Resolve all 46 low-severity architecture review findings

docs/plans/2026-09-09-arch-review.md

@@ -38,7 +38,7 @@ contract changes since August are additive; all eight migrations are sound and t
 matches. The test suite is broad; fresh execution evidence and its limits are in §7.
 
 The reviewed baseline contained **92 unique findings: 13 High, 33 Medium, 46 Low**.
-**Remediation status: all 13 High and 33 Medium findings completed; 46 Low findings remain open.**
+**Remediation status: all 13 High and 33 Medium findings completed; 46 / 46 Low findings completed (see §11).**
 Completion evidence and limits are recorded in §§9–10.
 This includes low-priority test/documentation gaps and latent risks, not just reproduced failures.
 The reviewed High-priority findings were:
@@ -983,4 +983,110 @@ cross-reviews rechecked lifecycle, sandbox containment, relay provenance and mig
   explicit field/service metadata. Earlier fixture/build failures were corrected without
   weakening production guards: audit test doubles accept caller scope, and protocol-writing
   fixtures use stable ephemeral key rings. These are not claimed as before-fix reproductions.
-- The 46 Low findings remain open. Focused test counts overlap the full suite and are not additive.
+- Low findings are tracked in §11. Focused test counts overlap the full suite and are not additive.
+
+
+## 11. Low-severity remediation progress
+
+**Completed: 46 / 46 Low findings.** All 46 Low findings are in scope. This register supersedes the
+baseline finding status only when a row is marked **Completed** with verification.
+High and Medium completion records in §§9–10 remain authoritative.
+
+Implementation follows the existing finding-specific fixes: preserve wire compatibility,
+bound maintenance and debugging work, enforce authorization at application boundaries,
+and correct documentation against current source. Independent UI, Flow Debugger, and
+runtime/device groups run in parallel with exclusive file ownership. Transport,
+maintenance, package/configuration work, and this register have one coordinating owner.
+Behavior changes receive focused regression checks; documentation and configuration
+changes receive source/structure validation. Final gates are full build, relevant/full
+solution tests, diff review, and a local rig rebuild for shipping runtime changes.
+
+| Finding | Status | Progress / evidence |
+|---|---|---|
+| SR-6 | **Completed** | Device-to-script linkage is explicitly inferred; alarm causal parents remain reserved for actual writes. Runtime/Commons regressions pass. |
+| SR-7 | **Completed** | Trace failure diagnostics use the undecorated logger; recursive trace capture regression passes. |
+| SR-8 | **Completed** | Thread-static scheduler identity prevents cross-scheduler inlining; saturation regression passes. |
+| SR-9 | **Completed** | Shared trigger gate has explicit process ownership; consumer Dispose cannot poison later callers. Lifecycle regression passes. |
+| SR-10 | **Completed** | Per-context helpers and guard closures are lazily cached; identity regression passes. |
+| CM-3 | **Completed** | Raw audit/site-call pulls reject limits outside 1–2000 before reading; both reconciliation option validators enforce the same cap. Boundary regressions pass. |
+| CM-4 | **Completed** | Bootstrap checks cancellation before resolving the actor system or joining seeds, and propagates canceled probes. Host suite 598 passed. |
+| CM-5 | **Completed** | Retired site ingest RPCs always return Unimplemented, including empty payloads; dead actor wiring removed. Contract regressions pass. |
+| CM-6 | **Completed** | Central and site HTTP/2 listeners share finite keepalive settings; metrics listener isolation remains enforced. Build and Host 598 tests pass. |
+| CM-7 | **Completed** | Channel graveyard retains active calls beyond grace; lifecycle locking closes shutdown/requeue races. Completion and shutdown regressions pass. |
+| CM-8 | **Completed** | Connected-header timeout is immutable per client, bound through validated CommunicationOptions. Parallel-instance regression passes. |
+| MG-5 | **Completed** | Total live-command budget includes lookup/write/audit/pull, reserves response grace, and propagates audit cancellation. Management suite 658 passed. |
