Merge local master 5135a036 into remed/lane-AbLegacy

Refs #738
Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/Forms/AbCipDriverForm.razor

@@ -21,7 +21,7 @@
             <div class="col-md-3">
                 <label class="form-label">Max concurrent reads</label>
                 <InputNumber @bind-Value="_form.MaxConcurrentReads" @bind-Value:after="EmitAsync" class="form-control form-control-sm" />
-                <div class="form-text">Read work items in flight at once. Default 8; 1 = sequential.</div>
+                <div class="form-text">Read work items in flight at once. Default 8; 1 = sequential (libplctag). The native transport always uses at least 64 — it packs concurrent reads into one request.</div>
             </div>
             <div class="col-md-3">
                 <div class="form-check form-switch mt-4">

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/ScriptAnalysis/IScriptTagCatalog.cs

@@ -50,7 +50,7 @@ public sealed record ScriptTagInfo(string Path, string Kind, string DataType, st
 ///         else. Verified chain: <c>AddressSpaceComposer</c> harvests the <c>ctx.GetTag("…")</c> literals
 ///         (via <c>EquipmentScriptPaths.ExtractDependencyRefs</c>) into <c>DependencyRefs</c>; those become
 ///         <c>VirtualTagActor._dependencyRefs</c>, registered with <c>DependencyMuxActor</c>, whose
-///         <c>_byRef</c> map is keyed (Ordinal) by <c>DriverInstanceActor.AttributeValuePublished.FullReference</c>
+///         <c>_byRef</c> map is keyed (Ordinal) by <c>DriverInstanceActor.AttributeValueItem.FullReference</c>
 ///         — and in v3 a driver's wire reference <b>is the RawPath</b>
 ///         (<c>DriverHostActor._nodeIdByDriverRef</c> is keyed <c>(DriverInstanceId, RawPath)</c>).
 ///     </para>

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/ScriptAnalysis/ScriptAnalysisService.cs

@@ -268,7 +268,16 @@ public sealed class ScriptAnalysisService
         var typeInfo = model.GetTypeInfo(memberAccess.Expression);
         var type = typeInfo.Type ?? typeInfo.ConvertedType;
         if (type == null) return null;
-        return type.GetMembers()
+        // The type's own members, then the INSTANCE members it inherits (stopping before System.Object, whose
+        // ToString/GetHashCode noise was never offered). Without the base chain, a member declared only on
+        // ScriptContext — ctx.CancellationToken — compiled and published but never completed. Inherited statics
+        // (ScriptContext.Deadband) are left out: they are not reachable through an instance receiver. This applies to
+        // EVERY receiver, not only ctx: a struct or enum receiver now also offers the System.ValueType /
+        // System.Enum instance members it inherits (CompareTo, HasFlag, ...), all of which compile.
+        var inherited = new List<ISymbol>();
+        for (var b = type.BaseType; b is not null && b.SpecialType != SpecialType.System_Object; b = b.BaseType)
+            inherited.AddRange(b.GetMembers().Where(m => !m.IsStatic));
+        return type.GetMembers().Concat(inherited)
             .Where(m => m.CanBeReferencedByName && !m.IsImplicitlyDeclared)
             // NotApplicable covers members (e.g. some BCL/special members) that carry no explicit accessibility but are referenceable.
             .Where(m => m.DeclaredAccessibility == Accessibility.Public || m.DeclaredAccessibility == Accessibility.NotApplicable)

src/Server/ZB.MOM.WW.OtOpcUa.Host/Configuration/ScriptingOptionsBinding.cs

@@ -0,0 +1,23 @@
+using Microsoft.Extensions.Configuration;
+using ZB.MOM.WW.OtOpcUa.Core.Scripting;
+
+namespace ZB.MOM.WW.OtOpcUa.Host.Configuration;
+
+/// <summary>
+///     Binds the node-wide <c>Scripting</c> section into <see cref="ScriptingOptions"/> and clamps it
+///     (<see cref="ScriptingOptions.Sanitized"/>). One place, so <c>Program.cs</c> and its unit test bind the same
+///     way and a misspelled key cannot silently fall back to the compiled defaults unnoticed.
+/// </summary>
+public static class ScriptingOptionsBinding
+{
+    /// <summary>Binds and clamps the <c>Scripting</c> section.</summary>
+    /// <param name="configuration">The host configuration.</param>
+    /// <param name="adjustments">One line per clamped value, for the caller to log as a Warning.</param>
+    /// <returns>The clamped options; the compiled defaults when the section is absent.</returns>
+    public static ScriptingOptions Bind(IConfiguration configuration, out IReadOnlyList<string> adjustments)
+    {
+        ArgumentNullException.ThrowIfNull(configuration);
+        var bound = configuration.GetSection(ScriptingOptions.SectionName).Get<ScriptingOptions>() ?? new ScriptingOptions();
+        return bound.Sanitized(out adjustments);
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.Host/Drivers/DriverFactoryBootstrap.cs

