Merge codex/resolve-high-review-findings: 2026-09-09 arch-review remediation — all 13 High + 33 Medium findings

High slice 146a1323 (DCL subscription lifecycle + handle release + no write replay, source-scoped OPC UA alarm snapshots, gRPC 32 MiB limits + audit byte budget, PSK identity bound to payload ownership, no blind Unavailable replay, script-pool ConfigureAwait, audited-connection transaction escape, trust deny-list, UI mutations through typed commands, idle-session handling, circuit grant revalidation) and Medium slice 9a87d7a3 (see its message). Verified before merge: dotnet build 0 errors; dotnet test (Playwright excluded) 9 397 passed, 0 failed, 0 skipped across 29 assemblies. Migration 20260909203046_EnforceGlobalInstanceNamesAndProtectProtocolConfiguration is a coordinated central-pair upgrade (protocol config encrypted at rest; old binaries cannot read protected rows); already applied on the local docker rig. 46 Low findings remain open.
2026-09-09 22:10:05 -04:00
parent 8bfe65512e 9a87d7a328
commit fef3e7675f
304 changed files with 8592 additions and 1392 deletions
@@ -13,7 +13,7 @@ The authoritative spec for each entry is `docs/requirements/Component-<Name>.md`
 2. Deployment Manager — Central-side deployment pipeline, system-wide artifact deployment, instance lifecycle.
 3. Site Runtime — Site-side actor hierarchy (Deployment Manager singleton, Instance/Script/Alarm Actors), script compilation, Akka stream.
 4. Data Connection Layer — Protocol abstraction (OPC UA, custom), subscription management, clean data pipe.
-5. Central–Site Communication — Akka.NET ClusterClient (command/control) + gRPC server-streaming (real-time data), message patterns, debug streaming.
+5. Central–Site Communication — Authenticated gRPC command/control in both directions + SiteStreamService server-streaming, token-gated HTTP configuration fetch, message patterns, debug streaming.
 6. Store-and-Forward Engine — Buffering, fixed-interval retry, parking, SQLite persistence, replication.
 7. External System Gateway — External system definitions, API method invocation, database connections.
 8. Notification Service — Central-only notification-list and SMTP definitions, per-type delivery adapters (sites no longer deliver notifications).
@@ -26,7 +26,7 @@ The authoritative spec for each entry is `docs/requirements/Component-<Name>.md`
 15. Host — Single deployable binary, role-based component registration, Akka.NET bootstrap.
 16. Commons — Shared types, POCO entity classes, repository interfaces, message contracts.
 17. Configuration Database — EF Core data access layer, repositories, unit-of-work, audit logging (IAuditService), migrations.
-18. Management Service — Akka.NET actor providing programmatic access to all admin operations, ClusterClientReceptionist registration.
+18. Management Service — Akka.NET actor providing programmatic access to all admin operations, authenticated HTTP Management API.
 19. CLI — Command-line tool using HTTP Management API, System.CommandLine, JSON/table output.
 20. Traefik Proxy — Reverse proxy/load balancer fronting central cluster, active node routing via `/health/active`, automatic failover.
 21. Notification Outbox — Central component ingesting store-and-forwarded notifications, `Notifications` audit table, dispatcher loop, retry/parking, delivery KPIs.
@@ -80,7 +80,7 @@ Both stacks share the infrastructure services in [`infra/`](infra/) (MS SQL, LDA
 | 2 | Deployment Manager | [docs/requirements/Component-DeploymentManager.md](docs/requirements/Component-DeploymentManager.md) | Central-side deployment pipeline with deployment ID/idempotency, per-instance operation lock, state transition matrix, all-or-nothing site apply, system-wide artifact deployment with per-site status. |
 | 3 | Site Runtime | [docs/requirements/Component-SiteRuntime.md](docs/requirements/Component-SiteRuntime.md) | Site-side actor hierarchy with explicit supervision strategies, staggered startup, script trust model (constrained APIs), Tell/Ask conventions, concurrency serialization, site-wide Akka stream with per-subscriber backpressure, and a read-only Native Alarm Actor (peer to the computed Alarm Actor) mirroring native OPC UA A&C / MxAccess alarms with site SQLite persistence. |
 | 4 | Data Connection Layer | [docs/requirements/Component-DataConnectionLayer.md](docs/requirements/Component-DataConnectionLayer.md) | Common data connection interface (OPC UA, MxGateway, custom), Become/Stash connection actor model, auto-reconnect, immediate bad quality on disconnect, transparent re-subscribe, synchronous write failures, tag path resolution retry, protocol-agnostic address-space browse (with `BrowseNext` paging, type-info, and the `IAddressSpaceSearchable` recursive-search seam), a never-trusting OPC UA verify-endpoint probe, and optional read-only native alarm mirroring (`IAlarmSubscribableConnection`, one alarm feed per connection with snapshot replay). |
-| 5 | Central–Site Communication | [docs/requirements/Component-Communication.md](docs/requirements/Component-Communication.md) | Dual transport: Akka.NET ClusterClient (command/control) + gRPC server-streaming (real-time data). 9 message patterns with per-pattern timeouts, SiteStreamGrpcServer/Client, application-level correlation IDs, transport heartbeat config, gRPC keepalive, message ordering, connection failure behavior. The gRPC stream additively carries the read-only native alarm mirror (computed + native OPC UA / MxAccess) via the enriched `AlarmStateUpdate`. |
+| 5 | Central–Site Communication | [docs/requirements/Component-Communication.md](docs/requirements/Component-Communication.md) | Authenticated gRPC command/control in both directions + gRPC server-streaming (real-time data); token-gated HTTP deployment configuration fetch. 9 message patterns with per-pattern timeouts, SiteStreamGrpcServer/Client, application-level correlation IDs, transport heartbeat config, gRPC keepalive, message ordering, connection failure behavior. The gRPC stream additively carries the read-only native alarm mirror (computed + native OPC UA / MxAccess) via the enriched `AlarmStateUpdate`. |
 | 6 | Store-and-Forward Engine | [docs/requirements/Component-StoreAndForward.md](docs/requirements/Component-StoreAndForward.md) | Buffering (transient failures only), fixed-interval retry, parking, async best-effort replication, SQLite persistence at sites. |
 | 7 | External System Gateway | [docs/requirements/Component-ExternalSystemGateway.md](docs/requirements/Component-ExternalSystemGateway.md) | HTTP/REST + JSON, API key/Basic Auth, per-system timeout, dual call modes (Call/CachedCall), transient/permanent error classification, dedicated blocking I/O dispatcher, ADO.NET connection pooling. |
 | 8 | Notification Service | [docs/requirements/Component-NotificationService.md](docs/requirements/Component-NotificationService.md) | Central-only — manages typed notification-list, SMTP, and SMS definitions; supplies per-type delivery adapters (Email via SMTP with OAuth2 (M365) or Basic Auth, or on-prem Exchange EWS, BCC, plain text; SMS via Twilio REST, per-recipient, outbound-only); delivery performed by the Notification Outbox. |
@@ -93,7 +93,7 @@ Both stacks share the infrastructure services in [`infra/`](infra/) (MS SQL, LDA
 | 15 | Host | [docs/requirements/Component-Host.md](docs/requirements/Component-Host.md) | Single deployable binary, role-based component registration, per-component config binding (Options pattern), readiness gating, dead letter monitoring, Akka.NET bootstrap, ASP.NET Core hosting for central. |
 | 16 | Commons | [docs/requirements/Component-Commons.md](docs/requirements/Component-Commons.md) | Namespace/folder convention (Types/Interfaces/Entities/Messages), shared data types, POCOs, repository interfaces, message contracts with additive-only versioning, UTC timestamp convention, the unified read-only alarm condition model (`AlarmConditionState`/`AlarmKind`), and native alarm source entities + the `IAlarmSubscribableConnection` capability seam. |
 | 17 | Configuration Database | [docs/requirements/Component-ConfigurationDatabase.md](docs/requirements/Component-ConfigurationDatabase.md) | EF Core data access, per-component repositories, unit-of-work, optimistic concurrency on deployment status, audit logging (IAuditService), migration management (incl. the `AddNativeAlarmSources` migration + native alarm source repository CRUD). |
-| 18 | Management Service | [docs/requirements/Component-ManagementService.md](docs/requirements/Component-ManagementService.md) | Akka.NET ManagementActor on central, ClusterClientReceptionist registration, programmatic access to all admin operations (incl. the MxGateway two-person secured-write handlers — no-self-approval + CAS, MxGateway-only relay — and OPC UA browse/search/verify/cert-trust verbs), CLI interface. |
+| 18 | Management Service | [docs/requirements/Component-ManagementService.md](docs/requirements/Component-ManagementService.md) | Akka.NET ManagementActor on central, authenticated HTTP Management API, programmatic access to all admin operations (incl. the MxGateway two-person secured-write handlers — no-self-approval + CAS, MxGateway-only relay — and OPC UA browse/search/verify/cert-trust verbs), CLI interface. |
 | 19 | CLI | [docs/requirements/Component-CLI.md](docs/requirements/Component-CLI.md) | Standalone command-line tool, System.CommandLine, HTTP transport via Management API, JSON/table output, mirrors all Management Service operations. |
 | 20 | Traefik Proxy | [docs/requirements/Component-TraefikProxy.md](docs/requirements/Component-TraefikProxy.md) | Reverse proxy/load balancer fronting central cluster, active node routing via `/health/active`, automatic failover. |
 | 21 | Notification Outbox | [docs/requirements/Component-NotificationOutbox.md](docs/requirements/Component-NotificationOutbox.md) | Central component ingesting store-and-forwarded notifications into the `Notifications` audit table, with `NotificationOutboxActor` singleton dispatcher, per-type delivery adapters, retry/parking, status tracking, daily purge, and delivery KPIs. |
@@ -61,4 +61,5 @@
    <Project Path="tests/ZB.MOM.WW.ScadaBridge.KpiHistory.Tests/ZB.MOM.WW.ScadaBridge.KpiHistory.Tests.csproj" />
    <Project Path="tests/ZB.MOM.WW.ScadaBridge.DelmiaNotifier.Tests/ZB.MOM.WW.ScadaBridge.DelmiaNotifier.Tests.csproj" />
  </Folder>
+  <Project Path="src/ZB.MOM.WW.ScadaBridge.CentralUI.SandboxWorker/ZB.MOM.WW.ScadaBridge.CentralUI.SandboxWorker.csproj" />
 </Solution>
@@ -17,7 +17,14 @@
      "StableAfter": "00:00:15",
      "HeartbeatInterval": "00:00:02",
      "FailureDetectionThreshold": "00:00:10",
-      "MinNrOfMembers": 1
+      "MinNrOfMembers": 1,
+      "_bootstrapGuard": "Deterministic two-node bootstrap for simultaneous container recreation.",
+      "BootstrapGuard": {
+        "Enabled": true,
+        "PartnerProbeSeconds": 25,
+        "PartnerProbeIntervalMs": 500,
+        "ProbeConnectTimeoutMs": 1000
+      }
    },
    "Database": {
      "_comment": "ConfigurationDb/MachineDataDb (which carry the dev SQL password) are supplied as ScadaBridge__Database__* whole-key env overrides in docker-env2/docker-compose.yml (dev-only-insecure, mirroring docker/docker-compose.yml and the ApiKeyPepper convention). The same dev password already ships committed for the sibling scadabridge-mssql container (infra/docker-compose.yml MSSQL_SA_PASSWORD) — this is consolidation, not new exposure. Env overrides layer over JSON before the ${secret:} expander runs, so the dev cluster boots with no KEK/secret store. Real/prod config uses ${secret:} tokens in src/.../appsettings.Central.json (T4)."
@@ -73,10 +80,7 @@
      "StandbyForwardPeerEndpoints": [ "http://scadabridge-env2-central-b:5000" ]
    },
    "Notification": {
-      "SmtpServer": "scadabridge-smtp",
-      "SmtpPort": 1025,
-      "AuthMode": "None",
-      "FromAddress": "scada-notifications-env2@company.com"
+      "_comment": "SMTP delivery configuration is stored in the database; manage it with notification smtp or /notifications/smtp."
    },
    "NotificationOutbox": {
      "DispatchInterval": "00:00:05",
@@ -17,7 +17,14 @@
      "StableAfter": "00:00:15",
      "HeartbeatInterval": "00:00:02",
      "FailureDetectionThreshold": "00:00:10",
-      "MinNrOfMembers": 1
+      "MinNrOfMembers": 1,
+      "_bootstrapGuard": "Deterministic two-node bootstrap for simultaneous container recreation.",
+      "BootstrapGuard": {
+        "Enabled": true,
+        "PartnerProbeSeconds": 25,
+        "PartnerProbeIntervalMs": 500,
+        "ProbeConnectTimeoutMs": 1000
+      }
    },
    "Database": {
      "_comment": "ConfigurationDb/MachineDataDb (which carry the dev SQL password) are supplied as ScadaBridge__Database__* whole-key env overrides in docker-env2/docker-compose.yml (dev-only-insecure, mirroring docker/docker-compose.yml and the ApiKeyPepper convention). The same dev password already ships committed for the sibling scadabridge-mssql container (infra/docker-compose.yml MSSQL_SA_PASSWORD) — this is consolidation, not new exposure. Env overrides layer over JSON before the ${secret:} expander runs, so the dev cluster boots with no KEK/secret store. Real/prod config uses ${secret:} tokens in src/.../appsettings.Central.json (T4)."
@@ -73,10 +80,7 @@
      "StandbyForwardPeerEndpoints": [ "http://scadabridge-env2-central-a:5000" ]
    },
    "Notification": {
-      "SmtpServer": "scadabridge-smtp",
-      "SmtpPort": 1025,
-      "AuthMode": "None",
-      "FromAddress": "scada-notifications-env2@company.com"
+      "_comment": "SMTP delivery configuration is stored in the database; manage it with notification smtp or /notifications/smtp."
    },
    "NotificationOutbox": {
      "DispatchInterval": "00:00:05",
@@ -17,7 +17,14 @@
      "StableAfter": "00:00:15",
      "HeartbeatInterval": "00:00:02",
      "FailureDetectionThreshold": "00:00:10",
-      "MinNrOfMembers": 1
+      "MinNrOfMembers": 1,
+      "_bootstrapGuard": "Deterministic two-node bootstrap for simultaneous container recreation.",
+      "BootstrapGuard": {
+        "Enabled": true,
+        "PartnerProbeSeconds": 25,
+        "PartnerProbeIntervalMs": 500,
+        "ProbeConnectTimeoutMs": 1000
+      }
    },
    "Database": {
      // Migration-only as of LocalDb Phase 2. The site config tables now live in the
@@ -64,7 +71,7 @@
    "SiteEventLog": {
      "RetentionDays": 30,
      "MaxStorageMb": 1024,
-      "PurgeScheduleCron": "0 2 * * *"
+      "_comment": "Retention uses the configured PurgeInterval delay after each purge; no wall-clock cron schedule is supported."
    },
    "Notification": {},
    "Logging": {
@@ -17,7 +17,14 @@
      "StableAfter": "00:00:15",
      "HeartbeatInterval": "00:00:02",
      "FailureDetectionThreshold": "00:00:10",
-      "MinNrOfMembers": 1
+      "MinNrOfMembers": 1,
+      "_bootstrapGuard": "Deterministic two-node bootstrap for simultaneous container recreation.",
+      "BootstrapGuard": {
+        "Enabled": true,
+        "PartnerProbeSeconds": 25,
+        "PartnerProbeIntervalMs": 500,
+        "ProbeConnectTimeoutMs": 1000
+      }
    },
    "Database": {
      // Migration-only as of LocalDb Phase 2. The site config tables now live in the
@@ -64,7 +71,7 @@
    "SiteEventLog": {
      "RetentionDays": 30,
      "MaxStorageMb": 1024,
-      "PurgeScheduleCron": "0 2 * * *"
+      "_comment": "Retention uses the configured PurgeInterval delay after each purge; no wall-clock cron schedule is supported."
    },
    "Notification": {},
    "Logging": {
@@ -14,6 +14,7 @@ COPY src/ZB.MOM.WW.ScadaBridge.StoreAndForward/ZB.MOM.WW.ScadaBridge.StoreAndFor
 COPY src/ZB.MOM.WW.ScadaBridge.ExternalSystemGateway/ZB.MOM.WW.ScadaBridge.ExternalSystemGateway.csproj src/ZB.MOM.WW.ScadaBridge.ExternalSystemGateway/
 COPY src/ZB.MOM.WW.ScadaBridge.NotificationService/ZB.MOM.WW.ScadaBridge.NotificationService.csproj src/ZB.MOM.WW.ScadaBridge.NotificationService/
 COPY src/ZB.MOM.WW.ScadaBridge.CentralUI/ZB.MOM.WW.ScadaBridge.CentralUI.csproj src/ZB.MOM.WW.ScadaBridge.CentralUI/
+COPY src/ZB.MOM.WW.ScadaBridge.CentralUI.SandboxWorker/ZB.MOM.WW.ScadaBridge.CentralUI.SandboxWorker.csproj src/ZB.MOM.WW.ScadaBridge.CentralUI.SandboxWorker/
 COPY src/ZB.MOM.WW.ScadaBridge.Security/ZB.MOM.WW.ScadaBridge.Security.csproj src/ZB.MOM.WW.ScadaBridge.Security/
 COPY src/ZB.MOM.WW.ScadaBridge.HealthMonitoring/ZB.MOM.WW.ScadaBridge.HealthMonitoring.csproj src/ZB.MOM.WW.ScadaBridge.HealthMonitoring/
 COPY src/ZB.MOM.WW.ScadaBridge.SiteEventLogging/ZB.MOM.WW.ScadaBridge.SiteEventLogging.csproj src/ZB.MOM.WW.ScadaBridge.SiteEventLogging/
@@ -82,10 +82,7 @@
      "StandbyForwardPeerEndpoints": [ "http://scadabridge-central-b:5000" ]
    },
    "Notification": {
-      "SmtpServer": "scadabridge-smtp",
-      "SmtpPort": 1025,
-      "AuthMode": "None",
-      "FromAddress": "scada-notifications@company.com"
+      "_comment": "SMTP delivery configuration is stored in the database; manage it with notification smtp or /notifications/smtp."
    },
    "NotificationOutbox": {
      "DispatchInterval": "00:00:05",
@@ -82,10 +82,7 @@
      "StandbyForwardPeerEndpoints": [ "http://scadabridge-central-a:5000" ]
    },
    "Notification": {
-      "SmtpServer": "scadabridge-smtp",
-      "SmtpPort": 1025,
-      "AuthMode": "None",
-      "FromAddress": "scada-notifications@company.com"
+      "_comment": "SMTP delivery configuration is stored in the database; manage it with notification smtp or /notifications/smtp."
    },
    "NotificationOutbox": {
      "DispatchInterval": "00:00:05",
@@ -72,7 +72,7 @@
    "SiteEventLog": {
      "RetentionDays": 30,
      "MaxStorageMb": 1024,
-      "PurgeScheduleCron": "0 2 * * *"
+      "_comment": "Retention uses the configured PurgeInterval delay after each purge; no wall-clock cron schedule is supported."
    },
    "Notification": {},
    "Logging": {
@@ -72,7 +72,7 @@
    "SiteEventLog": {
      "RetentionDays": 30,
      "MaxStorageMb": 1024,
-      "PurgeScheduleCron": "0 2 * * *"
+      "_comment": "Retention uses the configured PurgeInterval delay after each purge; no wall-clock cron schedule is supported."
    },
    "Notification": {},
    "Logging": {
@@ -72,7 +72,7 @@
    "SiteEventLog": {
      "RetentionDays": 30,
      "MaxStorageMb": 1024,
-      "PurgeScheduleCron": "0 2 * * *"
+      "_comment": "Retention uses the configured PurgeInterval delay after each purge; no wall-clock cron schedule is supported."
    },
    "Notification": {},
    "Logging": {
@@ -72,7 +72,7 @@
    "SiteEventLog": {
      "RetentionDays": 30,
      "MaxStorageMb": 1024,
-      "PurgeScheduleCron": "0 2 * * *"
+      "_comment": "Retention uses the configured PurgeInterval delay after each purge; no wall-clock cron schedule is supported."
    },
    "Notification": {},
    "Logging": {
@@ -72,7 +72,7 @@
    "SiteEventLog": {
      "RetentionDays": 30,
      "MaxStorageMb": 1024,
-      "PurgeScheduleCron": "0 2 * * *"
+      "_comment": "Retention uses the configured PurgeInterval delay after each purge; no wall-clock cron schedule is supported."
    },
    "Notification": {},
    "Logging": {
@@ -72,7 +72,7 @@
    "SiteEventLog": {
      "RetentionDays": 30,
      "MaxStorageMb": 1024,
-      "PurgeScheduleCron": "0 2 * * *"
+      "_comment": "Retention uses the configured PurgeInterval delay after each purge; no wall-clock cron schedule is supported."
    },
    "Notification": {},
    "Logging": {
@@ -1,6 +1,6 @@
 # ScadaBridge — architectural / code review (whole system)

-**Date:** 2026-09-09 · **Status:** SECOND-PASS REVIEW REPORT (documentation only; no production code changed)
+**Date:** 2026-09-09 · **Status:** ALL 13 HIGH AND 33 MEDIUM FINDINGS COMPLETED (see §§9–10)
 **Reviewed revision:** `main` @ `c078bc8f`. Its only difference from the first review's
 `d8229916` is the original findings document; production source/configuration is identical.
 **Scope:** all 26 `src/` projects, 32 test/support projects, both Docker rig configurations,
@@ -13,7 +13,8 @@ rechecked all High source paths, ran build/test/format/package checks, and execu
 probes. Each area revalidated its existing IDs and searched for additional defects. Source-traced
 mechanisms, runtime probes, latent risks, and unproven operational impact are distinguished below.
 This is a focused whole-system review, not a claim that every line or production topology was
-exercised. No rig rebuild, device writes, failover drill, or remote QA/production inspection ran.
+exercised. The review phase ran no rig rebuild, device writes, failover drill, or remote QA/production inspection.
+Sections 1–8 preserve that reviewed baseline; §§9–10 record subsequent implementation and local rig verification.

 **Second-pass changes:** 11 new findings; UI-3 withdrawn as unsupported; XC-6 merged into CM-5;
 UI-4/6/7 reclassified as Low hardening gaps. Existing IDs are preserved for traceability. The
@@ -36,9 +37,11 @@ references; every mapped gRPC service is behind a fail-closed constant-time inte
 contract changes since August are additive; all eight migrations are sound and the model snapshot
 matches. The test suite is broad; fresh execution evidence and its limits are in §7.

-The updated register has **92 unique active findings: 13 High, 33 Medium, 46 Low**.
+The reviewed baseline contained **92 unique findings: 13 High, 33 Medium, 46 Low**.
+**Remediation status: all 13 High and 33 Medium findings completed; 46 Low findings remain open.**
+Completion evidence and limits are recorded in §§9–10.
 This includes low-priority test/documentation gaps and latent risks, not just reproduced failures.
-The High-priority findings are:
+The reviewed High-priority findings were:

 | # | Sev | Finding | Area |
 |---|---|---|---|
@@ -56,7 +59,7 @@ The High-priority findings are:
 | CM-10 | **High** | **Cross-node retry treats every `Unavailable` as unsent**, repeating non-idempotent writes after an ambiguous response loss | Communication |
 | UI-13 | **High** | **Open Blazor circuits retain revoked roles and site scopes**, even after the HTTP cookie has refreshed | Central UI / Security |

-The remaining findings group into five themes: **audit completeness** (EI-1/2/3/5,
+The other reviewed findings grouped into five themes: **audit completeness** (EI-1/2/3/5,
 UI-1), **authorization scope** (MG-2, UI-6/7/8, XC-1, XC-8), **stale/duplicate-apply under
 failover** (MG-3/4, EI-4/9, DL-1/6, ORCH-1), **subscription/stream lifecycle** (DC-4/5, SR-3/5,
 CM-2), and **inert configuration** (XC-2/3/7). §5 groups everything into a remediation program.
@@ -740,7 +743,7 @@ fetched production credentials.
 | CM-9 | Real central auth interceptor with site-A metadata/key accepted reconciliation payload `SiteIdentifier=site-b`; real mapper preserved B | Auth/request binding gap, followed in source to token staging; no cross-site secret fetch executed |
 | CM-10 | Provider callback applied a synthetic effect, threw Unavailable, then succeeded on peer: **applications=2**, returned `ok` | Fault-injected retry path, not physical network/device duplication |
 | SR-11 | In-memory SQLite: normal wrapped write audit count **1**; `tx.Connection` was original provider, not wrapper; raw write affected **1** row with **0** audit emissions, persisted value 42 | Actual ADO escape and missing audit; reflection only instantiated internal wrapper in harness, not used by escape; not SQL Server/Roslyn end-to-end |
-| EI-10 | Real Kestrel read-before-cap pattern: desired cap 8, listener cap 1000, chunked body 100 → **HTTP 200, IsReadOnly=True, acceptedBytes=100** | Real framework middleware-order mechanism, not full app/Traefik deployment |
+| EI-10 | Implemented; verification pending | Early bounded body reader applies even with auditing disabled; real Kestrel gate pending. |

