fix(opcuaserver): UNS reference nodes repair on backing-tag historian/shape edits

Adversarial review of 9f68f272 (classifier: non-alarm raw-tag deltas became
surgical) found stale UNS inheritance after a surgical raw edit. Editing a raw
tag's IsHistorized / HistorianTagname / IsArray / ArrayLength left every
referencing UNS node STALE: none of those fields were on UnsReferenceVariable,
so no coincident UnsReferenceDelta fired; the applier updated the raw node in
place; and EnsureVariable early-returns on an existing node. Consequences:
HistoryRead through the UNS NodeId served a different series than through the
raw NodeId (breaking the documented dual-registration invariant), a
de-historized tag kept serving history via UNS, and a scalar->array flip left
the UNS mirror scalar AND writable (bypassing the array read-only write gate).

UnsReferenceVariable now carries Backing{IsHistorized,HistorianTagname,IsArray,
ArrayLength}, copied from the backing tag's TagConfigIntent at compose time, so
record equality makes the reference Changed in the SAME plan. Both deltas are
non-rebuild kinds, so the existing machinery repairs the mirror surgically:
remove-previous in Apply, recreate in MaterialiseUnsReferences. That pass now
reads the four values from the RECORD (the single truth the planner diffed)
instead of a rawByPath back-lookup, preserving historian resolution exactly
(blank override => BackingRawPath, which is the backing tag's NodeId).

The artifact-decode seam needs no change: DeploymentArtifact.BuildRawAndUnsSubtrees
drives AddressSpaceComposer.Compose verbatim, which is what guarantees byte-parity.
The classifier needs no change either (a UnsReferenceDelta never forces Rebuild);
its comment now records why.

Also from the same review: a three-place-contract comment on RawTagPlan's
hand-written Equals naming its two downstream consumers, plus classifier pins for
the .Any(!eligible) quantifier, an ArrayLength-only delta, and an
alarm-content-only delta.

