Merge commit '7feffc96' into remed/lane-Modbus

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli/AbLegacyCommandBase.cs

@@ -32,6 +32,27 @@ public abstract class AbLegacyCommandBase : DriverCommandBase
         "LogixPccc unverified).")]
     public AbLegacyCliTransport Transport { get; init; } = AbLegacyCliTransport.Default;
 
+    /// <summary>
+    ///     Runs a one-shot command's driver work so a Ctrl-C (cancellation of <paramref name="ct"/>) prints
+    ///     <c>Cancelled.</c> instead of an unhandled <see cref="OperationCanceledException"/> stack trace (review 07 U7).
+    ///     Any other exception — and an OCE the operator did not ask for — still propagates.
+    /// </summary>
+    /// <param name="console">The CLI console.</param>
+    /// <param name="ct">The console's Ctrl-C token.</param>
+    /// <param name="body">The command body.</param>
+    /// <returns>A task that completes when the body has finished or was cancelled.</returns>
+    internal static async ValueTask RunCancellableAsync(CliFx.Infrastructure.IConsole console, CancellationToken ct, Func<Task> body)
+    {
+        try
+        {
+            await body();
+        }
+        catch (OperationCanceledException) when (ct.IsCancellationRequested)
+        {
+            await console.Error.WriteLineAsync("Cancelled.");
+        }
+    }
+
     /// <summary>Gets the per-operation timeout in milliseconds.</summary>
     [CommandOption("timeout-ms", Description = "Per-operation timeout in ms (default 5000).")]
     public int TimeoutMs { get; init; } = 5000;

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli/Commands/ProbeCommand.cs

@@ -43,17 +43,20 @@ public sealed class ProbeCommand : AbLegacyCommandBase
         var driver = new AbLegacyDriver(options, DriverInstanceId);
         try
         {
-            await driver.InitializeAsync("{}", ct);
-            var snapshot = await driver.ReadAsync(["__probe"], ct);
-            var health = driver.GetHealth();
+            await RunCancellableAsync(console, ct, async () =>
+            {
+                await driver.InitializeAsync("{}", ct);
+                var snapshot = await driver.ReadAsync(["__probe"], ct);
+                var health = driver.GetHealth();
 
-            await console.Output.WriteLineAsync($"Gateway:      {Gateway}");
-            await console.Output.WriteLineAsync($"PLC type:     {PlcType}");
-            await console.Output.WriteLineAsync($"Health:       {health.State}");
-            if (health.LastError is { } err)
-                await console.Output.WriteLineAsync($"Last error:   {err}");
-            await console.Output.WriteLineAsync();
-            await console.Output.WriteLineAsync(SnapshotFormatter.Format(Address, snapshot[0]));
+                await console.Output.WriteLineAsync($"Gateway:      {Gateway}");
+                await console.Output.WriteLineAsync($"PLC type:     {PlcType}");
+                await console.Output.WriteLineAsync($"Health:       {health.State}");
+                if (health.LastError is { } err)
+                    await console.Output.WriteLineAsync($"Last error:   {err}");
+                await console.Output.WriteLineAsync();
+                await console.Output.WriteLineAsync(SnapshotFormatter.Format(Address, snapshot[0]));
+            });
         }
         finally
         {

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli/Commands/ReadCommand.cs

@@ -45,9 +45,12 @@ public sealed class ReadCommand : AbLegacyCommandBase
         var driver = new AbLegacyDriver(options, DriverInstanceId);
         try
         {
-            await driver.InitializeAsync("{}", ct);
-            var snapshot = await driver.ReadAsync([tagName], ct);
-            await console.Output.WriteLineAsync(SnapshotFormatter.Format(Address, snapshot[0]));
+            await RunCancellableAsync(console, ct, async () =>
+            {
+                await driver.InitializeAsync("{}", ct);
+                var snapshot = await driver.ReadAsync([tagName], ct);
+                await console.Output.WriteLineAsync(SnapshotFormatter.Format(Address, snapshot[0]));
+            });
         }
         finally
         {

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli/Commands/WriteCommand.cs

@@ -55,9 +55,12 @@ public sealed class WriteCommand : AbLegacyCommandBase
         var driver = new AbLegacyDriver(options, DriverInstanceId);
         try
         {
-            await driver.InitializeAsync("{}", ct);
-            var results = await driver.WriteAsync([new WriteRequest(tagName, parsed)], ct);
-            await console.Output.WriteLineAsync(SnapshotFormatter.FormatWrite(Address, results[0]));
+            await RunCancellableAsync(console, ct, async () =>
+            {
+                await driver.InitializeAsync("{}", ct);
+                var results = await driver.WriteAsync([new WriteRequest(tagName, parsed)], ct);
+                await console.Output.WriteLineAsync(SnapshotFormatter.FormatWrite(Address, results[0]));
+            });
         }
         finally
         {

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Contracts/AbLegacyDriverOptions.cs

@@ -48,6 +48,16 @@ public sealed class AbLegacyDriverOptions
     /// <summary>Gets or sets the default timeout for read/write operations.</summary>
     public TimeSpan Timeout { get; init; } = TimeSpan.FromSeconds(2);
 
+    /// <summary>
+    ///     Whether scalar tags on adjacent elements of one N / B / F / L file are read as ONE multi-element PCCC read
+    ///     (driver-config key <c>coalesceReads</c>, default <see langword="true"/>). A block the device refuses falls
+    ///     back to per-tag reads on its own; set this false to read every tag singly. <see langword="null"/> (the key
+    ///     absent) means the default, ON - and null is never written, so a save through any serializer (the AdminUI
+    ///     form included) keeps a defaulted driver defaulted instead of pinning today's default (review 07 r0 M9).
+    /// </summary>
+    [System.Text.Json.Serialization.JsonIgnore(Condition = System.Text.Json.Serialization.JsonIgnoreCondition.WhenWritingNull)]
+    public bool? CoalesceReads { get; init; }
+
     /// <summary>
     ///     Timeout for the AdminUI Test Connect probe, in seconds. The AdminUI clamps to a
     ///     60s server-side maximum; this default is what the form pre-fills for new instances.

