fix(redundancy): elect the Primary by cluster age, not by address

RedundancyStateActor derived the driver Primary from ClusterState.RoleLeader("driver").
Akka offers two different notions of a "first" member and they are not the same
one: role leader is the lowest-ADDRESSED Up member (host, then port), while
ClusterSingletonManager places singletons on the OLDEST — lowest up-number.

They agree on a freshly-formed cluster, which is why every existing test passed.
They diverge after any restart: the restarted node re-joins as the youngest while
keeping its address, so if it holds the lower address it becomes role leader while
the singletons stay put. The snapshot would then name a Primary that is not
hosting the work, and every Primary-gated surface follows it — inbound device
writes, native-alarm acks, the fleet-wide alerts emit, and the alarm-history
drain would all enable on the wrong node while the node actually running the
singletons stayed gated off.

BuildSnapshot now selects the oldest Up member carrying the driver role, matching
singleton placement. Leaving members are excluded: a node handing its singletons
over must not be named Primary.

NodeRedundancyState.IsRoleLeaderForDriver is renamed IsDriverPrimary, and
NodeHealthInputs.IsDriverRoleLeader likewise. Keeping the old names would have
left the wire contract asserting a derivation the code no longer uses — the same
drift that made this defect invisible.

Proven by a real two-node cluster rather than a mock. RedundancyPrimaryElectionTests
binds the first-joining node to the HIGHER port, so oldest and lowest-address name
different nodes, and includes a fixture assertion that the divergence actually
occurred — without it the real assertion could pass for the wrong reason. Positive
control: restoring the RoleLeader derivation turns exactly the two election tests
red while the fixture check stays green.

Runtime.Tests 440 passed, ControlPlane.Tests 82, Cluster.Tests 36.

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW

tests/Core/ZB.MOM.WW.OtOpcUa.Cluster.Tests/ServiceLevelCalculatorTests.cs

@@ -21,7 +21,7 @@ public sealed class ServiceLevelCalculatorTests
     public void NotUp_returns_zero(MemberStatus status)
     {
         var sl = ServiceLevelCalculator.Compute(new(status,
-            DbReachable: true, OpcUaProbeOk: true, Stale: false, IsDriverRoleLeader: true));
+            DbReachable: true, OpcUaProbeOk: true, Stale: false, IsDriverPrimary: true));
         sl.ShouldBe((byte)0);
     }
 
@@ -30,7 +30,7 @@ public sealed class ServiceLevelCalculatorTests
     public void Fully_healthy_non_leader_returns_240()
     {
         var sl = ServiceLevelCalculator.Compute(new(MemberStatus.Up,
-            DbReachable: true, OpcUaProbeOk: true, Stale: false, IsDriverRoleLeader: false));
+            DbReachable: true, OpcUaProbeOk: true, Stale: false, IsDriverPrimary: false));
         sl.ShouldBe((byte)240);
     }
 
@@ -39,7 +39,7 @@ public sealed class ServiceLevelCalculatorTests
     public void Fully_healthy_role_leader_returns_250()
     {
         var sl = ServiceLevelCalculator.Compute(new(MemberStatus.Up,
-            DbReachable: true, OpcUaProbeOk: true, Stale: false, IsDriverRoleLeader: true));
+            DbReachable: true, OpcUaProbeOk: true, Stale: false, IsDriverPrimary: true));
         sl.ShouldBe((byte)250);
     }
 
@@ -48,7 +48,7 @@ public sealed class ServiceLevelCalculatorTests
     public void Db_reachable_but_stale_returns_200()
     {
         var sl = ServiceLevelCalculator.Compute(new(MemberStatus.Up,
-            DbReachable: true, OpcUaProbeOk: true, Stale: true, IsDriverRoleLeader: false));
+            DbReachable: true, OpcUaProbeOk: true, Stale: true, IsDriverPrimary: false));
         sl.ShouldBe((byte)200);
     }
 
@@ -57,7 +57,7 @@ public sealed class ServiceLevelCalculatorTests
     public void Db_unreachable_and_stale_returns_100()
     {
         var sl = ServiceLevelCalculator.Compute(new(MemberStatus.Up,
-            DbReachable: false, OpcUaProbeOk: false, Stale: true, IsDriverRoleLeader: false));
+            DbReachable: false, OpcUaProbeOk: false, Stale: true, IsDriverPrimary: false));
         sl.ShouldBe((byte)100);
     }
 
