Phase 1 Streams B–E scaffold + Phase 2 Streams A–C scaffold — 8 new projects with ~70 new tests, all green alongside the 494 v1 IntegrationTests baseline (parity preserved: no v1 tests broken; legacy OtOpcUa.Host untouched). Phase 1 finish: Configuration project (16 entities + 10 enums + DbContext + DesignTimeDbContextFactory + InitialSchema/StoredProcedures/AuthorizationGrants migrations — 8 procs including sp_PublishGeneration with MERGE on ExternalIdReservation per decision #124, sp_RollbackToGeneration cloning rows into a new published generation, sp_ValidateDraft with cross-cluster-namespace + EquipmentUuid-immutability + ZTag/SAPID reservation pre-flight, sp_ComputeGenerationDiff with CHECKSUM-based row signature — plus OtOpcUaNode/OtOpcUaAdmin SQL roles with EXECUTE grants scoped to per-principal-class proc sets and DENY UPDATE/DELETE/INSERT/SELECT on dbo schema); managed DraftValidator covering UNS segment regex, path length, EquipmentUuid immutability across generations, same-cluster namespace binding (decision #122), reservation pre-flight, EquipmentId derivation (decision #125), driver↔namespace compatibility — returning every failing rule in one pass; LiteDB local cache with round-trip + ring pruning + corruption-fast-fail; GenerationApplier with per-entity Added/Removed/Modified diff and dependency-ordered callbacks (namespace → driver → device → equipment → poll-group → tag, Removed before Added); Core project with GenericDriverNodeManager (scaffold for the Phase 2 Galaxy port) and DriverHost lifecycle registry; Server project using Microsoft.Extensions.Hosting BackgroundService replacing TopShelf, with NodeBootstrap that falls back to LiteDB cache when the central DB is unreachable (decision #79); Admin project scaffolded as Blazor Server with Bootstrap 5 sidebar layout, cookie auth, three admin roles (ConfigViewer/ConfigEditor/FleetAdmin), Cluster + Generation services fronting the stored procs. Phase 2 scaffold: Driver.Galaxy.Shared (netstandard2.0) with full MessagePack IPC contract surface — Hello version negotiation, Open/CloseSession, Heartbeat, DiscoverHierarchy + GalaxyObjectInfo/GalaxyAttributeInfo, Read/WriteValues, Subscribe/Unsubscribe/OnDataChange, AlarmSubscribe/Event/Ack, HistoryRead, HostConnectivityStatus, Recycle — plus length-prefixed framing (decision #28) with a 16 MiB cap and thread-safe FrameWriter/FrameReader; Driver.Galaxy.Host (net48) implementing the Tier C cross-cutting protections from driver-stability.md — strict PipeAcl (allow configured server SID only, explicit deny on LocalSystem + Administrators), PipeServer with caller-SID verification via pipe.RunAsClient + WindowsIdentity.GetCurrent and per-process shared-secret Hello, Galaxy-specific MemoryWatchdog (warn at max(1.5×baseline, +200 MB), soft-recycle at max(2×baseline, +200 MB), hard ceiling 1.5 GB, slope ≥5 MB/min over 30-min rolling window), RecyclePolicy (1 soft recycle per hour cap + 03:00 local daily scheduled), PostMortemMmf (1000-entry ring buffer in %ProgramData%\OtOpcUa\driver-postmortem\galaxy.mmf, survives hard crash, readable cross-process), MxAccessHandle : SafeHandle (ReleaseHandle loops Marshal.ReleaseComObject until refcount=0 then calls optional unregister callback), StaPump with responsiveness probe (BlockingCollection dispatcher for Phase 1 — real Win32 GetMessage/DispatchMessage pump slots in with the same semantics when the Galaxy code lift happens), IsExternalInit shim for init setters on .NET 4.8; Driver.Galaxy.Proxy (net10) implementing IDriver + ITagDiscovery forwarding over the IPC channel with MX data-type and security-classification mapping, plus Supervisor pieces — Backoff (5s → 15s → 60s capped, reset-on-stable-run), CircuitBreaker (3 crashes per 5 min opens; 1h → 4h → manual cooldown escalation; sticky alert doesn't auto-clear), HeartbeatMonitor (2s cadence, 3 consecutive misses = host dead per driver-stability.md). Infrastructure: docker SQL Server remapped to host port 14330 to coexist with the native MSSQL14 Galaxy ZB DB instance on 1433; NuGetAuditSuppress applied per-project for two System.Security.Cryptography.Xml advisories that only reach via EF Core Design with PrivateAssets=all (fix ships in 11.0.0-preview); .slnx gains 14 project registrations. Deferred with explicit TODOs in docs/v2/implementation/phase-2-partial-exit-evidence.md: Phase 1 Stream E Admin UI pages (Generations listing + draft-diff-publish, Equipment CRUD with OPC 40010 fields, UNS Areas/Lines tabs, ACLs + permission simulator, Generic JSON config editor, SignalR real-time, Release-Reservation + Merge-Equipment workflows, LDAP login page, AppServer smoke test per decision #142), Phase 2 Stream D (Galaxy MXAccess code lift out of legacy OtOpcUa.Host, dual-service installer, appsettings → DriverConfig migration script, legacy Host deletion — blocked by parity), Phase 2 Stream E (v1 IntegrationTests against v2 topology, Client.CLI walkthrough diff, four 2026-04-13 stability findings regression tests, adversarial review — requires live MXAccess runtime).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/ZB.MOM.WW.OtOpcUa.Configuration/Enums/CredentialKind.cs