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Contracts/AbLegacyTagDefinitionFactory.cs

@@ -77,6 +77,10 @@ public static class AbLegacyTagDefinitionFactory
                 if (rawLength >= 1)
                     arrayLength = Math.Min(rawLength, AbLegacyArray.MaxElements);
             }
+            // A deterministic refusal (review 07 H16): String / Timer / Counter / Control elements are structured
+            // or variable-width and do not lay out as a flat array, so both runtimes refuse to decode them. Accepting
+            // the tag only bought a handle create + a NotSupportedException on every poll.
+            if (arrayLength is not null && !IsArrayElementTypeSupported(dataType)) return false;
             // "writable" defaults to true when absent (today's value) — makes read-only equipment tags
             // authorable.
             var writable = TagConfigJson.ReadWritable(root);
@@ -173,6 +177,9 @@ public static class AbLegacyTagDefinitionFactory
         {
             if (AbLegacyAddress.Validate(accepted.Address, family) is { } addressError)
                 warnings.Add($"AbLegacy tag address: {addressError} The driver reads this tag as BadNodeIdUnknown.");
+            else if (accepted.ArrayLength is not null
+                     && ArrayFileMismatch(accepted.DataType, accepted.Address) is { } widthError)
+                warnings.Add(widthError);
             return warnings;
         }
 
@@ -224,6 +231,78 @@ public static class AbLegacyTagDefinitionFactory
         }
 
         if (TagConfigJson.DescribeInvalidEnum<AbLegacyDataType>(root, "dataType") is { } w) warnings.Add(w);
+
+        if (IsArrayFlag(root) && ReadInt(root, "arrayLength") >= 1
+            && TagConfigJson.TryReadEnumStrict(root, "dataType", AbLegacyDataType.Int, out var dt)
+            && !IsArrayElementTypeSupported(dt))
+            warnings.Add(ArrayElementTypeError(dt));
+    }
+
+    /// <summary>
+    ///     Whether <paramref name="type"/> can be the element type of an array tag. Only the flat word/long/float/bit
+    ///     files lay out as a contiguous array; String, Timer, Counter and Control elements are structured.
+    /// </summary>
+    /// <param name="type">The authored element data type.</param>
+    /// <returns><see langword="true"/> for Bit, Int, AnalogInt, Long and Float.</returns>
+    public static bool IsArrayElementTypeSupported(AbLegacyDataType type) => type is
+        AbLegacyDataType.Bit or AbLegacyDataType.Int or AbLegacyDataType.AnalogInt
+        or AbLegacyDataType.Long or AbLegacyDataType.Float;
+
+    /// <summary>The authoring / deploy-gate message for an array of an unsupported element type.</summary>
+    /// <param name="type">The authored element data type.</param>
+    /// <returns>The message.</returns>
+    public static string ArrayElementTypeError(AbLegacyDataType type) =>
+        $"AbLegacy {type} is not supported as an array element (String, Timer, Counter and Control elements are "
+        + "structured); author a scalar tag per element instead. The driver skips this tag and it reads BadNodeIdUnknown.";
+
+    /// <summary>
+    ///     The element width an array on <paramref name="address"/>'s data file has, as the data type that decodes /
+    ///     encodes it: N, B, A and the I/O/S word files are 16-bit words (<see cref="AbLegacyDataType.Int"/>), L is
+    ///     32-bit (<see cref="AbLegacyDataType.Long"/>), F is IEEE float (<see cref="AbLegacyDataType.Float"/>).
+    ///     <see langword="null"/> for a file with no flat array layout (ST, T, C, R, function files) or an address that
+    ///     does not parse.
+    /// </summary>
+    /// <param name="address">The authored address.</param>
+    /// <returns>The file's element type, or <see langword="null"/>.</returns>
+    public static AbLegacyDataType? ArrayFileElementType(string address) =>
+        AbLegacyAddress.TryParse(address) is { } a ? ArrayFileElementType(a) : null;
+
+    /// <inheritdoc cref="ArrayFileElementType(string)"/>
+    public static AbLegacyDataType? ArrayFileElementType(AbLegacyAddress a) => a.FileLetter switch
+    {
+        "N" or "B" or "A" or "I" or "O" or "S" => AbLegacyDataType.Int,
+        "L" => AbLegacyDataType.Long,
+        "F" => AbLegacyDataType.Float,
+        _ => null,
+    };
+
+    /// <summary>
+    ///     Why an ARRAY authored as <paramref name="type"/> on <paramref name="address"/> does not match its data
+    ///     file's element width (review 07 r0 I3), or <see langword="null"/> when it does. Int / AnalogInt need a 16-bit
+    ///     word file (N/B/A/I/O/S), Long an L file, Float an F file; Bit arrays are bit-packed words and fit any 16-bit
+    ///     word file. A mismatch reads the file at the wrong width (garbage) and the driver refuses to WRITE it
+    ///     (<c>BadTypeMismatch</c>), because encoding at the authored width would corrupt the neighbouring elements.
+    /// </summary>
+    /// <param name="type">The authored element data type.</param>
+    /// <param name="address">The authored address.</param>
+    /// <returns>The mismatch message, or <see langword="null"/>.</returns>
+    public static string? ArrayFileMismatch(AbLegacyDataType type, string address)
+    {
+        if (!IsArrayElementTypeSupported(type)) return null; // structured arrays have their own refusal
+        // The file LETTER is static even for an indirect address (N7:[N7:0], N[N7:0]:5) — only the numbers move —
+        // so the width rule applies to it too (review 07 r1 N5).
+        if (AbLegacyAddress.TryParse(address) is not { } a) return null;
+        var file = ArrayFileElementType(a);
+        var ok = type switch
+        {
+            AbLegacyDataType.Int or AbLegacyDataType.AnalogInt or AbLegacyDataType.Bit => file == AbLegacyDataType.Int,
+            _ => file == type,
+        };
+        return ok
+            ? null
+            : $"AbLegacy {type} array on '{address}' does not match the {a.FileLetter} file's element width "
+              + "(Int/AnalogInt/Bit need an N/B/A word file, Long an L file, Float an F file): reads decode the wrong width "
+              + "and writes are refused BadTypeMismatch.";
     }
 
     private static int ReadInt(JsonElement o, string name)

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/AbLegacyArrayWriteEncoder.cs