@@ -66,7 +66,7 @@ public sealed class ServiceLevelCalculatorTests
     public void Opcua_probe_fail_when_not_stale_returns_zero()
     {
         var sl = ServiceLevelCalculator.Compute(new(MemberStatus.Up,
-            DbReachable: true, OpcUaProbeOk: false, Stale: false, IsDriverRoleLeader: false));
+            DbReachable: true, OpcUaProbeOk: false, Stale: false, IsDriverPrimary: false));
         sl.ShouldBe((byte)0);
     }
 
@@ -75,7 +75,7 @@ public sealed class ServiceLevelCalculatorTests
     public void Joining_member_is_treated_like_Up()
     {
         var sl = ServiceLevelCalculator.Compute(new(MemberStatus.Joining,
-            DbReachable: true, OpcUaProbeOk: true, Stale: false, IsDriverRoleLeader: false));
+            DbReachable: true, OpcUaProbeOk: true, Stale: false, IsDriverPrimary: false));
         sl.ShouldBe((byte)240);
     }
 
@@ -85,7 +85,7 @@ public sealed class ServiceLevelCalculatorTests
     {
         // basis 240 + 10 = 250, already within byte range; confirms Clamp is in path
         var sl = ServiceLevelCalculator.Compute(new(MemberStatus.Up,
-            DbReachable: true, OpcUaProbeOk: true, Stale: false, IsDriverRoleLeader: true));
+            DbReachable: true, OpcUaProbeOk: true, Stale: false, IsDriverPrimary: true));
         ((int)sl).ShouldBeLessThanOrEqualTo(255);
     }
 }

tests/Server/ZB.MOM.WW.OtOpcUa.ControlPlane.Tests/RedundancyPrimaryElectionTests.cs

