feat(worker): route alarm acks through the operator-authenticated AckMsg writer

AlarmCommandHandler -> AlarmDispatcher -> IAlarmAckWriter: the dispatcher resolves the ack item through the consumer and the writer authenticates the operator and writes the comment. The executor builds AlarmAckOperator from operator_user/domain/password, maps AlarmAckOutcome to the reply (Applied/Unconfirmed Ok, AlarmNotFound/NotAckable InvalidRequest, AuthenticationFailed/WriteRejected MxaccessFailure) and reports escaping exceptions by type and HRESULT only, so operator_password cannot leak. Removes the inert managed/WNAL alarm-client ack path.

Claude-Session: https://claude.ai/code/session_016J6isfcgqy4SB2RK3ZvFvT

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/AlarmDispatcher.cs

@@ -18,7 +18,9 @@ namespace ZB.MOM.WW.MxGateway.Worker.MxAccess;
 ///         worker's IPC layer issues <c>SubscribeAlarmsCommand</c> /
 ///         <c>AcknowledgeAlarmCommand</c> / <c>QueryActiveAlarmsCommand</c>
 ///         through <see cref="AlarmCommandHandler"/>, which owns one
-///         dispatcher per session.
+///         dispatcher per session. Acknowledgement resolves the alarm to its
+///         MXAccess ack item through the consumer and hands the write to the
+///         <see cref="IAlarmAckWriter"/>, which authenticates as the operator.
 ///     </para>
 ///     <para>
 ///         Threading: <see cref="WnWrapAlarmConsumer"/> owns no internal
@@ -36,30 +38,29 @@ public sealed class AlarmDispatcher : IDisposable
     private readonly MxAccessAlarmEventSink sink;
     private readonly string sessionId;
     private readonly EventHandler<MxAlarmTransitionEvent> handler;
-    private IManagedAlarmAckClient? managedAck;
+    private readonly IAlarmAckWriter ackWriter;
     private bool disposed;
 
-    /// <summary>Initializes a new alarm dispatcher for the given consumer, sink, and session ID.</summary>
+    /// <summary>Initializes a new alarm dispatcher for the given consumer, sink, session ID and ack writer.</summary>
     /// <param name="consumer">The alarm consumer.</param>
     /// <param name="sink">The alarm event sink.</param>
     /// <param name="sessionId">The session identifier.</param>
-    /// <param name="managedAck">
-    ///     Optional managed ack client. When non-null, GUID-keyed acknowledges
-    ///     route to it (AVEVA's modern <c>AlarmClient.AlarmAckByGUID</c>) instead
-    ///     of the wnwrap consumer while the alarmmgr provider is active; null
-    ///     keeps the existing wnwrap ack path. Subtag-mode acks always stay on
-    ///     the consumer because their GUIDs are synthetic.
+    /// <param name="ackWriter">
+    ///     Writes the resolved ack item as the authenticated operator. Owned by
+    ///     the caller (<see cref="AlarmCommandHandler"/>), which disposes it; the
+    ///     dispatcher never does, so the writer's registered MXAccess server
+    ///     outlives an unsubscribe/resubscribe cycle.
     /// </param>
     public AlarmDispatcher(
         IMxAccessAlarmConsumer consumer,
         MxAccessAlarmEventSink sink,
         string sessionId,
-        IManagedAlarmAckClient? managedAck = null)
+        IAlarmAckWriter ackWriter)
     {
         this.consumer = consumer ?? throw new ArgumentNullException(nameof(consumer));
         this.sink = sink ?? throw new ArgumentNullException(nameof(sink));
         this.sessionId = sessionId ?? string.Empty;
-        this.managedAck = managedAck;
+        this.ackWriter = ackWriter ?? throw new ArgumentNullException(nameof(ackWriter));
         // Sink.Attach is the seam that propagates the session id onto the
         // proto SessionId field of every emitted MxEvent. Pass the consumer
         // as the "associated COM object" — sink ignores the object reference
@@ -80,113 +81,37 @@ public sealed class AlarmDispatcher : IDisposable
     {
         if (disposed) throw new ObjectDisposedException(nameof(AlarmDispatcher));
         consumer.Subscribe(subscription);
-        // The managed ack client maintains its own registered/subscribed
-        // consumer; run its lifecycle against the same expression so a later
-        // AlarmAckByGUID has a live consumer to act through. It is an opt-in
-        // enhancement, so a failed lifecycle drops back to the wnwrap ack path
-        // rather than failing the alarm subscription.
-        if (managedAck is not null)
-        {
-            try
-            {
-                managedAck.Subscribe(subscription);
-            }
-            catch
-            {
-                try { managedAck.Dispose(); } catch { /* swallow */ }
-                managedAck = null;
-            }
-        }
     }
 
