDbPath": "/app/data/scadabridge.db"
     },
     "DataConnection": {
@@ -29,8 +33,11 @@
       "SeedReadTimeout": "00:00:30"
     },
     "StoreAndForward": {
-      "SqliteDbPath": "/app/data/store-and-forward.db",
+      // Migration-only as of LocalDb Phase 2. The store-and-forward buffer now lives in the
-      "ReplicationEnabled": true
+      // consolidated LocalDb database (LocalDb:Path) as the replicated sf_messages table.
+      // SqliteDbPath is read once at boot by SiteLocalDbLegacyMigrator to drain a pre-Phase-2
+      // file, and is unused after that - keep it until this node has started once.
+      "SqliteDbPath": "/app/data/store-and-forward.db"
     },
     "Communication": {
       "CentralContactPoints": [

docker/site-a-node-a/appsettings.Site.json

@@ -21,6 +21,10 @@
       "MinNrOfMembers": 1
     },
     "Database": {
+      // Migration-only as of LocalDb Phase 2. The site config tables now live in the
+      // consolidated LocalDb database (LocalDb:Path). SiteDbPath is read once at boot to drain
+      // a pre-Phase-2 scadabridge.db, and is unused after that - keep it until this node has
+      // started once.
       "SiteDbPath": "/app/data/scadabridge.db"
     },
     "DataConnection": {
@@ -30,8 +34,11 @@
       "SeedReadTimeout": "00:00:30"
     },
     "StoreAndForward": {
-      "SqliteDbPath": "/app/data/store-and-forward.db",
+      // Migration-only as of LocalDb Phase 2. The store-and-forward buffer now lives in the
-      "ReplicationEnabled": true
+      // consolidated LocalDb database (LocalDb:Path) as the replicated sf_messages table.
+      // SqliteDbPath is read once at boot by SiteLocalDbLegacyMigrator to drain a pre-Phase-2
+      // file, and is unused after that - keep it until this node has started once.
+      "SqliteDbPath": "/app/data/store-and-forward.db"
     },
     "Communication": {
       "CentralContactPoints": [

docker/site-a-node-b/appsettings.Site.json

@@ -21,6 +21,10 @@
       "MinNrOfMembers": 1
     },
     "Database": {
+      // Migration-only as of LocalDb Phase 2. The site config tables now live in the
+      // consolidated LocalDb database (LocalDb:Path). SiteDbPath is read once at boot to drain
+      // a pre-Phase-2 scadabridge.db, and is unused after that - keep it until this node has
+      // started once.
       "SiteDbPath": "/app/data/scadabridge.db"
     },
     "DataConnection": {
@@ -30,8 +34,11 @@
       "SeedReadTimeout": "00:00:30"
     },
     "StoreAndForward": {
-      "SqliteDbPath": "/app/data/store-and-forward.db",
+      // Migration-only as of LocalDb Phase 2. The store-and-forward buffer now lives in the
-      "ReplicationEnabled": true
+      // consolidated LocalDb database (LocalDb:Path) as the replicated sf_messages table.
+      // SqliteDbPath is read once at boot by SiteLocalDbLegacyMigrator to drain a pre-Phase-2
+      // file, and is unused after that - keep it until this node has started once.
+      "SqliteDbPath": "/app/data/store-and-forward.db"
     },
     "Communication": {
       "CentralContactPoints": [

docker/site-b-node-a/appsettings.Site.json

@@ -21,6 +21,10 @@
       "MinNrOfMembers": 1
     },
     "Database": {
+      // Migration-only as of LocalDb Phase 2. The site config tables now live in the
+      // consolidated LocalDb database (LocalDb:Path). SiteDbPath is read once at boot to drain
+      // a pre-Phase-2 scadabridge.db, and is unused after that - keep it until this node has
+      // started once.
       "SiteDbPath": "/app/data/scadabridge.db"
     },
     "DataConnection": {
@@ -30,8 +34,11 @@
       "SeedReadTimeout": "00:00:30"
     },
     "StoreAndForward": {
-      "SqliteDbPath": "/app/data/store-and-forward.db",
+      // Migration-only as of LocalDb Phase 2. The store-and-forward buffer now lives in the
-      "ReplicationEnabled": true
+      // consolidated LocalDb database (LocalDb:Path) as the replicated sf_messages table.
+      // SqliteDbPath is read once at boot by SiteLocalDbLegacyMigrator to drain a pre-Phase-2
+      // file, and is unused after that - keep it until this node has started once.
+      "SqliteDbPath": "/app/data/store-and-forward.db"
     },
     "Communication": {
       "CentralContactPoints": [

