feat(deploy): bake the ServerCluster/ClusterNode seed into docker-compose

Adds a one-shot cluster-seed service to docker-dev/docker-compose.yml
that pre-populates the three Akka clusters' scope rows in the shared
OtOpcUa ConfigDb so operators don't have to click through /clusters +
/hosts on every fresh bring-up.

Seed contents:
  ServerCluster   MAIN (Warm/2), SITE-A (Warm/2), SITE-B (Warm/2)
  ClusterNode     driver-a + driver-b  → MAIN
                  site-a-1 + site-a-2  → SITE-A
                  site-b-1 + site-b-2  → SITE-B

NodeCount + RedundancyMode honour the CK_ServerCluster check constraint.
ApplicationUri follows the urn:OtOpcUa:<NodeId> convention; uniqueness
across the fleet satisfies UX_ClusterNode_ApplicationUri.

Mechanism:
  - docker-dev/seed/seed-clusters.sql — idempotent INSERTs (IF NOT EXISTS
    guards on every row).
  - docker-dev/seed/entrypoint.sh — bash wrapper that waits for SQL to
    accept connections, then polls until dbo.ServerCluster exists (the
    host containers' EF auto-migration creates it on first boot), then
    applies the SQL script.
  - cluster-seed service uses mcr.microsoft.com/mssql-tools as the base
    image (bash + sqlcmd available), restart: "no" so it runs once.

Re-running `docker compose up` is safe: the seed exits cleanly on the
second run because every INSERT is guarded.

Manual re-seed: `docker compose run --rm cluster-seed`.

.github/workflows/v2-ci.yml

@@ -61,10 +61,16 @@ jobs:
   integration:
     needs: build
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        project:
+          - tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests
+          - tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-dotnet@v4
         with:
           dotnet-version: 10.0.x
-      - name: dotnet test Host.IntegrationTests
-        run: dotnet test tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests --configuration Release --filter "Category!=E2E"
+      - name: dotnet test ${{ matrix.project }}
+        run: dotnet test ${{ matrix.project }} --configuration Release --filter "Category!=E2E"

ZB.MOM.WW.OtOpcUa.slnx

@@ -63,6 +63,7 @@
   <Folder Name="/tests/Server/">
     <Project Path="tests/Server/ZB.MOM.WW.OtOpcUa.ControlPlane.Tests/ZB.MOM.WW.OtOpcUa.ControlPlane.Tests.csproj" />
     <Project Path="tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests.csproj" />
+    <Project Path="tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.csproj" />
     <Project Path="tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests.csproj" />
     <Project Path="tests/Server/ZB.MOM.WW.OtOpcUa.Runtime.Tests/ZB.MOM.WW.OtOpcUa.Runtime.Tests.csproj" />
     <Project Path="tests/Server/ZB.MOM.WW.OtOpcUa.Security.Tests/ZB.MOM.WW.OtOpcUa.Security.Tests.csproj" />

docker-dev/README.md

@@ -1,20 +1,63 @@
 # docker-dev
 
-Mac-friendly four-node OtOpcUa fleet for manual UI exercise + integration smoke tests. Spins up an Akka cluster + SQL Server + OpenLDAP + Traefik in front of two admin nodes.
+Mac-friendly multi-cluster OtOpcUa fleet for manual UI exercise + integration smoke tests. Spins up **three isolated Akka clusters** + SQL Server + OpenLDAP + Traefik on the same Compose network. All three clusters share the single `OtOpcUa` ConfigDb — multi-tenancy is enforced by per-row `ServerCluster.ClusterId` scoping. Akka.Cluster gossip stays isolated between meshes because their seed-node lists are disjoint, even though they share the same system name `otopcua`.
 
 ## Stack
 
+### Shared infrastructure
+
 | Service | Role | Ports |
 |---|---|---|
-| `sql` | SQL Server 2022 (`ConfigDb` backing store) | host `14330` → container `1433` |
+| `sql` | SQL Server 2022 — single `OtOpcUa` ConfigDb shared by all three clusters | host `14330` → container `1433` |
 | `ldap` | OpenLDAP with dev users `alice` / `bob` | host `3893` → container `1389` |
-| `admin-a` | OtOpcUa.Host, `OTOPCUA_ROLES=admin`, cluster seed | internal `9000` |
-| `admin-b` | OtOpcUa.Host, `OTOPCUA_ROLES=admin`, joins admin-a | internal `9000` |
-| `driver-a` | OtOpcUa.Host, `OTOPCUA_ROLES=driver` | host `4840` → container `4840` |
-| `driver-b` | OtOpcUa.Host, `OTOPCUA_ROLES=driver` | host `4841` → container `4840` |
-| `traefik` | Routes `:80` to whichever admin-* currently passes `/health/active` | host `80`, dashboard `8080` |
+| `traefik` | Routes :80 by Host header / PathPrefix | host `80`, dashboard `8080` |
 
-All six containers share an Akka cluster bound to port `4053` inside the Compose network. The Akka `PublicHostname` of each container matches its Compose service name; the seed-node list points at `admin-a` so the other three join via that.
+### Main cluster — split admin/driver roles
+
+| Service | Role | Ports |
+|---|---|---|
+| `admin-a` | `OTOPCUA_ROLES=admin`, cluster seed | internal `9000` |
+| `admin-b` | `OTOPCUA_ROLES=admin`, joins admin-a | internal `9000` |
+| `driver-a` | `OTOPCUA_ROLES=driver` | host `4840` → container `4840` |
+| `driver-b` | `OTOPCUA_ROLES=driver` | host `4841` → container `4840` |
+
+### Site A cluster — 2-node fused admin+driver
+
+| Service | Role | Ports |
+|---|---|---|
+| `site-a-1` | `OTOPCUA_ROLES=admin,driver`, cluster seed | host `4842` → container `4840` |
+| `site-a-2` | `OTOPCUA_ROLES=admin,driver`, joins site-a-1 | host `4843` → container `4840` |
+
+### Site B cluster — 2-node fused admin+driver
+
+| Service | Role | Ports |
+|---|---|---|
+| `site-b-1` | `OTOPCUA_ROLES=admin,driver`, cluster seed | host `4844` → container `4840` |
+| `site-b-2` | `OTOPCUA_ROLES=admin,driver`, joins site-b-1 | host `4845` → container `4840` |
+
+All containers bind Akka remoting to port `4053` inside their own network namespace; the `PublicHostname` of each matches its Compose service name. Akka mesh isolation is enforced purely by disjoint seed lists. Configuration-side isolation is enforced by `ServerCluster.ClusterId` — see "Multi-tenancy" below.
+
+## Multi-tenancy
+
+All eight host nodes write to the same `OtOpcUa` ConfigDb. The `ServerCluster` table differentiates the three Akka meshes: each Akka cluster maps to one row, and each `ClusterNode` row's `ClusterId` ties the runtime node back to its owning cluster scope.
+
+A one-shot `cluster-seed` Compose service (image `mcr.microsoft.com/mssql-tools`) waits for SQL + the EF auto-migration to complete and then INSERTs the rows below. The seed is **idempotent** — `IF NOT EXISTS` guards every insert — so re-runs on `docker compose up` are no-ops:
+
+| Akka mesh | `ServerCluster.ClusterId` | `ClusterNode.NodeId` rows |
+|---|---|---|
+| Main | `MAIN` | `driver-a`, `driver-b` (OPC UA publishers) |
+| Site A | `SITE-A` | `site-a-1`, `site-a-2` |
+| Site B | `SITE-B` | `site-b-1`, `site-b-2` |
+
+`ClusterNode` is the table for **OPC UA-publishing nodes** (not every Akka cluster member), which is why the main cluster's `admin-a` / `admin-b` don't get rows — they're control-plane-only.
+
+Each `ClusterNode.NodeId` matches the node's `Cluster__PublicHostname` env value (Compose service name) — that's the lookup the runtime uses to resolve its own membership. `ApplicationUri` follows the `urn:OtOpcUa:<NodeId>` convention.
+
+The SQL lives at `seed/seed-clusters.sql`; the wait-and-apply wrapper lives at `seed/entrypoint.sh`. To re-seed manually:
+
+```bash
+docker compose -f docker-dev/docker-compose.yml run --rm cluster-seed
+```
 
 ## Bring up
 
@@ -22,12 +65,16 @@ All six containers share an Akka cluster bound to port `4053` inside the Compose
 # from the repo root
 docker compose -f docker-dev/docker-compose.yml up -d --build
 
-# wait ~15 seconds for SQL to come up + the cluster to form
+# wait ~20 seconds for SQL to come up + all three clusters to form
 
