docs(mesh): ConfigSource/ConfigServe config, rig flip switch, Phase 3 as shipped

Phase 3 Task 9. docker-dev rig: central-1/2 carry ConfigServe (:4055 h2c + committed
dev key) and stay Direct; the four site nodes carry ConfigSource (both central
endpoints + matching key) defaulting to Direct. Flip only the site nodes with
OTOPCUA_CONFIG_MODE=FetchAndCache at 'docker compose up' — central keeps SQL and models
the target topology. Binding :4055 activates the dedicated-h2c Kestrel takeover on
central (re-binds :9000 too). Docs: new docs/Configuration.md ConfigSource/ConfigServe
section; docs/Redundancy.md 'config bytes travel out-of-band' note; the program plan
Phase 3 section + tracking row flipped to CODE-COMPLETE; a CLAUDE.md 'Config source'
section.

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW

docs/plans/2026-07-22-per-cluster-mesh-program.md

@@ -141,16 +141,30 @@ admin-change refresh), clusters know central from appsettings (static, restart t
 flow over ClusterClient (DPS paths deleted or dark-switched), including an Ask timing out cleanly
 against a stopped node.
 
-### Phase 3 — Config fetch-and-cache from central
-**Scope:** the deploy artifact is served **by central** (transport per its own phase plan — the
-ScadaBridge analogue is token-gated HTTP; decide HTTP vs a gRPC fetch RPC when planning) and
-cached in LocalDb; driver nodes read config exclusively from LocalDb (boot-from-cache becomes the
-normal path — design §6.1); chunking, SHA-256 verify, newest-2 retention, pair replication carry
-over unchanged. **This phase changes a running data path — it gets its own live gate** (design §7
-note): deploy lands on a driver pair with central SQL stopped mid-fetch → retry lands; #485
-last-known-good semantics re-proven on the new path.
-**Exit gate:** live gate green on the rig; a driver node with an empty LocalDb and reachable
-central boots into the current config; with central down it boots last-known-good.
+### Phase 3 — Config fetch-and-cache from central — **CODE-COMPLETE 2026-07-23 (Tasks 0–8; live gate Task 10 pending)**
+**Decisions taken:** the deploy artifact is served **by central over a gRPC fetch RPC**
+(`DeploymentArtifactService.Fetch`, streamed chunks — chosen over token-gated HTTP), authenticated by
+a **shared node bearer key** (`ConfigServe:ApiKey == ConfigSource:ApiKey`, `FixedTimeEquals`,
+fail-closed — chosen over a per-deployment token, so **no migration** and `DispatchDeployment` stays
+payload-free). Cutover is a **config-flagged dark switch** `ConfigSource:Mode` (`Direct` default |
+`FetchAndCache`), per node. Plan + task ledger:
+[`docs/plans/2026-07-22-mesh-phase3-config-fetch-and-cache.md`](2026-07-22-mesh-phase3-config-fetch-and-cache.md).
+**Shipped (all green, sabotage-checked):** `ConfigSource`/`ConfigServe` options + validator; the repo's
+first in-repo `.proto` + `Grpc.Tools` codegen; central `DeploymentArtifactGrpcService` (streams the
+sealed blob, NotFound-hides unknown/not-sealed/empty); `ConfigServeAuthInterceptor` + a dedicated h2c
+Kestrel listener merged with the LocalDb-sync listener (re-binds the existing surface once, adds both
+dedicated ports); node `GrpcDeploymentArtifactFetcher` (SHA-verified reassembly, endpoint failover,
+null-on-any-failure); the `FetchAndCache` apply path (`PipeTo(Self)`, fetch→cache→apply-from-bytes,
+null = apply-failure keeping last-known-good) and bootstrap-from-the-LocalDb-pointer (no driver-side
+config SQL read); #485 coverage; and a **real two-Host gRPC boundary test** (right-key reassembles,
+wrong-key control returns null, failover). Chunking, SHA-256 verify, newest-2 retention, pair
+replication carry over unchanged. **Phase boundary held:** config **reads** only — the
+`NodeDeploymentState` ack-row write, `DbHealthProbe`, `EfAlarmConditionStateStore` stay for Phase 4.
+**Remaining (Tasks 9–10):** rig config + docs (done) and the live gate — deploy on a site pair flipped
+to `FetchAndCache` with central SQL stopped mid-fetch → retry lands; #485 last-known-good re-proven on
+the new path.
+**Exit gate:** live gate green on the rig; a driver node with an empty LocalDb and reachable central
+boots into the current config; with central down it boots last-known-good.
 
 ### Phase 4 — Cut the driver-side ConfigDb connection
 **Scope (design §6.1 audit table):** re-home `EfAlarmConditionStateStore` to LocalDb (pair-local
@@ -229,7 +243,7 @@ resource sizing on the site VMs should be checked once both products run the ful
 | Prereq: selfform-fallback + manual-failover plan | **DONE 2026-07-22**, merged `a78425ea`. Shipped *not* as the planned `SelfFormAfter` watchdog — the live gate caught that islanding a manually-failed-over node — but as self-first seed ordering + `AkkaClusterOptionsValidator`. Phase 6's seed-ordering scope is therefore already discharged. |
 | 1 ClusterNode columns + DB ack set | **DONE 2026-07-22**, merged `7654f24d`. Deploy-seal semantics changed as flagged, but the escape hatch is **`ClusterNode.MaintenanceMode`**, not `Enabled=0` — the live gate found `Enabled=0` is rejected by `DraftValidator.ValidateClusterTopology` on any 2-node pair. Gate record: `2026-07-22-mesh-phase1-live-gate.md`. |
 | 2 ClusterClient transport | **DONE 2026-07-22** (live gate PASSED, shipped dark) — shipped dark (`MeshTransport:Mode=Dps` default), both comm actors registered in both modes. Corrections: `SendToAll` not `Send`, one fleet-wide client not one per cluster, `/user/node-communication` not `/user/cluster-communication`. The gate's "Ask timing out" item does not exist to test — no cross-boundary Ask in this phase; see the phase section. |
-| 3 fetch-and-cache | not started |
+| 3 fetch-and-cache | **CODE-COMPLETE 2026-07-23** (Tasks 0–8 merged to the phase branch, all green + sabotage-checked; live gate Task 10 pending). gRPC fetch RPC + shared node key; dark switch `ConfigSource:Mode` (Direct default). Rig flip: `OTOPCUA_CONFIG_MODE=FetchAndCache` on the site nodes. See `2026-07-22-mesh-phase3-config-fetch-and-cache.md`. |
 | 4 cut driver ConfigDb | not started |
 | 5 gRPC telemetry | not started |
 | 6 mesh partition + co-location | not started |