Resolve all 33 medium-severity architecture review findings

Second slice of the 2026-09-09 whole-system review remediation
(docs/plans/2026-09-09-arch-review.md §10), on top of the High slice 146a1323.

Runtime/devices: SR-2 alarm on-trigger integration scope; SR-3 correlated NativeAlarmActor
subscribe retry; SR-4 immutable audited DB target; SR-5 ordered InstanceActor stop/flush;
SR-12 rehydration fence; SR-13 S&F gate recheck per delivery; DC-4 no OPC UA security
downgrade; DC-5 alarm snapshot for every new subscriber; ORCH-1 sync-dispose joins the pump.

Management/UI: MG-2 site scope on audit tree + Flow Debugger Replay; MG-3 stale-probe memo
removed; MG-4 server-owned bulk-deploy deadline; UI-5 sandbox runs in a killable child
process (new CentralUI.SandboxWorker project); UI-14 bounded sandbox output/IPC.

Edge/audit: EI-1 relay audit ownership; EI-2 SkipBodyCapture suppresses error text; EI-3/EI-11
error-field redaction + caps; EI-4 single relay deadline, pre-execution-only retry; EI-5
authenticated relay provenance; EI-10 body cap before audit read.

Persistence/contracts: DL-1 global Instance.UniqueName unique index + conflict translation;
DL-2 DataConnection protocol config encrypted at rest (migration
20260909203046_EnforceGlobalInstanceNamesAndProtectProtocolConfiguration — coordinated
central upgrade, old binaries cannot read protected rows); DL-3 bounded Replay paging;
DL-6 cross-site Overwrite of a deployed instance rejected; XC-4 proto descriptor contract test.

Config/hygiene: XC-1 central listener isolation by local port; XC-2/XC-3 inert SMTP + cron
keys removed from rig settings; CM-2 env2 bootstrap guard enabled; DC-6 deploy site exit code;
DC-7 notifier retries only explicit standby rejection; XC-5 ClusterClient purged from docs.

Gates recorded in the report: build 0/0, 9 397 passed / 0 failed, rig redeployed on all
eight nodes with the migration applied. 46 Low findings remain open.

src/ZB.MOM.WW.ScadaBridge.Commons/Entities/Instances/InstanceNameConflictException.cs

@@ -0,0 +1,5 @@
+namespace ZB.MOM.WW.ScadaBridge.Commons.Entities.Instances;
+
+/// <summary>A database-enforced global instance name conflict, including concurrent creation.</summary>
+public sealed class InstanceNameConflictException(Exception innerException)
+    : InvalidOperationException("An instance with this unique name already exists. Choose a different name.", innerException);

src/ZB.MOM.WW.ScadaBridge.Commons/Interfaces/Repositories/IAuditLogRepository.cs

@@ -294,7 +294,7 @@ public interface IAuditLogRepository
     /// <returns>A task that resolves to the full execution tree rooted at the topmost ancestor, one node per distinct execution.</returns>
     Task<IReadOnlyList<ExecutionTreeNode>> GetExecutionTreeAsync(
         Guid executionId,
-        CancellationToken ct = default);
+        CancellationToken ct = default, IReadOnlyList<string>? permittedSiteIds = null);
 
     /// <summary>
     /// Flow Debugger Replay (design 2026-09-05 §7.1): every row of the execution tree that
@@ -309,7 +309,7 @@ public interface IAuditLogRepository
     /// <returns>The canonical audit events that make up the flow, oldest first.</returns>
     Task<IReadOnlyList<AuditEvent>> GetTraceEventsAsync(
         Guid executionId,
-        CancellationToken ct = default);
+        CancellationToken ct = default, IReadOnlyList<string>? permittedSiteIds = null);
 
     /// <summary>
     /// Returns the distinct, non-null <c>SourceNode</c> values present in the

src/ZB.MOM.WW.ScadaBridge.Commons/Interfaces/Services/ISandboxDatabaseConnectionSource.cs

@@ -0,0 +1,6 @@
+namespace ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services;
+/// <summary>Private worker handoff for an existing configured SQL connection. Never log or expose the returned secret.</summary>
+public interface ISandboxDatabaseConnectionSource
+{
+    Task<string> GetSandboxConnectionStringAsync(string connectionName, CancellationToken cancellationToken);
+}

src/ZB.MOM.WW.ScadaBridge.Commons/Types/Audit/TraceEventBatch.cs

@@ -0,0 +1,11 @@
+using System.Collections;
+using ZB.MOM.WW.Audit;
+namespace ZB.MOM.WW.ScadaBridge.Commons.Types.Audit;
+/// <summary>Bounded replay data with independently retained chain-root and truncation metadata.</summary>
+public sealed record TraceEventBatch(Guid RootExecutionId, IReadOnlyList<AuditEvent> Events, bool Truncated) : IReadOnlyList<AuditEvent>
+{
+    public AuditEvent this[int index] => Events[index];
+    public int Count => Events.Count;
+    public IEnumerator<AuditEvent> GetEnumerator() => Events.GetEnumerator();
+    IEnumerator IEnumerable.GetEnumerator() => GetEnumerator();
+}