@@ -68,6 +68,8 @@ public static class DriverFactoryBootstrap
             // The calc driver needs the root script logger so a script failure fans out onto the
             // script-logs topic; resolve it here (null on nodes without the script pipeline wired).
             var scriptRoot = sp.GetService<ZB.MOM.WW.OtOpcUa.Core.Scripting.ScriptRootLogger>();
+            // The node-wide Scripting section (bound + clamped in Program.cs); null in test graphs ⇒ defaults.
+            var scripting = sp.GetService<ZB.MOM.WW.OtOpcUa.Core.Scripting.ScriptingOptions>();
             // The Galaxy driver resolves its Gateway.ApiKeySecretRef secret: arm through the
             // shared ISecretResolver (registered unconditionally by AddZbSecrets on every node).
             var secretResolver = sp.GetRequiredService<ISecretResolver>();
@@ -84,7 +86,7 @@ public static class DriverFactoryBootstrap
             // failures; without this it writes to NullLogger in production.
             ConfigureAbTransportLogging(sp);
             Register(registry, loggerFactory, secretResolver, primaryRoleSource, ResolveAbCipDefaultTransport(sp),
-                scriptRoot);
+                scriptRoot, scripting);
             return registry;
         });
         services.AddSingleton<IDriverFactory>(sp =>
@@ -209,11 +211,12 @@ public static class DriverFactoryBootstrap
         ISecretResolver secretResolver,
         IDriverPrimaryRoleSource primaryRoleSource,
         Driver.AbCip.AbCipTransport abCipDefaultTransport,
-        ZB.MOM.WW.OtOpcUa.Core.Scripting.ScriptRootLogger? scriptRoot = null)
+        ZB.MOM.WW.OtOpcUa.Core.Scripting.ScriptRootLogger? scriptRoot = null,
+        ZB.MOM.WW.OtOpcUa.Core.Scripting.ScriptingOptions? scripting = null)
     {
         Driver.AbCip.AbCipDriverFactoryExtensions.Register(registry, loggerFactory, abCipDefaultTransport);
         Driver.AbLegacy.AbLegacyDriverFactoryExtensions.Register(registry, loggerFactory);
-        Driver.Calculation.CalculationDriverFactoryExtensions.Register(registry, loggerFactory, scriptRoot);
+        Driver.Calculation.CalculationDriverFactoryExtensions.Register(registry, loggerFactory, scriptRoot, scripting);
         Driver.FOCAS.FocasDriverFactoryExtensions.Register(registry, loggerFactory);
         Driver.Galaxy.GalaxyDriverFactoryExtensions.Register(registry, secretResolver, loggerFactory);
         Driver.Modbus.ModbusDriverFactoryExtensions.Register(registry, loggerFactory);

src/Server/ZB.MOM.WW.OtOpcUa.Host/Program.cs

@@ -365,10 +365,22 @@ if (hasDriver)
     // F8b — production virtual-tag evaluator (Roslyn-compiled scripts cached per expression).
     // Replaces the F8-default NullVirtualTagEvaluator so VirtualTagActor evaluates real user
     // scripts at runtime.
+    // Node-wide script run-guard knobs (Scripting:MaxAllocBytesPerRun / QuarantineAfterConsecutiveTimeouts /
+    // StuckOrphanQuarantineFactor). Bound once and clamped into sane ranges here, so an absurd value is a startup
+    // Warning rather than an OverflowException inside a script run. The one instance is shared by every script
+    // seam on the node: the virtual-tag evaluator below, the scripted-alarm engine (DriverHostActor, via
+    // WithOtOpcUaRuntimeActors) and every Calculation driver (DriverFactoryBootstrap).
+    var scriptingOptions = ZB.MOM.WW.OtOpcUa.Host.Configuration.ScriptingOptionsBinding.Bind(
+        builder.Configuration, out var scriptingAdjustments);
+    foreach (var adjustment in scriptingAdjustments)
+        Log.Warning("Scripting misconfiguration detected at startup: {Adjustment}", adjustment);
+    builder.Services.AddSingleton(scriptingOptions);
+
     builder.Services.AddSingleton<RoslynVirtualTagEvaluator>(sp =>
         new RoslynVirtualTagEvaluator(
             sp.GetRequiredService<ILoggerFactory>().CreateLogger<RoslynVirtualTagEvaluator>(),
-            sp.GetRequiredService<ScriptRootLogger>()));
+            sp.GetRequiredService<ScriptRootLogger>(),
+            scripting: sp.GetRequiredService<ScriptingOptions>()));
     builder.Services.AddSingleton<IVirtualTagEvaluator>(sp => sp.GetRequiredService<RoslynVirtualTagEvaluator>());
 
     // Script-log fan-out (Layer 0). The DPS publisher resolves the ActorSystem lazily so it never

