docs(design): fix two staleness artefacts the settled decisions introduced

Section 5 still listed "site-local-primary storage" among the things deliberately
NOT copied from ScadaBridge — which §6.1 now reverses, since driver nodes stop
connecting to the ConfigDb and read their configuration from LocalDb. Replaced
with an explicit copied/not-copied split, and narrowed the not-copied item to what
it should have said all along: their transient-only central alarm cache, which
OtOpcUa has no reason to adopt because it persists alarm history through the
historian and Phase 2's replicated buffer already survives a failover.

Also corrected a renumbering artefact — the risk about rewriting the docker-dev
rig cited Phase 4, but the mesh partition moved to Phase 6 when the two data-path
phases were inserted.

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW

docs/plans/2026-07-21-per-cluster-mesh-design.md

@@ -165,8 +165,14 @@ Mirror ScadaBridge's shape, adapted to OtOpcUa's existing substrate:
   observability topics with one stream contract carrying a `oneof` event — additive-only field
   evolution, contract-locked by test.
 
-Deliberately **not** copied: their transient-only central alarm cache and site-local-primary storage
-(see §6.1), and their unauthenticated transports (§6.3).
+**Copied:** their node-local configuration store fed by fetch-and-cache (§6.1), their oldest-Up
+active-node rule (§4), their two-node keep-oldest posture including its acknowledged outage gap
+(§6.2), and their unauthenticated inter-cluster transports (§6.3).
+
+**Deliberately not copied:** their *transient-only* central alarm cache. OtOpcUa persists alarm
+history centrally through the historian, and Phase 2's replicated store-and-forward buffer already
+guarantees delivery across a failover — so there is no reason to adopt a design whose stated
+trade-off is that a new active node re-seeds alarm state from scratch.
 
 ## 6. Decisions (settled 2026-07-21)
 
@@ -258,7 +264,7 @@ deserves its own live gate.
   blast radius raised.
 - **`DbHealthProbeActor` feeds a client-visible value.** Removing the driver-side DB connection
   changes what ServiceLevel means on those nodes; that is an interop-visible change, not internal.
-- **The rig currently models the topology that would be abolished.** Phase 4 rewrites
+- **The rig currently models the topology that would be abolished.** Phase 6 rewrites
   `docker-dev/docker-compose.yml` substantially, and every live gate that depends on it.
 - **Losing gossip loses free fleet-wide observability.** Seven AdminUI panels are fed by DPS today;
   each needs an explicit stream and a reconnect story.