 Probe sources/output: `/tmp/scadabridge-review-probes/Program.cs` and
 `/tmp/scadabridge-review-probes.log`; `/tmp/scadabridge-sr11-probe/Program.cs`;
@@ -756,7 +759,7 @@ Repeatable regression recipes are attached to each finding and the §5 acceptanc
 | UI-3 | Withdraw: caller awaits retain renderer synchronization context; no demonstrated off-dispatcher entry |
 | XC-6 / CM-5 | One defect, retain CM-5 Low; XC-6 is a historical alias |
 | UI-1 | Many bypass paths in 16 files, not every UI edit; template/shared-script service paths already audit |
-| MG-3 | Use peer-originated DB edit/local-watermark mismatch as trigger; activation-only invalidation is insufficient |
+| MG-3 | Implemented; verification pending | Removed stale deployment probe memoization; peer-change regressions passed. |
 | UI-4/6/7 | Low hardening/prevention gaps; no continuing-circuit refresh outage or unauthorized handler exploit demonstrated |
 | UI-2 / UI-13 | Passive cookie renewal and stale circuit authority are separate failures; both need server-side handling |
 | UI-5 / UI-14 | Timeout is not termination or a memory bound; never recycle an admission slot while runaway work remains |
@@ -821,3 +824,163 @@ A `pass` is limited to the cited check, not a blanket claim that the component i
 Add these to the repository's chosen CI system with existing build/test gates; keep formatting
 cleanup and framework/package migration in separate maintenance work so they do not obscure the
 correctness/security remediation.
+
+
+## 9. High-severity remediation completion
+
+**Completed 2026-09-09. All 13 High findings are resolved and verified.** Implementation
+started from `8bfe6551` on `codex/resolve-high-review-findings`, with parallel device/runtime,
+transport, and UI/security agents plus primary-agent integration and independent reviews.
+The findings above preserve the reviewed baseline; this section supersedes their open status.
+Medium/Low findings remain outside this remediation unless a change was required for a High fix.
+
+| Finding | Status | Implementation / verification |
+|---|---|---|
+| DC-1 | **Completed** | Owner-checked PostStop unsubscribe and DeathWatch release dead demand. Shared/replacement demand survives old-owner termination and in-flight completion. Deterministic lifecycle/race regressions pass. |
+| DC-2 | **Completed** | Initial subscribe and resolution exclude each other’s in-flight tags; equal live handles are never released. Mx reverse-map removal is atomic and identity-checked. Adapter and controlled-race regressions pass. |
+| DC-3 | **Completed** | Connecting/reconnecting reject single and batch writes immediately; subscription retries are deduplicated by owner/source. No stale setpoint replay after reconnect. Full DCL suite: 365 passed. |
+| DC-12 | **Completed** | OPC snapshot start/entries/end retain source and epoch; NativeAlarmActor ignores unrelated/duplicate ends and drops partial snapshots on disconnect. Legacy Mx framing remains supported. Actor tests prove standing-alarm preservation; live two-boiler feed verifies distinct wire scopes and epochs. |
+| CM-1 | **Completed** | Servers and all six application channels use explicit 32 MiB send/receive limits. Protobuf-exact 2 MiB audit budgets cover pending/cached drain and reconciliation paging. Both 256×64 KiB lanes drain without loss; real gRPC 17 MiB response passes. Oversize-row policy is explicit below. |
+| CM-9 | **Completed** | Authenticated site identity guards RPC payloads, audit rows and notification status. SQL upsert rejects another site’s stored operation ID, including duplicate-insert retry. Real gRPC denial, outbox ownership and 29 SQL Server lifecycle/ownership tests pass. |
+| CM-10 | **Completed** | Reads/idempotent ingests may retry; mutations retry only after explicit server pre-dispatch rejection. Ambiguous primary/secondary response loss returns `OUTCOME_UNKNOWN` without replay. Real transport and effect-count tests pass. |
+| UI-1 | **Completed** | All 16 configuration repository-bypass pages use typed commands. One transaction spans entity saves and final scrubbed audit flush, including generated IDs; cache publication follows commit. Direct instance/area paths retain domain checks within the same boundary. LDAP CRUD and audit-failure rollback regressions pass; deployed browser CRUD passes. |
+| UI-2 | **Completed** | Passive ping/Blazor validation neither slides cookies nor advances activity. Trusted browser input posts with antiforgery; per-login activity reaches existing circuits. Stable NameIdentifier preserves antiforgery across role refresh. Real HTTP fake-clock tests and deployed trusted/synthetic-input browser gate pass. |
+| UI-13 | **Completed** | Circuit authority remaps stored groups in fresh scopes; mutations require current roles and persisted-site scope. API keys, reports, failover, parked messages, instances and Topology recheck before dispatch. Revoked-scope and authorized-positive tests pass, including nonnumeric site identifiers. Explicit server-configured auto-login retains synthetic grants under its existing startup guard. |
+| SR-1 | **Completed** | Attribute get/set/wait/batch continuations use `ConfigureAwait(false)`. Saturated two-worker synchronous read/write regressions pass without watchdog assistance; wait/trace regression coverage remains green. |
+| SR-11 | **Completed** | Sync/async transaction and command connection/transaction readback retain auditing wrappers. SQLite regressions prove persisted writes and exactly one audit through each former escape. |
+| MG-1 | **Completed** | Trust gate denies Unsafe, RuntimeHelpers and Runtime.Loader, including alias/static imports, while preserving async and CallerMemberName. ScriptAnalysis suite: 81 passed. |
+
+### Final verification
+
+| Gate | Result / evidence |
+|---|---|
+| Final solution build | `dotnet build ZB.MOM.WW.ScadaBridge.slnx --no-restore`: **0 warnings, 0 errors**. `/tmp/high-final-build3.log` |
+| Selected full solution | `dotnet test ZB.MOM.WW.ScadaBridge.slnx --no-build --no-restore --filter 'FullyQualifiedName!~PlaywrightTests' --logger trx --results-directory /tmp/scadabridge-high-final-green`: **9,310 passed, 0 failed, 0 skipped**; exit 0. `/tmp/high-final-tests2.log` |
+| Final UI follow-up | After the final auto-login compatibility fix: **1,392 passed, 0 failed, 0 skipped** in the full CentralUI suite. This reruns the 1,391 UI cases included above plus the new regression; counts are not additive. `/tmp/high-ui-final.log` |
+| Deployed browser | LDAP create/edit/delete round trip and trusted-input/passive-input/antiforgery/throttle scenario: **2 passed, 0 failed, 0 skipped**. `/tmp/high-browser-final.log` |
+| Independent reviews | Runtime/trust, transport/ownership, and UI transaction/authorization reviews passed after corrections; final auto-login guard follow-up also passed. `/tmp/scadabridge-ui-independent-review.md` |
+| Local rig | Final image `sha256:b9d6b60ab77093ee537470992fb891f78cc9888170d290021855c902c0115eb6` on **all eight nodes**. All ready (200), one active per pair (200) and four standbys (503), two members per pair, zero unreachable/restarts, all five central singletons reachable. Site-A replication connected with backlog 0. `/tmp/scadabridge-final-loginfix-postdeploy-health.json` |
+| Change hygiene | `git diff --check` clean. Canonical original-repository config/log mounts and named data volumes preserved; env2 remains untouched. Component requirements updated with implementation. |
+
+The local image was built with `bash docker/build.sh` from the implementation worktree, then
+all eight nodes were recreated using the canonical original repository’s Compose file. This
+keeps existing configuration, logs and data in place rather than rebinding them to the worktree.
+No device writes, failover drill, remote deployment, commit or push was performed by this remediation.
+
+### Regression evidence and limits
+
+- SR-1/SR-11 reproduced **five failures before** their fixes; the runtime follow-up passed 39
+  targeted tests. MG-1 reproduced five forbidden-call failures while two benign cases passed;
+  all 81 ScriptAnalysis cases pass afterward. Full SiteRuntime: **774 passed**.
+- CM-1’s 17 MiB response failed at the previous default limit. CM-9’s stored-owner SQL regression
+  failed before its guard. Full Communication **756**, ConfigurationDatabase **411**, AuditLog
+  **396**, Host **590**, and integration **117** tests pass. Two historical Host tests expected
+  blind mutation retry on `Unavailable`; they now model explicit pre-dispatch rejection, with
+  a separate real-transport test proving ambiguous failure never dispatches to the peer.
+- Device tests control owner death, replacement, shared-tag demand, subscribe/resolve races,
+  disconnected writes and interleaved snapshots. A stale failover test assertion was corrected:
+  backup demand must be restored while an original subscribe remains pending. The full DCL
+  suite subsequently passed. The local two-boiler snapshots were empty; standing-condition
+  preservation is proven by deterministic actor tests, **not by live raised alarms**.
+- UI revocation and Topology denied-mutation tests reproduced failures before correction.
+  The first LDAP baseline test stopped at an incorrect seeded-row count, so it does **not**
+  establish a before-fix missing-audit reproduction. Corrected real-SQLite CRUD/audit/rollback
+  tests pass. A real HTTP regression found antiforgery failure after role refresh; stable user
+  identity fixed it. The deployed browser found the synthetic auto-login role-loss regression;
+  the explicit trusted-configuration guard passed its red/green test and repeat live CRUD gate.
+- A single audit row above 2 MiB travels alone up to the 32 MiB wire ceiling. A larger row remains
+  durable/unacknowledged with an explicit operator-action error, without truncation or silent
+  loss. Stored LDAP groups are remapped live; directory group-membership changes still require
+  login. Pre-upgrade cookies without stable NameIdentifier may require a fresh sign-in.
+- No separate formatter cleanup or framework/package migration was included. The original
+  Medium/Low register and baseline formatting debt remain. The local rig has an existing
+  `zztest-conn-5d93ea81` test connection retrying unreachable `localhost:4840`; healthy cluster
+  readiness does not assert that every configured device endpoint is reachable.
+
+## 10. Medium-severity remediation completion
+
+**All 33 Medium findings are completed and verified.** The High fixes were committed first as
+`146a1323` (`Resolve all high-severity architecture review findings`). Medium implementation,
+tests and documentation remain uncommitted on `codex/resolve-high-review-findings` in
+`/Users/dohertj2/Desktop/ScadaBridge-high-findings`; no push was requested for this phase.
+Parallel subagents handled runtime/devices, management/UI and edge integrations; the primary
+agent handled persistence, listener/contracts, configuration and final integration. Independent
+cross-reviews rechecked lifecycle, sandbox containment, relay provenance and migration safety.
+
+| Finding | Status | Progress / evidence |
+|---|---|---|
+| SR-2 | Completed | Fresh alarm execution scope supplies database and tracking dependencies; runtime focused and full solution suites passed. |
+| SR-3 | Completed | Correlated bounded retry restores failed alarm subscriptions; full solution suite passed. |
+| SR-4 | Completed | Implemented; immutable audited target regression passed. |
+| SR-5 | Completed | Ordered persistence drain and same-name stop barriers; independent review passed; runtime suite 102 passed including locked delete/disable and queued cancellation. |
+| SR-12 | Completed | Implemented; delayed rehydration fencing regression passed. |
+| SR-13 | Completed | Authority rechecked after each lane admission and before every delivery; StoreAndForward suite 38 passed. |
+| CM-2 | Completed | Implemented; all four env2 node configurations enable deterministic bootstrap; parsed configuration validation passed. |
+| MG-2 | Completed | Mandatory fresh caller scope filters audit trees and replay; management regressions and full UI suite passed. |
+| MG-3 | Completed | Removed stale deployment probe memoization; peer-change regressions passed. |
+| MG-4 | Completed | Server-owned bulk deadline stops subsequent dispatch and returns unfinished failures; targeted deployment tests passed. |
+| UI-5 | Completed | Isolated child processes killed and joined before admission reuse; broker-deadline and runaway-worker tests included in 97 passing UI cases. Published Linux image contains worker DLL/deps/runtimeconfig; deployed browser termination/recovery check passed. |
+| UI-14 | Completed | Console, return serialization and IPC bounded; oversized-output regressions passed in the full UI suite and deployed browser. |
+| EI-1 | Completed | Relay ownership and uncertain-outcome audit completion implemented; InboundAPI suite passed. |
+| EI-2 | Completed | Body-capture opt-out also suppresses free-form failure details and companion events; InboundAPI suite passed. |
+| EI-3 | Completed | SQL exception details respect sensitive-parameter redaction policy; audit redaction regressions passed. |
+| EI-4 | Completed | Single relay deadline and explicit pre-execution-only retry; ambiguous outcomes are not replayed; InboundAPI suite passed. |
+| EI-5 | Completed | Authenticated request-bound relay provenance replaces trust in caller-supplied forwarding headers; independent review and InboundAPI suite passed. |
+| EI-10 | Completed | Early body cap applies with auditing disabled; real Kestrel oversized/chunked cases included in six passing Host regressions. |
+| EI-11 | Completed | All retained error-message/detail fields are capped and redacted; targeted audit suite passed. |
+| DL-1 | Completed | Global unique index, domain conflict translation and duplicate preflight migration; real SQL concurrency/upgrade guard tests passed. |
+| DL-2 | Completed | Protected primary/backup configuration with per-provider model cache and idempotent bounded startup upgrade; real SQL and SQLite regressions passed. |
+| DL-3 | Completed | Eight-row keyset paging, 500-event ceiling, UTF-8 budget and preserved root/truncation metadata; all six real SQL regressions passed. |
+| DL-6 | Completed | Deployed cross-site overwrite rejected; both real import cases passed after a valid failing baseline. |
+| DC-4 | Completed | Exact requested OPC UA security mode enforced during discovery/connect; focused device suite passed. |
+| DC-5 | Completed | Shared alarm cache merges live events with snapshots and fences stale epochs; independent review and 34 device regressions passed. |
+| DC-6 | Completed | CLI returns failure for nonzero bulk failureCount and malformed responses; all three actual command/socket regressions passed. |
+| DC-7 | Completed | Notifier retries only explicit standby rejection; notifier suite passed. |
+| XC-1 | Completed | Actual socket and gRPC metadata enforce endpoint ownership despite forged authority; six combined Host/Kestrel regressions passed. |
+| XC-2 | Completed | Implemented; removed four ignored SMTP keys from all four central rig settings; database configuration guidance replaces them. |
+| XC-3 | Completed | Implemented; removed ignored cron key from all eight site settings; documents interval-based purge. |
+| XC-4 | Completed | Actual protoc descriptors match vendored message/service graphs; four tests passed including three name/type/service drift controls. Implicit JSON names normalized using effective runtime descriptors. |
+| XC-5 | Completed | Implemented; README, high-level/component requirements and component skill now describe actual gRPC/HTTP transport. |
+| ORCH-1 | Completed | Synchronous disposal joins context-free persistence drain; runtime 102-case suite passed. |
+
+### Final verification
+
+| Gate | Result / evidence |
+|---|---|
+| Full solution build | **0 warnings, 0 errors**; `/tmp/medium-full-build2.log`. Final deployed-browser project build also passed 0/0 after its test-only update (`/tmp/medium-browser-build.log`). |
+| Selected full solution | `dotnet test ZB.MOM.WW.ScadaBridge.slnx --no-restore --filter 'FullyQualifiedName!~PlaywrightTests' --logger trx --results-directory /tmp/scadabridge-medium-full`: **9,397 passed, 0 failed, 0 skipped**, exit 0, 30 result files. `/tmp/medium-full-tests.log`. Includes 1,399 UI, 596 Host, 125 Transport integration and 117 cross-component integration cases plus 13 performance checks. |
+| Deployed browser | **2 passed, 0 failed, 0 skipped**: Linux sandbox normal execution, bounded console/return output, noncooperative infinite-loop timeout and subsequent successful execution; trusted/passive session input and antiforgery. `/tmp/medium-browser-final.log`. No child worker remained afterward on either central node. |
+| Real persistence | Global-name concurrency and duplicate-upgrade rejection, primary/backup encryption and idempotent conversion passed against SQL Server; key-ring isolation and guards passed against SQLite. `/tmp/medium-persistence-final.log`. Final replay keyset/Unicode/oversized-root SQL checks also passed and are included in the full solution run. |
+| Transport contract | Six real Kestrel listener/body-cap cases passed (`/tmp/medium-host-green.log`); actual protoc descriptor comparison and three drift controls passed (`/tmp/medium-proto-green2.log`). |
+| Local rig | Image `sha256:b8d158309b5d850fc01a3d32e7325e2238611b039e37f5fa0d51e7a488ddee36` on all **eight nodes**; all ready, one active per pair, two members per pair, zero unreachable members or restarts. Site-A replication connected, backlog 0. `/tmp/scadabridge-medium-postdeploy-health.json`. |
+| Upgrade | Coordinated central-pair stop, successful COPY_ONLY/CHECKSUM backup and RESTORE VERIFYONLY, then migration `20260909203046_EnforceGlobalInstanceNamesAndProtectProtocolConfiguration`. All 4 protocol rows retained; 3 non-null primary values protected, 0 unprotected values, existing 1-entry key ring preserved. `/tmp/medium-rig-backup.log`, `/tmp/medium-rig-before-counts.log`, `/tmp/medium-rig-after-counts.log`. Live Site-A OPC UA connection reconnected after upgrade. |
+| Configuration/docs | All 12 rig JSON files parse; four env2 bootstrap guards enabled; obsolete SMTP/cron keys removed; transport entry-point documentation corrected. Component requirements and umbrella project index updated. |
+
+### Operational notes and verification limits
+
+- The SQL backup remains inside the existing SQL Server data volume at
+  `/var/opt/mssql/backup/ScadaBridgeConfig_before_medium_20260909_211100.bak`.
+  Protocol encryption is a coordinated central upgrade: old binaries cannot read the new values.
+  A rollback requires the coordinated pre-upgrade database/key-ring backup, as documented in
+  `Component-ConfigurationDatabase.md`; the migration refuses a downgrade over protected rows.
+- The image was built from the implementation worktree and deployed using the original
+  repository's canonical Compose file. Existing configuration/log bind mounts and named data
+  volumes were preserved. Env2 bootstrap settings were verified statically; env2 containers
+  remain untouched. No device writes, live failover drill or remote deployment was performed.
+- Sandbox isolation provides a process resource/lifetime boundary, not a separate OS identity.
+  The worker is killed at the deadline. If a parent-side broker ignores cancellation, its slot
+  and scope remain owned until that operation actually completes; no orphan broker operation
+  or early capacity reuse is introduced. Already accepted remote work cannot be undone by
+  killing its client. Console retains 32,768 characters plus a fixed truncation marker; return
+  serialization is capped at 32 KiB bytes, IPC at 1 MiB, managed worker heap at 512 MiB.
+- Replay is capped at 500 events and a 1 MiB serialized UTF-8 budget, with eight-row keyset
+  pages bounding EF buffering. Oversized events are omitted whole with truthful truncation
+  and separately retained root metadata. Shared snapshot/lifecycle races are covered by
+  deterministic tests, not a live raised-alarm scenario. The pre-existing unreachable
+  `zztest-conn-5d93ea81` test connection remains outside this remediation.
+- The first proto comparison exposed implicit JSON-name representation differences, not
+  wire drift. It now compares effective runtime names against compiler output while preserving
+  explicit field/service metadata. Earlier fixture/build failures were corrected without
+  weakening production guards: audit test doubles accept caller scope, and protocol-writing
+  fixtures use stable ephemeral key rings. These are not claimed as before-fix reproductions.
+- The 46 Low findings remain open. Focused test counts overlap the full suite and are not additive.
@@ -881,3 +881,26 @@ orphaned entries) and in the CLI's `audit tree` output.
  reusing the existing audit-KPI reads; the resulting `totalEventsLastHour` /
  `errorEventsLastHour` / `backlogTotal` series render as trends on the Audit Log
  page via `KpiTrendChart`.
+
+### Serialized-byte budgets for telemetry and reconciliation (2026-09-09)
+
+The audit-only drain, combined cached telemetry drain, and site reconciliation responses use
+`AuditWireBudget`: the complete protobuf row (including error message/detail, summaries, extra,
+provenance and nested operational fields), repeated-message tag/length prefixes, five-byte gRPC
+frame and the continuation flag must fit a normal **2 MiB** budget. A drain sends a prefix and
+marks only acknowledged rows forwarded. A byte-limited pull returns `MoreAvailable = true`;
+its cursor advances from the last returned row, so unreturned rows remain available.
+
+A single row exceeding 2 MiB is sent alone if it fits the coordinated **32 MiB** channel ceiling.
+A row exceeding that ceiling is never truncated, falsely acknowledged or silently skipped:
+the operation reports `ResourceExhausted` with its row identifier and required byte count, and
+the row remains durable locally. Good rows preceding it can still advance. Operators must
+reduce that oversized payload or deploy coordinated larger limits to resume past it; repeated
+drain failures are logged. A lost response retains the existing at-least-once retry/cursor
+semantics. The separate Flow Debugger trace pull remains governed by its own contract.
+
+### Error-field privacy
+
+The canonical redactor applies global and per-target body patterns and UTF-8 byte caps to `ErrorMessage` as well as `ErrorDetail`, request, response, and extra fields. A secret cannot survive only because an emitter placed it in the short error message.
+
+For `DbOutbound` targets with `RedactSqlParamsMatching`, request parameters are selected by parameter name. SQL exception messages often echo parameter values without names, so both free-text error fields are suppressed under that policy; the audit channel, failed status, operation target and other structured metadata remain available. Applying the name regex to exception text would not protect the values. This policy covers inbound helper and site raw-connection emitters through the shared canonical redactor.
@@ -464,3 +464,11 @@ Configuration is resolved in the following priority order (highest wins):
 - **Management Service (via HTTP)**: The primary runtime dependency. All operations except `debug stream` are sent as HTTP POST requests to the Management API endpoint on a central node, which dispatches to the ManagementActor.
 - **Central Host**: Serves the Management API at `POST /management` and the debug stream SignalR hub at `/hubs/debug-stream`. Handles LDAP authentication, role resolution, and ManagementActor dispatch.
 - **Debug Stream Hub (via SignalR WebSocket)**: The `debug stream` command connects to the `/hubs/debug-stream` hub on the central server for real-time event streaming. This is the only CLI command that uses a persistent connection rather than request/response.
+
+
+### Bulk deployment completion
+
+deploy site preserves the returned summary in JSON/table output and exits 1 when failureCount
+is nonzero or the summary is malformed, even when HTTP returned 2xx. A zero failure count exits
+0; HTTP authorization failures retain exit 2. The server owns the bounded bulk operation deadline;
+the client does not impose a shorter total timer on this command.
@@ -330,3 +330,19 @@ Per-leaf alarm rendering (leaf nodes are individual conditions for native alarms
 - **Site Call Audit**: Serves the `SiteCalls` table queries and relays Retry/Discard actions to sites for the Site Calls page.
 - **Audit Log (#23)**: Serves all `AuditLog` table queries (filter / grid / drilldown / CSV export) for the new Audit Log page and the drill-in surfaces on Notifications, Site Calls, External Systems, Inbound API keys, Sites, and Instances. Payload capture, redaction, and per-site authorization follow the Audit Log component's "Payload Capture Policy" and "Security & Tamper-Evidence" sections.
 - **KPI History (#26)**: The Central UI hosts the `KpiHistoryQueryService` (scoped-repository read over `IKpiHistoryRepository.GetRawSeriesAsync` + `KpiSeriesBucketer`, dual-ctor test seam) and renders the reusable custom-SVG `KpiTrendChart` fed by it. Trend sections appear on the Notification Outbox, Site Calls, and Audit Log pages and in a per-site panel on the Health Monitoring dashboard; a query failure degrades to an unavailable-chart placeholder rather than breaking the page. See [Component-KpiHistory.md](Component-KpiHistory.md).
+
+### Configuration mutations and live circuit authority (2026-09-09)
+
+Page configuration handlers use `ConfigurationCommandService` and the guarded management command boundary. Database changes and their scrubbed audit entries commit in one transaction, including generated entity IDs. Existing instance service operations execute through the same transaction seam and retain their domain validation and audit ownership. Circuit read tracking is cleared after a separate transaction scope changes configuration.
+
+Cookie circuits retain their initial principal without retaining `HttpContext`; authoritative reads re-map stored directory groups against current grants. Mutation handlers recheck role and persisted target site immediately before dispatch. Passive session pings do not count as user activity. Trusted browser input posts an antiforgery-protected activity signal; the server activity tracker also makes it visible to the existing circuit.
+
+The explicit server-configured development auto-login mode preserves its synthetic all-role principal. It uses the Cookies scheme but has no LDAP group claims; it must not enter directory re-mapping. This exception follows validated `AuthDisableLoginOptions`, never a caller-supplied claim.
+
+### Isolated Test Run workers
+
+Test Run executes in a disposable `CentralUI.SandboxWorker` process. A process-wide admission gate permits at most four workers. Queueing, compilation, execution and gateway calls consume the requested deadline (1–10 seconds); cancellation kills the process tree and capacity is released only after confirmed exit. Console capture retains at most 32,000 characters with an explicit truncation marker; return JSON is limited to 32,000 bytes. Private IPC frames are limited to 1 MiB and stderr is drained without accumulation. Each worker has a 512 MiB managed-heap ceiling. The worker is a resource/lifetime boundary; the semantic script trust policy still gates compilation.
+
+External calls, shared-script lookup and bound-instance operations use a parent broker. Configured SQL connections are recreated inside the worker using credentials passed only over its private pipe, preserving the existing SQL permissions and API. Termination prevents further calls and closes worker-owned sockets; it cannot undo SQL or remote work already accepted by another server. Timeout results do not retain a terminated worker's partial console buffer.
+
+The deadline terminates the child independently of gateway cancellation. If a broker provider ignores cancellation, the response waits for that operation to finish and its admission slot remains charged; this preserves the owning request scope and prevents unbounded abandoned operations.
@@ -289,7 +289,7 @@ ZB.MOM.WW.ScadaBridge.Commons/
 │   │                               #   IngestCachedTelemetryCommand/Reply,
 │   │                               #   UpsertSiteCallCommand/Reply, SiteCallQueries,
 │   │                               #   SiteCallRelayMessages
-│   └── Management/                 # HTTP/ClusterClient management commands + registry,
+│   └── Management/                 # HTTP management commands + registry,
 │                                   #   including TransportCommands (Export/Preview/Import bundle)
 ├── Observability/                  # ScadaBridgeTelemetry — shared Meter ("ZB.MOM.WW.ScadaBridge") +
 │                                   #   counters/observable-gauges (deployments applied, inbound-API
@@ -452,3 +452,50 @@ Disconnect is detected at the **transport layer**, never via an application-leve
 - **Audit Log (#23)**: Sites forward audit-event telemetry (push) and serve the `PullAuditEvents` gRPC reconciliation pull from their `ISiteAuditQueue`; the central `AuditLogIngestActor` is the ingest target for both the push path and the combined cached-call telemetry packet.
 - **Site Event Logging**: Event log queries are routed through communication.
 - **Management Service**: The ManagementActor runs at `/user/management` on central nodes and is reached **in-process** via `ManagementActorHolder`. The CLI communicates with it over the central HTTP `/management` endpoints (HTTP Basic), not over any cluster transport. It is no longer registered with ClusterClientReceptionist (that registration, and the whole ClusterClient surface, is gone).
+
+### Control-plane ownership, retry safety and message limits (2026-09-09)
+
+Both gRPC servers and every application client channel explicitly set maximum send and receive
+message sizes to **32 MiB** through `GrpcMessageLimits`. Audit push and reconciliation normally
+use **2 MiB** batches measured from the complete protobuf message fields, repeated-message
+length/tag prefixes and gRPC framing. The shared limits must move together on both peers.
+
+On the central control service, the PSK interceptor stores a verified site identity in the
+server call context. Before dispatch it compares that identity to notification source site,
+reconciliation site identifier, health report and heartbeat site, **each** audit row's source
+site and **both** halves of every cached telemetry packet. A mismatch or missing owner denies
+the request with `PermissionDenied` before any handler or partial batch runs. Execution and
+parent-execution linkage may cross sites; those identifiers are not ownership fields.
+Notification status queries carry the verified identity to the outbox, which returns no result
+for a notification stored under another site. An unrecognized protobuf request is denied until
+its ownership rule is explicitly implemented.
+
+`Unavailable` alone does not prove a command was unsent: it can represent a connection loss
+after a device write, deployment or script call ran. The site transport automatically retries
+only an explicit read-only command whitelist, or a server readiness rejection carrying the
+`scadabridge-dispatch: not-started` trailer emitted before actor dispatch. An ambiguous mutation
+returns `Aborted` with `OUTCOME_UNKNOWN`; the caller must inspect the operation before retrying.
+The provider selects the peer for subsequent independent calls, without replaying the failed
+mutation. A secondary attempt that loses its response has the same uncertain-outcome behavior.
+
+Site-to-central notification submission and audit ingestion can retry because their durable
+identifiers are idempotent; status reads and sequence-guarded health reports can retry as well.
+Reconciliation mints fetch tokens and only retries a proven pre-dispatch rejection. Attempts
+share the original absolute deadline. No transport retries `DeadlineExceeded` across nodes.
+
+
+### Source and generated wire contract guard
+
+ProtoDescriptorContractTests invokes the pinned Grpc.Tools protoc for the test host and compares
+the full compiled FileDescriptorProto against each vendored descriptor. This covers message/field
+names, numbers, types, maps, oneofs, enums, options and RPC service signatures, including streaming.
+Mutation controls prove name/type/service drift is detected. Updating a proto requires regenerating
+its vendored C# with docker/regen-proto.sh; changing a source hash alone cannot satisfy the guard.
+The guard requires the package's native compiler to execute on the test host; it does not run
+inside the Docker image build, which retains vendored sources for the documented ARM workaround.
+
+Central listener isolation runs after endpoint routing and before authentication/dispatch. Only
+mapped gRPC methods can execute on the control-plane socket; they are rejected on HTTP/metrics
+sockets. Dedicated metrics sockets expose metrics and health only. Decisions use LocalPort and
+endpoint metadata, never the caller's Host/authority header. The env2 central/site pairs now enable
+the same deterministic bootstrap guard as the main rig for simultaneous container recreation.
@@ -435,7 +435,7 @@ The `AuditLog` table is append-only and grows by every script-trust-boundary eve
 - Connection strings are provided via the Host's `DatabaseConfiguration` options (bound from `appsettings.json`).
 - EF Core manages connection pooling via the underlying ADO.NET SQL Server provider.
 - The DbContext is registered as a **scoped** service in the DI container, ensuring each request/operation gets its own instance.
- **`DbContext` pooling (`AddDbContextPool`) is deliberately NOT used (arch-review WP2.2 — verified, not overlooked).** Pooling requires a context with a single public constructor taking only `DbContextOptions<TContext>`; `ScadaBridgeDbContext` has a second, runtime constructor taking `IDataProtectionProvider`, because the encrypting value converter for secret-bearing columns is built during `OnModelCreating` from that provider — and the model itself *differs* between the two constructors (no provider ⇒ no encrypting converter), so a pooled activator could silently produce a context that reads secret columns as ciphertext. Adopting pooling would mean moving the protector out of the constructor into a `DbContextOptions` extension — a change to the secrets-at-rest path, not a performance refactor — so it is deferred rather than folded into this pass.
+- **`DbContext` pooling (`AddDbContextPool`) is deliberately NOT used (arch-review WP2.2 — verified, not overlooked).** Pooling requires a context with a single public constructor taking only `DbContextOptions<TContext>`; `ScadaBridgeDbContext` has a second, runtime constructor taking `IDataProtectionProvider`, because the encrypting value converter for secret-bearing columns is built during `OnModelCreating` from that provider — and the model itself *differs* between the two constructors (no provider ⇒ schema-only protector that rejects secret access), so a pooled activator could silently produce a context that reads secret columns as ciphertext. Adopting pooling would mean moving the protector out of the constructor into a `DbContextOptions` extension — a change to the secrets-at-rest path, not a performance refactor — so it is deferred rather than folded into this pass.
 - No connection management for the Machine Data Database — that is handled separately by consumers (Inbound API scripts, external system gateway).

 ---
@@ -460,3 +460,39 @@ The `AuditLog` table is append-only and grows by every script-trust-boundary eve
 - **Central UI**: Uses `ICentralUiRepository` for read-oriented queries across domain areas, including config-audit queries for the Configuration Audit Log Viewer (the operational Audit Log page is owned by #23).
 - **All central components that modify state**: Call `IAuditService.LogAsync()` after successful operations to record audit entries within the same transaction.
 - **Host**: Provides database connection configuration. Registers DbContext, repository implementations, and `IAuditService` implementation in the DI container. Triggers auto-migration in development or validates schema version in production.
+
+### Configuration command transactions (2026-09-09)
+
+`ConfigurationCommandTransaction` creates a fresh dependency scope and EF context for each execution-strategy attempt. Entity changes and staged audit entries share one transaction, including intermediate saves needed for generated keys. A failure before commit rolls back both. An uncertain commit is not replayed, preventing duplicate creates; the caller must reconcile its result. Postcommit cache actions execute while their dependency scope remains alive; failures are logged without replaying the committed operation.
+
+### Bounded trace retrieval
+
+Execution-chain readers use a parameterized permitted-site JSON set throughout the up/down SQL walk and metadata projection. Replay caps chain identifiers at2048, reads at most501ordered candidates sequentially, and bounds DetailsJson in SQL before materialization. Whole events exceeding the remaining UTF-8 budget are omitted and `TraceEventBatch.Truncated` is set; `RootExecutionId` survives independently when an oversized first row cannot be included.
+
+
+### Global instance identity and protocol credential upgrade
+
+Instance UniqueName is globally unique in SQL Server, matching name-based routing and lookup.
+The migration checks for existing duplicates before creating the unique index and fails with
+an explicit inventory/remediation message. It does not select a winning site or rename deployed
+instances. Concurrent creation/import conflicts become InstanceNameConflictException and a
+curated domain failure. SiteId retains a separate lookup index.
+
+DataConnection.PrimaryConfiguration and BackupConfiguration are protected in full with a
+purpose-scoped Data Protection converter, using a versioned dp:protocol:v1: prefix. Both SQL
+columns are nvarchar(max) to accommodate ciphertext expansion. Schema-only contexts reject
+non-null protocol configuration writes without a real key ring.
+
+After schema migration/validation and before repositories are used, DataConnectionSecretUpgrade
+reads legacy rows in batches of 256 and protects both columns with an atomic, binary-comparison
+compare-and-swap update. Concurrent central startup is safe; reruns validate existing ciphertext
+without double encryption. No plaintext fallback exists on normal entity reads. Protection failure
+prevents startup rather than silently using plaintext.
+
+Upgrade central nodes together: old binaries cannot read the new protected values. SQL migration
+alone does not encrypt data; the first updated host performs the data upgrade with the shared
+persisted key ring. Keep a coordinated pre-upgrade database/key-ring backup. Downgrade is rejected
+while protected protocol rows exist. The existing same-database key-ring storage remains
+defence in depth; this change does not introduce external key management.
+
+Trace replay reads keyset pages of eight rows, so EF retry buffering cannot materialize a whole trace before the consumer applies its byte budget. SQL omits an oversized DetailsJson value before transfer; all other projected strings have schema length limits. Canonical serialized UTF-8 size, including escaping and metadata, determines the final 1 MiB limit.
@@ -304,7 +304,7 @@ The `AlarmTransitionCallback` delivers a protocol-neutral `NativeAlarmTransition

 ### Protocol Adapters

- **OPC UA** (`OpcUaDataConnection` + `RealOpcUaClient`): a single **event MonitoredItem** (`AttributeId = EventNotifier`) on the Server object, with an `EventFilter` selecting `EventType` / `SourceNode` / `Severity` plus the `ConditionType` / `AcknowledgeableConditionType` / `AlarmConditionType` state fields. `ConditionRefresh` is invoked on subscribe to replay active conditions as the snapshot. The OPC UA field → `NativeAlarmTransition` mapping is isolated in the pure helper `OpcUaAlarmMapper`, unit-testable without a live server.
+- **OPC UA** (`OpcUaDataConnection` + `RealOpcUaClient`): one **event MonitoredItem per source binding** (`AttributeId = EventNotifier`), sharing an event subscription (the empty binding selects the Server object), with an `EventFilter` selecting `EventType` / `SourceNode` / `Severity` plus the `ConditionType` / `AcknowledgeableConditionType` / `AlarmConditionType` state fields. `ConditionRefresh` is invoked on subscribe to replay active conditions as the snapshot. The OPC UA field → `NativeAlarmTransition` mapping is isolated in the pure helper `OpcUaAlarmMapper`, unit-testable without a live server.
 - **MxGateway** (`MxGatewayDataConnection` + `RealMxGatewayClient`): mirrors over the gateway package's `StreamAlarmsAsync` — a resumable background stream whose reconnect re-sends a snapshot. The field mapping lives in `MxGatewayAlarmMapper`.

