Merge branch 'master' into fix/r3-02-stale-good-family

# Conflicts:
#	src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DriverHostActor.cs
#	tests/Server/ZB.MOM.WW.OtOpcUa.Runtime.Tests/Harness/V3ArtifactSeeder.cs

src/Core/ZB.MOM.WW.OtOpcUa.Commons/Observability/OtOpcUaTelemetry.cs

@@ -104,8 +104,6 @@ public static class OtOpcUaTelemetry
         Meter.CreateCounter<long>("otopcua.redundancy.service_level_change", unit: "{change}",
             description: "OPC UA Server.ServiceLevel transitions emitted by the redundancy state.");
 
-    /// <summary>Inbound operations denied by the Primary data-plane gate (archreview 03/S4) —
-    /// site=write|ack|alarm-emit, reason=secondary|detached|role-unknown.</summary>
     /// <summary>Archreview 03/S15 — tag refs a driver left <c>BadNoCommunication</c> after it reconnected:
     /// the host marked them Bad on the outage, and the driver never re-published them. Non-zero means a
     /// driver that reconnects without a full re-publish (a push driver missing its initial push, or a
@@ -115,10 +113,26 @@ public static class OtOpcUaTelemetry
         Meter.CreateCounter<long>("otopcua.driver.comms_latched_refs", unit: "{ref}",
             description: "Refs still BadNoCommunication after their driver reconnected (driver, driver_type).");
 
+    /// <summary>Inbound operations denied by the Primary data-plane gate (archreview 03/S4) —
+    /// site=write|ack|alarm-emit, reason=secondary|detached|role-unknown.</summary>
     public static readonly Counter<long> PrimaryGateDenied =
         Meter.CreateCounter<long>("otopcua.redundancy.primary_gate_denied", unit: "{denial}",
             description: "Operations denied by the Primary gate (site=write|ack|alarm-emit, reason=secondary|detached|role-unknown).");
 
+    /// <summary>
+    ///     API-key store lookups the 03/S18 bound intervened on (outcome=timeout|cache_hit).
+    /// </summary>
+    /// <remarks>
+    ///     One counter with an <c>outcome</c> tag rather than two: <c>timeout</c> is the alarm signal that
+    ///     the ConfigDb is not answering the OPC UA impersonation callback, and <c>cache_hit</c> is the
+    ///     ratio that says whether the TTL is doing anything. A missing <c>cache_hit</c> stream on a busy
+    ///     fused central is how you notice <c>Security:ApiKeys:StoreCacheSeconds</c> was set to 0 by
+    ///     accident. A plain read-through meters neither — the counter names interventions, not traffic.
+    /// </remarks>
+    public static readonly Counter<long> ApiKeyStoreBounded =
+        Meter.CreateCounter<long>("otopcua.opcua.apikey_store.bounded", unit: "{lookup}",
+            description: "API-key store lookups the bound intervened on (outcome=timeout|cache_hit).");
+
     // ---------------- Convenience helpers ----------------
 
     /// <summary>