fix(historian): #674 review follow-ups — HistoryUpdate boot-window gate, node-level v1 refusal, plan-before-gate, UTC skew compare

- HistoryUpdate Primary gate now reads IHistoryUpdateRoleView (PrimaryGatePolicy.ShouldServeHistoryUpdate):
  the data-plane verdict but CLOSED until this node's first redundancy snapshot, so both pair nodes cannot
  accept in the pre-join boot window. Single nodes open on their own singleton's first snapshot; admin-only
  nodes register no view => no gate. DriverHostActor publishes it at every Primary-verdict publish point.
- SqlServer v1: the updater throws NotSupportedException on every arm; the node manager maps it to a
  node-level BadHistoryOperationUnsupported (was per-item under a Good node for UpdateData/DeleteAtTime).
  HistoryWrite bit still advertised on v1 (not knowable at materialise time) — documented.
- The update plan is evaluated before the Primary gate: an unservable request (Remove, IsDeleteModified,
  not historized, no updater) is BadHistoryOperationUnsupported off-Primary, not BadInvalidState.
- Local-kind SourceTimestamp converted to UTC before the future-skew compare and sent as UTC.
- Hosted-service wiring extracted to BuildHistoryUpdatePosture and tested (gate source, skew, clock).
- Docs: Historian.md (boot window, ordering, node-level v1, HistoryWrite bit), CLAUDE.md.

Co-Authored-By: Claude <noreply@anthropic.com>

src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/Historian/IHistorianDataUpdater.cs

@@ -23,6 +23,12 @@ public enum HistoryUpdateMode
 ///     <see cref="HistoryUpdateContext.Principal"/>, the modification time and the <see cref="HistoryModificationType"/>,
 ///     readable through <see cref="IHistorianDataSource.ReadModifiedAsync"/>. A refused item (any non-Good code) leaves
 ///     no record. Live recorder writes and retention purges never leave one.
+///     <para>
+///         <b>Cannot update at all</b> (Gitea #674): an implementation that is wired but cannot perform any update right
+///         now — the SqlServer backend on a schema without the modification trail — throws
+///         <see cref="NotSupportedException"/> from every method without touching storage. The server reports it as a
+///         node-level <c>BadHistoryOperationUnsupported</c>, the same as <see cref="IHistorianDataSource.ReadModifiedAsync"/>.
+///     </para>
 /// </remarks>
 public interface IHistorianDataUpdater
 {

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Sql.Common/HistorianStatusCodes.cs

@@ -27,10 +27,4 @@ public static class HistorianStatusCodes
     ///     status, or a tag name longer than <see cref="HistorianTagNames.MaxLength"/>.
     /// </summary>
     public const uint BadInvalidArgument = 0x80AB0000u;
-
-    /// <summary>
-    ///     A modified-value read or HistoryUpdate item against a SQL Server schema still at version 1 (no Part 11
-    ///     modification trail, Gitea #674): refused without touching the database.
-    /// </summary>
-    public const uint BadHistoryOperationUnsupported = 0x80720000u;
 }

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.SqlServer/SqlServerHistorianDataUpdater.cs

@@ -28,8 +28,9 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.Historian.SqlServer;
 ///     <see cref="HistoryModificationType"/> and <c>SYSUTCDATETIME()</c>. One statement means the sample change and its
 ///     audit row commit or roll back together: a failed update leaves no audit row.</para>
 ///     <para><b>Schema v1 (Gitea #674).</b> Without the trail (<see cref="SqlServerSchemaBootstrapper.SupportsModifiedTrail"/>
-///     false) a change could not be audited, so every item (and DeleteRaw's single result) reports
-///     <c>BadHistoryOperationUnsupported</c> and nothing is sent to the database beyond the one-time schema check.</para>
+///     false) a change could not be audited, so every call throws <see cref="NotSupportedException"/> — which the node
+///     manager reports as a node-level <c>BadHistoryOperationUnsupported</c>, on all three arms alike — and nothing is
+///     sent to the database beyond the one-time schema check.</para>
 /// </summary>
 internal sealed class SqlServerHistorianDataUpdater : IHistorianDataUpdater
 {
@@ -49,20 +50,19 @@ internal sealed class SqlServerHistorianDataUpdater : IHistorianDataUpdater
         _tags = tags;
     }
 
