fix(acl): revalidation memo rejects empty node identifiers, mirroring the authorizer's guard

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaNodeManager.cs

@@ -3298,9 +3298,12 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
     ///         identifier spaces, so an identifier alone does not name a node.
     ///     </para>
     ///     <para>
-    ///         Anything the key cannot be built from — no role-carrying identity, no principal, a non-string
-    ///         node identifier — falls through to the un-memoized call and keeps its existing verdict. Those
-    ///         are the cases the authorizer denies anyway; memoizing them would only make a deny cheaper.
+    ///         Anything the key cannot be built from — no role-carrying identity, no principal, a node
+    ///         identifier that is not a non-empty string — falls through to the un-memoized call and keeps
+    ///         its existing verdict. Those are the cases the authorizer denies anyway; memoizing them would
+    ///         only make a deny cheaper. The empty identifier is excluded for the same reason
+    ///         <see cref="Security.DataPlaneAuthorizer"/> excludes it from its own decision cache: it
+    ///         addresses no ACL scope, so it is not an identity to key on.
     ///     </para>
     ///     <para>
     ///         This memo does cover the key expiry check that the authorizer's own cache excludes, but only
@@ -3318,7 +3321,7 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
 
         if (identity is null
             || (identity.ApiKeyId ?? identity.Principal) is not { Length: > 0 } sessionKey
-            || nodeId.Identifier is not string identifier)
+            || nodeId.Identifier is not string { Length: > 0 } identifier)
         {
             return _authorizer!.IsAllowedCached(
                 identity, OpcUaOperation.CreateMonitoredItems, nodeId, realm);