docs(mesh-phase5): telemetry stream — Telemetry.md, config keys, supersede §6.3, program status

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW

docs/Configuration.md

@@ -177,6 +177,60 @@ PersistNodeAck`) and LDAP group→role DB grants (a driver-only node maps LDAP g
 the `Security:Ldap:GroupToRole` appsettings baseline only — see `docs/Redundancy.md` and
 `CLAUDE.md` §"Phase 4" for the full picture, including the client-visible ServiceLevel change).
 
+### `Telemetry` / `TelemetryDial` (live telemetry transport)
+
+- **Purpose:** [per-cluster mesh](plans/2026-07-21-per-cluster-mesh-design.md) **Phase 5**. Selects how
+  the four live-observability channels (`alerts`, `script-logs`, `driver-health`,
+  `driver-resilience-status`) reach central: `Dps` (DistributedPubSub — the four existing SignalR
+  bridges, today's behaviour) or `Grpc` (a driver node hosts one gRPC server-streaming contract over a
+  dedicated h2c port; central dials in and feeds the same in-process sinks). `Telemetry` is the
+  **node/serve** side; `TelemetryDial` is the **central/dial** side.
+- **Options classes:** `TelemetryOptions` (`SectionName = "Telemetry"`) + `TelemetryDialOptions`
+  (`SectionName = "TelemetryDial"`), both in `src/Core/ZB.MOM.WW.OtOpcUa.Cluster/`. Bound by
+  `AddOtOpcUaCluster(config)`; their validators run at `ValidateOnStart`.
+
+**`Telemetry` (node-side, serve):**
+
+| Key | Type | Default | Meaning |
+|---|---|---|---|
+| `Mode` | string | `Dps` | `Dps` = no change, node just keeps publishing DPS as it always has. `Grpc` = central-ingest hint (see `TelemetryDial:Mode` below — this key does not gate anything on the node itself). Any other value **refuses to start**. |
+| `GrpcListenPort` | int | `0` | Dedicated **h2c-only** Kestrel port for the telemetry stream service. `0` = disabled (nothing bound). The node hosts the server whenever this is `> 0`, **regardless of `Mode`**. |
+| `ApiKey` | string | `""` | Shared bearer key the serve-side interceptor checks (constant-time, **fail-closed**: an unset key rejects every call). **Supply via env `Telemetry__ApiKey` — never commit.** |
+
+**`TelemetryDial` (central-side, dial):**
+
+| Key | Type | Default | Meaning |
+|---|---|---|---|
+| `Mode` | string | `Dps` | `Dps` = the four DPS SignalR bridges (alert, script-log, driver-status, resilience) subscribe as today. `Grpc` = those four bridges are **not spawned**; the `TelemetryDialSupervisor` actor dials every driver node instead and feeds the same sinks. Any other value **refuses to start**. |
+| `ApiKey` | string | `""` | Shared bearer key; must equal the nodes' `Telemetry:ApiKey`. **Supply via env `TelemetryDial__ApiKey` — never commit.** Required under `Grpc`. |
+| `ContactRefreshSeconds` | int | `60` | How often central rebuilds its dial-target set from the `ClusterNode` rows (`Host` + `GrpcPort`). |
+| `CallTimeoutSeconds` | int | `30` | Per-call deadline for the streaming RPC's keepalive/health bookkeeping. |
+
+**It is a dark switch; the node always hosts.** Unlike `ConfigServe`/`MeshTransport`, where the serve
+side is gated on a role, the telemetry server binds whenever `Telemetry:GrpcListenPort > 0` — hosting
+is unconditional on a driver-role node, in both modes, because the node also always emits into its
+local hub and always publishes DPS. Only `TelemetryDial:Mode` on central actually changes behaviour:
+which of the two already-always-available sources (DPS bridges vs. the gRPC dial supervisor) feeds the
+AdminUI sinks. Flipping either side is a config change plus restart, not a redeploy — the same
+discipline as `MeshTransport:Mode` and `ConfigSource:Mode`.
+
+**A driver-role node with `Telemetry:Mode=Grpc` must set `GrpcListenPort > 0`** (nothing to serve
+otherwise) — enforced by `TelemetryOptionsValidator`. **`Grpc` mode on either side requires a
+non-empty `ApiKey`** — fail-closed, same as `ConfigServe`/`LocalDb:Replication`.
+
+**Three DPS observability topics stay out of scope for this transport, on purpose:**
+`redundancy-state` (pair-local, built from `Cluster.State`, stays on DPS in both modes — see
+[`Redundancy.md`](Redundancy.md#command-transport-centralnode)), `fleet-status` (central-internal;
+`Fleet.razor` polls the Config DB, not any stream), and `deployment-acks` (already rides the Phase 2
+`ClusterClient` transport as a command-plane reply). See
+[`docs/Telemetry.md`](Telemetry.md) for the full architecture, the reconnect/generation-stamped
+dialer story, and the rationale for the node-hosts/central-dials inversion.
+
+On the docker-dev rig every driver-role node carries `Telemetry:GrpcListenPort` (`4056`) + a
+committed dev key, and central carries the matching `TelemetryDial:ApiKey`; both `Mode` keys stay
+unset (⇒ `Dps`) until the rig is flipped with `Telemetry__Mode=Grpc` / `TelemetryDial__Mode=Grpc` at
+`docker compose up`.
+
 ### `ConnectionStrings` → `ConfigDb`
 
 - **Purpose:** the central Config DB connection string. **Required on admin-role nodes only** — `Program.cs` calls `AddOtOpcUaConfigDb` when `hasAdmin` (per-cluster mesh Phase 4). A driver-only node holds no `ConfigDb` connection string; it fetches its configuration via `ConfigSource:Mode=FetchAndCache` instead (see above). A fused `admin,driver` node still requires it.
@@ -283,6 +337,7 @@ These are consumed by the driver **integration-test fixtures** (under `tests/Dri
 
 - [`security.md`](security.md) — transport security, OPC UA authentication, LDAP (`Security:Ldap`), data-plane ACLs, control-plane roles.
 - [`Redundancy.md`](Redundancy.md) — the `Cluster` section in the context of warm/hot redundancy, ServiceLevel, peer discovery.
+- [`Telemetry.md`](Telemetry.md) — the `Telemetry`/`TelemetryDial` gRPC live-telemetry stream: direction, dark switch, the four migrated channels + three deferrals, auth, reconnect story.
 - [`ServiceHosting.md`](ServiceHosting.md) — role-based host wiring and `OTOPCUA_ROLES`.
 - [`docs/drivers/Galaxy.md`](drivers/Galaxy.md) — Galaxy/MxAccess driver overview.
 - [`docs/v2/config-db-schema.md`](v2/config-db-schema.md) — the full Config DB schema.