docs: within-timestamp tie-cluster paging + AbCip/TwinCAT UDT member discovery

docs/drivers/AbCip.md

@@ -119,6 +119,43 @@ integration fixture is down during normal dev (Docker host fixture currently off
 See [Uns.md §Array tags](../Uns.md#array-tags-1-d) for the cross-driver coverage matrix
 and the UI authoring flow.
 
+## Controller-discovered UDT member variables
+
+When `EnableControllerBrowse` is set, the driver walks the controller's `@tags` symbol table and
+surfaces each UDT-typed tag's **atomic member leaves** as individually addressable OPC UA
+Variables — in addition to the UDT container tag itself.
+
+### What is discovered
+
+- **Top-level UDT members** — the Template Object for each controller-browse UDT is fetched via
+  its template instance ID; each atomic member (BOOL, SINT, INT, DINT, REAL, …) becomes a
+  separate Variable node under the UDT's `Discovered/` sub-folder, addressable by its member
+  path (e.g. `MyUdt.Temperature`, `MyUdt.Flags`). Top-level atomic member discovery is
+  **functional in production**.
+- **Nested struct members** — when a UDT member is itself a struct, the driver walks into it up
+  to a **depth cap of 8 levels**. Nested-struct expansion is a **documented deferral in
+  production**: the Template Object member block carries no nested template ID, so the
+  sub-shape cannot be re-fetched from the controller at discovery time. Nested struct leaves are
+  never mis-emitted — they are simply dropped (the parent member is omitted from discovery if it
+  is not atomic and its sub-shape is unavailable). Use pre-declared `Members` for nested structs
+  that must be individually addressed.
+
+### Bare-container reads
+
+Reading the UDT container tag itself (without a member suffix) returns
+`BadNotSupported` — address the atomic member leaves instead.
+
+### Member writes
+
+UDT member **writes** discovered via controller browse are **deferred** in this release.
+Pre-declared `Members` with `Writable: true` retain full read/write support as before.
+
+### Configuration
+
+No new configuration keys are required. Set `EnableControllerBrowse: true` in the
+`AbCipDriverOptions` JSON to enable the `@tags` walk; UDT member expansion is automatic for all
+UDT-typed tags found in the walk.
+
 ## Operational Notes
 
 - **Native heap is invisible to the GC.** `GetMemoryFootprint()` reports CLR allocations only; libplctag's native `Tag` heap does not show up there. Watch whole-process RSS, and use `ReinitializeAsync` (tears down + re-creates every device's libplctag handles) as the remediation for native-heap growth.