-    /// <summary>#674: ensures the schema and reports whether the Part 11 trail exists (no SQL after the first success).</summary>
+    /// <summary>
+    ///     #674: ensures the schema and refuses the call when it has no Part 11 trail (no SQL after the first success).
+    /// </summary>
     /// <param name="ct">Cancellation.</param>
-    /// <returns>True when the modification trail is available.</returns>
-    private async Task<bool> TrailAvailableAsync(CancellationToken ct)
+    /// <returns>A task completing when the trail is available.</returns>
+    /// <exception cref="NotSupportedException">The schema is below <see cref="SqlServerSchemaBootstrapper.ModifiedTrailVersion"/>.</exception>
+    private async Task RequireTrailAsync(CancellationToken ct)
     {
         await _bootstrap.EnsureAsync(ct).ConfigureAwait(false);
-        return _bootstrap.SupportsModifiedTrail;
-    }
-
-    private static uint[] Unsupported(int count)
-    {
-        var codes = new uint[count];
-        Array.Fill(codes, HistorianStatusCodes.BadHistoryOperationUnsupported);
-        return codes;
+        if (!_bootstrap.SupportsModifiedTrail)
+            throw new NotSupportedException(
+                $"Historian schema [{_conn.Schema}] is below version {SqlServerSchemaBootstrapper.ModifiedTrailVersion}: " +
+                "HistoryUpdate needs the Part 11 modification trail (apply 002_sample_modified.sql and restart).");
     }
 
     /// <inheritdoc/>
@@ -72,7 +72,7 @@ internal sealed class SqlServerHistorianDataUpdater : IHistorianDataUpdater
         ArgumentNullException.ThrowIfNull(tag);
         ArgumentNullException.ThrowIfNull(values);
         ArgumentNullException.ThrowIfNull(context);
-        if (!await TrailAvailableAsync(ct).ConfigureAwait(false)) return Unsupported(values.Count);
+        await RequireTrailAsync(ct).ConfigureAwait(false);
         var plan = HistoryUpdatePlanner.Plan(tag, mode, values);
         if (plan.Winners.Count == 0) return HistoryUpdatePlanner.Complete(plan, mode, new Dictionary<long, UpsertOutcome>());
 
@@ -92,7 +92,7 @@ internal sealed class SqlServerHistorianDataUpdater : IHistorianDataUpdater
     {
         ArgumentNullException.ThrowIfNull(tag);
         ArgumentNullException.ThrowIfNull(context);
-        if (!await TrailAvailableAsync(ct).ConfigureAwait(false)) return HistorianStatusCodes.BadHistoryOperationUnsupported;
+        await RequireTrailAsync(ct).ConfigureAwait(false);
         if (!HistorianTagNames.IsValid(tag)) return HistorianStatusCodes.BadInvalidArgument;
         var tagId = await _tags.TryGetTagIdAsync(tag, ct).ConfigureAwait(false);
         if (tagId is null) return HistoryUpdatePlanner.DeleteRawResult(tagKnown: false, 0);
@@ -120,7 +120,7 @@ internal sealed class SqlServerHistorianDataUpdater : IHistorianDataUpdater
         ArgumentNullException.ThrowIfNull(tag);
         ArgumentNullException.ThrowIfNull(timesUtc);
         ArgumentNullException.ThrowIfNull(context);
-        if (!await TrailAvailableAsync(ct).ConfigureAwait(false)) return Unsupported(timesUtc.Count);
+        await RequireTrailAsync(ct).ConfigureAwait(false);
         if (!HistorianTagNames.IsValid(tag))
         {
             var refused = new uint[timesUtc.Count];

src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/OtOpcUaServerHostedService.cs

@@ -13,6 +13,7 @@ using ZB.MOM.WW.OtOpcUa.OpcUaServer.Security;
 using ZB.MOM.WW.OtOpcUa.Runtime;
 using ZB.MOM.WW.OtOpcUa.Runtime.Drivers;
 using ZB.MOM.WW.OtOpcUa.Runtime.Historian;
+using ZB.MOM.WW.OtOpcUa.Runtime.Redundancy;
 using ZB.MOM.WW.OtOpcUa.Runtime.ScriptedAlarms;
 
 namespace ZB.MOM.WW.OtOpcUa.Host.OpcUa;
@@ -46,6 +47,7 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
     private readonly ILogger<OtOpcUaServerHostedService> _logger;
     private readonly IDriverPrimaryRoleSource? _primaryRoleSource;
     private readonly HistorianUpdaterHolder _historianUpdater;
+    private readonly IHistoryUpdateRoleView? _historyUpdateRoleView;
 