@@ -0,0 +1,79 @@
+using System.Collections;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy;
+
+/// <summary>
+///     Converts an OPC UA array-write value into the element-typed CLR array a runtime's
+///     <see cref="IAbLegacyTagRuntime.EncodeArray"/> takes. Pure: it runs BEFORE any runtime is created, so a refused
+///     write never costs a wire round trip and never touches driver health.
+/// </summary>
+/// <remarks>
+///     <para><b>Elements are converted, not exact-matched.</b> ScadaBridge writes CLR lists such as <c>int[]</c> to
+///     Int16 nodes, and an OPC UA client may send any numeric array, so each element goes through the same checked
+///     <see cref="Convert"/> the scalar path uses. A value that does not fit is <c>BadOutOfRange</c>; one that is not
+///     a number at all is <c>BadTypeMismatch</c>.</para>
+///     <para><b>The length must equal the tag's element count</b> (<c>BadOutOfRange</c> otherwise): a shorter write
+///     would have to fill the tail from the last read buffer, which is the stale-elements defect this replaces.</para>
+///     <para><b>Bit arrays are refused</b> (<c>BadNotSupported</c>): a PCCC bit array is bit-packed into words, so
+///     encoding it rewrites whole words and would clobber neighbouring bits the PLC owns. String / Timer / Counter /
+///     Control arrays never reach here — the mapper rejects them.</para>
+/// </remarks>
+internal static class AbLegacyArrayWriteEncoder
+{
+    /// <summary>Converts <paramref name="value"/> to a typed array of exactly <paramref name="count"/> elements.</summary>
+    /// <param name="type">The tag's element data type.</param>
+    /// <param name="value">The value the client wrote.</param>
+    /// <param name="count">The tag's element count.</param>
+    /// <param name="typed">The converted array when the result is Good.</param>
+    /// <returns><see cref="AbLegacyStatusMapper.Good"/>, or the Bad status the write is answered with.</returns>
+    public static uint TryConvert(AbLegacyDataType type, object? value, int count, out Array? typed)
+    {
+        typed = null;
+        if (type is AbLegacyDataType.Bit) return AbLegacyStatusMapper.BadNotSupported;
+        if (type is not (AbLegacyDataType.Int or AbLegacyDataType.AnalogInt or AbLegacyDataType.Long or AbLegacyDataType.Float))
+            return AbLegacyStatusMapper.BadNotSupported;
+        if (value is null or string || value is not IEnumerable items) return AbLegacyStatusMapper.BadTypeMismatch;
+
+        var elements = items.Cast<object?>().ToList();
+        if (elements.Count != count) return AbLegacyStatusMapper.BadOutOfRange;
+        try
+        {
+            switch (type)
+            {
+                case AbLegacyDataType.Long:
+                {
+                    var a = new int[count];
+                    for (var i = 0; i < count; i++) a[i] = Convert.ToInt32(Element(elements[i]));
+                    typed = a;
+                    break;
+                }
+                case AbLegacyDataType.Float:
+                {
+                    var a = new float[count];
+                    for (var i = 0; i < count; i++) a[i] = Convert.ToSingle(Element(elements[i]));
+                    typed = a;
+                    break;
+                }
+                default:
+                {
+                    var a = new short[count];
+                    for (var i = 0; i < count; i++) a[i] = Convert.ToInt16(Element(elements[i]));
+                    typed = a;
+                    break;
+                }
+            }
+            return AbLegacyStatusMapper.Good;
+        }
+        catch (OverflowException) { return AbLegacyStatusMapper.BadOutOfRange; }
+        catch (Exception ex) when (ex is FormatException or InvalidCastException) { return AbLegacyStatusMapper.BadTypeMismatch; }
+    }
+
+    // A string element is not a number: Convert.ToInt16("12") would PARSE it, which no OPC UA numeric array carries.
+    private static object Element(object? e) => e switch
+    {
+        null => throw new InvalidCastException("null array element"),
+        string => throw new InvalidCastException("string array element"),
+        bool => throw new InvalidCastException("bool array element"),
+        _ => e,
+    };
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/AbLegacyDriver.Coalescing.cs

