Merge commit '5135a036' into remed/lane-S7

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Cli/Commands/ProbeCommand.cs

@@ -28,6 +28,7 @@ public sealed class ProbeCommand : FocasCommandBase
     {
         ConfigureLogging();
         ValidateOptions();
+        ValidateDataType(Address, DataType);
         var ct = console.RegisterCancellationHandler();
 
         var probeTag = new FocasTagDefinition(

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Cli/Commands/ReadCommand.cs

@@ -19,7 +19,7 @@ public sealed class ReadCommand : FocasCommandBase
 
     /// <summary>Gets the data type to interpret the address as.</summary>
     [CommandOption("type", 't', Description =
-        "Bit / Byte / Int16 / Int32 / Float32 / Float64 / String (default Int16).")]
+        "Bit / Byte / Int16 / Int32 / Float32 / Float64 / String (default Int16). String only on FIXED: paths.")]
     public FocasDataType DataType { get; init; } = FocasDataType.Int16;
 
     /// <inheritdoc />
@@ -28,6 +28,7 @@ public sealed class ReadCommand : FocasCommandBase
         ConfigureLogging();
         // Validate numeric option ranges before any driver work.
         ValidateOptions();
+        ValidateDataType(Address, DataType);
         var ct = console.RegisterCancellationHandler();
 
         var tagName = SynthesiseTagName(Address, DataType);

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Cli/Commands/SubscribeCommand.cs

@@ -18,7 +18,7 @@ public sealed class SubscribeCommand : FocasCommandBase
 
     /// <summary>Gets the data type of the address.</summary>
     [CommandOption("type", 't', Description =
-        "Bit / Byte / Int16 / Int32 / Float32 / Float64 / String (default Int16).")]
+        "Bit / Byte / Int16 / Int32 / Float32 / Float64 / String (default Int16). String only on FIXED: paths.")]
     public FocasDataType DataType { get; init; } = FocasDataType.Int16;
 
     /// <summary>Gets the polling interval in milliseconds.</summary>
@@ -33,6 +33,7 @@ public sealed class SubscribeCommand : FocasCommandBase
         // --interval-ms) before any driver work so a zero/negative interval surfaces as a
         // clean CommandException rather than a tight-spinning poll loop.
         ValidateOptions(IntervalMs);
+        ValidateDataType(Address, DataType);
         var ct = console.RegisterCancellationHandler();
 
         var tagName = ReadCommand.SynthesiseTagName(Address, DataType);

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Cli/Commands/WriteCommand.cs

@@ -20,7 +20,7 @@ public sealed class WriteCommand : FocasCommandBase
 
     /// <summary>Gets the data type of the value to write.</summary>
     [CommandOption("type", 't', Description =
-        "Bit / Byte / Int16 / Int32 / Float32 / Float64 / String (default Int16).")]
+        "Bit / Byte / Int16 / Int32 / Float32 / Float64 / String (default Int16). String only on FIXED: paths.")]
     public FocasDataType DataType { get; init; } = FocasDataType.Int16;
 
     /// <summary>Gets the value to write.</summary>
@@ -37,6 +37,7 @@ public sealed class WriteCommand : FocasCommandBase
         // port/timeout surfaces as a clean CommandException rather than an opaque
         // downstream exception.
         ValidateOptions();
+        ValidateDataType(Address, DataType);
         var ct = console.RegisterCancellationHandler();
 
         var tagName = ReadCommand.SynthesiseTagName(Address, DataType);

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Cli/FocasCommandBase.cs

@@ -89,4 +89,17 @@ public abstract class FocasCommandBase : DriverCommandBase
             throw new CliFx.Exceptions.CommandException(
                 $"--interval-ms must be positive (got {iv}).");
     }
+
+    /// <summary>
+    ///     Refuses an <c>--address</c> / <c>--type</c> pair the driver cannot serve (String on a PMC / PARAM / MACRO
+    ///     address — the driver skips such a tag, so the command would only ever print BadNodeIdUnknown). Same
+    ///     rule as the driver and the AdminUI editor: <see cref="FocasTagDefinitionFactory.DescribeDataTypeMismatch"/>.
+    /// </summary>
+    /// <param name="address">The FOCAS address.</param>
+    /// <param name="type">The data type.</param>
+    protected static void ValidateDataType(string address, FocasDataType type)
+    {
+        if (FocasTagDefinitionFactory.DescribeDataTypeMismatch(type, address) is { } error)
+            throw new CliFx.Exceptions.CommandException(error);
+    }
 }

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli/Commands/ReadCommand.cs

@@ -25,6 +25,11 @@ public sealed class ReadCommand : TwinCATTagCommandBase
         "String / WString / Time / Date / DateTime / TimeOfDay (default DInt).")]
     public TwinCATDataType DataType { get; init; } = TwinCATDataType.DInt;
 
+    /// <summary>Gets the element count for an array read; null reads a scalar.</summary>
+    [CommandOption("array-length", Description =
+        "Read the symbol as a 1-D array of this many --type elements (the leading sub-range when shorter).")]
+    public int? ArrayLength { get; init; }
+
     /// <inheritdoc />
     public override async ValueTask ExecuteAsync(IConsole console)
     {
@@ -38,7 +43,8 @@ public sealed class ReadCommand : TwinCATTagCommandBase
             DeviceHostAddress: Gateway,
             SymbolPath: SymbolPath,
             DataType: DataType,
-            Writable: false);
+            Writable: false,
+            ArrayLength: ArrayLength);
         var options = BuildOptions([tag]);
 
         await using var driver = new TwinCATDriver(options, DriverInstanceId);
@@ -47,6 +53,9 @@ public sealed class ReadCommand : TwinCATTagCommandBase
             await driver.InitializeAsync("{}", ct);
             var snapshot = await driver.ReadAsync([tagName], ct);
             await console.Output.WriteLineAsync(SnapshotFormatter.Format(SymbolPath, snapshot[0]));
+            if (snapshot[0].Value is Array elements)
+                await console.Output.WriteLineAsync("Elements:    [" + string.Join(", ",
+                    elements.Cast<object?>().Select(e => Convert.ToString(e, System.Globalization.CultureInfo.InvariantCulture))) + "]");
         }
         finally
         {

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli/Commands/WriteCommand.cs

@@ -30,6 +30,16 @@ public sealed class WriteCommand : TwinCATTagCommandBase
         IsRequired = true)]
     public string Value { get; init; } = default!;
 
+    /// <summary>Gets the element count for an array write; null writes a scalar.</summary>
+    [CommandOption("array-length", Description =
+        "Write the symbol as a 1-D array of this many --type elements. --value then carries the elements " +
+        "separated by --separator (e.g. -v 1,2,3 --array-length 3); the count must match.")]
+    public int? ArrayLength { get; init; }
+
+    /// <summary>Gets the element separator for an array write.</summary>
+    [CommandOption("separator", Description = "Element separator for --array-length writes (default ',').")]
+    public string Separator { get; init; } = ",";
+
     /// <inheritdoc />
     public override async ValueTask ExecuteAsync(IConsole console)
     {
@@ -48,10 +58,13 @@ public sealed class WriteCommand : TwinCATTagCommandBase
             DeviceHostAddress: Gateway,
             SymbolPath: SymbolPath,
             DataType: DataType,
-            Writable: true);
+            Writable: true,
+            ArrayLength: ArrayLength);
         var options = BuildOptions([tag]);
 
-        var parsed = ParseValue(Value, DataType);
+        var parsed = ArrayLength is int count
+            ? ParseArrayValue(Value, DataType, count, Separator)
+            : ParseValue(Value, DataType);
 
         await using var driver = new TwinCATDriver(options, DriverInstanceId);
         try
@@ -113,6 +126,27 @@ public sealed class WriteCommand : TwinCATTagCommandBase
         }
     }
 
+    /// <summary>
+    ///     Parse an array <c>--value</c>: <paramref name="separator"/>-separated elements, each parsed by
+    ///     <see cref="ParseValue"/>. The element count must equal <paramref name="count"/> — the driver
+    ///     refuses a mismatch with BadOutOfRange, but the CLI says so before touching the PLC.
+    /// </summary>
+    /// <param name="raw">The raw separated element list.</param>
+    /// <param name="type">The element type.</param>
+    /// <param name="count">The expected element count (<c>--array-length</c>).</param>
+    /// <param name="separator">The element separator.</param>
+    /// <returns>The parsed elements.</returns>
+    internal static object[] ParseArrayValue(string raw, TwinCATDataType type, int count, string separator)
+    {
+        if (count < 1)
+            throw new CliFx.Exceptions.CommandException("--array-length must be >= 1.");
+        var parts = raw.Split(string.IsNullOrEmpty(separator) ? "," : separator);
+        if (parts.Length != count)
+            throw new CliFx.Exceptions.CommandException(
+                $"--value has {parts.Length} element(s) but --array-length is {count}.");
+        return [.. parts.Select(p => ParseValue(type is TwinCATDataType.String or TwinCATDataType.WString ? p : p.Trim(), type))];
+    }
+
     private static bool ParseBool(string raw) => raw.Trim().ToLowerInvariant() switch
     {
         "1" or "true" or "on" or "yes" => true,

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Contracts/AbCipDriverOptions.cs

@@ -117,6 +117,12 @@ public sealed class AbCipDriverOptions
     ///     device round trips (the whole point: a strictly sequential batch pays one full round
     ///     trip per tag); lowering it to <c>1</c> restores strictly sequential reads. Values below
     ///     <c>1</c> are clamped to <c>1</c> at the use site.
+    ///     <para>
+    ///     On the <see cref="AbCipTransport.Native"/> transport the effective window is at least 64: there the
+    ///     window caps how many services one Multiple Service Packet coalesces (the device's shared scheduler packs
+    ///     what is queued, bounded by the connection's request/reply byte budget), so a small value only multiplies
+    ///     round trips. A value above 64 is honoured; a value below it is raised.
+    ///     </para>
     /// </summary>
     public int MaxConcurrentReads { get; init; } = 8;
 

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipArrayCodec.cs

@@ -0,0 +1,80 @@
+using System.Buffers.Binary;
+using System.Collections;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Encodes a whole-array write (review 07 U10): <c>count</c> elements at the element type's wire width,
+///     little-endian, exactly the layout a Logix atomic array holds and the read path decodes. Shared by both
+///     runtimes so the bytes on the wire are transport-independent.
+/// </summary>
+/// <remarks>
+///     <para><b>Element values CONVERT, they are not exact-matched.</b> ScadaBridge (and any OPC UA client that
+///     round-trips what it read) writes CLR lists such as <c>int[]</c> to an INT array — the read path itself
+///     publishes INT/SINT elements as <c>int</c> — so each element goes through the same <see cref="Convert"/> the
+///     scalar path uses. A value that does not fit is an <see cref="OverflowException"/> (BadOutOfRange) and one that
+///     cannot convert a <see cref="FormatException"/> / <see cref="InvalidCastException"/> (BadTypeMismatch), all
+///     thrown before any byte is sent.</para>
+///     <para>BOOL arrays (bit-packed DWORDs — a byte-per-element encode would clobber neighbour bits), STRING arrays
+///     (structures) and structure arrays are not encodable here; the driver refuses them <c>BadNotSupported</c>
+///     before a runtime exists.</para>
+/// </remarks>
+internal static class AbCipArrayCodec
+{
+    /// <summary>Wire width of one element of an encodable array type, or <c>null</c> when the type is not encodable.</summary>
+    /// <param name="type">The element type.</param>
+    /// <returns>The element width in bytes, or <c>null</c>.</returns>
+    public static int? ElementWidth(AbCipDataType type) => type switch
+    {
+        AbCipDataType.SInt or AbCipDataType.USInt => 1,
+        AbCipDataType.Int or AbCipDataType.UInt => 2,
+        AbCipDataType.DInt or AbCipDataType.UDInt or AbCipDataType.Real or AbCipDataType.Dt => 4,
+        AbCipDataType.LInt or AbCipDataType.ULInt or AbCipDataType.LReal => 8,
+        _ => null,
+    };
+
+    /// <summary>
+    ///     The elements of an array write value, or <c>null</c> when the value is not a list (a scalar, a string, null).
+    ///     Any non-string <see cref="IEnumerable"/> is accepted — <c>int[]</c>, <c>short[]</c>, <c>List&lt;object&gt;</c> …
+    /// </summary>
+    /// <param name="value">The client's write value.</param>
+    /// <returns>The elements, or <c>null</c>.</returns>
+    public static object?[]? Elements(object? value) => value switch
+    {
+        null or string => null,
+        IEnumerable list => [.. list.Cast<object?>()],
+        _ => null,
+    };
+
+    /// <summary>Encodes <paramref name="values"/> as <paramref name="type"/> elements.</summary>
+    /// <param name="type">The element type (must have an <see cref="ElementWidth"/>).</param>
+    /// <param name="values">The element values; their count is the element count.</param>
+    /// <returns>The little-endian wire bytes, <c>values.Count × ElementWidth(type)</c> long.</returns>
+    /// <exception cref="NotSupportedException">The type is not encodable.</exception>
+    public static byte[] Encode(AbCipDataType type, IReadOnlyList<object?> values)
+    {
+        var width = ElementWidth(type)
+            ?? throw new NotSupportedException($"Array writes of {type} elements are not supported.");
+        var buffer = new byte[values.Count * width];
+        for (var i = 0; i < values.Count; i++)
+        {
+            var v = values[i];
+            var span = buffer.AsSpan(i * width, width);
+            switch (type)
+            {
+                case AbCipDataType.SInt: span[0] = unchecked((byte)Convert.ToSByte(v)); break;
+                case AbCipDataType.USInt: span[0] = Convert.ToByte(v); break;
+                case AbCipDataType.Int: BinaryPrimitives.WriteInt16LittleEndian(span, Convert.ToInt16(v)); break;
+                case AbCipDataType.UInt: BinaryPrimitives.WriteUInt16LittleEndian(span, Convert.ToUInt16(v)); break;
+                case AbCipDataType.DInt:
+                case AbCipDataType.Dt: BinaryPrimitives.WriteInt32LittleEndian(span, Convert.ToInt32(v)); break;
+                case AbCipDataType.UDInt: BinaryPrimitives.WriteUInt32LittleEndian(span, Convert.ToUInt32(v)); break;
+                case AbCipDataType.LInt: BinaryPrimitives.WriteInt64LittleEndian(span, Convert.ToInt64(v)); break;
+                case AbCipDataType.ULInt: BinaryPrimitives.WriteUInt64LittleEndian(span, Convert.ToUInt64(v)); break;
+                case AbCipDataType.Real: BinaryPrimitives.WriteSingleLittleEndian(span, Convert.ToSingle(v)); break;
+                case AbCipDataType.LReal: BinaryPrimitives.WriteDoubleLittleEndian(span, Convert.ToDouble(v)); break;
+            }
+        }
+        return buffer;
+    }
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipDriverProbe.cs