-open http://localhost          # Blazor admin UI via Traefik
-open http://localhost:8080     # Traefik dashboard
+open http://localhost                      # main cluster admin UI
+open http://site-a.localhost               # site A admin UI
+open http://site-b.localhost               # site B admin UI
+open http://localhost:8080                 # Traefik dashboard
 ```
 
+On macOS, `*.localhost` resolves to `127.0.0.1` automatically. On Linux add `127.0.0.1 site-a.localhost site-b.localhost` to `/etc/hosts` if your resolver doesn't.
+
 The first build takes a few minutes (.NET SDK image + restore + publish). Subsequent rebuilds are faster with Docker's layer cache.
 
 ## Auth (dev only)
@@ -58,5 +105,8 @@ The `-v` drops the SQL + LDAP volumes; remove it to keep ConfigDb state across r
 ## Notes
 
 - This compose is for the **local Mac/Linux developer rig**. The team's CI + soak runs go to the remote docker host at `10.100.0.35` (see `docs/v2/dev-environment.md`); the file there mirrors this one with adjusted port bindings.
-- The OPC UA driver endpoints (`opc.tcp://localhost:4840`, `opc.tcp://localhost:4841`) are reachable directly from the host — Traefik is only in front of the admin HTTP surface.
+- The OPC UA driver endpoints are reachable directly from the host (Traefik is only in front of the admin HTTP surface):
+  - Main: `opc.tcp://localhost:4840` (driver-a), `opc.tcp://localhost:4841` (driver-b)
+  - Site A: `opc.tcp://localhost:4842` (site-a-1), `opc.tcp://localhost:4843` (site-a-2)
+  - Site B: `opc.tcp://localhost:4844` (site-b-1), `opc.tcp://localhost:4845` (site-b-2)
 - Galaxy + Wonderware drivers can't run in Linux containers (they need the Windows-only mxaccessgw + Historian SDK). On non-Windows, `DriverInstanceActor.ShouldStub(driverType, roles)` returns `true` for those types and the actor goes straight to a `Stubbed` state that returns deterministic success.

docker-dev/docker-compose.yml

@@ -1,18 +1,41 @@
-# docker-dev/ — Mac-friendly four-node fleet for v2 development + manual UI exercise.
+# docker-dev/ — Mac-friendly multi-cluster fleet for v2 development + manual UI exercise.
 #
-# Stack:
-#   sql       SQL Server 2022 (ConfigDb backing store)
-#   ldap      OpenLDAP with the dev users from C:\publish\glauth\auth.md mirrored in
-#   admin-a   OtOpcUa.Host with OTOPCUA_ROLES=admin (cluster seed)
-#   admin-b   OtOpcUa.Host with OTOPCUA_ROLES=admin (joins admin-a)
-#   driver-a  OtOpcUa.Host with OTOPCUA_ROLES=driver (joins via admin-a)
-#   driver-b  OtOpcUa.Host with OTOPCUA_ROLES=driver (joins via admin-a)
-#   traefik   Routes :80 to whichever admin-* currently passes /health/active
+# Stack (3 separate Akka clusters — all share the single `OtOpcUa` ConfigDb):
+#   sql        SQL Server 2022 — hosts the one ConfigDb that all three clusters use
+#   ldap       OpenLDAP with the dev users from C:\publish\glauth\auth.md mirrored in
+#
+#   Main cluster (existing — split-role admin / driver pair on a single Akka mesh):
+#     admin-a   OtOpcUa.Host with OTOPCUA_ROLES=admin (seed)
+#     admin-b   OtOpcUa.Host with OTOPCUA_ROLES=admin (joins admin-a)
+#     driver-a  OtOpcUa.Host with OTOPCUA_ROLES=driver (joins via admin-a)
+#     driver-b  OtOpcUa.Host with OTOPCUA_ROLES=driver (joins via admin-a)
+#
+#   Site A cluster (2-node fused admin+driver):
+#     site-a-1, site-a-2     OTOPCUA_ROLES=admin,driver, seed = site-a-1
+#
+#   Site B cluster (2-node fused admin+driver):
+#     site-b-1, site-b-2     OTOPCUA_ROLES=admin,driver, seed = site-b-1
+#
+#   traefik    PathPrefix → main cluster admin-a/admin-b; Host(`site-a.localhost`) →
+#              site-a-*; Host(`site-b.localhost`) → site-b-*. Add the two site hosts to
+#              your /etc/hosts (or rely on macOS `.localhost` auto-resolution).
+#
+# Multi-tenancy: ConfigDb is one schema with a `ServerCluster` table; each Akka cluster
+# corresponds to a row in it (ClusterId = "MAIN" / "SITE-A" / "SITE-B"), and each node's
+# `ClusterNode.NodeId` points back at the row that owns it. After first boot, sign in to
+# any cluster's Admin UI and create the matching ServerCluster + ClusterNode rows via
+# /clusters and /hosts so the runtime knows what configuration scope applies.
+#
+# Akka mesh isolation: same system name "otopcua" + same remoting port 4053 inside each
+# container's own network namespace, but with disjoint seed-node lists — gossip never
+# crosses between the three meshes.
 #
 # Usage:
 #   docker compose -f docker-dev/docker-compose.yml up -d --build
-#   open http://localhost            # Blazor admin UI via Traefik
-#   open http://localhost:8080       # Traefik dashboard
+#   open http://localhost                  # main cluster Blazor admin UI
+#   open http://site-a.localhost           # site A admin UI
+#   open http://site-b.localhost           # site B admin UI
+#   open http://localhost:8080             # Traefik dashboard
 #
 # Tear-down:  docker compose -f docker-dev/docker-compose.yml down -v
 
@@ -34,6 +57,20 @@ services:
       timeout: 5s
       retries: 20
 
+  # ── Cluster seed (one-shot) ────────────────────────────────────────────────
+  # Waits for SQL + the host containers' EF auto-migration, then INSERTs the
+  # three ServerCluster rows and the six ClusterNode rows that scope each Akka
+  # mesh inside the shared OtOpcUa ConfigDb. Idempotent — re-runs are no-ops.
+  cluster-seed:
+    image: mcr.microsoft.com/mssql-tools:latest
+    depends_on:
+      sql:
+        condition: service_healthy
+    volumes:
+      - ./seed:/seed:ro
+    entrypoint: ["/bin/bash", "/seed/entrypoint.sh"]
+    restart: "no"
+
   ldap:
     image: bitnami/openldap:2.6
     environment:
@@ -113,6 +150,103 @@ services:
     ports:
       - "4841:4840"
 
+  # ── Site A cluster (2-node fused admin+driver) ──────────────────────────────
+  # Shares the OtOpcUa ConfigDb with the main + site-b clusters; multi-tenancy is
+  # enforced by ServerCluster.ClusterId rows (configure via /clusters after boot).
+  # Akka isolation comes from the disjoint seed list (seed = site-a-1).
+
+  site-a-1:
+    <<: *otopcua-host
+    environment:
+      OTOPCUA_ROLES: "admin,driver"
+      ASPNETCORE_URLS: "http://+:9000"
+      ConnectionStrings__ConfigDb: "Server=sql,1433;Database=OtOpcUa;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
+      Cluster__Hostname: "0.0.0.0"
+      Cluster__Port: "4053"
+      Cluster__PublicHostname: "site-a-1"
+      Cluster__SeedNodes__0: "akka.tcp://otopcua@site-a-1:4053"
+      Cluster__Roles__0: "admin"
+      Cluster__Roles__1: "driver"
+      Security__Jwt__SigningKey: "docker-dev-signing-key-with-at-least-32-bytes-of-utf8-content-12345"
+      Security__Jwt__Issuer: "otopcua-dev"
+      Security__Jwt__Audience: "otopcua-dev"
+      Authentication__Ldap__Server: "ldap"
+      Authentication__Ldap__Port: "1389"
+      Authentication__Ldap__AllowInsecureLdap: "true"
+    ports:
+      - "4842:4840"
+
+  site-a-2:
+    <<: *otopcua-host
+    depends_on:
+      sql: { condition: service_healthy }
+      site-a-1: { condition: service_started }
+    environment:
+      OTOPCUA_ROLES: "admin,driver"
+      ASPNETCORE_URLS: "http://+:9000"
+      ConnectionStrings__ConfigDb: "Server=sql,1433;Database=OtOpcUa;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
+      Cluster__Hostname: "0.0.0.0"
+      Cluster__Port: "4053"
+      Cluster__PublicHostname: "site-a-2"
+      Cluster__SeedNodes__0: "akka.tcp://otopcua@site-a-1:4053"
+      Cluster__Roles__0: "admin"
+      Cluster__Roles__1: "driver"
+      Security__Jwt__SigningKey: "docker-dev-signing-key-with-at-least-32-bytes-of-utf8-content-12345"
+      Security__Jwt__Issuer: "otopcua-dev"
+      Security__Jwt__Audience: "otopcua-dev"
+      Authentication__Ldap__Server: "ldap"
+      Authentication__Ldap__Port: "1389"
+      Authentication__Ldap__AllowInsecureLdap: "true"
+    ports:
+      - "4843:4840"
+
+  # ── Site B cluster (2-node fused admin+driver) ──────────────────────────────
+
+  site-b-1:
+    <<: *otopcua-host
+    environment:
+      OTOPCUA_ROLES: "admin,driver"
+      ASPNETCORE_URLS: "http://+:9000"
+      ConnectionStrings__ConfigDb: "Server=sql,1433;Database=OtOpcUa;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
+      Cluster__Hostname: "0.0.0.0"
+      Cluster__Port: "4053"
+      Cluster__PublicHostname: "site-b-1"
+      Cluster__SeedNodes__0: "akka.tcp://otopcua@site-b-1:4053"
+      Cluster__Roles__0: "admin"
+      Cluster__Roles__1: "driver"
+      Security__Jwt__SigningKey: "docker-dev-signing-key-with-at-least-32-bytes-of-utf8-content-12345"
+      Security__Jwt__Issuer: "otopcua-dev"
+      Security__Jwt__Audience: "otopcua-dev"
+      Authentication__Ldap__Server: "ldap"
+      Authentication__Ldap__Port: "1389"
+      Authentication__Ldap__AllowInsecureLdap: "true"
+    ports:
+      - "4844:4840"
+
+  site-b-2:
+    <<: *otopcua-host
+    depends_on:
+      sql: { condition: service_healthy }
+      site-b-1: { condition: service_started }
+    environment:
+      OTOPCUA_ROLES: "admin,driver"
+      ASPNETCORE_URLS: "http://+:9000"
+      ConnectionStrings__ConfigDb: "Server=sql,1433;Database=OtOpcUa;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
+      Cluster__Hostname: "0.0.0.0"
+      Cluster__Port: "4053"
+      Cluster__PublicHostname: "site-b-2"
+      Cluster__SeedNodes__0: "akka.tcp://otopcua@site-b-1:4053"
+      Cluster__Roles__0: "admin"
+      Cluster__Roles__1: "driver"
+      Security__Jwt__SigningKey: "docker-dev-signing-key-with-at-least-32-bytes-of-utf8-content-12345"
+      Security__Jwt__Issuer: "otopcua-dev"
+      Security__Jwt__Audience: "otopcua-dev"
+      Authentication__Ldap__Server: "ldap"
+      Authentication__Ldap__Port: "1389"
+      Authentication__Ldap__AllowInsecureLdap: "true"
+    ports:
+      - "4845:4840"
+
   traefik:
     image: traefik:v3.1
     command:
@@ -128,3 +262,7 @@ services:
     depends_on:
       - admin-a
       - admin-b
+      - site-a-1
+      - site-a-2
+      - site-b-1
+      - site-b-2

docker-dev/seed/entrypoint.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# docker-dev cluster-seed entrypoint. Waits for the host containers to finish
+# their EF Core auto-migration (which creates the ServerCluster table), then
+# applies the idempotent seed script.
+#
+# Image: mcr.microsoft.com/mssql-tools (Debian + sqlcmd at /opt/mssql-tools18/bin).
+
+set -euo pipefail
+
+SQLCMD="/opt/mssql-tools18/bin/sqlcmd"
+SERVER="${SQL_HOST:-sql},1433"
+USER="${SQL_USER:-sa}"
+PASS="${SQL_PASSWORD:-OtOpcUa!Dev123}"
+DB="${SQL_DATABASE:-OtOpcUa}"
+
+run_sql() {
+    "$SQLCMD" -S "$SERVER" -U "$USER" -P "$PASS" -d "$DB" -No -b -h -1 "$@"
+}
+
+echo "[cluster-seed] waiting for SQL Server to accept connections..."
+until run_sql -Q "SELECT 1" >/dev/null 2>&1; do
+    sleep 2
+done
+echo "[cluster-seed] SQL Server up."
+
+echo "[cluster-seed] waiting for $DB.ServerCluster (host containers must finish EF migration)..."
+until run_sql -Q "IF OBJECT_ID('dbo.ServerCluster') IS NULL THROW 50001, 'missing', 1; SELECT 1" >/dev/null 2>&1; do
+    sleep 3
+done
+echo "[cluster-seed] schema ready."
+
+echo "[cluster-seed] applying seed-clusters.sql..."
+run_sql -i /seed/seed-clusters.sql
+
+echo "[cluster-seed] done."

docker-dev/seed/seed-clusters.sql

@@ -0,0 +1,106 @@
+-- docker-dev cluster seed. Idempotent — safe to re-run on every `docker compose up`.
+--
+-- Populates:
+--   ServerCluster   MAIN, SITE-A, SITE-B
+--   ClusterNode     driver-a, driver-b  → MAIN
+--                   site-a-1, site-a-2  → SITE-A
+--                   site-b-1, site-b-2  → SITE-B
+--
+-- ServerCluster.NodeCount + RedundancyMode are coupled by CHECK constraint:
+--   NodeCount=1 ⇒ RedundancyMode='None'
+--   NodeCount=2 ⇒ RedundancyMode∈('Warm','Hot')
+--
+-- Each ClusterNode.ApplicationUri MUST be globally unique (UX_ClusterNode_ApplicationUri).
+-- Convention: urn:OtOpcUa:<NodeId>.
+--
+-- Host = Compose service name (resolves inside the otopcua-dev network).
+-- OpcUaPort stays at the container-internal 4840; the host-side port mapping is in
+-- docker-compose.yml ports: blocks and is irrelevant to ClusterNode rows.
+
+SET NOCOUNT ON;
+SET XACT_ABORT ON;
+
+BEGIN TRANSACTION;
+
+------------------------------------------------------------------------------
+-- ServerCluster
+------------------------------------------------------------------------------
+
+IF NOT EXISTS (SELECT 1 FROM dbo.ServerCluster WHERE ClusterId = 'MAIN')
+    INSERT INTO dbo.ServerCluster
+        (ClusterId, Name, Enterprise, Site, NodeCount, RedundancyMode, Enabled, Notes, CreatedBy)
+    VALUES
+        ('MAIN', 'Main cluster', 'zb', 'docker-dev',
+         2, 'Warm', 1,
+         'docker-dev seed — admin-a/admin-b control-plane, driver-a/driver-b OPC UA publishers.',
+         'docker-dev-seed');
+
+IF NOT EXISTS (SELECT 1 FROM dbo.ServerCluster WHERE ClusterId = 'SITE-A')
+    INSERT INTO dbo.ServerCluster
+        (ClusterId, Name, Enterprise, Site, NodeCount, RedundancyMode, Enabled, Notes, CreatedBy)
+    VALUES
+        ('SITE-A', 'Site A', 'zb', 'site-a',
+         2, 'Warm', 1,
+         'docker-dev seed — 2-node fused admin+driver cluster.',
+         'docker-dev-seed');
+
+IF NOT EXISTS (SELECT 1 FROM dbo.ServerCluster WHERE ClusterId = 'SITE-B')
+    INSERT INTO dbo.ServerCluster
+        (ClusterId, Name, Enterprise, Site, NodeCount, RedundancyMode, Enabled, Notes, CreatedBy)
+    VALUES
+        ('SITE-B', 'Site B', 'zb', 'site-b',
+         2, 'Warm', 1,
+         'docker-dev seed — 2-node fused admin+driver cluster.',
+         'docker-dev-seed');
+
+------------------------------------------------------------------------------
+-- ClusterNode — main cluster OPC UA publishers
+------------------------------------------------------------------------------
+
+IF NOT EXISTS (SELECT 1 FROM dbo.ClusterNode WHERE NodeId = 'driver-a')
+    INSERT INTO dbo.ClusterNode
+        (NodeId, ClusterId, Host, OpcUaPort, DashboardPort, ApplicationUri, ServiceLevelBase, Enabled, CreatedBy)
+    VALUES ('driver-a', 'MAIN', 'driver-a', 4840, 8081, 'urn:OtOpcUa:driver-a', 200, 1, 'docker-dev-seed');
+
+IF NOT EXISTS (SELECT 1 FROM dbo.ClusterNode WHERE NodeId = 'driver-b')
+    INSERT INTO dbo.ClusterNode
+        (NodeId, ClusterId, Host, OpcUaPort, DashboardPort, ApplicationUri, ServiceLevelBase, Enabled, CreatedBy)
+    VALUES ('driver-b', 'MAIN', 'driver-b', 4840, 8081, 'urn:OtOpcUa:driver-b', 150, 1, 'docker-dev-seed');
+
+------------------------------------------------------------------------------
+-- ClusterNode — site A
+------------------------------------------------------------------------------
+
+IF NOT EXISTS (SELECT 1 FROM dbo.ClusterNode WHERE NodeId = 'site-a-1')
+    INSERT INTO dbo.ClusterNode
+        (NodeId, ClusterId, Host, OpcUaPort, DashboardPort, ApplicationUri, ServiceLevelBase, Enabled, CreatedBy)
+    VALUES ('site-a-1', 'SITE-A', 'site-a-1', 4840, 8081, 'urn:OtOpcUa:site-a-1', 200, 1, 'docker-dev-seed');
+
+IF NOT EXISTS (SELECT 1 FROM dbo.ClusterNode WHERE NodeId = 'site-a-2')
+    INSERT INTO dbo.ClusterNode
+        (NodeId, ClusterId, Host, OpcUaPort, DashboardPort, ApplicationUri, ServiceLevelBase, Enabled, CreatedBy)
+    VALUES ('site-a-2', 'SITE-A', 'site-a-2', 4840, 8081, 'urn:OtOpcUa:site-a-2', 150, 1, 'docker-dev-seed');
+
+------------------------------------------------------------------------------
+-- ClusterNode — site B
+------------------------------------------------------------------------------
+
+IF NOT EXISTS (SELECT 1 FROM dbo.ClusterNode WHERE NodeId = 'site-b-1')
+    INSERT INTO dbo.ClusterNode
+        (NodeId, ClusterId, Host, OpcUaPort, DashboardPort, ApplicationUri, ServiceLevelBase, Enabled, CreatedBy)
+    VALUES ('site-b-1', 'SITE-B', 'site-b-1', 4840, 8081, 'urn:OtOpcUa:site-b-1', 200, 1, 'docker-dev-seed');
+
+IF NOT EXISTS (SELECT 1 FROM dbo.ClusterNode WHERE NodeId = 'site-b-2')
+    INSERT INTO dbo.ClusterNode
+        (NodeId, ClusterId, Host, OpcUaPort, DashboardPort, ApplicationUri, ServiceLevelBase, Enabled, CreatedBy)
+    VALUES ('site-b-2', 'SITE-B', 'site-b-2', 4840, 8081, 'urn:OtOpcUa:site-b-2', 150, 1, 'docker-dev-seed');
+
+COMMIT TRANSACTION;
+
+------------------------------------------------------------------------------
+-- Summary (logged by sqlcmd output)
+------------------------------------------------------------------------------
+
+SELECT ClusterId, Name, NodeCount, RedundancyMode FROM dbo.ServerCluster ORDER BY ClusterId;
+SELECT NodeId, ClusterId, Host, OpcUaPort, ApplicationUri, ServiceLevelBase
+  FROM dbo.ClusterNode ORDER BY ClusterId, NodeId;

docker-dev/traefik-dynamic.yml

@@ -1,6 +1,12 @@
-# docker-dev companion to scripts/install/traefik-dynamic.yml. Same routing rules,
-# but the upstream targets are the Compose service names (admin-a, admin-b) on
-# port 9000 instead of the Windows hostnames a bare-metal deployment would use.
+# docker-dev companion to scripts/install/traefik-dynamic.yml. Routes three
+# Akka clusters that share the Compose network:
+#
+#   - Main cluster (default): PathPrefix(`/`) → admin-a / admin-b.
+#   - Site A cluster:         Host(`site-a.localhost`) → site-a-1 / site-a-2.
+#   - Site B cluster:         Host(`site-b.localhost`) → site-b-1 / site-b-2.
+#
+# Host-header rules are more specific than PathPrefix, so they win over the
+# default router for the site hostnames automatically — no priority field needed.
 
 http:
   routers:
@@ -9,6 +15,16 @@ http:
       rule: "PathPrefix(`/`)"
       service: otopcua-admin
 
+    otopcua-site-a:
+      entryPoints: ["web"]
+      rule: "Host(`site-a.localhost`)"
+      service: otopcua-site-a
+
+    otopcua-site-b:
+      entryPoints: ["web"]
+      rule: "Host(`site-b.localhost`)"
+      service: otopcua-site-b
+
   services:
     otopcua-admin:
       loadBalancer:
@@ -19,3 +35,23 @@ http:
           path: /health/active
           interval: 5s
           timeout: 2s
+
+    otopcua-site-a:
+      loadBalancer:
+        servers:
+          - url: "http://site-a-1:9000"
+          - url: "http://site-a-2:9000"
+        healthCheck:
+          path: /health/active
+          interval: 5s
+          timeout: 2s
+
+    otopcua-site-b:
+      loadBalancer:
+        servers:
+          - url: "http://site-b-1:9000"
+          - url: "http://site-b-2:9000"
+        healthCheck:
+          path: /health/active
+          interval: 5s
+          timeout: 2s

docs/AddressSpace.md

@@ -1,6 +1,6 @@
 # Address Space
 
-Each driver's browsable subtree is built by streaming nodes from the driver's `ITagDiscovery.DiscoverAsync` implementation into an `IAddressSpaceBuilder`. `GenericDriverNodeManager` (`src/Core/ZB.MOM.WW.OtOpcUa.Core/OpcUa/GenericDriverNodeManager.cs`) owns the shared orchestration; `DriverNodeManager` (`src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/DriverNodeManager.cs`) implements `IAddressSpaceBuilder` against the OPC Foundation stack's `CustomNodeManager2`. The same code path serves Galaxy object hierarchies, Modbus PLC registers, AB CIP tags, TwinCAT symbols, FOCAS CNC parameters, and OPC UA Client aggregations — Galaxy is one driver of seven, not the driver.
+Each driver's browsable subtree is built by streaming nodes from the driver's `ITagDiscovery.DiscoverAsync` implementation into an `IAddressSpaceBuilder`. `GenericDriverNodeManager` (`src/Core/ZB.MOM.WW.OtOpcUa.Core/OpcUa/GenericDriverNodeManager.cs`) owns the shared orchestration; in v2 the SDK-driven materialization is handled by `OtOpcUaNodeManager` (`src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaNodeManager.cs`) fed via `SdkAddressSpaceSink` (`src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/SdkAddressSpaceSink.cs`). The same code path serves Galaxy object hierarchies, Modbus PLC registers, AB CIP tags, TwinCAT symbols, FOCAS CNC parameters, and OPC UA Client aggregations — Galaxy is one driver of seven, not the driver.
 
 ## Driver root folder
 
@@ -66,7 +66,7 @@ Drivers that implement `IRediscoverable` fire `OnRediscoveryNeeded` when their b
 ## Key source files
 
 - `src/Core/ZB.MOM.WW.OtOpcUa.Core/OpcUa/GenericDriverNodeManager.cs` — orchestration + `CapturingBuilder`
-- `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/DriverNodeManager.cs` — OPC UA materialization (`IAddressSpaceBuilder` impl + `NestedBuilder`)
+- `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaNodeManager.cs`, `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/SdkAddressSpaceSink.cs` — OPC UA materialization (write-only sink fed by the actor system)
 - `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/IAddressSpaceBuilder.cs` — builder contract
 - `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/ITagDiscovery.cs` — driver discovery capability
 - `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverAttributeInfo.cs` — per-attribute descriptor

docs/AlarmTracking.md

@@ -15,9 +15,10 @@ historical reference.
 | **Galaxy sub-attribute fallback**  | `IWritable` writes to `$Alarm*` sub-attributes | gateway data subscription → driver `OnDataChange` → `DriverNodeManager` ConditionSink → `AlarmConditionService` |
 | **Scripted alarms**                | `Phase7EngineComposer` | server-side script evaluator → `Phase7EngineComposer.RouteToHistorianAsync` + `AlarmConditionService` |
 
-All three converge on `AlarmConditionService` (`src/Server/ZB.MOM.WW.OtOpcUa.Server/Alarms/AlarmConditionService.cs`),
-which owns the OPC UA Part 9 state machine and dispatches transitions
-to the OPC UA condition node managers. Driver-native transitions take
+All three converge on the alarm-state actor — in v2 the OPC UA Part 9 state
+machine lives inside `ScriptedAlarmActor`
+(`src/Server/ZB.MOM.WW.OtOpcUa.Runtime/ScriptedAlarms/ScriptedAlarmActor.cs`),
+which dispatches transitions to the OPC UA condition node managers. Driver-native transitions take
 precedence over sub-attribute synthesis when both arrive for the same
 condition — the dedup logic prefers the richer driver-native record
 because it carries the full operator + raise-time + category metadata

docs/IncrementalSync.md

@@ -28,7 +28,7 @@ Static drivers (Modbus, S7, AB CIP, AB Legacy, FOCAS) do not implement `IRedisco
 
 Tag-set changes authored in the Admin UI (UNS edits, CSV imports, driver-config edits) accumulate in a draft generation and commit via `sp_PublishGeneration`. The delta between the currently-published generation and the proposed next one is computed by `sp_ComputeGenerationDiff`, which drives:
 
-- The **DiffViewer** in Admin (`src/Server/ZB.MOM.WW.OtOpcUa.Admin/Components/Pages/Clusters/DiffViewer.razor`) so operators can preview what will change before clicking Publish.
+- The publish-preview surface in the Admin UI (`src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/Deployments.razor`, backed by `AdminOperationsClient`) so operators can preview what will change before clicking Publish.
 - The 409-on-stale-draft flow (decision #161) — a UNS drag-reorder preview carries a `DraftRevisionToken` so Confirm returns `409 Conflict / refresh-required` if the draft advanced between preview and commit.
 
 After publish, the server's generation applier invokes `IDriver.ReinitializeAsync(driverConfigJson, ct)` on every driver whose `DriverInstance.DriverConfig` row changed in the new generation. Reinitialize is the in-process recovery path for Tier A/B drivers; if it fails the driver is marked `DriverState.Faulted` and its nodes go Bad quality — but the server process stays running. See `docs/v2/driver-stability.md`.
@@ -64,6 +64,7 @@ Subscriptions for unchanged references stay live across rebuilds — their ref-c
 - `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/IRediscoverable.cs` — backend-change capability
 - `src/Core/ZB.MOM.WW.OtOpcUa.Core/OpcUa/GenericDriverNodeManager.cs` — discovery orchestration
 - `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/IDriver.cs` — `ReinitializeAsync` contract
-- `src/Server/ZB.MOM.WW.OtOpcUa.Admin/Services/GenerationService.cs` — publish-flow driver
+- `src/Server/ZB.MOM.WW.OtOpcUa.ControlPlane/Coordinators/ConfigPublishCoordinator.cs` — publish-flow driver
+- `src/Server/ZB.MOM.WW.OtOpcUa.ControlPlane/AdminOperations/AdminOperationsActor.cs` — cluster singleton invoked by the Admin UI's `AdminOperationsClient`
 - `docs/v2/config-db-schema.md` — `sp_PublishGeneration` + `sp_ComputeGenerationDiff`
 - `docs/v2/admin-ui.md` — DiffViewer + draft-revision-token flow

docs/OpcUaServer.md

@@ -1,13 +1,13 @@
 # OPC UA Server
 
-The OPC UA server component (`src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/OtOpcUaServer.cs`) hosts the OPC UA stack and exposes one browsable subtree per registered driver. The server itself is driver-agnostic — Galaxy/MXAccess, Modbus, S7, AB CIP, AB Legacy, TwinCAT, FOCAS, and OPC UA Client are all plugged in as `IDriver` implementations via the capability interfaces in `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/`.
+The OPC UA server component (`src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaSdkServer.cs`) hosts the OPC UA stack and exposes one browsable subtree per registered driver. The server itself is driver-agnostic — Galaxy/MXAccess, Modbus, S7, AB CIP, AB Legacy, TwinCAT, FOCAS, and OPC UA Client are all plugged in as `IDriver` implementations via the capability interfaces in `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/`.
 
 ## Composition
 
 `OtOpcUaServer` subclasses the OPC Foundation `StandardServer` and wires:
 
 - A `DriverHost` (`src/Core/ZB.MOM.WW.OtOpcUa.Core/Hosting/DriverHost.cs`) which registers drivers and holds the per-instance `IDriver` references.
-- One `DriverNodeManager` per registered driver (`src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/DriverNodeManager.cs`), constructed in `CreateMasterNodeManager`. Each manager owns its own namespace URI (`urn:OtOpcUa:{DriverInstanceId}`) and exposes the driver as a subtree under the standard `Objects` folder.
+- One `DriverNodeManager` per registered driver (`src/Core/ZB.MOM.WW.OtOpcUa.Core/OpcUa/GenericDriverNodeManager.cs`), constructed in `CreateMasterNodeManager`. Each manager owns its own namespace URI (`urn:OtOpcUa:{DriverInstanceId}`) and exposes the driver as a subtree under the standard `Objects` folder.
 - A `CapabilityInvoker` (`src/Core/ZB.MOM.WW.OtOpcUa.Core/Resilience/CapabilityInvoker.cs`) per driver instance, keyed on `(DriverInstanceId, HostName, DriverCapability)` against the shared `DriverResiliencePipelineBuilder`. Every Read/Write/Discovery/Subscribe/HistoryRead/AlarmSubscribe call on the driver flows through this invoker so the Polly pipeline (retry / timeout / breaker / bulkhead) applies. The OTOPCUA0001 Roslyn analyzer enforces the wrapping at compile time.
 - An `IUserAuthenticator` (LDAP in production, injected stub in tests) for `UserName` token validation in the `ImpersonateUser` hook.
 - Optional `AuthorizationGate` + `NodeScopeResolver` (Phase 6.2) that sit in front of every dispatch call. In lax mode the gate passes through when the identity lacks LDAP groups so existing integration tests keep working; strict mode (`Authorization:StrictMode = true`) denies those cases.
@@ -50,7 +50,7 @@ The host name fed to the invoker comes from `IPerCallHostResolver.ResolveHost(fu
 
 ## Redundancy
 
-`Redundancy.Enabled = true` on the `ServerInstance` activates the `RedundancyCoordinator` + `ServiceLevelCalculator` (`src/Server/ZB.MOM.WW.OtOpcUa.Server/Redundancy/`). Standard OPC UA redundancy nodes (`Server/ServerRedundancy/RedundancySupport`, `ServerUriArray`, `Server/ServiceLevel`) are populated on startup; `ServiceLevel` recomputes whenever any driver's `DriverHealth` changes. The apply-lease mechanism prevents two instances from concurrently applying a generation. See `docs/Redundancy.md`.
+`Redundancy.Enabled = true` on the `ServerInstance` activates the `RedundancyStateActor` + `ServiceLevelCalculator` (`src/Server/ZB.MOM.WW.OtOpcUa.ControlPlane/Redundancy/`). Standard OPC UA redundancy nodes (`Server/ServerRedundancy/RedundancySupport`, `ServerUriArray`, `Server/ServiceLevel`) are populated on startup; `ServiceLevel` recomputes whenever any driver's `DriverHealth` changes. The apply-lease mechanism prevents two instances from concurrently applying a generation. See `docs/Redundancy.md`.
 
 ## Server class hierarchy
 
@@ -79,10 +79,11 @@ Certificate stores default to `%LOCALAPPDATA%\OPC Foundation\pki\` (directory-ba
 
 ## Key source files
 
-- `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/OtOpcUaServer.cs` — `StandardServer` subclass + `ImpersonateUser` hook
-- `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/DriverNodeManager.cs` — per-driver `CustomNodeManager2` + dispatch surface
-- `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/OpcUaApplicationHost.cs` — programmatic `ApplicationConfiguration` + lifecycle
+- `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaSdkServer.cs` — `StandardServer` subclass
+- `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OpcUaApplicationHost.cs` — programmatic `ApplicationConfiguration` + lifecycle + `ImpersonateUser` hook
+- `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaNodeManager.cs` — SDK node manager + write-only address-space sink
+- `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/SdkAddressSpaceSink.cs` — `IOpcUaAddressSpaceSink` adapter the actor system pushes into
+- `src/Core/ZB.MOM.WW.OtOpcUa.Core/OpcUa/GenericDriverNodeManager.cs` — per-driver discovery + dispatch surface
 - `src/Core/ZB.MOM.WW.OtOpcUa.Core/Hosting/DriverHost.cs` — driver registration
 - `src/Core/ZB.MOM.WW.OtOpcUa.Core/Resilience/CapabilityInvoker.cs` — Polly pipeline entry point
-- `src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/` — Phase 6.2 permission trie + evaluator
-- `src/Server/ZB.MOM.WW.OtOpcUa.Server/Security/AuthorizationGate.cs` — stack-to-evaluator bridge
+- `src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/` — permission trie + evaluator (`PermissionTrie`, `PermissionTrieCache`, `TriePermissionEvaluator`)

docs/README.md

@@ -59,7 +59,7 @@ For Modbus / S7 / AB CIP / AB Legacy / TwinCAT / FOCAS / OPC UA Client specifics
 | [security.md](security.md) | Transport security profiles, LDAP auth, ACL trie, role grants, OTOPCUA0001 analyzer |
 | [Redundancy.md](Redundancy.md) | `RedundancyCoordinator`, `ServiceLevelCalculator`, apply-lease, Prometheus metrics |
 | [Reservations.md](Reservations.md) | Fleet-wide ZTag / SAPID external-ID reservations — publish-time claim, release flow |
-| [ServiceHosting.md](ServiceHosting.md) | Two-process deploy (Server + Admin) install/uninstall, plus the optional `OtOpcUaWonderwareHistorian` sidecar |
+| [ServiceHosting.md](ServiceHosting.md) | Single fused `OtOpcUa.Host` binary install/uninstall with `OTOPCUA_ROLES` gating, plus the optional `OtOpcUaWonderwareHistorian` sidecar |
 | [StatusDashboard.md](StatusDashboard.md) | Pointer — superseded by [v2/admin-ui.md](v2/admin-ui.md) |
 
 ### Client tooling

docs/ReadWriteOperations.md

@@ -1,6 +1,6 @@
 # Read/Write Operations
 
-`DriverNodeManager` (`src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/DriverNodeManager.cs`) wires the OPC UA stack's per-variable `OnReadValue` and `OnWriteValue` hooks to each driver's `IReadable` and `IWritable` capabilities. Every dispatch flows through `CapabilityInvoker` so the Polly pipeline (retry / timeout / breaker / bulkhead) applies uniformly across Galaxy, Modbus, S7, AB CIP, AB Legacy, TwinCAT, FOCAS, and OPC UA Client drivers.
+`GenericDriverNodeManager` (`src/Core/ZB.MOM.WW.OtOpcUa.Core/OpcUa/GenericDriverNodeManager.cs`) wires the OPC UA stack's per-variable `OnReadValue` and `OnWriteValue` hooks to each driver's `IReadable` and `IWritable` capabilities. Every dispatch flows through `CapabilityInvoker` so the Polly pipeline (retry / timeout / breaker / bulkhead) applies uniformly across Galaxy, Modbus, S7, AB CIP, AB Legacy, TwinCAT, FOCAS, and OPC UA Client drivers.
 
 ## Driver vs virtual dispatch
 
@@ -60,8 +60,7 @@ Per decision #12, exceptions in the driver's capability call are logged and conv
 
 ## Key source files
 
-- `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/DriverNodeManager.cs` — `OnReadValue` / `OnWriteValue` hooks
-- `src/Server/ZB.MOM.WW.OtOpcUa.Server/Security/WriteAuthzPolicy.cs` — classification-to-role policy
-- `src/Server/ZB.MOM.WW.OtOpcUa.Server/Security/AuthorizationGate.cs` — Phase 6.2 trie gate
+- `src/Core/ZB.MOM.WW.OtOpcUa.Core/OpcUa/GenericDriverNodeManager.cs` — `OnReadValue` / `OnWriteValue` hooks
+- `src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/` — permission trie + evaluator (`PermissionTrie`, `PermissionTrieCache`, `TriePermissionEvaluator`) that gates Read/Write/Subscribe per the session's resolved LDAP groups
 - `src/Core/ZB.MOM.WW.OtOpcUa.Core/Resilience/CapabilityInvoker.cs` — `ExecuteAsync` / `ExecuteWriteAsync`
 - `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/IReadable.cs`, `IWritable.cs`, `WriteIdempotentAttribute.cs`

docs/Redundancy.md

@@ -2,7 +2,9 @@
 
 ## Overview
 
-OtOpcUa supports OPC UA **non-transparent** warm/hot redundancy. Two or more `OtOpcUa.Host` processes run side-by-side, share the same Config DB, and join the same Akka.NET cluster. Each process owns a distinct `ApplicationUri`; OPC UA clients see both endpoints via the standard `ServerUriArray` and pick one based on the `ServiceLevel` byte that each server publishes.
+OtOpcUa supports OPC UA **non-transparent** warm/hot redundancy. Two or more `OtOpcUa.Host` processes run side-by-side, share the same Config DB, and join the same Akka.NET cluster. Each process owns a distinct `ApplicationUri`; OPC UA clients discover both endpoints by reading `Server.ServerArray` (NodeId `i=2254`) on either node and pick one based on the `ServiceLevel` byte that each server publishes.
+
+> **Discovery surface.** The `ServerArray` path on the `Server` object is what each node populates with self + peer `ApplicationUri`s — see `OpcUaApplicationHost.PopulateServerArray` and the per-node `PeerApplicationUris` option below. The redundancy-object-type `ServerUriArray` proper (a child of `Server.ServerRedundancy`) remains deferred pending an SDK object-type upgrade; clients should read `Server.ServerArray` for peer discovery today.
 
 > **v2 change.** v1's operator-managed `ClusterNode.RedundancyRole` column + `RedundancyCoordinator` / `ApplyLeaseRegistry` / `PeerHttpProbeLoop` are gone. Primary/secondary is now derived from **Akka cluster role-leader** for the `driver` role. The operator no longer writes a role into the DB; cluster topology + health drive ServiceLevel automatically.
 
@@ -78,6 +80,20 @@ Both nodes share the same `ConfigDb` connection string; `Cluster.PublicHostname`
 
 There is no longer a `Node:NodeId` setting, no `ClusterNode.RedundancyRole`, no `ServiceLevelBase`. NodeId is derived as `host:port` of the cluster `PublicHostname` (see `ClusterRoleInfo.LocalNode` for the formula).
 
+### Peer URI advertising
+
+Each node advertises its partner via `OpcUaApplicationHostOptions.PeerApplicationUris` (an `IList<string>`, default empty). `OpcUaApplicationHost.PopulateServerArray` appends each configured peer URI to the SDK's `IServerInternal.ServerUris` string table after server startup, so that `Server.ServerArray` reads served by `OnReadServerArray` return both self + peers. Set this per-node in `appsettings.json`:
+
+```json
+{
+  "OpcUaServer": {
+    "PeerApplicationUris": ["urn:node-b:OtOpcUa"]
+  }
+}
+```
+
+Node A lists Node B's `ApplicationUri` and vice-versa. Validated by `DualEndpointTests` in `tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/` — boots two `OpcUaApplicationHost` instances on loopback, asserts a real OPCFoundation client `Session` reading `Server.ServerArray` from Node A sees both URIs.
+
 ## Split-brain
 
 `akka.conf` configures Akka's split-brain resolver with `active-strategy = keep-oldest`, `stable-after = 15s`, and `failure-detector.threshold = 10.0`. Under a clean partition: the oldest member stays up + the smaller (or younger) side downs itself within ~15 seconds. The `RedundancyStateActor` on the surviving partition re-computes from the post-partition `Cluster.State`.

docs/ScriptedAlarms.md

@@ -111,13 +111,13 @@ Emissions map into `AlarmEventArgs` as `AlarmType = Kind.ToString()`, `SourceNod
 
 ## Composition
 
-`Phase7EngineComposer.Compose` (`src/Server/ZB.MOM.WW.OtOpcUa.Server/Phase7/Phase7EngineComposer.cs`) is the single call site that instantiates the engine. It takes the generation's `Script` / `VirtualTag` / `ScriptedAlarm` rows, the shared `CachedTagUpstreamSource`, an `IAlarmStateStore`, and an `IAlarmHistorianSink`, and returns a `Phase7ComposedSources` the caller owns. When `scriptedAlarms.Count > 0`:
+`Phase7Composer` (`src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/Phase7Composer.cs`) is the single call site that instantiates the engine. It takes the generation's `Script` / `VirtualTag` / `ScriptedAlarm` rows, the shared upstream-tag source, an `IAlarmStateStore`, and an `IAlarmHistorianSink`, and returns the composed sources the caller owns. When `scriptedAlarms.Count > 0`:
 
 1. `ProjectScriptedAlarms` resolves each row's `PredicateScriptId` against the script dictionary and produces a `ScriptedAlarmDefinition` list. Unknown or disabled scripts throw immediately — the DB publish guarantees referential integrity but this is a belt-and-braces check.
 2. A `ScriptedAlarmEngine` is constructed with the upstream source, the store, a shared `ScriptLoggerFactory` keyed to `scripts-*.log`, and the root Serilog logger.
 3. `alarmEngine.OnEvent` is wired to `RouteToHistorianAsync`, which projects each emission into an `AlarmHistorianEvent` and enqueues it on the sink. Fire-and-forget — the SQLite store-and-forward sink is already non-blocking.
 4. `LoadAsync(alarmDefs)` runs synchronously on the startup thread: it compiles every predicate, subscribes to the union of predicate inputs and message-template tokens, seeds the value cache, loads persisted state, re-derives `ActiveState` from a fresh predicate evaluation, and starts the 5s shelving timer. Compile failures are aggregated into one `InvalidOperationException` so operators see every bad predicate in one startup log line rather than one at a time.
-5. A `ScriptedAlarmSource` is created for the event stream, and a `ScriptedAlarmReadable` (`src/Server/ZB.MOM.WW.OtOpcUa.Server/Phase7/ScriptedAlarmReadable.cs`) is created for OPC UA variable reads on the alarm's active-state node (task #245) — unknown alarm ids return `BadNodeIdUnknown` rather than silently reading `false`.
+5. A `ScriptedAlarmSource` is created for the event stream; the v2 `ScriptedAlarmActor` (`src/Server/ZB.MOM.WW.OtOpcUa.Runtime/ScriptedAlarms/ScriptedAlarmActor.cs`) owns the active-state surface for OPC UA variable reads on the alarm's active-state node (task #245) — unknown alarm ids return `BadNodeIdUnknown` rather than silently reading `false`.
 
 Both engine and source are added to `Phase7ComposedSources.Disposables`, which `Phase7Composer` disposes on server shutdown.
 
@@ -132,5 +132,7 @@ Both engine and source are added to `Phase7ComposedSources.Disposables`, which `
 - `src/Core/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms/AlarmTypes.cs` — `AlarmKind` + the four Part 9 enums
 - `src/Core/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms/MessageTemplate.cs` — `{path}` placeholder resolver
 - `src/Core/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms/IAlarmStateStore.cs` — persistence contract + `InMemoryAlarmStateStore` default
-- `src/Server/ZB.MOM.WW.OtOpcUa.Server/Phase7/Phase7EngineComposer.cs` — composition, config-row projection, historian routing
-- `src/Server/ZB.MOM.WW.OtOpcUa.Server/Phase7/ScriptedAlarmReadable.cs` — `IReadable` adapter exposing `ActiveState` to OPC UA variable reads
+- `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/Phase7Composer.cs` — composition, config-row projection, historian routing
+- `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/Phase7Applier.cs` — applies the composed Phase 7 plan into the SDK node manager
+- `src/Server/ZB.MOM.WW.OtOpcUa.Runtime/ScriptedAlarms/ScriptedAlarmActor.cs` — actor wrapper owning the alarm state machine and exposing `ActiveState` for OPC UA variable reads
+- `src/Server/ZB.MOM.WW.OtOpcUa.Host/Engines/RoslynScriptedAlarmEvaluator.cs` — production Roslyn predicate evaluator

docs/ServiceHosting.md

@@ -25,6 +25,16 @@ Galaxy access still uses the separately-installed **mxaccessgw** sidecar (see `d
 
 Single-node dev: `OTOPCUA_ROLES=admin,driver`. Production: typically two admin nodes (HA pair) + N driver nodes.
 
+### Per-role configuration overlays
+
+`Program.cs:33-35` builds a role suffix by joining the parsed roles **alphabetically** with `-` and loads `appsettings.{roleSuffix}.json` as an optional overlay on top of base `appsettings.json`. Three overlays ship in `src/Server/ZB.MOM.WW.OtOpcUa.Host/`:
+
+- `appsettings.admin.json` — admin-only nodes
+- `appsettings.driver.json` — driver-only nodes
+- `appsettings.admin-driver.json` — fused single-node dev / small deployments
+
+All three carry Serilog log-level overrides + `Security:Ldap:DevStubMode = false`. Loading order is **base `appsettings.json` → role overlay (`appsettings.{role}.json`) → environment overlay (`appsettings.{Environment}.json`)** — later layers win. Overlays are optional; the base file boots a node on its own.
+
 ## Akka cluster
 
 The host joins an Akka.NET cluster bound to the address in `appsettings.json::Cluster`:

docs/VirtualTags.md

@@ -107,13 +107,12 @@ Per [ADR-002](v2/implementation/adr-002-driver-vs-virtual-dispatch.md) Option B,
 
 `ITagUpstreamSource` and `IHistoryWriter` are the two ports the engine requires from its host. Both live in `Core.VirtualTags`. In the Server process:
 
-- **`CachedTagUpstreamSource`** (`src/Server/ZB.MOM.WW.OtOpcUa.Server/Phase7/CachedTagUpstreamSource.cs`) implements the interface (and the parallel `Core.ScriptedAlarms.ITagUpstreamSource` — identical shape, distinct namespace). A `ConcurrentDictionary<path, DataValueSnapshot>` cache. `Push(path, snapshot)` updates the cache and fans out synchronously to every observer. Reads of never-pushed paths return `BadNodeIdUnknown` quality (`UpstreamNotConfigured = 0x80340000`).
-- **`DriverSubscriptionBridge`** (`src/Server/ZB.MOM.WW.OtOpcUa.Server/Phase7/DriverSubscriptionBridge.cs`) feeds the cache. For each registered `ISubscribable` driver it batches a single `SubscribeAsync` for every fullRef the script graph references, installs an `OnDataChange` handler that translates driver-opaque fullRefs back to UNS paths via a reverse map, and pushes each delta into `CachedTagUpstreamSource`. Unsubscribes on dispose. The bridge suppresses `OTOPCUA0001` (the Roslyn analyzer that requires `ISubscribable` callers to go through `CapabilityInvoker`) on the documented basis that this is a lifecycle wiring, not per-evaluation hot path.
+- **Upstream-tag feed.** In v2 the upstream-tag feed is provided by the actor system. `DependencyMuxActor` (`src/Server/ZB.MOM.WW.OtOpcUa.Runtime/VirtualTags/DependencyMuxActor.cs`) multiplexes driver `ISubscribable` subscriptions for every fullRef the script graph references, translating driver-opaque fullRefs back to UNS paths via a reverse map. Deltas land on `VirtualTagActor` (`src/Server/ZB.MOM.WW.OtOpcUa.Runtime/VirtualTags/VirtualTagActor.cs`) as `DependencyValueChanged` messages; the actor's in-memory cache serves the engine's synchronous `GetTag` reads. Reads of never-pushed paths return `BadNodeIdUnknown` quality (`UpstreamNotConfigured = 0x80340000`).
 - **`IHistoryWriter`** — no production implementation is currently wired for virtual tags; `VirtualTagEngine` gets `NullHistoryWriter` by default from `Phase7EngineComposer`.
 
 ## Composition
 
-`Phase7Composer` (`src/Server/ZB.MOM.WW.OtOpcUa.Server/Phase7/Phase7Composer.cs`) is an `IAsyncDisposable` injected into `OpcUaServerService`:
+`Phase7Composer` (`src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/Phase7Composer.cs`) projects the published generation into a `Phase7Plan` that `Phase7Applier` applies to the running SDK node manager:
 
 1. `PrepareAsync(generationId, ct)` — called after the bootstrap generation loads and before `OpcUaApplicationHost.StartAsync`. Reads the `Script` / `VirtualTag` / `ScriptedAlarm` rows for that generation from the config DB (`OtOpcUaConfigDbContext`). Empty-config fast path returns `Phase7ComposedSources.Empty`.
 2. Constructs a `CachedTagUpstreamSource` + hands it to `Phase7EngineComposer.Compose`.
@@ -145,8 +144,9 @@ Definition reload on config publish: `VirtualTagEngine.Load` is re-entrant — a
 - `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/ITagUpstreamSource.cs` — driver-tag read + subscribe port
 - `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/IHistoryWriter.cs` — historize sink port + `NullHistoryWriter`
 - `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/VirtualTagSource.cs` — `IReadable` + `ISubscribable` adapter
-- `src/Server/ZB.MOM.WW.OtOpcUa.Server/Phase7/CachedTagUpstreamSource.cs` — production `ITagUpstreamSource`
-- `src/Server/ZB.MOM.WW.OtOpcUa.Server/Phase7/DriverSubscriptionBridge.cs` — driver `ISubscribable` → cache feed
-- `src/Server/ZB.MOM.WW.OtOpcUa.Server/Phase7/Phase7EngineComposer.cs` — row projection + engine instantiation
-- `src/Server/ZB.MOM.WW.OtOpcUa.Server/Phase7/Phase7Composer.cs` — lifecycle host: load rows, compose, wire bridge
-- `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/DriverNodeManager.cs` — `SelectReadable` + `IsWriteAllowedBySource` dispatch kernel
+- `src/Server/ZB.MOM.WW.OtOpcUa.Runtime/VirtualTags/VirtualTagActor.cs` — actor wrapper that owns per-instance state and the synchronous read cache
+- `src/Server/ZB.MOM.WW.OtOpcUa.Runtime/VirtualTags/DependencyMuxActor.cs` — driver `ISubscribable` → actor feed (replaces the v1 `DriverSubscriptionBridge`)
+- `src/Server/ZB.MOM.WW.OtOpcUa.Host/Engines/RoslynVirtualTagEvaluator.cs` — production Roslyn evaluator wired into the actor
+- `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/Phase7Composer.cs` — row projection + engine instantiation (`Phase7Plan` composer)
+- `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/Phase7Applier.cs` — applies the composed plan into the SDK node manager
+- `src/Core/ZB.MOM.WW.OtOpcUa.Core/OpcUa/GenericDriverNodeManager.cs` — driver-vs-virtual dispatch kernel

docs/drivers/OpcUaClient-Test-Fixture.md

@@ -136,9 +136,10 @@ ConditionType events (non-base `BaseEventType`) is not verified.
 ## Follow-up candidates
 
 The easiest win here is to **wire the client driver tests against this
-repo's own server**. The integration test project
-`tests/Server/ZB.MOM.WW.OtOpcUa.Server.Tests/OpcUaServerIntegrationTests.cs`
-already stands up a real OPC UA server on a non-default port with a seeded
+repo's own server**. The v2 integration test project
+`tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/DualEndpointTests.cs`
+(the v2 replacement for the retired v1 `OpcUaServerIntegrationTests`) already
+stands up a real OPC UA server on a non-default port with a seeded
 FakeDriver. An `OpcUaClientLiveLoopbackTests` that connects the client
 driver to that server would give:
 
@@ -165,6 +166,6 @@ Beyond that:
   mocked `Session`
 - `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/OpcUaClientDriver.cs` — ctor +
   session-factory seam tests mock through
-- `tests/Server/ZB.MOM.WW.OtOpcUa.Server.Tests/OpcUaServerIntegrationTests.cs` —
-  the server-side integration harness a future loopback client test could
-  piggyback on
+- `tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/DualEndpointTests.cs` —
+  the v2 dual-endpoint integration harness a future loopback client test could
+  piggyback on (v1 `OpcUaServerIntegrationTests.cs` retired with the v1 server project)

docs/plans/2026-05-26-akka-hosting-alignment-gaps-closeout.md

@@ -0,0 +1,716 @@
+# Akka Hosting Alignment — Gap Closeout Implementation Plan
+
+> **For Claude:** REQUIRED SUB-SKILL: Use `superpowers-extended-cc:executing-plans` to implement this plan task-by-task.
+
+**Goal:** Close the four real/cosmetic gaps identified by the audit of `docs/plans/2026-05-26-akka-hosting-alignment-plan.md` so the v2 implementation matches the plan's literal contract (per-role appsettings overlays, explicit dual-endpoint visibility test, plan-prescribed filenames, removal of empty legacy directories).
+
+**Architecture:** Additive only. No production-runtime semantics change. One small extension to `OpcUaApplicationHost` so the OPC UA server can advertise peer URIs in `Server.ServerArray` — gated on a new option, defaults to old behavior. Everything else is JSON, test code, file moves, and `rm -rf` of stale bin/obj trees.
+
+**Tech Stack:** .NET 10, OPCFoundation .NET Standard SDK (`Opc.Ua.*`), xunit.v3, Shouldly, EF Core 10 (inherited; no schema changes).
+
+**Source plan:** `docs/plans/2026-05-26-akka-hosting-alignment-plan.md`. The audit findings closed by this plan map to Tasks 54, 59, 60, and the post-Task-56 cosmetic cleanup. **Read the source plan's "Conventions for every task" block — those rules still apply here.**
+
+**Branch:** `v2-gap-closeout` off `master`.
+
+---
+
+## Conventions for every task
+
+- **Branch:** Stay on `v2-gap-closeout`. Never commit to `master` while plan is running.
+- **Build command:** `dotnet build ZB.MOM.WW.OtOpcUa.slnx` — must be green before commit.
+- **Test command:** `dotnet test ZB.MOM.WW.OtOpcUa.slnx --no-build` — relevant new/changed tests must pass.
+- **Commit format:** Conventional Commits matching the source plan — `feat(host):`, `test(opcua):`, `chore(cleanup):`, `refactor(test):`, etc.
+- **Mac compatibility:** All code must build on macOS. The new dual-endpoint test boots two real OPC UA servers on loopback — works on macOS (no Windows-only APIs needed; PKI is created under a per-test temp dir).
+
+---
+
+## Task 0: Add three role-overlay appsettings files (Task 54 gap)
+
+**Classification:** small
+**Estimated implement time:** ~3 min
+**Parallelizable with:** Task 1, Task 5, Task 6
+
+**Files:**
+- Create: `/Users/dohertj2/Desktop/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.Host/appsettings.admin.json`
+- Create: `/Users/dohertj2/Desktop/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.Host/appsettings.driver.json`
+- Create: `/Users/dohertj2/Desktop/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.Host/appsettings.admin-driver.json`
+
+**Background:**
+`Program.cs` line 33-35 loads `appsettings.{role-suffix}.json` where the suffix is the roles joined alphabetically with `'-'`. Today the loader passes `optional: true`, so the host boots without these files — but the source plan (Task 54) called them out as required scaffolding so operators have per-role tunable defaults.
+
+Suffix matrix:
+| `OTOPCUA_ROLES` env | Loaded file |
+|---|---|
+| `admin` | `appsettings.admin.json` |
+| `driver` | `appsettings.driver.json` |
+| `admin,driver` (any order) | `appsettings.admin-driver.json` (joined alphabetical) |
+
+**Step 1: Create `appsettings.admin.json`**
+
+Admin-only nodes don't bind drivers; tighten Serilog and disable the LDAP dev stub by default.
+
+```json
+{
+  "Serilog": {
+    "MinimumLevel": {
+      "Default": "Information",
+      "Override": {
+        "Microsoft.AspNetCore": "Warning",
+        "Akka": "Information"
+      }
+    }
+  },
+  "Security": {
+    "Ldap": {
+      "DevStubMode": false
+    }
+  }
+}
+```
+
+**Step 2: Create `appsettings.driver.json`**
+
+Driver-only nodes have no Admin UI; raise OPC UA verbosity slightly so per-node diagnostics flow to logs.
+
+```json
+{
+  "Serilog": {
+    "MinimumLevel": {
+      "Default": "Information",
