fix(runtime): route a reprovision by incarnation, not driver id (review F2)

A ReprovisionRequested in flight from an old incarnation could reach the NEW child
after HandleRestartDriver swapped it in. In Connecting that child DOES handle
InitializeRequested, so it started a second concurrent InitializeAsync, racing the
#527 dispose-before-overwrite.

Seen RED: InitializeCount == 2 on a child held in Connecting by a gated init
(an already-connected child swallows InitializeRequested and passes vacuously).

tests/Server/ZB.MOM.WW.OtOpcUa.Runtime.Tests/Drivers/DriverHostActorRestartTests.cs

@@ -5,6 +5,7 @@ using Xunit;
 using ZB.MOM.WW.OtOpcUa.Commons.Messages.Admin;
 using ZB.MOM.WW.OtOpcUa.Commons.Types;
 using ZB.MOM.WW.OtOpcUa.Configuration;
+using ZB.MOM.WW.OtOpcUa.Runtime.Drivers;
 using ZB.MOM.WW.OtOpcUa.Runtime.Tests.Harness;
 
 namespace ZB.MOM.WW.OtOpcUa.Runtime.Tests.Drivers;
@@ -419,6 +420,64 @@ public sealed class DriverHostActorRestartTests : RuntimeActorTestBase
             duration: PresenceBudget);
     }
 
+    /// <summary>
+    ///     <b>Review finding F2 — a reprovision must be routed by INCARNATION, not just by driver id.</b>
+    ///     <c>ReprovisionRequested</c> is delivered asynchronously, so one can still be in flight from an old
+    ///     incarnation when <c>HandleRestartDriver</c> has already stopped that child and swapped in a new
+    ///     one under the same <c>DriverInstanceId</c>. Routing on the id alone delivers it to the NEW child,
+    ///     which is in <c>Connecting</c> around a healthy driver: it triggers a second, concurrent
+    ///     <c>InitializeAsync</c> that races the very dispose-before-overwrite the #527 teardown exists to
+    ///     serialise (<c>ModbusDriver._transport</c>, <c>MqttDriver._connection</c>).
+    ///     <para>
+    ///         A stale sender is simulated directly — a probe standing in for the dead incarnation — because
+    ///         provoking the real race would be timing-dependent. The assertion is an ABSENCE, so it carries
+    ///         a positive control: the current child is proven alive and provisioned first, and its
+    ///         <c>InitializeCount</c> must then not move.
+    ///     </para>
+    /// </summary>
+    [Fact]
+    public void A_reprovision_from_a_stale_incarnation_is_ignored()
+    {
+        var db = NewInMemoryDbFactory();
+        // The child must be in CONNECTING for this defect to bite: InitializeRequested is unhandled in the
+        // Connected behaviour, so an already-connected child would swallow the stale reprovision for the
+        // wrong reason and the test would pass vacuously. The gated init holds it in Connecting.
+        var factory = new RecordingSubscribableDriverFactory("Modbus", gateInitialize: true);
+        var deploymentId = V3ArtifactSeeder.SeedV3Deployment(
+            db, RevA,
+            new[] { (DriverId, "Modbus", "dev1", "speed", "Float", false) },
+            Array.Empty<(string, string, string, string, string?)>(),
+            enabled: true);
+        var (host, _, _) = V3ArtifactSeeder.SpawnHostAndApply(this, db, TestNode, deploymentId, RevA, factory);
+
+        // Positive control: the current child is alive and has begun its one and only initialise.
+        AwaitAssert(
+            () =>
+            {
+                factory.Created.Count.ShouldBe(1);
+                factory.Created[0].InitializeCount.ShouldBe(1);
+            },
+            duration: PresenceBudget);
+        var driver = factory.Created[0];
+
+        // A ReprovisionRequested that did NOT come from the child the host currently holds.
+        var staleIncarnation = CreateTestProbe();
+        host.Tell(
+            new DriverInstanceActor.ReprovisionRequested(DriverId, "NullReferenceException"),
+            staleIncarnation.Ref);
+
+        // Round-trip a message the host must answer, so the reprovision above is provably processed before
+        // the absence is asserted — otherwise "nothing happened yet" would pass for "it was ignored".
+        var coordinator = CreateTestProbe();
+        host.Tell(new Commons.Messages.Fleet.GetDiagnostics(CorrelationId.NewId()), coordinator.Ref);
+        coordinator.ExpectMsg<Commons.Interfaces.NodeDiagnosticsSnapshot>(PresenceBudget);
+
+        driver.InitializeCount.ShouldBe(
+            1,
+            "a reprovision from a dead incarnation reached the CURRENT child and started a second, " +
+            "concurrent InitializeAsync on a driver that was already connected");
+    }
+
     /// <summary>
     ///     The verified negative, pinned so this plan's edits to the restart paths cannot break the one that
     ///     was already correct. Force Reconnect (<c>ReconnectDriver</c>) Tells <c>ForceReconnect</c> to the