@@ -0,0 +1,184 @@
+using Akka.Actor;
+using Akka.Cluster;
+using Akka.Configuration;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Commons.Messages.Redundancy;
+using ZB.MOM.WW.OtOpcUa.ControlPlane.Redundancy;
+
+namespace ZB.MOM.WW.OtOpcUa.ControlPlane.Tests;
+
+/// <summary>
+/// Pins <b>which</b> node <see cref="RedundancyStateActor"/> elects Primary, using a real two-node
+/// cluster deliberately built so that the oldest member is <i>not</i> the lowest-addressed one.
+/// </summary>
+/// <remarks>
+///     <para>
+///         The distinction is the whole point. Akka offers two different "first" members and they
+///         disagree after any restart:
+///     </para>
+///     <list type="bullet">
+///         <item>
+///             <description>
+///                 <c>ClusterState.RoleLeader(role)</c> — the <b>lowest-addressed</b> Up member with
+///                 that role. Address order is host, then port; it has nothing to do with time.
+///             </description>
+///         </item>
+///         <item>
+///             <description>
+///                 <b>Oldest</b> — the Up member with the lowest up-number, i.e. the one that has been
+///                 in the cluster longest. This is what <c>ClusterSingletonManager</c> uses to place
+///                 singletons, and (under <c>keep-oldest</c>) what the split-brain resolver keys on.
+///             </description>
+///         </item>
+///     </list>
+///     <para>
+///         They coincide on a freshly-formed cluster, which is why single-node and
+///         happy-path tests never caught the difference. They diverge the moment a node restarts: the
+///         restarted node becomes the <i>youngest</i> while keeping its address, so if it happens to
+///         hold the lower address it becomes role leader — and the actor would have named it Primary
+///         while the cluster singletons, and every piece of work they own, stayed on the other node.
+///         The Primary-gated data plane (writes, alarm acks, alerts emit, alarm-history drain) would
+///         then be enabled on the node that is not hosting the work.
+///     </para>
+///     <para>
+///         This test reproduces that divergence directly rather than waiting for a restart: node A
+///         binds the <b>higher</b> port and joins first (so it is oldest), node B binds the
+///         <b>lower</b> port and joins second (so it is role leader). The correct answer is A.
+///     </para>
+/// </remarks>
+public sealed class RedundancyPrimaryElectionTests : IAsyncLifetime
+{
+    // Fixed, unusual ports: the test needs a deterministic address ordering, which port 0 cannot give.
+    private const int OldestPort = 19_531;   // joins FIRST  -> oldest, but the HIGHER address
+    private const int YoungestPort = 19_530; // joins SECOND -> role leader, the LOWER address
+
+    private ActorSystem? _oldest;
+    private ActorSystem? _youngest;
+
+    private static Config NodeConfig(int port) => ConfigurationFactory.ParseString($$"""
+        akka {
+            loglevel = "WARNING"
+            actor.provider = "Akka.Cluster.ClusterActorRefProvider, Akka.Cluster"
+            remote.dot-netty.tcp {
+                hostname = "127.0.0.1"
+                port = {{port}}
+            }
+            cluster {
+                seed-nodes = ["akka.tcp://redundancy-election@127.0.0.1:{{OldestPort}}"]
+                roles = ["admin", "driver"]
+                min-nr-of-members = 1
+                run-coordinated-shutdown-when-down = off
+                downing-provider-class = ""
+            }
+        }
+        """);
+
+    public async Task InitializeAsync()
+    {
+        // Order matters: the seed forms the cluster and is therefore the oldest member.
+        _oldest = ActorSystem.Create("redundancy-election", NodeConfig(OldestPort));
+        await WaitForUpAsync(_oldest, expectedMembers: 1);
+
+        _youngest = ActorSystem.Create("redundancy-election", NodeConfig(YoungestPort));
+        await WaitForUpAsync(_oldest, expectedMembers: 2);
+        await WaitForUpAsync(_youngest, expectedMembers: 2);
+    }
+
+    public async Task DisposeAsync()
+    {
+        if (_youngest is not null) await _youngest.Terminate();
+        if (_oldest is not null) await _oldest.Terminate();
+    }
+
+    private static async Task WaitForUpAsync(ActorSystem system, int expectedMembers)
+    {
+        var cluster = Akka.Cluster.Cluster.Get(system);
+        var deadline = DateTime.UtcNow + TimeSpan.FromSeconds(30);
+        while (DateTime.UtcNow < deadline)
+        {
+            var up = cluster.State.Members.Count(m => m.Status == MemberStatus.Up);
+            if (up >= expectedMembers) return;
+            await Task.Delay(100);
+        }
+
+        throw new TimeoutException(
+            $"cluster on port {cluster.SelfAddress.Port} never saw {expectedMembers} Up members "
+            + $"(saw {cluster.State.Members.Count(m => m.Status == MemberStatus.Up)})");
+    }
+
+    /// <summary>
+    /// Sanity check on the fixture itself: if the two orderings did not actually diverge, the real
+    /// assertion below would pass for the wrong reason. This asserts the setup produced the
+    /// divergence it claims to — role leader is the younger node, not the oldest one.
+    /// </summary>
+    [Fact]
+    public void Fixture_actually_produces_divergent_age_and_address_ordering()
+    {
+        var state = Akka.Cluster.Cluster.Get(_oldest!).State;
+
+        state.RoleLeader("driver")!.Port.ShouldBe(
+            YoungestPort,
+            "the fixture is only meaningful if the lowest-addressed node is the YOUNGER one");
+    }
+
+    /// <summary>
+    /// The elected Primary is the oldest driver member — the node that hosts the cluster singletons —
+    /// not the lowest-addressed one.
+    /// </summary>
+    [Fact]
+    public async Task Primary_is_the_oldest_driver_member_not_the_role_leader()
+    {
+        var snapshot = await CaptureSnapshotAsync();
+
+        var primaries = snapshot.Where(n => n.Role == RedundancyRole.Primary).ToList();
+        primaries.Count.ShouldBe(1, "exactly one node may be Primary");
+        primaries[0].NodeId.Value.ShouldBe(
+            $"127.0.0.1:{OldestPort}",
+            "Primary must follow cluster-singleton placement (oldest Up member), or the Primary-gated data plane is enabled on a node that is not hosting the work");
+    }
+
+    /// <summary>The younger node is Secondary, not a second Primary and not Detached.</summary>
+    [Fact]
+    public async Task Younger_driver_member_is_secondary()
+    {
+        var snapshot = await CaptureSnapshotAsync();
+
+        snapshot.Single(n => n.NodeId.Value == $"127.0.0.1:{YoungestPort}")
+            .Role.ShouldBe(RedundancyRole.Secondary);
+    }
+
+    /// <summary>
+    /// <c>IsDriverPrimary</c> agrees with <c>Role</c>. They feed different consumers — the OPC UA
+    /// ServiceLevel calculation reads the flag while the data-plane gates read the role — so a
+    /// disagreement would advertise one node as authoritative while gating writes on the other.
+    /// </summary>
+    [Fact]
+    public async Task IsDriverPrimary_flag_agrees_with_the_role()
+    {
+        var snapshot = await CaptureSnapshotAsync();
+
+        foreach (var node in snapshot)
+        {
+            node.IsDriverPrimary.ShouldBe(
+                node.Role == RedundancyRole.Primary,
+                $"{node.NodeId.Value} disagrees between Role and IsDriverPrimary");
+        }
+    }
+
+    private async Task<IReadOnlyList<NodeRedundancyState>> CaptureSnapshotAsync()
+    {
+        var tcs = new TaskCompletionSource<RedundancyStateChanged>(
+            TaskCreationOptions.RunContinuationsAsynchronously);
+
+        _oldest!.ActorOf(
+            RedundancyStateActor.Props(broadcast: msg =>
+            {
+                if (msg is RedundancyStateChanged changed) tcs.TrySetResult(changed);
+            }),
+            $"redundancy-{Guid.NewGuid():N}");
+
+        var published = await tcs.Task.WaitAsync(TimeSpan.FromSeconds(15));
+        return published.Nodes;
+    }
+}