@@ -18,10 +18,11 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
 ///     non-CIP server) returns <c>Ok = false</c> with a "handshake failed" message instead of
 ///     a false-positive green tick.
 ///     <para>
-///     Status-code discrimination: <c>AbStatus.Ok</c> and <c>AbStatus.NotFound</c> mean the controller
-///     answered the CIP session (a non-existent probe tag name still proves CIP connectivity) and are
-///     treated as "reachable - Ok = true". Every other status (timeout, bad connection, bad reply,
-///     partial, abort, ...) is a transport or session failure: "handshake failed - Ok = false".
+///     Status-code discrimination: <c>AbStatus.Ok</c> and every device refusal (not found, out of bounds,
+///     not allowed, too large/small, type mismatch, unsupported) mean the controller answered the CIP session
+///     (a non-existent probe tag name still proves CIP connectivity) and are treated as "reachable - Ok = true".
+///     Every other status (timeout, bad connection, bad reply, partial, abort, ...) is a transport or session
+///     failure: "handshake failed - Ok = false".
 ///     </para>
 /// </summary>
 public sealed class AbCipDriverProbe : IDriverProbe
@@ -147,7 +148,7 @@ public sealed class AbCipDriverProbe : IDriverProbe
             {
                 var msg = statusCode == AbStatus.Ok
                     ? "CIP session OK"
-                    : "CIP session OK (controller reachable; probe tag not found)";
+                    : RefusedProbeMessage(statusCode);
                 return new(true, msg, sw.Elapsed);
             }
 
@@ -164,7 +165,7 @@ public sealed class AbCipDriverProbe : IDriverProbe
             if (IsReachableException(ex))
             {
                 sw.Stop();
-                return new(true, "CIP session OK (controller reachable; probe tag not found)", sw.Elapsed);
+                return new(true, RefusedProbeMessage(ex.Status), sw.Elapsed);
             }
 
             return new(false, $"Reachable at {host}:{port} but CIP handshake failed: {ex.Message}", null);
@@ -180,13 +181,20 @@ public sealed class AbCipDriverProbe : IDriverProbe
     }
 
     /// <summary>
-    ///     Returns <c>true</c> for transport statuses that indicate the CIP controller answered
-    ///     but the probe tag name was not found or did not match — sufficient to confirm CIP
-    ///     reachability. Returns <c>true</c> for <c>Ok</c> (tag was found).
+    ///     Returns <c>true</c> for transport statuses that indicate the CIP controller answered — <c>Ok</c>, or any
+    ///     device refusal (<see cref="AbCipRefusals.IsDeviceRefusal(AbStatus)"/>: not found, out of bounds, not
+    ///     allowed, too large/small, type mismatch, unsupported) — sufficient to confirm CIP reachability.
     /// </summary>
     /// <param name="s">The transport status to classify.</param>
     /// <returns><see langword="true"/> if the status confirms CIP reachability.</returns>
-    internal static bool IsReachableStatus(AbStatus s) => s is AbStatus.Ok or AbStatus.NotFound;
+    internal static bool IsReachableStatus(AbStatus s) => s == AbStatus.Ok || AbCipRefusals.IsDeviceRefusal(s);
+
+    /// <summary>The Test-Connect message for a controller that answered but refused the probe tag.</summary>
+    /// <param name="status">The refusal.</param>
+    /// <returns>The message.</returns>
+    private static string RefusedProbeMessage(AbStatus status) => status == AbStatus.NotFound
+        ? "CIP session OK (controller reachable; probe tag not found)"
+        : $"CIP session OK (controller reachable; probe tag refused: {status})";
 
     /// <summary>
     ///     Decides whether an <see cref="AbTransportException"/> is a "controller answered CIP but the
@@ -198,7 +206,8 @@ public sealed class AbCipDriverProbe : IDriverProbe
     internal static bool IsReachableException(AbTransportException ex)
     {
         ArgumentNullException.ThrowIfNull(ex);
-        return IsReachableStatus(ex.Status);
+        // A local refusal (the library / driver refused without any I/O) proves nothing about the controller.
+        return ex is not AbCipLocalRefusalException && IsReachableStatus(ex.Status);
     }
 
     private static (AbCipHostAddress? parsed, AbCipDeviceOptions? device) ExtractTarget(AbCipDriverOptions opts)

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipInitializationSupersededException.cs

@@ -0,0 +1,18 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Thrown by <see cref="AbCipDriver.InitializeAsync"/> when a shutdown, dispose or newer initialization retired the
+///     driver's tables while this initialization was building, so it published nothing. Deliberately NOT an
+///     <see cref="OperationCanceledException"/>: nobody cancelled this call, and a caller that treats cancellation as
+///     "my own token fired" must not mistake a superseded attempt for one. The superseding operation owns the driver's
+///     state; the caller (normally the runtime, which has already abandoned this attempt) can ignore the result.
+/// </summary>
+/// <remarks>
+///     Resilience accounting (#737 m2): not being an OCE, it passes the Initialize pipeline's breaker
+///     <c>ShouldHandle</c> (<c>DriverResiliencePipelineBuilder</c>) and, if its generation still matched, the actor's
+///     <c>RecordFault</c>. That is practically unreachable — <c>DriverInstanceActor</c> runs initialisation single-flight
+///     and drops generation-mismatched results — and a superseded attempt is at worst one counted failure. Recognising
+///     it there is a runtime-side (Lane A) change if it is ever wanted.
+/// </remarks>
+/// <param name="message">The detail.</param>
+public sealed class AbCipInitializationSupersededException(string message) : InvalidOperationException(message);

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipLocalRefusalException.cs

@@ -0,0 +1,15 @@
+using ZB.MOM.WW.OtOpcUa.Driver.Ab.Transport;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     A refusal raised LOCALLY — by the driver's own runtime or by libplctag (<c>ErrorNotImplemented</c>) — before or
+///     without any reply from the controller. It carries <see cref="AbStatus.Unsupported"/> (so it maps to
+///     <c>BadNotSupported</c>) but, unlike a device refusal, proves nothing about the device: it keeps the runtime and
+///     writes no health, does NOT advance <c>LastSuccessfulRead</c>, records nothing in the connect backoff, and is not
+///     "reachable" for the probe or Test Connect (review 07 / Gitea #737 I2).
+/// </summary>
+/// <param name="message">The refusal detail.</param>
+/// <param name="inner">The underlying exception, if any.</param>
+public sealed class AbCipLocalRefusalException(string message, Exception? inner = null)
+    : AbTransportException(AbStatus.Unsupported, message, inner);

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipRefusals.cs

@@ -0,0 +1,42 @@
+using ZB.MOM.WW.OtOpcUa.Driver.Ab.Transport;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     The ONE classification of a transport status into "the controller answered" vs "the wire failed", shared by
+///     the data path, the probe loop, the Test-Connect probe and the native runtime's initialisation.
+/// </summary>
+/// <remarks>
+///     A device refusal is deterministic: the session works and the controller said no to this one tag (a renamed
+///     tag, <c>Arr[999]</c>, a read-protected tag, a type the authored config does not match). It is per-tag Bad,
+///     keeps the tag runtime (evicting re-creates it — and, for a sole lease holder, re-Forward-Opens — on every poll),
+///     never writes <c>Degraded</c>, never opens the device-wide connect backoff, and warns once per tag. Everything
+///     else (timeout, bad connection, a reply that failed to parse, partial, abort, …) is a comms fault.
+///     <para>
+///     The native transport currently folds CIP general statuses 0x1C, 0x20 and 0xFF/0x2104 into
+///     <see cref="AbStatus.BadReply"/> (<c>AbStatusCodes.FromCip</c>, owned by <c>Driver.Ab.Transport</c>), which
+///     this classification cannot tell from a garbled reply; until the transport maps them explicitly they stay
+///     comms faults.
+///     </para>
+/// </remarks>
+internal static class AbCipRefusals
+{
+    /// <summary>True when <paramref name="status"/> proves the controller answered but refused this tag.</summary>
+    /// <param name="status">The transport status.</param>
+    /// <returns><see langword="true"/> for a deterministic device refusal.</returns>
+    public static bool IsDeviceRefusal(AbStatus status) => status is AbStatus.NotFound or AbStatus.OutOfBounds
+        or AbStatus.NotAllowed or AbStatus.TooLarge or AbStatus.TooSmall or AbStatus.TypeMismatch
+        or AbStatus.Unsupported;
+
+    /// <summary>True when <paramref name="status"/> (an <see cref="AbStatus"/> value) is a device refusal.</summary>
+    /// <param name="status">The runtime status word.</param>
+    /// <returns><see langword="true"/> for a deterministic device refusal.</returns>
+    public static bool IsDeviceRefusal(int status) => IsDeviceRefusal((AbStatus)status);
+
+    /// <summary>True when <paramref name="ex"/> is an <see cref="AbTransportException"/> carrying a device refusal.</summary>
+    /// <param name="ex">The exception.</param>
+    /// <returns><see langword="true"/> for a deterministic device refusal.</returns>
+    /// <remarks>An <see cref="AbCipLocalRefusalException"/> is never a device refusal: nothing reached the device.</remarks>
+    public static bool IsDeviceRefusal(Exception ex) =>
+        ex is AbTransportException ate and not AbCipLocalRefusalException && IsDeviceRefusal(ate.Status);
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipStatusMapper.cs

@@ -15,6 +15,7 @@ public static class AbCipStatusMapper
     public const uint GoodMoreData = 0x00A60000u;
     public const uint BadInternalError = 0x80020000u;
     public const uint BadNodeIdUnknown = 0x80340000u;
+    public const uint BadNotReadable = 0x803A0000u;
     public const uint BadNotWritable = 0x803B0000u;
     public const uint BadOutOfRange = 0x803C0000u;
     public const uint BadNotSupported = 0x803D0000u;
@@ -51,4 +52,14 @@ public static class AbCipStatusMapper
     /// <returns>The OPC UA status code.</returns>
     public static uint MapException(Exception ex) =>
         AbOpcUaStatusMap.MapException(ex);
+
+    /// <summary>
+    ///     Status for a READ the controller refused: as <see cref="MapStatus(AbStatus)"/>, except that a
+    ///     <see cref="AbStatus.NotAllowed"/> answer to a read is <see cref="BadNotReadable"/> (the shared table's
+    ///     <c>BadNotWritable</c> describes a refused write).
+    /// </summary>
+    /// <param name="status">The refusal status.</param>
+    /// <returns>The OPC UA status code.</returns>
+    public static uint MapReadStatus(AbStatus status) =>
+        status == AbStatus.NotAllowed ? BadNotReadable : MapStatus(status);
 }

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipUdtMemberLayout.cs

@@ -25,6 +25,30 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
 /// </remarks>
 public static class AbCipUdtMemberLayout
 {
+    /// <summary>Layouts already computed, keyed by the parent definition's member list (reference identity).</summary>
+    private static readonly System.Runtime.CompilerServices.ConditionalWeakTable<IReadOnlyList<AbCipStructureMember>, LayoutBox> Cache = new();
+
+    /// <summary>Holds a computed layout, including a "not groupable" (<c>null</c>) verdict.</summary>
+    private sealed class LayoutBox(IReadOnlyDictionary<string, int>? offsets)
+    {
+        public IReadOnlyDictionary<string, int>? Offsets { get; } = offsets;
+    }
+
+    /// <summary>
+    ///     <see cref="TryBuild"/>, computed once per member list (review 07 P11: the read planner rebuilt the layout —
+    ///     a dictionary allocation and an O(members) walk — for every member reference on every poll, O(members²) per
+    ///     parent per tick). A parent definition's member list is immutable for the life of the tag table that holds
+    ///     it, so caching by list identity is exact; a re-init builds new lists and the old entries are collected with
+    ///     them (<see cref="System.Runtime.CompilerServices.ConditionalWeakTable{TKey,TValue}"/>).
+    /// </summary>
+    /// <param name="members">The parent definition's declared members.</param>
+    /// <returns>The member offsets, or <c>null</c> when the members cannot be laid out by declaration.</returns>
+    public static IReadOnlyDictionary<string, int>? GetOrBuild(IReadOnlyList<AbCipStructureMember> members)
+    {
+        ArgumentNullException.ThrowIfNull(members);
+        return Cache.GetValue(members, m => new LayoutBox(TryBuild(m))).Offsets;
+    }
+
     /// <summary>
     ///     Try to compute member offsets for the supplied declared members. Returns <c>null</c>
     ///     if any member type is unsupported for declaration-only layout.

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipUdtReadPlanner.cs

@@ -67,7 +67,7 @@ public static class AbCipUdtReadPlanner
                 continue;
             }
 
-            var offsets = AbCipUdtMemberLayout.TryBuild(parent.Members);
+            var offsets = AbCipUdtMemberLayout.GetOrBuild(parent.Members);
             if (offsets is null || !offsets.TryGetValue(memberName, out var offset))
             {
                 fallback.Add(new AbCipUdtReadFallback(i, name));

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/IAbCipTagRuntime.cs

@@ -85,6 +85,17 @@ public interface IAbCipTagRuntime : IDisposable
     /// <param name="bitIndex">Bit index for BOOL-within-DINT insertion, or null.</param>
     /// <param name="value">Value to encode.</param>
     void EncodeValue(AbCipDataType type, int? bitIndex, object? value);
+
+    /// <summary>
+    ///     Encode a WHOLE-array write of <paramref name="values"/> (<c>values.Count</c> elements of
+    ///     <paramref name="type"/>, at the element width — see <see cref="AbCipArrayCodec"/>) into the local buffer.
+    ///     Callers pair this with <see cref="WriteAsync"/>. A runtime that cannot write arrays throws
+    ///     <see cref="NotSupportedException"/>.
+    /// </summary>
+    /// <param name="type">The array element type.</param>
+    /// <param name="values">The element values; already length-checked against the tag's element count.</param>
+    void EncodeArray(AbCipDataType type, IReadOnlyList<object?> values) =>
+        throw new NotSupportedException($"{GetType().Name} does not support array writes.");
 }
 
 /// <summary>

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/LibplctagStatusTranslation.cs

@@ -14,11 +14,21 @@ internal static class LibplctagStatusTranslation
         Status.Ok => AbStatus.Ok,
         Status.Pending => AbStatus.Pending,
         Status.ErrorTimeout => AbStatus.Timeout,
-        Status.ErrorNotFound or Status.ErrorNoMatch or Status.ErrorBadDevice => AbStatus.NotFound,
+        // #737 I2: only ErrorNotFound is the controller saying "no such tag". ErrorNoMatch / ErrorBadDevice describe a
+        // session or device-level failure (no proof the controller answered this tag), so they are comms-class: with
+        // the widened refusal classification, folding them into NotFound made a broken session read as "reachable".
+        Status.ErrorNotFound => AbStatus.NotFound,
+        Status.ErrorNoMatch or Status.ErrorBadDevice => AbStatus.BadConnection,
         Status.ErrorNotAllowed => AbStatus.NotAllowed,
         Status.ErrorOutOfBounds => AbStatus.OutOfBounds,
         Status.ErrorTooLarge => AbStatus.TooLarge,
         Status.ErrorTooSmall => AbStatus.TooSmall,
+        // ErrorNotImplemented is the LIBRARY refusing (no I/O); the exception paths raise it as an
+        // AbCipLocalRefusalException so it never counts as "the device answered" (see FromException).
+        // ASSUMPTION (#737 m3): libplctag reports a failed operation by THROWING, so a NotImplemented reaches the driver
+        // only through FromException. AbStatus has no "local" member (it is Driver.Ab.Transport's, Lane K), so a
+        // NotImplemented observed only as a STATUS WORD (GetStatus after a non-throwing op) would still classify as a
+        // device Unsupported refusal; that combination is not produced by libplctag.NET 1.5.2.
         Status.ErrorUnsupported or Status.ErrorNotImplemented => AbStatus.Unsupported,
         Status.ErrorPartial => AbStatus.Partial,
         Status.ErrorAbort => AbStatus.Abort,
@@ -70,9 +80,21 @@ internal static class LibplctagStatusTranslation
     public static async Task Wrap(Func<Task> op)
     {
         try { await op().ConfigureAwait(false); }
-        catch (LibPlcTagException ex) { throw new AbTransportException(ToAbStatus(ex), ex.Message, ex); }
+        catch (LibPlcTagException ex) { throw FromException(ex); }
     }
 
