feat(v3-batch4-wp4): multi-notifier native alarms (single ReportEvent → raw + equipment notifiers) + teardown symmetry

Materialize each native alarm ONCE at the raw tag (ConditionId = RawPath, Raw realm); wire the single condition as an SDK event notifier of each referencing equipment's UNS folder so one ReportEvent fans to every root without re-reporting per root (which would break Server-object dedup + Part 9 ack correlation). - New sink method WireAlarmNotifiers(alarmNodeId, alarmRealm, notifierFolderNodeIds, notifierFolderRealm) on IOpcUaAddressSpaceSink, forwarded through DeferredAddressSpaceSink + SdkAddressSpaceSink + NullOpcUaAddressSpaceSink (the forwarding-trap guard); auto-covered by the DeferredSinkForwardingReflectionTests realm + forwarding guards + a hand-written forward test. - OtOpcUaNodeManager: the normative AddNotifier(isInverse) pair + idempotent EnsureFolderIsEventNotifier per equipment folder; tracked per condition in _alarmNotifierWiring. Teardown symmetry: RemoveNotifier(bidirectional:true) on RebuildAddressSpace, RemoveAlarmConditionNode, and RemoveEquipmentSubtree so no inverse-notifier entry leaks across redeploys. - AddressSpaceApplier.MaterialiseRawSubtree wires notifiers for each native alarm tag, resolving its ReferencingEquipmentPaths (Area/Line/Equipment) to the EquipmentId folder NodeIds via BuildEquipmentIdByFolderPath. - AlarmTransitionEvent gains ReferencingEquipmentPaths (empty default); /alerts renders the referencing-equipment list as display metadata. - Un-skipped + rewrote the native-alarm dark tests (DriverHostActorNativeAlarmTests x6, DriverHostActorNativeAlarmAckRoutingTests x1) for the v3 raw-condition model; new NodeManagerMultiNotifierAlarmTests proves multi-notifier wiring + teardown symmetry (no leaked duplicates after a re-trip) + applier wiring test. Claude-Session: https://claude.ai/code/session_01LVneM3eh1UtJxEisFXgmox
2026-07-16 12:07:11 -04:00
parent 9d09523675
commit 8ebc712eff
21 changed files with 744 additions and 182 deletions
@@ -189,6 +189,7 @@ public sealed class AddressSpaceApplierFailureSurfaceTests
        }

        public void RaiseNodesAddedModelChange(string affectedNodeId, AddressSpaceRealm realm = AddressSpaceRealm.Uns) { }
+        public void WireAlarmNotifiers(string alarmNodeId, AddressSpaceRealm alarmRealm, IReadOnlyList<string> notifierFolderNodeIds, AddressSpaceRealm notifierFolderRealm) { }
        public void AddReference(string sourceNodeId, AddressSpaceRealm sourceRealm, string targetNodeId, AddressSpaceRealm targetRealm, string referenceType = "Organizes") { }
    }
 }
@@ -338,6 +338,7 @@ public sealed class AddressSpaceApplierHierarchyTests : IDisposable
        public void RebuildAddressSpace() { }
        /// <summary>Announces a NodeAdded model-change (stub implementation for testing).</summary>
        public void RaiseNodesAddedModelChange(string affectedNodeId, AddressSpaceRealm realm = AddressSpaceRealm.Uns) { }
+        public void WireAlarmNotifiers(string alarmNodeId, AddressSpaceRealm alarmRealm, IReadOnlyList<string> notifierFolderNodeIds, AddressSpaceRealm notifierFolderRealm) { }
        public void AddReference(string sourceNodeId, AddressSpaceRealm sourceRealm, string targetNodeId, AddressSpaceRealm targetRealm, string referenceType = "Organizes") { }
    }
 }
@@ -107,6 +107,49 @@ public sealed class AddressSpaceApplierRawUnsTests
        c.Parent.ShouldBe("Plant/A/dev");
        c.Realm.ShouldBe(AddressSpaceRealm.Raw);
        c.IsNative.ShouldBeTrue();
+        // No referencing equipment ⇒ no multi-notifier wiring.
+        sink.NotifierWirings.ShouldBeEmpty();
+    }
+
+    [Fact]
+    public void MaterialiseRawSubtree_alarm_tag_wires_a_notifier_per_referencing_equipment_folder()
+    {
+        var sink = new RealmRecordingSink();
+        // UNS topology so the alarm's referencing-equipment PATHS (Area/Line/Equipment) resolve to the
+        // EquipmentId the equipment folders were materialised under. Two equipment reference the one alarm tag.
+        var composition = new AddressSpaceComposition(
+            new[] { new UnsAreaProjection("a1", "filling") },
+            new[] { new UnsLineProjection("l1", "a1", "line1"), new UnsLineProjection("l2", "a1", "line2") },
+            new[]
+            {
+                new EquipmentNode("EQ-1", "station1", "l1"),
+                new EquipmentNode("EQ-2", "station2", "l2"),
+            },
+            Array.Empty<DriverInstancePlan>(),
+            Array.Empty<ScriptedAlarmPlan>())
+        {
+            RawTags = new[]
+            {
+                new RawTagPlan("t1", "Plant/A/dev/OverTemp", "Plant/A/dev", "drv", "OverTemp", "Boolean",
+                    Writable: false, Alarm: new EquipmentTagAlarmInfo("OffNormalAlarm", 700),
+                    // The composer emits Area/Line/Equipment NAME paths here.
+                    ReferencingEquipmentPaths: new[] { "filling/line1/station1", "filling/line2/station2" }),
+            },
+        };
+
+        NewApplier(sink).MaterialiseRawSubtree(composition);
+
+        // The single condition is materialised ONCE at the RawPath (Raw realm)...
+        var c = sink.Conditions.ShouldHaveSingleItem();
+        c.NodeId.ShouldBe("Plant/A/dev/OverTemp");
+        c.Realm.ShouldBe(AddressSpaceRealm.Raw);
+        // ...and wired as a notifier of BOTH referencing equipment folders — resolved from the name paths to the
+        // logical EquipmentId folder NodeIds, in the Uns realm. ONE wiring call (single condition), not per-root.
+        var w = sink.NotifierWirings.ShouldHaveSingleItem();
+        w.AlarmNodeId.ShouldBe("Plant/A/dev/OverTemp");
+        w.AlarmRealm.ShouldBe(AddressSpaceRealm.Raw);
+        w.FolderRealm.ShouldBe(AddressSpaceRealm.Uns);
+        w.FolderNodeIds.ShouldBe(new[] { "EQ-1", "EQ-2" }, ignoreOrder: true);
    }

    [Fact]
@@ -156,6 +199,7 @@ public sealed class AddressSpaceApplierRawUnsTests
        public List<(string NodeId, string? Parent, bool Writable, string? HistorianTagname, AddressSpaceRealm Realm)> Variables { get; } = new();
        public List<(string NodeId, string? Parent, bool IsNative, AddressSpaceRealm Realm)> Conditions { get; } = new();
        public List<(string Source, AddressSpaceRealm SourceRealm, string Target, AddressSpaceRealm TargetRealm, string ReferenceType)> References { get; } = new();
+        public List<(string AlarmNodeId, AddressSpaceRealm AlarmRealm, IReadOnlyList<string> FolderNodeIds, AddressSpaceRealm FolderRealm)> NotifierWirings { get; } = new();

        public void EnsureFolder(string folderNodeId, string? parentNodeId, string displayName, AddressSpaceRealm realm)
            => Folders.Add((folderNodeId, parentNodeId, realm));
@@ -166,6 +210,9 @@ public sealed class AddressSpaceApplierRawUnsTests
        public void MaterialiseAlarmCondition(string alarmNodeId, string equipmentNodeId, string displayName, string alarmType, int severity, AddressSpaceRealm realm, bool isNative = false)
            => Conditions.Add((alarmNodeId, equipmentNodeId, isNative, realm));

+        public void WireAlarmNotifiers(string alarmNodeId, AddressSpaceRealm alarmRealm, IReadOnlyList<string> notifierFolderNodeIds, AddressSpaceRealm notifierFolderRealm)
+            => NotifierWirings.Add((alarmNodeId, alarmRealm, notifierFolderNodeIds, notifierFolderRealm));
+
        public void AddReference(string sourceNodeId, AddressSpaceRealm sourceRealm, string targetNodeId, AddressSpaceRealm targetRealm, string referenceType = "Organizes")
            => References.Add((sourceNodeId, sourceRealm, targetNodeId, targetRealm, referenceType));

@@ -2307,6 +2307,7 @@ public sealed class AddressSpaceApplierTests
        /// <summary>Records a NodeAdded model-change announcement.</summary>
        /// <param name="affectedNodeId">The node under which discovered nodes were added.</param>
        public void RaiseNodesAddedModelChange(string affectedNodeId, AddressSpaceRealm realm = AddressSpaceRealm.Uns) => ModelChangeQueue.Enqueue(affectedNodeId);
+        public void WireAlarmNotifiers(string alarmNodeId, AddressSpaceRealm alarmRealm, IReadOnlyList<string> notifierFolderNodeIds, AddressSpaceRealm notifierFolderRealm) { }
        public void AddReference(string sourceNodeId, AddressSpaceRealm sourceRealm, string targetNodeId, AddressSpaceRealm targetRealm, string referenceType = "Organizes") { }
    }

