lmxopcua/archreview/plans/FOLLOWUP-11-crit1-sbr-premise.md

Follow-up #11 — Correct Critical 1's premise: SBR was already active on master (not NoDowning)

Status: ✅ IMPLEMENTED (fix/archreview-crit1-split-brain-resolver eaf78aad) · Surfaced by: the #9 hard-kill failover test's negative control on a25c9ed0 · Task: TaskCreate #11 · Severity: Low (docs/rationale accuracy; the code change is harmless) · Effort: S. See STATUS.md.

Outcome (implemented)

Docs/comment-only correction landed on the crit1 branch (eaf78aad) — no code reverted (the typed KeepOldestOption { DownIfAlone = true } is correct belt-and-suspenders). Corrected the inaccurate "HOCON inert / cluster runs NoDowning / never fails over" framing in all four places it appeared:

1. ServiceCollectionExtensions.BuildClusterOptions XML comment → now states Akka.Cluster.Hosting enables an SBR provider by default (applies SplitBrainResolverOption.Default when the option is null, reading the akka.conf keep-oldest block); the typed option makes the strategy explicit in code, reinforcing not activating.
2. akka.conf split-brain-resolver comment → the block IS active (via the Hosting default); the typed option makes it explicit; only an explicit downing-provider-class = "" would disable failover.
3. docs/Redundancy.md Split-brain section → rewrote the "activated in code / without it → NoDowning" paragraph; dropped the "now triggers failover" wording; cross-referenced HardKillFailoverTests + its negative control.
4. SplitBrainResolverActivationTests class summary + the ShouldNotBeNull message; renamed BuildClusterOptions_activates_a_split_brain_resolver → ..._sets_an_explicit_split_brain_resolver.

Verification: Cluster.Tests 29/29 green (the guards still assert the typed option is set — a refactor can't silently drop the explicitness). Failover behaviour remains guarded by HardKillFailoverTests, which passes regardless of activation path.

The finding

Critical 1 (03/S1) claimed: the akka.conf split-brain-resolver block was inert, the cluster ran Akka's default NoDowning, and setting the typed ClusterOptions.SplitBrainResolver = KeepOldestOption { DownIfAlone = true } is what activated the resolver so hard-crashed nodes fail over.

That premise is inaccurate. The cluster was never running NoDowning; hard-crash failover already worked on master before Critical 1.

Evidence (empirical + source)

1. The #9 failover test's negative control. With the typed SplitBrainResolver option removed, the hard-kill failover test still passes — node B downs the alone crashed oldest node and takes over. Only forcing explicit NoDowning (akka.cluster.downing-provider-class = "") makes the test time out (node stuck Up-but-Unreachable). So removing Critical 1's change does not disable failover; only an explicit NoDowning does.

2. Akka.Cluster.Hosting default (v1.5.51). WithClustering(ClusterOptions) applies SplitBrainResolverOption.Default when SplitBrainResolver is null — i.e. it enables the SBR downing provider by default. That provider then reads the akka.cluster.split-brain-resolver HOCON. (Confirmed by IL inspection of Akka.Cluster.Hosting.dll: the null branch loads …Default and calls .Apply(builder, …).)

3. The akka.conf keep-oldest block pre-existed Critical 1. git show master:…/Resources/akka.conf already contains split-brain-resolver { active-strategy = "keep-oldest"; stable-after = 15s; keep-oldest { down-if-alone = on } }. Critical 1's diff to akka.conf added only comments (plus the typed option in ServiceCollectionExtensions.BuildClusterOptions).

Net: the effective resolver on master was already keep-oldest + down-if-alone (active via Akka.Cluster.Hosting's default provider reading the pre-existing akka.conf block). Critical 1's typed option produces the same effective behavior — it is reinforcing/explicit, not the activator.

What is (and isn't) wrong

• ❌ Wrong: the claim that SBR was inert / the cluster ran NoDowning / hard-crash failover was broken before Critical 1. This appears in the BuildClusterOptions XML comment, the akka.conf comment Critical 1 added, and the Redundancy.md / Architecture.md wording Critical 1 touched.
• ✅ Fine to keep: the typed KeepOldestOption { DownIfAlone = true } itself. Making the strategy explicit in code (independent of the framework's default) is defensible belt-and-suspenders and matches the akka.conf block. Do not revert the code.

Proposed correction

1. Rewrite the BuildClusterOptions XML comment to state accurately: Akka.Cluster.Hosting enables an SBR downing provider by default (applies SplitBrainResolverOption.Default when the option is null), which reads the akka.conf keep-oldest block; this typed option makes the strategy explicit in code rather than relying on the framework default — it is not the sole activator.
2. Correct the akka.conf comment (drop "inert" / "NoDowning" framing).
3. Correct docs/Redundancy.md + docs/v2/Architecture.md wording Critical 1 added — do not describe Critical 1 as "fixing a NoDowning bug."
4. Keep the #9 HardKillFailoverTests as the standing guard — it verifies the failover OUTCOME regardless of activation path, and its comments already reflect the corrected understanding.

Decision needed

Confirm the correction (docs + comments only, no code revert), or flag if there is production context where the akka.conf block or the Hosting default would not apply (none found — production uses the same WithClustering path and ships the same akka.conf). Bundle with the docs branch (low-risk).