 Other/custom protocols do not implement the capability; a subscribe request against such a connection is replied to with a failure (`SubscribeAlarmsResponse.Success = false`).
@@ -315,12 +315,12 @@ The `DataConnectionActor` opens **one alarm feed per source** (not per subscribe

 The registered `SourceReference` is a **NodeId** for OPC UA (the picker, CSV and config all store NodeIds), so the transition's routing identity must live in the same space or nothing matches. **Gitea #17**: the OPC UA adapter previously set `SourceObjectReference` from the event's `SourceName` (a plain name — the RawPath for OtOpcUa), which never prefix-matches a NodeId binding, so every native OPC UA alarm transition was silently dropped. Because each OPC UA feed is opened for exactly one binding, the adapter now tags every transition on that feed with the **binding string verbatim** (via the pure `OpcUaAlarmMapper.BuildIdentity`), making the routing key an exact match independent of whether the binding is stored as `ns=<index>` or the durable `nsu=<uri>` form. The Server-object aggregate feed (empty binding) keeps an empty routing identity, so it reaches only "mirror everything" subscribers and never leaks into a specific-node binding. The per-condition `SourceReference` key stays the human-readable `SourceName.ConditionName`, so persistence and display are unchanged. MxGateway is unaffected — its bindings are object names and its mapper already emits matching names.

- **State gating**: `SubscribeAlarmsRequest` is handled only in the **Connected** state; requests arriving while **Connecting**/**Reconnecting** are stashed (standard Become/Stash) and processed on entering Connected.
+- **State gating**: `SubscribeAlarmsRequest` is handled only in the **Connected** state; requests arriving while **Connecting**/**Reconnecting** are coalesced to the latest request per subscriber actor/source and processed on entering Connected. Unsubscribes and subscriber termination are handled in every state.
 - **Capability check**: if `_adapter is not IAlarmSubscribableConnection`, the actor replies `SubscribeAlarmsResponse(Success = false, ...)`.
 - **Reconnect handling**: on entering **Reconnecting**, the actor pushes a `NativeAlarmSourceUnavailable` to every alarm subscriber (consumers mark mirrored alarms uncertain rather than clearing them). On successful reconnection it re-subscribes the feed; the adapter re-emits a snapshot, reconciling state.
 - **Shared condition filter (last-subscriber-wins)**: because the feed is opened once per source, it carries a single condition filter. A second subscriber that registers a *different* filter for the same source overwrites it (last writer wins) and the actor logs a warning — co-subscribers to one source are expected to agree on the filter.
- **Routing index**: subscribed sources are bucketed by the **first path segment** of their reference (everything before the first `.`), and a transition is matched only against the bucket for its own first segment, plus a residue list of sources that carry no separator at all (a prefix shorter than one segment, which can match other buckets). This is sound because a source reference containing a separator can only prefix a reference sharing its entire first segment. The per-source `StartsWith` test and the condition-type gate inside the bucket are unchanged, so routing decisions are identical to the previous linear scan over every subscribed source; the `SnapshotComplete` sentinel still bypasses the index entirely and is broadcast to every subscriber.
- **Gateway union filter (MxGateway)**: `StreamAlarms` carries a single `alarm_filter_prefix`, so the adapter opens the stream on the **longest common prefix** of the currently subscribed source references and restarts it only when a NEW source falls outside that prefix (the source then replays a fresh snapshot, which `NativeAlarmActor` already handles). An unsubscribe never restarts the stream — the prefix it leaves behind is at worst too broad, which costs bandwidth, not correctness. The prefix is a bandwidth optimisation only; the actor's per-source + condition-type gate remains authoritative, mirroring the OPC UA server-side WhereClause stance.
+- **Routing index**: subscribed sources are bucketed by the **first path segment** of their reference (everything before the first `.`), and a transition is matched only against the bucket for its own first segment, plus a residue list of sources that carry no separator at all (a prefix shorter than one segment, which can match other buckets). This is sound because a source reference containing a separator can only prefix a reference sharing its entire first segment. The per-source `StartsWith` test and the condition-type gate inside the bucket are unchanged, so routing decisions are identical to the previous linear scan over every subscribed source; snapshot boundaries bypass the condition filter, but OPC UA boundaries are sent only to the exact source binding. Connection-wide Mx boundaries broadcast to all subscribers while preserving their refresh epoch.
+- **Gateway union filter (MxGateway)**: `StreamAlarms` carries a single `alarm_filter_prefix`, so the adapter opens the stream on the **longest common prefix** of the currently subscribed source references and restarts it for each new source, including one covered by the existing prefix, so every newly bound source receives standing state. Each transport refresh has connection-wide start/end markers and a distinct epoch. An unsubscribe never restarts the stream — the prefix it leaves behind is at worst too broad, which costs bandwidth, not correctness. The prefix is a bandwidth optimisation only; the actor's per-source + condition-type gate remains authoritative, mirroring the OPC UA server-side WhereClause stance.

 ### Protocol-Neutral Types & Messages

@@ -330,7 +330,7 @@ All defined in Commons so the feed is identical across protocols:
 |------|-------|
 | `NativeAlarmTransition` | `SourceReference`, `SourceObjectReference`, `AlarmTypeName`, `Kind`, `Condition`, `Category`, `Description`, `Message`, `OperatorUser`, `OperatorComment`, `OriginalRaiseTime?`, `TransitionTime`, `CurrentValue`, `LimitValue`, `AckTime?` |
 | `AlarmConditionState` | `Active`, `Acknowledged`, `Confirmed?` (null when not confirmable), `Shelve`, `Suppressed`, `Severity` (0–1000) |
-| `AlarmTransitionKind` (enum) | `Snapshot`, `SnapshotComplete`, `Raise`, `Acknowledge`, `Clear`, `Retrigger`, `StateChange` |
+| `AlarmTransitionKind` (enum) | `Snapshot`, `SnapshotComplete`, `Raise`, `Acknowledge`, `Clear`, `Retrigger`, `StateChange`, `SnapshotStart` (appended) |

 `OperatorUser` / `OperatorComment` and `CurrentValue` / `LimitValue` are display-only mirrors from the source.

@@ -377,11 +377,15 @@ Each value update delivered to an Instance Actor includes:
 >
 > **Stop-and-recreate was rejected, and the reason is worth keeping.** Subscriptions are held inside `DataConnectionActor`, and `InstanceActor` cancels its per-connection subscribe-retry timer on the first success — so a rebuilt connection actor would have *no* subscribers and nothing would ever re-subscribe. That trades "stale endpoint, data flowing" for "correct endpoint, no data until redeploy". See *In-place reconfiguration* below for what the actor does instead.

-Each data connection is managed by a dedicated connection actor that uses the Akka.NET **Become/Stash** pattern to model its lifecycle as a state machine:
+Each data connection is managed by a dedicated connection actor that uses the Akka.NET **Become** pattern to model its lifecycle as a state machine:

- **Connecting**: The actor attempts to establish the connection. Subscription requests and write commands received during this phase are **stashed** (buffered in the actor's stash).
- **Connected**: The actor is actively servicing subscriptions. On entering this state, all stashed messages are unstashed and processed.
- **Reconnecting**: The connection was lost. The actor transitions back to a connecting-like state, stashing new requests while it retries.
+- **Connecting**: The actor attempts to establish the connection. It retains only the latest tag-subscribe request per instance and alarm-subscribe request per subscriber/source. Single and batch device writes receive an immediate failed response; they are never retained.
+- **Connected**: The actor actively services subscriptions and processes the retained latest subscription requests.
+- **Reconnecting**: The connection was lost. Existing subscribers receive bad quality, the latest subscription requests are coalesced while the actor retries, and single/batch writes fail immediately. A caller timeout never leaves a queued setpoint to replay on recovery.
+
+Instance Actors and NativeAlarmActors send explicit unsubscribe requests from `PostStop`, with their own actor references as sender. DCL also watches every subscriber. A stopped actor releases only its own registrations; a delayed unsubscribe or termination from an old actor cannot remove the replacement actor with the same instance name. A narrower replacement drops tags it no longer requests. Completion of outstanding device subscribe/resolution I/O adopts handles only for tags still requested and releases orphan handles. Existing identical Mx handles are never released as redundant, and adapter reverse-map removals compare the handle atomically before removing a tag mapping.
+
+OPC UA refreshes carry an exact `SnapshotSourceReference` (including the empty Server binding) and a `SnapshotId` shared by `SnapshotStart`, entries and `SnapshotComplete`. Each NativeAlarmActor replaces its buffer on a new start and commits only a matching end; duplicate or superseded ends cannot clear a committed snapshot. The adapter tags each monitored item's refresh separately even though ConditionRefresh targets the shared event subscription. Mx snapshots retain their connection-wide framing. An interrupted refresh buffer is discarded on disconnect.

 This pattern ensures no messages are lost during connection transitions and is the standard Akka.NET approach for actors with I/O lifecycle dependencies.

@@ -455,3 +459,10 @@ The DCL reports the following metrics to the Health Monitoring component via the
 - **Site Runtime (NativeAlarmActor)**: Bidirectional — receives alarm subscribe/unsubscribe requests, delivers native alarm transitions and source-unavailable notifications (read-only; no ack-back to the source).
 - **Health Monitoring**: Reports connection health periodically.
 - **Site Event Logging**: Logs connection/disconnection events.
+
+
+### Medium architecture review connection guarantees (2026-09-09)
+
+OPC UA connection and endpoint verification select exactly the configured security mode. If a protected mode is unavailable, or discovery fails while protection was requested, the operation fails with the requested mode in its diagnostic; it never falls back to an unsecured session.
+
+DCL retains each subscribed alarm source's current standing state and its in-progress snapshot. A new subscriber sharing a feed receives a scoped replay, or the already-received prefix of an in-progress frame followed by the remaining frame. Cache state is discarded on reconnect and last-owner unsubscribe. A new Mx source reopens the shared stream even when the existing prefix covers it, obtaining a fresh standing-state snapshot; callbacks from the canceled stream are ignored. Mx refresh boundaries remain connection-wide but share a distinct per-stream epoch. Both replay cache and runtime mirror ignore stale-epoch rows and apply newer live raises/clears over a concurrent refresh before committing it.
@@ -180,8 +180,7 @@ to re-enable", and the single-instance deploy remains the explicit re-enable pat
 **Reconciliation is bounded per batch.** Phase 1 is serial, so an unreachable site
 would otherwise cost the batch one full communication-layer `QueryTimeout` (30 s)
 per instance before a single deploy was sent — hours for a large site, past the
-CLI's 5-minute bulk deadline, which cancels and re-arms the identical cost on the
-next attempt. Each reconcile in a bulk deploy therefore runs under the short
+server's bulk scheduling deadline. Repeated client timeouts must not re-arm the identical cost on another attempt. Each reconcile in a bulk deploy therefore runs under the short
 `SiteDeploymentReconcileTimeout` (default **5 s**), and the FIRST one to hit that
 deadline opens a once-per-batch circuit-breaker that skips the remaining
 reconciles (one summary log line, not N). Skipping costs nothing: a timed-out
@@ -319,3 +318,9 @@ The Deployment Manager sends the following commands to sites via the Communicati
 - **Site Runtime**: Receives and applies configurations and lifecycle commands.
 - **Health Monitoring**: Deployment failures contribute to site health status.
 - **Transport (#24)**: Does not invoke Deployment Manager directly. Transport-driven template changes propagate to deployed instances through the existing revision-hash drift detection in `DeploymentService.CompareAsync`; the Deployments page surfaces affected instances as stale automatically.
+
+### Authoritative staleness and bulk deadlines
+
+`StaleInstanceProbe` no longer memoizes revision hashes against process-local watermarks. Every probe starts a fresh flatten session, so a configuration edit through another central is visible to the next deployment skip decision. This trades extra flattening work for correctness across shared-database writers.
+
+Management bulk deployment uses `LongRunningCommandTimeout` as an overall scheduling/send deadline. Cancellation stops scheduling more instances, fails unfinished eligible rows, and releases prepared operation locks. Completed and deliberately skipped outcomes remain in the response. HTTP Ask reserves an additional60 seconds for cleanup and response; the bulk CLI defers its timeout to this server-owned deadline.
@@ -74,9 +74,9 @@ Each API method definition includes:

 > **Authoring note — idempotent methods for at-least-once callers**: some external callers retry
 > on their own connect-failure/timeout failover loop and cannot tell "the first attempt actually
-> succeeded" from "the first attempt was lost" — e.g. the `DelmiaRecipeDownload` method backing
-> `DelmiaNotifier` (see `docs/plans/2026-06-26-delmia-recipe-notifier-design.md`, "Delivery
-> semantics: at-least-once"). Implementation scripts for such methods must be idempotent on their
+> succeeded" from "the first attempt was lost". The updated `DelmiaNotifier` returns an uncertain
+> result instead of automatically replaying such attempts. Scripts exposed to other retrying
+> clients should still be idempotent on their
 > natural key so a duplicate delivery returns the same result without double-applying side effects.

 ### Management
@@ -148,7 +148,8 @@ The `sbk_<keyId>_<secret>` design already supports zero-downtime rotation — a
 | `VALIDATION_FAILED` | 400 | Parameter validation failed (missing required field, wrong type, undeclared field). |
 | `BODY_TOO_LARGE` | 413 | Request body exceeded `MaxRequestBodyBytes`. |
 | `STANDBY_NODE` | 503 | Request hit a standby central node that could not relay it: no `StandbyForwardPeerEndpoints` configured, or the request was already relayed once (loop guard — neither node is active, e.g. mid-failover). Carries the `X-ScadaBridge-Standby: 1` response header. |
-| `ACTIVE_NODE_UNREACHABLE` | 503 | A standby tried every configured peer and none served the relay (unreachable, timed out after `StandbyForwardTimeout`, or also standby). |
+| `ACTIVE_NODE_UNREACHABLE` | 503 | Every configured peer refused before execution or failed with proven name-resolution/connection-refusal errors. |
+| `OUTCOME_UNKNOWN` | 502 | A relay timed out or lost its response after possible execution; it does not replay the request. Verify the operation before retrying. |
 | `TIMEOUT` | 500 | The method script exceeded its execution timeout. |
 | `SITE_UNREACHABLE` | 500 | The target site did not respond to the routed request within the routing timeout (no contact / down / partitioned) — typed from the routed Ask expiring (`AskTimeoutException`), never inferred from an error-message substring. A `Success=false` response means the site answered and is classified `SCRIPT_ERROR`. |
 | `SCRIPT_COMPILE_FAILED` | 500 | The method's script failed to compile (returned consistently on every node until a compiling version is saved). |
@@ -362,10 +363,10 @@ Both central nodes expose `POST /api/{methodName}`, but only the active node (th

 A standby now **relays** the request to the active peer instead (`InboundApiEndpointFilter` → `IStandbyRequestForwarder` / `HttpStandbyRequestForwarder`):

- **Configuration.** `ScadaBridge:InboundApi:StandbyForwardPeerEndpoints` — the HTTP base URL(s) of the *other* central node(s), e.g. `["http://scadabridge-central-b:5000"]` on central-a. Empty (default) keeps the old 503 behaviour. `StandbyForwardTimeout` (default 60 s) is the per-peer attempt deadline and must exceed the longest method timeout in use. Validated at startup (absolute http/https URLs, positive timeout). Note the standby discovers the active peer from **appsettings**, not from cluster state — the Akka member address carries the remoting port, not the HTTP port — so this is a static, restart-to-change list, like `CentralGrpcEndpoints` on sites.
- **Pure relay.** Method, path, query string, body and headers travel verbatim (hop-by-hop headers and `Host` excepted), so the **active node** authenticates the caller's own `Authorization`/`X-API-Key` credential, applies its own body cap and method timeout, and writes the audit row. The peer's status, `Content-Type` and body are replayed unchanged. The standby's `AuditWriteMiddleware` skips its own `ApiInbound` row for a relayed request (`HttpContext.Items[RelayedToActiveItemKey]`) so a call is audited once, where it ran.
- **Order of checks.** The body-size cap (413 `BODY_TOO_LARGE`) runs *before* the active-node check, so a standby never buffers or relays a body the active node would refuse. The body is buffered once on the standby (bounded by `MaxRequestBodyBytes`) so it can be re-sent to a second peer.
- **Peer selection.** The standby knows only that it is *not* active. It tries the peers in order and accepts the first response that is not a standby refusal; a peer answering 503 with `X-ScadaBridge-Standby: 1`, a connection failure, or a `StandbyForwardTimeout` expiry each move to the next peer. A 503 *without* the marker is the active node's own answer and is replayed, not retried. All peers failing → 503 `ACTIVE_NODE_UNREACHABLE`.
+- **Configuration.** `ScadaBridge:InboundApi:StandbyForwardPeerEndpoints` — the HTTP base URL(s) of the *other* central node(s), e.g. `["http://scadabridge-central-b:5000"]` on central-a. Empty (default) keeps the old 503 behaviour. `StandbyForwardTimeout` (default 60 s) is the total relay budget and should exceed the longest method timeout plus network overhead. Validated at startup (absolute http/https URLs, positive timeout). Note the standby discovers the active peer from **appsettings**, not from cluster state — the Akka member address carries the remoting port, not the HTTP port — the options snapshot is read per relay.
+- **Pure relay.** Method, path, query string, body and credentials travel unchanged; hop-by-hop/Host/forwarding-provenance headers are excluded and authenticated provenance is rebuilt, so the **active node** authenticates the caller's own `Authorization`/`X-API-Key` credential, applies its own body cap and method timeout, and writes the audit row. The peer's status, `Content-Type` and body are replayed unchanged. The serving node owns its `ApiInbound` row; the originating standby retains a failure row when no peer serves or the outcome is uncertain. Verified internal standby refusals are not duplicated.
+- **Order of checks.** The body-size cap (HTTP 413) runs before audit reads and the active-node check, so a standby never buffers or relays a body the active node would refuse. The body is buffered once on the standby (bounded by `MaxRequestBodyBytes`) so it can be re-sent to a second peer.
+- **Peer selection.** The standby knows only that it is *not* active. It tries the peers in order and accepts the first response that is not a standby refusal; a peer answering 503 with `X-ScadaBridge-Standby: 1`, proven name-resolution failure, or connection refusal permits trying the next peer. Timeout or ambiguous response loss returns 502 `OUTCOME_UNKNOWN` without replay. A 503 *without* the marker is the active node's own answer and is replayed, not retried. All peers failing → 503 `ACTIVE_NODE_UNREACHABLE`.
 - **One-hop loop guard.** Every relayed request carries `X-ScadaBridge-Forwarded: <relaying host>`. A standby never relays a request that already carries it — it answers 503 `STANDBY_NODE` with the marker header — so a pair in which neither node is active (a transient during failover) bounces at most one hop and never ping-pongs. The active node ignores the header and serves the request normally.
 - **Still not a retry layer.** The relay makes one HTTP attempt per peer and does not retry a peer that answered; at-least-once callers keep their own retry loop and the idempotent-method authoring note above still applies.

@@ -394,3 +395,15 @@ A standby now **relays** the request to the active peer instead (`InboundApiEndp
 - **Site Runtime (Instance Actors, Script Actors)**: Routed calls execute on site Instance Actors via their Script Actors.
 - **Central UI**: Administrator manages API keys; Designer manages method definitions.
 - **Configuration Database (via IAuditService)**: Configuration changes are audited.
+
+### Relay audit ownership, privacy, and request limits
+
+The inbound body limit is installed before audit buffering. Declared oversized bodies and unknown-length HTTP/1.1 or HTTP/2 bodies are rejected with HTTP 413; enabling audit capture cannot relax the route limit. The relay also bounds its buffered copy explicitly.
+
+A serving peer owns the inbound audit for its success or method failure. The originating standby writes a correlated failure if no peer serves the request, including an uncertain lost response. Authenticated internal standby refusals do not create duplicate inbound rows. Audit writes remain best effort; ownership is not a durable audit receipt.
+
+Relays overwrite caller-supplied provenance with an HMAC signed envelope using a domain-separated key derived from `ApiKeyPepper`. Both centrals must share that server secret. The envelope binds the original verified remote address, execution ID, timestamp, method, path/query, content type, caller credentials, and bounded body digest. The receiver accepts it for at most five minutes and only when the request binding matches. Unsigned loop markers and forwarded-address headers confer no identity trust; missing or invalid proof uses the receiver's verified remote address. Forwarding remains one hop. Use TLS between peers when network confidentiality is required.
+
+`StandbyForwardTimeout` is one budget across permitted attempts and response consumption. Only explicit pre-execution standby rejection, name-resolution failure, or connection refusal permits another peer. Timeout or response loss returns HTTP 502 `OUTCOME_UNKNOWN`: verify the operation before manually retrying because it may already have applied. This avoids blindly replaying non-idempotent methods.
+
+`SkipBodyCapture` suppresses request/response summaries and all exception message/detail text, including stashed script exceptions; retain status/category and request metadata for diagnosis. Error text can quote payload values and is subject to the same privacy boundary as the body.
@@ -2,7 +2,7 @@

 ## Purpose

-The Management Service is an Akka.NET actor on the central cluster that provides programmatic access to all administrative operations. It exposes the same capabilities as the Central UI but through an actor-based interface, enabling the CLI (and potentially other tooling) to interact with the system without going through the web UI. The ManagementActor registers with ClusterClientReceptionist for cross-cluster access and is also exposed via an HTTP Management API endpoint (`POST /management`) for external tools like the CLI.
+The Management Service is an Akka.NET actor on the central cluster that provides programmatic access to all administrative operations. It exposes the same capabilities as the Central UI but through an actor-based interface, enabling the CLI (and potentially other tooling) to interact with the system without going through the web UI. The ManagementActor is reached in-process through `ManagementActorHolder` and is exposed via an authenticated HTTP Management API endpoint (`POST /management`) for external tools like the CLI.

 ## Location

@@ -13,18 +13,18 @@ Central cluster only. The ManagementActor runs as a plain actor on **every** cen
 ## Responsibilities

 - Provide an actor-based interface to all administrative operations available in the Central UI.
- Register with Akka.NET ClusterClientReceptionist so external tools (CLI) can discover and communicate with it via ClusterClient.
+- Serve external tools through the authenticated HTTP Management API; actor references remain internal to the central host.
 - Expose an HTTP API endpoint (`POST /management`) that accepts JSON commands with Basic Auth, performs LDAP authentication and role resolution, and dispatches to the ManagementActor.
 - Validate and authorize all incoming commands using the authenticated user identity carried in message envelopes.
 - Delegate to the appropriate services and repositories for each operation.
 - Return structured response messages for all commands and queries.
- Failover: The ManagementActor runs on all central nodes, so no actor-level failover is needed. If one node goes down, the ClusterClient transparently routes to the ManagementActor on the remaining node.
+- Failover: The ManagementActor runs on all central nodes, so no actor-level failover is needed. Clients address the HTTP management endpoint through the configured active-node proxy. Site-bound commands use the gRPC pair transport and its explicit retry-safety contract.

 ## Key Classes

 ### ManagementActor

-The central actor that receives and processes all management commands. Created at the well-known actor path (`/user/management`) and handed to `ManagementActorHolder`, which is how every in-process caller (notably `ManagementEndpoints`) reaches it. It is **not** advertised via ClusterClientReceptionist — see the note under "ManagementActor and ClusterClient" in Component-Communication.
+The central actor that receives and processes all management commands. Created at the well-known actor path (`/user/management`) and handed to `ManagementActorHolder`, which is how every in-process caller (notably `ManagementEndpoints`) reaches it. There is no receptionist registration or cross-cluster actor discovery.

 ### ManagementEndpoints

@@ -45,10 +45,6 @@ All request/response messages are defined in **Commons** under `Messages/Managem
 - **CorrelationId**: Application-level correlation ID for request/response pairing.
 - **AuthenticatedUser**: The identity and roles of the user issuing the command (username, display name, roles, permitted sites). This is populated by the CLI from the user's authenticated session.

-## ClusterClientReceptionist Registration
-
-The ManagementActor registers itself with `ClusterClientReceptionist` at startup. This allows external processes using `ClusterClient` to send messages to the ManagementActor without joining the Akka.NET cluster as a full member. The receptionist advertises the actor under its well-known path.
-
 ## HTTP Management API

 The Management Service also exposes a `POST /management` endpoint on the Central Host's web server. This provides an HTTP interface to the same ManagementActor, enabling the CLI (and other HTTP clients) to interact without Akka.NET dependencies.
@@ -298,14 +294,22 @@ The ManagementActor receives the following services and repositories via DI (inj
 - **Configuration Database (via IAuditService)**: All mutating operations are audit logged through the existing transactional audit mechanism.
 - **Communication Layer**: Deployment commands and remote queries (parked messages, event logs) are routed to sites via Communication.
 - **Security & Auth**: Authorization rules are enforced on every command using the authenticated user identity from the message envelope.
- **Cluster Infrastructure**: ManagementActor runs on all central nodes; ClusterClientReceptionist requires cluster membership.
+- **Cluster Infrastructure**: ManagementActor runs on all central nodes within the shared central ActorSystem.
 - **All service components**: The ManagementActor delegates to the same services used by the Central UI — Template Engine, Deployment Manager, etc.

 ## Interactions

 - **CLI**: The primary consumer. Connects via the HTTP Management API (`POST /management`) and sends commands as JSON with Basic Auth credentials.
- **Host**: Registers the ManagementActor and ClusterClientReceptionist on central nodes during startup.
+- **Host**: Creates the ManagementActor and its holder, and maps the authenticated HTTP endpoint on central nodes during startup.
 - **Central UI**: Shares the same underlying services and repositories. The ManagementActor and Central UI are parallel interfaces to the same operations.
 - **Communication Layer**: Deployment commands and remote site queries flow through communication actors.
 - **Configuration Database (via IAuditService)**: All configuration changes are audited.
 - **Security & Auth**: The ManagementActor enforces authorization using user identity passed in messages. For HTTP API access, the Management endpoint authenticates the user via LDAP and resolves roles before dispatching to the ManagementActor.
+
+### Atomic configuration command boundary (2026-09-09)
+
+Database-only configuration commands may execute through `ExecuteConfigurationCommandAsync` from the actor or Central UI. The boundary requires role authorization and `IConfigurationCommandTransaction`; missing transaction configuration fails closed. Repository mutations may flush generated keys within the transaction; a final flush persists the audit before commit. Existing service-owned audits are retained. Site cache refresh and inbound API handler publication run only after a successful commit.
+
+### Scoped and bounded execution-chain reads
+
+Audit tree HTTP reads and Flow Debugger Replay pass the authenticated caller's permitted source-site set into the repository. Administrator and system-wide grants omit the filter; scoped reads retain central rows with null SourceSiteId while excluding other sites from ancestors, descendants and aggregates. Replay retains root identity separately from payload rows and propagates truncation truthfully. It returns at most500 events and reserves envelope overhead within a1MiB UTF-8 budget. The Central UI direct tree-query facade applies the same current-scope policy.
@@ -28,7 +28,7 @@ SMTP and HTTP delivery is blocking I/O. A dispatch sweep runs **off the actor th
 %%{init: {'theme':'base', 'themeVariables': {'textColor':'#111111','lineColor':'#555555','edgeLabelBackground':'#ffffff','fontSize':'15px'}}}%%
 flowchart TD
    SCRIPT(["Site script: Notify.To('list').Send(subject, body)<br/>generate NotificationId (GUID) locally;<br/>return it to the script immediately"])
-    SNF["Site Store-and-Forward Engine<br/>(notification category, target = central)<br/>durably forwards to central via Central-Site Communication<br/>(ClusterClient); buffers/retries if central is unreachable"]
+    SNF["Site Store-and-Forward Engine<br/>(notification category, target = central)<br/>durably forwards to central via Central-Site Communication<br/>(authenticated CentralControlService gRPC); buffers/retries if central is unreachable"]
    INGEST[("Central ingest: insert-if-not-exists on NotificationId<br/>to Notifications table (Pending)<br/>ack the site, site S and F clears the message")]
    OUTBOX["Central Notification Outbox actor<br/>(singleton, active central node)<br/>polls due rows; resolves the list;<br/>delivers via the matching adapter"]
    D1{Delivery outcome}
@@ -199,3 +199,12 @@ Delivery max-retry-count and retry interval are not part of `NotificationOutboxO
 - **Central UI**: Queries the `Notifications` table for the Notification Outbox page and issues operator Retry/Discard actions on parked notifications.
 - **Health Monitoring**: Polls the outbox for KPI tiles on the health dashboard.
 - **KPI History (#26)**: Emits `IKpiSampleSource` (`NotificationOutboxKpiSampleSource`, Global + per-Site + per-Node) consumed by the KpiHistory recorder (#26), reusing the existing `Compute…KpisAsync` reads; the resulting `queueDepth` / `stuckCount` / `parkedCount` / `deliveredLastInterval` / `oldestPendingAgeSeconds` series render as trends on the Notification Outbox page via `KpiTrendChart`. See [Component-KpiHistory.md](Component-KpiHistory.md).
+
+### Site-scoped delivery-status queries (2026-09-09)
+
+The central gRPC ingress adds its credential-verified site identity to the internal status
+query; the site cannot supply or override this field on the wire. The outbox compares it to
+the stored notification's `SourceSiteId` before returning delivery state or error details.
+A foreign or unknown notification returns the same `Found = false` response. Existing trusted
+in-process central callers may omit the site constraint. Notification ingest remains
+idempotent on `NotificationId`; this does not imply row-level dispatch claiming.
@@ -38,6 +38,8 @@ The following namespace/type prefixes are forbidden in all scripts:
 | `System.Reflection` | Reflection — forbidden entirely |
 | `System.Net` | Raw network access — forbidden entirely (scripts must use `ExternalSystem.Call`) |
 | `System.Runtime.InteropServices` | Native interop — forbidden entirely |
+| `System.Runtime.CompilerServices.Unsafe`, `System.Runtime.CompilerServices.RuntimeHelpers` | Type-punning and constructor/runtime bypass — forbidden types; compiler attributes and async support remain allowed |
+| `System.Runtime.Loader` | Assembly loading and load-context control — forbidden entirely |
 | `Microsoft.Win32` | Win32 API access — forbidden entirely |
 | `System.Environment` | Whole type — forbidden entirely; exposes process control (`Exit`/`FailFast`), the host environment, and secrets via environment variables (e.g. `SCADABRIDGE_API_KEY`). Scripts that need a line break use `"\n"` instead of `Environment.NewLine`. |
 | `System.GC` | Whole type — forbidden entirely; GC control (`Collect`, `KeepAlive`, memory-pressure knobs) has no legitimate script use. |
@@ -194,7 +196,7 @@ All five call sites that previously maintained their own script trust enforcemen
 | **Central UI** `ScriptAnalysisService` | Semantic + full compile, lenient threading | Delegates forbidden-API verdict and sources editor-marker deny-list from `ScriptTrustPolicy`; retains Test-Run execution host |
 | **Transport** `BundleImporter.RunSemanticValidationAsync` / `DetectBlockersAsync` | No trust gate — a bundle's forbidden-API scripts imported clean, deferred to runtime (fifth write path) | Runs `ScriptTrustValidator.FindViolations` over every non-Skip template / shared / ApiMethod body, template script + alarm Expression-trigger bodies, **and instance alarm-override trigger expressions** at import review — hard error (apply) / Blocker row (preview) for all kinds |

-The static enforcement is **defence-in-depth**, not a true runtime sandbox. Scripts execute in-process; the denied API list prevents obvious escapes at compile time but does not provide the isolation guarantees of an out-of-process sandbox or a restricted `AssemblyLoadContext`. This caveat applies to all consumers.
+The static enforcement is **defence-in-depth**, not a true runtime sandbox. The denied API list blocks disallowed APIs at compile time but does not establish an operating-system security boundary. Site-runtime consumers execute in-process. Central UI Test Run uses a bounded, killable worker process; that adds resource/lifetime containment, while the worker retains the same operating-system identity and permitted gateway access.