+      "Override": {
+        "Opc.Ua": "Debug",
+        "Akka": "Information"
+      }
+    }
+  },
+  "Security": {
+    "Ldap": {
+      "DevStubMode": false
+    }
+  }
+}
+```
+
+**Step 3: Create `appsettings.admin-driver.json`**
+
+Combined-role nodes (the docker-dev compose default + the integration test harness) — turn on both surfaces with shared defaults.
+
+```json
+{
+  "Serilog": {
+    "MinimumLevel": {
+      "Default": "Information",
+      "Override": {
+        "Microsoft.AspNetCore": "Warning",
+        "Opc.Ua": "Information",
+        "Akka": "Information"
+      }
+    }
+  },
+  "Security": {
+    "Ldap": {
+      "DevStubMode": false
+    }
+  }
+}
+```
+
+**Step 4: Build green check**
+
+Run: `dotnet build ZB.MOM.WW.OtOpcUa.slnx`
+Expected: succeeds. (JSON files do not break the build; this is a smoke check that nothing else regressed.)
+
+**Step 5: Commit**
+
+```bash
+git add src/Server/ZB.MOM.WW.OtOpcUa.Host/appsettings.admin.json \
+        src/Server/ZB.MOM.WW.OtOpcUa.Host/appsettings.driver.json \
+        src/Server/ZB.MOM.WW.OtOpcUa.Host/appsettings.admin-driver.json
+git commit -m "feat(host): add per-role appsettings overlays for admin/driver/admin-driver"
+```
+
+---
+
+## Task 1: Extend `OpcUaApplicationHost` with `PeerApplicationUris` + populate `Server.ServerArray`
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 0, Task 5, Task 6
+
+**Files:**
+- Modify: `/Users/dohertj2/Desktop/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OpcUaApplicationHost.cs` (add option + post-start population)
+- Test: `/Users/dohertj2/Desktop/OtOpcUa/tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/OpcUaApplicationHostServerArrayTests.cs`
+
+**Background:**
+The source plan's Task 60 promised a test where "real OPCFoundation client → both endpoints visible in ServerUriArray". That requires production code to populate the peer URIs onto each server's `Server.ServerArray` (NodeId i=2254) property. No such code exists in v2 today — this task adds it as an opt-in option so existing single-node tests keep their current behavior. Task 3 then writes the integration test that drives it across two servers.
+
+**Step 1: Write the failing unit test**
+
+Create `tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/OpcUaApplicationHostServerArrayTests.cs`:
+
+```csharp
+using System.IO;
+using System.Net.Sockets;
+using System.Net;
+using Microsoft.Extensions.Logging.Abstractions;
+using Opc.Ua;
+using Opc.Ua.Server;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.OpcUaServer;
+
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests;
+
+/// <summary>
+/// Audit gap closeout — verifies <see cref="OpcUaApplicationHostOptions.PeerApplicationUris"/>
+/// is reflected in <c>Server.ServerArray</c> after start. Single-server in-process check; the
+/// cross-server visibility check lives in <c>OtOpcUa.OpcUaServer.IntegrationTests</c>.
+/// </summary>
+public sealed class OpcUaApplicationHostServerArrayTests
+{
+    [Fact]
+    public async Task ServerArray_contains_local_uri_and_configured_peers_after_start()
+    {
+        var pkiRoot = Path.Combine(Path.GetTempPath(), $"otopcua-pki-{Guid.NewGuid():N}");
+        try
+        {
+            var options = new OpcUaApplicationHostOptions
+            {
+                ApplicationName = "OtOpcUa.UnitTest",
+                ApplicationUri = "urn:OtOpcUa.UnitTest.NodeA",
+                OpcUaPort = AllocateFreePort(),
+                PublicHostname = "127.0.0.1",
+                PkiStoreRoot = pkiRoot,
+                PeerApplicationUris = new[] { "urn:OtOpcUa.UnitTest.NodeB" },
+            };
+
+            var server = new StandardServer();
+            await using var host = new OpcUaApplicationHost(options, NullLogger<OpcUaApplicationHost>.Instance);
+            await host.StartAsync(server, CancellationToken.None);
+
+            var serverArray = server.CurrentInstance.ServerObject.ServerArray.Value;
+            serverArray.ShouldNotBeNull();
+            serverArray.ShouldContain("urn:OtOpcUa.UnitTest.NodeA");
+            serverArray.ShouldContain("urn:OtOpcUa.UnitTest.NodeB");
+        }
+        finally
+        {
+            if (Directory.Exists(pkiRoot)) Directory.Delete(pkiRoot, recursive: true);
+        }
+    }
+
+    private static int AllocateFreePort()
+    {
+        var listener = new TcpListener(IPAddress.Loopback, 0);
+        listener.Start();
+        var port = ((IPEndPoint)listener.LocalEndpoint).Port;
+        listener.Stop();
+        return port;
+    }
+}
+```
+
+**Step 2: Run the test — confirm it fails**
+
+Run: `dotnet test tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests --filter "FullyQualifiedName~OpcUaApplicationHostServerArrayTests"`
+Expected: FAIL with `PeerApplicationUris` not found (compile error) — the option doesn't exist yet.
+
+**Step 3: Add the option**
+
+Edit `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OpcUaApplicationHost.cs`. Add to `OpcUaApplicationHostOptions` (after `AutoAcceptUntrustedClientCertificates`, around line 65):
+
+```csharp
+/// <summary>
+/// Peer server URIs published in <c>Server.ServerArray</c> after start, in addition to
+/// the local <see cref="ApplicationUri"/>. Empty by default — set this on warm-redundancy
+/// deployments so OPC UA clients can discover the partner endpoint via the standard
+/// Server.ServerArray property (NodeId i=2254). Order does not matter; the local URI
+/// is always element 0.
+/// </summary>
+public IList<string> PeerApplicationUris { get; set; } = new List<string>();
+```
+
+**Step 4: Populate `Server.ServerArray` after start**
+
+Edit `OpcUaApplicationHost.StartAsync` (around line 100-118). After the `_application.Start(server)` call and before the log line, insert:
+
+```csharp
+PopulateServerArray();
+```
+
+Then add the private method below `AttachUserAuthenticator`:
+
+```csharp
+/// <summary>
+/// Writes the union of <see cref="OpcUaApplicationHostOptions.ApplicationUri"/> and
+/// <see cref="OpcUaApplicationHostOptions.PeerApplicationUris"/> to the OPC UA standard
+/// <c>Server.ServerArray</c> property (NodeId i=2254). Clients in a warm-redundancy
+/// deployment discover the partner endpoint by reading this property.
+/// </summary>
+private void PopulateServerArray()
+{
+    var serverObject = _server?.CurrentInstance?.ServerObject;
+    if (serverObject is null) return;
+
+    var uris = new List<string> { _options.ApplicationUri };
+    foreach (var peer in _options.PeerApplicationUris)
+    {
+        if (!string.IsNullOrWhiteSpace(peer) && !uris.Contains(peer))
+            uris.Add(peer);
+    }
+    serverObject.ServerArray.Value = uris.ToArray();
+}
+```
+
+**Step 5: Run the test — confirm it passes**
+
+Run: `dotnet test tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests --filter "FullyQualifiedName~OpcUaApplicationHostServerArrayTests"`
+Expected: PASS. If `ServerObject.ServerArray.Value` is read-only (some SDK versions guard it), fall back to writing through `ServerArrayNode.Value` via the address-space accessor — but try the direct write first; the SDK exposes it as a settable BaseDataVariableState on `ServerObjectState`.
+
+**Step 6: Run full OpcUaServer.Tests suite to confirm no regression**
+
+Run: `dotnet test tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests`
+Expected: all tests pass — `PopulateServerArray` is additive when `PeerApplicationUris` is empty (default), so existing tests don't change behavior.
+
+**Step 7: Commit**
+
+```bash
+git add src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OpcUaApplicationHost.cs \
+        tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/OpcUaApplicationHostServerArrayTests.cs
+git commit -m "feat(opcua): OpcUaApplicationHost publishes peer URIs in Server.ServerArray"
+```
+
+---
+
+## Task 2: Create `OtOpcUa.OpcUaServer.IntegrationTests` project
+
+**Classification:** small
+**Estimated implement time:** ~4 min
+**Parallelizable with:** Task 5, Task 6 (file moves elsewhere)
+**Depends on:** none (csproj is self-contained)
+
+**Files:**
+- Create: `/Users/dohertj2/Desktop/OtOpcUa/tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.csproj`
+- Modify: `/Users/dohertj2/Desktop/OtOpcUa/ZB.MOM.WW.OtOpcUa.slnx` (add the project)
+
+**Background:**
+The source plan's Task 60 named this exact project. Audit found ServiceLevel coverage relocated to other test projects but no `OpcUaServer.IntegrationTests` project exists. Creating the project skeleton in its own task keeps Task 3's commit focused on the test code.
+
+**Step 1: Create the csproj**
+
+Mirror the conventions in `tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests.csproj`. The integration project needs the `Opc.Ua.Client` package (vs. only `Opc.Ua.Server` in the unit tests) — confirm the version against the existing client CLI's csproj: `src/Client/ZB.MOM.WW.OtOpcUa.Client.CLI/ZB.MOM.WW.OtOpcUa.Client.CLI.csproj`.
+
+```xml
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <IsPackable>false</IsPackable>
+        <IsTestProject>true</IsTestProject>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests</RootNamespace>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="xunit.v3"/>
+        <PackageReference Include="Shouldly"/>
+        <PackageReference Include="Microsoft.NET.Test.Sdk"/>
+        <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Client"/>
+        <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Configuration"/>
+        <PackageReference Include="Microsoft.Extensions.Logging.Abstractions"/>
+        <PackageReference Include="xunit.runner.visualstudio">
+            <PrivateAssets>all</PrivateAssets>
+            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+        </PackageReference>
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\..\..\src\Server\ZB.MOM.WW.OtOpcUa.OpcUaServer\ZB.MOM.WW.OtOpcUa.OpcUaServer.csproj"/>
+    </ItemGroup>
+
+</Project>
+```
+
+If `OPCFoundation.NetStandard.Opc.Ua.Client` isn't in `Directory.Packages.props`, add it there (mirror the existing `OPCFoundation.NetStandard.Opc.Ua.Server` version exactly).
+
+**Step 2: Add project to the solution**
+
+Run: `dotnet sln ZB.MOM.WW.OtOpcUa.slnx add tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.csproj`
+Expected: "Project added to the solution."
+
+**Step 3: Build green check**
+
+Run: `dotnet build ZB.MOM.WW.OtOpcUa.slnx`
+Expected: builds. (Empty project, so no test discovery yet — `dotnet test` would say "no tests".)
+
+**Step 4: Commit**
+
+```bash
+git add tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/ \
+        ZB.MOM.WW.OtOpcUa.slnx \
+        Directory.Packages.props  # only if the Opc.Ua.Client version was added there
+git commit -m "test(opcua): scaffold OtOpcUa.OpcUaServer.IntegrationTests project"
+```
+
+---
+
+## Task 3: `DualEndpointTests` — real OPC UA client reads both URIs from `Server.ServerArray`
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 5, Task 6
+**Depends on:** Task 1 (PeerApplicationUris wiring), Task 2 (IT project exists)
+
+**Files:**
+- Create: `/Users/dohertj2/Desktop/OtOpcUa/tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/DualEndpointTests.cs`
+
+**Background:**
+This is the explicit Task 60 deliverable: a real OPC UA client connects to one server and confirms it can discover the partner via `Server.ServerArray`. Single-server unit-side coverage exists in Task 1; this test exercises the wire path with both servers up.
+
+**Step 1: Write the test**
+
+```csharp
+using System.Net;
+using System.Net.Sockets;
+using Microsoft.Extensions.Logging.Abstractions;
+using Opc.Ua;
+using Opc.Ua.Client;
+using Opc.Ua.Configuration;
+using Opc.Ua.Server;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.OpcUaServer;
+
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests;
+
+/// <summary>
+/// Source plan Task 60 — closes the audit gap. Boots two real <see cref="StandardServer"/>
+/// instances on loopback, each configured with the other's <c>ApplicationUri</c> in
+/// <see cref="OpcUaApplicationHostOptions.PeerApplicationUris"/>. A real OPC UA client connects
+/// to Node A, reads <c>Server.ServerArray</c>, and asserts both URIs are visible — the
+/// warm-redundancy discovery contract clients depend on.
+/// </summary>
+public sealed class DualEndpointTests
+{
+    private const string NodeAUri = "urn:OtOpcUa.DualEndpoint.NodeA";
+    private const string NodeBUri = "urn:OtOpcUa.DualEndpoint.NodeB";
+
+    [Fact]
+    public async Task Client_reads_both_ApplicationUris_from_NodeA_ServerArray()
+    {
+        var pkiRootA = Path.Combine(Path.GetTempPath(), $"otopcua-pki-a-{Guid.NewGuid():N}");
+        var pkiRootB = Path.Combine(Path.GetTempPath(), $"otopcua-pki-b-{Guid.NewGuid():N}");
+        var portA = AllocateFreePort();
+        var portB = AllocateFreePort();
+
+        try
+        {
+            await using var nodeA = await StartNodeAsync(NodeAUri, portA, pkiRootA, peers: new[] { NodeBUri });
+            await using var nodeB = await StartNodeAsync(NodeBUri, portB, pkiRootB, peers: new[] { NodeAUri });
+
+            var serverArray = await ReadServerArrayAsync($"opc.tcp://127.0.0.1:{portA}/OtOpcUa");
+            serverArray.ShouldContain(NodeAUri);
+            serverArray.ShouldContain(NodeBUri);
+        }
+        finally
+        {
+            if (Directory.Exists(pkiRootA)) Directory.Delete(pkiRootA, recursive: true);
+            if (Directory.Exists(pkiRootB)) Directory.Delete(pkiRootB, recursive: true);
+        }
+    }
+
+    private static async Task<OpcUaApplicationHost> StartNodeAsync(
+        string applicationUri, int port, string pkiRoot, string[] peers)
+    {
+        var options = new OpcUaApplicationHostOptions
+        {
+            ApplicationName = applicationUri,           // unique per node — SDK uses it for cert CN
+            ApplicationUri = applicationUri,
+            OpcUaPort = port,
+            PublicHostname = "127.0.0.1",
+            PkiStoreRoot = pkiRoot,
+            EnabledSecurityProfiles = new List<OpcUaSecurityProfile> { OpcUaSecurityProfile.None },
+            AutoAcceptUntrustedClientCertificates = true,
+            PeerApplicationUris = peers,
+        };
+        var server = new StandardServer();
+        var host = new OpcUaApplicationHost(options, NullLogger<OpcUaApplicationHost>.Instance);
+        await host.StartAsync(server, CancellationToken.None);
+        return host;
+    }
+
+    private static async Task<string[]> ReadServerArrayAsync(string endpointUrl)
+    {
+        var appConfig = new ApplicationConfiguration
+        {
+            ApplicationName = "OtOpcUa.DualEndpointClient",
+            ApplicationUri = $"urn:OtOpcUa.DualEndpointClient.{Guid.NewGuid():N}",
+            ApplicationType = ApplicationType.Client,
+            SecurityConfiguration = new SecurityConfiguration
+            {
+                ApplicationCertificate = new CertificateIdentifier(),
+                AutoAcceptUntrustedCertificates = true,
+            },
+            ClientConfiguration = new ClientConfiguration { DefaultSessionTimeout = 60_000 },
+            CertificateValidator = new CertificateValidator(),
+        };
+        await appConfig.Validate(ApplicationType.Client);
+        appConfig.CertificateValidator.CertificateValidation += (_, e) => e.Accept = true;
+
+        var endpoint = CoreClientUtils.SelectEndpoint(appConfig, endpointUrl, useSecurity: false);
+        var endpointConfiguration = EndpointConfiguration.Create(appConfig);
+        var configuredEndpoint = new ConfiguredEndpoint(null, endpoint, endpointConfiguration);
+
+        using var session = await Session.Create(
+            appConfig, configuredEndpoint, updateBeforeConnect: false,
+            sessionName: "DualEndpointTests", sessionTimeout: 60_000,
+            identity: new UserIdentity(new AnonymousIdentityToken()),
+            preferredLocales: null);
+
+        var value = session.ReadValue(VariableIds.Server_ServerArray);
+        return (string[])value.Value;
+    }
+
+    private static int AllocateFreePort()
+    {
+        var listener = new TcpListener(IPAddress.Loopback, 0);
+        listener.Start();
+        var port = ((IPEndPoint)listener.LocalEndpoint).Port;
+        listener.Stop();
+        return port;
+    }
+}
+```
+
+**Step 2: Run the test**
+
+Run: `dotnet test tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests`
+Expected: PASS. Wall-time ~3-5 s (two cert-creation cycles + session handshake).
+
+If the test hangs on the session handshake on first run, it's the SDK reading the trusted-cert store — bumping `AutoAcceptUntrustedClientCertificates = true` on both server hosts (already set above) should resolve it. If `CoreClientUtils.SelectEndpoint` throws because the SDK version uses a different overload, fall back to constructing the `EndpointDescription` directly with `EndpointUrl = endpointUrl, SecurityMode = MessageSecurityMode.None, SecurityPolicyUri = SecurityPolicies.None` and skipping `SelectEndpoint`.
+
+**Step 3: Commit**
+
+```bash
+git add tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/DualEndpointTests.cs
+git commit -m "test(opcua): DualEndpointTests — real client reads peer URIs from Server.ServerArray"
+```
+
+---
+
+## Task 4: Wire `OtOpcUa.OpcUaServer.IntegrationTests` into v2-ci.yml
+
+**Classification:** small
+**Estimated implement time:** ~3 min
+**Parallelizable with:** Task 5, Task 6
+**Depends on:** Task 3 (project must exist + have a real test before CI runs it)
+
+**Files:**
+- Modify: `/Users/dohertj2/Desktop/OtOpcUa/.github/workflows/v2-ci.yml`
+
+**Step 1: Add the project to the `integration` job**
+
+Either extend the existing `integration` job to run a second `dotnet test` step, or convert it to a matrix. Prefer a matrix for symmetry with `unit-tests`:
+
+Open `.github/workflows/v2-ci.yml`, locate the `integration:` job. Replace it with:
+
+```yaml
+  integration:
+    needs: build
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        project:
+          - tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests
+          - tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+      - name: dotnet test ${{ matrix.project }}
+        run: dotnet test ${{ matrix.project }} --configuration Release --filter "Category!=E2E"
+```
+
+**Step 2: Build green check**
+
+Run: `dotnet test tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests --configuration Release --filter "Category!=E2E"`
+Expected: matches the exact CI command — passes locally so CI will pass too.
+
+**Step 3: Commit**
+
+```bash
+git add .github/workflows/v2-ci.yml
+git commit -m "ci(v2): include OpcUaServer.IntegrationTests in integration matrix"
+```
+
+---
+
+## Task 5: Rename `FailoverScenarioTests` → `FailoverDuringDeployTests` (Task 59 cosmetic)
+
+**Classification:** trivial
+**Estimated implement time:** ~2 min
+**Parallelizable with:** Task 0, Task 1, Task 2, Task 6 (different files)
+
+**Files:**
+- Rename: `tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/FailoverScenarioTests.cs` → `FailoverDuringDeployTests.cs`
+- Modify: class name + namespace-internal references
+
+**Step 1: Rename the file and the class**
+
+```bash
+git mv tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/FailoverScenarioTests.cs \
+       tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/FailoverDuringDeployTests.cs
+```
+
+Then edit `FailoverDuringDeployTests.cs` and replace the single class declaration `public sealed class FailoverScenarioTests` with `public sealed class FailoverDuringDeployTests`. Use Edit, not sed — the file only declares this class once (`grep -c "FailoverScenario" .` ≤ 2).
+
+**Step 2: Sweep for any stale references**
+
+Run: `grep -rln "FailoverScenarioTests" .`
+Expected: zero matches after Step 1. If anything appears (e.g., a CI filter, a doc), fix the reference.
+
+**Step 3: Build + run test**
+
+Run: `dotnet test tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests --filter "FullyQualifiedName~FailoverDuringDeployTests"`
+Expected: same tests pass that previously passed under the old name.
+
+**Step 4: Commit**
+
+```bash
+git add tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/FailoverDuringDeployTests.cs
+git commit -m "refactor(test): rename FailoverScenarioTests → FailoverDuringDeployTests for plan parity"
+```
+
+---
+
+## Task 6: Delete empty bin/obj-only legacy directories
+
+**Classification:** trivial
+**Estimated implement time:** ~2 min
+**Parallelizable with:** Task 0, Task 1, Task 2, Task 5
+
+**Files:**
+- Delete: `src/Server/ZB.MOM.WW.OtOpcUa.Server/`
+- Delete: `src/Server/ZB.MOM.WW.OtOpcUa.Admin/`
+- Delete: `tests/Server/ZB.MOM.WW.OtOpcUa.Server.Tests/`
+- Delete: `tests/Server/ZB.MOM.WW.OtOpcUa.Admin.Tests/`
+- Delete: `tests/Server/ZB.MOM.WW.OtOpcUa.Admin.E2ETests/`
+
+**Background:**
+Source plan Task 56 deleted the projects from `ZB.MOM.WW.OtOpcUa.slnx` (confirmed by the audit) but left `bin/`+`obj/` shells on disk. These confuse new contributors and skew directory listings. None of them are referenced anywhere.
+
+**Step 1: Sanity-check that each directory is bin/obj-only**
+
+```bash
+for dir in \
+  src/Server/ZB.MOM.WW.OtOpcUa.Server \
+  src/Server/ZB.MOM.WW.OtOpcUa.Admin \
+  tests/Server/ZB.MOM.WW.OtOpcUa.Server.Tests \
+  tests/Server/ZB.MOM.WW.OtOpcUa.Admin.Tests \
+  tests/Server/ZB.MOM.WW.OtOpcUa.Admin.E2ETests; do
+  echo "--- $dir ---"
+  find "$dir" -maxdepth 2 -type f | grep -v "/bin/\|/obj/"
+done
+```
+
+Expected: every section is empty (no source files leak out). If any source file shows, STOP and surface it — don't delete blindly.
+
+**Step 2: Verify slnx doesn't reference them**
+
+Run: `grep -nE 'ZB\.MOM\.WW\.OtOpcUa\.(Server|Admin)(/|\.Tests|\.E2ETests)' ZB.MOM.WW.OtOpcUa.slnx`
+Expected: zero matches.
+
+**Step 3: Delete the directories**
+
+```bash
+rm -rf src/Server/ZB.MOM.WW.OtOpcUa.Server \
+       src/Server/ZB.MOM.WW.OtOpcUa.Admin \
+       tests/Server/ZB.MOM.WW.OtOpcUa.Server.Tests \
+       tests/Server/ZB.MOM.WW.OtOpcUa.Admin.Tests \
+       tests/Server/ZB.MOM.WW.OtOpcUa.Admin.E2ETests
+```
+
+**Step 4: Build green check**
+
+Run: `dotnet build ZB.MOM.WW.OtOpcUa.slnx`
+Expected: succeeds (these directories were already out of the solution).
+
+**Step 5: Commit**
+
+```bash
+git add -A
+git commit -m "chore(cleanup): remove stale bin/obj shells for deleted v1 Server/Admin projects"
+```
+
+---
+
+## Task 7: Final build + test green check
+
+**Classification:** trivial
+**Estimated implement time:** ~3 min
+**Parallelizable with:** none (verification, depends on all prior tasks)
+
+**Step 1: Restore + build**
+
+Run: `dotnet build ZB.MOM.WW.OtOpcUa.slnx`
+Expected: 0 errors, 0 warnings (TreatWarningsAsErrors is on across the solution).
+
+**Step 2: Run the full test suite**
+
+Run: `dotnet test ZB.MOM.WW.OtOpcUa.slnx --no-build`
+Expected: all tests green. Specifically confirm:
+- `OpcUaApplicationHostServerArrayTests` (Task 1) — pass
+- `DualEndpointTests` (Task 3) — pass
+- `FailoverDuringDeployTests` (Task 5) — same count of tests pass as before the rename
+
+**Step 3: Smoke check the audit assertions**
+
+Run:
+```bash
+ls src/Server/ZB.MOM.WW.OtOpcUa.Host/appsettings.*.json
+find tests/Server -iname "DualEndpointTests.cs" -o -iname "FailoverDuringDeployTests.cs"
+ls -la src/Server/ZB.MOM.WW.OtOpcUa.{Server,Admin} 2>/dev/null
+```
+
+Expected:
+- 4 appsettings files: `.json`, `.Development.json`, `.admin.json`, `.admin-driver.json`, `.driver.json`
+- Both renamed/new test files exist
+- The two `ls -la` calls return errors (directories gone)
+
+**Step 4: No commit unless cleanup turned up**
+
+If anything failed in Steps 1-3, fix it as a follow-up task — do not paper over with a `--no-verify` commit.
+
+---
+
+## Final verification
+
+After Task 7:
+
+1. `dotnet build ZB.MOM.WW.OtOpcUa.slnx` — green
+2. `dotnet test ZB.MOM.WW.OtOpcUa.slnx --no-build` — green (incl. 2 new tests)
+3. `git log --oneline master..HEAD` — exactly 6 commits, Conventional-Commits style
+4. Open PR `v2-gap-closeout` → `master` titled "v2: close audit gaps — appsettings overlays, DualEndpointTests, cleanup"
+
+---
+
+## Task index
+
+| # | Title | Class | Time | Parallel with |
+|---|---|---|---|---|
+| 0 | Per-role appsettings overlays | small | 3m | 1, 5, 6 |
+| 1 | OpcUaApplicationHost.PeerApplicationUris + ServerArray | standard | 5m | 0, 5, 6 |
+| 2 | OpcUaServer.IntegrationTests project skeleton | small | 4m | 5, 6 |
+| 3 | DualEndpointTests | standard | 5m | 5, 6 |
+| 4 | CI matrix entry for new IT project | small | 3m | 5, 6 |
+| 5 | Rename FailoverScenarioTests → FailoverDuringDeployTests | trivial | 2m | 0, 1, 2, 6 |
+| 6 | Delete stale bin/obj-only directories | trivial | 2m | 0, 1, 2, 5 |
+| 7 | Final build + test green check | trivial | 3m | none |
+
+**Total estimated subagent time:** ~27 min.
+
+**Dependency graph (non-parallel pairs):**
+- Task 3 depends on Task 1 (option must exist) and Task 2 (project must exist)
+- Task 4 depends on Task 3 (CI runs the project's tests)
+- Task 7 depends on all prior tasks

docs/plans/2026-05-26-akka-hosting-alignment-gaps-closeout.md.tasks.json

@@ -0,0 +1,17 @@
+{
+  "planPath": "docs/plans/2026-05-26-akka-hosting-alignment-gaps-closeout.md",
+  "tasks": [
+    {"id": 1, "subject": "Task 0: Per-role appsettings overlays", "status": "completed", "commit": "898a477"},
+    {"id": 2, "subject": "Task 1: OpcUaApplicationHost.PeerApplicationUris + ServerArray population", "status": "completed", "commits": ["70ffd28", "cb936db"]},
+    {"id": 3, "subject": "Task 2: OpcUaServer.IntegrationTests project skeleton", "status": "completed", "commit": "83eda9e"},
+    {"id": 4, "subject": "Task 3: DualEndpointTests — real OPC UA client reads both URIs from Server.ServerArray", "status": "completed", "commits": ["dce2528", "a5412c1", "cb936db"], "blockedBy": ["2", "3"]},
+    {"id": 5, "subject": "Task 4: Wire OpcUaServer.IntegrationTests into v2-ci.yml", "status": "completed", "commit": "e8c4f18", "blockedBy": ["4"]},
+    {"id": 6, "subject": "Task 5: Rename FailoverScenarioTests → FailoverDuringDeployTests", "status": "completed", "commit": "25ce111"},
+    {"id": 7, "subject": "Task 6: Delete empty bin/obj-only legacy directories", "status": "completed", "commit": "(no tracked changes — bin/obj only)"},
+    {"id": 8, "subject": "Task 7: Final build + test green check", "status": "completed", "blockedBy": ["1", "2", "3", "4", "5", "6", "7"]}
+  ],
+  "lastUpdated": "2026-05-26T00:00:00Z",
+  "finalReview": "approved",
+  "branchHead": "e8c4f18",
+  "branchCommitCount": 8
+}

docs/plans/2026-05-26-akka-hosting-alignment-plan.md.tasks.json

@@ -81,20 +81,20 @@
     {"id": "F4", "subject": "Follow-up: Harden AuditWriterActor.WrapDetails JSON synthesis with System.Text.Json", "status": "completed", "classification": "small", "estMinutes": 5, "parallelizableWith": ["F3"], "blockedBy": [], "commit": "f57f61d", "deviation": "Moot — F3 deleted WrapDetails entirely (EventId/CorrelationId now live in dedicated columns).", "origin": "Self-review of Task 33 — WrapDetails uses string concat; malformed caller DetailsJson would produce invalid JSON and trip the CK_ConfigAuditLog_DetailsJson_IsJson constraint, killing the entire flush batch. Discard this task if F3 lands first (F3 removes WrapDetails entirely)."},
     {"id": "F5", "subject": "Follow-up: ConfigPublishCoordinator multi-node happy-path test", "status": "completed", "classification": "standard", "estMinutes": 30, "parallelizableWith": [], "blockedBy": [], "commit": "5cfbe8b", "deviation": "Delivered by Task 59 — DeployHappyPathTests.StartDeployment_seals_after_both_nodes_apply exercises the exact 'dispatch to N driver nodes, all ack, seals' flow via the real 2-node TwoNodeClusterHarness rather than a multi-system TestKit. Cleaner because it tests the production code path end-to-end.", "origin": "Self-review of Task 30 — single-ActorSystem TestKit can't simulate the plan's 'dispatch to N driver nodes, all ack, seals' happy path because DiscoverDriverNodes() needs real cluster membership. Add a multi-system test (two ActorSystems joined into one cluster, driver-role on the second)."},
     {"id": "F6", "subject": "Follow-up: RedundancyStateActor publisher abstraction so tests don't need DPS bootstrap", "status": "completed", "classification": "small", "estMinutes": 10, "parallelizableWith": [], "blockedBy": [], "commit": "dfc143c", "origin": "Self-review of Task 35 — RedundancyStateActorTests are skipped because single-node DistributedPubSub bootstrap is unreliable in TestKit. Inject an Action<object> broadcast so tests can replace it with a probe; un-skip both tests."},
-    {"id": "F7", "subject": "Follow-up: DriverInstanceActor full engine wiring (subscriptions, writes, ApplyDelta diff)", "status": "pending", "classification": "standard", "estMinutes": 45, "parallelizableWith": [], "blockedBy": [44], "origin": "Self-review of Task 41 — subscription publishing, ApplyDelta diffing, bad-quality-on-disconnect, write path, and supervisor backoff are stubbed. Wire after OpcUaPublishActor lands."},
-    {"id": "F8", "subject": "Follow-up: VirtualTagActor engine wiring (compile expression, subscribe deps, publish result)", "status": "pending", "classification": "standard", "estMinutes": 30, "parallelizableWith": [], "blockedBy": [], "origin": "Self-review of Task 42 — VirtualTagEngine.Evaluate not called; DependencyValueChanged just buffers."},
-    {"id": "F9", "subject": "Follow-up: ScriptedAlarmActor engine wiring + state persistence", "status": "pending", "classification": "standard", "estMinutes": 30, "parallelizableWith": [], "blockedBy": [], "origin": "Self-review of Task 43 — AlarmConditionService not called; PreRestart persistence to ScriptedAlarmState DB not wired; HistorianAdapter rows not emitted."},
-    {"id": "F10", "subject": "Follow-up: OpcUaPublishActor SDK integration (address-space writes + ServiceLevel + RebuildAddressSpace)", "status": "pending", "classification": "high-risk", "estMinutes": 60, "parallelizableWith": [], "blockedBy": [47], "origin": "Self-review of Task 44 — SDK calls stubbed; counters only. Wire after Phase 7 OpcUaServer extraction."},
+    {"id": "F7", "subject": "Follow-up: DriverInstanceActor full engine wiring (subscriptions, writes, ApplyDelta diff)", "status": "completed", "classification": "standard", "estMinutes": 45, "parallelizableWith": [], "blockedBy": [44], "origin": "Self-review of Task 41 — subscription publishing, ApplyDelta diffing, bad-quality-on-disconnect, write path, and supervisor backoff are stubbed. Wire after OpcUaPublishActor lands.", "shipped": "All three pieces landed: (1) spawn lifecycle in DriverHostActor (DriverSpawnPlanner + IDriverFactory seam) — da14149, (2) ISubscribable wiring + OPC UA status-code → OpcUaQuality severity-bit mapping + DetachSubscription on disconnect/PostStop, (3) IWritable.WriteAsync write path with 5s timeout, status-code bubble-up, and AttributeValuePublished published to parent on every OnDataChange — both shipped in the F7-residual batch. Host DI binding (DriverFactoryBootstrap registers AbCip/AbLegacy/FOCAS/Galaxy/Modbus/S7/TwinCAT factories) lives in src/Server/ZB.MOM.WW.OtOpcUa.Host/Drivers/."},
+    {"id": "F8", "subject": "Follow-up: VirtualTagActor engine wiring (compile expression, subscribe deps, publish result)", "status": "partial", "classification": "standard", "estMinutes": 30, "parallelizableWith": [], "blockedBy": [], "origin": "Self-review of Task 42 — VirtualTagEngine.Evaluate not called; DependencyValueChanged just buffers.", "shipped": "(1) IVirtualTagEvaluator seam + NullVirtualTagEvaluator default. VirtualTagActor calls evaluator on DependencyValueChanged, dedupes unchanged results, emits EvaluationResult to parent, publishes Warning ScriptLogEntry on failure. (2) DependencyMuxActor in Runtime fans out DriverInstanceActor.AttributeValuePublished from DriverHostActor through to interested VirtualTagActor subscribers. VirtualTagActor takes dependencyRefs + mux ActorRef in Props, registers interest in PreStart, unregisters in PostStop. WithOtOpcUaRuntimeActors spawns the mux + threads it into DriverHostActor. Production binding to Core.VirtualTags.VirtualTagEngine (expression compile + dep extraction) still TODO — split as F8b."},
+    {"id": "F9", "subject": "Follow-up: ScriptedAlarmActor engine wiring + state persistence", "status": "partial", "classification": "standard", "estMinutes": 30, "parallelizableWith": [], "blockedBy": [], "origin": "Self-review of Task 43 — AlarmConditionService not called; PreRestart persistence to ScriptedAlarmState DB not wired; HistorianAdapter rows not emitted.", "shipped": "(1) IScriptedAlarmEvaluator seam + NullScriptedAlarmEvaluator default. ScriptedAlarmActor takes AlarmConfig (id/name/path/severity/predicate), evaluates on DependencyValueChanged, publishes AlarmTransitionEvent + ScriptLogEntry on every transition. (2) IAlarmActorStateStore seam in Commons.Engines + NullAlarmActorStateStore default + EfAlarmActorStateStore production adapter over the ScriptedAlarmState entity. ScriptedAlarmActor PreStart loads + restores; every Transition fires a fire-and-forget save with lastAckUser. Predicate binding to Core.ScriptedAlarms.ScriptedAlarmEngine still TODO — split as F9b."},
+    {"id": "F10", "subject": "Follow-up: OpcUaPublishActor SDK integration (address-space writes + ServiceLevel + RebuildAddressSpace)", "status": "partial", "classification": "high-risk", "estMinutes": 60, "parallelizableWith": [], "blockedBy": [47], "origin": "Self-review of Task 44 — SDK calls stubbed; counters only. Wire after Phase 7 OpcUaServer extraction.", "shipped": "(1) IOpcUaAddressSpaceSink + IServiceLevelPublisher seams in Commons.OpcUa with Null* defaults. OpcUaPublishActor routes through the sink, dedupes ServiceLevelChanged, subscribes to redundancy-state DPS topic, maps redundancy snapshot to a coarse ServiceLevel (Primary+leader=240, Primary=200, Secondary=100, Detached=0). (2) OtOpcUaNodeManager (CustomNodeManager2) + OtOpcUaSdkServer (StandardServer subclass) + SdkAddressSpaceSink in OpcUaServer — lazy variable creation on first WriteValue, WriteAlarmState shape, RebuildAddressSpace tear-down. Variable updates propagate via ClearChangeMasks so subscribed OPC UA clients see them. Tests boot a real StandardServer + verify sink writes show up in the manager. Production wiring through OpcUaApplicationHost.StartAsync (default server = OtOpcUaSdkServer) + IServiceLevelPublisher SDK binding + #109 OpcUaPublishActor→Phase7Applier integration are the remaining pieces."},
     {"id": "F11", "subject": "Follow-up: HistorianAdapterActor named-pipe IPC + SqliteStoreAndForwardSink wiring", "status": "completed", "classification": "standard", "estMinutes": 30, "parallelizableWith": [], "blockedBy": [], "commit": "6861381", "deviationNotes": "Reshaped HistorianAdapterActor around the existing IAlarmHistorianSink abstraction (alarm-event shape, not the original tag-history-row stub). Defaults to NullAlarmHistorianSink; production deployments wire SqliteStoreAndForwardSink + WonderwareHistorianClient via AddOtOpcUaRuntime overrides. Actor now exposes GetStatus returning HistorianSinkStatus for diagnostics. Named-pipe transport implementation lives unchanged in src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Wonderware.Client/WonderwareHistorianClient.cs — the actor is intentionally just a fire-and-forget bridge.", "origin": "Self-review of Task 45 — stub buffers in-memory; named-pipe + SQLite store-and-forward not wired."},
     {"id": "F12", "subject": "Follow-up: PeerOpcUaProbeActor real opc.tcp ping (replace Ok=true stub)", "status": "completed", "classification": "small", "estMinutes": 20, "parallelizableWith": [], "blockedBy": [], "commit": "b06e3ae", "deviation": "TCP-connect probe rather than full OPC UA Hello/Acknowledge handshake. Enough for the redundancy calc; deeper liveness signals can layer on later without changing the actor's contract.", "origin": "Self-review of Task 45 — RunProbe always returns Ok=true; replace with OPC UA Client connect."},
     {"id": "F13", "subject": "Follow-up: Full OpcUaApplicationHost extraction (security/alarms/history/observability)", "status": "partial", "classification": "high-risk", "estMinutes": 120, "parallelizableWith": [], "blockedBy": [], "commit": "36c4751-partial", "deviationNotes": "F13a (cert auto-creation) shipped in 36c4751. Remaining: endpoint-security wiring (SecurityProfileResolver into ServerConfiguration.SecurityPolicies), LDAP user-token validator (the OPC UA UserNameToken path; HTTP-layer LDAP auth is separate and already in OtOpcUa.Security), scripted-alarm node manager creation, history backend wiring, observability hooks (OpenTelemetry metrics + traces). These are gated by F10's OpcUaPublishActor SDK integration — until F10 lands, nothing instantiates OpcUaApplicationHost so the missing wiring is dead weight.", "origin": "Self-review of Task 46 — facade only boots ApplicationInstance + StandardServer. Legacy 391-line file pulls Server.Security/Alarms/History/Observability. Pull those into thin OpcUaServer interfaces."},
-    {"id": "F14", "subject": "Follow-up: Migrate side-effecting Phase7Composer (EquipmentNodeWalker, trace logs, node cache)", "status": "pending", "classification": "standard", "estMinutes": 60, "parallelizableWith": [], "blockedBy": [], "origin": "Self-review of Task 47 — pure version covers the projection. Walker + alarm sink registration + cache mutation stay in legacy until split into Phase7Applier."},
+    {"id": "F14", "subject": "Follow-up: Migrate side-effecting Phase7Composer (EquipmentNodeWalker, trace logs, node cache)", "status": "partial", "classification": "standard", "estMinutes": 60, "parallelizableWith": [], "blockedBy": [], "origin": "Self-review of Task 47 — pure version covers the projection. Walker + alarm sink registration + cache mutation stay in legacy until split into Phase7Applier.", "shipped": "Phase7Plan + Phase7Planner.Compute (pure diff over EquipmentNodes/DriverInstancePlans/ScriptedAlarmPlans by stable id, with Added/Removed/Changed lists). Phase7Applier consumes plan + IOpcUaAddressSpaceSink: drives RebuildAddressSpace on Equipment/Alarm topology change, writes inactive AlarmState for removed nodes, catches + logs sink faults. Driver-only changes correctly skip the rebuild (DriverHostActor's spawn-plan in Runtime handles those). Walker integration with the real SDK NodeManager is the remaining piece — split as F14b (consumes the existing EquipmentNodeWalker once F10b lands an SDK builder)."},
     {"id": "F15", "subject": "Follow-up: Migrate 47 legacy Admin Blazor components into AdminUI library", "status": "completed", "classification": "high-risk", "estMinutes": 180, "commit": "Phase A-D (read views) + F15.2 batches 1-4 (live-edit CRUD) + F15.3 (live alerts/script-log/CSV import/Monaco)", "deviationNotes": "All 4 phases of read-only views shipped: Phase A (shell/auth/fleet/hosts), B (cluster CRUD + Overview/Redundancy), C (Equipment/UNS/Namespaces/Drivers/Tags/ACLs), D (Audit/VirtualTags/ScriptedAlarms/Scripts/RoleGrants/Certificates/Reservations/AlarmsHistorian). Per Q1–Q5 of docs/v2/AdminUI-rebuild-plan.md: typed driver editors deferred, top-level VirtualTags/ScriptedAlarms kept (Q2 reversed for cross-cluster discoverability), routes-not-tabs adopted, fleet-wide LDAP→role map only, generic login errors. Live-edit forms (F15.2) and ScriptLog page (depends on F16 ScriptLogHub) are explicit follow-ups.", "parallelizableWith": [], "blockedBy": [], "origin": "Self-review of Task 48 — only MapAdminUI scaffold + 1 new page (Deployments). 47 pages stay in legacy Admin (accepted-broken) until Task 56."},
     {"id": "F16", "subject": "Follow-up: Bridge FleetStatusBroadcaster → SignalR hubs (FleetStatusHub / AlertHub / ScriptLogHub)", "status": "completed", "classification": "standard", "estMinutes": 30, "parallelizableWith": [], "blockedBy": [], "commit": "f18c285", "deviation": "FleetStatusHub bridge landed. AlertHub + ScriptLogHub deferred — they need upstream message contracts that aren't defined yet (alerts emerge from F9 ScriptedAlarmActor, script logs from F8 VirtualTagActor).", "origin": "Self-review of Task 49 — hubs are passive Hub subclasses; the bridge from FleetStatusBroadcaster.broadcast → IHubContext is not wired."},
     {"id": "F17", "subject": "Follow-up: FleetDiagnosticsClient real Akka ActorSelection round-trip (GetDiagnosticsRequest)", "status": "completed", "classification": "standard", "estMinutes": 30, "parallelizableWith": [], "blockedBy": [], "commit": "8f32b89", "origin": "Self-review of Task 51 — client returns an empty snapshot stub. Add GetDiagnosticsRequest contract + DriverHostActor handler + real Ask/Reply."},
     {"id": "F18", "subject": "Follow-up: Thread HttpContext.User.Identity.Name into Deployments page (createdBy)", "status": "completed", "classification": "small", "estMinutes": 5, "parallelizableWith": [], "blockedBy": [], "commit": "b266f63", "origin": "Self-review of Task 52 — Deployments.razor hardcodes createdBy=\"(current user)\"; needs @inject AuthenticationStateProvider."},
     {"id": "F19", "subject": "Follow-up: RuntimeStartup extension for driver-role node-actor spawn", "status": "completed", "classification": "standard", "estMinutes": 20, "parallelizableWith": [], "blockedBy": [], "commit": "09d6676", "origin": "Self-review of Task 53 — only admin-role singletons are wired via WithOtOpcUaControlPlaneSingletons. Driver-role nodes need a parallel WithOtOpcUaRuntimeActors that spawns DriverHostActor."},
-    {"id": "F20", "subject": "Follow-up: Wire DriverInstanceActor.ShouldStub() into DriverHostActor child spawn", "status": "pending", "classification": "small", "estMinutes": 10, "parallelizableWith": ["F7"], "blockedBy": [], "origin": "Self-review of Task 55 — ShouldStub helper exists but nothing calls it. Folds into F7 when DriverHostActor learns to spawn DriverInstanceActor children."},
+    {"id": "F20", "subject": "Follow-up: Wire DriverInstanceActor.ShouldStub() into DriverHostActor child spawn", "status": "completed", "classification": "small", "estMinutes": 10, "parallelizableWith": ["F7"], "blockedBy": [], "origin": "Self-review of Task 55 — ShouldStub helper exists but nothing calls it. Folds into F7 when DriverHostActor learns to spawn DriverInstanceActor children.", "shipped": "DriverHostActor.SpawnChild now calls DriverInstanceActor.ShouldStub(type, _localRoles) and routes Windows-only driver types to the stub path on non-Windows / dev-role hosts. Verified by DriverHostActorReconcileTests.Galaxy_on_non_windows_is_stubbed_by_ShouldStub_check."},
     {"id": "F21", "subject": "Follow-up: docker-compose.yml for Host.IntegrationTests (real SQL Server + OpenLDAP)", "status": "completed", "classification": "standard", "estMinutes": 30, "parallelizableWith": [], "blockedBy": [], "commit": "b0a2bb0", "deviationNotes": "Stack shipped (SQL on 14331, OpenLDAP on 3894). HarnessMode reads OTOPCUA_HARNESS_USE_SQL=1 / USE_LDAP=1 from env; SQL mode uses per-harness unique DB via EnsureCreated. Compose itself not local-validated — DESKTOP-6JL3KKO has no Docker per CLAUDE.md; CI on Linux will exercise the real path. The xunit test-trait split was punted — env vars are simpler and cover the same use case (one suite, two modes, no test-class duplication).", "origin": "Deviation from Task 58 — TwoNodeClusterHarness uses EF InMemoryDatabase + StubLdapAuthService. For Mac-friendly local runs against real SQL constraints + LDAP, add tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/docker-compose.yml (SQL Server + OpenLDAP), wire EF SqlServer provider behind an env var (OTOPCUA_HARNESS_USE_SQL=1), and add a test trait so CI can run both modes."},
     {"id": "F22", "subject": "Follow-up: failover scenario integration tests (kill-mid-apply, split-brain, restart-during-deploy)", "status": "completed", "classification": "standard", "estMinutes": 60, "parallelizableWith": [], "blockedBy": [], "commit": "cd5540c", "deviationNotes": "Shipped 3 scenarios on the existing 2-node harness: stop-shrinks, restart-rejoins-same-port, deploy-with-one-node-down. Split-brain via simulated partition deferred — Akka.Hosting + xunit don't expose transport-level interference cleanly. The graceful-shutdown + rejoin path is what production actually exercises; ungraceful kill-mid-apply non-deterministic under SBR's 15s stable-after.", "origin": "Deviation from Task 59 — happy-path + idempotency landed but design §8 cases 3-7 need controlled node-down primitives on TwoNodeClusterHarness (StopNodeAsync, RestartNodeAsync, PartitionBetweenAsync). Add those + 5 scenario tests."}
   ]

docs/security.md

@@ -109,7 +109,7 @@ The Server accepts three OPC UA identity-token types:
 | Token | Handler | Notes |
 |---|---|---|
 | Anonymous | `IUserAuthenticator.AuthenticateAsync(username: "", password: "")` | Refused in strict mode unless explicit anonymous grants exist; allowed in lax mode for backward compatibility. |
-| UserName/Password | `LdapUserAuthenticator` (`src/Server/ZB.MOM.WW.OtOpcUa.Server/Security/LdapUserAuthenticator.cs`) | LDAP bind + group lookup; resolved `LdapGroups` flow into the session's identity bearer (`ILdapGroupsBearer`). |
+| UserName/Password | `LdapOpcUaUserAuthenticator` (`src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/LdapOpcUaUserAuthenticator.cs`, backed by `LdapAuthService` at `src/Server/ZB.MOM.WW.OtOpcUa.Security/Ldap/LdapAuthService.cs`) | LDAP bind + group lookup; resolved `LdapGroups` flow into the session's identity bearer (`ILdapGroupsBearer`). |
 | X.509 Certificate | Stack-level acceptance + role mapping via CN | X.509 identity carries `AuthenticatedUser` + read roles; finer-grain authorization happens through the data-plane ACLs. |
 
 ### LDAP bind flow (`LdapUserAuthenticator`)
@@ -221,20 +221,16 @@ The three Write tiers map to Galaxy's v1 `SecurityClassification` — `FreeAcces
 
 `NodeScope` carries `(ClusterId, NamespaceId, AreaId, LineId, EquipmentId, TagId)`; any suffix may be null — a tag-level ACL is more specific than an area-level ACL but both contribute via union.
 
-### Dispatch gate — `AuthorizationGate`
+### Dispatch gate — `IPermissionEvaluator`
 
-`src/Server/ZB.MOM.WW.OtOpcUa.Server/Security/AuthorizationGate.cs` bridges the OPC UA stack's `ISystemContext.UserIdentity` to the evaluator. `DriverNodeManager` holds exactly one reference to it and calls `IsAllowed(identity, OpcUaOperation.*, NodeScope)` on every Read, Write, HistoryRead, Browse, Subscribe, AckAlarm, Call path. A false return short-circuits the dispatch with `BadUserAccessDenied`.
+`IPermissionEvaluator.Authorize(session, operation, scope)` (default impl `TriePermissionEvaluator` at `src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/TriePermissionEvaluator.cs`) bridges the OPC UA stack's `ISystemContext.UserIdentity` to the trie. The dispatch path calls it on every Read, Write, HistoryRead, Browse, Subscribe, AckAlarm, Call. A non-allow decision short-circuits the dispatch with `BadUserAccessDenied`.
 
 Key properties:
 
-- **Driver-agnostic.** No driver-level code participates in authorization decisions. Drivers report `SecurityClassification` as metadata on tag discovery; everything else flows through `AuthorizationGate`.
+- **Driver-agnostic.** No driver-level code participates in authorization decisions. Drivers report `SecurityClassification` as metadata on tag discovery; everything else flows through the evaluator.
 - **Fail-open-during-transition.** `StrictMode = false` (default during ACL rollouts) lets sessions without resolved LDAP groups proceed; flip `Authorization:StrictMode = true` in production once ACLs are populated.
 - **Evaluator stays pure.** `TriePermissionEvaluator` has no OPC UA stack dependency — it's tested directly from xUnit.
 
-### Probe-this-permission (Admin UI)
-
-`PermissionProbeService` (`src/Server/ZB.MOM.WW.OtOpcUa.Admin/Services/PermissionProbeService.cs`) lets an operator ask "if a user with groups X, Y, Z asked to do operation O on node N, would it succeed?" The answer is rendered in the AclsTab "Probe" dialog — same evaluator, same trie, so the Admin UI answer and the live Server answer cannot disagree.
-
 ### Full model
 
 See [`docs/v2/acl-design.md`](v2/acl-design.md) for the complete design: trie invalidation, flag semantics, per-path override rules, and the reasoning behind additive-only (no Deny).
@@ -249,7 +245,7 @@ Per decision #150 control-plane roles are **deliberately independent of data-pla
 
 ### Roles
 
-`src/Server/ZB.MOM.WW.OtOpcUa.Admin/Services/AdminRoles.cs`:
+The `AdminRole` enum (`src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Enums/AdminRole.cs`) defines:
 
 | Role | Capabilities |
 |---|---|
@@ -257,15 +253,7 @@ Per decision #150 control-plane roles are **deliberately independent of data-pla
 | `ConfigEditor` | ConfigViewer plus draft editing (UNS, equipment, tags, ACLs, driver instances, reservations, CSV imports). Cannot publish. |
 | `FleetAdmin` | ConfigEditor plus publish, cluster/node CRUD, credential management, role-grant management. |
 
-Policies registered in Admin `Program.cs`:
-
-```csharp
-builder.Services.AddAuthorizationBuilder()
-    .AddPolicy("CanEdit",    p => p.RequireRole(AdminRoles.ConfigEditor, AdminRoles.FleetAdmin))
-    .AddPolicy("CanPublish", p => p.RequireRole(AdminRoles.FleetAdmin));
-```
-
-Razor pages and API endpoints gate with `[Authorize(Policy = "CanEdit")]` / `"CanPublish"`; nav-menu sections hide via `<AuthorizeView>`.
+In v2 the authentication + authorization stack is wired centrally by `AddOtOpcUaAuth` (`src/Server/ZB.MOM.WW.OtOpcUa.Security/ServiceCollectionExtensions.cs`) and Razor pages gate inline with the role names, e.g. `@attribute [Authorize(Roles = "FleetAdmin,ConfigEditor")]` on `Deployments.razor`. Nav-menu sections hide via `<AuthorizeView>`.
 
 ### Role grant source
 

docs/v2/Architecture-v2.md

@@ -124,4 +124,5 @@ Each cluster member has a `NodeId` derived as `{PublicHostname}:{Port}` of the A
 | Driver actors | `Runtime.WithOtOpcUaRuntimeActors` | extension on `AkkaConfigurationBuilder` |
 | Auth pipeline | `Security.AddOtOpcUaAuth` + `MapOtOpcUaAuth` | extensions on `IServiceCollection` / `IEndpointRouteBuilder` |
 | OPC UA facade | `OpcUaServer.OpcUaApplicationHost` | runtime host, started by driver-role startup |
+| Partner-URI advertising | `OpcUaServer.OpcUaApplicationHost.PopulateServerArray` | runs after `_application.Start`, appends `PeerApplicationUris` to the SDK `ServerUris` `StringTable` so `Server.ServerArray` (i=2254) returns self + peers |
 | Health endpoints | `Host.Health.AddOtOpcUaHealth` + `MapOtOpcUaHealth` | extensions on `IServiceCollection` / `IEndpointRouteBuilder` |

docs/v2/Cluster.md

@@ -67,6 +67,8 @@ The Cluster.Tests project verifies these key values stay correct (`HoconLoaderTe
 - `SeedNodes`: where new nodes go to join. List one (or two) stable nodes. First node bootstraps the cluster from its own address.
 - `Roles`: free-form tags Akka gossip propagates. v2 uses `admin` + `driver`; per-role wiring in `Program.cs` reads `OTOPCUA_ROLES` env var, not this list — these two should stay in sync.
 
+Per-role overlay files (`appsettings.admin.json`, `appsettings.driver.json`, `appsettings.admin-driver.json`) layer on top of base `appsettings.json` based on the parsed `OTOPCUA_ROLES` (alphabetical, joined by `-`). See [ServiceHosting.md § Per-role configuration overlays](../ServiceHosting.md#per-role-configuration-overlays).
+
 ## IClusterRoleInfo
 
 Anywhere in the host that needs the local node's identity or a view of who-else-is-in-the-cluster, inject `IClusterRoleInfo`:

docs/v2/admin-ui.md

@@ -36,7 +36,7 @@ Mirror ScadaLink's layout exactly:
 
