Merge FB-7: surgical DataType/array-shape in-place tag writes

Widens the F10b surgical address-space path to DataType/IsArray/ArrayLength
changes (in-place DataType+ValueRank+ArrayDimensions swap + value reset +
GeneralModelChangeEvent), gated to stable-FullName drivers. Live-verified on
docker-dev (surgicalTags=1, rebuild=False on both central nodes). 275/275
OpcUaServer.Tests green.

src/Core/ZB.MOM.WW.OtOpcUa.Commons/OpcUa/DeferredAddressSpaceSink.cs

@@ -74,12 +74,17 @@ public sealed class DeferredAddressSpaceSink : IOpcUaAddressSpaceSink, ISurgical
     /// surgical capability. Returns false otherwise — before the real <c>SdkAddressSpaceSink</c> is
     /// swapped in (inner is still the null sink), or any inner sink that isn't surgical — so the caller
     /// (AddressSpaceApplier) falls back to a full rebuild. Without this forward the surgical optimization is
-    /// inert on every driver-role host, because actors inject THIS wrapper, not the inner sink.</summary>
+    /// inert on every driver-role host, because actors inject THIS wrapper, not the inner sink. ALL six args
+    /// (including the FB-7 DataType/array-shape ones) MUST be forwarded — a partial forward silently drops the
+    /// shape update on every driver-role host.</summary>
     /// <param name="variableNodeId">The node ID of the variable to update in place.</param>
     /// <param name="writable">Whether the node should be read/write.</param>
     /// <param name="historianTagname">null ⇒ not historized; non-null ⇒ Historizing + historian binding.</param>
+    /// <param name="dataType">The OPC UA built-in data type name to apply in place.</param>
+    /// <param name="isArray">When true the node becomes a 1-D array; when false scalar.</param>
+    /// <param name="arrayLength">The declared length of the 1-D array when <paramref name="isArray"/> is true.</param>
     /// <returns>True when the inner sink applied the update; false when it lacks the capability or the node is missing.</returns>
-    public bool UpdateTagAttributes(string variableNodeId, bool writable, string? historianTagname)
+    public bool UpdateTagAttributes(string variableNodeId, bool writable, string? historianTagname, string dataType, bool isArray, uint? arrayLength)
         => _inner is ISurgicalAddressSpaceSink surgical
-           && surgical.UpdateTagAttributes(variableNodeId, writable, historianTagname);
+           && surgical.UpdateTagAttributes(variableNodeId, writable, historianTagname, dataType, isArray, arrayLength);
 }

src/Core/ZB.MOM.WW.OtOpcUa.Commons/OpcUa/ISurgicalAddressSpaceSink.cs

@@ -2,12 +2,25 @@ namespace ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
 
 /// <summary>Optional capability on an address-space sink: surgical in-place attribute updates on an
 /// EXISTING variable node, used by AddressSpaceApplier to avoid a full RebuildAddressSpace for pure-property
-/// tag changes (Writable / Historizing). A sink that does not implement it ⇒ caller falls back to a
-/// full rebuild (safe default).</summary>
+/// tag changes (Writable / Historizing / DataType / array-shape). A sink that does not implement it ⇒ caller
+/// falls back to a full rebuild (safe default).</summary>
 public interface ISurgicalAddressSpaceSink
 {
-    /// <summary>Update an existing variable node's Writable (AccessLevel + inbound-write handler) and
-    /// Historizing (+ historian-tagname binding) IN PLACE, notifying subscribers (ClearChangeMasks)
-    /// without a rebuild. Returns false if the node does not exist (caller should rebuild instead).</summary>
-    bool UpdateTagAttributes(string variableNodeId, bool writable, string? historianTagname);
+    /// <summary>Update an existing variable node's surgically-updatable attributes IN PLACE, notifying
+    /// subscribers (ClearChangeMasks) without a rebuild — so client MonitoredItems on the node survive.
+    /// Covers Writable (AccessLevel + inbound-write handler), Historizing (+ historian-tagname binding),
+    /// and the node's presentation shape: <paramref name="dataType"/> (the OPC UA DataType) and
+    /// <paramref name="isArray"/>/<paramref name="arrayLength"/> (ValueRank + ArrayDimensions). When the
+    /// shape actually changes, the implementation resets the node's value to BadWaitingForInitialData
+    /// (no stale wrong-typed value is exposed until the driver republishes) and raises a Part 3
+    /// GeneralModelChangeEvent (verb=DataTypeChanged) so model-aware clients re-read the node definition.
+    /// Returns false if the node does not exist (caller should rebuild instead).</summary>
+    /// <param name="variableNodeId">The folder-scoped node id of the variable to update in place.</param>
+    /// <param name="writable">When true the node becomes read/write (with the inbound-write handler); otherwise read-only.</param>
+    /// <param name="historianTagname">null ⇒ not historized; non-null ⇒ Historizing with the HistoryRead bit and tagname binding.</param>
+    /// <param name="dataType">The OPC UA built-in data type name (e.g. "Boolean", "Int32", "Float").</param>
+    /// <param name="isArray">When true the node is a 1-D array (ValueRank=OneDimension); when false scalar.</param>
+    /// <param name="arrayLength">The declared length of the 1-D array when <paramref name="isArray"/> is true; ignored for scalars.</param>
+    /// <returns>True when the in-place update was applied; false when the node is missing (caller rebuilds).</returns>
+    bool UpdateTagAttributes(string variableNodeId, bool writable, string? historianTagname, string dataType, bool isArray, uint? arrayLength);
 }

