fix(mesh): scope ClusterNode address reconcile to the admin node's own cluster

Phase 6 splits the fleet into one mesh per Cluster, so an admin (central) node's Cluster.State.Members shows only its own pair — it no longer sees site members via gossip. The ClusterNodeAddressReconciler singleton compared live membership against EVERY ClusterNode row fleet-wide, so post-split every foreign-cluster row would log EnabledRowNotInCluster forever. Scope the actor's two DB queries to rows whose ClusterId matches the admin node's own (IClusterRoleInfo.ClusterId, sourced at registration). A legacy admin node with no cluster role (null ClusterId) still reconciles the whole fleet — it genuinely sees every member via gossip. The pure Reconcile function and AddressMismatchKind semantics are unchanged; scoping lives entirely in the actor's queries. Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW
2026-07-24 01:39:06 -04:00
parent a2c5d57fa0
commit 2535df019b
6 changed files with 149 additions and 40 deletions
@@ -58,10 +58,16 @@ public sealed record ClusterNodeAddress(string NodeId, string Host, int AkkaPort
 ///         to be deleted again.
 ///     </para>
 ///     <para>
-///         <b>Phase 2 must revisit this.</b> Once the fleet splits into one mesh per cluster, an
-///         admin node no longer sees site members at all, and every site row would report
-///         <see cref="AddressMismatchKind.EnabledRowNotInCluster"/> forever. The check then has to
-///         move to whatever transport replaces gossip — or be scoped to the central mesh.
+///         <b>Scoped to the admin node's own cluster (Phase 6).</b> Once the fleet splits into one
+///         mesh per cluster, an admin node no longer sees site members at all, and a fleet-wide sweep
+///         would report every other cluster's row as
+///         <see cref="AddressMismatchKind.EnabledRowNotInCluster"/> forever. The actor therefore loads
+///         only rows whose <c>ClusterId</c> matches the admin node's own
+///         (<see cref="ZB.MOM.WW.OtOpcUa.Commons.Interfaces.IClusterRoleInfo.ClusterId"/>) before
+///         calling <see cref="Reconcile"/>, so it never false-reports a cluster it cannot observe. A
+///         legacy admin node carrying no cluster role (null <c>ClusterId</c>) still sees every member
+///         via gossip and reconciles the full fleet unchanged. The pure function below is untouched by
+///         this — scoping happens entirely in the actor's DB queries.
 ///     </para>
 /// </remarks>
 public static class ClusterNodeAddressReconciler