feat(worker): route alarm acks through the operator-authenticated AckMsg writer

AlarmCommandHandler -> AlarmDispatcher -> IAlarmAckWriter: the dispatcher resolves the ack item through the consumer and the writer authenticates the operator and writes the comment. The executor builds AlarmAckOperator from operator_user/domain/password, maps AlarmAckOutcome to the reply (Applied/Unconfirmed Ok, AlarmNotFound/NotAckable InvalidRequest, AuthenticationFailed/WriteRejected MxaccessFailure) and reports escaping exceptions by type and HRESULT only, so operator_password cannot leak. Removes the inert managed/WNAL alarm-client ack path.

Claude-Session: https://claude.ai/code/session_016J6isfcgqy4SB2RK3ZvFvT

clients/rust/protos/mxaccess_gateway.proto

@@ -391,10 +391,13 @@ message AlarmFailoverConfig {
   int32 failback_stable_probes = 3;          // clean probes before switching back (>=1)
 }
 
-// Acknowledge a single alarm by its GUID. Operator identity fields are
-// recorded atomically with the ack transition in the alarm-history log.
-// The reply's hresult / native_status surfaces AVEVA's
-// AlarmAckByGUID return code.
+// Acknowledge a single alarm by its GUID. The worker resolves the GUID to the
+// alarm's Galaxy reference from its active-alarm snapshot and acknowledges it
+// by writing `comment` to `<TAGNAME>.AckMsg` over MXAccess after
+// AuthenticateUser as the operator, so the alarm history records the real
+// operator. The reply's hresult / native_status is 0 when the write was
+// applied (or sent but unconfirmed), otherwise the AuthenticateUser HRESULT or
+// the OnWriteComplete status detail.
 message AcknowledgeAlarmCommand {
   // Canonical 8-4-4-4-12 GUID string (e.g. "BCC47053-9542-4D65-BDAA-BCDEA6A32A73").
   string alarm_guid = 1;
@@ -403,6 +406,10 @@ message AcknowledgeAlarmCommand {
   string operator_node = 4;
   string operator_domain = 5;
   string operator_full_name = 6;
+  // Operator credential used for AuthenticateUser before the AckMsg write.
+  // Implementations must keep this field out of logs, metrics labels, command
+  // lines, and diagnostics.
+  string operator_password = 7;
 }
 
 // Snapshot the currently-active alarm set. Optional filter prefix scopes
@@ -414,9 +421,7 @@ message QueryActiveAlarmsCommand {
 
 // Acknowledge a single alarm by its (name, provider, group) tuple. Used
 // when the public RPC's AlarmFullReference (Provider!Group.Tag) cannot
-// be resolved to a GUID directly. The worker invokes
-// wwAlarmConsumerClass.AlarmAckByName which reaches the same alarm
-// history path as AlarmAckByGUID.
+// be resolved to a GUID directly. The worker acknowledges by writing `comment` to `<alarm_name>.AckMsg` (Galaxy provider only) after AuthenticateUser as the operator.
 message AcknowledgeAlarmByNameCommand {
   // Tag/alarm name (e.g. "TestMachine_001.TestAlarm001"). Tag itself
   // may contain dots; the gateway-side parser splits on the first dot
@@ -431,6 +436,10 @@ message AcknowledgeAlarmByNameCommand {
   string operator_node = 6;
   string operator_domain = 7;
   string operator_full_name = 8;
+  // Operator credential used for AuthenticateUser before the AckMsg write.
+  // Implementations must keep this field out of logs, metrics labels, command
+  // lines, and diagnostics.
+  string operator_password = 9;
 }
 
 message UnsubscribeBulkCommand {
@@ -725,11 +734,11 @@ message DrainEventsReply {
 // Reply payload for AcknowledgeAlarmCommand AND
 // AcknowledgeAlarmByNameCommand — both ack command kinds reuse this
 // payload case (`MxCommandReply.acknowledge_alarm`); there is no
-// dedicated by-name reply case. Surfaces AVEVA's native ack return
-// code (AlarmAckByGUID for the GUID arm, AlarmAckByName for the
-// by-name arm); 0 means success. The MxCommandReply's hresult field
+// dedicated by-name reply case. Surfaces the ack outcome: 0 when the
+// AckMsg write was applied or sent but unconfirmed; otherwise the
+// AuthenticateUser HRESULT or the OnWriteComplete status detail. The MxCommandReply's hresult field
 // carries the same value and is preferred for protocol consumers —
-// this payload exists so the gateway-side WorkerAlarmRpcDispatcher
+// this payload exists so GatewayAlarmMonitor
 // can echo native_status into AcknowledgeAlarmReply.hresult without
 // unpacking the outer envelope.
 message AcknowledgeAlarmReplyPayload {
@@ -987,6 +996,15 @@ message AcknowledgeAlarmRequest {
   // Operator principal performing the acknowledgement. The lmxopcua side
   // resolves this from the OPC UA session prior to invoking the RPC.
   string operator_user = 5;
+  // Operator's Galaxy (or OS) password. The gateway authenticates as
+  // operator_user with it before writing the acknowledgement so the alarm
+  // history records the real operator. May be empty for accounts without a
+  // password. Credential-sensitive: implementations must keep this field out
+  // of logs, metrics labels, command lines, and diagnostics.
+  string operator_password = 6;
+  // Optional domain for OS-authenticated galaxies. When set the gateway
+  // authenticates as "<operator_domain>\<operator_user>".
+  string operator_domain = 7;
 }
 
 message AcknowledgeAlarmReply {
@@ -997,8 +1015,7 @@ message AcknowledgeAlarmReply {
   ProtocolStatus protocol_status = 3;
   // Native ack return code echoed from the worker. The worker carries the
   // ack outcome as a single int32 (AcknowledgeAlarmReplyPayload.native_status,
-  // = AlarmAckByName / AlarmAckByGUID return code; 0 = success); the gateway's
-  // WorkerAlarmRpcDispatcher copies that value here. This is the authoritative
+  // 0 = applied or sent; otherwise the AuthenticateUser HRESULT or OnWriteComplete detail); GatewayAlarmMonitor copies that value here. This is the authoritative
   // ack-outcome field for the public RPC. Absent only when the worker reply
   // omitted the value entirely (a protocol violation).
   optional int32 hresult = 4;

docs/AlarmClientDiscovery.md

@@ -793,6 +793,55 @@ in the codebase for the forward-compat shape, but the gateway-side
 `AcknowledgeAlarmByName` when the public RPC supplies a recognizable
 `Provider!Group.Tag` reference.
 
+**Opt-in managed GUID ack — does not work on this rig (live-tested
+2026-10-18).** Setting `MXGATEWAY_USE_MANAGED_ALARM_ACK=1` in the
+gateway's environment (workers inherit it) makes the worker build an
+`AaManagedAlarmAckConsumer`, which drives
+`aaAlarmManagedClient.AlarmClient` by reflection (its members are
+non-public) and is meant to take GUID-keyed acks in place of the
+wnwrap method. The live test shows it cannot do that as built, so leave
+the flag off.
+
+The test raised `TestMachine_001.TestAlarm001` with a secured write,
+read its GUID from the wnwrap XML snapshot (the public API exposes no
+alarm GUIDs), and acknowledged it through the `AcknowledgeAlarm` RPC
+with the flag on:
+
+| Step | Result |
+|---|---|
+| RPC ack by GUID, flag off (control) | `NotImplementedException`; `.Acked` stays `False` |
+| RPC ack by GUID, flag on | Same `NotImplementedException`; `.Acked` `False`, `.AckMsg` empty |
+| `AlarmClient.RegisterConsumer` in a process with a registered wnwrap consumer | `-65` — and wnwrap gets `-65` if the managed client registered first; a real `hWnd` does not help |
+| Managed client alone in its own process, records loaded | `AlarmAckByGUID` → `-1`, `SelectByGUID` → `-1` for the wnwrap GUID in both byte orders, `AlarmAckSelected` → `-57` |
+
+Three separate problems follow:
+
+1. **The two libraries cannot share a process.** The worker always runs
+   a wnwrap reader, so the managed `RegisterConsumer` fails with `-65`.
+   The dispatcher is built to drop back to the wnwrap ack path on a
+   lifecycle failure (so alarm reads keep working), and it does so
+   silently — which is why the flag-on RPC is indistinguishable from the
+   control.
+2. **The managed client does not recognise the wnwrap GUID.** `-1` from
+   `SelectByGUID` is "not found", not a security refusal, even with the
+   client holding records. Getting the client's own identifier for the
+   alarm is not reliable either: `GetHighPriAlarm` mostly throws the
+   FILETIME `ArgumentOutOfRangeException` described above. The
+   `MxSecurityOperate` question was therefore never reached.
+3. **The gateway does not send the identity fields.** Its GUID arm fills
+   `OperatorNode`, `OperatorDomain` and `OperatorFullName` with empty
+   strings, so the domain and full name the managed method carries
+   would not arrive through the public RPC even if 1 and 2 were solved.
+
+A working managed ack would need the client hosted out of process, a way
+to resolve the alarm to the identifier the managed client uses, and the
+identity fields plumbed through the gateway. Routing rules the worker
+already applies stay correct and would carry over: subtag-mode acks
+(synthetic GUIDs) stay on the subtag consumer, and by-name acks stay on
+wnwrap because `AlarmClient` has no by-name ack. The skip-gated
+`AlarmManagedGuidAckLiveSmokeTests` exercises the in-process
+arrangement and hits problem 1.
+
 ### 5. STA / threading — resolved
 
 The wnwrap COM is `ThreadingModel=Apartment`. The consumer's

docs/GatewayConfiguration.md

@@ -446,6 +446,14 @@ behavior.
 The alarm monitor is independent of client sessions: `AcknowledgeAlarm` and
 `StreamAlarms` are session-less RPCs served by the monitor.
 
+The worker also reads `MXGATEWAY_USE_MANAGED_ALARM_ACK` (inherited from the
+gateway process). Setting it to `1` is meant to route GUID-keyed acknowledges
+through AVEVA's managed alarm client, but a live test (2026-10-18) showed the
+path cannot work as built: the managed client fails to register alongside the
+worker's wnwrap reader and the worker silently falls back to wnwrap. Leave it
+unset. It has no `MxGateway:*` option. See
+[AlarmClientDiscovery](./AlarmClientDiscovery.md) ("Opt-in managed GUID ack").
+
 ### Alarm fallback options
 
 The `Fallback` sub-section controls how the alarm feed selects between the

src/ZB.MOM.WW.MxGateway.Contracts/Protos/mxaccess_gateway.proto

@@ -391,10 +391,13 @@ message AlarmFailoverConfig {
   int32 failback_stable_probes = 3;          // clean probes before switching back (>=1)
 }
 
-// Acknowledge a single alarm by its GUID. Operator identity fields are
-// recorded atomically with the ack transition in the alarm-history log.
-// The reply's hresult / native_status surfaces AVEVA's
-// AlarmAckByGUID return code.
+// Acknowledge a single alarm by its GUID. The worker resolves the GUID to the
+// alarm's Galaxy reference from its active-alarm snapshot and acknowledges it
+// by writing `comment` to `<TAGNAME>.AckMsg` over MXAccess after
+// AuthenticateUser as the operator, so the alarm history records the real
+// operator. The reply's hresult / native_status is 0 when the write was
+// applied (or sent but unconfirmed), otherwise the AuthenticateUser HRESULT or
+// the OnWriteComplete status detail.
 message AcknowledgeAlarmCommand {
   // Canonical 8-4-4-4-12 GUID string (e.g. "BCC47053-9542-4D65-BDAA-BCDEA6A32A73").
   string alarm_guid = 1;
@@ -403,6 +406,10 @@ message AcknowledgeAlarmCommand {
   string operator_node = 4;
   string operator_domain = 5;
   string operator_full_name = 6;
+  // Operator credential used for AuthenticateUser before the AckMsg write.
+  // Implementations must keep this field out of logs, metrics labels, command
+  // lines, and diagnostics.
+  string operator_password = 7;
 }
 
 // Snapshot the currently-active alarm set. Optional filter prefix scopes
@@ -414,9 +421,7 @@ message QueryActiveAlarmsCommand {
 
 // Acknowledge a single alarm by its (name, provider, group) tuple. Used
 // when the public RPC's AlarmFullReference (Provider!Group.Tag) cannot
-// be resolved to a GUID directly. The worker invokes
-// wwAlarmConsumerClass.AlarmAckByName which reaches the same alarm
-// history path as AlarmAckByGUID.
+// be resolved to a GUID directly. The worker acknowledges by writing `comment` to `<alarm_name>.AckMsg` (Galaxy provider only) after AuthenticateUser as the operator.
 message AcknowledgeAlarmByNameCommand {
   // Tag/alarm name (e.g. "TestMachine_001.TestAlarm001"). Tag itself
   // may contain dots; the gateway-side parser splits on the first dot
@@ -431,6 +436,10 @@ message AcknowledgeAlarmByNameCommand {
   string operator_node = 6;
   string operator_domain = 7;
   string operator_full_name = 8;
+  // Operator credential used for AuthenticateUser before the AckMsg write.
+  // Implementations must keep this field out of logs, metrics labels, command
+  // lines, and diagnostics.
+  string operator_password = 9;
 }
 
 message UnsubscribeBulkCommand {
@@ -725,11 +734,11 @@ message DrainEventsReply {
 // Reply payload for AcknowledgeAlarmCommand AND
 // AcknowledgeAlarmByNameCommand — both ack command kinds reuse this
 // payload case (`MxCommandReply.acknowledge_alarm`); there is no
-// dedicated by-name reply case. Surfaces AVEVA's native ack return
-// code (AlarmAckByGUID for the GUID arm, AlarmAckByName for the
-// by-name arm); 0 means success. The MxCommandReply's hresult field
+// dedicated by-name reply case. Surfaces the ack outcome: 0 when the
+// AckMsg write was applied or sent but unconfirmed; otherwise the
+// AuthenticateUser HRESULT or the OnWriteComplete status detail. The MxCommandReply's hresult field
 // carries the same value and is preferred for protocol consumers —
-// this payload exists so the gateway-side WorkerAlarmRpcDispatcher
+// this payload exists so GatewayAlarmMonitor
 // can echo native_status into AcknowledgeAlarmReply.hresult without
 // unpacking the outer envelope.
 message AcknowledgeAlarmReplyPayload {
@@ -987,6 +996,15 @@ message AcknowledgeAlarmRequest {
   // Operator principal performing the acknowledgement. The lmxopcua side
   // resolves this from the OPC UA session prior to invoking the RPC.
   string operator_user = 5;
+  // Operator's Galaxy (or OS) password. The gateway authenticates as
+  // operator_user with it before writing the acknowledgement so the alarm
+  // history records the real operator. May be empty for accounts without a
+  // password. Credential-sensitive: implementations must keep this field out
+  // of logs, metrics labels, command lines, and diagnostics.
+  string operator_password = 6;
+  // Optional domain for OS-authenticated galaxies. When set the gateway
+  // authenticates as "<operator_domain>\<operator_user>".
+  string operator_domain = 7;
 }
 
 message AcknowledgeAlarmReply {
@@ -997,8 +1015,7 @@ message AcknowledgeAlarmReply {
   ProtocolStatus protocol_status = 3;
   // Native ack return code echoed from the worker. The worker carries the
   // ack outcome as a single int32 (AcknowledgeAlarmReplyPayload.native_status,
-  // = AlarmAckByName / AlarmAckByGUID return code; 0 = success); the gateway's
-  // WorkerAlarmRpcDispatcher copies that value here. This is the authoritative
+  // 0 = applied or sent; otherwise the AuthenticateUser HRESULT or OnWriteComplete detail); GatewayAlarmMonitor copies that value here. This is the authoritative
   // ack-outcome field for the public RPC. Absent only when the worker reply
   // omitted the value entirely (a protocol violation).
   optional int32 hresult = 4;

src/ZB.MOM.WW.MxGateway.Contracts/WorkerLaunchEnvironment.cs

@@ -22,4 +22,10 @@ public static class WorkerLaunchEnvironment
 
     /// <summary>Maximum alarm records requested in one current-alarm fetch.</summary>
     public const string MaxAlarmsPerFetch = "MXGATEWAY_ALARM_MAX_ALARMS_PER_FETCH";
+
+    /// <summary>
+    ///     MXAccess client name the worker's alarm-ack writer registers with. The
+    ///     Historian records it as the acknowledgement's OperatorNode.
+    /// </summary>
+    public const string AlarmAckClientName = "MXGATEWAY_ALARM_ACK_CLIENT_NAME";
 }

src/ZB.MOM.WW.MxGateway.Tests/Contracts/ProtobufContractRoundTripTests.cs

@@ -310,11 +310,47 @@ public sealed class ProtobufContractRoundTripTests
             AlarmFullReference = "Tank01.Level.HiHi",
             Comment = "shift handover",
             OperatorUser = "operator2",
+            OperatorPassword = "s3cret",
+            OperatorDomain = "CORP",
         };
 
         var parsed = AcknowledgeAlarmRequest.Parser.ParseFrom(original.ToByteArray());
 
         Assert.Equal(original, parsed);
+        Assert.Equal("s3cret", parsed.OperatorPassword);
+        Assert.Equal("CORP", parsed.OperatorDomain);
+    }
+
+    /// <summary>Verifies that the worker ack commands round-trip the operator password.</summary>
+    [Fact]
+    public void AcknowledgeAlarmCommands_RoundTripOperatorPassword()
+    {
+        MxCommand byGuid = new()
+        {
+            Kind = MxCommandKind.AcknowledgeAlarm,
+            AcknowledgeAlarmCommand = new AcknowledgeAlarmCommand
+            {
+                AlarmGuid = "BCC47053-9542-4D65-BDAA-BCDEA6A32A73",
+                OperatorUser = "alice",
+                OperatorDomain = "CORP",
+                OperatorPassword = "s3cret",
+            },
+        };
+        MxCommand byName = new()
+        {
+            Kind = MxCommandKind.AcknowledgeAlarmByName,
+            AcknowledgeAlarmByNameCommand = new AcknowledgeAlarmByNameCommand
+            {
+                AlarmName = "TestMachine_001.TestAlarm001",
+                ProviderName = "Galaxy",
+                GroupName = "TestArea",
+                OperatorUser = "alice",
+                OperatorPassword = "s3cret",
+            },
+        };
+
+        Assert.Equal("s3cret", MxCommand.Parser.ParseFrom(byGuid.ToByteArray()).AcknowledgeAlarmCommand.OperatorPassword);
+        Assert.Equal("s3cret", MxCommand.Parser.ParseFrom(byName.ToByteArray()).AcknowledgeAlarmByNameCommand.OperatorPassword);
     }
 
     /// <summary>Verifies that AcknowledgeAlarmReply round-trips with status, hresult, and diagnostics.</summary>

src/ZB.MOM.WW.MxGateway.Tests/Gateway/GatewayEndToEndMultiSubscriberTests.cs

@@ -2,6 +2,7 @@ using Google.Protobuf.WellKnownTypes;
 using Grpc.Core;
 using Microsoft.Extensions.Logging.Abstractions;
 using Microsoft.Extensions.Options;
+using Xunit.Abstractions;
 using ZB.MOM.WW.MxGateway.Contracts;
 using ZB.MOM.WW.MxGateway.Contracts.Proto;
 using ZB.MOM.WW.MxGateway.Server.Configuration;
@@ -21,7 +22,7 @@ namespace ZB.MOM.WW.MxGateway.Tests.Gateway;
 /// the fake worker harness. Covers fan-out to two concurrent subscribers, independent
 /// cancellation isolation, and the per-session subscriber cap.
 /// </summary>
-public sealed class GatewayEndToEndMultiSubscriberTests
+public sealed class GatewayEndToEndMultiSubscriberTests(ITestOutputHelper output)
 {
     private static readonly TimeSpan TestTimeout = TimeSpan.FromSeconds(10);
     private const int ServerHandle = 3001;
@@ -37,7 +38,7 @@ public sealed class GatewayEndToEndMultiSubscriberTests
     public async Task StreamEvents_TwoSubscribers_BothReceiveAllEvents()
     {
         MultiEventFakeWorkerProcessLauncher launcher = new(EventCount);
-        await using MultiSubscriberGatewayServiceFixture fixture = new(launcher);
+        await using MultiSubscriberGatewayServiceFixture fixture = new(launcher, diagnosticOutput: output.WriteLine);
 
         OpenSessionReply openReply = await fixture.Service.OpenSession(
             new OpenSessionRequest
@@ -136,7 +137,7 @@ public sealed class GatewayEndToEndMultiSubscriberTests
     public async Task StreamEvents_OneSubscriberCancels_OtherContinuesReceivingEvents()
     {
         GatedEventFakeWorkerProcessLauncher launcher = new();
-        await using MultiSubscriberGatewayServiceFixture fixture = new(launcher);
+        await using MultiSubscriberGatewayServiceFixture fixture = new(launcher, diagnosticOutput: output.WriteLine);
 
         OpenSessionReply openReply = await fixture.Service.OpenSession(
             new OpenSessionRequest
@@ -254,7 +255,7 @@ public sealed class GatewayEndToEndMultiSubscriberTests
         // (EventSubscriberLimitReached) is only reachable when multi-subscriber mode is on.
         // Without it the service hits EventSubscriberAlreadyActive instead — also
         // ResourceExhausted, but for the wrong reason — masking a misconfiguration.
-        await using MultiSubscriberGatewayServiceFixture fixture = new(launcher, maxEventSubscribersPerSession: cap);
+        await using MultiSubscriberGatewayServiceFixture fixture = new(launcher, maxEventSubscribersPerSession: cap, diagnosticOutput: output.WriteLine);
 
         OpenSessionReply openReply = await fixture.Service.OpenSession(
             new OpenSessionRequest
@@ -413,20 +414,25 @@ public sealed class GatewayEndToEndMultiSubscriberTests
     {
         private readonly GatewayMetrics _metrics = new();
         private readonly SessionRegistry _registry = new();
+        private readonly FakeWorkerDiagnostics _diagnostics;
 
         /// <summary>Initializes a new instance of the <see cref="MultiSubscriberGatewayServiceFixture"/> class.</summary>
         /// <param name="launcher">Fake worker process launcher backing the session manager.</param>
+        /// <param name="diagnosticOutput">Safe metadata output sink.</param>
         /// <param name="maxEventSubscribersPerSession">Maximum concurrent event subscribers allowed per session.</param>
         public MultiSubscriberGatewayServiceFixture(
             IWorkerProcessLauncher launcher,
-            int maxEventSubscribersPerSession = 8)
+            int maxEventSubscribersPerSession = 8,
+            Action<string>? diagnosticOutput = null)
         {
+            _diagnostics = ((IDiagnosticFakeWorker)launcher).Diagnostics;
+            _diagnostics.SetOutput(diagnosticOutput);
             IOptions<GatewayOptions> options = Options.Create(CreateOptions(maxEventSubscribersPerSession));
             SessionWorkerClientFactory workerClientFactory = new(
                 launcher,
                 options,
                 _metrics,
-                NullLoggerFactory.Instance);
+                _diagnostics);
             SessionManager sessionManager = new(
                 _registry,
                 workerClientFactory,
@@ -499,13 +505,20 @@ public sealed class GatewayEndToEndMultiSubscriberTests
         /// <summary>Disposes every session in the registry and releases the fixture's metrics.</summary>
         /// <returns>A task that represents the asynchronous operation.</returns>
         public async ValueTask DisposeAsync()
+        {
+            // Session disposal and worker observation share the existing test budget.
+            // The observer consumes a late cleanup fault without replacing the primary failure.
+            _diagnostics.Track(DisposeSessionsAsync(), "teardown");
+            await _diagnostics.DrainAsync(TestTimeout).ConfigureAwait(false);
+            _metrics.Dispose();
+        }
+
+        private async Task DisposeSessionsAsync()
         {
             foreach (GatewaySession session in _registry.Snapshot())
             {
-                await session.DisposeAsync();
+                await session.DisposeAsync().ConfigureAwait(false);
             }
-
-            _metrics.Dispose();
         }
 
         private static GatewayOptions CreateOptions(int maxEventSubscribersPerSession) =>
@@ -540,7 +553,7 @@ public sealed class GatewayEndToEndMultiSubscriberTests
     /// command, then waits for shutdown. Events carry an indexed string value so the test can
     /// verify fan-out order across two subscribers.
     /// </summary>
-    private sealed class MultiEventFakeWorkerProcessLauncher(int eventCount) : IWorkerProcessLauncher
+    private sealed class MultiEventFakeWorkerProcessLauncher(int eventCount) : IWorkerProcessLauncher, IDiagnosticFakeWorker
     {
         public const int ProcessId = 7710;
 
@@ -549,12 +562,16 @@ public sealed class GatewayEndToEndMultiSubscriberTests
         /// <summary>Gets the task representing the fake worker's running background loop.</summary>
         public Task WorkerTask { get; private set; } = Task.CompletedTask;
 
+        /// <inheritdoc />
+        public FakeWorkerDiagnostics Diagnostics { get; } = new();
+
         /// <inheritdoc />
         public Task<WorkerProcessHandle> LaunchAsync(
             WorkerProcessLaunchRequest request,
             CancellationToken cancellationToken = default)
         {
             WorkerTask = RunWorkerAsync(request, cancellationToken);
+            Diagnostics.Track(WorkerTask);
 
             return Task.FromResult(new WorkerProcessHandle(
                 _process,
@@ -578,6 +595,7 @@ public sealed class GatewayEndToEndMultiSubscriberTests
             {
                 WorkerEnvelope envelope = await harness.ReadGatewayEnvelopeAsync(cancellationToken).ConfigureAwait(false);
 
+                Diagnostics.Received(envelope);
                 if (envelope.BodyCase == WorkerEnvelope.BodyOneofCase.WorkerShutdown)
                 {
                     await harness.SendShutdownAckAsync(cancellationToken: cancellationToken).ConfigureAwait(false);
@@ -630,7 +648,7 @@ public sealed class GatewayEndToEndMultiSubscriberTests
     /// deterministic. Call <see cref="StopEmitting"/> before closing the session so the
     /// worker loop exits cleanly and can process the shutdown envelope.
     /// </summary>
-    private sealed class GatedEventFakeWorkerProcessLauncher : IWorkerProcessLauncher
+    private sealed class GatedEventFakeWorkerProcessLauncher : IWorkerProcessLauncher, IDiagnosticFakeWorker
     {
         public const int ProcessId = 7720;
 
@@ -643,6 +661,9 @@ public sealed class GatewayEndToEndMultiSubscriberTests
         /// <summary>Gets the task representing the fake worker's running background loop.</summary>
         public Task WorkerTask { get; private set; } = Task.CompletedTask;
 
+        /// <inheritdoc />
+        public FakeWorkerDiagnostics Diagnostics { get; } = new();
+
         /// <summary>Releases the gate so the worker emits one event.</summary>
         public void AllowNextEvent() => _emitGate.Release();
 
@@ -662,6 +683,7 @@ public sealed class GatewayEndToEndMultiSubscriberTests
             CancellationToken cancellationToken = default)
         {
             WorkerTask = RunWorkerAsync(request, cancellationToken);
+            Diagnostics.Track(WorkerTask);
 
             return Task.FromResult(new WorkerProcessHandle(
                 _process,
@@ -717,6 +739,7 @@ public sealed class GatewayEndToEndMultiSubscriberTests
                     continue;
                 }
 
+                Diagnostics.Received(envelope);
                 if (envelope.BodyCase == WorkerEnvelope.BodyOneofCase.WorkerShutdown)
                 {
                     await harness.SendShutdownAckAsync(cancellationToken: cancellationToken).ConfigureAwait(false);

src/ZB.MOM.WW.MxGateway.Tests/Gateway/GatewayEndToEndReconnectReplayTests.cs

@@ -1,8 +1,10 @@
+using System.Collections.Concurrent;
 using Google.Protobuf.WellKnownTypes;
 using Grpc.Core;
 using Microsoft.Extensions.Logging.Abstractions;
 using Microsoft.Extensions.Options;
 using Microsoft.Extensions.Time.Testing;
+using Xunit.Abstractions;
 using ZB.MOM.WW.MxGateway.Contracts;
 using ZB.MOM.WW.MxGateway.Contracts.Proto;
 using ZB.MOM.WW.MxGateway.Server.Configuration;
@@ -36,7 +38,7 @@ namespace ZB.MOM.WW.MxGateway.Tests.Gateway;
 ///     per session and survives detach, so events emitted while no subscriber is attached are
 ///     retained for the reconnecting stream.
 /// </remarks>
-public sealed class GatewayEndToEndReconnectReplayTests
+public sealed class GatewayEndToEndReconnectReplayTests(ITestOutputHelper output)
 {
     private static readonly TimeSpan TestTimeout = TimeSpan.FromSeconds(10);
     private const int ServerHandle = 3001;
@@ -58,7 +60,7 @@ public sealed class GatewayEndToEndReconnectReplayTests
         GatedEventFakeWorkerProcessLauncher launcher = new();
         // Capacity 16 retains every event emitted here (7 total), so nothing is evicted and a
         // resume from a middle cursor never produces a gap.
-        await using ReconnectReplayGatewayServiceFixture fixture = new(launcher, replayBufferCapacity: 16);
+        await using ReconnectReplayGatewayServiceFixture fixture = new(launcher, replayBufferCapacity: 16, diagnosticOutput: output.WriteLine);
 
         string sessionId = await OpenSessionAsync(fixture, "reconnect-no-gap");
 