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/AddressSpaceApplier.cs

@@ -95,13 +95,15 @@ public sealed class AddressSpaceApplier
         // respawn (DriverHostActor → ApplyVirtualTags), so it skips the rebuild and PRESERVES every
         // client's server-wide subscriptions. Any structural / node-affecting vtag change (Name/
         // FolderPath/DataType) — or any non-vtag change anywhere — still forces a full rebuild.
-        // F10b (surgical tag write): a CHANGED equipment tag whose ONLY differences are Writable /
-        // IsHistorized / HistorianTagname (a plain value variable — no alarm condition node) can be
-        // updated IN PLACE on the existing node via ISurgicalAddressSpaceSink.UpdateTagAttributes
-        // (see TagDeltaIsSurgicalEligible), again avoiding the full rebuild and preserving subscriptions.
-        // Any other tag difference (DataType/IsArray/ArrayLength/FullName/identity/alarm) — or a sink
-        // that lacks the surgical capability, or a node that turns out missing — falls back to a full
-        // rebuild (safe default).
+        // F10b + FB-7 (surgical tag write): a CHANGED equipment tag whose ONLY differences are Writable /
+        // IsHistorized / HistorianTagname / DataType / IsArray / ArrayLength (a plain value variable — no
+        // alarm condition node) can be updated IN PLACE on the existing node via
+        // ISurgicalAddressSpaceSink.UpdateTagAttributes (see TagDeltaIsSurgicalEligible), avoiding the full
+        // rebuild and preserving subscriptions. The shape fields (DataType/IsArray/ArrayLength) are now
+        // surgical because the sink swaps DataType + ValueRank + ArrayDimensions in place and raises a
+        // GeneralModelChangeEvent. Any other tag difference (FullName/Name/DriverInstanceId/identity/alarm) —
+        // or a sink that lacks the surgical capability, or a node that turns out missing — falls back to a
+        // full rebuild (safe default).
         var structuralRebuild =
             plan.AddedEquipment.Count > 0 || plan.RemovedEquipment.Count > 0 || plan.ChangedEquipment.Count > 0 ||
             plan.AddedAlarms.Count > 0 || plan.RemovedAlarms.Count > 0 || plan.ChangedAlarms.Count > 0 ||
@@ -125,15 +127,16 @@ public sealed class AddressSpaceApplier
                 var allApplied = true;
                 foreach (var d in surgicalTagDeltas)
                 {
-                    // Compute the node id + writable + historian EXACTLY as MaterialiseEquipmentTags would
-                    // so the in-place update matches what a rebuild would have produced.
+                    // Compute the node id + writable + historian + shape EXACTLY as MaterialiseEquipmentTags
+                    // would so the in-place update matches what a rebuild would have produced. Array tags are
+                    // forced read-only (same as EnsureVariable: the driver write path doesn't handle arrays).
                     var nodeId = EquipmentNodeIds.Variable(d.Current.EquipmentId, d.Current.FolderPath, d.Current.Name);
                     var writable = d.Current.Writable && !d.Current.IsArray;
                     var historian = d.Current.IsHistorized
                         ? (string.IsNullOrWhiteSpace(d.Current.HistorianTagname) ? d.Current.FullName : d.Current.HistorianTagname)
                         : null;
                     bool ok;
-                    try { ok = surgical.UpdateTagAttributes(nodeId, writable, historian); }
+                    try { ok = surgical.UpdateTagAttributes(nodeId, writable, historian, d.Current.DataType, d.Current.IsArray, d.Current.ArrayLength); }
                     catch (Exception ex)
                     {
                         _logger.LogError(ex, "AddressSpaceApplier: surgical UpdateTagAttributes threw for {Node}", nodeId);
@@ -389,11 +392,21 @@ public sealed class AddressSpaceApplier
             Historize = d.Current.Historize,
         }).Equals(d.Current);
 