+    /// <summary>
+    ///     The transport exception for a libplctag failure: <c>ErrorNotImplemented</c> becomes an
+    ///     <see cref="AbCipLocalRefusalException"/> (a library refusal, no I/O); everything else an
+    ///     <see cref="AbTransportException"/> carrying the translated status.
+    /// </summary>
+    /// <param name="ex">The libplctag exception.</param>
+    /// <returns>The exception to throw.</returns>
+    public static AbTransportException FromException(LibPlcTagException ex) =>
+        Enum.TryParse<Status>((ex.Message ?? string.Empty).Trim(), ignoreCase: true, out var s) && s == Status.ErrorNotImplemented
+            ? new AbCipLocalRefusalException($"libplctag does not implement this operation: {ex.Message}", ex)
+            : new AbTransportException(ToAbStatus(ex), ex.Message ?? string.Empty, ex);
+
     /// <summary>Runs <paramref name="op"/>, rethrowing any <see cref="LibPlcTagException"/> as <see cref="AbTransportException"/>.</summary>
     /// <typeparam name="T">The result type.</typeparam>
     /// <param name="op">The libplctag operation.</param>
@@ -80,7 +102,7 @@ internal static class LibplctagStatusTranslation
     public static async Task<T> Wrap<T>(Func<Task<T>> op)
     {
         try { return await op().ConfigureAwait(false); }
-        catch (LibPlcTagException ex) { throw new AbTransportException(ToAbStatus(ex), ex.Message, ex); }
+        catch (LibPlcTagException ex) { throw FromException(ex); }
     }
 
     /// <summary>Runs a synchronous libplctag call, rethrowing <see cref="LibPlcTagException"/> as <see cref="AbTransportException"/>.</summary>
@@ -90,7 +112,7 @@ internal static class LibplctagStatusTranslation
     public static T WrapSync<T>(Func<T> op)
     {
         try { return op(); }
-        catch (LibPlcTagException ex) { throw new AbTransportException(ToAbStatus(ex), ex.Message, ex); }
+        catch (LibPlcTagException ex) { throw FromException(ex); }
     }
 
     /// <summary>Runs a synchronous libplctag call, rethrowing <see cref="LibPlcTagException"/> as <see cref="AbTransportException"/>.</summary>
@@ -98,6 +120,6 @@ internal static class LibplctagStatusTranslation
     public static void WrapSync(Action op)
     {
         try { op(); }
-        catch (LibPlcTagException ex) { throw new AbTransportException(ToAbStatus(ex), ex.Message, ex); }
+        catch (LibPlcTagException ex) { throw FromException(ex); }
     }
 }

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/LibplctagTagRuntime.cs

@@ -29,8 +29,19 @@ internal sealed class LibplctagTagRuntime : IAbCipTagRuntime
     public LibplctagTagRuntime(AbCipTagCreateParams p)
     {
         _tag = BuildTag(p);
+        _boolArrayElement = !p.IsArray && p.AuthoredType == AbCipDataType.Bool
+            && NativeAbCipTagRuntime.TrySplitBoolArrayElement(p.TagName, out _, out _);
     }
 
+    /// <summary>
+    ///     A scalar BOOL authored over a BOOL-array element (<c>Bits[n]</c>). libplctag reads it as whatever the
+    ///     controller returns for that element segment — a packed DWORD — and exposes no type code, so which DWORD
+    ///     came back (and so which bit is element n) cannot be checked here. Review 07 U11: such a read used to decode
+    ///     "low byte != 0" as Good; it is refused (<c>BadNotSupported</c>) when a DWORD came back. The native transport
+    ///     (the default) addresses the right DWORD and decodes the bit.
+    /// </summary>
+    private readonly bool _boolArrayElement;
+
     /// <summary>Builds the (uninitialized) libplctag tag for <paramref name="p"/>.</summary>
     /// <param name="p">The tag creation parameters.</param>
     /// <returns>The new, uninitialised libplctag tag.</returns>
@@ -120,7 +131,10 @@ internal sealed class LibplctagTagRuntime : IAbCipTagRuntime
     {
         AbCipDataType.Bool => bitIndex is int bit
             ? _tag.GetBit(bit)
-            : _tag.GetInt8(offset) != 0,
+            : _boolArrayElement && offset == 0 && _tag.GetSize() == 4
+                ? throw new AbTransportException(AbStatus.Unsupported,
+                    $"'{_tag.Name}' is a BOOL-array element read as a packed DWORD; libplctag cannot say which DWORD it is — use the native transport.")
+                : _tag.GetInt8(offset) != 0,
         AbCipDataType.SInt => (int)(sbyte)_tag.GetInt8(offset),
         AbCipDataType.USInt => (int)_tag.GetUInt8(offset),
         AbCipDataType.Int => (int)_tag.GetInt16(offset),
@@ -221,6 +235,23 @@ internal sealed class LibplctagTagRuntime : IAbCipTagRuntime
         _ => 4,
     };
 
+    /// <inheritdoc />
+    /// <remarks>
+    ///     The codec's bytes are copied into the buffer the last read sized (<c>elem_count</c> elements), so the write
+    ///     sends exactly the new array — never a stale tail. A buffer smaller than the encoded array is refused
+    ///     (<see cref="AbStatus.TooSmall"/>) before anything is changed.
+    /// </remarks>
+    public void EncodeArray(AbCipDataType type, IReadOnlyList<object?> values) =>
+        LibplctagStatusTranslation.WrapSync(() =>
+        {
+            var bytes = AbCipArrayCodec.Encode(type, values);
+            var size = _tag.GetSize();
+            if (size < bytes.Length)
+                throw new AbTransportException(AbStatus.TooSmall,
+                    $"Array write to '{_tag.Name}': {bytes.Length} byte(s) encoded but the tag buffer holds {size}.");
+            for (var i = 0; i < bytes.Length; i++) _tag.SetUInt8(i, bytes[i]);
+        });
+
     /// <inheritdoc />
     public void EncodeValue(AbCipDataType type, int? bitIndex, object? value) =>
         LibplctagStatusTranslation.WrapSync(() => EncodeValueCore(type, bitIndex, value));

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/NativeAbCipTagRuntime.cs

@@ -41,6 +41,34 @@ internal sealed class NativeAbCipTagRuntime : IAbCipTagRuntime
     private int? _implicitBit;
     private byte[]? _path;
 
+    // U11: a scalar BOOL authored over a BOOL-array element "Bits[n]" — the bit (n % 32) of DWORD n / 32 when the
+    // array is packed. Null for every other tag.
+    private int? _boolElementBit;
+
+    // Both addressings of such a tag: "Bits[n / 32]" (packed: a Logix BOOL array is stored as 0xD3 DWORDs) and the
+    // original "Bits[n]" (per-element: a family that answers 0xC1). _path is whichever _boolLayout selects.
+    private byte[]? _dwordPath;
+    private byte[]? _elementPath;
+
+    /// <summary>How a BOOL-array element tag's array is laid out, as the controller's REPLY TYPE last showed it.</summary>
+    private enum BoolLayout
+    {
+        /// <summary>No reply type seen yet (or only refusals / comms faults): request DWORD-addressed, keep asking.</summary>
+        Unsettled,
+
+        /// <summary>The controller answered 0xD3: address DWORD n / 32, decode bit n % 32.</summary>
+        Packed,
+
+        /// <summary>The controller answered 0xC1: address element n, decode its byte.</summary>
+        PerElement,
+    }
+
+    // #737 fix round 2 (N1): ONLY a reply type settles (or re-settles) the layout — 0xD3 ⇒ Packed, 0xC1 ⇒ PerElement.
+    // A refusal or comms fault says nothing about the layout and leaves it as it was, so a tag deployed before the
+    // online edit that creates its array starts reading correctly once the array exists. A reply whose type disagrees
+    // with the addressing it was asked under is DISCARDED (never decoded) and re-read under the right addressing.
+    private BoolLayout _boolLayout;
+
     private ConnectionLease? _lease;
     private RequestScheduler? _privateScheduler; // ForTest only — production always uses the lease's
     private LogixTagClient? _client;
@@ -51,6 +79,7 @@ internal sealed class NativeAbCipTagRuntime : IAbCipTagRuntime
     private AbStatus _status = AbStatus.Pending;
 
     private byte[]? _writeBuffer;
+    private ushort _writeElements = 1;
     private string? _pendingString;
     private bool _disposed;
 
@@ -94,16 +123,15 @@ internal sealed class NativeAbCipTagRuntime : IAbCipTagRuntime
     /// <summary>The trailing bit selector split off the tag name (<c>Tag.5</c>), if any.</summary>
     internal int? ImplicitBit => _implicitBit;
 
-    // Performs one read to prove the tag exists: libplctag's InitializeAsync errors for an unknown
-    // tag, and the driver's backoff classification depends on create throwing AbStatus.NotFound.
+    // Performs one read to prove the session works and learn the tag's type.
     //
     // A name the encoder refuses throws AbCipTagConfigurationException before any lease: it is this
     // tag's configuration, not the device, and must not black out the device's other tags. A read the
-    // controller answers with a deterministic refusal (AbStatus.TypeMismatch / AbStatus.Unsupported)
-    // proves the tag exists, so it completes the initialization with that status rather than throwing:
-    // a throw here makes the driver dispose the runtime and re-create it - and, for a sole lease
-    // holder, re-Forward-Open - on every poll (mistype churn). The driver's own read reports the
-    // refusal.
+    // controller answers with a deterministic refusal (AbCipRefusals.IsDeviceRefusal: NotFound, OutOfBounds,
+    // NotAllowed, TooLarge/TooSmall, TypeMismatch, Unsupported) proves the session works, so it completes the
+    // initialization with that status rather than throwing: a throw here makes the driver dispose the runtime
+    // and re-create it - and, for a sole lease holder, re-Forward-Open - on every poll (a renamed tag or a
+    // mistype churned the lease). The driver's own read reports the refusal, per tag, on the kept runtime.
     /// <inheritdoc />
     public async Task InitializeAsync(CancellationToken cancellationToken)
     {
@@ -116,7 +144,20 @@ internal sealed class NativeAbCipTagRuntime : IAbCipTagRuntime
             try
             {
                 split = CipPath.SplitBitSelector(_p.TagName);
-                path = CipPath.EncodeSymbolic(split.Name);
+                var name = split.Name;
+                if (split.Bit is null && !_p.IsArray && _p.AuthoredType == AbCipDataType.Bool
+                    && TrySplitBoolArrayElement(name, out var dwordName, out var bit))
+                {
+                    _elementPath = CipPath.EncodeSymbolic(name);
+                    _dwordPath = CipPath.EncodeSymbolic(dwordName);
+                    _boolElementBit = bit;
+                    _boolLayout = BoolLayout.Unsettled;
+                    path = _dwordPath;
+                }
+                else
+                {
+                    path = CipPath.EncodeSymbolic(name);
+                }
             }
             catch (Exception ex) when (ex is ArgumentException or FormatException or OverflowException)
             {
@@ -137,20 +178,45 @@ internal sealed class NativeAbCipTagRuntime : IAbCipTagRuntime
         {
             await ReadAsync(cancellationToken).ConfigureAwait(false);
         }
-        catch (AbTransportException ex) when (ex.Status is AbStatus.TypeMismatch or AbStatus.Unsupported)
+        catch (AbTransportException ex) when (AbCipRefusals.IsDeviceRefusal(ex))
         {
-            // The controller answered — the tag exists. _status already holds the refusal.
+            // The controller answered. _status already holds the refusal.
         }
     }
 
     /// <inheritdoc />
-    public async Task ReadAsync(CancellationToken cancellationToken)
+    public Task ReadAsync(CancellationToken cancellationToken) => ReadCoreAsync(cancellationToken, mayRelayout: true);
+
+    private async Task ReadCoreAsync(CancellationToken cancellationToken, bool mayRelayout)
     {
         var client = Client();
         var path = Path();
         try
         {
             var (type, handle, data) = await client.ReadAsync(path, _elements, cancellationToken, ExpectedElementBytes(_p.AuthoredType)).ConfigureAwait(false);
+            if (_boolElementBit is not null)
+            {
+                BoolLayout? shown = type == LogixTypeCode.BoolArray ? BoolLayout.Packed
+                    : type == LogixTypeCode.Bool ? BoolLayout.PerElement
+                    : null; // any other type (a mistyped tag): no layout evidence; the type check below reports it
+                if (shown is { } layout)
+                {
+                    var askedPacked = ReferenceEquals(path, _dwordPath);
+                    SetBoolLayout(layout);
+                    if ((layout == BoolLayout.Packed) != askedPacked)
+                    {
+                        // The reply is for the OTHER addressing (element n / 32 of a per-element array, or DWORD n of a
+                        // packed one) — not this element. Discard it and ask again under the layout it just showed.
+                        if (mayRelayout)
+                        {
+                            await ReadCoreAsync(cancellationToken, mayRelayout: false).ConfigureAwait(false);
+                            return;
+                        }
+                        throw new AbTransportException(AbStatus.TypeMismatch,
+                            $"'{_p.TagName}': the controller's BOOL-array layout changed between two reads; retrying next read.");
+                    }
+                }
+            }
             _data = data;
             _typeCode = type;
             _structHandle = handle;
@@ -164,6 +230,13 @@ internal sealed class NativeAbCipTagRuntime : IAbCipTagRuntime
         }
     }
 