@@ -2332,6 +2333,7 @@ public sealed class AddressSpaceApplierTests
        public void RebuildAddressSpace() => Interlocked.Increment(ref RebuildCalls);
        /// <summary>No-op NodeAdded model-change announcement.</summary>
        public void RaiseNodesAddedModelChange(string affectedNodeId, AddressSpaceRealm realm = AddressSpaceRealm.Uns) { }
+        public void WireAlarmNotifiers(string alarmNodeId, AddressSpaceRealm alarmRealm, IReadOnlyList<string> notifierFolderNodeIds, AddressSpaceRealm notifierFolderRealm) { }
        public void AddReference(string sourceNodeId, AddressSpaceRealm sourceRealm, string targetNodeId, AddressSpaceRealm targetRealm, string referenceType = "Organizes") { }
    }

@@ -2381,6 +2383,7 @@ public sealed class AddressSpaceApplierTests
        public void RebuildAddressSpace() { }
        /// <summary>No-op NodeAdded model-change announcement.</summary>
        public void RaiseNodesAddedModelChange(string affectedNodeId, AddressSpaceRealm realm = AddressSpaceRealm.Uns) { }
+        public void WireAlarmNotifiers(string alarmNodeId, AddressSpaceRealm alarmRealm, IReadOnlyList<string> notifierFolderNodeIds, AddressSpaceRealm notifierFolderRealm) { }
        public void AddReference(string sourceNodeId, AddressSpaceRealm sourceRealm, string targetNodeId, AddressSpaceRealm targetRealm, string referenceType = "Organizes") { }
    }
 }
@@ -249,6 +249,7 @@ public sealed class DeferredAddressSpaceSinkTests
        public void RebuildAddressSpace() => CallQueue.Enqueue("RB");
        /// <inheritdoc />
        public void RaiseNodesAddedModelChange(string affectedNodeId, AddressSpaceRealm realm = AddressSpaceRealm.Uns) => CallQueue.Enqueue($"NA:{affectedNodeId}");
+        public void WireAlarmNotifiers(string alarmNodeId, AddressSpaceRealm alarmRealm, IReadOnlyList<string> notifierFolderNodeIds, AddressSpaceRealm notifierFolderRealm) { }
        public void AddReference(string sourceNodeId, AddressSpaceRealm sourceRealm, string targetNodeId, AddressSpaceRealm targetRealm, string referenceType = "Organizes") { }
    }

