fix(runtime): the passive half of a LocalDb pair stands its alarm drain down for its mesh partner (review R6 MINOR-4)

The drain gate's 'is my queue-sharing peer Primary?' used only the host of
LocalDb:Replication:PeerAddress, which the passive half (ApiKey +
SyncListenPort) does not set - so as Secondary it kept draining beside its
Primary partner and every alarm event reached the historian twice.
DriverHostActor takes a sharesAlarmQueueWithLocal predicate used when no
peer host is known; WithOtOpcUaRuntimeActors builds it
(BuildAlarmQueuePeerPredicate) for a SharesRowsWithPeer node with no
PeerAddress as 'a member of my own cluster-{ClusterId} mesh other than
me'. A node sharing no rows, or with no mesh role, gets none and keeps
draining. AlarmHistorian.md / Redundancy.md / pair-replication runbook
updated.

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DriverHostActor.cs

@@ -472,6 +472,14 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// </summary>
     private readonly string? _replicationPeerHost;
 
+    /// <summary>
+    ///     Review R6 MINOR-4: identifies the alarm-queue-sharing peer when <see cref="_replicationPeerHost"/> is
+    ///     unknown — the passive (listening) half of a pair, which replicates the same rows but dials nobody. Before
+    ///     this the passive half had no peer to defer to, so as Secondary it kept draining alongside its Primary
+    ///     partner and every alarm event reached the historian twice. Null ⇒ no peer known ⇒ never stand down.
+    /// </summary>
+    private readonly Func<CommonsNodeId, bool>? _sharesAlarmQueueWithLocal;
+
     /// <summary>Debounces the S5 "snapshot omitted this node" Warning to once per process — a persistent
     /// identity mismatch (03/S5) would otherwise log on every snapshot.</summary>
     private bool _warnedSnapshotMissingLocalNode;
@@ -617,7 +625,8 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         Func<CommonsNodeId, bool>? sharesHistorizationScopeWithLocal = null,
         TimeSpan? applyWedgeTimeout = null,
         TimeSpan? reprovisionBackoff = null,
-        TimeSpan? commsRecoveryAuditDelay = null) =>
+        TimeSpan? commsRecoveryAuditDelay = null,
+        Func<CommonsNodeId, bool>? sharesAlarmQueueWithLocal = null) =>
         // WARNING: this forwarding list is POSITIONAL, and Props.Create compiles it into an
         // expression tree. Six IActorRef? parameters and several interface-typed ones mean a
         // mis-ordered argument is usually type-compatible and therefore compiles clean, then binds
@@ -629,7 +638,8 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
             loggerFactory, scriptRootLogger, scriptedAlarmHostOverride, invokerFactory, driverMemberCountProvider,
             deploymentArtifactCache, redundancyRoleView, replicationPeerHost, fetchAndCacheMode, artifactFetcher,
             alarmStateStore, telemetryHub, primaryRoleSource, historizationRoleView,
-            sharesHistorizationScopeWithLocal, applyWedgeTimeout, reprovisionBackoff, commsRecoveryAuditDelay));
+            sharesHistorizationScopeWithLocal, applyWedgeTimeout, reprovisionBackoff, commsRecoveryAuditDelay,
+            sharesAlarmQueueWithLocal));
 
     /// <summary>Initializes a new DriverHostActor with the specified dependencies.</summary>
     /// <param name="dbFactory">Database context factory for configuration database access.</param>
@@ -691,6 +701,12 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// <param name="commsRecoveryAuditDelay">Archreview 03/S15: how long after a driver reconnects the
     /// recovery audit waits before reporting refs still latched <c>BadNoCommunication</c>. Defaults to
     /// <see cref="DefaultCommsRecoveryAuditDelay"/>; a test shortens it for the same reason.</param>
+    /// <param name="sharesAlarmQueueWithLocal">Review R6 MINOR-4: tests whether a node named in a redundancy
+    /// snapshot holds this node's replicated alarm queue, for a node that knows no
+    /// <paramref name="replicationPeerHost"/> — the PASSIVE half of a LocalDb pair (ApiKey + SyncListenPort, no
+    /// PeerAddress), whose partner is its per-cluster mesh partner. Ignored when
+    /// <paramref name="replicationPeerHost"/> is set. Null ⇒ no such peer is known and this node never stands its
+    /// drain down.</param>
     public DriverHostActor(
         IDbContextFactory<OtOpcUaConfigDbContext>? dbFactory,
         CommonsNodeId localNode,
@@ -720,8 +736,10 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         Func<CommonsNodeId, bool>? sharesHistorizationScopeWithLocal = null,
         TimeSpan? applyWedgeTimeout = null,
         TimeSpan? reprovisionBackoff = null,
-        TimeSpan? commsRecoveryAuditDelay = null)
+        TimeSpan? commsRecoveryAuditDelay = null,
+        Func<CommonsNodeId, bool>? sharesAlarmQueueWithLocal = null)
     {
+        _sharesAlarmQueueWithLocal = sharesAlarmQueueWithLocal;
         _applyWedgeTimeout = applyWedgeTimeout ?? DefaultApplyWedgeTimeout;
         _reprovisionBackoff = reprovisionBackoff ?? DefaultReprovisionBackoff;
         _commsRecoveryAuditDelay = commsRecoveryAuditDelay ?? DefaultCommsRecoveryAuditDelay;
@@ -2022,6 +2040,14 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         }
     }
 
+    /// <summary>Whether <paramref name="nodeId"/> holds this node's replicated alarm queue: the PeerAddress host when
+    /// this node dials, else the passive-half predicate (review R6 MINOR-4). This node itself never counts.</summary>
+    private bool SharesAlarmQueue(CommonsNodeId nodeId) =>
+        nodeId != _localNode
+        && (_replicationPeerHost is not null
+            ? HostOf(nodeId) == _replicationPeerHost
+            : _sharesAlarmQueueWithLocal?.Invoke(nodeId) == true);
+
     /// <summary>Host part of a <c>host:port</c> node id.</summary>
     private static string HostOf(NodeId nodeId)
     {
@@ -2071,10 +2097,10 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         // Defer ONLY to the node that holds a copy of our rows. The redundancy election is
         // cluster-wide and the queue is pair-local, so "somebody is Primary" is not a licence to stop
         // draining — that Primary is usually in another pair entirely, and cannot deliver our events.
-        var peerIsPrimary =
-            _replicationPeerHost is not null
-            && msg.Nodes.Any(n => n.Role == RedundancyRole.Primary
-                                  && HostOf(n.NodeId) == _replicationPeerHost);
+        //
+        // The dialling half knows its peer by PeerAddress host. The passive half (review R6 MINOR-4) knows it
+        // only as its mesh partner — the predicate — and must be gated too, or both halves drain the same rows.
+        var peerIsPrimary = msg.Nodes.Any(n => n.Role == RedundancyRole.Primary && SharesAlarmQueue(n.NodeId));
 
         _redundancyRoleView?.Publish(
             PrimaryGatePolicy.ShouldDrainAlarmHistory(_localRole, queueSharingPeerIsPrimary: peerIsPrimary));