+    /// <summary>Settles a BOOL-array element tag's layout and selects the matching request path.</summary>
+    private void SetBoolLayout(BoolLayout layout)
+    {
+        _boolLayout = layout;
+        _path = layout == BoolLayout.PerElement ? _elementPath : _dwordPath;
+    }
+
     /// <summary>
     ///     Upper bound on one element's wire bytes for the scheduler's reply budget; 0 when the
     ///     authored type is unknown or a structure, which sends the read alone rather than guess.
@@ -196,6 +269,14 @@ internal sealed class NativeAbCipTagRuntime : IAbCipTagRuntime
 
         try
         {
+            // An unsettled BOOL-array element layout is settled by a read first, so a write never goes to the
+            // DWORD-addressed element of an element-addressed array (#737 I1). A packed layout's write is refused below
+            // (0xD3 DWORD — it would clobber 31 neighbours); a per-element one writes "Bits[n]" as a BOOL.
+            if (_boolElementBit is not null && _boolLayout == BoolLayout.Unsettled)
+            {
+                await ReadAsync(cancellationToken).ConfigureAwait(false);
+                path = Path();
+            }
             if (_pendingString is { } text)
             {
                 // A STRING writes as the type the controller reported — a Logix STRING is a structure
@@ -204,7 +285,7 @@ internal sealed class NativeAbCipTagRuntime : IAbCipTagRuntime
                 if (_typeCode is null || (_typeCode == LogixTypeCode.Struct && _structHandle is null))
                     await ReadAsync(cancellationToken).ConfigureAwait(false);
                 if (_typeCode == LogixTypeCode.Struct && _structHandle is null)
-                    throw new AbTransportException(AbStatus.Unsupported,
+                    throw new AbCipLocalRefusalException(
                         $"STRING write to '{_p.TagName}': the controller returned no structure handle.");
                 var payload = EncodeStringPayload(text);
                 await client.WriteAsync(path, _typeCode!.Value, _structHandle, 1, payload, cancellationToken)
@@ -213,7 +294,7 @@ internal sealed class NativeAbCipTagRuntime : IAbCipTagRuntime
             else if (_writeBuffer is { } buffer)
             {
                 var type = _typeCode ?? AtomicCode(_p.AuthoredType)
-                    ?? throw new AbTransportException(AbStatus.Unsupported,
+                    ?? throw new AbCipLocalRefusalException(
                         $"Write to '{_p.TagName}': type unknown — no prior read and no authored atomic type.");
                 // The read rule decides first: a same-width mismatch (REAL under a DINT-authored tag)
                 // would otherwise send the int bit pattern as a REAL and report Good.
@@ -223,17 +304,18 @@ internal sealed class NativeAbCipTagRuntime : IAbCipTagRuntime
                 // Width is checked only for codes with a known width: DATE / DATE_AND_TIME (0xCD/0xCF) and
                 // Micro800 BYTE/WORD/LWORD (0xD1/0xD2/0xD4) are outside LogixTypeCode's table and write as today.
                 var width = LogixTypeCode.ByteWidth(type);
-                if (width > 0 && width != buffer.Length)
+                if (width > 0 && width * _writeElements != buffer.Length)
                 {
                     // An authored BOOL over a packed BOOL-array DWORD: writing the DWORD would clobber the
                     // 31 sibling bools (libplctag does exactly that), so refuse it as a config error.
-                    if (type == LogixTypeCode.BoolArray)
+                    if (type == LogixTypeCode.BoolArray && _writeElements == 1)
                         throw new NotSupportedException(
                             $"Write to '{_p.TagName}': a BOOL-array element (type 0xD3 DWORD) cannot be written as a single BOOL.");
                     throw new AbTransportException(AbStatus.TypeMismatch,
-                        $"Write to '{_p.TagName}': encoded {buffer.Length} byte(s) but the controller's type 0x{type:X4} is {width} byte(s) wide.");
+                        $"Write to '{_p.TagName}': encoded {buffer.Length} byte(s) for {_writeElements} element(s) but the controller's type 0x{type:X4} is {width} byte(s) wide.");
                 }
-                await client.WriteAsync(path, type, null, 1, buffer, cancellationToken).ConfigureAwait(false);
+                // U10: an array write is ONE Write Tag of _writeElements elements (the client fragments it if large).
+                await client.WriteAsync(path, type, null, _writeElements, buffer, cancellationToken).ConfigureAwait(false);
             }
             else
             {
@@ -276,7 +358,7 @@ internal sealed class NativeAbCipTagRuntime : IAbCipTagRuntime
 
         return type switch
         {
-            AbCipDataType.Bool => bitIndex is int bit ? GetBit(bit) : Span(offset, 1)[0] != 0,
+            AbCipDataType.Bool => bitIndex is int bit ? GetBit(bit) : DecodeScalarBool(offset),
             AbCipDataType.SInt => (int)(sbyte)Span(offset, 1)[0],
             AbCipDataType.USInt => (int)Span(offset, 1)[0],
             AbCipDataType.Int => (int)BinaryPrimitives.ReadInt16LittleEndian(Span(offset, 2)),
@@ -315,10 +397,22 @@ internal sealed class NativeAbCipTagRuntime : IAbCipTagRuntime
         };
     }
 
+    /// <inheritdoc />
+    public void EncodeArray(AbCipDataType type, IReadOnlyList<object?> values)
+    {
+        ArgumentNullException.ThrowIfNull(values);
+        _writeBuffer = null;
+        _pendingString = null;
+        var buffer = AbCipArrayCodec.Encode(type, values); // throws (nothing staged) before any state changes
+        _writeElements = (ushort)Math.Clamp(values.Count, 1, ushort.MaxValue);
+        _writeBuffer = buffer;
+    }
+
     /// <inheritdoc />
     public void EncodeValue(AbCipDataType type, int? bitIndex, object? value)
     {
         _writeBuffer = null;
+        _writeElements = 1;
         _pendingString = null;
         switch (type)
         {
@@ -410,6 +504,47 @@ internal sealed class NativeAbCipTagRuntime : IAbCipTagRuntime
         catch (Exception) { /* ForTest only; Dispose must not throw */ }
     }
 
+    /// <summary>
+    ///     A scalar BOOL. A packed (0xD3) reply is decoded ONLY as the element's own bit of the DWORD the packed layout
+    ///     addressed; any other 0xD3 reply (no element bit, or not settled packed) is refused rather than decoded as
+    ///     "byte 0 != 0" — that value would be some other bit, published as Good (#737 N1).
+    /// </summary>
+    private bool DecodeScalarBool(int offset)
+    {
+        if (offset == 0 && _typeCode == LogixTypeCode.BoolArray)
+        {
+            if (_boolElementBit is int element && _boolLayout == BoolLayout.Packed) return GetBit(element);
+            throw new AbTransportException(AbStatus.TypeMismatch,
+                $"'{_p.TagName}' is a scalar BOOL but the controller answered a packed BOOL-array DWORD (0xD3) with no element bit to select.");
+        }
+        return Span(offset, 1)[0] != 0;
+    }
+
+    /// <summary>
+    ///     Splits a BOOL-array element reference <c>Name[n]</c> (one non-negative subscript, last segment) into the
+    ///     DWORD it lives in (<c>Name[n / 32]</c>) and its bit within that DWORD (<c>n % 32</c>). A Logix BOOL array
+    ///     is stored as DWORDs (type 0xD3) and its element segment addresses those DWORDs.
+    /// </summary>
+    /// <param name="name">The tag name, bit selector already split off.</param>
+    /// <param name="dwordName">The name addressing the containing DWORD.</param>
+    /// <param name="bit">The element's bit within that DWORD.</param>
+    /// <returns><see langword="true"/> when <paramref name="name"/> ends in a single subscript.</returns>
+    internal static bool TrySplitBoolArrayElement(string name, out string dwordName, out int bit)
+    {
+        dwordName = name;
+        bit = 0;
+        if (!name.EndsWith(']')) return false;
+        var open = name.LastIndexOf('[');
+        if (open <= 0) return false;
+        var inner = name[(open + 1)..^1];
+        if (inner.Length == 0 || !inner.All(char.IsAsciiDigit)
+            || !int.TryParse(inner, System.Globalization.NumberStyles.None, System.Globalization.CultureInfo.InvariantCulture, out var n))
+            return false;
+        dwordName = $"{name[..open]}[{n / 32}]";
+        bit = n % 32;
+        return true;
+    }
+
     private byte[] Path() =>
         _path ?? throw new InvalidOperationException("InitializeAsync has not been called.");
 

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Calculation/CalculationDriverFactoryExtensions.cs

@@ -38,13 +38,16 @@ public static class CalculationDriverFactoryExtensions
     /// <param name="registry">The driver factory registry to register with.</param>
     /// <param name="loggerFactory">Optional logger factory for per-instance diagnostics loggers.</param>
     /// <param name="scriptRoot">Optional root script logger (fans failure entries onto the <c>script-logs</c> topic).</param>
+    /// <param name="scripting">The node-wide <c>Scripting</c> options every Calculation driver inherits; a key
+    /// authored in a driver's own config overrides that one knob. Null ⇒ the compiled defaults.</param>
     public static void Register(
         DriverFactoryRegistry registry,
         ILoggerFactory? loggerFactory = null,
-        ScriptRootLogger? scriptRoot = null)
+        ScriptRootLogger? scriptRoot = null,
+        ScriptingOptions? scripting = null)
     {
         ArgumentNullException.ThrowIfNull(registry);
-        registry.Register(DriverTypeName, (id, json) => CreateInstance(id, json, loggerFactory, scriptRoot));
+        registry.Register(DriverTypeName, (id, json) => CreateInstance(id, json, loggerFactory, scriptRoot, scripting));
     }
 
     /// <summary>Public overload for the Server-side bootstrapper + test consumers.</summary>
@@ -63,6 +66,18 @@ public static class CalculationDriverFactoryExtensions
     public static CalculationDriver CreateInstance(
         string driverInstanceId, string driverConfigJson,
         ILoggerFactory? loggerFactory, ScriptRootLogger? scriptRoot)
+        => CreateInstance(driverInstanceId, driverConfigJson, loggerFactory, scriptRoot, nodeScripting: null);
+
+    /// <summary>The full overload: also takes the node-wide <c>Scripting</c> options the driver inherits.</summary>
+    /// <param name="driverInstanceId">The unique identifier for the driver instance.</param>
+    /// <param name="driverConfigJson">The merged driver config JSON (carries the <c>RawTags</c> array).</param>
+    /// <param name="loggerFactory">Optional logger factory for per-instance diagnostics loggers.</param>
+    /// <param name="scriptRoot">Optional root script logger for failure fan-out.</param>
+    /// <param name="nodeScripting">The node-wide run-guard options; null ⇒ the compiled defaults.</param>
+    /// <returns>The constructed <see cref="CalculationDriver"/>.</returns>
+    public static CalculationDriver CreateInstance(
+        string driverInstanceId, string driverConfigJson,
+        ILoggerFactory? loggerFactory, ScriptRootLogger? scriptRoot, ScriptingOptions? nodeScripting)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(driverInstanceId);
         ArgumentException.ThrowIfNullOrWhiteSpace(driverConfigJson);
@@ -71,15 +86,14 @@ public static class CalculationDriverFactoryExtensions
             ?? throw new InvalidOperationException(
                 $"Calculation driver config for '{driverInstanceId}' deserialised to null");
 
-        // Run-guard knobs are optional and default to the node-wide ScriptingOptions defaults; only an
-        // explicitly authored key overrides one (so a config carrying neither binds Scripting = null).
-        ScriptingOptions? scripting = null;
-        if (dto.MaxAllocBytesPerRun is not null || dto.QuarantineAfterConsecutiveTimeouts is not null)
-        {
-            scripting = new ScriptingOptions();
-            if (dto.MaxAllocBytesPerRun is { } alloc) scripting.MaxAllocBytesPerRun = alloc;
-            if (dto.QuarantineAfterConsecutiveTimeouts is { } n) scripting.QuarantineAfterConsecutiveTimeouts = n;
-        }
+        var scripting = ResolveScripting(
+            dto.MaxAllocBytesPerRun, dto.QuarantineAfterConsecutiveTimeouts, nodeScripting, out var adjustments);
+        var logger = loggerFactory?.CreateLogger<CalculationDriver>();
+        // An authored value is never changed silently: the run guard would clamp it anyway, without a word.
+        foreach (var adjustment in adjustments)
+            logger?.LogWarning(
+                "Calculation driver {DriverInstanceId}: its run-guard config was out of range and is clamped: {Adjustment}",
+                driverInstanceId, adjustment);
 
         var options = new CalculationDriverOptions
         {
@@ -89,9 +103,37 @@ public static class CalculationDriverFactoryExtensions
             Scripting = scripting,
         };
 
-        return new CalculationDriver(
-            options, driverInstanceId, scriptRoot,
-            logger: loggerFactory?.CreateLogger<CalculationDriver>());
+        return new CalculationDriver(options, driverInstanceId, scriptRoot, logger: logger);
+    }
+
+    /// <summary>
+    ///     The run-guard options for one Calculation driver. The node-wide options are the base. A key authored
+    ///     in the driver's config overrides only its own knob, on a copy, so the shared node object is never
+    ///     written. With neither, the result is null and the guard uses its compiled defaults.
+    /// </summary>
+    /// <param name="maxAllocBytesPerRun">The driver config's <c>maxAllocBytesPerRun</c>, or null.</param>
+    /// <param name="quarantineAfterConsecutiveTimeouts">The driver config's <c>quarantineAfterConsecutiveTimeouts</c>, or null.</param>
+    /// <param name="nodeScripting">The node-wide options, or null.</param>
+    /// <param name="adjustments">The clamps applied to the driver's OWN keys (the node options were already
+    /// clamped and logged at bind), for the caller to log. Empty when nothing was out of range.</param>
+    /// <returns>The options to hand the driver, or null.</returns>
+    internal static ScriptingOptions? ResolveScripting(
+        long? maxAllocBytesPerRun, int? quarantineAfterConsecutiveTimeouts, ScriptingOptions? nodeScripting,
+        out IReadOnlyList<string> adjustments)
+    {
+        adjustments = [];
+        if (maxAllocBytesPerRun is null && quarantineAfterConsecutiveTimeouts is null) return nodeScripting;
+
+        var resolved = new ScriptingOptions();
+        if (nodeScripting is not null)
+        {
+            resolved.MaxAllocBytesPerRun = nodeScripting.MaxAllocBytesPerRun;
+            resolved.QuarantineAfterConsecutiveTimeouts = nodeScripting.QuarantineAfterConsecutiveTimeouts;
+            resolved.StuckOrphanQuarantineFactor = nodeScripting.StuckOrphanQuarantineFactor;
+        }
+        if (maxAllocBytesPerRun is { } alloc) resolved.MaxAllocBytesPerRun = alloc;
+        if (quarantineAfterConsecutiveTimeouts is { } n) resolved.QuarantineAfterConsecutiveTimeouts = n;
+        return resolved.Sanitized(out adjustments);
     }
 
     /// <summary>The merged-config DTO the calc factory binds from. The Calculation driver has no

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Contracts/FocasTagDefinitionFactory.cs

@@ -53,6 +53,9 @@ public static class FocasTagDefinitionFactory
             // Strict enum read: a typo'd dataType rejects the tag (→ BadNodeIdUnknown)
             // instead of silently defaulting to a wrong-width Good.
             if (!TagConfigJson.TryReadEnumStrict(root, "dataType", FocasDataType.Int32, out var dataType)) return false;
+            // A data type no read of this address can produce (String on PMC / PARAM / MACRO) rejects the tag:
+            // served, it published a boxed number at Good into a String node.
+            if (DescribeDataTypeMismatch(dataType, address) is not null) return false;
             // FOCAS authored tags carry no `writable` key (writability lives on the Tag entity / node ACL):
             // absent ⇒ read-only. An explicit writable:true is honoured for the driver's internal write gate
             // (default-false, so a missing key stays read-only — the note is preserved).
@@ -73,6 +76,26 @@ public static class FocasTagDefinitionFactory
         catch (InvalidOperationException) { return false; }
     }
 
