fix(opcua,drivers): carry driver status sub-codes to clients (#519) + health-write ordering (#517)

#519 — a driver's OPC UA status code now reaches a client with its sub-code intact.
DriverInstanceActor projected the driver's uint onto a 3-state Good/Uncertain/Bad enum
and OtOpcUaNodeManager re-expanded Bad to a bare 0x80000000, so BadNoCommunication,
BadTypeMismatch and BadNotSupported were indistinguishable on the wire and every
driver's status constants (incl. the 16 #497 had just corrected) were diagnostic in
logs only. Resolved by option (b): the raw uint rides AttributeValuePublished ->
AttributeValueUpdate -> IOpcUaAddressSpaceSink.WriteValue, OpcUaQuality is deleted, and
severity classification is a helper (OpcUaStatus.IsGood/IsUncertain/IsBad).

The surface was wider than the issue costed (41 files, not "the sink and 3
implementations"): OpcUaQuality had non-driver producers with no uint to carry.
Each got its natural code — BadInternalError for a failed virtual-tag script,
BadNoCommunication for driver comms loss — and ScriptedAlarmHostActor's pair of
mutually-inverse uint<->enum mappers is deleted, having round-tripped a code the
engine already held. AddressSpaceApplier's removal writes deliberately keep the
generic Bad: not losing a code the driver had is this issue; inventing one for the
deploy path is a separate call.

Behaviour change: WriteAlarmQuality fires its Part 9 event on a status-code change
rather than a severity-bucket change. While the annotation was 3-state those were the
same predicate; now a move between two Bad reasons changes what a subscriber reads.

New SDK-free named constants live on Commons.OpcUa.OpcUaStatus, and
StatusCodeParityTests is widened to cover them — that guard is reflection-driven, so
it can only see a named constant, never an inline literal.

#517 — the symptom is real but the issue named the wrong path and its fix was unsafe.
ShutdownAsync cannot race: DriverInstanceActor calls it from PostStop, after the
mailbox drains. (Core/Hosting/DriverHost, the one class with a concurrent GetHealth,
has no production call site.) InitializeAsync can: it runs on a fire-and-forget
Task.Run, and MTConnectDriver writes Healthy then starts loops that can throw into a
catch which disposes the client before writing Faulted.

Moving the write earlier, as suggested, inverts the terminal state — teardown drains
in-flight loops that write health as they unwind, so a late loop could leave Healthy at
rest with every connection closed. The fix is a bracket (conservative before, terminal
after), applied to MTConnect's init-failure path only; shutdown keeps its single
trailing write, and the rule plus the reachability table are documented on
IDriver.ShutdownAsync.

CalculationDriver.GetHealth returned a hard-coded Healthy that consulted nothing —
Healthy before initialize, after shutdown and after dispose. Now derived from _running.
Its test, named Health_is_always_Connected, asserted the defect and is replaced.

Every new guard was falsified by breaking the production code and watching it go red.
The two sub-code tests each assert two different Bad codes, since a single-code
assertion could pass against a hard-coded constant under the old projection.

Pre-existing failures, verified unchanged on a stashed tree and not chased: 4 in
Driver.AbLegacy.IntegrationTests (slc500/micrologix/plc5 fixtures not up) and 3 in
Host.IntegrationTests.

Closes #517
Closes #519

Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo

tests/Core/ZB.MOM.WW.OtOpcUa.Commons.Tests/OpcUa/DeferredAddressSpaceSinkTests.cs

@@ -19,7 +19,7 @@ public class DeferredAddressSpaceSinkTests
     {
         var sink = new DeferredAddressSpaceSink();
         // Must not throw.
-        sink.WriteValue("ns=2;s=x", 42, OpcUaQuality.Good, DateTime.UtcNow, AddressSpaceRealm.Uns);
+        sink.WriteValue("ns=2;s=x", 42, OpcUaStatus.Good, DateTime.UtcNow, AddressSpaceRealm.Uns);
     }
 