     private OpcUaApplicationHost? _appHost;
     private OtOpcUaSdkServer? _server;
@@ -98,6 +100,9 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
     /// <param name="historianUpdater">The selected historian backend's optional HistoryUpdate capability.
     /// Optional: when unregistered it resolves to <see cref="HistorianUpdaterHolder.None"/> and HistoryUpdate is
     /// reported unsupported on every node.</param>
+    /// <param name="historyUpdateRoleView">Gitea #674 — the HistoryUpdate verdict <c>DriverHostActor</c> publishes (the
+    /// data-plane Primary verdict, closed until this node's first redundancy snapshot). Optional: registered on every
+    /// driver-role node; an admin-only node has none and wires no HistoryUpdate Primary gate (allow).</param>
     public OtOpcUaServerHostedService(
         IOptions<OpcUaApplicationHostOptions> options,
         DeferredAddressSpaceSink deferredSink,
@@ -113,7 +118,8 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
         TimeProvider time,
         ILoggerFactory loggerFactory,
         IDriverPrimaryRoleSource? primaryRoleSource = null,
-        HistorianUpdaterHolder? historianUpdater = null)
+        HistorianUpdaterHolder? historianUpdater = null,
+        IHistoryUpdateRoleView? historyUpdateRoleView = null)
     {
         ArgumentNullException.ThrowIfNull(aclOptions);
         ArgumentNullException.ThrowIfNull(time);
@@ -137,6 +143,7 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
         _loggerFactory = loggerFactory;
         _primaryRoleSource = primaryRoleSource;
         _historianUpdater = historianUpdater ?? HistorianUpdaterHolder.None;
+        _historyUpdateRoleView = historyUpdateRoleView;
         _logger = loggerFactory.CreateLogger<OtOpcUaServerHostedService>();
     }
 
@@ -252,15 +259,13 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
         if (_primaryRoleSource is { } primaryRoleSource)
         {
             _server.SetNativeAlarmAckPrimaryGate(() => primaryRoleSource.ShouldActAsPrimary);
-            // Gitea #674: HistoryUpdate is single-writer — only the Primary rewrites history (BadInvalidState elsewhere).
-            _server.SetHistoryUpdatePrimaryGate(() => primaryRoleSource.ShouldActAsPrimary);
         }
         else
         {
             // Every driver node registers one (AddOtOpcUaRuntime), so this is a wiring regression, not a mode:
             // say so rather than let a Secondary silently go back to accepting acks it will revert.
             _logger.LogWarning(
-                "OtOpcUaServerHostedService: no IDriverPrimaryRoleSource registered — native-alarm acknowledges and HistoryUpdate are accepted on every node regardless of redundancy role");
+                "OtOpcUaServerHostedService: no IDriverPrimaryRoleSource registered — native-alarm acknowledges are accepted on every node regardless of redundancy role");
         }
 
         // Wire the reverse-path inbound operator-write gateway: a client write to a writable equipment-tag
@@ -319,10 +324,13 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
         _server.NodeManager.MaxConcurrentHistoryReadBatches = _serverHistorianOptions.MaxConcurrentHistoryReadBatches;
         _server.NodeManager.HistoryReadDeadline = _serverHistorianOptions.HistoryReadDeadline;
 
-        // Gitea #674: HistoryUpdate refuses a SourceTimestamp beyond now + HistoryUpdateMaxFutureSkew (BadOutOfRange),
+        // Gitea #674: HistoryUpdate is Primary-only (BadInvalidState elsewhere, and closed until this node's first
+        // redundancy snapshot) and refuses a SourceTimestamp beyond now + HistoryUpdateMaxFutureSkew (BadOutOfRange),
         // judged against the host clock.
-        _server.NodeManager.HistoryUpdateMaxFutureSkew = _serverHistorianOptions.HistoryUpdateMaxFutureSkew;
-        _server.NodeManager.Clock = _time;
+        var historyUpdate = BuildHistoryUpdatePosture();
+        _server.NodeManager.HistoryUpdatePrimaryGate = historyUpdate.PrimaryGate;
+        _server.NodeManager.HistoryUpdateMaxFutureSkew = historyUpdate.MaxFutureSkew;
+        _server.NodeManager.Clock = historyUpdate.Clock;
 
         // ServiceLevel publisher needs IServerInternal — only available after Start.
         if (_server.CurrentInstance is { } serverInternal)
@@ -339,6 +347,28 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
         _logger.LogInformation("OtOpcUaServerHostedService: SDK started, address-space + ServiceLevel sinks bound");
     }
 