+    /// <summary>
+    ///     The ONE address/data-type compatibility rule, shared by the mapper (and so the driver's init and the
+    ///     deploy inspector), the AdminUI tag editor and the CLI. <see cref="FocasDataType.String"/> is only
+    ///     servable from the fixed tree (Identity / Program name / mode text …): a PMC, parameter or macro read
+    ///     returns a number, which a String node would receive at Good. An <c>ALARM:</c> tag has no value, so its
+    ///     data type is irrelevant; an unparseable address is left to the address check, which names it better.
+    /// </summary>
+    /// <param name="dataType">The authored data type.</param>
+    /// <param name="address">The authored address.</param>
+    /// <returns>The reason the pair cannot be served, or <see langword="null"/> when it can.</returns>
+    public static string? DescribeDataTypeMismatch(FocasDataType dataType, string? address)
+    {
+        if (dataType != FocasDataType.String) return null;
+        var parsed = FocasAddress.TryParse(address);
+        if (parsed is null || parsed.Kind is FocasAreaKind.Fixed or FocasAreaKind.Alarm) return null;
+        return $"FOCAS data type 'String' is not readable at '{address!.Trim()}' — PMC, PARAM: and MACRO: reads " +
+               "return numbers (String is only valid on FIXED: paths such as FIXED:Identity/SeriesNumber). " +
+               "Choose Bit / Byte / Int16 / Int32 / Float32 / Float64.";
+    }
+
     /// <summary>
     ///     The tag's cross-driver <c>alarm</c> object, or <see langword="null"/> when it carries none.
     ///     Lenient like the host's <c>TagConfigIntent</c>: a non-integer <c>severity</c> is simply absent.
@@ -236,6 +259,10 @@ public static class FocasTagDefinitionFactory
         }
 
         if (TagConfigJson.DescribeInvalidEnum<FocasDataType>(root, "dataType") is { } w) rejections.Add(w);
+        else if (addr.ValueKind == JsonValueKind.String
+                 && TagConfigJson.TryReadEnumStrict(root, "dataType", FocasDataType.Int32, out var dataType)
+                 && DescribeDataTypeMismatch(dataType, addr.GetString()) is { } mismatch)
+            rejections.Add(mismatch + " The driver will skip this tag and it will read BadNodeIdUnknown.");
     }
 
     /// <summary>

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/SynchronizedFocasClient.cs

@@ -32,6 +32,9 @@ public sealed class SynchronizedFocasClient : IFocasClient
     private readonly IFocasClient _inner;
     private readonly TimeSpan _callTimeout;
     private readonly SemaphoreSlim _gate = new(1, 1);
+    /// <summary>Ops holding or queued for <see cref="_gate"/> — what <see cref="DisposeWhenIdleAsync"/> drains.</summary>
+    private int _pending;
+    private int _disposed;
 
     /// <summary>Wraps <paramref name="inner"/> with per-device serialization + a per-call timeout.</summary>
     /// <param name="inner">The underlying FOCAS client to serialize access to.</param>
@@ -115,26 +118,66 @@ public sealed class SynchronizedFocasClient : IFocasClient
     public Task<IReadOnlyList<double?>> GetSpindleMotorSpeedsAsync(CancellationToken cancellationToken) =>
         RunBoundedAsync(ct => _inner.GetSpindleMotorSpeedsAsync(ct), cancellationToken);
 
-    /// <summary>Disposes the inner client and the call gate.</summary>
+    /// <summary>
+    ///     Disposes the inner client. Ops still queued on the call gate then fail with
+    ///     <see cref="ObjectDisposedException"/> instead of running on a disposed socket. The gate itself is NOT
+    ///     disposed: an op that already holds it releases it on the way out, and releasing a disposed
+    ///     <see cref="SemaphoreSlim"/> threw out of a read that had otherwise completed.
+    /// </summary>
     public void Dispose()
     {
+        if (Interlocked.Exchange(ref _disposed, 1) != 0) return;
         _inner.Dispose();
-        _gate.Dispose();
+    }
+
+    /// <summary>
+    ///     Disposes once every op that already holds (or is queued for) this client has finished, waiting at most
+    ///     <paramref name="maxWait"/>. Used by the handle-recycle loop, which detaches the client under the device's
+    ///     connect gate first — so nothing new can reach it — and then must not kill a read that is mid-flight on
+    ///     it (that read used to surface BadCommunicationError + Degraded on every recycle tick).
+    /// </summary>
+    /// <param name="maxWait">Upper bound on the wait; the client is disposed regardless once it passes.</param>
+    /// <returns>A task that completes when the client is disposed.</returns>
+    public async Task DisposeWhenIdleAsync(TimeSpan maxWait)
+    {
+        var deadline = DateTime.UtcNow + maxWait;
+        while (Volatile.Read(ref _pending) > 0 && DateTime.UtcNow < deadline)
+            await Task.Delay(5, CancellationToken.None).ConfigureAwait(false);
+        Dispose();
+    }
+
+    /// <summary>Gets the number of ops currently holding or queued for the call gate. Test seam.</summary>
+    internal int PendingOperations => Volatile.Read(ref _pending);
+
+    private void ThrowIfDisposed()
+    {
+        if (Volatile.Read(ref _disposed) != 0)
+            throw new ObjectDisposedException(nameof(SynchronizedFocasClient), "The FOCAS client was recycled or disposed.");
     }
 
     // Gate only — the caller already governs the budget (connect timeout arg / probe linked token).
     private async Task<T> RunGatedAsync<T>(Func<CancellationToken, Task<T>> op, CancellationToken ct)
     {
-        await _gate.WaitAsync(ct).ConfigureAwait(false);
-        try { return await op(ct).ConfigureAwait(false); }
-        finally { _gate.Release(); }
+        Interlocked.Increment(ref _pending);
+        try
+        {
+            await _gate.WaitAsync(ct).ConfigureAwait(false);
+            try { ThrowIfDisposed(); return await op(ct).ConfigureAwait(false); }
+            finally { _gate.Release(); }
+        }
+        finally { Interlocked.Decrement(ref _pending); }
     }
 
     private async Task RunGatedAsync(Func<CancellationToken, Task> op, CancellationToken ct)
     {
-        await _gate.WaitAsync(ct).ConfigureAwait(false);
-        try { await op(ct).ConfigureAwait(false); }
-        finally { _gate.Release(); }
+        Interlocked.Increment(ref _pending);
+        try
+        {
+            await _gate.WaitAsync(ct).ConfigureAwait(false);
+            try { ThrowIfDisposed(); await op(ct).ConfigureAwait(false); }
+            finally { _gate.Release(); }
+        }
+        finally { Interlocked.Decrement(ref _pending); }
     }
 
     // Gate + per-call timeout. A fired timeout surfaces as OperationCanceledException whose token is
@@ -142,16 +185,22 @@ public sealed class SynchronizedFocasClient : IFocasClient
     // their own token's IsCancellationRequested.
     private async Task<T> RunBoundedAsync<T>(Func<CancellationToken, Task<T>> op, CancellationToken ct)
     {
-        await _gate.WaitAsync(ct).ConfigureAwait(false);
+        Interlocked.Increment(ref _pending);
         try
         {
-            if (_callTimeout <= TimeSpan.Zero)
-                return await op(ct).ConfigureAwait(false);
+            await _gate.WaitAsync(ct).ConfigureAwait(false);
+            try
+            {
+                ThrowIfDisposed();
+                if (_callTimeout <= TimeSpan.Zero)
+                    return await op(ct).ConfigureAwait(false);
 
-            using var linked = CancellationTokenSource.CreateLinkedTokenSource(ct);
-            linked.CancelAfter(_callTimeout);
-            return await op(linked.Token).ConfigureAwait(false);
+                using var linked = CancellationTokenSource.CreateLinkedTokenSource(ct);
+                linked.CancelAfter(_callTimeout);
+                return await op(linked.Token).ConfigureAwait(false);
+            }
+            finally { _gate.Release(); }
         }
-        finally { _gate.Release(); }
+        finally { Interlocked.Decrement(ref _pending); }
     }
 }

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/Wire/FocasWireClient.cs

@@ -467,18 +467,41 @@ public sealed class FocasWireClient : IAsyncDisposable, IDisposable
     /// <param name="pathId">Optional path ID override; defaults to <see cref="PathId"/>.</param>
     /// <returns>The raw parameter payload bytes, wrapped in a <see cref="FocasResult{T}"/>.</returns>
     public async Task<FocasResult<byte[]>> ReadParameterBytesAsync(
-        short dataNumber,
+        int dataNumber,
         short axis = 0,
         CancellationToken cancellationToken = default,
         TimeSpan? timeout = null,
         ushort? pathId = null)
     {
         using var callTimeout = CreateCallTimeout(cancellationToken, timeout);
-        var secondArg = axis == 0 ? dataNumber : axis;
-        var block = await SendSingleRequestAsync(callTimeout.Token, new RequestBlock(0x000e, dataNumber, secondArg, PathId: EffectivePathId(pathId))).ConfigureAwait(false);
+        var block = await SendSingleRequestAsync(callTimeout.Token, ParameterRequest(dataNumber, axis, EffectivePathId(pathId))).ConfigureAwait(false);
         return ToResult(block, payload => payload);
     }
 
+    /// <summary>
+    ///     The <c>cnc_rdparam</c> (0x000e) request block. The data number travels in the 32-bit
+    ///     <c>Arg1</c> UNNARROWED — the request block has always carried <see cref="int"/> arguments, and
+    ///     a <c>short</c> cast in the adapter once asked the CNC for a different (wrapped) number than the
+    ///     one authored. A global parameter repeats the number in <c>Arg2</c>; an axis parameter carries
+    ///     the axis there.
+    /// </summary>
+    /// <param name="dataNumber">The parameter data number.</param>
+    /// <param name="axis">Axis selector; zero means a global parameter.</param>
+    /// <param name="pathId">The CNC path.</param>
+    /// <returns>The request block.</returns>
+    internal static RequestBlock ParameterRequest(int dataNumber, short axis, ushort pathId) =>
+        new(0x000e, dataNumber, axis == 0 ? dataNumber : axis, PathId: pathId);
+
+    /// <summary>
+    ///     The <c>cnc_rdmacro</c> (0x0015) request block: the variable number, unnarrowed, in both 32-bit
+    ///     arguments (start / end of a one-variable range) — byte-identical to the live 31i-B capture for #500.
+    /// </summary>
+    /// <param name="number">The macro variable number.</param>
+    /// <param name="pathId">The CNC path.</param>
+    /// <returns>The request block.</returns>
+    internal static RequestBlock MacroRequest(int number, ushort pathId) =>
+        new(0x0015, number, number, PathId: pathId);
+
     /// <summary>Typed Int32 parameter read — convenience over <see cref="ReadParameterBytesAsync"/>.</summary>
     /// <param name="dataNumber">The parameter data number.</param>
     /// <param name="type">The FOCAS parameter type code.</param>
@@ -487,7 +510,7 @@ public sealed class FocasWireClient : IAsyncDisposable, IDisposable
     /// <param name="pathId">Optional path ID override; defaults to <see cref="PathId"/>.</param>
     /// <returns>The typed parameter value, wrapped in a <see cref="FocasResult{T}"/>.</returns>
     public async Task<FocasResult<WireParameter>> ReadParameterAsync(
-        short dataNumber,
+        int dataNumber,
         short type = 0,
         CancellationToken cancellationToken = default,
         TimeSpan? timeout = null,
@@ -507,7 +530,7 @@ public sealed class FocasWireClient : IAsyncDisposable, IDisposable
     /// <param name="timeout">Optional per-call timeout override.</param>
     /// <param name="pathId">Optional path ID override; defaults to <see cref="PathId"/>.</param>
     /// <returns>The typed 8-bit parameter value, wrapped in a <see cref="FocasResult{T}"/>.</returns>
-    public async Task<FocasResult<byte>> ReadParameterByteAsync(short dataNumber, short axis = 0, CancellationToken cancellationToken = default, TimeSpan? timeout = null, ushort? pathId = null)
+    public async Task<FocasResult<byte>> ReadParameterByteAsync(int dataNumber, short axis = 0, CancellationToken cancellationToken = default, TimeSpan? timeout = null, ushort? pathId = null)
     {
         var result = await ReadParameterBytesAsync(dataNumber, axis, cancellationToken, timeout, pathId).ConfigureAwait(false);
         return !result.IsOk || result.Value is null
@@ -522,7 +545,7 @@ public sealed class FocasWireClient : IAsyncDisposable, IDisposable
     /// <param name="timeout">Optional per-call timeout override.</param>
     /// <param name="pathId">Optional path ID override; defaults to <see cref="PathId"/>.</param>
     /// <returns>The typed 16-bit parameter value, wrapped in a <see cref="FocasResult{T}"/>.</returns>
-    public async Task<FocasResult<short>> ReadParameterInt16Async(short dataNumber, short axis = 0, CancellationToken cancellationToken = default, TimeSpan? timeout = null, ushort? pathId = null)
+    public async Task<FocasResult<short>> ReadParameterInt16Async(int dataNumber, short axis = 0, CancellationToken cancellationToken = default, TimeSpan? timeout = null, ushort? pathId = null)
     {
         var result = await ReadParameterBytesAsync(dataNumber, axis, cancellationToken, timeout, pathId).ConfigureAwait(false);
         return !result.IsOk || result.Value is null
@@ -537,7 +560,7 @@ public sealed class FocasWireClient : IAsyncDisposable, IDisposable
     /// <param name="timeout">Optional per-call timeout override.</param>
     /// <param name="pathId">Optional path ID override; defaults to <see cref="PathId"/>.</param>
     /// <returns>The typed 32-bit parameter value, wrapped in a <see cref="FocasResult{T}"/>.</returns>
-    public async Task<FocasResult<int>> ReadParameterInt32Async(short dataNumber, short axis = 0, CancellationToken cancellationToken = default, TimeSpan? timeout = null, ushort? pathId = null)
+    public async Task<FocasResult<int>> ReadParameterInt32Async(int dataNumber, short axis = 0, CancellationToken cancellationToken = default, TimeSpan? timeout = null, ushort? pathId = null)
     {
         var result = await ReadParameterBytesAsync(dataNumber, axis, cancellationToken, timeout, pathId).ConfigureAwait(false);
         return !result.IsOk || result.Value is null
@@ -552,7 +575,7 @@ public sealed class FocasWireClient : IAsyncDisposable, IDisposable
     /// <param name="timeout">Optional per-call timeout override.</param>
     /// <param name="pathId">Optional path ID override; defaults to <see cref="PathId"/>.</param>
     /// <returns>The typed single-precision parameter value, wrapped in a <see cref="FocasResult{T}"/>.</returns>
-    public async Task<FocasResult<float>> ReadParameterFloat32Async(short dataNumber, short axis = 0, CancellationToken cancellationToken = default, TimeSpan? timeout = null, ushort? pathId = null)
+    public async Task<FocasResult<float>> ReadParameterFloat32Async(int dataNumber, short axis = 0, CancellationToken cancellationToken = default, TimeSpan? timeout = null, ushort? pathId = null)
     {
         var result = await ReadParameterBytesAsync(dataNumber, axis, cancellationToken, timeout, pathId).ConfigureAwait(false);
         return !result.IsOk || result.Value is null || result.Value.Length < 4
@@ -567,7 +590,7 @@ public sealed class FocasWireClient : IAsyncDisposable, IDisposable
     /// <param name="timeout">Optional per-call timeout override.</param>
     /// <param name="pathId">Optional path ID override; defaults to <see cref="PathId"/>.</param>
     /// <returns>The typed double-precision parameter value, wrapped in a <see cref="FocasResult{T}"/>.</returns>
-    public async Task<FocasResult<double>> ReadParameterFloat64Async(short dataNumber, short axis = 0, CancellationToken cancellationToken = default, TimeSpan? timeout = null, ushort? pathId = null)
+    public async Task<FocasResult<double>> ReadParameterFloat64Async(int dataNumber, short axis = 0, CancellationToken cancellationToken = default, TimeSpan? timeout = null, ushort? pathId = null)
     {
         var result = await ReadParameterBytesAsync(dataNumber, axis, cancellationToken, timeout, pathId).ConfigureAwait(false);
         return !result.IsOk || result.Value is null || result.Value.Length < 8
@@ -582,14 +605,17 @@ public sealed class FocasWireClient : IAsyncDisposable, IDisposable
     /// <param name="pathId">Optional path ID override; defaults to <see cref="PathId"/>.</param>
     /// <returns>The macro variable value, wrapped in a <see cref="FocasResult{T}"/>.</returns>
     public Task<FocasResult<WireMacro>> ReadMacroAsync(
-        short number,
+        int number,
         CancellationToken cancellationToken = default,
         TimeSpan? timeout = null,
         ushort? pathId = null)
-        => ReadSingleWithTimeoutAsync(
-            0x0015,
+    {
+        var request = MacroRequest(number, EffectivePathId(pathId));
+        return ReadSingleWithTimeoutAsync(
+            request.Command,
             payload => ParseMacro(number, payload),
-            cancellationToken, timeout, EffectivePathId(pathId), number, number);
+            cancellationToken, timeout, request.PathId, request.Arg1, request.Arg2);
+    }
 