docker/site-b-node-b/appsettings.Site.json

@@ -21,6 +21,10 @@
       "MinNrOfMembers": 1
     },
     "Database": {
+      // Migration-only as of LocalDb Phase 2. The site config tables now live in the
+      // consolidated LocalDb database (LocalDb:Path). SiteDbPath is read once at boot to drain
+      // a pre-Phase-2 scadabridge.db, and is unused after that - keep it until this node has
+      // started once.
       "SiteDbPath": "/app/data/scadabridge.db"
     },
     "DataConnection": {
@@ -30,8 +34,11 @@
       "SeedReadTimeout": "00:00:30"
     },
     "StoreAndForward": {
-      "SqliteDbPath": "/app/data/store-and-forward.db",
+      // Migration-only as of LocalDb Phase 2. The store-and-forward buffer now lives in the
-      "ReplicationEnabled": true
+      // consolidated LocalDb database (LocalDb:Path) as the replicated sf_messages table.
+      // SqliteDbPath is read once at boot by SiteLocalDbLegacyMigrator to drain a pre-Phase-2
+      // file, and is unused after that - keep it until this node has started once.
+      "SqliteDbPath": "/app/data/store-and-forward.db"
     },
     "Communication": {
       "CentralContactPoints": [

docker/site-c-node-a/appsettings.Site.json

@@ -21,6 +21,10 @@
       "MinNrOfMembers": 1
     },
     "Database": {
+      // Migration-only as of LocalDb Phase 2. The site config tables now live in the
+      // consolidated LocalDb database (LocalDb:Path). SiteDbPath is read once at boot to drain
+      // a pre-Phase-2 scadabridge.db, and is unused after that - keep it until this node has
+      // started once.
       "SiteDbPath": "/app/data/scadabridge.db"
     },
     "DataConnection": {
@@ -30,8 +34,11 @@
       "SeedReadTimeout": "00:00:30"
     },
     "StoreAndForward": {
-      "SqliteDbPath": "/app/data/store-and-forward.db",
+      // Migration-only as of LocalDb Phase 2. The store-and-forward buffer now lives in the
-      "ReplicationEnabled": true
+      // consolidated LocalDb database (LocalDb:Path) as the replicated sf_messages table.
+      // SqliteDbPath is read once at boot by SiteLocalDbLegacyMigrator to drain a pre-Phase-2
+      // file, and is unused after that - keep it until this node has started once.
+      "SqliteDbPath": "/app/data/store-and-forward.db"
     },
     "Communication": {
       "CentralContactPoints": [

docker/site-c-node-b/appsettings.Site.json

@@ -21,6 +21,10 @@
       "MinNrOfMembers": 1
     },
     "Database": {
+      // Migration-only as of LocalDb Phase 2. The site config tables now live in the
+      // consolidated LocalDb database (LocalDb:Path). SiteDbPath is read once at boot to drain
+      // a pre-Phase-2 scadabridge.db, and is unused after that - keep it until this node has
+      // started once.
       "SiteDbPath": "/app/data/scadabridge.db"
     },
     "DataConnection": {
@@ -30,8 +34,11 @@
       "SeedReadTimeout": "00:00:30"
     },
     "StoreAndForward": {
-      "SqliteDbPath": "/app/data/store-and-forward.db",
+      // Migration-only as of LocalDb Phase 2. The store-and-forward buffer now lives in the
-      "ReplicationEnabled": true
+      // consolidated LocalDb database (LocalDb:Path) as the replicated sf_messages table.
+      // SqliteDbPath is read once at boot by SiteLocalDbLegacyMigrator to drain a pre-Phase-2
+      // file, and is unused after that - keep it until this node has started once.
+      "SqliteDbPath": "/app/data/store-and-forward.db"
     },
     "Communication": {
       "CentralContactPoints": [

src/ZB.MOM.WW.ScadaBridge.Host/StartupValidator.cs

@@ -94,7 +94,7 @@ public static class StartupValidator
                 _ => seedNodes != null && seedNodes.Count >= 2,
                 "must have at least 2 entries")
             // The big Site-only block: GrpcPort/MetricsPort validity + cross-field
-            // collisions + SiteDbPath + seed-node-port loop, in the original order.
+            // collisions + seed-node-port loop, in the original order.
             .When(role == "Site", p =>
             {
                 // GrpcPort range, then GrpcPort vs RemotingPort.
@@ -110,9 +110,12 @@ public static class StartupValidator
                 p.Require("ScadaBridge:Node:MetricsPort", _ => metricsPort != port, "must differ from RemotingPort");
                 p.Require("ScadaBridge:Node:MetricsPort", _ => metricsPort != grpcPort, "must differ from GrpcPort");
 