 ```
 src/
-  ZB.MOM.WW.OtOpcUa.Admin/                        # Razor Components project (.NET 10)
+  ZB.MOM.WW.OtOpcUa.AdminUI/                       # Razor Components project (.NET 10)
     Auth/
       AuthEndpoints.cs                            # /auth/login, /auth/logout, /auth/token
       CookieAuthenticationStateProvider.cs        # bridges cookie auth to Blazor <AuthorizeView>
@@ -61,10 +61,10 @@ src/
         NotAuthorizedView.razor
     EndpointExtensions.cs                         # MapAuthEndpoints + role policies
     ServiceCollectionExtensions.cs                # AddCentralAdmin
-  ZB.MOM.WW.OtOpcUa.Admin.Security/               # LDAP + role mapping + JWT (sibling of ScadaLink.Security)
+  ZB.MOM.WW.OtOpcUa.Security/                      # LDAP + role mapping + JWT (sibling of ScadaLink.Security)
 ```
 
-The `Admin.Security` project carries `LdapAuthService`, `RoleMapper`, `JwtTokenService`, `AuthorizationPolicies`. If it ever makes sense to consolidate with ScadaLink's identical project, lift to a shared internal NuGet — out of scope for v2.0 to keep OtOpcUa decoupled from ScadaLink's release cycle.
+The `Security` project carries `LdapAuthService`, `RoleMapper`, `JwtTokenService`, `AuthorizationPolicies`. If it ever makes sense to consolidate with ScadaLink's identical project, lift to a shared internal NuGet — out of scope for v2.0 to keep OtOpcUa decoupled from ScadaLink's release cycle.
 
 ## Authentication & Authorization
 

docs/v2/phase-7-status.md

@@ -96,7 +96,7 @@ Shipped as PR #183 (12 tests in configuration; 13 more in Admin.Tests).
 | F.4 — Test harness (modal, synthetic inputs, output + logger display) | **Partial** | `ScriptTestHarnessService.cs` is complete and tested. `ScriptsTab.razor` calls `Harness.RunVirtualTagAsync` with zero-value synthetic inputs derived from the extractor. A full interactive input-form modal was not shipped — the harness zeroes all inputs automatically rather than prompting the operator per-tag. |
 | F.5 — Script log viewer (SignalR tail of `scripts-*.log` filtered by `ScriptName`, load-more) | **Not started** | No SignalR stream of the scripts log is wired in the Admin UI. The `AlertHub` / `FleetStatusHub` exist but there is no `ScriptLogHub`. |
 | F.6 — `/alarms/historian` diagnostics view | **Done** | `AlarmsHistorian.razor` + `HistorianDiagnosticsService.cs` |
-| F.7 — Playwright smoke (author calc tag, verify in equipment tree; author alarm, verify in `AlarmsAndConditions`) | **Not started** | `tests/Server/ZB.MOM.WW.OtOpcUa.Admin.E2ETests/` exists but its `UnsTabDragDropE2ETests.cs` is the only Playwright test; no Phase 7 Admin UI playwright scenario. |
+| F.7 — Playwright smoke (author calc tag, verify in equipment tree; author alarm, verify in `AlarmsAndConditions`) | **Not started** | No Phase 7 Playwright/E2E project exists in the repo today; future-work item without an assigned path. |
 
 Shipped as PR #185 (13 Admin service tests; UI completeness is partial — see gaps section).
 
@@ -190,8 +190,8 @@ The SignalR tail of `scripts-*.log` filtered by `ScriptName` was not implemented
 | `Core.VirtualTags` sources | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/` |
 | `Core.ScriptedAlarms` sources | `src/Core/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms/` |
 | `Core.AlarmHistorian` sources | `src/Core/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian/` |
-| Server Phase7 composition | `src/Server/ZB.MOM.WW.OtOpcUa.Server/Phase7/` |
-| Admin services | `src/Server/ZB.MOM.WW.OtOpcUa.Admin/Services/Script*.cs`, `VirtualTagService.cs`, `HistorianDiagnosticsService.cs` |
-| Admin UI pages | `src/Server/ZB.MOM.WW.OtOpcUa.Admin/Components/Pages/Clusters/ScriptsTab.razor`, `AlarmsHistorian.razor` |
+| Server Phase7 composition | `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/Phase7Composer.cs`, `Phase7Applier.cs`, `Phase7Plan.cs` |
+| Admin services (CRUD writes) | `src/Server/ZB.MOM.WW.OtOpcUa.ControlPlane/AdminOperations/AdminOperationsActor.cs` (actor-driven); live state in `src/Server/ZB.MOM.WW.OtOpcUa.Runtime/ScriptedAlarms/ScriptedAlarmActor.cs`, `Runtime/VirtualTags/VirtualTagActor.cs`; Roslyn engines in `src/Server/ZB.MOM.WW.OtOpcUa.Host/Engines/` — v1 `Admin/Services/Script*.cs`, `VirtualTagService.cs`, `HistorianDiagnosticsService.cs` deleted |
+| Admin UI pages | `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/Scripts.razor`, `ScriptEdit.razor`, `ScriptedAlarms.razor`, `ScriptedAlarmEdit.razor`, `AlarmsHistorian.razor`, `VirtualTags.razor`, `VirtualTagEdit.razor` |
 | Historian sidecar writer | `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Wonderware.Client/WonderwareHistorianClient.cs` |
 | EF migrations | `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Migrations/20260420231641_AddPhase7ScriptingTables.cs`, `20260420232000_ExtendComputeGenerationDiffWithPhase7.cs` |

docs/v2/redundancy-interop-playbook.md

@@ -55,6 +55,7 @@ Each row is one manual run; pass criterion in the right column.
 | A2 | ServiceLevel updates on peer down | Connect to Primary. Stop Backup (`sc stop OtOpcUa`). Watch `ServiceLevel`. | Transitions 200 → 150 within ~2 s of peer probe timeout |
 | A3 | RedundancySupport | Browse to `Server.ServerRedundancy.RedundancySupport`. | Value matches the declared `RedundancyMode` (Warm / Hot / None) |
 | A4 | ServerUriArray (non-transparent upgrade) | Requires a redundancy-object-type upgrade follow-up. | When upgrade lands: `ServerUriArray` reports both ApplicationUris, self first |
+| A4b | Peer URI visibility via `Server.ServerArray` (i=2254) | Configure each `OpcUaApplicationHost` with the partner's `ApplicationUri` via `OpcUaApplicationHostOptions.PeerApplicationUris`. From any client, Read NodeId `i=2254` (`Server.ServerArray`). | Returned `String[]` includes both self + peer `ApplicationUri`s. Validated by `DualEndpointTests` in `tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/` (loopback dual-host with real OPCFoundation client `Session` read). |
 | A5 | Mid-apply dip | On Primary trigger a `sp_PublishGeneration` apply. | `ServiceLevel` drops to 75 for the apply duration + dwell |
 
 ### Block B — Client failover
@@ -101,7 +102,9 @@ flips A4 from "deferred" to "expected pass").
 - **A4 pending**: `Server.ServerRedundancy` on our current SDK build lands as
   the base `ServerRedundancyState`, which has no `ServerUriArray` child.
   `ServerRedundancyNodeWriter.ApplyServerUriArray` logs-and-skips until the
-  redundancy-object-type upgrade follow-up lands.
+  redundancy-object-type upgrade follow-up lands. Cross-reference **A4b** —
+  peer URIs are visible today via `Server.ServerArray` (i=2254) populated by
+  `OpcUaApplicationHost.PopulateServerArray`.
 - **Recovery dwell default**: `RecoveryStateManager.DwellTime` defaults to 60 s
   in `Program.cs`. Adjust via future config knob if B3 takes too long to
   observe.
@@ -121,8 +124,8 @@ flips A4 from "deferred" to "expected pass").
   redundancy implementations we don't control.
 - For the sub-set of scenarios that *can* be automated — the self-loopback
   case where our own `otopcua-cli` drives Primary + Backup — the existing
-  `tests/Server/ZB.MOM.WW.OtOpcUa.Server.Tests/RedundancyStatePublisherTests` +
-  `ServiceLevelCalculatorTests` (unit) + `ClusterTopologyLoaderTests`
-  (integration) already cover the math + data path. The wire-level assertion
-  that the values actually land on the right OPC UA nodes is covered by
-  `ServerRedundancyNodeWriterTests`.
+  `tests/Server/ZB.MOM.WW.OtOpcUa.ControlPlane.Tests/RedundancyStateActorTests` +
+  `ServiceLevelCalculatorTests` (unit) already cover the math + data path.
+  The wire-level assertion that the peer URIs actually land on the
+  `Server.ServerArray` node (i=2254) is covered by `DualEndpointTests` in
+  `tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/`.

docs/v2/v2-release-readiness.md

@@ -57,7 +57,7 @@ Remaining follow-ups (hardening):
 Remaining Phase 6.3 surfaces (hardening, not release-blocking):
 
 - ~~`PeerHttpProbeLoop` + `PeerUaProbeLoop` HostedServices populating `PeerReachabilityTracker` on each tick.~~ **Closed 2026-04-24.** Two-layer probe model shipped: HTTP probe at 2 s / 1 s timeout against `/healthz`; OPC UA probe at 10 s / 5 s timeout via `DiscoveryClient.GetEndpoints`, short-circuiting when HTTP reports the peer unhealthy. Registered on the Server as `AddHostedService<PeerHttpProbeLoop>` + `AddHostedService<PeerUaProbeLoop>`. Publisher now sees accurate `PeerReachability` per peer instead of degrading to `Unknown` → Isolated-Primary band (230).
-- OPC UA variable-node wiring: bind `ServiceLevel` Byte + `ServerUriArray` String[] to the publisher's events via `BaseDataVariable.OnReadValue` / direct value push.
+- ~~OPC UA variable-node wiring: bind `ServiceLevel` Byte + `ServerUriArray` String[] to the publisher's events via `BaseDataVariable.OnReadValue` / direct value push.~~ **Closed 2026-05-26.** `ServiceLevel` byte binding closed earlier under Path D. Peer-URI half closed via `OpcUaApplicationHost.PopulateServerArray` — populates self + each `PeerApplicationUris` entry into the SDK `IServerInternal.ServerUris` `StringTable`; clients read `Server.ServerArray` (NodeId `i=2254`). Validated by `DualEndpointTests` in `tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/`. `ServerUriArray` proper (the redundancy-object-type child) remains deferred pending object-type upgrade.
 - ~~`sp_PublishGeneration` wraps its apply in `await using var lease = coordinator.BeginApplyLease(...)` so the `PrimaryMidApply` band (200) fires during actual publishes (task #148 part 2).~~ **Closed 2026-04-24.** The apply loop now lives in `GenerationRefreshHostedService` — polls `sp_GetCurrentGenerationForCluster` every 5s, opens a lease when a new generation is detected, calls `RedundancyCoordinator.RefreshAsync` inside the `await using`, releases the lease on all exit paths. Replaces the previous "topology never refreshes without a process restart" behaviour.
 - Client interop matrix — Ignition / Kepware / Aveva OI Gateway (Stream F, task #150). Manual + doc-only.
 
@@ -118,6 +118,7 @@ v2 GA requires all of the following:
 
 ## Change log
 
+- **2026-05-26** — Gap-closeout pass. `OpcUaApplicationHost.PopulateServerArray` populates `Server.ServerArray` (NodeId `i=2254`) with self + `OpcUaApplicationHostOptions.PeerApplicationUris`, giving non-transparent peer URI visibility through the standard discovery surface. New `tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/` IT project (`DualEndpointTests`) validates with two real `OpcUaApplicationHost` instances on loopback + a live OPCFoundation client `Session` read. CI `v2-ci.yml` `integration:` job converted to a matrix across `Host.IntegrationTests` + `OpcUaServer.IntegrationTests`. Per-role appsettings overlays shipped (`appsettings.admin.json` / `appsettings.driver.json` / `appsettings.admin-driver.json`) — `Program.cs:33-35` loads by alphabetical-joined role suffix. `FailoverScenarioTests` → `FailoverDuringDeployTests` rename. Stale empty `src/Server/{Server,Admin}` + `tests/Server/{Server.Tests,Admin.Tests,Admin.E2ETests}` directories deleted (no source, absent from `.slnx`).
 - **2026-04-24** — Phase 5 driver complement closed (task #120 CLOSED). AB CIP, AB Legacy, TwinCAT, FOCAS all shipped. FOCAS migration: retired the Tier-C split (`Driver.FOCAS.Host` + `Driver.FOCAS.Shared` + `FwlibNative` + shim DLL deleted) in favour of a pure-managed in-process `FocasWireClient` inlined into `Driver.FOCAS`; driver is now read-only against the CNC by design. Integration test matrix grew to cover Browse / Subscribe / IAlarmSource / Probe end-to-end.
 - **2026-04-23** — Phase 6.4 audit close-out. IdentificationFolderBuilder + OPC 40010 Identification folder verified against the shipped code.
 - **2026-04-20** — Phase 7 plan drafted (`phase-7-scripting-and-alarming.md`, `phase-7-e2e-smoke.md`). Out of scope for v2 GA.

src/Core/ZB.MOM.WW.OtOpcUa.Commons/Engines/IAlarmActorStateStore.cs

@@ -0,0 +1,41 @@
+namespace ZB.MOM.WW.OtOpcUa.Commons.Engines;
+
+/// <summary>
+///     Persistence seam for <c>ScriptedAlarmActor</c>'s in-memory state across actor restarts.
+///     Captures only the slice the actor's 3-state machine needs (Inactive / Active /
+///     Acknowledged + last transition + last-ack user). The fuller GxP audit trail
+///     (<see cref="Configuration.Entities.ScriptedAlarmState"/>'s Comments/Confirmed/Shelving)
+///     stays in the production engine binding — this seam is the small surface the actor
+///     consumes directly.
+/// </summary>
+public interface IAlarmActorStateStore
+{
+    Task<AlarmActorStateSnapshot?> LoadAsync(string alarmId, CancellationToken ct);
+    Task SaveAsync(AlarmActorStateSnapshot snapshot, CancellationToken ct);
+}
+
+/// <summary>Persisted slice of <c>ScriptedAlarmActor</c>'s state. Active is NOT persisted —
+/// it re-derives from the evaluator on startup per Phase 7 decision #14. <c>State</c> here
+/// distinguishes Acknowledged vs not-yet-acknowledged for cases where the actor came up
+/// Active and operator interaction had already happened.</summary>
+/// <param name="AlarmId">Matches <c>ScriptedAlarm.ScriptedAlarmId</c>.</param>
+/// <param name="State">Inactive / Active / Acknowledged — the actor's 3-state enum, projected to string.</param>
+/// <param name="LastTransitionUtc">When the actor last transitioned.</param>
+/// <param name="LastAckUser">Who acknowledged most recently. Null when never acked.</param>
+public sealed record AlarmActorStateSnapshot(
+    string AlarmId,
+    string State,
+    DateTime LastTransitionUtc,
+    string? LastAckUser);
+
+/// <summary>No-op default. Bound when no production store is configured (tests, smoke runs).
+/// Load returns null → actor boots Inactive; Save is a no-op so state doesn't leak.</summary>
+public sealed class NullAlarmActorStateStore : IAlarmActorStateStore
+{
+    public static readonly NullAlarmActorStateStore Instance = new();
+    private NullAlarmActorStateStore() { }
+    public Task<AlarmActorStateSnapshot?> LoadAsync(string alarmId, CancellationToken ct) =>
+        Task.FromResult<AlarmActorStateSnapshot?>(null);
+    public Task SaveAsync(AlarmActorStateSnapshot snapshot, CancellationToken ct) =>
+        Task.CompletedTask;
+}

src/Core/ZB.MOM.WW.OtOpcUa.Commons/Engines/IScriptedAlarmEvaluator.cs

@@ -0,0 +1,30 @@
+namespace ZB.MOM.WW.OtOpcUa.Commons.Engines;
+
+/// <summary>
+///     Abstraction over the scripted-alarm predicate engine. Production binds this to a
+///     wrapper around <c>ScriptedAlarmEngine</c> from <c>Core.ScriptedAlarms</c>; default
+///     binding is <see cref="NullScriptedAlarmEvaluator"/> which keeps the alarm in its
+///     current state (so an unconfigured node never spuriously alarms).
+/// </summary>
+public interface IScriptedAlarmEvaluator
+{
+    ScriptedAlarmEvalResult Evaluate(string alarmId, string predicate, IReadOnlyDictionary<string, object?> dependencies);
+}
+
+/// <summary>Result of one alarm-predicate evaluation. <c>Active</c> is only meaningful when
+/// <c>Success</c> is true; on failure the caller should keep the prior state and log Reason.</summary>
+public sealed record ScriptedAlarmEvalResult(bool Success, bool Active, string? Reason)
+{
+    public static ScriptedAlarmEvalResult Ok(bool active) => new(true, active, null);
+    public static ScriptedAlarmEvalResult Failure(string reason) => new(false, false, reason);
+}
+
+/// <summary>Default that always returns <c>Active = false, Success = true</c>. Safe no-op:
+/// no alarm fires when no real engine is bound.</summary>
+public sealed class NullScriptedAlarmEvaluator : IScriptedAlarmEvaluator
+{
+    public static readonly NullScriptedAlarmEvaluator Instance = new();
+    private NullScriptedAlarmEvaluator() { }
+    public ScriptedAlarmEvalResult Evaluate(string alarmId, string predicate, IReadOnlyDictionary<string, object?> dependencies)
+        => ScriptedAlarmEvalResult.Ok(active: false);
+}

src/Core/ZB.MOM.WW.OtOpcUa.Commons/Engines/IVirtualTagEvaluator.cs

@@ -0,0 +1,36 @@
+namespace ZB.MOM.WW.OtOpcUa.Commons.Engines;
+
+/// <summary>
+///     Abstraction over the compiled virtual-tag expression engine. Runtime consumes this so
+///     <see cref="VirtualTagActor"/> can stay free of Roslyn / scripting machinery and the
+///     production wiring binds an adapter over <c>VirtualTagEngine</c> from
+///     <c>Core.VirtualTags</c>.
+/// </summary>
+public interface IVirtualTagEvaluator
+{
+    /// <summary>
+    ///     Evaluate <paramref name="expression"/> against the snapshot in
+    ///     <paramref name="dependencies"/>. Implementations must not throw — script failures
+    ///     are reported via <see cref="VirtualTagEvalResult.Failure"/>.
+    /// </summary>
+    VirtualTagEvalResult Evaluate(string virtualTagId, string expression, IReadOnlyDictionary<string, object?> dependencies);
+}
+
+/// <summary>Result of one virtual-tag expression eval. Stash a Reason on every Failure so
+/// callers can emit a useful <c>ScriptLogEntry</c> to operators.</summary>
+public sealed record VirtualTagEvalResult(bool Success, object? Value, string? Reason)
+{
+    public static readonly VirtualTagEvalResult NoChange = new(true, null, "no-change");
+    public static VirtualTagEvalResult Ok(object? value) => new(true, value, null);
+    public static VirtualTagEvalResult Failure(string reason) => new(false, null, reason);
+}
+
+/// <summary>Returns <see cref="VirtualTagEvalResult.NoChange"/> from every call. Bound by default
+/// when the production <c>VirtualTagEngine</c> adapter hasn't been registered (Mac dev, tests).</summary>
+public sealed class NullVirtualTagEvaluator : IVirtualTagEvaluator
+{
+    public static readonly NullVirtualTagEvaluator Instance = new();
+    private NullVirtualTagEvaluator() { }
+    public VirtualTagEvalResult Evaluate(string virtualTagId, string expression, IReadOnlyDictionary<string, object?> dependencies)
+        => VirtualTagEvalResult.NoChange;
+}

src/Core/ZB.MOM.WW.OtOpcUa.Commons/Observability/OtOpcUaTelemetry.cs

@@ -0,0 +1,81 @@
+using System.Diagnostics;
+using System.Diagnostics.Metrics;
+
+namespace ZB.MOM.WW.OtOpcUa.Commons.Observability;
+
+/// <summary>
+/// Central <see cref="Meter"/> + <see cref="ActivitySource"/> definitions for OtOpcUa.
+/// All Akka actors, the OPC UA publish path, and the deploy coordinator emit through these
+/// pre-created instruments so a single OpenTelemetry / Prometheus binding in <c>Host</c>
+/// catches everything. No exporter is required — instruments are no-op until a listener
+/// attaches, so tests and dev hosts pay nothing for instrumentation that nobody scrapes.
+///
+/// Instrument names follow the OpenTelemetry semantic convention pattern
+/// <c>otopcua.&lt;subsystem&gt;.&lt;event&gt;</c>. Subsystem is one of: deploy, driver,
+/// virtualtag, scriptedalarm, opcua, redundancy.
+/// </summary>
+public static class OtOpcUaTelemetry
+{
+    public const string MeterName = "ZB.MOM.WW.OtOpcUa";
+    public const string ActivitySourceName = "ZB.MOM.WW.OtOpcUa";
+
+    /// <summary>Singleton <see cref="Meter"/> all counters/histograms hang off.</summary>
+    public static readonly Meter Meter = new(MeterName);
+
+    /// <summary>Singleton <see cref="ActivitySource"/> used to start spans wrapping deploy/apply/rebuild.</summary>
+    public static readonly ActivitySource ActivitySource = new(ActivitySourceName);
+
+    // ---------------- Deployment / driver-host coordination ----------------
+
+    /// <summary>Incremented every time DriverHostActor finishes applying a deployment (Ack or Reject).</summary>
+    public static readonly Counter<long> DeploymentApplied =
+        Meter.CreateCounter<long>("otopcua.deploy.applied", unit: "{deployment}",
+            description: "Deployments applied by a driver-role node (outcome=ack|reject).");
+
+    /// <summary>Time from DriverHostActor receiving DispatchDeployment to emitting the ack/reject.</summary>
+    public static readonly Histogram<double> DeploymentApplyDurationSec =
+        Meter.CreateHistogram<double>("otopcua.deploy.apply.duration", unit: "s",
+            description: "Driver-role apply latency from DispatchDeployment → Ack/Reject.");
+
+    /// <summary>DriverInstanceActor spawn count (added=new instance; stop=disposed).</summary>
+    public static readonly Counter<long> DriverInstanceLifecycle =
+        Meter.CreateCounter<long>("otopcua.driver.lifecycle", unit: "{event}",
+            description: "DriverInstanceActor lifecycle transitions (event=spawn|stop|fault).");
+
+    // ---------------- VirtualTag / ScriptedAlarm engines ----------------
+
+    public static readonly Counter<long> VirtualTagEval =
+        Meter.CreateCounter<long>("otopcua.virtualtag.eval", unit: "{eval}",
+            description: "Virtual-tag evaluations attempted (outcome=ok|fail|skip).");
+
+    public static readonly Counter<long> ScriptedAlarmTransition =
+        Meter.CreateCounter<long>("otopcua.scriptedalarm.transition", unit: "{transition}",
+            description: "Scripted-alarm state transitions (state=active|acknowledged|inactive).");
+
+    // ---------------- OPC UA address-space + redundancy ----------------
+
+    public static readonly Counter<long> OpcUaSinkWrite =
+        Meter.CreateCounter<long>("otopcua.opcua.sink.write", unit: "{write}",
+            description: "Writes that landed in IOpcUaAddressSpaceSink (kind=value|alarm|rebuild).");
+
+    public static readonly Counter<long> ServiceLevelChange =
+        Meter.CreateCounter<long>("otopcua.redundancy.service_level_change", unit: "{change}",
+            description: "OPC UA Server.ServiceLevel transitions emitted by the redundancy state.");
+
+    // ---------------- Convenience helpers ----------------
+
+    /// <summary>
+    /// Starts a deploy span tagged with the deployment id. Caller disposes to close. Returns
+    /// null when no listener is attached so the call site stays cheap on undecorated builds.
+    /// </summary>
+    public static Activity? StartDeployApplySpan(string deploymentId)
+    {
+        var activity = ActivitySource.StartActivity("otopcua.deploy.apply", ActivityKind.Internal);
+        activity?.SetTag("otopcua.deployment_id", deploymentId);
+        return activity;
+    }
+
+    /// <summary>Span wrapping a full OPC UA address-space rebuild (Phase7 plan → apply).</summary>
+    public static Activity? StartAddressSpaceRebuildSpan()
+        => ActivitySource.StartActivity("otopcua.opcua.address_space_rebuild", ActivityKind.Internal);
+}

src/Core/ZB.MOM.WW.OtOpcUa.Commons/OpcUa/DeferredAddressSpaceSink.cs

@@ -0,0 +1,34 @@
+namespace ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
+
+/// <summary>
+///     Wrapper <see cref="IOpcUaAddressSpaceSink"/> that defers to an inner sink swapped in at
+///     runtime. Needed because the production sink (<c>SdkAddressSpaceSink</c>) wraps an
+///     <c>OtOpcUaNodeManager</c> that only exists after the SDK <c>StandardServer</c> has
+///     started — but Akka actors resolve their sink dependency at construction time, before
+///     the hosted service has booted the SDK.
+///
+///     Bound as a singleton in DI on driver-role hosts; the OPC UA hosted service calls
+///     <see cref="SetSink"/> once the server is up. Until that swap happens, every call is a
+///     no-op against <see cref="NullOpcUaAddressSpaceSink"/>, so the actor stays safe to
+///     receive messages from the moment it boots.
+/// </summary>
+public sealed class DeferredAddressSpaceSink : IOpcUaAddressSpaceSink
+{
+    private volatile IOpcUaAddressSpaceSink _inner = NullOpcUaAddressSpaceSink.Instance;
+
+    /// <summary>Swap in the production sink. Pass <c>null</c> to revert to the null sink
+    /// (used during graceful shutdown so post-stop writes don't hit a half-disposed manager).</summary>
+    public void SetSink(IOpcUaAddressSpaceSink? sink) =>
+        _inner = sink ?? NullOpcUaAddressSpaceSink.Instance;
+
+    public void WriteValue(string nodeId, object? value, OpcUaQuality quality, DateTime sourceTimestampUtc)
+        => _inner.WriteValue(nodeId, value, quality, sourceTimestampUtc);
+
+    public void WriteAlarmState(string alarmNodeId, bool active, bool acknowledged, DateTime sourceTimestampUtc)
+        => _inner.WriteAlarmState(alarmNodeId, active, acknowledged, sourceTimestampUtc);
+
+    public void EnsureFolder(string folderNodeId, string? parentNodeId, string displayName)
+        => _inner.EnsureFolder(folderNodeId, parentNodeId, displayName);
+
+    public void RebuildAddressSpace() => _inner.RebuildAddressSpace();
+}

src/Core/ZB.MOM.WW.OtOpcUa.Commons/OpcUa/DeferredServiceLevelPublisher.cs

@@ -0,0 +1,19 @@
+namespace ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
+
+/// <summary>
+/// Late-binding adapter that holds an inner <see cref="IServiceLevelPublisher"/> reference
+/// swappable at runtime. Mirrors <see cref="DeferredAddressSpaceSink"/>: Akka actors resolve
+/// the publisher at DI time, but the production <c>SdkServiceLevelPublisher</c> only exists
+/// after <c>StandardServer.Start</c>. The Host's hosted service swaps the inner once the SDK
+/// is up; until then writes route through <see cref="NullServiceLevelPublisher"/>.
+/// </summary>
+public sealed class DeferredServiceLevelPublisher : IServiceLevelPublisher
+{
+    private volatile IServiceLevelPublisher _inner = NullServiceLevelPublisher.Instance;
+
+    /// <summary>Swap the underlying publisher. Pass null to revert to the Null no-op.</summary>
+    public void SetInner(IServiceLevelPublisher? inner) =>
+        _inner = inner ?? NullServiceLevelPublisher.Instance;
+
+    public void Publish(byte serviceLevel) => _inner.Publish(serviceLevel);
+}

src/Core/ZB.MOM.WW.OtOpcUa.Commons/OpcUa/IOpcUaAddressSpaceSink.cs

@@ -0,0 +1,46 @@
+namespace ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
+
+/// <summary>
+///     Abstraction over the OPC UA SDK's address space. <c>OpcUaPublishActor</c> consumes this
+///     so the Runtime project doesn't reference <c>Opc.Ua.Server</c> directly — production
+///     binds a real SDK-backed sink in the fused Host's wiring, dev/Mac binds the
+///     <see cref="NullOpcUaAddressSpaceSink"/> no-op.
+/// </summary>
+public interface IOpcUaAddressSpaceSink
+{
+    /// <summary>Write a Variable node's current value + quality + source timestamp.</summary>
+    void WriteValue(string nodeId, object? value, OpcUaQuality quality, DateTime sourceTimestampUtc);
+
+    /// <summary>Write an alarm-condition Variable's active/acknowledged state.</summary>
+    void WriteAlarmState(string alarmNodeId, bool active, bool acknowledged, DateTime sourceTimestampUtc);
+
+    /// <summary>
+    ///     Ensure a folder node exists under the given parent. Used by <c>Phase7Applier</c> to
+    ///     materialise the UNS Area/Line/Equipment hierarchy in the address space. When
+    ///     <paramref name="parentNodeId"/> is null the folder is parented under the namespace
+    ///     root. Idempotent: calling twice with the same id is safe.
+    /// </summary>
+    void EnsureFolder(string folderNodeId, string? parentNodeId, string displayName);
+
+    /// <summary>
+    ///     Tear down + repopulate the address space. Called by <c>OpcUaPublishActor</c> after a
+    ///     successful deployment apply so the node manager reflects the new config. Idempotent.
+    /// </summary>
+    void RebuildAddressSpace();
+}
+
+/// <summary>OPC UA status code projection — Good / Uncertain / Bad. Real SDK has finer-grained
+/// codes; the engine actors only need this 3-state classification.</summary>
+public enum OpcUaQuality { Good, Uncertain, Bad }
+
+/// <summary>No-op sink. Bound by default so the actors are safe to run in dev / Mac /
+/// integration tests without a real SDK behind them.</summary>
+public sealed class NullOpcUaAddressSpaceSink : IOpcUaAddressSpaceSink
+{
+    public static readonly NullOpcUaAddressSpaceSink Instance = new();
+    private NullOpcUaAddressSpaceSink() { }
+    public void WriteValue(string nodeId, object? value, OpcUaQuality quality, DateTime sourceTimestampUtc) { }
+    public void WriteAlarmState(string alarmNodeId, bool active, bool acknowledged, DateTime sourceTimestampUtc) { }
+    public void EnsureFolder(string folderNodeId, string? parentNodeId, string displayName) { }
+    public void RebuildAddressSpace() { }
+}

src/Core/ZB.MOM.WW.OtOpcUa.Commons/OpcUa/IServiceLevelPublisher.cs

@@ -0,0 +1,22 @@
+namespace ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
+
+/// <summary>
+///     Writes the OPC UA Server object's <c>ServiceLevel</c> Variable (0–255). Production binds
+///     a sink that pokes the SDK's ServiceLevel node; tests + dev mode bind
+///     <see cref="NullServiceLevelPublisher"/> which just records the most recently set level
+///     for inspection.
+/// </summary>
+public interface IServiceLevelPublisher
+{
+    void Publish(byte serviceLevel);
+}
+
+/// <summary>No-op default that retains the last-written ServiceLevel in
+/// <see cref="LastPublished"/>. Used by dev mode + verified by tests.</summary>
+public sealed class NullServiceLevelPublisher : IServiceLevelPublisher
+{
+    public static readonly NullServiceLevelPublisher Instance = new();
+    private NullServiceLevelPublisher() { }
+    public byte LastPublished { get; private set; }
+    public void Publish(byte serviceLevel) => LastPublished = serviceLevel;
+}

src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/IDriverFactory.cs

@@ -0,0 +1,35 @@
+namespace ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+/// <summary>
+///     Abstraction over the process-wide driver registry. Runtime consumes this instead of
+///     <c>DriverFactoryRegistry</c> directly so the Runtime project doesn't pull in
+///     <c>ZB.MOM.WW.OtOpcUa.Core</c> (which would drag in Polly + driver hosting). The fused
+///     Host binds a <c>DriverFactoryRegistryAdapter</c> after every <c>Driver.*.Register()</c>
+///     extension has run.
+/// </summary>
+public interface IDriverFactory
+{
+    /// <summary>
+    ///     Return a new <see cref="IDriver"/> for the given <paramref name="driverType"/>, or
+    ///     <c>null</c> when no factory is registered for that type (missing assembly, typo, etc.).
+    ///     The DriverHostActor logs + skips the row rather than failing the whole apply.
+    /// </summary>
+    IDriver? TryCreate(string driverType, string driverInstanceId, string driverConfigJson);
+
+    /// <summary>Driver-type names this factory can materialise. Mostly for diagnostics + logs.</summary>
+    IReadOnlyCollection<string> SupportedTypes { get; }
+}
+
+/// <summary>
+///     Returns <c>null</c> from every <see cref="IDriverFactory.TryCreate"/> call. Bound when the
+///     fused Host hasn't registered any concrete driver assemblies yet (Mac dev path, smoke
+///     tests). DriverHostActor sees zero supported types and treats the deployment as a no-op.
+/// </summary>
+public sealed class NullDriverFactory : IDriverFactory
+{
+    public static readonly NullDriverFactory Instance = new();
+    private NullDriverFactory() { }
+
+    public IDriver? TryCreate(string driverType, string driverInstanceId, string driverConfigJson) => null;
+    public IReadOnlyCollection<string> SupportedTypes { get; } = Array.Empty<string>();
+}

src/Core/ZB.MOM.WW.OtOpcUa.Core/Hosting/DriverFactoryRegistryAdapter.cs

@@ -0,0 +1,28 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Core.Hosting;
+
+/// <summary>
+///     Adapts the existing <see cref="DriverFactoryRegistry"/> (v1 surface, still the
+///     concrete singleton every driver assembly registers itself against) to the v2
+///     <see cref="IDriverFactory"/> abstraction consumed by Runtime. The fused Host binds
+///     this in DI once each <c>Driver.*.Register(registry)</c> call has completed.
+/// </summary>
+public sealed class DriverFactoryRegistryAdapter : IDriverFactory
+{
+    private readonly DriverFactoryRegistry _registry;
+
+    public DriverFactoryRegistryAdapter(DriverFactoryRegistry registry)
+    {
+        ArgumentNullException.ThrowIfNull(registry);
+        _registry = registry;
+    }
+
+    public IDriver? TryCreate(string driverType, string driverInstanceId, string driverConfigJson)
+    {
+        var factory = _registry.TryGet(driverType);
+        return factory?.Invoke(driverInstanceId, driverConfigJson);
+    }
+
+    public IReadOnlyCollection<string> SupportedTypes => _registry.RegisteredTypes;
+}

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/App.razor

@@ -21,6 +21,7 @@
 <body>
     <Routes/>
     <script src="_content/ZB.MOM.WW.OtOpcUa.AdminUI/lib/bootstrap/js/bootstrap.bundle.min.js"></script>
+    <script src="_content/ZB.MOM.WW.OtOpcUa.AdminUI/js/nav-state.js"></script>
     <script src="_framework/blazor.web.js"></script>
 </body>
 </html>

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Layout/LoginLayout.razor

@@ -0,0 +1,5 @@
+@inherits LayoutComponentBase
+
+@* Minimal layout for the login page: no side rail, no brand block. The page
+   renders its own centred card. Mirrors ScadaLink CentralUI's LoginLayout. *@
+@Body

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Layout/MainLayout.razor

@@ -1,24 +1,9 @@
 @inherits LayoutComponentBase
 
-<header class="app-bar">
-    <span class="brand"><span class="mark">&#9646;</span> OtOpcUa</span>
-    <span class="crumb">&rsaquo;</span>
-    <span class="crumb">admin console</span>
-    <span class="spacer"></span>
-    <AuthorizeView>
-        <Authorized>
-            <span class="meta">@context.User.Identity?.Name</span>
-            <span class="conn-pill" data-state="connected">
-                <span class="dot"></span><span>signed in</span>
-            </span>
-        </Authorized>
-        <NotAuthorized>
-            <span class="conn-pill" data-state="disconnected">
-                <span class="dot"></span><span>signed out</span>
-            </span>
-        </NotAuthorized>
-    </AuthorizeView>
-</header>
+@* Layout chrome ported from ScadaLink CentralUI: no separate top bar — brand sits
+   at the top of the side rail. The sidebar itself is the interactive island
+   (<NavSidebar/>); MainLayout stays statically rendered so the Body RenderFragment
+   doesn't have to cross an interactive boundary. *@
 
 <div class="app-shell d-flex flex-column flex-lg-row">
     @* Hamburger toggle: visible only on viewports <lg.
@@ -34,47 +19,7 @@
     </button>
 
     <div class="collapse d-lg-block" id="sidebar-collapse">
-        <nav class="side-rail">
-            <div class="rail-eyebrow">Navigation</div>
-            <NavLink class="rail-link" href="/" Match="NavLinkMatch.All">Overview</NavLink>
-            <NavLink class="rail-link" href="/fleet" Match="NavLinkMatch.Prefix">Fleet status</NavLink>
-            <NavLink class="rail-link" href="/hosts" Match="NavLinkMatch.Prefix">Host status</NavLink>
-            <NavLink class="rail-link" href="/clusters" Match="NavLinkMatch.Prefix">Clusters</NavLink>
-            <NavLink class="rail-link" href="/reservations" Match="NavLinkMatch.Prefix">Reservations</NavLink>
-            <NavLink class="rail-link" href="/certificates" Match="NavLinkMatch.Prefix">Certificates</NavLink>
-            <NavLink class="rail-link" href="/role-grants" Match="NavLinkMatch.Prefix">Role grants</NavLink>
-            <div class="rail-eyebrow">Scripting</div>
-            <NavLink class="rail-link" href="/virtual-tags" Match="NavLinkMatch.Prefix">Virtual tags</NavLink>
-            <NavLink class="rail-link" href="/scripted-alarms" Match="NavLinkMatch.Prefix">Scripted alarms</NavLink>
-            <NavLink class="rail-link" href="/scripts" Match="NavLinkMatch.Prefix">Scripts</NavLink>
-            <NavLink class="rail-link" href="/script-log" Match="NavLinkMatch.Prefix">Script log</NavLink>
-
-            <div class="rail-eyebrow">Live</div>
-            <NavLink class="rail-link" href="/deployments" Match="NavLinkMatch.Prefix">Deployments</NavLink>
-            <NavLink class="rail-link" href="/alerts" Match="NavLinkMatch.Prefix">Alerts</NavLink>
-            <NavLink class="rail-link" href="/alarms-historian" Match="NavLinkMatch.Prefix">Alarms historian</NavLink>
-
-            <div class="rail-foot">
-                <AuthorizeView>
-                    <Authorized>
-                        <div class="rail-eyebrow">Session</div>
-                        <a class="rail-user" href="/account">@context.User.Identity?.Name</a>
-                        <div class="rail-roles">
-                            @string.Join(", ", context.User.Claims
-                                .Where(c => c.Type.EndsWith("/role")).Select(c => c.Value))
-                        </div>
-                        <form method="post" action="/auth/logout">
-                            <AntiforgeryToken />
-                            <button class="rail-btn" type="submit">Sign out</button>
-                        </form>
-                    </Authorized>
-                    <NotAuthorized>
-                        <div class="rail-eyebrow">Session</div>
-                        <a class="rail-btn" href="/login">Sign in</a>
-                    </NotAuthorized>
-                </AuthorizeView>
-            </div>
-        </nav>
+        <NavSidebar />
     </div>
 
     <main class="page">

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Layout/NavSection.razor

@@ -0,0 +1,36 @@
+@* A collapsible sidebar nav section: an uppercase-eyebrow button that toggles
+   the visibility of its child nav items. Mirrors the ScadaLink NavSection at
+   /Users/dohertj2/Desktop/scadalink-design/src/ScadaLink.CentralUI/Components/Layout/NavSection.razor
+   but uses OtOpcUa's rail-eyebrow + rail-link classes. *@
+
+<button type="button"
+        class="rail-eyebrow-toggle"
+        @onclick="OnToggle"
+        aria-expanded="@(Expanded ? "true" : "false")">
+    <span class="rail-eyebrow-chevron">@(Expanded ? "▼" : "▶")</span>
+    <span class="rail-eyebrow-label">@Title</span>
+</button>
+@if (Expanded)
+{
+    <div class="rail-section-body">
+        @ChildContent
+    </div>
+}
+
+@code {
+    /// <summary>Section label shown in the eyebrow (e.g. "Scripting").</summary>
+    [Parameter, EditorRequired]
+    public string Title { get; set; } = string.Empty;
+
+    /// <summary>Whether the section is expanded — its child links rendered.</summary>
+    [Parameter]
+    public bool Expanded { get; set; }
+
+    /// <summary>Raised when the eyebrow button is clicked.</summary>
+    [Parameter]
+    public EventCallback OnToggle { get; set; }
+
+    /// <summary>The section's child nav links, rendered only while expanded.</summary>
+    [Parameter]
+    public RenderFragment? ChildContent { get; set; }
+}

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Layout/NavSidebar.razor

@@ -0,0 +1,160 @@
+@rendermode InteractiveServer
+@using Microsoft.AspNetCore.Components.Routing
+@using Microsoft.JSInterop
+@implements IDisposable
+@inject NavigationManager Navigation
+@inject IJSRuntime JS
+
+@* Interactive sidebar — extracted from MainLayout so the layout itself can stay
+   statically rendered (layouts can't take RenderFragment Body across an interactive
+   boundary). Hosts the collapsible NavSection groups and cookie persistence. *@
+
+<nav class="side-rail">
+    <div class="brand"><span class="mark">&#9646;</span> OtOpcUa</div>
+
+    <NavSection Title="Navigation"
+                Expanded="@_expanded.Contains("nav")"
+                OnToggle="@(() => ToggleAsync("nav"))">
+        <NavLink class="rail-link" href="/" Match="NavLinkMatch.All">Overview</NavLink>
+        <NavLink class="rail-link" href="/fleet" Match="NavLinkMatch.Prefix">Fleet status</NavLink>
+        <NavLink class="rail-link" href="/hosts" Match="NavLinkMatch.Prefix">Host status</NavLink>
+        <NavLink class="rail-link" href="/clusters" Match="NavLinkMatch.Prefix">Clusters</NavLink>
+        <NavLink class="rail-link" href="/reservations" Match="NavLinkMatch.Prefix">Reservations</NavLink>
+        <NavLink class="rail-link" href="/certificates" Match="NavLinkMatch.Prefix">Certificates</NavLink>
+        <NavLink class="rail-link" href="/role-grants" Match="NavLinkMatch.Prefix">Role grants</NavLink>
+    </NavSection>
+
+    <NavSection Title="Scripting"
+                Expanded="@_expanded.Contains("scripting")"
+                OnToggle="@(() => ToggleAsync("scripting"))">
+        <NavLink class="rail-link" href="/virtual-tags" Match="NavLinkMatch.Prefix">Virtual tags</NavLink>
+        <NavLink class="rail-link" href="/scripted-alarms" Match="NavLinkMatch.Prefix">Scripted alarms</NavLink>
+        <NavLink class="rail-link" href="/scripts" Match="NavLinkMatch.Prefix">Scripts</NavLink>
+        <NavLink class="rail-link" href="/script-log" Match="NavLinkMatch.Prefix">Script log</NavLink>
+    </NavSection>
+
+    <NavSection Title="Live"
+                Expanded="@_expanded.Contains("live")"
+                OnToggle="@(() => ToggleAsync("live"))">
+        <NavLink class="rail-link" href="/deployments" Match="NavLinkMatch.Prefix">Deployments</NavLink>
+        <NavLink class="rail-link" href="/alerts" Match="NavLinkMatch.Prefix">Alerts</NavLink>
+        <NavLink class="rail-link" href="/alarms-historian" Match="NavLinkMatch.Prefix">Alarms historian</NavLink>
+    </NavSection>
+
+    <div class="rail-foot">
+        <AuthorizeView>
+            <Authorized>
+                <div class="rail-eyebrow">Session</div>
+                <a class="rail-user" href="/account">@context.User.Identity?.Name</a>
+                <div class="rail-roles">
+                    @string.Join(", ", context.User.Claims
+                        .Where(c => c.Type.EndsWith("/role")).Select(c => c.Value))
+                </div>
+                <form method="post" action="/auth/logout">
+                    <AntiforgeryToken />
+                    <button class="rail-btn" type="submit">Sign out</button>
+                </form>
+            </Authorized>
+            <NotAuthorized>
+                <div class="rail-eyebrow">Session</div>
+                <a class="rail-btn" href="/login">Sign in</a>
+            </NotAuthorized>
+        </AuthorizeView>
+    </div>
+</nav>
+
+@code {
+    // Expanded-section state persists in the `otopcua_nav` cookie via
+    // wwwroot/js/nav-state.js (window.navState.get/.set). Same pattern as
+    // ScadaLink CentralUI's NavMenu.
+
+    private static readonly string[] SectionIds = { "nav", "scripting", "live" };
+
+    private readonly HashSet<string> _expanded = new(StringComparer.Ordinal);
+
+    protected override void OnInitialized()
+    {
+        Navigation.LocationChanged += OnLocationChanged;
+        // Seed from the URL so the current page's section is expanded on the
+        // initial render — works even before JS interop is ready.
+        EnsureCurrentSectionExpanded();
+    }
+
+    protected override async Task OnAfterRenderAsync(bool firstRender)
+    {
+        if (!firstRender) return;
+
+        string saved;
+        try
+        {
+            saved = await JS.InvokeAsync<string>("navState.get") ?? string.Empty;
+        }
+        catch (JSDisconnectedException) { return; }
+        catch (InvalidOperationException) { return; }
+
+        foreach (var id in saved.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries))
+        {
+            if (Array.IndexOf(SectionIds, id) >= 0)
+                _expanded.Add(id);
+        }
+
+        if (EnsureCurrentSectionExpanded())
+            await PersistAsync();
+
+        StateHasChanged();
+    }
+
+    private void OnLocationChanged(object? sender, LocationChangedEventArgs e)
+    {
+        if (EnsureCurrentSectionExpanded())
+        {
+            _ = PersistAsync();
+            _ = InvokeAsync(StateHasChanged);
+        }
+    }
+
+    private async Task ToggleAsync(string id)
+    {
+        if (!_expanded.Remove(id))
+            _expanded.Add(id);
+        await PersistAsync();
+    }
+
+    private bool EnsureCurrentSectionExpanded()
+    {
+        var section = CurrentSection();
+        return section is not null && _expanded.Add(section);
+    }
+
+    private string? CurrentSection()
+    {
+        var relative = Navigation.ToBaseRelativePath(Navigation.Uri);
+        var firstSegment = relative.Split('?', '#')[0]
+            .Split('/', StringSplitOptions.RemoveEmptyEntries)
+            .FirstOrDefault();
+
+        return firstSegment switch
+        {
+            null or "" => "nav",
+            "fleet" or "hosts" or "clusters" or "reservations" or "certificates" or "role-grants" => "nav",
+            "virtual-tags" or "scripted-alarms" or "scripts" or "script-log" => "scripting",
+            "deployments" or "alerts" or "alarms-historian" => "live",
+            _ => null,
+        };
+    }
+
+    private async Task PersistAsync()
+    {
+        try
+        {
+            await JS.InvokeVoidAsync("navState.set", string.Join(',', _expanded));
+        }
+        catch (JSDisconnectedException) { }
+        catch (InvalidOperationException) { }
+    }
+
+    public void Dispose()
+    {
+        Navigation.LocationChanged -= OnLocationChanged;
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/Alerts.razor

@@ -1,7 +1,7 @@
 @page "/alerts"
 @* Live alarm tail via SignalR. Subscribes to /hubs/alerts and shows the most-recent
-   AlarmTransitionEvent entries. Engine wiring (ScriptedAlarmActor publish on the `alerts`
-   topic) lands with F9; until then the connection stays open and the table is empty. *@
+   AlarmTransitionEvent entries published by ScriptedAlarmActor (Runtime/ScriptedAlarms)
+   and the AB CIP ALMD bridge. *@
 @attribute [Microsoft.AspNetCore.Authorization.Authorize]
 @rendermode RenderMode.InteractiveServer
 @using Microsoft.AspNetCore.SignalR.Client
@@ -23,14 +23,14 @@
 <section class="panel notice rise" style="animation-delay:.02s">
     Live alarm transitions from the cluster's <span class="mono">alerts</span> DPS topic. Shows
     the most-recent @Capacity entries since the page opened; reload for a fresh window. Sources:
-    ScriptedAlarmActor, native AB CIP ALMD bridge (F9), Galaxy alarm bridge (future).
+    ScriptedAlarmActor, native driver alarm bridges (AB CIP ALMD, Galaxy where wired).
 </section>
 
 @if (_rows.Count == 0)
 {
     <section class="panel notice rise mt-3" style="animation-delay:.08s">
-        No alarms yet. Engine wiring (F9 ScriptedAlarmActor) is pending; once it ships the table
-        below will start populating in real time.
+        No alarms in the current window. The table will populate as soon as a
+        ScriptedAlarmActor or driver alarm bridge publishes a transition.
     </section>
 }
 else

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/Login.razor

@@ -1,8 +1,11 @@
 @page "/login"
+@layout LoginLayout
 @* Login MUST stay anonymously reachable — otherwise the fallback authorization policy
    would lock operators out of the only way in (Admin-001). Static-rendered on purpose:
    the form POSTs to /auth/login while ASP.NET still owns an unstarted HTTP response.
-   Calling SignInAsync from an interactive circuit would be too late. *@
+   Calling SignInAsync from an interactive circuit would be too late.
+
+   Uses LoginLayout (no side rail) so the page renders as a clean centred card. *@
 @attribute [Microsoft.AspNetCore.Authorization.AllowAnonymous]
 
 <div class="login-wrap rise" style="animation-delay:.02s">
@@ -32,12 +35,6 @@
 
                 <button class="btn btn-primary w-100" type="submit">Sign in</button>
             </form>
-
-            <div style="margin-top:1rem;padding-top:.85rem;border-top:1px solid var(--rule);
-                        font-size:.78rem;color:var(--ink-faint)">
-                LDAP bind against the configured directory (per Q5 of the AdminUI rebuild plan:
-                generic error in production; specific reason when <span class="mono">Authentication:Ldap:AllowInsecureLdap=true</span>).
-            </div>
         </div>
     </section>
 </div>

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/EndpointRouteBuilderExtensions.cs

@@ -20,6 +20,9 @@ public static class EndpointRouteBuilderExtensions
     public static IEndpointRouteBuilder MapAdminUI<TApp>(this IEndpointRouteBuilder app)
         where TApp : IComponent
     {
+        // Razor class library static assets (_content/ZB.MOM.WW.OtOpcUa.AdminUI/**) are
+        // served via the Host's app.UseStaticFiles() middleware which must run BEFORE
+        // UseAuthentication() — see Program.cs.
         app.MapRazorComponents<TApp>()
             .AddInteractiveServerRenderMode();
         return app;

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/_Imports.razor

@@ -6,3 +6,4 @@
 @using static Microsoft.AspNetCore.Components.Web.RenderMode
 @using Microsoft.JSInterop
 @using ZB.MOM.WW.OtOpcUa.AdminUI.Components.Shared
+@using ZB.MOM.WW.OtOpcUa.AdminUI.Components.Layout

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/wwwroot/css/site.css

@@ -49,6 +49,19 @@
     }
 }
 
+/* Brand block pinned at the top of the side rail. Mirrors ScadaLink's
+   .sidebar .brand styling — used now that the top app-bar was dropped. */
+.side-rail .brand {
+    color: var(--ink);
+    font-size: 1.1rem;
+    font-weight: 600;
+    letter-spacing: 0.02em;
+    padding: 1rem;
+    border-bottom: 1px solid var(--rule);
+    margin-bottom: 0.4rem;
+}
+.side-rail .brand .mark { color: var(--accent); }
+
 .rail-eyebrow {
     font-size: 0.68rem;
     font-weight: 600;
@@ -58,6 +71,36 @@
     padding: 0.3rem 0.6rem;
 }
 
+/* Collapsible variant — rendered by NavSection.razor. Looks like .rail-eyebrow
+   plus a leading chevron; clicking flips chevron + expanded state. */
+.rail-eyebrow-toggle {
+    display: flex;
+    align-items: center;
+    gap: 0.4rem;
+    width: 100%;
+    background: transparent;
+    border: 0;
+    text-align: left;
+    font-size: 0.68rem;
+    font-weight: 600;
+    text-transform: uppercase;
+    letter-spacing: 0.07em;
+    color: var(--ink-faint);
+    padding: 0.45rem 0.6rem 0.3rem;
+    cursor: pointer;
+}
+.rail-eyebrow-toggle:hover { color: var(--ink); }
+.rail-eyebrow-chevron {
+    display: inline-block;
+    width: 0.7rem;
+    font-size: 0.55rem;
+    color: var(--ink-faint);
+}
+.rail-section-body {
+    display: flex;
+    flex-direction: column;
+}
+
 .rail-link {
     display: block;
     padding: 0.4rem 0.6rem;

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/wwwroot/js/nav-state.js

@@ -0,0 +1,19 @@
+// Sidebar nav collapse state — persisted in the `otopcua_nav` cookie so it
+// survives full page reloads and reconnects. Invoked from MainLayout.razor via
+// JS interop (window.navState.get / .set). Mirrors the ScadaLink pattern at
+// /Users/dohertj2/Desktop/scadalink-design/src/ScadaLink.CentralUI/wwwroot/js/nav-state.js.
+window.navState = {
+    // Returns the raw cookie value (comma-separated expanded section ids), or
+    // an empty string when the cookie is absent.
+    get: function () {
+        const match = document.cookie.match(/(?:^|;\s*)otopcua_nav=([^;]*)/);
+        return match ? decodeURIComponent(match[1]) : "";
+    },
+    // Writes the cookie with a one-year lifetime. SameSite=Lax; not HttpOnly
+    // (JS must write it) and not sensitive.
+    set: function (value) {
+        const oneYearSeconds = 60 * 60 * 24 * 365;
+        document.cookie = "otopcua_nav=" + encodeURIComponent(value) +
+            ";path=/;max-age=" + oneYearSeconds + ";samesite=lax";
+    }
+};

src/Server/ZB.MOM.WW.OtOpcUa.Host/Drivers/DriverFactoryBootstrap.cs

@@ -0,0 +1,55 @@
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Core.Hosting;
+
+namespace ZB.MOM.WW.OtOpcUa.Host.Drivers;
+
+/// <summary>
+///     Wires every cross-platform driver assembly's <c>Register(registry, loggerFactory)</c>
+///     extension into a single <see cref="DriverFactoryRegistry"/> singleton and binds the
+///     v2 <see cref="IDriverFactory"/> abstraction to a <see cref="DriverFactoryRegistryAdapter"/>
+///     over it. Replaces the F7 seam's <c>NullDriverFactory</c> default so deploys actually
+///     materialise real <see cref="IDriver"/> instances on driver-role nodes.
+///
+///     Skipped entirely on admin-only nodes — they never run drivers, so the registry doesn't
+///     need to exist (Program.cs guards via the <c>hasDriver</c> flag).
+/// </summary>
+public static class DriverFactoryBootstrap
+{
+    /// <summary>
+    ///     Register the cross-platform driver factories + bind <see cref="IDriverFactory"/>.
+    ///     Must be called BEFORE <c>services.AddAkka</c> so the runtime extension can resolve
+    ///     <see cref="IDriverFactory"/> from DI when spawning <c>DriverHostActor</c>.
+    /// </summary>
+    public static IServiceCollection AddOtOpcUaDriverFactories(this IServiceCollection services)
+    {
+        services.AddSingleton<DriverFactoryRegistry>(sp =>
+        {
+            var registry = new DriverFactoryRegistry();
+            var loggerFactory = sp.GetService<ILoggerFactory>();
+            Register(registry, loggerFactory);
+            return registry;
+        });
+        services.AddSingleton<IDriverFactory>(sp =>
+            new DriverFactoryRegistryAdapter(sp.GetRequiredService<DriverFactoryRegistry>()));
+        return services;
+    }
+
+    /// <summary>
+    ///     Invoke every cross-platform driver's <c>Register</c> extension. New driver assemblies
+    ///     get added here — one line per type. ShouldStub() in <c>DriverInstanceActor</c> still
+    ///     handles platform/role-dependent stubbing (e.g. Galaxy on macOS), so registering a
+    ///     factory here doesn't mean it always runs in production.
+    /// </summary>
+    private static void Register(DriverFactoryRegistry registry, ILoggerFactory? loggerFactory)
+    {
+        Driver.AbCip.AbCipDriverFactoryExtensions.Register(registry);
+        Driver.AbLegacy.AbLegacyDriverFactoryExtensions.Register(registry, loggerFactory);
+        Driver.FOCAS.FocasDriverFactoryExtensions.Register(registry);
+        Driver.Galaxy.GalaxyDriverFactoryExtensions.Register(registry, loggerFactory);
+        Driver.Modbus.ModbusDriverFactoryExtensions.Register(registry, loggerFactory);
+        Driver.S7.S7DriverFactoryExtensions.Register(registry);
+        Driver.TwinCAT.TwinCATDriverFactoryExtensions.Register(registry);
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.Host/Engines/RoslynScriptedAlarmEvaluator.cs

@@ -0,0 +1,107 @@
+using System.Collections.Concurrent;
+using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.OtOpcUa.Commons.Engines;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms;
+using ZB.MOM.WW.OtOpcUa.Core.Scripting;
+using SerilogLogger = Serilog.ILogger;
+using SerilogLog = Serilog.Log;
+
+namespace ZB.MOM.WW.OtOpcUa.Host.Engines;
+
+/// <summary>
+/// F9b — production <see cref="IScriptedAlarmEvaluator"/> binding. Compiles each unique
+/// predicate once via <see cref="ScriptEvaluator{TContext, TResult}"/> against
+/// <see cref="AlarmPredicateContext"/> and caches the resulting evaluator. Predicates are
+/// pure functions returning <c>bool</c>: <see cref="AlarmPredicateContext.SetVirtualTag"/>
+/// throws so a misbehaving script can't smuggle a side effect into alarm evaluation.
+///
+/// Failure modes (compile error, sandbox violation, runtime exception, timeout) all surface
+/// as <see cref="ScriptedAlarmEvalResult.Failure"/>; <see cref="ScriptedAlarmActor"/>
+/// preserves the prior state on failure (does not flip Active/Inactive).
+/// </summary>
+public sealed class RoslynScriptedAlarmEvaluator : IScriptedAlarmEvaluator, IDisposable
+{
+    private static readonly SerilogLogger ScriptLogger = SerilogLog.ForContext<RoslynScriptedAlarmEvaluator>();
+
+    private readonly ConcurrentDictionary<string, ScriptEvaluator<AlarmPredicateContext, bool>> _cache
+        = new(StringComparer.Ordinal);
+    private readonly ILogger<RoslynScriptedAlarmEvaluator> _logger;
+    private readonly TimeSpan _runTimeout;
+    private bool _disposed;
+
+    public RoslynScriptedAlarmEvaluator(ILogger<RoslynScriptedAlarmEvaluator> logger, TimeSpan? runTimeout = null)
+    {
+        _logger = logger;
+        _runTimeout = runTimeout ?? TimeSpan.FromSeconds(2);
+    }
+
+    public ScriptedAlarmEvalResult Evaluate(string alarmId, string predicate, IReadOnlyDictionary<string, object?> dependencies)
+    {
+        if (_disposed) return ScriptedAlarmEvalResult.Failure("evaluator disposed");
+        if (string.IsNullOrWhiteSpace(predicate)) return ScriptedAlarmEvalResult.Failure("empty predicate");
+
+        ScriptEvaluator<AlarmPredicateContext, bool> evaluator;
+        try
+        {
+            evaluator = _cache.GetOrAdd(predicate, ScriptEvaluator<AlarmPredicateContext, bool>.Compile);
+        }
+        catch (CompilationErrorException ex)
+        {
+            _logger.LogWarning(ex, "Alarm {Id}: predicate compile failed", alarmId);
+            return ScriptedAlarmEvalResult.Failure($"compile error: {ex.Message}");
+        }
+        catch (ScriptSandboxViolationException ex)
+        {
+            _logger.LogWarning(ex, "Alarm {Id}: predicate sandbox violation", alarmId);
+            return ScriptedAlarmEvalResult.Failure($"sandbox violation: {ex.Message}");
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "Alarm {Id}: predicate compile threw", alarmId);
+            return ScriptedAlarmEvalResult.Failure($"compile failure: {ex.Message}");
+        }
+
+        var readCache = BuildReadCache(dependencies);
+        var context = new AlarmPredicateContext(readCache, ScriptLogger);
+
+        try
+        {
+            using var cts = new CancellationTokenSource(_runTimeout);