 ---

@@ -51,12 +51,12 @@ Set in a local or docker-dev environment via the environment variable `ScadaBrid
 > intent and is the mechanism for any non-cookie bearer surface (e.g. `/auth/token`), but
 > it is **not** the transport for the cookie principal.

- **Idle timeout**: Configurable, default **30 minutes**. If no requests are made within the idle window, the session is rejected and the user must re-login. Tracked via a `LastActivity` last-activity timestamp claim. The cookie's `ExpireTimeSpan` is set to the idle timeout and `SlidingExpiration` renews it on activity, so the cookie window and the explicit `OnValidatePrincipal` idle check use the **same** value and cannot contradict each other.
- **Role-mapping refresh (LDAP-free)**: Configurable, default **15 minutes** (`SecurityOptions.RoleRefreshThresholdMinutes`). At login the session stores the user's raw LDAP groups (one `zb:group` claim each) plus a `zb:lastrolerefresh` anchor. Once the anchor is older than the threshold, `OnValidatePrincipal` re-runs the **DB-backed** `RoleMapper` on the stored groups — **with no LDAP call** — rebuilds the role/scope claims via the shared claim-builder, advances the anchor, and re-issues the cookie. Central role-mapping (DB) changes — including a **revoked** mapping that drops the user's roles, and changed site-scope rules — take effect within this window. Roles derived from central mappings are never more than ~15 minutes stale.
+- **Idle timeout**: Configurable, default **30 minutes**. Without eligible activity within the idle window, the session is rejected and the user must re-login. Passive `/auth/ping`, activity prevalidation, and Blazor transport requests preserve the activity anchor and suppress sliding renewal; the activity endpoint renews only after authentication and antiforgery validation. Tracked via a `LastActivity` last-activity timestamp claim. The cookie's `ExpireTimeSpan` is set to the idle timeout and `SlidingExpiration` renews it on activity, so the cookie window and the explicit `OnValidatePrincipal` idle check use the **same** value and cannot contradict each other.
+- **Role-mapping refresh (LDAP-free)**: Configurable, default **15 minutes** (`SecurityOptions.RoleRefreshThresholdMinutes`). At login the session stores the user's raw LDAP groups (one `zb:group` claim each) plus a `zb:lastrolerefresh` anchor. Once the anchor is older than the threshold, `OnValidatePrincipal` re-runs the **DB-backed** `RoleMapper` on the stored groups — **with no LDAP call** — rebuilds the role/scope claims via the shared claim-builder, advances the anchor, and re-issues the cookie. Central role-mapping (DB) changes — including a **revoked** mapping that drops the user's roles, and changed site-scope rules — take effect within this window. Ordinary HTTP validation uses this threshold. A live circuit refreshes mappings in fresh scopes on authentication-state reads, and mutation entrypoints require a successful current mapping before dispatch.

 #### Session Validation (`OnValidatePrincipal`)
 - The cookie principal is built at login by a **single shared claim-builder** (`SessionClaimBuilder`). The `OnValidatePrincipal` role-refresh path rebuilds the principal through the **same** builder, so the login and refresh claim shapes cannot drift.
- **Failure policy**: the refresh is best-effort. Any error during the refresh (e.g. the configuration database is unreachable) **keeps the existing principal with its current roles** — it never signs the user out and never throws out of the request pipeline. This mirrors the **Active sessions** stance under *LDAP Connection Failure* below. Only the explicit idle-timeout path rejects the principal.
+- **Failure policy**: ordinary cookie validation and display-state refresh retain existing grants on a mapping lookup error. Authoritative circuit mutation checks fail closed on the same error, so a mutation cannot proceed using grants that could not be refreshed. Idle timeout rejects the principal.

 > **Residual limitation — live LDAP group-membership changes (follow-up).** The
 > mid-session refresh re-maps the **stored** groups against the central database; it does
@@ -66,7 +66,7 @@ Set in a local or docker-dev environment via the environment variable `ScadaBrid
 > shared `ZB.MOM.WW.Auth.Ldap` library, which is an **external NuGet package** and exposes
 > only `AuthenticateAsync(username, password, ct)` (no standalone group search). Adding
 > that method is tracked as a follow-up. Until then: central role-mapping/scope changes are
-> reflected within ~15 minutes; directory group-membership changes require re-login.
+> reflected during HTTP refresh and immediately at circuit mutation checks; directory group-membership changes require re-login.

 ### Load Balancer Compatibility
 - The authentication cookie carries a self-contained JWT — no server-side session state. A load balancer in front of the central cluster can route requests to either node without sticky sessions or a shared session store.
@@ -213,3 +213,7 @@ To blunt online password-spray and brute-force against the directory, every LDAP
 - **Proxy topologies and the username-lockout DoS.** The key is deliberately `{username}|{IP}`, not `{username}` alone: keying on username alone would let any network-adjacent actor lock any operator out of a SCADA control surface with five wrong passwords, repeatable indefinitely. That isolation only exists when the throttle sees real client IPs — behind a proxy **without** ForwardedHeaders trust, all clients collapse onto the proxy's IP and the DoS returns. Mitigations: (a) the shipped Traefik topologies enable trusted-proxy ForwardedHeaders (so per-IP isolation is real in the documented deployment); (b) the lockout window is short by default (`LoginLockoutMinutes` = 5) and never touches the directory account itself; (c) residual risk — an attacker spraying from their *own* IP locking out a victim username *at that IP only* — is the throttle working as designed. A success-path bypass ("a correct password unlocks") was considered and rejected: it would let an attacker who has the password bypass the lockout entirely, and it converts the throttle into a password oracle during the lockout window.
 - **Behaviour when locked**: the surface refuses the bind without contacting LDAP. The Basic-Auth surfaces (`ManagementAuthenticator`) and `POST /auth/token` return HTTP `429` with `code = "AUTH_THROTTLED"`; `POST /auth/login` redirects to `/login` with a "Too many failed attempts. Try again later." message.
 - **Best-effort, per-node**: the throttle is in-memory with no external state. The two central nodes maintain independent counters (a spray hitting both simply burns its budget on each). Memory is bounded — writes prune expired keys and cap the tracked-key count. This is a rate-limit guard, not an account-lockout policy; it never disables the directory account itself.
+
+### Passive traffic and circuit refresh (2026-09-09)
+
+`/auth/ping`, `/auth/activity`, and Blazor transport validation do not advance inactivity timestamps or trigger sliding renewal. The explicit activity endpoint validates antiforgery before renewing the cookie and recording activity by protected session ID. A bounded process-local tracker lets a live circuit observe successful activity renewal. Role refresh preserves the session ID and activity timestamp; current circuit mutation checks re-map stored groups with fail-closed lookup behavior.
@@ -148,6 +148,8 @@ and the mailbox supplies the memory barrier between consecutive passes. The
 daily terminal-row purge uses the same shape. (`NotificationOutboxActor`'s
 dispatch sweep is the in-repo reference.)

+**Stored site ownership is immutable.** Authenticated control-plane requests must claim their verified site in both audit and operational halves. An existing `TrackedOperationId` cannot be advanced by another site even when the incoming packet claims its own site consistently: the SQL upsert rejects the owner mismatch before its monotonic update, including the duplicate-insert retry path. The update predicate independently requires an exact owner match. A rejection rolls back the paired audit/operational ingest transaction and produces no acknowledgment.
+
 **The central upsert is one round trip, INSERT-first.**
 `SiteCallAuditRepository.UpsertAsync` ships both statements in a single command
 text — `IF NOT EXISTS … INSERT;` then the monotonic `UPDATE` — so a packet costs
@@ -213,3 +213,5 @@ Each event entry contains:
 - **Central UI**: Site Event Log Viewer displays queried events.
 - **Store-and-Forward Engine**: Its notification path (the site→central forward of script-generated notifications) reports forward failures and long-buffered notifications as Notification-category events. Routine enqueue and forward-success events are deliberately not logged — central's authoritative `Notifications` table (owned by the Notification Outbox component) is the audit record of record; site-side logging covers only the in-transit blind spot when central is unreachable.
 - **Health Monitoring**: Script error rates and alarm evaluation error rates can be derived from event log data; this component also reports `SiteEventLogWriteFailures`, and its purge is the expected cause of the transient `LocalDbOplogBacklog` spikes described in [Component-HealthMonitoring.md](Component-HealthMonitoring.md) → Monitored Metrics.
+
+Rig settings no longer advertise PurgeScheduleCron. Retention uses PurgeInterval after the previous purge completes, so it is interval-based rather than a fixed wall-clock schedule.
@@ -216,7 +216,7 @@ flowchart TD
 - **Alarm state changes**: `[InstanceUniqueName].[AlarmName]`, alarm state (active/normal), priority, timestamp.

 ### GetAttribute / SetAttribute
- **GetAttribute**: Returns the current in-memory value for the requested attribute.
+- **GetAttribute**: Returns the current in-memory value for the requested attribute. Attribute read/write/wait helper continuations do not capture the calling scheduler (`ConfigureAwait(false)`), so synchronous `Attributes[key]` access can complete even when every script worker is blocked. AsyncLocal trace attribution still flows with execution context.
 - **SetAttribute** (for attributes with data source reference): Sends a write request to the Data Connection Layer. The DCL writes to the physical device. If the write fails (connection down, device rejection, timeout), the error is returned synchronously to the calling script for handling. On success, the existing subscription picks up the confirmed value from the device and sends it back as a value update, which then updates the in-memory value. The in-memory value is **not** optimistically updated.
 - **SetAttribute** (for static attributes): Updates the in-memory value and **persists the override to local SQLite**. On restart (or failover), the Instance Actor loads persisted overrides on top of the deployed configuration, preserving runtime-modified values. A redeployment of the instance resets all persisted overrides to the new deployed configuration values.

@@ -379,6 +379,8 @@ that owns the Instance Actor, and central reads the linkage from audit rows.
 - **`NativeAlarmSourceUnavailable`**: the source connection has dropped. The actor **retains its last-known mirrored conditions** but marks them uncertain rather than purging them, so a transient disconnect does not flap every condition to normal. The set is reconciled against truth by the next reconnect snapshot.

 ### Transition Handling (`NativeAlarmTransitionUpdate`)
+- **Owned subscription cleanup**: Instance Actors send tag unsubscribes for each bound connection in `PostStop`; Native Alarm Actors send their alarm-source unsubscribe with their own actor identity. DCL DeathWatch provides cleanup if an owner terminates without a graceful message. Late cleanup from an old actor cannot remove its same-name replacement.
+- **OPC UA refresh scope**: snapshot start, entries and completion preserve the exact source binding and refresh epoch. Native Alarm Actors ignore unrelated feeds and mismatched/duplicate completion epochs, and discard a partial refresh on source disconnect. MxGateway keeps its connection-wide snapshot framing.
 - **Snapshot / SnapshotComplete (reconnect reconciliation)**: `Snapshot` updates buffer into a staging set; `SnapshotComplete` performs an **atomic swap** of the mirrored set with the staged set. Any condition that was previously mirrored but is **not present** in the new snapshot emits a return-to-normal `AlarmStateChanged` and drops out. This is how the mirror self-corrects after an outage.
 - **Live transitions** (`Raise` / `Ack` / `Clear` / `Retrigger` / `StateChange`): upsert the condition by `SourceReference`. Updates carrying a `TransitionTime` **older** than the currently held transition are ignored (out-of-order protection). Accepted transitions persist to SQLite and emit an enriched `AlarmStateChanged` upward to the Instance Actor.
 - **Retention**: a mirrored condition is dropped once it is both inactive **and** acknowledged (`!Active && Acknowledged`) — the alarm has fully run its course at the source and no longer needs mirroring. The drop emits a final state change and deletes the SQLite row.
@@ -499,12 +501,12 @@ Available to all script runs and alarm on-trigger runs:
 - `Notify.Status("trackedOperationId")` — A thin alias of `Tracking.Status(id)` retained for the notification domain. Returns a status record (status, retry count, last error, key timestamps). While the notification is still in the site store-and-forward buffer the site answers locally (status `Forwarding`); once forwarded the query round-trips to central.

 ### Database Access
- `Database.Connection("connectionName")` — Obtain a raw MS SQL client connection (ADO.NET) for synchronous read/write.
+- `Database.Connection("connectionName")` — Obtain an audited ADO.NET connection for read/write. Commands and synchronous/asynchronous transactions retain the auditing connection on public readback; provider transactions are unwrapped only internally for command assignment. Each command execution emits one audit event, including commands reached through `transaction.Connection` or `command.Connection`. Commit, rollback, savepoints and disposal retain provider semantics.
 - `Database.CachedWrite("connectionName", "sql", parameters)` — Submit a write operation for store-and-forward delivery. Returns a `TrackedOperationId` tracking handle immediately; pass it to `Tracking.Status(id)` to observe delivery progress.

 ### Operation Tracking
 - `Tracking.Status("trackedOperationId")` — Returns a status record (status, retry count, last error, key timestamps) for any tracked operation: a cached external system call, a cached database write, or a notification. For cached calls and writes the answer is always site-local and authoritative — the site owns the operation tracking table. (`Notify.Status(...)` is a thin alias scoped to the notification domain.)
- **Cached-call telemetry is off the script thread (2026-09-06).** A `Database.CachedWrite` / `ExternalSystem.CachedCall` emits three `CachedCallTelemetry` packets (submit, attempted, resolve) through `CachedCallTelemetryForwarder`, each an audit row plus a tracking row. Both halves used to be awaited to commit on the script thread; the audit half was the real cost — `SqliteAuditWriter.WriteAsync` returns the batch completion, and the writer coalesces for `FlushIntervalMs` (50 ms) before committing — so a cached call paid ~160 ms of a 176 ms run for bookkeeping (measured on the rig; now 17 ms). The forwarder now **enqueues the audit row and observes its completion on a fault-logging continuation** (the same pattern every other script-path audit emission already used), and `OperationTrackingStore` is a **single-writer queue**: `RecordEnqueue/Attempt/TerminalAsync` return once the row is *queued*, and one background pump applies each drained batch in one SQLite transaction. Preserved: FIFO order across the three lifecycle rows; **read-your-writes** — `GetStatusAsync` (behind `Tracking.Status`, and the telemetry actor's status join) and `ReadChangedSinceAsync` (central's `PullSiteCalls`) wait for every write queued before them; timestamps are stamped when recorded, not when applied; `PurgeTerminalAsync` returns after the purge lands; `DisposeAsync` drains the queue (the sync `Dispose()` does not — host shutdown uses the async path). Accepted: a row queued but unapplied is lost on a hard crash (milliseconds), leaving the tracking row at its previous state until reconciled; the S&F buffer and audit rows are unaffected. The queue is bounded (8 192) with wait backpressure — it never drops. `FlushAsync()` is the explicit barrier for callers that go to the file directly. **Trap for new audit emitters on a script path:** never `await` `IAuditWriter.WriteAsync` there — it waits for the writer's flush, not the enqueue. Design + measurements: `docs/plans/2026-09-06-tracking-store-async-writes-design.md`.
+- **Cached-call telemetry is off the script thread (2026-09-06).** A `Database.CachedWrite` / `ExternalSystem.CachedCall` emits three `CachedCallTelemetry` packets (submit, attempted, resolve) through `CachedCallTelemetryForwarder`, each an audit row plus a tracking row. Both halves used to be awaited to commit on the script thread; the audit half was the real cost — `SqliteAuditWriter.WriteAsync` returns the batch completion, and the writer coalesces for `FlushIntervalMs` (50 ms) before committing — so a cached call paid ~160 ms of a 176 ms run for bookkeeping (measured on the rig; now 17 ms). The forwarder now **enqueues the audit row and observes its completion on a fault-logging continuation** (the same pattern every other script-path audit emission already used), and `OperationTrackingStore` is a **single-writer queue**: `RecordEnqueue/Attempt/TerminalAsync` return once the row is *queued*, and one background pump applies each drained batch in one SQLite transaction. Preserved: FIFO order across the three lifecycle rows; **read-your-writes** — `GetStatusAsync` (behind `Tracking.Status`, and the telemetry actor's status join) and `ReadChangedSinceAsync` (central's `PullSiteCalls`) wait for every write queued before them; timestamps are stamped when recorded, not when applied; `PurgeTerminalAsync` returns after the purge lands; Both `DisposeAsync` and sync `Dispose()` drain the queue before closing the writer; host shutdown uses the async path. Accepted: a row queued but unapplied is lost on a hard crash (milliseconds), leaving the tracking row at its previous state until reconciled; the S&F buffer and audit rows are unaffected. The queue is bounded (8 192) with wait backpressure — it never drops. `FlushAsync()` is the explicit barrier for callers that go to the file directly. **Trap for new audit emitters on a script path:** never `await` `IAuditWriter.WriteAsync` there — it waits for the writer's flush, not the enqueue. Design + measurements: `docs/plans/2026-09-06-tracking-store-async-writes-design.md`.

 ### Alarm State (read-only)
 - `Alarms.CurrentAsync()` — Returns a snapshot of the instance's **current** alarm conditions as `IReadOnlyList<ScriptAlarm>` (`Commons.Types.Scripts`), covering computed alarms and mirrored native (OPC UA A&C / MxAccess Gateway) conditions alike. Served by a **local Ask** (`GetAlarmSnapshotRequest`/`GetAlarmSnapshotResponse`) to the script's own Instance Actor — the same mechanism attribute reads use, never a cross-cluster hop.
@@ -635,3 +637,12 @@ Per Akka.NET best practices, internal actor communication uses **Tell** (fire-an
 - **Communication Layer**: Receives commands from central, sends deployment results, serves debug view data.
 - **Store-and-Forward Engine**: Scripts route cached writes, notifications, and external system calls here.
 - **Health Monitoring**: Periodically reports error rate metrics.
+
+
+### Medium architecture review lifecycle guarantees (2026-09-09)
+
+- Alarm on-trigger runs resolve the same scoped integration services as ordinary scripts, including external systems, databases, notifications, operation tracking, auditing, and site/node provenance. The scope remains alive for the run and is disposed on every exit.
+- Native alarm subscription retries retain the current correlation ID until its response deadline, reject stale replies, and back off to a bounded interval. Rehydration cannot overwrite a condition touched by a live event, including deletion, or a completed authoritative snapshot.
+- Audited raw ADO connections expose no connection string and reject `ConnectionString` assignment and `ChangeDatabase`; their configured database name remains the audit target.
+- Static override persistence runs in order off the actor dispatcher. Redeployment waits for both predecessor termination and successful final persistence acknowledgement before clearing old state; failed persistence fails the redeployment. At most four redeployment predecessor stops are in progress per deployment manager. Delete and disable retain the same-name stop barrier until the final flush and lifecycle persistence finish; an overlapping deploy/enable is rejected with a retryable busy diagnostic. Timer flushes keep coalescing while a previous SQLite write is pending.
+- Synchronous operation-tracking disposal drains and joins its thread-pool writer before disposing SQLite resources, including when invoked under a synchronization context.
@@ -167,3 +167,6 @@ Each buffered message stores:
 - **Notification Outbox**: The central destination for the notification category — central ingests each forwarded notification into the `Notifications` table and acks the site, on which the engine clears the buffered message.
 - **Site Call Audit**: The central observability sibling for the cached-call categories — this engine emits `CachedCallTelemetry` on every tracking-table transition, answers `CachedCallReconcileRequest` pulls, and executes the `RetryParkedOperation` / `DiscardParkedOperation` commands it relays.
 - **Health Monitoring**: Reports buffer depth metrics, including the notification backlog covering the site→central forward leg.
+
+
+The active-node gate is checked again before each new retry attempt, including after waiting for a target lane. A false or throwing gate abandons the remaining lane without changing retry counters. A delivery already sent at demotion can still finish; downstream idempotency remains necessary for ambiguous outcomes.
@@ -513,3 +513,12 @@ The `manifest.json` file is always present in the ZIP root and is never encrypte
 | `encryption.ivB64` | Base64-encoded 12-byte (GCM standard) random IV generated at export time. |
 | `summary` | Artifact count by type, for display in the import wizard's upload step without needing to decrypt content. Schema 1.1 adds `sites` / `dataConnections` / `instances` counts. |
 | `contents` | Ordered list of all artifacts in the bundle. Order is topological (base templates before derived; sites before their connections and instances). Each entry carries the artifact's name (connections use the site-qualified `{SiteIdentifier}/{Name}`), the schema `version` at export time, and its direct `dependsOn` edges for dependency display in the export wizard's Step 2. T18 adds the `Site`, `DataConnection`, and `Instance` entry `type`s. |
+
+
+### Instance ownership during overwrite
+
+An instance Overwrite may change SiteId only when the existing instance is NotDeployed.
+Other states require an explicit undeploy first; import rejects the operation before replacing
+the instance fields/children and rolls back its database transaction. Same-site overwrite retains
+the existing behavior. Rename targets are checked for global name collisions, and the database
+global unique index also rejects concurrent add/rename collisions as domain conflicts.
@@ -46,10 +46,10 @@

 ### 2.2 Communication: Central ↔ Site
 - Two transport layers are used for central-site communication:
-  - **Akka.NET ClusterClient/ClusterClientReceptionist**: Handles **command/control** messaging — deployments, instance lifecycle commands, subscribe/unsubscribe handshake, debug snapshots, health reports, remote queries, and integration routing. Provides automatic failover between contact points.
-  - **gRPC server-streaming (site→central)**: Handles **real-time data streaming** — attribute value updates and alarm state changes. Each site node hosts a **SiteStreamGrpcServer** on a dedicated HTTP/2 port (Kestrel, default port 8083). Central creates per-site **SiteStreamGrpcClient** instances to subscribe to site streams. gRPC provides HTTP/2 flow control and per-stream backpressure that ClusterClient lacks.
- **Site addressing**: Site Akka base addresses (NodeA and NodeB) and gRPC endpoints (GrpcNodeAAddress and GrpcNodeBAddress) are stored in the **Sites database table** and configured via the Central UI or CLI. Central creates a ClusterClient per site using both Akka addresses as contact points, and per-site gRPC clients using the gRPC addresses.
- **Central contact points**: Sites configure **multiple central contact points** (both central node addresses) for redundancy. ClusterClient handles failover between central nodes automatically.
+  - **Authenticated gRPC command/control**: `SiteCommandService` handles central-to-site lifecycle, snapshots, queries and integration routing. `CentralControlService` handles site-to-central notifications, telemetry, health and reconciliation. Per-site credentials bind the authenticated site to payload ownership. Deployment configuration is fetched over token-gated HTTP.
+  - **gRPC server-streaming (site→central)**: Each site hosts `SiteStreamService` through `SiteStreamGrpcServer` on its HTTP/2 listener. Central subscribes through `SiteStreamGrpcClient` for attribute updates and computed/native alarm state, with flow control and bounded batching.
+- **Site addressing**: The Sites table stores node Akka addresses for cluster identity and gRPC endpoints for application transport. `SitePairChannelProvider` manages gRPC pair selection. Mutations are not replayed after ambiguous response loss; only explicit pre-dispatch rejection permits retry.
+- **Central endpoints**: Sites configure both central gRPC endpoints. Read/idempotent operations can fail over within their deadline; non-idempotent calls preserve outcome uncertainty.
 - **Central as integration hub**: Central brokers requests between external systems and sites. For example, a recipe manager sends a recipe to central, which routes it to the appropriate site. MES requests machine values from central, which routes the request to the site and returns the response.
 - **Real-time data streaming** is not continuous for all machine data. The only real-time stream is an **on-demand debug view** — an engineer in the central UI can open a live view of a specific instance's tag values and alarm states for troubleshooting purposes. This is session-based and temporary. The debug view subscribes via gRPC to the site's SiteStreamManager filtered by instance (see Section 8.1).

@@ -402,7 +402,7 @@ The central cluster hosts a **configuration and management UI** (no live machine
 - **Site Event Log Viewer**: Query and view operational event logs from site clusters (see Section 12).

 ### 8.1 Debug View
- **Subscribe-on-demand**: When an engineer opens a debug view for an instance, central opens a **gRPC server-streaming subscription** to the site's `SiteStreamGrpcServer` for the instance, then requests a **snapshot** of all current attribute values and alarm states via ClusterClient. The gRPC stream delivers subsequent attribute value and alarm state changes directly from the site's `SiteStreamManager`.
+- **Subscribe-on-demand**: When an engineer opens a debug view for an instance, central opens a **gRPC server-streaming subscription** to the site's `SiteStreamGrpcServer` for the instance, then requests a **snapshot** of all current attribute values and alarm states via `SiteCommandService`. The gRPC stream delivers subsequent attribute value and alarm state changes directly from the site's `SiteStreamManager`.
 - Attribute value stream messages are structured as: `[InstanceUniqueName].[AttributePath].[AttributeName]`, attribute value, attribute quality, attribute change timestamp.
 - Alarm state stream messages are structured as: `[InstanceUniqueName].[AlarmName]`, alarm state (active/normal), priority, timestamp.
 - The stream continues until the engineer **closes the debug view**, at which point central unsubscribes and the site stops streaming.
@@ -520,7 +520,7 @@ Sites log operational events locally, including:

 ### 13.1 Management Service
 - The central cluster exposes a **ManagementActor** that provides programmatic access to all administrative operations — the same operations available through the Central UI.
- The ManagementActor registers with Akka.NET **ClusterClientReceptionist** for cross-cluster access, and is also exposed via an HTTP Management API endpoint (`POST /management`) with Basic Auth, LDAP authentication, and role resolution — enabling external tools like the CLI to interact without Akka.NET dependencies.
+- The ManagementActor is reached in-process through `ManagementActorHolder` and exposed via an HTTP Management API endpoint (`POST /management`) with Basic Auth, LDAP authentication, and role resolution — enabling external tools like the CLI to interact without Akka.NET dependencies.
 - The ManagementActor enforces the **same role-based authorization** as the Central UI. Every incoming message carries the authenticated user's identity and roles.
 - All mutating operations performed through the Management Service are **audit logged** via IAuditService, identical to operations performed through the Central UI.
 - The ManagementActor runs on **every central node** (stateless). For HTTP API access, any central node can handle any request without sticky sessions.
@@ -342,7 +342,7 @@ public sealed class GrpcPullAuditEventsInvoker
                KeepAlivePingTimeout = _options.GrpcKeepAlivePingTimeout,
                KeepAlivePingPolicy = HttpKeepAlivePingPolicy.Always,
            },
-        }.WithSiteCredentials(_pskProvider, siteId));
+        }.WithMessageLimits().WithSiteCredentials(_pskProvider, siteId));

    /// <summary>Disposes all cached channels.</summary>
    public void Dispose()
@@ -356,7 +356,7 @@ public sealed class GrpcPullSiteCallsInvoker
                KeepAlivePingTimeout = _options.GrpcKeepAlivePingTimeout,
                KeepAlivePingPolicy = HttpKeepAlivePingPolicy.Always,
            },
-        }.WithSiteCredentials(_pskProvider, siteId));
+        }.WithMessageLimits().WithSiteCredentials(_pskProvider, siteId));

    /// <summary>Disposes all cached channels.</summary>
    public void Dispose()
@@ -209,7 +209,7 @@ public sealed class GrpcPullTraceEventsInvoker : GrpcPullTraceEventsClient.IPull
                KeepAlivePingTimeout = _options.GrpcKeepAlivePingTimeout,
                KeepAlivePingPolicy = HttpKeepAlivePingPolicy.Always,
            },
-        }.WithSiteCredentials(_pskProvider, siteId));
+        }.WithMessageLimits().WithSiteCredentials(_pskProvider, siteId));

    /// <inheritdoc />
    public void Dispose()
@@ -22,7 +22,8 @@ public sealed class PerTargetRedactionOverride
    /// whose name matches are replaced with <c>&lt;redacted&gt;</c>. Null (the
    /// default) means parameter values are captured verbatim. Only applied to
    /// <see cref="ZB.MOM.WW.ScadaBridge.Commons.Types.Enums.AuditChannel.DbOutbound"/>
-    /// rows.
+    /// rows. When configured, free-text SQL errors are suppressed because they can echo
+    /// sensitive parameter values without their names.
    /// </summary>
    public string? RedactSqlParamsMatching { get; set; }

@@ -31,8 +32,9 @@ public sealed class PerTargetRedactionOverride
    /// request/response headers and metadata (status, duration, actor, etc.)
    /// but the request and response body strings are omitted
    /// (<c>RequestSummary</c> / <c>ResponseSummary</c> are left null). The
-    /// audit row itself is always emitted — only the body content is suppressed.
-    /// Null (the default, equivalent to <c>false</c>) means body capture
+    /// audit row itself is still emitted; exception message/detail are also suppressed
+    /// because failures may quote body values.
+    /// The default <c>false</c> means body capture
    /// proceeds normally up to <see cref="AuditLogOptions.InboundMaxBytes"/>.
    /// </summary>
    public bool SkipBodyCapture { get; set; }
@@ -192,6 +192,7 @@ public sealed class ScadaBridgeAuditRedactor : IAuditRedactor, IDisposable
            var request = RedactHeaders(d.RequestSummary, opts.HeaderRedactList);
            var response = RedactHeaders(d.ResponseSummary, opts.HeaderRedactList);
            var errorDetail = d.ErrorDetail;
+            var errorMessage = d.ErrorMessage;
            var extra = d.Extra;

