R2-10: driver failures propagate through the full Polly pipeline (CircuitBreaker->
Retry->Timeout->CapabilityInvoker.cs:84) live — the #10 dispatch-gap fix + tracker
source confirmed in prod; breaker-OPEN not forced (backoff-throttled, per FOLLOWUP-10).
R2-03: rig has no driver data (all nodes Bad_WaitingForInitialData), so VT Good->Bad
can't be staged; unit-verified. 5 gates live-confirmed total; remaining items need
external infra (integration fixtures, VPN gateway, live LDAP, S7 blackhole).
All 12 R2 plans executed + merged (PRs #426-#437) in 3 waves. Consolidated unit
sweep green on merged master; 3 failures confirmed pre-existing/environmental (not
R2). Records the PR/wave map, unit-sweep tallies, and the deferred integration /
docker-dev / 2-node-rig / VPN heavy-pass checklist.
Re-ran all seven domain reviews at master f6eaa267 (reports rewritten in
place, each with a prior-finding status table): all 4 round-1 Criticals
verified closed; new top findings are the S7 connect-timeout OCE regression
(05/STAB-14), the ResilienceConfig operator-authorable brick (01/S-6), and
a batch of resilience-seam Mediums. 00-OVERALL.md carries the updated
maturity matrix + 12-item action list.
Adds R2-01..R2-12 design/implementation plans (one per action item, house
format + bite-sized TDD task breakdowns + co-located .tasks.json; 193 tasks,
~18-24 dev-days). STATUS.md updated: round-1 topology marked historical
(all merged+pushed), re-review findings table + plan pointers added.
Flip the #12 rig-bug note from 'recommend fixing' to fixed: FOLLOWUP-10 + STATUS task #12
+ new branch topology row. central-1 verified booting clean with the committed compose.
Ran the #10 live gate: built the Host image from source (crit13 tip; Gitea feed answers
200 anonymously so restore worked), stood up the docker-dev rig, central-1 booted healthy
on the new invoker wiring. Prod DI binds the REAL DriverCapabilityInvokerFactory —
confirmed live + by a new deterministic guard (ResilienceInvokerFactoryRegistrationTests,
crit13 8a8b9ec5). The behavioral retry/breaker log-line was NOT observed: reading the
Modbus driver showed its cheap paths don't throw a wrapped exception (Discover offline,
Subscribe lazy, reads non-wrapped) — only an idempotent write-to-dead-endpoint or S7 does,
not worth the multi-dependency chase since the retry behavior is deterministically proven.
Also found a rig bug: docker-dev compose's retired Wonderware ServerHistorian keys
(Host/Port/SharedSecret, Enabled=true) crash the Host at bring-up (historian-gateway cutover
now reads Endpoint -> empty UriFormatException). Worked around with an override; recommend
fixing the committed compose. FOLLOWUP-10 + STATUS updated; crit13 topology head -> 8a8b9ec5.
Updates FOLLOWUP-10 + STATUS.md now that #10 is wired:
- The filed "thread CapabilityInvoker into the actor" was infeasible — Runtime is
deliberately Polly-free (refs Core.Abstractions, not Core). Shipped a seam mirroring
IDriverFactory (branch fix/archreview-crit10-wire-capability-invoker @ 62556c24).
- Triage corrections: only 6 of 7 sites are real (GenericDriverNodeManager is test-only
scaffolding, re-annotated); tier-defaults only (ResilienceConfig not in the artifact).
- Observability finding: the resilience-status tracker has no reader (Stream E.2/E.3
never shipped) → added retry/breaker logging as the interim surface + live-verify enabler.
- Verification: negative-control, recording-invoker routing, real-invoker actor-context,
analyzer + logging tests; clean solution build; Runtime 358 / Core 238 / Analyzers 32.
- Residual: live behavioral gate (rig recipe recorded) + the ResilienceConfig-in-artifact
sub-gap follow-up.
Track remediation progress: 2 of 4 Criticals done (03/S1 split-brain resolver;
02/U2+U3 VT timeout+ALC) + both CLAUDE.md doc-drifts fixed. STATUS.md is the
single source of truth (branch topology, completed items, task list, next-up,
resume facts). Each plan carries a status banner.
Joseph Doherty