Merge Wave-1 integration: cross-lane scripting/runtime follow-ups (#731, #734)

Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/IDependencyConsumer.cs

@@ -11,7 +11,7 @@ namespace ZB.MOM.WW.OtOpcUa.Core.Abstractions;
 ///     <para>
 ///         The mechanism mirrors how a <c>VirtualTagActor</c> registers interest on the
 ///         <c>DependencyMuxActor</c>: the mux already receives every driver's
-///         <c>AttributeValuePublished</c> keyed by wire-ref (under v3, RawPath), so a driver that
+///         published values (batched, one item per value) keyed by wire-ref (under v3, RawPath), so a driver that
 ///         implements this interface simply piggy-backs on that fan-out. A calc tag's computed output
 ///         re-enters the mux via the ordinary driver publish path, so calc-of-calc chains work with no
 ///         extra machinery — which is exactly why the deploy-time cycle gate is mandatory.

src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions/ScriptContext.cs

@@ -80,6 +80,50 @@ public abstract class ScriptContext
     /// </summary>
     public abstract ILogger Logger { get; }
 
+    /// <summary>
+    ///     The current run's cancellation token. The run guard cancels it when the run exceeds its wall-clock
+    ///     budget, and it is linked to the caller's token, so it is also cancelled when the caller cancels (host
+    ///     shutdown, an actor stopping mid-run). A long-running script can poll <c>ctx.CancellationToken.IsCancellationRequested</c> (or call
+    ///     <c>ThrowIfCancellationRequested()</c>) and end its own abandoned run instead of holding a pool thread
+    ///     until it returns. Cooperative only: a script that never looks at it still runs to completion as an
+    ///     orphan. <see cref="CancellationToken.None"/> outside a run.
+    /// </summary>
+    /// <remarks>
+    ///     Scoped per run through an <see cref="AsyncLocal{T}"/>, not stored on the context, because a context
+    ///     object can be reused across runs (the scripted-alarm engine keeps one per alarm). An abandoned orphan
+    ///     therefore keeps seeing its own cancelled token even after a newer run starts on the same context.
+    /// </remarks>
+    public CancellationToken CancellationToken => s_runToken.Value;
+
+    private static readonly AsyncLocal<CancellationToken> s_runToken = new();
+
+    /// <summary>
+    ///     Makes <paramref name="token"/> the script-visible <see cref="CancellationToken"/> on the calling
+    ///     execution context until the returned scope is disposed. Called by <c>ScriptEvaluator.RunAsync</c>
+    ///     around the compiled delegate.
+    /// </summary>
+    /// <param name="token">The run token.</param>
+    /// <returns>A scope that restores the previous token.</returns>
+    internal static RunTokenScope EnterRun(CancellationToken token)
+    {
+        var previous = s_runToken.Value;
+        s_runToken.Value = token;
+        return new RunTokenScope(previous);
+    }
+
+    /// <summary>Restores the token that was current before <see cref="EnterRun"/>.</summary>
+    internal readonly struct RunTokenScope : IDisposable
+    {
+        private readonly CancellationToken _previous;
+
+        /// <summary>Captures the token to restore.</summary>
+        /// <param name="previous">The token current before the run.</param>
+        public RunTokenScope(CancellationToken previous) => _previous = previous;
+
+        /// <inheritdoc />
+        public void Dispose() => s_runToken.Value = _previous;
+    }
+
     /// <summary>
     ///     Deadband helper — returns <c>true</c> when <paramref name="current"/> differs
     ///     from <paramref name="previous"/> by more than <paramref name="tolerance"/>.

src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions/ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions.csproj

@@ -16,4 +16,10 @@
     <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Core.Abstractions\ZB.MOM.WW.OtOpcUa.Core.Abstractions.csproj"/>
   </ItemGroup>
 
+  <ItemGroup>
+    <!-- ScriptEvaluator scopes the script-visible run token (ScriptContext.EnterRun). Internal so a script
+         cannot replace its own token. -->
+    <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Core.Scripting"/>
+  </ItemGroup>
+
 </Project>

src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting/ScriptEvaluator.cs

@@ -185,7 +185,13 @@ public sealed class ScriptEvaluator<TContext, TResult> : IDisposable
         // TResult directly). We surface a Task<TResult> only to keep the existing
         // RunAsync contract consumers depend on. TimedScriptEvaluator wraps this in
         // Task.Run so a long-running script still honours its wall-clock budget.
-        var result = _func(globals);
+        // The run token is the script-visible ctx.CancellationToken for exactly this call. ScriptRunGuard passes
+        // the token it cancels on timeout, so a polling script can end its own abandoned run.
+        TResult result;
+        using (ScriptContext.EnterRun(ct))
+        {
+            result = _func(globals);
+        }
         return Task.FromResult(result);
     }
 

src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting/ScriptRunGuard.cs

@@ -96,9 +96,11 @@ public sealed class ScriptRunGuard
     /// <param name="logger">Where the quarantine Error line goes; null ⇒ Serilog's global logger.</param>
     public ScriptRunGuard(ScriptingOptions? options = null, ILogger? logger = null)
     {
-        options ??= new ScriptingOptions();
+        // Clamped here as well as at the bind site, because options also arrive from a Calculation driver's own
+        // config and from tests. An unclamped factor made the refusal path's timeout * factor overflow.
+        options = (options ?? new ScriptingOptions()).Sanitized(out _);
         _maxAllocBytesPerRun = options.MaxAllocBytesPerRun;
-        _quarantineThreshold = Math.Max(1, options.QuarantineAfterConsecutiveTimeouts);
+        _quarantineThreshold = options.QuarantineAfterConsecutiveTimeouts;
         _stuckFactor = options.StuckOrphanQuarantineFactor;
         _logger = logger ?? Log.Logger;
     }
@@ -197,7 +199,11 @@ public sealed class ScriptRunGuard
             if (_stuckFactor > 0 && Volatile.Read(ref state.RunStartedTimestamp) is var startedAt and not 0)
             {
                 var running = Stopwatch.GetElapsedTime(startedAt);
-                var threshold = timeout * _stuckFactor;
+                // Saturating: even the clamped maximum factor times a huge timeout must not overflow TimeSpan.
+                var thresholdTicks = timeout.Ticks * _stuckFactor;
+                var threshold = thresholdTicks >= TimeSpan.MaxValue.Ticks
+                    ? TimeSpan.MaxValue
+                    : TimeSpan.FromTicks((long)thresholdTicks);
                 if (running > threshold)
                 {
                     Quarantine(key, state,