            // --- Body-regex stage (also runs BEFORE truncation) -----------
@@ -211,6 +212,7 @@ public sealed class ScadaBridgeAuditRedactor : IAuditRedactor, IDisposable
                request = RedactBody(request, bodyRegexes);
                response = RedactBody(response, bodyRegexes);
                errorDetail = RedactBody(errorDetail, bodyRegexes);
+                errorMessage = RedactBody(errorMessage, bodyRegexes);
                extra = RedactBody(extra, bodyRegexes);
            }

@@ -223,6 +225,10 @@ public sealed class ScadaBridgeAuditRedactor : IAuditRedactor, IDisposable
                        opts, rawEvent.Target, out var sqlParamRegex, out var sqlRedactorUnavailable))
                {
                    request = RedactSqlParameters(request, sqlParamRegex!);
+                    // Parameter policy matches names, whereas SQL exceptions can echo VALUES.
+                    // Free text cannot be safely filtered with a name regex. Keep status/category.
+                    if (errorMessage is not null) errorMessage = "Database operation failed (sensitive SQL error suppressed)";
+                    if (errorDetail is not null) errorDetail = "<redacted: SQL parameter privacy policy>";
                }
                else if (sqlRedactorUnavailable)
                {
@@ -235,6 +241,7 @@ public sealed class ScadaBridgeAuditRedactor : IAuditRedactor, IDisposable
            request = TruncateField(request, cap, ref truncated);
            response = TruncateField(response, cap, ref truncated);
            errorDetail = TruncateField(errorDetail, cap, ref truncated);
+            errorMessage = TruncateField(errorMessage, cap, ref truncated);
            extra = TruncateField(extra, cap, ref truncated);

            var rewritten = d with
@@ -242,6 +249,7 @@ public sealed class ScadaBridgeAuditRedactor : IAuditRedactor, IDisposable
                RequestSummary = request,
                ResponseSummary = response,
                ErrorDetail = errorDetail,
+                ErrorMessage = errorMessage,
                Extra = extra,
                PayloadTruncated = d.PayloadTruncated || truncated,
            };
@@ -260,6 +260,7 @@ public class SiteAuditTelemetryActor : ReceiveActor
            }

            var batch = new CachedTelemetryBatch();
+            var wireBytes = AuditWireBudget.InitialBytes;
            var emittedEventIds = new List<Guid>(pending.Count);
            // Rows whose operational half can never be built. They are marked
            // Forwarded so they LEAVE this queue — see AbandonUnresolvableAsync
@@ -326,7 +327,7 @@ public class SiteAuditTelemetryActor : ReceiveActor
                }

                var packet = BuildCachedPacket(auditRow, snapshot);
-                batch.Packets.Add(packet);
+                if (!AuditWireBudget.TryAppend(batch.Packets, packet, ref wireBytes, auditRow.EventId.ToString())) break;
                emittedEventIds.Add(auditRow.EventId);
            }

@@ -452,9 +453,10 @@ public class SiteAuditTelemetryActor : ReceiveActor
    private static AuditEventBatch BuildBatch(IReadOnlyList<AuditEvent> events)
    {
        var batch = new AuditEventBatch();
+        var wireBytes = AuditWireBudget.InitialBytes;
        foreach (var e in events)
        {
-            batch.Events.Add(AuditEventDtoMapper.ToDto(e));
+            if (!AuditWireBudget.TryAppend(batch.Events, AuditEventDtoMapper.ToDto(e), ref wireBytes, e.EventId.ToString())) break;
        }
        return batch;
    }
@@ -1,5 +1,6 @@
 using System.CommandLine;
 using System.CommandLine.Parsing;
+using System.Text.Json;
 using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management;

 namespace ZB.MOM.WW.ScadaBridge.CLI.Commands;
@@ -77,16 +78,31 @@ public static class DeployCommands
                // A bulk deploy is N instance round-trips; the default 30 s client
                // timeout would abandon the request while the server is still
                // applying. Matches the server-side long-running Ask window.
-                timeout: BulkDeployTimeout);
+                timeout: BulkDeployTimeout,
+                onSuccess: json => HandleSiteDeploymentResponse(json, CommandHelpers.ResolveFormat(result, formatOption, CliConfig.Load())));
        });
        return cmd;
    }

    /// <summary>
-    /// Client-side timeout for the bulk site deploy, matching the management
-    /// service's long-running command Ask window.
+    /// The server owns the bounded overall bulk deadline; do not abandon it with a shorter client timer.
    /// </summary>
-    internal static readonly TimeSpan BulkDeployTimeout = TimeSpan.FromMinutes(5);
+    internal static readonly TimeSpan BulkDeployTimeout = Timeout.InfiniteTimeSpan;
+
+    internal static int HandleSiteDeploymentResponse(string json, string format)
+    {
+        CommandHelpers.HandleResponse(new ManagementResponse(200, json, null, null), format);
+        try
+        {
+            using var payload = JsonDocument.Parse(json);
+            if (payload.RootElement.TryGetProperty("failureCount", out var failures)
+                && failures.TryGetInt32(out var count) && count >= 0)
+                return count == 0 ? 0 : 1;
+        }
+        catch (JsonException) { }
+        OutputFormatter.WriteError("The server returned an invalid site deployment summary.", "INVALID_RESPONSE");
+        return 1;
+    }

    private static Command BuildArtifacts(Option<string> urlOption, Option<string> formatOption, Option<string> usernameOption, Option<string> passwordOption)
    {
@@ -0,0 +1,6 @@
+namespace ZB.MOM.WW.ScadaBridge.CentralUI.SandboxWorker;
+
+internal static class WorkerProgram
+{
+    public static Task Main() => ScriptAnalysis.SandboxWorkerProtocol.RunWorkerAsync();
+}
@@ -0,0 +1,5 @@
+<Project Sdk="Microsoft.NET.Sdk">
+<PropertyGroup><OutputType>Exe</OutputType><TargetFramework>net10.0</TargetFramework><ImplicitUsings>enable</ImplicitUsings><Nullable>enable</Nullable><TreatWarningsAsErrors>true</TreatWarningsAsErrors></PropertyGroup>
+<ItemGroup><FrameworkReference Include="Microsoft.AspNetCore.App" /></ItemGroup>
+<ItemGroup><ProjectReference Include="../ZB.MOM.WW.ScadaBridge.CentralUI/ZB.MOM.WW.ScadaBridge.CentralUI.csproj" /></ItemGroup>
+</Project>
@@ -1,3 +1,5 @@
+using Microsoft.AspNetCore.Antiforgery;
+using System.Security.Claims;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.Cookies;
 using Microsoft.AspNetCore.Builder;
@@ -198,6 +200,7 @@ public static class AuthEndpoints
        // page. Allowing anonymous access and returning 200/401 ourselves gives
        // the client an unambiguous expiry signal.
        endpoints.MapGet("/auth/ping", HandlePing);
+        endpoints.MapPost("/auth/activity", HandleActivity);

        return endpoints;
    }
@@ -217,6 +220,29 @@ public static class AuthEndpoints
        return Task.CompletedTask;
    }

+    /// <summary>Records real browser input only after authenticating and validating antiforgery.</summary>
+    public static async Task<IResult> HandleActivity(HttpContext context, IAntiforgery antiforgery,
+        SessionActivityTracker tracker, TimeProvider clock)
+    {
+        if (context.User.Identity?.IsAuthenticated != true) return Results.Unauthorized();
+        try { await antiforgery.ValidateRequestAsync(context); }
+        catch (AntiforgeryValidationException) { return Results.BadRequest(); }
+        var now = clock.GetUtcNow();
+        var identity = new ClaimsIdentity((ClaimsIdentity)context.User.Identity);
+        var old = identity.FindFirst(JwtTokenService.LastActivityClaimType);
+        if (old is not null) identity.RemoveClaim(old);
+        identity.AddClaim(new Claim(JwtTokenService.LastActivityClaimType, now.ToString("o")));
+        var principal = new ClaimsPrincipal(identity);
+        // Preserve the login's persistence semantics; renew expiry from this actual interaction.
+        var authenticated = await context.AuthenticateAsync(CookieAuthenticationDefaults.AuthenticationScheme);
+        var properties = authenticated.Properties ?? BuildSignInProperties();
+        properties.IssuedUtc = now;
+        properties.ExpiresUtc = null;
+        await context.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, principal, properties);
+        tracker.Record(principal, now);
+        return Results.NoContent();
+    }
+
    /// <summary>
    /// Builds the <see cref="AuthenticationProperties"/> for the login sign-in.
    /// Deliberately does <b>not</b> set <see cref="AuthenticationProperties.ExpiresUtc"/>.
@@ -12,6 +12,20 @@ namespace ZB.MOM.WW.ScadaBridge.CentralUI.Auth;
 /// </summary>
 public static class ClaimsPrincipalExtensions
 {
+    /// <summary>Gets fresh mutation authority, failing closed on a mapping error.</summary>
+    public static Task<AuthenticationState> GetAuthoritativeStateAsync(this AuthenticationStateProvider provider)
+        => provider is CookieAuthenticationStateProvider cookie
+            ? cookie.GetAuthoritativeStateAsync() : provider.GetAuthenticationStateAsync();
+
+    /// <summary>Checks the current grant before invoking a directly audited application service.</summary>
+    public static async Task<string> RequireRoleAsync(this AuthenticationStateProvider provider, string role)
+    {
+        var principal = (await provider.GetAuthoritativeStateAsync()).User;
+        if (principal.Identity?.IsAuthenticated != true || !principal.HasClaim(JwtTokenService.RoleClaimType, role))
+            throw new UnauthorizedAccessException($"The current session requires the {role} role.");
+        return principal.GetUsername();
+    }
+
    /// <summary>Fallback returned when no username claim is present.</summary>
    public const string UnknownUser = "unknown";

@@ -1,48 +1,71 @@
+using Microsoft.Extensions.Options;
+using ZB.MOM.WW.ScadaBridge.Security.Auth;
 using System.Security.Claims;
+using Microsoft.AspNetCore.Authentication.Cookies;
 using Microsoft.AspNetCore.Components.Authorization;
 using Microsoft.AspNetCore.Components.Server;
 using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.DependencyInjection;
+using ZB.MOM.WW.ScadaBridge.Security;

 namespace ZB.MOM.WW.ScadaBridge.CentralUI.Auth;

 /// <summary>
-/// Bridges ASP.NET Core cookie authentication with Blazor Server's auth state.
-/// <para>
-/// The cookie middleware validates and decrypts the cookie during the initial
-/// HTTP request that establishes the Blazor circuit. This provider is registered
-/// <c>Scoped</c>, so it is constructed within that request's DI scope while
-/// <see cref="IHttpContextAccessor.HttpContext"/> is still valid. We snapshot
-/// the authenticated principal <b>once</b> in the constructor and serve that
-/// snapshot for the lifetime of the circuit.
-/// </para>
-/// <para>
-/// We must NOT read <see cref="IHttpContextAccessor"/> on every
-/// <see cref="GetAuthenticationStateAsync"/> call: for the
-/// lifetime of a long-lived SignalR circuit <c>HttpContext</c> is <c>null</c>
-/// (or, worse, a stale/foreign context), so a later re-evaluation —
-/// e.g. <c>&lt;AuthorizeView&gt;</c> re-rendering — would otherwise see an
-/// unauthenticated principal and render the wrong UI.
-/// </para>
+/// Captures the circuit identity once, then revalidates its stored groups and session
+/// against current server state. Fresh scopes avoid sharing the circuit's DbContext.
+/// Never reads IHttpContextAccessor after construction.
 /// </summary>
 public class CookieAuthenticationStateProvider : ServerAuthenticationStateProvider
 {
-    private readonly Task<AuthenticationState> _circuitAuthState;
+    private AuthenticationState _state;
+    private readonly IServiceScopeFactory? _scopes;
+    private readonly bool _autoLogin;
+    private readonly SemaphoreSlim _gate = new(1, 1);

-    /// <summary>
-    /// Snapshots the authenticated principal from the current HTTP context for use throughout the circuit lifetime.
-    /// </summary>
-    /// <param name="httpContextAccessor">Accessor used to read the initial HTTP context principal.</param>
-    public CookieAuthenticationStateProvider(IHttpContextAccessor httpContextAccessor)
+    /// <summary>Captures identity and the factory used for subsequent server-side revalidation.</summary>
+    public CookieAuthenticationStateProvider(IHttpContextAccessor httpContextAccessor, IServiceScopeFactory? scopes = null, IOptions<AuthDisableLoginOptions>? autoLogin = null)
    {
-        // Snapshot the principal at circuit-construction time. HttpContext is
-        // valid here (initial HTTP request) and will not be afterwards.
-        var user = httpContextAccessor.HttpContext?.User
-            ?? new ClaimsPrincipal(new ClaimsIdentity());
-
-        _circuitAuthState = Task.FromResult(new AuthenticationState(user));
+        _state = new AuthenticationState(httpContextAccessor.HttpContext?.User ?? new ClaimsPrincipal(new ClaimsIdentity()));
+        _scopes = scopes;
+        // Trusted startup configuration, already checked by DisableLoginGuard. The
+        // auto-login handler deliberately uses the Cookies scheme with no LDAP groups.
+        _autoLogin = autoLogin?.Value.DisableLogin == true;
    }

    /// <inheritdoc />
-    public override Task<AuthenticationState> GetAuthenticationStateAsync()
-        => _circuitAuthState;
+    public override Task<AuthenticationState> GetAuthenticationStateAsync() => RefreshAsync(failClosed: false);
+
+    /// <summary>Requires a current mapping before a mutation; mapping faults deny rather than reuse old grants.</summary>
+    public Task<AuthenticationState> GetAuthoritativeStateAsync() => RefreshAsync(failClosed: true);
+
+    private async Task<AuthenticationState> RefreshAsync(bool failClosed)
+    {
+        if (_autoLogin || _scopes is null || _state.User.Identity?.AuthenticationType != CookieAuthenticationDefaults.AuthenticationScheme)
+            return _state;
+        AuthenticationState state;
+        bool changed;
+        await _gate.WaitAsync();
+        try
+        {
+            using var scope = _scopes.CreateScope();
+            var validator = scope.ServiceProvider.GetRequiredService<CookieSessionValidator>();
+            var result = await validator.ValidateAsync(_state.User, recordActivity: false, forceRefresh: true, failClosed: failClosed);
+            var user = result.Action switch
+            {
+                SessionValidationAction.Replace => result.Principal!,
+                SessionValidationAction.Reject => new ClaimsPrincipal(new ClaimsIdentity()),
+                _ => _state.User,
+            };
+            changed = Authority(_state.User) != Authority(user);
+            _state = state = new AuthenticationState(user);
+        }
+        finally { _gate.Release(); }
+        if (changed) NotifyAuthenticationStateChanged(Task.FromResult(state));
+        return state;
+    }
+
+    private static string Authority(ClaimsPrincipal principal)
+        => principal.Identity?.IsAuthenticated + "|" + string.Join("|", principal.Claims
+            .Where(c => c.Type == JwtTokenService.RoleClaimType || c.Type == JwtTokenService.SiteIdClaimType)
+            .Select(c => c.Type + "=" + c.Value).OrderBy(x => x, StringComparer.Ordinal));
 }
@@ -37,7 +37,6 @@ namespace ZB.MOM.WW.ScadaBridge.CentralUI.Auth;
 public sealed class SiteScopeService
 {
    private readonly AuthenticationStateProvider _authStateProvider;
-    private (bool IsSystemWide, IReadOnlySet<int> Sites)? _cached;

    /// <summary>Initializes a new instance of <see cref="SiteScopeService"/>.</summary>
    /// <param name="authStateProvider">The Blazor authentication state provider used to read the current user's claims.</param>
@@ -92,10 +91,7 @@ public sealed class SiteScopeService

    private async Task<(bool IsSystemWide, IReadOnlySet<int> Sites)> ResolveAsync()
    {
-        if (_cached is { } cached)
-            return cached;
-
-        var state = await _authStateProvider.GetAuthenticationStateAsync();
+        var state = await _authStateProvider.GetAuthoritativeStateAsync();

        // Administrator => system-wide, whatever SiteId claims are present. Read
        // the role CLAIM rather than IsInRole: the principal's role claim type is
@@ -103,6 +99,9 @@ public sealed class SiteScopeService
        // by SessionClaimBuilder, and the comparison is OrdinalIgnoreCase to match
        // ManagementActor's — IsInRole compares claim VALUES ordinally, which would
        // make the two sides disagree on a differently-cased role name.
+        if (state.User.Identity?.IsAuthenticated != true)
+            return (false, new HashSet<int>());
+
        var isAdministrator = state.User
            .FindAll(JwtTokenService.RoleClaimType)
            .Any(c => string.Equals(c.Value, Roles.Administrator, StringComparison.OrdinalIgnoreCase));
@@ -126,7 +125,6 @@ public sealed class SiteScopeService
        // unrestricted deployer (this service is the sole
        // site-scoping mechanism — there is no separate handler to mirror).
        var result = (IsSystemWide: isAdministrator || ids.Count == 0, Sites: (IReadOnlySet<int>)ids);
-        _cached = result;
        return result;
    }
 }
@@ -1,3 +1,5 @@
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Auth
+@inject Microsoft.AspNetCore.Components.Authorization.AuthenticationStateProvider MutationAuth
@using Microsoft.AspNetCore.Components.Authorization
@using ZB.MOM.WW.ScadaBridge.CentralUI.Components.Shared
@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
@@ -92,7 +94,7 @@

        try
        {
-            var actor = await ResolveActorAsync();
+            var actor = await MutationAuth.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Administrator);

            if (IsSite)
            {
@@ -1,3 +1,5 @@
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Auth
+@inject Microsoft.AspNetCore.Components.Authorization.AuthenticationStateProvider MutationAuth
@page "/admin/api-keys/create"
@page "/admin/api-keys/{KeyId}/edit"
@using ZB.MOM.WW.ScadaBridge.Security
@@ -187,6 +189,7 @@

        try
        {
+            await MutationAuth.RequireRoleAsync(Roles.Administrator);
            if (_editingKey != null)
            {
                // Edit: name is fixed; only the method-scope set is mutable.
@@ -1,3 +1,5 @@
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Auth
+@inject Microsoft.AspNetCore.Components.Authorization.AuthenticationStateProvider MutationAuth
@page "/admin/api-keys"
@using ZB.MOM.WW.ScadaBridge.Security
@using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Security
@@ -151,6 +153,7 @@
        {
            var newEnabled = !key.Enabled;
            // The seam persists; there is no separate SaveChangesAsync.
+            await MutationAuth.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Administrator);
            var ok = await ApiKeyAdmin.SetEnabledAsync(key.KeyId, newEnabled);
            if (!ok)
            {
@@ -177,6 +180,7 @@

        try
        {
+            await MutationAuth.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Administrator);
            var ok = await ApiKeyAdmin.DeleteAsync(key.KeyId);
            if (!ok)
            {
@@ -1,3 +1,6 @@
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
+@using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management
+@inject IServiceProvider MutationServices
@page "/admin/ldap-mappings/create"
@page "/admin/ldap-mappings/{Id:int}/edit"
@using ZB.MOM.WW.ScadaBridge.Commons.Entities.Security
@@ -163,19 +166,9 @@

        try
        {
-            if (_editingMapping != null)
-            {
-                _editingMapping.LdapGroupName = _formGroupName.Trim();
-                _editingMapping.Role = _formRole;
-                await SecurityRepository.UpdateMappingAsync(_editingMapping);
-            }
-            else
-            {
-                var mapping = new LdapGroupMapping(_formGroupName.Trim(), _formRole);
-                await SecurityRepository.AddMappingAsync(mapping);
-            }
-
-            await SecurityRepository.SaveChangesAsync();
+            await MutationServices.ExecuteConfigurationAsync(_editingMapping is not null
+                ? new UpdateRoleMappingCommand(_editingMapping.Id, _formGroupName.Trim(), _formRole)
+                : new CreateRoleMappingCommand(_formGroupName.Trim(), _formRole));
            NavigationManager.NavigateTo("/admin/ldap-mappings");
        }
        catch (Exception ex)
@@ -196,9 +189,7 @@

        try
        {
-            var rule = new SiteScopeRule { LdapGroupMappingId = Id!.Value, SiteId = _scopeRuleSiteId };
-            await SecurityRepository.AddScopeRuleAsync(rule);
-            await SecurityRepository.SaveChangesAsync();
+            await MutationServices.ExecuteConfigurationAsync(new AddScopeRuleCommand(Id!.Value, _scopeRuleSiteId));
            _scopeRules = (await SecurityRepository.GetScopeRulesForMappingAsync(Id.Value)).ToList();
            _scopeRuleSiteId = 0;
        }
@@ -219,8 +210,7 @@

        try
        {
-            await SecurityRepository.DeleteScopeRuleAsync(rule.Id);
-            await SecurityRepository.SaveChangesAsync();
+            await MutationServices.ExecuteConfigurationAsync(new DeleteScopeRuleCommand(rule.Id));
            _scopeRules = (await SecurityRepository.GetScopeRulesForMappingAsync(Id!.Value)).ToList();
        }
        catch (Exception ex)
@@ -1,3 +1,6 @@
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
+@using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management
+@inject IServiceProvider MutationServices
@page "/admin/ldap-mappings"
@attribute [Authorize(Policy = AuthorizationPolicies.RequireAdmin)]
@using ZB.MOM.WW.ScadaBridge.Commons.Entities.Security
@@ -143,14 +146,7 @@
    {
        try
        {
-            // Also delete scope rules for this mapping
-            var rules = await SecurityRepository.GetScopeRulesForMappingAsync(id);
-            foreach (var rule in rules)
-            {
-                await SecurityRepository.DeleteScopeRuleAsync(rule.Id);
-            }
-            await SecurityRepository.DeleteMappingAsync(id);
-            await SecurityRepository.SaveChangesAsync();
+            await MutationServices.ExecuteConfigurationAsync(new DeleteRoleMappingCommand(id));
            await LoadDataAsync();
        }
        catch (Exception ex)
@@ -1,3 +1,6 @@
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
+@using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management
+@inject IServiceProvider MutationServices
@page "/admin/sites/create"
@page "/admin/sites/{Id:int}/edit"
@using ZB.MOM.WW.ScadaBridge.Security
@@ -158,35 +161,16 @@

        try
        {
-            if (_editingSite != null)
+            if (_editingSite is null && string.IsNullOrWhiteSpace(_formIdentifier))
            {
-                _editingSite.Name = _formName.Trim();
-                _editingSite.Description = _formDescription?.Trim();
-                _editingSite.NodeAAddress = _formNodeAAddress?.Trim();
-                _editingSite.NodeBAddress = _formNodeBAddress?.Trim();
-                _editingSite.GrpcNodeAAddress = _formGrpcNodeAAddress?.Trim();
-                _editingSite.GrpcNodeBAddress = _formGrpcNodeBAddress?.Trim();
-                await SiteRepository.UpdateSiteAsync(_editingSite);
+                _formError = "Identifier is required.";
+                return;
            }
-            else
-            {
-                if (string.IsNullOrWhiteSpace(_formIdentifier))
-                {
-                    _formError = "Identifier is required.";
-                    return;
-                }
-                var site = new Site(_formName.Trim(), _formIdentifier.Trim())
-                {
-                    Description = _formDescription?.Trim(),
-                    NodeAAddress = _formNodeAAddress?.Trim(),
-                    NodeBAddress = _formNodeBAddress?.Trim(),
-                    GrpcNodeAAddress = _formGrpcNodeAAddress?.Trim(),
-                    GrpcNodeBAddress = _formGrpcNodeBAddress?.Trim()
-                };
-                await SiteRepository.AddSiteAsync(site);
-            }
-
-            await SiteRepository.SaveChangesAsync();
+            await MutationServices.ExecuteConfigurationAsync(_editingSite is not null
+                ? new UpdateSiteCommand(_editingSite.Id, _formName.Trim(), _formDescription?.Trim(),
+                    _formNodeAAddress?.Trim(), _formNodeBAddress?.Trim(), _formGrpcNodeAAddress?.Trim(), _formGrpcNodeBAddress?.Trim())
+                : new CreateSiteCommand(_formName.Trim(), _formIdentifier.Trim(), _formDescription?.Trim(),
+                    _formNodeAAddress?.Trim(), _formNodeBAddress?.Trim(), _formGrpcNodeAAddress?.Trim(), _formGrpcNodeBAddress?.Trim()));
            CommunicationService.RefreshSiteAddresses();
            NavigationManager.NavigateTo("/admin/sites");
        }
@@ -1,3 +1,6 @@
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
+@using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management
+@inject IServiceProvider MutationServices
@* Reference pattern for list pages: card grid (col-lg-6) + flex header + search filter + kebab dropdown + Bootstrap collapse for noisy detail + @key on iterated cards + "No X match the filter." inline + empty-state CTA. Mirror this when building new list pages. *@
@page "/admin/sites"
@using ZB.MOM.WW.ScadaBridge.Security
@@ -165,7 +168,7 @@
    // CentralUI-024: delegates to the shared helper so the claim type stays
    // resolved through JwtTokenService rather than a duplicated magic string.
    private Task<string> GetCurrentUserAsync()
-        => AuthStateProvider.GetCurrentUsernameAsync();
+        => AuthStateProvider.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Administrator);

    private List<Site> _sites = new();
    private Dictionary<int, List<DataConnection>> _siteConnections = new();
@@ -221,8 +224,7 @@

        try
        {
-            await SiteRepository.DeleteSiteAsync(site.Id);
-            await SiteRepository.SaveChangesAsync();
+            await MutationServices.ExecuteConfigurationAsync(new DeleteSiteCommand(site.Id));
            CommunicationService.RefreshSiteAddresses();
            _toast.ShowSuccess($"Site '{site.Name}' deleted.");
            await LoadDataAsync();
@@ -1,3 +1,7 @@
+@using Microsoft.Extensions.DependencyInjection
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
+@using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management
+@inject IServiceProvider MutationServices
@page "/deployment/instances/{Id:int}/configure"
@using ZB.MOM.WW.ScadaBridge.Security
@using ZB.MOM.WW.ScadaBridge.Commons.Entities.Instances
@@ -5,14 +9,12 @@
@using ZB.MOM.WW.ScadaBridge.Commons.Entities.Templates
@using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Protocol
@using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories
-@using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management
@using ZB.MOM.WW.ScadaBridge.Commons.Types
@using ZB.MOM.WW.ScadaBridge.Commons.Types.Enums
@using ZB.MOM.WW.ScadaBridge.TemplateEngine.Flattening
@using ZB.MOM.WW.ScadaBridge.TemplateEngine.Services
@using ZB.MOM.WW.ScadaBridge.DeploymentManager
@using ZB.MOM.WW.ScadaBridge.CentralUI.Components.Dialogs
-@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
@using ZB.MOM.WW.ScadaBridge.Commons.Types.Flattening
@attribute [Authorize(Policy = AuthorizationPolicies.RequireDeployment)]
@inject ITemplateEngineRepository TemplateEngineRepository
@@ -963,8 +965,14 @@

    // CentralUI-024: delegates to the shared helper so the claim type stays
    // resolved through JwtTokenService rather than a duplicated magic string.
-    private Task<string> GetCurrentUserAsync()
-        => AuthStateProvider.GetCurrentUsernameAsync();
+    private async Task<string> GetCurrentUserAsync()
+    {
+        var user = await AuthStateProvider.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Deployer);
+        var current = await TemplateEngineRepository.GetInstanceByIdAsync(Id);
+        if (current is null || !await SiteScope.IsSiteAllowedAsync(current.SiteId))
+            throw new UnauthorizedAccessException("The instance is outside your current site scope.");
+        return user;
+    }

    // ── Bindings ────────────────────────────────────────────

@@ -1243,7 +1251,7 @@
                    _bindingOverrides.GetValueOrDefault(kv.Key)))
                .ToList();
            var user = await GetCurrentUserAsync();
-            var result = await InstanceService.SetConnectionBindingsAsync(Id, bindings, user);
+            var result = await MutationServices.GetRequiredService<ConfigurationCommandService>().ExecuteInstanceAsync(Id, null, (instanceService, currentUser) => instanceService.SetConnectionBindingsAsync(Id, bindings, currentUser));
            if (result.IsSuccess)
            {
                SnapshotSavedBindingState();
@@ -1323,8 +1331,7 @@
        {
            if (_existingOverrides.TryGetValue(attrName, out var ovr))
            {
-                await TemplateEngineRepository.DeleteInstanceAttributeOverrideAsync(ovr.Id);
-                await TemplateEngineRepository.SaveChangesAsync();
+                await MutationServices.ExecuteConfigurationAsync(new DeleteInstanceAttributeOverrideCommand(Id, attrName));
                _existingOverrides.Remove(attrName);
            }
            _overrideValues.Remove(attrName);
@@ -1377,7 +1384,7 @@
            var failures = new List<string>();
            foreach (var (attrName, value) in toSave)
            {
-                var result = await InstanceService.SetAttributeOverrideAsync(Id, attrName, value, user);
+                var result = await MutationServices.GetRequiredService<ConfigurationCommandService>().ExecuteInstanceAsync(Id, null, (instanceService, currentUser) => instanceService.SetAttributeOverrideAsync(Id, attrName, value, currentUser));
                if (result.IsSuccess)
                    _existingOverrides[attrName] = result.Value!;
                else
@@ -1454,7 +1461,7 @@
            var failures = new List<string>();
            foreach (var (attrName, value) in outcome.Overrides)
            {
-                var result = await InstanceService.SetAttributeOverrideAsync(Id, attrName, value, user);
+                var result = await MutationServices.GetRequiredService<ConfigurationCommandService>().ExecuteInstanceAsync(Id, null, (instanceService, currentUser) => instanceService.SetAttributeOverrideAsync(Id, attrName, value, currentUser));
                if (result.IsSuccess)
                {
                    _existingOverrides[attrName] = result.Value!;
@@ -1622,7 +1629,7 @@
            {
                if (_existingAlarmOverrides.ContainsKey(alarmName))
                {
-                    var del = await InstanceService.DeleteAlarmOverrideAsync(Id, alarmName, user);
+                    var del = await MutationServices.GetRequiredService<ConfigurationCommandService>().ExecuteInstanceAsync(Id, null, (instanceService, currentUser) => instanceService.DeleteAlarmOverrideAsync(Id, alarmName, currentUser));
                    if (!del.IsSuccess)
                    {
                        _editingError = del.Error;
@@ -1639,8 +1646,8 @@
            }
            else
            {
-                var result = await InstanceService.SetAlarmOverrideAsync(
-                    Id, alarmName, overrideJson, priority, user);
+                var result = await MutationServices.GetRequiredService<ConfigurationCommandService>().ExecuteInstanceAsync(Id, null, (instanceService, currentUser) => instanceService.SetAlarmOverrideAsync(
+                    Id, alarmName, overrideJson, priority, currentUser));
                if (!result.IsSuccess)
                {
                    _editingError = result.Error;
@@ -1675,7 +1682,7 @@
        try
        {
            var user = await GetCurrentUserAsync();
-            var result = await InstanceService.DeleteAlarmOverrideAsync(Id, alarmName, user);
+            var result = await MutationServices.GetRequiredService<ConfigurationCommandService>().ExecuteInstanceAsync(Id, null, (instanceService, currentUser) => instanceService.DeleteAlarmOverrideAsync(Id, alarmName, currentUser));
            if (result.IsSuccess)
            {
                _existingAlarmOverrides.Remove(alarmName);
@@ -1718,7 +1725,6 @@
            }

            await UpsertNativeOverrideCore(sourceName, conn, sref, filt);
-            await TemplateEngineRepository.SaveChangesAsync();
            _toast.ShowSuccess($"Saved native alarm source override on '{sourceName}'.");
        }
        catch (Exception ex)
@@ -1751,27 +1757,8 @@
    /// </summary>
    private async Task UpsertNativeOverrideCore(string sourceName, string? conn, string? sref, string? filt)
    {
-        var existing = await TemplateEngineRepository.GetNativeAlarmSourceOverrideAsync(Id, sourceName);
-        if (existing == null)
-        {
-            var ovr = new InstanceNativeAlarmSourceOverride(sourceName)
-            {
-                InstanceId = Id,
-                ConnectionNameOverride = conn,
-                SourceReferenceOverride = sref,
-                ConditionFilterOverride = filt
-            };
-            await TemplateEngineRepository.AddInstanceNativeAlarmSourceOverrideAsync(ovr);
-            _existingNativeOverrides[sourceName] = ovr;
-        }
-        else
-        {
-            existing.ConnectionNameOverride = conn;
-            existing.SourceReferenceOverride = sref;
-            existing.ConditionFilterOverride = filt;
-            await TemplateEngineRepository.UpdateInstanceNativeAlarmSourceOverrideAsync(existing);
-            _existingNativeOverrides[sourceName] = existing;
-        }
+        var result = await MutationServices.ExecuteConfigurationAsync(new SetInstanceNativeAlarmSourceOverrideCommand(Id, sourceName, conn, sref, filt));
+        if (result is InstanceNativeAlarmSourceOverride saved) _existingNativeOverrides[sourceName] = saved;