+    /// <summary>
+    ///     Gitea #674 — what <c>StartAsync</c> wires onto the node manager for HistoryUpdate: the Primary gate (read from
+    ///     the <see cref="IHistoryUpdateRoleView"/> on every call; null when none is registered, i.e. allow), the
+    ///     future-timestamp bound from <c>ServerHistorian:HistoryUpdateMaxFutureSkew</c>, and the host clock it is judged
+    ///     against. Separate from <c>StartAsync</c> so the wiring is testable without booting the SDK.
+    /// </summary>
+    /// <returns>The posture to apply.</returns>
+    internal HistoryUpdatePosture BuildHistoryUpdatePosture()
+    {
+        Func<bool>? gate = _historyUpdateRoleView is { } view ? () => view.ShouldServeHistoryUpdate : null;
+        if (gate is null)
+            _logger.LogInformation(
+                "OtOpcUaServerHostedService: no IHistoryUpdateRoleView registered (no redundancy manager on this node) — HistoryUpdate is not Primary-gated");
+        return new HistoryUpdatePosture(gate, _serverHistorianOptions.HistoryUpdateMaxFutureSkew, _time);
+    }
+
+    /// <summary>Gitea #674 — the HistoryUpdate settings <see cref="BuildHistoryUpdatePosture"/> produces.</summary>
+    /// <param name="PrimaryGate">The node manager's HistoryUpdate Primary gate; null allows.</param>
+    /// <param name="MaxFutureSkew">The future-timestamp bound; non-positive disables it.</param>
+    /// <param name="Clock">The clock the bound is judged against.</param>
+    internal sealed record HistoryUpdatePosture(Func<bool>? PrimaryGate, TimeSpan MaxFutureSkew, TimeProvider Clock);
+
     /// <summary>
     ///     Arms the clock-driven monitored-item revalidation tick (arch-review 03/S19).
     /// </summary>

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaNodeManager.cs

@@ -5484,6 +5484,20 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
         });
     }
 
+    /// <summary>
+    ///     #674 review: a HistoryUpdate timestamp as UTC. Wire timestamps are UTC; an in-process caller can hand a
+    ///     <see cref="DateTimeKind.Local"/> value, which is converted (comparing its raw ticks against a UTC bound would be
+    ///     off by the zone offset). <see cref="DateTimeKind.Unspecified"/> is treated as UTC, as the backends treat it.
+    /// </summary>
+    /// <param name="value">The item's source timestamp.</param>
+    /// <returns>The same instant as a UTC <see cref="DateTime"/>.</returns>
+    private static DateTime ToUtc(DateTime value) => value.Kind switch
+    {
+        DateTimeKind.Local => value.ToUniversalTime(),
+        DateTimeKind.Unspecified => DateTime.SpecifyKind(value, DateTimeKind.Utc),
+        _ => value,
+    };
+
     /// <summary>
     ///     #674: the latest <c>SourceTimestamp</c> a HistoryUpdate item may carry — <see cref="Clock"/>'s now plus
     ///     <see cref="HistoryUpdateMaxFutureSkew"/> — or <c>null</c> when the bound is disabled (non-positive skew).
@@ -5533,9 +5547,9 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
             {
                 codes[i] = StatusCodes.BadInvalidTimestamp;
             }
-            else if (latest is { } bound && item.SourceTimestamp > bound)
+            else if (latest is { } bound && ToUtc(item.SourceTimestamp) > bound)
             {
-                // #674: a far-future history edit is refused before any backend sees it (wire timestamps are UTC).
+                // #674: a far-future history edit is refused before any backend sees it.
                 codes[i] = StatusCodes.BadOutOfRange;
             }
             else if (!HistorianValue.TryFromObject(item.Value, out var value))
@@ -5544,7 +5558,7 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
             }
             else
             {
-                toSend.Add(new HistorizationValue(item.SourceTimestamp, value, item.StatusCode.Code));
+                toSend.Add(new HistorizationValue(ToUtc(item.SourceTimestamp), value, item.StatusCode.Code));
                 sentIndex.Add(i);
             }
         }
@@ -5588,13 +5602,35 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
         nodesToProcess = AuthorizeHistoryUpdate(context, nodesToProcess, results, errors);
         if (nodesToProcess.Count == 0) return;
 