@@ -157,7 +159,7 @@ public sealed class GatewayEndToEndReconnectReplayTests
         GatedEventFakeWorkerProcessLauncher launcher = new();
         // Small capacity forces eviction: with 6 events emitted and a 3-slot ring, the first 3
         // are evicted and only the newest 3 remain replayable.
-        await using ReconnectReplayGatewayServiceFixture fixture = new(launcher, replayBufferCapacity: capacity);
+        await using ReconnectReplayGatewayServiceFixture fixture = new(launcher, replayBufferCapacity: capacity, diagnosticOutput: output.WriteLine);
 
         string sessionId = await OpenSessionAsync(fixture, "reconnect-gap");
 
@@ -256,7 +258,8 @@ public sealed class GatewayEndToEndReconnectReplayTests
             launcher,
             replayBufferCapacity: 16,
             replayRetentionSeconds: retentionSeconds,
-            timeProvider: clock);
+            timeProvider: clock,
+            diagnosticOutput: output.WriteLine);
 
         string sessionId = await OpenSessionAsync(fixture, "reconnect-aged-out");
 
@@ -340,6 +343,34 @@ public sealed class GatewayEndToEndReconnectReplayTests
             $"Live event {delivered.WorkerSequence} must be newer than the highest previously seen {highestSeen}.");
     }
 
+    /// <summary>Setup failures preserve gateway EOF and report the original fake worker fault safely.</summary>
+    /// <param name="faultCommand">The setup command where the fake worker fails.</param>
+    /// <returns>The asynchronous test operation.</returns>
+    [Theory]
+    [InlineData(MxCommandKind.Register)]
+    [InlineData(MxCommandKind.AddItem)]
+    public async Task Setup_WhenFakeWorkerFaults_ReportsFaultWithoutMaskingRpcFailure(MxCommandKind faultCommand)
+    {
+        ConcurrentQueue<string> output = new();
+        GatedEventFakeWorkerProcessLauncher launcher = new(faultCommand);
+        Exception? failure = await Record.ExceptionAsync(async () =>
+        {
+            await using ReconnectReplayGatewayServiceFixture fixture = new(
+                launcher, replayBufferCapacity: 16, diagnosticOutput: output.Enqueue);
+            string sessionId = await OpenSessionAsync(fixture, "injected-fault");
+            await WireUpAdviseAsync(fixture, sessionId);
+        });
+
+        RpcException rpc = Assert.IsType<RpcException>(failure);
+        Assert.Equal(StatusCode.Unavailable, rpc.StatusCode);
+        Assert.Contains("Worker pipe disconnected", rpc.Status.Detail);
+        Assert.Contains(output, line => line.Contains("source=fake-worker")
+            && line.Contains("type=WorkerFrameProtocolException") && line.Contains("code=InvalidEnvelope")
+            && line.Contains($"command={faultCommand}") && line.Contains("phase=command"));
+        Assert.Contains(output, line => line.Contains("source=gateway") && line.Contains("code=EndOfStream"));
+        Assert.DoesNotContain(output, line => line.Contains("secret-item") || line.Contains("Galaxy.Tag.Value"));
+    }
+
     // ---- shared flow helpers ----
 
     private static async Task<string> OpenSessionAsync(
@@ -490,6 +521,7 @@ public sealed class GatewayEndToEndReconnectReplayTests
     {
         private readonly GatewayMetrics _metrics = new();
         private readonly SessionRegistry _registry = new();
+        private readonly FakeWorkerDiagnostics _diagnostics;
 
         /// <summary>Initializes a new instance of the <see cref="ReconnectReplayGatewayServiceFixture"/> class.</summary>
         /// <param name="launcher">Fake worker process launcher backing the session manager.</param>
@@ -499,6 +531,7 @@ public sealed class GatewayEndToEndReconnectReplayTests
         ///     duration of a fast test; the age-eviction test shortens it and drives
         ///     <paramref name="timeProvider"/>.
         /// </param>
+        /// <param name="diagnosticOutput">Safe metadata output sink.</param>
         /// <param name="timeProvider">
         ///     Clock handed to the session manager, which flows through to the session's event
         ///     distributor. Pass a fake to make age-eviction deterministic.
@@ -507,15 +540,18 @@ public sealed class GatewayEndToEndReconnectReplayTests
             IWorkerProcessLauncher launcher,
             int replayBufferCapacity,
             double replayRetentionSeconds = 300,
-            TimeProvider? timeProvider = null)
+            TimeProvider? timeProvider = null,
+            Action<string>? diagnosticOutput = null)
         {
+            _diagnostics = ((IDiagnosticFakeWorker)launcher).Diagnostics;
+            _diagnostics.SetOutput(diagnosticOutput);
             IOptions<GatewayOptions> options = Options.Create(
                 CreateOptions(replayBufferCapacity, replayRetentionSeconds));
             SessionWorkerClientFactory workerClientFactory = new(
                 launcher,
                 options,
                 _metrics,
-                NullLoggerFactory.Instance);
+                _diagnostics);
             SessionManager sessionManager = new(
                 _registry,
                 workerClientFactory,
@@ -585,13 +621,20 @@ public sealed class GatewayEndToEndReconnectReplayTests
         /// <summary>Disposes every session in the registry and releases the fixture's metrics.</summary>
         /// <returns>A task that represents the asynchronous operation.</returns>
         public async ValueTask DisposeAsync()
+        {
+            // Session disposal and worker observation share the existing test budget.
+            // The observer consumes a late cleanup fault without replacing the primary failure.
+            _diagnostics.Track(DisposeSessionsAsync(), "teardown");
+            await _diagnostics.DrainAsync(TestTimeout).ConfigureAwait(false);
+            _metrics.Dispose();
+        }
+
+        private async Task DisposeSessionsAsync()
         {
             foreach (GatewaySession session in _registry.Snapshot())
             {
                 await session.DisposeAsync().ConfigureAwait(false);
             }
-
-            _metrics.Dispose();
         }
 
         private static GatewayOptions CreateOptions(int replayBufferCapacity, double replayRetentionSeconds) =>
@@ -642,7 +685,7 @@ public sealed class GatewayEndToEndReconnectReplayTests
     ///     <see cref="StopEmitting"/> before closing the session so the loop exits cleanly and can
     ///     process the shutdown envelope.
     /// </summary>
-    private sealed class GatedEventFakeWorkerProcessLauncher : IWorkerProcessLauncher
+    private sealed class GatedEventFakeWorkerProcessLauncher(MxCommandKind? faultCommand = null) : IWorkerProcessLauncher, IDiagnosticFakeWorker
     {
         public const int ProcessId = 7730;
 
@@ -655,6 +698,9 @@ public sealed class GatewayEndToEndReconnectReplayTests
         /// <summary>Gets the task representing the fake worker's running background loop.</summary>
         public Task WorkerTask { get; private set; } = Task.CompletedTask;
 
+        /// <inheritdoc />
+        public FakeWorkerDiagnostics Diagnostics { get; } = new();
+
         /// <summary>Releases the gate so the worker emits one event.</summary>
         public void AllowNextEvent() => _emitGate.Release();
 
@@ -674,6 +720,7 @@ public sealed class GatewayEndToEndReconnectReplayTests
             CancellationToken cancellationToken = default)
         {
             WorkerTask = RunWorkerAsync(request, cancellationToken);
+            Diagnostics.Track(WorkerTask);
 
             return Task.FromResult(new WorkerProcessHandle(
                 _process,
@@ -729,6 +776,7 @@ public sealed class GatewayEndToEndReconnectReplayTests
                     continue;
                 }
 
+                Diagnostics.Received(envelope);
                 if (envelope.BodyCase == WorkerEnvelope.BodyOneofCase.WorkerShutdown)
                 {
                     await harness.SendShutdownAckAsync(cancellationToken: cancellationToken).ConfigureAwait(false);
@@ -742,6 +790,11 @@ public sealed class GatewayEndToEndReconnectReplayTests
                 }
 
                 MxCommand command = envelope.WorkerCommand.Command;
+                if (command.Kind == faultCommand)
+                {
+                    throw new WorkerFrameProtocolException(WorkerFrameProtocolErrorCode.InvalidEnvelope, "secret-item");
+                }
+
                 await harness.ReplyToCommandAsync(
                     envelope,
                     configureReply: reply => ConfigureCommandReply(reply, command.Kind),

src/ZB.MOM.WW.MxGateway.Tests/Gateway/Workers/FakeWorkerDiagnosticsTests.cs

@@ -0,0 +1,88 @@
+using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.MxGateway.Server.Workers;
+using ZB.MOM.WW.MxGateway.Tests.TestSupport;
+
+namespace ZB.MOM.WW.MxGateway.Tests.Gateway.Workers;
+
+/// <summary>Protects bounded teardown, fault observation, and safe diagnostic output.</summary>
+public sealed class FakeWorkerDiagnosticsTests
+{
+    /// <summary>Repeated gateway logs remain bounded and never format sensitive state or messages.</summary>
+    [Fact]
+    public void Log_WhenFaultsRepeat_ReportsOnlyBoundedMetadata()
+    {
+        using FakeWorkerDiagnostics diagnostics = new();
+        List<string> output = [];
+        diagnostics.SetOutput(output.Add);
+        for (int i = 0; i < 32; i++)
+        {
+            diagnostics.Log(LogLevel.Warning, new EventId(1), "secret-command",
+                new WorkerFrameProtocolException(WorkerFrameProtocolErrorCode.InvalidEnvelope, "secret-item"),
+                (state, exception) => $"{state} {exception}");
+        }
+
+        Assert.NotEmpty(output);
+        Assert.InRange(output.Count, 1, 16);
+        Assert.All(output, line =>
+        {
+            Assert.Contains("type=WorkerFrameProtocolException", line);
+            Assert.Contains("code=InvalidEnvelope", line);
+            Assert.DoesNotContain("secret", line);
+        });
+    }
+
+    /// <summary>A late fault is observed after timeout without calling the completed output sink.</summary>
+    /// <returns>The asynchronous test operation.</returns>
+    [Fact]
+    public async Task DrainAsync_WhenWorkerOutlivesBudget_ObservesLateFaultWithoutLateOutput()
+    {
+        FakeWorkerDiagnostics diagnostics = new();
+        List<string> output = [];
+        diagnostics.SetOutput(output.Add);
+        TaskCompletionSource worker = new(TaskCreationOptions.RunContinuationsAsynchronously);
+        diagnostics.Track(worker.Task);
+        await diagnostics.DrainAsync(TimeSpan.Zero);
+        Assert.Contains(output, line => line.Contains("source=teardown") && line.Contains("type=TimeoutException"));
+        int beforeFault = output.Count;
+        worker.SetException(new WorkerFrameProtocolException(WorkerFrameProtocolErrorCode.InvalidEnvelope, "secret-item"));
+        await diagnostics.DrainAsync(TimeSpan.FromSeconds(5));
+        Assert.Equal(beforeFault, output.Count);
+    }
+
+    /// <summary>Expected cancellation does not add fault diagnostics.</summary>
+    /// <returns>The asynchronous test operation.</returns>
+    [Fact]
+    public async Task DrainAsync_WhenWorkerIsCancelled_DoesNotReportFault()
+    {
+        FakeWorkerDiagnostics diagnostics = new();
+        List<string> output = [];
+        diagnostics.SetOutput(output.Add);
+        diagnostics.Track(Task.FromCanceled(new CancellationToken(true)));
+        await diagnostics.DrainAsync(TimeSpan.FromSeconds(5));
+        Assert.Empty(output);
+    }
+
+    /// <summary>An unavailable output helper cannot fault the observer or replace the primary failure.</summary>
+    /// <returns>The asynchronous test operation.</returns>
+    [Fact]
+    public async Task DrainAsync_WhenOutputThrows_PreservesPrimaryFailure()
+    {
+        InvalidOperationException primary = new("primary");
+        FakeWorkerDiagnostics diagnostics = new();
+        diagnostics.SetOutput(_ => throw new InvalidOperationException("completed output"));
+        Exception? failure = await Record.ExceptionAsync(async () =>
+        {
+            try
+            {
+                throw primary;
+            }
+            finally
+            {
+                diagnostics.Track(Task.FromException(new WorkerFrameProtocolException(
+                    WorkerFrameProtocolErrorCode.InvalidEnvelope, "secret-item")));
+                await diagnostics.DrainAsync(TimeSpan.FromSeconds(5));
+            }
+        });
+        Assert.Same(primary, failure);
+    }
+}

src/ZB.MOM.WW.MxGateway.Tests/Gateway/Workers/GatedWorkerEnvelopeReaderTests.cs

@@ -11,8 +11,11 @@ public sealed class GatedWorkerEnvelopeReaderTests
 {
     /// <summary>A gate wakeup must preserve a partially consumed frame and the following frame.</summary>
     /// <returns>The asynchronous test operation.</returns>
-    [Fact]
-    public async Task ReadOrGateAsync_WhenGateOpensDuringSegmentedFrame_PreservesBothFrames()
+    /// <param name="watchGate">Whether the emission gate is watched (false before Advise).</param>
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task ReadOrGateAsync_WhenGateOpensDuringSegmentedFrame_PreservesBothFrames(bool watchGate)
     {
         WorkerFrameProtocolOptions options = new("segmented-session");
         WorkerEnvelope first = new()
@@ -38,15 +41,27 @@ public sealed class GatedWorkerEnvelopeReaderTests
 
         // The length and first payload byte are consumed before the remaining bytes exist.
         await pipe.Writer.WriteAsync(bytes.AsMemory(0, 5));
-        Task<WorkerEnvelope?> pending = selector.ReadOrGateAsync();
+        Task<WorkerEnvelope?> pending = selector.ReadOrGateAsync(watchGate);
         Assert.False(pending.IsCompleted);
         gate.Release();
-        Assert.Null(await pending);
+        if (watchGate)
+        {
+            Assert.Null(await pending.WaitAsync(TimeSpan.FromSeconds(5)));
+        }
+        else
+        {
+            // Explicit deadline probe: pre-Advise framing must remain pending beyond the old
+            // 50ms cancellation budget, even with the emission gate already open.
+            Task oldReadBudget = Task.Delay(TimeSpan.FromMilliseconds(100), lifetime.Token);
+            Assert.Same(oldReadBudget, await Task.WhenAny(pending, oldReadBudget));
+            await oldReadBudget;
+        }
+
         await pipe.Writer.WriteAsync(bytes.AsMemory(5));
         await pipe.Writer.CompleteAsync();
 
-        Assert.Equal(first, await selector.ReadOrGateAsync());
-        Assert.Equal(second, await selector.ReadOrGateAsync());
+        Assert.Equal(first, watchGate ? await selector.ReadOrGateAsync() : await pending.WaitAsync(TimeSpan.FromSeconds(5)));
+        Assert.Equal(second, await selector.ReadOrGateAsync(watchGate));
     }
 
     /// <summary>Disposal or lifetime cancellation drains the retained read and gate wait.</summary>

src/ZB.MOM.WW.MxGateway.Tests/TestSupport/FakeWorkerDiagnostics.cs

@@ -0,0 +1,135 @@
+using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.MxGateway.Contracts.Proto;
+using ZB.MOM.WW.MxGateway.Server.Workers;
+
+namespace ZB.MOM.WW.MxGateway.Tests.TestSupport;
+
+/// <summary>Exposes test-owned worker tasks and safe diagnostic context to fixture cleanup.</summary>
+internal interface IDiagnosticFakeWorker
+{
+    /// <summary>Gets the diagnostic collector for this launcher's workers.</summary>
+    FakeWorkerDiagnostics Diagnostics { get; }
+}
+
+/// <summary>Observes fake worker faults without replacing the test's primary exception.</summary>
+internal sealed class FakeWorkerDiagnostics : ILoggerFactory, ILogger
+{
+    private readonly object _sync = new();
+    private readonly List<Task> _observations = [];
+    private Action<string>? _output;
+    private int _remaining = 16;
+    private bool _closed;
+    private string _phase = "startup";
+    private MxCommandKind? _command;
+    private ulong? _sequence;
+
+    /// <summary>Attaches the fixture's output sink before any workers are launched.</summary>
+    /// <param name="output">Destination for safe, bounded metadata.</param>
+    public void SetOutput(Action<string>? output) => _output = output;
+
+    /// <summary>Records only structural context, never envelopes or command arguments.</summary>
+    /// <param name="envelope">Incoming envelope whose safe metadata is retained.</param>
+    public void Received(WorkerEnvelope envelope)
+    {
+        lock (_sync)
+        {
+            _phase = envelope.BodyCase == WorkerEnvelope.BodyOneofCase.WorkerCommand ? "command" : "shutdown";
+            _command = envelope.BodyCase == WorkerEnvelope.BodyOneofCase.WorkerCommand
+                ? envelope.WorkerCommand.Command.Kind : null;
+            _sequence = envelope.Sequence;
+        }
+    }
+
+    /// <summary>Retains an observation that consumes faults even if bounded teardown times out.</summary>
+    /// <param name="worker">Background task launched by the fake worker.</param>
+    /// <param name="source">Whether the task belongs to a fake worker or fixture teardown.</param>
+    public void Track(Task worker, string source = "fake-worker")
+    {
+        Task observation = worker.ContinueWith(completed =>
+        {
+            // Reading Exception observes every fault; retain no unobserved continuation fault.
+            if (completed.Exception is { } faults)
+            {
+                foreach (Exception fault in faults.Flatten().InnerExceptions)
+                {
+                    Report(source, fault);
+                }
+            }
+        }, CancellationToken.None, TaskContinuationOptions.ExecuteSynchronously, TaskScheduler.Default);
+        _observations.Add(observation);
+    }
+
+    /// <summary>Drains workers under the fixture's existing time limit and closes output.</summary>
+    /// <param name="timeout">Existing test timeout; never extended for diagnostics.</param>
+    /// <returns>The bounded cleanup operation.</returns>
+    public async Task DrainAsync(TimeSpan timeout)
+    {
+        try
+        {
+            await Task.WhenAll(_observations).WaitAsync(timeout).ConfigureAwait(false);
+        }
+        catch (TimeoutException exception)
+        {
+            Report("teardown", exception);
+        }
+        finally
+        {
+            Dispose();
+        }
+    }
+
+    private void Report(string source, Exception exception)
+    {
+        lock (_sync)
+        {
+            if (_closed || _remaining-- <= 0)
+            {
+                return;
+            }
+
+            string code = exception is WorkerFrameProtocolException protocol ? protocol.ErrorCode.ToString() : "none";
+            string line = $"source={source} type={exception.GetType().Name} code={code} phase={_phase} command={_command} sequence={_sequence}";
+            try
+            {
+                _output?.Invoke(line);
+            }
+            catch (Exception)
+            {
+                // A completed output helper must never mask the primary test failure.
+            }
+        }
+    }
+
+    /// <inheritdoc />
+    public ILogger CreateLogger(string categoryName) => this;
+
+    /// <inheritdoc />
+    public void AddProvider(ILoggerProvider provider) => throw new NotSupportedException();
+
+    /// <inheritdoc />
+    public void Dispose()
+    {
+        lock (_sync)
+        {
+            _closed = true;
+            _output = null;
+        }
+    }
+
+    /// <inheritdoc />
+    public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
+
+    /// <inheritdoc />
+    public bool IsEnabled(LogLevel logLevel) => logLevel >= LogLevel.Warning;
+
+    /// <inheritdoc />
+    public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception? exception,
+        Func<TState, Exception?, string> formatter)
+    {
+        // Never invoke formatter: state and exception messages may contain item names/secrets.
+        if (IsEnabled(logLevel) && exception is not null)
+        {
+            Report("gateway", exception);
+        }
+    }
+}

src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/AlarmAckWriterTests.cs

@@ -0,0 +1,262 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Runtime.InteropServices;
+using Google.Protobuf.Collections;
+using ZB.MOM.WW.MxGateway.Contracts.Proto;
+using ZB.MOM.WW.MxGateway.Worker.MxAccess;
+
+namespace ZB.MOM.WW.MxGateway.Worker.Tests.MxAccess;
+
+public sealed class AlarmAckWriterTests
+{
+    private static AlarmAckOperator Alice() =>
+        new AlarmAckOperator { UserName = "alice", Domain = "CORP", Password = "pw-secret" };
+
+    private static RepeatedField<MxStatusProxy> Rows(MxStatusCategory category, int detail) =>
+        new RepeatedField<MxStatusProxy> { new MxStatusProxy { Success = category == MxStatusCategory.Ok ? 1 : 0, Category = category, Detail = detail } };
+
+    [Fact]
+    public void Acknowledge_AuthenticatesThenWritesCommentWithOperatorUserId()
+    {
+        RecordingAckServer server = new RecordingAckServer { AuthenticateResult = 5 };
+        MxAccessWriteCompletionCache cache = new MxAccessWriteCompletionCache();
+        server.OnWrite = (handle, item) => cache.Record(handle, item, Rows(MxStatusCategory.Ok, 0));
+        using AlarmAckWriter writer = new AlarmAckWriter(server, cache, () => { }, TimeSpan.FromSeconds(1), "MxGateway");
+
+        AlarmAckResult result = writer.Acknowledge("T.A.AckMsg", "checked", Alice());
+
+        Assert.Equal(AlarmAckOutcome.Applied, result.Outcome);
+        Assert.Equal(0, result.NativeStatus);
+        Assert.Equal(new[] { "Register:MxGateway", "AuthenticateUser:CORP\\alice", "AddItem:T.A.AckMsg", "Advise", "Write:checked:5" }, server.Operations);
+        Assert.Equal("pw-secret", server.LastPassword);
+    }
+
+    [Fact]
+    public void Acknowledge_WhenWriteRejected_ReturnsDetailAndStatuses()
+    {
+        RecordingAckServer server = new RecordingAckServer { AuthenticateResult = 5 };
+        MxAccessWriteCompletionCache cache = new MxAccessWriteCompletionCache();
+        server.OnWrite = (handle, item) => cache.Record(handle, item, Rows(MxStatusCategory.SecurityError, 1008));
+        using AlarmAckWriter writer = new AlarmAckWriter(server, cache, () => { }, TimeSpan.FromSeconds(1), "MxGateway");
+
+        AlarmAckResult result = writer.Acknowledge("T.A.AckMsg", "checked", Alice());
+
+        Assert.Equal(AlarmAckOutcome.WriteRejected, result.Outcome);
+        Assert.Equal(1008, result.NativeStatus);
+        Assert.Single(result.Statuses);
+    }
+
+    [Fact]
+    public void Acknowledge_WhenNoCompletion_ReturnsUnconfirmed()
+    {
+        RecordingAckServer server = new RecordingAckServer { AuthenticateResult = 5 };
+        using AlarmAckWriter writer = new AlarmAckWriter(server, new MxAccessWriteCompletionCache(), () => { }, TimeSpan.FromMilliseconds(50), "MxGateway");
+
+        AlarmAckResult result = writer.Acknowledge("T.A.AckMsg", "checked", Alice());
+
+        Assert.Equal(AlarmAckOutcome.Unconfirmed, result.Outcome);
+        Assert.Equal(0, result.NativeStatus);
+    }
+
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    public void Acknowledge_WhenAuthenticationFails_DoesNotWriteOrLeakPassword(bool throwComException)
+    {
+        RecordingAckServer server = new RecordingAckServer
+        {
+            AuthenticateResult = 0,
+            AuthenticateException = throwComException ? new COMException("bad credentials", unchecked((int)0x80070005)) : null,
+        };
+        using AlarmAckWriter writer = new AlarmAckWriter(server, new MxAccessWriteCompletionCache(), () => { }, TimeSpan.FromMilliseconds(50), "MxGateway");
+
+        AlarmAckResult result = writer.Acknowledge("T.A.AckMsg", "checked", Alice());
+
+        Assert.Equal(AlarmAckOutcome.AuthenticationFailed, result.Outcome);
+        Assert.NotEqual(0, result.NativeStatus);
+        Assert.DoesNotContain(server.Operations, op => op.StartsWith("Write", StringComparison.Ordinal));
+        Assert.DoesNotContain("pw-secret", result.Diagnostic, StringComparison.Ordinal);
+        Assert.DoesNotContain(server.Operations, op => op.Contains("pw-secret"));
+    }
+
+    [Fact]
+    public void Acknowledge_Twice_ReusesItemHandle()
+    {
+        RecordingAckServer server = new RecordingAckServer { AuthenticateResult = 5 };
+        using AlarmAckWriter writer = new AlarmAckWriter(server, new MxAccessWriteCompletionCache(), () => { }, TimeSpan.FromMilliseconds(10), "MxGateway");
+
+        writer.Acknowledge("T.A.AckMsg", "one", Alice());
+        writer.Acknowledge("T.A.AckMsg", "two", Alice());
+
+        Assert.Equal(1, server.Operations.Count(op => op.StartsWith("AddItem", StringComparison.Ordinal)));
+        Assert.Equal(1, server.Operations.Count(op => op == "Advise"));
+    }
+
+    [Fact]
+    public void Acknowledge_WhenAdviseThrows_RejectsCleansUpAndReAddsNextTime()
+    {
+        RecordingAckServer server = new RecordingAckServer { AuthenticateResult = 5, AdviseException = new COMException("x", unchecked((int)0x80004005)) };
+        using AlarmAckWriter writer = new AlarmAckWriter(server, new MxAccessWriteCompletionCache(), () => { }, TimeSpan.FromMilliseconds(10), "MxGateway");
+
+        AlarmAckResult first = writer.Acknowledge("T.A.AckMsg", "one", Alice());
+        server.AdviseException = null;
+        writer.Acknowledge("T.A.AckMsg", "two", Alice());
+
+        Assert.Equal(AlarmAckOutcome.WriteRejected, first.Outcome);
+        Assert.Equal(unchecked((int)0x80004005), first.NativeStatus);
+        Assert.DoesNotContain("pw-secret", first.Diagnostic, StringComparison.Ordinal);
+        Assert.Contains("RemoveItem", server.Operations);
+        Assert.Equal(2, server.Operations.Count(op => op.StartsWith("AddItem", StringComparison.Ordinal)));
+    }
+
+    [Fact]
+    public void Acknowledge_WhenCachedWriteThrows_RejectsAndReAddsNextTime()
+    {
+        RecordingAckServer server = new RecordingAckServer { AuthenticateResult = 5 };
+        using AlarmAckWriter writer = new AlarmAckWriter(server, new MxAccessWriteCompletionCache(), () => { }, TimeSpan.FromMilliseconds(10), "MxGateway");
+        writer.Acknowledge("T.A.AckMsg", "one", Alice());
+        server.WriteException = new COMException("x", unchecked((int)0x80004005));
+
+        AlarmAckResult failed = writer.Acknowledge("T.A.AckMsg", "two", Alice());
+        server.WriteException = null;
+        writer.Acknowledge("T.A.AckMsg", "three", Alice());
+
+        Assert.Equal(AlarmAckOutcome.WriteRejected, failed.Outcome);
+        Assert.Equal(2, server.Operations.Count(op => op.StartsWith("AddItem", StringComparison.Ordinal)));
+    }
+
+    [Fact]
+    public void Acknowledge_WhenWriteDisconnected_TearsDownServer()
+    {
+        // The test seam has no COM factory, so re-registration itself is not
+        // exercised here; this verifies the teardown that makes it possible.
+        RecordingAckServer server = new RecordingAckServer { AuthenticateResult = 5, WriteException = new COMException("x", unchecked((int)0x80010108)) };
+        using AlarmAckWriter writer = new AlarmAckWriter(server, new MxAccessWriteCompletionCache(), () => { }, TimeSpan.FromMilliseconds(10), "MxGateway");
+
+        AlarmAckResult result = writer.Acknowledge("T.A.AckMsg", "one", Alice());
+
+        Assert.Equal(AlarmAckOutcome.WriteRejected, result.Outcome);
+        Assert.Equal(unchecked((int)0x80010108), result.NativeStatus);
+        Assert.Contains("Unregister", server.Operations);
+    }
+
+    [Fact]
+    public void Acknowledge_WhenNonOkCompletionHasNoDetail_ReturnsMinusOne()
+    {
+        RecordingAckServer server = new RecordingAckServer { AuthenticateResult = 5 };
+        MxAccessWriteCompletionCache cache = new MxAccessWriteCompletionCache();
+        server.OnWrite = (handle, item) => cache.Record(handle, item, Rows(MxStatusCategory.SecurityError, 0));
+        using AlarmAckWriter writer = new AlarmAckWriter(server, cache, () => { }, TimeSpan.FromSeconds(1), "MxGateway");
+
+        AlarmAckResult result = writer.Acknowledge("T.A.AckMsg", "checked", Alice());
+
+        Assert.Equal(AlarmAckOutcome.WriteRejected, result.Outcome);
+        Assert.Equal(-1, result.NativeStatus);
+    }
+
+    [Fact]
+    public void AlarmAckOperator_ToString_OmitsPassword()
+    {
+        Assert.DoesNotContain("pw-secret", Alice().ToString(), StringComparison.Ordinal);
+    }
+}
+
+internal sealed class RecordingAckServer : IMxAccessServer
+{
+    private int nextItemHandle = 100;
+
+    public List<string> Operations { get; } = new();
+
+    public int AuthenticateResult { get; set; }
+
+    public Exception? AuthenticateException { get; set; }
+
+    public Exception? AdviseException { get; set; }
+
+    public Exception? WriteException { get; set; }
+
+    public string? LastPassword { get; private set; }
+
+    public Action<int, int>? OnWrite { get; set; }
+
+    public int Register(string clientName)
+    {
+        Operations.Add("Register:" + clientName);
+        return 7;
+    }
+
+    public void Unregister(int serverHandle) => Operations.Add("Unregister");
+
+    public int AddItem(int serverHandle, string itemDefinition)
+    {
+        Operations.Add("AddItem:" + itemDefinition);
+        return nextItemHandle++;
+    }
+
+    public int AddItem2(int serverHandle, string itemDefinition, string itemContext) => AddItem(serverHandle, itemDefinition);
+
+    public void RemoveItem(int serverHandle, int itemHandle) => Operations.Add("RemoveItem");
+
+    public void Advise(int serverHandle, int itemHandle)
+    {
+        Operations.Add("Advise");
+        if (AdviseException is not null)
+        {
+            throw AdviseException;
+        }
+    }
+
+    public void UnAdvise(int serverHandle, int itemHandle) => Operations.Add("UnAdvise");
+
+    public void AdviseSupervisory(int serverHandle, int itemHandle)
+    {
+    }
+
+    public void Write(int serverHandle, int itemHandle, object? value, int userId)
+    {
+        Operations.Add("Write:" + value + ":" + userId);
+        if (WriteException is not null)
+        {
+            throw WriteException;
+        }
+
+        OnWrite?.Invoke(serverHandle, itemHandle);
+    }
+
+    public void Write2(int serverHandle, int itemHandle, object? value, object? timestamp, int userId)
+    {
+    }
+
+    public void WriteSecured(int serverHandle, int itemHandle, int currentUserId, int verifierUserId, object? value)
+    {
+    }
+
+    public void WriteSecured2(int serverHandle, int itemHandle, int currentUserId, int verifierUserId, object? value, object? timestamp)
+    {
+    }
+
+    public object Suspend(int serverHandle, int itemHandle) => new object();
+
+    public object Activate(int serverHandle, int itemHandle) => new object();
+
+    public int AuthenticateUser(int serverHandle, string verifyUser, string verifyUserPassword)
+    {
+        Operations.Add("AuthenticateUser:" + verifyUser);
+        LastPassword = verifyUserPassword;
+        if (AuthenticateException is not null)
+        {
+            throw AuthenticateException;
+        }
+
+        return AuthenticateResult;
+    }
+
+    public int ArchestrAUserToId(int serverHandle, string userIdGuid) => 0;
+
+    public int AddBufferedItem(int serverHandle, string itemDefinition, string itemContext) => AddItem(serverHandle, itemDefinition);
+
+    public void SetBufferedUpdateInterval(int serverHandle, int updateIntervalMilliseconds)
+    {
+    }
+}

src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/AlarmCommandExecutorTests.cs