-    /// <summary>
-    ///     True when the consumer is currently serving alarms from the subtag
-    ///     fallback, whose alarm GUIDs are synthetic and unknown to alarmmgr.
-    /// </summary>
-    private bool IsSubtagActive() =>
-        consumer is SubtagAlarmConsumer ||
-        (consumer is FailoverAlarmConsumer failover && failover.Mode == AlarmProviderMode.Subtag);
-
-    /// <summary>
-    ///     Forward an <c>AcknowledgeAlarm</c> request to the underlying
-    ///     consumer's <c>AlarmAckByGUID</c>. Returns the AVEVA-native
-    ///     status code (0 = success).
-    /// </summary>
+    /// <summary>Acknowledges the alarm with the given GUID by writing its ack item as the operator.</summary>
     /// <param name="alarmGuid">The alarm GUID.</param>
-    /// <param name="ackComment">The acknowledgment comment.</param>
-    /// <param name="ackOperatorName">The operator name.</param>
-    /// <param name="ackOperatorNode">The operator node.</param>
-    /// <param name="ackOperatorDomain">The operator domain.</param>
-    /// <param name="ackOperatorFullName">The operator full name.</param>
-    /// <returns>The AVEVA-native status code.</returns>
-    public int Acknowledge(
-        Guid alarmGuid,
-        string ackComment,
-        string ackOperatorName,
-        string ackOperatorNode,
-        string ackOperatorDomain,
-        string ackOperatorFullName)
+    /// <param name="ackComment">The acknowledgement comment.</param>
+    /// <param name="ackOperator">The operator to authenticate as.</param>
+    /// <returns>The outcome.</returns>
+    public AlarmAckResult Acknowledge(Guid alarmGuid, string ackComment, AlarmAckOperator ackOperator)
     {
         if (disposed) throw new ObjectDisposedException(nameof(AlarmDispatcher));
-        if (managedAck is not null && !IsSubtagActive())
-        {
-            // Preferred path: AVEVA's modern AlarmClient.AlarmAckByGUID carries
-            // operator domain + full name and is not E_NOTIMPL like the wnwrap
-            // COM AlarmAckByGUID. Skipped in subtag mode: those GUIDs are
-            // synthetic and only the subtag consumer can resolve them (it acks
-            // via an AckMsg write).
-            return managedAck.AcknowledgeByGuid(
-                alarmGuid,
-                ackComment,
-                ackOperatorName,
-                ackOperatorNode,
-                ackOperatorDomain,
-                ackOperatorFullName);
-        }
-
-        return consumer.AcknowledgeByGuid(
-            alarmGuid,
-            ackComment,
-            ackOperatorName,
-            ackOperatorNode,
-            ackOperatorDomain,
-            ackOperatorFullName);
+        AlarmAckTarget target = consumer.ResolveAckTarget(alarmGuid);
+        return target.Found
+            ? ackWriter.Acknowledge(target.ItemAddress, ackComment, ackOperator)
+            : AlarmAckResult.FromTarget(target);
     }
 
-    /// <summary>
-    ///     Acknowledge an alarm by its (name, provider, group) tuple.
-    ///     Routes to the consumer's <c>AcknowledgeByName</c> path which
-    ///     maps to <c>wwAlarmConsumerClass.AlarmAckByName</c>.
-    /// </summary>
-    /// <param name="alarmName">The alarm name.</param>
-    /// <param name="providerName">The provider name.</param>
-    /// <param name="groupName">The group name.</param>
-    /// <param name="ackComment">The acknowledgment comment.</param>
-    /// <param name="ackOperatorName">The operator name.</param>
-    /// <param name="ackOperatorNode">The operator node.</param>
-    /// <param name="ackOperatorDomain">The operator domain.</param>
-    /// <param name="ackOperatorFullName">The operator full name.</param>
-    /// <returns>The AVEVA-native status code.</returns>
-    public int AcknowledgeByName(
-        string alarmName,
-        string providerName,
-        string groupName,
-        string ackComment,
-        string ackOperatorName,
-        string ackOperatorNode,
-        string ackOperatorDomain,
-        string ackOperatorFullName)
+    /// <summary>Acknowledges the alarm identified by name/provider/group as the operator.</summary>
+    /// <param name="alarmName">The tag/alarm name.</param>
+    /// <param name="providerName">The provider.</param>
+    /// <param name="groupName">The group/area.</param>
+    /// <param name="ackComment">The acknowledgement comment.</param>
+    /// <param name="ackOperator">The operator to authenticate as.</param>
+    /// <returns>The outcome.</returns>
+    public AlarmAckResult AcknowledgeByName(
+        string alarmName, string providerName, string groupName, string ackComment, AlarmAckOperator ackOperator)
     {
         if (disposed) throw new ObjectDisposedException(nameof(AlarmDispatcher));
-        return consumer.AcknowledgeByName(
-            alarmName,
-            providerName,
-            groupName,
-            ackComment,
-            ackOperatorName,
-            ackOperatorNode,
-            ackOperatorDomain,
-            ackOperatorFullName);
+        AlarmAckTarget target = consumer.ResolveAckTargetByName(alarmName, providerName, groupName);
+        return target.Found
+            ? ackWriter.Acknowledge(target.ItemAddress, ackComment, ackOperator)
+            : AlarmAckResult.FromTarget(target);
     }
 
     /// <summary>
@@ -327,6 +252,5 @@ public sealed class AlarmDispatcher : IDisposable
         try { consumer.AlarmTransitionEmitted -= handler; } catch { /* swallow */ }
         try { sink.Detach(); } catch { /* swallow */ }
         try { consumer.Dispose(); } catch { /* swallow */ }
-        try { managedAck?.Dispose(); } catch { /* swallow */ }
     }
 }