Merge R2-02 ResilienceConfig hardening (arch-review round 2) [PR #431]

Findings 01/S-6 (High — clamp hostile ResilienceConfig, no ValidationException
driver-brick), 01/U-6 (delete dead bulkhead knob), 01/S-8=03/S12 (Write/Ack
non-idempotent + retry->0), 04/C-7 (JsonObject round-trip preserves unknown
keys), 01/S-7=03/S13 (per-Create options-generation kills respawn cache race).
T15/T18 deferred. STATUS.md conflict resolved additively. Build clean.

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DriverHostActor.cs

@@ -1627,7 +1627,7 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
         else
         {
             // Attach the per-instance Phase 6.1 resilience invoker so this driver's capability calls
-            // route through the retry/breaker/bulkhead/telemetry pipeline. The tier defaults are layered
+            // route through the retry/breaker/telemetry pipeline. The tier defaults are layered
             // with the per-instance ResilienceConfig from the artifact; the pass-through factory yields a
             // no-op invoker on nodes without the real resilience factory bound.
             var invoker = _invokerFactory.Create(spec.DriverInstanceId, spec.DriverType, spec.ResilienceConfig);

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DriverInstanceActor.cs

@@ -139,7 +139,7 @@ public sealed class DriverInstanceActor : ReceiveActor, IWithTimers
     private readonly IDriver _driver;
 
     /// <summary>Phase 6.1 resilience seam: every guarded driver-capability call this actor makes is
-    /// routed through this invoker (retry / breaker / bulkhead / tracker telemetry). Defaults to
+    /// routed through this invoker (retry / breaker / in-flight accounting / tracker telemetry). Defaults to
     /// <see cref="NullDriverCapabilityInvoker"/> (a genuine pass-through) when none is supplied — so
     /// unit tests + the F7 skeleton path behave exactly as a raw driver call. The fused Host builds a
     /// real per-instance invoker via <see cref="IDriverCapabilityInvokerFactory"/> and injects it at
@@ -589,14 +589,16 @@ public sealed class DriverInstanceActor : ReceiveActor, IWithTimers
         using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(5));
         try
         {
-            // Route through the resilience invoker (Write pipeline: timeout, no retry by default,
-            // per-host breaker). An OPC UA attribute set is idempotent (writing value X twice == once),
-            // so a configured Write retry is safe to apply; the Write tier default is RetryCount=0, so
-            // this stays behavior-neutral until an operator opts in via ResilienceConfig. The outer cts
-            // is retained as a hard backstop above the (typically tighter) tier timeout.
+            // Route through the resilience invoker (Write pipeline: timeout, per-host breaker). Writes
+            // default to NON-idempotent (03/S12): a timed-out write may already have committed at the
+            // device, and replaying a command-shaped write (pulse coil, counter increment, Galaxy
+            // supervisory write) can duplicate an irreversible field action. The invoker's no-retry arm is
+            // therefore authoritative regardless of any configured Write retry. Per-tag opt-in to retries via
+            // WriteIdempotentAttribute is the unshipped forward path (see WriteIdempotentAttribute). The outer
+            // cts is retained as a hard backstop above the (typically tighter) tier timeout.
             var results = await _invoker.ExecuteWriteAsync(
                 ResolveHost(msg.TagId),
-                isIdempotent: true,
+                isIdempotent: false,
                 async ct => await writable.WriteAsync(request, ct),
                 cts.Token);
             if (results is { Count: 1 } && IsGoodStatus(results[0].StatusCode))