@@ -0,0 +1,250 @@
+using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.Ab.Transport;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy;
+
+/// <summary>
+///     Adjacent-element read coalescing (review 07 P7): scalar tags on the same N / B / F / L data file whose
+///     elements are close together are read as ONE multi-element PCCC read (the same path array tags already use),
+///     then each tag is decoded from its offset in the block. One round trip instead of one per tag.
+/// </summary>
+/// <remarks>
+///     <para><b>Only shapes the single-tag path decodes identically are coalesced</b>: a word tag
+///     (<c>Int</c>/<c>AnalogInt</c>) or a bit of a word (<c>Bit</c>, with or without <c>/n</c>) on an N or B file; a
+///     <c>Float</c> on an F file; a <c>Long</c> or a bit of a long on an L file. Indirect addresses, sub-elements
+///     (<c>T4:0.ACC</c>), arrays, the file-number-less system files (<c>S:</c>, <c>I:</c>, <c>O:</c>) and any tag
+///     authored with a type that does not match its file's element width keep the single-tag path, so a
+///     mis-authored tag still gets exactly the answer it got before.</para>
+///     <para><b>The span is safe to read.</b> A block runs from its lowest to its highest member, so every element
+///     it reads lies between two authored elements of the same file — inside the file whenever the authored tags
+///     are. A device REFUSAL of a block (an authored element past the end of the file, a PLC-5 native non-N file)
+///     — or ANY other status the device returned, incl. libplctag's remote error — falls back to single reads for that
+///     block's members in the same pass, so one bad tag never blackens its neighbours; a shape refused twice in a row
+///     is remembered so it is not retried every poll. Only a NO-REPLY failure fails the members together — they
+///     share the connection — exactly as their single reads would have.</para>
+///     <para>Turned off with the driver-config key <c>coalesceReads: false</c>.</para>
+/// </remarks>
+public sealed partial class AbLegacyDriver
+{
+    /// <summary>Largest block, in data bytes. Below the 236-byte PCCC typed-read limit, so libplctag never needs
+    /// to fragment a coalesced read (the native runtime would chunk it anyway).</summary>
+    internal const int MaxCoalescedBytes = 200;
+
+    /// <summary>Largest run of UNAUTHORED elements a block may read across to join two members.</summary>
+    internal const int MaxCoalesceGap = 8;
+
+    /// <summary>One unit of a device pass: a single tag, or a coalesced block of several.</summary>
+    private sealed record ReadUnit(ReadItem? Single, CoalescedBlock? Block);
+
+    /// <summary>A coalesced block: <paramref name="Count"/> elements of one file from <paramref name="Start"/>.</summary>
+    private sealed record CoalescedBlock(
+        string FileLetter, int FileNumber, int Start, int Count, AbLegacyDataType ElementType, List<ReadItem> Members)
+    {
+        /// <summary>The runtime-cache key; distinct from any RawPath (RawPaths never contain '|').</summary>
+        public string Key => $"|block|{FileLetter}{FileNumber}:{Start}+{Count}";
+
+        /// <summary>The block's base address in libplctag form.</summary>
+        public string StartName => $"{FileLetter}{FileNumber}:{Start}";
+    }
+
+    /// <summary>
+    ///     The element type a scalar tag is decoded from when it rides a coalesced block, or <see langword="null"/>
+    ///     when the tag keeps the single-tag path.
+    /// </summary>
+    private static AbLegacyDataType? CoalescedElementType(ReadItem item)
+    {
+        var a = item.Parsed;
+        if (a.IsIndirect || a.SubElement is not null || a.FileNumber is null || IsArrayTag(item.Def)) return null;
+        return (a.FileLetter, item.Def.DataType) switch
+        {
+            ("N" or "B", AbLegacyDataType.Int or AbLegacyDataType.AnalogInt or AbLegacyDataType.Bit) => AbLegacyDataType.Int,
+            ("F", AbLegacyDataType.Float) => AbLegacyDataType.Float,
+            ("L", AbLegacyDataType.Long) => AbLegacyDataType.Long,
+            ("L", AbLegacyDataType.Bit) when a.BitIndex is not null => AbLegacyDataType.Long,
+            _ => null,
+        };
+    }
+
+    /// <summary>
+    ///     Plans a device pass: coalescable tags grouped per file into runs of nearby elements (a run of two or more
+    ///     tags becomes a block), everything else a single unit. Block shapes the device refused before stay single.
+    /// </summary>
+    private List<ReadUnit> PlanReadUnits(DeviceState device, List<ReadItem> items)
+    {
+        if (_options.CoalesceReads == false || items.Count < 2) return [.. items.Select(i => new ReadUnit(i, null))];
+
+        var units = new List<ReadUnit>(items.Count);
+        var groups = new Dictionary<(string Letter, int File, AbLegacyDataType Type), List<ReadItem>>();
+        foreach (var item in items)
+        {
+            if (CoalescedElementType(item) is not { } type)
+            {
+                units.Add(new ReadUnit(item, null));
+                continue;
+            }
+            var key = (item.Parsed.FileLetter, item.Parsed.FileNumber!.Value, type);
+            if (!groups.TryGetValue(key, out var list)) groups[key] = list = [];
+            list.Add(item);
+        }
+
+        foreach (var ((letter, file, type), members) in groups)
+        {
+            var width = type == AbLegacyDataType.Int ? 2 : 4;
+            var maxElements = MaxCoalescedBytes / width;
+            var ordered = members.OrderBy(m => m.Parsed.WordNumber).ToList();
+            var run = new List<ReadItem> { ordered[0] };
+            for (var i = 1; i <= ordered.Count; i++)
+            {
+                var next = i < ordered.Count ? ordered[i] : null;
+                var start = run[0].Parsed.WordNumber;
+                if (next is not null
+                    && next.Parsed.WordNumber - run[^1].Parsed.WordNumber <= MaxCoalesceGap + 1
+                    && next.Parsed.WordNumber - start + 1 <= maxElements)
+                {
+                    run.Add(next);
+                    continue;
+                }
+                var count = run[^1].Parsed.WordNumber - start + 1;
+                var block = new CoalescedBlock(letter, file, start, count, type, run);
+                if (run.Count < 2 || device.RefusedBlocks.ContainsKey(block.Key))
+                    units.AddRange(run.Select(r => new ReadUnit(r, null)));
+                else
+                    units.Add(new ReadUnit(null, block));
+                if (next is not null) run = [next];
+            }
+        }
+        return units;
+    }
+
+    /// <summary>What a block read concluded; <see cref="Fallback"/> = read the members singly instead.</summary>
+    private enum BlockOutcome { Done, Fallback }
+
+    /// <summary>
+    ///     Reads one coalesced block and decodes each member from its offset. A device refusal or a local refusal
+    ///     returns <see cref="BlockOutcome.Fallback"/> (and remembers the shape) without writing any member's result.
+    /// </summary>
+    private async Task<(BlockOutcome Outcome, OpVerdict Verdict, string? Message)> ReadBlockAsync(
+        DeviceState device, CoalescedBlock block, DataValueSnapshot[] results, DateTime now, CancellationToken ct)
+    {
+        void FailAll(uint status)
+        {
+            foreach (var m in block.Members) results[m.Index] = new DataValueSnapshot(null, status, null, now);
+        }
+
+        (BlockOutcome, OpVerdict, string?) Refused(string why)
+        {
+            // The handle is never kept for a refused shape (review 07 r0 M5): it may never be planned again.
+            EvictRuntime(device, block.Key);
+            // Every refusal falls back to per-member reads THIS pass, so each member gets its own answer and a bad
+            // member can never black out its neighbours. The shape is only REMEMBERED after a repeat — one refusal can
+            // be transient (program mode, a download in progress), two in a row are deterministic.
+            var refusals = device.BlockRefusals.AddOrUpdate(block.Key, 1, (_, n) => n + 1);
+            if (refusals >= 2 && device.RefusedBlocks.TryAdd(block.Key, 0))
+            {
+                device.BlockRefusals.TryRemove(block.Key, out _);
+                _logger.LogInformation(
+                    "AbLegacy coalesced read {Block} refused twice ({Reason}); its {Count} tags read singly from now on. Driver={DriverInstanceId} Device={DeviceHostAddress}",
+                    block.StartName + "+" + block.Count, why, block.Members.Count, _driverInstanceId, device.Options.HostAddress);
+            }
+            return (BlockOutcome.Fallback, OpVerdict.Neutral, null);
+        }
+
+        try
+        {
+            var createParams = new AbLegacyTagCreateParams(
+                Gateway: device.ParsedAddress.Gateway,
+                Port: device.ParsedAddress.Port,
+                CipPath: device.EffectiveCipPath,
+                LibplctagPlcAttribute: device.Profile.LibplctagPlcAttribute,
+                TagName: block.StartName,
+                Timeout: _options.Timeout,
+                ElementCount: block.Count);
+            var runtime = await CreateSingleFlightAsync(
+                device, device.Runtimes, block.Key, () => _tagFactory.Create(createParams), ct).ConfigureAwait(false);
+
+            int status;
+            Array? data = null;
+            var opLock = device.GetRuntimeLock(block.Key);
+            await opLock.WaitAsync(ct).ConfigureAwait(false);
+            try
+            {
+                await runtime.ReadAsync(ct).ConfigureAwait(false);
+                status = runtime.GetStatus();
+                if (status == 0) data = runtime.DecodeArray(block.ElementType, block.Count) as Array;
+            }
+            finally
+            {
+                opLock.Release();
+            }
+
+            if (status != 0)
+            {
+                // ANY status the device returned (a refusal, a remote error, an unmapped reply, Unsupported) falls back
+                // to per-member reads; only a no-reply status fails the block's members together (review 07 r0 I1).
+                if (!IsNoReply((AbStatus)status))
+                    return Refused($"device status {(AbStatus)status}");
+                EvictRuntime(device, block.Key);
+                FailAll(AbLegacyStatusMapper.MapStatus(status));
+                return (BlockOutcome.Done, OpVerdict.Fault, $"transport status {status} reading {block.StartName}+{block.Count}");
+            }
+            if (data is null || data.Length < block.Count)
+                return Refused("the block decoded short");
+
+            foreach (var m in block.Members)
+                results[m.Index] = new DataValueSnapshot(DecodeMember(block, m, data), AbLegacyStatusMapper.Good, now, now);
+            device.BlockRefusals.TryRemove(block.Key, out _);
+            device.FirstNonZeroStatusLogged = false;
+            return (BlockOutcome.Done, OpVerdict.Answered, null);
+        }
+        catch (OperationCanceledException) { throw; }
+        catch (ConnectionThrottledException tex)
+        {
+            FailAll(AbLegacyStatusMapper.BadCommunicationError);
+            return (BlockOutcome.Done, OpVerdict.Throttled, tex.Message);
+        }
+        catch (AbTransportException ex) when (!IsNoReply(ex.Status))
+        {
+            return Refused(ex.Message);
+        }
+        catch (NotSupportedException nse)
+        {
+            return Refused(nse.Message);
+        }
+        catch (Exception ex)
+        {
+            EvictRuntime(device, block.Key);
+            FailAll(AbLegacyStatusMapper.BadCommunicationError);
+            return (BlockOutcome.Done, OpVerdict.Fault, ex.Message);
+        }
+    }
+
+    /// <summary>
+    ///     Decodes one member from the block, returning exactly the CLR type and value the single-tag path's
+    ///     <see cref="IAbLegacyTagRuntime.DecodeValue"/> would (<c>int</c> for a word or long, <c>float</c>, <c>bool</c>).
+    /// </summary>
+    private static object DecodeMember(CoalescedBlock block, ReadItem m, Array data)
+    {
+        var offset = m.Parsed.WordNumber - block.Start;
+        var bit = m.Parsed.BitIndex;
+        switch (data)
+        {
+            case short[] words:
+            {
+                var w = words[offset];
+                return m.Def.DataType == AbLegacyDataType.Bit
+                    ? ((ushort)w >> (bit ?? 0) & 1) != 0
+                    : (int)w;
+            }
+            case int[] longs:
+            {
+                var l = longs[offset];
+                return m.Def.DataType == AbLegacyDataType.Bit ? ((uint)l >> bit!.Value & 1) != 0 : l;
+            }
+            case float[] floats:
+                return floats[offset];
+            default:
+                throw new InvalidOperationException($"Unexpected block buffer {data.GetType().Name}.");
+        }
+    }
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/AbLegacyDriverFactoryExtensions.cs