+            var active = evaluator.RunAsync(context, cts.Token).GetAwaiter().GetResult();
+            return ScriptedAlarmEvalResult.Ok(active);
+        }
+        catch (OperationCanceledException)
+        {
+            return ScriptedAlarmEvalResult.Failure($"predicate timed out after {_runTimeout.TotalSeconds:F1}s");
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "Alarm {Id}: predicate execution threw", alarmId);
+            return ScriptedAlarmEvalResult.Failure($"predicate threw: {ex.Message}");
+        }
+    }
+
+    private static IReadOnlyDictionary<string, DataValueSnapshot> BuildReadCache(
+        IReadOnlyDictionary<string, object?> deps)
+    {
+        var nowUtc = DateTime.UtcNow;
+        var cache = new Dictionary<string, DataValueSnapshot>(StringComparer.Ordinal);
+        foreach (var kv in deps)
+        {
+            cache[kv.Key] = new DataValueSnapshot(kv.Value, StatusCode: 0u, SourceTimestampUtc: nowUtc, ServerTimestampUtc: nowUtc);
+        }
+        return cache;
+    }
+
+    public void Dispose()
+    {
+        if (_disposed) return;
+        _disposed = true;
+        foreach (var ev in _cache.Values)
+        {
+            try { ev.Dispose(); } catch { /* best-effort */ }
+        }
+        _cache.Clear();
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.Host/Engines/RoslynVirtualTagEvaluator.cs

@@ -0,0 +1,116 @@
+using System.Collections.Concurrent;
+using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.OtOpcUa.Commons.Engines;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Core.Scripting;
+using ZB.MOM.WW.OtOpcUa.Core.VirtualTags;
+using SerilogLogger = Serilog.ILogger;
+using SerilogLog = Serilog.Log;
+
+namespace ZB.MOM.WW.OtOpcUa.Host.Engines;
+
+/// <summary>
+/// F8b — production <see cref="IVirtualTagEvaluator"/> binding. Compiles each unique
+/// expression once via <see cref="ScriptEvaluator{TContext, TResult}"/> (Roslyn-backed
+/// sandbox) and caches the resulting evaluator keyed by source. Subsequent evaluations are
+/// in-process method invocations on the dependency dictionary — fast enough to run inline
+/// inside the actor's message handler.
+///
+/// Single-tag mode: cross-tag <c>ctx.SetVirtualTag</c> writes are dropped (logged) because
+/// fan-out between actors is owned by <c>DependencyMuxActor</c>, not by the eval engine.
+/// Cycle detection + cascade ordering live in <see cref="VirtualTagEngine"/>; this adapter
+/// stays single-tag scoped to keep <see cref="VirtualTagActor"/>'s message loop simple.
+/// </summary>
+public sealed class RoslynVirtualTagEvaluator : IVirtualTagEvaluator, IDisposable
+{
+    private static readonly SerilogLogger ScriptLogger = SerilogLog.ForContext<RoslynVirtualTagEvaluator>();
+
+    private readonly ConcurrentDictionary<string, ScriptEvaluator<VirtualTagContext, object?>> _cache
+        = new(StringComparer.Ordinal);
+    private readonly ILogger<RoslynVirtualTagEvaluator> _logger;
+    private readonly TimeSpan _runTimeout;
+    private bool _disposed;
+
+    public RoslynVirtualTagEvaluator(ILogger<RoslynVirtualTagEvaluator> logger, TimeSpan? runTimeout = null)
+    {
+        _logger = logger;
+        _runTimeout = runTimeout ?? TimeSpan.FromSeconds(2);
+    }
+
+    public VirtualTagEvalResult Evaluate(string virtualTagId, string expression, IReadOnlyDictionary<string, object?> dependencies)
+    {
+        if (_disposed) return VirtualTagEvalResult.Failure("evaluator disposed");
+        if (string.IsNullOrWhiteSpace(expression)) return VirtualTagEvalResult.Failure("empty expression");
+
+        ScriptEvaluator<VirtualTagContext, object?> evaluator;
+        try
+        {
+            evaluator = _cache.GetOrAdd(expression, ScriptEvaluator<VirtualTagContext, object?>.Compile);
+        }
+        catch (CompilationErrorException ex)
+        {
+            _logger.LogWarning(ex, "VirtualTag {Id}: Roslyn compile failed", virtualTagId);
+            return VirtualTagEvalResult.Failure($"compile error: {ex.Message}");
+        }
+        catch (ScriptSandboxViolationException ex)
+        {
+            _logger.LogWarning(ex, "VirtualTag {Id}: sandbox violation", virtualTagId);
+            return VirtualTagEvalResult.Failure($"sandbox violation: {ex.Message}");
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "VirtualTag {Id}: compile threw", virtualTagId);
+            return VirtualTagEvalResult.Failure($"compile failure: {ex.Message}");
+        }
+
+        var readCache = BuildReadCache(dependencies);
+        var context = new VirtualTagContext(
+            readCache,
+            setVirtualTag: (path, _) =>
+                _logger.LogDebug("VirtualTag {Id}: cross-tag write to {Path} dropped (single-tag adapter)",
+                    virtualTagId, path),
+            logger: ScriptLogger);
+
+        try
+        {
+            using var cts = new CancellationTokenSource(_runTimeout);
+            var raw = evaluator.RunAsync(context, cts.Token).GetAwaiter().GetResult();
+            return VirtualTagEvalResult.Ok(raw);
+        }
+        catch (OperationCanceledException)
+        {
+            return VirtualTagEvalResult.Failure($"script timed out after {_runTimeout.TotalSeconds:F1}s");
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "VirtualTag {Id}: script execution threw", virtualTagId);
+            return VirtualTagEvalResult.Failure($"script threw: {ex.Message}");
+        }
+    }
+
+    private static IReadOnlyDictionary<string, DataValueSnapshot> BuildReadCache(
+        IReadOnlyDictionary<string, object?> deps)
+    {
+        // VirtualTagContext.GetTag returns a DataValueSnapshot — we wrap each raw dep value
+        // as Good-quality so the script's `(int)ctx.GetTag("a").Value` pattern works. Null
+        // values stay null; the script can null-check via GetTag(path).Value.
+        var nowUtc = DateTime.UtcNow;
+        var cache = new Dictionary<string, DataValueSnapshot>(StringComparer.Ordinal);
+        foreach (var kv in deps)
+        {
+            cache[kv.Key] = new DataValueSnapshot(kv.Value, StatusCode: 0u, SourceTimestampUtc: nowUtc, ServerTimestampUtc: nowUtc);
+        }
+        return cache;
+    }
+
+    public void Dispose()
+    {
+        if (_disposed) return;
+        _disposed = true;
+        foreach (var ev in _cache.Values)
+        {
+            try { ev.Dispose(); } catch { /* best-effort */ }
+        }
+        _cache.Clear();
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.Host/Observability/ObservabilityExtensions.cs

@@ -0,0 +1,38 @@
+using OpenTelemetry.Metrics;
+using OpenTelemetry.Trace;
+using ZB.MOM.WW.OtOpcUa.Commons.Observability;
+
+namespace ZB.MOM.WW.OtOpcUa.Host.Observability;
+
+/// <summary>
+/// Wires the OtOpcUa Meter + ActivitySource into OpenTelemetry and exposes a Prometheus
+/// scrape endpoint at <c>/metrics</c> on the host pipeline. F13d slice — only the meter +
+/// activity source declared in <see cref="OtOpcUaTelemetry"/> are surfaced; per-Akka
+/// internals + ASP.NET request metrics stay off by default to keep the scrape payload
+/// scoped to OtOpcUa-owned signals.
+/// </summary>
+public static class ObservabilityExtensions
+{
+    public static IServiceCollection AddOtOpcUaObservability(this IServiceCollection services)
+    {
+        services.AddOpenTelemetry()
+            .WithMetrics(b => b
+                .AddMeter(OtOpcUaTelemetry.MeterName)
+                .AddPrometheusExporter())
+            .WithTracing(b => b
+                .AddSource(OtOpcUaTelemetry.ActivitySourceName));
+
+        return services;
+    }
+
+    /// <summary>
+    /// Mounts the Prometheus scrape endpoint on the existing ASP.NET pipeline. Call after
+    /// <c>app.UseAuthentication/UseAuthorization</c> if metrics access should require auth;
+    /// the default leaves it unauthenticated for local Prometheus scrapes.
+    /// </summary>
+    public static IEndpointRouteBuilder MapOtOpcUaMetrics(this IEndpointRouteBuilder app)
+    {
+        app.MapPrometheusScrapingEndpoint("/metrics");
+        return app;
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/LdapOpcUaUserAuthenticator.cs

@@ -0,0 +1,36 @@
+using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.OtOpcUa.OpcUaServer.Security;
+using ZB.MOM.WW.OtOpcUa.Security.Ldap;
+
+namespace ZB.MOM.WW.OtOpcUa.Host.OpcUa;
+
+/// <summary>
+/// Production <see cref="IOpcUaUserAuthenticator"/> adapter that bridges OPC UA UserName
+/// tokens to the same <see cref="ILdapAuthService"/> the Admin UI cookie/JWT flows use, so a
+/// single LDAP source-of-truth governs both control-plane (Admin) and data-plane (OPC UA)
+/// session identities. Roles flow through unchanged — the data-plane ACL evaluator reads
+/// them off <c>OperationContext.UserIdentity</c> downstream.
+/// </summary>
+public sealed class LdapOpcUaUserAuthenticator(
+    ILdapAuthService ldap,
+    ILogger<LdapOpcUaUserAuthenticator> logger)
+    : IOpcUaUserAuthenticator
+{
+    public async Task<OpcUaUserAuthResult> AuthenticateUserNameAsync(string username, string password, CancellationToken ct)
+    {
+        try
+        {
+            var result = await ldap.AuthenticateAsync(username, password, ct).ConfigureAwait(false);
+            if (!result.Success)
+            {
+                return OpcUaUserAuthResult.Deny(result.Error ?? "Invalid credentials");
+            }
+            return OpcUaUserAuthResult.Allow(result.DisplayName ?? username, result.Roles);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            logger.LogWarning(ex, "LDAP authentication threw for OPC UA user {User}", username);
+            return OpcUaUserAuthResult.Deny("Authentication backend error");
+        }
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/OtOpcUaServerHostedService.cs

@@ -0,0 +1,106 @@
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
+using ZB.MOM.WW.OtOpcUa.OpcUaServer;
+using ZB.MOM.WW.OtOpcUa.OpcUaServer.Security;
+
+namespace ZB.MOM.WW.OtOpcUa.Host.OpcUa;
+
+/// <summary>
+///     Owns the OPC UA SDK lifecycle on driver-role hosts. Reads
+///     <see cref="OpcUaApplicationHostOptions"/> from the <c>OpcUa</c> config section, boots
+///     an <see cref="OtOpcUaSdkServer"/> through <see cref="OpcUaApplicationHost"/>, then
+///     swaps a real <see cref="SdkAddressSpaceSink"/> into the
+///     <see cref="DeferredAddressSpaceSink"/> singleton so <c>OpcUaPublishActor</c>'s writes
+///     start landing in the real address space.
+///
+///     Tests boot the OPC UA server directly via <see cref="OpcUaApplicationHost"/>; this
+///     hosted service is the production wiring.
+/// </summary>
+public sealed class OtOpcUaServerHostedService : IHostedService, IAsyncDisposable
+{
+    private readonly IConfiguration _configuration;
+    private readonly DeferredAddressSpaceSink _deferredSink;
+    private readonly DeferredServiceLevelPublisher _deferredServiceLevel;
+    private readonly IOpcUaUserAuthenticator _userAuthenticator;
+    private readonly ILoggerFactory _loggerFactory;
+    private readonly ILogger<OtOpcUaServerHostedService> _logger;
+
+    private OpcUaApplicationHost? _appHost;
+    private OtOpcUaSdkServer? _server;
+
+    public OtOpcUaServerHostedService(
+        IConfiguration configuration,
+        DeferredAddressSpaceSink deferredSink,
+        DeferredServiceLevelPublisher deferredServiceLevel,
+        IOpcUaUserAuthenticator userAuthenticator,
+        ILoggerFactory loggerFactory)
+    {
+        _configuration = configuration;
+        _deferredSink = deferredSink;
+        _deferredServiceLevel = deferredServiceLevel;
+        _userAuthenticator = userAuthenticator;
+        _loggerFactory = loggerFactory;
+        _logger = loggerFactory.CreateLogger<OtOpcUaServerHostedService>();
+    }
+
+    public async Task StartAsync(CancellationToken cancellationToken)
+    {
+        var options = new OpcUaApplicationHostOptions();
+        _configuration.GetSection("OpcUa").Bind(options);
+
+        _server = new OtOpcUaSdkServer();
+        _appHost = new OpcUaApplicationHost(
+            options,
+            _loggerFactory.CreateLogger<OpcUaApplicationHost>(),
+            _userAuthenticator);
+
+        try
+        {
+            await _appHost.StartAsync(_server, cancellationToken).ConfigureAwait(false);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex,
+                "OtOpcUaServerHostedService: SDK start failed; OpcUaPublishActor writes will continue to no-op");
+            // Don't rethrow — the rest of the host (admin UI, driver actors, etc.) can still boot.
+            // Operators see the failure via the logs + can correct config without a process bounce
+            // of the whole binary.
+            return;
+        }
+
+        if (_server.NodeManager is null)
+        {
+            _logger.LogWarning(
+                "OtOpcUaServerHostedService: SDK reported started but NodeManager is null; sink stays Null");
+            return;
+        }
+
+        _deferredSink.SetSink(new SdkAddressSpaceSink(_server.NodeManager));
+
+        // ServiceLevel publisher needs IServerInternal — only available after Start.
+        if (_server.CurrentInstance is { } serverInternal)
+        {
+            _deferredServiceLevel.SetInner(new SdkServiceLevelPublisher(
+                serverInternal,
+                _loggerFactory.CreateLogger<SdkServiceLevelPublisher>()));
+        }
+
+        _logger.LogInformation("OtOpcUaServerHostedService: SDK started, address-space + ServiceLevel sinks bound");
+    }
+
+    public Task StopAsync(CancellationToken cancellationToken)
+    {
+        // Revert to Null adapters so any in-flight writes from a poison-pilled actor don't hit a
+        // half-disposed NodeManager.
+        _deferredSink.SetSink(null);
+        _deferredServiceLevel.SetInner(null);
+        return Task.CompletedTask;
+    }
+
+    public async ValueTask DisposeAsync()
+    {
+        if (_appHost is not null) await _appHost.DisposeAsync();
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.Host/Program.cs

@@ -7,11 +7,19 @@ using ZB.MOM.WW.OtOpcUa.AdminUI.Hubs;
 using ZB.MOM.WW.OtOpcUa.Cluster;
 using ZB.MOM.WW.OtOpcUa.Configuration;
 using ZB.MOM.WW.OtOpcUa.ControlPlane;
+using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
+using ZB.MOM.WW.OtOpcUa.Commons.Engines;
 using ZB.MOM.WW.OtOpcUa.Host;
+using ZB.MOM.WW.OtOpcUa.Host.Drivers;
+using ZB.MOM.WW.OtOpcUa.Host.Engines;
 using ZB.MOM.WW.OtOpcUa.Host.Health;
+using ZB.MOM.WW.OtOpcUa.Host.Observability;
+using ZB.MOM.WW.OtOpcUa.Host.OpcUa;
+using ZB.MOM.WW.OtOpcUa.OpcUaServer.Security;
 using ZB.MOM.WW.OtOpcUa.Runtime;
 using ZB.MOM.WW.OtOpcUa.Security;
 using ZB.MOM.WW.OtOpcUa.Security.Endpoints;
+using ZB.MOM.WW.OtOpcUa.Security.Ldap;
 
 // Roles drive the entire conditional wiring below — see ZB.MOM.WW.OtOpcUa.Cluster.RoleParser.
 var roles = RoleParser.Parse(Environment.GetEnvironmentVariable("OTOPCUA_ROLES"));
@@ -20,6 +28,11 @@ var hasDriver = roles.Contains("driver");
 
 var builder = WebApplication.CreateBuilder(args);
 
+// Razor class library static assets (_content/<libname>/...) only auto-enable in
+// the Development environment. Opt in explicitly so the AdminUI's CSS/JS works
+// regardless of ASPNETCORE_ENVIRONMENT.
+builder.WebHost.UseStaticWebAssets();
+
 // Per-role appsettings overlay: appsettings.{role}.json (single role) or appsettings.admin-driver.json
 // (both). Optional — base appsettings.json carries enough to boot if these don't exist.
 var roleSuffix = roles.Length == 0 ? null : string.Join('-', roles.OrderBy(r => r, StringComparer.Ordinal));
@@ -40,7 +53,49 @@ builder.Services.AddOtOpcUaConfigDb(builder.Configuration);
 builder.Services.AddOtOpcUaCluster(builder.Configuration);
 
 if (hasDriver)
+{
     builder.Services.AddOtOpcUaRuntime();
+    // Bind every cross-platform driver factory before AddAkka resolves IDriverFactory — replaces
+    // the F7-default NullDriverFactory with a real DriverFactoryRegistryAdapter so DriverHostActor
+    // can materialise real IDriver instances on deploy.
+    builder.Services.AddOtOpcUaDriverFactories();
+
+    // Deferred sink so Akka actors can resolve IOpcUaAddressSpaceSink at construction time —
+    // the OPC UA hosted service swaps in a real SdkAddressSpaceSink once StandardServer has
+    // started. Until then writes route through NullOpcUaAddressSpaceSink.
+    builder.Services.AddSingleton<DeferredAddressSpaceSink>();
+    builder.Services.AddSingleton<IOpcUaAddressSpaceSink>(sp =>
+        sp.GetRequiredService<DeferredAddressSpaceSink>());
+
+    // Same late-binding pattern for the ServiceLevel publisher — actor wants it at ctor time,
+    // production SdkServiceLevelPublisher needs IServerInternal which only exists after Start.
+    builder.Services.AddSingleton<DeferredServiceLevelPublisher>();
+    builder.Services.AddSingleton<IServiceLevelPublisher>(sp =>
+        sp.GetRequiredService<DeferredServiceLevelPublisher>());
+
+    // F13c — bind UserName tokens to the same LDAP backend the Admin cookie/JWT flows use.
+    // ILdapAuthService is registered by AddOtOpcUaAuth on admin nodes; on driver-only nodes
+    // it isn't, so we register the LDAP options + service unconditionally for driver hosts
+    // to keep parity. The LdapAdapter falls back to Deny on any backend error.
+    // F8b — production virtual-tag evaluator (Roslyn-compiled scripts cached per expression).
+    // Replaces the F8-default NullVirtualTagEvaluator so VirtualTagActor evaluates real user
+    // scripts at runtime.
+    builder.Services.AddSingleton<RoslynVirtualTagEvaluator>(sp =>
+        new RoslynVirtualTagEvaluator(sp.GetRequiredService<ILoggerFactory>().CreateLogger<RoslynVirtualTagEvaluator>()));
+    builder.Services.AddSingleton<IVirtualTagEvaluator>(sp => sp.GetRequiredService<RoslynVirtualTagEvaluator>());
+
+    // F9b — same pattern for scripted-alarm predicates. The actor preserves prior state on
+    // any Failure result, so a misbehaving script can't flip Active/Inactive spuriously.
+    builder.Services.AddSingleton<RoslynScriptedAlarmEvaluator>(sp =>
+        new RoslynScriptedAlarmEvaluator(sp.GetRequiredService<ILoggerFactory>().CreateLogger<RoslynScriptedAlarmEvaluator>()));
+    builder.Services.AddSingleton<IScriptedAlarmEvaluator>(sp => sp.GetRequiredService<RoslynScriptedAlarmEvaluator>());
+
+    builder.Services.AddOptions<LdapOptions>().Bind(builder.Configuration.GetSection("Ldap"));
+    builder.Services.AddSingleton<ILdapAuthService, LdapAuthService>();
+    builder.Services.AddSingleton<IOpcUaUserAuthenticator, LdapOpcUaUserAuthenticator>();
+
+    builder.Services.AddHostedService<OtOpcUaServerHostedService>();
+}
 
 // Akka cluster bootstrap. Role-specific singletons are registered on the AkkaConfigurationBuilder
 // from inside the configurator lambda. AddAkka spins the ActorSystem at host start.
@@ -61,15 +116,25 @@ if (hasAdmin)
     // Auth + AdminUI surface only mounted on admin-role nodes. Driver-only nodes have no UI.
     builder.Services.AddOtOpcUaAuth(builder.Configuration);
     builder.Services.AddAdminUI();
+    // Flow AuthenticationState through cascading parameters so <AuthorizeView/> works
+    // inside interactive components (NavSidebar's session block).
+    builder.Services.AddCascadingAuthenticationState();
     builder.Services.AddSignalR();
     builder.Services.AddOtOpcUaAdminClients();
 }
 
 builder.Services.AddOtOpcUaHealth();
+builder.Services.AddOtOpcUaObservability();
 
 var app = builder.Build();
 app.UseSerilogRequestLogging();
 
+// Razor class library static assets (_content/<libname>/...) are served via endpoint
+// routing, NOT the UseStaticFiles middleware — so we MUST mark the static-asset
+// endpoints AllowAnonymous, otherwise the AddOtOpcUaAuth fallback RequireAuthenticatedUser
+// policy 401s every CSS/JS request and the login page renders unstyled.
+app.MapStaticAssets().AllowAnonymous();
+
 if (hasAdmin)
 {
     app.UseAuthentication();
@@ -81,6 +146,7 @@ if (hasAdmin)
 }
 
 app.MapOtOpcUaHealth();
+app.MapOtOpcUaMetrics();
 
 Log.Information("OtOpcUa.Host starting with roles=[{Roles}] (admin={HasAdmin}, driver={HasDriver})",
     string.Join(",", roles), hasAdmin, hasDriver);

src/Server/ZB.MOM.WW.OtOpcUa.Host/ZB.MOM.WW.OtOpcUa.Host.csproj

@@ -5,6 +5,12 @@
         <AssemblyName>OtOpcUa.Host</AssemblyName>
         <UserSecretsId>zb-mom-ww-otopcua-host</UserSecretsId>
         <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+        <!-- Microsoft.CodeAnalysis.CSharp.Scripting (4.12.0, pulled in via Core.Scripting for F8b
+             user-script compilation) requires CodeAnalysis.Common 4.12.0 exactly, but ASP.NET
+             Core's transitive Microsoft.CodeAnalysis.CSharp 5.0.0 wins resolution. Suppress
+             NU1608 — the surface we use from Scripting (ScriptEvaluator + RoslynScriptHost) is
+             stable across the version drift; verified by Core.Scripting.Tests. -->
+        <NoWarn>$(NoWarn);NU1608</NoWarn>
     </PropertyGroup>
 
     <ItemGroup>
@@ -15,12 +21,18 @@
             <PrivateAssets>all</PrivateAssets>
             <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
         </PackageReference>
+        <PackageReference Include="OpenTelemetry.Extensions.Hosting"/>
+        <PackageReference Include="OpenTelemetry.Exporter.Prometheus.AspNetCore"/>
     </ItemGroup>
 
     <ItemGroup>
         <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Commons\ZB.MOM.WW.OtOpcUa.Commons.csproj"/>
         <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Cluster\ZB.MOM.WW.OtOpcUa.Cluster.csproj"/>
         <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Configuration\ZB.MOM.WW.OtOpcUa.Configuration.csproj"/>
+        <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Core\ZB.MOM.WW.OtOpcUa.Core.csproj"/>
+        <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Core.Scripting\ZB.MOM.WW.OtOpcUa.Core.Scripting.csproj"/>
+        <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Core.VirtualTags\ZB.MOM.WW.OtOpcUa.Core.VirtualTags.csproj"/>
+        <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms\ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms.csproj"/>
         <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Security\ZB.MOM.WW.OtOpcUa.Security.csproj"/>
         <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.ControlPlane\ZB.MOM.WW.OtOpcUa.ControlPlane.csproj"/>
         <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Runtime\ZB.MOM.WW.OtOpcUa.Runtime.csproj"/>
@@ -28,6 +40,22 @@
         <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.AdminUI\ZB.MOM.WW.OtOpcUa.AdminUI.csproj"/>
     </ItemGroup>
 
+    <!-- Cross-platform driver assemblies. Each Register(registry, loggerFactory) extension is
+         called from DriverFactoryBootstrap on driver-role nodes; the F7 seam (IDriverFactory)
+         then exposes the registry to DriverHostActor. Galaxy is net10 because it talks gRPC to
+         the out-of-process mxaccessgw worker — the COM-bound net48 piece is over there.
+         Historian.Wonderware (the net48 COM-bridge driver) is intentionally excluded; the
+         net10 .Client gRPC wrapper is what production binds when the historian role is needed. -->
+    <ItemGroup>
+        <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.AbCip\ZB.MOM.WW.OtOpcUa.Driver.AbCip.csproj"/>
+        <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.AbLegacy\ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.csproj"/>
+        <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.FOCAS\ZB.MOM.WW.OtOpcUa.Driver.FOCAS.csproj"/>
+        <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.Galaxy\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.csproj"/>
+        <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.Modbus\ZB.MOM.WW.OtOpcUa.Driver.Modbus.csproj"/>
+        <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.S7\ZB.MOM.WW.OtOpcUa.Driver.S7.csproj"/>
+        <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.TwinCAT\ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.csproj"/>
+    </ItemGroup>
+
     <ItemGroup>
         <!-- OpenTelemetry.Api transitively via Akka; Opc.Ua.Core transitively via OpcUaServer. -->
         <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-g94r-2vxg-569j"/>

src/Server/ZB.MOM.WW.OtOpcUa.Host/appsettings.admin-driver.json

@@ -0,0 +1,17 @@
+{
+  "Serilog": {
+    "MinimumLevel": {
+      "Default": "Information",
+      "Override": {
+        "Microsoft.AspNetCore": "Warning",
+        "Opc.Ua": "Information",
+        "Akka": "Information"
+      }
+    }
+  },
+  "Security": {
+    "Ldap": {
+      "DevStubMode": false
+    }
+  }
+}

src/Server/ZB.MOM.WW.OtOpcUa.Host/appsettings.admin.json

@@ -0,0 +1,16 @@
+{
+  "Serilog": {
+    "MinimumLevel": {
+      "Default": "Information",
+      "Override": {
+        "Microsoft.AspNetCore": "Warning",
+        "Akka": "Information"
+      }
+    }
+  },
+  "Security": {
+    "Ldap": {
+      "DevStubMode": false
+    }
+  }
+}

src/Server/ZB.MOM.WW.OtOpcUa.Host/appsettings.driver.json

@@ -0,0 +1,16 @@
+{
+  "Serilog": {
+    "MinimumLevel": {
+      "Default": "Information",
+      "Override": {
+        "Opc.Ua": "Debug",
+        "Akka": "Information"
+      }
+    }
+  },
+  "Security": {
+    "Ldap": {
+      "DevStubMode": false
+    }
+  }
+}

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OpcUaApplicationHost.cs

@@ -2,9 +2,26 @@ using Microsoft.Extensions.Logging;
 using Opc.Ua;
 using Opc.Ua.Configuration;
 using Opc.Ua.Server;
+using ZB.MOM.WW.OtOpcUa.OpcUaServer.Security;
 
 namespace ZB.MOM.WW.OtOpcUa.OpcUaServer;
 
+/// <summary>
+/// Transport-security profile served by the OPC UA endpoint. F13b ships the three baseline
+/// profiles defined by docs/security.md; the remaining Aes128/Aes256 variants can be added
+/// later by extending <see cref="OpcUaSecurityProfile.PolicyUri"/>+<see cref="OpcUaSecurityProfile.Mode"/>
+/// — the wiring in <c>BuildConfigurationAsync</c> is profile-agnostic.
+/// </summary>
+public enum OpcUaSecurityProfile
+{
+    /// <summary>No signing or encryption. Dev / isolated networks only.</summary>
+    None,
+    /// <summary>Basic256Sha256 + Sign. Messages signed, payload visible on the wire.</summary>
+    Basic256Sha256Sign,
+    /// <summary>Basic256Sha256 + SignAndEncrypt. Full transport protection.</summary>
+    Basic256Sha256SignAndEncrypt,
+}
+
 public sealed class OpcUaApplicationHostOptions
 {
     public string ApplicationName { get; set; } = "OtOpcUa";
@@ -26,6 +43,35 @@ public sealed class OpcUaApplicationHostOptions
     /// to "pki" (relative to the host's working directory) to keep dev flows identical to v1.
     /// </summary>
     public string PkiStoreRoot { get; set; } = "pki";
+
+    /// <summary>
+    /// Transport-security profiles exposed by the server. The SDK publishes one endpoint
+    /// descriptor per profile and clients choose at session open. Default = all three
+    /// baseline profiles (None + Basic256Sha256 in both modes); production deployments
+    /// typically drop None.
+    /// </summary>
+    public IList<OpcUaSecurityProfile> EnabledSecurityProfiles { get; set; } = new List<OpcUaSecurityProfile>
+    {
+        OpcUaSecurityProfile.None,
+        OpcUaSecurityProfile.Basic256Sha256Sign,
+        OpcUaSecurityProfile.Basic256Sha256SignAndEncrypt,
+    };
+
+    /// <summary>
+    /// When true, unknown client certificates are auto-added to the trusted store on first
+    /// connection. Convenient for dev; should be false in production (operators promote via
+    /// the Admin UI). Has no effect on <c>None</c> endpoints, which don't exchange certs.
+    /// </summary>
+    public bool AutoAcceptUntrustedClientCertificates { get; set; }
+
+    /// <summary>
+    /// Peer server URIs published in <c>Server.ServerArray</c> after start, in addition to
+    /// the local <see cref="ApplicationUri"/>. Empty by default — set this on warm-redundancy
+    /// deployments so OPC UA clients can discover the partner endpoint via the standard
+    /// Server.ServerArray property (NodeId i=2254). Order does not matter; the local URI
+    /// is always element 0.
+    /// </summary>
+    public IList<string> PeerApplicationUris { get; set; } = new List<string>();
 }
 
 /// <summary>
@@ -41,16 +87,20 @@ public sealed class OpcUaApplicationHostOptions
 public sealed class OpcUaApplicationHost : IAsyncDisposable
 {
     private readonly OpcUaApplicationHostOptions _options;
+    private readonly IOpcUaUserAuthenticator _userAuthenticator;
     private readonly ILogger<OpcUaApplicationHost> _logger;
     private ApplicationInstance? _application;
     private StandardServer? _server;
+    private ImpersonateEventHandler? _impersonateHandler;
 
     public OpcUaApplicationHost(
         OpcUaApplicationHostOptions options,
-        ILogger<OpcUaApplicationHost> logger)
+        ILogger<OpcUaApplicationHost> logger,
+        IOpcUaUserAuthenticator? userAuthenticator = null)
     {
         _options = options;
         _logger = logger;
+        _userAuthenticator = userAuthenticator ?? NullOpcUaUserAuthenticator.Instance;
     }
 
     public ApplicationInstance? ApplicationInstance => _application;
@@ -70,10 +120,154 @@ public sealed class OpcUaApplicationHost : IAsyncDisposable
         await EnsureApplicationCertificateAsync(cancellationToken).ConfigureAwait(false);
         await _application.Start(server).ConfigureAwait(false);
 
+        AttachUserAuthenticator();
+        PopulateServerArray();
+
         _logger.LogInformation("OPC UA server started on opc.tcp://{Host}:{Port}",
             _options.PublicHostname, _options.OpcUaPort);
     }
 
+    /// <summary>
+    /// Subscribes to <see cref="SessionManager.ImpersonateUser"/> after the SDK has its
+    /// <c>SessionManager</c> ready (only after <c>_application.Start</c>). Anonymous tokens
+    /// pass through; UserName tokens hit <see cref="IOpcUaUserAuthenticator"/> and, on
+    /// success, attach a <see cref="UserIdentity"/> with the mapped role-set to the session
+    /// so downstream ACL checks can read it via <c>OperationContext.UserIdentity</c>.
+    ///
+    /// The SDK calls <c>ImpersonateUser</c> synchronously off the session-activation
+    /// thread, so the authenticator's async work is run via <c>GetAwaiter().GetResult()</c>.
+    /// LDAP binds typically complete in &lt;100 ms; if a backing store ever gets that slow
+    /// it should not block the OPC UA stack — callers must enforce their own timeouts inside
+    /// <see cref="IOpcUaUserAuthenticator.AuthenticateUserNameAsync"/>.
+    /// </summary>
+    private void AttachUserAuthenticator()
+    {
+        var sessionManager = _server?.CurrentInstance?.SessionManager;
+        if (sessionManager is null)
+        {
+            _logger.LogWarning("OpcUaApplicationHost: SessionManager unavailable after Start; UserName auth disabled");
+            return;
+        }
+
+        _impersonateHandler = OnImpersonateUser;
+        sessionManager.ImpersonateUser += _impersonateHandler;
+    }
+
+    /// <summary>
+    /// Publishes <see cref="OpcUaApplicationHostOptions.PeerApplicationUris"/> via the OPC UA
+    /// standard <c>Server.ServerArray</c> property (NodeId i=2254) so warm-redundancy clients
+    /// can discover the partner endpoint.
+    ///
+    /// The wire-served value of <c>Server.ServerArray</c> comes from
+    /// <see cref="IServerInternal.ServerUris"/> (an <see cref="Opc.Ua.StringTable"/>) via the
+    /// SDK's <c>OnReadServerArray</c> callback — writes to
+    /// <c>ServerObject.ServerArray.Value</c> are NOT what clients read. The SDK auto-populates
+    /// slot 0 with the local <c>ApplicationUri</c> on <c>ApplicationInstance.Start</c>; we
+    /// append the configured peers at slots 1, 2, … here.
+    ///
+    /// The address-space property is also mirrored for in-process readers (the unit-test
+    /// observation seam) and as a defensive belt-and-braces measure.
+    /// </summary>
+    private void PopulateServerArray()
+    {
+        var internalData = _server?.CurrentInstance;
+        if (internalData is null) return;
+
+        // Wire path: append peers to IServerInternal.ServerUris — this is what
+        // OnReadServerArray serves to remote clients reading VariableIds.Server_ServerArray.
+        var serverUris = internalData.ServerUris;
+        var existing = new HashSet<string>(StringComparer.Ordinal);
+        for (uint i = 0; i < (uint)serverUris.Count; i++)
+        {
+            var existingUri = serverUris.GetString(i);
+            if (existingUri is not null) existing.Add(existingUri);
+        }
+
+        foreach (var peer in _options.PeerApplicationUris)
+        {
+            if (string.IsNullOrWhiteSpace(peer)) continue;
+            if (existing.Contains(peer)) continue;
+            serverUris.Append(peer);
+            existing.Add(peer);
+        }
+
+        // In-process mirror: ServerObject.ServerArray.Value is consulted by some tests and
+        // tooling that read the SDK's address-space model directly rather than going through
+        // a session. Harmless on the wire (the SDK ignores it) but useful in-VM.
+        var serverObject = internalData.ServerObject;
+        if (serverObject is not null)
+        {
+            var uris = new List<string> { _options.ApplicationUri };
+            foreach (var peer in _options.PeerApplicationUris)
+            {
+                if (!string.IsNullOrWhiteSpace(peer) && !uris.Contains(peer))
+                    uris.Add(peer);
+            }
+            serverObject.ServerArray.Value = uris.ToArray();
+        }
+    }
+
+    private void OnImpersonateUser(Session session, ImpersonateEventArgs args) =>
+        HandleImpersonation(_userAuthenticator, args, _logger);
+
+    /// <summary>
+    /// Pure(-ish) impersonation handler: extracted so unit tests can drive it without booting
+    /// the full SDK. Side-effects are confined to mutating <see cref="ImpersonateEventArgs"/>
+    /// and logging.
+    /// </summary>
+    internal static void HandleImpersonation(
+        IOpcUaUserAuthenticator authenticator,
+        ImpersonateEventArgs args,
+        ILogger logger)
+    {
+        if (args.NewIdentity is not UserNameIdentityToken token)
+        {
+            // Anonymous + X509 tokens — let the SDK's default validation stand.
+            return;
+        }
+
+        string password;
+        try
+        {
+            password = token.DecryptedPassword ?? string.Empty;
+        }
+        catch (Exception ex)
+        {
+            logger.LogWarning(ex, "OpcUaApplicationHost: failed to decrypt UserName token");
+            args.IdentityValidationError = new ServiceResult(StatusCodes.BadIdentityTokenRejected,
+                "UserName token decryption failed");
+            return;
+        }
+
+        OpcUaUserAuthResult result;
+        try
+        {
+            result = authenticator
+                .AuthenticateUserNameAsync(token.UserName ?? string.Empty, password, CancellationToken.None)
+                .GetAwaiter().GetResult();
+        }
+        catch (Exception ex)
+        {
+            logger.LogError(ex, "OpcUaApplicationHost: UserName authenticator threw for {User}", token.UserName);
+            args.IdentityValidationError = new ServiceResult(StatusCodes.BadIdentityTokenRejected,
+                "Authentication failed");
+            return;
+        }
+
+        if (!result.Success)
+        {
+            logger.LogInformation("OpcUaApplicationHost: UserName auth denied for {User}: {Error}",
+                token.UserName, result.Error);
+            args.IdentityValidationError = new ServiceResult(StatusCodes.BadIdentityTokenRejected,
+                result.Error ?? "Invalid credentials");
+            return;
+        }
+
+        args.Identity = new UserIdentity(token);
+        logger.LogInformation("OpcUaApplicationHost: UserName auth granted for {User} ({Roles})",
+            token.UserName, string.Join(",", result.Roles));
+    }
+
     /// <summary>
     /// Guarantees the application instance certificate exists in <c>{PkiStoreRoot}/own</c>.
     /// The SDK auto-creates a self-signed certificate the first time this is called on a fresh
@@ -103,21 +297,30 @@ public sealed class OpcUaApplicationHost : IAsyncDisposable
             return await _application!.LoadApplicationConfiguration(_options.ApplicationConfigPath, silent: true);
         }
 
-        // Minimal defaults — security and certificate stores hardcoded to local files in
-        // the app's working directory. Full security wiring stays in legacy Server until F13.
+        var serverConfig = new ServerConfiguration
+        {
+            BaseAddresses = { $"opc.tcp://{_options.PublicHostname}:{_options.OpcUaPort}/OtOpcUa" },
+            MinRequestThreadCount = 5,
+            MaxRequestThreadCount = 100,
+            MaxQueuedRequestCount = 200,
+        };
+
+        foreach (var policy in BuildSecurityPolicies(_options.EnabledSecurityProfiles))
+        {
+            serverConfig.SecurityPolicies.Add(policy);
+        }
+        foreach (var token in BuildUserTokenPolicies())
+        {
+            serverConfig.UserTokenPolicies.Add(token);
+        }
+
         var config = new ApplicationConfiguration
         {
             ApplicationName = _options.ApplicationName,
             ApplicationUri = _options.ApplicationUri,
             ProductUri = _options.ProductUri,
             ApplicationType = ApplicationType.Server,
-            ServerConfiguration = new ServerConfiguration
-            {
-                BaseAddresses = { $"opc.tcp://{_options.PublicHostname}:{_options.OpcUaPort}/OtOpcUa" },
-                MinRequestThreadCount = 5,
-                MaxRequestThreadCount = 100,
-                MaxQueuedRequestCount = 200,
-            },
+            ServerConfiguration = serverConfig,
             SecurityConfiguration = new SecurityConfiguration
             {
                 ApplicationCertificate = new CertificateIdentifier
@@ -129,7 +332,7 @@ public sealed class OpcUaApplicationHost : IAsyncDisposable
                 TrustedIssuerCertificates = new CertificateTrustList { StoreType = "Directory", StorePath = Path.Combine(_options.PkiStoreRoot, "issuer") },
                 TrustedPeerCertificates = new CertificateTrustList { StoreType = "Directory", StorePath = Path.Combine(_options.PkiStoreRoot, "trusted") },
                 RejectedCertificateStore = new CertificateTrustList { StoreType = "Directory", StorePath = Path.Combine(_options.PkiStoreRoot, "rejected") },
-                AutoAcceptUntrustedCertificates = false,
+                AutoAcceptUntrustedCertificates = _options.AutoAcceptUntrustedClientCertificates,
             },
             TransportQuotas = new TransportQuotas(),
             ClientConfiguration = new ClientConfiguration(),
@@ -141,8 +344,80 @@ public sealed class OpcUaApplicationHost : IAsyncDisposable
         return config;
     }
 
+    /// <summary>
+    /// Maps each configured <see cref="OpcUaSecurityProfile"/> to a SDK
+    /// <see cref="ServerSecurityPolicy"/>. Duplicate profiles are silently de-duped because
+    /// the SDK rejects duplicate (policy,mode) pairs at <c>Validate</c> time. Empty input
+    /// falls back to a single None entry so the server doesn't refuse to start with no
+    /// listening endpoints — the misconfiguration is logged and very visible.
+    /// </summary>
+    internal static IEnumerable<ServerSecurityPolicy> BuildSecurityPolicies(IEnumerable<OpcUaSecurityProfile> profiles)
+    {
+        var seen = new HashSet<OpcUaSecurityProfile>();
+        var any = false;
+        foreach (var profile in profiles)
+        {
+            if (!seen.Add(profile)) continue;
+            any = true;
+            yield return profile switch
+            {
+                OpcUaSecurityProfile.None => new ServerSecurityPolicy
+                {
+                    SecurityMode = MessageSecurityMode.None,
+                    SecurityPolicyUri = SecurityPolicies.None,
+                },
+                OpcUaSecurityProfile.Basic256Sha256Sign => new ServerSecurityPolicy
+                {
+                    SecurityMode = MessageSecurityMode.Sign,
+                    SecurityPolicyUri = SecurityPolicies.Basic256Sha256,
+                },
+                OpcUaSecurityProfile.Basic256Sha256SignAndEncrypt => new ServerSecurityPolicy
+                {
+                    SecurityMode = MessageSecurityMode.SignAndEncrypt,
+                    SecurityPolicyUri = SecurityPolicies.Basic256Sha256,
+                },
+                _ => throw new InvalidOperationException($"Unknown OpcUaSecurityProfile: {profile}"),
+            };
+        }
+        if (!any)
+        {
+            yield return new ServerSecurityPolicy
+            {
+                SecurityMode = MessageSecurityMode.None,
+                SecurityPolicyUri = SecurityPolicies.None,
+            };
+        }
+    }
+
+    /// <summary>
+    /// Anonymous + UserName token policies. UserName tokens are always SDK-encrypted with
+    /// the server certificate (see docs/security.md "UserName token encryption") so the
+    /// policy works on None endpoints too. F13c will plug a real LDAP-bound validator into
+    /// <c>StandardServer.SessionManager.ImpersonateUser</c>.
+    /// </summary>
+    internal static IEnumerable<UserTokenPolicy> BuildUserTokenPolicies()
+    {
+        yield return new UserTokenPolicy(UserTokenType.Anonymous)
+        {
+            PolicyId = "anonymous",
+            SecurityPolicyUri = SecurityPolicies.None,
+        };
+        yield return new UserTokenPolicy(UserTokenType.UserName)
+        {
+            PolicyId = "username_basic256sha256",
+            SecurityPolicyUri = SecurityPolicies.Basic256Sha256,
+        };
+    }
+
     public ValueTask DisposeAsync()
     {
+        if (_impersonateHandler is not null && _server?.CurrentInstance?.SessionManager is { } sessionManager)
+        {
+            try { sessionManager.ImpersonateUser -= _impersonateHandler; }
+            catch (Exception ex) { _logger.LogWarning(ex, "OpcUaApplicationHost: detaching ImpersonateUser threw"); }
+        }
+        _impersonateHandler = null;
+
         try { _application?.Stop(); }
         catch (Exception ex) { _logger.LogWarning(ex, "OpcUaApplicationHost: Stop threw on dispose"); }
         return ValueTask.CompletedTask;

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaNodeManager.cs

@@ -0,0 +1,196 @@
+using System.Collections.Concurrent;
+using Opc.Ua;
+using Opc.Ua.Server;
+using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
+
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer;
+
+/// <summary>
+///     Custom OPC UA <see cref="CustomNodeManager2"/> that owns the writable address space for
+///     the OtOpcUa server. Variable nodes are created lazily on first <see cref="WriteValue"/>
+///     under the manager's namespace; subsequent writes update the existing node's Value +
+///     StatusCode + SourceTimestamp and notify subscribed clients via the standard
+///     <c>ClearChangeMasks</c> path.
+///
+///     This is the F10b production wiring behind the v2 <see cref="IOpcUaAddressSpaceSink"/>
+///     seam — once a <see cref="SdkAddressSpaceSink"/> is bound, OpcUaPublishActor's writes
+///     materialise as real OPC UA Variable updates that clients can browse + subscribe to.
+///
+///     Node-id encoding uses the manager's default namespace + the caller-supplied string id
+///     as the identifier portion (e.g. <c>"ns=2;s=eq-1/temp"</c>). Equipment-folder hierarchy
+///     and OPC UA type metadata still come from the Phase7Applier / EquipmentNodeWalker
+///     integration (F14b, tracked under #85) — this manager treats every id as a flat
+///     <see cref="BaseDataVariableState"/> under the namespace root.
+/// </summary>
+public sealed class OtOpcUaNodeManager : CustomNodeManager2
+{
+    public const string DefaultNamespaceUri = "https://zb.com/otopcua/ns";
+
+    private readonly ConcurrentDictionary<string, BaseDataVariableState> _variables = new(StringComparer.Ordinal);
+    private readonly ConcurrentDictionary<string, FolderState> _folders = new(StringComparer.Ordinal);
+    private FolderState? _root;
+
+    public OtOpcUaNodeManager(IServerInternal server, ApplicationConfiguration configuration)
+        : base(server, configuration, DefaultNamespaceUri)
+    {
+        // SystemContext is initialised by the base ctor.
+    }
+
+    public int VariableCount => _variables.Count;
+    public int FolderCount => _folders.Count;
+
+    /// <summary>
+    ///     Apply a value write from <see cref="IOpcUaAddressSpaceSink.WriteValue"/>. Creates the
+    ///     variable node on first call; subsequent calls update Value + StatusCode +
+    ///     SourceTimestamp and call <c>ClearChangeMasks</c> so subscribed clients see the change.
+    /// </summary>
+    public void WriteValue(string nodeId, object? value, OpcUaQuality quality, DateTime sourceTimestampUtc)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(nodeId);
+        var variable = _variables.GetOrAdd(nodeId, CreateVariable);
+
+        lock (Lock)
+        {
+            variable.Value = value;
+            variable.StatusCode = StatusFromQuality(quality);
+            variable.Timestamp = sourceTimestampUtc;
+            variable.ClearChangeMasks(SystemContext, includeChildren: false);
+        }
+    }
+
+    /// <summary>Apply an alarm-state write. Surfaced as a two-element Variable carrying
+    /// <c>[active, acknowledged]</c> — proper <c>AlarmConditionState</c> + event firing
+    /// comes when the F14b walker integration lands and registers real condition nodes.</summary>
+    public void WriteAlarmState(string alarmNodeId, bool active, bool acknowledged, DateTime sourceTimestampUtc)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(alarmNodeId);
+        var variable = _variables.GetOrAdd(alarmNodeId, CreateVariable);
+
+        lock (Lock)
+        {
+            variable.Value = new[] { active, acknowledged };
+            variable.StatusCode = StatusCodes.Good;
+            variable.Timestamp = sourceTimestampUtc;
+            variable.ClearChangeMasks(SystemContext, includeChildren: false);
+        }
+    }
+
+    /// <summary>
+    ///     Ensure a folder node exists at <paramref name="folderNodeId"/> with the given display
+    ///     name, parented under <paramref name="parentNodeId"/> (or the namespace root when null).
+    ///     #85 — used by <see cref="Phase7Applier"/> to materialise the UNS Area/Line/Equipment
+    ///     folder hierarchy. Idempotent: the second call with the same id returns the cached
+    ///     folder so adding child variables under it still works.
+    /// </summary>
+    public void EnsureFolder(string folderNodeId, string? parentNodeId, string displayName)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(folderNodeId);
+        ArgumentException.ThrowIfNullOrEmpty(displayName);
+
+        if (_folders.ContainsKey(folderNodeId)) return;
+
+        lock (Lock)
+        {
+            if (_folders.ContainsKey(folderNodeId)) return;
+
+            var parent = ResolveParentFolder(parentNodeId);
+            var folder = new FolderState(parent)
+            {
+                NodeId = new NodeId(folderNodeId, NamespaceIndex),
+                BrowseName = new QualifiedName(folderNodeId, NamespaceIndex),
+                DisplayName = displayName,
+                EventNotifier = EventNotifiers.None,
+                TypeDefinitionId = ObjectTypeIds.FolderType,
+                ReferenceTypeId = ReferenceTypeIds.Organizes,
+            };
+            parent.AddChild(folder);
+            AddPredefinedNode(SystemContext, folder);
+            _folders[folderNodeId] = folder;
+        }
+    }
+
+    /// <summary>Clear every registered variable + folder from the address space. Phase7Applier
+    /// calls this when Equipment/Alarm topology changes; the populator then re-adds via
+    /// EnsureFolder + WriteValue on the next pass.</summary>
+    public void RebuildAddressSpace()
+    {
+        lock (Lock)
+        {
+            foreach (var v in _variables.Values)
+            {
+                v.Parent?.RemoveChild(v);
+                PredefinedNodes?.Remove(v.NodeId);
+            }
+            _variables.Clear();
+
+            foreach (var f in _folders.Values)
+            {
+                f.Parent?.RemoveChild(f);
+                PredefinedNodes?.Remove(f.NodeId);
+            }
+            _folders.Clear();
+        }
+    }
+
+    private FolderState ResolveParentFolder(string? parentNodeId)
+    {
+        if (string.IsNullOrEmpty(parentNodeId)) return _root!;
+        return _folders.TryGetValue(parentNodeId, out var existing) ? existing : _root!;
+    }
+
+    /// <inheritdoc />
+    public override void CreateAddressSpace(IDictionary<NodeId, IList<IReference>> externalReferences)
+    {
+        lock (Lock)
+        {
+            base.CreateAddressSpace(externalReferences);
+
+            // Create one root folder under Objects/ for every variable we mint to hang under.
+            _root = new FolderState(null)
+            {
+                NodeId = new NodeId("OtOpcUa", NamespaceIndex),
+                BrowseName = new QualifiedName("OtOpcUa", NamespaceIndex),
+                DisplayName = "OtOpcUa",
+                EventNotifier = EventNotifiers.None,
+                TypeDefinitionId = ObjectTypeIds.FolderType,
+            };
+            _root.AddReference(ReferenceTypeIds.Organizes, isInverse: true, ObjectIds.ObjectsFolder);
+
+            if (!externalReferences.TryGetValue(ObjectIds.ObjectsFolder, out var refs))
+            {
+                refs = new List<IReference>();
+                externalReferences[ObjectIds.ObjectsFolder] = refs;
+            }
+            refs.Add(new NodeStateReference(ReferenceTypeIds.Organizes, isInverse: false, _root.NodeId));
+
+            AddPredefinedNode(SystemContext, _root);
+        }
+    }
+
+    private BaseDataVariableState CreateVariable(string nodeId)
+    {
+        var v = new BaseDataVariableState(_root)
+        {
+            NodeId = new NodeId(nodeId, NamespaceIndex),
+            BrowseName = new QualifiedName(nodeId, NamespaceIndex),
+            DisplayName = nodeId,
+            TypeDefinitionId = VariableTypeIds.BaseDataVariableType,
+            ReferenceTypeId = ReferenceTypeIds.Organizes,
+            DataType = DataTypeIds.BaseDataType,
+            ValueRank = ValueRanks.Scalar,
+            AccessLevel = AccessLevels.CurrentRead,
+            UserAccessLevel = AccessLevels.CurrentRead,
+            Historizing = false,
+        };
+        _root?.AddChild(v);
+        AddPredefinedNode(SystemContext, v);
+        return v;
+    }
+
+    private static StatusCode StatusFromQuality(OpcUaQuality quality) => quality switch
+    {
+        OpcUaQuality.Good => StatusCodes.Good,
+        OpcUaQuality.Uncertain => StatusCodes.Uncertain,
+        _ => StatusCodes.Bad,
+    };
+}

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaSdkServer.cs

@@ -0,0 +1,27 @@
+using Opc.Ua;
+using Opc.Ua.Server;
+
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer;
+
+/// <summary>
+///     <see cref="StandardServer"/> subclass that wires in the v2 <see cref="OtOpcUaNodeManager"/>.
+///     Exposes the live node manager after start so callers (<see cref="OpcUaApplicationHost"/>,
+///     the fused Host's DI binding) can wrap it in a <see cref="SdkAddressSpaceSink"/> and hand
+///     it to <c>OpcUaPublishActor</c>.
+/// </summary>
+public sealed class OtOpcUaSdkServer : StandardServer
+{
+    private OtOpcUaNodeManager? _otOpcUaNodeManager;
+
+    /// <summary>The custom node manager once <c>StartAsync</c> has called
+    /// <see cref="CreateMasterNodeManager"/>. Null until the SDK has bootstrapped.</summary>
+    public OtOpcUaNodeManager? NodeManager => _otOpcUaNodeManager;
+
+    /// <inheritdoc />
+    protected override MasterNodeManager CreateMasterNodeManager(
+        IServerInternal server, ApplicationConfiguration configuration)
+    {
+        _otOpcUaNodeManager = new OtOpcUaNodeManager(server, configuration);
+        return new MasterNodeManager(server, configuration, dynamicNamespaceUri: null, _otOpcUaNodeManager);
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/Phase7Applier.cs

@@ -0,0 +1,146 @@
+using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
+
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer;
+
+/// <summary>
+///     Side-effecting orchestrator over <see cref="Phase7Plan"/>. Drives an
+///     <see cref="IOpcUaAddressSpaceSink"/> to materialise the diff between two
+///     <see cref="Phase7CompositionResult"/> snapshots:
+///
+///     <list type="bullet">
+///         <item>RemovedEquipment / RemovedAlarms — write Bad-quality on every removed
+///             node id then call <c>RebuildAddressSpace</c> at the end so the sink can
+///             actually tear down the OPC UA folders + variables.</item>
+///         <item>AddedEquipment / AddedAlarms — same Rebuild trigger (real SDK NodeManager
+///             will repopulate from the persisted artifact). For now we record the work.</item>
+///         <item>ChangedEquipment / ChangedAlarms — record what changed; the SDK adapter
+///             that lands in F10b will decide between in-place property writes and
+///             tear-down + rebuild.</item>
+///     </list>
+///
+///     This is the side-effecting layer Task 47 deferred to F14. It stays pure-of-SDK so
+///     production binds a real SDK sink, dev/Mac binds <see cref="NullOpcUaAddressSpaceSink"/>,
+///     and tests can capture every call.
+/// </summary>
+public sealed class Phase7Applier
+{
+    private readonly IOpcUaAddressSpaceSink _sink;
+    private readonly ILogger<Phase7Applier> _logger;
+
+    public Phase7Applier(IOpcUaAddressSpaceSink sink, ILogger<Phase7Applier> logger)
+    {
+        ArgumentNullException.ThrowIfNull(sink);
+        ArgumentNullException.ThrowIfNull(logger);
+        _sink = sink;
+        _logger = logger;
+    }
+
+    /// <summary>
+    ///     Apply <paramref name="plan"/> to the sink. Returns a summary of what was applied so
+    ///     callers (OpcUaPublishActor) can correlate the work back to the originating deployment.
+    /// </summary>
+    public Phase7ApplyOutcome Apply(Phase7Plan plan)
+    {
+        ArgumentNullException.ThrowIfNull(plan);
+
+        if (plan.IsEmpty)
+        {
+            _logger.LogDebug("Phase7Applier: plan is empty; skipping sink writes");
+            return new Phase7ApplyOutcome(RemovedNodes: 0, AddedNodes: 0, ChangedNodes: 0, RebuildCalled: false);
+        }
+
+        var ts = DateTime.UtcNow;
+        var removedCount = 0;
+        foreach (var eq in plan.RemovedEquipment)
+        {
+            SafeWriteAlarmState(eq.EquipmentId, active: false, acknowledged: false, ts);
+            removedCount++;
+        }
+        foreach (var alarm in plan.RemovedAlarms)
+        {
+            SafeWriteAlarmState(alarm.ScriptedAlarmId, active: false, acknowledged: false, ts);
+            removedCount++;
+        }
+
+        var changedCount =
+            plan.ChangedEquipment.Count + plan.ChangedDrivers.Count + plan.ChangedAlarms.Count;
+        var addedCount =
+            plan.AddedEquipment.Count + plan.AddedDrivers.Count + plan.AddedAlarms.Count;
+
+        // Any add/remove of Equipment or ScriptedAlarm requires a real address-space rebuild.
+        // Driver-instance changes don't touch the address-space topology directly — they go
+        // through DriverHostActor's spawn-plan in Runtime.
+        var needsRebuild =
+            plan.AddedEquipment.Count > 0 || plan.RemovedEquipment.Count > 0 ||
+            plan.AddedAlarms.Count > 0 || plan.RemovedAlarms.Count > 0;
+
+        if (needsRebuild)
+        {
+            try
+            {
+                _sink.RebuildAddressSpace();
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "Phase7Applier: sink.RebuildAddressSpace threw");
+            }
+        }
+
+        _logger.LogInformation(
+            "Phase7Applier: applied plan (added={Added}, removed={Removed}, changed={Changed}, rebuild={Rebuild})",
+            addedCount, removedCount, changedCount, needsRebuild);
+
+        return new Phase7ApplyOutcome(removedCount, addedCount, changedCount, needsRebuild);
+    }
+
+    /// <summary>
+    ///     #85 — build the UNS Area/Line/Equipment folder hierarchy in the address space from a
+    ///     composition snapshot. Called by <c>OpcUaPublishActor</c> after a rebuild so OPC UA
+    ///     clients browsing the server see proper folder structure instead of flat tag ids.
+    ///     Idempotent: each <c>EnsureFolder</c> call returns the existing folder if already
+    ///     present, so re-applies are cheap.
+    /// </summary>
+    public void MaterialiseHierarchy(Phase7CompositionResult composition)
+    {
+        ArgumentNullException.ThrowIfNull(composition);
+
+        foreach (var area in composition.UnsAreas)
+        {
+            SafeEnsureFolder(area.UnsAreaId, parentNodeId: null, displayName: area.DisplayName);
+        }
+        foreach (var line in composition.UnsLines)
+        {
+            SafeEnsureFolder(line.UnsLineId, parentNodeId: line.UnsAreaId, displayName: line.DisplayName);
+        }
+        foreach (var equipment in composition.EquipmentNodes)
+        {
+            // Equipment with no UnsLineId (legacy / dev rows) hang under the root.
+            var parent = string.IsNullOrWhiteSpace(equipment.UnsLineId) ? null : equipment.UnsLineId;
+            SafeEnsureFolder(equipment.EquipmentId, parentNodeId: parent, displayName: equipment.DisplayName);