+| MG-6 | **Completed** | Clock-independent keyset rescans capture late/backdated completion and descendant rows. Indexed key union bounds payload pages; real SQLite plans cover 1/64 IDs and malformed legacy JSON. Management 660 and AuditLog 407 tests pass. |
+| MG-7 | **Completed** | Live write results use bounded collector with explicit event/log truncation; Management suite 658 passed. |
+| MG-8 | **Completed** | Shared-script create/update uses cached compile/trust validation; TemplateEngine suite 483 passed. |
+| MG-9 | **Completed** | Positive page sizes clamp to 1000; null/nonpositive semantics preserved and boundaries tested. |
+| MG-10 | **Completed** | Management component catalog now documents all four FlowDebug commands, authority, paging and budget. |
+| UI-4 | **Completed** | Poll cleanup runs in outer finally and observes rejected renderer work; full UI suite 1416 passed. |
+| UI-6 | **Completed** | Scoped failover facade requires current Administrator authority before invoking the host backend; positive/negative tests pass. |
+| UI-7 | **Completed** | Exact route-policy sweep covers UI and external Secrets components; full UI suite 1416 passed. |
+| UI-8 | **Completed** | Shared parked-call relay resolves site ownership and denies unknown/out-of-scope targets for scoped principals; regressions pass. |
+| UI-9 | **Completed** | Tree value snapshots skip unchanged forest rebuilds while preserving in-place edits, child metadata and filtered key/inheritance behavior. |
+| UI-10 | **Completed** | Cookie login explicitly validates antiforgery; missing token rejected and valid real token issues cookie. CLI bearer-token endpoint preserved. |
+| UI-11 | **Completed** | Lazy site/area queries retain one untracked 50-row instance page per loaded branch; shared async gate serializes branch/refresh/staleness. SQLite paging and controlled interleaving regressions pass. |
+| UI-12 | **Completed** | Viewer sees no empty Notifications heading and Flow Debugger navigation matches its policy; regression passes. |
+| EI-6 | **Completed** | Purge actor forwards per-channel 50000-row tick budget; repository caps final partial batch. Purge/options 20 and repository/guard 10 tests pass. |
+| EI-7 | **Completed** | Root-DI admission registry retains one unfinished collection per registration across actor recreation; actual wait is bounded and task owns scope until completion. Full KPI suite 57 passed. |
+| EI-8 | **Completed** | Relay strips Accept-Encoding because it forwards raw response bytes without Content-Encoding; regression and full InboundAPI suite 360 pass. |
+| EI-9 | **Completed** | Outbox contract explicitly documents repeated duplicate batches during dual-active operation and lack of row claims. |
+| DL-4 | **Completed** | Echo edges replace ordinary duplicate endpoint pairs; unique-edge and echo-semantic regressions pass. |
+| DL-5 | **Completed** | Refresh bases graph order on authoritative Replay and appends live-only rows; order regression passes. |
+| DL-7 | **Completed** | Graph build parses each audit payload once and reuses projections; Commons suite 851 passed. |
+| DL-8 | **Completed** | Existing Medium chain-anchor fix revalidated by timestamp-skewed child/root regression. |
+| DL-9 | **Completed** | Commons Debugging namespace, per-run bounded collector ownership and redaction documented. |
+| DL-10 | **Completed** | Enum name/value serialization contracts and display ordering have separate regression coverage. |
+| DL-11 | **Completed** | Folded steps/lifecycle records retain latest exception detail and clear stale details after success; regressions pass. |
+| DC-8 | **Completed** | CLI harness covers all 19 groups plus browse/search/verify/certs; secured-write README added; CLI suite 475 passed. |
+| DC-9 | **Completed** | DCL docs corrected against current unsubscribe, write rejection, atomic disconnect and snapshot behavior. |
+| DC-10 | **Completed** | OPC shard plans are computed once per resolved chunk and reused for each monitored item; DCL suite 379 passed. |
+| DC-11 | **Completed** | All notifier base URLs are validated as absolute HTTP(S) before delivery; notifier suite 36 passed. |
