fix(options): bind + validate OperationTrackingOptions; register the site IOperationTrackingStore that two comments claimed AddSiteRuntime provides (plan R2-08 T8, arch-review 08r2 NF4)

VERIFY-THEN-FIX: the plan-authoring discovery is CONFIRMED. No code anywhere in
src/ registered IOperationTrackingStore in DI, yet AkkaHostedService and
AuditLog SCE both comment that AddSiteRuntime provides it. Every consumer
resolved it via GetService (null-tolerant) and silently ran degraded:
cached-drain scheduler never armed, PullSiteCalls reconciliation seam never
wired, Tracking.Status degraded to audit-only. This is a FUNCTIONAL FIX riding
the hygiene plan: AddSiteRuntime now registers the store (site-only), so
site-local cached-call tracking runs in its intended mode. OperationTrackingOptions
is now bound + eagerly validated in the Host site-options block.

src/ZB.MOM.WW.ScadaBridge.Host/SiteServiceRegistration.cs

@@ -137,6 +137,18 @@ public static class SiteServiceRegistration
         services.TryAddEnumerable(
             ServiceDescriptor.Singleton<IValidateOptions<SiteRuntimeOptions>, SiteRuntimeOptionsValidator>());
 
+        // OperationTrackingOptions for the site-local cached-call tracking store
+        // (registered by AddSiteRuntime). Bind + eagerly validate here — the store
+        // opens its SQLite connection string at construction, so a blank connection
+        // string should fail the host at boot with a key-naming message rather than
+        // throw opaquely on first resolve (arch-review 08r2 NF4/T8).
+        services.AddOptions<SiteRuntime.Tracking.OperationTrackingOptions>()
+            .Bind(config.GetSection("ScadaBridge:OperationTracking"))
+            .ValidateOnStart();
+        services.TryAddEnumerable(
+            ServiceDescriptor.Singleton<IValidateOptions<SiteRuntime.Tracking.OperationTrackingOptions>,
+                SiteRuntime.Tracking.OperationTrackingOptionsValidator>());
+
         services.Configure<DataConnectionOptions>(config.GetSection("ScadaBridge:DataConnection"));
 
         services.AddOptions<StoreAndForwardOptions>()

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/ServiceCollectionExtensions.cs

@@ -60,6 +60,19 @@ public static class ServiceCollectionExtensions
         });
         services.AddSingleton<ISiteStreamSubscriber>(sp => sp.GetRequiredService<SiteStreamManager>());
 
+        // Site-local cached-operation tracking store — the SQLite source of truth
+        // that Tracking.Status(TrackedOperationId) reads and the cached-call telemetry
+        // forwarder writes. Registered HERE (site-only) so the two comments that claim
+        // "the operational tracking store is registered by AddSiteRuntime" are true
+        // again (AuditLog SCE + AkkaHostedService). Before this (arch-review 08 round 2
+        // NF4/T8) it had no DI registration anywhere in src/, so every consumer resolved
+        // it as null and silently ran degraded (no cached-drain, no PullSiteCalls
+        // reconciliation, Tracking.Status audit-only). Central roots never call
+        // AddSiteRuntime, so this stays absent on central — matching the SITE-ONLY
+        // contract. OperationTrackingOptions is bound + validated by the Host's
+        // SiteServiceRegistration site-options block.
+        services.AddSingleton<Commons.Interfaces.IOperationTrackingStore, Tracking.OperationTrackingStore>();
+
         // Site-local repository implementations backed by SQLite
         services.AddScoped<IExternalSystemRepository, SiteExternalSystemRepository>();
 

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/Tracking/OperationTrackingOptionsValidator.cs

@@ -0,0 +1,26 @@
+using ZB.MOM.WW.Configuration;
+
+namespace ZB.MOM.WW.ScadaBridge.SiteRuntime.Tracking;
+
+/// <summary>
+/// Validates <see cref="OperationTrackingOptions"/> at host startup (arch-review
+/// 08 round 2 NF4). <see cref="OperationTrackingStore"/> opens the SQLite
+/// connection string in its constructor, so an empty/blank connection string
+/// must fail the host at boot rather than throw opaquely on first resolve. The
+/// retention window must be positive — a zero would make the host's terminal-row
+/// purge delete every tracking row.
+/// </summary>
+public sealed class OperationTrackingOptionsValidator : OptionsValidatorBase<OperationTrackingOptions>
+{
+    /// <inheritdoc />
+    protected override void Validate(ValidationBuilder builder, OperationTrackingOptions options)
+    {
+        builder.RequireThat(!string.IsNullOrWhiteSpace(options.ConnectionString),
+            $"ScadaBridge:OperationTracking:{nameof(OperationTrackingOptions.ConnectionString)} " +
+            "must be a non-empty SQLite connection string.");
+
+        builder.RequireThat(options.RetentionDays > 0,
+            $"ScadaBridge:OperationTracking:{nameof(OperationTrackingOptions.RetentionDays)} " +
+            $"({options.RetentionDays}) must be > 0.");
+    }
+}