fix(historian): #674 review follow-ups — HistoryUpdate boot-window gate, node-level v1 refusal, plan-before-gate, UTC skew compare

- HistoryUpdate Primary gate now reads IHistoryUpdateRoleView (PrimaryGatePolicy.ShouldServeHistoryUpdate):
  the data-plane verdict but CLOSED until this node's first redundancy snapshot, so both pair nodes cannot
  accept in the pre-join boot window. Single nodes open on their own singleton's first snapshot; admin-only
  nodes register no view => no gate. DriverHostActor publishes it at every Primary-verdict publish point.
- SqlServer v1: the updater throws NotSupportedException on every arm; the node manager maps it to a
  node-level BadHistoryOperationUnsupported (was per-item under a Good node for UpdateData/DeleteAtTime).
  HistoryWrite bit still advertised on v1 (not knowable at materialise time) — documented.
- The update plan is evaluated before the Primary gate: an unservable request (Remove, IsDeleteModified,
  not historized, no updater) is BadHistoryOperationUnsupported off-Primary, not BadInvalidState.
- Local-kind SourceTimestamp converted to UTC before the future-skew compare and sent as UTC.
- Hosted-service wiring extracted to BuildHistoryUpdatePosture and tested (gate source, skew, clock).
- Docs: Historian.md (boot window, ordering, node-level v1, HistoryWrite bit), CLAUDE.md.

Co-Authored-By: Claude <noreply@anthropic.com>

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DriverHostActor.cs

@@ -452,6 +452,13 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// </summary>
     private readonly IHistorizationRoleView? _historizationRoleView;
 
+    /// <summary>Gitea #674 review: where the HistoryUpdate verdict is published. Null on nodes that wire no redundancy manager.</summary>
+    private readonly IHistoryUpdateRoleView? _historyUpdateRoleView;
+
+    /// <summary>Gitea #674 review: whether any redundancy snapshot has reached this host — the HistoryUpdate gate stays
+    /// closed until one has (see <see cref="PrimaryGatePolicy.ShouldServeHistoryUpdate"/>).</summary>
+    private bool _redundancySnapshotReceived;
+
     /// <summary>
     ///     Tests whether a node named in a redundancy snapshot serves this node's address space — i.e.
     ///     is a per-cluster mesh partner recording the very same historized refs. Null (the default)
@@ -689,7 +696,8 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         TimeSpan? commsRecoveryAuditDelay = null,
         Func<CommonsNodeId, bool>? sharesAlarmQueueWithLocal = null,
         TimeSpan? applyOutcomeTimeout = null,
-        bool captureWhilePrimaryUnreachable = true) =>
+        bool captureWhilePrimaryUnreachable = true,
+        IHistoryUpdateRoleView? historyUpdateRoleView = null) =>
         // WARNING: this forwarding list is POSITIONAL, and Props.Create compiles it into an
         // expression tree. Six IActorRef? parameters and several interface-typed ones mean a
         // mis-ordered argument is usually type-compatible and therefore compiles clean, then binds
@@ -702,7 +710,7 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
             deploymentArtifactCache, redundancyRoleView, replicationPeerHost, fetchAndCacheMode, artifactFetcher,
             alarmStateStore, telemetryHub, primaryRoleSource, historizationRoleView,
             sharesHistorizationScopeWithLocal, applyWedgeTimeout, reprovisionBackoff, commsRecoveryAuditDelay,
-            sharesAlarmQueueWithLocal, applyOutcomeTimeout, captureWhilePrimaryUnreachable));
+            sharesAlarmQueueWithLocal, applyOutcomeTimeout, captureWhilePrimaryUnreachable, historyUpdateRoleView));
 
     /// <summary>Initializes a new DriverHostActor with the specified dependencies.</summary>
     /// <param name="dbFactory">Database context factory for configuration database access.</param>
@@ -775,6 +783,10 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// reported UNREACHABLE by the cluster failure detector, stop deferring to it and capture — rather than waiting
     /// for auto-down + a fresh redundancy snapshot. Affects ONLY the historization capture verdict; the alarm drain
     /// and the Primary data-plane verdict are unchanged. <c>false</c> restores the pre-#672 behaviour.</param>
+    /// <param name="historyUpdateRoleView">Gitea #674 review: where the OPC UA HistoryUpdate verdict
+    /// (<see cref="PrimaryGatePolicy.ShouldServeHistoryUpdate"/> — the data-plane verdict, but closed until the first
+    /// redundancy snapshot) is published for the node manager's HistoryUpdate Primary gate. Null on nodes that wire no
+    /// redundancy manager.</param>
     public DriverHostActor(
         IDbContextFactory<OtOpcUaConfigDbContext>? dbFactory,
         CommonsNodeId localNode,
@@ -807,9 +819,11 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         TimeSpan? commsRecoveryAuditDelay = null,
         Func<CommonsNodeId, bool>? sharesAlarmQueueWithLocal = null,
         TimeSpan? applyOutcomeTimeout = null,
-        bool captureWhilePrimaryUnreachable = true)
+        bool captureWhilePrimaryUnreachable = true,
+        IHistoryUpdateRoleView? historyUpdateRoleView = null)
     {
         _captureWhilePrimaryUnreachable = captureWhilePrimaryUnreachable;
+        _historyUpdateRoleView = historyUpdateRoleView;
         _applyOutcomeTimeout = applyOutcomeTimeout ?? DefaultApplyOutcomeTimeout;
         _sharesAlarmQueueWithLocal = sharesAlarmQueueWithLocal;
         _applyWedgeTimeout = applyWedgeTimeout ?? DefaultApplyWedgeTimeout;
@@ -909,6 +923,7 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// </summary>
     private void StartPrimaryVerdictPublishing()
     {
+        PublishHistoryUpdateVerdict();
         if (_primaryRoleSource is null) return;
         PublishPrimaryVerdict();
         try
@@ -948,6 +963,7 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// The snapshot path publishes on every snapshot, as the other verdicts do.</summary>
     private void PublishPrimaryVerdict()
     {
+        PublishHistoryUpdateVerdict();
         if (_primaryRoleSource is null) return;
         var verdict = ShouldServiceAsPrimary();
         _lastPublishedPrimaryVerdict = verdict;
@@ -958,10 +974,18 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// role information, so republishing an unchanged verdict on each would be noise.</summary>
     private void PublishPrimaryVerdictIfChanged()
     {
+        PublishHistoryUpdateVerdict();
         if (_primaryRoleSource is null || ShouldServiceAsPrimary() == _lastPublishedPrimaryVerdict) return;
         PublishPrimaryVerdict();
     }
 
