Merge branch 'worktree-agent-a95eaaa8a3181ad4c' into arch-review-remediation

docs/deployment/topology-guide.md

@@ -157,6 +157,26 @@ Each site has its own two-node cluster:
 - SQLite persistence: each node owns its own consolidated LocalDb database, kept in step by
   asynchronous CDC replication over a gRPC sync stream (LocalDb Phase 1 + 2). The nodes do NOT
   share a SQLite file.
+- CDC capture triggers are installed **only on a node that has replication configured** —
+  `LocalDb:Replication:PeerAddress` *or* `LocalDb:Replication:ApiKey`. Either key counts, because
+  only the initiating half of a pair sets `PeerAddress` (one bidirectional stream, dialled by one
+  side); the passive half carries the key alone. A deliberately unreplicated node — site-b and
+  site-c on the rig — runs with no triggers at all and stops paying the per-write capture cost.
+
+#### Turning replication ON for a site that has been running without it
+
+Set the keys on **both** nodes and restart both. Two things to know before you do:
+
+- **Existing rows are not baselined.** Capture is change-data-capture: rows written while the node
+  had no triggers were never recorded in `__localdb_row_version`, and LocalDb's snapshot resync
+  streams from that ledger, so it will not ship them. The pair converges on everything written
+  *after* the restart and stays silently divergent on everything before it. Start from a copy of one
+  node's database on both sides, or accept that only new writes converge.
+- **A node upgraded in place keeps stale triggers.** The guard decides whether triggers are
+  *installed*, not whether existing ones are removed, and the library has no removal API yet. A
+  database file first created by a build that always registered keeps capturing until that lands.
+  Recreating the node's data volume clears it — which is what a schema-change redeploy does on the
+  docker rig, so the rig is unaffected.
 
 ### Site Pair Upgrades — stop and start BOTH nodes together