src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting/ScriptingOptions.cs

@@ -53,4 +53,85 @@ public sealed class ScriptingOptions
     ///     refusal. Zero or negative disables the rule. Default 10.
     /// </summary>
     public double StuckOrphanQuarantineFactor { get; set; } = DefaultStuckOrphanQuarantineFactor;
+
+    /// <summary>Upper bound <see cref="Sanitized"/> applies to <see cref="StuckOrphanQuarantineFactor"/>.</summary>
+    public const double MaxStuckOrphanQuarantineFactor = 1000;
+
+    /// <summary>Upper bound <see cref="Sanitized"/> applies to <see cref="QuarantineAfterConsecutiveTimeouts"/>.</summary>
+    public const int MaxQuarantineAfterConsecutiveTimeouts = 1000;
+
+    /// <summary>
+    ///     Lower bound <see cref="Sanitized"/> applies to a positive <see cref="MaxAllocBytesPerRun"/>: 1 MB. A
+    ///     smaller budget would quarantine practically every script on its first run.
+    /// </summary>
+    public const long MinMaxAllocBytesPerRun = 1024L * 1024;
+
+    /// <summary>
+    ///     Returns a copy with every numeric knob pulled into a sane range. The bind site calls it and logs
+    ///     <paramref name="adjustments"/>. <see cref="ScriptRunGuard"/> calls it again, so options that reach the
+    ///     guard by another route (a Calculation driver's own config, a test) are clamped too.
+    ///     <list type="bullet">
+    ///         <item><see cref="StuckOrphanQuarantineFactor"/>: NaN becomes the default, a negative value becomes 0
+    ///         (disabled), and a value above <see cref="MaxStuckOrphanQuarantineFactor"/> becomes that maximum.
+    ///         Unclamped, an absurd factor made <c>timeout * factor</c> throw <see cref="OverflowException"/> on
+    ///         the first refused run.</item>
+    ///         <item><see cref="QuarantineAfterConsecutiveTimeouts"/>: into [1, <see cref="MaxQuarantineAfterConsecutiveTimeouts"/>].</item>
+    ///         <item><see cref="MaxAllocBytesPerRun"/>: a negative value becomes 0 (disabled), and a positive value
+    ///         below <see cref="MinMaxAllocBytesPerRun"/> becomes that minimum.</item>
+    ///     </list>
+    /// </summary>
+    /// <param name="adjustments">One line per value that was out of range, naming its key. A negative value that
+    /// already meant "disabled" is normalised without a line.</param>
+    /// <returns>A new, clamped instance. This instance is not modified.</returns>
+    public ScriptingOptions Sanitized(out IReadOnlyList<string> adjustments)
+    {
+        var notes = new List<string>();
+
+        var factor = StuckOrphanQuarantineFactor;
+        if (double.IsNaN(factor))
+        {
+            notes.Add($"{SectionName}:{nameof(StuckOrphanQuarantineFactor)} is NaN; using the default {DefaultStuckOrphanQuarantineFactor}.");
+            factor = DefaultStuckOrphanQuarantineFactor;
+        }
+        else if (factor < 0)
+        {
+            factor = 0;
+        }
+        else if (factor > MaxStuckOrphanQuarantineFactor)
+        {
+            notes.Add($"{SectionName}:{nameof(StuckOrphanQuarantineFactor)} {factor} is above the maximum; clamped to {MaxStuckOrphanQuarantineFactor}.");
+            factor = MaxStuckOrphanQuarantineFactor;
+        }
+
+        var threshold = QuarantineAfterConsecutiveTimeouts;
+        if (threshold < 1)
+        {
+            notes.Add($"{SectionName}:{nameof(QuarantineAfterConsecutiveTimeouts)} {threshold} is below 1; clamped to 1.");
+            threshold = 1;
+        }
+        else if (threshold > MaxQuarantineAfterConsecutiveTimeouts)
+        {
+            notes.Add($"{SectionName}:{nameof(QuarantineAfterConsecutiveTimeouts)} {threshold} is above the maximum; clamped to {MaxQuarantineAfterConsecutiveTimeouts}.");
+            threshold = MaxQuarantineAfterConsecutiveTimeouts;
+        }
+
+        var alloc = MaxAllocBytesPerRun;
+        if (alloc < 0)
+        {
+            alloc = 0;
+        }
+        else if (alloc > 0 && alloc < MinMaxAllocBytesPerRun)
+        {
+            notes.Add($"{SectionName}:{nameof(MaxAllocBytesPerRun)} {alloc} is below the minimum; clamped to {MinMaxAllocBytesPerRun}.");
+            alloc = MinMaxAllocBytesPerRun;
+        }
+
+        adjustments = notes;
+        return new ScriptingOptions
+        {
+            MaxAllocBytesPerRun = alloc,
+            QuarantineAfterConsecutiveTimeouts = threshold,
+            StuckOrphanQuarantineFactor = factor,
+        };
+    }
 }

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Calculation/CalculationDriverFactoryExtensions.cs

@@ -38,13 +38,16 @@ public static class CalculationDriverFactoryExtensions
     /// <param name="registry">The driver factory registry to register with.</param>
     /// <param name="loggerFactory">Optional logger factory for per-instance diagnostics loggers.</param>
     /// <param name="scriptRoot">Optional root script logger (fans failure entries onto the <c>script-logs</c> topic).</param>
+    /// <param name="scripting">The node-wide <c>Scripting</c> options every Calculation driver inherits; a key
+    /// authored in a driver's own config overrides that one knob. Null ⇒ the compiled defaults.</param>
     public static void Register(
         DriverFactoryRegistry registry,
         ILoggerFactory? loggerFactory = null,
-        ScriptRootLogger? scriptRoot = null)
+        ScriptRootLogger? scriptRoot = null,
+        ScriptingOptions? scripting = null)
     {
         ArgumentNullException.ThrowIfNull(registry);
-        registry.Register(DriverTypeName, (id, json) => CreateInstance(id, json, loggerFactory, scriptRoot));
+        registry.Register(DriverTypeName, (id, json) => CreateInstance(id, json, loggerFactory, scriptRoot, scripting));
     }
 
     /// <summary>Public overload for the Server-side bootstrapper + test consumers.</summary>
@@ -63,6 +66,18 @@ public static class CalculationDriverFactoryExtensions
     public static CalculationDriver CreateInstance(
         string driverInstanceId, string driverConfigJson,
         ILoggerFactory? loggerFactory, ScriptRootLogger? scriptRoot)
+        => CreateInstance(driverInstanceId, driverConfigJson, loggerFactory, scriptRoot, nodeScripting: null);
+
+    /// <summary>The full overload: also takes the node-wide <c>Scripting</c> options the driver inherits.</summary>
+    /// <param name="driverInstanceId">The unique identifier for the driver instance.</param>
+    /// <param name="driverConfigJson">The merged driver config JSON (carries the <c>RawTags</c> array).</param>
+    /// <param name="loggerFactory">Optional logger factory for per-instance diagnostics loggers.</param>
+    /// <param name="scriptRoot">Optional root script logger for failure fan-out.</param>
+    /// <param name="nodeScripting">The node-wide run-guard options; null ⇒ the compiled defaults.</param>
+    /// <returns>The constructed <see cref="CalculationDriver"/>.</returns>
+    public static CalculationDriver CreateInstance(
+        string driverInstanceId, string driverConfigJson,
+        ILoggerFactory? loggerFactory, ScriptRootLogger? scriptRoot, ScriptingOptions? nodeScripting)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(driverInstanceId);
         ArgumentException.ThrowIfNullOrWhiteSpace(driverConfigJson);
@@ -71,15 +86,14 @@ public static class CalculationDriverFactoryExtensions
             ?? throw new InvalidOperationException(
                 $"Calculation driver config for '{driverInstanceId}' deserialised to null");
 