tests/Server/ZB.MOM.WW.OtOpcUa.ControlPlane.Tests/ServiceLevelCalculatorTests.cs

@@ -17,7 +17,7 @@ public sealed class ServiceLevelCalculatorTests
     public void NotUp_returns_zero(MemberStatus status)
     {
         var sl = ServiceLevelCalculator.Compute(new(status,
-            DbReachable: true, OpcUaProbeOk: true, Stale: false, IsDriverRoleLeader: true));
+            DbReachable: true, OpcUaProbeOk: true, Stale: false, IsDriverPrimary: true));
         sl.ShouldBe((byte)0);
     }
 
@@ -26,7 +26,7 @@ public sealed class ServiceLevelCalculatorTests
     public void Fully_healthy_non_leader_returns_240()
     {
         var sl = ServiceLevelCalculator.Compute(new(MemberStatus.Up,
-            DbReachable: true, OpcUaProbeOk: true, Stale: false, IsDriverRoleLeader: false));
+            DbReachable: true, OpcUaProbeOk: true, Stale: false, IsDriverPrimary: false));
         sl.ShouldBe((byte)240);
     }
 
@@ -35,7 +35,7 @@ public sealed class ServiceLevelCalculatorTests
     public void Fully_healthy_role_leader_returns_250()
     {
         var sl = ServiceLevelCalculator.Compute(new(MemberStatus.Up,
-            DbReachable: true, OpcUaProbeOk: true, Stale: false, IsDriverRoleLeader: true));
+            DbReachable: true, OpcUaProbeOk: true, Stale: false, IsDriverPrimary: true));
         sl.ShouldBe((byte)250);
     }
 
@@ -44,7 +44,7 @@ public sealed class ServiceLevelCalculatorTests
     public void Db_reachable_but_stale_returns_200()
     {
         var sl = ServiceLevelCalculator.Compute(new(MemberStatus.Up,
-            DbReachable: true, OpcUaProbeOk: true, Stale: true, IsDriverRoleLeader: false));
+            DbReachable: true, OpcUaProbeOk: true, Stale: true, IsDriverPrimary: false));
         sl.ShouldBe((byte)200);
     }
 
@@ -53,7 +53,7 @@ public sealed class ServiceLevelCalculatorTests
     public void Db_unreachable_and_stale_returns_100()
     {
         var sl = ServiceLevelCalculator.Compute(new(MemberStatus.Up,
-            DbReachable: false, OpcUaProbeOk: false, Stale: true, IsDriverRoleLeader: false));
+            DbReachable: false, OpcUaProbeOk: false, Stale: true, IsDriverPrimary: false));
         sl.ShouldBe((byte)100);
     }
 
@@ -63,7 +63,7 @@ public sealed class ServiceLevelCalculatorTests
     {
         // (DbReachable=true, OpcUaProbeOk=false, Stale=false) falls through to the catch-all 0.
         var sl = ServiceLevelCalculator.Compute(new(MemberStatus.Up,
-            DbReachable: true, OpcUaProbeOk: false, Stale: false, IsDriverRoleLeader: false));
+            DbReachable: true, OpcUaProbeOk: false, Stale: false, IsDriverPrimary: false));
         sl.ShouldBe((byte)0);
     }
 
