{
  "planPath": "docs/plans/2026-07-20-localdb-adoption-phase2.md",
  "tasks": [
    {
      "id": 0,
      "subject": "Task 0: Recon \u2014 sink schema, seam, drain lifecycle, role-view bridge (STOP conditions)",
      "status": "completed",
      "note": "STOP condition does NOT fire (no BLOB; PayloadJson TEXT). Recon doc: docs/plans/2026-07-20-localdb-phase2-recon.md. Key finding: the drain worker is an internal Timer inside the sink (not a hosted service/actor), so the gate is a Func<bool> ctor param; and HistorianAdapterActor already primary-gates ENQUEUE with a different policy (ShouldHistorize) - which is why today's ungated drain is safe and why replication breaks it. Deviations D-1..D-4 recorded."
    },
    {
      "id": 1,
      "subject": "Task 1: alarm_sf_events schema + registration (+ exact-set pin update)",
      "status": "completed",
      "blockedBy": [
        0
      ],
      "note": "alarm_sf_events created in AlarmSfSchema (Core.AlarmHistorian) + registered third in LocalDbSetup.OnReady. Exact-set pin updated to 3 tables. DEVIATION D-5: kept the legacy delete-on-ack + dead_lettered flag + last_error rather than the plan's status column (no sweeper for 'delivered' rows; last_error is the only record of why a row died). Drain ORDER BY moves to (enqueued_at_utc, id)."
    },
    {
      "id": 2,
      "subject": "Task 2: Rewire sink onto ILocalDb + delete bespoke file management (cutover 1/2)",
      "status": "completed",
      "blockedBy": [
        1
      ],
      "note": "Sink rewritten as LocalDbStoreAndForwardSink over ILocalDb; bespoke file/pragma/schema management deleted with the old class. AlarmHistorian:DatabasePath removed (breaking config key). Ids are a deterministic payload hash (D-1), not GUIDs."
    },
    {
      "id": 3,
      "subject": "Task 3: Primary-gated drain via PrimaryGatePolicy (cutover 2/2 \u2014 may co-commit with Task 2)",
      "status": "completed",
      "blockedBy": [
        2
      ],
      "note": "Drain gated on IRedundancyRoleView, a singleton DriverHostActor publishes PrimaryGatePolicy's verdict to on every snapshot. Fails closed on a throwing gate; seeded OPEN so a non-redundant deployment is never silently stopped. New HistorianDrainState.NotPrimary + transition-logged (D-2). Landed with Task 2 as one commit (D-3)."
    },
    {
      "id": 4,
      "subject": "Task 4: One-time alarm-historian.db legacy migrator",
      "status": "completed",
      "blockedBy": [
        3
      ],
      "note": "AlarmSfLegacyMigrator runs LAST in OnReady (which now takes IConfiguration - no skip-migration overload exists). DEVIATION D-6: ids are the payload hash (AlarmSfSchema.DeriveId, lifted out of the sink) rather than mig-{node}-{legacyId} - a warm pair's two legacy files OVERLAP, and node-prefixing would carry that duplication forward forever. DEVIATION: tests live in Host.IntegrationTests; the plan's Host.Tests project does not exist."
    },
    {
      "id": 5,
      "subject": "Task 5: Convergence + failover scenarios in the pair harness (+ positive control)",
      "status": "completed",
      "blockedBy": [
        3
      ],
      "note": "4 scenarios green. POSITIVE CONTROL RUN (RegisterReplicated(alarm_sf_events) commented out): 3/4 went red immediately; the 4th (same-event-on-both-nodes) passed VACUOUSLY - with replication off each node trivially held its own single row. Strengthened by enqueuing a second distinct event on B and asserting BOTH nodes hold 2; it then went red under the control too. Control restored, all 4 green. Also fixed a SECOND exact-set pin the plan predicted: LocalDbWiringTests."
    },
    {
      "id": 6,
      "subject": "Task 6: Rig config + docs",
      "status": "completed",
      "blockedBy": [
        3
      ],
      "note": "Rig: AlarmHistorian__Enabled=true on site-a-1/2 AND site-b-1/2, with MaxAttempts raised to 1e6 (D-4: the default 10 would dead-letter the queue ~5min into the rig's permanent gateway outage) and a deliberately unresolvable ServerHistorian__Endpoint. NOTE: the endpoint is REQUIRED - ServerHistorianOptionsValidator is consumer-gated on AlarmHistorian:Enabled, so an empty one fails host start. Docs: runbook, AlarmHistorian.md, AlarmTracking.md, Configuration.md, Redundancy.md, docs/README.md, CLAUDE.md."
    },
    {
      "id": 7,
      "subject": "Task 7: DoD sweep (offline) \u2014 STOP and report after this",
      "status": "pending",
      "blockedBy": [
        4,
        5,
        6
      ]
    },
    {
      "id": 8,
      "subject": "Task 8: Live gate on the docker-dev rig (needs explicit user go-ahead)",
      "status": "pending",
      "blockedBy": [
        7
      ]
    }
  ],
  "lastUpdated": "2026-07-21T00:00:00Z"
}