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DriverHostActor.cs

@@ -54,7 +54,7 @@ namespace ZB.MOM.WW.OtOpcUa.Runtime.Drivers;
 /// and the ONLY value ingress from driver children (<see cref="DriverInstanceActor"/> wraps even a
 /// single data change in an <c>AttributeValueBatchPublished</c>). <see cref="FanCommsLossToDependencyMux"/>
 /// fabricates a batch of the same shape straight to the dependency mux, so the host neither receives nor
-/// sends the per-value <c>AttributeValuePublished</c> any more.
+/// sends a per-value message any more (the per-value record is deleted).
 /// </summary>
 public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedStash
 {
@@ -202,6 +202,20 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     private readonly IHistoryWriter _historyWriter;
     private readonly IActorRef? _virtualTagHostOverride;
     private readonly ScriptRootLogger? _scriptRootLogger;
+
+    /// <summary>Node-wide script run-guard options for the scripted-alarm engine; null ⇒ compiled defaults.</summary>
+    private readonly ScriptingOptions? _scripting;
+
+    /// <summary>
+    ///     Driver children this host has stopped (<see cref="StopChild"/>, an operator Restart) and is watching
+    ///     until they terminate. A value burst from one of them is DROPPED in <see cref="ForwardBatchToMux"/>:
+    ///     <c>Context.Stop</c> is asynchronous, so the old child keeps publishing for the rest of the apply
+    ///     handler and its own stop, and forwarding those bursts after <see cref="EvictRetainedValues"/> would
+    ///     re-retain a removed driver's last Good in the dependency mux indefinitely. Akka delivers
+    ///     <see cref="Terminated"/> after the last message the watched child sent here, so removing the entry
+    ///     there bounds the set without ever dropping a live incarnation's values.
+    /// </summary>
+    private readonly HashSet<IActorRef> _retiredChildren = new();
     private readonly IActorRef? _scriptedAlarmHostOverride;
     private readonly ILoggingAdapter _log = Context.GetLogger();
 
@@ -264,6 +278,11 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// from <see cref="PushDesiredSubscriptions"/>.</summary>
     private IActorRef? _scriptedAlarmHost;
 
+    /// <summary>The scripted-alarm plans last sent to <see cref="_scriptedAlarmHost"/>, re-sent when it reports a
+    /// supervision restart (<see cref="ScriptedAlarmHostActor.ScriptedAlarmHostRestarted"/>). Null until the
+    /// first apply.</summary>
+    private IReadOnlyList<EquipmentScriptedAlarmPlan>? _lastScriptedAlarmPlans;
+
     private RevisionHash? _currentRevision;
 
     /// <summary>
@@ -641,8 +660,6 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// VirtualTag host instead of spawning a real <see cref="VirtualTagHostActor"/> child, so tests
     /// can intercept the <see cref="VirtualTagHostActor.ApplyVirtualTags"/> message. Null in
     /// production (the real host is spawned).</param>
-    /// <param name="loggerFactory">Retained for constructor-signature stability; unused since the
-    /// <c>EfAlarmConditionStateStore</c> fallback that consumed it was retired. Defaults to null.</param>
     /// <param name="scriptRootLogger">Optional root script logger required to spawn the ScriptedAlarm
     /// host (the engine + its script logging hang off it). When null the ScriptedAlarm host is left
     /// unspawned — the graceful dev/None-deployment path.</param>
@@ -694,6 +711,8 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// capture to a mesh-partner Primary the cluster failure detector reports unreachable.</param>
     /// <param name="historyUpdateRoleView">Where the OPC UA HistoryUpdate verdict is published for the node manager's
     /// HistoryUpdate Primary gate. Null on nodes that wire no redundancy manager.</param>
+    /// <param name="scripting">The node-wide <c>Scripting</c> run-guard options handed to the scripted-alarm
+    /// engine. Null ⇒ the compiled defaults.</param>
     /// <returns>The Akka.NET <see cref="Akka.Actor.Props"/> used to spawn this actor.</returns>
     public static Props Props(
         IDbContextFactory<OtOpcUaConfigDbContext>? dbFactory,
@@ -707,7 +726,6 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         IVirtualTagEvaluator? virtualTagEvaluator = null,
         IHistoryWriter? historyWriter = null,
         IActorRef? virtualTagHostOverride = null,
-        ILoggerFactory? loggerFactory = null,
         ScriptRootLogger? scriptRootLogger = null,
         IActorRef? scriptedAlarmHostOverride = null,
         IDriverCapabilityInvokerFactory? invokerFactory = null,
@@ -728,7 +746,8 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         Func<CommonsNodeId, bool>? sharesAlarmQueueWithLocal = null,
         TimeSpan? applyOutcomeTimeout = null,
         bool captureWhilePrimaryUnreachable = true,
-        IHistoryUpdateRoleView? historyUpdateRoleView = null) =>
+        IHistoryUpdateRoleView? historyUpdateRoleView = null,
+        ScriptingOptions? scripting = null) =>
         // WARNING: this forwarding list is POSITIONAL, and Props.Create compiles it into an
         // expression tree. Six IActorRef? parameters and several interface-typed ones mean a
         // mis-ordered argument is usually type-compatible and therefore compiles clean, then binds
@@ -737,11 +756,12 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         Akka.Actor.Props.Create(() => new DriverHostActor(
             dbFactory, localNode, ackRouter, driverFactory, localRoles, dependencyMux, opcUaPublishActor,
             healthPublisher, virtualTagEvaluator, historyWriter, virtualTagHostOverride,
-            loggerFactory, scriptRootLogger, scriptedAlarmHostOverride, invokerFactory, driverMemberCountProvider,
+            scriptRootLogger, scriptedAlarmHostOverride, invokerFactory, driverMemberCountProvider,
             deploymentArtifactCache, redundancyRoleView, replicationPeerHost, fetchAndCacheMode, artifactFetcher,
             alarmStateStore, telemetryHub, primaryRoleSource, historizationRoleView,
             sharesHistorizationScopeWithLocal, applyWedgeTimeout, reprovisionBackoff, commsRecoveryAuditDelay,
-            sharesAlarmQueueWithLocal, applyOutcomeTimeout, captureWhilePrimaryUnreachable, historyUpdateRoleView));
+            sharesAlarmQueueWithLocal, applyOutcomeTimeout, captureWhilePrimaryUnreachable, historyUpdateRoleView,
+            scripting));
 