@@ -72,7 +72,7 @@ public sealed class ServiceLevelCalculatorTests
     public void Joining_member_is_treated_like_Up_for_grading()
     {
         var sl = ServiceLevelCalculator.Compute(new(MemberStatus.Joining,
-            DbReachable: true, OpcUaProbeOk: true, Stale: false, IsDriverRoleLeader: false));
+            DbReachable: true, OpcUaProbeOk: true, Stale: false, IsDriverPrimary: false));
         sl.ShouldBe((byte)240);
     }
 }

tests/Server/ZB.MOM.WW.OtOpcUa.Runtime.Tests/Drivers/DriverHostActorNativeAlarmAckRoutingTests.cs

@@ -106,7 +106,7 @@ public sealed class DriverHostActorNativeAlarmAckRoutingTests : RuntimeActorTest
             new[]
             {
                 new NodeRedundancyState(TestNode, RedundancyRole.Secondary,
-                    IsClusterLeader: false, IsRoleLeaderForDriver: false, AsOfUtc: DateTime.UtcNow),
+                    IsClusterLeader: false, IsDriverPrimary: false, AsOfUtc: DateTime.UtcNow),
             },
             CorrelationId.NewId()));
 

tests/Server/ZB.MOM.WW.OtOpcUa.Runtime.Tests/Drivers/DriverHostActorNativeAlarmTests.cs

@@ -330,7 +330,7 @@ public sealed class DriverHostActorNativeAlarmTests : RuntimeActorTestBase
                     NodeId: TestNode,
                     Role: role,
                     IsClusterLeader: role == RedundancyRole.Primary,
-                    IsRoleLeaderForDriver: role == RedundancyRole.Primary,
+                    IsDriverPrimary: role == RedundancyRole.Primary,
                     AsOfUtc: DateTime.UtcNow),
             },
             CorrelationId.NewId()));

tests/Server/ZB.MOM.WW.OtOpcUa.Runtime.Tests/Drivers/DriverHostActorPrimaryGateTests.cs

@@ -216,7 +216,7 @@ public sealed class DriverHostActorPrimaryGateTests : RuntimeActorTestBase
             {
                 new NodeRedundancyState(TestNode, role,
                     IsClusterLeader: role == RedundancyRole.Primary,
-                    IsRoleLeaderForDriver: role == RedundancyRole.Primary,
+                    IsDriverPrimary: role == RedundancyRole.Primary,
                     AsOfUtc: DateTime.UtcNow),
             },
             CorrelationId.NewId()));

tests/Server/ZB.MOM.WW.OtOpcUa.Runtime.Tests/Drivers/DriverHostActorRoleViewTests.cs

@@ -66,10 +66,10 @@ public sealed class DriverHostActorRoleViewTests : RuntimeActorTestBase
         SpawnHost(view, driverMemberCount: 4).Tell(new RedundancyStateChanged(
             [
                 new NodeRedundancyState(TestNode, RedundancyRole.Secondary,
-                    IsClusterLeader: false, IsRoleLeaderForDriver: false, AsOfUtc: DateTime.UtcNow),
+                    IsClusterLeader: false, IsDriverPrimary: false, AsOfUtc: DateTime.UtcNow),
                 // A Primary DOES exist — in another pair. It is not this node's replication peer.
                 new NodeRedundancyState(NodeId.Parse("some-other-pair:4053"), RedundancyRole.Primary,
-                    IsClusterLeader: true, IsRoleLeaderForDriver: true, AsOfUtc: DateTime.UtcNow),
+                    IsClusterLeader: true, IsDriverPrimary: true, AsOfUtc: DateTime.UtcNow),
             ],
             CorrelationId.NewId()));
 
@@ -198,13 +198,13 @@ public sealed class DriverHostActorRoleViewTests : RuntimeActorTestBase
             [
                 new NodeRedundancyState(node, role,
                     IsClusterLeader: role == RedundancyRole.Primary,
-                    IsRoleLeaderForDriver: role == RedundancyRole.Primary,
+                    IsDriverPrimary: role == RedundancyRole.Primary,
                     AsOfUtc: DateTime.UtcNow),
                 new NodeRedundancyState(
                     NodeId.Parse($"{PeerHost}:4053"),
                     role == RedundancyRole.Primary ? RedundancyRole.Secondary : RedundancyRole.Primary,
                     IsClusterLeader: role != RedundancyRole.Primary,
-                    IsRoleLeaderForDriver: role != RedundancyRole.Primary,
+                    IsDriverPrimary: role != RedundancyRole.Primary,
                     AsOfUtc: DateTime.UtcNow),
             ],
             CorrelationId.NewId());

tests/Server/ZB.MOM.WW.OtOpcUa.Runtime.Tests/Drivers/DriverHostActorWriteRoutingTests.cs