-        // #674 — PRIMARY GATE, after authorization (a caller who may not update learns nothing about the node's role).
-        // Off-Primary every authorized node is refused BadInvalidState and nothing reaches the updater.
+        // Plan BEFORE the Primary gate (#674 review): a request this server can never serve (no updater, a node that is
+        // not historized, Remove, IsDeleteModified) is answered with the honest BadHistoryOperationUnsupported on every
+        // node, so a Secondary does not send the client to the Primary for something the Primary would also refuse.
+        // Planning is pure — it builds closures and reads the in-memory tagname map; nothing reaches a backend.
+        var updater = _historianDataUpdater;
+        var planned = new List<(NodeHandle Handle, string Tagname,
+            Func<IHistorianDataUpdater, string, HistoryUpdateContext, CancellationToken, Task<HistoryUpdateResult>> Operation)>(nodesToProcess.Count);
+        foreach (var handle in nodesToProcess)
+        {
+            var operation = updater is null ? null : plan(handle);
+            if (operation is null || !TryGetHistorizedTagname(handle.NodeId, out var tagname) || tagname is null)
+            {
+                errors[handle.Index] = StatusCodes.BadHistoryOperationUnsupported;
+                results[handle.Index] = new HistoryUpdateResult { StatusCode = StatusCodes.BadHistoryOperationUnsupported };
+                continue;
+            }
+
+            planned.Add((handle, tagname, operation));
+        }
+
+        if (planned.Count == 0) return;
+
+        // #674 — PRIMARY GATE, after authorization (a caller who may not update learns nothing about the node's role)
+        // and after planning. Off-Primary every servable node is refused BadInvalidState and nothing reaches the updater.
         if (HistoryUpdatePrimaryGate is { } primary && !primary())
         {
             var refusal = new ServiceResult(StatusCodes.BadInvalidState,
                 new LocalizedText("This server is not the redundancy Primary; update history on the Primary (the server with the higher ServiceLevel)."));
-            foreach (var handle in nodesToProcess)
+            foreach (var (handle, _, _) in planned)
             {
                 errors[handle.Index] = refusal;
                 results[handle.Index] = new HistoryUpdateResult { StatusCode = StatusCodes.BadInvalidState };
@@ -5606,25 +5642,17 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
         // Who is rewriting history — recorded on every modification-trail row (Part 11 ModificationInfo.UserName, #668).
         var who = HistoryUpdateCallerOf(context);
 
-        WithHistoryReadBatchLimiter(nodesToProcess, results, errors, () =>
+        WithHistoryReadBatchLimiter(planned.Select(p => p.Handle).ToList(), results, errors, () =>
         {
             using var deadline = CreateDeadline();
             var ct = deadline?.Token ?? CancellationToken.None;
-            var updater = _historianDataUpdater;
-            var work = new List<Func<Task>>(nodesToProcess.Count);
-            foreach (var handle in nodesToProcess)
+            var work = new List<Func<Task>>(planned.Count);
+            foreach (var (handle, tagname, operation) in planned)
             {
-                var operation = updater is null ? null : plan(handle);
-                if (operation is null || !TryGetHistorizedTagname(handle.NodeId, out var tagname) || tagname is null)
-                {
-                    errors[handle.Index] = StatusCodes.BadHistoryOperationUnsupported;
-                    results[handle.Index] = new HistoryUpdateResult { StatusCode = StatusCodes.BadHistoryOperationUnsupported };
-                    continue;
-                }
-
                 var h = handle;
                 var tag = tagname;
-                work.Add(() => ServeUpdateNodeAsync(h, results, errors, token => operation(updater!, tag, who, token), ct));
+                var op = operation;
+                work.Add(() => ServeUpdateNodeAsync(h, results, errors, token => op(updater!, tag, who, token), ct));
             }
 
             RunBounded(work, HistoryReadBatchParallelism);
@@ -5677,6 +5705,14 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
             errors[handle.Index] = StatusCodes.BadTimeout;
             results[handle.Index] = new HistoryUpdateResult { StatusCode = StatusCodes.BadTimeout };
         }
+        catch (NotSupportedException)
+        {
+            // The backend cannot perform this update at all (e.g. a SqlServer historian still at schema v1, with no
+            // modification trail to record it in, #674) — the spec status for the whole node, not a server fault.
+            // Mirrors the HistoryRead side's handling of the same exception.
+            errors[handle.Index] = StatusCodes.BadHistoryOperationUnsupported;
+            results[handle.Index] = new HistoryUpdateResult { StatusCode = StatusCodes.BadHistoryOperationUnsupported };
+        }
         catch (Exception ex)
         {
             _logger.LogError(ex, "OtOpcUaNodeManager: HistoryUpdate failed for node {NodeId}", handle.NodeId);

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DriverHostActor.cs

@@ -452,6 +452,13 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// </summary>
     private readonly IHistorizationRoleView? _historizationRoleView;
 