     /// <summary>Initializes a new DriverHostActor with the specified dependencies.</summary>
     /// <param name="dbFactory">Database context factory for configuration database access.</param>
@@ -760,8 +780,6 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// for historized VirtualTag results; defaults to <see cref="NullHistoryWriter"/>.</param>
     /// <param name="virtualTagHostOverride">Test seam: when supplied, used as the VirtualTag host
     /// instead of spawning a real <see cref="VirtualTagHostActor"/> child.</param>
-    /// <param name="loggerFactory">Retained for constructor-signature stability; unused since the
-    /// <c>EfAlarmConditionStateStore</c> fallback that consumed it was retired. Defaults to null.</param>
     /// <param name="scriptRootLogger">Optional root script logger required to spawn the ScriptedAlarm
     /// host; when null the host is left unspawned.</param>
     /// <param name="scriptedAlarmHostOverride">Test seam: when supplied, used as the ScriptedAlarm host
@@ -830,6 +848,8 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// (<see cref="PrimaryGatePolicy.ShouldServeHistoryUpdate"/> — the data-plane verdict, but closed until the first
     /// redundancy snapshot) is published for the node manager's HistoryUpdate Primary gate. Null on nodes that wire no
     /// redundancy manager.</param>
+    /// <param name="scripting">The node-wide <c>Scripting</c> run-guard options handed to the scripted-alarm
+    /// engine. Null ⇒ the compiled defaults.</param>
     public DriverHostActor(
         IDbContextFactory<OtOpcUaConfigDbContext>? dbFactory,
         CommonsNodeId localNode,
@@ -842,7 +862,6 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         IVirtualTagEvaluator? virtualTagEvaluator = null,
         IHistoryWriter? historyWriter = null,
         IActorRef? virtualTagHostOverride = null,
-        ILoggerFactory? loggerFactory = null,
         ScriptRootLogger? scriptRootLogger = null,
         IActorRef? scriptedAlarmHostOverride = null,
         IDriverCapabilityInvokerFactory? invokerFactory = null,
@@ -863,8 +882,10 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         Func<CommonsNodeId, bool>? sharesAlarmQueueWithLocal = null,
         TimeSpan? applyOutcomeTimeout = null,
         bool captureWhilePrimaryUnreachable = true,
-        IHistoryUpdateRoleView? historyUpdateRoleView = null)
+        IHistoryUpdateRoleView? historyUpdateRoleView = null,
+        ScriptingOptions? scripting = null)
     {
+        _scripting = scripting;
         _captureWhilePrimaryUnreachable = captureWhilePrimaryUnreachable;
         _historyUpdateRoleView = historyUpdateRoleView;
         _applyOutcomeTimeout = applyOutcomeTimeout ?? DefaultApplyOutcomeTimeout;
@@ -1146,8 +1167,9 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     ///     null and ApplyScriptedAlarms becomes a no-op. The engine is built around a fresh
     ///     <see cref="DependencyMuxTagUpstreamSource"/> + the wired <see cref="IAlarmStateStore"/> (the
     ///     replicated <c>LocalDbAlarmConditionStateStore</c> on a driver-role node); when no store was
-    ///     wired the host is skipped. The host (spawned as a child) owns + disposes the engine in its
-    ///     PostStop, so it stops with the driver host.
+    ///     wired the host is skipped. The host is spawned through the factory <c>Props</c>, so EACH
+    ///     incarnation (a supervision restart included) builds, owns and disposes its own engine; it stops
+    ///     with the driver host.
     /// </summary>
     private void SpawnScriptedAlarmHost()
     {
@@ -1178,13 +1200,23 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
             return;
         }
 
+        // Factory Props: every incarnation of the host (a supervision restart included) builds and owns a fresh
+        // (upstream, engine) pair, so a restart never reuses an engine the previous incarnation disposed or left
+        // half-loaded. The closure captures locals only; it runs in the child's constructor.
         var store = _alarmStateStore;
-        var upstream = new DependencyMuxTagUpstreamSource();
-        var engine = new ScriptedAlarmEngine(
-            upstream, store, new ScriptLoggerFactory(_scriptRootLogger.Logger), _scriptRootLogger.Logger);
+        var scriptLogger = _scriptRootLogger.Logger;
+        var scripting = _scripting;
         _scriptedAlarmHost = Context.ActorOf(
             ScriptedAlarmHostActor.Props(
-                _opcUaPublishActor, _dependencyMux, upstream, engine, _localNode, telemetryHub: _telemetryHub),
+                _opcUaPublishActor, _dependencyMux,
+                () =>
+                {
+                    var upstream = new DependencyMuxTagUpstreamSource();
+                    var engine = new ScriptedAlarmEngine(
+                        upstream, store, new ScriptLoggerFactory(scriptLogger), scriptLogger, scripting: scripting);
+                    return (upstream, engine);
+                },
+                _localNode, telemetryHub: _telemetryHub),
             "scripted-alarm-host");
     }
 
