fix(logging): #561 — SelfLog to file+stderr and a startup file-sink growth self-check

Production ran six weeks with a healthy process and a 0-byte log because
Serilog isolates per-sink failures: a file sink whose every write fails is
invisible from anywhere but SelfLog, which was not enabled. Two instruments:

- LogPipelineDiagnostics.EnableSelfLog (before the first logger builds):
  SelfLog to logs/serilog-selflog.txt (rotated at 5 MB) + stderr — the only
  channel that carries the exception the sink swallows.
- CheckFileSinkGrowth (after the startup banner): verifies each configured,
  unbuffered file sink's rolled-file family physically grew across a marker
  event; a silent sink is reported at boot via SelfLog/stderr and the
  console sink instead of discovered months later. Growth-across-marker,
  not existence — a previous run's bytes must not mask a silent sink (the
  false pass an existence check would have given on wonder-app-vd03).

Never throws: both instruments swallow their own failures — a diagnostics
channel that can fail startup is worse than the defect it watches for.

The load-bearing test is the failure case (a sink that writes nothing IS
reported); a check that can only pass is indistinguishable from no check.

tests/Server/ZB.MOM.WW.OtOpcUa.Host.Tests/Logging/LogPipelineDiagnosticsTests.cs

@@ -0,0 +1,143 @@
+using Microsoft.Extensions.Configuration;
+using Serilog;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Host.Logging;
+
+namespace ZB.MOM.WW.OtOpcUa.Host.Tests.Logging;
+
+/// <summary>
+///     Gitea #561 — the startup log-pipeline self-check. The failure mode under test is "healthy
+///     process, 0-byte log": Serilog isolates per-sink write failures, so nothing else in the
+///     system can observe a file sink whose writes never reach disk. The load-bearing test here is
+///     the <b>failure</b> case (<see cref="A_sink_that_writes_nothing_is_reported"/>): a check that
+///     can only pass would be indistinguishable from no check at all — the same vacuity that let
+///     the original defect run silent for six weeks.
+/// </summary>
+public sealed class LogPipelineDiagnosticsTests : IDisposable
+{
+    private readonly string _dir = Directory.CreateTempSubdirectory("otopcua-logcheck-").FullName;
+
+    public void Dispose()
+    {
+        try { Directory.Delete(_dir, recursive: true); } catch { /* best effort */ }
+    }
+
+    private static IConfiguration FileSinkConfig(string pathTemplate, bool? buffered = null)
+    {
+        var values = new Dictionary<string, string?>
+        {
+            ["Serilog:WriteTo:0:Name"] = "Console",
+            ["Serilog:WriteTo:1:Name"] = "File",
+            ["Serilog:WriteTo:1:Args:path"] = pathTemplate,
+            ["Serilog:WriteTo:1:Args:rollingInterval"] = "Day",
+        };
+        if (buffered is not null)
+            values["Serilog:WriteTo:1:Args:buffered"] = buffered.Value ? "true" : "false";
+
+        return new ConfigurationBuilder().AddInMemoryCollection(values).Build();
+    }
+
+    [Fact]
+    public void A_working_file_sink_passes()
+    {
+        var template = Path.Combine(_dir, "t-.log");
+        using var logger = new LoggerConfiguration()
+            .WriteTo.File(template, rollingInterval: RollingInterval.Day)
+            .CreateLogger();
+
+        var warning = LogPipelineDiagnostics.CheckFileSinkGrowth(
+            FileSinkConfig(template), () => logger.Information("marker"));
+
+        warning.ShouldBeNull();
+    }
+
+    [Fact]
+    public void A_sink_that_writes_nothing_is_reported()
+    {
+        // The marker goes through a logger with NO file sink, so the configured template never
+        // grows — the on-disk shape of the wonder-app-vd03 incident (open handle, failed writes).
+        var template = Path.Combine(_dir, "t-.log");
+        using var fileless = new LoggerConfiguration().CreateLogger();
+
+        var warning = LogPipelineDiagnostics.CheckFileSinkGrowth(
+            FileSinkConfig(template), () => fileless.Information("marker"));
+
+        warning.ShouldNotBeNull();
+        warning.ShouldContain(template);
+        warning.ShouldContain("did not grow");
+    }
+
+    [Fact]
+    public void A_preexisting_file_does_not_mask_a_silent_sink()
+    {
+        // A previous healthy run's bytes on disk must not satisfy the check: growth is measured
+        // across the marker, not existence. This is the exact false-pass an existence check
+        // would have given on wonder (the 0-byte file was created by the broken run itself, but a
+        // >0-byte survivor from an earlier build would fool existence just the same).
+        var template = Path.Combine(_dir, "t-.log");
+        File.WriteAllText(Path.Combine(_dir, "t-20260811.log"), "bytes from a previous run");
+        using var fileless = new LoggerConfiguration().CreateLogger();
+
+        var warning = LogPipelineDiagnostics.CheckFileSinkGrowth(
+            FileSinkConfig(template), () => fileless.Information("marker"));
+
+        warning.ShouldNotBeNull();
+    }
+
+    [Fact]
+    public void The_rolled_and_sequenced_family_counts_as_the_template()
+    {
+        // The sink writes t-20260811.log (rolled) — the template t-.log itself never exists.
+        // Growth must be attributed to the template through the family glob, or every healthy
+        // rolling deployment would false-alarm.
+        var template = Path.Combine(_dir, "t-.log");
+        using var logger = new LoggerConfiguration()
+            .WriteTo.File(template, rollingInterval: RollingInterval.Day)
+            .CreateLogger();
+        logger.Information("creates the rolled file before the check runs");
+
+        var warning = LogPipelineDiagnostics.CheckFileSinkGrowth(
+            FileSinkConfig(template), () => logger.Information("marker"));
+
+        warning.ShouldBeNull();
+        File.Exists(template).ShouldBeFalse("the un-rolled template name must not exist — only the rolled form");
+    }
+
+    [Fact]
+    public void No_file_sink_configured_is_not_a_failure()
+    {
+        var config = new ConfigurationBuilder().AddInMemoryCollection(
+            new Dictionary<string, string?> { ["Serilog:WriteTo:0:Name"] = "Console" }).Build();
+        var markerRan = false;
+
+        var warning = LogPipelineDiagnostics.CheckFileSinkGrowth(config, () => markerRan = true);
+
+        warning.ShouldBeNull();
+        markerRan.ShouldBeFalse("with nothing checkable the marker event should not be emitted");
+    }
+
+    [Fact]
+    public void A_buffered_sink_is_skipped_not_reported()
+    {
+        // buffered:true legitimately defers bytes past the marker; growth proves nothing either
+        // way, so the check must skip rather than false-alarm.
+        var template = Path.Combine(_dir, "t-.log");
+        using var fileless = new LoggerConfiguration().CreateLogger();
+
+        var warning = LogPipelineDiagnostics.CheckFileSinkGrowth(
+            FileSinkConfig(template, buffered: true), () => fileless.Information("marker"));
+
+        warning.ShouldBeNull();
+    }
+
+    [Fact]
+    public void A_file_entry_with_no_path_is_tolerated()
+    {
+        var config = new ConfigurationBuilder().AddInMemoryCollection(
+            new Dictionary<string, string?> { ["Serilog:WriteTo:0:Name"] = "File" }).Build();
+
+        Should.NotThrow(() => LogPipelineDiagnostics.CheckFileSinkGrowth(
+            config, () => { })).ShouldBeNull();
+    }
+}