        // Keep the inline editor showing what was just persisted.
        _nasConnEdit[sourceName] = conn;
@@ -1781,12 +1768,7 @@

    private async Task ClearNativeOverrideCore(string sourceName)
    {
-        var existing = await TemplateEngineRepository.GetNativeAlarmSourceOverrideAsync(Id, sourceName);
-        if (existing != null)
-        {
-            await TemplateEngineRepository.DeleteInstanceNativeAlarmSourceOverrideAsync(existing.Id);
-            await TemplateEngineRepository.SaveChangesAsync();
-        }
+        await MutationServices.ExecuteConfigurationAsync(new DeleteInstanceNativeAlarmSourceOverrideCommand(Id, sourceName));
        _existingNativeOverrides.Remove(sourceName);
        _nasConnEdit[sourceName] = null;
        _nasRefEdit[sourceName] = null;
@@ -1849,17 +1831,9 @@
                return;
            }

-            // Every row was validated up front, so the batch applies as a unit through
-            // the same repository upsert/clear the inline editor uses.
-            foreach (var row in outcome.Rows)
-            {
-                if (row.IsClear)
-                    await ClearNativeOverrideCore(row.SourceName);
-                else
-                    await UpsertNativeOverrideCore(
-                        row.SourceName, row.Connection, row.SourceReference, row.Filter);
-            }
-            await TemplateEngineRepository.SaveChangesAsync();
+            await MutationServices.ExecuteConfigurationAsync(new SetInstanceNativeAlarmSourceOverridesCommand(Id,
+                outcome.Rows.Select(row => new NativeAlarmSourceOverrideEntry(row.SourceName, row.Connection, row.SourceReference, row.Filter)).ToList()));
+            await OnInitializedAsync();

            _nasCsvImportSucceeded = true;
            _nasCsvImportResult = $"Imported {outcome.Rows.Count} native alarm source override(s).";
@@ -1957,7 +1931,7 @@
        try
        {
            var user = await GetCurrentUserAsync();
-            var result = await InstanceService.AssignToAreaAsync(Id, _reassignAreaId == 0 ? null : _reassignAreaId, user);
+            var result = await MutationServices.GetRequiredService<ConfigurationCommandService>().ExecuteInstanceAsync(Id, null, (instanceService, currentUser) => instanceService.AssignToAreaAsync(Id, _reassignAreaId == 0 ? null : _reassignAreaId, currentUser));
            if (result.IsSuccess)
            {
                _areaName = _siteAreas.FirstOrDefault(a => a.Id == _reassignAreaId)?.Name ?? "";
@@ -1,3 +1,5 @@
+@using Microsoft.Extensions.DependencyInjection
+@inject IServiceProvider MutationServices
@page "/deployment/instances/create"
@using ZB.MOM.WW.ScadaBridge.Security
@using ZB.MOM.WW.ScadaBridge.Commons.Entities.Instances
@@ -324,8 +326,8 @@
        try
        {
            user = await GetCurrentUserAsync();
-            var result = await InstanceService.CreateInstanceAsync(
-                _createName.Trim(), _createTemplateId, _createSiteId, _createAreaId == 0 ? null : _createAreaId, user);
+            var result = await MutationServices.GetRequiredService<ConfigurationCommandService>().ExecuteInstanceAsync(null, _createSiteId, (instanceService, currentUser) => instanceService.CreateInstanceAsync(
+                _createName.Trim(), _createTemplateId, _createSiteId, _createAreaId == 0 ? null : _createAreaId, currentUser));
            if (result.IsFailure)
            {
                _formError = result.Error;
@@ -355,7 +357,7 @@
        string? bindError = null;
        try
        {
-            var bind = await InstanceService.SetConnectionBindingsAsync(id, bindings, user);
+            var bind = await MutationServices.GetRequiredService<ConfigurationCommandService>().ExecuteInstanceAsync(id, null, (instanceService, currentUser) => instanceService.SetConnectionBindingsAsync(id, bindings, currentUser));
            if (bind.IsFailure) bindError = bind.Error;
        }
        catch (Exception ex)
@@ -378,7 +380,7 @@
    // CentralUI-024: delegates to the shared helper so the claim type stays
    // resolved through JwtTokenService rather than a duplicated magic string.
    private Task<string> GetCurrentUserAsync()
-        => AuthStateProvider.GetCurrentUsernameAsync();
+        => AuthStateProvider.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Deployer);

    /// <summary>
    /// Opens the folder-tree template picker. A pick clears any dangling-id hint and
@@ -1,3 +1,6 @@
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
+@using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management
+@inject IServiceProvider MutationServices
@page "/deployment/topology"
@page "/deployment/instances"
@using ZB.MOM.WW.ScadaBridge.Security
@@ -705,8 +708,7 @@
            return;
        }

-        var user = await GetCurrentUserAsync();
-        var result = await AreaService.UpdateAreaAsync(node.EntityId, _renameBuffer.Trim(), user);
+        var result = await ExecuteConfigurationAsync<Area>(new UpdateAreaCommand(node.EntityId, _renameBuffer.Trim()));
        if (result.IsSuccess)
        {
            CancelRename();
@@ -765,8 +767,7 @@
        if (req.SiteId == 0) { _createAreaError = "Select a site."; return; }
        if (string.IsNullOrWhiteSpace(req.Name)) { _createAreaError = "Area name is required."; return; }

-        var user = await GetCurrentUserAsync();
-        var result = await AreaService.CreateAreaAsync(req.Name, req.SiteId, req.ParentAreaId, user);
+        var result = await ExecuteConfigurationAsync<Area>(new CreateAreaCommand(req.SiteId, req.Name, req.ParentAreaId));
        if (result.IsSuccess)
        {
            _showCreateAreaDialog = false;
@@ -800,8 +801,7 @@
    private async Task SubmitMoveArea((int AreaId, int? NewParentId) req)
    {
        _moveAreaError = null;
-        var user = await GetCurrentUserAsync();
-        var result = await AreaService.MoveAreaAsync(req.AreaId, req.NewParentId, user);
+        var result = await ExecuteConfigurationAsync<Area>(new MoveAreaCommand(req.AreaId, req.NewParentId));
        if (result.IsSuccess)
        {
            _showMoveAreaDialog = false;
@@ -836,8 +836,7 @@
    private async Task SubmitMoveInstance((int InstanceId, int? NewAreaId) req)
    {
        _moveInstanceError = null;
-        var user = await GetCurrentUserAsync();
-        var result = await InstanceService.AssignToAreaAsync(req.InstanceId, req.NewAreaId, user);
+        var result = await ExecuteConfigurationAsync<Instance>(new SetInstanceAreaCommand(req.InstanceId, req.NewAreaId));
        if (result.IsSuccess)
        {
            _showMoveInstanceDialog = false;
@@ -860,8 +859,7 @@
        if (!confirmed) return;

        _actionInProgress = true;
-        var user = await GetCurrentUserAsync();
-        var result = await AreaService.DeleteAreaAsync(node.EntityId, user);
+        var result = await ExecuteConfigurationAsync<bool>(new DeleteAreaCommand(node.EntityId));
        if (result.IsSuccess)
        {
            _toast.ShowSuccess($"Area '{node.Label}' deleted.");
@@ -885,7 +883,8 @@
        _actionInProgress = true;
        try
        {
-            var user = await GetCurrentUserAsync();
+            var user = await GetCurrentUserAsync(inst.Id);
+            if (user is null) return;
            var result = await DeploymentService.DeleteInstanceAsync(inst.Id, user);
            if (result.IsSuccess)
            {
@@ -910,7 +909,8 @@
        _actionInProgress = true;
        try
        {
-            var user = await GetCurrentUserAsync();
+            var user = await GetCurrentUserAsync(inst.Id);
+            if (user is null) return;
            var result = await DeploymentService.EnableInstanceAsync(inst.Id, user);
            if (result.IsSuccess)
            {
@@ -941,7 +941,8 @@
        _actionInProgress = true;
        try
        {
-            var user = await GetCurrentUserAsync();
+            var user = await GetCurrentUserAsync(inst.Id);
+            if (user is null) return;
            var result = await DeploymentService.DisableInstanceAsync(inst.Id, user);
            if (result.IsSuccess)
            {
@@ -965,7 +966,8 @@
        _actionInProgress = true;
        try
        {
-            var user = await GetCurrentUserAsync();
+            var user = await GetCurrentUserAsync(inst.Id);
+            if (user is null) return;
            var result = await DeploymentService.DeployInstanceAsync(inst.Id, user);
            if (result.IsSuccess)
            {
@@ -1239,6 +1241,35 @@

    // CentralUI-024: delegates to the shared helper so the claim type stays
    // resolved through JwtTokenService rather than a duplicated magic string.
-    private Task<string> GetCurrentUserAsync()
-        => AuthStateProvider.GetCurrentUsernameAsync();
+    private async Task<string?> GetCurrentUserAsync(int instanceId)
+    {
+        var user = await AuthStateProvider.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Deployer);
+        // Re-fetch outside the circuit tracker: the instance may have moved since rendering.
+        using var scope = ScopeFactory.CreateScope();
+        var repository = scope.ServiceProvider.GetRequiredService<ITemplateEngineRepository>();
+        var instance = await repository.GetInstanceByIdAsync(instanceId);
+        if (instance is null || !await SiteScope.IsSiteAllowedAsync(instance.SiteId))
+        {
+            _toast.ShowError("This instance is no longer available within your permitted sites.");
+            _actionInProgress = false;
+            return null;
+        }
+        return user;
+    }
+
+    private async Task<ZB.MOM.WW.ScadaBridge.Commons.Types.Result<T>> ExecuteConfigurationAsync<T>(object command)
+    {
+        try
+        {
+            var value = await MutationServices.ExecuteConfigurationAsync(command);
+            return ZB.MOM.WW.ScadaBridge.Commons.Types.Result<T>.Success((T)value!);
+        }
+        catch (Exception ex)
+        {
+            var message = ex is UnauthorizedAccessException
+                or ZB.MOM.WW.ScadaBridge.ManagementService.ManagementCommandException
+                ? ex.Message : "The configuration change failed. Refresh the page and try again.";
+            return ZB.MOM.WW.ScadaBridge.Commons.Types.Result<T>.Failure(message);
+        }
+    }
 }
@@ -1,10 +1,14 @@
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Auth
+@inject Microsoft.AspNetCore.Components.Authorization.AuthenticationStateProvider MutationAuth
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
+@using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management
+@inject IServiceProvider MutationServices
@page "/design/api-methods/create"
@page "/design/api-methods/{Id:int}/edit"
@using ZB.MOM.WW.ScadaBridge.Security
@using ZB.MOM.WW.ScadaBridge.Commons.Entities.InboundApi
@using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories
@using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Security
-@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
@using ScriptAnalysis = ZB.MOM.WW.ScadaBridge.CentralUI.ScriptAnalysis
@attribute [Authorize(Policy = AuthorizationPolicies.RequireDesign)]
@inject IInboundApiRepository InboundApiRepository
@@ -297,33 +301,10 @@

        try
        {
-            // Save the ApiMethod entity FIRST so the method Name exists before we reconcile
-            // key scopes against it. The method entity stays in SQL Server; we leave the
-            // (now-legacy) ApprovedApiKeyIds column untouched — it is dropped in C5.
-            string methodName;
-            if (_existing != null)
-            {
-                _existing.Script = _script;
-                _existing.TimeoutSeconds = _timeoutSeconds;
-                _existing.TraceAllCalls = _traceAllCalls;
-                _existing.ParameterDefinitions = _params?.Trim();
-                _existing.ReturnDefinition = _returns?.Trim();
-                await InboundApiRepository.UpdateApiMethodAsync(_existing);
-                methodName = _existing.Name;
-            }
-            else
-            {
-                var m = new ApiMethod(_name.Trim(), _script)
-                {
-                    TimeoutSeconds = _timeoutSeconds,
-                    TraceAllCalls = _traceAllCalls,
-                    ParameterDefinitions = _params?.Trim(),
-                    ReturnDefinition = _returns?.Trim()
-                };
-                await InboundApiRepository.AddApiMethodAsync(m);
-                methodName = m.Name;
-            }
-            await InboundApiRepository.SaveChangesAsync();
+            var methodName = _existing?.Name ?? _name.Trim();
+            await MutationServices.ExecuteConfigurationAsync(_existing is not null
+                ? new UpdateApiMethodCommand(_existing.Id, _script, _timeoutSeconds, _params?.Trim(), _returns?.Trim(), _traceAllCalls)
+                : new CreateApiMethodCommand(methodName, _script, _timeoutSeconds, _params?.Trim(), _returns?.Trim(), _traceAllCalls));

            // Reconcile per-key method-scopes for the affected keys (added/removed vs. load time).
            if (!await ReconcileKeyScopesAsync(methodName)) return;
@@ -371,6 +352,7 @@
        {
            foreach (var update in plan.Updates)
            {
+                await MutationAuth.RequireRoleAsync(Roles.Designer);
                var ok = await ApiKeyAdmin.SetMethodsAsync(update.KeyId, update.NewMethods);
                if (!ok)
                    throw new InvalidOperationException(
@@ -1,3 +1,6 @@
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
+@using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management
+@inject IServiceProvider MutationServices
@page "/design/connections/create"
@page "/design/connections/{Id:int}/edit"
@page "/design/data-connections/create"
@@ -327,26 +330,9 @@

        try
        {
-            if (_editingConnection != null)
-            {
-                _editingConnection.Name = _formName.Trim();
-                _editingConnection.Protocol = _protocol;
-                _editingConnection.PrimaryConfiguration = primaryJson;
-                _editingConnection.BackupConfiguration = backupJson;
-                _editingConnection.FailoverRetryCount = _showBackup ? _formFailoverRetryCount : 3;
-                await SiteRepository.UpdateDataConnectionAsync(_editingConnection);
-            }
-            else
-            {
-                var conn = new DataConnection(_formName.Trim(), _protocol, _formSiteId)
-                {
-                    PrimaryConfiguration = primaryJson,
-                    BackupConfiguration = backupJson,
-                    FailoverRetryCount = _showBackup ? _formFailoverRetryCount : 3
-                };
-                await SiteRepository.AddDataConnectionAsync(conn);
-            }
-            await SiteRepository.SaveChangesAsync();
+            await MutationServices.ExecuteConfigurationAsync(_editingConnection is not null
+                ? new UpdateDataConnectionCommand(_editingConnection.Id, _formName.Trim(), _protocol, primaryJson, backupJson, _showBackup ? _formFailoverRetryCount : 3)
+                : new CreateDataConnectionCommand(_formSiteId, _formName.Trim(), _protocol, primaryJson, backupJson, _showBackup ? _formFailoverRetryCount : 3));
            NavigationManager.NavigateTo("/design/connections");
        }
        catch (Exception ex)
@@ -1,7 +1,9 @@
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
+@using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management
+@inject IServiceProvider MutationServices
@page "/design/connections"
@page "/design/data-connections"
@using ZB.MOM.WW.ScadaBridge.Security
-@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
@using ZB.MOM.WW.ScadaBridge.Commons.Entities.Sites
@using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories
@using ZB.MOM.WW.ScadaBridge.Commons.Types.Enums
@@ -417,8 +419,7 @@

        try
        {
-            await SiteRepository.DeleteDataConnectionAsync(conn.Id);
-            await SiteRepository.SaveChangesAsync();
+            await MutationServices.ExecuteConfigurationAsync(new DeleteDataConnectionCommand(conn.Id));
            _toast.ShowSuccess($"Connection '{conn.Name}' deleted.");
            await LoadDataAsync();
        }
@@ -1,3 +1,6 @@
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
+@using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management
+@inject IServiceProvider MutationServices
@page "/design/db-connections/create"
@page "/design/db-connections/{Id:int}/edit"
@using ZB.MOM.WW.ScadaBridge.Security
@@ -94,24 +97,9 @@

        try
        {
-            if (_existing != null)
-            {
-                _existing.Name = _name.Trim();
-                _existing.ConnectionString = _connectionString.Trim();
-                _existing.MaxRetries = _maxRetries;
-                _existing.RetryDelay = TimeSpan.FromSeconds(_retryDelaySeconds);
-                await ExternalSystemRepository.UpdateDatabaseConnectionAsync(_existing);
-            }
-            else
-            {
-                var dc = new DatabaseConnectionDefinition(_name.Trim(), _connectionString.Trim())
-                {
-                    MaxRetries = _maxRetries,
-                    RetryDelay = TimeSpan.FromSeconds(_retryDelaySeconds)
-                };
-                await ExternalSystemRepository.AddDatabaseConnectionAsync(dc);
-            }
-            await ExternalSystemRepository.SaveChangesAsync();
+            await MutationServices.ExecuteConfigurationAsync(_existing is not null
+                ? new UpdateDatabaseConnectionDefCommand(_existing.Id, _name.Trim(), _connectionString.Trim(), _maxRetries, TimeSpan.FromSeconds(_retryDelaySeconds))
+                : new CreateDatabaseConnectionDefCommand(_name.Trim(), _connectionString.Trim(), _maxRetries, TimeSpan.FromSeconds(_retryDelaySeconds)));
            NavigationManager.NavigateTo("/design/external-systems");
        }
        catch (Exception ex) { _formError = ex.Message; }
@@ -1,3 +1,6 @@
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
+@using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management
+@inject IServiceProvider MutationServices
@page "/design/external-systems/create"
@page "/design/external-systems/{Id:int}/edit"
@using ZB.MOM.WW.ScadaBridge.Security
@@ -137,29 +140,9 @@

        try
        {
-            if (_existing != null)
-            {
-                _existing.Name = _name.Trim();
-                _existing.EndpointUrl = _endpointUrl.Trim();
-                _existing.AuthType = _authType;
-                _existing.AuthConfiguration = _authConfig?.Trim();
-                _existing.MaxRetries = _maxRetries;
-                _existing.RetryDelay = TimeSpan.FromSeconds(_retryDelaySeconds);
-                _existing.TimeoutSeconds = _timeoutSeconds;
-                await ExternalSystemRepository.UpdateExternalSystemAsync(_existing);
-            }
-            else
-            {
-                var es = new ExternalSystemDefinition(_name.Trim(), _endpointUrl.Trim(), _authType)
-                {
-                    AuthConfiguration = _authConfig?.Trim(),
-                    MaxRetries = _maxRetries,
-                    RetryDelay = TimeSpan.FromSeconds(_retryDelaySeconds),
-                    TimeoutSeconds = _timeoutSeconds
-                };
-                await ExternalSystemRepository.AddExternalSystemAsync(es);
-            }
-            await ExternalSystemRepository.SaveChangesAsync();
+            await MutationServices.ExecuteConfigurationAsync(_existing is not null
+                ? new UpdateExternalSystemCommand(_existing.Id, _name.Trim(), _endpointUrl.Trim(), _authType, _authConfig?.Trim() ?? "", _timeoutSeconds, _maxRetries, TimeSpan.FromSeconds(_retryDelaySeconds))
+                : new CreateExternalSystemCommand(_name.Trim(), _endpointUrl.Trim(), _authType, _authConfig?.Trim(), _timeoutSeconds, _maxRetries, TimeSpan.FromSeconds(_retryDelaySeconds)));
            NavigationManager.NavigateTo("/design/external-systems");
        }
        catch (Exception ex) { _formError = ex.Message; }
@@ -1,3 +1,6 @@
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
+@using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management
+@inject IServiceProvider MutationServices
@page "/design/external-systems"
@using ZB.MOM.WW.ScadaBridge.Security
@using ZB.MOM.WW.ScadaBridge.Commons.Entities.ExternalSystems
@@ -189,7 +192,7 @@
    private async Task DeleteExtSys(ExternalSystemDefinition es)
    {
        if (!await Dialog.ConfirmAsync("Delete External System", $"Delete '{es.Name}'?", danger: true)) return;
-        try { await ExternalSystemRepository.DeleteExternalSystemAsync(es.Id); await ExternalSystemRepository.SaveChangesAsync(); _toast.ShowSuccess("Deleted."); await LoadAllAsync(); }
+        try { await MutationServices.ExecuteConfigurationAsync(new DeleteExternalSystemCommand(es.Id)); _toast.ShowSuccess("Deleted."); await LoadAllAsync(); }
        catch (Exception ex) { _toast.ShowError(ex.Message); }
    }

@@ -262,7 +265,7 @@
    private async Task DeleteDbConn(DatabaseConnectionDefinition dc)
    {
        if (!await Dialog.ConfirmAsync("Delete DB Connection", $"Delete '{dc.Name}'?", danger: true)) return;
-        try { await ExternalSystemRepository.DeleteDatabaseConnectionAsync(dc.Id); await ExternalSystemRepository.SaveChangesAsync(); _toast.ShowSuccess("Deleted."); await LoadAllAsync(); }
+        try { await MutationServices.ExecuteConfigurationAsync(new DeleteDatabaseConnectionDefCommand(dc.Id)); _toast.ShowSuccess("Deleted."); await LoadAllAsync(); }
        catch (Exception ex) { _toast.ShowError(ex.Message); }
    }

@@ -337,7 +340,7 @@
    private async Task DeleteApiMethod(ApiMethod m)
    {
        if (!await Dialog.ConfirmAsync("Delete", $"Delete API method '{m.Name}'?", danger: true)) return;
-        try { await InboundApiRepository.DeleteApiMethodAsync(m.Id); await InboundApiRepository.SaveChangesAsync(); _toast.ShowSuccess("Deleted."); await LoadAllAsync(); }
+        try { await MutationServices.ExecuteConfigurationAsync(new DeleteApiMethodCommand(m.Id)); _toast.ShowSuccess("Deleted."); await LoadAllAsync(); }
        catch (Exception ex) { _toast.ShowError(ex.Message); }
    }

@@ -207,7 +207,7 @@
    // CentralUI-024: delegates to the shared helper so the claim type stays
    // resolved through JwtTokenService rather than a duplicated magic string.
    private Task<string> GetCurrentUserAsync()
-        => AuthStateProvider.GetCurrentUsernameAsync();
+        => AuthStateProvider.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Designer);

    protected override async Task OnInitializedAsync()
    {
@@ -104,7 +104,7 @@
    // CentralUI-024: delegates to the shared helper so the claim type stays
    // resolved through JwtTokenService rather than a duplicated magic string.
    private Task<string> GetCurrentUserAsync()
-        => AuthStateProvider.GetCurrentUsernameAsync();
+        => AuthStateProvider.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Designer);

    private List<SharedScript> _scripts = new();
    private bool _loading = true;
@@ -122,5 +122,5 @@
    // CentralUI-024: delegates to the shared helper so the claim type stays
    // resolved through JwtTokenService rather than a duplicated magic string.
    private Task<string> GetCurrentUserAsync()
-        => AuthStateProvider.GetCurrentUsernameAsync();
+        => AuthStateProvider.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Designer);
 }
@@ -1,3 +1,6 @@
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
+@using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management
+@inject IServiceProvider MutationServices
@page "/design/templates/{Id:int}"
@using ZB.MOM.WW.ScadaBridge.Security
@using ZB.MOM.WW.ScadaBridge.Commons.Entities.Instances
@@ -217,7 +220,7 @@
    // CentralUI-024: delegates to the shared helper so the claim type stays
    // resolved through JwtTokenService rather than a duplicated magic string.
    private Task<string> GetCurrentUserAsync()
-        => AuthStateProvider.GetCurrentUsernameAsync();
+        => AuthStateProvider.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Designer);

    private RenderFragment RenderTemplateDetail() => __builder =>
    {
@@ -1080,13 +1083,10 @@
        {
            var existing = await TemplateEngineRepository.GetTemplateNativeAlarmSourceByIdAsync(id);
            if (existing == null) return "Source no longer exists.";
-            existing.ConnectionName = draft.ConnectionName.Trim();
-            existing.SourceReference = draft.SourceReference.Trim();
-            existing.ConditionFilter = string.IsNullOrWhiteSpace(draft.ConditionFilter) ? null : draft.ConditionFilter.Trim();
-            existing.Description = string.IsNullOrWhiteSpace(draft.Description) ? null : draft.Description.Trim();
-            existing.IsLocked = draft.IsLocked;
-            await TemplateEngineRepository.UpdateTemplateNativeAlarmSourceAsync(existing);
-            await TemplateEngineRepository.SaveChangesAsync();
+            await MutationServices.ExecuteConfigurationAsync(new UpdateTemplateNativeAlarmSourceCommand(id, existing.Name,
+                draft.ConnectionName.Trim(), draft.SourceReference.Trim(),
+                string.IsNullOrWhiteSpace(draft.ConditionFilter) ? null : draft.ConditionFilter.Trim(),
+                string.IsNullOrWhiteSpace(draft.Description) ? null : draft.Description.Trim(), draft.IsLocked));
            _toast.ShowSuccess($"Native alarm source '{existing.Name}' updated.");
            return null;
        }
@@ -1105,8 +1105,8 @@
            Description = string.IsNullOrWhiteSpace(draft.Description) ? null : draft.Description.Trim(),
            IsLocked = draft.IsLocked
        };
-        await TemplateEngineRepository.AddTemplateNativeAlarmSourceAsync(source);
-        await TemplateEngineRepository.SaveChangesAsync();
+        await MutationServices.ExecuteConfigurationAsync(new AddTemplateNativeAlarmSourceCommand(source.TemplateId, source.Name,
+            source.ConnectionName, source.SourceReference, source.ConditionFilter, source.Description, source.IsLocked));
        _toast.ShowSuccess($"Native alarm source '{source.Name}' added.");
        return null;
    }
@@ -1115,8 +1115,7 @@
    {
        var confirmed = await Dialog.ConfirmAsync("Delete Native Alarm Source", $"Delete native alarm source '{src.Name}'?", danger: true);
        if (!confirmed) return;
-        await TemplateEngineRepository.DeleteTemplateNativeAlarmSourceAsync(src.Id);
-        await TemplateEngineRepository.SaveChangesAsync();
+        await MutationServices.ExecuteConfigurationAsync(new DeleteTemplateNativeAlarmSourceCommand(src.Id));
        _toast.ShowSuccess($"Native alarm source '{src.Name}' deleted.");
        await LoadAsync();
    }
@@ -118,7 +118,7 @@
    // CentralUI-024: delegates to the shared helper so the claim type stays
    // resolved through JwtTokenService rather than a duplicated magic string.
    private Task<string> GetCurrentUserAsync()
-        => AuthStateProvider.GetCurrentUsernameAsync();
+        => AuthStateProvider.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Designer);

