fix(review): full code-review remediation — 5 High + Medium/Low across 16 modules

Remediation from the full per-module code review at 4307c381 (findings recorded
separately in code-reviews/).

Highs fixed:
- DeploymentManager-025/SiteRuntime-031: stop broadcasting notification lists + SMTP
  configs (incl. credentials) to sites; site purges already-persisted rows on apply
  (enforces the central-only delivery design; clears plaintext SMTP creds at rest).
- DataConnectionLayer-023: guard the native-alarm subscribe path against the
  mid-flight-unsubscribe adapter-feed leak (mirrors the DCL-021 tag-path fix).
- SiteEventLogging-024: normalize From/To query bounds to UTC (the -016 fix the
  audit trail claimed but never committed).
- KpiHistory-001: add an in-flight guard to the recorder sample tick.
- ScriptAnalysis-001: harden the trust analyzer's TPA-absent fallback (resolve
  forbidden anchors in the minimal reference set; warn on degraded mode) — anchors
  added to validation references only, never the compile gate.
(InboundAPI-026 left to the feat/ipsen-movein effort per owner decision.)

Medium/Low: DM-026 deterministic deploy-status tiebreaker; SR-027/028/029/030
native-alarm leak/phantom-active/delete-during-redeploy fixes; AL-013/014/016;
TE-024 (folder-mutation audit rows now persisted)/025; SF-025 gauge-provider
clear-on-stop; ESG-025/026; SEC-023/024/025; SCA-007/008/009; plus doc/test
accuracy COM-023/024, HOST-025/026, HM-024/025, NS-027/028.

Full-solution build 0 warnings; ~3560 tests across 18 touched suites green.

src/ZB.MOM.WW.ScadaBridge.DataConnectionLayer/Actors/DataConnectionActor.cs

@@ -99,7 +99,12 @@ public class DataConnectionActor : UntypedActor, IWithStash, IWithTimers
     // routed to subscribers (NativeAlarmActors) by source-object reference.
     /// <summary>sourceReference → set of subscriber actor refs (NativeAlarmActors), for routing + ref-count.</summary>
     private readonly Dictionary<string, HashSet<IActorRef>> _alarmSourceSubscribers = new();
-    /// <summary>sourceReference → raw condition filter string passed to the adapter (first subscriber wins).</summary>
+    /// <summary>
+    /// sourceReference → raw condition filter string passed to the adapter (last subscriber wins).
+    /// The shared feed carries a single filter: <see cref="HandleSubscribeAlarms"/> overwrites it
+    /// unconditionally on every subscribe, so co-subscribers to one source reference must agree on
+    /// the condition filter (a second subscriber's filter re-gates the first subscriber's transitions).
+    /// </summary>
     private readonly Dictionary<string, string?> _alarmSourceFilter = new();
     /// <summary>
     /// sourceReference → parsed condition-type predicate (M2.4 / #8). The authoritative
@@ -1791,6 +1796,30 @@ public class DataConnectionActor : UntypedActor, IWithStash, IWithTimers
     {
         _alarmSubscribesInFlight.Remove(msg.SourceReference);
 
+        // DataConnectionLayer-023: the last (or only) subscriber may have been
+        // unsubscribed while this alarm subscribe was in flight. HandleUnsubscribeAlarms
+        // emptied/removed _alarmSourceSubscribers for the source but could not tear down
+        // the adapter feed because the subscription id was not stored yet. Mirror the
+        // DCL-021 tag-path guard: if no subscriber remains, release the just-created
+        // adapter feed instead of storing an orphaned subscription id that would stream
+        // transitions to nobody for the lifetime of the adapter.
+        if (!_alarmSourceSubscribers.ContainsKey(msg.SourceReference))
+        {
+            if (msg.Success && msg.SubscriptionId != null &&
+                _adapter is IAlarmSubscribableConnection alarmable)
+            {
+                _log.Warning(
+                    "[{0}] AlarmSubscribeCompleted arrived for source {1} but the last " +
+                    "subscriber unsubscribed while the subscribe was in flight; releasing " +
+                    "the orphaned adapter alarm feed.",
+                    _connectionName, msg.SourceReference);
+                _ = alarmable.UnsubscribeAlarmsAsync(msg.SubscriptionId);
+            }
+
+            // No live requester remains to receive a response.
+            return;
+        }
+
         if (msg.Success && msg.SubscriptionId != null)
         {
             _alarmSubscriptionIds[msg.SourceReference] = msg.SubscriptionId;
@@ -1874,6 +1903,11 @@ public class DataConnectionActor : UntypedActor, IWithStash, IWithTimers
         _alarmSourceSubscribers.Remove(request.SourceReference);
         _alarmSourceFilter.Remove(request.SourceReference);
         _alarmSourceFilterPredicate.Remove(request.SourceReference);
+        // DataConnectionLayer-023: clear the in-flight marker so that if an adapter
+        // subscribe is still in flight for this source, the late AlarmSubscribeCompleted
+        // is recognized as orphaned (its guard checks _alarmSourceSubscribers, now empty)
+        // and the just-created feed is released rather than stored and leaked.
+        _alarmSubscribesInFlight.Remove(request.SourceReference);
         if (_alarmSubscriptionIds.Remove(request.SourceReference, out var subId) &&
             _adapter is IAlarmSubscribableConnection alarmable)
         {

src/ZB.MOM.WW.ScadaBridge.DataConnectionLayer/Adapters/MxGatewayDataConnection.cs

@@ -277,6 +277,19 @@ public class MxGatewayDataConnection : IDataConnection, IBrowsableDataConnection
     public async ValueTask DisposeAsync()
     {
         _eventLoopCts?.Cancel();
+        // DataConnectionLayer-025: the DataConnectionActor disposes adapters
+        // fire-and-forget on failover/stop without necessarily calling
+        // DisconnectAsync first, so tear down the alarm stream here too — otherwise
+        // the long-running RunAlarmStreamAsync task and its CTS leak on every
+        // MxGateway failover/teardown that goes through DisposeAsync. Mirror the
+        // lock-guarded block already in DisconnectAsync.
+        lock (_alarmLock)
+        {
+            _alarmCts?.Cancel();
+            _alarmCts?.Dispose();
+            _alarmCts = null;
+            _alarmSubCount = 0;
+        }
         if (_client is not null)
             await _client.DisposeAsync();
         GC.SuppressFinalize(this);