     [Fact]
@@ -46,7 +46,7 @@ public class DeferredAddressSpaceSinkTests
         var sink = new DeferredAddressSpaceSink();
         sink.SetSink(inner);
 
-        sink.WriteValue("ns=2;s=x", 99, OpcUaQuality.Good, DateTime.UtcNow, AddressSpaceRealm.Uns);
+        sink.WriteValue("ns=2;s=x", 99, OpcUaStatus.Good, DateTime.UtcNow, AddressSpaceRealm.Uns);
 
         inner.WriteValueCalled.ShouldBeTrue();
     }
@@ -193,7 +193,7 @@ public class DeferredAddressSpaceSinkTests
         sink.SetSink(inner);
         sink.SetSink(null); // revert
 
-        sink.WriteValue("ns=2;s=x", 1, OpcUaQuality.Good, DateTime.UtcNow, AddressSpaceRealm.Uns);
+        sink.WriteValue("ns=2;s=x", 1, OpcUaStatus.Good, DateTime.UtcNow, AddressSpaceRealm.Uns);
 
         inner.WriteValueCalled.ShouldBeFalse("write should be no-op after reverting to null sink");
     }
@@ -206,10 +206,10 @@ public class DeferredAddressSpaceSinkTests
         public bool RebuildCalled { get; private set; }
         public (string AlarmNodeId, AddressSpaceRealm AlarmRealm, IReadOnlyList<string> Folders, AddressSpaceRealm FolderRealm)? WireAlarmNotifiersArgs { get; private set; }
 
-        public void WriteValue(string nodeId, object? value, OpcUaQuality quality, DateTime sourceTimestampUtc, AddressSpaceRealm realm = AddressSpaceRealm.Uns)
+        public void WriteValue(string nodeId, object? value, uint statusCode, DateTime sourceTimestampUtc, AddressSpaceRealm realm = AddressSpaceRealm.Uns)
             => WriteValueCalled = true;
 
-        public void WriteAlarmQuality(string alarmNodeId, OpcUaQuality quality, DateTime sourceTimestampUtc, AddressSpaceRealm realm) { }
+        public void WriteAlarmQuality(string alarmNodeId, uint statusCode, DateTime sourceTimestampUtc, AddressSpaceRealm realm) { }
 
         public void WriteAlarmCondition(string alarmNodeId, AlarmConditionSnapshot state, DateTime sourceTimestampUtc, AddressSpaceRealm realm = AddressSpaceRealm.Uns) { }
         public void MaterialiseAlarmCondition(string alarmNodeId, string equipmentNodeId, string displayName, string alarmType, int severity, AddressSpaceRealm realm, bool isNative = false) { }
@@ -227,8 +227,8 @@ public class DeferredAddressSpaceSinkTests
         public bool UpdateCalled { get; private set; }
         public bool FolderRenameCalled { get; private set; }
 
-        public void WriteValue(string nodeId, object? value, OpcUaQuality quality, DateTime sourceTimestampUtc, AddressSpaceRealm realm = AddressSpaceRealm.Uns) { }
-        public void WriteAlarmQuality(string alarmNodeId, OpcUaQuality quality, DateTime sourceTimestampUtc, AddressSpaceRealm realm) { }
+        public void WriteValue(string nodeId, object? value, uint statusCode, DateTime sourceTimestampUtc, AddressSpaceRealm realm = AddressSpaceRealm.Uns) { }
+        public void WriteAlarmQuality(string alarmNodeId, uint statusCode, DateTime sourceTimestampUtc, AddressSpaceRealm realm) { }
         public void WriteAlarmCondition(string alarmNodeId, AlarmConditionSnapshot state, DateTime sourceTimestampUtc, AddressSpaceRealm realm = AddressSpaceRealm.Uns) { }
         public void MaterialiseAlarmCondition(string alarmNodeId, string equipmentNodeId, string displayName, string alarmType, int severity, AddressSpaceRealm realm, bool isNative = false) { }
         public void EnsureFolder(string folderNodeId, string? parentNodeId, string displayName, AddressSpaceRealm realm = AddressSpaceRealm.Uns) { }

tests/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions.Tests/StatusCodeParityTests.cs

