fix(review): full code-review remediation — 5 High + Medium/Low across 16 modules

Remediation from the full per-module code review at 4307c381 (findings recorded
separately in code-reviews/).

Highs fixed:
- DeploymentManager-025/SiteRuntime-031: stop broadcasting notification lists + SMTP
  configs (incl. credentials) to sites; site purges already-persisted rows on apply
  (enforces the central-only delivery design; clears plaintext SMTP creds at rest).
- DataConnectionLayer-023: guard the native-alarm subscribe path against the
  mid-flight-unsubscribe adapter-feed leak (mirrors the DCL-021 tag-path fix).
- SiteEventLogging-024: normalize From/To query bounds to UTC (the -016 fix the
  audit trail claimed but never committed).
- KpiHistory-001: add an in-flight guard to the recorder sample tick.
- ScriptAnalysis-001: harden the trust analyzer's TPA-absent fallback (resolve
  forbidden anchors in the minimal reference set; warn on degraded mode) — anchors
  added to validation references only, never the compile gate.
(InboundAPI-026 left to the feat/ipsen-movein effort per owner decision.)

Medium/Low: DM-026 deterministic deploy-status tiebreaker; SR-027/028/029/030
native-alarm leak/phantom-active/delete-during-redeploy fixes; AL-013/014/016;
TE-024 (folder-mutation audit rows now persisted)/025; SF-025 gauge-provider
clear-on-stop; ESG-025/026; SEC-023/024/025; SCA-007/008/009; plus doc/test
accuracy COM-023/024, HOST-025/026, HM-024/025, NS-027/028.

Full-solution build 0 warnings; ~3560 tests across 18 touched suites green.

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/Actors/DeploymentManagerActor.cs

@@ -528,7 +528,28 @@ public class DeploymentManagerActor : ReceiveActor, IWithTimers
     {
         var instanceName = command.InstanceUniqueName;
 
-        if (_instanceActors.TryGetValue(instanceName, out var actor))
+        // SiteRuntime-029: a disable arriving mid-redeploy must cancel the buffered
+        // redeploy. Otherwise HandleTerminated re-creates the Instance Actor and
+        // re-stores its config with isEnabled: true when the predecessor terminates,
+        // silently reverting the operator's disable back to enabled. Mirror the
+        // last-write-wins handling in HandleDeploy/HandleDelete: drop the pending
+        // command (so HandleTerminated returns early), clear the shadow, and tell the
+        // displaced deployer it was superseded. The disable itself still persists
+        // is_enabled = false below, which becomes the durable state.
+        if (_terminatingActorsByName.TryGetValue(instanceName, out var terminatingRef))
+        {
+            if (_pendingRedeploys.Remove(terminatingRef, out var pending))
+            {
+                pending.OriginalSender.Tell(new DeploymentStatusResponse(
+                    pending.Command.DeploymentId,
+                    instanceName,
+                    DeploymentStatus.Failed,
+                    $"superseded by disable of {instanceName} before redeploy finished terminating",
+                    DateTimeOffset.UtcNow));
+            }
+            _terminatingActorsByName.Remove(instanceName);
+        }
+        else if (_instanceActors.TryGetValue(instanceName, out var actor))
         {
             Context.Stop(actor);
             _instanceActors.Remove(instanceName);
@@ -628,12 +649,45 @@ public class DeploymentManagerActor : ReceiveActor, IWithTimers
     {
         var instanceName = command.InstanceUniqueName;
 