    private List<Template> _templates = new();
    private List<TemplateFolder> _folders = new();
@@ -382,7 +382,7 @@ public partial class TransportExport : ComponentBase
        _downloadError = null;
        try
        {
-            var user = await Auth.GetCurrentUsernameAsync();
+            var user = await Auth.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Designer);
            var sourceEnv = TransportOptions.Value.SourceEnvironment;
            if (string.IsNullOrWhiteSpace(sourceEnv))
            {
@@ -465,7 +465,7 @@ public partial class TransportImport : ComponentBase, IDisposable
    {
        try
        {
-            var user = await Auth.GetCurrentUsernameAsync();
+            var user = await Auth.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Administrator);
            var entityName = _session?.Manifest.SourceEnvironment ?? "<unknown>";
            await AuditService.LogAsync(
                user: user,
@@ -857,7 +857,7 @@ public partial class TransportImport : ComponentBase, IDisposable
        _result = null;
        try
        {
-            var user = await Auth.GetCurrentUsernameAsync();
+            var user = await Auth.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Administrator);
            // Fold the operator's Map-step choices into the name map. For
            // central-config-only bundles (no required mappings) this is
            // BundleNameMap.Empty, which the importer normalises away.
@@ -1,3 +1,5 @@
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Auth
+@inject Microsoft.AspNetCore.Components.Authorization.AuthenticationStateProvider MutationAuth
@page "/monitoring/parked-messages"
@attribute [Authorize(Policy = ZB.MOM.WW.ScadaBridge.Security.AuthorizationPolicies.RequireDeployment)]
@using ZB.MOM.WW.ScadaBridge.Commons.Entities.Sites
@@ -647,7 +649,10 @@
            try
            {
                var req = new ParkedMessageRetryRequest(Guid.NewGuid().ToString("N"), _selectedSiteId, id, DateTimeOffset.UtcNow);
-                var resp = await CommunicationService.RetryParkedMessageAsync(_selectedSiteId, req);
+                await MutationAuth.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Deployer);
+            var mutationSite = (await SiteRepository.GetAllSitesAsync()).FirstOrDefault(s => s.SiteIdentifier == _selectedSiteId);
+            if (mutationSite is null || !await SiteScope.IsSiteAllowedAsync(mutationSite.Id)) throw new UnauthorizedAccessException("Site access was revoked.");
+            var resp = await CommunicationService.RetryParkedMessageAsync(_selectedSiteId, req);
                if (resp.Success) success++; else failed++;
            }
            catch { failed++; }
@@ -680,7 +685,10 @@
            try
            {
                var req = new ParkedMessageDiscardRequest(Guid.NewGuid().ToString("N"), _selectedSiteId, id, DateTimeOffset.UtcNow);
-                var resp = await CommunicationService.DiscardParkedMessageAsync(_selectedSiteId, req);
+                await MutationAuth.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Deployer);
+            var mutationSite = (await SiteRepository.GetAllSitesAsync()).FirstOrDefault(s => s.SiteIdentifier == _selectedSiteId);
+            if (mutationSite is null || !await SiteScope.IsSiteAllowedAsync(mutationSite.Id)) throw new UnauthorizedAccessException("Site access was revoked.");
+            var resp = await CommunicationService.DiscardParkedMessageAsync(_selectedSiteId, req);
                if (resp.Success) success++; else failed++;
            }
            catch { failed++; }
@@ -702,6 +710,9 @@
        try
        {
            var req = new ParkedMessageRetryRequest(Guid.NewGuid().ToString("N"), _selectedSiteId, msg.MessageId, DateTimeOffset.UtcNow);
+            await MutationAuth.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Deployer);
+            var mutationSite = (await SiteRepository.GetAllSitesAsync()).FirstOrDefault(s => s.SiteIdentifier == _selectedSiteId);
+            if (mutationSite is null || !await SiteScope.IsSiteAllowedAsync(mutationSite.Id)) throw new UnauthorizedAccessException("Site access was revoked.");
            var resp = await CommunicationService.RetryParkedMessageAsync(_selectedSiteId, req);
            if (resp.Success)
            {
@@ -731,6 +742,9 @@
        try
        {
            var req = new ParkedMessageDiscardRequest(Guid.NewGuid().ToString("N"), _selectedSiteId, msg.MessageId, DateTimeOffset.UtcNow);
+            await MutationAuth.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Deployer);
+            var mutationSite = (await SiteRepository.GetAllSitesAsync()).FirstOrDefault(s => s.SiteIdentifier == _selectedSiteId);
+            if (mutationSite is null || !await SiteScope.IsSiteAllowedAsync(mutationSite.Id)) throw new UnauthorizedAccessException("Site access was revoked.");
            var resp = await CommunicationService.DiscardParkedMessageAsync(_selectedSiteId, req);
            if (resp.Success)
            {
@@ -1,7 +1,9 @@
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
+@using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management
+@inject IServiceProvider MutationServices
@page "/notifications/lists/create"
@page "/notifications/lists/{Id:int}/edit"
@using ZB.MOM.WW.ScadaBridge.Security
-@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
@using ZB.MOM.WW.ScadaBridge.Commons.Entities.Notifications
@using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories
@using ZB.MOM.WW.ScadaBridge.Commons.Types.Enums
@@ -185,20 +187,9 @@

        try
        {
-            if (_existing != null)
-            {
-                _existing.Name = _name.Trim();
-                await NotificationRepository.UpdateNotificationListAsync(_existing);
-            }
-            else
-            {
-                // Type is set at create time and never changes thereafter (the selector
-                // is disabled on edit) so a list's recipients always carry the matching
-                // contact field.
-                var nl = new NotificationList(_name.Trim()) { Type = _type };
-                await NotificationRepository.AddNotificationListAsync(nl);
-            }
-            await NotificationRepository.SaveChangesAsync();
+            await MutationServices.ExecuteConfigurationAsync(_existing is not null
+                ? new RenameNotificationListCommand(_existing.Id, _name.Trim())
+                : new CreateNotificationListCommand(_name.Trim(), [], _type));
            NavigationManager.NavigateTo("/notifications/lists");
        }
        catch (Exception ex) { _formError = ex.Message; }
@@ -238,8 +229,7 @@

        try
        {
-            await NotificationRepository.AddRecipientAsync(r);
-            await NotificationRepository.SaveChangesAsync();
+            await MutationServices.ExecuteConfigurationAsync(new AddNotificationRecipientCommand(r.NotificationListId, r.Name, r.EmailAddress, r.PhoneNumber));
            _recipientName = _recipientEmail = _recipientPhone = string.Empty;
            _recipients = (await NotificationRepository.GetRecipientsByListIdAsync(Id.Value)).ToList();
        }
@@ -264,8 +254,7 @@
    {
        try
        {
-            await NotificationRepository.DeleteRecipientAsync(r.Id);
-            await NotificationRepository.SaveChangesAsync();
+            await MutationServices.ExecuteConfigurationAsync(new DeleteNotificationRecipientCommand(r.Id));
            _recipients = (await NotificationRepository.GetRecipientsByListIdAsync(Id!.Value)).ToList();
        }
        catch (Exception ex) { _recipientFormError = ex.Message; }
@@ -1,3 +1,6 @@
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
+@using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management
+@inject IServiceProvider MutationServices
@page "/notifications/lists"
@using ZB.MOM.WW.ScadaBridge.Security
@using ZB.MOM.WW.ScadaBridge.Commons.Entities.Notifications
@@ -165,8 +168,7 @@
        }
        try
        {
-            await NotificationRepository.DeleteNotificationListAsync(list.Id);
-            await NotificationRepository.SaveChangesAsync();
+            await MutationServices.ExecuteConfigurationAsync(new DeleteNotificationListCommand(list.Id));
            _toast.ShowSuccess("Deleted.");
            await LoadAsync();
        }
@@ -604,7 +604,8 @@
        _actionInProgress = true;
        try
        {
-            var requestedBy = await AuthStateProvider.GetCurrentUsernameAsync();
+            if (!await IsRowSiteAllowedAsync(n.SourceSiteId)) throw new UnauthorizedAccessException("Site access was revoked.");
+            var requestedBy = await AuthStateProvider.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Deployer);
            var response = await CommunicationService.RetryNotificationAsync(
                new RetryNotificationRequest(Guid.NewGuid().ToString("N"), n.NotificationId, requestedBy));
            if (response.Success)
@@ -642,7 +643,8 @@
        _actionInProgress = true;
        try
        {
-            var requestedBy = await AuthStateProvider.GetCurrentUsernameAsync();
+            if (!await IsRowSiteAllowedAsync(n.SourceSiteId)) throw new UnauthorizedAccessException("Site access was revoked.");
+            var requestedBy = await AuthStateProvider.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Deployer);
            var response = await CommunicationService.DiscardNotificationAsync(
                new DiscardNotificationRequest(Guid.NewGuid().ToString("N"), n.NotificationId, requestedBy));
            if (response.Success)
@@ -848,6 +850,9 @@
        return _permittedSiteIds.Contains(resolved.Id);
    }

-    private Task<bool> IsRowSiteAllowedAsync(string sourceSiteId)
-        => Task.FromResult(IsRowSiteAllowedSync(sourceSiteId));
+    private async Task<bool> IsRowSiteAllowedAsync(string sourceSiteId)
+    {
+        var resolved = (await SiteRepository.GetAllSitesAsync()).FirstOrDefault(s => s.SiteIdentifier == sourceSiteId);
+        return resolved is not null && await SiteScope.IsSiteAllowedAsync(resolved.Id);
+    }
 }
@@ -1,3 +1,6 @@
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
+@using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management
+@inject IServiceProvider MutationServices
@page "/notifications/sms"
@using ZB.MOM.WW.ScadaBridge.Security
@using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories
@@ -245,48 +248,18 @@

        try
        {
-            if (_editingSms != null)
+            if (_editingSms is null && typedAuthToken is null)
            {
-                _editingSms.AccountSid = _accountSid.Trim();
-                _editingSms.FromNumber = string.IsNullOrWhiteSpace(_fromNumber) ? null : _fromNumber.Trim();
-                _editingSms.MessagingServiceSid = string.IsNullOrWhiteSpace(_messagingServiceSid)
-                    ? null
-                    : _messagingServiceSid.Trim();
-                _editingSms.ApiBaseUrl = string.IsNullOrWhiteSpace(_apiBaseUrl) ? null : _apiBaseUrl.Trim();
-                // Preserve-if-blank: only overwrite the stored token when a new value was typed.
-                if (typedAuthToken != null)
-                {
-                    _editingSms.AuthToken = typedAuthToken;
-                }
-                _editingSms.ConnectionTimeoutSeconds = _connectionTimeoutSeconds;
-                _editingSms.MaxRetries = _maxRetries;
-                _editingSms.RetryDelay = TimeSpan.FromSeconds(_retryDelaySeconds);
-                await NotificationRepository.UpdateSmsConfigurationAsync(_editingSms);
+                _formError = "Auth Token is required.";
+                return;
            }
-            else
-            {
-                if (typedAuthToken == null)
-                {
-                    _formError = "Auth Token is required.";
-                    return;
-                }
-
-                var sms = new SmsConfigurationEntity(
-                    _accountSid.Trim(),
-                    string.IsNullOrWhiteSpace(_fromNumber) ? null : _fromNumber.Trim())
-                {
-                    MessagingServiceSid = string.IsNullOrWhiteSpace(_messagingServiceSid)
-                        ? null
-                        : _messagingServiceSid.Trim(),
-                    ApiBaseUrl = string.IsNullOrWhiteSpace(_apiBaseUrl) ? null : _apiBaseUrl.Trim(),
-                    AuthToken = typedAuthToken,
-                    ConnectionTimeoutSeconds = _connectionTimeoutSeconds,
-                    MaxRetries = _maxRetries,
-                    RetryDelay = TimeSpan.FromSeconds(_retryDelaySeconds),
-                };
-                await NotificationRepository.AddSmsConfigurationAsync(sms);
-            }
-            await NotificationRepository.SaveChangesAsync();
+            var from = string.IsNullOrWhiteSpace(_fromNumber) ? null : _fromNumber.Trim();
+            var messaging = string.IsNullOrWhiteSpace(_messagingServiceSid) ? null : _messagingServiceSid.Trim();
+            await MutationServices.ExecuteConfigurationAsync(_editingSms is not null
+                ? new UpdateSmsConfigCommand(_editingSms.Id, _accountSid.Trim(), from, messaging, _apiBaseUrl?.Trim() ?? "", typedAuthToken,
+                    _connectionTimeoutSeconds, _maxRetries, TimeSpan.FromSeconds(_retryDelaySeconds))
+                : new CreateSmsConfigCommand(_accountSid.Trim(), from, messaging, _apiBaseUrl?.Trim(), typedAuthToken,
+                    _connectionTimeoutSeconds, _maxRetries, TimeSpan.FromSeconds(_retryDelaySeconds)));
            _showForm = false;
            _toast.ShowSuccess("SMS configuration saved.");
            await LoadAsync();
@@ -1,3 +1,6 @@
+@using ZB.MOM.WW.ScadaBridge.CentralUI.Services
+@using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management
+@inject IServiceProvider MutationServices
@page "/notifications/smtp"
@using ZB.MOM.WW.ScadaBridge.Security
@using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories
@@ -345,33 +348,11 @@

        try
        {
-            if (_editingSmtp != null)
-            {
-                _editingSmtp.Host = _host.Trim();
-                _editingSmtp.Port = _port;
-                _editingSmtp.Transport = _transport;
-                _editingSmtp.AuthType = _authType;
-                _editingSmtp.TlsMode = _tlsMode;
-                _editingSmtp.Credentials = _credentials?.Trim();
-                _editingSmtp.FromAddress = _fromAddress.Trim();
-                _editingSmtp.OAuth2Authority = NormalizeOptional(_oauth2Authority);
-                _editingSmtp.OAuth2Scope = NormalizeOptional(_oauth2Scope);
-                await NotificationRepository.UpdateSmtpConfigurationAsync(_editingSmtp);
-            }
-            else
-            {
-                var smtp = new SmtpConfigurationEntity(_host.Trim(), _authType, _fromAddress.Trim())
-                {
-                    Port = _port,
-                    Transport = _transport,
-                    TlsMode = _tlsMode,
-                    Credentials = _credentials?.Trim(),
-                    OAuth2Authority = NormalizeOptional(_oauth2Authority),
-                    OAuth2Scope = NormalizeOptional(_oauth2Scope)
-                };
-                await NotificationRepository.AddSmtpConfigurationAsync(smtp);
-            }
-            await NotificationRepository.SaveChangesAsync();
+            await MutationServices.ExecuteConfigurationAsync(_editingSmtp is not null
+                ? new UpdateSmtpConfigCommand(_editingSmtp.Id, _host.Trim(), _port, _authType, _fromAddress.Trim(), _tlsMode,
+                    _credentials?.Trim() ?? "", NormalizeOptional(_oauth2Authority) ?? "", NormalizeOptional(_oauth2Scope) ?? "", _transport)
+                : new CreateSmtpConfigCommand(_host.Trim(), _port, _authType, _fromAddress.Trim(), _tlsMode,
+                    _credentials?.Trim(), NormalizeOptional(_oauth2Authority), NormalizeOptional(_oauth2Scope), _transport));
            _showForm = false;
            _toast.ShowSuccess("SMTP configuration saved.");
            await LoadAsync();
@@ -338,7 +338,8 @@ public partial class SiteCallsReport
        _actionInProgress = true;
        try
        {
-            var requestedBy = await AuthStateProvider.GetCurrentUsernameAsync();
+            if (!await IsRowSiteAllowedAsync(c.SourceSite)) throw new UnauthorizedAccessException("Site access was revoked.");
+            var requestedBy = await AuthStateProvider.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Deployer);
            var response = await CommunicationService.RetrySiteCallAsync(
                new RetrySiteCallRequest(Guid.NewGuid().ToString("N"), c.TrackedOperationId, c.SourceSite, requestedBy));
            ShowRelayOutcome(response.Outcome, response.SiteReachable, response.ErrorMessage,
@@ -374,7 +375,8 @@ public partial class SiteCallsReport
        _actionInProgress = true;
        try
        {
-            var requestedBy = await AuthStateProvider.GetCurrentUsernameAsync();
+            if (!await IsRowSiteAllowedAsync(c.SourceSite)) throw new UnauthorizedAccessException("Site access was revoked.");
+            var requestedBy = await AuthStateProvider.RequireRoleAsync(ZB.MOM.WW.ScadaBridge.Security.Roles.Deployer);
            var response = await CommunicationService.DiscardSiteCallAsync(
                new DiscardSiteCallRequest(Guid.NewGuid().ToString("N"), c.TrackedOperationId, c.SourceSite, requestedBy));
            ShowRelayOutcome(response.Outcome, response.SiteReachable, response.ErrorMessage,
@@ -589,16 +591,10 @@ public partial class SiteCallsReport
    /// Server-side re-check for the Retry/Discard relay. True for a system-wide
    /// user, or when the row's source site maps to a Site.Id in the permitted set.
    /// </summary>
-    private Task<bool> IsRowSiteAllowedAsync(string sourceSite)
+    private async Task<bool> IsRowSiteAllowedAsync(string sourceSite)
    {
-        if (_siteScopeSystemWide)
-            return Task.FromResult(true);
-
-        var resolved = _allSites.FirstOrDefault(s => s.SiteIdentifier == sourceSite);
-        if (resolved is null)
-            return Task.FromResult(true);
-
-        return Task.FromResult(_permittedSiteIds.Contains(resolved.Id));
+        var resolved = (await SiteRepository.GetAllSitesAsync()).FirstOrDefault(s => s.SiteIdentifier == sourceSite);
+        return resolved is not null && await SiteScope.IsSiteAllowedAsync(resolved.Id);
    }

    // ── Trends ──────────────────────────────────────────────────────────────
@@ -2,28 +2,11 @@
@inject NavigationManager Navigation
@inject IJSRuntime JS

+<AntiforgeryToken />
+
@code {
-    // CentralUI-005 / CentralUI-020: session expiry is a sliding window owned by
-    // the cookie authentication middleware (ZB.MOM.WW.ScadaBridge.Security AddCookie:
-    // ExpireTimeSpan = idle timeout, SlidingExpiration = true). An active user's
-    // cookie is continually renewed; an idle user's cookie lapses after the idle
-    // timeout. There is no fixed login-time deadline to redirect at.
-    //
-    // This component must NOT poll the Blazor AuthenticationStateProvider:
-    // CookieAuthenticationStateProvider serves a frozen constructor-time
-    // principal for the whole circuit (CentralUI-004), so the polled auth state
-    // can never transition to "expired" and the redirect would never fire
-    // (CentralUI-020).
-    //
-    // Instead it polls the server endpoint GET /auth/ping via fetch(). Being a
-    // normal HTTP request, the cookie middleware re-validates — and slides — the
-    // cookie on every hit, and answers 200 while the session is live or 401 once
-    // it has lapsed. A genuine idle user's circuit produces no other HTTP
-    // traffic, so once the cookie lapses the next ping returns 401 and this
-    // component redirects to /login. (The ping itself slides the cookie, but the
-    // poll interval is well under the idle timeout, so an idle session still
-    // lapses on schedule once the poll catches the lapsed state — the ping only
-    // ever observes expiry, it does not keep a dead session alive.)
+    // Passive HTTP probes observe expiry but never advance activity. The JS module
+    // separately reports trusted browser input through an antiforgery-protected POST.

    /// <summary>Server endpoint that reports live session validity.</summary>
    internal const string PingUrl = "/auth/ping";
@@ -49,6 +32,14 @@
        _ = PollSessionAsync(_cts.Token);
    }

+    protected override async Task OnAfterRenderAsync(bool firstRender)
+    {
+        if (!firstRender || IsOnLoginPage) return;
+        try { _module ??= await JS.InvokeAsync<IJSObjectReference>("import", ModulePath); }
+        catch (JSDisconnectedException) { }
+        catch (JSException) { }
+    }
+
    private bool IsOnLoginPage =>
        Navigation.ToBaseRelativePath(Navigation.Uri)
            .StartsWith("login", StringComparison.OrdinalIgnoreCase);
@@ -0,0 +1,45 @@
+using System.Text;
+
+namespace ZB.MOM.WW.ScadaBridge.CentralUI.ScriptAnalysis;
+
+/// <summary>Thread-safe console sink that never retains more than its character budget.</summary>
+public sealed class BoundedSandboxWriter(int capacity) : StringWriter
+{
+    private readonly StringBuilder _retained = new(Math.Max(0, capacity));
+    private readonly object _gate = new();
+    private long _dropped;
+    public int RetainedCharacters { get { lock (_gate) return _retained.Length; } }
+    public long DroppedCharacters { get { lock (_gate) return _dropped; } }
+    public override void Write(char value) { Span<char> one = stackalloc char[1]; one[0] = value; Write(one); }
+    public override void Write(string? value) { if (value is not null) Write(value.AsSpan()); }
+    public override void Write(char[] buffer, int index, int count) => Write(buffer.AsSpan(index, count));
+    public override void Write(ReadOnlySpan<char> buffer)
+    {
+        lock (_gate)
+        {
+            var take = Math.Min(buffer.Length, Math.Max(0, capacity - _retained.Length));
+            _retained.Append(buffer[..take]);
+            _dropped = Math.Min(long.MaxValue - (buffer.Length - take), _dropped) + buffer.Length - take;
+        }
+    }
+    public override void WriteLine(string? value) { lock (_gate) { Write(value); Write(NewLine); } }
+    public override void WriteLine() => Write(NewLine);
+    public override string ToString() { lock (_gate) return _retained.ToString() + (_dropped > 0 ? "\n… (truncated)" : ""); }
+}
+
+/// <summary>Rejects serialized data once its byte budget is reached, without retaining the excess.</summary>
+public sealed class BoundedSandboxStream(int capacity) : MemoryStream
+{
+    public override void Write(byte[] buffer, int offset, int count) => Write(buffer.AsSpan(offset, count));
+    public override void Write(ReadOnlySpan<byte> buffer)
+    {
+        if (Length + buffer.Length > capacity) throw new InvalidDataException("Sandbox output exceeds its byte budget.");
+        var bounded = buffer.ToArray();
+        base.Write(bounded, 0, bounded.Length);
+    }
+    public override void WriteByte(byte value) { Span<byte> one = stackalloc byte[1]; one[0] = value; Write(one); }
+    public override ValueTask WriteAsync(ReadOnlyMemory<byte> buffer, CancellationToken cancellationToken = default)
+    { cancellationToken.ThrowIfCancellationRequested(); Write(buffer.Span); return ValueTask.CompletedTask; }
+    public override Task WriteAsync(byte[] buffer, int offset, int count, CancellationToken cancellationToken)
+    { cancellationToken.ThrowIfCancellationRequested(); Write(buffer, offset, count); return Task.CompletedTask; }
+}
@@ -0,0 +1,224 @@
+using System.Buffers.Binary;
+using System.Data.Common;
+using System.Diagnostics;
+using System.Text.Json;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.DependencyInjection;
+using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services;
+using ZB.MOM.WW.ScadaBridge.Commons.Types;
+using ZB.MOM.WW.ScadaBridge.Communication;
+
+namespace ZB.MOM.WW.ScadaBridge.CentralUI.ScriptAnalysis;
+
+/// <summary>Bounded private IPC for disposable, killable Test Run processes.</summary>
+public static class SandboxWorkerProtocol
+{
+    private const int FrameLimit = 1024 * 1024;
+    private static readonly SemaphoreSlim Admission = new(4, 4);
+    private static readonly JsonSerializerOptions Json = new() { IgnoreReadOnlyProperties = true };
+    private sealed record Frame(string Kind, string? Method, JsonElement Data, string? Error = null);
+    private sealed record Start(SandboxRunRequest Request, bool External, bool Database, bool Bound);
+    private sealed record ConnectionInfo(string Provider, string ConnectionString, bool Open);
+
+    /// <summary>Runs one child under a deadline; a slot remains charged until confirmed process exit.</summary>
+    public static async Task<SandboxRunResult> RunAsync(SandboxRunRequest request, IServiceProvider services,
+        ISharedScriptCatalog catalog, CancellationToken caller)
+        => await RunCoreAsync(request, services, catalog, caller);
+
+    internal static async Task<SandboxRunResult> RunCoreAsync(SandboxRunRequest request, IServiceProvider services,
+        ISharedScriptCatalog catalog, CancellationToken caller, Action<int>? started = null)
+    {
+        var seconds = Math.Clamp(request.TimeoutSeconds ?? 5, 1, 10);
+        using var deadline = CancellationTokenSource.CreateLinkedTokenSource(caller);
+        deadline.CancelAfter(TimeSpan.FromSeconds(seconds));
+        var clock = Stopwatch.StartNew();
+        var acquired = false;
+        Process? process = null;
+        Task? stderr = null;
+        CancellationTokenRegistration terminateOnDeadline = default;
+        try
+        {
+            await Admission.WaitAsync(deadline.Token); acquired = true;
+            ISandboxInstanceGateway? gateway = null;
+            if (request.Kind != ScriptKind.InboundApi && !string.IsNullOrWhiteSpace(request.BindInstanceUniqueName))
+            {
+                var locator = services.GetService<IInstanceLocator>();
+                var comms = services.GetService<CommunicationService>();
+                var site = locator is null ? null : await locator.GetSiteIdForInstanceAsync(request.BindInstanceUniqueName, deadline.Token);
+                if (site is null || comms is null) throw new ScriptSandboxException("Cannot bind instance: cross-site communication or deployment is unavailable.");
+                gateway = new SandboxInstanceGateway(comms, site, request.BindInstanceUniqueName, deadline.Token);
+            }
+            var worker = Path.Combine(AppContext.BaseDirectory, "ZB.MOM.WW.ScadaBridge.CentralUI.SandboxWorker.dll");
+            if (!File.Exists(worker)) throw new InvalidOperationException("Sandbox worker is not installed.");
+            var start = new ProcessStartInfo("dotnet") { UseShellExecute = false, RedirectStandardInput = true,
+                RedirectStandardOutput = true, RedirectStandardError = true, CreateNoWindow = true };
+            start.ArgumentList.Add(worker);
+            // A finite heap bounds accidental allocation in return serialization and script code.
+            start.Environment["DOTNET_GCHeapHardLimit"] = "20000000"; // 512 MiB, hexadecimal runtime setting.
+            process = Process.Start(start) ?? throw new InvalidOperationException("Could not start sandbox worker.");
+            terminateOnDeadline = deadline.Token.Register(static state =>
+            {
+                var child = (Process)state!;
+                try { if (!child.HasExited) child.Kill(entireProcessTree: true); }
+                catch (InvalidOperationException) { /* Concurrent normal process exit. */ }
+            }, process);
+            started?.Invoke(process.Id);
+            stderr = DrainAsync(process.StandardError.BaseStream);
+            await WriteAsync(process.StandardInput.BaseStream, new Frame("start", null,
+                Encode(new Start(request, services.GetService<IExternalSystemClient>() is not null,
+                    services.GetService<IDatabaseGateway>() is not null, gateway is not null))), deadline.Token);
+            while (true)
+            {
+                var frame = await ReadAsync(process.StandardOutput.BaseStream, deadline.Token);
+                if (frame.Kind == "result")
+                    return frame.Data.Deserialize<SandboxRunResult>(Json) ?? throw new InvalidDataException("Missing sandbox result.");
+                if (frame.Kind != "call") throw new InvalidDataException("Unexpected sandbox message.");
+                deadline.Token.ThrowIfCancellationRequested();
+                Frame reply;
+                try
+                {
+                    var value = await DispatchAsync(frame.Method!, frame.Data, services, catalog, gateway, deadline.Token);
+                    deadline.Token.ThrowIfCancellationRequested();
+                    reply = new Frame("reply", null, Encode(value));
+                }
+                catch (Exception ex) when (ex is not OperationCanceledException)
+                { reply = new Frame("reply", null, Encode(null), ex is ScriptSandboxException ? ex.Message : "Sandbox gateway request failed."); }
+                await WriteAsync(process.StandardInput.BaseStream, reply, deadline.Token);
+            }
+        }
+        catch (OperationCanceledException)
+        { return new(false, null, null, "", $"Script execution exceeded the {seconds}-second sandbox timeout or was canceled.", SandboxErrorKind.Timeout, clock.ElapsedMilliseconds, null); }
+        catch (ScriptSandboxException ex)
+        { return new(false, null, null, "", ex.Message, SandboxErrorKind.SandboxLimitation, clock.ElapsedMilliseconds, null); }
+        catch (Exception)
+        { return new(false, null, null, "", "Sandbox worker exited or exceeded its resource budget.", SandboxErrorKind.RuntimeError, clock.ElapsedMilliseconds, null); }
+        finally
+        {
+            deadline.Cancel(); // Stop accepting/brokering new operations before termination.
+            terminateOnDeadline.Dispose();
+            if (process is not null)
+            {
+                try { if (!process.HasExited) process.Kill(entireProcessTree: true); }
+                catch (InvalidOperationException) when (process.HasExited) { }
+                await process.WaitForExitAsync(CancellationToken.None);
+                if (stderr is not null) await stderr;
+                process.Dispose();
+            }
+            if (acquired) Admission.Release();
+        }
+    }
+
+    private static async Task DrainAsync(Stream stream)
+    { var buffer = new byte[4096]; while (await stream.ReadAsync(buffer) != 0) { } }
+
+    private static async Task<object?> DispatchAsync(string method, JsonElement args, IServiceProvider services,
+        ISharedScriptCatalog catalog, ISandboxInstanceGateway? gateway, CancellationToken ct)
+    {
+        string Text(int i) => args[i].GetString()!;
+        IReadOnlyDictionary<string, object?>? Parameters(int i) => args[i].ValueKind == JsonValueKind.Null ? null
+            : args[i].EnumerateObject().ToDictionary(p => p.Name, p => ScriptAnalysisService.JsonElementToObject(p.Value));
+        switch (method)
+        {
+            case "shared": return await catalog.GetByNameAsync(Text(0), ct);
+            case "external": return await services.GetRequiredService<IExternalSystemClient>().CallAsync(Text(0), Text(1), Parameters(2), ct);
+            case "cachedExternal": return await services.GetRequiredService<IExternalSystemClient>().CachedCallAsync(Text(0), Text(1), Parameters(2), Text(3), ct);
+            case "cachedDb": return await services.GetRequiredService<IDatabaseGateway>().CachedWriteAsync(Text(0), Text(1), Parameters(2), Text(3), ct);
+            case "connection":
+                var source = services.GetRequiredService<IDatabaseGateway>() as ISandboxDatabaseConnectionSource
+                    ?? throw new ScriptSandboxException("Database worker handoff is unavailable for this provider.");
+                return new ConnectionInfo("Microsoft.Data.SqlClient.SqlConnection",
+                    await source.GetSandboxConnectionStringAsync(Text(0), ct), true);
+            case "get": return await (gateway ?? throw new ScriptSandboxException("Instance not bound.")).GetAttributeAsync(Text(0), ct);
+            case "set": await gateway!.SetAttributeAsync(Text(0), Text(1), ct); return null;
+            case "script": return await gateway!.CallScriptAsync(Text(0), Parameters(1), ct);
+            case "wait": return await gateway!.WaitForAttributeAsync(Text(0), args[1].GetString(), TimeSpan.FromTicks(args[2].GetInt64()), args[3].GetBoolean(), ct);
+            default: throw new ScriptSandboxException("Unknown sandbox operation.");
+        }
+    }
+
+    private static JsonElement Encode(object? value)
+    {
+        using var buffer = new BoundedSandboxStream(FrameLimit - 4096);
+        JsonSerializer.Serialize(buffer, value, Json);
+        using var document = JsonDocument.Parse(buffer.GetBuffer().AsMemory(0, (int)buffer.Length));
+        return document.RootElement.Clone();
+    }
+
+    private static async Task WriteAsync(Stream stream, Frame frame, CancellationToken ct)
+    {
+        using var bytes = new BoundedSandboxStream(FrameLimit);
+        JsonSerializer.Serialize(bytes, frame, Json);
+        var prefix = new byte[4]; BinaryPrimitives.WriteInt32LittleEndian(prefix, (int)bytes.Length);
+        await stream.WriteAsync(prefix, ct);
+        await stream.WriteAsync(bytes.GetBuffer().AsMemory(0, (int)bytes.Length), ct);
+        await stream.FlushAsync(ct);
+    }
+    private static async Task<Frame> ReadAsync(Stream stream, CancellationToken ct)
+    {
+        var prefix = new byte[4]; await stream.ReadExactlyAsync(prefix, ct);
+        var length = BinaryPrimitives.ReadInt32LittleEndian(prefix);
+        if (length is < 1 or > FrameLimit) throw new InvalidDataException("Sandbox frame budget exceeded.");
+        var data = new byte[length]; await stream.ReadExactlyAsync(data, ct);
+        return JsonSerializer.Deserialize<Frame>(data, Json) ?? throw new InvalidDataException("Invalid sandbox frame.");
+    }
+
+    /// <summary>Worker executable entry. Protocol streams are captured before script console routing.</summary>
+    public static async Task RunWorkerAsync()
+    {
+        var input = Console.OpenStandardInput(); var output = Console.OpenStandardOutput();
+        var first = await ReadAsync(input, CancellationToken.None);
+        var start = first.Data.Deserialize<Start>(Json) ?? throw new InvalidDataException("Missing worker request.");
+        var rpc = new Rpc(input, output);
+        var services = new ServiceCollection();
+        if (start.External) services.AddSingleton<IExternalSystemClient>(rpc);
+        if (start.Database) services.AddSingleton<IDatabaseGateway>(rpc);
+        if (start.Bound) services.AddSingleton<ISandboxInstanceGateway>(rpc);
+        using var provider = services.BuildServiceProvider();
+        using var cache = new MemoryCache(new MemoryCacheOptions());
+        var runner = new ScriptAnalysisService(rpc, cache, provider);
+        var result = await runner.RunInWorkerAsync(start.Request, CancellationToken.None);
+        await WriteAsync(output, new Frame("result", null, Encode(result)), CancellationToken.None);
+    }
+
+    private sealed class Rpc(Stream input, Stream output) : ISharedScriptCatalog, IExternalSystemClient, IDatabaseGateway, ISandboxInstanceGateway
+    {
+        private readonly SemaphoreSlim _gate = new(1);
+        private async Task<JsonElement> Call(string method, object?[] args, CancellationToken ct)
+        {
+            await _gate.WaitAsync(ct);
+            try
+            {
+                await WriteAsync(output, new Frame("call", method, Encode(args)), ct);
+                var reply = await ReadAsync(input, ct);
+                if (reply.Error is not null) throw new ScriptSandboxException(reply.Error);
+                return reply.Data;
+            }
+            finally { _gate.Release(); }
+        }
+        public Task<IReadOnlyList<ScriptShape>> GetShapesAsync() => Task.FromResult<IReadOnlyList<ScriptShape>>([]);
+        public async Task<SharedScriptSource?> GetByNameAsync(string name, CancellationToken cancellationToken = default)
+            => (await Call("shared", [name], cancellationToken)).Deserialize<SharedScriptSource>(Json);
+        public async Task<ExternalCallResult> CallAsync(string systemName, string methodName, IReadOnlyDictionary<string, object?>? parameters = null, CancellationToken cancellationToken = default)
+            => (await Call("external", [systemName, methodName, parameters], cancellationToken)).Deserialize<ExternalCallResult>(Json)!;
+        public async Task<ExternalCallResult> CachedCallAsync(string systemName, string methodName, IReadOnlyDictionary<string, object?>? parameters = null, string? originInstanceName = null, CancellationToken cancellationToken = default, TrackedOperationId? trackedOperationId = null, Guid? executionId = null, string? sourceScript = null, Guid? parentExecutionId = null)
+            => (await Call("cachedExternal", [systemName, methodName, parameters, originInstanceName], cancellationToken)).Deserialize<ExternalCallResult>(Json)!;
+        public async Task<ExternalCallResult> CachedWriteAsync(string connectionName, string sql, IReadOnlyDictionary<string, object?>? parameters = null, string? originInstanceName = null, CancellationToken cancellationToken = default, TrackedOperationId? trackedOperationId = null, Guid? executionId = null, string? sourceScript = null, Guid? parentExecutionId = null)
+            => (await Call("cachedDb", [connectionName, sql, parameters, originInstanceName], cancellationToken)).Deserialize<ExternalCallResult>(Json)!;
+        public async Task<DbConnection> GetConnectionAsync(string connectionName, CancellationToken cancellationToken = default)
+        {
+            var info = (await Call("connection", [connectionName], cancellationToken)).Deserialize<ConnectionInfo>(Json)!;
+            DbConnection connection = info.Provider switch {
+                "Microsoft.Data.SqlClient.SqlConnection" => new Microsoft.Data.SqlClient.SqlConnection(info.ConnectionString),
+                _ => throw new ScriptSandboxException("Unsupported database provider.") };
+            if (info.Open) await connection.OpenAsync(cancellationToken);
+            return connection;
+        }
+        public async Task<object?> GetAttributeAsync(string canonicalName, CancellationToken ct)
+            => ScriptAnalysisService.JsonElementToObject(await Call("get", [canonicalName], ct));
+        public async Task SetAttributeAsync(string canonicalName, string value, CancellationToken ct) => await Call("set", [canonicalName, value], ct);
+        public async Task<object?> CallScriptAsync(string canonicalScriptName, IReadOnlyDictionary<string, object?>? parameters, CancellationToken ct)
+            => ScriptAnalysisService.JsonElementToObject(await Call("script", [canonicalScriptName, parameters], ct));
+        public async Task<WaitResult> WaitForAttributeAsync(string canonicalName, string? targetValueEncoded, TimeSpan timeout, bool requireGoodQuality, CancellationToken ct)
+            => (await Call("wait", [canonicalName, targetValueEncoded, timeout.Ticks, requireGoodQuality], ct)).Deserialize<WaitResult>(Json)!;
+    }
+}
@@ -189,20 +189,9 @@ public class ScriptAnalysisService
    private const int SandboxMaxCallSharedDepth = 16;