-        // Run-guard knobs are optional and default to the node-wide ScriptingOptions defaults; only an
-        // explicitly authored key overrides one (so a config carrying neither binds Scripting = null).
-        ScriptingOptions? scripting = null;
-        if (dto.MaxAllocBytesPerRun is not null || dto.QuarantineAfterConsecutiveTimeouts is not null)
-        {
-            scripting = new ScriptingOptions();
-            if (dto.MaxAllocBytesPerRun is { } alloc) scripting.MaxAllocBytesPerRun = alloc;
-            if (dto.QuarantineAfterConsecutiveTimeouts is { } n) scripting.QuarantineAfterConsecutiveTimeouts = n;
-        }
+        var scripting = ResolveScripting(
+            dto.MaxAllocBytesPerRun, dto.QuarantineAfterConsecutiveTimeouts, nodeScripting, out var adjustments);
+        var logger = loggerFactory?.CreateLogger<CalculationDriver>();
+        // An authored value is never changed silently: the run guard would clamp it anyway, without a word.
+        foreach (var adjustment in adjustments)
+            logger?.LogWarning(
+                "Calculation driver {DriverInstanceId}: its run-guard config was out of range and is clamped: {Adjustment}",
+                driverInstanceId, adjustment);
 
         var options = new CalculationDriverOptions
         {
@@ -89,9 +103,37 @@ public static class CalculationDriverFactoryExtensions
             Scripting = scripting,
         };
 
-        return new CalculationDriver(
-            options, driverInstanceId, scriptRoot,
-            logger: loggerFactory?.CreateLogger<CalculationDriver>());
+        return new CalculationDriver(options, driverInstanceId, scriptRoot, logger: logger);
+    }
+
+    /// <summary>
+    ///     The run-guard options for one Calculation driver. The node-wide options are the base. A key authored
+    ///     in the driver's config overrides only its own knob, on a copy, so the shared node object is never
+    ///     written. With neither, the result is null and the guard uses its compiled defaults.
+    /// </summary>
+    /// <param name="maxAllocBytesPerRun">The driver config's <c>maxAllocBytesPerRun</c>, or null.</param>
+    /// <param name="quarantineAfterConsecutiveTimeouts">The driver config's <c>quarantineAfterConsecutiveTimeouts</c>, or null.</param>
+    /// <param name="nodeScripting">The node-wide options, or null.</param>
+    /// <param name="adjustments">The clamps applied to the driver's OWN keys (the node options were already
+    /// clamped and logged at bind), for the caller to log. Empty when nothing was out of range.</param>
+    /// <returns>The options to hand the driver, or null.</returns>
+    internal static ScriptingOptions? ResolveScripting(
+        long? maxAllocBytesPerRun, int? quarantineAfterConsecutiveTimeouts, ScriptingOptions? nodeScripting,
+        out IReadOnlyList<string> adjustments)
+    {
+        adjustments = [];
+        if (maxAllocBytesPerRun is null && quarantineAfterConsecutiveTimeouts is null) return nodeScripting;
+
+        var resolved = new ScriptingOptions();
+        if (nodeScripting is not null)
+        {
+            resolved.MaxAllocBytesPerRun = nodeScripting.MaxAllocBytesPerRun;
+            resolved.QuarantineAfterConsecutiveTimeouts = nodeScripting.QuarantineAfterConsecutiveTimeouts;
+            resolved.StuckOrphanQuarantineFactor = nodeScripting.StuckOrphanQuarantineFactor;
+        }
+        if (maxAllocBytesPerRun is { } alloc) resolved.MaxAllocBytesPerRun = alloc;
+        if (quarantineAfterConsecutiveTimeouts is { } n) resolved.QuarantineAfterConsecutiveTimeouts = n;
+        return resolved.Sanitized(out adjustments);
     }
 
     /// <summary>The merged-config DTO the calc factory binds from. The Calculation driver has no

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/ScriptAnalysis/IScriptTagCatalog.cs

@@ -50,7 +50,7 @@ public sealed record ScriptTagInfo(string Path, string Kind, string DataType, st
 ///         else. Verified chain: <c>AddressSpaceComposer</c> harvests the <c>ctx.GetTag("…")</c> literals
 ///         (via <c>EquipmentScriptPaths.ExtractDependencyRefs</c>) into <c>DependencyRefs</c>; those become
 ///         <c>VirtualTagActor._dependencyRefs</c>, registered with <c>DependencyMuxActor</c>, whose
-///         <c>_byRef</c> map is keyed (Ordinal) by <c>DriverInstanceActor.AttributeValuePublished.FullReference</c>
+///         <c>_byRef</c> map is keyed (Ordinal) by <c>DriverInstanceActor.AttributeValueItem.FullReference</c>
 ///         — and in v3 a driver's wire reference <b>is the RawPath</b>
 ///         (<c>DriverHostActor._nodeIdByDriverRef</c> is keyed <c>(DriverInstanceId, RawPath)</c>).
 ///     </para>

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/ScriptAnalysis/ScriptAnalysisService.cs

@@ -268,7 +268,16 @@ public sealed class ScriptAnalysisService
         var typeInfo = model.GetTypeInfo(memberAccess.Expression);
         var type = typeInfo.Type ?? typeInfo.ConvertedType;
         if (type == null) return null;
-        return type.GetMembers()
+        // The type's own members, then the INSTANCE members it inherits (stopping before System.Object, whose
+        // ToString/GetHashCode noise was never offered). Without the base chain, a member declared only on
+        // ScriptContext — ctx.CancellationToken — compiled and published but never completed. Inherited statics
+        // (ScriptContext.Deadband) are left out: they are not reachable through an instance receiver. This applies to
+        // EVERY receiver, not only ctx: a struct or enum receiver now also offers the System.ValueType /
+        // System.Enum instance members it inherits (CompareTo, HasFlag, ...), all of which compile.
+        var inherited = new List<ISymbol>();
+        for (var b = type.BaseType; b is not null && b.SpecialType != SpecialType.System_Object; b = b.BaseType)
+            inherited.AddRange(b.GetMembers().Where(m => !m.IsStatic));
+        return type.GetMembers().Concat(inherited)
             .Where(m => m.CanBeReferencedByName && !m.IsImplicitlyDeclared)
             // NotApplicable covers members (e.g. some BCL/special members) that carry no explicit accessibility but are referenceable.
             .Where(m => m.DeclaredAccessibility == Accessibility.Public || m.DeclaredAccessibility == Accessibility.NotApplicable)

src/Server/ZB.MOM.WW.OtOpcUa.Host/Configuration/ScriptingOptionsBinding.cs

@@ -0,0 +1,23 @@
+using Microsoft.Extensions.Configuration;
+using ZB.MOM.WW.OtOpcUa.Core.Scripting;
+
+namespace ZB.MOM.WW.OtOpcUa.Host.Configuration;
+
+/// <summary>
+///     Binds the node-wide <c>Scripting</c> section into <see cref="ScriptingOptions"/> and clamps it
+///     (<see cref="ScriptingOptions.Sanitized"/>). One place, so <c>Program.cs</c> and its unit test bind the same
+///     way and a misspelled key cannot silently fall back to the compiled defaults unnoticed.
+/// </summary>
+public static class ScriptingOptionsBinding
+{
+    /// <summary>Binds and clamps the <c>Scripting</c> section.</summary>
+    /// <param name="configuration">The host configuration.</param>
+    /// <param name="adjustments">One line per clamped value, for the caller to log as a Warning.</param>
+    /// <returns>The clamped options; the compiled defaults when the section is absent.</returns>
+    public static ScriptingOptions Bind(IConfiguration configuration, out IReadOnlyList<string> adjustments)
+    {
+        ArgumentNullException.ThrowIfNull(configuration);
+        var bound = configuration.GetSection(ScriptingOptions.SectionName).Get<ScriptingOptions>() ?? new ScriptingOptions();
+        return bound.Sanitized(out adjustments);
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.Host/Drivers/DriverFactoryBootstrap.cs