     /// <summary>
     ///     Decode a <c>cnc_rdmacro</c> (0x0015) payload. The on-wire <c>ODBM</c> record is 8
@@ -609,7 +635,7 @@ public sealed class FocasWireClient : IAsyncDisposable, IDisposable
     /// <param name="payload">The response-block payload.</param>
     /// <returns>The decoded macro.</returns>
     /// <exception cref="FocasWireException">The payload is shorter than 8 bytes.</exception>
-    internal static WireMacro ParseMacro(short number, byte[] payload)
+    internal static WireMacro ParseMacro(int number, byte[] payload)
     {
         RequireLength(payload, 8, "cnc_rdmacro");
         return new WireMacro(number, ReadInt32(payload, 0), ReadInt16(payload, 6));
@@ -1111,15 +1137,88 @@ public sealed class FocasWireClient : IAsyncDisposable, IDisposable
     /// <param name="count">The requested record count.</param>
     /// <returns>The decoded alarms.</returns>
     /// <exception cref="FocasWireException">The payload length matches neither record layout.</exception>
+    /// <remarks>
+    ///     <para><b>Choosing the layout.</b> The response block carries no record count, so a length that is a
+    ///     multiple of BOTH strides (1,520 B = 20 × 76 = 19 × 80, and its multiples) is ambiguous; picking the
+    ///     vendor stride on <c>Length % 76 == 0</c> alone decoded 19 legacy records as 20 garbage ones. The choice
+    ///     now uses what IS known: (1) the record count the REQUEST asked for — a reply never holds more, so a
+    ///     layout implying more records than <paramref name="count"/> is ruled out; (2) each layout's own field
+    ///     invariants, checked on every record (<see cref="LegacyRecordsValid"/> / <see cref="VendorRecordsValid"/>).
+    ///     Only when both readings remain plausible does the vendor layout win, as before.</para>
+    /// </remarks>
     internal static IReadOnlyList<WireAlarm> ParseAlarms(byte[] payload, short count)
     {
-        if (payload.Length % 76 == 0) return ParseVendorAlarms(payload, count);
-        if (payload.Length % 80 == 0) return ParseLegacyWireAlarms(payload, count);
+        if (payload.Length == 0) return [];
+        var vendor = payload.Length % VendorAlarmStride == 0 && payload.Length / VendorAlarmStride <= Math.Max((int)count, 1);
+        var legacy = payload.Length % LegacyAlarmStride == 0 && payload.Length / LegacyAlarmStride <= Math.Max((int)count, 1);
+        if (vendor && legacy)
+        {
+            // Ambiguous length: a legacy record's int32 type/axis/length fields must each fit the short they are
+            // read into and its length must fit the 64-byte message — a vendor payload read at the legacy stride
+            // fails that on its first non-empty message. Prefer the reading whose every record is self-consistent.
+            var legacyOk = LegacyRecordsValid(payload);
+            var vendorOk = VendorRecordsValid(payload);
+            if (legacyOk && !vendorOk) vendor = false;
+            else if (legacyOk && vendorOk && LengthsMatchText(payload, LegacyAlarmStride, 12, 4, 16)
+                     && !LengthsMatchText(payload, VendorAlarmStride, 10, 2, 12)) vendor = false;
+        }
+        if (vendor) return ParseVendorAlarms(payload, count);
+        if (legacy) return ParseLegacyWireAlarms(payload, count);
+        if (payload.Length % VendorAlarmStride == 0 || payload.Length % LegacyAlarmStride == 0)
+        {
+            // Fits a stride but holds more records than were requested: fall back to the stride it fits, capped
+            // at the count, exactly as before this check existed.
+            return payload.Length % VendorAlarmStride == 0
+                ? ParseVendorAlarms(payload, count)
+                : ParseLegacyWireAlarms(payload, count);
+        }
         throw new FocasWireException(
             $"cnc_rdalmmsg2 returned a {payload.Length}-byte payload, which fits neither the 76- nor the 80-byte " +
             "record layout; refusing to read it as an empty alarm list.", rc: null);
     }
 
+    private const int VendorAlarmStride = 76;
+    private const int LegacyAlarmStride = 80;
+    private const int AlarmMessageBytes = 64;
+
+    /// <summary>Every 80-byte record's int32 type / axis / length fit a short, and the length fits the message.</summary>
+    private static bool LegacyRecordsValid(byte[] payload)
+    {
+        for (var o = 0; o + LegacyAlarmStride <= payload.Length; o += LegacyAlarmStride)
+        {
+            var type = ReadInt32(payload, o + 4);
+            var axis = ReadInt32(payload, o + 8);
+            var length = ReadInt32(payload, o + 12);
+            if (type is < short.MinValue or > short.MaxValue) return false;
+            if (axis is < short.MinValue or > short.MaxValue) return false;
+            if (length is < 0 or > AlarmMessageBytes) return false;
+        }
+        return true;
+    }
+
+    /// <summary>Every 76-byte record's i16 message length fits the 64-byte message.</summary>
+    private static bool VendorRecordsValid(byte[] payload)
+    {
+        for (var o = 0; o + VendorAlarmStride <= payload.Length; o += VendorAlarmStride)
+        {
+            var length = ReadInt16(payload, o + 10);
+            if (length is < 0 or > AlarmMessageBytes) return false;
+        }
+        return true;
+    }
+
+    /// <summary>Every record's declared message length equals the length of the text actually in its message field.</summary>
+    private static bool LengthsMatchText(byte[] payload, int stride, int lengthOffset, int lengthWidth, int messageOffset)
+    {
+        for (var o = 0; o + stride <= payload.Length; o += stride)
+        {
+            var length = lengthWidth == 4 ? ReadInt32(payload, o + lengthOffset) : ReadInt16(payload, o + lengthOffset);
+            var text = FocasWireProtocol.ReadAscii(payload.AsSpan(o + messageOffset, AlarmMessageBytes));
+            if (length != text.Length) return false;
+        }
+        return true;
+    }
+
     private static IReadOnlyList<WireAlarm> ParseVendorAlarms(byte[] payload, short count)
     {
         var alarms = new List<WireAlarm>();

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/Wire/FocasWireModels.cs

@@ -170,7 +170,7 @@ public readonly record struct WireSpindleRecord(short Index, string Name);
 
 /// <summary>Parameter value returned by <c>cnc_rdparam</c>, interpreted as a scalar Int32.</summary>
 public sealed record WireParameter(
-    short DataNumber,
+    int DataNumber,
     short Type,
     int Value);
 
@@ -184,7 +184,7 @@ public sealed record WireParameter(
 /// <param name="Value">The 9-significant-digit mantissa.</param>
 /// <param name="Decimal">Implied decimal places; negative (<c>0xFFFF</c> on the wire) = vacant.</param>
 public sealed record WireMacro(
-    short Number,
+    int Number,
     int Value,
     short Decimal)
 {

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/Wire/WireFocasClient.cs

@@ -80,6 +80,7 @@ public sealed class WireFocasClient : IFocasClient
         var area = FocasPmcAreaLookup.FromLetter(letter);
         if (area is null) return (null, FocasStatusMapper.BadNodeIdUnknown);
         var dataType = FocasPmcDataTypeLookup.FromFocasDataType(slotType);
+        if (start < 0 || end > ushort.MaxValue || end < start) return (null, FocasStatusMapper.BadOutOfRange);
         try
         {
             var result = await _wire.ReadPmcRangeAsync(area.Value, dataType, (ushort)start, (ushort)end, cancellationToken)
@@ -334,18 +335,38 @@ public sealed class WireFocasClient : IFocasClient
 
     // ---- PMC / Parameter / Macro read paths ------------------------------------------
 
+    /// <summary>
+    ///     The 16-bit byte range <c>pmc_rdpmcrng</c> addresses for a slot of <paramref name="width"/> bytes at
+    ///     <paramref name="number"/>. False when any byte of it falls outside 0..65535 — the range is refused
+    ///     rather than wrapped onto a different PMC address (an Unknown-series device admits any number).
+    /// </summary>
+    /// <param name="number">The authored PMC byte address.</param>
+    /// <param name="width">The slot width in bytes (≥ 1).</param>
+    /// <param name="start">The first byte, when representable.</param>
+    /// <param name="end">The last byte, when representable.</param>
+    /// <returns>True when the whole slot is addressable.</returns>
+    internal static bool TryPmcRange(int number, int width, out ushort start, out ushort end)
+    {
+        start = end = 0;
+        var last = (long)number + Math.Max(width, 1) - 1;
+        if (number < 0 || last > ushort.MaxValue) return false;
+        start = (ushort)number;
+        end = (ushort)last;
+        return true;
+    }
+
     private async Task<(object? value, uint status)> ReadPmcAsync(
         FocasAddress address, FocasDataType type, CancellationToken cancellationToken)
     {
         var area = FocasPmcAreaLookup.FromLetter(address.PmcLetter ?? string.Empty);
         if (area is null) return (null, FocasStatusMapper.BadNodeIdUnknown);
         var dataType = FocasPmcDataTypeLookup.FromFocasDataType(type);
-        var start = (ushort)address.Number;
         // pmc_rdpmcrng returns (end-start+1) BYTES. A multi-byte slot (Word/Long/Real/Double) needs
         // the range widened to its byte width, else the value parser gets too few bytes → 0 values
         // → spurious BadOutOfRange (live-confirmed on the 31i-B: a Word read with end=start returned
         // a single byte). Bit/Byte stay width 1 so end==start. 2026-06-25.
-        var end = (ushort)(start + FocasWireClient.PmcByteWidth((short)dataType) - 1);
+        if (!TryPmcRange(address.Number, FocasWireClient.PmcByteWidth((short)dataType), out var start, out var end))
+            return (null, FocasStatusMapper.BadOutOfRange);
 
         try
         {
@@ -373,23 +394,23 @@ public sealed class WireFocasClient : IFocasClient
             switch (type)
             {
                 case FocasDataType.Byte:
-                    var b = await _wire.ReadParameterByteAsync((short)address.Number, 0, cancellationToken).ConfigureAwait(false);
+                    var b = await _wire.ReadParameterByteAsync(address.Number, 0, cancellationToken).ConfigureAwait(false);
                     return b.IsOk ? ((object)(sbyte)b.Value, FocasStatusMapper.Good) : (null, FocasStatusMapper.MapFocasReturn(b.Rc));
                 case FocasDataType.Int16:
-                    var s = await _wire.ReadParameterInt16Async((short)address.Number, 0, cancellationToken).ConfigureAwait(false);
+                    var s = await _wire.ReadParameterInt16Async(address.Number, 0, cancellationToken).ConfigureAwait(false);
                     return s.IsOk ? ((object)s.Value, FocasStatusMapper.Good) : (null, FocasStatusMapper.MapFocasReturn(s.Rc));
                 case FocasDataType.Float32:
-                    var f = await _wire.ReadParameterFloat32Async((short)address.Number, 0, cancellationToken).ConfigureAwait(false);
+                    var f = await _wire.ReadParameterFloat32Async(address.Number, 0, cancellationToken).ConfigureAwait(false);
                     return f.IsOk ? ((object)f.Value, FocasStatusMapper.Good) : (null, FocasStatusMapper.MapFocasReturn(f.Rc));
                 case FocasDataType.Float64:
-                    var d = await _wire.ReadParameterFloat64Async((short)address.Number, 0, cancellationToken).ConfigureAwait(false);
+                    var d = await _wire.ReadParameterFloat64Async(address.Number, 0, cancellationToken).ConfigureAwait(false);
                     return d.IsOk ? ((object)d.Value, FocasStatusMapper.Good) : (null, FocasStatusMapper.MapFocasReturn(d.Rc));
                 case FocasDataType.Bit when address.BitIndex is int bit:
-                    var bi = await _wire.ReadParameterInt32Async((short)address.Number, 0, cancellationToken).ConfigureAwait(false);
+                    var bi = await _wire.ReadParameterInt32Async(address.Number, 0, cancellationToken).ConfigureAwait(false);
                     if (!bi.IsOk) return (null, FocasStatusMapper.MapFocasReturn(bi.Rc));
                     return ((object)((bi.Value >> bit & 1) != 0), FocasStatusMapper.Good);
                 default:
-                    var i = await _wire.ReadParameterInt32Async((short)address.Number, 0, cancellationToken).ConfigureAwait(false);
+                    var i = await _wire.ReadParameterInt32Async(address.Number, 0, cancellationToken).ConfigureAwait(false);
                     return i.IsOk ? ((object)i.Value, FocasStatusMapper.Good) : (null, FocasStatusMapper.MapFocasReturn(i.Rc));
             }
         }
@@ -404,7 +425,7 @@ public sealed class WireFocasClient : IFocasClient
     {
         try
         {
-            var result = await _wire.ReadMacroAsync((short)address.Number, cancellationToken).ConfigureAwait(false);
+            var result = await _wire.ReadMacroAsync(address.Number, cancellationToken).ConfigureAwait(false);
             if (!result.IsOk || result.Value is null)
                 return (null, FocasStatusMapper.MapFocasReturn(result.Rc));
             return MapMacro(result.Value, type, address.BitIndex);

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT/AdsTwinCATClient.cs

@@ -469,6 +469,20 @@ internal sealed class AdsTwinCATClient : ITwinCATClient
     {
         try
         {
+            if (type is TwinCATDataType.String or TwinCATDataType.WString)
+            {
+                // A STRING / WSTRING is written as raw bytes at the PLC's own declared width, encoded by the
+                // same codec the read decodes with: Windows-1252 (or UTF-8 when the target says so) rather
+                // than the host's ANSI code page, NUL-padded so no stale tail survives, and refused
+                // (OverflowException → BadOutOfRange) when it does not fit STRING(n).
+                var (shape, _, symbol, symbolStatus) = await DescribeSymbolAsync(symbolPath, cancellationToken)
+                    .ConfigureAwait(false);
+                if (symbolStatus != TwinCATStatusMapper.Good) return symbolStatus;
+                var (planStatus, encoded) = PlanStringWrite(type, shape, value, StringsAreUtf8());
+                if (planStatus != TwinCATStatusMapper.Good) return planStatus;
+                return await WriteRawAsync(symbolPath, symbol!, encoded, cancellationToken).ConfigureAwait(false);
+            }
+
             var converted = ConvertForWrite(type, value);
             var result = await _client.WriteValueAsync(symbolPath, converted, cancellationToken)
                 .ConfigureAwait(false);
@@ -482,6 +496,123 @@ internal sealed class AdsTwinCATClient : ITwinCATClient
         }
     }
 
