refactor(auditlog+sitecallaudit): delete the _injectedRepository test ctors — register row 61

AuditLogIngestActor and SiteCallAuditActor each exposed constructors taking a scoped
repository and caching it on a field for the actor's lifetime. Safe only because no
production call site picked those overloads — i.e. one call site away from re-introducing
the row-45 captive-dependency bug — which is why CaptiveDependencyGuard had to allowlist
both fields.

Preferred fix applied: the test fixtures fold onto the IServiceProvider overload with a
stub provider, and the constructors are gone.

Product deletions:
  - AuditLogIngestActor: the (IAuditLogRepository, ILogger) ctor, the _injectedRepository
    field and its branch in OnIngestAsync, and OnCachedTelemetryWithoutDualWriteAsync (the
    "this ctor cannot dual-write" fallback handler that only that ctor installed).
    _serviceProvider is now non-nullable and the null-forgiving operators are gone.
  - SiteCallAuditActor: both test ctors (repo-only, and repo + reconciliation
    collaborators), the _injectedRepository field and its four branches, and the private
    SerializedRepository class. _backgroundTimersEnabled went with them: only the deleted
    repo-only ctor ever set it false, so it was a constant and its two guards are removed.
    The reconciliation tick is still gated — on the collaborators being resolvable, which
    is how production reaches the same state.

Test fixtures (12 call sites): two small TestSupport helpers build the stub providers.
SiteCallAuditActor's production wiring resolves a FRESH repository per scope, so the
serializing decorator existed only to protect fixtures that share one DbContext-backed
instance across every scope — it moves into the test project as
SerializingSiteCallAuditRepository, which is where the hazard is actually created.
Fixtures that relied on it keep it. The relay test's ICentralAuditWriter now arrives via
the provider, exactly as production resolves it.

Behaviour is preserved on the paths under test: the deleted audit ctor passed
redactor:null / failureCounter:null, and a provider registering neither resolves both to
null, so the SafeDefaultAuditRedactor fallback and counter-free logging are unchanged. No
fixture on the folded sites sends IngestCachedTelemetryCommand, so swapping to the real
dual-write handler is inert. The SiteCallAudit purge timer now arms in fixtures that
previously had timers off, but every one of them uses default purge settings whose first
tick is 5 minutes out — nothing fires inside a test.

One reconciliation test was renamed and rewritten rather than deleted:
TestCtor_RepositoryOnly_DoesNotStartReconciliationTick became
NoReconciliationCollaboratorsRegistered_DoesNotStartReconciliationTick — the same
guarantee, expressed the way production actually reaches it.

Guard: the allowlist is now EMPTY. The staleness self-test (every entry must still match a
flagged field) is replaced by two stronger pins — Allowlist_IsEmpty asserts nothing is
exempt at all, and FormerlyAllowlistedActors_NowScanClean scans both actors with the
allowlist DISABLED, so the empty allowlist is evidence the fields are gone rather than
evidence the scan stopped looking.

Negative control: re-adding an ISiteCallAuditRepository field to SiteCallAuditActor fails
both FormerlyAllowlistedActors_NowScanClean and the real
Central_NoActorHoldsCaptiveScopedState scan.

Verification: solution builds clean. AuditLog.Tests 3/3 (383), SiteCallAudit.Tests 3/3
(66), Host.Tests 2/2 (505), IntegrationTests 2/2 (115), Communication.Tests 2/2 (717).

src/ZB.MOM.WW.ScadaBridge.AuditLog/Central/AuditLogIngestActor.cs

@@ -42,13 +42,14 @@ namespace ZB.MOM.WW.ScadaBridge.AuditLog.Central;
 /// placeholder.
 /// </para>
 /// <para>
-/// Two constructors exist for a deliberate reason: the test ctor injects a
-/// concrete <see cref="IAuditLogRepository"/> against a per-test MSSQL fixture
-/// (the only way to verify the ingest-timestamp stamp + duplicate-key
-/// idempotency end to end), while the production host wiring registers the
-/// actor as a cluster singleton and must therefore resolve the repository —
-/// which is a scoped EF Core service — from a fresh DI scope per message.
-/// Mirroring the Notification Outbox actor's pattern.
+/// There is exactly ONE constructor, taking an <see cref="IServiceProvider"/>:
+/// the actor is a cluster singleton and the repository is a scoped EF Core
+/// service, so it must be resolved from a fresh DI scope per message and never
+/// held on a field. Mirroring the Notification Outbox actor's pattern. Tests
+/// that need a concrete repository (e.g. the MSSQL-backed fixture verifying the
+/// ingest-timestamp stamp and duplicate-key idempotency) supply a stub provider
+/// that hands one out, rather than a second constructor that would cache it —
+/// see register row 61.
 /// </para>
 /// </remarks>
 public class AuditLogIngestActor : ReceiveActor
@@ -100,41 +101,25 @@ public class AuditLogIngestActor : ReceiveActor
     /// </remarks>
     internal static readonly TimeSpan IngestFallbackBudget = TimeSpan.FromSeconds(5);
 