@@ -299,6 +300,7 @@ public sealed class DeferredAddressSpaceSinkTests
        public void RebuildAddressSpace() { }
        /// <inheritdoc />
        public void RaiseNodesAddedModelChange(string affectedNodeId, AddressSpaceRealm realm = AddressSpaceRealm.Uns) { }
+        public void WireAlarmNotifiers(string alarmNodeId, AddressSpaceRealm alarmRealm, IReadOnlyList<string> notifierFolderNodeIds, AddressSpaceRealm notifierFolderRealm) { }
        public void AddReference(string sourceNodeId, AddressSpaceRealm sourceRealm, string targetNodeId, AddressSpaceRealm targetRealm, string referenceType = "Organizes") { }
    }
 }
@@ -0,0 +1,216 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
+
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests;
+
+/// <summary>
+///     v3 Batch 4 (B4-WP4) — the native-alarm <b>multi-notifier</b> wiring +
+///     <b>teardown symmetry</b> on <see cref="OtOpcUaNodeManager"/>. A native alarm is a SINGLE Part 9
+///     condition materialised once at its raw tag (ConditionId = RawPath, Raw realm);
+///     <see cref="OtOpcUaNodeManager.WireAlarmNotifiers"/> wires that one condition as an event notifier of
+///     EACH referencing equipment's UNS folder so one <c>ReportEvent</c> fans one event to every referencing
+///     equipment (never re-reported per root). The obligation these tests lock in: the wiring is idempotent,
+///     a missing folder is a safe skip, and every teardown path (condition-removal / equipment-subtree-removal
+///     / full rebuild + re-wire) removes the notifier pair BIDIRECTIONALLY so no inverse-notifier entry leaks
+///     across redeploys (exactly N notifiers after a re-trip, not 2N).
+/// </summary>
+public sealed class NodeManagerMultiNotifierAlarmTests : IDisposable
+{
+    private static CancellationToken Ct => TestContext.Current.CancellationToken;
+
+    private const string RawAlarm = "Plant/Modbus/dev1/temp_hi";
+    private const string RawDeviceFolder = "Plant/Modbus/dev1";
+    private const string Equip1 = "EQ-filling-line1-station1";
+    private const string Equip2 = "EQ-filling-line2-station2";
+
+    private readonly string _pkiRoot = Path.Combine(
+        Path.GetTempPath(),
+        $"otopcua-multi-notifier-{Guid.NewGuid():N}");
+
+    /// <summary>Materialise the raw device folder + the single native condition + two equipment folders, then
+    /// wire the condition as a notifier of both. Returns the node manager.</summary>
+    private async Task<(OpcUaApplicationHost Host, OtOpcUaNodeManager Nm)> BootWithTwoEquipmentAsync()
+    {
+        var (host, server) = await BootAsync();
+        var nm = server.NodeManager!;
+        // Raw device folder (the condition's HasComponent parent) + the single native condition at the RawPath.
+        nm.EnsureFolder(RawDeviceFolder, parentNodeId: null, displayName: "dev1", realm: AddressSpaceRealm.Raw);
+        nm.MaterialiseAlarmCondition(RawAlarm, RawDeviceFolder, "temp_hi", "OffNormalAlarm", 700, isNative: true, realm: AddressSpaceRealm.Raw);
+        // Two referencing equipment folders (UNS realm).
+        nm.EnsureFolder(Equip1, parentNodeId: null, displayName: "station1", realm: AddressSpaceRealm.Uns);
+        nm.EnsureFolder(Equip2, parentNodeId: null, displayName: "station2", realm: AddressSpaceRealm.Uns);
+        return (host, nm);
+    }
+
+    /// <summary>The single condition is wired as a notifier of EACH referencing equipment folder: the condition
+    /// carries one inverse-notifier entry per folder, each folder carries the inverse back to the condition, and
+    /// each folder becomes a root (Server-object) event notifier.</summary>
+    [Trait("Category", "Unit")]
+    [Fact]
+    public async Task WireAlarmNotifiers_wires_the_single_condition_to_each_equipment_folder()
+    {
+        var (host, nm) = await BootWithTwoEquipmentAsync();
+
+        nm.WireAlarmNotifiers(RawAlarm, AddressSpaceRealm.Raw, new[] { Equip1, Equip2 }, AddressSpaceRealm.Uns);
+
+        // One inverse-notifier entry per equipment folder on the single condition.
+        nm.AlarmNotifierCount(RawAlarm, AddressSpaceRealm.Raw).ShouldBe(2);
+        // Each equipment folder holds the inverse entry back to the condition + is a root notifier.
+        nm.FolderNotifierCount(Equip1, AddressSpaceRealm.Uns).ShouldBe(1);
+        nm.FolderNotifierCount(Equip2, AddressSpaceRealm.Uns).ShouldBe(1);
+        nm.IsRootNotifier(Equip1, AddressSpaceRealm.Uns).ShouldBeTrue();
+        nm.IsRootNotifier(Equip2, AddressSpaceRealm.Uns).ShouldBeTrue();
+
+        await host.DisposeAsync();
+    }
+
+    /// <summary>Re-wiring the SAME pairs (an idempotent re-apply of the raw subtree pass) does not duplicate the
+    /// notifier entries — the SDK dedups by node reference and the tracking dedups its list.</summary>
+    [Trait("Category", "Unit")]
+    [Fact]
+    public async Task WireAlarmNotifiers_is_idempotent_no_duplicate_on_re_wire()
+    {
+        var (host, nm) = await BootWithTwoEquipmentAsync();
+
+        nm.WireAlarmNotifiers(RawAlarm, AddressSpaceRealm.Raw, new[] { Equip1, Equip2 }, AddressSpaceRealm.Uns);
+        nm.WireAlarmNotifiers(RawAlarm, AddressSpaceRealm.Raw, new[] { Equip1, Equip2 }, AddressSpaceRealm.Uns);
+        nm.WireAlarmNotifiers(RawAlarm, AddressSpaceRealm.Raw, new[] { Equip1, Equip2 }, AddressSpaceRealm.Uns);
+
+        nm.AlarmNotifierCount(RawAlarm, AddressSpaceRealm.Raw).ShouldBe(2);
+        nm.FolderNotifierCount(Equip1, AddressSpaceRealm.Uns).ShouldBe(1);
+        nm.FolderNotifierCount(Equip2, AddressSpaceRealm.Uns).ShouldBe(1);
+
+        await host.DisposeAsync();
+    }
+
+    /// <summary>A referencing equipment folder that is not (yet) materialised is skipped (no throw); the present
+    /// folders are still wired. A missing condition is likewise a no-op.</summary>
+    [Trait("Category", "Unit")]
+    [Fact]
+    public async Task WireAlarmNotifiers_missing_folder_or_condition_is_a_safe_skip()
+    {
+        var (host, nm) = await BootWithTwoEquipmentAsync();
+
+        // "EQ-missing" was never materialised — it is skipped; Equip1 is still wired.
+        nm.WireAlarmNotifiers(RawAlarm, AddressSpaceRealm.Raw, new[] { Equip1, "EQ-missing" }, AddressSpaceRealm.Uns);
+        nm.AlarmNotifierCount(RawAlarm, AddressSpaceRealm.Raw).ShouldBe(1);
+        nm.FolderNotifierCount(Equip1, AddressSpaceRealm.Uns).ShouldBe(1);
+
+        // An unmaterialised condition id is a no-op (never throws).
+        Should.NotThrow(() =>
+            nm.WireAlarmNotifiers("Plant/Modbus/dev1/does_not_exist", AddressSpaceRealm.Raw, new[] { Equip1 }, AddressSpaceRealm.Uns));
+
+        await host.DisposeAsync();
+    }
+
+    /// <summary>Removing the condition in place (surgical raw-alarm-tag removal) tears the notifier pairs down
+    /// BIDIRECTIONALLY: the surviving equipment folders lose their inverse-notifier entry back to the removed
+    /// condition (no dangling reference).</summary>
+    [Trait("Category", "Unit")]
+    [Fact]
+    public async Task RemoveAlarmConditionNode_unwires_notifiers_from_surviving_folders()
+    {
+        var (host, nm) = await BootWithTwoEquipmentAsync();
+        nm.WireAlarmNotifiers(RawAlarm, AddressSpaceRealm.Raw, new[] { Equip1, Equip2 }, AddressSpaceRealm.Uns);
+        nm.FolderNotifierCount(Equip1, AddressSpaceRealm.Uns).ShouldBe(1);
+
+        nm.RemoveAlarmConditionNode(RawAlarm, AddressSpaceRealm.Raw).ShouldBeTrue();
+
+        // Condition gone; the surviving equipment folders no longer reference it (bidirectional teardown).
+        nm.TryGetAlarmCondition(RawAlarm, AddressSpaceRealm.Raw).ShouldBeNull();
+        nm.FolderNotifierCount(Equip1, AddressSpaceRealm.Uns).ShouldBe(0);
+        nm.FolderNotifierCount(Equip2, AddressSpaceRealm.Uns).ShouldBe(0);
+
+        await host.DisposeAsync();
+    }
+
+    /// <summary>Removing one referencing equipment's subtree unwires ONLY that folder from the surviving raw
+    /// condition (which lives in the Raw realm and is untouched by a UNS subtree removal): the condition drops
+    /// exactly one notifier and keeps the other.</summary>
+    [Trait("Category", "Unit")]
+    [Fact]
+    public async Task RemoveEquipmentSubtree_unwires_only_that_folder_from_surviving_condition()
+    {
+        var (host, nm) = await BootWithTwoEquipmentAsync();
+        nm.WireAlarmNotifiers(RawAlarm, AddressSpaceRealm.Raw, new[] { Equip1, Equip2 }, AddressSpaceRealm.Uns);
+        nm.AlarmNotifierCount(RawAlarm, AddressSpaceRealm.Raw).ShouldBe(2);
+
+        nm.RemoveEquipmentSubtree(Equip1, AddressSpaceRealm.Uns).ShouldBeTrue();
+
+        // The raw condition SURVIVES (Raw realm) and now notifies only the remaining equipment folder.
+        nm.TryGetAlarmCondition(RawAlarm, AddressSpaceRealm.Raw).ShouldNotBeNull();
+        nm.AlarmNotifierCount(RawAlarm, AddressSpaceRealm.Raw).ShouldBe(1);
+        nm.FolderNotifierCount(Equip2, AddressSpaceRealm.Uns).ShouldBe(1);
+        nm.IsRootNotifier(Equip2, AddressSpaceRealm.Uns).ShouldBeTrue();
+
+        await host.DisposeAsync();
+    }
+
+    /// <summary>Teardown-symmetry / "exactly one copy after a re-trip": a full rebuild + re-materialise +
+    /// re-wire leaves EXACTLY the same notifier count (2), not a doubled/leaked set — the rebuild unwired the
+    /// prior notifier pairs bidirectionally before dropping the nodes.</summary>
+    [Trait("Category", "Unit")]
+    [Fact]
+    public async Task Rebuild_then_rewire_has_no_leaked_notifier_duplicates()
+    {
+        var (host, nm) = await BootWithTwoEquipmentAsync();
+        nm.WireAlarmNotifiers(RawAlarm, AddressSpaceRealm.Raw, new[] { Equip1, Equip2 }, AddressSpaceRealm.Uns);
+        nm.AlarmNotifierCount(RawAlarm, AddressSpaceRealm.Raw).ShouldBe(2);
+
+        // Redeploy (the full-rebuild path).
+        nm.RebuildAddressSpace();
+        nm.TryGetAlarmCondition(RawAlarm, AddressSpaceRealm.Raw).ShouldBeNull();
+
+        // Re-materialise the whole thing + re-wire (what the applier does every apply).
+        nm.EnsureFolder(RawDeviceFolder, parentNodeId: null, displayName: "dev1", realm: AddressSpaceRealm.Raw);
+        nm.MaterialiseAlarmCondition(RawAlarm, RawDeviceFolder, "temp_hi", "OffNormalAlarm", 700, isNative: true, realm: AddressSpaceRealm.Raw);
+        nm.EnsureFolder(Equip1, parentNodeId: null, displayName: "station1", realm: AddressSpaceRealm.Uns);
+        nm.EnsureFolder(Equip2, parentNodeId: null, displayName: "station2", realm: AddressSpaceRealm.Uns);
+        nm.WireAlarmNotifiers(RawAlarm, AddressSpaceRealm.Raw, new[] { Equip1, Equip2 }, AddressSpaceRealm.Uns);
+
+        // Exactly 2 again — no leaked inverse-notifier entries carried across the rebuild.
+        nm.AlarmNotifierCount(RawAlarm, AddressSpaceRealm.Raw).ShouldBe(2);
+        nm.FolderNotifierCount(Equip1, AddressSpaceRealm.Uns).ShouldBe(1);
+        nm.FolderNotifierCount(Equip2, AddressSpaceRealm.Uns).ShouldBe(1);
+
+        await host.DisposeAsync();
+    }
+
+    private async Task<(OpcUaApplicationHost Host, OtOpcUaSdkServer Server)> BootAsync()
+    {
+        var host = new OpcUaApplicationHost(
+            new OpcUaApplicationHostOptions
+            {
+                ApplicationName = "OtOpcUa.MultiNotifierTest",
+                ApplicationUri = $"urn:OtOpcUa.MultiNotifierTest:{Guid.NewGuid():N}",
+                OpcUaPort = AllocateFreePort(),
+                PublicHostname = "localhost",
+                PkiStoreRoot = _pkiRoot,
+            },
+            Microsoft.Extensions.Logging.Abstractions.NullLogger<OpcUaApplicationHost>.Instance);
+
+        var server = new OtOpcUaSdkServer();
+        await host.StartAsync(server, Ct);
+        return (host, server);
+    }
+
+    private static int AllocateFreePort()
+    {
+        using var listener = new System.Net.Sockets.TcpListener(System.Net.IPAddress.Loopback, 0);
+        listener.Start();
+        var port = ((System.Net.IPEndPoint)listener.LocalEndpoint).Port;
+        listener.Stop();
+        return port;
+    }
+
+    /// <summary>Cleans up the PKI root directory.</summary>
+    public void Dispose()
+    {
+        if (Directory.Exists(_pkiRoot))
+        {
+            try { Directory.Delete(_pkiRoot, recursive: true); }
+            catch { /* best-effort cleanup */ }
+        }
+    }
+}
@@ -346,6 +346,7 @@ public sealed class DiscoveryInjectionEndToEndTests : RuntimeActorTestBase

        /// <summary>Records a NodeAdded model-change announcement.</summary>
        public void RaiseNodesAddedModelChange(string affectedNodeId, AddressSpaceRealm realm = AddressSpaceRealm.Uns) => _modelChanges.Enqueue(affectedNodeId);
+        public void WireAlarmNotifiers(string alarmNodeId, AddressSpaceRealm alarmRealm, IReadOnlyList<string> notifierFolderNodeIds, AddressSpaceRealm notifierFolderRealm) { }
        public void AddReference(string sourceNodeId, AddressSpaceRealm sourceRealm, string targetNodeId, AddressSpaceRealm targetRealm, string referenceType = "Organizes") { }
    }
 }
@@ -19,21 +19,22 @@ using ZB.MOM.WW.OtOpcUa.Runtime.Tests.Harness;
 namespace ZB.MOM.WW.OtOpcUa.Runtime.Tests.Drivers;