-                p.Require("ScadaBridge:Database:SiteDbPath",
+                // ScadaBridge:Database:SiteDbPath was required here until LocalDb
-                    _ => !string.IsNullOrEmpty(configuration.GetSection("ScadaBridge:Database")["SiteDbPath"]),
+                // Phase 2. The site's tables now live in the consolidated LocalDb
-                    "required for Site nodes");
+                // database (LocalDb:Path, which SiteServiceRegistration requires),
+                // and SiteDbPath survives only as the legacy migration source — so
+                // its absence means "nothing to migrate", not a misconfiguration.
+                // DatabaseOptionsValidator still rejects a present-but-blank value.
 
                 // A seed node must reference an Akka.Remote endpoint, never the
                 // Kestrel HTTP/2 gRPC port. A seed entry whose port equals this node's

src/ZB.MOM.WW.ScadaBridge.Host/appsettings.Site.json

@@ -23,6 +23,10 @@
       "MinNrOfMembers": 1
     },
     "Database": {
+      // Migration-only as of LocalDb Phase 2. The site config tables now live in the
+      // consolidated LocalDb database (LocalDb:Path). SiteDbPath is read once at boot to drain
+      // a pre-Phase-2 scadabridge.db, and is unused after that - keep it until this node has
+      // started once.
       "SiteDbPath": "./data/scadabridge.db"
     },
     "DataConnection": {
@@ -31,8 +35,11 @@
       "WriteTimeout": "00:00:30"
     },
     "StoreAndForward": {
-      "SqliteDbPath": "./data/store-and-forward.db",
+      // Migration-only as of LocalDb Phase 2. The store-and-forward buffer now lives in the
-      "ReplicationEnabled": true
+      // consolidated LocalDb database (LocalDb:Path) as the replicated sf_messages table.
+      // SqliteDbPath is read once at boot by SiteLocalDbLegacyMigrator to drain a pre-Phase-2
+      // file, and is unused after that - keep it until this node has started once.
+      "SqliteDbPath": "./data/store-and-forward.db"
     },
     "Communication": {
       "_centralContactPoints": "Host-016: each entry MUST be a central node's remoting endpoint, NOT this site's own remoting port. The single dev-loopback default below points only at central-a (localhost:8081). In a multi-central deployment add the second central node here (e.g. 'akka.tcp://scadabridge@central-b-host:8081') so ClusterClient can fail over when central-a is down. The previous template listed localhost:8082 as the second contact — that is THIS site's own RemotingPort and is a permanent failure in the initial-contact rotation.",

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/SiteRuntimeOptions.cs

@@ -60,13 +60,6 @@ public class SiteRuntimeOptions
     /// <summary>HTTP timeout (seconds) for fetching a deployment config from central (notify-and-fetch).</summary>
     public int ConfigFetchTimeoutSeconds { get; set; } = 30;
 
-    /// <summary>
-    /// Bounded attempt count (including the first) for the standby's replicated-config
-    /// fetch; a 2 s fixed delay separates attempts and superseded fetches never retry.
-    /// Consumed by <c>SiteReplicationActor.HandleApplyConfigDeploy</c> (UA2). Default: 3.
-    /// </summary>
-    public int ConfigFetchRetryCount { get; set; } = 3;
-
     /// <summary>
     /// Fixed interval (ms) at which an Instance Actor re-sends a tag-subscribe
     /// request that either failed or whose response was lost (S4/UA6). The retry is

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/SiteRuntimeOptionsValidator.cs

@@ -53,10 +53,6 @@ public sealed class SiteRuntimeOptionsValidator : OptionsValidatorBase<SiteRunti
             $"ScadaBridge:SiteRuntime:ConfigFetchTimeoutSeconds must be greater than 0 " +
             $"(was {options.ConfigFetchTimeoutSeconds}).");
 