@@ -97,6 +97,7 @@ public static class AbLegacyDriverFactoryExtensions
                 ProbeAddress = dto.Probe?.ProbeAddress ?? "S:0",
             },
             Timeout = PositiveTimeoutOrDefault(dto.TimeoutMs, 2_000),
+            CoalesceReads = dto.CoalesceReads,
             // Absent ⇒ null ("use the default" = Libplctag, resolved by AbLegacyTransportResolver);
             // a bad value still fails exactly as any other bad enum field does.
             Transport = string.IsNullOrWhiteSpace(dto.Transport)
@@ -157,6 +158,9 @@ public static class AbLegacyDriverFactoryExtensions
         /// </summary>
         public string? Transport { get; init; }
 
+        /// <summary>Gets or sets whether adjacent scalar reads are coalesced; absent means <see langword="true"/>.</summary>
+        public bool? CoalesceReads { get; init; }
+
         /// <summary>
         /// Gets or sets the list of devices to connect to.
         /// </summary>

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/AbLegacyDriverProbe.cs

@@ -55,6 +55,10 @@ public sealed class AbLegacyDriverProbe : IDriverProbe
         catch (Exception ex) { return new(false, $"Config JSON is invalid: {ex.Message}", null); }
         if (opts is null) return new(false, "Config JSON deserialized to null.", null);
 
+        // The authored "Admin UI probe timeout" (probeTimeoutSeconds) tightens the caller's budget. It was parsed by
+        // nothing before: Test Connect always ran on the caller's budget alone.
+        timeout = EffectiveTimeout(timeout, opts.ProbeTimeoutSeconds);
+
         var (parsed, firstDevice) = ExtractTarget(opts);
         if (parsed is null || string.IsNullOrWhiteSpace(parsed.Gateway) || parsed.Port <= 0)
             return new(false, "Config has no host/port to probe.", null);
@@ -169,6 +173,22 @@ public sealed class AbLegacyDriverProbe : IDriverProbe
     /// <returns>Whether the status proves the controller answered.</returns>
     internal static bool IsReachableStatus(AbStatus s) => s is AbStatus.Ok or AbStatus.NotFound;
 
+    /// <summary>
+    ///     The deadline the probe runs under: the caller's budget, tightened by the config's
+    ///     <see cref="AbLegacyDriverOptions.ProbeTimeoutSeconds"/> when that is positive and shorter (same rule as the
+    ///     Galaxy probe). A non-positive caller budget is floored to 1 s first.
+    /// </summary>
+    /// <param name="callerTimeout">The budget the host handed the probe.</param>
+    /// <param name="configuredSeconds">The config's <c>probeTimeoutSeconds</c>; ignored when not positive.</param>
+    /// <returns>The effective probe deadline.</returns>
+    internal static TimeSpan EffectiveTimeout(TimeSpan callerTimeout, int configuredSeconds)
+    {
+        var caller = callerTimeout > TimeSpan.Zero ? callerTimeout : TimeSpan.FromSeconds(1);
+        if (configuredSeconds <= 0) return caller;
+        var configured = TimeSpan.FromSeconds(configuredSeconds);
+        return configured < caller ? configured : caller;
+    }
+
     private static (AbLegacyHostAddress? parsed, AbLegacyDeviceOptions? device) ExtractTarget(AbLegacyDriverOptions opts)
     {
         // Parse the first device's ab:// host address to extract the gateway IP + EIP port.

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/IAbLegacyTagRuntime.cs

@@ -50,6 +50,20 @@ public interface IAbLegacyTagRuntime : IDisposable
     /// <param name="bitIndex">Optional bit index for bit-level access.</param>
     /// <param name="value">The value to encode.</param>
     void EncodeValue(AbLegacyDataType type, int? bitIndex, object? value);
+
+    /// <summary>
+    ///     Encodes EVERY element of a multi-element tag for the next <see cref="WriteAsync"/>, at the element width
+    ///     of <paramref name="type"/>. <paramref name="values"/> is already element-typed by the driver
+    ///     (<c>short[]</c> for Int/AnalogInt, <c>int[]</c> for Long, <c>float[]</c> for Float) and its length must
+    ///     equal the runtime's element count (<see cref="AbLegacyTagCreateParams.ElementCount"/>), so no element of
+    ///     the write comes from a stale read buffer. Bit and structured element arrays are not encodable.
+    /// </summary>
+    /// <param name="type">The PCCC element data type.</param>
+    /// <param name="values">The typed elements, exactly element-count long.</param>
+    /// <exception cref="ArgumentException">The length differs from the element count, or the array's element type
+    ///     does not match <paramref name="type"/>.</exception>
+    /// <exception cref="NotSupportedException"><paramref name="type"/> has no flat array encoding.</exception>
+    void EncodeArray(AbLegacyDataType type, Array values);
 }
 
 public interface IAbLegacyTagFactory

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/LibplctagLegacyStatusTranslation.cs

@@ -23,6 +23,15 @@ internal static class LibplctagLegacyStatusTranslation
         Status.ErrorPartial => AbStatus.Partial,
         Status.ErrorAbort => AbStatus.Abort,
         Status.ErrorBadReply => AbStatus.BadReply,
+        // A reply ARRIVED but carries an error libplctag does not break out: it folds EVERY non-zero PCCC STS and CIP
+        // general status into PLCTAG_ERR_REMOTE_ERR / ERR_BAD_STATUS. That covers the PLC refusing (element past the
+        // end of the file) AND a routing hop reporting the end device is gone (CIP 0x01/0x0204 unconnected send timed
+        // out, 0x07 connection lost, PCCC STS 0x30 remote node missing). So it is neither a no-reply comms fault
+        // (review 07 r0 I1 — it must not fall into the BadConnection default, which black-outs coalesced neighbours and
+        // trips fail-fast) nor proof of reachability (review 07 r1 N1). AbStatus has no dedicated "opaque remote error"
+        // value and Driver.Ab.Transport is Lane K's, so this maps to the existing BadReply — "a reply we cannot
+        // classify" — which the driver treats as OPAQUE (AbLegacyDriver.IsOpaque). OPC UA: BadCommunicationError.
+        Status.ErrorRemoteErr or Status.ErrorBadStatus => AbStatus.BadReply,
         _ => AbStatus.BadConnection,
     };
 

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/LibplctagLegacyTagRuntime.cs

@@ -15,6 +15,9 @@ internal sealed class LibplctagLegacyTagRuntime : IAbLegacyTagRuntime
 {
     private readonly Tag _tag;
 
+    /// <summary>The element count the tag was created with (1 for a scalar).</summary>
+    private readonly int _count;
+
     /// <summary>Why a write to this tag is refused before the wire (<see cref="WriteRefusal"/>), else null.</summary>
     private readonly string? _writeRefusal;
 