-    // F10b: a CHANGED equipment tag whose ONLY differences are Writable / IsHistorized / HistorianTagname
-    // (a plain value variable — no alarm condition node) can be updated IN PLACE on the existing node via
-    // ISurgicalAddressSpaceSink.UpdateTagAttributes, avoiding a full rebuild (preserving subscriptions).
-    // DataType / IsArray / ArrayLength / FullName / DriverInstanceId / identity / alarm differences fall
-    // through to a rebuild — the override-unequal default also covers any future field.
+    // F10b + FB-7: a CHANGED equipment tag whose ONLY differences are Writable / IsHistorized /
+    // HistorianTagname / DataType / IsArray / ArrayLength (a plain value variable — no alarm condition node)
+    // can be updated IN PLACE on the existing node via ISurgicalAddressSpaceSink.UpdateTagAttributes,
+    // avoiding a full rebuild (preserving subscriptions). The presentation-shape fields (DataType / IsArray /
+    // ArrayLength) join the whitelist now that the surgical sink swaps DataType + ValueRank + ArrayDimensions
+    // in place (and raises a GeneralModelChangeEvent). FullName / DriverInstanceId / Name / identity / alarm
+    // differences still fall through to a rebuild — FullName/DriverInstanceId re-route the node to a different
+    // driver point, Name re-derives the NodeId, and an alarm flip turns the node into a Part 9 condition. The
+    // override-unequal default also covers any future field.
+    // REACH (live-verified FB-7): the shape path only fires for drivers whose TagConfig carries a stable
+    // top-level "FullName" (Galaxy = tag_name.AttributeName; OpcUaClient = the node id) — there a DataType/array
+    // edit leaves FullName untouched ⇒ surgical. For structured-TagConfig protocol drivers (Modbus/S7/AbCip/…)
+    // AddressSpaceComposer.ExtractTagFullName falls back to the RAW TagConfig blob as FullName, so a DataType/
+    // array edit also mutates that blob ⇒ FullName differs ⇒ this returns false ⇒ full rebuild. That is the
+    // correct safe default (a protocol driver's subscription needs re-spawning for a new shape anyway).
     private static bool TagDeltaIsSurgicalEligible(AddressSpacePlan.EquipmentTagDelta d) =>
         d.Previous.Alarm is null && d.Current.Alarm is null &&
         (d.Previous with
@@ -401,6 +414,9 @@ public sealed class AddressSpaceApplier
             Writable = d.Current.Writable,
             IsHistorized = d.Current.IsHistorized,
             HistorianTagname = d.Current.HistorianTagname,
+            DataType = d.Current.DataType,
+            IsArray = d.Current.IsArray,
+            ArrayLength = d.Current.ArrayLength,
         }).Equals(d.Current);
 
     /// <summary>The "no-event" condition state written to a removed equipment / alarm node before the

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaNodeManager.cs

@@ -1386,12 +1386,39 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
     }
 