@@ -0,0 +1,10 @@
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+
+/// <summary>Credential kind for <see cref="Entities.ClusterNodeCredential"/>. Per decision #83.</summary>
+public enum CredentialKind
+{
+    SqlLogin,
+    ClientCertThumbprint,
+    ADPrincipal,
+    gMSA,
+}

src/ZB.MOM.WW.OtOpcUa.Configuration/Enums/GenerationStatus.cs

@@ -0,0 +1,10 @@
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+
+/// <summary>Generation lifecycle state. Draft → Published → Superseded | RolledBack.</summary>
+public enum GenerationStatus
+{
+    Draft,
+    Published,
+    Superseded,
+    RolledBack,
+}

src/ZB.MOM.WW.OtOpcUa.Configuration/Enums/NamespaceKind.cs

@@ -0,0 +1,25 @@
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+
+/// <summary>OPC UA namespace kind per decision #107. One of each kind per cluster per generation.</summary>
+public enum NamespaceKind
+{
+    /// <summary>
+    ///     Equipment namespace — raw signals from native-protocol drivers (Modbus, AB CIP, AB Legacy,
+    ///     S7, TwinCAT, FOCAS, and OpcUaClient when gatewaying raw equipment). UNS 5-level hierarchy
+    ///     applies.
+    /// </summary>
+    Equipment,
+
+    /// <summary>
+    ///     System Platform namespace — Galaxy / MXAccess processed data (v1 LmxOpcUa folded in).
+    ///     UNS rules do NOT apply; Galaxy hierarchy preserved as v1 expressed it.
+    /// </summary>
+    SystemPlatform,
+
+    /// <summary>
+    ///     Reserved for future replay driver per handoff §"Digital Twin Touchpoints" — not populated
+    ///     in v2.0 but enum value reserved so the schema does not need to change when the replay
+    ///     driver lands.
+    /// </summary>
+    Simulated,
+}

src/ZB.MOM.WW.OtOpcUa.Configuration/Enums/NodeAclScopeKind.cs

@@ -0,0 +1,12 @@
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+
+/// <summary>ACL scope level. Per <c>acl-design.md</c> §"Scope Hierarchy".</summary>
+public enum NodeAclScopeKind
+{
+    Cluster,
+    Namespace,
+    UnsArea,
+    UnsLine,
+    Equipment,
+    Tag,
+}