@@ -68,6 +68,8 @@ public static class DriverFactoryBootstrap
             // The calc driver needs the root script logger so a script failure fans out onto the
             // script-logs topic; resolve it here (null on nodes without the script pipeline wired).
             var scriptRoot = sp.GetService<ZB.MOM.WW.OtOpcUa.Core.Scripting.ScriptRootLogger>();
+            // The node-wide Scripting section (bound + clamped in Program.cs); null in test graphs ⇒ defaults.
+            var scripting = sp.GetService<ZB.MOM.WW.OtOpcUa.Core.Scripting.ScriptingOptions>();
             // The Galaxy driver resolves its Gateway.ApiKeySecretRef secret: arm through the
             // shared ISecretResolver (registered unconditionally by AddZbSecrets on every node).
             var secretResolver = sp.GetRequiredService<ISecretResolver>();
@@ -84,7 +86,7 @@ public static class DriverFactoryBootstrap
             // failures; without this it writes to NullLogger in production.
             ConfigureAbTransportLogging(sp);
             Register(registry, loggerFactory, secretResolver, primaryRoleSource, ResolveAbCipDefaultTransport(sp),
-                scriptRoot);
+                scriptRoot, scripting);
             return registry;
         });
         services.AddSingleton<IDriverFactory>(sp =>
@@ -209,11 +211,12 @@ public static class DriverFactoryBootstrap
         ISecretResolver secretResolver,
         IDriverPrimaryRoleSource primaryRoleSource,
         Driver.AbCip.AbCipTransport abCipDefaultTransport,
-        ZB.MOM.WW.OtOpcUa.Core.Scripting.ScriptRootLogger? scriptRoot = null)
+        ZB.MOM.WW.OtOpcUa.Core.Scripting.ScriptRootLogger? scriptRoot = null,
+        ZB.MOM.WW.OtOpcUa.Core.Scripting.ScriptingOptions? scripting = null)
     {
         Driver.AbCip.AbCipDriverFactoryExtensions.Register(registry, loggerFactory, abCipDefaultTransport);
         Driver.AbLegacy.AbLegacyDriverFactoryExtensions.Register(registry, loggerFactory);
-        Driver.Calculation.CalculationDriverFactoryExtensions.Register(registry, loggerFactory, scriptRoot);
+        Driver.Calculation.CalculationDriverFactoryExtensions.Register(registry, loggerFactory, scriptRoot, scripting);
         Driver.FOCAS.FocasDriverFactoryExtensions.Register(registry, loggerFactory);
         Driver.Galaxy.GalaxyDriverFactoryExtensions.Register(registry, secretResolver, loggerFactory);
         Driver.Modbus.ModbusDriverFactoryExtensions.Register(registry, loggerFactory);

src/Server/ZB.MOM.WW.OtOpcUa.Host/Program.cs

@@ -365,10 +365,22 @@ if (hasDriver)
     // F8b — production virtual-tag evaluator (Roslyn-compiled scripts cached per expression).
     // Replaces the F8-default NullVirtualTagEvaluator so VirtualTagActor evaluates real user
     // scripts at runtime.
+    // Node-wide script run-guard knobs (Scripting:MaxAllocBytesPerRun / QuarantineAfterConsecutiveTimeouts /
+    // StuckOrphanQuarantineFactor). Bound once and clamped into sane ranges here, so an absurd value is a startup
+    // Warning rather than an OverflowException inside a script run. The one instance is shared by every script
+    // seam on the node: the virtual-tag evaluator below, the scripted-alarm engine (DriverHostActor, via
+    // WithOtOpcUaRuntimeActors) and every Calculation driver (DriverFactoryBootstrap).
+    var scriptingOptions = ZB.MOM.WW.OtOpcUa.Host.Configuration.ScriptingOptionsBinding.Bind(
+        builder.Configuration, out var scriptingAdjustments);
+    foreach (var adjustment in scriptingAdjustments)
+        Log.Warning("Scripting misconfiguration detected at startup: {Adjustment}", adjustment);
+    builder.Services.AddSingleton(scriptingOptions);
+
     builder.Services.AddSingleton<RoslynVirtualTagEvaluator>(sp =>
         new RoslynVirtualTagEvaluator(
             sp.GetRequiredService<ILoggerFactory>().CreateLogger<RoslynVirtualTagEvaluator>(),
-            sp.GetRequiredService<ScriptRootLogger>()));
+            sp.GetRequiredService<ScriptRootLogger>(),
+            scripting: sp.GetRequiredService<ScriptingOptions>()));
     builder.Services.AddSingleton<IVirtualTagEvaluator>(sp => sp.GetRequiredService<RoslynVirtualTagEvaluator>());
 
     // Script-log fan-out (Layer 0). The DPS publisher resolves the ActorSystem lazily so it never

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DriverHostActor.cs

@@ -54,7 +54,7 @@ namespace ZB.MOM.WW.OtOpcUa.Runtime.Drivers;
 /// and the ONLY value ingress from driver children (<see cref="DriverInstanceActor"/> wraps even a
 /// single data change in an <c>AttributeValueBatchPublished</c>). <see cref="FanCommsLossToDependencyMux"/>
 /// fabricates a batch of the same shape straight to the dependency mux, so the host neither receives nor
-/// sends the per-value <c>AttributeValuePublished</c> any more.
+/// sends a per-value message any more (the per-value record is deleted).
 /// </summary>
 public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedStash
 {
@@ -202,6 +202,20 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     private readonly IHistoryWriter _historyWriter;
     private readonly IActorRef? _virtualTagHostOverride;
     private readonly ScriptRootLogger? _scriptRootLogger;
+
+    /// <summary>Node-wide script run-guard options for the scripted-alarm engine; null ⇒ compiled defaults.</summary>
+    private readonly ScriptingOptions? _scripting;
+
+    /// <summary>
+    ///     Driver children this host has stopped (<see cref="StopChild"/>, an operator Restart) and is watching
+    ///     until they terminate. A value burst from one of them is DROPPED in <see cref="ForwardBatchToMux"/>:
+    ///     <c>Context.Stop</c> is asynchronous, so the old child keeps publishing for the rest of the apply
+    ///     handler and its own stop, and forwarding those bursts after <see cref="EvictRetainedValues"/> would
+    ///     re-retain a removed driver's last Good in the dependency mux indefinitely. Akka delivers
+    ///     <see cref="Terminated"/> after the last message the watched child sent here, so removing the entry
+    ///     there bounds the set without ever dropping a live incarnation's values.
+    /// </summary>
+    private readonly HashSet<IActorRef> _retiredChildren = new();
     private readonly IActorRef? _scriptedAlarmHostOverride;
     private readonly ILoggingAdapter _log = Context.GetLogger();
 
@@ -264,6 +278,11 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// from <see cref="PushDesiredSubscriptions"/>.</summary>
     private IActorRef? _scriptedAlarmHost;
 
+    /// <summary>The scripted-alarm plans last sent to <see cref="_scriptedAlarmHost"/>, re-sent when it reports a
+    /// supervision restart (<see cref="ScriptedAlarmHostActor.ScriptedAlarmHostRestarted"/>). Null until the
+    /// first apply.</summary>
+    private IReadOnlyList<EquipmentScriptedAlarmPlan>? _lastScriptedAlarmPlans;
+
     private RevisionHash? _currentRevision;
 
