test(alarms): native ack wrong-role deny + tidy NativeAlarmAck doc (code-review)

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/NativeAlarmAck.cs

@@ -12,9 +12,9 @@ namespace ZB.MOM.WW.OtOpcUa.OpcUaServer;
 ///         ref, the operator's acknowledge comment, and the authenticated operator's display name.
 ///     </para>
 /// </summary>
-/// <param name="ConditionNodeId">The acknowledged condition's folder-scoped NodeId identifier string
-/// (the same value the <c>DriverHostActor</c> inverse map keys native conditions by), used to resolve the
-/// command back to its backing driver + alarm ref.</param>
+/// <param name="ConditionNodeId">The folder-scoped condition NodeId identifier string — the same value
+/// stored in <c>DriverHostActor._alarmNodeIdByDriverRef</c> (keyed by <c>(DriverInstanceId, FullName)</c>),
+/// used to resolve the ack back to its backing driver.</param>
 /// <param name="Comment">The operator's acknowledge comment text, or <c>null</c> when none was supplied.</param>
 /// <param name="OperatorUser">The authenticated operator's display name (empty when none resolves).</param>
 public sealed record NativeAlarmAck(string ConditionNodeId, string? Comment, string OperatorUser);