-        builder.RequireThat(options.ConfigFetchRetryCount >= 0,
-            $"ScadaBridge:SiteRuntime:ConfigFetchRetryCount must be >= 0 " +
-            $"(was {options.ConfigFetchRetryCount}).");
-
         builder.RequireThat(options.TagSubscribeRetryIntervalMs > 0,
             $"ScadaBridge:SiteRuntime:TagSubscribeRetryIntervalMs must be greater than 0 " +
             $"(was {options.TagSubscribeRetryIntervalMs}); a zero interval hot-loops the tag-subscribe " +

src/ZB.MOM.WW.ScadaBridge.StoreAndForward/StoreAndForwardOptions.cs

@@ -5,12 +5,15 @@ namespace ZB.MOM.WW.ScadaBridge.StoreAndForward;
 /// </summary>
 public class StoreAndForwardOptions
 {
-    /// <summary>Path to the SQLite database for S&amp;F message persistence.</summary>
+    /// <summary>
+    /// Path to the legacy standalone store-and-forward SQLite file. <b>Migration-only.</b>
+    /// The buffer itself lives in the consolidated LocalDb database (<c>LocalDb:Path</c>)
+    /// as of LocalDb Phase 2; this path is read once at boot by
+    /// <c>SiteLocalDbLegacyMigrator</c> to drain a pre-Phase-2 file, and is otherwise
+    /// unused. A node that has already migrated may leave it set or unset.
+    /// </summary>
     public string SqliteDbPath { get; set; } = "./data/store-and-forward.db";
 
-    /// <summary>Whether to replicate buffer operations to standby node.</summary>
-    public bool ReplicationEnabled { get; set; } = true;
-
     /// <summary>Default retry interval for messages without per-source settings.</summary>
     public TimeSpan DefaultRetryInterval { get; set; } = TimeSpan.FromSeconds(30);
 

src/ZB.MOM.WW.ScadaBridge.StoreAndForward/StoreAndForwardOptionsValidator.cs

@@ -5,21 +5,23 @@ namespace ZB.MOM.WW.ScadaBridge.StoreAndForward;
 /// <summary>
 /// Validates <see cref="StoreAndForwardOptions"/> at startup. The retry intervals
 /// feed the background sweep timer (a zero/negative period trips
-/// <see cref="ArgumentOutOfRangeException"/> in the timer constructor) and the
+/// <see cref="ArgumentOutOfRangeException"/> in the timer constructor). Registered
-/// SQLite path is opened for the S&amp;F buffer; an empty path yields an opaque
+/// with <c>ValidateOnStart()</c> so a bad <c>ScadaBridge:StoreAndForward</c> section
-/// connection failure at first enqueue. Registered with <c>ValidateOnStart()</c>
+/// fails fast at boot with a clear, key-naming message.
-/// so a bad <c>ScadaBridge:StoreAndForward</c> section fails fast at boot with a
+/// <para>
-/// clear, key-naming message.
+/// <see cref="StoreAndForwardOptions.SqliteDbPath"/> is deliberately NOT validated.
+/// Before LocalDb Phase 2 it was the live buffer file, so an empty value produced an
+/// opaque connection failure at first enqueue; the buffer now lives in the
+/// consolidated LocalDb database and the key survives only as the legacy migration
+/// source. An empty value there is a legitimate "nothing to migrate", so requiring
+/// it would make every already-migrated node carry a dead key forever.
+/// </para>
 /// </summary>
 public sealed class StoreAndForwardOptionsValidator : OptionsValidatorBase<StoreAndForwardOptions>
 {
     /// <inheritdoc />
     protected override void Validate(ValidationBuilder builder, StoreAndForwardOptions options)
     {
-        builder.RequireThat(!string.IsNullOrWhiteSpace(options.SqliteDbPath),
-            "ScadaBridge:StoreAndForward:SqliteDbPath must be a non-empty path; " +
-            "it is the SQLite file backing the store-and-forward buffer.");
-
         builder.RequireThat(options.DefaultRetryInterval > TimeSpan.Zero,
             $"ScadaBridge:StoreAndForward:DefaultRetryInterval must be a positive duration " +
             $"(was {options.DefaultRetryInterval}); it is the default per-message retry interval.");

tests/ZB.MOM.WW.ScadaBridge.Host.Tests/StartupValidatorTests.cs

@@ -232,15 +232,22 @@ public class StartupValidatorTests
         Assert.Null(ex);
     }
 