     /// <summary>
@@ -641,8 +660,6 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// VirtualTag host instead of spawning a real <see cref="VirtualTagHostActor"/> child, so tests
     /// can intercept the <see cref="VirtualTagHostActor.ApplyVirtualTags"/> message. Null in
     /// production (the real host is spawned).</param>
-    /// <param name="loggerFactory">Retained for constructor-signature stability; unused since the
-    /// <c>EfAlarmConditionStateStore</c> fallback that consumed it was retired. Defaults to null.</param>
     /// <param name="scriptRootLogger">Optional root script logger required to spawn the ScriptedAlarm
     /// host (the engine + its script logging hang off it). When null the ScriptedAlarm host is left
     /// unspawned — the graceful dev/None-deployment path.</param>
@@ -694,6 +711,8 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// capture to a mesh-partner Primary the cluster failure detector reports unreachable.</param>
     /// <param name="historyUpdateRoleView">Where the OPC UA HistoryUpdate verdict is published for the node manager's
     /// HistoryUpdate Primary gate. Null on nodes that wire no redundancy manager.</param>
+    /// <param name="scripting">The node-wide <c>Scripting</c> run-guard options handed to the scripted-alarm
+    /// engine. Null ⇒ the compiled defaults.</param>
     /// <returns>The Akka.NET <see cref="Akka.Actor.Props"/> used to spawn this actor.</returns>
     public static Props Props(
         IDbContextFactory<OtOpcUaConfigDbContext>? dbFactory,
@@ -707,7 +726,6 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         IVirtualTagEvaluator? virtualTagEvaluator = null,
         IHistoryWriter? historyWriter = null,
         IActorRef? virtualTagHostOverride = null,
-        ILoggerFactory? loggerFactory = null,
         ScriptRootLogger? scriptRootLogger = null,
         IActorRef? scriptedAlarmHostOverride = null,
         IDriverCapabilityInvokerFactory? invokerFactory = null,
@@ -728,7 +746,8 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         Func<CommonsNodeId, bool>? sharesAlarmQueueWithLocal = null,
         TimeSpan? applyOutcomeTimeout = null,
         bool captureWhilePrimaryUnreachable = true,
-        IHistoryUpdateRoleView? historyUpdateRoleView = null) =>
+        IHistoryUpdateRoleView? historyUpdateRoleView = null,
+        ScriptingOptions? scripting = null) =>
         // WARNING: this forwarding list is POSITIONAL, and Props.Create compiles it into an
         // expression tree. Six IActorRef? parameters and several interface-typed ones mean a
         // mis-ordered argument is usually type-compatible and therefore compiles clean, then binds
@@ -737,11 +756,12 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         Akka.Actor.Props.Create(() => new DriverHostActor(
             dbFactory, localNode, ackRouter, driverFactory, localRoles, dependencyMux, opcUaPublishActor,
             healthPublisher, virtualTagEvaluator, historyWriter, virtualTagHostOverride,
-            loggerFactory, scriptRootLogger, scriptedAlarmHostOverride, invokerFactory, driverMemberCountProvider,
+            scriptRootLogger, scriptedAlarmHostOverride, invokerFactory, driverMemberCountProvider,
             deploymentArtifactCache, redundancyRoleView, replicationPeerHost, fetchAndCacheMode, artifactFetcher,
             alarmStateStore, telemetryHub, primaryRoleSource, historizationRoleView,
             sharesHistorizationScopeWithLocal, applyWedgeTimeout, reprovisionBackoff, commsRecoveryAuditDelay,
-            sharesAlarmQueueWithLocal, applyOutcomeTimeout, captureWhilePrimaryUnreachable, historyUpdateRoleView));
+            sharesAlarmQueueWithLocal, applyOutcomeTimeout, captureWhilePrimaryUnreachable, historyUpdateRoleView,
+            scripting));
 
     /// <summary>Initializes a new DriverHostActor with the specified dependencies.</summary>
     /// <param name="dbFactory">Database context factory for configuration database access.</param>
@@ -760,8 +780,6 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// for historized VirtualTag results; defaults to <see cref="NullHistoryWriter"/>.</param>
     /// <param name="virtualTagHostOverride">Test seam: when supplied, used as the VirtualTag host
     /// instead of spawning a real <see cref="VirtualTagHostActor"/> child.</param>
-    /// <param name="loggerFactory">Retained for constructor-signature stability; unused since the
-    /// <c>EfAlarmConditionStateStore</c> fallback that consumed it was retired. Defaults to null.</param>
     /// <param name="scriptRootLogger">Optional root script logger required to spawn the ScriptedAlarm
     /// host; when null the host is left unspawned.</param>
     /// <param name="scriptedAlarmHostOverride">Test seam: when supplied, used as the ScriptedAlarm host
@@ -830,6 +848,8 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// (<see cref="PrimaryGatePolicy.ShouldServeHistoryUpdate"/> — the data-plane verdict, but closed until the first
     /// redundancy snapshot) is published for the node manager's HistoryUpdate Primary gate. Null on nodes that wire no
     /// redundancy manager.</param>
+    /// <param name="scripting">The node-wide <c>Scripting</c> run-guard options handed to the scripted-alarm
+    /// engine. Null ⇒ the compiled defaults.</param>
     public DriverHostActor(
         IDbContextFactory<OtOpcUaConfigDbContext>? dbFactory,
         CommonsNodeId localNode,
@@ -842,7 +862,6 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         IVirtualTagEvaluator? virtualTagEvaluator = null,
         IHistoryWriter? historyWriter = null,
         IActorRef? virtualTagHostOverride = null,
-        ILoggerFactory? loggerFactory = null,
         ScriptRootLogger? scriptRootLogger = null,
         IActorRef? scriptedAlarmHostOverride = null,
         IDriverCapabilityInvokerFactory? invokerFactory = null,
@@ -863,8 +882,10 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         Func<CommonsNodeId, bool>? sharesAlarmQueueWithLocal = null,
         TimeSpan? applyOutcomeTimeout = null,
         bool captureWhilePrimaryUnreachable = true,
-        IHistoryUpdateRoleView? historyUpdateRoleView = null)
+        IHistoryUpdateRoleView? historyUpdateRoleView = null,
+        ScriptingOptions? scripting = null)
     {
+        _scripting = scripting;
         _captureWhilePrimaryUnreachable = captureWhilePrimaryUnreachable;
         _historyUpdateRoleView = historyUpdateRoleView;
         _applyOutcomeTimeout = applyOutcomeTimeout ?? DefaultApplyOutcomeTimeout;
@@ -1146,8 +1167,9 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     ///     null and ApplyScriptedAlarms becomes a no-op. The engine is built around a fresh
     ///     <see cref="DependencyMuxTagUpstreamSource"/> + the wired <see cref="IAlarmStateStore"/> (the
     ///     replicated <c>LocalDbAlarmConditionStateStore</c> on a driver-role node); when no store was
-    ///     wired the host is skipped. The host (spawned as a child) owns + disposes the engine in its
-    ///     PostStop, so it stops with the driver host.
+    ///     wired the host is skipped. The host is spawned through the factory <c>Props</c>, so EACH
+    ///     incarnation (a supervision restart included) builds, owns and disposes its own engine; it stops
+    ///     with the driver host.
     /// </summary>
     private void SpawnScriptedAlarmHost()
     {
@@ -1178,13 +1200,23 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
             return;
         }
 