    /// <summary>
-    /// Process-wide cap on concurrently executing Test Runs (arch-review WP2.4).
-    /// <para>
-    /// A sandbox run occupies a thread-pool thread for its whole duration — the
-    /// <c>SandboxScriptHost</c> attribute accessors are synchronous by contract and block on
-    /// cross-site I/O (<c>GetAwaiter().GetResult()</c>), so the thread is <em>parked</em>, not
-    /// merely busy, for up to the 10s sandbox timeout. Unbounded, a handful of Designers
-    /// each hitting Run on a slow-bound script could park enough pool threads to starve the
-    /// Blazor circuits sharing this process. The gate bounds that: excess runs wait for a
-    /// slot instead of taking a thread, and the wait is charged to the caller's own timeout.
-    /// </para>
-    /// <para>
-    /// Static because <c>ScriptAnalysisService</c> is registered scoped — a per-instance gate
-    /// would be per-request and bound nothing.
-    /// </para>
+    /// Secondary guard inside the disposable worker. Parent admission and process
+    /// termination are enforced by <see cref="SandboxWorkerProtocol"/>; synchronous
+    /// script helper calls never occupy a central Blazor thread.
    /// </summary>
    private static readonly SemaphoreSlim SandboxRunGate =
        new(SandboxMaxConcurrentRuns, SandboxMaxConcurrentRuns);
@@ -214,7 +203,7 @@ public class ScriptAnalysisService
    private const int SandboxMaxConcurrentRuns = 4;

    /// <summary>
-    /// Compiles and runs a script in the central process. The globals surface
+    /// Compiles and runs a script in a disposable worker process. The globals surface
    /// depends on <see cref="SandboxRunRequest.Kind"/>: template and shared
    /// scripts run against <see cref="SandboxScriptHost"/>, inbound API method
    /// scripts against <see cref="SandboxInboundScriptHost"/>.
@@ -242,7 +231,11 @@ public class ScriptAnalysisService
    /// <param name="request">The sandbox run request including code, kind, parameters, and optional instance binding.</param>
    /// <param name="ct">Cancellation token for the caller; combined with an internal timeout CTS.</param>
    /// <returns>A <see cref="SandboxRunResult"/> describing the outcome, return value, console output, and any error.</returns>
-    public virtual async Task<SandboxRunResult> RunInSandboxAsync(SandboxRunRequest request, CancellationToken ct)
+    public virtual Task<SandboxRunResult> RunInSandboxAsync(SandboxRunRequest request, CancellationToken ct)
+        => SandboxWorkerProtocol.RunAsync(request, _services, _sharedScripts, ct);
+
+    /// <summary>Execution core invoked only by the disposable worker executable.</summary>
+    public async Task<SandboxRunResult> RunInWorkerAsync(SandboxRunRequest request, CancellationToken ct)
    {
        if (string.IsNullOrWhiteSpace(request.Code))
        {
@@ -294,7 +287,7 @@ public class ScriptAnalysisService
        // Trust-model gate: the documented forbidden-API set is
        // enforced HERE, before execution — not merely surfaced as an editor hint.
        // Without this, a Design-role user could run arbitrary file/process/
-        // reflection/network code in the central host process.
+        // reflection/network code in the worker process.
        var trustViolations = EnforceTrustModel(script.GetCompilation());
        if (trustViolations.Count > 0)
        {
@@ -313,9 +306,9 @@ public class ScriptAnalysisService
        // Optional instance binding: when the Test Run targets a deployed
        // instance, Instance.GetAttribute/SetAttribute/CallScript and the
        // Attributes/Children/Parent accessors route to it cross-site.
-        ISandboxInstanceGateway? instanceGateway = null;
-        var instanceLabel = "test-run";
-        if (request.Kind != ScriptKind.InboundApi
+        ISandboxInstanceGateway? instanceGateway = _services.GetService<ISandboxInstanceGateway>();
+        var instanceLabel = request.BindInstanceUniqueName ?? "test-run";
+        if (instanceGateway is null && request.Kind != ScriptKind.InboundApi
            && !string.IsNullOrWhiteSpace(request.BindInstanceUniqueName))
        {
            var bindName = request.BindInstanceUniqueName.Trim();
@@ -457,7 +450,7 @@ public class ScriptAnalysisService
        // restore Console.Out while the other is still writing. SandboxConsoleCapture
        // installs routing writers once and scopes capture to this call-tree only.
        var (captureOut, captureError) = SandboxConsoleCapture.Install();
-        var captured = new StringWriter();
+        var captured = new BoundedSandboxWriter(SandboxMaxConsoleChars);
        using var outScope = captureOut.BeginCapture(captured);
        using var errorScope = captureError.BeginCapture(captured);

@@ -485,7 +478,7 @@ public class ScriptAnalysisService
                Success: true,
                ReturnValueJson: returnJson,
                ReturnTypeName: returnType,
-                ConsoleOutput: TruncateConsole(captured.ToString()),
+                ConsoleOutput: captured.ToString(),
                Error: null,
                ErrorKind: SandboxErrorKind.None,
                DurationMs: stopwatch.ElapsedMilliseconds,
@@ -495,14 +488,14 @@ public class ScriptAnalysisService
        {
            stopwatch.Stop();
            return new SandboxRunResult(false, null, null,
-                TruncateConsole(captured.ToString()), sandboxEx.Message,
+                captured.ToString(), sandboxEx.Message,
                SandboxErrorKind.SandboxLimitation, stopwatch.ElapsedMilliseconds, null);
        }
        catch (OperationCanceledException) when (timeoutCts.IsCancellationRequested)
        {
            stopwatch.Stop();
            return new SandboxRunResult(false, null, null,
-                TruncateConsole(captured.ToString()),
+                captured.ToString(),
                $"Script execution exceeded the {timeoutSeconds}-second sandbox timeout.",
                SandboxErrorKind.Timeout, stopwatch.ElapsedMilliseconds, null);
        }
@@ -513,11 +506,11 @@ public class ScriptAnalysisService
            if (inner is ScriptSandboxException sx)
            {
                return new SandboxRunResult(false, null, null,
-                    TruncateConsole(captured.ToString()), sx.Message,
+                    captured.ToString(), sx.Message,
                    SandboxErrorKind.SandboxLimitation, stopwatch.ElapsedMilliseconds, null);
            }
            return new SandboxRunResult(false, null, null,
-                TruncateConsole(captured.ToString()),
+                captured.ToString(),
                $"{inner.GetType().Name}: {inner.Message}",
                SandboxErrorKind.RuntimeError, stopwatch.ElapsedMilliseconds, null);
        }
@@ -542,7 +535,7 @@ public class ScriptAnalysisService
        return result;
    }

-    private static object? JsonElementToObject(JsonElement element)
+    internal static object? JsonElementToObject(JsonElement element)
    {
        return element.ValueKind switch
        {
@@ -561,25 +554,17 @@ public class ScriptAnalysisService

    private static (string Json, string TypeName) SerializeReturn(object? value)
    {
-        if (value == null) return ("null", "null");
-        var typeName = value.GetType().Name;
+        var typeName = value?.GetType().FullName ?? "null";
        try
        {
-            var json = JsonSerializer.Serialize(value, SandboxReturnJsonOptions);
-            if (json.Length > SandboxMaxReturnJsonChars)
-                json = json[..SandboxMaxReturnJsonChars] + "\n… (truncated)";
-            return (json, typeName);
+            if (value is string text && text.Length > SandboxMaxReturnJsonChars)
+                return ("\"<return value truncated>\"", typeName);
+            using var buffer = new BoundedSandboxStream(SandboxMaxReturnJsonChars);
+            JsonSerializer.Serialize(buffer, value, SandboxReturnJsonOptions);
+            return (Encoding.UTF8.GetString(buffer.GetBuffer(), 0, (int)buffer.Length), typeName);
        }
-        catch (Exception ex)
-        {
-            return ($"\"<unserializable: {ex.Message}>\"", typeName);
-        }
-    }
-
-    private static string TruncateConsole(string text)
-    {
-        if (text.Length <= SandboxMaxConsoleChars) return text;
-        return text[..SandboxMaxConsoleChars] + "\n… (truncated)";
+        catch (InvalidDataException) { return ("\"<return value truncated>\"", typeName); }
+        catch (Exception) { return ("\"<unserializable>\"", typeName); }
    }

    private DiagnoseResponse Cache(string key, DiagnoseResponse value)
@@ -37,6 +37,7 @@ public static class ServiceCollectionExtensions
        // Resolves the current user's permitted site set from their SiteId claims
        // so Deployment/Monitoring pages can enforce site scoping.
        services.AddScoped<SiteScopeService>();
+        services.AddScoped<ConfigurationCommandService>();

        // Centralised dialog service: pages inject IDialogService and a single
        // <DialogHost /> in MainLayout renders the active dialog. See
@@ -54,7 +55,7 @@ public static class ServiceCollectionExtensions
        // racing AuditFilterBar's site enumeration on the shared scoped context.
        services.AddScoped<IAuditLogQueryService>(sp => new AuditLogQueryService(
            sp.GetRequiredService<IServiceScopeFactory>(),
-            sp.GetRequiredService<ICentralHealthAggregator>()));
+            sp.GetRequiredService<ICentralHealthAggregator>(), sp.GetRequiredService<AuthenticationStateProvider>()));

        // Server-side streaming CSV export.
        // Backs the Audit Log page's Export button via GET /api/centralui/audit/export.
@@ -1,3 +1,6 @@
+using Microsoft.AspNetCore.Components.Authorization;
+using ZB.MOM.WW.ScadaBridge.CentralUI.Auth;
+using ZB.MOM.WW.ScadaBridge.Security;
 using Microsoft.Extensions.DependencyInjection;
 using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories;
 using ZB.MOM.WW.ScadaBridge.Commons.Types;
@@ -45,6 +48,7 @@ public sealed class AuditLogQueryService : IAuditLogQueryService

    // Production path: open a fresh scope per operation. Null in the test-seam ctor.
    private readonly IServiceScopeFactory? _scopeFactory;
+    private readonly AuthenticationStateProvider? _auth;

    // Test seam: a directly-injected repository whose lifetime the test owns.
    // Null in the production ctor.
@@ -68,9 +72,10 @@ public sealed class AuditLogQueryService : IAuditLogQueryService
    /// <param name="healthAggregator">Central health aggregator for KPI backlog data.</param>
    public AuditLogQueryService(
        IServiceScopeFactory scopeFactory,
-        ICentralHealthAggregator healthAggregator)
+        ICentralHealthAggregator healthAggregator, AuthenticationStateProvider? auth = null)
    {
        _scopeFactory = scopeFactory ?? throw new ArgumentNullException(nameof(scopeFactory));
+        _auth = auth;
        _healthAggregator = healthAggregator ?? throw new ArgumentNullException(nameof(healthAggregator));
    }

@@ -171,7 +176,12 @@ public sealed class AuditLogQueryService : IAuditLogQueryService
        // page's auto-load never shares the circuit-scoped context.
        await using var scope = _scopeFactory!.CreateAsyncScope();
        var repository = scope.ServiceProvider.GetRequiredService<IAuditLogRepository>();
-        return await repository.GetExecutionTreeAsync(executionId, ct);
+        if (_auth is null) throw new InvalidOperationException("Audit tree caller authentication is not configured.");
+        var principal = (await _auth.GetAuthoritativeStateAsync()).User;
+        if (principal.Identity?.IsAuthenticated != true || !principal.FindAll(JwtTokenService.RoleClaimType).Any(c => AuthorizationPolicies.OperationalAuditRoles.Contains(c.Value))) throw new UnauthorizedAccessException();
+        var sites = principal.FindAll(JwtTokenService.SiteIdClaimType).Select(c => c.Value).ToArray();
+        var permitted = principal.HasClaim(JwtTokenService.RoleClaimType, Roles.Administrator) || sites.Length == 0 ? null : sites;
+        return await repository.GetExecutionTreeAsync(executionId, ct, permitted);
    }

    /// <inheritdoc/>
@@ -1,3 +1,4 @@
+using ZB.MOM.WW.ScadaBridge.CentralUI.Auth;
 using Microsoft.AspNetCore.Components.Authorization;
 using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management;
 using ZB.MOM.WW.ScadaBridge.Communication;
@@ -39,7 +40,7 @@ public sealed class BindingTester : IBindingTester
        // roles, so the Designer check must happen here before any cross-cluster
        // traffic. Use HasClaim against JwtTokenService.RoleClaimType (not
        // IsInRole, per c1e16cf).
-        var state = await _auth.GetAuthenticationStateAsync();
+        var state = await _auth.GetAuthoritativeStateAsync();
        if (!state.User.HasClaim(JwtTokenService.RoleClaimType, Roles.Designer))
        {
            return new ReadTagValuesResult(
@@ -1,3 +1,4 @@
+using ZB.MOM.WW.ScadaBridge.CentralUI.Auth;
 using Microsoft.AspNetCore.Components.Authorization;
 using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Protocol;
 using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management;
@@ -45,7 +46,7 @@ public sealed class BrowseService : IBrowseService
    {
        // CentralUI-side role guard — sites don't enforce envelope-level roles,
        // so the Designer check must happen here before any cross-cluster traffic.
-        var state = await _auth.GetAuthenticationStateAsync();
+        var state = await _auth.GetAuthoritativeStateAsync();
        if (!state.User.HasClaim(JwtTokenService.RoleClaimType, Roles.Designer))
        {
            return new BrowseNodeResult(
@@ -100,7 +101,7 @@ public sealed class BrowseService : IBrowseService
        // Same CentralUI-side role guard as BrowseChildrenAsync — sites don't
        // enforce envelope-level roles, so the Designer check must happen here
        // before any cross-cluster traffic.
-        var state = await _auth.GetAuthenticationStateAsync();
+        var state = await _auth.GetAuthoritativeStateAsync();
        if (!state.User.HasClaim(JwtTokenService.RoleClaimType, Roles.Designer))
        {
            return new SearchAddressSpaceResult(
@@ -1,3 +1,4 @@
+using ZB.MOM.WW.ScadaBridge.CentralUI.Auth;
 using Microsoft.AspNetCore.Components.Authorization;
 using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management;
 using ZB.MOM.WW.ScadaBridge.Communication;
@@ -142,7 +143,7 @@ public sealed class CertManagementService : ICertManagementService

    private async Task<bool> HasRoleAsync(string role)
    {
-        var state = await _auth.GetAuthenticationStateAsync();
+        var state = await _auth.GetAuthoritativeStateAsync();
        return state.User.HasClaim(JwtTokenService.RoleClaimType, role);
    }
 }
@@ -0,0 +1,57 @@
+using Microsoft.AspNetCore.Components.Authorization;
+using Microsoft.Extensions.DependencyInjection;
+using ZB.MOM.WW.ScadaBridge.CentralUI.Auth;
+using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services;
+using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management;
+using ZB.MOM.WW.ScadaBridge.ManagementService;
+using ZB.MOM.WW.ScadaBridge.Security;
+
+namespace ZB.MOM.WW.ScadaBridge.CentralUI.Services;
+
+/// <summary>Fresh caller authorization and audited configuration commands for page event handlers.</summary>
+public sealed class ConfigurationCommandService(IServiceProvider services, AuthenticationStateProvider auth)
+{
+    /// <summary>Runs an existing audited instance operation with fresh scope and an atomic audit commit.</summary>
+    public async Task<T> ExecuteInstanceAsync<T>(int? instanceId, int? createSiteId,
+        Func<ZB.MOM.WW.ScadaBridge.TemplateEngine.Services.InstanceService, string, Task<T>> operation)
+    {
+        var username = await auth.RequireRoleAsync(Roles.Deployer);
+        var sites = new SiteScopeService(auth);
+        try
+        {
+            return (T)(await services.GetRequiredService<IConfigurationCommandTransaction>().ExecuteAsync(async sp =>
+            {
+                var siteId = createSiteId;
+                if (instanceId.HasValue)
+                {
+                    var instance = await sp.GetRequiredService<ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Repositories.ITemplateEngineRepository>().GetInstanceByIdAsync(instanceId.Value);
+                    siteId = instance?.SiteId;
+                }
+                if (!siteId.HasValue || !await sites.IsSiteAllowedAsync(siteId.Value))
+                    throw new UnauthorizedAccessException("Instance site access was revoked.");
+                return await operation(sp.GetRequiredService<ZB.MOM.WW.ScadaBridge.TemplateEngine.Services.InstanceService>(), username);
+            }))!;
+        }
+        finally { services.GetService<IConfigurationReadSession>()?.Reset(); }
+    }
+
+    /// <summary>Executes one command through the same guarded boundary as the management actor.</summary>
+    public async Task<object?> ExecuteAsync(object command)
+    {
+        var principal = (await auth.GetAuthoritativeStateAsync()).User;
+        if (principal.Identity?.IsAuthenticated != true) throw new UnauthorizedAccessException("Session expired.");
+        var user = new AuthenticatedUser(principal.GetUsername(), principal.GetDisplayName() ?? principal.GetUsername(),
+            principal.FindAll(JwtTokenService.RoleClaimType).Select(c => c.Value).ToArray(),
+            principal.FindAll(JwtTokenService.SiteIdClaimType).Select(c => c.Value).ToArray());
+        try { return await ManagementActor.ExecuteConfigurationCommandAsync(services, command, user, services.GetService<CircuitClientAddressProvider>()?.ClientAddress); }
+        finally { services.GetService<IConfigurationReadSession>()?.Reset(); }
+    }
+}
+
+/// <summary>Resolves the mutation facade only when a page acts, keeping read-only rendering independent.</summary>
+public static class ConfigurationCommandExtensions
+{
+    /// <summary>Submits a database-only configuration mutation with current server-side authority.</summary>
+    public static Task<object?> ExecuteConfigurationAsync(this IServiceProvider services, object command)
+        => services.GetRequiredService<ConfigurationCommandService>().ExecuteAsync(command);
+}
@@ -1,3 +1,4 @@
+using ZB.MOM.WW.ScadaBridge.CentralUI.Auth;
 using System.Security.Claims;
 using Akka.Actor;
 using Microsoft.AspNetCore.Components.Authorization;
@@ -106,7 +107,7 @@ public sealed class DataConnectionMoveService : IDataConnectionMoveService
    /// </summary>
    private async Task<AuthenticatedUser> BuildAuthenticatedUserAsync()
    {
-        var state = await _auth.GetAuthenticationStateAsync();
+        var state = await _auth.GetAuthoritativeStateAsync();
        var principal = state.User;

        var username = principal.FindFirst(JwtTokenService.UsernameClaimType)?.Value ?? "unknown";
@@ -1,3 +1,4 @@
+using ZB.MOM.WW.ScadaBridge.CentralUI.Auth;
 using Microsoft.AspNetCore.Components.Authorization;
 using ZB.MOM.WW.ScadaBridge.Commons.Messages.Management;
 using ZB.MOM.WW.ScadaBridge.Commons.Serialization;
@@ -47,7 +48,7 @@ public sealed class EndpointVerificationService : IEndpointVerificationService
    {
        // CentralUI-side role guard — sites don't enforce envelope-level roles, so the
        // Designer check must happen here before any cross-cluster traffic.
-        var state = await _auth.GetAuthenticationStateAsync();
+        var state = await _auth.GetAuthoritativeStateAsync();
        if (!state.User.HasClaim(JwtTokenService.RoleClaimType, Roles.Designer))
        {
            return new VerifyEndpointResult(
@@ -299,7 +299,7 @@ public sealed class FlowDebugService : IFlowDebugService
        var shortId = c.ToString("N")[..12];
        try
        {
-            var requestedBy = await _auth.GetCurrentUsernameAsync();
+            var requestedBy = await _auth.RequireRoleAsync(Roles.Deployer);
            var corr = Guid.NewGuid().ToString("N");

            if (isNotify)
@@ -580,7 +580,7 @@ public sealed class FlowDebugService : IFlowDebugService

    private async Task<AuthenticatedUser> BuildAuthenticatedUserAsync()
    {
-        var state = await _auth.GetAuthenticationStateAsync();
+        var state = await _auth.GetAuthoritativeStateAsync();
        var principal = state.User;

        var username = principal.FindFirst(JwtTokenService.UsernameClaimType)?.Value ?? "unknown";
@@ -1,3 +1,4 @@
+using ZB.MOM.WW.ScadaBridge.CentralUI.Auth;
 using System.Security.Claims;
 using System.Text.Json;
 using Akka.Actor;
@@ -144,7 +145,7 @@ public sealed class SchemaLibraryService : ISchemaLibraryService
    /// </summary>
    private async Task<AuthenticatedUser> BuildAuthenticatedUserAsync()
    {
-        var state = await _auth.GetAuthenticationStateAsync();
+        var state = await _auth.GetAuthoritativeStateAsync();
        var principal = state.User;

        var username = principal.FindFirst(JwtTokenService.UsernameClaimType)?.Value ?? "unknown";
@@ -1,3 +1,4 @@
+using ZB.MOM.WW.ScadaBridge.CentralUI.Auth;
 using System.Security.Claims;
 using System.Text.Json;
 using Akka.Actor;
@@ -165,7 +166,7 @@ public sealed class SecuredWriteService : ISecuredWriteService
    /// </summary>
    private async Task<AuthenticatedUser> BuildAuthenticatedUserAsync()
    {
-        var state = await _auth.GetAuthenticationStateAsync();
+        var state = await _auth.GetAuthoritativeStateAsync();
        var principal = state.User;

        var username = principal.FindFirst(JwtTokenService.UsernameClaimType)?.Value ?? "unknown";
@@ -1,3 +1,4 @@
+using ZB.MOM.WW.ScadaBridge.CentralUI.Auth;
 using System.Security.Claims;
 using System.Text.Json;
 using Akka.Actor;
@@ -112,7 +113,7 @@ public sealed class TemplateInheritanceQueryService : ITemplateInheritanceQueryS
    /// </summary>
    private async Task<AuthenticatedUser> BuildAuthenticatedUserAsync()
    {
-        var state = await _auth.GetAuthenticationStateAsync();
+        var state = await _auth.GetAuthoritativeStateAsync();
        var principal = state.User;

        var username = principal.FindFirst(JwtTokenService.UsernameClaimType)?.Value ?? "unknown";
@@ -21,3 +21,24 @@ export async function ping(url) {
        return 0;
    }
 }
+
+// SignalR event traffic and automatic pings are not user activity. Only trusted
+// browser input can schedule this antiforgery-protected request.
+let lastReported = 0;
+let reporting = false;
+async function recordInput(event) {
+    if (!event.isTrusted || reporting || Date.now() - lastReported < 15000) return;
+    const token = document.querySelector('input[name="__RequestVerificationToken"]')?.value;
+    if (!token) return;
+    reporting = true;
+    try {
+        const response = await fetch('/auth/activity', {
+            method: 'POST', credentials: 'same-origin', cache: 'no-store',
+            headers: { 'RequestVerificationToken': token }
+        });
+        if (response.ok) lastReported = Date.now();
+    } catch { /* A failed request never advances the server's idle clock. */ }
+    finally { reporting = false; }
+}
+for (const name of ['pointerdown', 'keydown', 'wheel', 'touchstart'])
+    document.addEventListener(name, recordInput, { passive: true });
@@ -0,0 +1,5 @@
+namespace ZB.MOM.WW.ScadaBridge.Commons.Entities.Instances;
+
+/// <summary>A database-enforced global instance name conflict, including concurrent creation.</summary>
+public sealed class InstanceNameConflictException(Exception innerException)
+    : InvalidOperationException("An instance with this unique name already exists. Choose a different name.", innerException);
@@ -294,7 +294,7 @@ public interface IAuditLogRepository
    /// <returns>A task that resolves to the full execution tree rooted at the topmost ancestor, one node per distinct execution.</returns>
    Task<IReadOnlyList<ExecutionTreeNode>> GetExecutionTreeAsync(
        Guid executionId,
-        CancellationToken ct = default);
+        CancellationToken ct = default, IReadOnlyList<string>? permittedSiteIds = null);

    /// <summary>
    /// Flow Debugger Replay (design 2026-09-05 §7.1): every row of the execution tree that
@@ -309,7 +309,7 @@ public interface IAuditLogRepository
    /// <returns>The canonical audit events that make up the flow, oldest first.</returns>
    Task<IReadOnlyList<AuditEvent>> GetTraceEventsAsync(
        Guid executionId,
-        CancellationToken ct = default);
+        CancellationToken ct = default, IReadOnlyList<string>? permittedSiteIds = null);

    /// <summary>
    /// Returns the distinct, non-null <c>SourceNode</c> values present in the
@@ -0,0 +1,22 @@
+namespace ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services;
+
+/// <summary>Executes one database-only configuration command and its audit rows atomically.</summary>
+public interface IConfigurationCommandTransaction
+{
+    /// <summary>Each database retry supplies a fresh scope; the operation must not perform external side effects.</summary>
+    Task<object?> ExecuteAsync(Func<IServiceProvider, Task<object?>> operation);
+}
+
+/// <summary>Defers local cache/channel maintenance until a configuration commit succeeds.</summary>
+public interface IConfigurationCommitActions
+{
+    /// <summary>Queues an idempotent local maintenance action.</summary>
+    void Add(Func<Task> action);
+}
+
+/// <summary>Evicts a circuit's tracked read entities after a separately scoped configuration command.</summary>
+public interface IConfigurationReadSession
+{
+    /// <summary>Clears stale tracked read state; form drafts must be held separately.</summary>
+    void Reset();
+}
@@ -0,0 +1,6 @@
+namespace ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services;
+/// <summary>Private worker handoff for an existing configured SQL connection. Never log or expose the returned secret.</summary>
+public interface ISandboxDatabaseConnectionSource
+{
+    Task<string> GetSandboxConnectionStringAsync(string connectionName, CancellationToken cancellationToken);
+}
--- a/Show More
+++ b/Show More