+        }
+
+        _logger.LogInformation(
+            "Phase7Applier: hierarchy materialised (areas={Areas}, lines={Lines}, equipment={Equipment})",
+            composition.UnsAreas.Count, composition.UnsLines.Count, composition.EquipmentNodes.Count);
+    }
+
+    private void SafeEnsureFolder(string nodeId, string? parentNodeId, string displayName)
+    {
+        try { _sink.EnsureFolder(nodeId, parentNodeId, displayName); }
+        catch (Exception ex) { _logger.LogWarning(ex, "Phase7Applier: EnsureFolder threw for {Node}", nodeId); }
+    }
+
+    private void SafeWriteAlarmState(string nodeId, bool active, bool acknowledged, DateTime ts)
+    {
+        try { _sink.WriteAlarmState(nodeId, active, acknowledged, ts); }
+        catch (Exception ex) { _logger.LogWarning(ex, "Phase7Applier: WriteAlarmState threw for {Node}", nodeId); }
+    }
+}
+
+/// <summary>Summary of one apply pass. Useful for tests + audit-log entries on the deploy path.</summary>
+public sealed record Phase7ApplyOutcome(
+    int RemovedNodes,
+    int AddedNodes,
+    int ChangedNodes,
+    bool RebuildCalled);

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/Phase7Composer.cs

@@ -2,12 +2,30 @@ using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
 
 namespace ZB.MOM.WW.OtOpcUa.OpcUaServer;
 
-/// <summary>Outcome of <see cref="Phase7Composer.Compose"/> — pure value tuple, no side effects.</summary>
+/// <summary>Outcome of <see cref="Phase7Composer.Compose"/> — pure value tuple, no side effects.
+/// <see cref="UnsAreas"/> + <see cref="UnsLines"/> carry the UNS topology so the applier can
+/// materialise the Area/Line/Equipment folder hierarchy in the address space; equipment carries
+/// its parent line id so the applier knows where to hang each equipment folder.</summary>
 public sealed record Phase7CompositionResult(
+    IReadOnlyList<UnsAreaProjection> UnsAreas,
+    IReadOnlyList<UnsLineProjection> UnsLines,
     IReadOnlyList<EquipmentNode> EquipmentNodes,
     IReadOnlyList<DriverInstancePlan> DriverInstancePlans,
-    IReadOnlyList<ScriptedAlarmPlan> ScriptedAlarmPlans);
+    IReadOnlyList<ScriptedAlarmPlan> ScriptedAlarmPlans)
+{
+    /// <summary>Convenience constructor for tests + earlier callers that don't yet carry UNS topology.</summary>
+    public Phase7CompositionResult(
+        IReadOnlyList<EquipmentNode> equipmentNodes,
+        IReadOnlyList<DriverInstancePlan> driverInstancePlans,
+        IReadOnlyList<ScriptedAlarmPlan> scriptedAlarmPlans)
+        : this(Array.Empty<UnsAreaProjection>(), Array.Empty<UnsLineProjection>(),
+               equipmentNodes, driverInstancePlans, scriptedAlarmPlans)
+    {
+    }
+}
 
+public sealed record UnsAreaProjection(string UnsAreaId, string DisplayName);
+public sealed record UnsLineProjection(string UnsLineId, string UnsAreaId, string DisplayName);
 public sealed record EquipmentNode(string EquipmentId, string DisplayName, string UnsLineId);
 public sealed record DriverInstancePlan(string DriverInstanceId, string DriverType, string ConfigJson);
 public sealed record ScriptedAlarmPlan(string ScriptedAlarmId, string EquipmentId, string PredicateScriptId, string MessageTemplate);
@@ -17,18 +35,38 @@ public sealed record ScriptedAlarmPlan(string ScriptedAlarmId, string EquipmentI
 /// driver-role host needs. Same inputs → same outputs, no logging, no DB writes. The driver-role
 /// startup (Task 53) consumes the result and hands it to the node-manager factory.
 ///
-/// Full migration of the legacy <c>Server.Phase7.Phase7Composer</c> (which mutates a server-side
-/// node cache, emits trace logs, and calls into <c>EquipmentNodeWalker</c>) is tracked as
-/// follow-up F14. This pure version handles the projection step; the side-effecting wiring
-/// stays in the legacy code until F14 lands.
+/// #85 — the composer now carries UNS topology (<see cref="UnsAreaProjection"/> +
+/// <see cref="UnsLineProjection"/>) so <c>Phase7Applier</c> can build the
+/// <c>Area/Line/Equipment</c> folder hierarchy in the SDK's address space. The legacy
+/// <c>EquipmentNodeWalker</c> integration that did this server-side is fully replaced by the
+/// (composer → applier → sink → node manager) chain.
 /// </summary>
 public static class Phase7Composer
 {
+    /// <summary>Convenience overload for legacy callers + tests that don't yet supply UNS topology.</summary>
     public static Phase7CompositionResult Compose(
+        IReadOnlyList<Equipment> equipment,
+        IReadOnlyList<DriverInstance> driverInstances,
+        IReadOnlyList<ScriptedAlarm> scriptedAlarms) =>
+        Compose(Array.Empty<UnsArea>(), Array.Empty<UnsLine>(), equipment, driverInstances, scriptedAlarms);
+
+    public static Phase7CompositionResult Compose(
+        IReadOnlyList<UnsArea> unsAreas,
+        IReadOnlyList<UnsLine> unsLines,
         IReadOnlyList<Equipment> equipment,
         IReadOnlyList<DriverInstance> driverInstances,
         IReadOnlyList<ScriptedAlarm> scriptedAlarms)
     {
+        var areas = unsAreas
+            .OrderBy(a => a.UnsAreaId, StringComparer.Ordinal)
+            .Select(a => new UnsAreaProjection(a.UnsAreaId, a.Name))
+            .ToList();
+
+        var lines = unsLines
+            .OrderBy(l => l.UnsLineId, StringComparer.Ordinal)
+            .Select(l => new UnsLineProjection(l.UnsLineId, l.UnsAreaId, l.Name))
+            .ToList();
+
         var nodes = equipment
             .OrderBy(e => e.EquipmentId, StringComparer.Ordinal)
             .Select(e => new EquipmentNode(e.EquipmentId, e.MachineCode, e.UnsLineId))
@@ -44,6 +82,6 @@ public static class Phase7Composer
             .Select(a => new ScriptedAlarmPlan(a.ScriptedAlarmId, a.EquipmentId, a.PredicateScriptId, a.MessageTemplate))
             .ToList();
 
-        return new Phase7CompositionResult(nodes, plans, alarms);
+        return new Phase7CompositionResult(areas, lines, nodes, plans, alarms);
     }
 }

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/Phase7Plan.cs

@@ -0,0 +1,98 @@
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer;
+
+/// <summary>
+///     Pure diff between two <see cref="Phase7CompositionResult"/> snapshots — the
+///     <c>previous</c> currently-applied composition and the <c>next</c> from a freshly-applied
+///     deployment. Three lists per entity class (Equipment / DriverInstance / ScriptedAlarm)
+///     captured by stable identity: added items are new, removed items have to be torn down,
+///     changed items have the same identity but at least one field differs.
+///
+///     OpcUaPublishActor's <c>RebuildAddressSpace</c> consumes this against a real
+///     <see cref="Commons.OpcUa.IOpcUaAddressSpaceSink"/> binding so re-applies only mutate the
+///     nodes that actually changed — full tear-down + rebuild is reserved for first-boot or
+///     drastic schema flips.
+/// </summary>
+public sealed record Phase7Plan(
+    IReadOnlyList<EquipmentNode> AddedEquipment,
+    IReadOnlyList<EquipmentNode> RemovedEquipment,
+    IReadOnlyList<Phase7Plan.EquipmentDelta> ChangedEquipment,
+    IReadOnlyList<DriverInstancePlan> AddedDrivers,
+    IReadOnlyList<DriverInstancePlan> RemovedDrivers,
+    IReadOnlyList<Phase7Plan.DriverDelta> ChangedDrivers,
+    IReadOnlyList<ScriptedAlarmPlan> AddedAlarms,
+    IReadOnlyList<ScriptedAlarmPlan> RemovedAlarms,
+    IReadOnlyList<Phase7Plan.AlarmDelta> ChangedAlarms)
+{
+    public bool IsEmpty =>
+        AddedEquipment.Count == 0 && RemovedEquipment.Count == 0 && ChangedEquipment.Count == 0 &&
+        AddedDrivers.Count == 0 && RemovedDrivers.Count == 0 && ChangedDrivers.Count == 0 &&
+        AddedAlarms.Count == 0 && RemovedAlarms.Count == 0 && ChangedAlarms.Count == 0;
+
+    public sealed record EquipmentDelta(EquipmentNode Previous, EquipmentNode Current);
+    public sealed record DriverDelta(DriverInstancePlan Previous, DriverInstancePlan Current);
+    public sealed record AlarmDelta(ScriptedAlarmPlan Previous, ScriptedAlarmPlan Current);
+}
+
+public static class Phase7Planner
+{
+    /// <summary>
+    ///     Diff two compositions, emitting Added/Removed/Changed sets per entity class.
+    ///     Identity is the entity's stable id (EquipmentId, DriverInstanceId, ScriptedAlarmId).
+    ///     Element equality on the projection records doubles as the "did this change" check,
+    ///     so any field difference moves an item from "stable" to ChangedX.
+    /// </summary>
+    public static Phase7Plan Compute(Phase7CompositionResult previous, Phase7CompositionResult next)
+    {
+        ArgumentNullException.ThrowIfNull(previous);
+        ArgumentNullException.ThrowIfNull(next);
+
+        var (addedEq, removedEq, changedEq) = DiffById(
+            previous.EquipmentNodes, next.EquipmentNodes,
+            n => n.EquipmentId,
+            (a, b) => new Phase7Plan.EquipmentDelta(a, b));
+
+        var (addedDrv, removedDrv, changedDrv) = DiffById(
+            previous.DriverInstancePlans, next.DriverInstancePlans,
+            d => d.DriverInstanceId,
+            (a, b) => new Phase7Plan.DriverDelta(a, b));
+
+        var (addedAlarm, removedAlarm, changedAlarm) = DiffById(
+            previous.ScriptedAlarmPlans, next.ScriptedAlarmPlans,
+            a => a.ScriptedAlarmId,
+            (a, b) => new Phase7Plan.AlarmDelta(a, b));
+
+        return new Phase7Plan(
+            addedEq, removedEq, changedEq,
+            addedDrv, removedDrv, changedDrv,
+            addedAlarm, removedAlarm, changedAlarm);
+    }
+
+    private static (IReadOnlyList<T> Added, IReadOnlyList<T> Removed, IReadOnlyList<TDelta> Changed)
+        DiffById<T, TDelta>(
+            IReadOnlyList<T> previous,
+            IReadOnlyList<T> next,
+            Func<T, string> identity,
+            Func<T, T, TDelta> deltaFactory) where T : class
+    {
+        var prevById = previous.ToDictionary(identity, StringComparer.Ordinal);
+        var nextById = next.ToDictionary(identity, StringComparer.Ordinal);
+
+        var added = new List<T>();
+        var removed = new List<T>();
+        var changed = new List<TDelta>();
+
+        foreach (var (id, p) in prevById)
+        {
+            if (!nextById.TryGetValue(id, out var n)) { removed.Add(p); continue; }
+            if (!EqualityComparer<T>.Default.Equals(p, n)) changed.Add(deltaFactory(p, n));
+        }
+        foreach (var (id, n) in nextById)
+        {
+            if (!prevById.ContainsKey(id)) added.Add(n);
+        }
+
+        added.Sort((a, b) => string.CompareOrdinal(identity(a), identity(b)));
+        removed.Sort((a, b) => string.CompareOrdinal(identity(a), identity(b)));
+        return (added, removed, changed);
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/SdkAddressSpaceSink.cs

@@ -0,0 +1,31 @@
+using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
+
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer;
+
+/// <summary>
+///     Production <see cref="IOpcUaAddressSpaceSink"/> binding for v2 — bridges
+///     OpcUaPublishActor's writes to the SDK address space owned by
+///     <see cref="OtOpcUaNodeManager"/>. The host wires this in once the StandardServer has
+///     been started (so the node manager exists).
+/// </summary>
+public sealed class SdkAddressSpaceSink : IOpcUaAddressSpaceSink
+{
+    private readonly OtOpcUaNodeManager _nodeManager;
+
+    public SdkAddressSpaceSink(OtOpcUaNodeManager nodeManager)
+    {
+        ArgumentNullException.ThrowIfNull(nodeManager);
+        _nodeManager = nodeManager;
+    }
+
+    public void WriteValue(string nodeId, object? value, OpcUaQuality quality, DateTime sourceTimestampUtc)
+        => _nodeManager.WriteValue(nodeId, value, quality, sourceTimestampUtc);
+
+    public void WriteAlarmState(string alarmNodeId, bool active, bool acknowledged, DateTime sourceTimestampUtc)
+        => _nodeManager.WriteAlarmState(alarmNodeId, active, acknowledged, sourceTimestampUtc);
+
+    public void EnsureFolder(string folderNodeId, string? parentNodeId, string displayName)
+        => _nodeManager.EnsureFolder(folderNodeId, parentNodeId, displayName);
+
+    public void RebuildAddressSpace() => _nodeManager.RebuildAddressSpace();
+}

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/SdkServiceLevelPublisher.cs

@@ -0,0 +1,56 @@
+using Microsoft.Extensions.Logging;
+using Opc.Ua;
+using Opc.Ua.Server;
+using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
+
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer;
+
+/// <summary>
+/// Production <see cref="IServiceLevelPublisher"/> that writes the OPC UA Server object's
+/// <c>ServiceLevel</c> Variable through the SDK. Clients reading
+/// <c>VariableIds.Server_ServiceLevel</c> see the live value updated whenever the redundancy
+/// state changes — that's the standard OPC UA non-transparent-redundancy signal callers use
+/// to pick a primary.
+///
+/// Uses <see cref="IServerInternal.ServerObject"/> (a <see cref="ServerObjectState"/>) and
+/// its <see cref="ServerObjectState.ServiceLevel"/> child variable, which the SDK populates
+/// automatically during <see cref="DiagnosticsNodeManager"/> initialization. Writes are
+/// guarded by <see cref="IServerInternal.DiagnosticsLock"/> so concurrent diagnostics scans
+/// from the SDK don't fight with our update.
+/// </summary>
+public sealed class SdkServiceLevelPublisher : IServiceLevelPublisher
+{
+    private readonly IServerInternal _serverInternal;
+    private readonly ILogger<SdkServiceLevelPublisher> _logger;
+
+    public SdkServiceLevelPublisher(IServerInternal serverInternal, ILogger<SdkServiceLevelPublisher> logger)
+    {
+        _serverInternal = serverInternal;
+        _logger = logger;
+    }
+
+    public void Publish(byte serviceLevel)
+    {
+        var node = _serverInternal.ServerObject?.ServiceLevel;
+        if (node is null)
+        {
+            _logger.LogWarning("SdkServiceLevelPublisher: ServerObject.ServiceLevel unavailable; skipping write");
+            return;
+        }
+
+        try
+        {
+            lock (_serverInternal.DiagnosticsLock)
+            {
+                node.Value = serviceLevel;
+                node.Timestamp = DateTime.UtcNow;
+                node.StatusCode = StatusCodes.Good;
+                node.ClearChangeMasks(_serverInternal.DefaultSystemContext, includeChildren: false);
+            }
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "SdkServiceLevelPublisher: write to Server.ServiceLevel threw");
+        }
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/Security/IOpcUaUserAuthenticator.cs

@@ -0,0 +1,49 @@
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer.Security;
+
+/// <summary>
+/// Validates OPC UA UserName tokens. The SDK already decrypts the token (using the server
+/// application cert) and hands the cleartext username + password to this seam. Implementations
+/// decide whether the credentials are valid and what roles to attach for downstream ACL checks.
+///
+/// Production implementation lives in the Host project (wraps <c>ILdapAuthService</c>); the
+/// <see cref="NullOpcUaUserAuthenticator"/> default rejects every attempt so misconfigured
+/// dev nodes don't silently accept credentials.
+/// </summary>
+public interface IOpcUaUserAuthenticator
+{
+    /// <summary>
+    /// Resolves cleartext UserName credentials against the configured backing store. Must not
+    /// throw — callers turn results into <c>ImpersonateEventArgs.IdentityValidationError</c>
+    /// reject codes, and a thrown exception escapes into the OPC UA SDK's session-activation
+    /// path where it surfaces as a generic <c>BadInternalError</c>.
+    /// </summary>
+    Task<OpcUaUserAuthResult> AuthenticateUserNameAsync(string username, string password, CancellationToken ct);
+}
+
+/// <summary>Outcome of a UserName authentication attempt. <see cref="Roles"/> populates the session identity's role set.</summary>
+public sealed record OpcUaUserAuthResult(
+    bool Success,
+    string? DisplayName,
+    IReadOnlyList<string> Roles,
+    string? Error)
+{
+    public static OpcUaUserAuthResult Allow(string displayName, IReadOnlyList<string> roles) =>
+        new(true, displayName, roles, null);
+
+    public static OpcUaUserAuthResult Deny(string error) =>
+        new(false, null, Array.Empty<string>(), error);
+}
+
+/// <summary>
+/// Default deny-all authenticator. Wired by <c>OpcUaApplicationHost</c> when no production
+/// authenticator is registered in DI — keeps the server safe-by-default rather than accepting
+/// arbitrary UserName credentials. Production Host DI overrides this with the LDAP adapter.
+/// </summary>
+public sealed class NullOpcUaUserAuthenticator : IOpcUaUserAuthenticator
+{
+    public static readonly NullOpcUaUserAuthenticator Instance = new();
+    private NullOpcUaUserAuthenticator() { }
+
+    public Task<OpcUaUserAuthResult> AuthenticateUserNameAsync(string username, string password, CancellationToken ct) =>
+        Task.FromResult(OpcUaUserAuthResult.Deny("No UserName authenticator is configured on this server."));
+}

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/ZB.MOM.WW.OtOpcUa.OpcUaServer.csproj

@@ -19,6 +19,10 @@
         <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Configuration\ZB.MOM.WW.OtOpcUa.Configuration.csproj"/>
     </ItemGroup>
 
+    <ItemGroup>
+        <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests"/>
+    </ItemGroup>
+
     <ItemGroup>
         <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-37gx-xxp4-5rgx"/>
         <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-w3x6-4m5h-cxqf"/>

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DeploymentArtifact.cs

@@ -0,0 +1,192 @@
+using System.Text.Json;
+using ZB.MOM.WW.OtOpcUa.OpcUaServer;
+
+namespace ZB.MOM.WW.OtOpcUa.Runtime.Drivers;
+
+/// <summary>
+///     Minimal driver-side view of the deployment artifact emitted by
+///     <c>ConfigComposer.SnapshotAndFlattenAsync</c>. The artifact JSON is the full snapshot —
+///     for driver spawning we only need the <c>DriverInstances</c> array. Reading just the
+///     subset keeps allocations cheap on every deploy.
+/// </summary>
+public sealed record DriverInstanceSpec(
+    Guid DriverInstanceRowId,
+    string DriverInstanceId,
+    string Name,
+    string DriverType,
+    bool Enabled,
+    string DriverConfig);
+
+public static class DeploymentArtifact
+{
+    private static readonly JsonSerializerOptions JsonOptions = new()
+    {
+        PropertyNameCaseInsensitive = true,
+    };
+
+    /// <summary>
+    ///     Parse a deployment artifact blob into the list of driver-instance specs to spawn.
+    ///     Empty / malformed blobs return an empty list — callers log + treat as "no drivers".
+    /// </summary>
+    public static IReadOnlyList<DriverInstanceSpec> ParseDriverInstances(ReadOnlySpan<byte> blob)
+    {
+        if (blob.IsEmpty) return Array.Empty<DriverInstanceSpec>();
+
+        try
+        {
+            using var doc = JsonDocument.Parse(blob.ToArray());
+            if (!doc.RootElement.TryGetProperty("DriverInstances", out var arr)
+                || arr.ValueKind != JsonValueKind.Array)
+            {
+                return Array.Empty<DriverInstanceSpec>();
+            }
+
+            var result = new List<DriverInstanceSpec>(arr.GetArrayLength());
+            foreach (var el in arr.EnumerateArray())
+            {
+                if (el.ValueKind != JsonValueKind.Object) continue;
+                var spec = TryReadSpec(el);
+                if (spec is not null) result.Add(spec);
+            }
+            return result;
+        }
+        catch (JsonException)
+        {
+            return Array.Empty<DriverInstanceSpec>();
+        }
+    }
+
+    private static DriverInstanceSpec? TryReadSpec(JsonElement el)
+    {
+        var rowId = el.TryGetProperty("DriverInstanceRowId", out var rowEl)
+            && rowEl.TryGetGuid(out var rid) ? rid : Guid.Empty;
+        var id = el.TryGetProperty("DriverInstanceId", out var idEl) ? idEl.GetString() : null;
+        var name = el.TryGetProperty("Name", out var nameEl) ? nameEl.GetString() : null;
+        var type = el.TryGetProperty("DriverType", out var typeEl) ? typeEl.GetString() : null;
+        var enabled = !el.TryGetProperty("Enabled", out var enEl) || enEl.GetBoolean();
+        var config = el.TryGetProperty("DriverConfig", out var cfgEl) ? cfgEl.GetString() : null;
+
+        if (string.IsNullOrWhiteSpace(id) || string.IsNullOrWhiteSpace(type)) return null;
+
+        return new DriverInstanceSpec(
+            DriverInstanceRowId: rowId,
+            DriverInstanceId: id!,
+            Name: name ?? id!,
+            DriverType: type!,
+            Enabled: enabled,
+            DriverConfig: config ?? "{}");
+    }
+
+    /// <summary>
+    ///     Parse the artifact into the projected <see cref="Phase7CompositionResult"/> used by
+    ///     <c>Phase7Planner</c> + <c>Phase7Applier</c>. Returns an empty composition for empty/
+    ///     malformed blobs so callers can treat parse failure as a no-op deploy.
+    ///
+    ///     The artifact JSON is produced by <c>ConfigComposer.SnapshotAndFlattenAsync</c> in the
+    ///     ControlPlane — its Pascal-case property names match the EF entities. We only need a
+    ///     subset of fields per entity class to drive the address-space rebuild on driver-role
+    ///     nodes.
+    /// </summary>
+    public static Phase7CompositionResult ParseComposition(ReadOnlySpan<byte> blob)
+    {
+        if (blob.IsEmpty) return Empty();
+
+        try
+        {
+            using var doc = JsonDocument.Parse(blob.ToArray());
+            var root = doc.RootElement;
+
+            var areas = ReadArray(root, "UnsAreas", ReadAreaProjection);
+            var lines = ReadArray(root, "UnsLines", ReadLineProjection);
+            var equipment = ReadArray(root, "Equipment", ReadEquipmentNode);
+            var drivers = ReadArray(root, "DriverInstances", ReadDriverPlan);
+            var alarms = ReadArray(root, "ScriptedAlarms", ReadAlarmPlan);
+
+            return new Phase7CompositionResult(areas, lines, equipment, drivers, alarms);
+        }
+        catch (JsonException)
+        {
+            return Empty();
+        }
+    }
+
+    private static Phase7CompositionResult Empty() => new(
+        Array.Empty<UnsAreaProjection>(),
+        Array.Empty<UnsLineProjection>(),
+        Array.Empty<EquipmentNode>(),
+        Array.Empty<DriverInstancePlan>(),
+        Array.Empty<ScriptedAlarmPlan>());
+
+    private static IReadOnlyList<T> ReadArray<T>(JsonElement root, string propertyName, Func<JsonElement, T?> reader)
+        where T : class
+    {
+        if (!root.TryGetProperty(propertyName, out var arr) || arr.ValueKind != JsonValueKind.Array)
+            return Array.Empty<T>();
+
+        var result = new List<T>(arr.GetArrayLength());
+        foreach (var el in arr.EnumerateArray())
+        {
+            if (el.ValueKind != JsonValueKind.Object) continue;
+            var item = reader(el);
+            if (item is not null) result.Add(item);
+        }
+        // Match Phase7Composer's natural-key sort so plan diffs are deterministic across
+        // artifact-decode + composer-compose passes.
+        return result.OrderBy(IdentityOf, StringComparer.Ordinal).ToList();
+    }
+
+    private static string IdentityOf<T>(T item) where T : class => item switch
+    {
+        UnsAreaProjection a => a.UnsAreaId,
+        UnsLineProjection l => l.UnsLineId,
+        EquipmentNode e => e.EquipmentId,
+        DriverInstancePlan d => d.DriverInstanceId,
+        ScriptedAlarmPlan a => a.ScriptedAlarmId,
+        _ => string.Empty,
+    };
+
+    private static UnsAreaProjection? ReadAreaProjection(JsonElement el)
+    {
+        var id = el.TryGetProperty("UnsAreaId", out var idEl) ? idEl.GetString() : null;
+        var name = el.TryGetProperty("Name", out var nameEl) ? nameEl.GetString() : null;
+        if (string.IsNullOrWhiteSpace(id)) return null;
+        return new UnsAreaProjection(id!, name ?? id!);
+    }
+
+    private static UnsLineProjection? ReadLineProjection(JsonElement el)
+    {
+        var id = el.TryGetProperty("UnsLineId", out var idEl) ? idEl.GetString() : null;
+        var areaId = el.TryGetProperty("UnsAreaId", out var areaEl) ? areaEl.GetString() : null;
+        var name = el.TryGetProperty("Name", out var nameEl) ? nameEl.GetString() : null;
+        if (string.IsNullOrWhiteSpace(id) || string.IsNullOrWhiteSpace(areaId)) return null;
+        return new UnsLineProjection(id!, areaId!, name ?? id!);
+    }
+
+    private static EquipmentNode? ReadEquipmentNode(JsonElement el)
+    {
+        var id = el.TryGetProperty("EquipmentId", out var idEl) ? idEl.GetString() : null;
+        var displayName = el.TryGetProperty("MachineCode", out var mcEl) ? mcEl.GetString() : null;
+        var lineId = el.TryGetProperty("UnsLineId", out var lineEl) ? lineEl.GetString() : null;
+        if (string.IsNullOrWhiteSpace(id)) return null;
+        return new EquipmentNode(id!, displayName ?? id!, lineId ?? string.Empty);
+    }
+
+    private static DriverInstancePlan? ReadDriverPlan(JsonElement el)
+    {
+        var id = el.TryGetProperty("DriverInstanceId", out var idEl) ? idEl.GetString() : null;
+        var type = el.TryGetProperty("DriverType", out var typeEl) ? typeEl.GetString() : null;
+        var config = el.TryGetProperty("DriverConfig", out var cfgEl) ? cfgEl.GetString() : null;
+        if (string.IsNullOrWhiteSpace(id) || string.IsNullOrWhiteSpace(type)) return null;
+        return new DriverInstancePlan(id!, type!, config ?? "{}");
+    }
+
+    private static ScriptedAlarmPlan? ReadAlarmPlan(JsonElement el)
+    {
+        var id = el.TryGetProperty("ScriptedAlarmId", out var idEl) ? idEl.GetString() : null;
+        var equipmentId = el.TryGetProperty("EquipmentId", out var eqEl) ? eqEl.GetString() : null;
+        var script = el.TryGetProperty("PredicateScriptId", out var scEl) ? scEl.GetString() : null;
+        var template = el.TryGetProperty("MessageTemplate", out var tmEl) ? tmEl.GetString() : null;
+        if (string.IsNullOrWhiteSpace(id)) return null;
+        return new ScriptedAlarmPlan(id!, equipmentId ?? string.Empty, script ?? string.Empty, template ?? string.Empty);
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DriverHostActor.cs

@@ -1,3 +1,4 @@
+using System.Diagnostics;
 using Akka.Actor;
 using Akka.Cluster.Tools.PublishSubscribe;
 using Akka.Event;
@@ -5,10 +6,12 @@ using Microsoft.EntityFrameworkCore;
 using ZB.MOM.WW.OtOpcUa.Commons.Interfaces;
 using ZB.MOM.WW.OtOpcUa.Commons.Messages.Deploy;
 using ZB.MOM.WW.OtOpcUa.Commons.Messages.Fleet;
+using ZB.MOM.WW.OtOpcUa.Commons.Observability;
 using ZB.MOM.WW.OtOpcUa.Commons.Types;
 using ZB.MOM.WW.OtOpcUa.Configuration;
 using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
 using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
 using CommonsNodeId = ZB.MOM.WW.OtOpcUa.Commons.Types.NodeId;
 
 namespace ZB.MOM.WW.OtOpcUa.Runtime.Drivers;
@@ -38,11 +41,19 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
     private readonly IDbContextFactory<OtOpcUaConfigDbContext> _dbFactory;
     private readonly CommonsNodeId _localNode;
     private readonly IActorRef? _coordinatorOverride;
+    private readonly IDriverFactory _driverFactory;
+    private readonly IReadOnlySet<string> _localRoles;
+    private readonly IActorRef? _dependencyMux;
+    private readonly IActorRef? _opcUaPublishActor;
     private readonly ILoggingAdapter _log = Context.GetLogger();
 
     private RevisionHash? _currentRevision;
     private DeploymentId? _applyingDeploymentId;
 
+    private readonly Dictionary<string, ChildEntry> _children = new(StringComparer.Ordinal);
+
+    private sealed record ChildEntry(IActorRef Actor, string DriverType, string LastConfigJson, bool Stubbed);
+
     public ITimerScheduler Timers { get; set; } = null!;
 
     public sealed class RetryConfigDbConnection
@@ -54,17 +65,30 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
     public static Props Props(
         IDbContextFactory<OtOpcUaConfigDbContext> dbFactory,
         CommonsNodeId localNode,
-        IActorRef? coordinator = null) =>
-        Akka.Actor.Props.Create(() => new DriverHostActor(dbFactory, localNode, coordinator));
+        IActorRef? coordinator = null,
+        IDriverFactory? driverFactory = null,
+        IReadOnlySet<string>? localRoles = null,
+        IActorRef? dependencyMux = null,
+        IActorRef? opcUaPublishActor = null) =>
+        Akka.Actor.Props.Create(() => new DriverHostActor(
+            dbFactory, localNode, coordinator, driverFactory, localRoles, dependencyMux, opcUaPublishActor));
 
     public DriverHostActor(
         IDbContextFactory<OtOpcUaConfigDbContext> dbFactory,
         CommonsNodeId localNode,
-        IActorRef? coordinator)
+        IActorRef? coordinator,
+        IDriverFactory? driverFactory = null,
+        IReadOnlySet<string>? localRoles = null,
+        IActorRef? dependencyMux = null,
+        IActorRef? opcUaPublishActor = null)
     {
         _dbFactory = dbFactory;
         _localNode = localNode;
         _coordinatorOverride = coordinator;
+        _driverFactory = driverFactory ?? NullDriverFactory.Instance;
+        _localRoles = localRoles ?? new HashSet<string>(StringComparer.Ordinal);
+        _dependencyMux = dependencyMux;
+        _opcUaPublishActor = opcUaPublishActor;
 
         // Default behavior is Steady — PreStart may flip to Stale or replay an orphan apply.
         Become(Steady);
@@ -137,6 +161,7 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
     {
         Receive<DispatchDeployment>(HandleDispatchFromSteady);
         Receive<GetDiagnostics>(HandleGetDiagnostics);
+        Receive<DriverInstanceActor.AttributeValuePublished>(ForwardToMux);
         Receive<SubscribeAck>(_ => { /* PubSub ack */ });
     }
 
@@ -155,9 +180,18 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
             Self.Forward(msg); // re-deliver after we transition back
         });
         Receive<GetDiagnostics>(HandleGetDiagnostics);
+        Receive<DriverInstanceActor.AttributeValuePublished>(ForwardToMux);
         Receive<SubscribeAck>(_ => { /* PubSub ack */ });
     }
 
+    private void ForwardToMux(DriverInstanceActor.AttributeValuePublished msg)
+    {
+        // Pass driver-published values to the dependency mux when one is wired. Without a mux,
+        // VirtualTagActor evaluation can't fire — values just drop here. That's the dev/Mac path
+        // (no virtual tags registered); production binds the mux via the RuntimeActors extension.
+        _dependencyMux?.Tell(msg);
+    }
+
     private void Stale()
     {
         Receive<DispatchDeployment>(_ =>
@@ -172,12 +206,19 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
 
     private void HandleGetDiagnostics(GetDiagnostics msg)
     {
-        // Driver-instance children aren't spawned yet (F7); the snapshot reports an empty driver
-        // list. CurrentRevision is real — it's what the host believes is its applied revision.
+        var drivers = _children
+            .Select(kv => new DriverInstanceDiagnostics(
+                DriverInstanceId: Guid.Empty,
+                Name: kv.Key,
+                State: kv.Value.Stubbed ? "Stubbed" : "Spawned",
+                ConnectedDevices: 0,
+                FaultedDevices: 0,
+                LastChangeUtc: DateTime.UtcNow))
+            .ToArray();
         var snapshot = new NodeDiagnosticsSnapshot(
             NodeId: _localNode,
             CurrentRevision: _currentRevision,
-            Drivers: Array.Empty<DriverInstanceDiagnostics>(),
+            Drivers: drivers,
             AsOfUtc: DateTime.UtcNow);
         Sender.Tell(snapshot);
     }
@@ -200,30 +241,165 @@ public sealed class DriverHostActor : ReceiveActor, IWithTimers
         _applyingDeploymentId = deploymentId;
         Become(Applying);
 
+        using var span = OtOpcUaTelemetry.StartDeployApplySpan(deploymentId.ToString());
+        span?.SetTag("otopcua.node_id", _localNode.ToString());
+        span?.SetTag("otopcua.revision", revision.ToString());
+        span?.SetTag("otopcua.correlation_id", correlation.ToString());
+        var sw = Stopwatch.StartNew();
+
         // Persist Applying row (idempotent on PK).
         UpsertNodeDeploymentState(deploymentId, NodeDeploymentStatus.Applying, failureReason: null);
 
         try
         {
-            // Future: dispatch ApplyDelta to children, wait for acks. For Task 37/38, just no-op.
+            ReconcileDrivers(deploymentId);
             _currentRevision = revision;
             UpsertNodeDeploymentState(deploymentId, NodeDeploymentStatus.Applied, failureReason: null);
             SendAck(deploymentId, ApplyAckOutcome.Applied, failureReason: null, correlation);
-            _log.Info("DriverHost {Node}: applied deployment {Id} (rev {Rev})", _localNode, deploymentId, revision);
+            // Trigger the OPC UA address-space rebuild so the local SDK reflects the new
+            // composition. The publish actor handles the load-compose-diff-apply pipeline; we
+            // just forward the same correlation id so the audit trail joins up.
+            _opcUaPublishActor?.Tell(new ZB.MOM.WW.OtOpcUa.Runtime.OpcUa.OpcUaPublishActor.RebuildAddressSpace(correlation));
+            OtOpcUaTelemetry.DeploymentApplied.Add(1, new KeyValuePair<string, object?>("outcome", "ack"));
+            _log.Info("DriverHost {Node}: applied deployment {Id} (rev {Rev}, children={Count})",
+                _localNode, deploymentId, revision, _children.Count);
         }
         catch (Exception ex)
         {
             UpsertNodeDeploymentState(deploymentId, NodeDeploymentStatus.Failed, ex.Message);
             SendAck(deploymentId, ApplyAckOutcome.Failed, ex.Message, correlation);
+            OtOpcUaTelemetry.DeploymentApplied.Add(1, new KeyValuePair<string, object?>("outcome", "reject"));
+            span?.SetStatus(ActivityStatusCode.Error, ex.Message);
             _log.Error(ex, "DriverHost {Node}: apply of {Id} failed", _localNode, deploymentId);
         }
         finally
         {
+            OtOpcUaTelemetry.DeploymentApplyDurationSec.Record(sw.Elapsed.TotalSeconds);
             _applyingDeploymentId = null;
             Become(Steady);
         }
     }
 
+    /// <summary>
+    ///     Read the deployment artifact + reconcile the set of running <see cref="DriverInstanceActor"/>
+    ///     children. Spawn missing, ApplyDelta on config change, stop removed/disabled drivers.
+    ///     When the artifact blob is empty (legacy ControlPlane tests, smoke fixtures) or the
+    ///     configured <see cref="IDriverFactory"/> can't materialise any of the requested
+    ///     types, this is effectively a no-op.
+    /// </summary>
+    private void ReconcileDrivers(DeploymentId deploymentId)
+    {
+        byte[] blob;
+        try
+        {
+            using var db = _dbFactory.CreateDbContext();
+            blob = db.Deployments.AsNoTracking()
+                .Where(d => d.DeploymentId == deploymentId.Value)
+                .Select(d => d.ArtifactBlob)
+                .FirstOrDefault() ?? Array.Empty<byte>();
+        }
+        catch (Exception ex)
+        {
+            _log.Warning(ex, "DriverHost {Node}: failed to load artifact for {Id}; skipping reconcile",
+                _localNode, deploymentId);
+            return;
+        }
+
+        var specs = DeploymentArtifact.ParseDriverInstances(blob);
+        var snapshots = _children.ToDictionary(
+            kv => kv.Key,
+            kv => new DriverChildSnapshot(kv.Value.DriverType, kv.Value.LastConfigJson),
+            StringComparer.Ordinal);
+        var plan = DriverSpawnPlanner.Compute(snapshots, specs);
+
+        foreach (var id in plan.ToStop) StopChild(id);
+        foreach (var spec in plan.ToApplyDelta) ApplyChildDelta(spec);
+        foreach (var spec in plan.ToSpawn) SpawnChild(spec);
+    }
+
+    private void SpawnChild(DriverInstanceSpec spec)
+    {
+        var stub = DriverInstanceActor.ShouldStub(spec.DriverType, _localRoles);
+        IDriver? driver = null;
+        if (!stub)
+        {
+            try { driver = _driverFactory.TryCreate(spec.DriverType, spec.DriverInstanceId, spec.DriverConfig); }
+            catch (Exception ex)
+            {
+                _log.Warning(ex, "DriverHost {Node}: factory for {Type} threw on {Id}; stubbing",
+                    _localNode, spec.DriverType, spec.DriverInstanceId);
+            }
+            if (driver is null)
+            {
+                _log.Warning(
+                    "DriverHost {Node}: no factory for driver type {Type} (instance {Id}); falling back to stub",
+                    _localNode, spec.DriverType, spec.DriverInstanceId);
+                stub = true;
+            }
+        }
+
+        IActorRef child;
+        if (stub)
+        {
+            child = Context.ActorOf(
+                DriverInstanceActor.Props(new StubbedDriver(spec.DriverInstanceId, spec.DriverType),
+                    reconnectInterval: null, startStubbed: true),
+                ActorNameFor(spec.DriverInstanceId));
+        }
+        else
+        {
+            child = Context.ActorOf(
+                DriverInstanceActor.Props(driver!),
+                ActorNameFor(spec.DriverInstanceId));
+            child.Tell(new DriverInstanceActor.InitializeRequested(spec.DriverConfig));
+        }
+
+        _children[spec.DriverInstanceId] = new ChildEntry(child, spec.DriverType, spec.DriverConfig, stub);
+        _log.Info("DriverHost {Node}: spawned {Type} driver {Id} (stub={Stub})",
+            _localNode, spec.DriverType, spec.DriverInstanceId, stub);
+    }
+
+    private void ApplyChildDelta(DriverInstanceSpec spec)
+    {
+        if (!_children.TryGetValue(spec.DriverInstanceId, out var entry)) return;
+        entry.Actor.Tell(new DriverInstanceActor.ApplyDelta(spec.DriverConfig, CorrelationId.NewId()));
+        _children[spec.DriverInstanceId] = entry with { LastConfigJson = spec.DriverConfig };
+        _log.Debug("DriverHost {Node}: ApplyDelta queued for {Id}", _localNode, spec.DriverInstanceId);
+    }
+
+    private void StopChild(string driverInstanceId)
+    {
+        if (!_children.TryGetValue(driverInstanceId, out var entry)) return;
+        Context.Stop(entry.Actor);
+        _children.Remove(driverInstanceId);
+        _log.Info("DriverHost {Node}: stopped driver child {Id}", _localNode, driverInstanceId);
+    }
+
+    private static string ActorNameFor(string driverInstanceId)
+    {
+        // Akka actor names cannot contain '/', ':', or whitespace. Mangle defensively.
+        var chars = driverInstanceId.Select(c => char.IsLetterOrDigit(c) || c is '-' or '_' or '.' ? c : '_').ToArray();
+        return "drv-" + new string(chars);
+    }
+
+    /// <summary>
+    ///     Minimal placeholder driver used when no factory is registered for a driver type or when
+    ///     <see cref="DriverInstanceActor.ShouldStub"/> returns true. <see cref="DriverInstanceActor"/>
+    ///     is started with <c>startStubbed:true</c> so the driver methods on this object never run.
+    /// </summary>
+    private sealed class StubbedDriver : IDriver
+    {
+        public string DriverInstanceId { get; }
+        public string DriverType { get; }
+        public StubbedDriver(string id, string type) { DriverInstanceId = id; DriverType = type; }
+        public Task InitializeAsync(string driverConfigJson, CancellationToken cancellationToken) => Task.CompletedTask;
+        public Task ReinitializeAsync(string driverConfigJson, CancellationToken cancellationToken) => Task.CompletedTask;
+        public Task ShutdownAsync(CancellationToken cancellationToken) => Task.CompletedTask;
+        public DriverHealth GetHealth() => new(DriverState.Healthy, DateTime.UtcNow, LastError: null);
+        public long GetMemoryFootprint() => 0;
+        public Task FlushOptionalCachesAsync(CancellationToken cancellationToken) => Task.CompletedTask;
+    }
+
     private void TryRecoverFromStale()
     {
         try

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DriverInstanceActor.cs

@@ -1,5 +1,7 @@
 using Akka.Actor;
 using Akka.Event;
+using ZB.MOM.WW.OtOpcUa.Commons.Observability;
+using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
 using ZB.MOM.WW.OtOpcUa.Commons.Types;
 using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
 
@@ -31,6 +33,14 @@ public sealed class DriverInstanceActor : ReceiveActor, IWithTimers
     public sealed record ApplyResult(bool Success, string? Reason, CorrelationId Correlation);
     public sealed record WriteAttribute(string TagId, object Value);
     public sealed record WriteAttributeResult(bool Success, string? Reason);
+    public sealed record Subscribe(IReadOnlyList<string> FullReferences, TimeSpan PublishingInterval);
+    public sealed record SubscriptionEstablished(string DiagnosticId, int ReferenceCount);
+    public sealed record SubscriptionFailed(string Reason);
+    public sealed record Unsubscribe;
+    /// <summary>Published to the actor's parent whenever the subscribed IDriver fires
+    /// <see cref="ISubscribable.OnDataChange"/>. The parent forwards to OpcUaPublishActor.</summary>
+    public sealed record AttributeValuePublished(string FullReference, object? Value, OpcUaQuality Quality, DateTime TimestampUtc);
+    private sealed record DataChangeForward(string FullReference, DataValueSnapshot Snapshot);
     public sealed class RetryConnect
     {
         public static readonly RetryConnect Instance = new();
@@ -43,6 +53,12 @@ public sealed class DriverInstanceActor : ReceiveActor, IWithTimers
     private readonly ILoggingAdapter _log = Context.GetLogger();
     private string? _currentConfigJson;
 
+    /// <summary>Active subscription handle (null when not subscribed). Lifetime is one-per-actor —
+    /// re-subscribe across reconnects is the consumer's responsibility today (subscribe-once
+    /// semantics keep the actor simple; mux-driven re-subscribe is tracked as F8b/#113).</summary>
+    private ISubscriptionHandle? _subscriptionHandle;
+    private EventHandler<DataChangeEventArgs>? _dataChangeHandler;
+
     public ITimerScheduler Timers { get; set; } = null!;
 
     public static Props Props(IDriver driver, TimeSpan? reconnectInterval = null, bool startStubbed = false) =>
@@ -67,6 +83,9 @@ public sealed class DriverInstanceActor : ReceiveActor, IWithTimers
         _driver = driver;
         _driverInstanceId = driver.DriverInstanceId;
         _reconnectInterval = reconnectInterval;
+        OtOpcUaTelemetry.DriverInstanceLifecycle.Add(1,
+            new KeyValuePair<string, object?>("event", startStubbed ? "spawn_stub" : "spawn"),
+            new KeyValuePair<string, object?>("driver_type", driver.DriverType));
         if (startStubbed)
         {
             Context.GetLogger().Info("[DEV-STUB] driver={Name} type={Type}",
@@ -111,9 +130,13 @@ public sealed class DriverInstanceActor : ReceiveActor, IWithTimers
         {
             _log.Warning("DriverInstance {Id}: disconnect observed ({Reason}); reconnecting",
                 _driverInstanceId, msg.Reason);
+            DetachSubscription();
             Become(Reconnecting);
         });
-        Receive<WriteAttribute>(HandleWrite);
+        ReceiveAsync<WriteAttribute>(HandleWriteAsync);
+        ReceiveAsync<Subscribe>(HandleSubscribeAsync);
+        ReceiveAsync<Unsubscribe>(_ => UnsubscribeAsync());
+        Receive<DataChangeForward>(OnDataChangeForward);
     }
 
     private void Reconnecting()
@@ -162,23 +185,141 @@ public sealed class DriverInstanceActor : ReceiveActor, IWithTimers
         }
     }
 
-    private void HandleWrite(WriteAttribute msg)
+    private async Task HandleWriteAsync(WriteAttribute msg)
     {
-        // Per-tag write requires IWritable capability discovery. Skeleton stub — see follow-up F7.
-        if (_driver is IWritable writable)
-        {
-            // Future: writable.WriteAsync(msg.TagId, msg.Value, ct) and Pipe back to Sender.
-            Sender.Tell(new WriteAttributeResult(false, "Write path not yet implemented (F7)"));
-        }
-        else
+        if (_driver is not IWritable writable)
         {
             Sender.Tell(new WriteAttributeResult(false, "Driver does not implement IWritable"));
+            return;
+        }
+
+        var replyTo = Sender;
+        var request = new[] { new WriteRequest(msg.TagId, msg.Value) };
+        // Bound the write so a hung backend can't pin this actor forever — decision #44/#45 keeps
+        // retry off by default, but a stalled call still needs an answer.
+        using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(5));
+        try
+        {
+            var results = await writable.WriteAsync(request, cts.Token).ConfigureAwait(false);
+            if (results is { Count: 1 } && IsGoodStatus(results[0].StatusCode))
+            {
+                replyTo.Tell(new WriteAttributeResult(true, null));
+                return;
+            }
+            var status = results is { Count: > 0 } ? results[0].StatusCode : 0xFFFFFFFF;
+            replyTo.Tell(new WriteAttributeResult(false, $"StatusCode=0x{status:X8}"));
+        }
+        catch (OperationCanceledException)
+        {
+            replyTo.Tell(new WriteAttributeResult(false, "write timeout"));
+        }
+        catch (Exception ex)
+        {
+            replyTo.Tell(new WriteAttributeResult(false, ex.Message));
         }
     }
 
+    private async Task HandleSubscribeAsync(Subscribe msg)
+    {
+        if (_driver is not ISubscribable subscribable)
+        {
+            Sender.Tell(new SubscriptionFailed("Driver does not implement ISubscribable"));
+            return;
+        }
+        if (_subscriptionHandle is not null)
+        {
+            // Subscribe-twice — drop the prior subscription before establishing the new one.
+            await UnsubscribeAsync().ConfigureAwait(false);
+        }
+
+        var replyTo = Sender;
+        var self = Self;
+        try
+        {
+            _dataChangeHandler = (_, args) => self.Tell(new DataChangeForward(args.FullReference, args.Snapshot));
+            subscribable.OnDataChange += _dataChangeHandler;
+
+            using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+            _subscriptionHandle = await subscribable
+                .SubscribeAsync(msg.FullReferences, msg.PublishingInterval, cts.Token)
+                .ConfigureAwait(false);
+
+            replyTo.Tell(new SubscriptionEstablished(_subscriptionHandle.DiagnosticId, msg.FullReferences.Count));
+            _log.Info("DriverInstance {Id}: subscribed to {Count} refs ({Diag})",
+                _driverInstanceId, msg.FullReferences.Count, _subscriptionHandle.DiagnosticId);
+        }
+        catch (Exception ex)
+        {
+            DetachSubscription();
+            _log.Warning(ex, "DriverInstance {Id}: subscribe failed", _driverInstanceId);
+            replyTo.Tell(new SubscriptionFailed(ex.Message));
+        }
+    }
+
+    private async Task UnsubscribeAsync()
+    {
+        if (_driver is not ISubscribable subscribable || _subscriptionHandle is null)
+        {
+            DetachSubscription();
+            return;
+        }
+        try
+        {
+            using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(5));
+            await subscribable.UnsubscribeAsync(_subscriptionHandle, cts.Token).ConfigureAwait(false);
+        }
+        catch (Exception ex)
+        {
+            _log.Warning(ex, "DriverInstance {Id}: unsubscribe threw (continuing)", _driverInstanceId);
+        }
+        finally
+        {
+            DetachSubscription();
+        }
+    }
+
+    /// <summary>Tear down the event handler + null the handle. Called from Unsubscribe path, on
+    /// PostStop, and on Connected → Reconnecting transitions so a stale handler doesn't push
+    /// data-change events to an actor that has lost its driver connection.</summary>
+    private void DetachSubscription()
+    {
+        if (_driver is ISubscribable subscribable && _dataChangeHandler is not null)
+        {
+            subscribable.OnDataChange -= _dataChangeHandler;
+        }
+        _dataChangeHandler = null;
+        _subscriptionHandle = null;
+    }
+
+    private void OnDataChangeForward(DataChangeForward msg)
+    {
+        var quality = QualityFromStatus(msg.Snapshot.StatusCode);
+        var ts = msg.Snapshot.SourceTimestampUtc ?? msg.Snapshot.ServerTimestampUtc;
+        Context.Parent.Tell(new AttributeValuePublished(msg.FullReference, msg.Snapshot.Value, quality, ts));
+    }
+
+    /// <summary>Translate an OPC UA status code to the 3-state <see cref="OpcUaQuality"/> projection
+    /// the publish actor consumes. Severity bits (top 2): 00 = Good, 01 = Uncertain, 10/11 = Bad.</summary>
+    private static OpcUaQuality QualityFromStatus(uint statusCode)
+    {
+        var severity = statusCode >> 30;
+        return severity switch
+        {
+            0 => OpcUaQuality.Good,
+            1 => OpcUaQuality.Uncertain,
+            _ => OpcUaQuality.Bad,
+        };
+    }
+
+    private static bool IsGoodStatus(uint statusCode) => (statusCode >> 30) == 0;
+
     protected override void PostStop()
     {
+        DetachSubscription();
         try { _driver.ShutdownAsync(CancellationToken.None).GetAwaiter().GetResult(); }
         catch (Exception ex) { _log.Warning(ex, "DriverInstance {Id}: ShutdownAsync threw on PostStop", _driverInstanceId); }
+        OtOpcUaTelemetry.DriverInstanceLifecycle.Add(1,
+            new KeyValuePair<string, object?>("event", "stop"),
+            new KeyValuePair<string, object?>("driver_type", _driver.DriverType));
     }
 }

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DriverSpawnPlan.cs

@@ -0,0 +1,67 @@
+namespace ZB.MOM.WW.OtOpcUa.Runtime.Drivers;
+
+/// <summary>
+///     Pure diff between the currently-running driver children (keyed by
+///     <c>DriverInstance.DriverInstanceId</c>) and the target spec list from a freshly-applied
+///     deployment artifact. The DriverHostActor consumes the three lists and calls
+///     spawn / ApplyDelta / stop on its child actors accordingly.
+/// </summary>
+/// <param name="ToSpawn">Specs with no current child — create a new actor.</param>
+/// <param name="ToApplyDelta">Specs whose child exists but config JSON or type differs.</param>
+/// <param name="ToStop">DriverInstanceIds currently running but missing from the new artifact, or now disabled.</param>
+public sealed record DriverSpawnPlan(
+    IReadOnlyList<DriverInstanceSpec> ToSpawn,
+    IReadOnlyList<DriverInstanceSpec> ToApplyDelta,
+    IReadOnlyList<string> ToStop);
+
+public static class DriverSpawnPlanner
+{
+    /// <summary>
+    ///     Compute the spawn/delta/stop sets. Disabled entries in <paramref name="target"/> are
+    ///     treated as "not desired here": if a child exists for the id it goes into ToStop,
+    ///     otherwise the row is dropped entirely (no spawn for a disabled driver).
+    /// </summary>
+    public static DriverSpawnPlan Compute(
+        IReadOnlyDictionary<string, DriverChildSnapshot> current,
+        IReadOnlyList<DriverInstanceSpec> target)
+    {
+        var toSpawn = new List<DriverInstanceSpec>();
+        var toDelta = new List<DriverInstanceSpec>();
+        var toStop = new List<string>();
+
+        var targetById = new Dictionary<string, DriverInstanceSpec>(StringComparer.Ordinal);
+        foreach (var spec in target) targetById[spec.DriverInstanceId] = spec;
+
+        foreach (var (id, snap) in current)
+        {
+            if (!targetById.TryGetValue(id, out var spec) || !spec.Enabled)
+            {
+                toStop.Add(id);
+                continue;
+            }
+            // Driver type changes can't be reinitialized in-place (factory-bound) — stop + respawn.
+            if (!string.Equals(snap.DriverType, spec.DriverType, StringComparison.Ordinal))
+            {
+                toStop.Add(id);
+                toSpawn.Add(spec);
+                continue;
+            }
+            if (!string.Equals(snap.LastConfigJson, spec.DriverConfig, StringComparison.Ordinal))
+            {
+                toDelta.Add(spec);
+            }
+        }
+
+        foreach (var (id, spec) in targetById)
+        {
+            if (!spec.Enabled) continue;
+            if (current.ContainsKey(id)) continue;
+            toSpawn.Add(spec);
+        }
+
+        return new DriverSpawnPlan(toSpawn, toDelta, toStop);
+    }
+}
+
+/// <summary>Snapshot of one running driver child as the host sees it. Used as the diff input.</summary>
+public sealed record DriverChildSnapshot(string DriverType, string LastConfigJson);

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/OpcUa/OpcUaPublishActor.cs

@@ -1,70 +1,267 @@
 using Akka.Actor;
+using Akka.Cluster.Tools.PublishSubscribe;
 using Akka.Event;
+using Microsoft.EntityFrameworkCore;
+using ZB.MOM.WW.OtOpcUa.Commons.Messages.Redundancy;
+using ZB.MOM.WW.OtOpcUa.Commons.Observability;
+using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
 using ZB.MOM.WW.OtOpcUa.Commons.Types;
+using ZB.MOM.WW.OtOpcUa.Configuration;
+using ZB.MOM.WW.OtOpcUa.OpcUaServer;
+using ZB.MOM.WW.OtOpcUa.Runtime.Drivers;
 
 namespace ZB.MOM.WW.OtOpcUa.Runtime.OpcUa;
 
 /// <summary>
-/// Single-threaded bridge between Akka messages and the OPC UA SDK address space. Hosted on
-/// the pinned <c>opcua-synchronized-dispatcher</c> (Task 19 HOCON) so the OPC UA SDK sees
-/// only one thread per actor instance — its session/subscription locks expect strict
-/// single-threaded access.
+///     Single-threaded bridge between Akka messages and the OPC UA SDK address space. Hosted on
+///     the pinned <c>opcua-synchronized-dispatcher</c> (Task 19 HOCON) so the OPC UA SDK sees
+///     only one thread per actor instance — its session/subscription locks expect strict
+///     single-threaded access.
 ///
-/// Engine wiring (call into <c>OpcUaApplicationHost</c> address-space writes, manage
-/// <c>ServiceLevel</c> + <c>ServerUriArray</c> nodes, subscribe to the <c>redundancy-state</c>
-/// DistributedPubSub topic) is staged for follow-up F10. This skeleton compiles + exposes the
-/// message contracts so producers (DriverInstance, VirtualTag, ScriptedAlarm) can target it.
+///     Address-space writes route through <see cref="IOpcUaAddressSpaceSink"/>; ServiceLevel
+///     writes route through <see cref="IServiceLevelPublisher"/>. Production binds SDK-backed
+///     implementations; dev/Mac/tests bind the Null* defaults so the actor stays decoupled from
+///     <c>Opc.Ua.Server</c>. The remaining piece is wiring those bindings to a real
+///     <c>StandardServer</c> address space — tracked as F10b.
 /// </summary>
 public sealed class OpcUaPublishActor : ReceiveActor
 {
     public const string DispatcherId = "opcua-synchronized-dispatcher";
+    public const string RedundancyStateTopic = "redundancy-state";
 
     public sealed record AttributeValueUpdate(string NodeId, object? Value, OpcUaQuality Quality, DateTime TimestampUtc);
     public sealed record AlarmStateUpdate(string AlarmNodeId, bool Active, bool Acknowledged, DateTime TimestampUtc);
     public sealed record RebuildAddressSpace(CorrelationId Correlation);
     public sealed record ServiceLevelChanged(byte ServiceLevel);
 
-    public enum OpcUaQuality { Good, Uncertain, Bad }
-
+    private readonly IOpcUaAddressSpaceSink _sink;
+    private readonly IServiceLevelPublisher _serviceLevel;
+    private readonly bool _subscribeRedundancyTopic;
+    private readonly NodeId? _localNode;
+    private readonly IDbContextFactory<OtOpcUaConfigDbContext>? _dbFactory;
+    private readonly Phase7Applier? _applier;
     private readonly ILoggingAdapter _log = Context.GetLogger();
+
     private int _writes;
-
-    /// <summary>
-    /// Returns Props pre-configured to use the <c>opcua-synchronized-dispatcher</c>. Caller can
-    /// still override by chaining <c>.WithDispatcher(otherId)</c> for unit tests.
-    /// </summary>
-    public static Props Props() =>
-        Akka.Actor.Props.Create(() => new OpcUaPublishActor()).WithDispatcher(DispatcherId);
-
-    /// <summary>Test-only Props that omits the pinned dispatcher requirement.</summary>
-    public static Props PropsForTests() =>
-        Akka.Actor.Props.Create(() => new OpcUaPublishActor());
+    private byte _lastServiceLevel;
+    private Phase7CompositionResult _lastApplied = new(
+        Array.Empty<EquipmentNode>(),
+        Array.Empty<DriverInstancePlan>(),
+        Array.Empty<ScriptedAlarmPlan>());
 
     public int WriteCount => _writes;
+    public byte LastServiceLevel => _lastServiceLevel;
 
-    public OpcUaPublishActor()
+    /// <summary>Production Props — pins the OPC UA dispatcher + subscribes to the
+    /// <c>redundancy-state</c> DPS topic so cluster transitions drive the local ServiceLevel
+    /// publish path. When <paramref name="dbFactory"/> + <paramref name="applier"/> are supplied,
+    /// <see cref="RebuildAddressSpace"/> reads the latest deployment artifact + drives the
+    /// applier through the sink.</summary>
+    public static Props Props(
+        IOpcUaAddressSpaceSink? sink = null,
+        IServiceLevelPublisher? serviceLevel = null,
+        NodeId? localNode = null,
+        IDbContextFactory<OtOpcUaConfigDbContext>? dbFactory = null,
+        Phase7Applier? applier = null) =>
+        Akka.Actor.Props.Create(() => new OpcUaPublishActor(
+            sink ?? NullOpcUaAddressSpaceSink.Instance,
+            serviceLevel ?? NullServiceLevelPublisher.Instance,
+            subscribeRedundancyTopic: true,
+            localNode,
+            dbFactory,