     /// <summary>F10b surgical counterpart of <see cref="EnsureVariable"/>: update an EXISTING tag variable's
-    /// Writable (AccessLevel + <see cref="OnEquipmentTagWrite"/> handler) and Historizing (+ historian-tagname
-    /// binding) in place and notify subscribers, WITHOUT a rebuild — so client MonitoredItems on the node
-    /// survive. Returns false when the node id is unknown (caller falls back to a full rebuild).</summary>
-    public bool UpdateTagAttributes(string variableNodeId, bool writable, string? historianTagname)
+    /// Writable (AccessLevel + <see cref="OnEquipmentTagWrite"/> handler), Historizing (+ historian-tagname
+    /// binding), and presentation shape (<paramref name="dataType"/> → <c>DataType</c>;
+    /// <paramref name="isArray"/>/<paramref name="arrayLength"/> → <c>ValueRank</c> + <c>ArrayDimensions</c>)
+    /// in place and notify subscribers, WITHOUT a rebuild — so client MonitoredItems on the node survive.
+    /// Returns false when the node id is unknown (caller falls back to a full rebuild).
+    /// <para>
+    ///     FB-7: when the shape (DataType / ValueRank / ArrayDimensions) ACTUALLY changes, two extra things
+    ///     happen. (1) The node's value is reset to <c>BadWaitingForInitialData</c> (Value=null) so no value
+    ///     still typed to the OLD DataType is exposed between this update and the driver's next publish — the
+    ///     same fresh-node state <see cref="EnsureVariable"/> creates, which closes the "brief value-type
+    ///     mismatch" window. (2) A Part 3 <c>GeneralModelChangeEvent</c> (verb=<c>DataTypeChanged</c>) is
+    ///     raised from the Server object so model-aware clients re-read the node definition. A Writable /
+    ///     Historizing-only change (DataType + array-ness unchanged) skips both — its value stays valid and
+    ///     there is no model change to report (preserves the original surgical behaviour exactly).
+    /// </para>
+    /// <para>
+    ///     The model-change event is built under <c>Lock</c> but reported AFTER the lock is released —
+    ///     mirroring <see cref="RevertOptimisticWriteIfNeeded"/>: <c>Server.ReportEvent</c> re-enters the
+    ///     server's own subscription/event path, so holding the node <c>Lock</c> across it risks a
+    ///     lock-order inversion.
+    /// </para></summary>
+    /// <param name="variableNodeId">The folder-scoped node id of the variable to update in place.</param>
+    /// <param name="writable">When true the node becomes read/write with the inbound-write handler; otherwise read-only.</param>
+    /// <param name="historianTagname">null ⇒ not historized; non-null ⇒ Historizing with the HistoryRead bit and tagname binding.</param>
+    /// <param name="dataType">The OPC UA built-in data type name to apply (e.g. "Boolean", "Int32", "Float").</param>
+    /// <param name="isArray">When true the node becomes a 1-D array (ValueRank=OneDimension); when false scalar.</param>
+    /// <param name="arrayLength">The declared length of the 1-D array when <paramref name="isArray"/> is true; ignored for scalars.</param>
+    /// <returns>True when the in-place update was applied; false when the node id is unknown.</returns>
+    public bool UpdateTagAttributes(string variableNodeId, bool writable, string? historianTagname, string dataType, bool isArray, uint? arrayLength)
     {
         ArgumentException.ThrowIfNullOrEmpty(variableNodeId);
+        ArgumentException.ThrowIfNullOrEmpty(dataType); // widened surface ⇒ explicit contract (unknown names still map to BaseDataType)
+        BaseDataVariableState? shapeChangedNode = null;
         lock (Lock)
         {
             if (!_variables.TryGetValue(variableNodeId, out var v)) return false;
@@ -1403,8 +1430,95 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
             v.OnWriteValue = writable ? OnEquipmentTagWrite : null;
             if (historized) _historizedTagnames[variableNodeId] = historianTagname!;
             else _historizedTagnames.TryRemove(variableNodeId, out _);
+
+            // FB-7: swap DataType + ValueRank + ArrayDimensions in place, but only when they actually differ
+            // from the live node — a Writable/Historizing-only change leaves the shape untouched (no value
+            // reset, no model-change event), preserving the original surgical behaviour byte-for-byte.
+            var newDataType = ResolveBuiltInDataType(dataType);
+            var newValueRank = isArray ? ValueRanks.OneDimension : ValueRanks.Scalar;
+            if (v.DataType != newDataType || v.ValueRank != newValueRank || ArrayLengthDiffers(v, isArray, arrayLength))
+            {
+                v.DataType = newDataType;
+                v.ValueRank = newValueRank;
+                v.ArrayDimensions = isArray
+                    ? new ReadOnlyList<uint>(new UInt32Collection(new[] { arrayLength ?? 0u }))
+                    : null;
+                // Drop the stale (old-typed) value — mirrors EnsureVariable's fresh-node state so a client
+                // never reads a value whose runtime type contradicts the just-changed DataType.
+                v.Value = null;
+                v.StatusCode = StatusCodes.BadWaitingForInitialData;
+                v.Timestamp = DateTime.MinValue;
+                shapeChangedNode = v;
+            }
+
             v.ClearChangeMasks(SystemContext, includeChildren: false);
-            return true;
+        }
+        // Report OUTSIDE Lock (see the method remarks) — only when the shape actually changed.
+        if (shapeChangedNode is not null) ReportNodeShapeChangedEvent(shapeChangedNode);
+        return true;
+    }
+
+    /// <summary>True when an array target's requested 1-D length differs from the node's current one. This is
+    /// the array-to-array length-edit case: the caller's <c>ValueRank != newValueRank</c> check already catches
+    /// any scalar↔array transition, so this runs to decide whether an already-array node's dimension changed
+    /// (and treats absent/empty current dimensions as "differs", forcing the in-place update).</summary>
+    private static bool ArrayLengthDiffers(BaseDataVariableState v, bool isArray, uint? arrayLength)
+    {
+        if (!isArray) return false;                       // scalar target ⇒ ValueRank check owns the diff
+        if (v.ArrayDimensions is not { Count: > 0 }) return true; // no current dimension ⇒ shape differs
+        return v.ArrayDimensions[0] != (arrayLength ?? 0u);
+    }
+
+    /// <summary>Build (but do not report) the Part 3 <c>GeneralModelChangeEvent</c> announcing that
+    /// <paramref name="variable"/>'s definition changed (DataType / ValueRank / ArrayDimensions). Verb =
+    /// <c>DataTypeChanged</c> — the model-change verb the SDK exposes for an attribute-shape change (there is
+    /// no separate ValueRank verb). <c>internal</c> (not private) so a node-manager test can assert the
+    /// populated Changes structure at the nearest deterministic seam (the end-to-end <c>Server.ReportEvent</c>
+    /// dispatch would need a subscribed event monitored-item to observe).</summary>
+    /// <param name="variable">The variable whose shape changed.</param>
+    /// <returns>A populated, unreported <see cref="GeneralModelChangeEventState"/>.</returns>
+    internal GeneralModelChangeEventState BuildNodeShapeChangedEvent(BaseDataVariableState variable)
+    {
+        var e = new GeneralModelChangeEventState(null);
+        e.Initialize(
+            SystemContext,
+            source: null,
+            severity: EventSeverity.Medium,
+            message: new LocalizedText($"Node {variable.NodeId} definition changed (DataType/ValueRank)"));
+        // Part 3 §8.7.4: a GeneralModelChangeEvent is emitted by the Server object — set SourceNode/SourceName
+        // to Server explicitly (we report with source:null since this manager has no Server NodeState handle),
+        // so conformant clients that filter events by SourceNode still match this one.
+        e.SetChildValue(SystemContext, BrowseNames.SourceNode, ObjectIds.Server, false);
+        e.SetChildValue(SystemContext, BrowseNames.SourceName, "Server", false);
+        var change = new ModelChangeStructureDataType
+        {
+            Affected = variable.NodeId,
+            AffectedType = variable.TypeDefinitionId,
+            Verb = (byte)ModelChangeStructureVerbMask.DataTypeChanged,
+        };
+        // SetChildValue lazily creates + sets the Changes property (same pattern the audit-event builder
+        // relies on for its child PropertyStates).
+        e.SetChildValue(SystemContext, BrowseNames.Changes, new[] { change }, false);
+        return e;
+    }
+
+    /// <summary>Report the built <c>GeneralModelChangeEvent</c> through the SDK server, guarding against the
+    /// event path being disabled / having no subscribers / a transient failure — a surprise here MUST NOT
+    /// break the in-place update that already happened (mirrors <see cref="ReportAuditEvent"/>).</summary>
+    /// <param name="variable">The variable whose shape changed.</param>
+    private void ReportNodeShapeChangedEvent(BaseDataVariableState variable)
+    {
+        try
+        {
+            Server.ReportEvent(SystemContext, BuildNodeShapeChangedEvent(variable));
+        }
+        catch (Exception ex)
+        {
+            // Model-change reporting disabled / no monitored items / server shutting down ⇒ ReportEvent may
+            // no-op or throw; either way the in-place update already stands. Log to the SDK trace, don't rethrow.
+#pragma warning disable CS0618 // Utils.LogError is [Obsolete] in favour of an ITelemetryContext this manager doesn't carry.
+            Utils.LogError(ex, "OtOpcUaNodeManager: failed to report GeneralModelChangeEvent for {0}", variable.NodeId);
+#pragma warning restore CS0618
         }
     }
 

