Files
lmxopcua/docs/plans
Joseph Doherty 9303289d05 docs(plan): correct the self-form watchdog record — rejected, TCP guard was interim
Family-wide docs correction (paired with scadaproj 6d222ea4). This plan's superseded
banner was right but its task body still read as if the watchdog were merely patched.

- Dated 2026-08-01 correction section (history preserved): the timer calling
  Cluster.Join(SelfAddress) was implemented and REJECTED in both repos after live
  testing — outside Akka's join handshake, it fires mid-join on a routine standby
  restart (peer alive, join stalled behind stale-incarnation removal) and forms a
  permanent second cluster at the same address. ScadaBridge measured a split unhealed
  after 90s; Task 8 hit the same shape live here.
- The 'a booting node only self-forms when NO seed answers InitJoin' claim in the Task 2
  doc comment is marked FALSE for the watchdog: that guarantee belongs to Akka's native
  FirstSeedNodeProcess, which runs inside the handshake; the timer does not, and fires
  while a seed is answering.
- Task 8's TCP reachability guard is recorded as an INTERIM patch, not the fix — the
  race survived it, which is why the watchdog was deleted rather than patched.
- Shipped design restated: self-first seed ordering (AkkaClusterOptionsValidator +
  SelfFirstSeedBootstrapTests) plus the opt-in, default-OFF bootstrap guard (d1dac87f).

Source re-verified 2026-08-01: the defective watchdog is NOT present in this repo — no
ClusterBootstrapFallback.cs, no SelfFormAfter option, no Cluster.Join(SelfAddress) in
src/. Documentation-only change; no code touched.
2026-08-01 11:09:57 -04:00
..