fix(abcip): ALMA review round 2 - IsRestatement contract docs, ALMD no-InAlarm warning, un-ack retrigger

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

docs/AlarmTracking.md

@@ -69,10 +69,12 @@ same condition is wired as an **event notifier of every referencing equipment fo
   `Unspecified` kind projects no state change.
 - **Snapshot / first-sight re-statements (#656).** A source that RE-STATES upstream's current state — Galaxy's
   reconnect snapshot entries, OpcUaClient's first event per condition after a start or deploy respawn — flags
-  `AlarmEventArgs.IsRestatement` (optional, default `false`; FOCAS, MTConnect, AbCip and live Galaxy transitions never
-  set it). The flag governs **history only, never node state**: the projector still projects, but a flagged `Retrigger`
+  `AlarmEventArgs.IsRestatement` (optional, default `false`; FOCAS, MTConnect and live Galaxy transitions never
+  set it; AbCip ALMA sets it for the drop-out update below). The flag governs **history only, never node state**: the projector still projects, but a flagged `Retrigger`
   on a condition already Active+unacked with the **same message AND severity**, or a flagged `Clear` on an
-  already-inactive condition, writes no `/alerts` row. Before this every gateway reconnect wrote a duplicate
+  already-inactive condition, writes no `/alerts` row; so does a flagged `Unspecified` update on an already-active
+  condition, which moves the node's message/severity (one condition event, active/acked kept) — AbCip ALMA's
+  governing limit dropping out (HH→H), and OpcUaClient's first sight of an inactive condition after a respawn. Before this every gateway reconnect wrote a duplicate
   "Activated" (and "Cleared") row per alarm while clients saw no event. A **live** `Retrigger` is a genuine
   re-occurrence and keeps its row; a changed severity (an MTConnect Warning→Fault that keeps its text) does too.
   Residual: a Galaxy alarm that genuinely re-occurred during an outage and is still Active+unacked with identical

docs/drivers/AbCip.md

@@ -271,6 +271,8 @@ routes native transitions on) and `Kind` = `Raise` / `Clear`. Before Gitea #641
 **ALMD's active bit is `InAlarm`** (Rockwell's ALMD reference). Until hw4 the projection polled `InFaulted`, which
 is the *input-health* flag (Status.1, set when the program raises `InFault`), so a live ALMD would have raised on
 input faults and never on the alarm itself. Declare `InAlarm` (and `Severity`) on an ALMD tag.
+**Migration:** a tag that declared `InFaulted` but not `InAlarm` now never raises (the `InAlarm` read is
+`BadNodeIdUnknown`); the projection logs a once-per-tag Warning at subscribe — add `InAlarm` to the tag's members.
 
 ### ALMA (analog alarms)
 
@@ -294,7 +296,8 @@ layout — leave grouping off for ALMA tags (BOOL members are read member by mem
   instruction's `AckRequired` is false); active→none `Clear`; a limit **newly** entering while active `Retrigger`
   (a new unacknowledged occurrence) — or `ActiveAcknowledged` if nothing is pending ack, never
   Retrigger-then-Acknowledge; every declared `*Acked` bit going true while the condition was unacknowledged
-  `Acknowledge`; a limit dropping out (the governing limit or its severity changes, no new occurrence) an
+  `Acknowledge`; a Good `*Acked` read going false on a fully-acked condition with the same limits active
+  `Retrigger` (an occurrence the poll missed); a limit dropping out (the governing limit or its severity changes, no new occurrence) an
   `Unspecified` event flagged `IsRestatement`, which `NativeAlarmProjector` applies as a text/severity move with
   **no `/alerts` row**. A non-governing limit flickering emits nothing.
 - **"Acked" is judged over every declared limit, active or not.** In Logix an occurrence that returned to normal