+    /// <summary>Gitea #674 review: where the HistoryUpdate verdict is published. Null on nodes that wire no redundancy manager.</summary>
+    private readonly IHistoryUpdateRoleView? _historyUpdateRoleView;
+
+    /// <summary>Gitea #674 review: whether any redundancy snapshot has reached this host — the HistoryUpdate gate stays
+    /// closed until one has (see <see cref="PrimaryGatePolicy.ShouldServeHistoryUpdate"/>).</summary>
+    private bool _redundancySnapshotReceived;
+
     /// <summary>
     ///     Tests whether a node named in a redundancy snapshot serves this node's address space — i.e.
     ///     is a per-cluster mesh partner recording the very same historized refs. Null (the default)
@@ -689,7 +696,8 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         TimeSpan? commsRecoveryAuditDelay = null,
         Func<CommonsNodeId, bool>? sharesAlarmQueueWithLocal = null,
         TimeSpan? applyOutcomeTimeout = null,
-        bool captureWhilePrimaryUnreachable = true) =>
+        bool captureWhilePrimaryUnreachable = true,
+        IHistoryUpdateRoleView? historyUpdateRoleView = null) =>
         // WARNING: this forwarding list is POSITIONAL, and Props.Create compiles it into an
         // expression tree. Six IActorRef? parameters and several interface-typed ones mean a
         // mis-ordered argument is usually type-compatible and therefore compiles clean, then binds
@@ -702,7 +710,7 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
             deploymentArtifactCache, redundancyRoleView, replicationPeerHost, fetchAndCacheMode, artifactFetcher,
             alarmStateStore, telemetryHub, primaryRoleSource, historizationRoleView,
             sharesHistorizationScopeWithLocal, applyWedgeTimeout, reprovisionBackoff, commsRecoveryAuditDelay,
-            sharesAlarmQueueWithLocal, applyOutcomeTimeout, captureWhilePrimaryUnreachable));
+            sharesAlarmQueueWithLocal, applyOutcomeTimeout, captureWhilePrimaryUnreachable, historyUpdateRoleView));
 
     /// <summary>Initializes a new DriverHostActor with the specified dependencies.</summary>
     /// <param name="dbFactory">Database context factory for configuration database access.</param>
@@ -775,6 +783,10 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// reported UNREACHABLE by the cluster failure detector, stop deferring to it and capture — rather than waiting
     /// for auto-down + a fresh redundancy snapshot. Affects ONLY the historization capture verdict; the alarm drain
     /// and the Primary data-plane verdict are unchanged. <c>false</c> restores the pre-#672 behaviour.</param>
+    /// <param name="historyUpdateRoleView">Gitea #674 review: where the OPC UA HistoryUpdate verdict
+    /// (<see cref="PrimaryGatePolicy.ShouldServeHistoryUpdate"/> — the data-plane verdict, but closed until the first
+    /// redundancy snapshot) is published for the node manager's HistoryUpdate Primary gate. Null on nodes that wire no
+    /// redundancy manager.</param>
     public DriverHostActor(
         IDbContextFactory<OtOpcUaConfigDbContext>? dbFactory,
         CommonsNodeId localNode,
@@ -807,9 +819,11 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         TimeSpan? commsRecoveryAuditDelay = null,
         Func<CommonsNodeId, bool>? sharesAlarmQueueWithLocal = null,
         TimeSpan? applyOutcomeTimeout = null,
-        bool captureWhilePrimaryUnreachable = true)
+        bool captureWhilePrimaryUnreachable = true,
+        IHistoryUpdateRoleView? historyUpdateRoleView = null)
     {
         _captureWhilePrimaryUnreachable = captureWhilePrimaryUnreachable;
+        _historyUpdateRoleView = historyUpdateRoleView;
         _applyOutcomeTimeout = applyOutcomeTimeout ?? DefaultApplyOutcomeTimeout;
         _sharesAlarmQueueWithLocal = sharesAlarmQueueWithLocal;
         _applyWedgeTimeout = applyWedgeTimeout ?? DefaultApplyWedgeTimeout;
@@ -909,6 +923,7 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// </summary>
     private void StartPrimaryVerdictPublishing()
     {
+        PublishHistoryUpdateVerdict();
         if (_primaryRoleSource is null) return;
         PublishPrimaryVerdict();
         try
@@ -948,6 +963,7 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// The snapshot path publishes on every snapshot, as the other verdicts do.</summary>
     private void PublishPrimaryVerdict()
     {
+        PublishHistoryUpdateVerdict();
         if (_primaryRoleSource is null) return;
         var verdict = ShouldServiceAsPrimary();
         _lastPublishedPrimaryVerdict = verdict;
@@ -958,10 +974,18 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// role information, so republishing an unchanged verdict on each would be noise.</summary>
     private void PublishPrimaryVerdictIfChanged()
     {
+        PublishHistoryUpdateVerdict();
         if (_primaryRoleSource is null || ShouldServiceAsPrimary() == _lastPublishedPrimaryVerdict) return;
         PublishPrimaryVerdict();
     }
 
