fix(opcua,drivers): carry driver status sub-codes to clients (#519) + health-write ordering (#517)

#519 — a driver's OPC UA status code now reaches a client with its sub-code intact.
DriverInstanceActor projected the driver's uint onto a 3-state Good/Uncertain/Bad enum
and OtOpcUaNodeManager re-expanded Bad to a bare 0x80000000, so BadNoCommunication,
BadTypeMismatch and BadNotSupported were indistinguishable on the wire and every
driver's status constants (incl. the 16 #497 had just corrected) were diagnostic in
logs only. Resolved by option (b): the raw uint rides AttributeValuePublished ->
AttributeValueUpdate -> IOpcUaAddressSpaceSink.WriteValue, OpcUaQuality is deleted, and
severity classification is a helper (OpcUaStatus.IsGood/IsUncertain/IsBad).

The surface was wider than the issue costed (41 files, not "the sink and 3
implementations"): OpcUaQuality had non-driver producers with no uint to carry.
Each got its natural code — BadInternalError for a failed virtual-tag script,
BadNoCommunication for driver comms loss — and ScriptedAlarmHostActor's pair of
mutually-inverse uint<->enum mappers is deleted, having round-tripped a code the
engine already held. AddressSpaceApplier's removal writes deliberately keep the
generic Bad: not losing a code the driver had is this issue; inventing one for the
deploy path is a separate call.

Behaviour change: WriteAlarmQuality fires its Part 9 event on a status-code change
rather than a severity-bucket change. While the annotation was 3-state those were the
same predicate; now a move between two Bad reasons changes what a subscriber reads.

New SDK-free named constants live on Commons.OpcUa.OpcUaStatus, and
StatusCodeParityTests is widened to cover them — that guard is reflection-driven, so
it can only see a named constant, never an inline literal.

#517 — the symptom is real but the issue named the wrong path and its fix was unsafe.
ShutdownAsync cannot race: DriverInstanceActor calls it from PostStop, after the
mailbox drains. (Core/Hosting/DriverHost, the one class with a concurrent GetHealth,
has no production call site.) InitializeAsync can: it runs on a fire-and-forget
Task.Run, and MTConnectDriver writes Healthy then starts loops that can throw into a
catch which disposes the client before writing Faulted.

Moving the write earlier, as suggested, inverts the terminal state — teardown drains
in-flight loops that write health as they unwind, so a late loop could leave Healthy at
rest with every connection closed. The fix is a bracket (conservative before, terminal
after), applied to MTConnect's init-failure path only; shutdown keeps its single
trailing write, and the rule plus the reachability table are documented on
IDriver.ShutdownAsync.

CalculationDriver.GetHealth returned a hard-coded Healthy that consulted nothing —
Healthy before initialize, after shutdown and after dispose. Now derived from _running.
Its test, named Health_is_always_Connected, asserted the defect and is replaced.

Every new guard was falsified by breaking the production code and watching it go red.
The two sub-code tests each assert two different Bad codes, since a single-code
assertion could pass against a hard-coded constant under the old projection.

Pre-existing failures, verified unchanged on a stashed tree and not chased: 4 in
Driver.AbLegacy.IntegrationTests (slc500/micrologix/plc5 fixtures not up) and 3 in
Host.IntegrationTests.

Closes #517
Closes #519

Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DriverHostActor.cs

@@ -939,10 +939,10 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
         if (_nodeIdByDriverRef.TryGetValue((msg.DriverInstanceId, msg.FullReference), out var nodeIds))
         {
             // v3 Batch 4 single-source fan-out: one driver publish for a RawPath lands on the raw NodeId AND
-            // every referencing UNS NodeId, each with its realm, carrying IDENTICAL value/quality/timestamp.
+            // every referencing UNS NodeId, each with its realm, carrying IDENTICAL value/status/timestamp.
             foreach (var n in nodeIds)
                 _opcUaPublishActor.Tell(new ZB.MOM.WW.OtOpcUa.Runtime.OpcUa.OpcUaPublishActor.AttributeValueUpdate(
-                    n.NodeId, msg.Value, msg.Quality, msg.TimestampUtc, n.Realm));
+                    n.NodeId, msg.Value, msg.StatusCode, msg.TimestampUtc, n.Realm));
         }
         else
         {
@@ -975,8 +975,8 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
     /// </summary>
     /// <summary>
     ///     #477 — a child driver's connectivity transition. Annotates the source-data Quality of EVERY native
-    ///     alarm condition the driver owns: comms lost → <see cref="OpcUaQuality.Bad"/>, restored →
-    ///     <see cref="OpcUaQuality.Good"/>. This is the ONLY signal for a comms-lost native source, because a
+    ///     alarm condition the driver owns: comms lost → <see cref="OpcUaStatus.BadNoCommunication"/>, restored →
+    ///     <see cref="OpcUaStatus.Good"/>. This is the ONLY signal for a comms-lost native source, because a
     ///     disconnected driver emits no alarm transitions — the alarm feed goes silent, so without this a
     ///     comms-lost condition would keep reporting the accidentally-Good default forever.
     ///     <para>
@@ -992,7 +992,10 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
     {
         if (_opcUaPublishActor is null) return;
 