 /// <summary>
-///     Verifies the inbound native-condition <b>acknowledge</b> routing wired into
-///     <see cref="DriverHostActor"/> (H6d): an OPC UA client Acknowledges a NATIVE condition, the
-///     node manager invokes <c>NativeAlarmAckRouter</c>, and the host (NEXT task) Tells a
-///     <see cref="DriverHostActor.RouteNativeAlarmAck"/> in. The host resolves the condition NodeId →
-///     owning <c>(DriverInstanceId, FullName)</c> via the <c>_driverRefByAlarmNodeId</c> inverse map
-///     (built alongside the alarm forward map in <c>PushDesiredSubscriptions</c>), applies the SAME
+///     v3 Batch 4 (B4-WP4) — the inbound native-condition <b>acknowledge</b> routing wired into
+///     <see cref="DriverHostActor"/> re-expressed for the v3 raw-condition model. An OPC UA client Acknowledges
+///     a NATIVE condition (materialised at the raw tag, ConditionId = its RawPath); the node manager invokes
+///     <c>NativeAlarmAckRouter</c> and the host receives a <see cref="DriverHostActor.RouteNativeAlarmAck"/>.
+///     The host resolves the condition NodeId (== the RawPath) → owning <c>(DriverInstanceId, RawPath)</c> via
+///     the <c>_driverRefByAlarmNodeId</c> inverse map (built alongside the alarm forward map in
+///     <c>PushDesiredSubscriptions</c> from the alarm-bearing <c>composition.RawTags</c>), applies the SAME
 ///     primary gate the inbound write path uses, and routes to the owning driver child's
 ///     <see cref="IAlarmSource.AcknowledgeAsync"/> carrying the principal.
 ///
 ///     <para>
-///         Mirrors <c>DriverHostActorWriteRoutingTests</c>: a real apply through the existing harness
-///         spawns a real (non-stubbed) <see cref="DriverInstanceActor"/> child backed by a recording
-///         <see cref="IAlarmSource"/> driver, so the inverse map is populated authentically and the
-///         forwarded acknowledge request can be observed. The seeded tag carries an <c>alarm</c> object so
-///         it materialises as a Part 9 condition (folder-scoped condition NodeId), not a value variable.
+///         Mirrors <c>DriverHostActorLiveValueTests</c>: a real apply through the harness spawns a real
+///         (non-stubbed) <see cref="DriverInstanceActor"/> child backed by a recording <see cref="IAlarmSource"/>
+///         driver (DriverType "GalaxyMxGateway", Enabled), so the inverse map is populated authentically and the
+///         forwarded acknowledge request can be observed. The seeded raw tag carries an <c>alarm</c> object so it
+///         materialises as a Part 9 condition at its RawPath, not a value variable.
 ///     </para>
 /// </summary>
 public sealed class DriverHostActorNativeAlarmAckRoutingTests : RuntimeActorTestBase
@@ -42,31 +43,31 @@ public sealed class DriverHostActorNativeAlarmAckRoutingTests : RuntimeActorTest
    private static readonly RevisionHash RevA = RevisionHash.Parse(new string('a', 64));
    private static readonly TimeSpan Timeout = TimeSpan.FromSeconds(5);

-    /// <summary>On the PRIMARY (role unknown ⇒ Primary), a RouteNativeAlarmAck for a mapped condition NodeId
-    /// forwards exactly one <see cref="AlarmAcknowledgeRequest"/> to the owning driver's
-    /// <see cref="IAlarmSource.AcknowledgeAsync"/>, with <c>ConditionId == FullName</c>, the operator
-    /// principal, and the comment.</summary>
-    [Fact(Skip = DarkAddressSpaceReasons.EquipmentTagsDarkBatch4)]
+    // The v3 RawPath for the seeded alarm tag: RawFolder "Plant" / DriverName "gw" / Device "dev1" / Tag.
+    private const string AlarmRawPath = "Plant/gw/dev1/temp_hi";
+
+    /// <summary>On the PRIMARY (role unknown ⇒ Primary), a RouteNativeAlarmAck for a mapped raw condition NodeId
+    /// (== the RawPath) forwards exactly one <see cref="AlarmAcknowledgeRequest"/> to the owning driver's
+    /// <see cref="IAlarmSource.AcknowledgeAsync"/>, correlated on the RawPath, with the operator principal + the
+    /// comment.</summary>
+    [Fact]
    public void RouteNativeAlarmAck_routes_to_driver_AcknowledgeAsync_with_principal()
    {
        var db = NewInMemoryDbFactory();
        var recorder = new RecordingAlarmDriverFactory("GalaxyMxGateway");
-        // One alarm-bearing equipment tag: eq-1, drv-1, FullName "Temp.HiHi", no folder, Name "temp_hi"
-        // → condition NodeId "eq-1/temp_hi".
-        var deploymentId = SeedDeploymentWithAlarmTag(db, RevA,
-            Equip: "eq-1", Driver: "drv-1", FullName: "Temp.HiHi", Folder: null, Name: "temp_hi");
+        var deploymentId = SeedV3AlarmDeployment(db, RevA, Driver: "drv-1", Tag: "temp_hi");

        var actor = SpawnHostAndApply(db, deploymentId, recorder);

        // Local role unknown ⇒ treated as Primary ⇒ ack allowed (default-allow semantics).
-        actor.Tell(new DriverHostActor.RouteNativeAlarmAck("eq-1/temp_hi", "cmt", "alice"));
+        actor.Tell(new DriverHostActor.RouteNativeAlarmAck(AlarmRawPath, "cmt", "alice"));

-        // The driver received exactly one acknowledge, correlated on its wire-ref FullName, with principal.
+        // The driver received exactly one acknowledge, correlated on its wire-ref RawPath, with principal.
        AwaitAssert(() =>
        {
            recorder.Acks.Count.ShouldBe(1);
-            recorder.Acks[0].ConditionId.ShouldBe("Temp.HiHi");
-            recorder.Acks[0].SourceNodeId.ShouldBe("Temp.HiHi");
+            recorder.Acks[0].ConditionId.ShouldBe(AlarmRawPath);
+            recorder.Acks[0].SourceNodeId.ShouldBe(AlarmRawPath);
            recorder.Acks[0].Comment.ShouldBe("cmt");
            recorder.Acks[0].OperatorUser.ShouldBe("alice");
        }, duration: Timeout);
@@ -79,27 +80,24 @@ public sealed class DriverHostActorNativeAlarmAckRoutingTests : RuntimeActorTest
    {
        var db = NewInMemoryDbFactory();
        var recorder = new RecordingAlarmDriverFactory("GalaxyMxGateway");
-        var deploymentId = SeedDeploymentWithAlarmTag(db, RevA,
-            Equip: "eq-1", Driver: "drv-1", FullName: "Temp.HiHi", Folder: null, Name: "temp_hi");
+        var deploymentId = SeedV3AlarmDeployment(db, RevA, Driver: "drv-1", Tag: "temp_hi");

        var actor = SpawnHostAndApply(db, deploymentId, recorder);

-        actor.Tell(new DriverHostActor.RouteNativeAlarmAck("eq-1/does-not-exist", "cmt", "alice"));
+        actor.Tell(new DriverHostActor.RouteNativeAlarmAck("Plant/gw/dev1/does-not-exist", "cmt", "alice"));

        // Give the (fire-and-forget) handler time to run; the unmapped node must produce no ack.
        AwaitAssert(() => recorder.Acks.ShouldBeEmpty(), duration: TimeSpan.FromMilliseconds(800));
    }

    /// <summary>On a SECONDARY node the ack is gated off (same primary gate as the inbound write path): the
-    /// driver's <see cref="IAlarmSource.AcknowledgeAsync"/> is NOT called — a secondary keeps its address
-    /// space warm but must not push commands to the shared upstream alarm system.</summary>
+    /// driver's <see cref="IAlarmSource.AcknowledgeAsync"/> is NOT called.</summary>
    [Fact]
    public void RouteNativeAlarmAck_on_non_primary_is_dropped()
    {
        var db = NewInMemoryDbFactory();
        var recorder = new RecordingAlarmDriverFactory("GalaxyMxGateway");
-        var deploymentId = SeedDeploymentWithAlarmTag(db, RevA,
-            Equip: "eq-1", Driver: "drv-1", FullName: "Temp.HiHi", Folder: null, Name: "temp_hi");
+        var deploymentId = SeedV3AlarmDeployment(db, RevA, Driver: "drv-1", Tag: "temp_hi");

        var actor = SpawnHostAndApply(db, deploymentId, recorder);

@@ -112,7 +110,7 @@ public sealed class DriverHostActorNativeAlarmAckRoutingTests : RuntimeActorTest
            },
            CorrelationId.NewId()));

-        actor.Tell(new DriverHostActor.RouteNativeAlarmAck("eq-1/temp_hi", "cmt", "alice"));
+        actor.Tell(new DriverHostActor.RouteNativeAlarmAck(AlarmRawPath, "cmt", "alice"));

        // No ack reached the driver — the gate short-circuited before the inverse-map lookup.
        AwaitAssert(() => recorder.Acks.ShouldBeEmpty(), duration: TimeSpan.FromMilliseconds(800));
@@ -137,51 +135,48 @@ public sealed class DriverHostActorNativeAlarmAckRoutingTests : RuntimeActorTest
    }