+    /// <summary>Gitea #674 review: publishes <see cref="PrimaryGatePolicy.ShouldServeHistoryUpdate"/> (no-op when no view
+    /// is wired). Rides every Primary-verdict publish point — host start, every snapshot, membership changes — so it is
+    /// closed from host start and opens only once a snapshot has arrived and the data-plane verdict allows.</summary>
+    private void PublishHistoryUpdateVerdict() =>
+        _historyUpdateRoleView?.PublishHistoryUpdateRole(
+            PrimaryGatePolicy.ShouldServeHistoryUpdate(_redundancySnapshotReceived, _localRole, DriverMemberCount()));
+
     /// <summary>
     ///     Gitea #672: follow cluster reachability so the historization capture gate stops deferring to a recording
     ///     Primary the failure detector already considers dead. Its OWN subscription, deliberately not folded into
@@ -2270,6 +2294,7 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// <c>ScriptedAlarmHostActor.OnRedundancyStateChanged</c> / <c>OpcUaPublishActor</c>.</summary>
     private void OnRedundancyStateChanged(RedundancyStateChanged msg)
     {
+        _redundancySnapshotReceived = true;
         var local = msg.Nodes.FirstOrDefault(n => n.NodeId == _localNode);
         if (local is not null)
         {

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/PrimaryGatePolicy.cs

@@ -26,6 +26,36 @@ public static class PrimaryGatePolicy
             _ => driverMemberCount <= 1,   // unknown: allow only when no driver peer exists
         };
 
+    /// <summary>
+    ///     Gitea #674 review: decide whether this node may serve an OPC UA <b>HistoryUpdate</b>. The
+    ///     <see cref="ShouldServiceAsPrimary"/> verdict, but CLOSED until this node has received its first
+    ///     redundancy snapshot.
+    /// </summary>
+    /// <remarks>
+    ///     <para>
+    ///         <see cref="ShouldServiceAsPrimary"/> deliberately allows an unknown role while no driver peer is
+    ///         visible, which covers the pre-join boot window: a node spawned before it has joined its mesh sees a
+    ///         member count of 0. For a live data-plane operation (a device write, an ack) that is the right trade —
+    ///         denying would stall a genuine single node during its own join. HistoryUpdate is not live: a client can
+    ///         retry it, and both nodes of a pair accepting one concurrently during that window is exactly the
+    ///         wrong-prior-value race the Primary gate exists for. So it waits for a real verdict.
+    ///     </para>
+    ///     <para>
+    ///         "No snapshot yet" is told apart from "single node" by the snapshot itself: the redundancy singleton runs
+    ///         on every driver node (one per mesh, a single node included) and publishes on every change and every
+    ///         10 s heartbeat, so a single node is named Primary within seconds of joining. Once a snapshot has
+    ///         arrived this is exactly <see cref="ShouldServiceAsPrimary"/> (including its unknown-role member-count
+    ///         rule for a snapshot that omits this node). A node with no redundancy manager at all (admin-only, or a
+    ///         harness) wires no gate and so allows.
+    ///     </para>
+    /// </remarks>
+    /// <param name="redundancySnapshotReceived">Whether any redundancy snapshot has reached this node yet.</param>
+    /// <param name="localRole">This node's last-known redundancy role, or <c>null</c> when unknown.</param>
+    /// <param name="driverMemberCount">Count of Up cluster members carrying the <c>driver</c> role.</param>
+    /// <returns><c>true</c> to serve HistoryUpdate; <c>false</c> to refuse it (<c>BadInvalidState</c>).</returns>
+    public static bool ShouldServeHistoryUpdate(bool redundancySnapshotReceived, RedundancyRole? localRole, int driverMemberCount) =>
+        redundancySnapshotReceived && ShouldServiceAsPrimary(localRole, driverMemberCount);
+
     /// <summary>
     ///     Decide whether this node should drain the replicated alarm store-and-forward queue.
     /// </summary>

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Redundancy/IRedundancyRoleView.cs

@@ -75,9 +75,29 @@ public interface IHistorizationRoleView
     void PublishHistorizationRole(bool shouldRecordHistorizedValues);
 }
 