+    /// <summary>
+    /// The inverse of the rule this replaces. SiteDbPath was mandatory for Site
+    /// nodes until LocalDb Phase 2 moved the site tables into the consolidated
+    /// LocalDb database; it now names only the legacy file the boot-time migrator
+    /// drains, so its absence means "nothing to migrate". Requiring it would make
+    /// every already-migrated node carry a dead key forever.
+    /// </summary>
     [Fact]
-    public void Site_MissingSiteDbPath_FailsValidation()
+    public void Site_MissingSiteDbPath_IsAccepted_BecauseThePathIsMigrationOnly()
     {
         var values = ValidSiteConfig();
         values.Remove("ScadaBridge:Database:SiteDbPath");
         var config = BuildConfig(values);
 
-        var ex = Assert.Throws<InvalidOperationException>(() => StartupValidator.Validate(config));
+        var ex = Record.Exception(() => StartupValidator.Validate(config));
-        Assert.Contains("SiteDbPath required for Site nodes", ex.Message);
+        Assert.Null(ex);
     }
 
     [Fact]

tests/ZB.MOM.WW.ScadaBridge.StoreAndForward.Tests/ParkedMessageHandlerActorTests.cs

@@ -29,7 +29,6 @@ public class ParkedMessageHandlerActorTests : TestKit, IAsyncLifetime, IDisposab
             DefaultRetryInterval = TimeSpan.Zero,
             DefaultMaxRetries = 1,
             RetryTimerInterval = TimeSpan.FromMinutes(10),
-            ReplicationEnabled = false,
         };
 
         _service = new StoreAndForwardService(

tests/ZB.MOM.WW.ScadaBridge.StoreAndForward.Tests/ParkedOperationRelayTests.cs

@@ -34,7 +34,6 @@ public class ParkedOperationRelayTests : TestKit, IAsyncLifetime, IDisposable
             DefaultRetryInterval = TimeSpan.Zero,
             DefaultMaxRetries = 1,
             RetryTimerInterval = TimeSpan.FromMinutes(10),
-            ReplicationEnabled = false,
         };
 
         _service = new StoreAndForwardService(

tests/ZB.MOM.WW.ScadaBridge.StoreAndForward.Tests/StoreAndForwardOptionsTests.cs

@@ -11,7 +11,6 @@ public class StoreAndForwardOptionsTests
         var options = new StoreAndForwardOptions();
 
         Assert.Equal("./data/store-and-forward.db", options.SqliteDbPath);
-        Assert.True(options.ReplicationEnabled);
         Assert.Equal(TimeSpan.FromSeconds(30), options.DefaultRetryInterval);
         Assert.Equal(50, options.DefaultMaxRetries);
         Assert.Equal(TimeSpan.FromSeconds(10), options.RetryTimerInterval);
@@ -23,14 +22,12 @@ public class StoreAndForwardOptionsTests
         var options = new StoreAndForwardOptions
         {
             SqliteDbPath = "/custom/path.db",
-            ReplicationEnabled = false,
             DefaultRetryInterval = TimeSpan.FromMinutes(5),
             DefaultMaxRetries = 100,
             RetryTimerInterval = TimeSpan.FromSeconds(30)
         };
 
         Assert.Equal("/custom/path.db", options.SqliteDbPath);
-        Assert.False(options.ReplicationEnabled);
         Assert.Equal(TimeSpan.FromMinutes(5), options.DefaultRetryInterval);
         Assert.Equal(100, options.DefaultMaxRetries);
     }

tests/ZB.MOM.WW.ScadaBridge.StoreAndForward.Tests/StoreAndForwardOptionsValidatorTests.cs

@@ -39,13 +39,20 @@ public class StoreAndForwardOptionsValidatorTests
         Assert.Contains("RetryTimerInterval", result.FailureMessage);
     }
 
+    /// <summary>
+    /// The inverse of the rule this replaces. Before LocalDb Phase 2 an empty
+    /// SqliteDbPath was rejected, because it was the live buffer file and an empty
+    /// value failed opaquely at first enqueue. The buffer now lives in the
+    /// consolidated LocalDb database, so the key is only the legacy migration
+    /// source and an empty value legitimately means "nothing to migrate" — a node
+    /// that has already migrated must be able to drop it.
+    /// </summary>
     [Fact]
-    public void EmptySqliteDbPath_IsRejected()
+    public void EmptySqliteDbPath_IsAccepted_BecauseThePathIsMigrationOnly()
     {
         var result = Validate(new StoreAndForwardOptions { SqliteDbPath = "" });
 
-        Assert.True(result.Failed);
+        Assert.False(result.Failed);
-        Assert.Contains("SqliteDbPath", result.FailureMessage);
     }
 
     // ── R2 T9: sweep-tuning eager validation (N4) ──