    /// <summary>
-    ///     Seeds a Sealed deployment whose artifact carries one alarm-bearing equipment tag: the tag's
-    ///     <c>TagConfig</c> carries both a <c>FullName</c> and an <c>alarm</c> object so
-    ///     <c>DeploymentArtifact.ExtractTagAlarm</c> projects a non-null <c>EquipmentTagAlarmInfo</c> —
-    ///     making the tag a condition (folder-scoped condition NodeId) rather than a value variable. The
-    ///     <c>DriverInstances</c> row carries a non-Windows-only <c>DriverType</c> ("GalaxyMxGateway") + an
-    ///     Enabled flag so a REAL (non-stubbed) <see cref="DriverInstanceActor"/> child is spawned.
+    ///     Seeds a Sealed deployment whose artifact carries the v3 raw-tag chain (RawFolder "Plant" →
+    ///     DriverInstance(RawFolderId, Name "gw", DriverType "GalaxyMxGateway", Enabled) → Device "dev1" → Tag)
+    ///     with the tag's <c>TagConfig</c> carrying an <c>alarm</c> object so the composer projects a non-null
+    ///     <c>EquipmentTagAlarmInfo</c> — making the raw tag a Part 9 condition at its RawPath. The non-Windows
+    ///     <c>DriverType</c> + Enabled flag spawn a REAL <see cref="DriverInstanceActor"/> child.
    /// </summary>
-    private static DeploymentId SeedDeploymentWithAlarmTag(
-        IDbContextFactory<OtOpcUaConfigDbContext> db, RevisionHash rev,
-        string Equip, string Driver, string FullName, string? Folder, string Name)
+    private static DeploymentId SeedV3AlarmDeployment(
+        IDbContextFactory<OtOpcUaConfigDbContext> db, RevisionHash rev, string Driver, string Tag)
    {
        var artifact = JsonSerializer.SerializeToUtf8Bytes(new
        {
-            Namespaces = new[]
-            {
-                new { NamespaceId = "ns-eq", Kind = 0 }, // NamespaceKind.Equipment = 0
-            },
+            RawFolders = new[] { new { RawFolderId = "rf-plant", ParentRawFolderId = (string?)null, Name = "Plant", ClusterId = "c1" } },
            DriverInstances = new[]
            {
                new
                {
                    DriverInstanceRowId = Guid.NewGuid(),
                    DriverInstanceId = Driver,
-                    Name = Driver,
+                    RawFolderId = "rf-plant",
+                    Name = "gw",
                    DriverType = "GalaxyMxGateway", // not Windows-only ⇒ a real child is spawned (not stubbed)
                    Enabled = true,
                    DriverConfig = "{}",
-                    NamespaceId = "ns-eq",
+                    ClusterId = "c1",
                },
            },
+            Devices = new[]
+            {
+                new { DeviceId = $"{Driver}:dev1", DriverInstanceId = Driver, Name = "dev1", DeviceConfig = "{}" },
+            },
+            TagGroups = Array.Empty<object>(),
            Tags = new[]
            {
                new
                {
                    TagId = "tag-0",
-                    EquipmentId = Equip,
-                    DriverInstanceId = Driver,
-                    Name,
-                    FolderPath = Folder,
+                    DeviceId = $"{Driver}:dev1",
+                    TagGroupId = (string?)null,
+                    Name = Tag,
                    DataType = "Boolean",
-                    TagConfig = JsonSerializer.Serialize(new
-                    {
-                        FullName,
-                        alarm = new { alarmType = "OffNormalAlarm", severity = 700 },
-                    }),
+                    AccessLevel = 0, // TagAccessLevel.Read
+                    TagConfig = JsonSerializer.Serialize(new { alarm = new { alarmType = "OffNormalAlarm", severity = 700 } }),
                },
            },
        });
@@ -24,22 +24,20 @@ using ZB.MOM.WW.OtOpcUa.Runtime.Tests.Harness;
 namespace ZB.MOM.WW.OtOpcUa.Runtime.Tests.Drivers;

 /// <summary>
-///     Verifies the equipment-tag <b>native-alarm routing</b> wired into <see cref="DriverHostActor"/>
-///     (Phase B WS-4c, the LIVE-CONDITION half): a driver child publishes a native alarm transition as
-///     <see cref="DriverInstanceActor.AttributeAlarmPublished"/> keyed by the alarm source's
-///     <c>SourceNodeId</c> (the equipment tag's wire-ref <c>FullName</c>), but the materialised condition
-///     lives at a FOLDER-SCOPED NodeId (<c>{equipmentId}/{folderPath}/{name}</c>). After an apply, the
-///     host's <c>_alarmNodeIdByDriverRef</c> map (built only from alarm-bearing EquipmentTags) resolves
-///     <c>(DriverInstanceId, SourceNodeId)</c> to that NodeId, the <c>NativeAlarmProjector</c> projects
-///     the transition into a full <c>AlarmConditionSnapshot</c>, and <c>ForwardNativeAlarm</c> Tells the
-///     publish actor an <see cref="OpcUaPublishActor.AlarmStateUpdate"/> — the same message scripted
-///     alarms use.
+///     v3 Batch 4 (B4-WP4) — the equipment-tag <b>native-alarm routing</b> wired into
+///     <see cref="DriverHostActor"/> re-expressed for the v3 raw-condition model. A native alarm is a SINGLE
+///     Part 9 condition materialised at the RAW tag (ConditionId = its RawPath, Raw realm) — NOT a folder-scoped
+///     equipment-tag NodeId. After an apply, the host's <c>_alarmNodeIdByDriverRef</c> map (built from the
+///     alarm-bearing <c>composition.RawTags</c>) resolves <c>(DriverInstanceId, RawPath)</c> to the raw
+///     condition NodeId, the <c>NativeAlarmProjector</c> projects the transition into a full
+///     <c>AlarmConditionSnapshot</c>, and <c>ForwardNativeAlarm</c> Tells the publish actor a single
+///     <see cref="OpcUaPublishActor.AlarmStateUpdate"/> (Raw realm) — the fan-out to referencing equipment
+///     happens at the SDK-notifier level (WP4 node-manager wiring), NOT by re-reporting per root.
 ///
 ///     <para>
-///         Mirrors the value-routing harness in <c>DriverHostActorLiveValueTests</c>: the seeded artifact
-///         carries the <c>Namespaces</c> / <c>DriverInstances</c> / <c>Tags</c> arrays, with each alarm
-///         tag's <c>TagConfig</c> carrying an <c>alarm</c> object so
-///         <c>DeploymentArtifact.ExtractTagAlarm</c> projects a non-null
+///         Mirrors the v3 value-routing harness in <c>DriverHostActorLiveValueTests</c>: the seeded artifact
+///         carries the v3 raw-tag chain (RawFolder → DriverInstance(RawFolderId) → Device → Tag) with the alarm
+///         tag's <c>TagConfig</c> carrying an <c>alarm</c> object so the composer projects a non-null
 ///         <c>EquipmentTagAlarmInfo</c>. The OPC UA sink + dependency mux are injected as TestProbes.
 ///     </para>
 /// </summary>
@@ -49,25 +47,26 @@ public sealed class DriverHostActorNativeAlarmTests : RuntimeActorTestBase
    private static readonly RevisionHash RevA = RevisionHash.Parse(new string('a', 64));
    private static readonly DateTime Ts = new(2026, 6, 14, 10, 0, 0, DateTimeKind.Utc);

-    /// <summary>A native alarm RAISE whose <c>ConditionId</c> equals the alarm tag's <c>FullName</c> lands on
-    /// the condition's folder-scoped NodeId (here <c>eq-1/temp_hi</c>) as an
+    // The v3 RawPath for the seeded alarm tag: RawFolder "Plant" / DriverName "Modbus" / Device "dev1" / Tag.
+    private const string AlarmRawPath = "Plant/Modbus/dev1/temp_hi";
+
+    /// <summary>A native alarm RAISE whose <c>ConditionId</c> equals the alarm tag's RawPath (the v3 wire-ref)
+    /// lands on the RAW condition NodeId (== the RawPath, Raw realm) as an
    /// <see cref="OpcUaPublishActor.AlarmStateUpdate"/> with <c>State.Active == true</c>. The event carries a
-    /// production-shaped <c>SourceNodeId</c> (the bare owning object, distinct from <c>ConditionId</c>) so the
-    /// lookup is proven to key on <c>ConditionId</c>, not <c>SourceNodeId</c>.</summary>
-    [Fact(Skip = DarkAddressSpaceReasons.EquipmentTagsDarkBatch4)]
-    public void Native_alarm_raise_routes_to_folder_scoped_condition_NodeId_active()
+    /// distinct <c>SourceNodeId</c> so the lookup is proven to key on <c>ConditionId</c>, not
+    /// <c>SourceNodeId</c>.</summary>
+    [Fact]
+    public void Native_alarm_raise_routes_to_raw_condition_NodeId_active()
    {
        var db = NewInMemoryDbFactory();
-        // One alarm-bearing equipment tag: eq-1, drv-1, FullName "Temp.HiHi", no folder, Name "temp_hi".
-        var deploymentId = SeedDeploymentWithAlarmTag(db, RevA,
-            Equip: "eq-1", Driver: "drv-1", FullName: "Temp.HiHi", Folder: null, Name: "temp_hi");
+        var deploymentId = SeedV3AlarmDeployment(db, RevA, Driver: "drv-1", Tag: "temp_hi");

        var (actor, publish) = SpawnHostAndApply(db, deploymentId);

        actor.Tell(new DriverInstanceActor.AttributeAlarmPublished("drv-1", new AlarmEventArgs(
            new StubAlarmHandle(),
            SourceNodeId: "Temp",        // bare owning object (SourceObjectReference) — NOT the lookup key
-            ConditionId: "Temp.HiHi",    // dotted alarm full-reference = the authored FullName (the lookup key)
+            ConditionId: AlarmRawPath,   // the v3 wire-ref RawPath = the lookup key
            AlarmType: "OffNormalAlarm",
            Message: "temperature high",
            Severity: AlarmSeverity.High,
@@ -75,7 +74,8 @@ public sealed class DriverHostActorNativeAlarmTests : RuntimeActorTestBase
            Kind: AlarmTransitionKind.Raise)));