@@ -1,6 +1,7 @@
 using System.Reflection;
 using Shouldly;
 using Xunit;
+using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
 
 namespace ZB.MOM.WW.OtOpcUa.Core.Abstractions.Tests;
 
@@ -18,6 +19,10 @@ namespace ZB.MOM.WW.OtOpcUa.Core.Abstractions.Tests;
 ///     <c>ZB.MOM.WW.OtOpcUa.Driver.*.dll</c> deployed to its output directory for <c>const uint</c> fields
 ///     whose name reads as a status code, so a brand-new driver assembly referenced by this project is
 ///     covered automatically, with no edit here.</para>
+///     <para><b>Commons is in scope too</b> (Gitea #519). <c>Commons.OpcUa.OpcUaStatus</c> is SDK-free for
+///     the same layering reason the drivers are — <c>IOpcUaAddressSpaceSink</c> exists so Runtime need not
+///     reference <c>Opc.Ua.Server</c> — so its constants carry the identical name-vs-value risk. Commons
+///     arrives here transitively through <c>Core</c>.</para>
 ///     <para><b>An inline literal is invisible to this guard.</b> Reflection can only see a <em>named</em>
 ///     constant, so <c>StatusCode: 0x800B0000u, // BadTimeout</c> written at a call site is unguarded —
 ///     which is how <c>GalaxyDriver</c> shipped <c>BadServiceUnsupported</c> under a <c>BadTimeout</c>
@@ -60,7 +65,11 @@ public sealed class StatusCodeParityTests
         var data = new TheoryData<string, string, string, string, uint>();
 
         var binDir = Path.GetDirectoryName(typeof(StatusCodeParityTests).Assembly.Location)!;
-        foreach (var dll in Directory.GetFiles(binDir, "ZB.MOM.WW.OtOpcUa.Driver.*.dll").OrderBy(p => p, StringComparer.Ordinal))
+        var scanned = Directory.GetFiles(binDir, "ZB.MOM.WW.OtOpcUa.Driver.*.dll")
+            .Concat(Directory.GetFiles(binDir, "ZB.MOM.WW.OtOpcUa.Commons.dll"))
+            .OrderBy(p => p, StringComparer.Ordinal);
+
+        foreach (var dll in scanned)
         {
             Assembly asm;
             try { asm = Assembly.LoadFrom(dll); }
@@ -157,4 +166,25 @@ public sealed class StatusCodeParityTests
         assemblies.Length.ShouldBeGreaterThan(3,
             "status constants were found in fewer than four driver assemblies: " + string.Join(", ", assemblies));
     }
+
+    /// <summary>
+    ///     Positive control for the Commons half of the scan (#519). Widening the glob is worthless if
+    ///     <c>Commons.dll</c> does not actually deploy to this project's bin — the theory would simply run
+    ///     over the driver rows and pass, reporting nothing. Naming the type explicitly means a broken
+    ///     transitive reference fails here instead of silently un-guarding the engine's status constants.
+    /// </summary>
+    [Fact]
+    public void Discovery_covers_the_SDK_free_Commons_status_constants()
+    {
+        var commonsRows = DeclaredStatusConstants()
+            .Select(row => row.Data)
+            .Where(r => r.Item2 == "ZB.MOM.WW.OtOpcUa.Commons.OpcUa.OpcUaStatus")
+            .ToArray();
+
+        commonsRows.Length.ShouldBeGreaterThan(3,
+            "OpcUaStatus' constants were not discovered — ZB.MOM.WW.OtOpcUa.Commons.dll did not deploy to " +
+            "this project's bin, so the engine-layer status codes are unguarded despite the widened scan.");
+
+        commonsRows.Select(r => r.Item3).ShouldContain(nameof(OpcUaStatus.BadNoCommunication));
+    }
 }