docs: reconcile stale cluster/security/notification docs; close register row 117, add rows 128-135 (review 2026-10-21 wave 2)

docs/requirements/Component-ClusterInfrastructure.md

@@ -29,7 +29,7 @@ realised across two projects:
   timings, split-brain settings) bound from `appsettings.json` via the Options pattern.
 - **`src/ZB.MOM.WW.ScadaBridge.Host`** owns the cluster **bootstrap and runtime wiring**: it
   builds the Akka.NET HOCON from `ClusterOptions`, starts the `ActorSystem`,
-  configures the keep-oldest split-brain resolver (`down-if-alone = on`), wires
+  configures the downing strategy (`auto-down` by default; `keep-oldest` with `down-if-alone` is the opt-in alternative), wires
   `CoordinatedShutdown` into the service lifecycle, and provides active-node /
   cluster-membership health checks. See `Component-Host.md` (REQ-HOST-*) for detail.
 
@@ -220,7 +220,7 @@ If both nodes in a cluster fail simultaneously (e.g., site power outage):
 2. **State recovery** (each node has its own local copy of all required data):
    - **Site clusters**: The Deployment Manager singleton reads deployed configurations from local SQLite and re-creates the full Instance Actor hierarchy. Store-and-forward buffers are already persisted locally. Alarm states re-evaluate from incoming data values.
    - **Central cluster**: All state is in MS SQL (configuration database). The active node resumes normal operation.
-3. The keep-oldest resolver handles the "both starting fresh" case naturally — there is no pre-existing cluster to conflict with.
+3. Cold start does not involve the downing strategy: nothing is unreachable yet, so there is no pre-existing cluster to conflict with (the simultaneous-start residual is covered by the bootstrap guard above).
 
 ## Graceful Shutdown & Singleton Handover