        var update = publish.ExpectMsg<OpcUaPublishActor.AlarmStateUpdate>(TimeSpan.FromSeconds(5));
-        update.AlarmNodeId.ShouldBe("eq-1/temp_hi");
+        update.AlarmNodeId.ShouldBe(AlarmRawPath);
+        update.Realm.ShouldBe(AddressSpaceRealm.Raw);
        update.State.Active.ShouldBeTrue();
        update.State.Acknowledged.ShouldBeFalse();
        update.TimestampUtc.ShouldBe(Ts);
@@ -87,35 +87,31 @@ public sealed class DriverHostActorNativeAlarmTests : RuntimeActorTestBase
    public void Unknown_alarm_ref_produces_no_AlarmStateUpdate()
    {
        var db = NewInMemoryDbFactory();
-        var deploymentId = SeedDeploymentWithAlarmTag(db, RevA,
-            Equip: "eq-1", Driver: "drv-1", FullName: "Temp.HiHi", Folder: null, Name: "temp_hi");
+        var deploymentId = SeedV3AlarmDeployment(db, RevA, Driver: "drv-1", Tag: "temp_hi");

        var (actor, publish) = SpawnHostAndApply(db, deploymentId);

        actor.Tell(new DriverInstanceActor.AttributeAlarmPublished("drv-1", new AlarmEventArgs(
            new StubAlarmHandle(),
-            SourceNodeId: "Temp",          // owning object exists, but the condition ref below is unmapped
-            ConditionId: "NoSuch.HiHi",    // dotted ref not in the alarm map ⇒ drop
+            SourceNodeId: "Temp",
+            ConditionId: "Plant/Modbus/dev1/no_such",  // unmapped RawPath ⇒ drop
            AlarmType: "OffNormalAlarm",
            Message: "nope",
            Severity: AlarmSeverity.Low,
            SourceTimestampUtc: Ts,
            Kind: AlarmTransitionKind.Raise)));

-        // No alarm-condition NodeId for ("drv-1","NoSuch.Alarm") → nothing reaches the sink.
        publish.ExpectNoMsg(TimeSpan.FromMilliseconds(500));
    }

-    /// <summary>Primary (default/unset role) fan-out (Phase B WS-5): a native alarm RAISE on a known ref
-    /// publishes exactly one <see cref="AlarmTransitionEvent"/> to the cluster <c>alerts</c> topic with
-    /// <c>AlarmId</c> = the folder-scoped condition NodeId, alongside the (ungated) OPC UA condition
-    /// update. No <see cref="RedundancyStateChanged"/> is sent, so the cached role is unknown ⇒ emit.</summary>
-    [Fact(Skip = DarkAddressSpaceReasons.EquipmentTagsDarkBatch4)]
+    /// <summary>Primary (default/unset role) fan-out: a native alarm RAISE on a known ref publishes exactly one
+    /// <see cref="AlarmTransitionEvent"/> to the cluster <c>alerts</c> topic with <c>AlarmId</c> = the raw
+    /// condition NodeId (RawPath), alongside the (ungated) OPC UA condition update.</summary>
+    [Fact]
    public void Native_alarm_publishes_AlarmTransitionEvent_to_alerts_when_primary()
    {
        var db = NewInMemoryDbFactory();
-        var deploymentId = SeedDeploymentWithAlarmTag(db, RevA,
-            Equip: "eq-1", Driver: "drv-1", FullName: "Temp.HiHi", Folder: null, Name: "temp_hi");
+        var deploymentId = SeedV3AlarmDeployment(db, RevA, Driver: "drv-1", Tag: "temp_hi");

        var alerts = CreateTestProbe();
        SubscribeToAlerts(alerts);
@@ -124,8 +120,8 @@ public sealed class DriverHostActorNativeAlarmTests : RuntimeActorTestBase

        actor.Tell(new DriverInstanceActor.AttributeAlarmPublished("drv-1", new AlarmEventArgs(
            new StubAlarmHandle(),
-            SourceNodeId: "Temp",        // bare owning object (SourceObjectReference) — NOT the lookup key
-            ConditionId: "Temp.HiHi",    // dotted alarm full-reference = the authored FullName (the lookup key)
+            SourceNodeId: "Temp",
+            ConditionId: AlarmRawPath,
            AlarmType: "OffNormalAlarm",
            Message: "temperature high",
            Severity: AlarmSeverity.High,
@@ -134,38 +130,31 @@ public sealed class DriverHostActorNativeAlarmTests : RuntimeActorTestBase

        // The OPC UA condition update is UNGATED — it must arrive.
        var update = publish.ExpectMsg<OpcUaPublishActor.AlarmStateUpdate>(TimeSpan.FromSeconds(5));
-        update.AlarmNodeId.ShouldBe("eq-1/temp_hi");
+        update.AlarmNodeId.ShouldBe(AlarmRawPath);

        // Role unknown ⇒ default-emit: exactly one AlarmTransitionEvent on the alerts topic.
        var evt = alerts.ExpectMsg<AlarmTransitionEvent>(TimeSpan.FromSeconds(5));
-        evt.AlarmId.ShouldBe("eq-1/temp_hi");          // the folder-scoped condition NodeId
-        evt.EquipmentPath.ShouldBe("eq-1");            // from the alarm-bearing tag's EquipmentId
-        evt.AlarmName.ShouldBe("temp_hi");             // from the tag's Name
+        evt.AlarmId.ShouldBe(AlarmRawPath);            // the raw condition NodeId (v3: ConditionId == RawPath)
+        evt.EquipmentPath.ShouldBe(AlarmRawPath);      // v3: the alarm meta keys the display off the RawPath
+        evt.AlarmName.ShouldBe("temp_hi");             // from the raw tag's Name
        evt.TransitionKind.ShouldBe("Activated");      // native Kind → canonical EmissionKind vocabulary (Raise → Activated)
        evt.AlarmTypeName.ShouldBe("OffNormalAlarm");  // the tag's alarm AlarmType
        evt.Severity.ShouldBe(700);                    // AlarmSeverity.High → projector 700
        evt.Message.ShouldBe("temperature high");
        evt.User.ShouldBe(string.Empty);              // no operator comment ⇒ device-origin (empty user)
-        // This tag's TagConfig.alarm carries no historizeToAveva key ⇒ null ⇒ the HistorianAdapterActor
-        // gate (historizeToAveva is not false) still historizes (default-on). Only an explicit false
-        // suppresses the durable AVEVA row — see Native_alarm_historizeToAveva_false_threads_through.
-        evt.HistorizeToAveva.ShouldBeNull();
+        evt.HistorizeToAveva.ShouldBeNull();           // absent historizeToAveva key ⇒ null ⇒ default-on
        alerts.ExpectNoMsg(TimeSpan.FromMilliseconds(300)); // exactly one
    }

-    /// <summary>Native-alarm HistorizeToAveva opt-out (Task 3): a tag whose <c>TagConfig.alarm</c> carries
+    /// <summary>Native-alarm HistorizeToAveva opt-out: a tag whose <c>TagConfig.alarm</c> carries
    /// <c>historizeToAveva: false</c> publishes its <see cref="AlarmTransitionEvent"/> with
-    /// <c>HistorizeToAveva == false</c>, so the runtime's <c>HistorianAdapterActor</c> gate
-    /// (<c>historizeToAveva is not false</c>) suppresses the durable AVEVA write — the same opt-out the
-    /// scripted-alarm plan flag drives. The live <c>/alerts</c> fan-out is unaffected (the transition still
-    /// publishes; only the durable row is gated downstream).</summary>
-    [Fact(Skip = DarkAddressSpaceReasons.EquipmentTagsDarkBatch4)]
+    /// <c>HistorizeToAveva == false</c>, so the runtime's <c>HistorianAdapterActor</c> gate suppresses the
+    /// durable AVEVA write. The live <c>/alerts</c> fan-out is unaffected.</summary>
+    [Fact]
    public void Native_alarm_historizeToAveva_false_threads_through()
    {
        var db = NewInMemoryDbFactory();
-        var deploymentId = SeedDeploymentWithAlarmTag(db, RevA,
-            Equip: "eq-1", Driver: "drv-1", FullName: "Temp.HiHi", Folder: null, Name: "temp_hi",
-            historizeToAveva: false);
+        var deploymentId = SeedV3AlarmDeployment(db, RevA, Driver: "drv-1", Tag: "temp_hi", historizeToAveva: false);

        var alerts = CreateTestProbe();
        SubscribeToAlerts(alerts);
@@ -175,7 +164,7 @@ public sealed class DriverHostActorNativeAlarmTests : RuntimeActorTestBase
        actor.Tell(new DriverInstanceActor.AttributeAlarmPublished("drv-1", new AlarmEventArgs(
            new StubAlarmHandle(),
            SourceNodeId: "Temp",
-            ConditionId: "Temp.HiHi",
+            ConditionId: AlarmRawPath,
            AlarmType: "OffNormalAlarm",
            Message: "temperature high",
            Severity: AlarmSeverity.High,
@@ -183,21 +172,17 @@ public sealed class DriverHostActorNativeAlarmTests : RuntimeActorTestBase
            Kind: AlarmTransitionKind.Raise)));

        var evt = alerts.ExpectMsg<AlarmTransitionEvent>(TimeSpan.FromSeconds(5));
-        evt.AlarmId.ShouldBe("eq-1/temp_hi");
-        // The explicit opt-out rides onto the transition ⇒ the historian gate suppresses the durable row.
+        evt.AlarmId.ShouldBe(AlarmRawPath);
        evt.HistorizeToAveva.ShouldBe(false);
    }