+            applier)).WithDispatcher(DispatcherId);
+
+    /// <summary>Test-only Props that omits the pinned-dispatcher requirement and skips the
+    /// DPS subscribe so unit tests can spin up the actor on a vanilla TestKit cluster.</summary>
+    public static Props PropsForTests(
+        IOpcUaAddressSpaceSink? sink = null,
+        IServiceLevelPublisher? serviceLevel = null,
+        bool subscribeRedundancyTopic = false,
+        NodeId? localNode = null,
+        IDbContextFactory<OtOpcUaConfigDbContext>? dbFactory = null,
+        Phase7Applier? applier = null) =>
+        Akka.Actor.Props.Create(() => new OpcUaPublishActor(
+            sink ?? NullOpcUaAddressSpaceSink.Instance,
+            serviceLevel ?? NullServiceLevelPublisher.Instance,
+            subscribeRedundancyTopic,
+            localNode,
+            dbFactory,
+            applier));
+
+    public OpcUaPublishActor(
+        IOpcUaAddressSpaceSink sink,
+        IServiceLevelPublisher serviceLevel,
+        bool subscribeRedundancyTopic,
+        NodeId? localNode,
+        IDbContextFactory<OtOpcUaConfigDbContext>? dbFactory = null,
+        Phase7Applier? applier = null)
     {
-        Receive<AttributeValueUpdate>(msg =>
+        _sink = sink;
+        _serviceLevel = serviceLevel;
+        _subscribeRedundancyTopic = subscribeRedundancyTopic;
+        _localNode = localNode;
+        _dbFactory = dbFactory;
+        _applier = applier;
+
+        Receive<AttributeValueUpdate>(HandleAttributeUpdate);
+        Receive<AlarmStateUpdate>(HandleAlarmUpdate);
+        Receive<RebuildAddressSpace>(HandleRebuild);
+        Receive<ServiceLevelChanged>(HandleServiceLevelChanged);
+        Receive<RedundancyStateChanged>(HandleRedundancyStateChanged);
+        Receive<SubscribeAck>(_ => { /* PubSub ack */ });
+    }
+
+    protected override void PreStart()
+    {
+        if (_subscribeRedundancyTopic)
         {
-            // F10: call into OpcUaApplicationHost to write the address-space node.
+            DistributedPubSub.Get(Context.System).Mediator.Tell(new Subscribe(RedundancyStateTopic, Self));
+        }
+    }
+
+    private void HandleAttributeUpdate(AttributeValueUpdate msg)
+    {
+        try
+        {
+            _sink.WriteValue(msg.NodeId, msg.Value, msg.Quality, msg.TimestampUtc);
             Interlocked.Increment(ref _writes);
-            _log.Debug("OpcUaPublish: queued AttributeValueUpdate for {Node} ({Quality}) (write staged for F10)",
-                msg.NodeId, msg.Quality);
-        });
-        Receive<AlarmStateUpdate>(msg =>
+            OtOpcUaTelemetry.OpcUaSinkWrite.Add(1, new KeyValuePair<string, object?>("kind", "value"));
+        }
+        catch (Exception ex)
         {
+            _log.Warning(ex, "OpcUaPublish: sink.WriteValue threw for {Node}", msg.NodeId);
+        }
+    }
+
+    private void HandleAlarmUpdate(AlarmStateUpdate msg)
+    {
+        try
+        {
+            _sink.WriteAlarmState(msg.AlarmNodeId, msg.Active, msg.Acknowledged, msg.TimestampUtc);
             Interlocked.Increment(ref _writes);
-            _log.Debug("OpcUaPublish: queued AlarmStateUpdate for {Node} (active={Active})",
-                msg.AlarmNodeId, msg.Active);
-        });
-        Receive<RebuildAddressSpace>(msg =>
+            OtOpcUaTelemetry.OpcUaSinkWrite.Add(1, new KeyValuePair<string, object?>("kind", "alarm"));
+        }
+        catch (Exception ex)
         {
-            _log.Info("OpcUaPublish: address-space rebuild requested (correlation={Correlation}); F10 wires the SDK call",
-                msg.Correlation);
-        });
-        Receive<ServiceLevelChanged>(msg =>
+            _log.Warning(ex, "OpcUaPublish: sink.WriteAlarmState threw for {Node}", msg.AlarmNodeId);
+        }
+    }
+
+    private void HandleRebuild(RebuildAddressSpace msg)
+    {
+        using var span = OtOpcUaTelemetry.StartAddressSpaceRebuildSpan();
+        span?.SetTag("otopcua.correlation_id", msg.Correlation.ToString());
+
+        // Two modes: when dbFactory + applier are wired, do a real diff-and-apply pass against
+        // the latest deployment artifact. Without them, fall back to a raw sink rebuild — the
+        // F10b/dev path before the integration completes.
+        if (_dbFactory is null || _applier is null)
         {
-            _log.Debug("OpcUaPublish: ServiceLevel={Level} (write staged for F10)", msg.ServiceLevel);
-        });
+            try
+            {
+                _sink.RebuildAddressSpace();
+                OtOpcUaTelemetry.OpcUaSinkWrite.Add(1, new KeyValuePair<string, object?>("kind", "rebuild"));
+            }
+            catch (Exception ex)
+            {
+                _log.Error(ex, "OpcUaPublish: sink.RebuildAddressSpace threw (correlation={Correlation})",
+                    msg.Correlation);
+            }
+            return;
+        }
+
+        try
+        {
+            var artifact = LoadLatestArtifact();
+            var composition = DeploymentArtifact.ParseComposition(artifact);
+            var plan = Phase7Planner.Compute(_lastApplied, composition);
+
+            if (plan.IsEmpty)
+            {
+                _log.Debug("OpcUaPublish: rebuild requested but plan is empty (correlation={Correlation})",
+                    msg.Correlation);
+                return;
+            }
+
+            var outcome = _applier.Apply(plan);
+            _lastApplied = composition;
+
+            // #85 — after the plan diff lands, rebuild the UNS folder hierarchy so OPC UA
+            // clients see Area/Line/Equipment as proper folders. Idempotent; Phase7Applier
+            // skips folders that already exist with the same node id.
+            _applier.MaterialiseHierarchy(composition);
+
+            OtOpcUaTelemetry.OpcUaSinkWrite.Add(1, new KeyValuePair<string, object?>("kind", "rebuild"));
+            _log.Info("OpcUaPublish: applied rebuild (correlation={Correlation}, added={Added}, removed={Removed}, changed={Changed}, rebuild={Rebuild})",
+                msg.Correlation, outcome.AddedNodes, outcome.RemovedNodes, outcome.ChangedNodes, outcome.RebuildCalled);
+        }
+        catch (Exception ex)
+        {
+            _log.Error(ex, "OpcUaPublish: rebuild pipeline threw (correlation={Correlation})", msg.Correlation);
+        }
+    }
+
+    /// <summary>Read the most recent <c>Sealed</c> deployment's artifact blob from ConfigDb.
+    /// Empty array on any failure — the parser treats empty blob as "no composition".</summary>
+    private byte[] LoadLatestArtifact()
+    {
+        try
+        {
+            using var db = _dbFactory!.CreateDbContext();
+            return db.Deployments.AsNoTracking()
+                .Where(d => d.Status == Configuration.Enums.DeploymentStatus.Sealed)
+                .OrderByDescending(d => d.SealedAtUtc)
+                .Select(d => d.ArtifactBlob)
+                .FirstOrDefault() ?? Array.Empty<byte>();
+        }
+        catch (Exception ex)
+        {
+            _log.Warning(ex, "OpcUaPublish: failed to load latest deployment artifact; rebuild becomes no-op");
+            return Array.Empty<byte>();
+        }
+    }
+
+    private void HandleServiceLevelChanged(ServiceLevelChanged msg)
+    {
+        if (msg.ServiceLevel == _lastServiceLevel) return;
+        _lastServiceLevel = msg.ServiceLevel;
+        try
+        {
+            _serviceLevel.Publish(msg.ServiceLevel);
+            OtOpcUaTelemetry.ServiceLevelChange.Add(1,
+                new KeyValuePair<string, object?>("level", msg.ServiceLevel));
+            _log.Debug("OpcUaPublish: ServiceLevel={Level}", msg.ServiceLevel);
+        }
+        catch (Exception ex)
+        {
+            _log.Warning(ex, "OpcUaPublish: ServiceLevel publisher threw at level {Level}", msg.ServiceLevel);
+        }
+    }
+
+    /// <summary>
+    ///     Compute a coarse ServiceLevel from the cluster snapshot and forward to the
+    ///     <see cref="IServiceLevelPublisher"/>. This is a placeholder for F10b's full health
+    ///     aggregation — for now we surface "primary-leader → 240, secondary → 100, detached → 0"
+    ///     so the local SDK at least reflects role state. The full <see cref="ServiceLevelCalculator"/>
+    ///     path (with DB-reachable, OPC UA probe inputs) lives in <c>RedundancyStateActor</c> on
+    ///     admin nodes; this driver-side mirror exists so each node's own SDK exposes a sensible
+    ///     ServiceLevel without round-tripping back through the admin singleton.
+    /// </summary>
+    private void HandleRedundancyStateChanged(RedundancyStateChanged msg)
+    {
+        if (_localNode is null) return;
+
+        var local = msg.Nodes.FirstOrDefault(n => n.NodeId == _localNode.Value);
+        if (local is null) return;
+
+        byte level = local.Role switch
+        {
+            RedundancyRole.Primary when local.IsRoleLeaderForDriver => 240,
+            RedundancyRole.Primary => 200,
+            RedundancyRole.Secondary => 100,
+            RedundancyRole.Detached => 0,
+            _ => 0,
+        };
+        Self.Tell(new ServiceLevelChanged(level));
     }
 }

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/ScriptedAlarms/EfAlarmActorStateStore.cs

@@ -0,0 +1,111 @@
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.OtOpcUa.Commons.Engines;
+using ZB.MOM.WW.OtOpcUa.Configuration;
+using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
+
+namespace ZB.MOM.WW.OtOpcUa.Runtime.ScriptedAlarms;
+
+/// <summary>
+///     Production-side <see cref="IAlarmActorStateStore"/> backed by the
+///     <see cref="ScriptedAlarmState"/> table in the central config DB. The actor's
+///     3-state enum projects into the table's two persisted dimensions: Acked + an
+///     internal "_lastActiveState" recorded via a synthetic mapping (Inactive ⇒ Acked,
+///     Active ⇒ Unacked, Acknowledged ⇒ Acked). ActiveState itself is deliberately NOT
+///     persisted — re-derives from the evaluator on startup (Phase 7 decision #14).
+/// </summary>
+public sealed class EfAlarmActorStateStore : IAlarmActorStateStore
+{
+    private readonly IDbContextFactory<OtOpcUaConfigDbContext> _dbFactory;
+    private readonly ILogger<EfAlarmActorStateStore> _logger;
+
+    public EfAlarmActorStateStore(
+        IDbContextFactory<OtOpcUaConfigDbContext> dbFactory,
+        ILogger<EfAlarmActorStateStore> logger)
+    {
+        _dbFactory = dbFactory;
+        _logger = logger;
+    }
+
+    public async Task<AlarmActorStateSnapshot?> LoadAsync(string alarmId, CancellationToken ct)
+    {
+        using var db = await _dbFactory.CreateDbContextAsync(ct).ConfigureAwait(false);
+        var row = await db.ScriptedAlarmStates.AsNoTracking()
+            .FirstOrDefaultAsync(r => r.ScriptedAlarmId == alarmId, ct)
+            .ConfigureAwait(false);
+        if (row is null) return null;
+
+        var state = MapAckedToActorState(row.AckedState);
+        return new AlarmActorStateSnapshot(
+            AlarmId: alarmId,
+            State: state,
+            LastTransitionUtc: row.UpdatedAtUtc,
+            LastAckUser: row.LastAckUser);
+    }
+
+    public async Task SaveAsync(AlarmActorStateSnapshot snapshot, CancellationToken ct)
+    {
+        using var db = await _dbFactory.CreateDbContextAsync(ct).ConfigureAwait(false);
+        var row = await db.ScriptedAlarmStates
+            .FirstOrDefaultAsync(r => r.ScriptedAlarmId == snapshot.AlarmId, ct)
+            .ConfigureAwait(false);
+
+        var ackedState = MapActorStateToAcked(snapshot.State);
+        if (row is null)
+        {
+            db.ScriptedAlarmStates.Add(new ScriptedAlarmState
+            {
+                ScriptedAlarmId = snapshot.AlarmId,
+                EnabledState = "Enabled",
+                AckedState = ackedState,
+                ConfirmedState = "Confirmed",
+                ShelvingState = "Unshelved",
+                LastAckUser = snapshot.LastAckUser,
+                LastAckUtc = string.Equals(snapshot.State, "Acknowledged", StringComparison.Ordinal)
+                    ? snapshot.LastTransitionUtc
+                    : null,
+                UpdatedAtUtc = snapshot.LastTransitionUtc,
+                CommentsJson = "[]",
+            });
+        }
+        else
+        {
+            row.AckedState = ackedState;
+            row.LastAckUser = snapshot.LastAckUser ?? row.LastAckUser;
+            if (string.Equals(snapshot.State, "Acknowledged", StringComparison.Ordinal))
+                row.LastAckUtc = snapshot.LastTransitionUtc;
+            row.UpdatedAtUtc = snapshot.LastTransitionUtc;
+        }
+
+        try
+        {
+            await db.SaveChangesAsync(ct).ConfigureAwait(false);
+        }
+        catch (DbUpdateConcurrencyException ex)
+        {
+            // Two actors racing to save the same alarm is benign — the last writer wins on
+            // UpdatedAtUtc, and the next transition on either side will write again. Log
+            // + drop so a race doesn't crash the dispatcher.
+            _logger.LogDebug(ex, "EfAlarmActorStateStore: concurrency conflict for {AlarmId}; dropping save",
+                snapshot.AlarmId);
+        }
+    }
+
+    private static string MapActorStateToAcked(string actorState) => actorState switch
+    {
+        "Active" => "Unacknowledged",
+        "Acknowledged" => "Acknowledged",
+        // Inactive maps to Acknowledged — when an alarm clears, nothing is left to ack.
+        _ => "Acknowledged",
+    };
+
+    private static string MapAckedToActorState(string ackedState)
+    {
+        // Only Active distinguishes from Acked — Inactive comes from a re-eval, not from
+        // the table. Persisted "Unacknowledged" implies the actor was last Active +
+        // un-acked; we restore it to Active so a restart doesn't drop pending operator work.
+        return string.Equals(ackedState, "Unacknowledged", StringComparison.Ordinal)
+            ? "Active"
+            : "Acknowledged";
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/ScriptedAlarms/ScriptedAlarmActor.cs

@@ -1,60 +1,240 @@
 using Akka.Actor;
+using Akka.Cluster.Tools.PublishSubscribe;
 using Akka.Event;
+using ZB.MOM.WW.OtOpcUa.Commons.Engines;
+using ZB.MOM.WW.OtOpcUa.Commons.Messages.Alerts;
+using ZB.MOM.WW.OtOpcUa.Commons.Messages.Logging;
+using ZB.MOM.WW.OtOpcUa.Commons.Observability;
+using ZB.MOM.WW.OtOpcUa.Runtime.VirtualTags;
 
 namespace ZB.MOM.WW.OtOpcUa.Runtime.ScriptedAlarms;
 
 public enum ScriptedAlarmActorState { Inactive, Active, Acknowledged }
 
 /// <summary>
-/// State machine wrapping a single scripted alarm. Transitions:
-/// <c>Inactive → Active → Acknowledged → Inactive</c>.
-///
-/// Engine wiring (compile alarm expression via <c>AlarmConditionService</c>, persist state to
-/// <c>ScriptedAlarmState</c> ConfigDb table on <c>PreRestart</c>, emit history rows to
-/// <c>HistorianAdapter</c>) is staged for follow-up F9. This skeleton owns the state machine
-/// so DriverHostActor can spawn it as a child.
+///     One scripted alarm. Receives dependency value updates, runs the predicate via an
+///     injected <see cref="IScriptedAlarmEvaluator"/>, and on transitions publishes both
+///     an <see cref="AlarmTransitionEvent"/> on the cluster <c>alerts</c> DPS topic and a
+///     <see cref="ScriptLogEntry"/> on <c>script-logs</c>. Manual <see cref="AcknowledgeAlarm"/>
+///     + <see cref="ConditionCleared"/> still flow through the same state machine so the
+///     legacy callers keep working.
 /// </summary>
 public sealed class ScriptedAlarmActor : ReceiveActor
 {
+    public const string AlertsTopic = "alerts";
+    public const string ScriptLogsTopic = "script-logs";
+
+    public sealed record DependencyValueChanged(string TagId, object? Value, DateTime TimestampUtc);
     public sealed record ConditionMet(string Reason);
     public sealed record AcknowledgeAlarm(string Actor);
     public sealed record ConditionCleared;
     public sealed record StateChanged(string AlarmId, ScriptedAlarmActorState State, DateTime AtUtc);
 
-    private readonly string _alarmId;
+    public sealed record AlarmConfig(
+        string AlarmId,
+        string AlarmName,
+        string EquipmentPath,
+        int Severity,
+        string? Predicate);
+
+    private readonly AlarmConfig _config;
+    private readonly IScriptedAlarmEvaluator _evaluator;
+    private readonly IAlarmActorStateStore _stateStore;
+    private readonly Func<DPSPublisher>? _publisherFactory;
     private readonly ILoggingAdapter _log = Context.GetLogger();
+    private readonly Dictionary<string, object?> _dependencies = new(StringComparer.Ordinal);
+
     private ScriptedAlarmActorState _state = ScriptedAlarmActorState.Inactive;
+    private string? _lastAckUser;
 
+    public sealed record StateRestored(ScriptedAlarmActorState State, string? LastAckUser);
+
+    public static Props Props(
+        AlarmConfig config,
+        IScriptedAlarmEvaluator? evaluator = null,
+        Func<DPSPublisher>? publisherFactory = null,
+        IAlarmActorStateStore? stateStore = null) =>
+        Akka.Actor.Props.Create(() => new ScriptedAlarmActor(
+            config,
+            evaluator ?? NullScriptedAlarmEvaluator.Instance,
+            publisherFactory,
+            stateStore ?? NullAlarmActorStateStore.Instance));
+
+    /// <summary>Legacy single-arg ctor kept for callers that only care about the state machine
+    /// (no engine evaluation, no DPS fan-out, no persistence). Equivalent to <c>Props(new AlarmConfig(...))</c>.</summary>
     public static Props Props(string alarmId) =>
-        Akka.Actor.Props.Create(() => new ScriptedAlarmActor(alarmId));
+        Props(new AlarmConfig(alarmId, alarmId, EquipmentPath: "", Severity: 500, Predicate: null));
 
-    public ScriptedAlarmActor(string alarmId)
+    public ScriptedAlarmActor(
+        AlarmConfig config,
+        IScriptedAlarmEvaluator evaluator,
+        Func<DPSPublisher>? publisherFactory,
+        IAlarmActorStateStore stateStore)
     {
-        _alarmId = alarmId;
+        _config = config;
+        _evaluator = evaluator;
+        _publisherFactory = publisherFactory;
+        _stateStore = stateStore;
 
-        Receive<ConditionMet>(msg =>
+        Receive<DependencyValueChanged>(OnDependencyChanged);
+        Receive<ConditionMet>(_ => { if (_state == ScriptedAlarmActorState.Inactive) Transition(ScriptedAlarmActorState.Active, user: "system"); });
+        Receive<AcknowledgeAlarm>(msg => { if (_state == ScriptedAlarmActorState.Active) Transition(ScriptedAlarmActorState.Acknowledged, user: msg.Actor); });
+        Receive<ConditionCleared>(_ => { if (_state != ScriptedAlarmActorState.Inactive) Transition(ScriptedAlarmActorState.Inactive, user: "system"); });
+        Receive<StateRestored>(OnStateRestored);
+    }
+
+    protected override void PreStart()
+    {
+        // Load persisted state — when the store has a row, restore in-memory state before the
+        // first dependency-change arrives. Async I/O is piped back as StateRestored so we don't
+        // block the message-loop thread; until it arrives the actor stays at the default Inactive.
+        var self = Self;
+        _ = Task.Run(async () =>
         {
-            if (_state != ScriptedAlarmActorState.Inactive) return;
-            Transition(ScriptedAlarmActorState.Active);
-        });
-        Receive<AcknowledgeAlarm>(msg =>
-        {
-            if (_state != ScriptedAlarmActorState.Active) return;
-            Transition(ScriptedAlarmActorState.Acknowledged);
-        });
-        Receive<ConditionCleared>(_ =>
-        {
-            if (_state == ScriptedAlarmActorState.Inactive) return;
-            Transition(ScriptedAlarmActorState.Inactive);
+            try
+            {
+                var snapshot = await _stateStore.LoadAsync(_config.AlarmId, CancellationToken.None)
+                    .ConfigureAwait(false);
+                if (snapshot is null) return;
+                if (!Enum.TryParse<ScriptedAlarmActorState>(snapshot.State, ignoreCase: true, out var parsed))
+                    return;
+                self.Tell(new StateRestored(parsed, snapshot.LastAckUser));
+            }
+            catch (Exception ex)
+            {
+                _log.Warning(ex, "ScriptedAlarm {Id}: state-store load failed; booting Inactive",
+                    _config.AlarmId);
+            }
         });
     }
 
-    private void Transition(ScriptedAlarmActorState next)
+    private void OnStateRestored(StateRestored msg)
+    {
+        // Active is re-derived from the evaluator at the next DependencyValueChanged — we still
+        // restore Active here so operators don't lose the in-flight transition if a restart races
+        // ahead of the next eval. The first evaluator tick will correct it if the condition cleared.
+        _state = msg.State;
+        _lastAckUser = msg.LastAckUser;
+        _log.Info("ScriptedAlarm {Id}: restored persisted state {State} (lastAck={User})",
+            _config.AlarmId, _state, _lastAckUser ?? "(none)");
+    }
+
+    private void OnDependencyChanged(DependencyValueChanged msg)
+    {
+        _dependencies[msg.TagId] = msg.Value;
+
+        if (string.IsNullOrEmpty(_config.Predicate)) return;
+
+        ScriptedAlarmEvalResult result;
+        try
+        {
+            result = _evaluator.Evaluate(_config.AlarmId, _config.Predicate, _dependencies);
+        }
+        catch (Exception ex)
+        {
+            _log.Warning(ex, "ScriptedAlarm {Id}: evaluator threw", _config.AlarmId);
+            PublishLog("Error", $"evaluator threw: {ex.Message}");
+            return;
+        }
+
+        if (!result.Success)
+        {
+            PublishLog("Warning", result.Reason ?? "evaluator failure");
+            return;
+        }
+
+        // Active condition wins regardless of ack state — re-firing is suppressed because
+        // _state already == Active. Cleared moves Active OR Acknowledged → Inactive.
+        if (result.Active && _state == ScriptedAlarmActorState.Inactive)
+        {
+            Transition(ScriptedAlarmActorState.Active, user: "system");
+        }
+        else if (!result.Active && _state != ScriptedAlarmActorState.Inactive)
+        {
+            Transition(ScriptedAlarmActorState.Inactive, user: "system");
+        }
+    }
+
+    private void Transition(ScriptedAlarmActorState next, string user)
     {
         var prev = _state;
         _state = next;
-        _log.Info("ScriptedAlarm {Id}: {From} → {To}", _alarmId, prev, next);
-        Context.Parent.Tell(new StateChanged(_alarmId, next, DateTime.UtcNow));
-        // F9: emit history row via HistorianAdapter; persist state to ScriptedAlarmState DB.
+        if (next == ScriptedAlarmActorState.Acknowledged) _lastAckUser = user;
+        _log.Info("ScriptedAlarm {Id}: {From} → {To}", _config.AlarmId, prev, next);
+
+        var nowUtc = DateTime.UtcNow;
+        Context.Parent.Tell(new StateChanged(_config.AlarmId, next, nowUtc));
+        PersistStateAsync(nowUtc);
+
+        var kind = next switch
+        {
+            ScriptedAlarmActorState.Active => "Activated",
+            ScriptedAlarmActorState.Acknowledged => "Acknowledged",
+            ScriptedAlarmActorState.Inactive => "Cleared",
+            _ => next.ToString(),
+        };
+
+        OtOpcUaTelemetry.ScriptedAlarmTransition.Add(1,
+            new KeyValuePair<string, object?>("state", kind.ToLowerInvariant()));
+
+        var evt = new AlarmTransitionEvent(
+            AlarmId: _config.AlarmId,
+            EquipmentPath: _config.EquipmentPath,
+            AlarmName: _config.AlarmName,
+            TransitionKind: kind,
+            Severity: _config.Severity,
+            Message: $"{_config.AlarmName} {kind}",
+            User: user,
+            TimestampUtc: nowUtc);
+
+        PublishOrFallback(AlertsTopic, evt);
+        PublishLog("Information", $"{_config.AlarmName} {kind} (by {user})");
+    }
+
+    private void PublishLog(string level, string message)
+    {
+        var entry = new ScriptLogEntry(
+            ScriptId: _config.AlarmId,
+            Level: level,
+            Message: message,
+            TimestampUtc: DateTime.UtcNow,
+            VirtualTagId: null,
+            AlarmId: _config.AlarmId,
+            EquipmentId: null);
+        PublishOrFallback(ScriptLogsTopic, entry);
+    }
+
+    private void PublishOrFallback(string topic, object payload)
+    {
+        if (_publisherFactory is not null)
+        {
+            _publisherFactory().Publish(topic, payload);
+            return;
+        }
+        DistributedPubSub.Get(Context.System).Mediator.Tell(new Publish(topic, payload));
+    }
+
+    private void PersistStateAsync(DateTime nowUtc)
+    {
+        var snapshot = new AlarmActorStateSnapshot(
+            AlarmId: _config.AlarmId,
+            State: _state.ToString(),
+            LastTransitionUtc: nowUtc,
+            LastAckUser: _lastAckUser);
+
+        // Fire-and-forget. Save failures get logged but don't block the message loop —
+        // the worst case is a restart loses one transition, which then re-derives from
+        // the evaluator's next tick anyway.
+        _ = Task.Run(async () =>
+        {
+            try
+            {
+                await _stateStore.SaveAsync(snapshot, CancellationToken.None).ConfigureAwait(false);
+            }
+            catch (Exception ex)
+            {
+                _log.Warning(ex, "ScriptedAlarm {Id}: state-store save failed", _config.AlarmId);
+            }
+        });
     }
 }

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/ServiceCollectionExtensions.cs

@@ -3,12 +3,19 @@ using Akka.Hosting;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.DependencyInjection.Extensions;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
 using ZB.MOM.WW.OtOpcUa.Commons.Interfaces;
+using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
 using ZB.MOM.WW.OtOpcUa.Configuration;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
 using ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian;
+using ZB.MOM.WW.OtOpcUa.OpcUaServer;
 using ZB.MOM.WW.OtOpcUa.Runtime.Drivers;
 using ZB.MOM.WW.OtOpcUa.Runtime.Health;
 using ZB.MOM.WW.OtOpcUa.Runtime.Historian;
+using ZB.MOM.WW.OtOpcUa.Runtime.OpcUa;
+using ZB.MOM.WW.OtOpcUa.Runtime.VirtualTags;
 
 namespace ZB.MOM.WW.OtOpcUa.Runtime;
 
@@ -19,6 +26,8 @@ public static class ServiceCollectionExtensions
     public const string DriverHostActorName = "driver-host";
     public const string DbHealthProbeActorName = "db-health";
     public const string HistorianAdapterActorName = "historian-adapter";
+    public const string DependencyMuxActorName = "dependency-mux";
+    public const string OpcUaPublishActorName = "opcua-publish";
 
     /// <summary>
     /// Registers shared runtime services. Currently binds <see cref="IAlarmHistorianSink"/>
@@ -29,6 +38,9 @@ public static class ServiceCollectionExtensions
     public static IServiceCollection AddOtOpcUaRuntime(this IServiceCollection services)
     {
         services.TryAddSingleton<IAlarmHistorianSink>(NullAlarmHistorianSink.Instance);
+        services.TryAddSingleton<IDriverFactory>(NullDriverFactory.Instance);
+        services.TryAddSingleton<IOpcUaAddressSpaceSink>(NullOpcUaAddressSpaceSink.Instance);
+        services.TryAddSingleton<IServiceLevelPublisher>(NullServiceLevelPublisher.Instance);
         return services;
     }
 
@@ -50,20 +62,59 @@ public static class ServiceCollectionExtensions
     /// </summary>
     public static AkkaConfigurationBuilder WithOtOpcUaRuntimeActors(this AkkaConfigurationBuilder builder)
     {
+        // Production cluster HOCON (akka.conf) carries this dispatcher block, but consumers that
+        // bootstrap their own HOCON (e.g. ServiceCollectionExtensionsTests) wouldn't pick it up
+        // — OpcUaPublishActor.Props pins itself to opcua-synchronized-dispatcher and Akka throws
+        // ConfigurationException if it doesn't exist. Prepend a fallback so the runtime extension
+        // is self-contained.
+        builder.AddHocon(@"
+            opcua-synchronized-dispatcher {
+                type = ""PinnedDispatcher""
+                executor = ""thread-pool-executor""
+                throughput = 1
+            }
+        ", HoconAddMode.Prepend);
+
         builder.WithActors((system, registry, resolver) =>
         {
             var dbFactory = resolver.GetService<IDbContextFactory<OtOpcUaConfigDbContext>>();
             var roleInfo = resolver.GetService<IClusterRoleInfo>();
-            // Fallback to NullAlarmHistorianSink if AddOtOpcUaRuntime wasn't called (e.g., test harnesses).
+            // Fallback to Null* if AddOtOpcUaRuntime wasn't called (e.g., test harnesses).
             var historianSink = resolver.GetService<IAlarmHistorianSink>() ?? NullAlarmHistorianSink.Instance;
+            var driverFactory = resolver.GetService<IDriverFactory>() ?? NullDriverFactory.Instance;
+            var addressSpaceSink = resolver.GetService<IOpcUaAddressSpaceSink>() ?? NullOpcUaAddressSpaceSink.Instance;
+            var serviceLevel = resolver.GetService<IServiceLevelPublisher>() ?? NullServiceLevelPublisher.Instance;
+            var loggerFactory = resolver.GetService<ILoggerFactory>() ?? NullLoggerFactory.Instance;
 
             var dbHealth = system.ActorOf(
                 DbHealthProbeActor.Props(dbFactory),
                 DbHealthProbeActorName);
             registry.Register<DbHealthProbeActorKey>(dbHealth);
 
+            // Dependency mux must be spawned before DriverHostActor so the host can forward
+            // AttributeValuePublished into it from the very first driver spawn.
+            var mux = system.ActorOf(DependencyMuxActor.Props(), DependencyMuxActorName);
+            registry.Register<DependencyMuxActorKey>(mux);
+
+            // OPC UA publish actor — pinned dispatcher, owns the address-space side of the
+            // pipeline. Phase7Applier is constructed here so the actor + applier share the
+            // same sink reference (when DeferredAddressSpaceSink swaps later, both see it).
+            var applier = new Phase7Applier(addressSpaceSink, loggerFactory.CreateLogger<Phase7Applier>());
+            var publishActor = system.ActorOf(
+                OpcUaPublishActor.Props(
+                    sink: addressSpaceSink,
+                    serviceLevel: serviceLevel,
+                    localNode: roleInfo.LocalNode,
+                    dbFactory: dbFactory,
+                    applier: applier),
+                OpcUaPublishActorName);
+            registry.Register<OpcUaPublishActorKey>(publishActor);
+
             var driverHost = system.ActorOf(
-                DriverHostActor.Props(dbFactory, roleInfo.LocalNode),
+                DriverHostActor.Props(dbFactory, roleInfo.LocalNode, coordinator: null,
+                    driverFactory: driverFactory, localRoles: roleInfo.LocalRoles,
+                    dependencyMux: mux,
+                    opcUaPublishActor: publishActor),
                 DriverHostActorName);
             registry.Register<DriverHostActorKey>(driverHost);
 
@@ -81,3 +132,5 @@ public static class ServiceCollectionExtensions
 public sealed class DriverHostActorKey { }
 public sealed class DbHealthProbeActorKey { }
 public sealed class HistorianAdapterActorKey { }
+public sealed class DependencyMuxActorKey { }
+public sealed class OpcUaPublishActorKey { }

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/VirtualTags/DependencyMuxActor.cs

@@ -0,0 +1,107 @@
+using Akka.Actor;
+using Akka.Event;
+using ZB.MOM.WW.OtOpcUa.Runtime.Drivers;
+
+namespace ZB.MOM.WW.OtOpcUa.Runtime.VirtualTags;
+
+/// <summary>
+///     Per-node fan-out router from <see cref="DriverInstanceActor.AttributeValuePublished"/>
+///     to interested <see cref="VirtualTagActor"/> instances. VirtualTagActor sends
+///     <see cref="RegisterInterest"/> on start-up listing the tag refs it depends on; the mux
+///     keeps a map of <c>tagRef → Set&lt;IActorRef&gt;</c> and on every AttributeValuePublished
+///     forwards a <see cref="VirtualTagActor.DependencyValueChanged"/> to each interested
+///     subscriber.
+///
+///     DriverHostActor forwards every <c>AttributeValuePublished</c> it receives from its
+///     DriverInstanceActor children to this mux (one mux per driver-role node). The mux is
+///     deliberately not a DPS subscriber — virtual-tag evaluation is local to each node and
+///     would over-emit if it spanned the cluster.
+/// </summary>
+public sealed class DependencyMuxActor : ReceiveActor
+{
+    public const string ActorName = "dependency-mux";
+
+    /// <summary>Register a subscriber's interest in a set of tag refs. Idempotent on re-register —
+    /// the second call replaces the prior interest set for that subscriber.</summary>
+    public sealed record RegisterInterest(IReadOnlyList<string> TagRefs, IActorRef Subscriber);
+
+    /// <summary>Unregister every interest held by <see cref="Subscriber"/>. Sent on PostStop by
+    /// the subscriber, or by Terminated handling when the mux watches.</summary>
+    public sealed record UnregisterInterest(IActorRef Subscriber);
+
+    private readonly Dictionary<string, HashSet<IActorRef>> _byRef = new(StringComparer.Ordinal);
+    private readonly Dictionary<IActorRef, HashSet<string>> _bySubscriber = new();
+    private readonly ILoggingAdapter _log = Context.GetLogger();
+
+    public static Props Props() => Akka.Actor.Props.Create<DependencyMuxActor>();
+
+    public DependencyMuxActor()
+    {
+        Receive<RegisterInterest>(OnRegister);
+        Receive<UnregisterInterest>(msg => RemoveSubscriber(msg.Subscriber));
+        Receive<DriverInstanceActor.AttributeValuePublished>(OnAttributeValuePublished);
+        Receive<Terminated>(msg => RemoveSubscriber(msg.ActorRef));
+    }
+
+    private void OnRegister(RegisterInterest msg)
+    {
+        // Replace any prior interest set so re-registers on actor restart don't leak old refs.
+        if (_bySubscriber.TryGetValue(msg.Subscriber, out var priorRefs))
+        {
+            foreach (var r in priorRefs)
+            {
+                if (_byRef.TryGetValue(r, out var set))
+                {
+                    set.Remove(msg.Subscriber);
+                    if (set.Count == 0) _byRef.Remove(r);
+                }
+            }
+        }
+
+        var refs = new HashSet<string>(msg.TagRefs, StringComparer.Ordinal);
+        _bySubscriber[msg.Subscriber] = refs;
+        foreach (var r in refs)
+        {
+            if (!_byRef.TryGetValue(r, out var set))
+            {
+                set = new HashSet<IActorRef>();
+                _byRef[r] = set;
+            }
+            set.Add(msg.Subscriber);
+        }
+        Context.Watch(msg.Subscriber);
+        _log.Debug("DependencyMux: subscriber {Sub} registered for {Count} refs", msg.Subscriber, refs.Count);
+    }
+
+    private void RemoveSubscriber(IActorRef subscriber)
+    {
+        if (!_bySubscriber.TryGetValue(subscriber, out var refs)) return;
+        foreach (var r in refs)
+        {
+            if (_byRef.TryGetValue(r, out var set))
+            {
+                set.Remove(subscriber);
+                if (set.Count == 0) _byRef.Remove(r);
+            }
+        }
+        _bySubscriber.Remove(subscriber);
+        Context.Unwatch(subscriber);
+        _log.Debug("DependencyMux: subscriber {Sub} removed", subscriber);
+    }
+
+    private void OnAttributeValuePublished(DriverInstanceActor.AttributeValuePublished msg)
+    {
+        if (!_byRef.TryGetValue(msg.FullReference, out var subscribers) || subscribers.Count == 0)
+        {
+            // No virtual tag cares about this ref — drop. Common in normal operation; the address
+            // space carries thousands of tags and only a fraction feed virtual-tag expressions.
+            return;
+        }
+        var dep = new VirtualTagActor.DependencyValueChanged(msg.FullReference, msg.Value, msg.TimestampUtc);
+        foreach (var sub in subscribers)
+        {
+            sub.Tell(dep);
+        }
+    }
+
+}

src/Server/ZB.MOM.WW.OtOpcUa.Runtime/VirtualTags/VirtualTagActor.cs

@@ -1,41 +1,158 @@
 using Akka.Actor;
+using Akka.Cluster.Tools.PublishSubscribe;
 using Akka.Event;
+using ZB.MOM.WW.OtOpcUa.Commons.Engines;
+using ZB.MOM.WW.OtOpcUa.Commons.Messages.Logging;
+using ZB.MOM.WW.OtOpcUa.Commons.Observability;
 using ZB.MOM.WW.OtOpcUa.Commons.Types;
 
 namespace ZB.MOM.WW.OtOpcUa.Runtime.VirtualTags;
 
 /// <summary>
 /// Wraps a single virtual-tag expression. Receives dependency-tag updates, recomputes the
-/// expression, and publishes the result to <c>OpcUaPublishActor</c>.
-///
-/// Engine wiring (compile expression via <c>VirtualTagEngine</c>, manage subscriptions,
-/// emit <c>AttributeValueUpdate</c>) is staged for follow-up F8. This skeleton compiles + has
-/// a basic message contract so DriverHostActor can spawn it as a child.
+/// expression via an injected <see cref="IVirtualTagEvaluator"/>, and emits an
+/// <see cref="EvaluationResult"/> to the parent (the publish actor) whenever the value
+/// actually changes. Script failures publish a Warning <see cref="ScriptLogEntry"/> on the
+/// <c>script-logs</c> DPS topic so operators see the diagnostic in the live tail.
 /// </summary>
 public sealed class VirtualTagActor : ReceiveActor
 {
+    public const string ScriptLogsTopic = "script-logs";
+
     public sealed record DependencyValueChanged(string TagId, object? Value, DateTime TimestampUtc);
     public sealed record EvaluationResult(string VirtualTagId, object? Value, DateTime TimestampUtc, CorrelationId Correlation);
 
     private readonly string _virtualTagId;
+    private readonly string _scriptId;
     private readonly string _expression;
+    private readonly IVirtualTagEvaluator _evaluator;
+    private readonly Func<DPSPublisher>? _publisherFactory;
+    private readonly IReadOnlyList<string> _dependencyRefs;
+    private readonly IActorRef? _mux;
     private readonly ILoggingAdapter _log = Context.GetLogger();
     private readonly Dictionary<string, object?> _dependencies = new(StringComparer.Ordinal);
 
-    public static Props Props(string virtualTagId, string expression) =>
-        Akka.Actor.Props.Create(() => new VirtualTagActor(virtualTagId, expression));
+    private bool _hasLastValue;
+    private object? _lastValue;
 
-    public VirtualTagActor(string virtualTagId, string expression)
+    public static Props Props(
+        string virtualTagId,
+        string expression,
+        IVirtualTagEvaluator? evaluator = null,
+        string? scriptId = null,
+        Func<DPSPublisher>? publisherFactory = null,
+        IReadOnlyList<string>? dependencyRefs = null,
+        IActorRef? mux = null) =>
+        Akka.Actor.Props.Create(() => new VirtualTagActor(
+            virtualTagId, expression,
+            evaluator ?? NullVirtualTagEvaluator.Instance,
+            scriptId ?? virtualTagId,
+            publisherFactory,
+            dependencyRefs ?? Array.Empty<string>(),
+            mux));
+
+    public VirtualTagActor(
+        string virtualTagId,
+        string expression,
+        IVirtualTagEvaluator evaluator,
+        string scriptId,
+        Func<DPSPublisher>? publisherFactory,
+        IReadOnlyList<string> dependencyRefs,
+        IActorRef? mux)
     {
         _virtualTagId = virtualTagId;
+        _scriptId = scriptId;
         _expression = expression;
+        _evaluator = evaluator;
+        _publisherFactory = publisherFactory;
+        _dependencyRefs = dependencyRefs;
+        _mux = mux;
 
-        Receive<DependencyValueChanged>(msg =>
+        Receive<DependencyValueChanged>(OnDependencyChanged);
+    }
+
+    protected override void PreStart()
+    {
+        if (_mux is not null && _dependencyRefs.Count > 0)
         {
-            _dependencies[msg.TagId] = msg.Value;
-            // Engine wiring (F8): VirtualTagEngine.Evaluate(_expression, _dependencies) → publish.
-            _log.Debug("VirtualTag {Id}: dependency {Tag}={Value} buffered (eval staged for F8)",
-                _virtualTagId, msg.TagId, msg.Value);
-        });
+            _mux.Tell(new DependencyMuxActor.RegisterInterest(_dependencyRefs, Self));
+        }
+    }
+
+    protected override void PostStop()
+    {
+        _mux?.Tell(new DependencyMuxActor.UnregisterInterest(Self));
+    }
+
+    private void OnDependencyChanged(DependencyValueChanged msg)
+    {
+        _dependencies[msg.TagId] = msg.Value;
+
+        VirtualTagEvalResult result;
+        try
+        {
+            result = _evaluator.Evaluate(_virtualTagId, _expression, _dependencies);
+        }
+        catch (Exception ex)
+        {
+            _log.Warning(ex, "VirtualTag {Id}: evaluator threw", _virtualTagId);
+            OtOpcUaTelemetry.VirtualTagEval.Add(1, new KeyValuePair<string, object?>("outcome", "fail"));
+            PublishLog("Error", $"evaluator threw: {ex.Message}");
+            return;
+        }
+
+        if (!result.Success)
+        {
+            OtOpcUaTelemetry.VirtualTagEval.Add(1, new KeyValuePair<string, object?>("outcome", "fail"));
+            PublishLog("Warning", result.Reason ?? "evaluator failure");
+            return;
+        }
+
+        // Skip no-change results. Real evaluator returns Ok(value); Null returns NoChange — both
+        // safe because Null never produces a fresh value.
+        if (ReferenceEquals(result, VirtualTagEvalResult.NoChange))
+        {
+            OtOpcUaTelemetry.VirtualTagEval.Add(1, new KeyValuePair<string, object?>("outcome", "skip"));
+            return;
+        }
+
+        if (_hasLastValue && Equals(_lastValue, result.Value))
+        {
+            OtOpcUaTelemetry.VirtualTagEval.Add(1, new KeyValuePair<string, object?>("outcome", "skip"));
+            return;
+        }
+
+        _hasLastValue = true;
+        _lastValue = result.Value;
+        OtOpcUaTelemetry.VirtualTagEval.Add(1, new KeyValuePair<string, object?>("outcome", "ok"));
+        var evalResult = new EvaluationResult(_virtualTagId, result.Value, msg.TimestampUtc, CorrelationId.NewId());
+        Context.Parent.Tell(evalResult);
+    }
+
+    private void PublishLog(string level, string message)
+    {
+        var entry = new ScriptLogEntry(
+            ScriptId: _scriptId,
+            Level: level,
+            Message: message,
+            TimestampUtc: DateTime.UtcNow,
+            VirtualTagId: _virtualTagId,
+            AlarmId: null,
+            EquipmentId: null);
+
+        if (_publisherFactory is not null)
+        {
+            _publisherFactory().Publish(ScriptLogsTopic, entry);
+            return;
+        }
+
+        DistributedPubSub.Get(Context.System).Mediator.Tell(new Publish(ScriptLogsTopic, entry));
     }
 }
+
+/// <summary>
+///     Thin seam for tests to capture DPS publishes without standing up a real cluster.
+///     Production never instantiates this directly — the actor falls through to
+///     <see cref="DistributedPubSub"/> when the factory is null.
+/// </summary>
+public sealed record DPSPublisher(Action<string, object> Publish);

src/Server/ZB.MOM.WW.OtOpcUa.Security/Endpoints/AuthEndpoints.cs

@@ -1,4 +1,5 @@
 using System.Security.Claims;
+using System.Text.Json;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.Cookies;
 using Microsoft.AspNetCore.Authorization;
@@ -12,13 +13,20 @@ namespace ZB.MOM.WW.OtOpcUa.Security.Endpoints;
 
 public static class AuthEndpoints
 {
+    /// <summary>JSON body schema for API-side login callers (kept stable for tests).</summary>
     public sealed record LoginRequest(string Username, string Password);
 
     public sealed record TokenResponse(string Token);
 
     public static IEndpointRouteBuilder MapOtOpcUaAuth(this IEndpointRouteBuilder app)
     {
-        app.MapPost("/auth/login", (Delegate)LoginAsync).AllowAnonymous();
+        // The login endpoint serves two callers with different ergonomics:
+        //   - Browser form POST (application/x-www-form-urlencoded) → redirect dance
+        //   - API JSON POST (application/json) → 204 / 401 / 503 status codes
+        // DisableAntiforgery: the login form is the entry point — anonymous by definition,
+        // no prior session, so XSRF doesn't apply. AllowAnonymous: override the
+        // AddOtOpcUaAuth fallback policy that would otherwise 401 the request.
+        app.MapPost("/auth/login", (Delegate)LoginAsync).AllowAnonymous().DisableAntiforgery();
         app.MapGet("/auth/ping", (Delegate)Ping).AllowAnonymous();
         app.MapPost("/auth/token", (Delegate)IssueToken).RequireAuthorization();
         app.MapPost("/auth/logout", (Delegate)LogoutAsync).RequireAuthorization();
@@ -26,15 +34,35 @@ public static class AuthEndpoints
     }
 
     private static async Task<IResult> LoginAsync(
-        LoginRequest request,
         HttpContext http,
         ILdapAuthService ldap,
         CancellationToken ct)
     {
+        var isForm = http.Request.HasFormContentType;
+        string username, password, returnUrl;
+
+        if (isForm)
+        {
+            var form = await http.Request.ReadFormAsync(ct);
+            username = form["username"].ToString();
+            password = form["password"].ToString();
+            returnUrl = form["returnUrl"].ToString();
+        }
+        else
+        {
+            var body = await JsonSerializer.DeserializeAsync<LoginRequest>(
+                http.Request.Body,
+                new JsonSerializerOptions(JsonSerializerDefaults.Web),
+                ct);
+            username = body?.Username ?? string.Empty;
+            password = body?.Password ?? string.Empty;
+            returnUrl = string.Empty;
+        }
+
         LdapAuthResult result;
         try
         {
-            result = await ldap.AuthenticateAsync(request.Username, request.Password, ct);
+            result = await ldap.AuthenticateAsync(username, password, ct);
         }
         catch (Exception)
         {
@@ -42,13 +70,20 @@ public static class AuthEndpoints
         }
 
         if (!result.Success)
-            return Results.Unauthorized();
+        {
+            if (!isForm) return Results.Unauthorized();
+
+            var qs = $"?error={Uri.EscapeDataString(result.Error ?? "Invalid credentials")}";
+            if (!string.IsNullOrWhiteSpace(returnUrl))
+                qs += $"&returnUrl={Uri.EscapeDataString(returnUrl)}";
+            return Results.Redirect("/login" + qs);
+        }
 
         var claims = new List<Claim>
         {
-            new(ClaimTypes.NameIdentifier, result.Username ?? request.Username),
-            new(JwtTokenService.UsernameClaimType, result.Username ?? request.Username),
-            new(JwtTokenService.DisplayNameClaimType, result.DisplayName ?? request.Username),
+            new(ClaimTypes.NameIdentifier, result.Username ?? username),
+            new(JwtTokenService.UsernameClaimType, result.Username ?? username),
+            new(JwtTokenService.DisplayNameClaimType, result.DisplayName ?? username),
         };
         foreach (var role in result.Roles)
             claims.Add(new Claim(ClaimTypes.Role, role));
@@ -57,7 +92,9 @@ public static class AuthEndpoints
         var principal = new ClaimsPrincipal(identity);
 
         await http.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, principal);
-        return Results.NoContent();
+
+        if (!isForm) return Results.NoContent();
+        return Results.Redirect(string.IsNullOrWhiteSpace(returnUrl) ? "/" : returnUrl);
     }
 
     private static IResult Ping(HttpContext http) =>

src/Server/ZB.MOM.WW.OtOpcUa.Security/Ldap/LdapAuthService.cs

@@ -22,6 +22,12 @@ public sealed class LdapAuthService(IOptions<LdapOptions> options, ILogger<LdapA
         if (string.IsNullOrWhiteSpace(password))
             return new(false, null, null, [], [], "Password is required");
 
+        if (_options.DevStubMode)
+        {
+            logger.LogWarning("LdapAuthService: DevStubMode bypass — accepting {User} without a real LDAP bind", username);
+            return new(true, username, username, ["dev"], ["FleetAdmin"], null);
+        }
+
         if (!_options.UseTls && !_options.AllowInsecureLdap)
             return new(false, null, username, [], [],
                 "Insecure LDAP is disabled. Enable UseTls or set AllowInsecureLdap for dev/test.");

src/Server/ZB.MOM.WW.OtOpcUa.Security/Ldap/LdapOptions.cs

@@ -17,6 +17,13 @@ public sealed class LdapOptions
     /// <summary>Dev-only escape hatch — must be <c>false</c> in production.</summary>
     public bool AllowInsecureLdap { get; set; }
 
+    /// <summary>
+    ///     Dev-only stub: when <c>true</c>, <see cref="LdapAuthService"/> bypasses the real LDAP
+    ///     bind and accepts any non-empty username/password, returning a single FleetAdmin role
+    ///     so the operator can navigate the full Admin UI. MUST be <c>false</c> in production.
+    /// </summary>
+    public bool DevStubMode { get; set; }
+
     public string SearchBase { get; set; } = "dc=lmxopcua,dc=local";
 
     /// <summary>

src/Server/ZB.MOM.WW.OtOpcUa.Security/ServiceCollectionExtensions.cs

@@ -43,7 +43,11 @@ public static class ServiceCollectionExtensions
         services.AddOptions<LdapOptions>().Bind(configuration.GetSection(LdapOptions.SectionName));
 
         services.AddSingleton<JwtTokenService>();
-        services.AddScoped<ILdapAuthService, LdapAuthService>();
+        // Singleton — LdapAuthService is stateless (creates an LdapConnection per call) and
+        // must be consumable by the Singleton LdapOpcUaUserAuthenticator on driver-role nodes.
+        // The driver-branch in Host/Program.cs registers the same way; consistent lifetime
+        // across both paths keeps ValidateScopes-on-Build clean.
+        services.AddSingleton<ILdapAuthService, LdapAuthService>();
 
         services.AddDataProtection()
             .PersistKeysToDbContext<OtOpcUaConfigDbContext>()

tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/FailoverDuringDeployTests.cs

@@ -14,7 +14,7 @@ namespace ZB.MOM.WW.OtOpcUa.Host.IntegrationTests;
 /// Failover scenarios layered on <see cref="TwoNodeClusterHarness"/> Stop/Restart primitives.
 /// Covers graceful node loss, rejoin on the same Akka port, and deployment under reduced membership.
 /// </summary>
-public sealed class FailoverScenarioTests
+public sealed class FailoverDuringDeployTests
 {
     private static CancellationToken Ct => TestContext.Current.CancellationToken;
 

tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/LdapOpcUaUserAuthenticatorTests.cs

@@ -0,0 +1,75 @@
+using Microsoft.Extensions.Logging.Abstractions;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Host.OpcUa;
+using ZB.MOM.WW.OtOpcUa.Security.Ldap;
+
+namespace ZB.MOM.WW.OtOpcUa.Host.IntegrationTests;
+
+/// <summary>
+/// F13c — verifies <see cref="LdapOpcUaUserAuthenticator"/> faithfully translates
+/// <see cref="ILdapAuthService"/> outcomes into <c>OpcUaUserAuthResult</c> and turns LDAP
+/// backend exceptions into a denial rather than letting them escape into the SDK.
+/// </summary>
+public sealed class LdapOpcUaUserAuthenticatorTests
+{
+    [Fact]
+    public async Task Authenticate_LDAP_success_returns_Allow_with_roles()
+    {
+        var ldap = new FakeLdap(new LdapAuthResult(true, "Alice", "alice", new[] { "configeditor" }, new[] { "ConfigEditor" }, null));
+        var sut = new LdapOpcUaUserAuthenticator(ldap, NullLogger<LdapOpcUaUserAuthenticator>.Instance);
+
+        var result = await sut.AuthenticateUserNameAsync("alice", "secret", CancellationToken.None);
+
+        result.Success.ShouldBeTrue();
+        result.DisplayName.ShouldBe("Alice");
+        result.Roles.ShouldBe(new[] { "ConfigEditor" });
+    }
+
+    [Fact]
+    public async Task Authenticate_LDAP_failure_returns_Deny_with_error_text()
+    {
+        var ldap = new FakeLdap(new LdapAuthResult(false, null, "mallory", Array.Empty<string>(), Array.Empty<string>(), "Invalid username or password"));
+        var sut = new LdapOpcUaUserAuthenticator(ldap, NullLogger<LdapOpcUaUserAuthenticator>.Instance);
+
+        var result = await sut.AuthenticateUserNameAsync("mallory", "wrong", CancellationToken.None);
+
+        result.Success.ShouldBeFalse();
+        result.Error.ShouldBe("Invalid username or password");
+    }
+
+    [Fact]
+    public async Task Authenticate_LDAP_exception_returns_backend_error_denial()
+    {
+        var ldap = new FakeLdap(_ => throw new InvalidOperationException("LDAP unreachable"));
+        var sut = new LdapOpcUaUserAuthenticator(ldap, NullLogger<LdapOpcUaUserAuthenticator>.Instance);
+
+        var result = await sut.AuthenticateUserNameAsync("anyone", "x", CancellationToken.None);
+
+        result.Success.ShouldBeFalse();
+        result.Error.ShouldNotBeNull();
+        result.Error.ShouldContain("backend");
+    }
+
+    [Fact]
+    public async Task Authenticate_falls_back_to_username_when_LDAP_omits_display_name()
+    {
+        var ldap = new FakeLdap(new LdapAuthResult(true, null, "alice", Array.Empty<string>(), new[] { "ReadOnly" }, null));
+        var sut = new LdapOpcUaUserAuthenticator(ldap, NullLogger<LdapOpcUaUserAuthenticator>.Instance);
+
+        var result = await sut.AuthenticateUserNameAsync("alice", "x", CancellationToken.None);
+
+        result.Success.ShouldBeTrue();
+        result.DisplayName.ShouldBe("alice");
+    }
+
+    private sealed class FakeLdap : ILdapAuthService
+    {
+        private readonly Func<string, LdapAuthResult> _handler;
+        public FakeLdap(LdapAuthResult fixed_) => _handler = _ => fixed_;
+        public FakeLdap(Func<string, LdapAuthResult> handler) => _handler = handler;
+
+        public Task<LdapAuthResult> AuthenticateAsync(string username, string password, CancellationToken ct = default)
+            => Task.FromResult(_handler(username));
+    }
+}

tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/RoslynScriptedAlarmEvaluatorTests.cs

@@ -0,0 +1,102 @@
+using Microsoft.Extensions.Logging.Abstractions;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Host.Engines;
+
+namespace ZB.MOM.WW.OtOpcUa.Host.IntegrationTests;
+
+/// <summary>
+/// F9b — verifies <see cref="RoslynScriptedAlarmEvaluator"/> compiles alarm predicates,
+/// returns the bool result on success, surfaces compile/runtime errors as Failure (so the
+/// actor preserves prior state), and rejects predicates that try to ctx.SetVirtualTag (the
+/// AlarmPredicateContext throws on writes — predicates must stay pure).
+/// </summary>
+public sealed class RoslynScriptedAlarmEvaluatorTests
+{
+    [Fact]
+    public void Evaluate_predicate_returning_true_reports_Active()
+    {
+        using var sut = new RoslynScriptedAlarmEvaluator(NullLogger<RoslynScriptedAlarmEvaluator>.Instance);
+
+        var result = sut.Evaluate(
+            alarmId: "alarm-hi",
+            predicate: "return (int)ctx.GetTag(\"temp\").Value > 100;",
+            dependencies: new Dictionary<string, object?> { ["temp"] = 150 });
+
+        result.Success.ShouldBeTrue(result.Reason);
+        result.Active.ShouldBeTrue();
+    }
+
+    [Fact]
+    public void Evaluate_predicate_returning_false_reports_Inactive()
+    {
+        using var sut = new RoslynScriptedAlarmEvaluator(NullLogger<RoslynScriptedAlarmEvaluator>.Instance);
+
+        var result = sut.Evaluate(
+            alarmId: "alarm-hi",
+            predicate: "return (int)ctx.GetTag(\"temp\").Value > 100;",
+            dependencies: new Dictionary<string, object?> { ["temp"] = 50 });
+
+        result.Success.ShouldBeTrue(result.Reason);
+        result.Active.ShouldBeFalse();
+    }
+
+    [Fact]
+    public void Evaluate_caches_compiled_predicate_across_calls()
+    {
+        using var sut = new RoslynScriptedAlarmEvaluator(NullLogger<RoslynScriptedAlarmEvaluator>.Instance);
+        const string predicate = "return (bool)ctx.GetTag(\"door_open\").Value;";
+
+        var first = sut.Evaluate("alarm-door", predicate, new Dictionary<string, object?> { ["door_open"] = true });
+        var second = sut.Evaluate("alarm-door", predicate, new Dictionary<string, object?> { ["door_open"] = false });
+
+        first.Active.ShouldBeTrue();
+        second.Active.ShouldBeFalse();
+    }
+
+    [Fact]
+    public void Evaluate_compile_error_returns_Failure()
+    {
+        using var sut = new RoslynScriptedAlarmEvaluator(NullLogger<RoslynScriptedAlarmEvaluator>.Instance);
+
+        var result = sut.Evaluate("alarm-bad", "this isn't C#;", new Dictionary<string, object?>());
+
+        result.Success.ShouldBeFalse();
+        result.Reason!.ShouldContain("compile");
+    }
+
+    [Fact]
+    public void Evaluate_predicate_writing_virtual_tag_returns_Failure()
+    {
+        using var sut = new RoslynScriptedAlarmEvaluator(NullLogger<RoslynScriptedAlarmEvaluator>.Instance);
+
+        // AlarmPredicateContext.SetVirtualTag throws — wrapper catches + reports as Failure.
+        var result = sut.Evaluate(
+            alarmId: "alarm-bad-write",
+            predicate: "ctx.SetVirtualTag(\"x\", 1); return true;",
+            dependencies: new Dictionary<string, object?>());
+
+        result.Success.ShouldBeFalse();
+        result.Reason!.ShouldContain("threw");
+    }
+
+    [Fact]
+    public void Evaluate_empty_predicate_returns_Failure()
+    {
+        using var sut = new RoslynScriptedAlarmEvaluator(NullLogger<RoslynScriptedAlarmEvaluator>.Instance);
+
+        sut.Evaluate("alarm-empty", "", new Dictionary<string, object?>()).Success.ShouldBeFalse();
+    }
+
+    [Fact]
+    public void Evaluate_after_dispose_returns_Failure()
+    {
+        var sut = new RoslynScriptedAlarmEvaluator(NullLogger<RoslynScriptedAlarmEvaluator>.Instance);
+        sut.Dispose();