@@ -32,6 +35,7 @@ internal sealed class LibplctagLegacyTagRuntime : IAbLegacyTagRuntime
     public LibplctagLegacyTagRuntime(AbLegacyTagCreateParams p)
     {
         _tag = BuildTag(p);
+        _count = Math.Max(1, p.ElementCount);
         _writeRefusal = WriteRefusal(p);
     }
 
@@ -244,6 +248,32 @@ internal sealed class LibplctagLegacyTagRuntime : IAbLegacyTagRuntime
         }
     }
 
+    /// <inheritdoc />
+    public void EncodeArray(AbLegacyDataType type, Array values)
+    {
+        ArgumentNullException.ThrowIfNull(values);
+        if (values.Length != _count)
+            throw new ArgumentException($"Array write of {values.Length} elements to a {_count}-element tag.", nameof(values));
+        // Same offsets DecodeArray reads. EVERY element is set, so the buffer libplctag sends holds nothing from the
+        // last read (a scalar Set*(0, ...) used to re-send elements 1..n-1 as they were last read).
+        switch (type, values)
+        {
+            case (AbLegacyDataType.Int or AbLegacyDataType.AnalogInt, short[] s):
+                for (var i = 0; i < s.Length; i++) _tag.SetInt16(i * 2, s[i]);
+                break;
+            case (AbLegacyDataType.Long, int[] l):
+                for (var i = 0; i < l.Length; i++) _tag.SetInt32(i * 4, l[i]);
+                break;
+            case (AbLegacyDataType.Float, float[] f):
+                for (var i = 0; i < f.Length; i++) _tag.SetFloat32(i * 4, f[i]);
+                break;
+            case (AbLegacyDataType.Int or AbLegacyDataType.AnalogInt or AbLegacyDataType.Long or AbLegacyDataType.Float, _):
+                throw new ArgumentException($"{values.GetType().Name} is not the element type of a {type} array.", nameof(values));
+            default:
+                throw new NotSupportedException($"AbLegacyDataType {type} has no array write encoding.");
+        }
+    }
+
     /// <summary>Disposes the tag and releases its resources.</summary>
     public void Dispose() => _tag.Dispose();
 

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/NativeAbLegacyTagRuntime.cs

@@ -448,6 +448,32 @@ internal sealed class NativeAbLegacyTagRuntime : IAbLegacyTagRuntime
         }
     }
 
+    /// <inheritdoc />
+    public void EncodeArray(AbLegacyDataType type, Array values)
+    {
+        ArgumentNullException.ThrowIfNull(values);
+        if (values.Length != _count)
+            throw new ArgumentException($"Array write of {values.Length} elements to a {_count}-element tag.", nameof(values));
+        // Same layout as DecodeArray: element i at i * elementSize. Every element is overwritten, so nothing the
+        // write sends comes from the last read.
+        switch (type, values)
+        {
+            case (AbLegacyDataType.Int or AbLegacyDataType.AnalogInt, short[] s):
+                for (var i = 0; i < s.Length; i++) BinaryPrimitives.WriteInt16LittleEndian(SliceW(i * 2, 2), s[i]);
+                break;
+            case (AbLegacyDataType.Long, int[] l):
+                for (var i = 0; i < l.Length; i++) BinaryPrimitives.WriteInt32LittleEndian(SliceW(i * 4, 4), l[i]);
+                break;
+            case (AbLegacyDataType.Float, float[] f):
+                for (var i = 0; i < f.Length; i++) BinaryPrimitives.WriteSingleLittleEndian(SliceW(i * 4, 4), f[i]);
+                break;
+            case (AbLegacyDataType.Int or AbLegacyDataType.AnalogInt or AbLegacyDataType.Long or AbLegacyDataType.Float, _):
+                throw new ArgumentException($"{values.GetType().Name} is not the element type of a {type} array.", nameof(values));
+            default:
+                throw new NotSupportedException($"AbLegacyDataType {type} has no array write encoding.");
+        }
+    }
+
     /// <summary>
     ///     Releases the lease on the shared device connection (the last release closes it) without waiting:
     ///     closing does I/O (Forward Close / UnRegisterSession) and the driver disposes under a per-tag lock.

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts/S7TagDefinitionFactory.cs

@@ -48,8 +48,23 @@ public static class S7TagDefinitionFactory
     /// <param name="def">The mapped definition when this returns <see langword="true"/>.</param>
     /// <returns><see langword="true"/> when <paramref name="tagConfig"/> is a valid S7 address object.</returns>
     public static bool FromTagConfig(string tagConfig, string rawPath, out S7TagDefinition def)
+        => FromTagConfig(tagConfig, rawPath, out def, out _);
+
+    /// <summary>
+    ///     <see cref="FromTagConfig(string, string, out S7TagDefinition)"/>, also reporting WHY a structurally
+    ///     valid blob was refused by <see cref="S7TagShapeRules"/> (an unparseable address, or a shape the
+    ///     driver cannot serve). <paramref name="shapeRejection"/> stays <see langword="null"/> for a JSON-level
+    ///     refusal (missing keys, bad enum), which <see cref="Inspect"/> explains on its own.
+    /// </summary>
+    /// <param name="tagConfig">The authored equipment-tag TagConfig JSON.</param>
+    /// <param name="rawPath">The tag's RawPath — becomes the definition's identity (<c>Name</c>).</param>
+    /// <param name="def">The mapped definition when this returns <see langword="true"/>.</param>
+    /// <param name="shapeRejection">The shape/address rejection reason, when that is why it refused.</param>
+    /// <returns><see langword="true"/> when the driver can serve the tag.</returns>
+    public static bool FromTagConfig(string tagConfig, string rawPath, out S7TagDefinition def, out string? shapeRejection)
     {
         def = null!;
+        shapeRejection = null;
         if (string.IsNullOrWhiteSpace(tagConfig)) return false;
         try
         {
@@ -78,7 +93,7 @@ public static class S7TagDefinitionFactory
             // "writable" defaults to true when absent (today's value); node-level authz still governs
             // writes. Honouring the key makes read-only equipment tags authorable.
             var writable = TagConfigJson.ReadWritable(root);
-            def = new S7TagDefinition(
+            var mapped = new S7TagDefinition(
                 Name: rawPath,
                 Address: address,
                 DataType: dataType,
@@ -86,6 +101,15 @@ public static class S7TagDefinitionFactory
                 StringLength: stringLength == 0 ? MaxStringLength : stringLength,
                 WriteIdempotent: false,
                 ArrayCount: arrayCount);
+            // The address must parse and the shape must be one the driver can serve. These used to be
+            // init-time guards that THREW and faulted every tag on the PLC; refusing here skips only
+            // this tag, and the editor + deploy gate (which ask this method) refuse it too.
+            if (S7TagShapeRules.Validate(mapped, out _) is { } reason)
+            {
+                shapeRejection = reason;
+                return false;
+            }
+            def = mapped;
             return true;
         }
         catch (JsonException) { return false; }
@@ -162,7 +186,9 @@ public static class S7TagDefinitionFactory
     ///     <b>reject</b> — a structurally unparseable or non-object document, an absent / non-string /
     ///     blank <c>address</c>, an <b>absent</b> <c>dataType</c> (see <see cref="DeclaresDataType"/>), a
     ///     present-but-invalid <c>dataType</c> (the runtime enum read is STRICT, so a
-    ///     typo rejects the tag), or an out-of-range <c>stringLength</c> on a <c>String</c> tag. Such a tag
+    ///     typo rejects the tag), an out-of-range <c>stringLength</c> on a <c>String</c> tag, or a shape
+    ///     <see cref="S7TagShapeRules"/> refuses (an unparseable address, a wrong access width, a mis-typed
+    ///     Timer/Counter, an unsupported array). Such a tag
     ///     is skipped by the driver and reads <c>BadNodeIdUnknown</c> forever. Empty when the mapper accepts
     ///     the blob, when it is blank, or when it is not an equipment-tag object. Never throws.
     /// </summary>
@@ -184,7 +210,13 @@ public static class S7TagDefinitionFactory
 