+| XC-7 | **Completed** | Removed both migration-only sections from all eight rig site JSON configurations; parsed and verified each file. |
+| XC-8 | **Completed** | Source-discovered service maps and external LocalDb/Secrets mappings are compared against generated method descriptors and auth gates, with gate-removal negative control. Host suite 598 passed. |
+| XC-9 | **Completed** | Central SqlClient 6.1.1 removes per-test overrides; SignalR.Client 10.0.7 aligns with runtime; bUnit 2.7.2 uses stable syntax. Restore, zero-warning build and all solution suites pass. |
+| XC-10 | **Completed** | Global OPC/Mx options validate required identity strings at startup, preserving optional path defaults; DCL suite 379 passed. |
+| XC-11 | **Completed** | Umbrella index now includes instance picker/v1.4 logs and live remediation status. Fresh origin/main fetch confirms current main fef3e767 is already pushed (0 ahead/behind); no new push needed for the historical finding. |
+| XC-12 | **Completed** | Health-check remarks now distinguish seven central singleton proxies, five required and two best-effort exclusions. |
+
+
+### Final verification — completed 2026-09-09
+
+- Full solution restore succeeded after centralizing Microsoft.Data.SqlClient 6.1.1,
+  Microsoft.AspNetCore.SignalR.Client 10.0.7, and stable bUnit 2.7.2.
+- Full solution build: **0 warnings, 0 errors**. Canonical `docker/regen-proto.sh sitestream`
+  preserves the source descriptor path for the additive trace cursor; all 766 Communication
+  tests pass, including the complete source/vendored descriptor comparison.
+- Initial solution run (excluding deployed Playwright tests): 9474 passed, three failures.
+  One was the generated descriptor path, corrected and verified above. Two login integration
+  fixtures omitted the now-required antiforgery token; they now fetch the real rendered token
+  and cookie, preserve the original login assertions, and add missing-token rejection coverage.
+  Full Integration rerun: **118 passed, zero failed/skipped**. Across the full run with
+  corrected Communication and Integration suite reruns: **9478 passed, zero outstanding failures
+  or skips**. Counts replace earlier suite results rather than adding repeated tests. The deployed
+  Playwright smoke adds **1 passed**: real antiforgery login, initially unloaded topology, bounded
+  branch loading/page controls, and Flow Debugger navigation without browser errors.
+- `bash docker/deploy.sh` succeeded from the canonical repository. All eight primary rig nodes run
+  image `sha256:cfa919dd343ffa090995336f2854ac4d79d4c2bb919514aa7e72abf579b0b4ed`, with
+  zero restarts, `/health/ready` 200, two members and zero unreachable members per pair, and
+  exactly one `/health/active` 200 per pair (standby 503). Existing bind mounts and volumes
+  were preserved. Env2 containers were not redeployed.
+- Final completion audit verifies all 46 unique Low IDs have Completed rows, with no remaining
+  Low findings. `git diff --check` passes. The verified remediation is committed directly on `main`.
+- Validation logs: `/tmp/low-final-build2.log`, `/tmp/low-full-tests.log`,
+  `/tmp/low-comm-final.log`, `/tmp/low-integration-final.log`, `/tmp/low-rig-deploy.log`,
+  `/tmp/low-rig-health.json`, and `/tmp/low-smoke.log`. Focused regression evidence above overlaps
+  the full suite and is not additive.
+
+### Operational notes
+
+- MG-6 intentionally rescans matching execution-ID batches on each poll to capture completion
+  rows inserted late with earlier timestamps. Indexed SQLite key queries avoid scanning unrelated
+  retained audit payloads. Discovery memory grows with the traversed tree during the bounded
+  command; returned results have fixed count/byte caps. No central/site clock agreement is assumed.
+- EI-7 bounds the caller wait and admits at most one unfinished source collection per registration
+  across actor recreation on the same root provider. A source that ignores cancellation retains
+  its task and scope until actual completion; subsequent ticks do not create duplicate work.
+- EI-9 is resolved through the requested contract clarification: dual-active outbox writers can
+  deliver repeated duplicate batches; database row claims are not implemented by this change.