src/ZB.MOM.WW.OtOpcUa.Configuration/Enums/NodeApplyStatus.cs

@@ -0,0 +1,10 @@
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+
+/// <summary>Status tracked per node in <see cref="Entities.ClusterNodeGenerationState"/>.</summary>
+public enum NodeApplyStatus
+{
+    Applied,
+    RolledBack,
+    Failed,
+    InProgress,
+}

src/ZB.MOM.WW.OtOpcUa.Configuration/Enums/NodePermissions.cs

@@ -0,0 +1,37 @@
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+
+/// <summary>
+///     OPC UA client data-path permissions per <c>acl-design.md</c>.
+///     Stored as <c>int</c> bitmask in <see cref="Entities.NodeAcl.PermissionFlags"/>.
+/// </summary>
+[Flags]
+public enum NodePermissions : uint
+{
+    None = 0,
+
+    // Read-side
+    Browse = 1 << 0,
+    Read = 1 << 1,
+    Subscribe = 1 << 2,
+    HistoryRead = 1 << 3,
+
+    // Write-side (mirrors v1 SecurityClassification model)
+    WriteOperate = 1 << 4,
+    WriteTune = 1 << 5,
+    WriteConfigure = 1 << 6,
+
+    // Alarm-side
+    AlarmRead = 1 << 7,
+    AlarmAcknowledge = 1 << 8,
+    AlarmConfirm = 1 << 9,
+    AlarmShelve = 1 << 10,
+
+    // OPC UA Part 4 §5.11
+    MethodCall = 1 << 11,
+
+    // Bundles (one-click grants in Admin UI)
+    ReadOnly = Browse | Read | Subscribe | HistoryRead | AlarmRead,
+    Operator = ReadOnly | WriteOperate | AlarmAcknowledge | AlarmConfirm,
+    Engineer = Operator | WriteTune | AlarmShelve,
+    Admin = Engineer | WriteConfigure | MethodCall,
+}

src/ZB.MOM.WW.OtOpcUa.Configuration/Enums/RedundancyMode.cs

@@ -0,0 +1,17 @@
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+
+/// <summary>
+///     Cluster redundancy mode per OPC UA Part 5 §6.5. Persisted as string in
+///     <c>ServerCluster.RedundancyMode</c> with a CHECK constraint coupling to <c>NodeCount</c>.
+/// </summary>
+public enum RedundancyMode
+{
+    /// <summary>Single-node cluster. Required when <c>NodeCount = 1</c>.</summary>
+    None,
+
+    /// <summary>Warm redundancy (non-transparent). Two-node cluster.</summary>
+    Warm,
+
+    /// <summary>Hot redundancy (non-transparent). Two-node cluster.</summary>
+    Hot,
+}

src/ZB.MOM.WW.OtOpcUa.Configuration/Enums/RedundancyRole.cs

@@ -0,0 +1,9 @@
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+
+/// <summary>Per-node redundancy role within a cluster. Per decision #84.</summary>
+public enum RedundancyRole
+{
+    Primary,
+    Secondary,
+    Standalone,
+}

src/ZB.MOM.WW.OtOpcUa.Configuration/Enums/ReservationKind.cs

@@ -0,0 +1,8 @@
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+
+/// <summary>External-ID reservation kind. Per decision #124.</summary>
+public enum ReservationKind
+{
+    ZTag,
+    SAPID,
+}

src/ZB.MOM.WW.OtOpcUa.Configuration/Enums/TagAccessLevel.cs

@@ -0,0 +1,8 @@
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+
+/// <summary>Tag-level OPC UA access level baseline. Further narrowed per-user by NodeAcl grants.</summary>
+public enum TagAccessLevel
+{
+    Read,
+    ReadWrite,
+}