fix(mesh): scope ClusterNode address reconcile to the admin node's own cluster

Phase 6 splits the fleet into one mesh per Cluster, so an admin (central) node's Cluster.State.Members shows only its own pair — it no longer sees site members via gossip. The ClusterNodeAddressReconciler singleton compared live membership against EVERY ClusterNode row fleet-wide, so post-split every foreign-cluster row would log EnabledRowNotInCluster forever. Scope the actor's two DB queries to rows whose ClusterId matches the admin node's own (IClusterRoleInfo.ClusterId, sourced at registration). A legacy admin node with no cluster role (null ClusterId) still reconciles the whole fleet — it genuinely sees every member via gossip. The pure Reconcile function and AddressMismatchKind semantics are unchanged; scoping lives entirely in the actor's queries. Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW
2026-07-24 01:39:06 -04:00
parent a2c5d57fa0
commit 2535df019b
6 changed files with 149 additions and 40 deletions
@@ -30,6 +30,7 @@ public sealed class ClusterNodeAddressReconcilerActor : ReceiveActor, IWithTimer
    public static readonly TimeSpan DefaultSweepInterval = TimeSpan.FromMinutes(5);

    private readonly IDbContextFactory<OtOpcUaConfigDbContext> _dbFactory;
+    private readonly string? _ownClusterId;
    private readonly Akka.Cluster.Cluster _cluster;
    private readonly TimeSpan _sweepInterval;
    private readonly ILoggingAdapter _log = Context.GetLogger();
@@ -40,19 +41,35 @@ public sealed class ClusterNodeAddressReconcilerActor : ReceiveActor, IWithTimer

    /// <summary>Creates Props for the reconciler.</summary>
    /// <param name="dbFactory">Factory for the config database context.</param>
+    /// <param name="ownClusterId">
+    ///     The admin node's own <c>ClusterId</c> (e.g. <c>MAIN</c>), from
+    ///     <see cref="IClusterRoleInfo.ClusterId"/>. Non-null/empty scopes the reconcile to rows in that
+    ///     cluster — the only members central's own mesh can see after the Phase 6 split. Null/empty
+    ///     (a legacy admin node with no cluster role) reconciles the whole fleet, unchanged.
+    /// </param>
    /// <param name="sweepInterval">Periodic sweep interval; defaults to <see cref="DefaultSweepInterval"/>.</param>
    /// <returns>Props for actor creation.</returns>
    public static Props Props(
-        IDbContextFactory<OtOpcUaConfigDbContext> dbFactory, TimeSpan? sweepInterval = null) =>
-        Akka.Actor.Props.Create(() => new ClusterNodeAddressReconcilerActor(dbFactory, sweepInterval));
+        IDbContextFactory<OtOpcUaConfigDbContext> dbFactory,
+        string? ownClusterId = null,
+        TimeSpan? sweepInterval = null) =>
+        Akka.Actor.Props.Create(() =>
+            new ClusterNodeAddressReconcilerActor(dbFactory, ownClusterId, sweepInterval));

    /// <summary>Initializes a new instance of the <see cref="ClusterNodeAddressReconcilerActor"/> class.</summary>
    /// <param name="dbFactory">Factory for the config database context.</param>
+    /// <param name="ownClusterId">
+    ///     The admin node's own <c>ClusterId</c>; scopes the reconcile to that cluster's rows when
+    ///     non-null/empty, else reconciles the whole fleet (legacy behaviour).
+    /// </param>
    /// <param name="sweepInterval">Periodic sweep interval; defaults to <see cref="DefaultSweepInterval"/>.</param>
    public ClusterNodeAddressReconcilerActor(
-        IDbContextFactory<OtOpcUaConfigDbContext> dbFactory, TimeSpan? sweepInterval = null)
+        IDbContextFactory<OtOpcUaConfigDbContext> dbFactory,
+        string? ownClusterId = null,
+        TimeSpan? sweepInterval = null)
    {
        _dbFactory = dbFactory;
+        _ownClusterId = string.IsNullOrEmpty(ownClusterId) ? null : ownClusterId;
        _cluster = Akka.Cluster.Cluster.Get(Context.System);
        _sweepInterval = sweepInterval ?? DefaultSweepInterval;

@@ -87,13 +104,20 @@ public sealed class ClusterNodeAddressReconcilerActor : ReceiveActor, IWithTimer
        try
        {
            using var db = _dbFactory.CreateDbContext();
-            rows = db.ClusterNodes.AsNoTracking()
+            // Per-cluster mesh Phase 6: scope to the admin node's OWN cluster's rows. After the split,
+            // central's mesh sees only its own pair, so a row in another cluster it cannot observe would
+            // false-report EnabledRowNotInCluster forever. A legacy admin node with no cluster role
+            // (_ownClusterId == null) still sees every member via gossip, so it reconciles the full fleet.
+            var scoped = db.ClusterNodes.AsNoTracking();
+            if (_ownClusterId is not null)
+                scoped = scoped.Where(n => n.ClusterId == _ownClusterId);
+            rows = scoped
                .Select(n => new ClusterNodeAddress(n.NodeId, n.Host, n.AkkaPort))
                .ToList();
            // Same predicate the coordinator's expected-ack set uses — a node the deploy path will
            // not wait for must not be reported as missing either, or the maintenance hatch trades a
            // failed deployment for a permanent warning.
-            enabled = db.ClusterNodes.AsNoTracking()
+            enabled = scoped
                .Where(n => n.Enabled && !n.MaintenanceMode).Select(n => n.NodeId).ToList();
        }
        catch (Exception ex)