         // The accept gate: whatever the driver reads draws nothing. The RAW reference is handed to the
         // mapper — the driver reads the stored blob, not a trimmed copy of it.
-        if (FromTagConfig(reference, InspectionRawPath, out _)) return warnings;
+        if (FromTagConfig(reference, InspectionRawPath, out _, out var shapeRejection)) return warnings;
+
+        if (shapeRejection is not null)
+        {
+            warnings.Add(shapeRejection + " The driver will skip this tag and it will read BadNodeIdUnknown.");
+            return warnings;
+        }
 
         try
         {

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts/S7TagShapeRules.cs

@@ -0,0 +1,149 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.S7;
+
+/// <summary>
+///     <b>The single authority on which S7 tag shapes the driver can serve.</b> Consulted by
+///     <see cref="S7TagDefinitionFactory.FromTagConfig"/>, so the AdminUI editor, the deploy gate
+///     (<see cref="S7TagDefinitionFactory.Inspect"/>) and the driver's own init all refuse the same
+///     tags with the same words.
+/// </summary>
+/// <remarks>
+///     <para>
+///         These rules used to be init-time guards in <c>S7Driver</c> that THREW. One mis-authored tag
+///         (<c>DB1.DBZ0</c>, <c>DB1.DBW0</c> typed <c>Float64</c>, <c>T5</c> typed <c>Int32</c>) faulted the
+///         whole driver, and the actor retried that same init every 10 s forever, darkening every tag on
+///         the PLC. The editor and the deploy gate checked none of it, and a CSV import or API blob
+///         bypasses the editor entirely. A rejected tag is now skipped on its own (it reads
+///         <c>BadNodeIdUnknown</c>) and the deploy gate warns about it.
+///     </para>
+///     <para>
+///         Every rule rejects a tag that could never be served correctly. None of them can newly break
+///         a tag that used to work: each one either faulted init, or failed (or silently mis-decoded)
+///         every read of that tag.
+///     </para>
+/// </remarks>
+public static class S7TagShapeRules
+{
+    /// <summary>
+    ///     S7 data types addressed by START BYTE (the <c>B</c> suffix) rather than by an access-width
+    ///     suffix. The driver decodes them from a contiguous byte buffer, so a wide tag authored against a
+    ///     non-byte suffix (DBW/DBD/...) would mis-frame its value.
+    /// </summary>
+    private static readonly HashSet<S7DataType> ByteAnchoredDataTypes =
+    [
+        S7DataType.Int64,
+        S7DataType.UInt64,
+        S7DataType.Float64,
+        S7DataType.String,
+        S7DataType.DateTime,
+        S7DataType.WString,
+        S7DataType.Char,
+        S7DataType.WChar,
+        S7DataType.Dtl,
+        S7DataType.Date,
+        S7DataType.Tod,
+        S7DataType.Time,
+        S7DataType.S5Time,
+    ];
+
+    /// <summary>True when <paramref name="dataType"/> is a wide/structured type read from a byte-anchored block.</summary>
+    /// <param name="dataType">The declared data type.</param>
+    /// <returns><see langword="true"/> for the byte-anchored types.</returns>
+    public static bool IsByteAnchored(S7DataType dataType) => ByteAnchoredDataTypes.Contains(dataType);
+
+    /// <summary>
+    ///     Judges one tag definition. Returns <see langword="null"/> when the driver can serve it, or
+    ///     the operator-facing reason it cannot.
+    /// </summary>
+    /// <param name="def">The mapped tag definition.</param>
+    /// <param name="parsed">The parsed address when this returns <see langword="null"/>.</param>
+    /// <returns>The rejection reason, or <see langword="null"/> when the tag is servable.</returns>
+    public static string? Validate(S7TagDefinition def, out S7ParsedAddress parsed)
+    {
+        ArgumentNullException.ThrowIfNull(def);
+        parsed = default;
+
+        S7ParsedAddress addr;
+        try
+        {
+            addr = S7AddressParser.Parse(def.Address);
+        }
+        catch (FormatException ex)
+        {
+            return $"S7 address '{def.Address}' does not parse: {ex.Message}";
+        }
+
+        var isWide = IsByteAnchored(def.DataType);
+        var isArray = def.ArrayCount is >= 1;
+
+        // Wide-type arrays have no decoder.
+        if (isWide && isArray)
+            return $"S7 {def.DataType} arrays are not supported. Use a scalar {def.DataType} tag, or an " +
+                   "Int16/UInt16/Int32/UInt32/Float32/Byte/Bool element type for an array.";
+
+        // Timer / Counter type constraints: a timer decodes to Float64 seconds, a counter to an Int32 count.
+        if (addr.Area is S7Area.Timer && def.DataType != S7DataType.Float64)
+            return $"S7 Timer address '{def.Address}' is typed {def.DataType}. Timer tags must be " +
+                   "DataType=Float64 (decoded to seconds, read-only).";
+        if (addr.Area is S7Area.Counter && def.DataType != S7DataType.Int32)
+            return $"S7 Counter address '{def.Address}' is typed {def.DataType}. Counter tags must be " +
+                   "DataType=Int32 (decoded to a count, read-only).";
+        if (addr.Area is S7Area.Timer or S7Area.Counter)
+        {
+            if (isArray)
+                return $"S7 Timer/Counter address '{def.Address}' cannot be an array.";
+            if (def.Writable)
+                return $"S7 Timer/Counter address '{def.Address}' is declared writable. Timer/Counter tags " +
+                       "are read-only; set Writable=false.";
+            parsed = addr;
+            return null;
+        }
+
+        // Wide/structured scalars on DB/M/I/Q must be byte-anchored (DBB/MB/IB/QB).
+        if (isWide)
+        {
+            if (addr.Size != S7Size.Byte)
+                return $"S7 {def.DataType} at '{def.Address}' is not byte-addressed. Wide/structured types " +
+                       "must be byte-addressed (DBB/MB/IB/QB), e.g. 'DB1.DBB0', 'MB4'.";
+            parsed = addr;
+            return null;
+        }
+
+        // Narrow types: the declared type must match the address's access width, or every read fails
+        // (or decodes garbage) with a type mismatch.
+        var required = def.DataType switch
+        {
+            S7DataType.Bool => S7Size.Bit,
+            S7DataType.Byte => S7Size.Byte,
+            S7DataType.Int16 or S7DataType.UInt16 => S7Size.Word,
+            _ => S7Size.DWord, // Int32 / UInt32 / Float32
+        };
+        if (addr.Size != required)
+            return $"S7 {def.DataType} at '{def.Address}' has the wrong access width ({addr.Size}). " +
+                   $"A {def.DataType} tag needs a {SuffixHint(required)} address.";
+
+        if (isArray && def.DataType == S7DataType.Bool)
+        {
+            // Element i of a Bool array is bit 0 of byte (start + i): the array is byte-granular. A
+            // non-zero bit offset used to be silently ignored (DB1.DBX0.3 returned bit 0 of bytes 0..n).
+            if (addr.BitOffset != 0)
+                return $"S7 Bool array at '{def.Address}' starts at bit {addr.BitOffset}. A Bool array reads " +
+                       "one byte per element (bit 0 of each byte), so it must start at bit 0 (e.g. 'DB1.DBX0.0').";
+            // A byte-granular write would overwrite the 7 neighbouring bits of every byte it touches.
+            if (def.Writable)
+                return $"S7 Bool array at '{def.Address}' is declared writable. Bool array writes are not " +
+                       "supported (a byte-granular write would clobber neighbouring bits); set Writable=false " +
+                       "or write the bits as individual scalar Bool tags.";
+        }
+
+        parsed = addr;
+        return null;
+    }
+
+    private static string SuffixHint(S7Size size) => size switch
+    {
+        S7Size.Bit => "bit (DBX/M/I/Q n.b)",
+        S7Size.Byte => "byte (DBB/MB/IB/QB)",
+        S7Size.Word => "word (DBW/MW/IW/QW)",
+        _ => "double-word (DBD/MD/ID/QD)",
+    };
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7/S7DriverProbe.cs