@@ -1500,6 +1532,8 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         Receive<ApplyWedged>(HandleApplyWedged);
         Receive<GetDiagnostics>(HandleGetDiagnostics);
         Receive<DriverInstanceActor.AttributeValueBatchPublished>(ForwardBatchToMux);
+        Receive<Terminated>(OnRetiredChildTerminated);
+        Receive<ScriptedAlarmHostActor.ScriptedAlarmHostRestarted>(_ => HandleScriptedAlarmHostRestarted());
         Receive<DriverInstanceActor.AttributeAlarmPublished>(ForwardNativeAlarm);
         Receive<DriverInstanceActor.ConnectivityChanged>(OnDriverConnectivityChanged);
         Receive<CommsRecoveryAudit>(HandleCommsRecoveryAudit);
@@ -1562,6 +1596,8 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         Receive<ApplyWedged>(HandleApplyWedged);
         Receive<GetDiagnostics>(HandleGetDiagnostics);
         Receive<DriverInstanceActor.AttributeValueBatchPublished>(ForwardBatchToMux);
+        Receive<Terminated>(OnRetiredChildTerminated);
+        Receive<ScriptedAlarmHostActor.ScriptedAlarmHostRestarted>(_ => HandleScriptedAlarmHostRestarted());
         Receive<DriverInstanceActor.AttributeAlarmPublished>(ForwardNativeAlarm);
         Receive<DriverInstanceActor.ConnectivityChanged>(OnDriverConnectivityChanged);
         Receive<CommsRecoveryAudit>(HandleCommsRecoveryAudit);
@@ -1606,6 +1642,16 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     /// </summary>
     private void ForwardBatchToMux(DriverInstanceActor.AttributeValueBatchPublished msg)
     {
+        // A burst from an incarnation this host already stopped: forwarding it would undo the SourceRemoved
+        // eviction (see _retiredChildren). Its ConnectivityChanged is NOT filtered — the respawn path relies on
+        // that Bad fan to cover the gap.
+        if (_retiredChildren.Contains(Sender))
+        {
+            _log.Debug("DriverHost {Node}: dropped a {Count}-item value burst from a stopped incarnation of {Id}",
+                _localNode, msg.Items.Count, msg.DriverInstanceId);
+            return;
+        }
+
         // One envelope per burst; the mux filters per item (it registered a batch receive).
         _dependencyMux?.Tell(msg);
 
@@ -2501,6 +2547,8 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         Receive<DriverInstanceActor.AttributeValueBatchPublished>(m =>
             _log.Debug("DriverHost {Node}: dropping a {Count}-item value burst from {Id} while Stale (no address space)",
                 _localNode, m.Items.Count, m.DriverInstanceId));
+        Receive<Terminated>(OnRetiredChildTerminated);
+        Receive<ScriptedAlarmHostActor.ScriptedAlarmHostRestarted>(_ => HandleScriptedAlarmHostRestarted());
         Receive<DriverInstanceActor.AttributeAlarmPublished>(m =>
             _log.Debug("DriverHost {Node}: dropping a native alarm transition ({Cond}) from {Id} while Stale",
                 _localNode, m.Args.ConditionId, m.DriverInstanceId));
@@ -3652,6 +3700,7 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         // (re)loads its engine + re-registers mux interest for the union of dependency refs. Covers
         // both the fresh-apply and bootstrap-restore paths (both call this method); the Stale-recovery
         // path deliberately does not, matching driver + VirtualTag recovery.
+        _lastScriptedAlarmPlans = composition.EquipmentScriptedAlarms;
         _scriptedAlarmHost?.Tell(new ScriptedAlarmHostActor.ApplyScriptedAlarms(composition.EquipmentScriptedAlarms));
         if (composition.EquipmentScriptedAlarms.Count > 0)
         {
@@ -3816,8 +3865,10 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
     {
         if (!_children.TryGetValue(driverInstanceId, out var entry)) return;
         StopDependencyAdapter(driverInstanceId);
+        RetireChild(entry.Actor);
         Context.Stop(entry.Actor);
         _children.Remove(driverInstanceId);
+        EvictRetainedValues(driverInstanceId);
         // The instance left the plan (StopChild is only reached via plan.ToStop), so its cached
         // Health/Resilience snapshots must not replay to new telemetry subscribers. Release the shared
         // resilience state FIRST: the resilience publisher re-emits the tracker's snapshots every tick, so
@@ -3836,6 +3887,56 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
         _log.Info("DriverHost {Node}: stopped driver child {Id}", _localNode, driverInstanceId);
     }
 