@@ -106,7 +106,7 @@ public sealed class DriverHostActorWriteRoutingTests : RuntimeActorTestBase
             new[]
             {
                 new NodeRedundancyState(TestNode, RedundancyRole.Secondary,
-                    IsClusterLeader: false, IsRoleLeaderForDriver: false, AsOfUtc: DateTime.UtcNow),
+                    IsClusterLeader: false, IsDriverPrimary: false, AsOfUtc: DateTime.UtcNow),
             },
             CorrelationId.NewId()));
 

tests/Server/ZB.MOM.WW.OtOpcUa.Runtime.Tests/Health/PeerProbeSupervisorTests.cs

@@ -38,7 +38,7 @@ public sealed class PeerProbeSupervisorTests : RuntimeActorTestBase
         Akka.Actor.Props.Create(() => new RecordingNoopActor(spawned));
 
     private static NodeRedundancyState State(NodeId id, RedundancyRole role) =>
-        new(id, role, IsClusterLeader: false, IsRoleLeaderForDriver: false, DateTime.UtcNow);
+        new(id, role, IsClusterLeader: false, IsDriverPrimary: false, DateTime.UtcNow);
 
     private static RedundancyStateChanged Snapshot(params NodeRedundancyState[] nodes) =>
         new(nodes, CorrelationId.NewId());

tests/Server/ZB.MOM.WW.OtOpcUa.Runtime.Tests/Historian/HistorianAdapterActorTests.cs

@@ -85,7 +85,7 @@ public sealed class HistorianAdapterActorTests : RuntimeActorTestBase
                     NodeId: LocalNode,
                     Role: role,
                     IsClusterLeader: role == RedundancyRole.Primary,
-                    IsRoleLeaderForDriver: role == RedundancyRole.Primary,
+                    IsDriverPrimary: role == RedundancyRole.Primary,
                     AsOfUtc: DateTime.UtcNow),
             },
             CorrelationId.NewId()));
@@ -166,7 +166,7 @@ public sealed class HistorianAdapterActorTests : RuntimeActorTestBase
                     NodeId: new NodeId("some-other-node"),
                     Role: RedundancyRole.Secondary,
                     IsClusterLeader: false,
-                    IsRoleLeaderForDriver: false,
+                    IsDriverPrimary: false,
                     AsOfUtc: DateTime.UtcNow),
             },
             CorrelationId.NewId()));

tests/Server/ZB.MOM.WW.OtOpcUa.Runtime.Tests/OpcUa/OpcUaPublishActorTests.cs

@@ -181,7 +181,7 @@ public sealed class OpcUaPublishActorTests : RuntimeActorTestBase
             Nodes: new[]
             {
                 new NodeRedundancyState(local, RedundancyRole.Detached,
-                    IsClusterLeader: false, IsRoleLeaderForDriver: false, DateTime.UtcNow),
+                    IsClusterLeader: false, IsDriverPrimary: false, DateTime.UtcNow),
             },
             CorrelationId.NewId()));
 
@@ -202,9 +202,9 @@ public sealed class OpcUaPublishActorTests : RuntimeActorTestBase
             Nodes: new[]
             {
                 new NodeRedundancyState(local, RedundancyRole.Primary,
-                    IsClusterLeader: true, IsRoleLeaderForDriver: true, DateTime.UtcNow),
+                    IsClusterLeader: true, IsDriverPrimary: true, DateTime.UtcNow),
                 new NodeRedundancyState(NodeId.Parse("other-node"), RedundancyRole.Secondary,
-                    IsClusterLeader: false, IsRoleLeaderForDriver: false, DateTime.UtcNow),
+                    IsClusterLeader: false, IsDriverPrimary: false, DateTime.UtcNow),
             },
             CorrelationId.NewId());
         actor.Tell(snapshot);
@@ -225,7 +225,7 @@ public sealed class OpcUaPublishActorTests : RuntimeActorTestBase
             Nodes: new[]
             {
                 new NodeRedundancyState(local, RedundancyRole.Secondary,
-                    IsClusterLeader: false, IsRoleLeaderForDriver: false, DateTime.UtcNow),
+                    IsClusterLeader: false, IsDriverPrimary: false, DateTime.UtcNow),
             },
             CorrelationId.NewId());
         actor.Tell(snapshot);
@@ -251,7 +251,7 @@ public sealed class OpcUaPublishActorTests : RuntimeActorTestBase
             Nodes: new[]
             {
                 new NodeRedundancyState(local, RedundancyRole.Primary,
-                    IsClusterLeader: true, IsRoleLeaderForDriver: true, DateTime.UtcNow),
+                    IsClusterLeader: true, IsDriverPrimary: true, DateTime.UtcNow),
             },
             CorrelationId.NewId()));
 