@@ -116,7 +116,7 @@ public sealed class AlarmCommandExecutorTests
     [Fact]
     public void AcknowledgeAlarm_WithHandler_RoutesNativeStatusIntoHresultAndPayload()
     {
-        FakeAlarmHandler handler = new FakeAlarmHandler { AcknowledgeReturn = 0 };
+        FakeAlarmHandler handler = new FakeAlarmHandler();
         MxAccessCommandExecutor executor = NewExecutor(handler);
         Guid g = Guid.NewGuid();
 
@@ -143,7 +143,10 @@ public sealed class AlarmCommandExecutorTests
         Assert.NotNull(reply.AcknowledgeAlarm);
         Assert.Equal(0, reply.AcknowledgeAlarm.NativeStatus);
         Assert.Equal(g, handler.LastAckGuid);
-        Assert.Equal("alice", handler.LastAckOperatorName);
+        Assert.Equal("ack", handler.LastComment);
+        Assert.Equal("alice", handler.LastOperator!.UserName);
+        Assert.Equal("CORP", handler.LastOperator.Domain);
+        Assert.Equal(string.Empty, handler.LastOperator.Password);
     }
 
     /// <summary>Verifies that invalid alarm GUID returns invalid request.</summary>
@@ -168,11 +171,14 @@ public sealed class AlarmCommandExecutorTests
         Assert.Equal(ProtocolStatusCode.InvalidRequest, reply.ProtocolStatus.Code);
     }
 
-    /// <summary>Verifies that nonzero native status carries a diagnostic message.</summary>
+    /// <summary>Verifies that a rejected write carries its native status and diagnostic.</summary>
     [Fact]
     public void AcknowledgeAlarm_WithNonzeroNativeStatus_CarriesDiagnostic()
     {
-        FakeAlarmHandler handler = new FakeAlarmHandler { AcknowledgeReturn = -123 };
+        FakeAlarmHandler handler = new FakeAlarmHandler
+        {
+            AckResult = AlarmAckResult.Create(AlarmAckOutcome.WriteRejected, -123, "AckMsg write rejected: detail -123."),
+        };
         MxAccessCommandExecutor executor = NewExecutor(handler);
 
         StaCommand command = new StaCommand(
@@ -188,7 +194,9 @@ public sealed class AlarmCommandExecutorTests
 
         MxCommandReply reply = executor.Execute(command);
 
+        Assert.Equal(ProtocolStatusCode.MxaccessFailure, reply.ProtocolStatus.Code);
         Assert.Equal(-123, reply.Hresult);
+        Assert.Equal(-123, reply.AcknowledgeAlarm.NativeStatus);
         Assert.Contains("-123", reply.DiagnosticMessage);
     }
 
@@ -196,7 +204,7 @@ public sealed class AlarmCommandExecutorTests
     [Fact]
     public void AcknowledgeAlarmByName_WithHandler_RoutesTupleToHandler()
     {
-        FakeAlarmHandler handler = new FakeAlarmHandler { AcknowledgeReturn = 0 };
+        FakeAlarmHandler handler = new FakeAlarmHandler();
         MxAccessCommandExecutor executor = NewExecutor(handler);
 
         StaCommand command = new StaCommand(
@@ -223,7 +231,133 @@ public sealed class AlarmCommandExecutorTests
         Assert.Equal("TestMachine_001.TestAlarm001", handler.LastAckByNameTuple!.Value.Name);
         Assert.Equal("Galaxy", handler.LastAckByNameTuple!.Value.Provider);
         Assert.Equal("TestArea", handler.LastAckByNameTuple!.Value.Group);
-        Assert.Equal("alice", handler.LastAckOperatorName);
+        Assert.Equal("ack", handler.LastComment);
+        Assert.Equal("alice", handler.LastOperator!.UserName);
+    }
+
+    /// <summary>
+    ///     Every ack outcome maps to its protocol status, carries the native
+    ///     status, and never echoes the operator password.
+    /// </summary>
+    /// <param name="outcome">The writer outcome.</param>
+    /// <param name="expected">The expected protocol status.</param>
+    [Theory]
+    [InlineData(AlarmAckOutcome.Applied, ProtocolStatusCode.Ok)]
+    [InlineData(AlarmAckOutcome.Unconfirmed, ProtocolStatusCode.Ok)]
+    [InlineData(AlarmAckOutcome.AlarmNotFound, ProtocolStatusCode.InvalidRequest)]
+    [InlineData(AlarmAckOutcome.NotAckable, ProtocolStatusCode.InvalidRequest)]
+    [InlineData(AlarmAckOutcome.AuthenticationFailed, ProtocolStatusCode.MxaccessFailure)]
+    [InlineData(AlarmAckOutcome.WriteRejected, ProtocolStatusCode.MxaccessFailure)]
+    public void AcknowledgeAlarm_MapsOutcomeWithoutLeakingPassword(AlarmAckOutcome outcome, ProtocolStatusCode expected)
+    {
+        int native = outcome is AlarmAckOutcome.Applied or AlarmAckOutcome.Unconfirmed ? 0 : 1008;
+        FakeAlarmHandler handler = new FakeAlarmHandler
+        {
+            AckResult = AlarmAckResult.Create(outcome, native, "diagnostic for alice"),
+        };
+
+        MxCommandReply reply = Execute(handler, new MxCommand
+        {
+            Kind = MxCommandKind.AcknowledgeAlarm,
+            AcknowledgeAlarmCommand = new AcknowledgeAlarmCommand
+            {
+                AlarmGuid = Guid.NewGuid().ToString(),
+                Comment = "checked",
+                OperatorUser = "alice",
+                OperatorDomain = "CORP",
+                OperatorPassword = "pw-secret",
+            },
+        });
+
+        AssertAckReply(reply, handler, expected, native);
+    }
+
+    /// <summary>The by-name ack maps outcomes identically and never echoes the operator password.</summary>
+    /// <param name="outcome">The writer outcome.</param>
+    /// <param name="expected">The expected protocol status.</param>
+    [Theory]
+    [InlineData(AlarmAckOutcome.Applied, ProtocolStatusCode.Ok)]
+    [InlineData(AlarmAckOutcome.Unconfirmed, ProtocolStatusCode.Ok)]
+    [InlineData(AlarmAckOutcome.AlarmNotFound, ProtocolStatusCode.InvalidRequest)]
+    [InlineData(AlarmAckOutcome.NotAckable, ProtocolStatusCode.InvalidRequest)]
+    [InlineData(AlarmAckOutcome.AuthenticationFailed, ProtocolStatusCode.MxaccessFailure)]
+    [InlineData(AlarmAckOutcome.WriteRejected, ProtocolStatusCode.MxaccessFailure)]
+    public void AcknowledgeAlarmByName_MapsOutcomeWithoutLeakingPassword(AlarmAckOutcome outcome, ProtocolStatusCode expected)
+    {
+        int native = outcome is AlarmAckOutcome.Applied or AlarmAckOutcome.Unconfirmed ? 0 : 1008;
+        FakeAlarmHandler handler = new FakeAlarmHandler
+        {
+            AckResult = AlarmAckResult.Create(outcome, native, "diagnostic for alice"),
+        };
+
+        MxCommandReply reply = Execute(handler, new MxCommand
+        {
+            Kind = MxCommandKind.AcknowledgeAlarmByName,
+            AcknowledgeAlarmByNameCommand = new AcknowledgeAlarmByNameCommand
+            {
+                AlarmName = "TestMachine_001.TestAlarm001",
+                ProviderName = "Galaxy",
+                GroupName = "TestArea",
+                Comment = "checked",
+                OperatorUser = "alice",
+                OperatorDomain = "CORP",
+                OperatorPassword = "pw-secret",
+            },
+        });
+
+        AssertAckReply(reply, handler, expected, native);
+    }
+
+    /// <summary>The writer's OnWriteComplete statuses are copied onto the reply.</summary>
+    [Fact]
+    public void AcknowledgeAlarm_CopiesWriteStatusesIntoReply()
+    {
+        MxStatusProxy status = new MxStatusProxy { Category = MxStatusCategory.Ok, Success = 1 };
+        FakeAlarmHandler handler = new FakeAlarmHandler
+        {
+            AckResult = AlarmAckResult.Create(AlarmAckOutcome.Applied, 0, string.Empty, new[] { status }),
+        };
+
+        MxCommandReply reply = Execute(handler, new MxCommand
+        {
+            Kind = MxCommandKind.AcknowledgeAlarm,
+            AcknowledgeAlarmCommand = new AcknowledgeAlarmCommand { AlarmGuid = Guid.NewGuid().ToString(), OperatorUser = "alice" },
+        });
+
+        Assert.Equal(status, Assert.Single(reply.Statuses));
+    }
+
+    /// <summary>
+    ///     An exception escaping the ack path (e.g. the writer's MXAccess
+    ///     Register failing) maps to MxaccessFailure with only the exception type
+    ///     and HRESULT — never the exception text, which is not under our control.
+    /// </summary>
+    [Fact]
+    public void AcknowledgeAlarmByName_WhenHandlerThrows_ReportsTypeAndHresultOnly()
+    {
+        FakeAlarmHandler handler = new FakeAlarmHandler
+        {
+            AcknowledgeException = new System.Runtime.InteropServices.COMException("echo pw-secret", unchecked((int)0x80004005)),
+        };
+
+        MxCommandReply reply = Execute(handler, new MxCommand
+        {
+            Kind = MxCommandKind.AcknowledgeAlarmByName,
+            AcknowledgeAlarmByNameCommand = new AcknowledgeAlarmByNameCommand
+            {
+                AlarmName = "TestMachine_001.TestAlarm001",
+                ProviderName = "Galaxy",
+                OperatorUser = "alice",
+                OperatorPassword = "pw-secret",
+            },
+        });
+
+        Assert.Equal(ProtocolStatusCode.MxaccessFailure, reply.ProtocolStatus.Code);
+        Assert.Equal(unchecked((int)0x80004005), reply.Hresult);
+        Assert.Contains("COMException", reply.DiagnosticMessage, StringComparison.Ordinal);
+        Assert.Contains("0x80004005", reply.DiagnosticMessage, StringComparison.Ordinal);
+        Assert.DoesNotContain("pw-secret", reply.DiagnosticMessage, StringComparison.Ordinal);
+        Assert.DoesNotContain("pw-secret", reply.ProtocolStatus.Message, StringComparison.Ordinal);
     }
 
     /// <summary>Verifies that empty alarm name returns invalid request.</summary>
@@ -393,7 +527,10 @@ public sealed class AlarmCommandExecutorTests
     [Fact]
     public void AcknowledgeAlarm_WhenHandlerThrows_ReturnsMxaccessFailure()
     {
-        FakeAlarmHandler handler = new FakeAlarmHandler { AcknowledgeThrow = true };
+        FakeAlarmHandler handler = new FakeAlarmHandler
+        {
+            AcknowledgeException = new InvalidOperationException("simulated alarm-handler failure"),
+        };
         MxAccessCommandExecutor executor = NewExecutor(handler);
 
         StaCommand command = new StaCommand(
@@ -410,7 +547,25 @@ public sealed class AlarmCommandExecutorTests
         MxCommandReply reply = executor.Execute(command);
 
         Assert.Equal(ProtocolStatusCode.MxaccessFailure, reply.ProtocolStatus.Code);
-        Assert.Contains("simulated", reply.DiagnosticMessage);
+        Assert.Contains("InvalidOperationException", reply.DiagnosticMessage, StringComparison.Ordinal);
+        Assert.DoesNotContain("simulated", reply.DiagnosticMessage, StringComparison.Ordinal);
+    }
+
+    private static MxCommandReply Execute(IAlarmCommandHandler handler, MxCommand command) =>
+        NewExecutor(handler).Execute(new StaCommand(SessionId, CorrelationId, command));
+
+    private static void AssertAckReply(MxCommandReply reply, FakeAlarmHandler handler, ProtocolStatusCode expected, int native)
+    {
+        Assert.Equal(expected, reply.ProtocolStatus.Code);
+        Assert.Equal(native, reply.Hresult);
+        Assert.Equal(native, reply.AcknowledgeAlarm.NativeStatus);
+        Assert.Equal("diagnostic for alice", reply.DiagnosticMessage);
+        Assert.Equal("checked", handler.LastComment);
+        Assert.Equal("alice", handler.LastOperator!.UserName);
+        Assert.Equal("CORP", handler.LastOperator.Domain);
+        Assert.Equal("pw-secret", handler.LastOperator.Password);
+        Assert.DoesNotContain("pw-secret", reply.DiagnosticMessage ?? string.Empty, StringComparison.Ordinal);
+        Assert.DoesNotContain("pw-secret", reply.ProtocolStatus.Message ?? string.Empty, StringComparison.Ordinal);
     }
 
     private static MxAccessCommandExecutor NewExecutor(IAlarmCommandHandler? alarmHandler)
@@ -442,14 +597,17 @@ public sealed class AlarmCommandExecutorTests
         /// <summary>Gets the last acknowledge alarm GUID.</summary>
         public Guid LastAckGuid { get; private set; }
 
-        /// <summary>Gets the last acknowledge operator name.</summary>
-        public string? LastAckOperatorName { get; private set; }
+        /// <summary>Gets the last acknowledge comment.</summary>
+        public string? LastComment { get; private set; }
 
-        /// <summary>Gets or sets the value returned by acknowledge.</summary>
-        public int AcknowledgeReturn { get; set; }
+        /// <summary>Gets the last acknowledge operator.</summary>
+        public AlarmAckOperator? LastOperator { get; private set; }
 
-        /// <summary>Gets or sets a value indicating whether acknowledge throws.</summary>
-        public bool AcknowledgeThrow { get; set; }
+        /// <summary>Gets or sets the result returned by both acknowledge methods.</summary>
+        public AlarmAckResult AckResult { get; set; } = AlarmAckResult.Create(AlarmAckOutcome.Applied, 0, string.Empty);
+
+        /// <summary>Gets or sets an exception both acknowledge methods throw.</summary>
+        public Exception? AcknowledgeException { get; set; }
 
         /// <summary>Gets or sets the query result snapshots.</summary>
         public IReadOnlyList<ActiveAlarmSnapshot> QueryResult { get; set; } =
@@ -484,28 +642,32 @@ public sealed class AlarmCommandExecutorTests
         }
 
         /// <inheritdoc />
-        public int Acknowledge(
-            Guid alarmGuid, string comment, string operatorUser,
-            string operatorNode, string operatorDomain, string operatorFullName)
+        public AlarmAckResult Acknowledge(Guid alarmGuid, string comment, AlarmAckOperator ackOperator)
         {
             LastAckGuid = alarmGuid;
-            LastAckOperatorName = operatorUser;
-            if (AcknowledgeThrow)
+            LastComment = comment;
+            LastOperator = ackOperator;
+            if (AcknowledgeException is not null)
             {
-                throw new InvalidOperationException("simulated alarm-handler failure");
+                throw AcknowledgeException;
             }
-            return AcknowledgeReturn;
+
+            return AckResult;
         }
 
         /// <inheritdoc />
-        public int AcknowledgeByName(
-            string alarmName, string providerName, string groupName,
-            string comment, string operatorUser, string operatorNode,
-            string operatorDomain, string operatorFullName)
+        public AlarmAckResult AcknowledgeByName(
+            string alarmName, string providerName, string groupName, string comment, AlarmAckOperator ackOperator)
         {
             LastAckByNameTuple = (alarmName, providerName, groupName);
-            LastAckOperatorName = operatorUser;
-            return AcknowledgeReturn;
+            LastComment = comment;
+            LastOperator = ackOperator;
+            if (AcknowledgeException is not null)
+            {
+                throw AcknowledgeException;
+            }
+
+            return AckResult;
         }
 
         /// <summary>Gets the last acknowledge by name tuple.</summary>

src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/AlarmCommandHandlerTests.cs

@@ -96,22 +96,100 @@ public sealed class AlarmCommandHandlerTests
         Assert.False(handler.IsSubscribed);
     }
 
-    /// <summary>Verifies that acknowledge forwards to consumer with full operator identity when subscribed.</summary>
+    /// <summary>Verifies that acknowledge resolves via the consumer and writes through the injected writer as the operator.</summary>
     [Fact]
-    public void Acknowledge_WhenSubscribed_ForwardsToConsumerWithFullOperatorIdentity()
+    public void Acknowledge_WhenSubscribed_ResolvesTargetAndWritesAsOperator()
     {
-        FakeConsumer consumer = new FakeConsumer { AcknowledgeReturn = 0 };
-        AlarmCommandHandler handler = new AlarmCommandHandler(
-            new MxAccessEventQueue(),
-            () => consumer);
+        FakeConsumer consumer = new FakeConsumer { AckTarget = AlarmAckTarget.For("T.A.AckMsg") };
+        RecordingAckWriter writer = new RecordingAckWriter();
+        AlarmCommandHandler handler = NewHandlerWithWriter(() => consumer, writer);
         handler.Subscribe(new SubscribeAlarmsCommand { SubscriptionExpression = @"\\HOST\Galaxy!A" }, "s1");
 
         Guid g = Guid.NewGuid();
-        int rc = handler.Acknowledge(g, "c", "u", "n", "d", "F");
+        AlarmAckOperator op = new AlarmAckOperator { UserName = "u", Domain = "d", Password = "p" };
+        AlarmAckResult result = handler.Acknowledge(g, "c", op);
 
-        Assert.Equal(0, rc);
-        Assert.Equal(g, consumer.LastAckGuid);
-        Assert.Equal("u", consumer.LastAckOperatorName);
+        Assert.Equal(AlarmAckOutcome.Applied, result.Outcome);
+        Assert.Equal(g, consumer.LastResolvedGuid);
+        Assert.Equal("T.A.AckMsg", writer.LastItemAddress);
+        Assert.Equal("c", writer.LastComment);
+        Assert.Same(op, writer.LastOperator);
+    }
+
+    /// <summary>Verifies acknowledge-by-name forwards the tuple and a null comment becomes empty.</summary>
+    [Fact]
+    public void AcknowledgeByName_WhenSubscribed_ForwardsTupleAndNormalizesComment()
+    {
+        FakeConsumer consumer = new FakeConsumer();
+        RecordingAckWriter writer = new RecordingAckWriter();
+        AlarmCommandHandler handler = NewHandlerWithWriter(() => consumer, writer);
+        handler.Subscribe(new SubscribeAlarmsCommand { SubscriptionExpression = @"\\HOST\Galaxy!A" }, "s1");
+
+        handler.AcknowledgeByName("Tag1", "Galaxy", "Area", null!, new AlarmAckOperator { UserName = "u" });
+
+        Assert.Equal(("Tag1", "Galaxy", "Area"), consumer.LastResolvedName);
+        Assert.Equal(string.Empty, writer.LastComment);
+    }
+
+    /// <summary>Verifies a null operator is rejected.</summary>
+    [Fact]
+    public void Acknowledge_NullOperator_Throws()
+    {
+        AlarmCommandHandler handler = NewHandlerWithWriter(() => new FakeConsumer(), new RecordingAckWriter());
+        handler.Subscribe(new SubscribeAlarmsCommand { SubscriptionExpression = @"\\HOST\Galaxy!A" }, "s1");
+
+        Assert.Throws<ArgumentNullException>(() => handler.Acknowledge(Guid.NewGuid(), "c", null!));
+    }
+
+    /// <summary>
+    ///     The ack writer is created once, on first acknowledgement, survives an
+    ///     unsubscribe/resubscribe cycle, and is disposed with the handler.
+    /// </summary>
+    [Fact]
+    public void AckWriter_CreatedLazilyOnce_AndDisposedWithHandler()
+    {
+        RecordingAckWriter writer = new RecordingAckWriter();
+        int created = 0;
+        AlarmCommandHandler handler = new AlarmCommandHandler(
+            new MxAccessEventQueue(),
+            () => new FakeConsumer(),
+            threadAffinityCheck: null,
+            comFactory: null,
+            standbyFactory: null,
+            ackWriterFactory: () =>
+            {
+                created++;
+                return writer;
+            });
+
+        handler.Subscribe(new SubscribeAlarmsCommand { SubscriptionExpression = @"\\HOST\Galaxy!A" }, "s1");
+        Assert.Equal(0, created);
+
+        handler.Acknowledge(Guid.NewGuid(), "c", new AlarmAckOperator());
+        handler.Unsubscribe();
+        Assert.False(writer.Disposed);
+
+        handler.Subscribe(new SubscribeAlarmsCommand { SubscriptionExpression = @"\\HOST\Galaxy!A" }, "s1");
+        handler.AcknowledgeByName("a", "Galaxy", "g", "c", new AlarmAckOperator());
+        Assert.Equal(1, created);
+
+        handler.Dispose();
+        Assert.True(writer.Disposed);
+    }
+
+    /// <summary>
+    ///     Without a COM factory or writer factory, subscribing still works and
+    ///     the acknowledgement fails with a diagnosable InvalidOperationException.
+    /// </summary>
+    [Fact]
+    public void Acknowledge_WithoutComFactoryOrWriterFactory_ThrowsInvalidOperation()
+    {
+        AlarmCommandHandler handler = new AlarmCommandHandler(new MxAccessEventQueue(), () => new FakeConsumer());
+        handler.Subscribe(new SubscribeAlarmsCommand { SubscriptionExpression = @"\\HOST\Galaxy!A" }, "s1");
+
+        InvalidOperationException ex = Assert.Throws<InvalidOperationException>(
+            () => handler.Acknowledge(Guid.NewGuid(), "c", new AlarmAckOperator()));
+        Assert.Contains("IMxAccessComObjectFactory", ex.Message);
     }
 
     /// <summary>Verifies that acknowledge throws invalid operation when called before subscribe.</summary>
@@ -123,7 +201,7 @@ public sealed class AlarmCommandHandlerTests
             () => new FakeConsumer());
 
         Assert.Throws<InvalidOperationException>(
-            () => handler.Acknowledge(Guid.Empty, "", "", "", "", ""));
+            () => handler.Acknowledge(Guid.Empty, "", new AlarmAckOperator()));
     }
 
     /// <summary>Verifies that query active returns mapped proto snapshots when consumer has alarms.</summary>
@@ -266,7 +344,10 @@ public sealed class AlarmCommandHandlerTests
         AlarmCommandHandler handler = new AlarmCommandHandler(
             new MxAccessEventQueue(),
             () => consumer,
-            () => guardInvocations++);
+            () => guardInvocations++,
+            comFactory: null,
+            standbyFactory: null,
+            ackWriterFactory: () => new RecordingAckWriter());
 
         // Subscribe is the first call — guard must run before the consumer
         // factory is invoked. We tally invocation counts after each call so
@@ -275,10 +356,10 @@ public sealed class AlarmCommandHandlerTests
         handler.Subscribe(new SubscribeAlarmsCommand { SubscriptionExpression = @"\\HOST\Galaxy!A" }, "s1");
         Assert.Equal(1, guardInvocations);
 
-        handler.Acknowledge(Guid.NewGuid(), "c", "u", "n", "d", "F");
+        handler.Acknowledge(Guid.NewGuid(), "c", new AlarmAckOperator { UserName = "u" });
         Assert.Equal(2, guardInvocations);
 
-        handler.AcknowledgeByName("a", "p", "g", "c", "u", "n", "d", "F");
+        handler.AcknowledgeByName("a", "p", "g", "c", new AlarmAckOperator { UserName = "u" });
         Assert.Equal(3, guardInvocations);
 
         _ = handler.QueryActive(null, out _);
@@ -323,9 +404,9 @@ public sealed class AlarmCommandHandlerTests
         // assert each independently with a fresh handler. Below we reuse
         // the same throwing handler for the not-subscribed-yet entries:
         Assert.Throws<InvalidOperationException>(
-            () => handler.Acknowledge(Guid.Empty, "", "", "", "", ""));
+            () => handler.Acknowledge(Guid.Empty, "", new AlarmAckOperator()));
         Assert.Throws<InvalidOperationException>(
-            () => handler.AcknowledgeByName("", "", "", "", "", "", "", ""));
+            () => handler.AcknowledgeByName("", "", "", "", new AlarmAckOperator()));
         Assert.Throws<InvalidOperationException>(() => handler.QueryActive(null, out _));
         Assert.Throws<InvalidOperationException>(() => handler.PollOnce());
         Assert.Throws<InvalidOperationException>(
@@ -422,16 +503,17 @@ public sealed class AlarmCommandHandlerTests
     [Fact]
     public void Subscribe_AutoModeWithEmptyWatchListAndFallbackEnabled_BuildsReplaceableStandby()
     {
-        FakeConsumer primary = new FakeConsumer { AcknowledgeReturn = 11 };
-        FakeConsumer initialStandby = new FakeConsumer { AcknowledgeReturn = 22 };
-        FakeConsumer replacement = new FakeConsumer { AcknowledgeReturn = 33 };
+        FakeConsumer primary = new FakeConsumer { AckTarget = AlarmAckTarget.For("11.AckMsg") };
+        FakeConsumer initialStandby = new FakeConsumer { AckTarget = AlarmAckTarget.For("22.AckMsg") };
+        FakeConsumer replacement = new FakeConsumer { AckTarget = AlarmAckTarget.For("33.AckMsg") };
         int buildCount = 0;
         AlarmCommandHandler handler = new AlarmCommandHandler(
             new MxAccessEventQueue(),
             () => primary,
             threadAffinityCheck: null,
             comFactory: null,
-            standbyFactory: _ => ++buildCount == 1 ? initialStandby : replacement);
+            standbyFactory: _ => ++buildCount == 1 ? initialStandby : replacement,
+            ackWriterFactory: () => new RecordingAckWriter());
 
         handler.Subscribe(new SubscribeAlarmsCommand
         {
@@ -443,7 +525,7 @@ public sealed class AlarmCommandHandlerTests
         Assert.Equal(2, buildCount);
         Assert.Equal(@"\\HOST\Galaxy!Area", replacement.LastSubscription);
         Assert.True(initialStandby.Disposed);
-        Assert.Equal(11, handler.Acknowledge(Guid.Empty, "", "", "", "", ""));
+        Assert.Equal("11.AckMsg", AckItemOf(handler));
     }
 