+    /// <summary>
+    ///     Tells the dependency mux to drop every retained value this driver instance produced, so a stopped
+    ///     driver's last Good is never replayed to a later replay-opting subscriber as if it were current. Sent
+    ///     wherever a driver OBJECT ends: a deploy removal, the stop half of a config-change respawn
+    ///     (<see cref="StopChild"/>) and an operator Restart (a new driver object). Deliberately NOT sent on a
+    ///     supervision restart (<see cref="HandleReprovisionRequested"/>): that re-uses the same driver, whose last value is
+    ///     still its current one. Sent before any respawn, on the same host→mux pair the new incarnation's
+    ///     values travel, so the eviction is ordered ahead of them.
+    /// </summary>
+    /// <remarks>
+    ///     The stopped child keeps publishing until it actually terminates, and for a REMOVED driver nothing
+    ///     would ever overwrite a value re-retained after this eviction (it never publishes again, and its
+    ///     PostStop Bad fan resolves no refs once the apply has rebuilt the index without it). So the caller
+    ///     also <see cref="RetireChild"/>s it, and <see cref="ForwardBatchToMux"/> drops every burst from a
+    ///     retired child.
+    /// </remarks>
+    /// <param name="driverInstanceId">The driver instance that ended.</param>
+    private void EvictRetainedValues(string driverInstanceId) =>
+        _dependencyMux?.Tell(new DependencyMuxActor.SourceRemoved(driverInstanceId));
+
+    /// <summary>Marks a child this host is about to stop as retired and watches it until it terminates.</summary>
+    /// <param name="child">The child being stopped.</param>
+    private void RetireChild(IActorRef child)
+    {
+        _retiredChildren.Add(child);
+        Context.Watch(child);
+    }
+
+    /// <summary>
+    ///     The scripted-alarm host was restarted by supervision and has an empty engine: re-send the last plans so
+    ///     its inputs and operator commands work again without waiting for the next deploy. Only the CURRENT host's
+    ///     signal is honoured.
+    /// </summary>
+    private void HandleScriptedAlarmHostRestarted()
+    {
+        if (_scriptedAlarmHost is null || !Sender.Equals(_scriptedAlarmHost)) return;
+        if (_lastScriptedAlarmPlans is null)
+        {
+            _log.Debug("DriverHost {Node}: ScriptedAlarm host restarted before any apply; nothing to re-send", _localNode);
+            return;
+        }
+        _log.Warning("DriverHost {Node}: ScriptedAlarm host was restarted by supervision; re-applying {Count} scripted alarm(s)",
+            _localNode, _lastScriptedAlarmPlans.Count);
+        _scriptedAlarmHost.Tell(new ScriptedAlarmHostActor.ApplyScriptedAlarms(_lastScriptedAlarmPlans));
+    }
+
+    /// <summary>A retired child has terminated; nothing more can arrive from it.</summary>
+    /// <param name="msg">The termination notice.</param>
+    private void OnRetiredChildTerminated(Terminated msg) => _retiredChildren.Remove(msg.ActorRef);
+
     private static string ActorNameFor(string driverInstanceId, long generation)
     {
         // Akka actor names cannot contain '/', ':', or whitespace. Mangle defensively. The monotonic
@@ -3881,8 +3982,12 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers, IWithUnboundedS
 
         // Stop the existing child actor — DriverInstanceActor.PostStop calls ShutdownAsync.
         StopDependencyAdapter(msg.DriverInstanceId);
+        RetireChild(entry.Actor);
         Context.Stop(entry.Actor);
         _children.Remove(msg.DriverInstanceId);
+        // An operator Restart builds a NEW driver object, so the old one's retained values are evicted like a
+        // removal's; the respawned driver republishes its own.
+        EvictRetainedValues(msg.DriverInstanceId);
         // The old incarnation's health must not read as the new one's until it publishes its own.
         _healthPublisher.Forget(msg.DriverInstanceId);
 

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DriverInstanceActor.cs

@@ -108,21 +108,16 @@ public sealed class DriverInstanceActor : ReceiveActor, IWithTimers
     ///     state — a no-op when already Reconnecting or Connecting.
     /// </summary>
     public sealed record ForceReconnect;
-    /// <summary>One driver-published value. <b>No production sender remains</b> — the subscription path
-    /// batches every data change into an <see cref="AttributeValueBatchPublished"/>, and the comms-loss fan
-    /// (<c>DriverHostActor.FanCommsLossToDependencyMux</c>), which was the last sender to fabricate this
-    /// message, now fabricates a batch too. The dependency mux still accepts it for tests and direct senders.
+    /// <summary>One value within an <see cref="AttributeValueBatchPublished"/>.
     /// <para><paramref name="StatusCode"/> is the driver's full OPC UA status code including its sub-code
     /// — not a severity bucket. Classify it with <see cref="OpcUaStatus.IsGood"/> and friends rather
-    /// than comparing it to <see cref="OpcUaStatus.Good"/>.</para></summary>
-    public sealed record AttributeValuePublished(string DriverInstanceId, string FullReference, object? Value, uint StatusCode, DateTime TimestampUtc);
-    /// <summary>One value within an <see cref="AttributeValueBatchPublished"/>.
+    /// than comparing it to <see cref="OpcUaStatus.Good"/>.</para>
     /// <para>A struct deliberately: an <c>AttributeValueItem[]</c> then holds its items inline, so a burst of
     /// N values costs one array allocation instead of one array plus N boxes. Indexed access through
     /// <see cref="IReadOnlyList{T}"/> does not box.</para></summary>
     public readonly record struct AttributeValueItem(string FullReference, object? Value, uint StatusCode, DateTime TimestampUtc);
-    /// <summary>Batched form of <see cref="AttributeValuePublished"/> — every changed attribute of ONE
-    /// driver production burst in one message. The parent fans the whole batch to the mux and the OPC UA
+    /// <summary>The ONLY value message a driver child sends: every changed attribute of ONE driver production
+    /// burst in one message (a single data change is a one-item batch). The parent fans the whole batch to the mux and the OPC UA
     /// publish path in one hop each. Status codes ride verbatim.</summary>
     public sealed record AttributeValueBatchPublished(string DriverInstanceId, IReadOnlyList<AttributeValueItem> Items);
     private sealed record DataChangeForward(string FullReference, DataValueSnapshot Snapshot);
@@ -132,7 +127,7 @@ public sealed class DriverInstanceActor : ReceiveActor, IWithTimers
     private sealed record DataChangeBatchForward(IReadOnlyList<DataChangeItem> Items);
     /// <summary>Published to the parent whenever the subscribed driver (an <see cref="IAlarmSource"/>) fires
     /// <see cref="IAlarmSource.OnAlarmEvent"/>. The parent (<see cref="DriverHostActor"/>) projects + routes it
-    /// to the materialised Part 9 condition. Parallels <see cref="AttributeValuePublished"/>.</summary>
+    /// to the materialised Part 9 condition. Parallels <see cref="AttributeValueBatchPublished"/>.</summary>
     public sealed record AttributeAlarmPublished(string DriverInstanceId, AlarmEventArgs Args);
     private sealed record NativeAlarmRaised(AlarmEventArgs Args);
     /// <summary>Self-sent on Connected entry / when alarm refs are (re)pushed, to establish the native-alarm