+
+        var result = sut.Evaluate("alarm", "return true;", new Dictionary<string, object?>());
+
+        result.Success.ShouldBeFalse();
+        result.Reason!.ShouldContain("disposed");
+    }
+}

tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/RoslynVirtualTagEvaluatorTests.cs

@@ -0,0 +1,92 @@
+using Microsoft.Extensions.Logging.Abstractions;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Host.Engines;
+
+namespace ZB.MOM.WW.OtOpcUa.Host.IntegrationTests;
+
+/// <summary>
+/// F8b — verifies <see cref="RoslynVirtualTagEvaluator"/> compiles user expressions through
+/// the Core.Scripting sandbox, runs them against the dependency dictionary, caches the
+/// compiled assembly per source, and surfaces failures (compile error, sandbox violation,
+/// runtime throw) as <c>VirtualTagEvalResult.Failure</c> instead of propagating exceptions.
+/// </summary>
+public sealed class RoslynVirtualTagEvaluatorTests
+{
+    [Fact]
+    public void Evaluate_simple_addition_returns_summed_value()
+    {
+        using var sut = new RoslynVirtualTagEvaluator(NullLogger<RoslynVirtualTagEvaluator>.Instance);
+
+        var result = sut.Evaluate(
+            virtualTagId: "vt-sum",
+            expression: "return (int)ctx.GetTag(\"a\").Value + (int)ctx.GetTag(\"b\").Value;",
+            dependencies: new Dictionary<string, object?> { ["a"] = 10, ["b"] = 32 });
+
+        result.Success.ShouldBeTrue(result.Reason);
+        result.Value.ShouldBe(42);
+    }
+
+    [Fact]
+    public void Evaluate_caches_compiled_expression_across_calls()
+    {
+        using var sut = new RoslynVirtualTagEvaluator(NullLogger<RoslynVirtualTagEvaluator>.Instance);
+        const string expr = "return (int)ctx.GetTag(\"x\").Value * 2;";
+
+        var first = sut.Evaluate("vt-cache", expr, new Dictionary<string, object?> { ["x"] = 5 });
+        var second = sut.Evaluate("vt-cache", expr, new Dictionary<string, object?> { ["x"] = 7 });
+
+        first.Success.ShouldBeTrue(first.Reason);
+        first.Value.ShouldBe(10);
+        second.Success.ShouldBeTrue(second.Reason);
+        second.Value.ShouldBe(14);
+    }
+
+    [Fact]
+    public void Evaluate_compile_error_returns_Failure_with_reason()
+    {
+        using var sut = new RoslynVirtualTagEvaluator(NullLogger<RoslynVirtualTagEvaluator>.Instance);
+
+        var result = sut.Evaluate("vt-bad", "this is not valid C#;", new Dictionary<string, object?>());
+
+        result.Success.ShouldBeFalse();
+        result.Reason.ShouldNotBeNull();
+        result.Reason.ShouldContain("compile");
+    }
+
+    [Fact]
+    public void Evaluate_runtime_exception_returns_Failure_with_reason()
+    {
+        using var sut = new RoslynVirtualTagEvaluator(NullLogger<RoslynVirtualTagEvaluator>.Instance);
+
+        var result = sut.Evaluate(
+            virtualTagId: "vt-div0",
+            expression: "int a = 0; return 1 / a;",
+            dependencies: new Dictionary<string, object?>());
+
+        result.Success.ShouldBeFalse();
+        result.Reason.ShouldNotBeNull();
+        result.Reason.ShouldContain("threw");
+    }
+
+    [Fact]
+    public void Evaluate_empty_expression_returns_Failure()
+    {
+        using var sut = new RoslynVirtualTagEvaluator(NullLogger<RoslynVirtualTagEvaluator>.Instance);
+
+        sut.Evaluate("vt-empty", "", new Dictionary<string, object?>()).Success.ShouldBeFalse();
+        sut.Evaluate("vt-empty", "   ", new Dictionary<string, object?>()).Success.ShouldBeFalse();
+    }
+
+    [Fact]
+    public void Evaluate_after_dispose_returns_Failure()
+    {
+        var sut = new RoslynVirtualTagEvaluator(NullLogger<RoslynVirtualTagEvaluator>.Instance);
+        sut.Dispose();
+
+        var result = sut.Evaluate("vt", "return 1;", new Dictionary<string, object?>());
+
+        result.Success.ShouldBeFalse();
+        result.Reason!.ShouldContain("disposed");
+    }
+}

tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/DualEndpointTests.cs

@@ -0,0 +1,115 @@
+using System.Net;
+using System.Net.Sockets;
+using Microsoft.Extensions.Logging.Abstractions;
+using Opc.Ua;
+using Opc.Ua.Client;
+using Opc.Ua.Server;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.OpcUaServer;
+using ClientSession = Opc.Ua.Client.Session;
+
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests;
+
+/// <summary>
+/// Source plan Task 60 — closes the audit gap. Boots two real <see cref="StandardServer"/>
+/// instances on loopback, each configured with the other's <c>ApplicationUri</c> in
+/// <see cref="OpcUaApplicationHostOptions.PeerApplicationUris"/>. A real OPC UA client connects
+/// to Node A, reads <c>Server.ServerArray</c>, and asserts both URIs are visible — the
+/// warm-redundancy discovery contract clients depend on.
+/// </summary>
+public sealed class DualEndpointTests
+{
+    private const string NodeAUri = "urn:OtOpcUa.DualEndpoint.NodeA";
+    private const string NodeBUri = "urn:OtOpcUa.DualEndpoint.NodeB";
+
+    [Fact]
+    public async Task Client_reads_both_ApplicationUris_from_NodeA_ServerArray()
+    {
+        var pkiRootA = Path.Combine(Path.GetTempPath(), $"otopcua-pki-a-{Guid.NewGuid():N}");
+        var pkiRootB = Path.Combine(Path.GetTempPath(), $"otopcua-pki-b-{Guid.NewGuid():N}");
+        var portA = AllocateFreePort();
+        var portB = AllocateFreePort();
+
+        try
+        {
+            await using var nodeA = await StartNodeAsync(NodeAUri, portA, pkiRootA, peers: new[] { NodeBUri });
+            await using var nodeB = await StartNodeAsync(NodeBUri, portB, pkiRootB, peers: new[] { NodeAUri });
+
+            var serverArray = await ReadServerArrayAsync($"opc.tcp://127.0.0.1:{portA}/OtOpcUa");
+            serverArray.ShouldContain(NodeAUri);
+            serverArray.ShouldContain(NodeBUri);
+        }
+        finally
+        {
+            if (Directory.Exists(pkiRootA)) Directory.Delete(pkiRootA, recursive: true);
+            if (Directory.Exists(pkiRootB)) Directory.Delete(pkiRootB, recursive: true);
+        }
+    }
+
+    private static async Task<OpcUaApplicationHost> StartNodeAsync(
+        string applicationUri, int port, string pkiRoot, string[] peers)
+    {
+        var options = new OpcUaApplicationHostOptions
+        {
+            ApplicationName = applicationUri,
+            ApplicationUri = applicationUri,
+            OpcUaPort = port,
+            PublicHostname = "127.0.0.1",
+            PkiStoreRoot = pkiRoot,
+            EnabledSecurityProfiles = new List<OpcUaSecurityProfile> { OpcUaSecurityProfile.None },
+            AutoAcceptUntrustedClientCertificates = true,
+            PeerApplicationUris = peers,
+        };
+        var server = new StandardServer();
+        var host = new OpcUaApplicationHost(options, NullLogger<OpcUaApplicationHost>.Instance);
+        await host.StartAsync(server, CancellationToken.None);
+        return host;
+    }
+
+    private static async Task<string[]> ReadServerArrayAsync(string endpointUrl)
+    {
+        // SDK 1.5.374 sync-style session-open path — mirrors src/Client/.../DefaultSessionFactory.cs
+        // and DefaultApplicationConfigurationFactory.cs. The 1.5.378 telemetry/async overloads are
+        // not available at this pinned version.
+        var appConfig = new ApplicationConfiguration
+        {
+            ApplicationName = "OtOpcUa.DualEndpointClient",
+            ApplicationUri = $"urn:OtOpcUa.DualEndpointClient.{Guid.NewGuid():N}",
+            ApplicationType = ApplicationType.Client,
+            SecurityConfiguration = new SecurityConfiguration
+            {
+                ApplicationCertificate = new CertificateIdentifier(),
+                AutoAcceptUntrustedCertificates = true,
+            },
+            ClientConfiguration = new ClientConfiguration { DefaultSessionTimeout = 60_000 },
+        };
+        await appConfig.Validate(ApplicationType.Client);
+        appConfig.CertificateValidator.CertificateValidation += (_, e) => e.Accept = true;
+
+        var endpoint = CoreClientUtils.SelectEndpoint(appConfig, endpointUrl, useSecurity: false);
+        var endpointConfiguration = EndpointConfiguration.Create(appConfig);
+        var configuredEndpoint = new ConfiguredEndpoint(null, endpoint, endpointConfiguration);
+
+        using var session = await ClientSession.Create(
+            appConfig,
+            configuredEndpoint,
+            updateBeforeConnect: false,
+            sessionName: "DualEndpointTests",
+            sessionTimeout: 60_000,
+            identity: new UserIdentity(new AnonymousIdentityToken()),
+            preferredLocales: null);
+
+        var value = session.ReadValue(VariableIds.Server_ServerArray);
+        return (string[])value.Value;
+    }
+
+    private static int AllocateFreePort()
+    {
+        var listener = new TcpListener(IPAddress.Loopback, 0);
+        listener.Start();
+        var port = ((IPEndPoint)listener.LocalEndpoint).Port;
+        listener.Stop();
+        return port;
+    }
+}

tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.csproj

@@ -0,0 +1,37 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <IsPackable>false</IsPackable>
+        <IsTestProject>true</IsTestProject>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests</RootNamespace>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="xunit.v3"/>
+        <PackageReference Include="Shouldly"/>
+        <PackageReference Include="Microsoft.NET.Test.Sdk"/>
+        <!-- Pin to 1.5.374.126 to match the server src (OpcUaServer.csproj). Mixing transitive
+             Opc.Ua.Core across 1.5.374 / 1.5.378 produces a MissingMethodException at runtime
+             because ApplicationInstance.Start(ServerBase) (sync) was removed in 1.5.378 in
+             favour of StartAsync. Stays here until Opc.Ua.Server publishes 1.5.378.x. -->
+        <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Client" VersionOverride="1.5.374.126"/>
+        <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Configuration" VersionOverride="1.5.374.126"/>
+        <PackageReference Include="Microsoft.Extensions.Logging.Abstractions"/>
+        <PackageReference Include="xunit.runner.visualstudio">
+            <PrivateAssets>all</PrivateAssets>
+            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+        </PackageReference>
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\..\..\src\Server\ZB.MOM.WW.OtOpcUa.OpcUaServer\ZB.MOM.WW.OtOpcUa.OpcUaServer.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-h958-fxgg-g7w3"/>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-37gx-xxp4-5rgx"/>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-w3x6-4m5h-cxqf"/>
+    </ItemGroup>
+
+</Project>

tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/DeferredAddressSpaceSinkTests.cs

@@ -0,0 +1,79 @@
+using System.Collections.Concurrent;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
+
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests;
+
+public sealed class DeferredAddressSpaceSinkTests
+{
+    [Fact]
+    public void Default_inner_is_null_sink_so_calls_before_SetSink_are_safe()
+    {
+        var deferred = new DeferredAddressSpaceSink();
+
+        // No throw, no observable side effect.
+        deferred.WriteValue("x", 1, OpcUaQuality.Good, DateTime.UtcNow);
+        deferred.WriteAlarmState("a", true, false, DateTime.UtcNow);
+        deferred.RebuildAddressSpace();
+    }
+
+    [Fact]
+    public void Calls_after_SetSink_are_forwarded_to_the_inner()
+    {
+        var deferred = new DeferredAddressSpaceSink();
+        var inner = new RecordingSink();
+        deferred.SetSink(inner);
+
+        deferred.WriteValue("x", 42, OpcUaQuality.Good, DateTime.UtcNow);
+        deferred.WriteAlarmState("a-1", true, false, DateTime.UtcNow);
+        deferred.RebuildAddressSpace();
+
+        inner.Calls.ShouldBe(new[] { "WV:x", "WA:a-1", "RB" });
+    }
+
+    [Fact]
+    public void SetSink_to_null_reverts_to_null_sink()
+    {
+        var deferred = new DeferredAddressSpaceSink();
+        var inner = new RecordingSink();
+        deferred.SetSink(inner);
+        deferred.WriteValue("x", 1, OpcUaQuality.Good, DateTime.UtcNow);
+        inner.Calls.Count.ShouldBe(1);
+
+        deferred.SetSink(null);
+        deferred.WriteValue("y", 2, OpcUaQuality.Good, DateTime.UtcNow); // dropped
+        inner.Calls.Count.ShouldBe(1);
+    }
+
+    [Fact]
+    public void SetSink_can_swap_between_implementations()
+    {
+        var deferred = new DeferredAddressSpaceSink();
+        var first = new RecordingSink();
+        var second = new RecordingSink();
+
+        deferred.SetSink(first);
+        deferred.WriteValue("a", 1, OpcUaQuality.Good, DateTime.UtcNow);
+
+        deferred.SetSink(second);
+        deferred.WriteValue("b", 2, OpcUaQuality.Good, DateTime.UtcNow);
+
+        first.Calls.Single().ShouldBe("WV:a");
+        second.Calls.Single().ShouldBe("WV:b");
+    }
+
+    private sealed class RecordingSink : IOpcUaAddressSpaceSink
+    {
+        public ConcurrentQueue<string> CallQueue { get; } = new();
+        public List<string> Calls => CallQueue.ToList();
+
+        public void WriteValue(string nodeId, object? value, OpcUaQuality quality, DateTime sourceTimestampUtc)
+            => CallQueue.Enqueue($"WV:{nodeId}");
+        public void WriteAlarmState(string alarmNodeId, bool active, bool acknowledged, DateTime sourceTimestampUtc)
+            => CallQueue.Enqueue($"WA:{alarmNodeId}");
+        public void EnsureFolder(string folderNodeId, string? parentNodeId, string displayName)
+            => CallQueue.Enqueue($"EF:{folderNodeId}");
+        public void RebuildAddressSpace() => CallQueue.Enqueue("RB");
+    }
+}

tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/DeferredServiceLevelPublisherTests.cs

@@ -0,0 +1,48 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
+
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests;
+
+public sealed class DeferredServiceLevelPublisherTests
+{
+    [Fact]
+    public void Publish_before_SetInner_is_a_safe_noop()
+    {
+        var deferred = new DeferredServiceLevelPublisher();
+
+        Should.NotThrow(() => deferred.Publish(123));
+    }
+
+    [Fact]
+    public void Publish_after_SetInner_routes_to_the_inner()
+    {
+        var recording = new RecordingPublisher();
+        var deferred = new DeferredServiceLevelPublisher();
+        deferred.SetInner(recording);
+
+        deferred.Publish(200);
+
+        recording.LastValue.ShouldBe((byte)200);
+    }
+
+    [Fact]
+    public void SetInner_null_reverts_to_Null_publisher()
+    {
+        var recording = new RecordingPublisher();
+        var deferred = new DeferredServiceLevelPublisher();
+        deferred.SetInner(recording);
+        deferred.Publish(50);
+
+        deferred.SetInner(null);
+        deferred.Publish(99);
+
+        recording.LastValue.ShouldBe((byte)50, "writes after SetInner(null) must not reach the previous inner");
+    }
+
+    private sealed class RecordingPublisher : IServiceLevelPublisher
+    {
+        public byte? LastValue { get; private set; }
+        public void Publish(byte serviceLevel) => LastValue = serviceLevel;
+    }
+}

tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/OpcUaApplicationHostImpersonationTests.cs

@@ -0,0 +1,118 @@
+using Microsoft.Extensions.Logging.Abstractions;
+using Opc.Ua;
+using Opc.Ua.Server;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.OpcUaServer.Security;
+
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests;
+
+/// <summary>
+/// F13c — verifies the impersonation handler routes UserName tokens through
+/// <see cref="IOpcUaUserAuthenticator"/> and translates its result into the SDK's
+/// <see cref="ImpersonateEventArgs"/> shape (granted identity vs. rejection status).
+/// </summary>
+public sealed class OpcUaApplicationHostImpersonationTests
+{
+    private static readonly UserTokenPolicy UserNamePolicy = new(UserTokenType.UserName) { PolicyId = "username_basic256sha256" };
+    private static readonly UserTokenPolicy AnonPolicy = new(UserTokenType.Anonymous) { PolicyId = "anonymous" };
+
+    [Fact]
+    public void HandleImpersonation_username_success_sets_identity_and_no_validation_error()
+    {
+        var token = new UserNameIdentityToken { UserName = "alice", DecryptedPassword = "secret" };
+        var args = new ImpersonateEventArgs(token, UserNamePolicy, new EndpointDescription());
+        var authenticator = new RecordingAuthenticator(
+            OpcUaUserAuthResult.Allow("Alice", new[] { "ReadOnly", "WriteOperate" }));
+
+        OpcUaApplicationHost.HandleImpersonation(authenticator, args, NullLogger<object>.Instance);
+
+        args.Identity.ShouldNotBeNull();
+        args.IdentityValidationError.ShouldBeNull();
+        authenticator.LastUsername.ShouldBe("alice");
+        authenticator.LastPassword.ShouldBe("secret");
+    }
+
+    [Fact]
+    public void HandleImpersonation_username_denial_sets_validation_error_and_no_identity()
+    {
+        var token = new UserNameIdentityToken { UserName = "mallory", DecryptedPassword = "wrong" };
+        var args = new ImpersonateEventArgs(token, UserNamePolicy, new EndpointDescription());
+        var authenticator = new RecordingAuthenticator(OpcUaUserAuthResult.Deny("Invalid credentials"));
+
+        OpcUaApplicationHost.HandleImpersonation(authenticator, args, NullLogger<object>.Instance);
+
+        args.Identity.ShouldBeNull();
+        args.IdentityValidationError.Code.ShouldBe(StatusCodes.BadIdentityTokenRejected);
+        args.IdentityValidationError.LocalizedText.Text.ShouldContain("Invalid credentials");
+    }
+
+    [Fact]
+    public void HandleImpersonation_anonymous_token_falls_through_to_sdk_default()
+    {
+        var args = new ImpersonateEventArgs(new AnonymousIdentityToken(), AnonPolicy, new EndpointDescription());
+        var authenticator = new RecordingAuthenticator(OpcUaUserAuthResult.Allow("x", Array.Empty<string>()));
+
+        OpcUaApplicationHost.HandleImpersonation(authenticator, args, NullLogger<object>.Instance);
+
+        // Handler leaves anonymous tokens untouched — no identity, no validation error.
+        args.Identity.ShouldBeNull();
+        args.IdentityValidationError.ShouldBeNull();
+        authenticator.LastUsername.ShouldBeNull("anonymous tokens must not hit the authenticator");
+    }
+
+    [Fact]
+    public void HandleImpersonation_authenticator_throwing_results_in_rejection()
+    {
+        var token = new UserNameIdentityToken { UserName = "bob", DecryptedPassword = "x" };
+        var args = new ImpersonateEventArgs(token, UserNamePolicy, new EndpointDescription());
+        var authenticator = new ThrowingAuthenticator(new InvalidOperationException("LDAP unreachable"));
+
+        OpcUaApplicationHost.HandleImpersonation(authenticator, args, NullLogger<object>.Instance);
+
+        args.Identity.ShouldBeNull();
+        args.IdentityValidationError.Code.ShouldBe(StatusCodes.BadIdentityTokenRejected);
+    }
+
+    [Fact]
+    public void HandleImpersonation_null_username_treated_as_empty_string()
+    {
+        var token = new UserNameIdentityToken { UserName = null, DecryptedPassword = "abc" };
+        var args = new ImpersonateEventArgs(token, UserNamePolicy, new EndpointDescription());
+        var authenticator = new RecordingAuthenticator(OpcUaUserAuthResult.Deny("no user"));
+
+        OpcUaApplicationHost.HandleImpersonation(authenticator, args, NullLogger<object>.Instance);
+
+        authenticator.LastUsername.ShouldBe(string.Empty);
+    }
+
+    [Fact]
+    public async Task NullOpcUaUserAuthenticator_always_denies()
+    {
+        var result = await NullOpcUaUserAuthenticator.Instance
+            .AuthenticateUserNameAsync("anyone", "anything", CancellationToken.None);
+
+        result.Success.ShouldBeFalse();
+        result.Error.ShouldNotBeNull();
+        result.Roles.ShouldBeEmpty();
+    }
+
+    private sealed class RecordingAuthenticator(OpcUaUserAuthResult outcome) : IOpcUaUserAuthenticator
+    {
+        public string? LastUsername { get; private set; }
+        public string? LastPassword { get; private set; }
+
+        public Task<OpcUaUserAuthResult> AuthenticateUserNameAsync(string username, string password, CancellationToken ct)
+        {
+            LastUsername = username;
+            LastPassword = password;
+            return Task.FromResult(outcome);
+        }
+    }
+
+    private sealed class ThrowingAuthenticator(Exception ex) : IOpcUaUserAuthenticator
+    {
+        public Task<OpcUaUserAuthResult> AuthenticateUserNameAsync(string username, string password, CancellationToken ct)
+            => Task.FromException<OpcUaUserAuthResult>(ex);
+    }
+}

tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/OpcUaApplicationHostSecurityTests.cs

@@ -0,0 +1,157 @@
+using Microsoft.Extensions.Logging.Abstractions;
+using Opc.Ua;
+using Opc.Ua.Server;
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests;
+
+/// <summary>
+/// F13b — verifies <see cref="OpcUaApplicationHost"/> publishes one
+/// <see cref="ServerSecurityPolicy"/> per <see cref="OpcUaSecurityProfile"/> and emits both
+/// Anonymous and UserName <see cref="UserTokenPolicy"/> entries. The pure-builder tests run
+/// cross-platform without touching disk; the boot-verify test reuses the F13a PKI pattern.
+/// </summary>
+public sealed class OpcUaApplicationHostSecurityTests : IDisposable
+{
+    private static CancellationToken Ct => TestContext.Current.CancellationToken;
+
+    private readonly string _pkiRoot = Path.Combine(
+        Path.GetTempPath(),
+        $"otopcua-pki-{Guid.NewGuid():N}");
+
+    [Fact]
+    public void BuildSecurityPolicies_default_set_emits_all_three_baseline_profiles()
+    {
+        var policies = OpcUaApplicationHost.BuildSecurityPolicies(new[]
+        {
+            OpcUaSecurityProfile.None,
+            OpcUaSecurityProfile.Basic256Sha256Sign,
+            OpcUaSecurityProfile.Basic256Sha256SignAndEncrypt,
+        }).ToList();
+
+        policies.Count.ShouldBe(3);
+        policies[0].SecurityMode.ShouldBe(MessageSecurityMode.None);
+        policies[0].SecurityPolicyUri.ShouldBe(SecurityPolicies.None);
+        policies[1].SecurityMode.ShouldBe(MessageSecurityMode.Sign);
+        policies[1].SecurityPolicyUri.ShouldBe(SecurityPolicies.Basic256Sha256);
+        policies[2].SecurityMode.ShouldBe(MessageSecurityMode.SignAndEncrypt);
+        policies[2].SecurityPolicyUri.ShouldBe(SecurityPolicies.Basic256Sha256);
+    }
+
+    [Fact]
+    public void BuildSecurityPolicies_dedupes_repeated_profiles()
+    {
+        var policies = OpcUaApplicationHost.BuildSecurityPolicies(new[]
+        {
+            OpcUaSecurityProfile.Basic256Sha256SignAndEncrypt,
+            OpcUaSecurityProfile.Basic256Sha256SignAndEncrypt,
+            OpcUaSecurityProfile.None,
+        }).ToList();
+
+        policies.Count.ShouldBe(2);
+        policies[0].SecurityMode.ShouldBe(MessageSecurityMode.SignAndEncrypt);
+        policies[1].SecurityMode.ShouldBe(MessageSecurityMode.None);
+    }
+
+    [Fact]
+    public void BuildSecurityPolicies_empty_input_falls_back_to_none()
+    {
+        var policies = OpcUaApplicationHost.BuildSecurityPolicies(Array.Empty<OpcUaSecurityProfile>()).ToList();
+
+        policies.Count.ShouldBe(1);
+        policies[0].SecurityMode.ShouldBe(MessageSecurityMode.None);
+        policies[0].SecurityPolicyUri.ShouldBe(SecurityPolicies.None);
+    }
+
+    [Fact]
+    public void BuildUserTokenPolicies_emits_anonymous_and_username()
+    {
+        var tokens = OpcUaApplicationHost.BuildUserTokenPolicies().ToList();
+
+        tokens.Count.ShouldBe(2);
+        tokens.ShouldContain(t => t.TokenType == UserTokenType.Anonymous && t.PolicyId == "anonymous");
+        var userName = tokens.Single(t => t.TokenType == UserTokenType.UserName);
+        userName.PolicyId.ShouldBe("username_basic256sha256");
+        userName.SecurityPolicyUri.ShouldBe(SecurityPolicies.Basic256Sha256);
+    }
+
+    [Fact]
+    public async Task StartAsync_populates_ServerConfiguration_with_all_enabled_profiles()
+    {
+        await using var host = new OpcUaApplicationHost(
+            new OpcUaApplicationHostOptions
+            {
+                ApplicationName = "OtOpcUa.SecAll",
+                ApplicationUri = $"urn:OtOpcUa.SecAll:{Guid.NewGuid():N}",
+                OpcUaPort = AllocateFreePort(),
+                PublicHostname = "localhost",
+                PkiStoreRoot = _pkiRoot,
+                EnabledSecurityProfiles =
+                {
+                    OpcUaSecurityProfile.None,
+                    OpcUaSecurityProfile.Basic256Sha256Sign,
+                    OpcUaSecurityProfile.Basic256Sha256SignAndEncrypt,
+                },
+                AutoAcceptUntrustedClientCertificates = true,
+            },
+            NullLogger<OpcUaApplicationHost>.Instance);
+
+        await host.StartAsync(new StandardServer(), Ct);
+
+        var config = host.ApplicationInstance!.ApplicationConfiguration;
+        config.ServerConfiguration.SecurityPolicies.Count.ShouldBe(3);
+        config.ServerConfiguration.UserTokenPolicies.Count.ShouldBe(2);
+        config.SecurityConfiguration.AutoAcceptUntrustedCertificates.ShouldBeTrue();
+
+        var modes = config.ServerConfiguration.SecurityPolicies
+            .Select(p => p.SecurityMode)
+            .OrderBy(m => (int)m)
+            .ToArray();
+        modes.ShouldBe(new[] { MessageSecurityMode.None, MessageSecurityMode.Sign, MessageSecurityMode.SignAndEncrypt });
+    }
+
+    [Fact]
+    public async Task StartAsync_with_only_signandencrypt_omits_None_endpoint()
+    {
+        await using var host = new OpcUaApplicationHost(
+            new OpcUaApplicationHostOptions
+            {
+                ApplicationName = "OtOpcUa.SecHardened",
+                ApplicationUri = $"urn:OtOpcUa.SecHardened:{Guid.NewGuid():N}",
+                OpcUaPort = AllocateFreePort(),
+                PublicHostname = "localhost",
+                PkiStoreRoot = _pkiRoot,
+                EnabledSecurityProfiles = new List<OpcUaSecurityProfile> { OpcUaSecurityProfile.Basic256Sha256SignAndEncrypt },
+                AutoAcceptUntrustedClientCertificates = false,
+            },
+            NullLogger<OpcUaApplicationHost>.Instance);
+
+        await host.StartAsync(new StandardServer(), Ct);
+
+        var policies = host.ApplicationInstance!.ApplicationConfiguration.ServerConfiguration.SecurityPolicies;
+        policies.Count.ShouldBe(1);
+        policies[0].SecurityMode.ShouldBe(MessageSecurityMode.SignAndEncrypt);
+        policies[0].SecurityPolicyUri.ShouldBe(SecurityPolicies.Basic256Sha256);
+        host.ApplicationInstance.ApplicationConfiguration.SecurityConfiguration
+            .AutoAcceptUntrustedCertificates.ShouldBeFalse();
+    }
+
+    private static int AllocateFreePort()
+    {
+        using var listener = new System.Net.Sockets.TcpListener(System.Net.IPAddress.Loopback, 0);
+        listener.Start();
+        var port = ((System.Net.IPEndPoint)listener.LocalEndpoint).Port;
+        listener.Stop();
+        return port;
+    }
+
+    public void Dispose()
+    {
+        if (Directory.Exists(_pkiRoot))
+        {
+            try { Directory.Delete(_pkiRoot, recursive: true); }
+            catch { /* best-effort cleanup */ }
+        }
+    }
+}

tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/OpcUaApplicationHostServerArrayTests.cs

@@ -0,0 +1,59 @@
+using System.IO;
+using System.Net.Sockets;
+using System.Net;
+using Microsoft.Extensions.Logging.Abstractions;
+using Opc.Ua;
+using Opc.Ua.Server;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.OpcUaServer;
+
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests;
+
+/// <summary>
+/// Audit gap closeout — verifies <see cref="OpcUaApplicationHostOptions.PeerApplicationUris"/>
+/// is reflected in <c>Server.ServerArray</c> after start. Single-server in-process check; the
+/// cross-server visibility check lives in <c>OtOpcUa.OpcUaServer.IntegrationTests</c>.
+/// </summary>
+public sealed class OpcUaApplicationHostServerArrayTests
+{
+    [Fact]
+    public async Task ServerArray_contains_local_uri_and_configured_peers_after_start()
+    {
+        var pkiRoot = Path.Combine(Path.GetTempPath(), $"otopcua-pki-{Guid.NewGuid():N}");
+        try
+        {
+            var options = new OpcUaApplicationHostOptions
+            {
+                ApplicationName = "OtOpcUa.UnitTest",
+                ApplicationUri = "urn:OtOpcUa.UnitTest.NodeA",
+                OpcUaPort = AllocateFreePort(),
+                PublicHostname = "127.0.0.1",
+                PkiStoreRoot = pkiRoot,
+                PeerApplicationUris = new[] { "urn:OtOpcUa.UnitTest.NodeB" },
+            };
+
+            var server = new StandardServer();
+            await using var host = new OpcUaApplicationHost(options, NullLogger<OpcUaApplicationHost>.Instance);
+            await host.StartAsync(server, CancellationToken.None);
+
+            var serverArray = server.CurrentInstance.ServerObject.ServerArray.Value;
+            serverArray.ShouldNotBeNull();
+            serverArray.ShouldContain("urn:OtOpcUa.UnitTest.NodeA");
+            serverArray.ShouldContain("urn:OtOpcUa.UnitTest.NodeB");
+        }
+        finally
+        {
+            if (Directory.Exists(pkiRoot)) Directory.Delete(pkiRoot, recursive: true);
+        }
+    }
+
+    private static int AllocateFreePort()
+    {
+        var listener = new TcpListener(IPAddress.Loopback, 0);
+        listener.Start();
+        var port = ((IPEndPoint)listener.LocalEndpoint).Port;
+        listener.Stop();
+        return port;
+    }
+}

tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/Phase7ApplierHierarchyTests.cs

@@ -0,0 +1,135 @@
+using System.Collections.Concurrent;
+using Microsoft.Extensions.Logging.Abstractions;
+using Opc.Ua.Server;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
+
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests;
+
+/// <summary>
+/// #85 — verifies <see cref="Phase7Applier.MaterialiseHierarchy"/> builds the UNS
+/// Area/Line/Equipment folder tree through <see cref="IOpcUaAddressSpaceSink.EnsureFolder"/>.
+/// One pure unit test (recording sink) confirms ordering + parenting; one boot-verify test
+/// drives a real <see cref="OtOpcUaNodeManager"/> and inspects the resulting predefined-node
+/// count to prove the folders land in the SDK address space.
+/// </summary>
+public sealed class Phase7ApplierHierarchyTests : IDisposable
+{
+    private static CancellationToken Ct => TestContext.Current.CancellationToken;
+
+    private readonly string _pkiRoot = Path.Combine(
+        Path.GetTempPath(),
+        $"otopcua-pki-{Guid.NewGuid():N}");
+
+    [Fact]
+    public void MaterialiseHierarchy_creates_areas_then_lines_then_equipment_with_correct_parents()
+    {
+        var sink = new RecordingFolderSink();
+        var applier = new Phase7Applier(sink, NullLogger<Phase7Applier>.Instance);
+
+        var composition = new Phase7CompositionResult(
+            UnsAreas: new[] { new UnsAreaProjection("area-1", "Plant North") },
+            UnsLines: new[] { new UnsLineProjection("line-1", "area-1", "Cell A") },
+            EquipmentNodes: new[] { new EquipmentNode("eq-1", "Pump-1", "line-1") },
+            DriverInstancePlans: Array.Empty<DriverInstancePlan>(),
+            ScriptedAlarmPlans: Array.Empty<ScriptedAlarmPlan>());
+
+        applier.MaterialiseHierarchy(composition);
+
+        var calls = sink.Calls;
+        calls.Count.ShouldBe(3);
+        calls[0].ShouldBe(("area-1", null, "Plant North"));
+        calls[1].ShouldBe(("line-1", "area-1", "Cell A"));
+        calls[2].ShouldBe(("eq-1", "line-1", "Pump-1"));
+    }
+
+    [Fact]
+    public void MaterialiseHierarchy_orphan_equipment_hangs_under_root()
+    {
+        var sink = new RecordingFolderSink();
+        var applier = new Phase7Applier(sink, NullLogger<Phase7Applier>.Instance);
+
+        var composition = new Phase7CompositionResult(
+            UnsAreas: Array.Empty<UnsAreaProjection>(),
+            UnsLines: Array.Empty<UnsLineProjection>(),
+            EquipmentNodes: new[] { new EquipmentNode("eq-orphan", "Orphan", UnsLineId: "") },
+            DriverInstancePlans: Array.Empty<DriverInstancePlan>(),
+            ScriptedAlarmPlans: Array.Empty<ScriptedAlarmPlan>());
+
+        applier.MaterialiseHierarchy(composition);
+
+        sink.Calls.Single().ShouldBe(("eq-orphan", null, "Orphan"));
+    }
+
+    [Fact]
+    public async Task MaterialiseHierarchy_against_real_SDK_node_manager_creates_folder_nodes()
+    {
+        await using var host = new OpcUaApplicationHost(
+            new OpcUaApplicationHostOptions
+            {
+                ApplicationName = "OtOpcUa.Hierarchy",
+                ApplicationUri = $"urn:OtOpcUa.Hierarchy:{Guid.NewGuid():N}",
+                OpcUaPort = AllocateFreePort(),
+                PublicHostname = "localhost",
+                PkiStoreRoot = _pkiRoot,
+            },
+            NullLogger<OpcUaApplicationHost>.Instance);
+
+        var sdkServer = new OtOpcUaSdkServer();
+        await host.StartAsync(sdkServer, Ct);
+        sdkServer.NodeManager.ShouldNotBeNull();
+
+        var sink = new SdkAddressSpaceSink(sdkServer.NodeManager!);
+        var applier = new Phase7Applier(sink, NullLogger<Phase7Applier>.Instance);
+
+        applier.MaterialiseHierarchy(new Phase7CompositionResult(
+            UnsAreas: new[] { new UnsAreaProjection("area-A", "Area A"), new UnsAreaProjection("area-B", "Area B") },
+            UnsLines: new[] { new UnsLineProjection("line-1", "area-A", "Line 1") },
+            EquipmentNodes: new[] { new EquipmentNode("eq-1", "Eq 1", "line-1"), new EquipmentNode("eq-2", "Eq 2", "line-1") },
+            DriverInstancePlans: Array.Empty<DriverInstancePlan>(),
+            ScriptedAlarmPlans: Array.Empty<ScriptedAlarmPlan>()));
+
+        sdkServer.NodeManager!.FolderCount.ShouldBe(5); // 2 areas + 1 line + 2 equipment
+
+        // Idempotent: re-applying with the same composition doesn't create duplicates.
+        applier.MaterialiseHierarchy(new Phase7CompositionResult(
+            UnsAreas: new[] { new UnsAreaProjection("area-A", "Area A"), new UnsAreaProjection("area-B", "Area B") },
+            UnsLines: new[] { new UnsLineProjection("line-1", "area-A", "Line 1") },
+            EquipmentNodes: new[] { new EquipmentNode("eq-1", "Eq 1", "line-1"), new EquipmentNode("eq-2", "Eq 2", "line-1") },
+            DriverInstancePlans: Array.Empty<DriverInstancePlan>(),
+            ScriptedAlarmPlans: Array.Empty<ScriptedAlarmPlan>()));
+
+        sdkServer.NodeManager!.FolderCount.ShouldBe(5);
+    }
+
+    private static int AllocateFreePort()
+    {
+        using var listener = new System.Net.Sockets.TcpListener(System.Net.IPAddress.Loopback, 0);
+        listener.Start();
+        var port = ((System.Net.IPEndPoint)listener.LocalEndpoint).Port;
+        listener.Stop();
+        return port;
+    }
+
+    public void Dispose()
+    {
+        if (Directory.Exists(_pkiRoot))
+        {
+            try { Directory.Delete(_pkiRoot, recursive: true); }
+            catch { /* best-effort */ }
+        }
+    }
+
+    private sealed class RecordingFolderSink : IOpcUaAddressSpaceSink
+    {
+        private readonly ConcurrentQueue<(string NodeId, string? Parent, string DisplayName)> _calls = new();
+        public List<(string NodeId, string? Parent, string DisplayName)> Calls => _calls.ToList();
+
+        public void WriteValue(string nodeId, object? value, OpcUaQuality quality, DateTime sourceTimestampUtc) { }
+        public void WriteAlarmState(string alarmNodeId, bool active, bool acknowledged, DateTime sourceTimestampUtc) { }
+        public void EnsureFolder(string folderNodeId, string? parentNodeId, string displayName)
+            => _calls.Enqueue((folderNodeId, parentNodeId, displayName));
+        public void RebuildAddressSpace() { }
+    }
+}

tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/Phase7ApplierTests.cs

@@ -0,0 +1,155 @@
+using System.Collections.Concurrent;
+using Microsoft.Extensions.Logging.Abstractions;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
+
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests;
+
+public sealed class Phase7ApplierTests
+{
+    [Fact]
+    public void Empty_plan_does_not_call_sink_and_does_not_trigger_rebuild()
+    {
+        var sink = new RecordingSink();
+        var applier = new Phase7Applier(sink, NullLogger<Phase7Applier>.Instance);
+
+        var outcome = applier.Apply(EmptyPlan);
+
+        outcome.RebuildCalled.ShouldBeFalse();
+        outcome.AddedNodes.ShouldBe(0);
+        outcome.RemovedNodes.ShouldBe(0);
+        outcome.ChangedNodes.ShouldBe(0);
+        sink.RebuildCalls.ShouldBe(0);
+        sink.AlarmWrites.ShouldBeEmpty();
+    }
+
+    [Fact]
+    public void Removed_equipment_writes_inactive_alarm_state_per_id_and_triggers_rebuild()
+    {
+        var sink = new RecordingSink();
+        var applier = new Phase7Applier(sink, NullLogger<Phase7Applier>.Instance);
+
+        var plan = WithEquipmentRemoval("eq-1", "eq-2");
+        var outcome = applier.Apply(plan);
+
+        outcome.RemovedNodes.ShouldBe(2);
+        outcome.RebuildCalled.ShouldBeTrue();
+        sink.AlarmWrites.Select(a => a.NodeId).OrderBy(x => x).ShouldBe(new[] { "eq-1", "eq-2" });
+        sink.AlarmWrites.All(a => a.Active == false && a.Acknowledged == false).ShouldBeTrue();
+        sink.RebuildCalls.ShouldBe(1);
+    }
+
+    [Fact]
+    public void Added_equipment_triggers_rebuild_without_alarm_writes()
+    {
+        var sink = new RecordingSink();
+        var applier = new Phase7Applier(sink, NullLogger<Phase7Applier>.Instance);
+
+        var plan = new Phase7Plan(
+            AddedEquipment: new[] { new EquipmentNode("new", "New", "line-1") },
+            RemovedEquipment: Array.Empty<EquipmentNode>(),
+            ChangedEquipment: Array.Empty<Phase7Plan.EquipmentDelta>(),
+            AddedDrivers: Array.Empty<DriverInstancePlan>(),
+            RemovedDrivers: Array.Empty<DriverInstancePlan>(),
+            ChangedDrivers: Array.Empty<Phase7Plan.DriverDelta>(),
+            AddedAlarms: Array.Empty<ScriptedAlarmPlan>(),
+            RemovedAlarms: Array.Empty<ScriptedAlarmPlan>(),
+            ChangedAlarms: Array.Empty<Phase7Plan.AlarmDelta>());
+
+        var outcome = applier.Apply(plan);
+
+        outcome.RebuildCalled.ShouldBeTrue();
+        outcome.AddedNodes.ShouldBe(1);
+        sink.AlarmWrites.ShouldBeEmpty();
+        sink.RebuildCalls.ShouldBe(1);
+    }
+
+    [Fact]
+    public void Driver_only_changes_do_not_trigger_address_space_rebuild()
+    {
+        var sink = new RecordingSink();
+        var applier = new Phase7Applier(sink, NullLogger<Phase7Applier>.Instance);
+
+        var plan = new Phase7Plan(
+            AddedEquipment: Array.Empty<EquipmentNode>(),
+            RemovedEquipment: Array.Empty<EquipmentNode>(),
+            ChangedEquipment: Array.Empty<Phase7Plan.EquipmentDelta>(),
+            AddedDrivers: new[] { new DriverInstancePlan("d-new", "Modbus", "{}") },
+            RemovedDrivers: Array.Empty<DriverInstancePlan>(),
+            ChangedDrivers: new[]
+            {
+                new Phase7Plan.DriverDelta(
+                    new DriverInstancePlan("d-1", "Modbus", "{\"v\":1}"),
+                    new DriverInstancePlan("d-1", "Modbus", "{\"v\":2}")),
+            },
+            AddedAlarms: Array.Empty<ScriptedAlarmPlan>(),
+            RemovedAlarms: Array.Empty<ScriptedAlarmPlan>(),
+            ChangedAlarms: Array.Empty<Phase7Plan.AlarmDelta>());
+
+        var outcome = applier.Apply(plan);
+
+        outcome.RebuildCalled.ShouldBeFalse();
+        sink.RebuildCalls.ShouldBe(0);
+    }
+
+    [Fact]
+    public void Sink_exception_in_WriteAlarmState_does_not_propagate_and_rebuild_still_fires()
+    {
+        var sink = new ThrowingSink(throwOnAlarmWrite: true);
+        var applier = new Phase7Applier(sink, NullLogger<Phase7Applier>.Instance);
+
+        var plan = WithEquipmentRemoval("eq-1");
+
+        var outcome = applier.Apply(plan); // should not throw
+        outcome.RemovedNodes.ShouldBe(1);
+        outcome.RebuildCalled.ShouldBeTrue();
+    }
+
+    private static Phase7Plan EmptyPlan => new(
+        Array.Empty<EquipmentNode>(), Array.Empty<EquipmentNode>(), Array.Empty<Phase7Plan.EquipmentDelta>(),
+        Array.Empty<DriverInstancePlan>(), Array.Empty<DriverInstancePlan>(), Array.Empty<Phase7Plan.DriverDelta>(),
+        Array.Empty<ScriptedAlarmPlan>(), Array.Empty<ScriptedAlarmPlan>(), Array.Empty<Phase7Plan.AlarmDelta>());
+
+    private static Phase7Plan WithEquipmentRemoval(params string[] ids) => new(
+        AddedEquipment: Array.Empty<EquipmentNode>(),
+        RemovedEquipment: ids.Select(id => new EquipmentNode(id, id, "line-1")).ToArray(),
+        ChangedEquipment: Array.Empty<Phase7Plan.EquipmentDelta>(),
+        AddedDrivers: Array.Empty<DriverInstancePlan>(),
+        RemovedDrivers: Array.Empty<DriverInstancePlan>(),
+        ChangedDrivers: Array.Empty<Phase7Plan.DriverDelta>(),
+        AddedAlarms: Array.Empty<ScriptedAlarmPlan>(),
+        RemovedAlarms: Array.Empty<ScriptedAlarmPlan>(),
+        ChangedAlarms: Array.Empty<Phase7Plan.AlarmDelta>());
+
+    private sealed class RecordingSink : IOpcUaAddressSpaceSink
+    {
+        public ConcurrentQueue<(string NodeId, bool Active, bool Acknowledged)> AlarmQueue { get; } = new();
+        public ConcurrentQueue<(string NodeId, string? Parent, string DisplayName)> FolderQueue { get; } = new();
+        public int RebuildCalls;
+
+        public List<(string NodeId, bool Active, bool Acknowledged)> AlarmWrites => AlarmQueue.ToList();
+        public List<(string NodeId, string? Parent, string DisplayName)> FolderCalls => FolderQueue.ToList();
+
+        public void WriteValue(string nodeId, object? value, OpcUaQuality quality, DateTime sourceTimestampUtc) { }
+        public void WriteAlarmState(string alarmNodeId, bool active, bool acknowledged, DateTime sourceTimestampUtc)
+            => AlarmQueue.Enqueue((alarmNodeId, active, acknowledged));
+        public void EnsureFolder(string folderNodeId, string? parentNodeId, string displayName)
+            => FolderQueue.Enqueue((folderNodeId, parentNodeId, displayName));
+        public void RebuildAddressSpace() => Interlocked.Increment(ref RebuildCalls);
+    }
+
+    private sealed class ThrowingSink : IOpcUaAddressSpaceSink
+    {
+        private readonly bool _throwOnAlarmWrite;
+        public ThrowingSink(bool throwOnAlarmWrite) { _throwOnAlarmWrite = throwOnAlarmWrite; }
+
+        public void WriteValue(string nodeId, object? value, OpcUaQuality quality, DateTime sourceTimestampUtc) { }
+        public void WriteAlarmState(string alarmNodeId, bool active, bool acknowledged, DateTime sourceTimestampUtc)
+        {
+            if (_throwOnAlarmWrite) throw new InvalidOperationException("simulated sink fault");
+        }
+        public void EnsureFolder(string folderNodeId, string? parentNodeId, string displayName) { }
+        public void RebuildAddressSpace() { }
+    }
+}

tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/Phase7PlannerTests.cs

@@ -0,0 +1,150 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests;
+
+public sealed class Phase7PlannerTests
+{
+    [Fact]
+    public void Empty_inputs_produce_empty_plan()
+    {
+        var prev = new Phase7CompositionResult(Array.Empty<EquipmentNode>(), Array.Empty<DriverInstancePlan>(), Array.Empty<ScriptedAlarmPlan>());
+        var next = prev;
+
+        var plan = Phase7Planner.Compute(prev, next);
+
+        plan.IsEmpty.ShouldBeTrue();
+    }
+
+    [Fact]
+    public void Identical_compositions_produce_empty_plan()
+    {
+        var eq = new EquipmentNode("eq-1", "Eq 1", "line-1");
+        var prev = new Phase7CompositionResult(new[] { eq }, Array.Empty<DriverInstancePlan>(), Array.Empty<ScriptedAlarmPlan>());
+        var next = new Phase7CompositionResult(new[] { eq }, Array.Empty<DriverInstancePlan>(), Array.Empty<ScriptedAlarmPlan>());
+
+        var plan = Phase7Planner.Compute(prev, next);
+
+        plan.IsEmpty.ShouldBeTrue();
+    }
+
+    [Fact]
+    public void New_equipment_goes_to_AddedEquipment()
+    {
+        var prev = new Phase7CompositionResult(Array.Empty<EquipmentNode>(), Array.Empty<DriverInstancePlan>(), Array.Empty<ScriptedAlarmPlan>());
+        var next = new Phase7CompositionResult(
+            new[] { new EquipmentNode("eq-1", "A", "line-1") },
+            Array.Empty<DriverInstancePlan>(),
+            Array.Empty<ScriptedAlarmPlan>());
+
+        var plan = Phase7Planner.Compute(prev, next);
+
+        plan.AddedEquipment.Single().EquipmentId.ShouldBe("eq-1");
+        plan.RemovedEquipment.ShouldBeEmpty();
+        plan.ChangedEquipment.ShouldBeEmpty();
+    }
+
+    [Fact]
+    public void Disappeared_equipment_goes_to_RemovedEquipment()
+    {
+        var prev = new Phase7CompositionResult(
+            new[] { new EquipmentNode("eq-1", "A", "line-1") },
+            Array.Empty<DriverInstancePlan>(),
+            Array.Empty<ScriptedAlarmPlan>());
+        var next = new Phase7CompositionResult(Array.Empty<EquipmentNode>(), Array.Empty<DriverInstancePlan>(), Array.Empty<ScriptedAlarmPlan>());
+
+        var plan = Phase7Planner.Compute(prev, next);
+
+        plan.RemovedEquipment.Single().EquipmentId.ShouldBe("eq-1");
+        plan.AddedEquipment.ShouldBeEmpty();
+    }
+
+    [Fact]
+    public void Same_id_with_different_display_name_routes_to_ChangedEquipment()
+    {
+        var prev = new Phase7CompositionResult(
+            new[] { new EquipmentNode("eq-1", "Old", "line-1") },
+            Array.Empty<DriverInstancePlan>(),
+            Array.Empty<ScriptedAlarmPlan>());
+        var next = new Phase7CompositionResult(
+            new[] { new EquipmentNode("eq-1", "New", "line-1") },
+            Array.Empty<DriverInstancePlan>(),
+            Array.Empty<ScriptedAlarmPlan>());
+
+        var plan = Phase7Planner.Compute(prev, next);
+
+        plan.ChangedEquipment.Single().Previous.DisplayName.ShouldBe("Old");
+        plan.ChangedEquipment.Single().Current.DisplayName.ShouldBe("New");
+        plan.AddedEquipment.ShouldBeEmpty();
+        plan.RemovedEquipment.ShouldBeEmpty();
+    }
+
+    [Fact]
+    public void Driver_config_change_routes_to_ChangedDrivers()
+    {
+        var prev = new Phase7CompositionResult(
+            Array.Empty<EquipmentNode>(),
+            new[] { new DriverInstancePlan("drv-1", "Modbus", "{\"host\":\"old\"}") },
+            Array.Empty<ScriptedAlarmPlan>());
+        var next = new Phase7CompositionResult(
+            Array.Empty<EquipmentNode>(),
+            new[] { new DriverInstancePlan("drv-1", "Modbus", "{\"host\":\"new\"}") },
+            Array.Empty<ScriptedAlarmPlan>());
+
+        var plan = Phase7Planner.Compute(prev, next);
+
+        plan.ChangedDrivers.Single().Current.ConfigJson.ShouldContain("new");
+    }
+
+    [Fact]
+    public void Alarm_message_template_change_routes_to_ChangedAlarms()
+    {
+        var prev = new Phase7CompositionResult(
+            Array.Empty<EquipmentNode>(),
+            Array.Empty<DriverInstancePlan>(),
+            new[] { new ScriptedAlarmPlan("a-1", "eq-1", "script-1", "old") });
+        var next = new Phase7CompositionResult(
+            Array.Empty<EquipmentNode>(),
+            Array.Empty<DriverInstancePlan>(),
+            new[] { new ScriptedAlarmPlan("a-1", "eq-1", "script-1", "new") });
+
+        var plan = Phase7Planner.Compute(prev, next);
+
+        plan.ChangedAlarms.Single().Current.MessageTemplate.ShouldBe("new");
+    }
+
+    [Fact]
+    public void Added_and_removed_lists_are_sorted_by_id_for_deterministic_ordering()
+    {
+        var prev = new Phase7CompositionResult(
+            new[] { new EquipmentNode("z", "Z", "line-1"), new EquipmentNode("a", "A", "line-1") },
+            Array.Empty<DriverInstancePlan>(),
+            Array.Empty<ScriptedAlarmPlan>());
+        var next = new Phase7CompositionResult(Array.Empty<EquipmentNode>(), Array.Empty<DriverInstancePlan>(), Array.Empty<ScriptedAlarmPlan>());
+
+        var plan = Phase7Planner.Compute(prev, next);
+
+        plan.RemovedEquipment.Select(e => e.EquipmentId).ShouldBe(new[] { "a", "z" });
+    }
+
+    [Fact]
+    public void Mixed_changes_across_all_three_classes_are_captured_in_one_pass()
+    {
+        var prev = new Phase7CompositionResult(
+            new[] { new EquipmentNode("eq-keep", "Keep", "line-1"), new EquipmentNode("eq-drop", "Drop", "line-1") },
+            new[] { new DriverInstancePlan("drv-keep", "Modbus", "{}"), new DriverInstancePlan("drv-change", "Modbus", "{\"v\":1}") },
+            new[] { new ScriptedAlarmPlan("a-keep", "eq-keep", "s1", "t1") });
+        var next = new Phase7CompositionResult(
+            new[] { new EquipmentNode("eq-keep", "Keep", "line-1"), new EquipmentNode("eq-new", "New", "line-1") },
+            new[] { new DriverInstancePlan("drv-keep", "Modbus", "{}"), new DriverInstancePlan("drv-change", "Modbus", "{\"v\":2}") },
+            new[] { new ScriptedAlarmPlan("a-keep", "eq-keep", "s1", "t1"), new ScriptedAlarmPlan("a-new", "eq-new", "s2", "t2") });
+
+        var plan = Phase7Planner.Compute(prev, next);
+
+        plan.AddedEquipment.Single().EquipmentId.ShouldBe("eq-new");
+        plan.RemovedEquipment.Single().EquipmentId.ShouldBe("eq-drop");
+        plan.ChangedEquipment.ShouldBeEmpty();
+        plan.ChangedDrivers.Single().Current.DriverInstanceId.ShouldBe("drv-change");
+        plan.AddedAlarms.Single().ScriptedAlarmId.ShouldBe("a-new");
+    }
+}

tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/SdkAddressSpaceSinkTests.cs

@@ -0,0 +1,119 @@
+using Microsoft.Extensions.Logging.Abstractions;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
+
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests;
+
+/// <summary>
+///     Integration tests for the F10b production binding: boot a real <see cref="OtOpcUaSdkServer"/>
+///     through <see cref="OpcUaApplicationHost"/>, attach a <see cref="SdkAddressSpaceSink"/>,
+///     drive <c>WriteValue</c>/<c>WriteAlarmState</c>/<c>RebuildAddressSpace</c>, and verify the
+///     <see cref="OtOpcUaNodeManager"/> reflects the writes.
+/// </summary>
+public sealed class SdkAddressSpaceSinkTests : IDisposable
+{
+    private static CancellationToken Ct => TestContext.Current.CancellationToken;
+
+    private readonly string _pkiRoot = Path.Combine(
+        Path.GetTempPath(),
+        $"otopcua-sink-{Guid.NewGuid():N}");
+
+    [Fact]
+    public async Task WriteValue_creates_and_updates_variable_in_node_manager()
+    {
+        var (host, server) = await BootAsync();
+        var sink = new SdkAddressSpaceSink(server.NodeManager!);
+
+        sink.WriteValue("eq-1/temp", 22.5, OpcUaQuality.Good, DateTime.UtcNow);
+        sink.WriteValue("eq-1/temp", 23.1, OpcUaQuality.Good, DateTime.UtcNow);
+        sink.WriteValue("eq-1/pressure", 100, OpcUaQuality.Uncertain, DateTime.UtcNow);
+
+        server.NodeManager!.VariableCount.ShouldBe(2);
+
+        await host.DisposeAsync();
+    }
+
+    [Fact]
+    public async Task WriteAlarmState_creates_dedicated_node_distinct_from_value_writes()
+    {
+        var (host, server) = await BootAsync();
+        var sink = new SdkAddressSpaceSink(server.NodeManager!);
+
+        sink.WriteAlarmState("alarm-7", active: true, acknowledged: false, DateTime.UtcNow);
+        sink.WriteValue("eq-1/temp", 22.5, OpcUaQuality.Good, DateTime.UtcNow);
+
+        server.NodeManager!.VariableCount.ShouldBe(2);
+
+        await host.DisposeAsync();
+    }
+
+    [Fact]
+    public async Task RebuildAddressSpace_clears_all_registered_variables()
+    {
+        var (host, server) = await BootAsync();
+        var sink = new SdkAddressSpaceSink(server.NodeManager!);
+
+        sink.WriteValue("a", 1, OpcUaQuality.Good, DateTime.UtcNow);
+        sink.WriteValue("b", 2, OpcUaQuality.Good, DateTime.UtcNow);
+        sink.WriteAlarmState("alarm-c", true, false, DateTime.UtcNow);
+        server.NodeManager!.VariableCount.ShouldBe(3);
+
+        sink.RebuildAddressSpace();
+        server.NodeManager.VariableCount.ShouldBe(0);
+
+        // After rebuild, subsequent writes start fresh.
+        sink.WriteValue("a", 99, OpcUaQuality.Good, DateTime.UtcNow);
+        server.NodeManager.VariableCount.ShouldBe(1);
+
+        await host.DisposeAsync();
+    }
+
+    [Fact]
+    public async Task NullOpcUaAddressSpaceSink_does_not_crash_on_any_call()
+    {
+        // Sanity check that the F10 fallback still works — production callers default to
+        // NullOpcUaAddressSpaceSink when no SDK NodeManager is wired.
+        var sink = NullOpcUaAddressSpaceSink.Instance;
+        sink.WriteValue("x", 1, OpcUaQuality.Good, DateTime.UtcNow);
+        sink.WriteAlarmState("a", true, false, DateTime.UtcNow);
+        sink.RebuildAddressSpace();
+        await Task.CompletedTask;
+    }
+
+    private async Task<(OpcUaApplicationHost Host, OtOpcUaSdkServer Server)> BootAsync()
+    {
+        var host = new OpcUaApplicationHost(
+            new OpcUaApplicationHostOptions
+            {
+                ApplicationName = "OtOpcUa.SinkTest",
+                ApplicationUri = $"urn:OtOpcUa.SinkTest:{Guid.NewGuid():N}",
+                OpcUaPort = AllocateFreePort(),
+                PublicHostname = "localhost",
+                PkiStoreRoot = _pkiRoot,
+            },
+            NullLogger<OpcUaApplicationHost>.Instance);
+
+        var server = new OtOpcUaSdkServer();
+        await host.StartAsync(server, Ct);
+        return (host, server);
+    }
+
+    private static int AllocateFreePort()
+    {
+        using var listener = new System.Net.Sockets.TcpListener(System.Net.IPAddress.Loopback, 0);
+        listener.Start();
+        var port = ((System.Net.IPEndPoint)listener.LocalEndpoint).Port;
+        listener.Stop();
+        return port;
+    }
+
+    public void Dispose()
+    {
+        if (Directory.Exists(_pkiRoot))
+        {
+            try { Directory.Delete(_pkiRoot, recursive: true); }
+            catch { /* best-effort cleanup */ }
+        }
+    }
+}

tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/SdkServiceLevelPublisherTests.cs

@@ -0,0 +1,94 @@
+using Microsoft.Extensions.Logging.Abstractions;
+using Opc.Ua.Server;
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests;
+
+/// <summary>
+/// #81 residual — verifies <see cref="SdkServiceLevelPublisher"/> locates the standard
+/// <c>VariableIds.Server_ServiceLevel</c> node through the SDK's DiagnosticsNodeManager and
+/// writes the byte value. Boots a real <see cref="StandardServer"/> on a free port so the
+/// SDK populates its predefined diagnostics nodes — that's what production sees.
+/// </summary>
+public sealed class SdkServiceLevelPublisherTests : IDisposable
+{
+    private static CancellationToken Ct => TestContext.Current.CancellationToken;
+
+    private readonly string _pkiRoot = Path.Combine(
+        Path.GetTempPath(),
+        $"otopcua-pki-{Guid.NewGuid():N}");
+
+    [Fact]
+    public async Task Publish_writes_value_to_Server_ServiceLevel_variable()
+    {
+        var server = new StandardServer();
+        await using var host = new OpcUaApplicationHost(
+            new OpcUaApplicationHostOptions
+            {
+                ApplicationName = "OtOpcUa.SvcLevel",
+                ApplicationUri = $"urn:OtOpcUa.SvcLevel:{Guid.NewGuid():N}",
+                OpcUaPort = AllocateFreePort(),
+                PublicHostname = "localhost",
+                PkiStoreRoot = _pkiRoot,
+            },
+            NullLogger<OpcUaApplicationHost>.Instance);
+
+        await host.StartAsync(server, Ct);
+
+        var publisher = new SdkServiceLevelPublisher(
+            server.CurrentInstance,
+            NullLogger<SdkServiceLevelPublisher>.Instance);
+
+        publisher.Publish(200);
+
+        var variable = server.CurrentInstance.ServerObject.ServiceLevel;
+        variable.ShouldNotBeNull("Server.ServiceLevel must be present in the address space");
+        variable.Value.ShouldBe((byte)200);
+    }
+
+    [Fact]
+    public async Task Publish_is_idempotent_when_called_multiple_times()
+    {
+        var server = new StandardServer();
+        await using var host = new OpcUaApplicationHost(
+            new OpcUaApplicationHostOptions
+            {
+                ApplicationName = "OtOpcUa.SvcLevel.Idem",
+                ApplicationUri = $"urn:OtOpcUa.SvcLevel.Idem:{Guid.NewGuid():N}",
+                OpcUaPort = AllocateFreePort(),
+                PublicHostname = "localhost",
+                PkiStoreRoot = _pkiRoot,
+            },
+            NullLogger<OpcUaApplicationHost>.Instance);
+
+        await host.StartAsync(server, Ct);
+        var publisher = new SdkServiceLevelPublisher(
+            server.CurrentInstance,
+            NullLogger<SdkServiceLevelPublisher>.Instance);
+
+        publisher.Publish(100);
+        publisher.Publish(150);
+        publisher.Publish(240);
+
+        server.CurrentInstance.ServerObject.ServiceLevel.Value.ShouldBe((byte)240);
+    }
+
+    private static int AllocateFreePort()
+    {
+        using var listener = new System.Net.Sockets.TcpListener(System.Net.IPAddress.Loopback, 0);
+        listener.Start();
+        var port = ((System.Net.IPEndPoint)listener.LocalEndpoint).Port;
+        listener.Stop();
+        return port;
+    }
+
+    public void Dispose()
+    {
+        if (Directory.Exists(_pkiRoot))
+        {
+            try { Directory.Delete(_pkiRoot, recursive: true); }
+            catch { /* best-effort */ }
+        }
+    }
+}