-    /// <summary>Native-alarm HistorizeToAveva opt-IN (Task 3): an explicit <c>historizeToAveva: true</c>
-    /// rides through as <c>true</c> (distinct from the absent ⇒ null default-on case) so an operator who
-    /// deliberately opts in is recorded as such on the transition.</summary>
-    [Fact(Skip = DarkAddressSpaceReasons.EquipmentTagsDarkBatch4)]
+    /// <summary>Native-alarm HistorizeToAveva opt-IN: an explicit <c>historizeToAveva: true</c> rides through as
+    /// <c>true</c> (distinct from the absent ⇒ null default-on case).</summary>
+    [Fact]
    public void Native_alarm_historizeToAveva_true_threads_through()
    {
        var db = NewInMemoryDbFactory();
-        var deploymentId = SeedDeploymentWithAlarmTag(db, RevA,
-            Equip: "eq-1", Driver: "drv-1", FullName: "Temp.HiHi", Folder: null, Name: "temp_hi",
-            historizeToAveva: true);
+        var deploymentId = SeedV3AlarmDeployment(db, RevA, Driver: "drv-1", Tag: "temp_hi", historizeToAveva: true);

        var alerts = CreateTestProbe();
        SubscribeToAlerts(alerts);
@@ -207,7 +192,7 @@ public sealed class DriverHostActorNativeAlarmTests : RuntimeActorTestBase
        actor.Tell(new DriverInstanceActor.AttributeAlarmPublished("drv-1", new AlarmEventArgs(
            new StubAlarmHandle(),
            SourceNodeId: "Temp",
-            ConditionId: "Temp.HiHi",
+            ConditionId: AlarmRawPath,
            AlarmType: "OffNormalAlarm",
            Message: "temperature high",
            Severity: AlarmSeverity.High,
@@ -218,16 +203,14 @@ public sealed class DriverHostActorNativeAlarmTests : RuntimeActorTestBase
        evt.HistorizeToAveva.ShouldBe(true);
    }

-    /// <summary>Secondary suppression (Phase B WS-5): when the cached local role is Secondary the host
-    /// MUST still write the local OPC UA condition node (ungated — keeps the standby's address space warm
-    /// for failover) but MUST NOT publish the cluster-wide <c>alerts</c> transition (the Primary publishes
-    /// the single fleet-wide copy).</summary>
-    [Fact(Skip = DarkAddressSpaceReasons.EquipmentTagsDarkBatch4)]
+    /// <summary>Secondary suppression: when the cached local role is Secondary the host MUST still write the
+    /// local OPC UA condition node (ungated — keeps the standby warm) but MUST NOT publish the cluster-wide
+    /// <c>alerts</c> transition (the Primary publishes the single fleet-wide copy).</summary>
+    [Fact]
    public void Secondary_node_suppresses_alerts_publish_but_still_updates_condition()
    {
        var db = NewInMemoryDbFactory();
-        var deploymentId = SeedDeploymentWithAlarmTag(db, RevA,
-            Equip: "eq-1", Driver: "drv-1", FullName: "Temp.HiHi", Folder: null, Name: "temp_hi");
+        var deploymentId = SeedV3AlarmDeployment(db, RevA, Driver: "drv-1", Tag: "temp_hi");

        var alerts = CreateTestProbe();
        SubscribeToAlerts(alerts);
@@ -239,8 +222,8 @@ public sealed class DriverHostActorNativeAlarmTests : RuntimeActorTestBase

        actor.Tell(new DriverInstanceActor.AttributeAlarmPublished("drv-1", new AlarmEventArgs(
            new StubAlarmHandle(),
-            SourceNodeId: "Temp",        // bare owning object (SourceObjectReference) — NOT the lookup key
-            ConditionId: "Temp.HiHi",    // dotted alarm full-reference = the authored FullName (the lookup key)
+            SourceNodeId: "Temp",
+            ConditionId: AlarmRawPath,
            AlarmType: "OffNormalAlarm",
            Message: "temperature high",
            Severity: AlarmSeverity.High,
@@ -249,7 +232,7 @@ public sealed class DriverHostActorNativeAlarmTests : RuntimeActorTestBase

        // The OPC UA condition update is UNGATED — it must still arrive on the secondary.
        var update = publish.ExpectMsg<OpcUaPublishActor.AlarmStateUpdate>(TimeSpan.FromSeconds(5));
-        update.AlarmNodeId.ShouldBe("eq-1/temp_hi");
+        update.AlarmNodeId.ShouldBe(AlarmRawPath);
        update.State.Active.ShouldBeTrue();

        // The cluster-wide alerts publish is gated off on the secondary.
@@ -257,27 +240,23 @@ public sealed class DriverHostActorNativeAlarmTests : RuntimeActorTestBase
    }

    /// <summary>A native alarm whose <c>AlarmEventArgs.OperatorComment</c> is set flows through
-    /// <c>DriverHostActor.ForwardNativeAlarm</c> into the published <see cref="AlarmTransitionEvent"/>:
-    /// <c>Comment</c> carries the operator string and <c>User</c> is <c>"device"</c> (a non-null comment
-    /// signals the upstream alarm system provided an operator origin, but without a specific user identity).
-    /// </summary>
-    [Fact(Skip = DarkAddressSpaceReasons.EquipmentTagsDarkBatch4)]
+    /// <c>ForwardNativeAlarm</c> into the published <see cref="AlarmTransitionEvent"/>: <c>Comment</c> carries
+    /// the operator string and <c>User</c> is <c>"device"</c>.</summary>
+    [Fact]
    public void Native_alarm_operator_comment_flows_to_transition_event()
    {
        var db = NewInMemoryDbFactory();
-        var deploymentId = SeedDeploymentWithAlarmTag(db, RevA,
-            Equip: "eq-1", Driver: "drv-1", FullName: "Temp.HiHi", Folder: null, Name: "temp_hi");
+        var deploymentId = SeedV3AlarmDeployment(db, RevA, Driver: "drv-1", Tag: "temp_hi");

        var alerts = CreateTestProbe();
        SubscribeToAlerts(alerts);

        var (actor, publish) = SpawnHostAndApply(db, deploymentId);

-        // Send an alarm whose OperatorComment is set — simulates an upstream acknowledge-with-comment.
        actor.Tell(new DriverInstanceActor.AttributeAlarmPublished("drv-1", new AlarmEventArgs(
            new StubAlarmHandle(),
            SourceNodeId: "Temp",
-            ConditionId: "Temp.HiHi",
+            ConditionId: AlarmRawPath,
            AlarmType: "OffNormalAlarm",
            Message: "investigating",
            Severity: AlarmSeverity.High,
@@ -285,18 +264,14 @@ public sealed class DriverHostActorNativeAlarmTests : RuntimeActorTestBase
            Kind: AlarmTransitionKind.Acknowledge,
            OperatorComment: "investigating")));

-        // OPC UA condition update is ungated — drain it.
        publish.ExpectMsg<OpcUaPublishActor.AlarmStateUpdate>(TimeSpan.FromSeconds(5));

-        // The published AlarmTransitionEvent must carry the comment + the "device" user marker.
        var evt = alerts.ExpectMsg<AlarmTransitionEvent>(TimeSpan.FromSeconds(5));
        evt.Comment.ShouldBe("investigating");
        evt.User.ShouldBe("device");
    }

-    /// <summary>Subscribe <paramref name="probe"/> to the <c>alerts</c> DPS topic and wait for the ack.
-    /// The Subscribe is sent FROM the probe so the SubscribeAck returns to it. Mirrors the
-    /// ScriptedAlarmHostActor test harness.</summary>
+    /// <summary>Subscribe <paramref name="probe"/> to the <c>alerts</c> DPS topic and wait for the ack.</summary>
    private void SubscribeToAlerts(TestProbe probe)
    {
        DistributedPubSub.Get(Sys).Mediator.Tell(
@@ -304,9 +279,8 @@ public sealed class DriverHostActorNativeAlarmTests : RuntimeActorTestBase
        probe.ExpectMsg<SubscribeAck>(TimeSpan.FromSeconds(5));
    }

-    /// <summary>Tell the host a <see cref="RedundancyStateChanged"/> snapshot marking the host's own
-    /// node (<see cref="TestNode"/>, which equals the host's <c>_localNode</c>) with <paramref name="role"/>
-    /// so the alerts-publish gate observes the local role.</summary>
+    /// <summary>Tell the host a <see cref="RedundancyStateChanged"/> snapshot marking the host's own node
+    /// (<see cref="TestNode"/>) with <paramref name="role"/> so the alerts-publish gate observes it.</summary>
    private static void TellRedundancyRole(IActorRef host, RedundancyRole role)
    {
        host.Tell(new RedundancyStateChanged(
@@ -322,10 +296,10 @@ public sealed class DriverHostActorNativeAlarmTests : RuntimeActorTestBase
            CorrelationId.NewId()));
    }