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/ScriptedAlarms/ScriptedAlarmHostActor.cs

@@ -86,6 +86,21 @@ public sealed class ScriptedAlarmHostActor : ReceiveActor
     /// <param name="Plans">The desired Equipment-namespace scripted-alarm plans.</param>
     public sealed record ApplyScriptedAlarms(IReadOnlyList<EquipmentScriptedAlarmPlan> Plans);
 
+    /// <summary>
+    ///     Told to the parent from <see cref="PostRestart"/>. A supervision restart is otherwise invisible to the
+    ///     parent, and the new incarnation has an EMPTY engine (factory Props) and no mux interest, so until the
+    ///     next <see cref="ApplyScriptedAlarms"/> its inputs stop and every operator command is dropped as not
+    ///     owned. The parent (<c>DriverHostActor</c>) answers by re-sending the last plans it applied, mirroring
+    ///     how a driver child's <c>ReprovisionRequested</c> is answered.
+    /// </summary>
+    public sealed class ScriptedAlarmHostRestarted
+    {
+        /// <summary>The single instance.</summary>
+        public static readonly ScriptedAlarmHostRestarted Instance = new();
+
+        private ScriptedAlarmHostRestarted() { }
+    }
+
     /// <summary>Marshals an engine emission off the engine's worker thread onto the actor thread.
     /// Carries the <see cref="ScriptedAlarmEvent"/> the engine raised on <c>OnEvent</c>.</summary>
     private sealed record EngineEmission(ScriptedAlarmEvent Event);
@@ -384,9 +399,10 @@ public sealed class ScriptedAlarmHostActor : ReceiveActor
         // subscriptions exist, so any DependencyValueChanged the mux delivers will be observed by the
         // engine. RegisterInterest replaces a subscriber's prior interest set (see DependencyMuxActor),
         // so a re-Apply with a fresh union simply supersedes the old one — no explicit unregister needed.
-        // ReplayRetained: the mux replays the last value it saw for each ref, so a fresh engine (a
-        // supervision restart builds one around an EMPTY upstream) converges immediately instead of
-        // waiting for every input to change again.
+        // ReplayRetained: the mux replays the last value it saw for each ref, so a freshly loaded engine
+        // converges immediately instead of waiting for every input to change again. That includes the engine
+        // a supervision restart builds around an EMPTY upstream, but only once the parent has re-sent
+        // ApplyScriptedAlarms in answer to ScriptedAlarmHostRestarted (PostRestart); nothing reloads it before.
         _mux?.Tell(new DependencyMuxActor.RegisterInterest(msg.DepRefs, Self, ReplayRetained: true));
         // Prune the upstream's retained snapshots to the loaded set (R02:L3): a path no alarm references
         // any more will never be pushed again, so its last value is dead weight for the process lifetime.
@@ -791,6 +807,15 @@ public sealed class ScriptedAlarmHostActor : ReceiveActor
         base.PreRestart(reason, message);
     }
 
+    /// <inheritdoc />
+    /// <remarks>Tells the parent <see cref="ScriptedAlarmHostRestarted"/> so it re-sends the last
+    /// <see cref="ApplyScriptedAlarms"/>: the new incarnation has nothing loaded and no mux interest.</remarks>
+    protected override void PostRestart(Exception reason)
+    {
+        base.PostRestart(reason);
+        Context.Parent.Tell(ScriptedAlarmHostRestarted.Instance);
+    }
+
     /// <inheritdoc />
     protected override void PostStop()
     {

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/ServiceCollectionExtensions.cs

@@ -609,7 +609,6 @@ public static class ServiceCollectionExtensions
                     healthPublisher: healthPublisher,
                     virtualTagEvaluator: virtualTagEvaluator,
                     historyWriter: historyWriter,
-                    loggerFactory: loggerFactory,
                     scriptRootLogger: scriptRootLogger,
                     invokerFactory: invokerFactory,
                     deploymentArtifactCache: deploymentArtifactCache,
@@ -638,7 +637,10 @@ public static class ServiceCollectionExtensions
                     sharesAlarmQueueWithLocal: BuildAlarmQueuePeerPredicate(
                         resolver.GetService<IConfiguration>(), roleInfo, replicationPeerHost),
                     // The HistoryUpdate verdict (closed until the first redundancy snapshot).
-                    historyUpdateRoleView: resolver.GetService<IHistoryUpdateRoleView>()),
+                    historyUpdateRoleView: resolver.GetService<IHistoryUpdateRoleView>(),
+                    // The node-wide Scripting section (bound + clamped in Program.cs) for the scripted-alarm
+                    // engine. Unbound in test graphs ⇒ null ⇒ the compiled defaults.
+                    scripting: resolver.GetService<ScriptingOptions>()),
                 DriverHostActorName);
             registry.Register<DriverHostActorKey>(driverHost);
 

