Merge review R6 fixes: numeric array writes converted element-wise (checked) to the node's element type, refusing out-of-range/fractional/NaN; array-to-scalar refusal scoped to Modbus/S7; Primary-verdict pre-join window documented + real MemberUp subscription test; passive LocalDb pair half drain-gated on its mesh partner

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

docs/AlarmTracking.md

@@ -357,6 +357,11 @@ is client-visible.
 > pair (role still unknown, a driver peer Up) the gate already denies, exactly
 > as the route does (review R1 m2 — previously the view sat on its single-node
 > "allow" seed until the first snapshot, reopening the flap for that window).
+> It mirrors, it does not deny from start: until this node has **joined** and
+> sees its peer Up, its member count is 0 and both the published verdict and the
+> live route **allow** (seconds normally; up to the bootstrap guard's 25 s
+> partner probe). The two agree there, so the flap cannot occur, but a native
+> ack in that pre-join window is serviced (review R6 MINOR-2).
 
 > **Best-effort during reconnect.** If a native ack arrives while the owning
 > driver is `Connecting`/`Reconnecting`, it is dropped with a debug log and **not**