-        if (_instanceActors.TryGetValue(instanceName, out var actor))
+        // SiteRuntime-029: a delete arriving while a redeploy is still terminating must
+        // be authoritative over the mid-redeploy bookkeeping. HandleDeploy already
+        // removed the instance from _instanceActors and buffered a PendingRedeploy
+        // keyed by the terminating ref. If we fall straight through to the
+        // _instanceActors miss + unconditional decrement, the buffered redeploy is
+        // left intact — so when Terminated fires, HandleTerminated calls
+        // ApplyDeployment(isRedeploy: true) and RESURRECTS the just-deleted instance,
+        // with the counter now inconsistent. Cancel the pending redeploy first.
+        var wasPresent = false;
+        if (_terminatingActorsByName.TryGetValue(instanceName, out var terminatingRef))
+        {
+            // Drop the buffered command so HandleTerminated's _pendingRedeploys.Remove
+            // misses and it returns early (no resurrection). Clear the shadow too.
+            if (_pendingRedeploys.Remove(terminatingRef, out var pending))
+            {
+                pending.OriginalSender.Tell(new DeploymentStatusResponse(
+                    pending.Command.DeploymentId,
+                    instanceName,
+                    DeploymentStatus.Failed,
+                    $"superseded by delete of {instanceName} before redeploy finished terminating",
+                    DateTimeOffset.UtcNow));
+            }
+            _terminatingActorsByName.Remove(instanceName);
+            // The terminating predecessor is already being stopped by HandleDeploy;
+            // no Context.Stop needed here.
+            wasPresent = true;
+        }
+        else if (_instanceActors.TryGetValue(instanceName, out var actor))
         {
             Context.Stop(actor);
             _instanceActors.Remove(instanceName);
+            wasPresent = true;
         }
-        _totalDeployedCount = Math.Max(0, _totalDeployedCount - 1);
+
+        // SiteRuntime-029: only decrement when the instance was actually present
+        // (live in _instanceActors OR mid-redeploy in _terminatingActorsByName).
+        // A delete for a wholly-unknown instance must not drive the count negative.
+        if (wasPresent)
+            _totalDeployedCount = Math.Max(0, _totalDeployedCount - 1);
         UpdateInstanceCounts();
 
         var sender = Sender;
@@ -1379,14 +1433,15 @@ public class DeploymentManagerActor : ReceiveActor, IWithTimers
                     }
                 }
 
-                // WP-33: Store notification lists
-                if (command.NotificationLists != null)
-                {
-                    foreach (var nl in command.NotificationLists)
-                    {
-                        await _storage.StoreNotificationListAsync(nl.Name, nl.RecipientEmails);
-                    }
-                }
+                // DeploymentManager-025 / SiteRuntime-031: notification lists and SMTP
+                // configuration are central-only — sites store-and-forward notifications
+                // to central and never deliver over SMTP. Central no longer ships these
+                // (the DeployArtifactsCommand fields stay for additive compatibility but
+                // are always null), so the site neither persists them nor reads them.
+                // Purge any rows a prior (pre-fix) build may have written — including the
+                // plaintext SMTP password — so existing exposure is cleared, not just
+                // future writes. Purge is idempotent and runs on every artifact apply.
+                await _storage.PurgeCentralOnlyNotificationConfigAsync();
 
                 // Store data connection definitions (OPC UA endpoints, etc.)
                 if (command.DataConnections != null)
@@ -1413,16 +1468,8 @@ public class DeploymentManagerActor : ReceiveActor, IWithTimers
                     self.Tell(new ApplyArtifactDataConnectionsToDcl(command.DataConnections));
                 }
 
-                // Store SMTP configurations
-                if (command.SmtpConfigurations != null)
-                {
-                    foreach (var smtp in command.SmtpConfigurations)
-                    {
-                        await _storage.StoreSmtpConfigurationAsync(
-                            smtp.Name, smtp.Server, smtp.Port, smtp.AuthMode,
-                            smtp.FromAddress, smtp.Username, smtp.Password, smtp.OAuthConfig);
-                    }
-                }
+                // DeploymentManager-025 / SiteRuntime-031: SMTP configuration is
+                // central-only and is never stored on a site (see the purge above).
 
                 // Replicate artifacts to standby node
                 _replicationActor?.Tell(new ReplicateArtifacts(command));