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/VirtualTags/DependencyMuxActor.cs

@@ -15,11 +15,9 @@ namespace ZB.MOM.WW.OtOpcUa.Runtime.VirtualTags;
 ///     DriverHostActor forwards driver-child value publishes to this mux (one mux per driver-role
 ///     node). The ONLY driver ingress is the batched
 ///     <see cref="DriverInstanceActor.AttributeValueBatchPublished"/> — one envelope per driver
-///     production burst, which the mux filters per item. The per-value
-///     <see cref="DriverInstanceActor.AttributeValuePublished"/> receive has <b>no production sender left
-///     at all</b>: the comms-loss fan (<c>DriverHostActor.FanCommsLossToDependencyMux</c>) was its last
-///     one and now fabricates an <c>AttributeValueBatchPublished</c> instead. The receive is kept for
-///     tests and direct senders — treat it as dead in production.
+///     production burst, which the mux filters per item. The comms-loss fan
+///     (<c>DriverHostActor.FanCommsLossToDependencyMux</c>) fabricates one too. There is no per-value
+///     ingress: a single value is a one-item batch (tests build one with <c>ValuePublishes.Single</c>).
 ///
 ///     <b>The mux emits ONLY batches</b>, so a subscriber's
 ///     batch receive is its complete hot path. Every subscriber keeps a per-value
@@ -52,11 +50,9 @@ namespace ZB.MOM.WW.OtOpcUa.Runtime.VirtualTags;
 ///         <b>Source removal.</b> The mux records which driver instance last published each retained ref;
 ///         <see cref="SourceRemoved"/> evicts every value that driver produced, so a removed driver's last
 ///         Good is never replayed as current. A comms-loss fan (a Bad batch) already overwrites the retained
-///         value with Bad. ⚠️ As of fix round 1 no production actor sends <see cref="SourceRemoved"/> yet —
-///         <c>DriverHostActor</c> (outside the scripting lane) must Tell it when it stops / removes a driver
-///         child. Until then a removed driver's last value can still be replayed to a replay-opting
-///         subscriber that re-registers for that ref while another replay-opting subscriber holds it, or
-///         within the grace window.
+///         value with Bad. <c>DriverHostActor</c> sends <see cref="SourceRemoved"/> wherever a driver object
+///         ends (a deploy removal, the stop half of a config-change respawn, an operator Restart), and never
+///         on a supervision restart, which re-uses the same driver.
 ///     </para>
 /// </summary>
 public sealed class DependencyMuxActor : ReceiveActor, IWithTimers
@@ -154,7 +150,6 @@ public sealed class DependencyMuxActor : ReceiveActor, IWithTimers
         Receive<UnregisterInterest>(msg => RemoveSubscriber(msg.Subscriber));
         Receive<SourceRemoved>(OnSourceRemoved);
         Receive<SweepReleased>(_ => OnSweep());
-        Receive<DriverInstanceActor.AttributeValuePublished>(OnAttributeValuePublished);
         Receive<DriverInstanceActor.AttributeValueBatchPublished>(OnAttributeValueBatchPublished);
         Receive<Terminated>(msg => RemoveSubscriber(msg.ActorRef));
     }
@@ -265,30 +260,6 @@ public sealed class DependencyMuxActor : ReceiveActor, IWithTimers
         _log.Debug("DependencyMux: source {Driver} removed — evicted {Count} retained value(s)", msg.DriverInstanceId, evicted);
     }
 
-    private void OnAttributeValuePublished(DriverInstanceActor.AttributeValuePublished msg)
-    {
-        if (!_byRef.TryGetValue(msg.FullReference, out var entry))
-        {
-            // Nothing is registered for (or retaining) this ref — drop. Common in normal operation; the address
-            // space carries thousands of tags and only a fraction feed virtual-tag expressions.
-            return;
-        }
-        var dep = new VirtualTagActor.DependencyValueChanged(msg.FullReference, msg.Value, msg.TimestampUtc, msg.StatusCode);
-        if (entry.Retains)
-        {
-            entry.Last = dep;
-            entry.LastSource = msg.DriverInstanceId;
-        }
-        foreach (var sub in entry.Subscribers)
-        {
-            // A single-item batch, so the mux emits exactly ONE message shape and every subscriber needs
-            // only the batch receive on its hot path. One list per subscriber: batch ownership transfers
-            // to the receiver, so a shared list must never cross mailboxes. Nothing in production reaches
-            // this path (see the class doc) — the extra allocation is noise on a test-only seam.
-            sub.Tell(new VirtualTagActor.DependencyValueBatch(new[] { dep }));
-        }
-    }
-
     private void OnAttributeValueBatchPublished(DriverInstanceActor.AttributeValueBatchPublished msg)
     {
         // Nothing registered and nothing retained — skip the whole burst rather than probing an empty map per item.