fix(localdb): phase-2 live gate — 4 production defects found and fixed

Gate record: docs/plans/2026-07-20-localdb-phase2-live-gate.md.
Checks 1, 2, 5, 6 pass. Checks 3 and 4 are NOT satisfied — the defect they
were meant to confirm turned out to be the opposite of what the plan assumed.

Three defects crash-looped every driver node before check 1 could even run:

1. An empty ServerHistorian:ApiKey kills the host. ServerHistorianOptions-
   Validator exists to turn exactly that class of failure into a named
   OptionsValidationException, but its documented fail tier explicitly excluded
   ApiKey on the reasoning that a keyless client "degrades — the gateway rejects
   calls". It does not: the client validates its own options at construction, so
   the process dies during Akka startup and never makes a call.

2. UseTls disagreeing with the endpoint scheme kills the host too, in both
   directions (both messages confirmed in the shipped client assembly). Moving an
   endpoint from https to http without clearing UseTls is an ordinary migration
   slip.

3. Plaintext h2c was UNREACHABLE. HistorianGatewayClientAdapter forwarded the
   TLS-only options unconditionally, and AllowUntrustedServerCertificate defaults
   to false, so it always sent RequireCertificateValidation=true — which the
   client rejects outright when UseTls=false. Every http:// deployment crashed,
   though the scheme is documented as the supported way to select h2c, and the
   only workaround was to assert a certificate posture for a connection that has
   no certificate.

The fourth was the blocker, and it is Phase 2's own:

4. The drain gate deferred to a Primary that cannot deliver. Redundancy roles are
   elected CLUSTER-WIDE; the alarm queue is PAIR-LOCAL. On the rig the elected
   driver Primary is central-1 — it carries the driver Akka role, replicates
   nobody's LocalDb and does not even run the alarm historian — so every driver
   node logged "Historian drain suspended", including the two site-b nodes that
   have no peer at all. Nothing drained anywhere, where before Phase 2 it drained
   fine. The cost is not a duplicate; it is the buffer growing to the capacity
   wall and evicting the audit trail it exists to protect.

   Fixed in three layers: a separate ShouldDrainAlarmHistory policy (unknown role
   drains; the two gates now deliberately disagree, and a test pins that); peer-
   host matching in DriverHostActor so a node stands down only for a Primary
   holding its rows; and AddAlarmHistorian short-circuiting the gate when
   replication is unconfigured — testing BOTH Replication:PeerAddress and
   SyncListenPort, since only the dialing half sets the former while both halves
   share the queue.

   Every one of these follows from the asymmetry: a false allow costs a duplicate
   row, which at-least-once delivery already accepts and payload-hash ids
   collapse; a false deny loses data silently.

A third vacuous test, caught by the same delete-the-guard discipline: the
role-view tests stayed green with the guard removed, because AwaitAssert polls
until an assertion passes and the assertion was "reads open" — which is the
SEEDED value, satisfied at the first poll before the actor processed anything.
They now assert the sequence of published values through a recording view; the
control then goes red for exactly the cases that matter.

Migration evidence: 11 legacy rows across two deliberately overlapping files
converged to exactly 9 identical rows on both nodes, proving D-6's payload-hash
identity on real nodes rather than in a fixture.

Open design fork, recorded in the gate doc rather than decided here: a pair
cannot currently identify its own Primary, so both halves drain. Safe in every
topology — nothing loses data — but the gate's de-duplication benefit is
unrealised until roles are scoped per pair.

