feat(options): eager startup validation for central-component options (Transport, SiteCallAudit, DeploymentManager) (arch-review 08 §1.5)

Claude-Session: https://claude.ai/code/session_01MtdgwpEeCUn6cUA5f1LMPj

src/ZB.MOM.WW.ScadaBridge.DeploymentManager/DeploymentManagerOptionsValidator.cs

@@ -0,0 +1,31 @@
+using ZB.MOM.WW.Configuration;
+
+namespace ZB.MOM.WW.ScadaBridge.DeploymentManager;
+
+/// <summary>
+/// Validates <see cref="DeploymentManagerOptions"/> at startup. Each timeout is
+/// applied as a linked-CTS deadline around a lifecycle command, per-site artifact
+/// deployment, or operation-lock acquisition; a zero/negative value makes the
+/// deadline fire immediately (or the <see cref="System.Threading.CancellationTokenSource"/>
+/// constructor throw), breaking deployments with an opaque failure. Registered
+/// with <c>ValidateOnStart()</c> so a bad <c>ScadaBridge:DeploymentManager</c>
+/// section fails fast at boot with a clear, key-naming message.
+/// </summary>
+public sealed class DeploymentManagerOptionsValidator : OptionsValidatorBase<DeploymentManagerOptions>
+{
+    /// <inheritdoc />
+    protected override void Validate(ValidationBuilder builder, DeploymentManagerOptions options)
+    {
+        builder.RequireThat(options.LifecycleCommandTimeout > TimeSpan.Zero,
+            $"ScadaBridge:DeploymentManager:LifecycleCommandTimeout must be a positive duration " +
+            $"(was {options.LifecycleCommandTimeout}); it bounds a lifecycle command round-trip.");
+
+        builder.RequireThat(options.ArtifactDeploymentTimeoutPerSite > TimeSpan.Zero,
+            $"ScadaBridge:DeploymentManager:ArtifactDeploymentTimeoutPerSite must be a positive duration " +
+            $"(was {options.ArtifactDeploymentTimeoutPerSite}); it bounds per-site artifact deployment.");
+
+        builder.RequireThat(options.OperationLockTimeout > TimeSpan.Zero,
+            $"ScadaBridge:DeploymentManager:OperationLockTimeout must be a positive duration " +
+            $"(was {options.OperationLockTimeout}); it bounds acquiring an instance operation lock.");
+    }
+}

src/ZB.MOM.WW.ScadaBridge.DeploymentManager/ServiceCollectionExtensions.cs

@@ -1,4 +1,6 @@
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection.Extensions;
+using Microsoft.Extensions.Options;
 using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Transport;
 
 namespace ZB.MOM.WW.ScadaBridge.DeploymentManager;
@@ -27,8 +29,14 @@ public static class ServiceCollectionExtensions
     {
         // Ensure the options class is always resolvable.
         // The Host binds OptionsSection to appsettings.json; absent that binding
-        // the declared option-class defaults apply.
-        services.AddOptions<DeploymentManagerOptions>();
+        // the declared option-class defaults apply. Eager startup validation
+        // (arch-review 08 §1.5): ValidateOnStart makes a zero/negative timeout —
+        // which would fire a linked-CTS deadline immediately (or throw in the
+        // CancellationTokenSource ctor) — fail fast at boot with a clear,
+        // key-naming message. Applies even though defaults are code-configured.
+        services.AddOptions<DeploymentManagerOptions>().ValidateOnStart();
+        services.TryAddEnumerable(
+            ServiceDescriptor.Singleton<IValidateOptions<DeploymentManagerOptions>, DeploymentManagerOptionsValidator>());
         services.AddSingleton<OperationLockManager>();
 
         // Push-based deployment-status notification. Registered

src/ZB.MOM.WW.ScadaBridge.DeploymentManager/ZB.MOM.WW.ScadaBridge.DeploymentManager.csproj

@@ -11,6 +11,7 @@
     <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Options" />
+    <PackageReference Include="ZB.MOM.WW.Configuration" />
   </ItemGroup>
 
   <ItemGroup>