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/SdkAddressSpaceSink.cs

@@ -65,13 +65,17 @@ public sealed class SdkAddressSpaceSink : IOpcUaAddressSpaceSink, ISurgicalAddre
     public void EnsureVariable(string variableNodeId, string? parentFolderNodeId, string displayName, string dataType, bool writable, string? historianTagname = null, bool isArray = false, uint? arrayLength = null)
         => _nodeManager.EnsureVariable(variableNodeId, parentFolderNodeId, displayName, dataType, writable, historianTagname, isArray, arrayLength);
 
-    /// <summary>F10b: surgically update an existing variable node's Writable + Historizing in place
-    /// (no rebuild). Returns false when the node does not exist (caller falls back to a full rebuild).</summary>
+    /// <summary>F10b: surgically update an existing variable node's Writable + Historizing + presentation
+    /// shape (DataType / array-ness) in place (no rebuild). Returns false when the node does not exist
+    /// (caller falls back to a full rebuild).</summary>
     /// <param name="variableNodeId">The variable node identifier.</param>
     /// <param name="writable">When true the node becomes read/write with the inbound-write handler; otherwise read-only.</param>
     /// <param name="historianTagname">null ⇒ not historized; non-null ⇒ Historizing with the HistoryRead bit and tagname binding.</param>
-    public bool UpdateTagAttributes(string variableNodeId, bool writable, string? historianTagname)
-        => _nodeManager.UpdateTagAttributes(variableNodeId, writable, historianTagname);
+    /// <param name="dataType">The OPC UA built-in data type name to apply in place.</param>
+    /// <param name="isArray">When true the node becomes a 1-D array; when false scalar.</param>
+    /// <param name="arrayLength">The declared length of the 1-D array when <paramref name="isArray"/> is true.</param>
+    public bool UpdateTagAttributes(string variableNodeId, bool writable, string? historianTagname, string dataType, bool isArray, uint? arrayLength)
+        => _nodeManager.UpdateTagAttributes(variableNodeId, writable, historianTagname, dataType, isArray, arrayLength);
 
     /// <summary>Rebuilds the entire OPC UA address space.</summary>
     public void RebuildAddressSpace() => _nodeManager.RebuildAddressSpace();

tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/AddressSpaceApplierTests.cs

@@ -616,10 +616,12 @@ public sealed class AddressSpaceApplierTests
         sink.RebuildCalls.ShouldBe(1);
     }
 
-    /// <summary>H1a — a deploy that ONLY changes an existing equipment tag (e.g. flips its dataType or
-    /// Writable bit) must rebuild the address space. The planner diffs the tag into
-    /// <c>ChangedEquipmentTags</c> with no Added/Removed of anything else; the applier must still drive
-    /// exactly one rebuild so the running server drops the stale node and re-materialises it.</summary>
+    /// <summary>H1a — a deploy that ONLY changes an existing equipment tag in a NON-surgical way (here the
+    /// driver-side <c>FullName</c> re-routes to a different point) must rebuild the address space. The planner
+    /// diffs the tag into <c>ChangedEquipmentTags</c> with no Added/Removed of anything else; the applier must
+    /// still drive exactly one rebuild so the running server drops the stale node and re-materialises it.
+    /// (Surgically-applicable tag changes — Writable/Historizing/DataType/array-shape — take the in-place path
+    /// instead; those are covered by the F10b + FB-7 surgical tests.)</summary>
     [Fact]
     public void Changed_equipment_tags_only_trigger_rebuild()
     {
@@ -628,9 +630,9 @@ public sealed class AddressSpaceApplierTests
 
         var previous = CompositionWithTags(
             new EquipmentTagPlan("tag-1", "eq-1", "drv", FolderPath: "", Name: "Speed", DataType: "Float", FullName: "40001", Writable: false, Alarm: null));
-        // Same tag id, but DataType + Writable flipped — the planner classifies this as a change.
+        // Same tag id, but the driver-side FullName flipped — a non-surgical change, so the applier rebuilds.
         var next = CompositionWithTags(
-            new EquipmentTagPlan("tag-1", "eq-1", "drv", FolderPath: "", Name: "Speed", DataType: "Int32", FullName: "40001", Writable: true, Alarm: null));
+            new EquipmentTagPlan("tag-1", "eq-1", "drv", FolderPath: "", Name: "Speed", DataType: "Float", FullName: "40002", Writable: false, Alarm: null));
 
         var plan = AddressSpacePlanner.Compute(previous, next);
 
