Two defects on the crash-failover path, found by the T13 live gate on an isolated docker pair:
1. When auto-down removed the unreachable Primary (~15 s after the survivor promoted), the
snapshot's Primary left the unreachable set, so (3') failed and the survivor demoted to
Standby (BadOutOfService, ServiceLevel 50) for ~15 s, until its own singleton published
after the hand-over retries. A Primary that is Down, or that this node saw removed, now
counts as gone (WarmRoleAuthority.SnapshotPrimaryGone). A member that is merely
Leaving/Exiting, or that this node never saw, is not.
2. The verdict read Cluster.State / SelfMember (Akka's ClusterReadView, a separate subscriber
to the same events), which can lag the event being handled. Live, the survivor stayed
Standby 4.3 s after its own UnreachableMember event (promotion waited for the next health
tick). The Warm verdict now uses a membership view built from this actor's own
member/reachability subscription, falling back to the read view only before the first event.
Tests: WarmRoleAuthorityTests.A_snapshot_Primary_that_auto_down_removed_is_still_gone_and_the_survivor_stays_Active,
OpcUaPublishActorWarmTests.The_crash_survivor_promotes_on_its_own_unreachable_event_and_stays_Active_through_the_removal
(synthetic events the read view never sees). Mutations: read-view-only verdict and the removed
arm switched off each fail the actor test. Runtime.Tests 1058 passed, 3 skipped.
Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi
Joseph Doherty
c569f80694