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/AddressSpaceComposer.cs

@@ -137,6 +137,17 @@ public sealed record RawContainerNode(
 ///     referencing equipment. <see cref="Realm"/> is always <see cref="AddressSpaceRealm.Raw"/>.
 ///     A null <see cref="HistorianTagname"/> means the historian tagname defaults to the RawPath (resolved
 ///     later, not here).
+///     <para><b>ADDING A FIELD IS A FOUR-PLACE CONTRACT — the hand-written equality below does NOT close
+///     over new members.</b> Because <see cref="ReferencingEquipmentPaths"/> forces a custom
+///     <c>Equals</c>/<c>GetHashCode</c>, the compiler's positional equality is suppressed, so a field added
+///     to the ctor and nowhere else silently never diffs (a redeploy that changes only it produces an EMPTY
+///     plan). Update, in order: (1) the primary constructor, (2) <see cref="Equals(RawTagPlan)"/>,
+///     (3) <see cref="GetHashCode"/>. Then reconsider two downstream consumers: (4a)
+///     <c>AddressSpaceChangeClassifier.RawTagDeltaIsSurgicalEligible</c>'s <c>with</c>-equality whitelist —
+///     a new field is default-closed (⇒ Rebuild) until it is listed, which is the safe direction but may be
+///     the wrong one; and (4b) <see cref="UnsReferenceVariable"/>'s <c>Backing*</c> mirror fields — if the
+///     new field is INHERITED by a UNS reference node at materialise time, it must be mirrored there too or
+///     referencing UNS nodes go stale on a surgical raw edit (the exact 2026-08-15 review finding).</para>
 /// </summary>
 public sealed record RawTagPlan(
     string TagId,
@@ -200,6 +211,27 @@ public sealed record RawTagPlan(
 ///     edit keeps the same id while the NodeId/effective-name changes; a backing-tag rename keeps the same id
 ///     + NodeId while <see cref="BackingRawPath"/> re-points). <see cref="Realm"/> is always
 ///     <see cref="AddressSpaceRealm.Uns"/>.
+///     <para><b><see cref="BackingIsHistorized"/> / <see cref="BackingHistorianTagname"/> /
+///     <see cref="BackingIsArray"/> / <see cref="BackingArrayLength"/> mirror the backing raw tag's
+///     historian intent + array shape, and they are on THIS record for one reason: to make a raw-side
+///     edit produce a COINCIDENT <c>UnsReferenceDelta</c>.</b> The 2026-08-15 surgical-deploys review
+///     found that once non-alarm raw-tag deltas became surgical, editing a backing tag's
+///     <c>IsHistorized</c> / <c>HistorianTagname</c> / <c>IsArray</c> / <c>ArrayLength</c> left every
+///     referencing UNS node STALE: the applier updates the raw node in place, no UNS-reference delta
+///     fired (none of those fields were on this record), and <c>EnsureVariable</c> early-returns on an
+///     existing node — so HistoryRead via the UNS NodeId served a different series than via the raw
+///     NodeId, a de-historized tag kept serving history through UNS, and a scalar→array flip left the
+///     UNS mirror scalar AND writable (bypassing the array read-only write gate). Carrying the four
+///     fields here makes record equality flag the reference as Changed in the same plan, and the
+///     existing machinery repairs it: the applier removes the previous UNS node and
+///     <see cref="AddressSpaceApplier.MaterialiseUnsReferences"/> recreates it from these values.
+///     <see cref="DataType"/> / <see cref="Writable"/> were already inherited onto the record and are
+///     covered by the same mechanism.</para>
+///     <para>Equality is the COMPILER-GENERATED positional-record equality: every member is a
+///     value/string type (no <c>IReadOnlyList</c> member, unlike <see cref="RawTagPlan"/>), so the four
+///     new fields are compared by value with no hand-written <c>Equals</c>/<c>GetHashCode</c> needed. If
+///     a collection-typed member is ever added here, custom equality becomes mandatory — see the
+///     three-place contract comment on <see cref="RawTagPlan"/>.</para>
 /// </summary>
 public sealed record UnsReferenceVariable(
     string UnsTagReferenceId,
@@ -209,6 +241,10 @@ public sealed record UnsReferenceVariable(
     string BackingRawPath,
     string DataType,
     bool Writable,
+    bool BackingIsHistorized = false,
+    string? BackingHistorianTagname = null,
+    bool BackingIsArray = false,
+    uint? BackingArrayLength = null,
     AddressSpaceRealm Realm = AddressSpaceRealm.Uns);
 
 public sealed record UnsAreaProjection(string UnsAreaId, string DisplayName);
@@ -799,6 +835,12 @@ public static class AddressSpaceComposer
                 continue; // invalid effective-name segment — dropped (deploy gate rejects invalid names)
             }
 
+            // The backing tag's historian intent + array shape ride the record so a raw-side edit to any of
+            // them produces a coincident UnsReferenceDelta that repairs this mirror node (see the record's
+            // doc-comment; 2026-08-15 surgical-deploys review). Parsed from the SAME TagConfigIntent the raw
+            // tag plan uses, so the two sides can never disagree.
+            var intent = TagConfigIntent.Parse(tag.TagConfig);
+
             vars.Add(new UnsReferenceVariable(
                 UnsTagReferenceId: r.UnsTagReferenceId,
                 EquipmentId: r.EquipmentId,
@@ -806,7 +848,11 @@ public static class AddressSpaceComposer
                 EffectiveName: effectiveName,
                 BackingRawPath: rawPath,
                 DataType: tag.DataType,
-                Writable: tag.AccessLevel == TagAccessLevel.ReadWrite));
+                Writable: tag.AccessLevel == TagAccessLevel.ReadWrite,
+                BackingIsHistorized: intent.IsHistorized,
+                BackingHistorianTagname: intent.HistorianTagname,
+                BackingIsArray: intent.IsArray,
+                BackingArrayLength: intent.ArrayLength));
         }
 
         vars.Sort((x, y) => string.CompareOrdinal(x.NodeId, y.NodeId));