@@ -815,9 +817,9 @@ public sealed class AddressSpaceApplierTests
     }
 
     /// <summary>F10b — the skip is ONLY for a node-irrelevant vtag edit that is the SOLE change. A
-    /// node-irrelevant Expression-only vtag edit MIXED with any other change (here a changed equipment
-    /// tag) must still rebuild — the rebuild is forced by the OTHER change, and the running server gets
-    /// its single rebuild as before.</summary>
+    /// node-irrelevant Expression-only vtag edit MIXED with another NON-surgical change (here a changed
+    /// equipment tag whose driver-side <c>FullName</c> re-routes) must still rebuild — the rebuild is forced
+    /// by the OTHER change, and the running server gets its single rebuild as before.</summary>
     [Fact]
     public void Node_irrelevant_vtag_edit_mixed_with_another_change_still_rebuilds()
     {
@@ -837,13 +839,13 @@ public sealed class AddressSpaceApplierTests
                     Expression: "ctx.GetTag(\"a\") * 60", DependencyRefs: new[] { "a" }),
             },
         };
-        // Expression-only vtag edit (node-irrelevant) AND a node-affecting tag DataType flip.
+        // Expression-only vtag edit (node-irrelevant) AND a non-surgical tag change (FullName re-route).
         var next = new AddressSpaceComposition(
             Array.Empty<EquipmentNode>(), Array.Empty<DriverInstancePlan>(), Array.Empty<ScriptedAlarmPlan>())
         {
             EquipmentTags = new[]
             {
-                new EquipmentTagPlan("tag-1", "eq-1", "drv", FolderPath: "", Name: "Speed", DataType: "Int32", FullName: "40001", Writable: false, Alarm: null),
+                new EquipmentTagPlan("tag-1", "eq-1", "drv", FolderPath: "", Name: "Speed", DataType: "Float", FullName: "40002", Writable: false, Alarm: null),
             },
             EquipmentVirtualTags = new[]
             {
@@ -1157,17 +1159,19 @@ public sealed class AddressSpaceApplierTests
         sink.SurgicalCalls.ShouldHaveSingleItem().Historian.ShouldBe("WW.New");  // override verbatim
     }
 
-    /// <summary>F10b safe-default — a tag delta whose <c>DataType</c> changed is NOT surgical-eligible (the
-    /// node's value type would differ), so the applier must rebuild and make NO surgical call.</summary>
+    /// <summary>FB-7 — a tag delta whose <c>DataType</c> changed is now surgical-eligible: the sink swaps the
+    /// node's DataType in place (and raises a GeneralModelChangeEvent), so the applier SKIPS the rebuild and
+    /// makes exactly one surgical call carrying the NEW DataType. Here Writable also flips, which the same
+    /// in-place update applies. Subscriptions are preserved.</summary>
     [Fact]
-    public void Changed_tag_data_type_change_rebuilds_and_no_surgical_call()
+    public void Changed_tag_data_type_change_skips_rebuild_and_updates_in_place()
     {
         var sink = new RecordingSink();
         var applier = new AddressSpaceApplier(sink, NullLogger<AddressSpaceApplier>.Instance);
 
         var previous = CompositionWithTags(
             new EquipmentTagPlan("tag-1", "eq-1", "drv", FolderPath: "", Name: "Speed", DataType: "Float", FullName: "40001", Writable: false, Alarm: null));
-        // DataType flips AND Writable flips — DataType is node-affecting, so this must rebuild.
+        // DataType flips Float → Int32 AND Writable flips false → true — both are now surgically applied.
         var next = CompositionWithTags(
             new EquipmentTagPlan("tag-1", "eq-1", "drv", FolderPath: "", Name: "Speed", DataType: "Int32", FullName: "40001", Writable: true, Alarm: null));
 
@@ -1176,15 +1180,22 @@ public sealed class AddressSpaceApplierTests
 
         var outcome = applier.Apply(plan);
 
-        outcome.RebuildCalled.ShouldBeTrue();
-        sink.RebuildCalls.ShouldBe(1);
-        sink.SurgicalCalls.ShouldBeEmpty();
+        outcome.RebuildCalled.ShouldBeFalse();
+        sink.RebuildCalls.ShouldBe(0);                 // NO rebuild — subscriptions preserved
+        var call = sink.SurgicalCalls.ShouldHaveSingleItem();
+        call.NodeId.ShouldBe(EquipmentNodeIds.Variable("eq-1", "", "Speed"));
+        call.DataType.ShouldBe("Int32");               // the NEW DataType
+        call.Writable.ShouldBeTrue();                  // the NEW Writable, applied in the same call
+        call.IsArray.ShouldBeFalse();
+        outcome.ChangedNodes.ShouldBe(1);
     }
 
-    /// <summary>F10b safe-default — a tag delta whose <c>IsArray</c> flag changed is NOT surgical-eligible
-    /// (array-ness drives ValueRank/ArrayDimensions on the node), so the applier rebuilds.</summary>
+    /// <summary>FB-7 — a tag delta whose <c>IsArray</c> flag flips scalar → array is now surgical-eligible:
+    /// the sink swaps ValueRank + ArrayDimensions in place, so the applier skips the rebuild and the surgical
+    /// call carries the new array shape. An array tag is forced read-only (matching EnsureVariable), so the
+    /// surgical Writable is false even though the tag stays non-writable here.</summary>
     [Fact]
-    public void Changed_tag_is_array_change_rebuilds()
+    public void Changed_tag_is_array_change_skips_rebuild_and_updates_in_place()
     {
         var sink = new RecordingSink();
         var applier = new AddressSpaceApplier(sink, NullLogger<AddressSpaceApplier>.Instance);
@@ -1201,9 +1212,13 @@ public sealed class AddressSpaceApplierTests
 
         var outcome = applier.Apply(plan);
 