     /// <summary>A replacement is rejected when no fallback-capable subscription is active.</summary>
@@ -471,16 +553,17 @@ public sealed class AlarmCommandHandlerTests
     [Fact]
     public void UpdateWatchList_WhenReplacementSubscribeFails_PreservesOldStandbyAndPrimaryMode()
     {
-        FakeConsumer primary = new FakeConsumer { AcknowledgeReturn = 11 };
-        FakeConsumer oldStandby = new FakeConsumer { AcknowledgeReturn = 22 };
-        FakeConsumer failedReplacement = new FakeConsumer { ThrowOnSubscribe = true, AcknowledgeReturn = 33 };
+        FakeConsumer primary = new FakeConsumer { AckTarget = AlarmAckTarget.For("11.AckMsg") };
+        FakeConsumer oldStandby = new FakeConsumer { AckTarget = AlarmAckTarget.For("22.AckMsg") };
+        FakeConsumer failedReplacement = new FakeConsumer { ThrowOnSubscribe = true, AckTarget = AlarmAckTarget.For("33.AckMsg") };
         int buildCount = 0;
         AlarmCommandHandler handler = new AlarmCommandHandler(
             new MxAccessEventQueue(),
             () => primary,
             null,
             null,
-            _ => ++buildCount == 1 ? oldStandby : failedReplacement);
+            _ => ++buildCount == 1 ? oldStandby : failedReplacement,
+            () => new RecordingAckWriter());
         SubscribeAlarmsCommand subscribe = new SubscribeAlarmsCommand
         {
             SubscriptionExpression = @"\\HOST\Galaxy!Area",
@@ -494,23 +577,24 @@ public sealed class AlarmCommandHandlerTests
 
         Assert.False(oldStandby.Disposed);
         Assert.True(failedReplacement.Disposed);
-        Assert.Equal(11, handler.Acknowledge(Guid.Empty, "", "", "", "", ""));
+        Assert.Equal("11.AckMsg", AckItemOf(handler));
     }
 
     /// <summary>A successful replacement while failed over keeps subtag mode active and delegates to the new standby.</summary>
     [Fact]
     public void UpdateWatchList_WhileSubtagActive_PreservesModeAndUsesReplacement()
     {
-        FakeConsumer primary = new FakeConsumer { ThrowOnSubscribe = true, AcknowledgeReturn = 11 };
-        FakeConsumer oldStandby = new FakeConsumer { AcknowledgeReturn = 22 };
-        FakeConsumer replacement = new FakeConsumer { AcknowledgeReturn = 33 };
+        FakeConsumer primary = new FakeConsumer { ThrowOnSubscribe = true, AckTarget = AlarmAckTarget.For("11.AckMsg") };
+        FakeConsumer oldStandby = new FakeConsumer { AckTarget = AlarmAckTarget.For("22.AckMsg") };
+        FakeConsumer replacement = new FakeConsumer { AckTarget = AlarmAckTarget.For("33.AckMsg") };
         int buildCount = 0;
         AlarmCommandHandler handler = new AlarmCommandHandler(
             new MxAccessEventQueue(),
             () => primary,
             null,
             null,
-            _ => ++buildCount == 1 ? oldStandby : replacement);
+            _ => ++buildCount == 1 ? oldStandby : replacement,
+            () => new RecordingAckWriter());
         SubscribeAlarmsCommand subscribe = new SubscribeAlarmsCommand
         {
             SubscriptionExpression = @"\\HOST\Galaxy!Area",
@@ -523,7 +607,7 @@ public sealed class AlarmCommandHandlerTests
         handler.UpdateWatchList(new[] { NewTarget("Galaxy!Area.Tank02.Alarm") });
 
         Assert.True(oldStandby.Disposed);
-        Assert.Equal(33, handler.Acknowledge(Guid.Empty, "", "", "", "", ""));
+        Assert.Equal("33.AckMsg", AckItemOf(handler));
     }
 
     /// <summary>
@@ -567,6 +651,19 @@ public sealed class AlarmCommandHandlerTests
         Assert.Equal(at, evt.OnAlarmProviderModeChanged.At.ToDateTime());
     }
 
+    private static AlarmCommandHandler NewHandlerWithWriter(Func<IMxAccessAlarmConsumer> consumerFactory, IAlarmAckWriter writer) =>
+        new AlarmCommandHandler(
+            new MxAccessEventQueue(),
+            consumerFactory,
+            threadAffinityCheck: null,
+            comFactory: null,
+            standbyFactory: null,
+            ackWriterFactory: () => writer);
+
+    /// <summary>Acks through the handler and returns the item the active consumer resolved (the fake writer echoes it as the diagnostic).</summary>
+    private static string AckItemOf(AlarmCommandHandler handler) =>
+        handler.Acknowledge(Guid.Empty, string.Empty, new AlarmAckOperator()).Diagnostic;
+
     private static MxAlarmSnapshotRecord NewRecord(string provider, string group, string tag)
     {
         return new MxAlarmSnapshotRecord
@@ -598,12 +695,12 @@ public sealed class AlarmCommandHandlerTests
 
         /// <summary>Gets the last subscription request.</summary>
         public string? LastSubscription { get; private set; }
-        /// <summary>Gets the last acknowledged alarm GUID.</summary>
-        public Guid LastAckGuid { get; private set; }
-        /// <summary>Gets the last acknowledged operator name.</summary>
-        public string? LastAckOperatorName { get; private set; }
-        /// <summary>Gets or sets the return value for acknowledge operations.</summary>
-        public int AcknowledgeReturn { get; set; }
+        /// <summary>Gets or sets the ack target both resolve methods return.</summary>
+        public AlarmAckTarget AckTarget { get; set; } = AlarmAckTarget.For("Fake.Alarm.AckMsg");
+        /// <summary>Gets the GUID from the last ResolveAckTarget call.</summary>
+        public Guid LastResolvedGuid { get; private set; }
+        /// <summary>Gets the (name, provider, group) from the last ResolveAckTargetByName call.</summary>
+        public (string Name, string Provider, string Group)? LastResolvedName { get; private set; }
         /// <summary>Gets or sets the snapshot result to return.</summary>
         public IReadOnlyList<MxAlarmSnapshotRecord> SnapshotResult { get; set; } =
             Array.Empty<MxAlarmSnapshotRecord>();
@@ -623,29 +720,19 @@ public sealed class AlarmCommandHandlerTests
         }
 
         /// <inheritdoc />
-        public int AcknowledgeByGuid(
-            Guid alarmGuid, string ackComment, string ackOperatorName,
-            string ackOperatorNode, string ackOperatorDomain, string ackOperatorFullName)
+        public AlarmAckTarget ResolveAckTarget(Guid alarmGuid)
         {
-            LastAckGuid = alarmGuid;
-            LastAckOperatorName = ackOperatorName;
-            return AcknowledgeReturn;
+            LastResolvedGuid = alarmGuid;
+            return AckTarget;
         }
 
         /// <inheritdoc />
-        public int AcknowledgeByName(
-            string alarmName, string providerName, string groupName,
-            string ackComment, string ackOperatorName, string ackOperatorNode,
-            string ackOperatorDomain, string ackOperatorFullName)
+        public AlarmAckTarget ResolveAckTargetByName(string alarmName, string providerName, string groupName)
         {
-            LastAckByNameTuple = (alarmName, providerName, groupName);
-            LastAckOperatorName = ackOperatorName;
-            return AcknowledgeReturn;
+            LastResolvedName = (alarmName, providerName, groupName);
+            return AckTarget;
         }
 
-        /// <summary>Gets the last acknowledge-by-name parameters.</summary>
-        public (string Name, string Provider, string Group)? LastAckByNameTuple { get; private set; }
-
         /// <summary>Gets or sets the truncation verdict this consumer reports with its snapshot.</summary>
         public bool SnapshotTruncated { get; set; }
 
@@ -671,4 +758,22 @@ public sealed class AlarmCommandHandlerTests
             Disposed = true;
         }
     }
+
+    private sealed class RecordingAckWriter : IAlarmAckWriter
+    {
+        public string? LastItemAddress { get; private set; }
+        public string? LastComment { get; private set; }
+        public AlarmAckOperator? LastOperator { get; private set; }
+        public bool Disposed { get; private set; }
+
+        public AlarmAckResult Acknowledge(string itemAddress, string comment, AlarmAckOperator ackOperator)
+        {
+            LastItemAddress = itemAddress;
+            LastComment = comment;
+            LastOperator = ackOperator;
+            return AlarmAckResult.Create(AlarmAckOutcome.Applied, 0, itemAddress);
+        }
+
+        public void Dispose() => Disposed = true;
+    }
 }

src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/AlarmDispatcherTests.cs

@@ -17,6 +17,38 @@ public sealed class AlarmDispatcherTests
 {
     private const string SessionId = "session-001";
 
+    /// <summary>Verifies an Acknowledge transition is attributed to the ACK_* operator and comment.</summary>
+    [Fact]
+    public void OnTransition_WhenAcknowledged_UsesAckOperatorAndComment()
+    {
+        FakeAlarmConsumer consumer = new FakeAlarmConsumer();
+        MxAccessEventQueue queue = new MxAccessEventQueue();
+        MxAccessAlarmEventSink sink = new MxAccessAlarmEventSink(queue, new MxAccessEventMapper());
+        using AlarmDispatcher dispatcher = new AlarmDispatcher(consumer, sink, SessionId, new FakeAckWriter());
+
+        consumer.RaiseTransition(new MxAlarmTransitionEvent
+        {
+            PreviousState = MxAlarmStateKind.UnackAlm,
+            Record = new MxAlarmSnapshotRecord
+            {
+                AlarmGuid = Guid.NewGuid(),
+                ProviderName = "Galaxy",
+                Group = "TestArea",
+                TagName = "TestMachine_001.TestAlarm001",
+                State = MxAlarmStateKind.AckAlm,
+                AlarmComment = "Test alarm #1",
+                AckOperatorName = "alice",
+                AckComment = "checked",
+            },
+        });
+
+        Assert.True(queue.TryDequeue(out WorkerEvent? evt));
+        OnAlarmTransitionEvent body = evt!.Event.OnAlarmTransition;
+        Assert.Equal(AlarmTransitionKind.Acknowledge, body.TransitionKind);
+        Assert.Equal("alice", body.OperatorUser);
+        Assert.Equal("checked", body.OperatorComment);
+    }
+
     /// <summary>Verifies that alarm transitions land in the queue with correctly mapped fields.</summary>
     [Fact]
     public void OnTransition_WhenAlarmTransitionRaised_LandsInQueueWithMappedFields()
@@ -24,7 +56,7 @@ public sealed class AlarmDispatcherTests
         FakeAlarmConsumer consumer = new FakeAlarmConsumer();
         MxAccessEventQueue queue = new MxAccessEventQueue();
         MxAccessAlarmEventSink sink = new MxAccessAlarmEventSink(queue, new MxAccessEventMapper());
-        using AlarmDispatcher dispatcher = new AlarmDispatcher(consumer, sink, SessionId);
+        using AlarmDispatcher dispatcher = new AlarmDispatcher(consumer, sink, SessionId, new FakeAckWriter());
 
         DateTime ts = new DateTime(2026, 5, 1, 17, 26, 14, 709, DateTimeKind.Utc);
         consumer.RaiseTransition(new MxAlarmTransitionEvent
@@ -110,7 +142,7 @@ public sealed class AlarmDispatcherTests
         FakeAlarmConsumer consumer = new FakeAlarmConsumer();
         MxAccessEventQueue queue = new MxAccessEventQueue();
         MxAccessAlarmEventSink sink = new MxAccessAlarmEventSink(queue, new MxAccessEventMapper());
-        using AlarmDispatcher dispatcher = new AlarmDispatcher(consumer, sink, SessionId);
+        using AlarmDispatcher dispatcher = new AlarmDispatcher(consumer, sink, SessionId, new FakeAckWriter());
 
         consumer.RaiseTransition(new MxAlarmTransitionEvent
         {
@@ -145,7 +177,7 @@ public sealed class AlarmDispatcherTests
         FakeAlarmConsumer consumer = new FakeAlarmConsumer();
         MxAccessEventQueue queue = new MxAccessEventQueue();
         MxAccessAlarmEventSink sink = new MxAccessAlarmEventSink(queue, new MxAccessEventMapper());
-        using AlarmDispatcher dispatcher = new AlarmDispatcher(consumer, sink, SessionId);
+        using AlarmDispatcher dispatcher = new AlarmDispatcher(consumer, sink, SessionId, new FakeAckWriter());
 
         consumer.RaiseTransition(new MxAlarmTransitionEvent
         {
@@ -173,61 +205,140 @@ public sealed class AlarmDispatcherTests
         using AlarmDispatcher dispatcher = new AlarmDispatcher(
             consumer,
             new MxAccessAlarmEventSink(new MxAccessEventQueue(), new MxAccessEventMapper()),
-            SessionId);
+            SessionId,
+            new FakeAckWriter());
 
         dispatcher.Subscribe(@"\\HOST\Galaxy!Area1");
         Assert.Equal(@"\\HOST\Galaxy!Area1", consumer.LastSubscription);
     }
 
-    /// <summary>Verifies that acknowledge calls are forwarded to the consumer with operator identity.</summary>
+    /// <summary>Verifies the dispatcher resolves the ack item via the consumer then writes it as the operator.</summary>
     [Fact]
-    public void Acknowledge_WhenInvoked_ForwardsToConsumerWithFullOperatorIdentity()
+    public void Acknowledge_ResolvesTargetThenWritesWithOperator()
     {
-        FakeAlarmConsumer consumer = new FakeAlarmConsumer();
-        consumer.AcknowledgeReturn = 0;
+        FakeAlarmConsumer consumer = new FakeAlarmConsumer { AckTarget = AlarmAckTarget.For("T.A.AckMsg") };
+        FakeAckWriter writer = new FakeAckWriter();
         using AlarmDispatcher dispatcher = new AlarmDispatcher(
-            consumer,
-            new MxAccessAlarmEventSink(new MxAccessEventQueue(), new MxAccessEventMapper()),
-            SessionId);
-
+            consumer, new MxAccessAlarmEventSink(new MxAccessEventQueue(), new MxAccessEventMapper()), SessionId, writer);
         Guid guid = Guid.NewGuid();
-        int rc = dispatcher.Acknowledge(
-            guid, "Acked", "alice", "WS01", "CORP", "Alice Smith");
+        AlarmAckOperator op = new AlarmAckOperator { UserName = "alice", Password = "pw" };
 
-        Assert.Equal(0, rc);
-        Assert.Equal(guid, consumer.LastAckGuid);
-        Assert.Equal("Acked", consumer.LastAckComment);
-        Assert.Equal("alice", consumer.LastAckOperatorName);
-        Assert.Equal("WS01", consumer.LastAckOperatorNode);
-        Assert.Equal("CORP", consumer.LastAckOperatorDomain);
-        Assert.Equal("Alice Smith", consumer.LastAckOperatorFullName);
+        AlarmAckResult result = dispatcher.Acknowledge(guid, "checked", op);
+
+        Assert.Equal(AlarmAckOutcome.Applied, result.Outcome);
+        Assert.Equal(guid, consumer.LastResolvedGuid);
+        Assert.Equal("T.A.AckMsg", writer.LastItemAddress);
+        Assert.Equal("checked", writer.LastComment);
+        Assert.Same(op, writer.LastOperator);
     }
 
-    /// <summary>Verifies that acknowledge-by-name calls are forwarded to the consumer.</summary>
+    /// <summary>Verifies an unresolved target short-circuits to its failure without calling the writer.</summary>
     [Fact]
-    public void AcknowledgeByName_WhenInvoked_ForwardsToConsumerWithFullTuple()
+    public void Acknowledge_WhenTargetNotFound_DoesNotWrite()
     {
-        FakeAlarmConsumer consumer = new FakeAlarmConsumer { AcknowledgeReturn = 0 };
+        FakeAlarmConsumer consumer = new FakeAlarmConsumer { AckTarget = AlarmAckTarget.NotFound("gone") };
+        FakeAckWriter writer = new FakeAckWriter();
         using AlarmDispatcher dispatcher = new AlarmDispatcher(
-            consumer,
+            consumer, new MxAccessAlarmEventSink(new MxAccessEventQueue(), new MxAccessEventMapper()), SessionId, writer);
+
+        AlarmAckResult result = dispatcher.Acknowledge(Guid.NewGuid(), "c", new AlarmAckOperator { UserName = "alice" });
+
+        Assert.Equal(AlarmAckOutcome.AlarmNotFound, result.Outcome);
+        Assert.Equal("gone", result.Diagnostic);
+        Assert.Null(writer.LastItemAddress);
+    }
+
+    /// <summary>Verifies acknowledge-by-name resolves with the full tuple and writes the resolved item.</summary>
+    [Fact]
+    public void AcknowledgeByName_ResolvesTupleThenWritesWithOperator()
+    {
+        FakeAlarmConsumer consumer = new FakeAlarmConsumer
+        {
+            AckTarget = AlarmAckTarget.For("TestMachine_001.TestAlarm001.AckMsg"),
+        };
+        FakeAckWriter writer = new FakeAckWriter();
+        using AlarmDispatcher dispatcher = new AlarmDispatcher(
+            consumer, new MxAccessAlarmEventSink(new MxAccessEventQueue(), new MxAccessEventMapper()), SessionId, writer);
+        AlarmAckOperator op = new AlarmAckOperator { UserName = "alice", Domain = "CORP" };
+
+        AlarmAckResult result = dispatcher.AcknowledgeByName(
+            "TestMachine_001.TestAlarm001", "Galaxy", "TestArea", "ack", op);
+
+        Assert.Equal(AlarmAckOutcome.Applied, result.Outcome);
+        Assert.Equal(("TestMachine_001.TestAlarm001", "Galaxy", "TestArea"), consumer.LastResolvedName);
+        Assert.Equal("TestMachine_001.TestAlarm001.AckMsg", writer.LastItemAddress);
+        Assert.Equal("ack", writer.LastComment);
+        Assert.Same(op, writer.LastOperator);
+    }
+
+    /// <summary>Verifies a NotAckable by-name target short-circuits without calling the writer.</summary>
+    [Fact]
+    public void AcknowledgeByName_WhenNotAckable_DoesNotWrite()
+    {
+        FakeAlarmConsumer consumer = new FakeAlarmConsumer { AckTarget = AlarmAckTarget.NotAckable("intouch") };
+        FakeAckWriter writer = new FakeAckWriter();
+        using AlarmDispatcher dispatcher = new AlarmDispatcher(
+            consumer, new MxAccessAlarmEventSink(new MxAccessEventQueue(), new MxAccessEventMapper()), SessionId, writer);
+
+        AlarmAckResult result = dispatcher.AcknowledgeByName("Tag1", "InTouch", "G", "c", new AlarmAckOperator());
+
+        Assert.Equal(AlarmAckOutcome.NotAckable, result.Outcome);
+        Assert.Null(writer.LastItemAddress);
+    }
+
+    /// <summary>
+    ///     Verifies that while the failover consumer serves the subtag standby,
+    ///     GUID acks resolve through the standby (its synthetic GUIDs).
+    /// </summary>
+    [Fact]
+    public void Acknowledge_WhenFailoverInSubtagMode_ResolvesThroughStandby()
+    {
+        FakeAlarmConsumer primary = new FakeAlarmConsumer { ThrowOnSubscribe = true };
+        FakeAlarmConsumer standby = new FakeAlarmConsumer { AckTarget = AlarmAckTarget.For("Standby.AckMsg") };
+        FailoverAlarmConsumer failover = new FailoverAlarmConsumer(
+            primary, standby, new FailoverSettings(threshold: 1, probeIntervalSeconds: 0, stableProbes: 3));
+        FakeAckWriter writer = new FakeAckWriter();
+        using AlarmDispatcher dispatcher = new AlarmDispatcher(
+            failover,
             new MxAccessAlarmEventSink(new MxAccessEventQueue(), new MxAccessEventMapper()),
-            SessionId);
+            SessionId,
+            writer);
+        dispatcher.Subscribe(@"\\HOST\Galaxy!Area1");
+        Assert.Equal(AlarmProviderMode.Subtag, failover.Mode);
 
-        int rc = dispatcher.AcknowledgeByName(
-            alarmName: "TestMachine_001.TestAlarm001",
-            providerName: "Galaxy",
-            groupName: "TestArea",
-            ackComment: "ack",
-            ackOperatorName: "alice",
-            ackOperatorNode: "WS",
-            ackOperatorDomain: "CORP",
-            ackOperatorFullName: "Alice Smith");
+        Guid guid = Guid.NewGuid();
+        dispatcher.Acknowledge(guid, "Acked", new AlarmAckOperator { UserName = "alice" });
 
-        Assert.Equal(0, rc);
-        Assert.NotNull(consumer.LastAckByNameTuple);
-        Assert.Equal("TestMachine_001.TestAlarm001", consumer.LastAckByNameTuple!.Value.Name);
-        Assert.Equal("Galaxy", consumer.LastAckByNameTuple!.Value.Provider);
-        Assert.Equal("TestArea", consumer.LastAckByNameTuple!.Value.Group);
+        Assert.Equal(guid, standby.LastResolvedGuid);
+        Assert.Equal(Guid.Empty, primary.LastResolvedGuid);
+        Assert.Equal("Standby.AckMsg", writer.LastItemAddress);
+    }
+
+    /// <summary>Verifies the dispatcher does not dispose the writer: the handler owns it.</summary>
+    [Fact]
+    public void Dispose_DoesNotDisposeAckWriter()
+    {
+        FakeAckWriter writer = new FakeAckWriter();
+        AlarmDispatcher dispatcher = new AlarmDispatcher(
+            new FakeAlarmConsumer(),
+            new MxAccessAlarmEventSink(new MxAccessEventQueue(), new MxAccessEventMapper()),
+            SessionId,
+            writer);
+
+        dispatcher.Dispose();
+
+        Assert.False(writer.Disposed);
+    }
+
+    /// <summary>Verifies the constructor rejects a null ack writer.</summary>
+    [Fact]
+    public void Constructor_NullAckWriter_Throws()
+    {
+        Assert.Throws<ArgumentNullException>(() => new AlarmDispatcher(
+            new FakeAlarmConsumer(),
+            new MxAccessAlarmEventSink(new MxAccessEventQueue(), new MxAccessEventMapper()),
+            SessionId,
+            null!));
     }
 
     /// <summary>Verifies that consumer alarm records are mapped to proto snapshots.</summary>
@@ -265,7 +376,8 @@ public sealed class AlarmDispatcherTests
         using AlarmDispatcher dispatcher = new AlarmDispatcher(
             consumer,
             new MxAccessAlarmEventSink(new MxAccessEventQueue(), new MxAccessEventMapper()),
-            SessionId);
+            SessionId,
+            new FakeAckWriter());
 
         IReadOnlyList<ActiveAlarmSnapshot> snapshots = dispatcher.SnapshotActiveAlarms(out _);
         Assert.Equal(2, snapshots.Count);
@@ -321,7 +433,8 @@ public sealed class AlarmDispatcherTests
         using AlarmDispatcher dispatcher = new AlarmDispatcher(
             consumer,
             new MxAccessAlarmEventSink(new MxAccessEventQueue(), new MxAccessEventMapper()),
-            SessionId);
+            SessionId,
+            new FakeAckWriter());
 
         IReadOnlyList<ActiveAlarmSnapshot> snapshots = dispatcher.SnapshotActiveAlarms(out _);
         Assert.Equal(2, snapshots.Count);
@@ -356,7 +469,8 @@ public sealed class AlarmDispatcherTests
         using AlarmDispatcher dispatcher = new AlarmDispatcher(
             consumer,
             new MxAccessAlarmEventSink(new MxAccessEventQueue(), new MxAccessEventMapper()),
-            SessionId);
+            SessionId,
+            new FakeAckWriter());
 
         IReadOnlyList<ActiveAlarmSnapshot> snapshots = dispatcher.SnapshotActiveAlarms(out bool truncated);
 
@@ -386,7 +500,8 @@ public sealed class AlarmDispatcherTests
         using AlarmDispatcher dispatcher = new AlarmDispatcher(
             consumer,
             new MxAccessAlarmEventSink(new MxAccessEventQueue(), new MxAccessEventMapper()),
-            SessionId);
+            SessionId,
+            new FakeAckWriter());
 
         IReadOnlyList<ActiveAlarmSnapshot> snapshots = dispatcher.SnapshotActiveAlarms(out bool truncated);
 
@@ -416,7 +531,7 @@ public sealed class AlarmDispatcherTests
         FakeAlarmConsumer consumer = new FakeAlarmConsumer();
         MxAccessEventQueue queue = new MxAccessEventQueue();
         MxAccessAlarmEventSink sink = new MxAccessAlarmEventSink(queue, new MxAccessEventMapper());
-        AlarmDispatcher dispatcher = new AlarmDispatcher(consumer, sink, SessionId);
+        AlarmDispatcher dispatcher = new AlarmDispatcher(consumer, sink, SessionId, new FakeAckWriter());
 
         dispatcher.Dispose();
 
@@ -443,20 +558,12 @@ public sealed class AlarmDispatcherTests
 
         /// <summary>Gets the last subscription reference.</summary>
         public string? LastSubscription { get; private set; }
-        /// <summary>Gets the GUID from the last acknowledge call.</summary>
-        public Guid LastAckGuid { get; private set; }
-        /// <summary>Gets the comment from the last acknowledge call.</summary>
-        public string? LastAckComment { get; private set; }
-        /// <summary>Gets the operator name from the last acknowledge call.</summary>
-        public string? LastAckOperatorName { get; private set; }
-        /// <summary>Gets the operator node from the last acknowledge call.</summary>
-        public string? LastAckOperatorNode { get; private set; }
-        /// <summary>Gets the operator domain from the last acknowledge call.</summary>
-        public string? LastAckOperatorDomain { get; private set; }
-        /// <summary>Gets the operator full name from the last acknowledge call.</summary>
-        public string? LastAckOperatorFullName { get; private set; }
-        /// <summary>Gets or sets the return code for acknowledge operations.</summary>
-        public int AcknowledgeReturn { get; set; }
+        /// <summary>Gets or sets the ack target both resolve methods return.</summary>
+        public AlarmAckTarget AckTarget { get; set; } = AlarmAckTarget.For("Fake.Alarm.AckMsg");
+        /// <summary>Gets the GUID from the last ResolveAckTarget call.</summary>
+        public Guid LastResolvedGuid { get; private set; }
+        /// <summary>Gets the (name, provider, group) from the last ResolveAckTargetByName call.</summary>
+        public (string Name, string Provider, string Group)? LastResolvedName { get; private set; }
         /// <summary>Gets or sets the result collection for snapshot operations.</summary>
         public IReadOnlyList<MxAlarmSnapshotRecord> SnapshotResult { get; set; } =
             Array.Empty<MxAlarmSnapshotRecord>();
@@ -470,44 +577,30 @@ public sealed class AlarmDispatcherTests
             AlarmTransitionEmitted?.Invoke(this, transition);
         }
 
+        /// <summary>Gets or sets a value indicating whether <see cref="Subscribe"/> throws.</summary>
+        public bool ThrowOnSubscribe { get; set; }
+
         /// <inheritdoc />
         public void Subscribe(string subscription)
         {
+            if (ThrowOnSubscribe) throw new InvalidOperationException("subscribe failed");
             LastSubscription = subscription;
         }
 
         /// <inheritdoc />
-        public int AcknowledgeByGuid(
-            Guid alarmGuid,
-            string ackComment,
-            string ackOperatorName,
-            string ackOperatorNode,
-            string ackOperatorDomain,
-            string ackOperatorFullName)
+        public AlarmAckTarget ResolveAckTarget(Guid alarmGuid)
         {
-            LastAckGuid = alarmGuid;
-            LastAckComment = ackComment;
-            LastAckOperatorName = ackOperatorName;
-            LastAckOperatorNode = ackOperatorNode;
-            LastAckOperatorDomain = ackOperatorDomain;
-            LastAckOperatorFullName = ackOperatorFullName;
-            return AcknowledgeReturn;
+            LastResolvedGuid = alarmGuid;
+            return AckTarget;
         }
 
