Merge branch 'fix/archreview-crit1-split-brain-resolver'

src/Core/ZB.MOM.WW.OtOpcUa.Cluster/Resources/akka.conf

@@ -37,6 +37,14 @@ akka {
         roles = []
         min-nr-of-members = 1
 
+        # Split-brain resolver (arch-review 03/S1). This block IS active: Akka.Cluster.Hosting's
+        # WithClustering enables an SBR downing provider by default (it applies
+        # SplitBrainResolverOption.Default when ClusterOptions.SplitBrainResolver is null), and that
+        # provider reads this block. ServiceCollectionExtensions.BuildClusterOptions additionally sets
+        # the typed KeepOldestOption { DownIfAlone = true } to make the strategy EXPLICIT in code —
+        # its active-strategy + keep-oldest.down-if-alone MUST match this block. (The cluster is NOT
+        # NoDowning; only an explicit downing-provider-class = "" would disable failover.)
+        # stable-after must stay >= failure-detector.acceptable-heartbeat-pause (10s) + margin.
         split-brain-resolver {
             active-strategy = "keep-oldest"
             stable-after = 15s

src/Core/ZB.MOM.WW.OtOpcUa.Cluster/ServiceCollectionExtensions.cs

@@ -1,4 +1,5 @@
 using Akka.Cluster.Hosting;
+using Akka.Cluster.Hosting.SBR;
 using Akka.Event;
 using Akka.Hosting;
 using Akka.Logger.Serilog;
@@ -77,12 +78,42 @@ public static class ServiceCollectionExtensions
             PublicHostName = options.PublicHostname,
         });
 
-        builder.WithClustering(new ClusterOptions
-        {
-            SeedNodes = options.SeedNodes,
-            Roles = options.Roles,
-        });
+        builder.WithClustering(BuildClusterOptions(options));
 
         return builder;
     }
+
+    /// <summary>
+    /// Builds the <see cref="ClusterOptions"/> for the fused-host cluster, setting the split-brain-resolver
+    /// strategy <b>explicitly in code</b>.
+    ///
+    /// <b>Activation note (arch-review 03/S1, corrected):</b> Akka.Cluster.Hosting's <c>WithClustering</c>
+    /// already enables an SBR downing provider <b>by default</b> — when <see cref="ClusterOptions.SplitBrainResolver"/>
+    /// is <c>null</c> it applies <c>SplitBrainResolverOption.Default</c>, which registers
+    /// <c>Akka.Cluster.SBR.SplitBrainResolverProvider</c> and reads the <c>split-brain-resolver</c> HOCON block in
+    /// <c>Resources/akka.conf</c>. So the cluster was <b>not</b> running <c>NoDowning</c> before this option was
+    /// set: the pre-existing akka.conf <c>keep-oldest</c> block was already active, and hard-crashed nodes already
+    /// failed over. Setting this typed option makes the strategy <b>explicit in code</b> (independent of the
+    /// framework default) rather than being the sole activator — it is reinforcing/belt-and-suspenders and
+    /// produces the same effective behavior. (Only an <i>explicit</i> <c>NoDowning</c>, e.g.
+    /// <c>downing-provider-class = ""</c>, would disable failover.)
+    ///
+    /// <see cref="KeepOldestOption"/> with <c>DownIfAlone=true</c> mirrors the HOCON intent and is the
+    /// correct strategy for a 2-node warm-redundancy pair: on an even split the oldest member (typically
+    /// the long-running primary) survives, and <c>down-if-alone</c> downs a singleton that loses its
+    /// peer. <c>keep-majority</c>/<c>static-quorum</c> are wrong for two nodes. The strategy + down-if-alone
+    /// here MUST stay consistent with the HOCON block; <c>stable-after</c> lives only in HOCON because the
+    /// typed option cannot express it (it must stay ≥ <c>failure-detector.acceptable-heartbeat-pause</c>).
+    /// </summary>
+    /// <param name="options">The bound cluster options carrying seed nodes and roles.</param>
+    /// <returns>The cluster options with seed nodes, roles, and the explicit split-brain-resolver strategy.</returns>
+    public static ClusterOptions BuildClusterOptions(AkkaClusterOptions options)
+    {
+        return new ClusterOptions
+        {
+            SeedNodes = options.SeedNodes,
+            Roles = options.Roles,
+            SplitBrainResolver = new KeepOldestOption { DownIfAlone = true },
+        };
+    }
 }