-        outcome.RebuildCalled.ShouldBeTrue();
-        sink.RebuildCalls.ShouldBe(1);
-        sink.SurgicalCalls.ShouldBeEmpty();
+        outcome.RebuildCalled.ShouldBeFalse();
+        sink.RebuildCalls.ShouldBe(0);
+        var call = sink.SurgicalCalls.ShouldHaveSingleItem();
+        call.IsArray.ShouldBeTrue();                   // the NEW array shape
+        call.ArrayLength.ShouldBe(16u);
+        call.DataType.ShouldBe("Int16");               // element type unchanged
+        call.Writable.ShouldBeFalse();                 // array tag forced read-only
     }
 
     /// <summary>F10b safe-default — a tag delta whose driver-side <c>FullName</c> changed is NOT
@@ -1499,10 +1514,10 @@ public sealed class AddressSpaceApplierTests
 
     private sealed class RecordingSink : IOpcUaAddressSpaceSink, ISurgicalAddressSpaceSink
     {
-        /// <summary>Gets the queue of surgical in-place tag-attribute update calls (F10b).</summary>
-        public ConcurrentQueue<(string NodeId, bool Writable, string? Historian)> SurgicalQueue { get; } = new();
+        /// <summary>Gets the queue of surgical in-place tag-attribute update calls (F10b + FB-7).</summary>
+        public ConcurrentQueue<(string NodeId, bool Writable, string? Historian, string DataType, bool IsArray, uint? ArrayLength)> SurgicalQueue { get; } = new();
         /// <summary>Gets the list of recorded surgical in-place tag-attribute update calls.</summary>
-        public List<(string NodeId, bool Writable, string? Historian)> SurgicalCalls => SurgicalQueue.ToList();
+        public List<(string NodeId, bool Writable, string? Historian, string DataType, bool IsArray, uint? ArrayLength)> SurgicalCalls => SurgicalQueue.ToList();
         /// <summary>When false, <see cref="UpdateTagAttributes"/> reports the node missing (returns false),
         /// driving the applier's rebuild fallback. Defaults to true (node present, update succeeds).</summary>
         public bool SurgicalReturns { get; init; } = true;
@@ -1511,9 +1526,12 @@ public sealed class AddressSpaceApplierTests
         /// <param name="variableNodeId">The variable node ID to update in place.</param>
         /// <param name="writable">The new Writable (AccessLevel) for the node.</param>
         /// <param name="historianTagname">The resolved historian tagname (null ⇒ not historized).</param>
-        public bool UpdateTagAttributes(string variableNodeId, bool writable, string? historianTagname)
+        /// <param name="dataType">The new OPC UA data type name to apply in place.</param>
+        /// <param name="isArray">The new array-ness of the node.</param>
+        /// <param name="arrayLength">The new 1-D array length when <paramref name="isArray"/> is true.</param>
+        public bool UpdateTagAttributes(string variableNodeId, bool writable, string? historianTagname, string dataType, bool isArray, uint? arrayLength)
         {
-            SurgicalQueue.Enqueue((variableNodeId, writable, historianTagname));
+            SurgicalQueue.Enqueue((variableNodeId, writable, historianTagname, dataType, isArray, arrayLength));
             return SurgicalReturns;
         }
 

tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/DeferredAddressSpaceSinkTests.cs

@@ -94,13 +94,19 @@ public sealed class DeferredAddressSpaceSinkTests
         var inner = new SurgicalRecordingSink { Result = true };
         deferred.SetSink(inner);
 
-        ((ISurgicalAddressSpaceSink)deferred).UpdateTagAttributes("v-1", writable: true, historianTagname: "MyTag.PV")
+        ((ISurgicalAddressSpaceSink)deferred).UpdateTagAttributes("v-1", writable: true, historianTagname: "MyTag.PV",
+            dataType: "Int32", isArray: true, arrayLength: 8u)
             .ShouldBeTrue();
 
         var call = inner.SurgicalCalls.ShouldHaveSingleItem();
         call.NodeId.ShouldBe("v-1");
         call.Writable.ShouldBeTrue();
         call.Historian.ShouldBe("MyTag.PV");
+        // FB-7: the DataType/array-shape args must forward verbatim too — a partial forward would silently
+        // drop the shape update on every driver-role host.
+        call.DataType.ShouldBe("Int32");
+        call.IsArray.ShouldBeTrue();
+        call.ArrayLength.ShouldBe(8u);
     }
 
     /// <summary>The surgical forward returns the inner's own result (false ⇒ node missing) so the caller
@@ -111,7 +117,8 @@ public sealed class DeferredAddressSpaceSinkTests
         var deferred = new DeferredAddressSpaceSink();
         deferred.SetSink(new SurgicalRecordingSink { Result = false });
 
-        ((ISurgicalAddressSpaceSink)deferred).UpdateTagAttributes("v-1", writable: false, historianTagname: null)
+        ((ISurgicalAddressSpaceSink)deferred).UpdateTagAttributes("v-1", writable: false, historianTagname: null,
+            dataType: "Float", isArray: false, arrayLength: null)
             .ShouldBeFalse();
     }
 
