fix(runtime): pessimistic write bound, incarnation-stamped write completions (fix round 2)

- RunWriteAsync wraps the invoker call in WaitAsync(writeTimeout) (Props,
  default 10 s = 2x the 5 s write cap): a token-ignoring hung write now
  answers BadTimeout, releases its slot and tag, and its orphan outcome
  is observed and discarded - later writes to that tag reach the device.
- WriteCompleted carries the launching incarnation (from the process-wide
  generation source); a late completion from a previous incarnation after
  a supervision restart is ignored instead of freeing the new
  incarnation's slot/tag.
- Test: a hung token-ignoring tag-a write is abandoned and a later tag-a
  write reaches the device while the abandoned one is still inside it.

Refs #731

Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

tests/Server/ZB.MOM.WW.OtOpcUa.Runtime.Tests/Drivers/DriverInstanceActorConcurrentWriteTests.cs

@@ -23,12 +23,12 @@ public sealed class DriverInstanceActorConcurrentWriteTests : RuntimeActorTestBa
     private static readonly TimeSpan WriteLatency = TimeSpan.FromMilliseconds(1200);
 
     private (IActorRef Actor, Akka.TestKit.TestProbe Parent) Connect(
-        IDriver driver, int? maxWritesInFlight = null, TimeSpan? queuedWriteBudget = null)
+        IDriver driver, int? maxWritesInFlight = null, TimeSpan? queuedWriteBudget = null, TimeSpan? writeTimeout = null)
     {
         var parent = CreateTestProbe();
         var actor = parent.ChildActorOf(DriverInstanceActor.Props(
             driver, commsLossTimeout: TimeSpan.Zero, maxWritesInFlight: maxWritesInFlight,
-            queuedWriteBudget: queuedWriteBudget));
+            queuedWriteBudget: queuedWriteBudget, writeTimeout: writeTimeout));
         actor.Tell(new DriverInstanceActor.InitializeRequested("{}"));
         parent.ExpectMsg<DriverInstanceActor.ConnectivityChanged>(m => m.Connected, PresenceBudget);
         return (actor, parent);
@@ -163,6 +163,38 @@ public sealed class DriverInstanceActorConcurrentWriteTests : RuntimeActorTestBa
         driver.EnteredRefs.ShouldBe(new[] { "tag-0" }, "the stale write must never reach the device");
     }
 
+    /// <summary>
+    ///     Fix round 2: a token-ignoring hung write held its tag forever, so every later write to that tag piled up
+    ///     in the queue. The write is bounded pessimistically; on overrun it answers BadTimeout and releases its
+    ///     slot and tag, and a later write to the same tag reaches the device.
+    /// </summary>
+    [Fact]
+    public async Task A_hung_token_ignoring_write_is_abandoned_and_releases_its_tag_for_a_later_write()
+    {
+        var driver = new SlowWritableDriver { HoldWrites = true, IgnoreCancellation = true };
+        var (actor, _) = Connect(driver, maxWritesInFlight: 1, writeTimeout: TimeSpan.FromMilliseconds(300));
+
+        var hung = actor.Ask<DriverInstanceActor.WriteAttributeResult>(
+            new DriverInstanceActor.WriteAttribute("tag-a", 1), PresenceBudget);
+        AwaitCondition(() => driver.WritesEntered == 1, PresenceBudget);
+
+        var hungResult = await hung;
+        hungResult.Success.ShouldBeFalse();
+        hungResult.Reason!.ShouldContain("800A0000", customMessage: "BadTimeout");
+        driver.MaxConcurrentWrites.ShouldBe(1);
+
+        // The tag (and the single slot) are free again: a later tag-a write reaches the device even though the
+        // abandoned one is still inside it.
+        var later = actor.Ask<DriverInstanceActor.WriteAttributeResult>(
+            new DriverInstanceActor.WriteAttribute("tag-a", 2), PresenceBudget);
+        AwaitCondition(() => driver.WritesEntered == 2, PresenceBudget);
+        driver.EnteredRefs.ShouldBe(new[] { "tag-a", "tag-a" });
+        driver.MaxConcurrentWrites.ShouldBe(2, "positive control: the abandoned write really is still wedged inside the driver");
+
+        driver.ReleaseWrites();
+        (await later).Success.ShouldBeTrue();
+    }
+
     [Fact]
     public async Task Queued_writes_fail_fast_when_the_driver_leaves_Connected()
     {
@@ -201,6 +233,8 @@ public sealed class DriverInstanceActorConcurrentWriteTests : RuntimeActorTestBa
 
         public TimeSpan Latency { get; init; }
         public bool HoldWrites { get; init; }
+        /// <summary>When true a held write ignores its cancellation token — a wedged driver.</summary>
+        public bool IgnoreCancellation { get; init; }
 
         public IReadOnlyList<WriteRequest> Writes => _writes.ToArray();
         public IReadOnlyList<string> EnteredRefs => _enteredRefs.ToArray();
@@ -227,7 +261,8 @@ public sealed class DriverInstanceActorConcurrentWriteTests : RuntimeActorTestBa
                 Interlocked.CompareExchange(ref _maxInside, inside, seen);
             try
             {
-                if (HoldWrites) await _release.Task.WaitAsync(cancellationToken);
+                if (HoldWrites && IgnoreCancellation) await _release.Task;
+                else if (HoldWrites) await _release.Task.WaitAsync(cancellationToken);
                 else if (Latency > TimeSpan.Zero) await Task.Delay(Latency, cancellationToken);
                 foreach (var w in writes) _writes.Enqueue(w);
                 return writes.Select(_ => new WriteResult(OpcUaStatus.Good)).ToList();