Merge #597/#599: real UnshelveTime, commented re-ack reports, native ack refused off-Primary, /alerts ack-path test; surgically-added raw nodes announced, equipment-with-references removal keeps references severed; Backing* parity guard

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/OpcUa/OpcUaPublishActor.cs

@@ -592,15 +592,11 @@ public sealed class OpcUaPublishActor : ReceiveActor, IWithTimers
             // (subscriptions are dead anyway) — the guard skips it. AnnounceAddedNodes is Safe-wrapped
             // internally, so a faulting announce can never break the deploy.
             //
-            // KNOWN GAP, and NOT a neutral pre-existing one — the delta work made it matter. Before this
-            // branch, a plan carrying raw adds went through a full RebuildAddressSpace, so every client had to
-            // re-browse anyway and the missing announcement changed nothing observable. Now those adds are
-            // materialised surgically while existing subscriptions stay alive, so an unannounced add is
-            // genuinely INVISIBLE until a client happens to browse again.
-            // Added UNS reference variables ARE announced (their equipment folder is the parent, which is the
-            // realm AnnounceAddedNodes hardcodes). Added RAW containers/tags are still not: the announce is
-            // Uns-only, and a raw parent needs a realm-aware RaiseNodesAddedModelChange call. That is a real
-            // follow-up, not an accepted limitation.
+            // The announce is realm-aware (Gitea #599): UNS parents in the Uns realm, and the parents of
+            // added RAW containers/tags in the Raw realm. It matters because of the delta work — before it, a
+            // plan carrying raw adds went through a full RebuildAddressSpace, so every client re-browsed
+            // anyway; now those adds are materialised surgically while existing subscriptions stay alive, and
+            // an unannounced add would stay invisible until a client happened to browse again.
             if (!outcome.RebuildCalled) _applier.AnnounceAddedNodes(plan);
 
             OtOpcUaTelemetry.OpcUaSinkWrite.Add(1, new KeyValuePair<string, object?>("kind", "rebuild"));

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/ScriptedAlarms/ScriptedAlarmHostActor.cs

@@ -739,7 +739,9 @@ public sealed class ScriptedAlarmHostActor : ReceiveActor
         // #478 — the condition's status is the worst status across the script's input tags at evaluation
         // time (carried on the event by the engine). A transition fired while an input is Uncertain projects
         // Uncertain here so the full-snapshot write doesn't clobber quality back to Good.
-        StatusCode: worstInputStatusCode);
+        StatusCode: worstInputStatusCode,
+        // Gitea #597 — the engine's own expiry, so the node's UnshelveTime counts down to it.
+        UnshelveAtUtc: condition.Shelving.Kind == ShelvingKind.Timed ? condition.Shelving.UnshelveAtUtc : null);
 
     /// <summary>Maps the Core <see cref="ShelvingKind"/> onto the Commons <see cref="AlarmShelvingKind"/>
     /// mirror (the Commons assembly can't see the Core enum).</summary>