docs: within-timestamp tie-cluster paging + AbCip/TwinCAT UDT member discovery

docs/drivers/TwinCAT.md

@@ -154,6 +154,48 @@ on PLC re-download (unchanged semantics from scalar nodes).
 See [Uns.md §Array tags](../Uns.md#array-tags-1-d) for the cross-driver coverage matrix
 and the UI authoring flow.
 
+## Controller-discovered struct/UDT/FB member variables
+
+When `EnableControllerBrowse` is set, `BrowseSymbolsAsync` walks the device's symbol tree
+recursively and expands **Struct / UDT / Function-Block typed symbols** into their **atomic
+member leaves** as individually addressable OPC UA Variables, surfaced under the `Discovered/`
+sub-folder.
+
+### What is discovered
+
+- Each symbol of a struct, UDT, or FB type is recursively expanded. The walk follows the ADS
+  symbol tree's `SubSymbols` collection.
+- **Full instance paths** are preserved for every leaf (e.g. `MAIN.Motor.Speed`,
+  `GVL.Drive1.Status.Running`).
+- The recursion is **depth-capped at 8 levels** to guard against pathological or circular-like
+  layouts.
+- **Unsupported leaves** (types the driver cannot map to an OPC UA data type) are silently
+  dropped rather than surfaced as error nodes.
+
+### Pre-declared Structure-typed tags
+
+Pre-declared `Tags` with a `DataType` of `Structure` are **still rejected** — the driver cannot
+read an opaque struct blob without knowing its member layout. For structs that must be
+individually addressed, use `EnableControllerBrowse` to let the driver discover the member
+layout from the controller's symbol table, rather than pre-declaring the container tag.
+
+### Member writes
+
+Discovered struct/UDT/FB member **writes** are **deferred** in this release. Scalar atomic
+members can be written when pre-declared with `Writable: true`; the controller-browse expansion
+path does not yet wire the write channel.
+
+### Live caveat — Flat-mode vs VirtualTree-mode browse
+
+The ADS client's `BrowseSymbolsAsync` may return symbols in **Flat mode** (a flat list of all
+instance paths, with no `SubSymbols` populated) on some TC3 runtime configurations, in which
+case the recursive struct expansion produces no sub-symbols and the walk yields only top-level
+symbols. If a live TC3 browse does not populate `SubSymbols` on struct-typed symbols, the
+alternative is **VirtualTree mode** (which returns a hierarchical symbol tree with `SubSymbols`
+populated). VirtualTree-mode browse is an unverified follow-up; if Flat-mode struct expansion
+produces empty `Discovered/` sub-folders for struct symbols, switch to VirtualTree mode via the
+driver configuration.
+
 ## Further reading
 
 - [`docs/v2/driver-specs.md §6`](../v2/driver-specs.md) — full per-field spec and