Merge #597/#599: real UnshelveTime, commented re-ack reports, native ack refused off-Primary, /alerts ack-path test; surgically-added raw nodes announced, equipment-with-references removal keeps references severed; Backing* parity guard

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/OtOpcUaServerHostedService.cs

@@ -44,6 +44,7 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
     private readonly ActorRegistry _actorRegistry;
     private readonly ILoggerFactory _loggerFactory;
     private readonly ILogger<OtOpcUaServerHostedService> _logger;
+    private readonly IDriverPrimaryRoleSource? _primaryRoleSource;
 
     private OpcUaApplicationHost? _appHost;
     private OtOpcUaSdkServer? _server;
@@ -88,6 +89,11 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
     /// <param name="time">The shared clock — the one instance the authorizer and the API-key store bound
     /// also read. Its <c>CreateTimer</c> arms the revalidation tick.</param>
     /// <param name="loggerFactory">The logger factory for creating loggers.</param>
+    /// <param name="primaryRoleSource">Gitea #597 — the data-plane Primary verdict <c>DriverHostActor</c>
+    /// publishes on every redundancy snapshot (the same one its native-ack route and device-write gates apply).
+    /// Wired onto the node manager so a native-condition Acknowledge on a non-Primary node is refused rather than
+    /// applied and then reverted. Optional: a node with no driver role registers none, and null means "allow" —
+    /// the single-node posture <c>UnmanagedDriverPrimaryRoleSource</c> also answers with.</param>
     public OtOpcUaServerHostedService(
         IOptions<OpcUaApplicationHostOptions> options,
         DeferredAddressSpaceSink deferredSink,
@@ -101,7 +107,8 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
         DataPlaneAuthorizer? dataPlaneAuthorizer,
         IOptions<AclOptions> aclOptions,
         TimeProvider time,
-        ILoggerFactory loggerFactory)
+        ILoggerFactory loggerFactory,
+        IDriverPrimaryRoleSource? primaryRoleSource = null)
     {
         ArgumentNullException.ThrowIfNull(aclOptions);
         ArgumentNullException.ThrowIfNull(time);
@@ -123,6 +130,7 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
         _actorSystemAccessor = actorSystemAccessor;
         _actorRegistry = actorRegistry;
         _loggerFactory = loggerFactory;
+        _primaryRoleSource = primaryRoleSource;
         _logger = loggerFactory.CreateLogger<OtOpcUaServerHostedService>();
     }
 
@@ -225,6 +233,21 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
             }
         });
 
+        // Gitea #597: a native ack is accepted only on the Primary. The verdict is the one DriverHostActor
+        // publishes and gates the route above on, so a Secondary refuses (BadInvalidState) instead of applying an
+        // ack the driver will never see and then reverting it. A volatile property read — safe under the SDK Lock.
+        if (_primaryRoleSource is { } primaryRoleSource)
+        {
+            _server.SetNativeAlarmAckPrimaryGate(() => primaryRoleSource.ShouldActAsPrimary);
+        }
+        else
+        {
+            // Every driver node registers one (AddOtOpcUaRuntime), so this is a wiring regression, not a mode:
+            // say so rather than let a Secondary silently go back to accepting acks it will revert.
+            _logger.LogWarning(
+                "OtOpcUaServerHostedService: no IDriverPrimaryRoleSource registered — native-alarm acknowledges are accepted on every node regardless of redundancy role");
+        }
+
         // Wire the reverse-path inbound operator-write gateway: a client write to a writable equipment-tag
         // node that passes the node manager's WriteOperate gate routes the write to the owning driver child
         // (RouteNodeWrite → NodeWriteResult) via the local DriverHostActor. The node manager calls the
@@ -345,6 +368,7 @@ public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposabl
         _server?.SetNodeWriteGateway(null);
         // Clear the native-alarm-ack router so a late ack doesn't Tell a stopping DriverHostActor.
         _server?.SetNativeAlarmAckRouter(null);
+        _server?.SetNativeAlarmAckPrimaryGate(null);
         // Restore the Null historian so a late HistoryRead doesn't hit a disposed read client.
         _server?.SetHistorianDataSource(null);
         // Restore the empty authority so a late session activation cannot authorize against a stopping node.