+        // Factory Props: every incarnation of the host (a supervision restart included) builds and owns a fresh
+        // (upstream, engine) pair, so a restart never reuses an engine the previous incarnation disposed or left
+        // half-loaded. The closure captures locals only; it runs in the child's constructor.
         var store = _alarmStateStore;
-        var upstream = new DependencyMuxTagUpstreamSource();
-        var engine = new ScriptedAlarmEngine(
-            upstream, store, new ScriptLoggerFactory(_scriptRootLogger.Logger), _scriptRootLogger.Logger);
+        var scriptLogger = _scriptRootLogger.Logger;
+        var scripting = _scripting;
         _scriptedAlarmHost = Context.ActorOf(
             ScriptedAlarmHostActor.Props(
-                _opcUaPublishActor, _dependencyMux, upstream, engine, _localNode, telemetryHub: _telemetryHub),
+                _opcUaPublishActor, _dependencyMux,
+                () =>
+                {
+                    var upstream = new DependencyMuxTagUpstreamSource();
+                    var engine = new ScriptedAlarmEngine(
+                        upstream, store, new ScriptLoggerFactory(scriptLogger), scriptLogger, scripting: scripting);
+                    return (upstream, engine);
+                },
+                _localNode, telemetryHub: _telemetryHub),
             "scripted-alarm-host");
     }
 
@@ -1500,6 +1532,8 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         Receive<ApplyWedged>(HandleApplyWedged);
         Receive<GetDiagnostics>(HandleGetDiagnostics);
         Receive<DriverInstanceActor.AttributeValueBatchPublished>(ForwardBatchToMux);
+        Receive<Terminated>(OnRetiredChildTerminated);
+        Receive<ScriptedAlarmHostActor.ScriptedAlarmHostRestarted>(_ => HandleScriptedAlarmHostRestarted());
         Receive<DriverInstanceActor.AttributeAlarmPublished>(ForwardNativeAlarm);
         Receive<DriverInstanceActor.ConnectivityChanged>(OnDriverConnectivityChanged);
         Receive<CommsRecoveryAudit>(HandleCommsRecoveryAudit);
@@ -1562,6 +1596,8 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         Receive<ApplyWedged>(HandleApplyWedged);
         Receive<GetDiagnostics>(HandleGetDiagnostics);
         Receive<DriverInstanceActor.AttributeValueBatchPublished>(ForwardBatchToMux);
+        Receive<Terminated>(OnRetiredChildTerminated);
+        Receive<ScriptedAlarmHostActor.ScriptedAlarmHostRestarted>(_ => HandleScriptedAlarmHostRestarted());
         Receive<DriverInstanceActor.AttributeAlarmPublished>(ForwardNativeAlarm);
         Receive<DriverInstanceActor.ConnectivityChanged>(OnDriverConnectivityChanged);
         Receive<CommsRecoveryAudit>(HandleCommsRecoveryAudit);
@@ -1606,6 +1642,16 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// </summary>
     private void ForwardBatchToMux(DriverInstanceActor.AttributeValueBatchPublished msg)
     {
+        // A burst from an incarnation this host already stopped: forwarding it would undo the SourceRemoved
+        // eviction (see _retiredChildren). Its ConnectivityChanged is NOT filtered — the respawn path relies on
+        // that Bad fan to cover the gap.
+        if (_retiredChildren.Contains(Sender))
+        {
+            _log.Debug("DriverHost {Node}: dropped a {Count}-item value burst from a stopped incarnation of {Id}",
+                _localNode, msg.Items.Count, msg.DriverInstanceId);
+            return;
+        }
+
         // One envelope per burst; the mux filters per item (it registered a batch receive).
         _dependencyMux?.Tell(msg);
 
@@ -2501,6 +2547,8 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         Receive<DriverInstanceActor.AttributeValueBatchPublished>(m =>
             _log.Debug("DriverHost {Node}: dropping a {Count}-item value burst from {Id} while Stale (no address space)",
                 _localNode, m.Items.Count, m.DriverInstanceId));
+        Receive<Terminated>(OnRetiredChildTerminated);
+        Receive<ScriptedAlarmHostActor.ScriptedAlarmHostRestarted>(_ => HandleScriptedAlarmHostRestarted());
         Receive<DriverInstanceActor.AttributeAlarmPublished>(m =>
             _log.Debug("DriverHost {Node}: dropping a native alarm transition ({Cond}) from {Id} while Stale",
                 _localNode, m.Args.ConditionId, m.DriverInstanceId));
@@ -3652,6 +3700,7 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         // (re)loads its engine + re-registers mux interest for the union of dependency refs. Covers
         // both the fresh-apply and bootstrap-restore paths (both call this method); the Stale-recovery
         // path deliberately does not, matching driver + VirtualTag recovery.
+        _lastScriptedAlarmPlans = composition.EquipmentScriptedAlarms;
         _scriptedAlarmHost?.Tell(new ScriptedAlarmHostActor.ApplyScriptedAlarms(composition.EquipmentScriptedAlarms));
         if (composition.EquipmentScriptedAlarms.Count > 0)
         {
@@ -3816,8 +3865,10 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     {
         if (!_children.TryGetValue(driverInstanceId, out var entry)) return;
         StopDependencyAdapter(driverInstanceId);
+        RetireChild(entry.Actor);
         Context.Stop(entry.Actor);
         _children.Remove(driverInstanceId);
+        EvictRetainedValues(driverInstanceId);
         // The instance left the plan (StopChild is only reached via plan.ToStop), so its cached
         // Health/Resilience snapshots must not replay to new telemetry subscribers. Release the shared
         // resilience state FIRST: the resilience publisher re-emits the tracker's snapshots every tick, so
@@ -3836,6 +3887,56 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         _log.Info("DriverHost {Node}: stopped driver child {Id}", _localNode, driverInstanceId);
     }
 
+    /// <summary>
+    ///     Tells the dependency mux to drop every retained value this driver instance produced, so a stopped
+    ///     driver's last Good is never replayed to a later replay-opting subscriber as if it were current. Sent
+    ///     wherever a driver OBJECT ends: a deploy removal, the stop half of a config-change respawn
+    ///     (<see cref="StopChild"/>) and an operator Restart (a new driver object). Deliberately NOT sent on a
+    ///     supervision restart (<see cref="HandleReprovisionRequested"/>): that re-uses the same driver, whose last value is
+    ///     still its current one. Sent before any respawn, on the same host→mux pair the new incarnation's
+    ///     values travel, so the eviction is ordered ahead of them.
+    /// </summary>
+    /// <remarks>
+    ///     The stopped child keeps publishing until it actually terminates, and for a REMOVED driver nothing
+    ///     would ever overwrite a value re-retained after this eviction (it never publishes again, and its
+    ///     PostStop Bad fan resolves no refs once the apply has rebuilt the index without it). So the caller
+    ///     also <see cref="RetireChild"/>s it, and <see cref="ForwardBatchToMux"/> drops every burst from a
+    ///     retired child.
+    /// </remarks>
+    /// <param name="driverInstanceId">The driver instance that ended.</param>
+    private void EvictRetainedValues(string driverInstanceId) =>
+        _dependencyMux?.Tell(new DependencyMuxActor.SourceRemoved(driverInstanceId));
+
+    /// <summary>Marks a child this host is about to stop as retired and watches it until it terminates.</summary>
+    /// <param name="child">The child being stopped.</param>
+    private void RetireChild(IActorRef child)
+    {
+        _retiredChildren.Add(child);
+        Context.Watch(child);
+    }
+
+    /// <summary>
+    ///     The scripted-alarm host was restarted by supervision and has an empty engine: re-send the last plans so
+    ///     its inputs and operator commands work again without waiting for the next deploy. Only the CURRENT host's
+    ///     signal is honoured.
+    /// </summary>
+    private void HandleScriptedAlarmHostRestarted()
+    {
+        if (_scriptedAlarmHost is null || !Sender.Equals(_scriptedAlarmHost)) return;
+        if (_lastScriptedAlarmPlans is null)
+        {
+            _log.Debug("DriverHost {Node}: ScriptedAlarm host restarted before any apply; nothing to re-send", _localNode);
+            return;
+        }
+        _log.Warning("DriverHost {Node}: ScriptedAlarm host was restarted by supervision; re-applying {Count} scripted alarm(s)",
+            _localNode, _lastScriptedAlarmPlans.Count);
+        _scriptedAlarmHost.Tell(new ScriptedAlarmHostActor.ApplyScriptedAlarms(_lastScriptedAlarmPlans));
+    }
+
+    /// <summary>A retired child has terminated; nothing more can arrive from it.</summary>
+    /// <param name="msg">The termination notice.</param>
+    private void OnRetiredChildTerminated(Terminated msg) => _retiredChildren.Remove(msg.ActorRef);
+
     private static string ActorNameFor(string driverInstanceId, long generation)
     {
         // Akka actor names cannot contain '/', ':', or whitespace. Mangle defensively. The monotonic
@@ -3881,8 +3982,12 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
 