+/// <summary>
+///     Gitea #674 review: a singleton snapshot of the OPC UA <b>HistoryUpdate</b> verdict
+///     (<see cref="PrimaryGatePolicy.ShouldServeHistoryUpdate"/>), read by the node manager's HistoryUpdate Primary gate.
+/// </summary>
+/// <remarks>
+///     A separate verdict from <see cref="IDriverPrimaryRoleSource.ShouldActAsPrimary"/> because it is closed until the
+///     first redundancy snapshot, where that one mirrors the live data-plane gate and is open through the pre-join boot
+///     window. Registered unconditionally on every driver-role node (same object as the other views); a node that does
+///     not register it wires no gate.
+/// </remarks>
+public interface IHistoryUpdateRoleView
+{
+    /// <summary>Whether this node may serve HistoryUpdate right now.</summary>
+    bool ShouldServeHistoryUpdate { get; }
+
+    /// <summary>Records a fresh decision. Called by <c>DriverHostActor</c> whenever it publishes its Primary verdict.</summary>
+    /// <param name="shouldServeHistoryUpdate">The decision <see cref="PrimaryGatePolicy.ShouldServeHistoryUpdate"/> produced.</param>
+    void PublishHistoryUpdateRole(bool shouldServeHistoryUpdate);
+}
+
 /// <summary>
 ///     Thread-safe <see cref="IRedundancyRoleView"/> + <see cref="IDriverPrimaryRoleSource"/> +
-///     <see cref="IHistorizationRoleView"/>, each backed by its own volatile field.
+///     <see cref="IHistorizationRoleView"/> + <see cref="IHistoryUpdateRoleView"/>, each backed by its own volatile field.
 /// </summary>
 /// <remarks>
 ///     <para>
@@ -90,8 +110,15 @@ public interface IHistorizationRoleView
 ///         them is the bug that live gate already found once.
 ///     </para>
 /// </remarks>
-public sealed class RedundancyRoleView : IRedundancyRoleView, IDriverPrimaryRoleSource, IHistorizationRoleView
+public sealed class RedundancyRoleView : IRedundancyRoleView, IDriverPrimaryRoleSource, IHistorizationRoleView,
+    IHistoryUpdateRoleView
 {
+    // Gitea #674 review: seeded CLOSED, unlike the data-plane verdict. HistoryUpdate waits for a real redundancy verdict
+    // (PrimaryGatePolicy.ShouldServeHistoryUpdate); a node that never publishes here is not a driver node with a
+    // redundancy manager, and such a node does not register this view as its gate source.
+    private volatile bool _shouldServeHistoryUpdate =
+        PrimaryGatePolicy.ShouldServeHistoryUpdate(redundancySnapshotReceived: false, localRole: null, driverMemberCount: 1);
+
     // Seeded with the decision for "role unknown" rather than a bare false. An unpublished view and a
     // node whose role nothing ever reports are genuinely the same situation, and they must behave the
     // same: a deployment that runs no redundancy at all never publishes here, and defaulting closed
@@ -121,6 +148,12 @@ public sealed class RedundancyRoleView : IRedundancyRoleView, IDriverPrimaryRole
     /// <inheritdoc/>
     public bool ShouldActAsPrimary => _shouldActAsPrimary;
 
+    /// <inheritdoc/>
+    public bool ShouldServeHistoryUpdate => _shouldServeHistoryUpdate;
+
+    /// <inheritdoc/>
+    public void PublishHistoryUpdateRole(bool shouldServeHistoryUpdate) => _shouldServeHistoryUpdate = shouldServeHistoryUpdate;
+
     /// <inheritdoc/>
     public void Publish(bool shouldDrainAlarmHistory) => _shouldDrainAlarmHistory = shouldDrainAlarmHistory;
 

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/ServiceCollectionExtensions.cs

@@ -98,6 +98,11 @@ public static class ServiceCollectionExtensions
         // with no gate at all, and both nodes would write every sample twice with nothing to say so.
         services.TryAddSingleton<IHistorizationRoleView>(sp => sp.GetRequiredService<RedundancyRoleView>());
 
+        // Gitea #674 review: the OPC UA HistoryUpdate verdict — the data-plane verdict, but closed until this node's first
+        // redundancy snapshot. Same instance; registered here (driver-role nodes only) so an admin-only node, which has no
+        // redundancy manager, wires no HistoryUpdate gate at all.
+        services.TryAddSingleton<IHistoryUpdateRoleView>(sp => sp.GetRequiredService<RedundancyRoleView>());
+
         // The node→central ack transport under MeshTransport:Mode = Grpc (mesh gRPC command plane,
         // Task 1B.2). Registered unconditionally but resolved only by the Grpc arm of
         // WithOtOpcUaRuntimeActors — the mode is not knowable here (this runs before configuration is
@@ -631,7 +636,9 @@ public static class ServiceCollectionExtensions
                     // Review R6 MINOR-4: the passive half of a LocalDb pair has no PeerAddress, so it is told
                     // its queue-sharing peer as its mesh partner instead — otherwise it never stands down.
                     sharesAlarmQueueWithLocal: BuildAlarmQueuePeerPredicate(
-                        resolver.GetService<IConfiguration>(), roleInfo, replicationPeerHost)),
+                        resolver.GetService<IConfiguration>(), roleInfo, replicationPeerHost),
+                    // Gitea #674 review: the HistoryUpdate verdict (closed until the first redundancy snapshot).
+                    historyUpdateRoleView: resolver.GetService<IHistoryUpdateRoleView>()),
                 DriverHostActorName);
             registry.Register<DriverHostActorKey>(driverHost);