From 4caaa11e9ec85df339fb38f831cad64736cebdfe Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Tue, 21 Jul 2026 10:09:10 -0400 Subject: [PATCH] docs(design): fix two staleness artefacts the settled decisions introduced MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Section 5 still listed "site-local-primary storage" among the things deliberately NOT copied from ScadaBridge — which §6.1 now reverses, since driver nodes stop connecting to the ConfigDb and read their configuration from LocalDb. Replaced with an explicit copied/not-copied split, and narrowed the not-copied item to what it should have said all along: their transient-only central alarm cache, which OtOpcUa has no reason to adopt because it persists alarm history through the historian and Phase 2's replicated buffer already survives a failover. Also corrected a renumbering artefact — the risk about rewriting the docker-dev rig cited Phase 4, but the mesh partition moved to Phase 6 when the two data-path phases were inserted. Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW --- docs/plans/2026-07-21-per-cluster-mesh-design.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/docs/plans/2026-07-21-per-cluster-mesh-design.md b/docs/plans/2026-07-21-per-cluster-mesh-design.md index 89f1e22e..addeb661 100644 --- a/docs/plans/2026-07-21-per-cluster-mesh-design.md +++ b/docs/plans/2026-07-21-per-cluster-mesh-design.md @@ -165,8 +165,14 @@ Mirror ScadaBridge's shape, adapted to OtOpcUa's existing substrate: observability topics with one stream contract carrying a `oneof` event — additive-only field evolution, contract-locked by test. -Deliberately **not** copied: their transient-only central alarm cache and site-local-primary storage -(see §6.1), and their unauthenticated transports (§6.3). +**Copied:** their node-local configuration store fed by fetch-and-cache (§6.1), their oldest-Up +active-node rule (§4), their two-node keep-oldest posture including its acknowledged outage gap +(§6.2), and their unauthenticated inter-cluster transports (§6.3). + +**Deliberately not copied:** their *transient-only* central alarm cache. OtOpcUa persists alarm +history centrally through the historian, and Phase 2's replicated store-and-forward buffer already +guarantees delivery across a failover — so there is no reason to adopt a design whose stated +trade-off is that a new active node re-seeds alarm state from scratch. ## 6. Decisions (settled 2026-07-21) @@ -258,7 +264,7 @@ deserves its own live gate. blast radius raised. - **`DbHealthProbeActor` feeds a client-visible value.** Removing the driver-side DB connection changes what ServiceLevel means on those nodes; that is an interop-visible change, not internal. -- **The rig currently models the topology that would be abolished.** Phase 4 rewrites +- **The rig currently models the topology that would be abolished.** Phase 6 rewrites `docker-dev/docker-compose.yml` substantially, and every live gate that depends on it. - **Losing gossip loses free fleet-wide observability.** Seven AdminUI panels are fed by DPS today; each needs an explicit stream and a reconnect story.