         // Stop the existing child actor — DriverInstanceActor.PostStop calls ShutdownAsync.
         StopDependencyAdapter(msg.DriverInstanceId);
+        RetireChild(entry.Actor);
         Context.Stop(entry.Actor);
         _children.Remove(msg.DriverInstanceId);
+        // An operator Restart builds a NEW driver object, so the old one's retained values are evicted like a
+        // removal's; the respawned driver republishes its own.
+        EvictRetainedValues(msg.DriverInstanceId);
         // The old incarnation's health must not read as the new one's until it publishes its own.
         _healthPublisher.Forget(msg.DriverInstanceId);
 

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DriverInstanceActor.cs

@@ -108,21 +108,16 @@ public sealed class DriverInstanceActor : ReceiveActor, IWithTimers
     ///     state — a no-op when already Reconnecting or Connecting.
     /// </summary>
     public sealed record ForceReconnect;
-    /// <summary>One driver-published value. <b>No production sender remains</b> — the subscription path
-    /// batches every data change into an <see cref="AttributeValueBatchPublished"/>, and the comms-loss fan
-    /// (<c>DriverHostActor.FanCommsLossToDependencyMux</c>), which was the last sender to fabricate this
-    /// message, now fabricates a batch too. The dependency mux still accepts it for tests and direct senders.
+    /// <summary>One value within an <see cref="AttributeValueBatchPublished"/>.
     /// <para><paramref name="StatusCode"/> is the driver's full OPC UA status code including its sub-code
     /// — not a severity bucket. Classify it with <see cref="OpcUaStatus.IsGood"/> and friends rather
-    /// than comparing it to <see cref="OpcUaStatus.Good"/>.</para></summary>
-    public sealed record AttributeValuePublished(string DriverInstanceId, string FullReference, object? Value, uint StatusCode, DateTime TimestampUtc);
-    /// <summary>One value within an <see cref="AttributeValueBatchPublished"/>.
+    /// than comparing it to <see cref="OpcUaStatus.Good"/>.</para>
     /// <para>A struct deliberately: an <c>AttributeValueItem[]</c> then holds its items inline, so a burst of
     /// N values costs one array allocation instead of one array plus N boxes. Indexed access through
     /// <see cref="IReadOnlyList{T}"/> does not box.</para></summary>
     public readonly record struct AttributeValueItem(string FullReference, object? Value, uint StatusCode, DateTime TimestampUtc);
-    /// <summary>Batched form of <see cref="AttributeValuePublished"/> — every changed attribute of ONE
-    /// driver production burst in one message. The parent fans the whole batch to the mux and the OPC UA
+    /// <summary>The ONLY value message a driver child sends: every changed attribute of ONE driver production
+    /// burst in one message (a single data change is a one-item batch). The parent fans the whole batch to the mux and the OPC UA
     /// publish path in one hop each. Status codes ride verbatim.</summary>
     public sealed record AttributeValueBatchPublished(string DriverInstanceId, IReadOnlyList<AttributeValueItem> Items);
     private sealed record DataChangeForward(string FullReference, DataValueSnapshot Snapshot);
@@ -132,7 +127,7 @@ public sealed class DriverInstanceActor : ReceiveActor, IWithTimers
     private sealed record DataChangeBatchForward(IReadOnlyList<DataChangeItem> Items);
     /// <summary>Published to the parent whenever the subscribed driver (an <see cref="IAlarmSource"/>) fires
     /// <see cref="IAlarmSource.OnAlarmEvent"/>. The parent (<see cref="DriverHostActor"/>) projects + routes it
-    /// to the materialised Part 9 condition. Parallels <see cref="AttributeValuePublished"/>.</summary>
+    /// to the materialised Part 9 condition. Parallels <see cref="AttributeValueBatchPublished"/>.</summary>
     public sealed record AttributeAlarmPublished(string DriverInstanceId, AlarmEventArgs Args);
     private sealed record NativeAlarmRaised(AlarmEventArgs Args);
     /// <summary>Self-sent on Connected entry / when alarm refs are (re)pushed, to establish the native-alarm

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/ScriptedAlarms/ScriptedAlarmHostActor.cs

@@ -86,6 +86,21 @@ public sealed class ScriptedAlarmHostActor : ReceiveActor
     /// <param name="Plans">The desired Equipment-namespace scripted-alarm plans.</param>
     public sealed record ApplyScriptedAlarms(IReadOnlyList<EquipmentScriptedAlarmPlan> Plans);
 
+    /// <summary>
+    ///     Told to the parent from <see cref="PostRestart"/>. A supervision restart is otherwise invisible to the
+    ///     parent, and the new incarnation has an EMPTY engine (factory Props) and no mux interest, so until the
+    ///     next <see cref="ApplyScriptedAlarms"/> its inputs stop and every operator command is dropped as not
+    ///     owned. The parent (<c>DriverHostActor</c>) answers by re-sending the last plans it applied, mirroring
+    ///     how a driver child's <c>ReprovisionRequested</c> is answered.
+    /// </summary>
+    public sealed class ScriptedAlarmHostRestarted
+    {
+        /// <summary>The single instance.</summary>
+        public static readonly ScriptedAlarmHostRestarted Instance = new();
+
+        private ScriptedAlarmHostRestarted() { }
+    }
+
     /// <summary>Marshals an engine emission off the engine's worker thread onto the actor thread.
     /// Carries the <see cref="ScriptedAlarmEvent"/> the engine raised on <c>OnEvent</c>.</summary>
     private sealed record EngineEmission(ScriptedAlarmEvent Event);
@@ -384,9 +399,10 @@ public sealed class ScriptedAlarmHostActor : ReceiveActor
         // subscriptions exist, so any DependencyValueChanged the mux delivers will be observed by the
         // engine. RegisterInterest replaces a subscriber's prior interest set (see DependencyMuxActor),
         // so a re-Apply with a fresh union simply supersedes the old one — no explicit unregister needed.
-        // ReplayRetained: the mux replays the last value it saw for each ref, so a fresh engine (a
-        // supervision restart builds one around an EMPTY upstream) converges immediately instead of
-        // waiting for every input to change again.
+        // ReplayRetained: the mux replays the last value it saw for each ref, so a freshly loaded engine
+        // converges immediately instead of waiting for every input to change again. That includes the engine
+        // a supervision restart builds around an EMPTY upstream, but only once the parent has re-sent
+        // ApplyScriptedAlarms in answer to ScriptedAlarmHostRestarted (PostRestart); nothing reloads it before.
         _mux?.Tell(new DependencyMuxActor.RegisterInterest(msg.DepRefs, Self, ReplayRetained: true));
         // Prune the upstream's retained snapshots to the loaded set (R02:L3): a path no alarm references
         // any more will never be pushed again, so its last value is dead weight for the process lifetime.
@@ -791,6 +807,15 @@ public sealed class ScriptedAlarmHostActor : ReceiveActor
         base.PreRestart(reason, message);
     }
 