         /// <inheritdoc />
-        public int AcknowledgeByName(
-            string alarmName, string providerName, string groupName,
-            string ackComment, string ackOperatorName, string ackOperatorNode,
-            string ackOperatorDomain, string ackOperatorFullName)
+        public AlarmAckTarget ResolveAckTargetByName(string alarmName, string providerName, string groupName)
         {
-            LastAckByNameTuple = (alarmName, providerName, groupName);
-            LastAckOperatorName = ackOperatorName;
-            return AcknowledgeReturn;
+            LastResolvedName = (alarmName, providerName, groupName);
+            return AckTarget;
         }
 
-        /// <summary>Gets the last acknowledge-by-name tuple (alarm name, provider, group).</summary>
-        public (string Name, string Provider, string Group)? LastAckByNameTuple { get; private set; }
-
         /// <summary>Gets or sets the truncation verdict this consumer reports with its snapshot.</summary>
         public bool SnapshotTruncated { get; set; }
 
@@ -533,4 +626,23 @@ public sealed class AlarmDispatcherTests
             Disposed = true;
         }
     }
+
+    private sealed class FakeAckWriter : IAlarmAckWriter
+    {
+        public string? LastItemAddress { get; private set; }
+        public string? LastComment { get; private set; }
+        public AlarmAckOperator? LastOperator { get; private set; }
+        public AlarmAckResult Result { get; set; } = AlarmAckResult.Create(AlarmAckOutcome.Applied, 0, string.Empty);
+        public bool Disposed { get; private set; }
+
+        public AlarmAckResult Acknowledge(string itemAddress, string comment, AlarmAckOperator ackOperator)
+        {
+            LastItemAddress = itemAddress;
+            LastComment = comment;
+            LastOperator = ackOperator;
+            return Result;
+        }
+
+        public void Dispose() => Disposed = true;
+    }
 }

src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/FailoverAlarmConsumerTests.cs

@@ -72,10 +72,10 @@ public sealed class FailoverAlarmConsumerTests
         }
 
         /// <inheritdoc />
-        public int AcknowledgeByGuid(Guid g, string c, string a, string b, string d, string e) => 11;
+        public AlarmAckTarget ResolveAckTarget(Guid g) => AlarmAckTarget.For("primary.guid.AckMsg");
 
         /// <inheritdoc />
-        public int AcknowledgeByName(string n, string p, string gr, string c, string a, string b, string d, string e) => 11;
+        public AlarmAckTarget ResolveAckTargetByName(string n, string p, string gr) => AlarmAckTarget.For("primary.name.AckMsg");
 
         /// <inheritdoc />
         public IReadOnlyList<MxAlarmSnapshotRecord> SnapshotActiveAlarms(out bool truncated)
@@ -122,10 +122,10 @@ public sealed class FailoverAlarmConsumerTests
         public void PollOnce() { }
 
         /// <inheritdoc />
-        public int AcknowledgeByGuid(Guid g, string c, string a, string b, string d, string e) => 22;
+        public AlarmAckTarget ResolveAckTarget(Guid g) => AlarmAckTarget.For("standby.guid.AckMsg");
 
         /// <inheritdoc />
-        public int AcknowledgeByName(string n, string p, string gr, string c, string a, string b, string d, string e) => 22;
+        public AlarmAckTarget ResolveAckTargetByName(string n, string p, string gr) => AlarmAckTarget.For("standby.name.AckMsg");
 
         /// <inheritdoc />
         public IReadOnlyList<MxAlarmSnapshotRecord> SnapshotActiveAlarms(out bool truncated)
@@ -305,9 +305,9 @@ public sealed class FailoverAlarmConsumerTests
         Assert.Equal(subscribeCountAfterSetup, primary.SubscribeCount);
     }
 
-    /// <summary>Proves that acknowledgment calls delegate to whichever child (primary or standby) is currently active.</summary>
+    /// <summary>Proves that ack-target resolution delegates to whichever child (primary or standby) is currently active.</summary>
     [Fact]
-    public void Acknowledge_DelegatesToActiveChild()
+    public void ResolveAckTarget_DelegatesToActiveChild()
     {
         FlakyPrimary primary = new FlakyPrimary { ThrowOnPoll = false };
         StubStandby standby = new StubStandby();
@@ -316,18 +316,18 @@ public sealed class FailoverAlarmConsumerTests
 
         sut.Subscribe(@"\\HOST\Galaxy!Area");
 
-        // Active = Primary → primary's sentinel value (11).
-        Assert.Equal(11, sut.AcknowledgeByGuid(Guid.NewGuid(), "c", "n", "node", "dom", "full"));
-        Assert.Equal(11, sut.AcknowledgeByName("a", "p", "g", "c", "n", "node", "dom", "full"));
+        // Active = Primary → primary's sentinel targets.
+        Assert.Equal("primary.guid.AckMsg", sut.ResolveAckTarget(Guid.NewGuid()).ItemAddress);
+        Assert.Equal("primary.name.AckMsg", sut.ResolveAckTargetByName("a", "p", "g").ItemAddress);
 
         // Force a failover by failing the primary past threshold.
         primary.ThrowOnPoll = true;
         sut.PollOnce(); // threshold=1 → switch to Standby
         Assert.Equal(AlarmProviderMode.Subtag, sut.Mode);
 
-        // Active = Standby → standby's sentinel value (22).
-        Assert.Equal(22, sut.AcknowledgeByGuid(Guid.NewGuid(), "c", "n", "node", "dom", "full"));
-        Assert.Equal(22, sut.AcknowledgeByName("a", "p", "g", "c", "n", "node", "dom", "full"));
+        // Active = Standby → standby's sentinel targets.
+        Assert.Equal("standby.guid.AckMsg", sut.ResolveAckTarget(Guid.NewGuid()).ItemAddress);
+        Assert.Equal("standby.name.AckMsg", sut.ResolveAckTargetByName("a", "p", "g").ItemAddress);
     }
 
     /// <summary>

src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/LmxSubtagAlarmSourceTests.cs

@@ -94,76 +94,28 @@ public sealed class LmxSubtagAlarmSourceTests
     }
 
     /// <summary>
-    ///     Verifies <see cref="LmxSubtagAlarmSource.Write"/> adds the item when
-    ///     it was not previously advised and writes with user id 0.
+    ///     Verifies <see cref="LmxSubtagAlarmSource.Dispose"/> UnAdvises and
+    ///     removes every advised handle and unregisters the server exactly once.
     /// </summary>
     [Fact]
-    public void Write_AddsItemWhenUnknownAndWrites()
-    {
-        var server = new RecordingMxAccessServer();
-        using var source = new LmxSubtagAlarmSource(server, FakeServerHandle);
-
-        source.Write("Tank1.Alarm.AckComment", "acknowledged");
-
-        Assert.Contains("Tank1.Alarm.AckComment", server.AddedItems);
-        Assert.Single(server.Writes);
-        RecordingMxAccessServer.WriteRecord write = server.Writes[0];
-        Assert.Equal(FakeServerHandle, write.ServerHandle);
-        Assert.Equal("acknowledged", write.Value);
-        Assert.Equal(0, write.UserId);
-    }
-
-    /// <summary>
-    ///     Verifies <see cref="LmxSubtagAlarmSource.Write"/> reuses an existing
-    ///     item handle (no duplicate AddItem) when the address was already
-    ///     advised.
-    /// </summary>
-    [Fact]
-    public void Write_ReusesHandleForAdvisedAddress()
-    {
-        var server = new RecordingMxAccessServer();
-        using var source = new LmxSubtagAlarmSource(server, FakeServerHandle);
-
-        source.Advise(new[] { "Tank1.Alarm.Subtag" });
-        int adviseAddCount = server.AddedItems.Count;
-
-        source.Write("Tank1.Alarm.Subtag", true);
-
-        // No second AddItem for the already-advised address.
-        Assert.Equal(adviseAddCount, server.AddedItems.Count);
-        Assert.Single(server.Writes);
-    }
-
-    /// <summary>
-    ///     Verifies <see cref="LmxSubtagAlarmSource.Dispose"/> UnAdvises only the
-    ///     handles that were actually advised — a write-only item (added by
-    ///     <see cref="LmxSubtagAlarmSource.Write"/> but never advised) is removed
-    ///     but not unadvised — and unregisters the server exactly once.
-    /// </summary>
-    [Fact]
-    public void Dispose_UnAdvisesOnlyAdvisedHandles_RemovesAll_AndUnregistersOnce()
+    public void Dispose_UnAdvisesAndRemovesAdvisedHandles_AndUnregistersOnce()
     {
         var server = new RecordingMxAccessServer();
         var source = new LmxSubtagAlarmSource(server, FakeServerHandle);
 
         source.Advise(new[] { "Tank1.Alarm.Subtag", "Tank2.Alarm.Subtag" });
-        // A write-only subtag: added by Write, never advised.
-        source.Write("Tank1.Alarm.AckComment", "acknowledged");
 
         int advised1 = server.LastItemHandleFor("Tank1.Alarm.Subtag");
         int advised2 = server.LastItemHandleFor("Tank2.Alarm.Subtag");
-        int writeOnly = server.LastItemHandleFor("Tank1.Alarm.AckComment");
 
         source.Dispose();
 
-        // Only the two advised handles are unadvised — never the write-only one.
         Assert.Equal(new[] { advised1, advised2 }, server.UnAdvisedItemHandles);
-        Assert.DoesNotContain(writeOnly, server.UnAdvisedItemHandles);
-        // Every added item (advised + write-only) is removed.
         Assert.Equal(
-            new[] { advised1, advised2, writeOnly }.OrderBy(h => h),
+            new[] { advised1, advised2 }.OrderBy(h => h),
             server.RemovedItemHandles.OrderBy(h => h));
         Assert.Equal(1, server.UnregisterCount);
+        Assert.Empty(server.Writes);
     }
 
     /// <summary>

src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/MxAccessStaSessionTests.cs

@@ -663,15 +663,13 @@ public sealed class MxAccessStaSessionTests
         }
 
         /// <inheritdoc />
-        public int Acknowledge(Guid alarmGuid, string comment, string operatorUser,
-            string operatorNode, string operatorDomain, string operatorFullName)
-            => 0;
+        public AlarmAckResult Acknowledge(Guid alarmGuid, string comment, AlarmAckOperator ackOperator)
+            => AlarmAckResult.Create(AlarmAckOutcome.Applied, 0, string.Empty);
 
         /// <inheritdoc />
-        public int AcknowledgeByName(string alarmName, string providerName, string groupName,
-            string comment, string operatorUser, string operatorNode,
-            string operatorDomain, string operatorFullName)
-            => 0;
+        public AlarmAckResult AcknowledgeByName(string alarmName, string providerName, string groupName,
+            string comment, AlarmAckOperator ackOperator)
+            => AlarmAckResult.Create(AlarmAckOutcome.Applied, 0, string.Empty);
 
         /// <inheritdoc />
         public IReadOnlyList<ActiveAlarmSnapshot> QueryActive(

src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/SubtagAlarmConsumerTests.cs

@@ -9,7 +9,7 @@ namespace ZB.MOM.WW.MxGateway.Worker.Tests.MxAccess;
 /// <summary>
 ///     Unit tests for <see cref="SubtagAlarmConsumer"/>: prove that the subtag
 ///     fallback advises the observable subtags, synthesizes degraded
-///     transitions with stable synthetic GUIDs, routes acknowledgments to the
+///     transitions with stable synthetic GUIDs, resolves acknowledgments to the
 ///     ack-comment subtag, and stamps snapshots. A <see cref="FakeSource"/>
 ///     stands in for the live MXAccess subtag source so this needs no AVEVA
 ///     install.
@@ -40,9 +40,13 @@ public sealed class SubtagAlarmConsumerTests
         return new SubtagAlarmConsumer(source, new[] { BuildTarget() });
     }
 
-    /// <summary>Verifies Subscribe advises the active, acked, priority, and ack-comment subtags (the ack-comment is advised so it is an active, writable MXAccess item).</summary>
+    /// <summary>
+    ///     Verifies Subscribe advises the observable active, acked and priority
+    ///     subtags but not the ack-comment subtag: the ack is written by
+    ///     <see cref="AlarmAckWriter"/>, which adds and advises it on its own server.
+    /// </summary>
     [Fact]
-    public void Subscribe_AdvisesAllSubtagsIncludingAckComment()
+    public void Subscribe_AdvisesObservableSubtagsButNotAckComment()
     {
         FakeSource source = new FakeSource();
         using SubtagAlarmConsumer consumer = BuildConsumer(source);
@@ -52,7 +56,7 @@ public sealed class SubtagAlarmConsumerTests
         Assert.Contains(ActiveSubtag, source.Advised);
         Assert.Contains(AckedSubtag, source.Advised);
         Assert.Contains(PrioritySubtag, source.Advised);
-        Assert.Contains(AckCommentSubtag, source.Advised);
+        Assert.DoesNotContain(AckCommentSubtag, source.Advised);
     }
 
     /// <summary>Verifies an active=true value change raises a degraded, GUID-stamped UNACK_ALM transition.</summary>
@@ -74,50 +78,49 @@ public sealed class SubtagAlarmConsumerTests
         Assert.NotEqual(Guid.Empty, emitted.Record.AlarmGuid);
     }
 
-    /// <summary>Verifies AcknowledgeByName writes the comment to the ack-comment subtag and returns success.</summary>
+    /// <summary>Verifies ResolveAckTargetByName resolves to the target's ack-comment subtag.</summary>
     [Fact]
-    public void AcknowledgeByName_WritesCommentToAckCommentSubtag()
+    public void ResolveAckTargetByName_ReturnsAckCommentSubtag()
     {
         FakeSource source = new FakeSource();
         using SubtagAlarmConsumer consumer = BuildConsumer(source);
         consumer.Subscribe(@"\\HOST\Galaxy!TestArea");
 
-        int rc = consumer.AcknowledgeByName(
-            alarmName: "Tank01.Level.HiHi",
-            providerName: "Galaxy",
-            groupName: "TestArea",
-            ackComment: "operator ack",
-            ackOperatorName: "alice",
-            ackOperatorNode: "WS01",
-            ackOperatorDomain: "CORP",
-            ackOperatorFullName: "Alice Smith");
+        AlarmAckTarget target = consumer.ResolveAckTargetByName("Tank01.Level.HiHi", "Galaxy", "TestArea");
 
-        Assert.Equal(0, rc);
-        Assert.NotNull(source.LastWrite);
-        Assert.Equal(AckCommentSubtag, source.LastWrite!.Value.Address);
-        Assert.Equal("operator ack", source.LastWrite!.Value.Value);
+        Assert.True(target.Found);
+        Assert.Equal(AckCommentSubtag, target.ItemAddress);
     }
 
-    /// <summary>Verifies AcknowledgeByName returns non-zero when no target matches the supplied name.</summary>
+    /// <summary>Verifies ResolveAckTargetByName reports AlarmNotFound when no target matches the supplied name.</summary>
     [Fact]
-    public void AcknowledgeByName_UnknownAlarm_ReturnsNonZero()
+    public void ResolveAckTargetByName_UnknownAlarm_IsNotFound()
     {
         FakeSource source = new FakeSource();
         using SubtagAlarmConsumer consumer = BuildConsumer(source);
         consumer.Subscribe(@"\\HOST\Galaxy!TestArea");
 
-        int rc = consumer.AcknowledgeByName(
-            alarmName: "DoesNotExist.NoSuchAlarm",
-            providerName: "Galaxy",
-            groupName: "TestArea",
-            ackComment: "operator ack",
-            ackOperatorName: "alice",
-            ackOperatorNode: "WS01",
-            ackOperatorDomain: "CORP",
-            ackOperatorFullName: "Alice Smith");
+        AlarmAckTarget target = consumer.ResolveAckTargetByName("DoesNotExist.NoSuchAlarm", "Galaxy", "TestArea");
 
-        Assert.NotEqual(0, rc);
-        Assert.Null(source.LastWrite);
+        Assert.False(target.Found);
+        Assert.Equal(AlarmAckOutcome.AlarmNotFound, target.Failure);
+    }
+
+    /// <summary>Verifies a target with no ack-comment subtag resolves as NotAckable, by name and by GUID.</summary>
+    [Fact]
+    public void ResolveAckTarget_EmptyAckCommentSubtag_IsNotAckable()
+    {
+        AlarmSubtagTarget noAck = BuildTarget();
+        noAck.AckCommentSubtag = string.Empty;
+        FakeSource source = new FakeSource();
+        using SubtagAlarmConsumer consumer = new SubtagAlarmConsumer(source, new[] { noAck });
+
+        Assert.Equal(
+            AlarmAckOutcome.NotAckable,
+            consumer.ResolveAckTargetByName("Tank01.Level.HiHi", "Galaxy", "TestArea").Failure);
+        Assert.Equal(
+            AlarmAckOutcome.NotAckable,
+            consumer.ResolveAckTarget(SyntheticAlarmGuid.ForReference(Reference)).Failure);
     }
 
     /// <summary>Verifies a snapshot of an active alarm stamps Degraded and a non-empty synthetic GUID.</summary>
@@ -160,11 +163,11 @@ public sealed class SubtagAlarmConsumerTests
 
     /// <summary>
     ///     Verifies that when two alarm targets share a prefix (e.g. Level.Hi vs Level.HiHi),
-    ///     AcknowledgeByName routes each ack to its own ack-comment subtag and never
+    ///     ResolveAckTargetByName resolves each to its own ack-comment subtag and never
     ///     conflates the shorter name with the longer one.
     /// </summary>
     [Fact]
-    public void AcknowledgeByName_PrefixNameDoesNotFalseMatch()
+    public void ResolveAckTargetByName_PrefixNameDoesNotFalseMatch()
     {
         const string ReferenceHi = "Galaxy!Area.Tank01.Level.Hi";
         const string ReferenceHiHi = "Galaxy!Area.Tank01.Level.HiHi";
@@ -195,42 +198,19 @@ public sealed class SubtagAlarmConsumerTests
             source, new[] { targetHi, targetHiHi });
         consumer.Subscribe(@"\\HOST\Galaxy!Area");
 
-        // Ack the shorter name — must write to the shorter target's subtag only.
-        int rcHi = consumer.AcknowledgeByName(
-            alarmName: "Tank01.Level.Hi",
-            providerName: "Galaxy",
-            groupName: "Area",
-            ackComment: "ack hi",
-            ackOperatorName: "op", ackOperatorNode: "WS01",
-            ackOperatorDomain: "CORP", ackOperatorFullName: "Operator");
-
-        Assert.Equal(0, rcHi);
-        Assert.NotNull(source.LastWrite);
-        Assert.Equal(AckCommentHi, source.LastWrite!.Value.Address);
-        Assert.Equal("ack hi", source.LastWrite.Value.Value);
-
-        // Ack the longer name — must write to the longer target's subtag.
-        int rcHiHi = consumer.AcknowledgeByName(
-            alarmName: "Tank01.Level.HiHi",
-            providerName: "Galaxy",
-            groupName: "Area",
-            ackComment: "ack hihi",
-            ackOperatorName: "op", ackOperatorNode: "WS01",
-            ackOperatorDomain: "CORP", ackOperatorFullName: "Operator");
-
-        Assert.Equal(0, rcHiHi);
-        Assert.NotNull(source.LastWrite);
-        Assert.Equal(AckCommentHiHi, source.LastWrite!.Value.Address);
-        Assert.Equal("ack hihi", source.LastWrite.Value.Value);
+        Assert.Equal(AckCommentHi, consumer.ResolveAckTargetByName("Tank01.Level.Hi", "Galaxy", "Area").ItemAddress);
+        Assert.Equal(AckCommentHiHi, consumer.ResolveAckTargetByName("Tank01.Level.HiHi", "Galaxy", "Area").ItemAddress);
+        Assert.Equal(
+            AlarmAckOutcome.AlarmNotFound,
+            consumer.ResolveAckTargetByName("Tank01.Level.H", "Galaxy", "Area").Failure);
     }
 
     /// <summary>
-    ///     Verifies AcknowledgeByGuid resolves the synthetic GUID (computed from
-    ///     the alarm's full reference) to the correct target and writes the comment
-    ///     to that target's ack-comment subtag.
+    ///     Verifies ResolveAckTarget resolves the synthetic GUID (computed from
+    ///     the alarm's full reference) to that target's ack-comment subtag.
     /// </summary>
     [Fact]
-    public void AcknowledgeByGuid_WritesCommentToAckCommentSubtag()
+    public void ResolveAckTarget_SyntheticGuid_ReturnsAckCommentSubtag()
     {
         FakeSource source = new FakeSource();
         using SubtagAlarmConsumer consumer = BuildConsumer(source);
@@ -246,41 +226,21 @@ public sealed class SubtagAlarmConsumerTests
         Guid syntheticGuid = emitted!.Record.AlarmGuid;
         Assert.NotEqual(Guid.Empty, syntheticGuid);
 
-        int rc = consumer.AcknowledgeByGuid(
-            alarmGuid: syntheticGuid,
-            ackComment: "guid ack",
-            ackOperatorName: "op",
-            ackOperatorNode: "WS01",
-            ackOperatorDomain: "CORP",
-            ackOperatorFullName: "Operator");
+        AlarmAckTarget target = consumer.ResolveAckTarget(syntheticGuid);
 
-        Assert.Equal(0, rc);
-        Assert.NotNull(source.LastWrite);
-        Assert.Equal(AckCommentSubtag, source.LastWrite!.Value.Address);
-        Assert.Equal("guid ack", source.LastWrite.Value.Value);
+        Assert.True(target.Found);
+        Assert.Equal(AckCommentSubtag, target.ItemAddress);
     }
 
-    /// <summary>
-    ///     Verifies AcknowledgeByGuid returns non-zero and performs no write when
-    ///     the supplied GUID is not known to the consumer.
-    /// </summary>
+    /// <summary>Verifies ResolveAckTarget reports AlarmNotFound for a GUID unknown to the consumer.</summary>
     [Fact]
-    public void AcknowledgeByGuid_UnknownGuid_ReturnsNonZero()
+    public void ResolveAckTarget_UnknownGuid_IsNotFound()
     {
         FakeSource source = new FakeSource();
         using SubtagAlarmConsumer consumer = BuildConsumer(source);
         consumer.Subscribe(@"\\HOST\Galaxy!TestArea");
 
-        int rc = consumer.AcknowledgeByGuid(
-            alarmGuid: Guid.NewGuid(),
-            ackComment: "should not write",
-            ackOperatorName: "op",
-            ackOperatorNode: "WS01",
-            ackOperatorDomain: "CORP",
-            ackOperatorFullName: "Operator");
-
-        Assert.NotEqual(0, rc);
-        Assert.Null(source.LastWrite);
+        Assert.Equal(AlarmAckOutcome.AlarmNotFound, consumer.ResolveAckTarget(Guid.NewGuid()).Failure);
     }
 
     private sealed class FakeSource : ISubtagAlarmSource
@@ -291,21 +251,12 @@ public sealed class SubtagAlarmConsumerTests
         /// <summary>Gets the subtag addresses passed to <see cref="Advise"/>.</summary>
         public List<string> Advised { get; } = new List<string>();
 
-        /// <summary>Gets the most recent (address, value) pair passed to <see cref="Write"/>.</summary>
-        public (string Address, object? Value)? LastWrite { get; private set; }
-
         /// <inheritdoc />
         public void Advise(IReadOnlyCollection<string> itemAddresses)
         {
             Advised.AddRange(itemAddresses);
         }
 
-        /// <inheritdoc />
-        public void Write(string itemAddress, object? value)
-        {
-            LastWrite = (itemAddress, value);
-        }
-
         /// <summary>Raises a <see cref="SubtagValueChange"/> for the given subtag.</summary>
         /// <param name="address">The subtag address whose value changed.</param>
         /// <param name="value">The new value.</param>

src/ZB.MOM.WW.MxGateway.Worker.Tests/MxAccess/WnWrapAlarmConsumerXmlTests.cs

@@ -801,4 +801,81 @@ public sealed class WnWrapAlarmConsumerXmlTests
             ProviderName = "Galaxy",
         };
     }
+
+    [Fact]
+    public void ParseSnapshotXml_WithAckElements_PopulatesAckFields()
+    {
+        const string xml =
+            "<?xml version=\"1.0\"?><ALARM_RECORDS COUNT=\"1\"><ALARM><GUID>2D8A9BE88FE04B0F8D996BB4D56620C7</GUID>" +
+            "<DATE>2026/10/19</DATE><TIME>18:2:53.812</TIME><GMTOFFSET>240</GMTOFFSET><DSTADJUST>0</DSTADJUST>" +
+            "<PROVIDER_NODE>DESKTOP-6JL3KKO</PROVIDER_NODE><PROVIDER_NAME>Galaxy</PROVIDER_NAME><GROUP>TestArea</GROUP>" +
+            "<TAGNAME>TestMachine_001.TestAlarm001</TAGNAME><TYPE>DSC</TYPE><VALUE>true</VALUE><LIMIT>true</LIMIT>" +
+            "<PRIORITY>500</PRIORITY><STATE>ACK_ALM</STATE><OPERATOR_NODE></OPERATOR_NODE><OPERATOR_NAME></OPERATOR_NAME>" +
+            "<ACK_DOMAIN_NAME>ArchestrA</ACK_DOMAIN_NAME><ACK_OPERATOR_NODE>mxa</ACK_OPERATOR_NODE>" +
+            "<ACK_OPERATOR_NAME>Administrator</ACK_OPERATOR_NAME><ALARM_COMMENT>Test alarm #1</ALARM_COMMENT>" +
+            "<ACK_COMMENT>mgack-authwrite 180714</ACK_COMMENT></ALARM></ALARM_RECORDS>";
+
+        Dictionary<Guid, MxAlarmSnapshotRecord> records = WnWrapAlarmConsumer.ParseSnapshotXml(xml);
+
+        MxAlarmSnapshotRecord record = Assert.Single(records.Values);
+        Assert.Equal("Administrator", record.AckOperatorName);
+        Assert.Equal("ArchestrA", record.AckOperatorDomain);
+        Assert.Equal("mxa", record.AckOperatorNode);
+        Assert.Equal("mgack-authwrite 180714", record.AckComment);
+        Assert.Equal("Test alarm #1", record.AlarmComment);
+    }
+
+    /// <summary>A Galaxy-provider record resolves to its <c>&lt;tag&gt;.AckMsg</c> item; an unknown GUID is not found.</summary>
+    [Fact]
+    public void ResolveAckTarget_GalaxyRecord_ReturnsAckMsgItem()
+    {
+        Guid guid = Guid.NewGuid();
+        using WnWrapAlarmConsumer consumer = CreateConsumerWithSnapshot(new MxAlarmSnapshotRecord
+        {
+            AlarmGuid = guid, ProviderName = "Galaxy", Group = "TestArea", TagName = "TestMachine_001.TestAlarm001", State = MxAlarmStateKind.UnackAlm,
+        });
+
+        AlarmAckTarget target = consumer.ResolveAckTarget(guid);
+
+        Assert.True(target.Found);
+        Assert.Equal("TestMachine_001.TestAlarm001.AckMsg", target.ItemAddress);
+        Assert.Equal(AlarmAckOutcome.AlarmNotFound, consumer.ResolveAckTarget(Guid.NewGuid()).Failure);
+    }
+
+    /// <summary>A non-Galaxy provider has no MXAccess ack attribute, so it is not ackable.</summary>
+    [Fact]
+    public void ResolveAckTarget_NonGalaxyProvider_IsNotAckable()
+    {
+        Guid guid = Guid.NewGuid();
+        using WnWrapAlarmConsumer consumer = CreateConsumerWithSnapshot(new MxAlarmSnapshotRecord
+        {
+            AlarmGuid = guid, ProviderName = "InTouch", Group = "G", TagName = "Tag1", State = MxAlarmStateKind.UnackAlm,
+        });
+
+        Assert.Equal(AlarmAckOutcome.NotAckable, consumer.ResolveAckTarget(guid).Failure);
+    }
+
+    /// <summary>By-name resolution needs no snapshot: a Galaxy name maps straight to its AckMsg item.</summary>
+    [Fact]
+    public void ResolveAckTargetByName_Galaxy_ReturnsAckMsgItem()
+    {
+        using WnWrapAlarmConsumer consumer = CreateConsumerWithSnapshot();
+
+        Assert.Equal("TestMachine_001.TestAlarm001.AckMsg",
+            consumer.ResolveAckTargetByName("TestMachine_001.TestAlarm001", "Galaxy", "TestArea").ItemAddress);
+        Assert.Equal(AlarmAckOutcome.NotAckable, consumer.ResolveAckTargetByName("Tag1", "InTouch", "G").Failure);
+    }
+
+    private static WnWrapAlarmConsumer CreateConsumerWithSnapshot(params MxAlarmSnapshotRecord[] records)
+    {
+        WnWrapAlarmConsumer consumer = new WnWrapAlarmConsumer(1024);
+        Dictionary<Guid, MxAlarmSnapshotRecord> next = new Dictionary<Guid, MxAlarmSnapshotRecord>();
+        foreach (MxAlarmSnapshotRecord record in records)
+        {
+            next[record.AlarmGuid] = record;
+        }
+
+        consumer.FoldFetch(next, truncated: false, out _);
+        return consumer;
+    }
 }

src/ZB.MOM.WW.MxGateway.Worker.Tests/Probes/AlarmSubtagLiveSmokeTests.cs

@@ -2,7 +2,7 @@
 //
 // Validates the subtag-fallback pipeline against a real Galaxy + MXAccess install:
 //   LmxSubtagAlarmSource (own LMXProxyServerClass) ->
-//   SubtagAlarmConsumer (state machine + AcknowledgeByName write) ->
+//   SubtagAlarmConsumer (state machine + ResolveAckTargetByName) + AlarmAckWriter (AckMsg write) ->
 //   synthesized MxAlarmTransitionEvent (Raise / Clear, Degraded=true, SyntheticGuid)
 //
 // FIELD NAMES CONFIRMED: InAlarm/Acked/AckMsg/Priority are the confirmed AVEVA
@@ -49,8 +49,9 @@ namespace ZB.MOM.WW.MxGateway.Worker.Tests.Probes;
 ///     synthesize <see cref="MxAlarmTransitionEvent"/> records from Galaxy
 ///     alarm subtags using the confirmed AVEVA <c>AlarmExtension</c> field
 ///     names (InAlarm/Acked/AckMsg/Priority), and that
-///     <see cref="SubtagAlarmConsumer.AcknowledgeByName"/> writes the
-///     ack-comment subtag (AckMsg) successfully.
+///     <see cref="SubtagAlarmConsumer.ResolveAckTargetByName"/> resolves the
+///     ack-comment subtag (AckMsg) that <see cref="AlarmAckWriter"/> then
+///     writes successfully.
 ///
 ///     Skip-gated; flip <c>Skip=null</c> on the dev rig with an alarm being
 ///     driven (flip script or a manual operator/IDE toggle of the alarm
@@ -119,7 +120,7 @@ public sealed class AlarmSubtagLiveSmokeTests
     ///     real <c>LMXProxyServerClass</c>, collects a Raise then a Clear
     ///     transition synthesized by <see cref="SubtagAlarmConsumer"/>, confirms
     ///     the Degraded flag and synthetic GUID are stamped, then
-    ///     AcknowledgeByName and verifies the ack-comment write returns 0.
+    ///     acknowledges through the resolved ack-comment subtag and verifies the write succeeds.
     /// </summary>
     [Fact(Skip = "Live dev-rig smoke test — flip Skip=null with AVEVA + an alarm being driven (flip script or manual operator/IDE toggle of the alarm attribute). Subtag fallback path. Field names confirmed (InAlarm/Acked/AckMsg/Priority); live-validate runtime path resolves without intermediate alarm-condition segment.")]
     public void SubtagFallback_FullPipelineRoundTrip_SynthesizesRaiseAndAcknowledges()
@@ -257,17 +258,9 @@ public sealed class AlarmSubtagLiveSmokeTests
         Log("InAlarm subtag delivered a value: " + inAlarmResolved);
 