-        var quality = msg.Connected ? OpcUaQuality.Good : OpcUaQuality.Bad;
+        // #519: name the actual cause. This is a connectivity transition, so the Bad case is
+        // BadNoCommunication — the bare OpcUaQuality.Bad it used to send reached clients as 0x80000000,
+        // indistinguishable from any other fault.
+        var statusCode = msg.Connected ? OpcUaStatus.Good : OpcUaStatus.BadNoCommunication;
         var ts = DateTime.UtcNow;
         var annotated = 0;
         // Fan out to every condition this driver owns. _alarmNodeIdByDriverRef is keyed by
@@ -1003,14 +1006,14 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
             foreach (var n in nodeIds)
             {
                 _opcUaPublishActor.Tell(new ZB.MOM.WW.OtOpcUa.Runtime.OpcUa.OpcUaPublishActor.AlarmQualityUpdate(
-                    n.NodeId, quality, ts, n.Realm));
+                    n.NodeId, statusCode, ts, n.Realm));
                 annotated++;
             }
         }
 
         if (annotated > 0)
-            _log.Debug("DriverHost {Node}: driver {Driver} {State} — annotated {Count} native condition(s) {Quality}",
-                _localNode, msg.DriverInstanceId, msg.Connected ? "connected" : "disconnected", annotated, quality);
+            _log.Debug("DriverHost {Node}: driver {Driver} {State} — annotated {Count} native condition(s) 0x{Status:X8}",
+                _localNode, msg.DriverInstanceId, msg.Connected ? "connected" : "disconnected", annotated, statusCode);
     }
 
     private void ForwardNativeAlarm(DriverInstanceActor.AttributeAlarmPublished msg)

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DriverInstanceActor.cs

@@ -102,8 +102,11 @@ public sealed class DriverInstanceActor : ReceiveActor, IWithTimers
     /// </summary>
     public sealed record ForceReconnect;
     /// <summary>Published to the actor's parent whenever the subscribed IDriver fires
-    /// <see cref="ISubscribable.OnDataChange"/>. The parent forwards to OpcUaPublishActor.</summary>
-    public sealed record AttributeValuePublished(string DriverInstanceId, string FullReference, object? Value, OpcUaQuality Quality, DateTime TimestampUtc);
+    /// <see cref="ISubscribable.OnDataChange"/>. The parent forwards to OpcUaPublishActor.
+    /// <para><paramref name="StatusCode"/> is the driver's full OPC UA status code including its sub-code
+    /// (#519) — not a severity bucket. Classify it with <see cref="OpcUaStatus.IsGood"/> and friends rather
+    /// than comparing it to <see cref="OpcUaStatus.Good"/>.</para></summary>
+    public sealed record AttributeValuePublished(string DriverInstanceId, string FullReference, object? Value, uint StatusCode, DateTime TimestampUtc);
     private sealed record DataChangeForward(string FullReference, DataValueSnapshot Snapshot);
     /// <summary>Published to the parent whenever the subscribed driver (an <see cref="IAlarmSource"/>) fires
     /// <see cref="IAlarmSource.OnAlarmEvent"/>. The parent (<see cref="DriverHostActor"/>) projects + routes it
@@ -957,27 +960,19 @@ public sealed class DriverInstanceActor : ReceiveActor, IWithTimers
         }
     }
 
+    /// <summary>Forward a driver's data change to the parent for OPC UA publication.
+    /// <para>The driver's status code rides through UNCHANGED (#519). This used to project it onto a
+    /// 3-state Good/Uncertain/Bad enum here, which the node manager then re-expanded to a bare
+    /// <c>0x80000000</c> — so no driver's sub-code ever reached a client, and the status constants each
+    /// driver maintains were diagnostic in logs only.</para></summary>
     private void OnDataChangeForward(DataChangeForward msg)
     {
-        var quality = QualityFromStatus(msg.Snapshot.StatusCode);
         var ts = msg.Snapshot.SourceTimestampUtc ?? msg.Snapshot.ServerTimestampUtc;
-        Context.Parent.Tell(new AttributeValuePublished(_driverInstanceId, msg.FullReference, msg.Snapshot.Value, quality, ts));
+        Context.Parent.Tell(new AttributeValuePublished(
+            _driverInstanceId, msg.FullReference, msg.Snapshot.Value, msg.Snapshot.StatusCode, ts));
     }
 
-    /// <summary>Translate an OPC UA status code to the 3-state <see cref="OpcUaQuality"/> projection
-    /// the publish actor consumes. Severity bits (top 2): 00 = Good, 01 = Uncertain, 10/11 = Bad.</summary>
-    private static OpcUaQuality QualityFromStatus(uint statusCode)
-    {
-        var severity = statusCode >> 30;
-        return severity switch
-        {
-            0 => OpcUaQuality.Good,
-            1 => OpcUaQuality.Uncertain,
-            _ => OpcUaQuality.Bad,
-        };
-    }
-
-    private static bool IsGoodStatus(uint statusCode) => (statusCode >> 30) == 0;
+    private static bool IsGoodStatus(uint statusCode) => OpcUaStatus.IsGood(statusCode);
 
     /// <summary>Resolve the resilience-pipeline host key for a single driver-side reference. Multi-host
     /// drivers (e.g. Modbus across N PLCs) implement <see cref="IPerCallHostResolver"/> so one dead host