Merge #863 TwinCAT Test Connect: drop the AmsNetId-as-IP TCP pre-check; probe via the local AMS router ADS handshake

Claude-Session: https://claude.ai/code/session_01GT67AD99zQQqpLCVm3p7xk

docs/drivers/TestConnectProbes.md

@@ -46,7 +46,7 @@ with a human-readable explanation rather than a false-green TCP-open tick.
 | **S7** | `Plc.OpenAsync` (COTP CR/CC + S7 setup-communication), check `IsConnected`, then `Close`. Wrong rack/slot or a non-S7 server causes `OpenAsync` to throw → handshake fail. | `"S7 connected (CPU …)"` | `10.100.0.35:1102` (python-snap7 sim) |
 | **AbCip** | `libplctag` Tag `InitializeAsync` (EIP session + CIP Forward Open). A CIP-level error such as tag-not-found still proves the controller answered CIP → `Ok`. A session/ForwardOpen/connect error → handshake fail. | `"CIP session OK"` | `10.100.0.35:44818` (CIP sim) |
 | **AbLegacy** | Same `libplctag` `InitializeAsync` handshake as AbCip, PCCC protocol family. | `"CIP session OK"` (PCCC family) | Deferred — no PLC5/SLC sim |
-| **TwinCAT** | `AdsClient.Connect` + `ReadStateAsync`. See [degrade semantics](#twincat-degrade) below. | `"ADS state: {state}"` | Deferred — no ADS target |
+| **TwinCAT** | `AdsClient.Connect` + `ReadStateAsync` through the **local AMS router** — no TCP pre-check. See [TwinCAT: no TCP pre-check](#twincat-no-tcp-pre-check) below. | `"ADS state: {state}"` | Z35474 (production TC3 press, read-only, via an in-process TcpRouter) |
 | **FOCAS** | `cnc_allclibhndl3` via a direct `DllImport("fwlib32")` in the probe. See [degrade semantics](#focas-degrade) below. | `"FOCAS handle OK"` | Deferred — no CNC + FWLIB |
 | **Galaxy** | gRPC unary call to `GalaxyRepository.TestConnection` on the configured mxaccessgw endpoint. See [auth-rejection rule](#galaxy-auth-rejection) below. | `"gateway gRPC OK"` | `http://10.100.0.48:5120` (mxaccessgw) |
 | **Heidenhain** | LSV2 `A_LG INSPECT` (password resolved from its `secret:`/`env:` reference) + `R_VR`, through the same read-only allowlist as the driver; a refusal or malformed version record → fail. No logout — the socket close ends the session. | `"LSV2 INSPECT session OK at host:port: <model> NC <version>"` | Deferred — no LSV2 control; simulator-proven |
@@ -61,29 +61,36 @@ backend is now the external HistorianGateway (a gRPC client package, not a probe
 
 ## Degrade semantics
 
-Three drivers have environmental constraints that can prevent the handshake
+Some drivers have environmental constraints that can prevent the handshake
 from running on certain hosts. The **degradation principle** is: the probe
 must never produce a result *worse* than today's TCP-only probe. A genuine
 protocol rejection from a reachable device is a correct RED; an inability to
-*run* the handshake at all (no FWLIB, no managed router) degrades to the
-existing TCP-reachability message — still a green tick but annotated.
+*run* the handshake at all (no FWLIB) degrades to the
+existing TCP-reachability message — still a green tick but annotated. TwinCAT
+no longer degrades (see below).
 
-### TwinCAT degrade
+### TwinCAT: no TCP pre-check
 
-Where the handshake is available:
+TwinCAT is the exception to the "TCP connect fails" row above: it opens **no socket of its own**
+(#863). The driver has no IP field — an AMS Net ID is a Beckhoff identifier the AMS router maps to a
+host through its route table, and the AMS port (801/851) is not a TCP port. The probe therefore takes
+exactly the driver's path (`AdsTwinCATClient.ConnectAsync`): `AdsClient.Connect(netId, port)` through
+the local AMS router (TwinCAT XAR, or `Beckhoff.TwinCAT.Ads.TcpRouter` hosted in-process), then one
+read-only `ReadStateAsync`, all inside the probe budget. Until #863 a first-phase check dialled the Net
+ID's first four octets as an IPv4 address on the AMS port — for Z35474 (`5.118.56.93.1.1`) an
+unrelated public host — so Test Connect timed out against every real runtime.
 
-- `AdsClient.Connect(netId, port)` + `ReadStateAsync` → `Ok=true`,
-  `"ADS state: {state}"` (Run / Config / Stop).
-- An ADS **route-table rejection** from a reachable ADS router is a **true RED**:
-  `"Reachable at {host}:{port} but ADS handshake failed: {detail} — check the
-  target's ADS route table authorizes this host"`. This is the correct result:
-  the driver would also be unable to function without an authorized route.
+| Outcome | `Ok` | Message |
+|---------|------|---------|
+| ReadState succeeds | `true` | `"ADS state: {state}"` (Run / Config / Stop) |
+| No local AMS router (Beckhoff "Check for a running TwinCAT router instance!", `ClientPortNotOpen`, router not active, ADS client cannot load) | `false` | `"No local AMS router on this host — start TwinCAT XAR or host the Beckhoff TcpRouter; the target was not contacted (…)"` |
+| Router answered but cannot reach the target (`TargetMachineNotFound`, `TargetPortNotFound`, port/access refused, host unreachable) | `false` | `"No route to {netId}:{port} or target unreachable: {code} — check the local AMS router has a route …"` |
+| Sync/device timeout code, or the budget expired | `false` | `"Probe timed out after {n}s waiting for ADS state from {netId}:{port} …"` |
+| Any other ADS error | `false` | `"ADS handshake with {netId}:{port} failed: {code}"` |
 
-Where the handshake is unavailable (headless server, no TwinCAT runtime, the
-managed AMS router cannot start):
-
-- Probe degrades to TCP-reachability: `Ok=true`,
-  `"(ADS handshake unavailable on this host — TCP reachability only)"`.
+There is **no degrade-to-green** any more: with no TCP check, a host that cannot run the handshake
+has contacted nothing, so it reports the missing router rather than a green tick. A stock admin node
+has no AMS router, so TwinCAT Test Connect is red there by design — the driver needs the same router.
 
 ### FOCAS degrade