         // Decisive write: AckMsg. Returns 0 only if the address resolves and is writable.
-        Log("AcknowledgeByName (writes AckMsg subtag) ...");
-        int rc = consumer.AcknowledgeByName(
-            alarmName: AlarmTagName,
-            providerName: Provider,
-            groupName: Group,
-            ackComment: "subtag-resolution-probe",
-            ackOperatorName: Environment.UserName,
-            ackOperatorNode: Environment.MachineName,
-            ackOperatorDomain: Environment.UserDomainName ?? string.Empty,
-            ackOperatorFullName: Environment.UserName);
-        Log(string.Format("AcknowledgeByName(AckMsg write) -> rc={0}", rc));
+        Log("Acknowledge (writes AckMsg subtag via AlarmAckWriter) ...");
+        int rc = AckViaWriter(consumer, "subtag-resolution-probe").NativeStatus;
+        Log(string.Format("Ack (AckMsg write) -> rc={0}", rc));
 
         DateTime settle = DateTime.UtcNow + TimeSpan.FromSeconds(2);
         while (DateTime.UtcNow < settle)
@@ -392,21 +385,13 @@ public sealed class AlarmSubtagLiveSmokeTests
         Assert.True(foundInSnapshot,
             string.Format("Active alarm snapshot must contain '{0}' after a Raise.", AlarmFullReference));
 
-        // 3. AcknowledgeByName — writes the ack-comment subtag.
+        // 3. Resolve the ack-comment subtag and write it as the operator.
         //    The dispatcher derives (alarmName, provider, group) via the same
         //    TryParseReference logic as AlarmsLiveSmokeTests.
-        Log("Calling AcknowledgeByName ...");
-        int rc = consumer.AcknowledgeByName(
-            alarmName: AlarmTagName,
-            providerName: Provider,
-            groupName: Group,
-            ackComment: "subtag-fallback-smoke ack",
-            ackOperatorName: Environment.UserName,
-            ackOperatorNode: Environment.MachineName,
-            ackOperatorDomain: Environment.UserDomainName ?? string.Empty,
-            ackOperatorFullName: Environment.UserName);
+        Log("Acknowledging via AlarmAckWriter ...");
+        int rc = AckViaWriter(consumer, "subtag-fallback-smoke ack").NativeStatus;
 
-        Log(string.Format("AcknowledgeByName -> rc={0}", rc));
+        Log(string.Format("Ack -> rc={0}", rc));
         Assert.Equal(0, rc);
 
         // 4. Wait for a Clear or Acknowledge transition to confirm the state
@@ -501,6 +486,29 @@ public sealed class AlarmSubtagLiveSmokeTests
     ///     Mirrors the pump pattern documented in
     ///     <c>docs/MxAccessWorkerInstanceDesign.md</c>.
     /// </summary>
+    /// <summary>
+    ///     Resolves the probe alarm's ack item through the consumer and writes it
+    ///     with <see cref="AlarmAckWriter"/> as the operator named by
+    ///     <c>MXGATEWAY_PROBE_ACK_USER</c>/<c>MXGATEWAY_PROBE_ACK_PASSWORD</c>
+    ///     (default: current user, empty password).
+    /// </summary>
+    private static AlarmAckResult AckViaWriter(SubtagAlarmConsumer consumer, string comment)
+    {
+        AlarmAckTarget target = consumer.ResolveAckTargetByName(AlarmTagName, Provider, Group);
+        if (!target.Found)
+        {
+            return AlarmAckResult.FromTarget(target);
+        }
+
+        using AlarmAckWriter writer = new AlarmAckWriter(
+            new MxAccessComObjectFactory(), PumpMessages, TimeSpan.FromSeconds(5), AlarmAckWriter.DefaultClientName);
+        return writer.Acknowledge(target.ItemAddress, comment, new AlarmAckOperator
+        {
+            UserName = Environment.GetEnvironmentVariable("MXGATEWAY_PROBE_ACK_USER") ?? Environment.UserName,
+            Password = Environment.GetEnvironmentVariable("MXGATEWAY_PROBE_ACK_PASSWORD") ?? string.Empty,
+        });
+    }
+
     private static void PumpMessages()
     {
         NativeMethods.MSG msg;

src/ZB.MOM.WW.MxGateway.Worker.Tests/Probes/AlarmsLiveSmokeTests.cs

@@ -86,7 +86,12 @@ public sealed class AlarmsLiveSmokeTests
             new WNWRAPCONSUMERLib.wwAlarmConsumerClass(),
             maxAlarmsPerFetch: 1024);
         MxAccessAlarmEventSink sink = new MxAccessAlarmEventSink(queue, new MxAccessEventMapper());
-        using AlarmDispatcher dispatcher = new AlarmDispatcher(consumer, sink, SessionId);
+        using AlarmAckWriter ackWriter = new AlarmAckWriter(
+            new MxAccessComObjectFactory(),
+            () => new ZB.MOM.WW.MxGateway.Worker.Sta.StaMessagePump().PumpPendingMessages(),
+            TimeSpan.FromSeconds(5),
+            AlarmAckWriter.DefaultClientName);
+        using AlarmDispatcher dispatcher = new AlarmDispatcher(consumer, sink, SessionId, ackWriter);
 
         Log("Constructed consumer + sink + dispatcher.");
         dispatcher.Subscribe(SubscriptionExpression);
@@ -139,26 +144,23 @@ public sealed class AlarmsLiveSmokeTests
             $"Captured reference '{raiseBody.AlarmFullReference}' did not parse as Provider!Group.Tag.");
         Log($"Ack target: provider='{provider}' group='{group}' name='{alarmName}'");
 
-        // Try the ack with real Windows identity. AVEVA's AlarmAckByName
-        // may reject synthetic operator strings; using the current process
-        // identity gives the alarm-history a recognizable principal.
-        string realUser = Environment.UserName;
-        string realNode = Environment.MachineName;
-        string realDomain = Environment.UserDomainName ?? string.Empty;
-        Log($"Ack identity: user='{realUser}' node='{realNode}' domain='{realDomain}'");
+        // The ack authenticates a Galaxy operator and writes <tag>.AckMsg.
+        // Operator credentials come from the environment (never logged);
+        // the user defaults to the current process identity.
+        AlarmAckOperator ackOperator = new AlarmAckOperator
+        {
+            UserName = Environment.GetEnvironmentVariable("MXGATEWAY_PROBE_ACK_USER") ?? Environment.UserName,
+            Password = Environment.GetEnvironmentVariable("MXGATEWAY_PROBE_ACK_PASSWORD") ?? string.Empty,
+        };
+        Log($"Ack identity: {ackOperator}");
 
-        int rc = dispatcher.AcknowledgeByName(
-            alarmName: alarmName,
-            providerName: provider,
-            groupName: group,
-            ackComment: "alarms-live-smoke ack",
-            ackOperatorName: realUser,
-            ackOperatorNode: realNode,
-            ackOperatorDomain: realDomain,
-            ackOperatorFullName: realUser);
-        Log($"AcknowledgeByName(real identity) -> rc={rc}");
+        AlarmAckResult result = dispatcher.AcknowledgeByName(
+            alarmName, provider, group, "alarms-live-smoke ack", ackOperator);
+        Log($"AcknowledgeByName -> outcome={result.Outcome} native={result.NativeStatus} diag='{result.Diagnostic}'");
 
-        Assert.Equal(0, rc);
+        Assert.True(
+            result.Outcome == AlarmAckOutcome.Applied || result.Outcome == AlarmAckOutcome.Unconfirmed,
+            $"Ack outcome {result.Outcome}: {result.Diagnostic}");
 
         // 4. Wait for the post-ack transition. With the alarm flipping every
         //    10s and the consumer polling every 500ms, the next state

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/AlarmAckOperator.cs

@@ -0,0 +1,24 @@
+namespace ZB.MOM.WW.MxGateway.Worker.MxAccess;
+
+/// <summary>
+///     Operator identity an alarm acknowledgement authenticates as. The password
+///     is a raw credential: it is passed to MXAccess <c>AuthenticateUser</c> only
+///     and must never be logged or echoed.
+/// </summary>
+public sealed class AlarmAckOperator
+{
+    /// <summary>Gets or sets the operator user name.</summary>
+    public string UserName { get; set; } = string.Empty;
+
+    /// <summary>Gets or sets the optional domain for OS-authenticated galaxies.</summary>
+    public string Domain { get; set; } = string.Empty;
+
+    /// <summary>Gets or sets the operator password (credential-sensitive).</summary>
+    public string Password { get; set; } = string.Empty;
+
+    /// <summary>Gets the user string passed to <c>AuthenticateUser</c>: <c>Domain\UserName</c> when a domain is set.</summary>
+    public string VerifyUser => string.IsNullOrEmpty(Domain) ? UserName : Domain + "\\" + UserName;
+
+    /// <inheritdoc />
+    public override string ToString() => "AlarmAckOperator(" + VerifyUser + ")";
+}

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/AlarmAckOutcome.cs

@@ -0,0 +1,18 @@
+namespace ZB.MOM.WW.MxGateway.Worker.MxAccess;
+
+/// <summary>Outcome of an alarm acknowledgement attempt.</summary>
+public enum AlarmAckOutcome
+{
+    /// <summary>The AckMsg write completed with an OK status.</summary>
+    Applied,
+    /// <summary>The write was sent but no OnWriteComplete arrived before the timeout.</summary>
+    Unconfirmed,
+    /// <summary>The alarm is not in the consumer's current view.</summary>
+    AlarmNotFound,
+    /// <summary>The alarm exists but has no MXAccess ack attribute (non-Galaxy provider or no ack subtag).</summary>
+    NotAckable,
+    /// <summary>AuthenticateUser rejected the operator credentials.</summary>
+    AuthenticationFailed,
+    /// <summary>The AckMsg write completed with a non-OK status.</summary>
+    WriteRejected,
+}

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/AlarmAckResult.cs

@@ -0,0 +1,49 @@
+using System.Collections.Generic;
+using ZB.MOM.WW.MxGateway.Contracts.Proto;
+
+namespace ZB.MOM.WW.MxGateway.Worker.MxAccess;
+
+/// <summary>Result of an alarm acknowledgement.</summary>
+public sealed class AlarmAckResult
+{
+    private static readonly IReadOnlyList<MxStatusProxy> NoStatuses = new MxStatusProxy[0];
+
+    private AlarmAckResult(AlarmAckOutcome outcome, int nativeStatus, string diagnostic, IReadOnlyList<MxStatusProxy>? statuses)
+    {
+        Outcome = outcome;
+        NativeStatus = nativeStatus;
+        Diagnostic = diagnostic;
+        Statuses = statuses ?? NoStatuses;
+    }
+
+    /// <summary>Gets the outcome.</summary>
+    public AlarmAckOutcome Outcome { get; }
+
+    /// <summary>Gets the native status: 0 for applied/unconfirmed, else the HRESULT or status detail.</summary>
+    public int NativeStatus { get; }
+
+    /// <summary>Gets a diagnostic message. Never contains credentials.</summary>
+    public string Diagnostic { get; }
+
+    /// <summary>Gets the OnWriteComplete statuses, empty when none was observed.</summary>
+    public IReadOnlyList<MxStatusProxy> Statuses { get; }
+
+    /// <summary>Creates a result.</summary>
+    /// <param name="outcome">The outcome.</param>
+    /// <param name="nativeStatus">The native status.</param>
+    /// <param name="diagnostic">A credential-free diagnostic.</param>
+    /// <param name="statuses">Observed write statuses.</param>
+    /// <returns>The result.</returns>
+    public static AlarmAckResult Create(
+        AlarmAckOutcome outcome,
+        int nativeStatus,
+        string diagnostic,
+        IReadOnlyList<MxStatusProxy>? statuses = null) =>
+        new AlarmAckResult(outcome, nativeStatus, diagnostic ?? string.Empty, statuses);
+
+    /// <summary>Creates the result for an unresolved ack target.</summary>
+    /// <param name="target">The unresolved target.</param>
+    /// <returns>The result.</returns>
+    public static AlarmAckResult FromTarget(AlarmAckTarget target) =>
+        new AlarmAckResult(target.Failure, -1, target.Reason, null);
+}

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/AlarmAckTarget.cs

@@ -0,0 +1,42 @@
+namespace ZB.MOM.WW.MxGateway.Worker.MxAccess;
+
+/// <summary>The MXAccess item an acknowledgement writes, or why none exists.</summary>
+public sealed class AlarmAckTarget
+{
+    private AlarmAckTarget(string itemAddress, AlarmAckOutcome failure, string reason)
+    {
+        ItemAddress = itemAddress;
+        Failure = failure;
+        Reason = reason;
+    }
+
+    /// <summary>Gets a value indicating whether an ack item was resolved.</summary>
+    public bool Found => ItemAddress.Length > 0;
+
+    /// <summary>Gets the ack item address (e.g. <c>TestMachine_001.TestAlarm001.AckMsg</c>), empty when not found.</summary>
+    public string ItemAddress { get; }
+
+    /// <summary>Gets the failure outcome when <see cref="Found"/> is false.</summary>
+    public AlarmAckOutcome Failure { get; }
+
+    /// <summary>Gets a human-readable reason when <see cref="Found"/> is false.</summary>
+    public string Reason { get; }
+
+    /// <summary>Creates a resolved target.</summary>
+    /// <param name="itemAddress">The ack item address.</param>
+    /// <returns>The target.</returns>
+    public static AlarmAckTarget For(string itemAddress) =>
+        new AlarmAckTarget(itemAddress ?? string.Empty, AlarmAckOutcome.Applied, string.Empty);
+
+    /// <summary>Creates a not-found result.</summary>
+    /// <param name="reason">Why the alarm was not found.</param>
+    /// <returns>The target.</returns>
+    public static AlarmAckTarget NotFound(string reason) =>
+        new AlarmAckTarget(string.Empty, AlarmAckOutcome.AlarmNotFound, reason);
+
+    /// <summary>Creates a not-ackable result.</summary>
+    /// <param name="reason">Why the alarm cannot be acknowledged over MXAccess.</param>
+    /// <returns>The target.</returns>
+    public static AlarmAckTarget NotAckable(string reason) =>
+        new AlarmAckTarget(string.Empty, AlarmAckOutcome.NotAckable, reason);
+}

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/AlarmAckWriter.cs

@@ -0,0 +1,279 @@
+using System;
+using System.Collections.Generic;
+using System.Runtime.InteropServices;
+using ArchestrA.MxAccess;
+using Google.Protobuf.Collections;
+using ZB.MOM.WW.MxGateway.Contracts;
+using ZB.MOM.WW.MxGateway.Contracts.Proto;
+using ZB.MOM.WW.MxGateway.Worker.Conversion;
+
+namespace ZB.MOM.WW.MxGateway.Worker.MxAccess;
+
+/// <summary>
+///     Acknowledges alarms the way the AVEVA runtime records operator identity:
+///     AuthenticateUser as the operator, then write the comment to the alarm's
+///     <c>AckMsg</c> attribute with that user id. Owns its own
+///     <c>LMXProxyServerClass</c> registered under the configured client name,
+///     which the Historian records as the acknowledgement's OperatorNode.
+///     Apartment-threaded: every call must run on the worker STA. The password
+///     is passed to MXAccess only; it never reaches diagnostics.
+/// </summary>
+public sealed class AlarmAckWriter : IAlarmAckWriter
+{
+    /// <summary>The ArchestrA alarm-primitive attribute whose write acknowledges the alarm.</summary>
+    public const string AckCommentAttribute = "AckMsg";
+
+    /// <summary>Default MXAccess client name when none is configured.</summary>
+    public const string DefaultClientName = "MxGateway";
+
+    private readonly IMxAccessComObjectFactory? factory;
+    private readonly MxAccessWriteCompletionCache completionCache;
+    private readonly Action pumpStep;
+    private readonly TimeSpan completionTimeout;
+    private readonly string clientName;
+    private readonly MxStatusProxyConverter statusConverter = new MxStatusProxyConverter();
+    private readonly Dictionary<string, int> itemHandles = new Dictionary<string, int>(StringComparer.OrdinalIgnoreCase);
+    private object? comObject;
+    private LMXProxyServerClass? comEventSource;
+    private IMxAccessServer? server;
+    private int serverHandle;
+    private bool disposed;
+
+    /// <summary>Creates a writer that registers its own MXAccess server on first use.</summary>
+    /// <param name="factory">Creates the <c>LMXProxyServerClass</c>.</param>
+    /// <param name="pumpStep">Drains the STA message queue (OnWriteComplete is delivered by pumping).</param>
+    /// <param name="completionTimeout">Bounded wait for OnWriteComplete.</param>
+    /// <param name="clientName">MXAccess client name (Historian OperatorNode).</param>
+    public AlarmAckWriter(
+        IMxAccessComObjectFactory factory,
+        Action pumpStep,
+        TimeSpan completionTimeout,
+        string? clientName)
+    {
+        this.factory = factory ?? throw new ArgumentNullException(nameof(factory));
+        this.pumpStep = pumpStep ?? throw new ArgumentNullException(nameof(pumpStep));
+        this.completionTimeout = completionTimeout;
+        this.clientName = string.IsNullOrWhiteSpace(clientName) ? DefaultClientName : clientName!;
+        completionCache = new MxAccessWriteCompletionCache();
+    }
+
+    /// <summary>Test seam: uses an already-constructed server and completion cache.</summary>
+    internal AlarmAckWriter(
+        IMxAccessServer server,
+        MxAccessWriteCompletionCache completionCache,
+        Action pumpStep,
+        TimeSpan completionTimeout,
+        string clientName)
+    {
+        this.server = server ?? throw new ArgumentNullException(nameof(server));
+        this.completionCache = completionCache ?? throw new ArgumentNullException(nameof(completionCache));
+        this.pumpStep = pumpStep ?? throw new ArgumentNullException(nameof(pumpStep));
+        this.completionTimeout = completionTimeout;
+        this.clientName = clientName;
+        serverHandle = server.Register(clientName);
+    }
+
+    /// <summary>Resolves the configured client name from the launcher environment.</summary>
+    /// <returns>The client name, or <see cref="DefaultClientName"/>.</returns>
+    public static string ResolveClientName()
+    {
+        string? value = Environment.GetEnvironmentVariable(WorkerLaunchEnvironment.AlarmAckClientName);
+        return string.IsNullOrWhiteSpace(value) ? DefaultClientName : value!.Trim();
+    }
+
+    /// <inheritdoc />
+    public AlarmAckResult Acknowledge(string itemAddress, string comment, AlarmAckOperator ackOperator)
+    {
+        if (disposed) throw new ObjectDisposedException(nameof(AlarmAckWriter));
+        if (string.IsNullOrWhiteSpace(itemAddress)) throw new ArgumentException("Ack item address is required.", nameof(itemAddress));
+        if (ackOperator is null) throw new ArgumentNullException(nameof(ackOperator));
+
+        IMxAccessServer mx = EnsureRegistered();
+
+        int userId;
+        try
+        {
+            userId = mx.AuthenticateUser(serverHandle, ackOperator.VerifyUser, ackOperator.Password ?? string.Empty);
+        }
+        catch (COMException ex)
+        {
+            return AlarmAckResult.Create(
+                AlarmAckOutcome.AuthenticationFailed,
+                ex.HResult,
+                $"Operator authentication failed for '{ackOperator.VerifyUser}' (HRESULT 0x{ex.HResult:X8}).");
+        }
+
+        if (userId == 0)
+        {
+            return AlarmAckResult.Create(
+                AlarmAckOutcome.AuthenticationFailed,
+                -1,
+                $"Operator authentication failed for '{ackOperator.VerifyUser}' (no user id returned).");
+        }
+
+        ulong baselineVersion = 0;
+        int itemHandle = 0;
+        bool cached = itemHandles.TryGetValue(itemAddress, out itemHandle);
+        string step = "AddItem";
+        try
+        {
+            if (!cached)
+            {
+                itemHandle = mx.AddItem(serverHandle, itemAddress);
+                itemHandles[itemAddress] = itemHandle;
+                step = "Advise";
+                // MXAccess rejects writes to added-but-unadvised items with E_INVALIDARG.
+                mx.Advise(serverHandle, itemHandle);
+            }
+
+            pumpStep();
+            step = "Write";
+            baselineVersion = completionCache.CurrentVersion(serverHandle, itemHandle);
+            mx.Write(serverHandle, itemHandle, comment ?? string.Empty, userId);
+        }
+        catch (COMException ex)
+        {
+            int hresult = ex.HResult;
+            if (itemHandles.Remove(itemAddress))
+            {
+                try { mx.UnAdvise(serverHandle, itemHandle); } catch { /* best effort */ }
+                try { mx.RemoveItem(serverHandle, itemHandle); } catch { /* best effort */ }
+            }
+
+            if (IsServerGone(hresult))
+            {
+                TearDownServer();
+            }
+
+            // Diagnostic names the step and HRESULT only: exception text can echo the item or operator.
+            return AlarmAckResult.Create(
+                AlarmAckOutcome.WriteRejected,
+                hresult,
+                $"AckMsg {step} failed (HRESULT 0x{hresult:X8}).");
+        }
+
+        ulong baseline = baselineVersion;
+
+        if (!completionCache.TryWaitForCompletion(
+                serverHandle,
+                itemHandle,
+                baseline,
+                DateTime.UtcNow + completionTimeout,
+                pumpStep,
+                out RepeatedField<MxStatusProxy> statuses))
+        {
+            return AlarmAckResult.Create(
+                AlarmAckOutcome.Unconfirmed,
+                0,
+                $"AckMsg write to '{itemAddress}' sent; OnWriteComplete not observed within {completionTimeout.TotalMilliseconds:F0} ms.");
+        }
+
+        foreach (MxStatusProxy status in statuses)
+        {
+            if (status.Category != Contracts.Proto.MxStatusCategory.Ok)
+            {
+                return AlarmAckResult.Create(
+                    AlarmAckOutcome.WriteRejected,
+                    status.Detail != 0 ? status.Detail : -1,
+                    $"AckMsg write to '{itemAddress}' rejected: category {status.Category}, detail {status.Detail}.",
+                    statuses);
+            }
+        }
+
+        return AlarmAckResult.Create(AlarmAckOutcome.Applied, 0, string.Empty, statuses);
+    }
+
+    /// <inheritdoc />
+    public void Dispose()
+    {
+        if (disposed) return;
+        disposed = true;
+
+        TearDownServer();
+    }
+
+    private static bool IsServerGone(int hresult) =>
+        hresult == unchecked((int)0x80010108) // RPC_E_DISCONNECTED
+        || hresult == unchecked((int)0x800706BA) // RPC_S_SERVER_UNAVAILABLE
+        || hresult == unchecked((int)0x80010105); // RPC_E_SERVERFAULT
+
+    /// <summary>Releases the MXAccess registration so the next call re-registers (also used by Dispose).</summary>
+    private void TearDownServer()
+    {
+        if (comEventSource is not null)
+        {
+            try { comEventSource.OnWriteComplete -= OnWriteComplete; } catch { /* best effort */ }
+        }
+
+        IMxAccessServer? mx = server;
+        if (mx is not null)
+        {
+            foreach (int itemHandle in itemHandles.Values)
+            {
+                try { mx.UnAdvise(serverHandle, itemHandle); } catch { /* best effort */ }
+                try { mx.RemoveItem(serverHandle, itemHandle); } catch { /* best effort */ }
+            }
+
+            try { mx.Unregister(serverHandle); } catch { /* best effort */ }
+        }
+
+        itemHandles.Clear();
+        server = null;
+        comEventSource = null;
+        object? toRelease = comObject;
+        comObject = null;
+        if (toRelease is not null && Marshal.IsComObject(toRelease))
+        {
+            try { Marshal.FinalReleaseComObject(toRelease); } catch { /* best effort */ }
+        }
+    }
+
+    private IMxAccessServer EnsureRegistered()
+    {
+        if (server is not null) return server;
+
+        if (factory is null)
+        {
+            throw new InvalidOperationException("MXAccess server is gone and no COM factory is available to re-register.");
+        }
+
+        object created = factory.Create() ?? throw new InvalidOperationException("MXAccess COM factory returned null.");
+        try
+        {
+            comObject = created;
+            if (created is LMXProxyServerClass comServer)
+            {
+                comEventSource = comServer;
+                comServer.OnWriteComplete += OnWriteComplete;
+            }
+
+            IMxAccessServer mx = new MxAccessComServer(created);
+            serverHandle = mx.Register(clientName);
+            server = mx;
+            return mx;
+        }
+        catch
+        {
+            if (comEventSource is not null)
+            {
+                try { comEventSource.OnWriteComplete -= OnWriteComplete; } catch { /* best effort */ }
+                comEventSource = null;
+            }
+
+            if (Marshal.IsComObject(created))
+            {
+                try { Marshal.FinalReleaseComObject(created); } catch { /* best effort */ }
+            }
+
+            comObject = null;
+            throw;
+        }
+    }
+
+    private void OnWriteComplete(int hLMXServerHandle, int phItemHandle, ref MXSTATUS_PROXY[] pVars)
+    {
+        RepeatedField<MxStatusProxy> rows = new RepeatedField<MxStatusProxy>();
+        rows.AddRange(statusConverter.ConvertMany(pVars));
+        completionCache.Record(hLMXServerHandle, phItemHandle, rows);
+    }
+}

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/AlarmCommandHandler.cs

@@ -1,6 +1,7 @@
 using System;
 using System.Collections.Generic;
 using ZB.MOM.WW.MxGateway.Contracts.Proto;
+using ZB.MOM.WW.MxGateway.Worker.Sta;
 
 namespace ZB.MOM.WW.MxGateway.Worker.MxAccess;
 