+    /// <summary>
+    ///     The pure encode plan of a STRING / WSTRING write against the RESOLVED symbol: the declared kind must
+    ///     match the PLC's (<see cref="TwinCATTypeGuard.CheckRead"/>, else <c>BadTypeMismatch</c>), then the value is
+    ///     encoded at the PLC's byte width by <see cref="TwinCATStringCodec"/>.
+    /// </summary>
+    /// <param name="type">The declared String / WString type.</param>
+    /// <param name="shape">The resolved PLC symbol shape.</param>
+    /// <param name="value">The written value.</param>
+    /// <param name="utf8">True when the target reports UTF-8 STRING data.</param>
+    /// <returns>Good with the bytes to write, or the refusal status with no bytes.</returns>
+    /// <exception cref="OverflowException">The value does not fit the PLC string.</exception>
+    internal static (uint status, byte[] bytes) PlanStringWrite(
+        TwinCATDataType type, TwinCATPlcSymbolShape shape, object? value, bool utf8)
+    {
+        if (TwinCATTypeGuard.CheckRead(type, shape) is not null) return (TwinCATStatusMapper.BadTypeMismatch, []);
+        var text = Convert.ToString(value, System.Globalization.CultureInfo.InvariantCulture) ?? string.Empty;
+        return (TwinCATStatusMapper.Good, type == TwinCATDataType.WString
+            ? TwinCATStringCodec.EncodeWString(text, shape.ByteSize)
+            : TwinCATStringCodec.EncodeString(text, shape.ByteSize, utf8));
+    }
+
+    /// <summary>
+    ///     The pure encode plan of an array write against the RESOLVED PLC array: the layout comes from
+    ///     <see cref="TwinCATTypeGuard.CheckArray"/> (the array read's rule, else <c>BadTypeMismatch</c>) and the
+    ///     bytes from <see cref="TwinCATArrayCodec.Encode"/>.
+    /// </summary>
+    /// <param name="type">The declared element type.</param>
+    /// <param name="elements">The converted elements.</param>
+    /// <param name="shape">The resolved PLC symbol shape.</param>
+    /// <param name="array">The resolved PLC array shape, or null for a non-array symbol.</param>
+    /// <param name="utf8">True when the target reports UTF-8 STRING data.</param>
+    /// <returns>Good with the bytes to write, or the refusal status with no bytes.</returns>
+    /// <exception cref="OverflowException">A string element does not fit its stride.</exception>
+    internal static (uint status, byte[] bytes) PlanArrayWrite(TwinCATDataType type, IReadOnlyList<object> elements,
+        TwinCATPlcSymbolShape shape, TwinCATPlcArrayShape? array, bool utf8)
+    {
+        if (TwinCATTypeGuard.CheckArray(type, elements.Count, shape, array, out var layout) is not null)
+            return (TwinCATStatusMapper.BadTypeMismatch, []);
+        return (TwinCATStatusMapper.Good, TwinCATArrayCodec.Encode(type, elements, layout, utf8));
+    }
+
+    /// <inheritdoc />
+    public async Task<uint> WriteArrayAsync(string symbolPath, TwinCATDataType type, IReadOnlyList<object> elements,
+        CancellationToken cancellationToken)
+    {
+        try
+        {
+            // Plan the layout from the RESOLVED PLC array exactly as the array read does, so the element
+            // stride (incl. a STRING(n) element's n+1) and the strict element-type rule are shared.
+            var (shape, array, symbol, symbolStatus) = await DescribeSymbolAsync(symbolPath, cancellationToken)
+                .ConfigureAwait(false);
+            if (symbolStatus != TwinCATStatusMapper.Good) return symbolStatus;
+            var (planStatus, bytes) = PlanArrayWrite(type, elements, shape, array, StringsAreUtf8());
+            if (planStatus != TwinCATStatusMapper.Good) return planStatus;
+            return await WriteRawAsync(symbolPath, symbol!, bytes, cancellationToken).ConfigureAwait(false);
+        }
+        catch (AdsErrorException ex)
+        {
+            return MapAndSignal((uint)ex.ErrorCode);
+        }
+    }
+
+    /// <inheritdoc />
+    public async Task<uint> WriteBitAsync(string parentPath, int bit, bool value, CancellationToken cancellationToken)
+    {
+        try
+        {
+            // Resolve the parent so the RMW happens at its OWN width (the notification path's model):
+            // the old 32-bit UDInt round-trip wrote a 16-bit parent's neighbours and overflowed on a
+            // signed parent with its sign bit set.
+            var (parent, _, symbol, status) = await DescribeSymbolAsync(parentPath, cancellationToken)
+                .ConfigureAwait(false);
+            if (status != TwinCATStatusMapper.Good) return status;
+            if (TwinCATBitAccess.CheckParent(bit, parent) is not null)
+                return TwinCATBitAccess.ApplyBitWrite(parent, ReadOnlySpan<byte>.Empty, bit, value, out _);
+
+            var (bytes, readStatus) = await ReadRawAsync(parentPath, symbol!, parent.ByteSize, cancellationToken)
+                .ConfigureAwait(false);
+            if (readStatus != TwinCATStatusMapper.Good) return readStatus;
+            var modify = TwinCATBitAccess.ApplyBitWrite(parent, bytes, bit, value, out var updated);
+            if (modify != TwinCATStatusMapper.Good) return modify;
+            return await WriteRawAsync(parentPath, symbol!, updated, cancellationToken).ConfigureAwait(false);
+        }
+        catch (AdsErrorException ex)
+        {
+            return MapAndSignal((uint)ex.ErrorCode);
+        }
+    }
+
+    /// <summary>
+    ///     Writes raw bytes to a resolved symbol — the mirror of <see cref="ReadRawAsync"/>: by its index
+    ///     group/offset, or through a fresh variable handle for a handle-addressed symbol (0xF005).
+    /// </summary>
+    private async Task<uint> WriteRawAsync(
+        string symbolPath, IAdsSymbol symbol, ReadOnlyMemory<byte> data, CancellationToken cancellationToken)
+    {
+        if (symbol.IndexGroup != SymbolValueByHandle)
+        {
+            var direct = await _client.WriteAsync(symbol.IndexGroup, symbol.IndexOffset, data, cancellationToken)
+                .ConfigureAwait(false);
+            return direct.ErrorCode == AdsErrorCode.NoError ? TwinCATStatusMapper.Good : MapAndSignal((uint)direct.ErrorCode);
+        }
+
+        var handle = await _client.CreateVariableHandleAsync(symbolPath, cancellationToken).ConfigureAwait(false);
+        if (handle.ErrorCode != AdsErrorCode.NoError) return MapAndSignal((uint)handle.ErrorCode);
+        try
+        {
+            var write = await _client.WriteAsync(handle.Handle, data, cancellationToken).ConfigureAwait(false);
+            return write.ErrorCode == AdsErrorCode.NoError ? TwinCATStatusMapper.Good : MapAndSignal((uint)write.ErrorCode);
+        }
+        finally
+        {
+            try { await _client.DeleteVariableHandleAsync(handle.Handle, CancellationToken.None).ConfigureAwait(false); }
+            catch { /* best-effort release */ }
+        }
+    }
+
     /// <inheritdoc />
     public async Task<bool> ProbeAsync(CancellationToken cancellationToken)
     {
@@ -523,8 +654,7 @@ internal sealed class AdsTwinCATClient : ITwinCATClient
             var (parent, _, _, parentStatus) = await DescribeSymbolAsync(registerPath, cancellationToken)
                 .ConfigureAwait(false);
             if (parentStatus != TwinCATStatusMapper.Good)
-                throw new InvalidOperationException(
-                    $"Resolving {registerPath} for a notification failed with status 0x{parentStatus:X8}");
+                throw RegistrationFailure(registerPath, "resolving the parent word", parentStatus);
             if (TwinCATBitAccess.CheckParent(bit, parent) is { } bitReason)
                 throw new TwinCATTypeMismatchException(symbolPath, bitReason);
             clrType = typeof(byte[]);
@@ -538,8 +668,7 @@ internal sealed class AdsTwinCATClient : ITwinCATClient
             var (shape, array, _, symbolStatus) = await DescribeSymbolAsync(symbolPath, cancellationToken)
                 .ConfigureAwait(false);
             if (symbolStatus != TwinCATStatusMapper.Good)
-                throw new InvalidOperationException(
-                    $"Resolving {symbolPath} for a notification failed with status 0x{symbolStatus:X8}");
+                throw RegistrationFailure(symbolPath, "resolving the symbol", symbolStatus);
 
             if (arrayCount is int count)
             {
@@ -582,8 +711,8 @@ internal sealed class AdsTwinCATClient : ITwinCATClient
             registerPath, settings, userData: null, clrType, anyTypeArgs, cancellationToken)
             .ConfigureAwait(false);
         if (result.ErrorCode != AdsErrorCode.NoError)
-            throw new InvalidOperationException(
-                $"AddDeviceNotificationExAsync failed with ADS error {result.ErrorCode} for {registerPath}");
+            throw RegistrationFailure(registerPath, $"AddDeviceNotificationEx (ADS error {result.ErrorCode})",
+                MapAndSignal((uint)result.ErrorCode));
 
         var reg = new NotificationRegistration(symbolPath, type, bitIndex, onChange, this, result.Handle)
         {
@@ -594,6 +723,17 @@ internal sealed class AdsTwinCATClient : ITwinCATClient
         return reg;
     }
 
+    /// <summary>
+    ///     Classifies a failed notification registration. A status proving the device ANSWERED (symbol not
+    ///     found, invalid access, PLC not ready, …) is a per-tag refusal the driver isolates without a health
+    ///     write; a comms-class status (<c>BadCommunicationError</c> / <c>BadTimeout</c>) stays an ordinary
+    ///     exception — a comms fault the driver degrades on and retries.
+    /// </summary>
+    internal static Exception RegistrationFailure(string symbolPath, string step, uint status) =>
+        status is TwinCATStatusMapper.BadCommunicationError or TwinCATStatusMapper.BadTimeout
+            ? new InvalidOperationException($"{step} for {symbolPath} failed with status 0x{status:X8}")
+            : new TwinCATNotificationRefusedException(symbolPath, $"{step} failed with status 0x{status:X8}", status);
+
     /// <summary>
     ///     Runs on the <see cref="AdsClient"/> AMS router thread. Does the cheap decode (bit
     ///     extraction, string, array) then enqueues — no driver logic, no consumer callbacks — so a slow consumer
@@ -618,15 +758,24 @@ internal sealed class AdsTwinCATClient : ITwinCATClient
             value = DecodeString(reg.Type, raw, reg.StringsUtf8);
         else if (TwinCATTemporalCodec.IsTemporal(reg.Type) && value is uint rawTemporal)
             value = TwinCATTemporalCodec.Decode(reg.Type, rawTemporal);
-        _notificationQueue.Writer.TryWrite(new PendingNotification(reg, value));
+        if (!_notificationQueue.Writer.TryWrite(new PendingNotification(reg, value)))
+            Interlocked.Increment(ref _droppedNotifications); // queue full (DropWrite): count, never block
     }
 
+    private long _droppedNotifications;
+
+    /// <inheritdoc />
+    public long DroppedNotificationCount => Interlocked.Read(ref _droppedNotifications);
+
     private async Task DispatchLoopAsync(CancellationToken ct)
     {
         try
         {
             await foreach (var pending in _notificationQueue.Reader.ReadAllAsync(ct).ConfigureAwait(false))
             {
+                // A value queued before its registration was deleted is purged here rather than delivered
+                // after the unsubscribe.
+                if (pending.Registration.IsDeleted) continue;
                 try { pending.Registration.OnChange(pending.Registration.SymbolPath, pending.Value); }
                 catch { /* consumer-side errors stay on this managed task, not the ADS thread */ }
             }
@@ -877,9 +1026,15 @@ internal sealed class AdsTwinCATClient : ITwinCATClient
         /// </summary>
         public void Dispose()
         {
+            IsDeleted = true;
             // Fire-and-forget AMS call — caller has already committed to the tear-down.
             _ = owner.DeleteNotificationAsync(handle, CancellationToken.None);
         }
+
+        /// <summary>Gets a value indicating whether the registration was disposed; queued values for it are dropped.</summary>
+        public bool IsDeleted { get => Volatile.Read(ref _deleted); private set => Volatile.Write(ref _deleted, value); }
+
+        private bool _deleted;
     }
 
     private static Type MapToClrType(TwinCATDataType type) => type switch
@@ -916,14 +1071,43 @@ internal sealed class AdsTwinCATClient : ITwinCATClient
         TwinCATDataType.UDInt => Convert.ToUInt32(value),
         TwinCATDataType.LInt => Convert.ToInt64(value),
         TwinCATDataType.ULInt => Convert.ToUInt64(value),
-        TwinCATDataType.Real => Convert.ToSingle(value),
-        TwinCATDataType.LReal => Convert.ToDouble(value),
+        TwinCATDataType.Real => ToSingleInRange(value),
+        TwinCATDataType.LReal => ToDoubleInRange(value),
         TwinCATDataType.String or TwinCATDataType.WString => Convert.ToString(value) ?? string.Empty,
         TwinCATDataType.Time or TwinCATDataType.Date
             or TwinCATDataType.DateTime or TwinCATDataType.TimeOfDay => TwinCATTemporalCodec.Encode(type, value),
         _ => throw new NotSupportedException($"TwinCATDataType {type} not writable."),
     };
 
+    // Convert.ToSingle(1e300) is +Infinity, and Convert.ToDouble("1e400") too: writing that to the PLC
+    // would store a value nobody wrote. A finite source that overflows the target is out of range; an
+    // explicit infinity (or NaN) passes through as the caller's own value.
+    private static float ToSingleInRange(object? value)
+    {
+        var f = Convert.ToSingle(value, System.Globalization.CultureInfo.InvariantCulture);
+        if (float.IsInfinity(f) && !IsExplicitInfinity(value))
+            throw new OverflowException($"{value} is outside the REAL range (±{float.MaxValue:R})");
+        return f;
+    }
+
+    private static double ToDoubleInRange(object? value)
+    {
+        var d = Convert.ToDouble(value, System.Globalization.CultureInfo.InvariantCulture);
+        if (double.IsInfinity(d) && !IsExplicitInfinity(value))
+            throw new OverflowException($"{value} is outside the LREAL range");
+        return d;
+    }
+
+    // An explicit infinity — a float/double infinity, or a string that SPELLS one ("Infinity", "-inf", "∞")
+    // — is the caller's own value and passes; a finite number that overflows ("1e400") does not.
+    private static bool IsExplicitInfinity(object? value) => value switch
+    {
+        float f => float.IsInfinity(f),
+        double d => double.IsInfinity(d),
+        string s => s.Contains("inf", StringComparison.OrdinalIgnoreCase) || s.Contains('∞'),
+        _ => false,
+    };
+
     private static bool ExtractBit(object? rawWord, int bit) => rawWord switch
     {
         short s => (s & (1 << bit)) != 0,

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT/ITwinCATClient.cs

@@ -102,6 +102,12 @@ public interface ITwinCATClient : IDisposable
     /// <summary>The overall ADS code of the most recent such fallback (0 = a malformed response).</summary>
     uint LastSumFallbackCode => 0;
 
+    /// <summary>
+    ///     Native notifications this client dropped because its bounded dispatch queue was full (the router
+    ///     thread never blocks on a slow consumer). The driver warns when it grows. Default 0.
+    /// </summary>
+    long DroppedNotificationCount => 0;
+
     /// <summary>
     ///     Write a symbolic value. Returns the mapped OPC UA status for the operation
     ///     (0 = Good, non-zero = error mapped via <see cref="TwinCATStatusMapper"/>).
@@ -119,6 +125,39 @@ public interface ITwinCATClient : IDisposable
         object? value,
         CancellationToken cancellationToken);
 