@@ -42,6 +42,14 @@ public sealed class S7DriverProbe : IDriverProbe
         if (string.IsNullOrWhiteSpace(host) || port <= 0)
             return new(false, "Config has no host/port to probe.", null);
 
+        // The S7 handshake + test read are bounded by the driver's own per-operation timeout
+        // (config "timeoutMs", what the deployed driver will wait), capped by the caller's overall
+        // Test Connect timeout. The options type carries it as a TimeSpan the JSON never names, so it
+        // used to be ignored and every handshake waited the full Test Connect timeout (R07:H7).
+        var opTimeout = ReadTimeoutMs(configJson) is { } ms && TimeSpan.FromMilliseconds(ms) < timeout
+            ? TimeSpan.FromMilliseconds(ms)
+            : timeout;
+
         // Phase 1: bare TCP preflight — fast rejection for unreachable hosts.
         var sw = Stopwatch.StartNew();
         try
@@ -71,9 +79,9 @@ public sealed class S7DriverProbe : IDriverProbe
         var plc = S7Tsap.Resolve(opts) is { } tsap
             ? new Plc(host, port, tsap)
             : new Plc(S7CpuTypeMap.ToS7Net(opts.CpuType), host, port, opts.Rack, opts.Slot);
-        plc.ReadTimeout = (int)timeout.TotalMilliseconds;
+        plc.ReadTimeout = (int)opTimeout.TotalMilliseconds;
         using var handshakeCts = CancellationTokenSource.CreateLinkedTokenSource(ct);
-        handshakeCts.CancelAfter(timeout);
+        handshakeCts.CancelAfter(opTimeout);
         try
         {
             await plc.OpenAsync(handshakeCts.Token);
@@ -128,15 +136,17 @@ public sealed class S7DriverProbe : IDriverProbe
             return null;
         }
         catch (OperationCanceledException) { throw; }
-        catch (PlcException pex) when (S7Driver.IsAccessDenied(pex))
+        // S7.Net's read paths raise the CPU's item error as a BARE Exception ("Received error from
+        // PLC: …"), not a PlcException, so both classifiers walk the whole chain (the driver's own).
+        catch (Exception ex) when (S7Driver.IsAccessDenied(ex))
         {
             return new(false,
                 "S7 connected but data access is denied — enable PUT/GET communication in TIA Portal " +
-                $"(Protection & Security) for this CPU. PLC reported: {pex.Message}", null);
+                $"(Protection & Security) for this CPU. PLC reported: {ex.Message}", null);
         }
-        catch (PlcException pex) when (pex.ErrorCode == ErrorCode.ReadData)
+        catch (Exception ex) when (S7Driver.IsRefusal(ex))
         {
-            return null; // address not available on this CPU — not a connection problem
+            return null; // address not available on this CPU — the CPU answered; not a connection problem
         }
         catch (Exception ex)
         {
@@ -146,4 +156,31 @@ public sealed class S7DriverProbe : IDriverProbe
 
     private static (string host, int port) ExtractTarget(S7DriverOptions opts)
         => (opts.Host, opts.Port);
+
+    /// <summary>
+    ///     The config's <c>timeoutMs</c> (any casing, as the driver factory binds it), or null when absent
+    ///     or not a positive integer.
+    /// </summary>
+    /// <param name="configJson">The driver config.</param>
+    /// <returns>The configured per-operation timeout in milliseconds, or null.</returns>
+    internal static int? ReadTimeoutMs(string configJson)
+    {
+        try
+        {
+            using var doc = JsonDocument.Parse(configJson);
+            if (doc.RootElement.ValueKind != JsonValueKind.Object) return null;
+            foreach (var prop in doc.RootElement.EnumerateObject())
+            {
+                if (!string.Equals(prop.Name, "timeoutMs", StringComparison.OrdinalIgnoreCase)) continue;
+                return prop.Value.ValueKind == JsonValueKind.Number && prop.Value.TryGetInt32(out var ms) && ms > 0
+                    ? ms
+                    : null;
+            }
+            return null;
+        }
+        catch (JsonException)
+        {
+            return null;
+        }
+    }
 }

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7/S7ReadSpanPlanner.cs

@@ -11,8 +11,14 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.S7;
 ///         <b>The safety invariant is that a span never extends past its last member's end.</b> A
 ///         span may deliberately read bytes nobody asked for BETWEEN its members (that is what the
 ///         gap budget buys), but every byte it requests lies inside a range some member was going
-///         to read anyway. A grouped read therefore cannot fault (area overrun, DB overrun) where
-///         the individual per-tag reads would have succeeded.
+///         to read anyway.
+///     </para>
+///     <para>
+///         <b>That does NOT make a grouped read as safe as the per-tag reads</b> (R07:P2): the block is
+///         the union of its members' ranges, so ONE member the CPU refuses (running past the DB's real
+///         end, an over-declared STRING) makes it refuse the whole block, neighbours included.
+///         <see cref="S7Driver.ReadAsync"/> owns that case: a refused multi-member span is re-read one
+///         member at a time, and the members that must not be grouped are left out of later plans.
 ///     </para>
 ///     <para>
 ///         <b>Timer and Counter tags are never grouped.</b> Their