@@ -39,9 +40,12 @@ public sealed class AlarmCommandHandler : IAlarmCommandHandler
     private readonly Action? threadAffinityCheck;
     private readonly IMxAccessComObjectFactory? comFactory;
     private readonly Func<IReadOnlyList<AlarmSubtagTarget>, IMxAccessAlarmConsumer>? standbyFactory;
+    private readonly Func<IAlarmAckWriter>? ackWriterFactory;
     private readonly MxAccessEventMapper mapper = new MxAccessEventMapper();
     private readonly object syncRoot = new object();
+    private readonly IAlarmAckWriter deferredAckWriter;
     private AlarmDispatcher? dispatcher;
+    private IAlarmAckWriter? ackWriter;
     private FailoverAlarmConsumer? failoverConsumer;
     private EventHandler<AlarmProviderModeChange>? providerModeChangedHandler;
     private string subscribeSessionId = string.Empty;
@@ -117,18 +121,31 @@ public sealed class AlarmCommandHandler : IAlarmCommandHandler
     ///     <paramref name="comFactory"/>. Tests inject a fake so they need no
     ///     live COM factory.
     /// </param>
+    /// <param name="ackWriterFactory">
+    ///     Optional seam that builds the <see cref="IAlarmAckWriter"/> used for
+    ///     every acknowledgement. Defaults to an <see cref="AlarmAckWriter"/> over
+    ///     <paramref name="comFactory"/> that registers its own MXAccess server
+    ///     (client name from <see cref="AlarmAckWriter.ResolveClientName"/>).
+    ///     The writer is created once per handler, on the first acknowledgement
+    ///     (so a subscription never fails because ack is unavailable), survives
+    ///     unsubscribe/resubscribe, and is disposed with the handler. Tests
+    ///     inject a fake.
+    /// </param>
     public AlarmCommandHandler(
         MxAccessEventQueue eventQueue,
         Func<IMxAccessAlarmConsumer> consumerFactory,
         Action? threadAffinityCheck,
         IMxAccessComObjectFactory? comFactory,
-        Func<IReadOnlyList<AlarmSubtagTarget>, IMxAccessAlarmConsumer>? standbyFactory)
+        Func<IReadOnlyList<AlarmSubtagTarget>, IMxAccessAlarmConsumer>? standbyFactory,
+        Func<IAlarmAckWriter>? ackWriterFactory = null)
     {
         this.eventQueue = eventQueue ?? throw new ArgumentNullException(nameof(eventQueue));
         this.consumerFactory = consumerFactory ?? throw new ArgumentNullException(nameof(consumerFactory));
         this.threadAffinityCheck = threadAffinityCheck;
         this.comFactory = comFactory;
         this.standbyFactory = standbyFactory;
+        this.ackWriterFactory = ackWriterFactory;
+        this.deferredAckWriter = new DeferredAckWriter(this);
     }
 
     /// <summary>Gets a value indicating whether the handler is subscribed.</summary>
@@ -170,7 +187,7 @@ public sealed class AlarmCommandHandler : IAlarmCommandHandler
             }
 
             MxAccessAlarmEventSink sink = new MxAccessAlarmEventSink(eventQueue, mapper);
-            dispatcher = new AlarmDispatcher(consumer, sink, subscribeSessionId);
+            dispatcher = new AlarmDispatcher(consumer, sink, subscribeSessionId, deferredAckWriter);
             try
             {
                 dispatcher.Subscribe(subscriptionExpression);
@@ -305,47 +322,31 @@ public sealed class AlarmCommandHandler : IAlarmCommandHandler
     }
 
     /// <inheritdoc />
-    public int Acknowledge(
-        Guid alarmGuid,
-        string comment,
-        string operatorUser,
-        string operatorNode,
-        string operatorDomain,
-        string operatorFullName)
+    public AlarmAckResult Acknowledge(Guid alarmGuid, string comment, AlarmAckOperator ackOperator)
     {
+        if (ackOperator is null) throw new ArgumentNullException(nameof(ackOperator));
         threadAffinityCheck?.Invoke();
-        AlarmDispatcher? d = GetDispatcherOrThrow();
-        return d.Acknowledge(
-            alarmGuid,
-            comment ?? string.Empty,
-            operatorUser ?? string.Empty,
-            operatorNode ?? string.Empty,
-            operatorDomain ?? string.Empty,
-            operatorFullName ?? string.Empty);
+        AlarmDispatcher d = GetDispatcherOrThrow();
+        return d.Acknowledge(alarmGuid, comment ?? string.Empty, ackOperator);
     }
 
     /// <inheritdoc />
-    public int AcknowledgeByName(
+    public AlarmAckResult AcknowledgeByName(
         string alarmName,
         string providerName,
         string groupName,
         string comment,
-        string operatorUser,
-        string operatorNode,
-        string operatorDomain,
-        string operatorFullName)
+        AlarmAckOperator ackOperator)
     {
+        if (ackOperator is null) throw new ArgumentNullException(nameof(ackOperator));
         threadAffinityCheck?.Invoke();
-        AlarmDispatcher? d = GetDispatcherOrThrow();
+        AlarmDispatcher d = GetDispatcherOrThrow();
         return d.AcknowledgeByName(
             alarmName ?? string.Empty,
             providerName ?? string.Empty,
             groupName ?? string.Empty,
             comment ?? string.Empty,
-            operatorUser ?? string.Empty,
-            operatorNode ?? string.Empty,
-            operatorDomain ?? string.Empty,
-            operatorFullName ?? string.Empty);
+            ackOperator);
     }
 
     /// <inheritdoc />
@@ -380,6 +381,60 @@ public sealed class AlarmCommandHandler : IAlarmCommandHandler
         d?.PollOnce();
     }
 
+    private IAlarmAckWriter GetOrCreateAckWriter()
+    {
+        lock (syncRoot)
+        {
+            if (disposed) throw new ObjectDisposedException(nameof(AlarmCommandHandler));
+            if (ackWriter is not null) return ackWriter;
+            if (ackWriterFactory is not null)
+            {
+                ackWriter = ackWriterFactory() ?? throw new InvalidOperationException("Alarm ack writer factory returned null.");
+                return ackWriter;
+            }
+
+            if (comFactory is null)
+            {
+                throw new InvalidOperationException(
+                    "Alarm acknowledgement requires an IMxAccessComObjectFactory; the alarm command handler was constructed without one.");
+            }
+
+            // StaMessagePump.PumpPendingMessages is PeekMessage/DispatchMessage on
+            // the calling thread — the STA, since acks run there — which is what
+            // delivers the writer's OnWriteComplete callback.
+            ackWriter = new AlarmAckWriter(
+                comFactory,
+                () => new StaMessagePump().PumpPendingMessages(),
+                MxAccessStaSession.ResolveWriteCompletionTimeout(),
+                AlarmAckWriter.ResolveClientName());
+            return ackWriter;
+        }
+    }
+
+    /// <summary>
+    ///     The writer handed to each <see cref="AlarmDispatcher"/>. Resolves the
+    ///     handler's real writer on first acknowledgement so the writer (and its
+    ///     MXAccess server registration) is created only when an ack happens and
+    ///     outlives dispatcher churn. Disposing it is a no-op; the handler owns
+    ///     the real writer.
+    /// </summary>
+    private sealed class DeferredAckWriter : IAlarmAckWriter
+    {
+        private readonly AlarmCommandHandler owner;
+
+        public DeferredAckWriter(AlarmCommandHandler owner)
+        {
+            this.owner = owner;
+        }
+
+        public AlarmAckResult Acknowledge(string itemAddress, string comment, AlarmAckOperator ackOperator) =>
+            owner.GetOrCreateAckWriter().Acknowledge(itemAddress, comment, ackOperator);
+
+        public void Dispose()
+        {
+        }
+    }
+
     private AlarmDispatcher GetDispatcherOrThrow()
     {
         if (disposed) throw new ObjectDisposedException(nameof(AlarmCommandHandler));
@@ -400,5 +455,13 @@ public sealed class AlarmCommandHandler : IAlarmCommandHandler
         if (disposed) return;
         disposed = true;
         Unsubscribe();
+        IAlarmAckWriter? writerToDispose;
+        lock (syncRoot)
+        {
+            writerToDispose = ackWriter;
+            ackWriter = null;
+        }
+
+        try { writerToDispose?.Dispose(); } catch { /* swallow */ }
     }
 }

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/AlarmDispatcher.cs

@@ -18,7 +18,9 @@ namespace ZB.MOM.WW.MxGateway.Worker.MxAccess;
 ///         worker's IPC layer issues <c>SubscribeAlarmsCommand</c> /
 ///         <c>AcknowledgeAlarmCommand</c> / <c>QueryActiveAlarmsCommand</c>
 ///         through <see cref="AlarmCommandHandler"/>, which owns one
-///         dispatcher per session.
+///         dispatcher per session. Acknowledgement resolves the alarm to its
+///         MXAccess ack item through the consumer and hands the write to the
+///         <see cref="IAlarmAckWriter"/>, which authenticates as the operator.
 ///     </para>
 ///     <para>
 ///         Threading: <see cref="WnWrapAlarmConsumer"/> owns no internal
@@ -36,20 +38,29 @@ public sealed class AlarmDispatcher : IDisposable
     private readonly MxAccessAlarmEventSink sink;
     private readonly string sessionId;
     private readonly EventHandler<MxAlarmTransitionEvent> handler;
+    private readonly IAlarmAckWriter ackWriter;
     private bool disposed;
 
-    /// <summary>Initializes a new alarm dispatcher for the given consumer, sink, and session ID.</summary>
+    /// <summary>Initializes a new alarm dispatcher for the given consumer, sink, session ID and ack writer.</summary>
     /// <param name="consumer">The alarm consumer.</param>
     /// <param name="sink">The alarm event sink.</param>
     /// <param name="sessionId">The session identifier.</param>
+    /// <param name="ackWriter">
+    ///     Writes the resolved ack item as the authenticated operator. Owned by
+    ///     the caller (<see cref="AlarmCommandHandler"/>), which disposes it; the
+    ///     dispatcher never does, so the writer's registered MXAccess server
+    ///     outlives an unsubscribe/resubscribe cycle.
+    /// </param>
     public AlarmDispatcher(
         IMxAccessAlarmConsumer consumer,
         MxAccessAlarmEventSink sink,
-        string sessionId)
+        string sessionId,
+        IAlarmAckWriter ackWriter)
     {
         this.consumer = consumer ?? throw new ArgumentNullException(nameof(consumer));
         this.sink = sink ?? throw new ArgumentNullException(nameof(sink));
         this.sessionId = sessionId ?? string.Empty;
+        this.ackWriter = ackWriter ?? throw new ArgumentNullException(nameof(ackWriter));
         // Sink.Attach is the seam that propagates the session id onto the
         // proto SessionId field of every emitted MxEvent. Pass the consumer
         // as the "associated COM object" — sink ignores the object reference
@@ -72,70 +83,35 @@ public sealed class AlarmDispatcher : IDisposable
         consumer.Subscribe(subscription);
     }
 
-    /// <summary>
-    ///     Forward an <c>AcknowledgeAlarm</c> request to the underlying
-    ///     consumer's <c>AlarmAckByGUID</c>. Returns the AVEVA-native
-    ///     status code (0 = success).
-    /// </summary>
+    /// <summary>Acknowledges the alarm with the given GUID by writing its ack item as the operator.</summary>
     /// <param name="alarmGuid">The alarm GUID.</param>
-    /// <param name="ackComment">The acknowledgment comment.</param>
-    /// <param name="ackOperatorName">The operator name.</param>
-    /// <param name="ackOperatorNode">The operator node.</param>
-    /// <param name="ackOperatorDomain">The operator domain.</param>
-    /// <param name="ackOperatorFullName">The operator full name.</param>
-    /// <returns>The AVEVA-native status code.</returns>
-    public int Acknowledge(
-        Guid alarmGuid,
-        string ackComment,
-        string ackOperatorName,
-        string ackOperatorNode,
-        string ackOperatorDomain,
-        string ackOperatorFullName)
+    /// <param name="ackComment">The acknowledgement comment.</param>
+    /// <param name="ackOperator">The operator to authenticate as.</param>
+    /// <returns>The outcome.</returns>
+    public AlarmAckResult Acknowledge(Guid alarmGuid, string ackComment, AlarmAckOperator ackOperator)
     {
         if (disposed) throw new ObjectDisposedException(nameof(AlarmDispatcher));
-        return consumer.AcknowledgeByGuid(
-            alarmGuid,
-            ackComment,
-            ackOperatorName,
-            ackOperatorNode,
-            ackOperatorDomain,
-            ackOperatorFullName);
+        AlarmAckTarget target = consumer.ResolveAckTarget(alarmGuid);
+        return target.Found
+            ? ackWriter.Acknowledge(target.ItemAddress, ackComment, ackOperator)
+            : AlarmAckResult.FromTarget(target);
     }
 
-    /// <summary>
-    ///     Acknowledge an alarm by its (name, provider, group) tuple.
-    ///     Routes to the consumer's <c>AcknowledgeByName</c> path which
-    ///     maps to <c>wwAlarmConsumerClass.AlarmAckByName</c>.
-    /// </summary>
-    /// <param name="alarmName">The alarm name.</param>
-    /// <param name="providerName">The provider name.</param>
-    /// <param name="groupName">The group name.</param>
-    /// <param name="ackComment">The acknowledgment comment.</param>
-    /// <param name="ackOperatorName">The operator name.</param>
-    /// <param name="ackOperatorNode">The operator node.</param>
-    /// <param name="ackOperatorDomain">The operator domain.</param>
-    /// <param name="ackOperatorFullName">The operator full name.</param>
-    /// <returns>The AVEVA-native status code.</returns>
-    public int AcknowledgeByName(
-        string alarmName,
-        string providerName,
-        string groupName,
-        string ackComment,
-        string ackOperatorName,
-        string ackOperatorNode,
-        string ackOperatorDomain,
-        string ackOperatorFullName)
+    /// <summary>Acknowledges the alarm identified by name/provider/group as the operator.</summary>
+    /// <param name="alarmName">The tag/alarm name.</param>
+    /// <param name="providerName">The provider.</param>
+    /// <param name="groupName">The group/area.</param>
+    /// <param name="ackComment">The acknowledgement comment.</param>
+    /// <param name="ackOperator">The operator to authenticate as.</param>
+    /// <returns>The outcome.</returns>
+    public AlarmAckResult AcknowledgeByName(
+        string alarmName, string providerName, string groupName, string ackComment, AlarmAckOperator ackOperator)
     {
         if (disposed) throw new ObjectDisposedException(nameof(AlarmDispatcher));
-        return consumer.AcknowledgeByName(
-            alarmName,
-            providerName,
-            groupName,
-            ackComment,
-            ackOperatorName,
-            ackOperatorNode,
-            ackOperatorDomain,
-            ackOperatorFullName);
+        AlarmAckTarget target = consumer.ResolveAckTargetByName(alarmName, providerName, groupName);
+        return target.Found
+            ? ackWriter.Acknowledge(target.ItemAddress, ackComment, ackOperator)
+            : AlarmAckResult.FromTarget(target);
     }
 
     /// <summary>
@@ -193,6 +169,7 @@ public sealed class AlarmDispatcher : IDisposable
 
         string fullReference = AlarmRecordTransitionMapper.ComposeFullReference(
             record.ProviderName, record.Group, record.TagName);
+        bool useAck = kind == AlarmTransitionKind.Acknowledge && HasAckAttribution(record);
 
         sink.EnqueueTransition(
             alarmFullReference: fullReference,
@@ -202,15 +179,22 @@ public sealed class AlarmDispatcher : IDisposable
             severity: record.Priority,
             originalRaiseTimestampUtc: null,
             transitionTimestampUtc: record.TransitionTimestampUtc,
-            operatorUser: record.OperatorName,
-            operatorComment: record.AlarmComment,
+            operatorUser: useAck ? record.AckOperatorName : record.OperatorName,
+            operatorComment: useAck ? record.AckComment : record.AlarmComment,
             category: record.Group,
             description: string.Empty,
             degraded: record.Degraded);
     }
 
+    private static bool HasAckAttribution(MxAlarmSnapshotRecord record) =>
+        !string.IsNullOrEmpty(record.AckOperatorName) || !string.IsNullOrEmpty(record.AckComment);
+
+    private static bool IsAcked(MxAlarmStateKind state) =>
+        state == MxAlarmStateKind.AckAlm || state == MxAlarmStateKind.AckRtn;
+
     private static ActiveAlarmSnapshot MapToSnapshot(MxAlarmSnapshotRecord record, bool truncated)
     {
+        bool useAck = IsAcked(record.State) && HasAckAttribution(record);
         ActiveAlarmSnapshot snapshot = new ActiveAlarmSnapshot
         {
             AlarmFullReference = AlarmRecordTransitionMapper.ComposeFullReference(
@@ -219,8 +203,8 @@ public sealed class AlarmDispatcher : IDisposable
             AlarmTypeName = record.Type,
             CurrentState = MapConditionState(record.State),
             Severity = record.Priority,
-            OperatorUser = record.OperatorName,
-            OperatorComment = record.AlarmComment,
+            OperatorUser = useAck ? record.AckOperatorName : record.OperatorName,
+            OperatorComment = useAck ? record.AckComment : record.AlarmComment,
             Category = record.Group,
             Description = string.Empty,
             Degraded = record.Degraded,

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/FailoverAlarmConsumer.cs

@@ -41,7 +41,7 @@ namespace ZB.MOM.WW.MxGateway.Worker.MxAccess;
 ///         <strong>Threading.</strong> Like its children, this type is driven
 ///         entirely on the worker's STA: <see cref="Subscribe"/>,
 ///         <see cref="PollOnce"/>, <see cref="ProbeOnce"/>, and the
-///         <c>AcknowledgeBy*</c> calls are all invoked from the apartment that
+///         <c>ResolveAckTarget*</c> calls are all invoked from the apartment that
 ///         owns the underlying COM objects. It owns no locks of its own and no
 ///         internal timer; the worker drives <see cref="PollOnce"/> on a timer.
 ///     </para>
@@ -259,34 +259,17 @@ public sealed class FailoverAlarmConsumer : IMxAccessAlarmConsumer
     }
 
     /// <inheritdoc />
-    public int AcknowledgeByGuid(
-        Guid alarmGuid,
-        string ackComment,
-        string ackOperatorName,
-        string ackOperatorNode,
-        string ackOperatorDomain,
-        string ackOperatorFullName)
+    public AlarmAckTarget ResolveAckTarget(Guid alarmGuid)
     {
         if (disposed) throw new ObjectDisposedException(nameof(FailoverAlarmConsumer));
-        return ActiveChild.AcknowledgeByGuid(
-            alarmGuid, ackComment, ackOperatorName, ackOperatorNode, ackOperatorDomain, ackOperatorFullName);
+        return ActiveChild.ResolveAckTarget(alarmGuid);
     }
 
     /// <inheritdoc />
-    public int AcknowledgeByName(
-        string alarmName,
-        string providerName,
-        string groupName,
-        string ackComment,
-        string ackOperatorName,
-        string ackOperatorNode,
-        string ackOperatorDomain,
-        string ackOperatorFullName)
+    public AlarmAckTarget ResolveAckTargetByName(string alarmName, string providerName, string groupName)
     {
         if (disposed) throw new ObjectDisposedException(nameof(FailoverAlarmConsumer));
-        return ActiveChild.AcknowledgeByName(
-            alarmName, providerName, groupName, ackComment,
-            ackOperatorName, ackOperatorNode, ackOperatorDomain, ackOperatorFullName);
+        return ActiveChild.ResolveAckTargetByName(alarmName, providerName, groupName);
     }
 
     /// <inheritdoc />

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/IAlarmAckWriter.cs

@@ -0,0 +1,17 @@
+using System;
+
+namespace ZB.MOM.WW.MxGateway.Worker.MxAccess;
+
+/// <summary>
+///     Acknowledges an alarm by writing its MXAccess ack item (<c>AckMsg</c>)
+///     after authenticating as the operator. Must be called on the worker STA.
+/// </summary>
+public interface IAlarmAckWriter : IDisposable
+{
+    /// <summary>Authenticates <paramref name="ackOperator"/> and writes <paramref name="comment"/> to <paramref name="itemAddress"/>.</summary>
+    /// <param name="itemAddress">The ack item, e.g. <c>Obj.Alarm.AckMsg</c>.</param>
+    /// <param name="comment">The acknowledgement comment.</param>
+    /// <param name="ackOperator">The operator to authenticate as.</param>
+    /// <returns>The outcome.</returns>
+    AlarmAckResult Acknowledge(string itemAddress, string comment, AlarmAckOperator ackOperator);
+}

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/IAlarmCommandHandler.cs

@@ -35,44 +35,21 @@ public interface IAlarmCommandHandler : IDisposable
     /// <summary>Tear down the active subscription. No-op if not subscribed.</summary>
     void Unsubscribe();
 
-    /// <summary>Acknowledge a single alarm by GUID. Returns AVEVA's native status (0 = success).</summary>
+    /// <summary>Acknowledges an alarm by GUID as <paramref name="ackOperator"/>.</summary>
     /// <param name="alarmGuid">The alarm GUID.</param>
-    /// <param name="comment">The acknowledgment comment.</param>
-    /// <param name="operatorUser">The operator user name.</param>
-    /// <param name="operatorNode">The operator node name.</param>
-    /// <param name="operatorDomain">The operator domain name.</param>
-    /// <param name="operatorFullName">The operator full name.</param>
-    /// <returns>AVEVA's native alarm status code (0 = success).</returns>
-    int Acknowledge(
-        Guid alarmGuid,
-        string comment,
-        string operatorUser,
-        string operatorNode,
-        string operatorDomain,
-        string operatorFullName);
+    /// <param name="comment">The acknowledgement comment written to the alarm's ack item.</param>
+    /// <param name="ackOperator">The operator to authenticate as (credential-sensitive).</param>
+    /// <returns>The acknowledgement outcome.</returns>
+    AlarmAckResult Acknowledge(Guid alarmGuid, string comment, AlarmAckOperator ackOperator);
 
-    /// <summary>
-    ///     Acknowledge a single alarm by (name, provider, group) — used when
-    ///     the caller has the human-readable reference but not the GUID.
-    /// </summary>
-    /// <param name="alarmName">The alarm name.</param>
+    /// <summary>Acknowledges an alarm by name/provider/group as <paramref name="ackOperator"/>.</summary>
+    /// <param name="alarmName">The alarm (tag) name.</param>
     /// <param name="providerName">The provider name.</param>
     /// <param name="groupName">The group name.</param>
-    /// <param name="comment">The acknowledgment comment.</param>
-    /// <param name="operatorUser">The operator user name.</param>
-    /// <param name="operatorNode">The operator node name.</param>
-    /// <param name="operatorDomain">The operator domain name.</param>
-    /// <param name="operatorFullName">The operator full name.</param>
-    /// <returns>AVEVA's native alarm status code (0 = success).</returns>
-    int AcknowledgeByName(
-        string alarmName,
-        string providerName,
-        string groupName,
-        string comment,
-        string operatorUser,
-        string operatorNode,
-        string operatorDomain,
-        string operatorFullName);
+    /// <param name="comment">The acknowledgement comment written to the alarm's ack item.</param>
+    /// <param name="ackOperator">The operator to authenticate as (credential-sensitive).</param>
+    /// <returns>The acknowledgement outcome.</returns>
+    AlarmAckResult AcknowledgeByName(string alarmName, string providerName, string groupName, string comment, AlarmAckOperator ackOperator);
 
     /// <summary>
     ///     Snapshot the currently-active alarm set, optionally scoped to a

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/IMxAccessAlarmConsumer.cs

@@ -49,51 +49,19 @@ public interface IMxAccessAlarmConsumer : IDisposable
     void Subscribe(string subscription);
 
     /// <summary>
-    ///     Acknowledges a single alarm with full operator-identity fidelity.
-    ///     Reaches AVEVA's native <c>AlarmAckByGUID</c>; operator
-    ///     user / node / domain / full-name and the comment land atomically
-    ///     with the ack transition in the alarm-history log.
+    ///     Resolves the MXAccess item whose write acknowledges the alarm with the
+    ///     given GUID (e.g. <c>Obj.Alarm.AckMsg</c>). Does not perform the ack.
     /// </summary>
-    /// <param name="alarmGuid">The alarm GUID.</param>
-    /// <param name="ackComment">The acknowledgment comment.</param>
-    /// <param name="ackOperatorName">The operator name.</param>
-    /// <param name="ackOperatorNode">The operator node.</param>
-    /// <param name="ackOperatorDomain">The operator domain.</param>
-    /// <param name="ackOperatorFullName">The operator full name.</param>
-    /// <returns>The AVEVA-native status code.</returns>
-    int AcknowledgeByGuid(
-        Guid alarmGuid,
-        string ackComment,
-        string ackOperatorName,
-        string ackOperatorNode,
-        string ackOperatorDomain,
-        string ackOperatorFullName);
+    /// <param name="alarmGuid">The alarm GUID as reported by this consumer.</param>
+    /// <returns>The resolved target or the reason none exists.</returns>
+    AlarmAckTarget ResolveAckTarget(Guid alarmGuid);
 
-    /// <summary>
-    ///     Acknowledge a single alarm by its (name, provider, group) tuple.
-    ///     Reaches AVEVA's <c>AlarmAckByName</c> on
-    ///     <c>wwAlarmConsumerClass</c>; same alarm-history outcome as
-    ///     <see cref="AcknowledgeByGuid"/>, used when the caller has the
-    ///     human-readable reference but not the canonical GUID.
-    /// </summary>
-    /// <param name="alarmName">The alarm name.</param>
-    /// <param name="providerName">The provider name.</param>
-    /// <param name="groupName">The group name.</param>
-    /// <param name="ackComment">The acknowledgment comment.</param>
-    /// <param name="ackOperatorName">The operator name.</param>
-    /// <param name="ackOperatorNode">The operator node.</param>
-    /// <param name="ackOperatorDomain">The operator domain.</param>
-    /// <param name="ackOperatorFullName">The operator full name.</param>
-    /// <returns>The AVEVA-native status code.</returns>
-    int AcknowledgeByName(
-        string alarmName,
-        string providerName,
-        string groupName,
-        string ackComment,
-        string ackOperatorName,
-        string ackOperatorNode,
-        string ackOperatorDomain,
-        string ackOperatorFullName);
+    /// <summary>Resolves the ack item for an alarm identified by name, provider and group.</summary>
+    /// <param name="alarmName">The tag/alarm name, e.g. <c>TestMachine_001.TestAlarm001</c>.</param>
+    /// <param name="providerName">The provider (literal <c>Galaxy</c> for ArchestrA).</param>
+    /// <param name="groupName">The area/group.</param>
+    /// <returns>The resolved target or the reason none exists.</returns>
+    AlarmAckTarget ResolveAckTargetByName(string alarmName, string providerName, string groupName);
 
     /// <summary>
     ///     Returns the consumer's most recently parsed snapshot of currently

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/ISubtagAlarmSource.cs

@@ -16,9 +16,4 @@ public interface ISubtagAlarmSource : IDisposable
     /// <summary>Begins advising the supplied MXAccess subtag item addresses.</summary>
     /// <param name="itemAddresses">The subtag references to advise.</param>
     void Advise(IReadOnlyCollection<string> itemAddresses);
-
-    /// <summary>Writes a value to the named MXAccess subtag (e.g. an ack request).</summary>
-    /// <param name="itemAddress">The subtag reference to write.</param>
-    /// <param name="value">The value to write.</param>
-    void Write(string itemAddress, object? value);
 }

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/LmxSubtagAlarmSource.cs

@@ -9,8 +9,9 @@ namespace ZB.MOM.WW.MxGateway.Worker.MxAccess;
 ///     Production <see cref="ISubtagAlarmSource"/> backed by its own MXAccess
 ///     <c>LMXProxyServerClass</c> COM object. It advises a set of alarm subtag
 ///     item addresses, normalizes each <c>OnDataChange</c> COM callback into a
-///     <see cref="SubtagValueChange"/>, and supports writing a value (e.g. an
-///     ack-comment) to a subtag.
+///     <see cref="SubtagValueChange"/>. It is observe-only: alarm
+///     acknowledgement goes through <see cref="AlarmAckWriter"/>, which
+///     authenticates the operator on its own server.
 /// </summary>
 /// <remarks>
 ///     <para>
@@ -25,7 +26,7 @@ namespace ZB.MOM.WW.MxGateway.Worker.MxAccess;
 ///         <strong>Threading.</strong> The <c>LMXProxyServerClass</c> CLSID is
 ///         apartment-threaded and delivers <c>OnDataChange</c> via the STA
 ///         message pump. Every method on this type — the lazy <see cref="Advise"/>
-///         creation, <see cref="Write"/>, and <see cref="Dispose"/> — must be
+///         creation and <see cref="Dispose"/> — must be
 ///         invoked on the worker's STA that created the source, exactly as
 ///         <see cref="MxAccessSession"/> and <see cref="WnWrapAlarmConsumer"/>
 ///         require. The <c>OnDataChange</c> COM event also arrives on that STA.
@@ -47,9 +48,7 @@ public sealed class LmxSubtagAlarmSource : ISubtagAlarmSource
         new Dictionary<int, string>();
 