-    /// <summary>Spawns the host with a publish probe, dispatches the deployment, and waits for the Applied
-    /// ACK so the apply (and thus the alarm-map build in PushDesiredSubscriptions) has completed before the
-    /// test publishes an alarm. A VirtualTag-host probe is injected so the real host isn't spawned.</summary>
-    private (IActorRef Actor, Akka.TestKit.TestProbe Publish) SpawnHostAndApply(
+    /// <summary>Spawns the host with a publish probe, dispatches the deployment, and waits for the Applied ACK
+    /// so the apply (and thus the alarm-map build in PushDesiredSubscriptions) has completed before the test
+    /// publishes an alarm. A VirtualTag-host probe is injected so the real host isn't spawned.</summary>
+    private (IActorRef Actor, TestProbe Publish) SpawnHostAndApply(
        IDbContextFactory<OtOpcUaConfigDbContext> db, DeploymentId deploymentId)
    {
        var coordinator = CreateTestProbe();
@@ -352,47 +326,46 @@ public sealed class DriverHostActorNativeAlarmTests : RuntimeActorTestBase
    }

    /// <summary>
-    ///     Seeds a Sealed deployment whose artifact carries one alarm-bearing equipment tag: the tag's
-    ///     <c>TagConfig</c> carries both a <c>FullName</c> and an <c>alarm</c> object
-    ///     (<c>alarmType</c> + <c>severity</c>) so <c>DeploymentArtifact.ExtractTagAlarm</c> projects a
-    ///     non-null <c>EquipmentTagAlarmInfo</c> (here <c>OffNormalAlarm</c> / 700) — making the tag a
-    ///     condition rather than a value variable.
+    ///     Seeds a Sealed deployment whose artifact carries the v3 raw-tag chain (RawFolder "Plant" →
+    ///     DriverInstance(RawFolderId, Name "Modbus") → Device "dev1" → Tag) with the tag's <c>TagConfig</c>
+    ///     carrying an <c>alarm</c> object so the composer projects a non-null <c>EquipmentTagAlarmInfo</c>
+    ///     (<c>OffNormalAlarm</c> / 700) — making the raw tag a Part 9 condition at its RawPath rather than a
+    ///     value variable. Enums serialize numerically. No UNS reference is needed for these routing/emit tests
+    ///     (the SDK-notifier fan-out to referencing equipment is covered by the node-manager tests).
    /// </summary>
-    private static DeploymentId SeedDeploymentWithAlarmTag(
+    private static DeploymentId SeedV3AlarmDeployment(
        IDbContextFactory<OtOpcUaConfigDbContext> db, RevisionHash rev,
-        string Equip, string Driver, string FullName, string? Folder, string Name,
-        bool? historizeToAveva = null)
+        string Driver, string Tag, bool? historizeToAveva = null)
    {
-        // historizeToAveva absent (null) ⇒ omit the key entirely so the absent ⇒ historize default path is
-        // exercised; a concrete true/false writes the bool into the alarm object so the native path threads it.
+        // historizeToAveva absent (null) ⇒ omit the key so the absent ⇒ historize default path is exercised;
+        // a concrete true/false writes the bool into the alarm object so the native path threads it.
        object alarm = historizeToAveva is { } h
            ? new { alarmType = "OffNormalAlarm", severity = 700, historizeToAveva = h }
            : new { alarmType = "OffNormalAlarm", severity = 700 };
+
        var artifact = JsonSerializer.SerializeToUtf8Bytes(new
        {
-            Namespaces = new[]
-            {
-                new { NamespaceId = "ns-eq", Kind = 0 }, // NamespaceKind.Equipment = 0
-            },
+            RawFolders = new[] { new { RawFolderId = "rf-plant", ParentRawFolderId = (string?)null, Name = "Plant", ClusterId = "c1" } },
            DriverInstances = new[]
            {
-                new { DriverInstanceId = Driver, NamespaceId = "ns-eq" },
+                new { DriverInstanceId = Driver, RawFolderId = "rf-plant", Name = "Modbus", DriverType = "Modbus", DriverConfig = "{}", ClusterId = "c1", Enabled = false },
            },
+            Devices = new[]
+            {
+                new { DeviceId = $"{Driver}:dev1", DriverInstanceId = Driver, Name = "dev1", DeviceConfig = "{}" },
+            },
+            TagGroups = Array.Empty<object>(),
            Tags = new[]
            {
                new
                {
                    TagId = "tag-0",
-                    EquipmentId = Equip,
-                    DriverInstanceId = Driver,
-                    Name,
-                    FolderPath = Folder,
+                    DeviceId = $"{Driver}:dev1",
+                    TagGroupId = (string?)null,
+                    Name = Tag,
                    DataType = "Boolean",
-                    TagConfig = JsonSerializer.Serialize(new
-                    {
-                        FullName,
-                        alarm,
-                    }),
+                    AccessLevel = 0, // TagAccessLevel.Read
+                    TagConfig = JsonSerializer.Serialize(new { alarm }),
                },
            },
        });
@@ -224,6 +224,7 @@ public sealed class OtOpcUaTelemetryHookTests : RuntimeActorTestBase
        public void RebuildAddressSpace() { /* recorded via span */ }
        /// <summary>Announces a NodeAdded model-change (stub implementation).</summary>
        public void RaiseNodesAddedModelChange(string affectedNodeId, AddressSpaceRealm realm = AddressSpaceRealm.Uns) { }
+        public void WireAlarmNotifiers(string alarmNodeId, AddressSpaceRealm alarmRealm, IReadOnlyList<string> notifierFolderNodeIds, AddressSpaceRealm notifierFolderRealm) { }
        public void AddReference(string sourceNodeId, AddressSpaceRealm sourceRealm, string targetNodeId, AddressSpaceRealm targetRealm, string referenceType = "Organizes") { }
    }
 }
@@ -125,6 +125,7 @@ public sealed class OpcUaPublishActorApplyFailureTests : RuntimeActorTestBase
        public void EnsureVariable(string variableNodeId, string? parentFolderNodeId, string displayName, string dataType, bool writable, AddressSpaceRealm realm, string? historianTagname = null, bool isArray = false, uint? arrayLength = null) { }
        public void RebuildAddressSpace() => throw new InvalidOperationException("simulated rebuild fault");
        public void RaiseNodesAddedModelChange(string affectedNodeId, AddressSpaceRealm realm = AddressSpaceRealm.Uns) { }
+        public void WireAlarmNotifiers(string alarmNodeId, AddressSpaceRealm alarmRealm, IReadOnlyList<string> notifierFolderNodeIds, AddressSpaceRealm notifierFolderRealm) { }
        public void AddReference(string sourceNodeId, AddressSpaceRealm sourceRealm, string targetNodeId, AddressSpaceRealm targetRealm, string referenceType = "Organizes") { }
    }

@@ -138,6 +139,7 @@ public sealed class OpcUaPublishActorApplyFailureTests : RuntimeActorTestBase
        public void EnsureVariable(string variableNodeId, string? parentFolderNodeId, string displayName, string dataType, bool writable, AddressSpaceRealm realm, string? historianTagname = null, bool isArray = false, uint? arrayLength = null) { }
        public void RebuildAddressSpace() { }
        public void RaiseNodesAddedModelChange(string affectedNodeId, AddressSpaceRealm realm = AddressSpaceRealm.Uns) { }
+        public void WireAlarmNotifiers(string alarmNodeId, AddressSpaceRealm alarmRealm, IReadOnlyList<string> notifierFolderNodeIds, AddressSpaceRealm notifierFolderRealm) { }
        public void AddReference(string sourceNodeId, AddressSpaceRealm sourceRealm, string targetNodeId, AddressSpaceRealm targetRealm, string referenceType = "Organizes") { }
    }

@@ -473,6 +473,7 @@ public sealed class OpcUaPublishActorRebuildTests : RuntimeActorTestBase
        /// <summary>Records a NodeAdded model-change announcement.</summary>
        /// <param name="affectedNodeId">The node under which discovered nodes were added.</param>
        public void RaiseNodesAddedModelChange(string affectedNodeId, AddressSpaceRealm realm = AddressSpaceRealm.Uns) => Calls.Enqueue($"NA:{affectedNodeId}");
+        public void WireAlarmNotifiers(string alarmNodeId, AddressSpaceRealm alarmRealm, IReadOnlyList<string> notifierFolderNodeIds, AddressSpaceRealm notifierFolderRealm) { }
        public void AddReference(string sourceNodeId, AddressSpaceRealm sourceRealm, string targetNodeId, AddressSpaceRealm targetRealm, string referenceType = "Organizes") { }
        /// <summary>Records a surgical in-place tag-attribute update (always succeeds in this recording sink).</summary>
        public bool UpdateTagAttributes(string variableNodeId, bool writable, string? historianTagname, string dataType, bool isArray, uint? arrayLength, AddressSpaceRealm realm = AddressSpaceRealm.Uns)
@@ -647,6 +647,7 @@ public sealed class OpcUaPublishActorTests : RuntimeActorTestBase
        /// <summary>Records a NodeAdded model-change announcement.</summary>
        /// <param name="affectedNodeId">The node under which discovered nodes were added.</param>
        public void RaiseNodesAddedModelChange(string affectedNodeId, AddressSpaceRealm realm = AddressSpaceRealm.Uns) => ModelChangeQueue.Enqueue(affectedNodeId);
+        public void WireAlarmNotifiers(string alarmNodeId, AddressSpaceRealm alarmRealm, IReadOnlyList<string> notifierFolderNodeIds, AddressSpaceRealm notifierFolderRealm) { }
        public void AddReference(string sourceNodeId, AddressSpaceRealm sourceRealm, string targetNodeId, AddressSpaceRealm targetRealm, string referenceType = "Organizes") { }
    }