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Redundancy/IRedundancyRoleView.cs

@@ -3,44 +3,55 @@ using ZB.MOM.WW.OtOpcUa.Runtime.Drivers;
 namespace ZB.MOM.WW.OtOpcUa.Runtime.Redundancy;
 
 /// <summary>
-///     A singleton snapshot of the Primary-gate decision, so code that lives outside an actor can
-///     ask "should this node be servicing Primary-only work right now?".
+///     A singleton snapshot of the alarm-history drain decision, so code that lives outside an actor
+///     can ask "should this node be draining the alarm queue right now?".
 /// </summary>
 /// <remarks>
 ///     <para>
 ///         Exists for the alarm store-and-forward drain. That drain runs on a timer owned by the
 ///         sink, not on an actor mailbox, so it cannot receive <c>RedundancyStateChanged</c>
-///         directly — but it must be Primary-scoped, because the queue it drains replicates to the
+///         directly — but it must be role-scoped, because the queue it drains replicates to the
 ///         pair peer and two draining nodes would deliver every event twice.
 ///     </para>
 ///     <para>
-///         Deliberately publishes the <i>decision</i> rather than the role and member count that
-///         produced it, so <see cref="PrimaryGatePolicy"/> stays the single place that decides.
+///         Deliberately publishes the <i>decision</i> rather than the role that produced it, so
+///         <see cref="PrimaryGatePolicy"/> stays the single place that decides.
+///     </para>
+///     <para>
+///         <b>This is not the device-write gate.</b> It is fed by
+///         <see cref="PrimaryGatePolicy.ShouldDrainAlarmHistory"/>, which opens on an unknown role
+///         where <see cref="PrimaryGatePolicy.ShouldServiceAsPrimary"/> closes. The naming is
+///         explicit about the consumer for that reason: an earlier revision published the
+///         write-gate verdict here, and on a cluster with several driver nodes but no configured
+///         redundancy it suspended the drain everywhere, so alarm history accumulated on every node
+///         and left none.
 ///     </para>
 /// </remarks>
 public interface IRedundancyRoleView
 {
-    /// <summary>Whether this node should service Primary-only work right now.</summary>
-    bool ShouldServiceAsPrimary { get; }
+    /// <summary>Whether this node should be draining the alarm store-and-forward queue right now.</summary>
+    bool ShouldDrainAlarmHistory { get; }
 
     /// <summary>Records a fresh decision. Called by <c>DriverHostActor</c> on every redundancy snapshot.</summary>
-    /// <param name="shouldServiceAsPrimary">The decision <see cref="PrimaryGatePolicy"/> produced.</param>
-    void Publish(bool shouldServiceAsPrimary);
+    /// <param name="shouldDrainAlarmHistory">
+    ///     The decision <see cref="PrimaryGatePolicy.ShouldDrainAlarmHistory"/> produced.
+    /// </param>
+    void Publish(bool shouldDrainAlarmHistory);
 }
 
 /// <summary>Thread-safe <see cref="IRedundancyRoleView"/> backed by a volatile field.</summary>
 public sealed class RedundancyRoleView : IRedundancyRoleView
 {
-    // Seeded with the decision for "role unknown, no driver peer" rather than a bare false. An
-    // unpublished view and a node with no peer are genuinely the same situation, and they must
-    // behave the same: a deployment that runs no redundancy at all never publishes here, and
-    // defaulting closed would silently stop its alarm history forever.
-    private volatile bool _shouldServiceAsPrimary =
-        PrimaryGatePolicy.ShouldServiceAsPrimary(localRole: null, driverMemberCount: 0);
+    // Seeded with the decision for "role unknown" rather than a bare false. An unpublished view and a
+    // node whose role nothing ever reports are genuinely the same situation, and they must behave the
+    // same: a deployment that runs no redundancy at all never publishes here, and defaulting closed
+    // would silently stop its alarm history forever.
+    private volatile bool _shouldDrainAlarmHistory =
+        PrimaryGatePolicy.ShouldDrainAlarmHistory(localRole: null, queueSharingPeerIsPrimary: false);
 
     /// <inheritdoc/>
-    public bool ShouldServiceAsPrimary => _shouldServiceAsPrimary;
+    public bool ShouldDrainAlarmHistory => _shouldDrainAlarmHistory;
 
     /// <inheritdoc/>
-    public void Publish(bool shouldServiceAsPrimary) => _shouldServiceAsPrimary = shouldServiceAsPrimary;
+    public void Publish(bool shouldDrainAlarmHistory) => _shouldDrainAlarmHistory = shouldDrainAlarmHistory;
 }