+    /// <inheritdoc />
+    /// <remarks>Tells the parent <see cref="ScriptedAlarmHostRestarted"/> so it re-sends the last
+    /// <see cref="ApplyScriptedAlarms"/>: the new incarnation has nothing loaded and no mux interest.</remarks>
+    protected override void PostRestart(Exception reason)
+    {
+        base.PostRestart(reason);
+        Context.Parent.Tell(ScriptedAlarmHostRestarted.Instance);
+    }
+
     /// <inheritdoc />
     protected override void PostStop()
     {

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/ServiceCollectionExtensions.cs

@@ -609,7 +609,6 @@ public static class ServiceCollectionExtensions
                     healthPublisher: healthPublisher,
                     virtualTagEvaluator: virtualTagEvaluator,
                     historyWriter: historyWriter,
-                    loggerFactory: loggerFactory,
                     scriptRootLogger: scriptRootLogger,
                     invokerFactory: invokerFactory,
                     deploymentArtifactCache: deploymentArtifactCache,
@@ -638,7 +637,10 @@ public static class ServiceCollectionExtensions
                     sharesAlarmQueueWithLocal: BuildAlarmQueuePeerPredicate(
                         resolver.GetService<IConfiguration>(), roleInfo, replicationPeerHost),
                     // The HistoryUpdate verdict (closed until the first redundancy snapshot).
-                    historyUpdateRoleView: resolver.GetService<IHistoryUpdateRoleView>()),
+                    historyUpdateRoleView: resolver.GetService<IHistoryUpdateRoleView>(),
+                    // The node-wide Scripting section (bound + clamped in Program.cs) for the scripted-alarm
+                    // engine. Unbound in test graphs ⇒ null ⇒ the compiled defaults.
+                    scripting: resolver.GetService<ScriptingOptions>()),
                 DriverHostActorName);
             registry.Register<DriverHostActorKey>(driverHost);
 

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/VirtualTags/DependencyMuxActor.cs

@@ -15,11 +15,9 @@ namespace ZB.MOM.WW.OtOpcUa.Runtime.VirtualTags;
 ///     DriverHostActor forwards driver-child value publishes to this mux (one mux per driver-role
 ///     node). The ONLY driver ingress is the batched
 ///     <see cref="DriverInstanceActor.AttributeValueBatchPublished"/> — one envelope per driver
-///     production burst, which the mux filters per item. The per-value
-///     <see cref="DriverInstanceActor.AttributeValuePublished"/> receive has <b>no production sender left
-///     at all</b>: the comms-loss fan (<c>DriverHostActor.FanCommsLossToDependencyMux</c>) was its last
-///     one and now fabricates an <c>AttributeValueBatchPublished</c> instead. The receive is kept for
-///     tests and direct senders — treat it as dead in production.
+///     production burst, which the mux filters per item. The comms-loss fan
+///     (<c>DriverHostActor.FanCommsLossToDependencyMux</c>) fabricates one too. There is no per-value
+///     ingress: a single value is a one-item batch (tests build one with <c>ValuePublishes.Single</c>).
 ///
 ///     <b>The mux emits ONLY batches</b>, so a subscriber's
 ///     batch receive is its complete hot path. Every subscriber keeps a per-value
@@ -52,11 +50,9 @@ namespace ZB.MOM.WW.OtOpcUa.Runtime.VirtualTags;
 ///         <b>Source removal.</b> The mux records which driver instance last published each retained ref;
 ///         <see cref="SourceRemoved"/> evicts every value that driver produced, so a removed driver's last
 ///         Good is never replayed as current. A comms-loss fan (a Bad batch) already overwrites the retained
-///         value with Bad. ⚠️ As of fix round 1 no production actor sends <see cref="SourceRemoved"/> yet —
-///         <c>DriverHostActor</c> (outside the scripting lane) must Tell it when it stops / removes a driver
-///         child. Until then a removed driver's last value can still be replayed to a replay-opting
-///         subscriber that re-registers for that ref while another replay-opting subscriber holds it, or
-///         within the grace window.
+///         value with Bad. <c>DriverHostActor</c> sends <see cref="SourceRemoved"/> wherever a driver object
+///         ends (a deploy removal, the stop half of a config-change respawn, an operator Restart), and never
+///         on a supervision restart, which re-uses the same driver.
 ///     </para>
 /// </summary>
 public sealed class DependencyMuxActor : ReceiveActor, IWithTimers
@@ -154,7 +150,6 @@ public sealed class DependencyMuxActor : ReceiveActor, IWithTimers
         Receive<UnregisterInterest>(msg => RemoveSubscriber(msg.Subscriber));
         Receive<SourceRemoved>(OnSourceRemoved);
         Receive<SweepReleased>(_ => OnSweep());
-        Receive<DriverInstanceActor.AttributeValuePublished>(OnAttributeValuePublished);
         Receive<DriverInstanceActor.AttributeValueBatchPublished>(OnAttributeValueBatchPublished);
         Receive<Terminated>(msg => RemoveSubscriber(msg.ActorRef));
     }
@@ -265,30 +260,6 @@ public sealed class DependencyMuxActor : ReceiveActor, IWithTimers
         _log.Debug("DependencyMux: source {Driver} removed — evicted {Count} retained value(s)", msg.DriverInstanceId, evicted);
     }
 
-    private void OnAttributeValuePublished(DriverInstanceActor.AttributeValuePublished msg)
-    {
-        if (!_byRef.TryGetValue(msg.FullReference, out var entry))
-        {
-            // Nothing is registered for (or retaining) this ref — drop. Common in normal operation; the address
-            // space carries thousands of tags and only a fraction feed virtual-tag expressions.
-            return;
-        }
-        var dep = new VirtualTagActor.DependencyValueChanged(msg.FullReference, msg.Value, msg.TimestampUtc, msg.StatusCode);
-        if (entry.Retains)
-        {
-            entry.Last = dep;
-            entry.LastSource = msg.DriverInstanceId;
-        }
-        foreach (var sub in entry.Subscribers)
-        {
-            // A single-item batch, so the mux emits exactly ONE message shape and every subscriber needs
-            // only the batch receive on its hot path. One list per subscriber: batch ownership transfers
-            // to the receiver, so a shared list must never cross mailboxes. Nothing in production reaches
-            // this path (see the class doc) — the extra allocation is noise on a test-only seam.
-            sub.Tell(new VirtualTagActor.DependencyValueBatch(new[] { dep }));
-        }
-    }
-
     private void OnAttributeValueBatchPublished(DriverInstanceActor.AttributeValueBatchPublished msg)
     {
         // Nothing registered and nothing retained — skip the whole burst rather than probing an empty map per item.