@@ -277,7 +277,7 @@ public sealed class OpcUaPublishActorTests : RuntimeActorTestBase
             Nodes: new[]
             {
                 new NodeRedundancyState(local, RedundancyRole.Secondary,
-                    IsClusterLeader: false, IsRoleLeaderForDriver: false, DateTime.UtcNow),
+                    IsClusterLeader: false, IsDriverPrimary: false, DateTime.UtcNow),
             },
             CorrelationId.NewId()));
 
@@ -302,7 +302,7 @@ public sealed class OpcUaPublishActorTests : RuntimeActorTestBase
             Nodes: new[]
             {
                 new NodeRedundancyState(local, RedundancyRole.Secondary,
-                    IsClusterLeader: false, IsRoleLeaderForDriver: false, DateTime.UtcNow),
+                    IsClusterLeader: false, IsDriverPrimary: false, DateTime.UtcNow),
             },
             CorrelationId.NewId()));
 
@@ -329,7 +329,7 @@ public sealed class OpcUaPublishActorTests : RuntimeActorTestBase
             Nodes: new[]
             {
                 new NodeRedundancyState(local, RedundancyRole.Secondary,
-                    IsClusterLeader: false, IsRoleLeaderForDriver: false,
+                    IsClusterLeader: false, IsDriverPrimary: false,
                     DateTime.UtcNow - TimeSpan.FromMinutes(1)),
             },
             CorrelationId.NewId()));
@@ -358,7 +358,7 @@ public sealed class OpcUaPublishActorTests : RuntimeActorTestBase
             Nodes: new[]
             {
                 new NodeRedundancyState(local, RedundancyRole.Primary,
-                    IsClusterLeader: true, IsRoleLeaderForDriver: true, DateTime.UtcNow),
+                    IsClusterLeader: true, IsDriverPrimary: true, DateTime.UtcNow),
             },
             CorrelationId.NewId()));
         AwaitAssert(() => publisher.Levels.ShouldContain((byte)250),
@@ -369,7 +369,7 @@ public sealed class OpcUaPublishActorTests : RuntimeActorTestBase
             Nodes: new[]
             {
                 new NodeRedundancyState(local, RedundancyRole.Detached,
-                    IsClusterLeader: false, IsRoleLeaderForDriver: false, DateTime.UtcNow),
+                    IsClusterLeader: false, IsDriverPrimary: false, DateTime.UtcNow),
             },
             CorrelationId.NewId()));
 
@@ -398,7 +398,7 @@ public sealed class OpcUaPublishActorTests : RuntimeActorTestBase
             Nodes: new[]
             {
                 new NodeRedundancyState(local, RedundancyRole.Secondary,
-                    IsClusterLeader: false, IsRoleLeaderForDriver: false, DateTime.UtcNow),
+                    IsClusterLeader: false, IsDriverPrimary: false, DateTime.UtcNow),
             },
             CorrelationId.NewId()));
 
@@ -441,7 +441,7 @@ public sealed class OpcUaPublishActorTests : RuntimeActorTestBase
             Nodes: new[]
             {
                 new NodeRedundancyState(local, RedundancyRole.Primary,
-                    IsClusterLeader: true, IsRoleLeaderForDriver: true, DateTime.UtcNow),
+                    IsClusterLeader: true, IsDriverPrimary: true, DateTime.UtcNow),
             },
             CorrelationId.NewId()));
 
@@ -469,7 +469,7 @@ public sealed class OpcUaPublishActorTests : RuntimeActorTestBase
             Nodes: new[]
             {
                 new NodeRedundancyState(local, RedundancyRole.Primary,
-                    IsClusterLeader: true, IsRoleLeaderForDriver: true, DateTime.UtcNow),
+                    IsClusterLeader: true, IsDriverPrimary: true, DateTime.UtcNow),
             },
             CorrelationId.NewId()));
 