+    /// <summary>
+    ///     Writes an array tag: <paramref name="elements"/> (already converted to the declared element type by
+    ///     <see cref="TwinCATArrayCodec.ToWriteElements"/>) as raw bytes at the layout planned from the RESOLVED
+    ///     PLC array (<see cref="TwinCATTypeGuard.CheckArray"/>) and encoded by
+    ///     <see cref="TwinCATArrayCodec.Encode"/> — the exact inverse of the array read, so an array tag writes
+    ///     what it reads. Fewer elements than the PLC array writes its leading sub-range.
+    /// </summary>
+    /// <param name="symbolPath">The ADS symbol path of the array.</param>
+    /// <param name="type">The declared element type.</param>
+    /// <param name="elements">The converted elements (the authored <c>ArrayLength</c> of them).</param>
+    /// <param name="cancellationToken">Cancellation token for the write.</param>
+    /// <returns>The mapped OPC UA status: Good; <c>BadTypeMismatch</c> when the declared element type /
+    ///     length cannot address the PLC array; the ADS write's status otherwise.</returns>
+    /// <exception cref="OverflowException">A string element does not fit the PLC element's width.</exception>
+    Task<uint> WriteArrayAsync(string symbolPath, TwinCATDataType type, IReadOnlyList<object> elements,
+        CancellationToken cancellationToken);
+
+    /// <summary>
+    ///     Sets or clears one bit of an integer parent word — the write half of a BOOL-within-word tag
+    ///     (<c>MAIN.Flags.3</c>; ADS has no symbol for <c>WORD.N</c>). A read-modify-write of the parent's raw
+    ///     bytes at the parent's OWN resolved width (<see cref="TwinCATBitAccess.ApplyBitWrite"/>), so a 16-bit
+    ///     parent is never written as 32 bits and a signed parent's sign bit is just a bit. The caller
+    ///     serialises concurrent writers to the same parent; the PLC program writing the word between the
+    ///     read and the write is inherent to RMW.
+    /// </summary>
+    /// <param name="parentPath">The parent word's ADS symbol path (the bit path without its <c>.N</c>).</param>
+    /// <param name="bit">The bit index (0 = least significant bit of the first byte).</param>
+    /// <param name="value">The bit value to write.</param>
+    /// <param name="cancellationToken">Cancellation token for the read and the write.</param>
+    /// <returns>The mapped OPC UA status: Good; the parent read's status; <c>BadOutOfRange</c> for a bit
+    ///     beyond the parent; <c>BadTypeMismatch</c> for a parent that is not an integer word.</returns>
+    Task<uint> WriteBitAsync(string parentPath, int bit, bool value, CancellationToken cancellationToken);
+
     /// <summary>
     ///     Cheap health probe — returns <c>true</c> when the target's AMS state is reachable.
     ///     Used by <see cref="Core.Abstractions.IHostConnectivityProbe"/>'s probe loop.

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT/TwinCATArrayCodec.cs

@@ -19,6 +19,84 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.TwinCAT;
 /// </remarks>
 internal static class TwinCATArrayCodec
 {
+    /// <summary>
+    ///     Converts a client-supplied array value into exactly <paramref name="count"/> elements of the
+    ///     declared type, each converted the way a scalar write converts (<see cref="AdsTwinCATClient.ConvertForWrite"/>
+    ///     — so TIME/DATE elements become their encoded <c>uint</c>). Any CLR collection is accepted and the
+    ///     element type is CONVERTED, not exact-matched: ScadaBridge writes an <c>int[]</c> to an Int16 node.
+    /// </summary>
+    /// <param name="declared">The tag's declared element type.</param>
+    /// <param name="value">The written value — an array or list.</param>
+    /// <param name="count">The tag's authored <c>ArrayLength</c>.</param>
+    /// <returns>The converted elements, in order.</returns>
+    /// <exception cref="InvalidCastException">The value is not a collection (a scalar, a string, null), or
+    ///     an element cannot convert.</exception>
+    /// <exception cref="OverflowException">The element count differs from <paramref name="count"/>, or an
+    ///     element is outside the declared type's range.</exception>
+    public static object[] ToWriteElements(TwinCATDataType declared, object? value, int count)
+    {
+        if (value is null or string || value is not System.Collections.IEnumerable items)
+            throw new InvalidCastException(
+                $"an array tag of {count} {declared} takes an array value, not {value?.GetType().Name ?? "null"}");
+        var elements = new List<object>(count);
+        foreach (var item in items) elements.Add(AdsTwinCATClient.ConvertForWrite(declared, item));
+        if (elements.Count != count)
+            throw new OverflowException($"wrote {elements.Count} elements to an array tag of arrayLength {count}");
+        return [.. elements];
+    }
+
+    /// <summary>
+    ///     Encodes converted elements (<see cref="ToWriteElements"/>) into the PLC's raw bytes at the planned
+    ///     layout — the exact inverse of <see cref="Decode"/>: little-endian at the element stride, a
+    ///     STRING / WSTRING element encoded by <see cref="TwinCATStringCodec"/> within its fixed stride.
+    /// </summary>
+    /// <param name="declared">The tag's declared element type.</param>
+    /// <param name="elements">The converted elements; exactly <see cref="TwinCATArrayLayout.ElementCount"/>.</param>
+    /// <param name="layout">The layout planned from the PLC array (<see cref="TwinCATTypeGuard.CheckArray"/>).</param>
+    /// <param name="utf8">True when the target reports UTF-8 STRING data (else Windows-1252).</param>
+    /// <returns>Exactly <see cref="TwinCATArrayLayout.ByteLength"/> bytes.</returns>
+    /// <exception cref="ArgumentException">The element count differs from the layout.</exception>
+    /// <exception cref="OverflowException">A string element does not fit its stride.</exception>
+    public static byte[] Encode(TwinCATDataType declared, IReadOnlyList<object> elements, TwinCATArrayLayout layout, bool utf8)
+    {
+        if (layout.Stride <= 0 || elements.Count != layout.ElementCount)
+            throw new ArgumentException(
+                $"{elements.Count} elements do not match a layout of {layout.ElementCount} × {layout.Stride} B", nameof(elements));
+
+        var bytes = new byte[layout.ByteLength];
+        var stride = layout.Stride;
+        for (var i = 0; i < elements.Count; i++)
+        {
+            var slot = bytes.AsSpan(i * stride, stride);
+            var e = elements[i];
+            switch (declared)
+            {
+                case TwinCATDataType.Bool: slot[0] = Convert.ToBoolean(e) ? (byte)1 : (byte)0; break;
+                case TwinCATDataType.SInt: slot[0] = unchecked((byte)Convert.ToSByte(e)); break;
+                case TwinCATDataType.USInt: slot[0] = Convert.ToByte(e); break;
+                case TwinCATDataType.Int: BinaryPrimitives.WriteInt16LittleEndian(slot, Convert.ToInt16(e)); break;
+                case TwinCATDataType.UInt: BinaryPrimitives.WriteUInt16LittleEndian(slot, Convert.ToUInt16(e)); break;
+                case TwinCATDataType.DInt: BinaryPrimitives.WriteInt32LittleEndian(slot, Convert.ToInt32(e)); break;
+                case TwinCATDataType.UDInt or TwinCATDataType.Time or TwinCATDataType.TimeOfDay
+                    or TwinCATDataType.Date or TwinCATDataType.DateTime:
+                    BinaryPrimitives.WriteUInt32LittleEndian(slot, Convert.ToUInt32(e)); break;
+                case TwinCATDataType.LInt: BinaryPrimitives.WriteInt64LittleEndian(slot, Convert.ToInt64(e)); break;
+                case TwinCATDataType.ULInt: BinaryPrimitives.WriteUInt64LittleEndian(slot, Convert.ToUInt64(e)); break;
+                case TwinCATDataType.Real: BinaryPrimitives.WriteSingleLittleEndian(slot, Convert.ToSingle(e)); break;
+                case TwinCATDataType.LReal: BinaryPrimitives.WriteDoubleLittleEndian(slot, Convert.ToDouble(e)); break;
+                case TwinCATDataType.String:
+                    TwinCATStringCodec.EncodeString(Convert.ToString(e) ?? string.Empty, stride, utf8).CopyTo(slot);
+                    break;
+                case TwinCATDataType.WString:
+                    TwinCATStringCodec.EncodeWString(Convert.ToString(e) ?? string.Empty, stride).CopyTo(slot);
+                    break;
+                default:
+                    throw new NotSupportedException($"TwinCATDataType {declared} has no array element encoding");
+            }
+        }
+        return bytes;
+    }
+
     /// <summary>Decodes <paramref name="layout"/>.ElementCount elements of <paramref name="declared"/>.</summary>
     /// <param name="declared">The tag's declared element type.</param>
     /// <param name="bytes">The PLC bytes from the array's first element (at least <see cref="TwinCATArrayLayout.ByteLength"/>).</param>

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT/TwinCATBitAccess.cs

@@ -32,6 +32,36 @@ internal static class TwinCATBitAccess
             : $"bit {bit} is outside the {parent.ByteSize * 8}-bit parent {parent.TypeName}";
     }
 
+    /// <summary>
+    ///     The modify step of a bit write's read-modify-write: checks the bit against the parent
+    ///     (<see cref="CheckParent"/>) and returns the parent's bytes — exactly <c>parent.ByteSize</c> of them —
+    ///     with one bit set or cleared. Works on raw bytes, so the parent's width and signedness play no part.
+    /// </summary>
+    /// <param name="parent">The parent symbol's resolved shape.</param>
+    /// <param name="current">The parent's current bytes as read from the PLC.</param>
+    /// <param name="bit">The bit index.</param>
+    /// <param name="value">The bit value.</param>
+    /// <param name="updated">The bytes to write back when the result is Good; otherwise empty.</param>
+    /// <returns>Good; <c>BadOutOfRange</c> for a bit beyond the parent; <c>BadTypeMismatch</c> for a parent
+    ///     that is not an integer word; <c>BadCommunicationError</c> for a read shorter than the parent
+    ///     (writing it back would zero the missing bytes).</returns>
+    public static uint ApplyBitWrite(TwinCATPlcSymbolShape parent, ReadOnlySpan<byte> current, int bit, bool value,
+        out byte[] updated)
+    {
+        updated = [];
+        if (CheckParent(bit, parent) is not null)
+            return parent.Kind != TwinCATPlcKind.Scalar || parent.IsFloat
+                ? TwinCATStatusMapper.BadTypeMismatch
+                : TwinCATStatusMapper.BadOutOfRange;
+        if (current.Length < parent.ByteSize) return TwinCATStatusMapper.BadCommunicationError;
+
+        var bytes = current[..parent.ByteSize].ToArray();
+        var mask = (byte)(1 << (bit % 8));
+        bytes[bit / 8] = value ? (byte)(bytes[bit / 8] | mask) : (byte)(bytes[bit / 8] & ~mask);
+        updated = bytes;
+        return TwinCATStatusMapper.Good;
+    }
+
     /// <summary>Reads bit <paramref name="bit"/> of a little-endian parent word.</summary>
     /// <param name="parent">The parent word's raw bytes.</param>
     /// <param name="bit">The bit index (0 = least significant bit of the first byte).</param>

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT/TwinCATStringCodec.cs

@@ -50,6 +50,57 @@ internal static class TwinCATStringCodec
         return (utf8 ? Encoding.UTF8 : Windows1252).GetString(bytes);
     }
 
+    // Strict encoders for the WRITE side: a character the target encoding cannot hold is refused rather
+    // than silently replaced with '?' (the replacement would be written to the PLC as if it were the value).
+    private static readonly Encoding StrictWindows1252 = CreateStrict(Windows1252.CodePage);
+    private static readonly Encoding StrictUtf8 = new UTF8Encoding(encoderShouldEmitUTF8Identifier: false, throwOnInvalidBytes: true);
+    private static readonly Encoding StrictUtf16 = new UnicodeEncoding(bigEndian: false, byteOrderMark: false, throwOnInvalidBytes: true);
+
+    private static Encoding CreateStrict(int codePage) =>
+        Encoding.GetEncoding(codePage, EncoderFallback.ExceptionFallback, DecoderFallback.ReplacementFallback);
+
+    /// <summary>
+    ///     Encodes a value into an IEC <c>STRING(n)</c> buffer of the PLC's declared width (n+1 bytes): the
+    ///     inverse of <see cref="DecodeString"/> — Windows-1252 unless <paramref name="utf8"/>, NUL-terminated
+    ///     and NUL-padded so no stale tail of a longer earlier value survives.
+    /// </summary>
+    /// <param name="value">The value to write.</param>
+    /// <param name="byteWidth">The PLC symbol's byte width (n+1 for a <c>STRING(n)</c>).</param>
+    /// <param name="utf8">True when the target reports UTF-8 string data.</param>
+    /// <returns>Exactly <paramref name="byteWidth"/> bytes.</returns>
+    /// <exception cref="OverflowException">The value does not fit <c>STRING(n)</c>, or holds a character the
+    ///     target encoding cannot represent.</exception>
+    public static byte[] EncodeString(string value, int byteWidth, bool utf8) =>
+        Encode(value, byteWidth, utf8 ? StrictUtf8 : StrictWindows1252, terminatorBytes: 1, "STRING");
+
+    /// <summary>
+    ///     Encodes a value into an IEC <c>WSTRING(n)</c> buffer (UTF-16LE, 2(n+1) bytes): the inverse of
+    ///     <see cref="DecodeWString"/>, terminated by an aligned <c>U+0000</c> and zero-padded.
+    /// </summary>
+    /// <param name="value">The value to write.</param>
+    /// <param name="byteWidth">The PLC symbol's byte width.</param>
+    /// <returns>Exactly <paramref name="byteWidth"/> bytes.</returns>
+    /// <exception cref="OverflowException">The value does not fit <c>WSTRING(n)</c>.</exception>
+    public static byte[] EncodeWString(string value, int byteWidth) =>
+        Encode(value, byteWidth, StrictUtf16, terminatorBytes: 2, "WSTRING");
+
+    private static byte[] Encode(string value, int byteWidth, Encoding encoding, int terminatorBytes, string kind)
+    {
+        ArgumentNullException.ThrowIfNull(value);
+        byte[] encoded;
+        try { encoded = encoding.GetBytes(value); }
+        catch (ArgumentException ex) // EncoderFallbackException: a character the encoding cannot hold
+        {
+            throw new OverflowException($"'{value}' cannot be represented in the PLC's {kind} encoding: {ex.Message}", ex);
+        }
+        if (encoded.Length + terminatorBytes > byteWidth)
+            throw new OverflowException(
+                $"'{value}' is {encoded.Length} B but the PLC {kind} holds {Math.Max(0, byteWidth - terminatorBytes)} B");
+        var buffer = new byte[byteWidth];
+        encoded.CopyTo(buffer, 0);
+        return buffer;
+    }
+
     /// <summary>Decodes an IEC <c>WSTRING(n)</c> buffer (UTF-16LE): ends at the first aligned <c>U+0000</c>.</summary>
     /// <param name="bytes">The raw symbol bytes (2(n+1) for a <c>WSTRING(n)</c>).</param>
     /// <returns>The decoded value.</returns>