+    /// <summary>Gitea #674 review: publishes <see cref="PrimaryGatePolicy.ShouldServeHistoryUpdate"/> (no-op when no view
+    /// is wired). Rides every Primary-verdict publish point — host start, every snapshot, membership changes — so it is
+    /// closed from host start and opens only once a snapshot has arrived and the data-plane verdict allows.</summary>
+    private void PublishHistoryUpdateVerdict() =>
+        _historyUpdateRoleView?.PublishHistoryUpdateRole(
+            PrimaryGatePolicy.ShouldServeHistoryUpdate(_redundancySnapshotReceived, _localRole, DriverMemberCount()));
+
     /// <summary>
     ///     Gitea #672: follow cluster reachability so the historization capture gate stops deferring to a recording
     ///     Primary the failure detector already considers dead. Its OWN subscription, deliberately not folded into
@@ -2270,6 +2294,7 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// <c>ScriptedAlarmHostActor.OnRedundancyStateChanged</c> / <c>OpcUaPublishActor</c>.</summary>
     private void OnRedundancyStateChanged(RedundancyStateChanged msg)
     {
+        _redundancySnapshotReceived = true;
         var local = msg.Nodes.FirstOrDefault(n => n.NodeId == _localNode);
         if (local is not null)
         {

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/PrimaryGatePolicy.cs

@@ -26,6 +26,36 @@ public static class PrimaryGatePolicy
             _ => driverMemberCount <= 1,   // unknown: allow only when no driver peer exists
         };
 
+    /// <summary>
+    ///     Gitea #674 review: decide whether this node may serve an OPC UA <b>HistoryUpdate</b>. The
+    ///     <see cref="ShouldServiceAsPrimary"/> verdict, but CLOSED until this node has received its first
+    ///     redundancy snapshot.
+    /// </summary>
+    /// <remarks>
+    ///     <para>
+    ///         <see cref="ShouldServiceAsPrimary"/> deliberately allows an unknown role while no driver peer is
+    ///         visible, which covers the pre-join boot window: a node spawned before it has joined its mesh sees a
+    ///         member count of 0. For a live data-plane operation (a device write, an ack) that is the right trade —
+    ///         denying would stall a genuine single node during its own join. HistoryUpdate is not live: a client can
+    ///         retry it, and both nodes of a pair accepting one concurrently during that window is exactly the
+    ///         wrong-prior-value race the Primary gate exists for. So it waits for a real verdict.
+    ///     </para>
+    ///     <para>
+    ///         "No snapshot yet" is told apart from "single node" by the snapshot itself: the redundancy singleton runs
+    ///         on every driver node (one per mesh, a single node included) and publishes on every change and every
+    ///         10 s heartbeat, so a single node is named Primary within seconds of joining. Once a snapshot has
+    ///         arrived this is exactly <see cref="ShouldServiceAsPrimary"/> (including its unknown-role member-count
+    ///         rule for a snapshot that omits this node). A node with no redundancy manager at all (admin-only, or a
+    ///         harness) wires no gate and so allows.
+    ///     </para>
+    /// </remarks>
+    /// <param name="redundancySnapshotReceived">Whether any redundancy snapshot has reached this node yet.</param>
+    /// <param name="localRole">This node's last-known redundancy role, or <c>null</c> when unknown.</param>
+    /// <param name="driverMemberCount">Count of Up cluster members carrying the <c>driver</c> role.</param>
+    /// <returns><c>true</c> to serve HistoryUpdate; <c>false</c> to refuse it (<c>BadInvalidState</c>).</returns>
+    public static bool ShouldServeHistoryUpdate(bool redundancySnapshotReceived, RedundancyRole? localRole, int driverMemberCount) =>
+        redundancySnapshotReceived && ShouldServiceAsPrimary(localRole, driverMemberCount);
+
     /// <summary>
     ///     Decide whether this node should drain the replicated alarm store-and-forward queue.
     /// </summary>