-    private readonly IServiceProvider? _serviceProvider;
-    private readonly IAuditLogRepository? _injectedRepository;
+    private readonly IServiceProvider _serviceProvider;
     private readonly ILogger<AuditLogIngestActor> _logger;
 
     /// <summary>
-    /// Test-mode constructor — injects a concrete repository instance whose
-    /// lifetime exceeds the test, so the actor reuses the same instance across
-    /// every message. Used by the MSSQL-backed TestKit fixture.
-    /// </summary>
-    /// <param name="repository">Audit log repository instance shared across all messages.</param>
-    /// <param name="logger">Logger for ingest diagnostics.</param>
-    public AuditLogIngestActor(
-        IAuditLogRepository repository,
-        ILogger<AuditLogIngestActor> logger)
-    {
-        ArgumentNullException.ThrowIfNull(repository);
-        ArgumentNullException.ThrowIfNull(logger);
-
-        _injectedRepository = repository;
-        _logger = logger;
-
-        ReceiveAsync<IngestAuditEventsCommand>(OnIngestAsync);
-        // The single-repository test ctor cannot service the dual-write —
-        // it has no SiteCalls repo and no DbContext. The handler still
-        // registers (so callers don't dead-letter) but replies empty so the
-        // test surface stays explicit about what this ctor supports.
-        ReceiveAsync<IngestCachedTelemetryCommand>(OnCachedTelemetryWithoutDualWriteAsync);
-    }
-
-    /// <summary>
-    /// Production constructor — resolves <see cref="IAuditLogRepository"/> from
+    /// The only constructor — resolves <see cref="IAuditLogRepository"/> from
     /// a fresh DI scope per message because the repository is a scoped EF Core
     /// service registered by <c>AddConfigurationDatabase</c>. The actor itself
     /// is a long-lived cluster singleton, so it cannot hold a scope across
     /// messages.
+    ///
+    /// <para>
+    /// Register row 61: a second, repository-taking "test-mode" constructor used
+    /// to cache a scoped repository on a field for the actor's whole lifetime.
+    /// Nothing in production selected it, but it left the captive-dependency bug
+    /// one call site away and had to be allowlisted in the Host tests'
+    /// <c>CaptiveDependencyGuard</c>. It is gone; test fixtures build a stub
+    /// <see cref="IServiceProvider"/> instead, which keeps the actor's own
+    /// contract "resolve per scope, hold nothing".
+    /// </para>
     /// </summary>
     /// <param name="serviceProvider">Root service provider used to open a fresh scope per message.</param>
     /// <param name="logger">Logger for ingest diagnostics.</param>
@@ -169,59 +154,51 @@ public class AuditLogIngestActor : ReceiveActor
         var accepted = new List<Guid>(cmd.Events.Count);
 