     // Handles that were actually Advise()d, tracked separately from the added
-    // set so Dispose only UnAdvises advised items. Write() can AddItem a
-    // write-only subtag (e.g. an ack-comment that was never advised); calling
-    // UnAdvise on such a handle would be an unbalanced teardown.
+    // set so Dispose only UnAdvises items this source advised.
     private readonly HashSet<int> advisedItemHandles = new HashSet<int>();
 
     private object? mxAccessComObject;
@@ -85,7 +84,7 @@ public sealed class LmxSubtagAlarmSource : ISubtagAlarmSource
     ///     <see cref="IMxAccessServer"/> with a pre-registered server handle,
     ///     bypassing the live COM factory. Exposed via
     ///     <c>InternalsVisibleTo("ZB.MOM.WW.MxGateway.Worker.Tests")</c> so tests can
-    ///     exercise <see cref="Advise"/>/<see cref="Write"/> and
+    ///     exercise <see cref="Advise"/> and
     ///     <see cref="HandleDataChange"/> without a live <c>LMXProxyServerClass</c>.
     ///     No COM event source is wired in this mode — tests drive
     ///     <see cref="HandleDataChange"/> directly to simulate an
@@ -140,29 +139,6 @@ public sealed class LmxSubtagAlarmSource : ISubtagAlarmSource
         }
     }
 
-    /// <inheritdoc />
-    public void Write(string itemAddress, object? value)
-    {
-        // Writes with MXAccess user id 0 — always an unsecured Write, never WriteSecured semantics.
-        if (itemAddress is null)
-        {
-            throw new ArgumentNullException(nameof(itemAddress));
-        }
-
-        ThrowIfDisposed();
-        EnsureRegistered();
-
-        IMxAccessServer mxServer = server!;
-        if (!itemHandlesByAddress.TryGetValue(itemAddress, out int itemHandle))
-        {
-            itemHandle = mxServer.AddItem(serverHandle, itemAddress);
-            itemHandlesByAddress[itemAddress] = itemHandle;
-            addressesByItemHandle[itemHandle] = itemAddress;
-        }
-
-        mxServer.Write(serverHandle, itemHandle, value, userId: 0);
-    }
-
     /// <summary>
     ///     Normalizes an MXAccess <c>OnDataChange</c> callback into a
     ///     <see cref="SubtagValueChange"/> and raises <see cref="ValueChanged"/>
@@ -223,8 +199,7 @@ public sealed class LmxSubtagAlarmSource : ISubtagAlarmSource
         {
             foreach (KeyValuePair<int, string> entry in addressesByItemHandle)
             {
-                // Only UnAdvise handles that were actually advised; a write-only
-                // item (added by Write but never Advise'd) was never advised.
+                // Only UnAdvise handles that were actually advised.
                 if (advisedItemHandles.Contains(entry.Key))
                 {
                     try { mxServer.UnAdvise(serverHandle, entry.Key); } catch { /* swallow — best effort */ }

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/MxAccessCommandExecutor.cs

@@ -1,5 +1,6 @@
 using System;
 using System.Collections.Generic;
+using System.Globalization;
 using ZB.MOM.WW.MxGateway.Contracts.Proto;
 using ZB.MOM.WW.MxGateway.Worker.Conversion;
 using ZB.MOM.WW.MxGateway.Worker.Sta;
@@ -912,30 +913,25 @@ public sealed class MxAccessCommandExecutor : IStaCommandExecutor
                 $"AcknowledgeAlarm.alarm_guid is not a valid canonical GUID: '{payload.AlarmGuid}'.");
         }
 
+        // operator_password is a raw credential: it goes into AlarmAckOperator for
+        // MXAccess AuthenticateUser and nowhere else. Never format the payload
+        // (its generated ToString renders every field) or the exception text.
         try
         {
-            int rc = alarmCommandHandler.Acknowledge(
+            AlarmAckResult result = alarmCommandHandler.Acknowledge(
                 alarmGuid,
                 payload.Comment,
-                payload.OperatorUser,
-                payload.OperatorNode,
-                payload.OperatorDomain,
-                payload.OperatorFullName);
-            MxCommandReply reply = CreateOkReply(command);
-            reply.Hresult = rc;
-            reply.AcknowledgeAlarm = new AcknowledgeAlarmReplyPayload
-            {
-                NativeStatus = rc,
-            };
-            if (rc != 0)
-            {
-                reply.DiagnosticMessage = $"AVEVA AlarmAckByGUID returned non-zero status {rc}.";
-            }
-            return reply;
+                new AlarmAckOperator
+                {
+                    UserName = payload.OperatorUser,
+                    Domain = payload.OperatorDomain,
+                    Password = payload.OperatorPassword,
+                });
+            return CreateAcknowledgeReply(command, result);
         }
         catch (Exception ex)
         {
-            return CreateAlarmFailureReply(command, ex);
+            return CreateAcknowledgeFailureReply(command, ex);
         }
     }
 
@@ -958,35 +954,80 @@ public sealed class MxAccessCommandExecutor : IStaCommandExecutor
             return CreateInvalidRequestReply(command, "AcknowledgeAlarmByName.alarm_name is required.");
         }
 
+        // See ExecuteAcknowledgeAlarm: operator_password never leaves AlarmAckOperator.
         try
         {
-            int rc = alarmCommandHandler.AcknowledgeByName(
+            AlarmAckResult result = alarmCommandHandler.AcknowledgeByName(
                 payload.AlarmName,
                 payload.ProviderName,
                 payload.GroupName,
                 payload.Comment,
-                payload.OperatorUser,
-                payload.OperatorNode,
-                payload.OperatorDomain,
-                payload.OperatorFullName);
-            MxCommandReply reply = CreateOkReply(command);
-            reply.Hresult = rc;
-            reply.AcknowledgeAlarm = new AcknowledgeAlarmReplyPayload
-            {
-                NativeStatus = rc,
-            };
-            if (rc != 0)
-            {
-                reply.DiagnosticMessage = $"AVEVA AlarmAckByName returned non-zero status {rc}.";
-            }
-            return reply;
+                new AlarmAckOperator
+                {
+                    UserName = payload.OperatorUser,
+                    Domain = payload.OperatorDomain,
+                    Password = payload.OperatorPassword,
+                });
+            return CreateAcknowledgeReply(command, result);
         }
         catch (Exception ex)
         {
-            return CreateAlarmFailureReply(command, ex);
+            return CreateAcknowledgeFailureReply(command, ex);
         }
     }
 
+    private static MxCommandReply CreateAcknowledgeReply(StaCommand command, AlarmAckResult result)
+    {
+        MxCommandReply reply = CreateOkReply(command);
+        reply.Hresult = result.NativeStatus;
+        reply.AcknowledgeAlarm = new AcknowledgeAlarmReplyPayload { NativeStatus = result.NativeStatus };
+        reply.Statuses.Add(result.Statuses);
+        reply.DiagnosticMessage = result.Diagnostic;
+        switch (result.Outcome)
+        {
+            case AlarmAckOutcome.AlarmNotFound:
+            case AlarmAckOutcome.NotAckable:
+                reply.ProtocolStatus = new ProtocolStatus { Code = ProtocolStatusCode.InvalidRequest, Message = result.Diagnostic };
+                break;
+            case AlarmAckOutcome.AuthenticationFailed:
+            case AlarmAckOutcome.WriteRejected:
+                reply.ProtocolStatus = new ProtocolStatus { Code = ProtocolStatusCode.MxaccessFailure, Message = result.Diagnostic };
+                break;
+        }
+
+        return reply;
+    }
+
+    /// <summary>
+    ///     Maps an exception escaping an acknowledgement (e.g. the ack writer's
+    ///     MXAccess Register failing, or no active subscription) to an
+    ///     <see cref="ProtocolStatusCode.MxaccessFailure"/> reply. Only the
+    ///     exception type and HRESULT are reported: exception text on this path
+    ///     is not under our control and must not be able to echo operator input.
+    /// </summary>
+    private static MxCommandReply CreateAcknowledgeFailureReply(StaCommand command, Exception exception)
+    {
+        string diagnostic = string.Format(
+            CultureInfo.InvariantCulture,
+            "Alarm acknowledgement failed: {0} (HRESULT 0x{1:X8}).",
+            exception.GetType().FullName,
+            exception.HResult);
+        return new MxCommandReply
+        {
+            SessionId = command.SessionId,
+            CorrelationId = command.CorrelationId,
+            Kind = command.Kind,
+            Hresult = exception.HResult,
+            ProtocolStatus = new ProtocolStatus
+            {
+                Code = ProtocolStatusCode.MxaccessFailure,
+                Message = diagnostic,
+            },
+            DiagnosticMessage = diagnostic,
+            AcknowledgeAlarm = new AcknowledgeAlarmReplyPayload { NativeStatus = exception.HResult },
+        };
+    }
+
     private MxCommandReply ExecuteQueryActiveAlarms(StaCommand command)
     {
         if (command.Command.PayloadCase != MxCommand.PayloadOneofCase.QueryActiveAlarmsCommand)

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/MxAlarmSnapshot.cs

@@ -39,6 +39,18 @@ public sealed class MxAlarmSnapshotRecord
     public string OperatorName { get; set; } = string.Empty;
     /// <summary>Gets or sets the alarm comment.</summary>
     public string AlarmComment { get; set; } = string.Empty;
+
+    /// <summary>Gets or sets the acknowledgement comment (wnwrap <c>ACK_COMMENT</c>).</summary>
+    public string AckComment { get; set; } = string.Empty;
+
+    /// <summary>Gets or sets the acknowledging operator's name (wnwrap <c>ACK_OPERATOR_NAME</c>).</summary>
+    public string AckOperatorName { get; set; } = string.Empty;
+
+    /// <summary>Gets or sets the acknowledging operator's domain (wnwrap <c>ACK_DOMAIN_NAME</c>).</summary>
+    public string AckOperatorDomain { get; set; } = string.Empty;
+
+    /// <summary>Gets or sets the acknowledging node, i.e. the MXAccess client name (wnwrap <c>ACK_OPERATOR_NODE</c>).</summary>
+    public string AckOperatorNode { get; set; } = string.Empty;
     /// <summary>
     ///     Gets or sets a value indicating whether this record was synthesized
     ///     by the subtag-provider fallback rather than emitted by the native

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/SubtagAlarmConsumer.cs

@@ -27,9 +27,11 @@ namespace ZB.MOM.WW.MxGateway.Worker.MxAccess;
 ///     <para>
 ///         The subtag path is event-driven, so <see cref="PollOnce"/> is a
 ///         no-op — value changes arrive through the source's advise stream
-///         rather than an explicit poll. Acknowledgment in subtag mode writes
-///         the comment to the target's writable ack-comment subtag rather than
-///         calling a native <c>AlarmAckByGUID</c> / <c>AlarmAckByName</c>.
+///         rather than an explicit poll. Acknowledgment in subtag mode resolves
+///         to the target's writable ack-comment subtag
+///         (<see cref="ResolveAckTarget"/>); <see cref="AlarmAckWriter"/>
+///         performs the operator-authenticated write on its own MXAccess
+///         server, so this consumer neither advises nor writes that subtag.
 ///     </para>
 /// </remarks>
 public sealed class SubtagAlarmConsumer : IMxAccessAlarmConsumer
@@ -49,7 +51,7 @@ public sealed class SubtagAlarmConsumer : IMxAccessAlarmConsumer
     ///     Initializes the consumer over a subtag source and a watch list of
     ///     alarm targets.
     /// </summary>
-    /// <param name="source">The subtag value source to advise and write through.</param>
+    /// <param name="source">The subtag value source to advise.</param>
     /// <param name="watchList">The alarm subtag targets to observe.</param>
     /// <exception cref="ArgumentNullException">
     ///     Thrown when <paramref name="source"/> or <paramref name="watchList"/>
@@ -91,7 +93,6 @@ public sealed class SubtagAlarmConsumer : IMxAccessAlarmConsumer
             AddIfNotEmpty(addresses, target.ActiveSubtag);
             AddIfNotEmpty(addresses, target.AckedSubtag);
             AddIfNotEmpty(addresses, target.PrioritySubtag);
-            AddIfNotEmpty(addresses, target.AckCommentSubtag);
         }
 
         source.Advise(addresses);
@@ -104,13 +105,7 @@ public sealed class SubtagAlarmConsumer : IMxAccessAlarmConsumer
     }
 
     /// <inheritdoc />
-    public int AcknowledgeByGuid(
-        Guid alarmGuid,
-        string ackComment,
-        string ackOperatorName,
-        string ackOperatorNode,
-        string ackOperatorDomain,
-        string ackOperatorFullName)
+    public AlarmAckTarget ResolveAckTarget(Guid alarmGuid)
     {
         if (disposed)
         {
@@ -120,22 +115,14 @@ public sealed class SubtagAlarmConsumer : IMxAccessAlarmConsumer
         if (!referencesBySyntheticGuid.TryGetValue(alarmGuid, out string reference) ||
             !targetsByReference.TryGetValue(reference, out AlarmSubtagTarget target))
         {
-            return -1;
+            return AlarmAckTarget.NotFound($"Alarm {alarmGuid} is not on the subtag watch list.");
         }
 
-        return WriteAckComment(target, ackComment);
+        return ToAckTarget(target);
     }
 
     /// <inheritdoc />
-    public int AcknowledgeByName(
-        string alarmName,
-        string providerName,
-        string groupName,
-        string ackComment,
-        string ackOperatorName,
-        string ackOperatorNode,
-        string ackOperatorDomain,
-        string ackOperatorFullName)
+    public AlarmAckTarget ResolveAckTargetByName(string alarmName, string providerName, string groupName)
     {
         if (disposed)
         {
@@ -143,12 +130,9 @@ public sealed class SubtagAlarmConsumer : IMxAccessAlarmConsumer
         }
 
         AlarmSubtagTarget? target = ResolveTargetByName(alarmName, providerName, groupName);
-        if (target is null)
-        {
-            return -1;
-        }
-
-        return WriteAckComment(target, ackComment);
+        return target is null
+            ? AlarmAckTarget.NotFound($"Alarm '{providerName}!{groupName}.{alarmName}' is not on the subtag watch list.")
+            : ToAckTarget(target);
     }
 
     /// <inheritdoc />
@@ -260,16 +244,12 @@ public sealed class SubtagAlarmConsumer : IMxAccessAlarmConsumer
         return target;
     }
 
-    private int WriteAckComment(AlarmSubtagTarget target, string ackComment)
+    private static AlarmAckTarget ToAckTarget(AlarmSubtagTarget target)
     {
-        string ackCommentSubtag = target.AckCommentSubtag ?? string.Empty;
-        if (string.IsNullOrEmpty(ackCommentSubtag))
-        {
-            return -1;
-        }
-
-        source.Write(ackCommentSubtag, ackComment);
-        return 0;
+        string ackItem = target.AckCommentSubtag ?? string.Empty;
+        return ackItem.Length == 0
+            ? AlarmAckTarget.NotAckable($"Alarm '{target.AlarmFullReference}' has no ack-comment subtag configured.")
+            : AlarmAckTarget.For(ackItem);
     }
 
     private static void AddIfNotEmpty(List<string> addresses, string? address)

src/ZB.MOM.WW.MxGateway.Worker/MxAccess/WnWrapAlarmConsumer.cs

@@ -34,7 +34,7 @@ namespace ZB.MOM.WW.MxGateway.Worker.MxAccess;
 ///         and operated from an STA thread; the worker's
 ///         <see cref="MxAccessStaSession"/> runs an STA pump that hosts it.
 ///         The consumer owns <em>no</em> internal timer: every COM call
-///         (<c>Subscribe</c>, <c>PollOnce</c>, <c>AcknowledgeBy*</c>) must
+///         (<c>Subscribe</c>, <c>PollOnce</c>) must
 ///         be invoked on the STA that created the consumer. Polling cadence
 ///         is driven externally by the worker's STA via
 ///         <c>StaRuntime.InvokeAsync(() =&gt; consumer.PollOnce())</c>, which
@@ -43,6 +43,15 @@ namespace ZB.MOM.WW.MxGateway.Worker.MxAccess;
 ///         off the owning STA and can deadlock on cross-apartment marshaling
 ///         when the STA is not pumping messages, so no such timer exists.
 ///     </para>
+///     <para>
+///         <strong>Acknowledgement.</strong> This consumer only receives
+///         alarms. The wnwrap <c>AlarmAckBy*</c> calls were accepted and then
+///         inert on the dev rig (see <c>docs/AlarmProbeFindings.md</c>), so
+///         acknowledgement no longer goes through wnwrap: the consumer resolves
+///         a Galaxy alarm to its <c>&lt;tag&gt;.AckMsg</c> item
+///         (<see cref="ResolveAckTarget"/>) and <see cref="AlarmAckWriter"/>
+///         writes that item over MXAccess as the authenticated operator.
+///     </para>
 /// </remarks>
 public sealed class WnWrapAlarmConsumer : IMxAccessAlarmConsumer
 {
@@ -50,6 +59,7 @@ public sealed class WnWrapAlarmConsumer : IMxAccessAlarmConsumer
     private const string DefaultApplicationName = "OtOpcUa.ZB.MOM.WW.MxGateway.Worker";
     private const string DefaultVersion = "1.0";
     private const int DefaultMaxAlarmsPerFetch = 1024;
+    private const string GalaxyProviderName = "Galaxy";
 
     /// <summary>
     ///     Floor on the resolved per-fetch cap. Mirrors the gateway-side
@@ -93,7 +103,6 @@ public sealed class WnWrapAlarmConsumer : IMxAccessAlarmConsumer
     private long truncatedFetchCount;
     private bool lastSnapshotTruncated;
     private wwAlarmConsumerClass? client;
-    private wwAlarmConsumerClass? ackClient;
     private bool subscribed;
     private bool disposed;
 
@@ -200,7 +209,7 @@ public sealed class WnWrapAlarmConsumer : IMxAccessAlarmConsumer
             // WIN-911-style code uses against the same wnwrap library.
             // Note rc=0 means the call was
             // accepted, not that an acknowledgement was applied — see
-            // AcknowledgeByName below and docs/AlarmProbeFindings.md.
+            // docs/AlarmProbeFindings.md. Acks now go through AlarmAckWriter.
             int init = com.IwwAlarmConsumer_InitializeConsumer(DefaultApplicationName);
             if (init != 0)
             {
@@ -241,10 +250,7 @@ public sealed class WnWrapAlarmConsumer : IMxAccessAlarmConsumer
             // SetXmlAlarmQuery is mangled (see docs/AlarmClientDiscovery.md),
             // calling it is necessary for subsequent GetXmlCurrentAlarms2
             // calls to succeed. Without it, GetXmlCurrentAlarms2 returns
-            // E_FAIL (HRESULT 0x80004005) on the first poll. SetXmlAlarmQuery
-            // also breaks AlarmAckByName on the same consumer (rejects with
-            // -55), so a separate ack-only consumer is provisioned below
-            // that gets only Initialize/Register/Subscribe (no SetXmlAlarmQuery).
+            // E_FAIL (HRESULT 0x80004005) on the first poll.
             //
             // The wnwrap interop signature is `void SetXmlAlarmQuery(string)`
             // — there is no integer return code to gate on like the other v1
@@ -268,116 +274,49 @@ public sealed class WnWrapAlarmConsumer : IMxAccessAlarmConsumer
                     ex);
             }
 
-            // Provision a parallel COM consumer for ack calls. It runs the
-            // v1 lifecycle (Initialize/Register/Subscribe) only; without
-            // SetXmlAlarmQuery, AlarmAckByName succeeds. State is read-only
-            // — we never poll this consumer.
-            ackClient = new wwAlarmConsumerClass();
-            int ackInit = ackClient.IwwAlarmConsumer_InitializeConsumer(DefaultApplicationName + ".ack");
-            int ackReg = ackClient.IwwAlarmConsumer_RegisterConsumer(
-                hWnd: 0,
-                szProductName: DefaultProductName,
-                szApplicationName: DefaultApplicationName + ".ack",
-                szVersion: DefaultVersion);
-            int ackSub = ackClient.IwwAlarmConsumer_Subscribe(
-                szSubscription: subscription,
-                wFromPri: 1,
-                wToPri: 999,
-                QueryType: eQueryType.qtSummary,
-                SortFlags: eSortFlags.sfReturnNewestFirst,
-                FilterMask: eAlarmFilterState.asAlarmActiveNow,
-                FilterSpecification: eAlarmFilterState.asAlarmActiveNow);
-            if (ackInit != 0 || ackReg != 0 || ackSub != 0)
-            {
-                throw new InvalidOperationException(
-                    $"Ack consumer setup returned non-zero status: " +
-                    $"Initialize={ackInit}, Register={ackReg}, Subscribe={ackSub}.");
-            }
-
             subscribed = true;
         }
     }
 
     /// <inheritdoc />
-    public int AcknowledgeByGuid(
-        Guid alarmGuid,
-        string ackComment,
-        string ackOperatorName,
-        string ackOperatorNode,
-        string ackOperatorDomain,
-        string ackOperatorFullName)
+    public AlarmAckTarget ResolveAckTarget(Guid alarmGuid)
     {
         if (disposed) throw new ObjectDisposedException(nameof(WnWrapAlarmConsumer));
+        MxAlarmSnapshotRecord? record;
+        lock (syncRoot)
+        {
+            latestSnapshot.TryGetValue(alarmGuid, out record);
+        }
 
-        wwAlarmConsumerClass com = client
-            ?? throw new ObjectDisposedException(nameof(WnWrapAlarmConsumer));
+        if (record is null)
+        {
+            return AlarmAckTarget.NotFound($"Alarm {alarmGuid} is not in the current alarm snapshot.");
+        }
 
-        // VBGUID is wnwrap's GUID interop struct (same memory layout as
-        // System.Guid: int32 + 2x int16 + 8x byte). Convert via a single
-        // unmanaged-blittable round-trip.
-        VBGUID vb = ToVbGuid(alarmGuid);
-        return com.AlarmAckByGUID(
-            AlmGUID: vb,
-            szComment: ackComment ?? string.Empty,
-            szOprName: ackOperatorName ?? string.Empty,
-            szNode: ackOperatorNode ?? string.Empty,
-            szDomainName: ackOperatorDomain ?? string.Empty,
-            szOprFullName: ackOperatorFullName ?? string.Empty);
+        return ResolveGalaxyAckTarget(record.ProviderName, record.TagName);
     }
 
     /// <inheritdoc />
-    public int AcknowledgeByName(
-        string alarmName,
-        string providerName,
-        string groupName,
-        string ackComment,
-        string ackOperatorName,
-        string ackOperatorNode,
-        string ackOperatorDomain,
-        string ackOperatorFullName)
+    public AlarmAckTarget ResolveAckTargetByName(string alarmName, string providerName, string groupName)
     {
         if (disposed) throw new ObjectDisposedException(nameof(WnWrapAlarmConsumer));
+        return ResolveGalaxyAckTarget(providerName, alarmName);
+    }
 
-        // Use the parallel ack-only consumer (no SetXmlAlarmQuery applied)
-        // — see docs/AlarmClientDiscovery.md "Option A — captured" for the
-        // empirical justification.
-        wwAlarmConsumerClass com = ackClient
-            ?? throw new InvalidOperationException(
-                "Cannot acknowledge: WnWrapAlarmConsumer was disposed or has not been subscribed yet.");
+    private static AlarmAckTarget ResolveGalaxyAckTarget(string? providerName, string? tagName)
+    {
+        if (!string.Equals(providerName, GalaxyProviderName, StringComparison.OrdinalIgnoreCase))
+        {
+            return AlarmAckTarget.NotAckable(
+                $"Alarm provider '{providerName}' is not a Galaxy provider; only Galaxy alarms can be acknowledged over MXAccess.");
+        }
 
-        // The original observation (live dev-rig 2026-05-01) was narrower than
-        // it read: the IwwAlarmConsumer2 8-arg AlarmAckByName returned -55
-        // "and looked like a stub" while the legacy 6-arg
-        // IwwAlarmConsumer.AlarmAckByName returned 0, which is how the 6-arg
-        // overload came to be the one called here. The 2026-08-18 probe
-        // corrected both halves. The -55 tracks the *consumer*, not the
-        // overload: both overloads return -55 against a
-        // SetXmlAlarmQuery-applied consumer and 0 against the ack-only one
-        // used above. And a zero return is NOT evidence the acknowledgement
-        // was applied — the probe acked a real, freshly raised alarm six ways
-        // and watched the snapshot stay UNACK_ALM, OPERATOR_NAME stay empty,
-        // and the alarm extension's own .Acked attribute stay False for 16 s
-        // after each call. On that rig the ack is accepted and then inert, so
-        // whether any wnwrap ack reaches the alarm-history path is
-        // unverified; see docs/AlarmProbeFindings.md and the 2026-08-18
-        // correction in docs/AlarmClientDiscovery.md. The 6-arg call site
-        // below therefore stays as-is for MXAccess parity — the choice is no
-        // longer justified by the rc, and rc semantics are per the probe.
-        //
-        // Operator-domain and operator-full-name fields are accepted by the
-        // proto contract for forward-compat but are not propagated to AVEVA
-        // today — wrapped in the 6-arg call so domain/full-name go to the
-        // alarm-history operator-name field via the szOprName parameter.
-        // Suppress unused-warning explicitly:
-        _ = ackOperatorDomain;
-        _ = ackOperatorFullName;
-        return com.AlarmAckByName(
-            szAlarmName: alarmName ?? string.Empty,
-            szProviderName: providerName ?? string.Empty,
-            szGroupName: groupName ?? string.Empty,
-            szComment: ackComment ?? string.Empty,
-            szOprName: ackOperatorName ?? string.Empty,
-            szNode: ackOperatorNode ?? string.Empty);
+        if (string.IsNullOrWhiteSpace(tagName))
+        {
+            return AlarmAckTarget.NotFound("Alarm record has no tag name.");
+        }
+
+        return AlarmAckTarget.For(tagName + "." + AlarmAckWriter.AckCommentAttribute);
     }
 
     /// <inheritdoc />
@@ -792,6 +731,10 @@ public sealed class WnWrapAlarmConsumer : IMxAccessAlarmConsumer
             string? operatorNode = null;
             string? operatorName = null;
             string? alarmComment = null;
+            string? ackComment = null;
+            string? ackOperatorName = null;
+            string? ackOperatorDomain = null;
+            string? ackOperatorNode = null;
 
             foreach (XmlNode child in alarmNode.ChildNodes)
             {
@@ -816,6 +759,10 @@ public sealed class WnWrapAlarmConsumer : IMxAccessAlarmConsumer
                     case "OPERATOR_NODE": operatorNode ??= child.InnerText; break;
                     case "OPERATOR_NAME": operatorName ??= child.InnerText; break;
                     case "ALARM_COMMENT": alarmComment ??= child.InnerText; break;
+                    case "ACK_COMMENT": ackComment ??= child.InnerText; break;
+                    case "ACK_OPERATOR_NAME": ackOperatorName ??= child.InnerText; break;
+                    case "ACK_DOMAIN_NAME": ackOperatorDomain ??= child.InnerText; break;
+                    case "ACK_OPERATOR_NODE": ackOperatorNode ??= child.InnerText; break;
                 }
             }
 
@@ -843,6 +790,10 @@ public sealed class WnWrapAlarmConsumer : IMxAccessAlarmConsumer
                 OperatorNode = operatorNode ?? string.Empty,
                 OperatorName = operatorName ?? string.Empty,
                 AlarmComment = alarmComment ?? string.Empty,
+                AckComment = ackComment ?? string.Empty,
+                AckOperatorName = ackOperatorName ?? string.Empty,
+                AckOperatorDomain = ackOperatorDomain ?? string.Empty,
+                AckOperatorNode = ackOperatorNode ?? string.Empty,
             };
         }
         return records;
@@ -932,37 +883,18 @@ public sealed class WnWrapAlarmConsumer : IMxAccessAlarmConsumer
         return sb.ToString();
     }
 
-    private static VBGUID ToVbGuid(Guid g)
-    {
-        byte[] bytes = g.ToByteArray();
-        // Guid byte layout: int32-LE + int16-LE + int16-LE + 8 bytes (Data4).
-        VBGUID vb = new VBGUID
-        {
-            Data1 = BitConverter.ToInt32(bytes, 0),
-            Data2 = BitConverter.ToInt16(bytes, 4),
-            Data3 = BitConverter.ToInt16(bytes, 6),
-            Data4 = new byte[8],
-        };
-        Array.Copy(bytes, 8, vb.Data4, 0, 8);
-        return vb;
-    }
-
     /// <inheritdoc />
     public void Dispose()
     {
         wwAlarmConsumerClass? clientToDispose;
-        wwAlarmConsumerClass? ackClientToDispose;
         lock (syncRoot)
         {
             if (disposed) return;
             disposed = true;
             clientToDispose = client;
             client = null;
-            ackClientToDispose = ackClient;
-            ackClient = null;
         }
         ReleaseConsumerCom(clientToDispose);
-        ReleaseConsumerCom(ackClientToDispose);
     }
 
     private static void ReleaseConsumerCom(wwAlarmConsumerClass? consumer)