@@ -498,7 +498,7 @@ public sealed class OpcUaPublishActorTests : RuntimeActorTestBase
             Nodes: new[]
             {
                 new NodeRedundancyState(local, RedundancyRole.Secondary,
-                    IsClusterLeader: false, IsRoleLeaderForDriver: false, DateTime.UtcNow),
+                    IsClusterLeader: false, IsDriverPrimary: false, DateTime.UtcNow),
             },
             CorrelationId.NewId()));
 
@@ -526,7 +526,7 @@ public sealed class OpcUaPublishActorTests : RuntimeActorTestBase
             Nodes: new[]
             {
                 new NodeRedundancyState(local, RedundancyRole.Primary,
-                    IsClusterLeader: true, IsRoleLeaderForDriver: true, DateTime.UtcNow),
+                    IsClusterLeader: true, IsDriverPrimary: true, DateTime.UtcNow),
             },
             CorrelationId.NewId()));
 
@@ -548,7 +548,7 @@ public sealed class OpcUaPublishActorTests : RuntimeActorTestBase
             Nodes: new[]
             {
                 new NodeRedundancyState(local, RedundancyRole.Primary,
-                    IsClusterLeader: true, IsRoleLeaderForDriver: true, DateTime.UtcNow),
+                    IsClusterLeader: true, IsDriverPrimary: true, DateTime.UtcNow),
             },
             CorrelationId.NewId()));
 
@@ -574,7 +574,7 @@ public sealed class OpcUaPublishActorTests : RuntimeActorTestBase
         actor.Tell(new RedundancyStateChanged(new[]
         {
             new NodeRedundancyState(local, RedundancyRole.Primary,
-                IsClusterLeader: true, IsRoleLeaderForDriver: true, DateTime.UtcNow),
+                IsClusterLeader: true, IsDriverPrimary: true, DateTime.UtcNow),
         }, CorrelationId.NewId()));
         // No direct DbHealthStatus Tell — the periodic HealthTick Ask must populate it → 250.
         AwaitAssert(() => publisher.Levels.ShouldContain((byte)250), TimeSpan.FromSeconds(2));

tests/Server/ZB.MOM.WW.OtOpcUa.Runtime.Tests/OpcUa/ServiceLevelEndToEndTests.cs

@@ -51,7 +51,7 @@ public sealed class ServiceLevelEndToEndTests : RuntimeActorTestBase
             actor.Tell(new RedundancyStateChanged(
                 Nodes: new[]
                 {
-                    new NodeRedundancyState(localNode, RedundancyRole.Primary, IsClusterLeader: true, IsRoleLeaderForDriver: true, AsOfUtc: DateTime.UtcNow),
+                    new NodeRedundancyState(localNode, RedundancyRole.Primary, IsClusterLeader: true, IsDriverPrimary: true, AsOfUtc: DateTime.UtcNow),
                 },
                 CorrelationId: CorrelationId.NewId()));
 
@@ -91,7 +91,7 @@ public sealed class ServiceLevelEndToEndTests : RuntimeActorTestBase
             actor.Tell(new RedundancyStateChanged(
                 Nodes: new[]
                 {
-                    new NodeRedundancyState(localNode, RedundancyRole.Secondary, IsClusterLeader: false, IsRoleLeaderForDriver: false, AsOfUtc: DateTime.UtcNow),
+                    new NodeRedundancyState(localNode, RedundancyRole.Secondary, IsClusterLeader: false, IsDriverPrimary: false, AsOfUtc: DateTime.UtcNow),
                 },
                 CorrelationId: CorrelationId.NewId()));
 

tests/Server/ZB.MOM.WW.OtOpcUa.Runtime.Tests/ScriptedAlarms/ScriptedAlarmHostActorTests.cs

@@ -102,7 +102,7 @@ public sealed class ScriptedAlarmHostActorTests : RuntimeActorTestBase
                     NodeId: id,
                     Role: role,
                     IsClusterLeader: role == RedundancyRole.Primary,
-                    IsRoleLeaderForDriver: role == RedundancyRole.Primary,
+                    IsDriverPrimary: role == RedundancyRole.Primary,
                     AsOfUtc: DateTime.UtcNow),
             },
             CorrelationId.NewId()));