         // Resolve the repository for the whole batch — one DbContext per
-        // message, mirroring NotificationOutboxActor. The injected-repository
-        // mode (test ctor) skips the scope entirely.
+        // message, mirroring NotificationOutboxActor.
         // The IAuditRedactor is also resolved from the per-message scope when
         // one is available so the row is truncated + redacted before
-        // InsertIfNotExistsAsync. The single-repository test ctor has no
-        // service provider — it falls through with no redactor, which preserves
-        // the small-payload assumptions baked into the existing fixtures.
+        // InsertIfNotExistsAsync. A composition root that registers no redactor
+        // (test fixtures) falls back to the SafeDefault inside
+        // IngestWithRepositoryAsync rather than to pass-through.
         // Use CreateAsyncScope + await using so scoped EF Core
         // services (IAsyncDisposable DbContexts) dispose asynchronously
         // without blocking on sync Dispose() of pending connection cleanup.
-        if (_injectedRepository is not null)
+        //
+        // Guard scope-creation + repository resolution in a
+        // try/catch, mirroring OnCachedTelemetryAsync. A transient DI /
+        // DbContext-factory fault (pooled-context init, SQL-connection
+        // exhaustion, a resolution race during host churn) would otherwise
+        // propagate out of the ReceiveAsync handler, trip the parent's
+        // supervision, and RESTART this central singleton over a transient
+        // fault — dropping the captured reply so the site's Ask times out.
+        // Best-effort audit must never wedge the singleton: log, optionally
+        // bump the failure counter, and still reply with whatever was
+        // accepted (empty on an up-front scope-resolution throw) so the
+        // site keeps its rows Pending and retries on the next drain.
+        try
         {
-            await IngestWithRepositoryAsync(_injectedRepository, redactor: null, failureCounter: null, cmd, nowUtc, accepted)
+            await using var scope = _serviceProvider.CreateAsyncScope();
+            var repository = scope.ServiceProvider.GetRequiredService<IAuditLogRepository>();
+            var redactor = scope.ServiceProvider.GetService<IAuditRedactor>();
+            // Central health counter is best-effort —
+            // unregistered (test composition roots) means the per-row catch
+            // simply logs without surfacing on the health dashboard.
+            var failureCounter = scope.ServiceProvider.GetService<ICentralAuditWriteFailureCounter>();
+            await IngestWithRepositoryAsync(repository, redactor, failureCounter, cmd, nowUtc, accepted)
                 .ConfigureAwait(false);
         }
-        else
+        catch (Exception ex)
         {
-            // Guard scope-creation + repository resolution in a
-            // try/catch, mirroring OnCachedTelemetryAsync. A transient DI /
-            // DbContext-factory fault (pooled-context init, SQL-connection
-            // exhaustion, a resolution race during host churn) would otherwise
-            // propagate out of the ReceiveAsync handler, trip the parent's
-            // supervision, and RESTART this central singleton over a transient
-            // fault — dropping the captured reply so the site's Ask times out.
-            // Best-effort audit must never wedge the singleton: log, optionally
-            // bump the failure counter, and still reply with whatever was
-            // accepted (empty on an up-front scope-resolution throw) so the
-            // site keeps its rows Pending and retries on the next drain.
-            try
-            {
-                await using var scope = _serviceProvider!.CreateAsyncScope();
-                var repository = scope.ServiceProvider.GetRequiredService<IAuditLogRepository>();
-                var redactor = scope.ServiceProvider.GetService<IAuditRedactor>();
-                // Central health counter is best-effort —
-                // unregistered (test composition roots) means the per-row catch
-                // simply logs without surfacing on the health dashboard.
-                var failureCounter = scope.ServiceProvider.GetService<ICentralAuditWriteFailureCounter>();
-                await IngestWithRepositoryAsync(repository, redactor, failureCounter, cmd, nowUtc, accepted)
-                    .ConfigureAwait(false);
-            }
-            catch (Exception ex)
-            {
-                // Scope creation or a required-service resolution threw before
-                // (or while) processing the batch. Surface a sustained fault on
-                // the dashboard if the counter is registered, but never let the
-                // throw escape the handler and restart the singleton.
-                try { _serviceProvider!.GetService<ICentralAuditWriteFailureCounter>()?.Increment(); }
-                catch { /* counter must never throw — defence in depth */ }
-                _logger.LogError(
-                    ex,
-                    "Audit event batch ingest failed before/while resolving the repository scope; replying with {Accepted} accepted row(s). The site keeps unaccepted rows Pending and retries on the next drain.",
-                    accepted.Count);
-            }
+            // Scope creation or a required-service resolution threw before
+            // (or while) processing the batch. Surface a sustained fault on
+            // the dashboard if the counter is registered, but never let the
+            // throw escape the handler and restart the singleton.
+            try { _serviceProvider.GetService<ICentralAuditWriteFailureCounter>()?.Increment(); }
+            catch { /* counter must never throw — defence in depth */ }
+            _logger.LogError(
+                ex,
+                "Audit event batch ingest failed before/while resolving the repository scope; replying with {Accepted} accepted row(s). The site keeps unaccepted rows Pending and retries on the next drain.",
+                accepted.Count);
         }
 
         replyTo.Tell(new IngestAuditEventsReply(accepted));
@@ -357,7 +334,7 @@ public class AuditLogIngestActor : ReceiveActor
 
         try
         {
-            await using var scope = _serviceProvider!.CreateAsyncScope();
+            await using var scope = _serviceProvider.CreateAsyncScope();
             var auditRepo = scope.ServiceProvider.GetRequiredService<IAuditLogRepository>();
             var siteCallRepo = scope.ServiceProvider.GetRequiredService<ISiteCallAuditRepository>();
             var dbContext = scope.ServiceProvider.GetRequiredService<ScadaBridgeDbContext>();
@@ -544,18 +521,4 @@ public class AuditLogIngestActor : ReceiveActor
         return true;
     }
 
-    /// <summary>
-    /// Fallback handler installed on the single-repository test ctor — that
-    /// ctor has no DbContext and no <see cref="ISiteCallAuditRepository"/>, so
-    /// it cannot service the dual-write. Logs a warning and replies with an
-    /// empty ack so callers fall through to their retry path.
-    /// </summary>
-    private Task OnCachedTelemetryWithoutDualWriteAsync(IngestCachedTelemetryCommand cmd)
-    {
-        _logger.LogWarning(
-            "AuditLogIngestActor received IngestCachedTelemetryCommand on the single-repository ctor; dual-write requires the IServiceProvider ctor. Replying with empty ack ({Count} entries).",
-            cmd.Entries.Count);
-        Sender.Tell(new IngestCachedTelemetryReply(Array.Empty<Guid>()));
-        return Task.CompletedTask;
-    }
 }