@@ -122,11 +129,13 @@ public sealed class DeferredAddressSpaceSinkTests
     public void UpdateTagAttributes_returns_false_when_inner_is_not_surgical()
     {
         var deferred = new DeferredAddressSpaceSink();   // default inner = null sink (not surgical)
-        ((ISurgicalAddressSpaceSink)deferred).UpdateTagAttributes("v-1", writable: true, historianTagname: null)
+        ((ISurgicalAddressSpaceSink)deferred).UpdateTagAttributes("v-1", writable: true, historianTagname: null,
+            dataType: "Float", isArray: false, arrayLength: null)
             .ShouldBeFalse();
 
         deferred.SetSink(new RecordingSink());           // a non-surgical inner
-        ((ISurgicalAddressSpaceSink)deferred).UpdateTagAttributes("v-1", writable: true, historianTagname: null)
+        ((ISurgicalAddressSpaceSink)deferred).UpdateTagAttributes("v-1", writable: true, historianTagname: null,
+            dataType: "Float", isArray: false, arrayLength: null)
             .ShouldBeFalse();
     }
 
@@ -175,13 +184,13 @@ public sealed class DeferredAddressSpaceSinkTests
     {
         /// <summary>Gets or sets the value <see cref="UpdateTagAttributes"/> returns.</summary>
         public bool Result { get; set; } = true;
-        /// <summary>Gets the recorded surgical calls.</summary>
-        public List<(string NodeId, bool Writable, string? Historian)> SurgicalCalls { get; } = new();
+        /// <summary>Gets the recorded surgical calls (incl. the FB-7 DataType/array-shape args).</summary>
+        public List<(string NodeId, bool Writable, string? Historian, string DataType, bool IsArray, uint? ArrayLength)> SurgicalCalls { get; } = new();
 
         /// <inheritdoc />
-        public bool UpdateTagAttributes(string variableNodeId, bool writable, string? historianTagname)
+        public bool UpdateTagAttributes(string variableNodeId, bool writable, string? historianTagname, string dataType, bool isArray, uint? arrayLength)
         {
-            SurgicalCalls.Add((variableNodeId, writable, historianTagname));
+            SurgicalCalls.Add((variableNodeId, writable, historianTagname, dataType, isArray, arrayLength));
             return Result;
         }
 

tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests/NodeManagerSurgicalShapeUpdateTests.cs

@@ -0,0 +1,270 @@
+using Opc.Ua;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
+
+namespace ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests;
+
+/// <summary>
+///     FB-7 — the BEHAVIOURAL half of the surgical DataType/array-shape in-place write (the applier-level
+///     eligibility + dispatch decisions live in <see cref="AddressSpaceApplierTests"/>). Boots a real
+///     <see cref="OtOpcUaSdkServer"/> through <see cref="OpcUaApplicationHost"/> (the same harness
+///     <see cref="NodeManagerWriteRevertTests"/> uses) so <see cref="OtOpcUaNodeManager.UpdateTagAttributes"/>
+///     runs against a live node manager (real <c>Lock</c> + <c>SystemContext</c> + <c>Server</c>), and asserts:
+///     <list type="bullet">
+///         <item>a DataType / ValueRank / array-length change is applied IN PLACE on the existing node and
+///         RESETS its value to BadWaitingForInitialData (no stale wrong-typed value), while the node identity
+///         (and therefore client subscriptions) survive;</item>
+///         <item>a Writable / Historizing-only change (shape unchanged) does NOT reset the value — the
+///         original surgical behaviour is preserved byte-for-byte;</item>
+///         <item>the built <c>GeneralModelChangeEvent</c> carries Changes=[{Affected=node, Verb=DataTypeChanged}].</item>
+///     </list>
+///     <para>
+///         Coverage boundary (deliberate, mirrors <see cref="NodeManagerWriteRevertTests"/>): the model-change
+///         event is asserted via its <i>builder</i> (<see cref="OtOpcUaNodeManager.BuildNodeShapeChangedEvent"/>)
+///         in isolation, not its end-to-end <c>Server.ReportEvent</c> dispatch — observing that would require a
+///         subscribed event monitored-item. The single in-lock report call-site is covered by inspection.
+///     </para>
+/// </summary>
+public sealed class NodeManagerSurgicalShapeUpdateTests : IDisposable
+{
+    private static CancellationToken Ct => TestContext.Current.CancellationToken;
+
+    private readonly string _pkiRoot = Path.Combine(
+        Path.GetTempPath(),
+        $"otopcua-surgical-shape-{Guid.NewGuid():N}");
+
+    // ───────────────────────────── Shape swap (DataType / ValueRank / array length) ─────────────────────────────
+
+    /// <summary>A DataType change swaps the node's DataType in place and resets the value (the old Float value
+    /// must not survive on a now-Int32 node); the node id is unchanged, so client subscriptions are preserved.</summary>
+    [Fact]
+    public async Task DataType_change_swaps_in_place_and_resets_value()
+    {
+        var (host, server) = await BootAsync();
+        var nm = server.NodeManager!;
+
+        nm.EnsureVariable("eq-1/sp", parentFolderNodeId: null, displayName: "Sp", dataType: "Float", writable: false);
+        nm.WriteValue("eq-1/sp", 3.5f, OpcUaQuality.Good, DateTime.UtcNow);
+        var node = nm.TryGetVariable("eq-1/sp")!;
+        node.DataType.ShouldBe(DataTypeIds.Float); // arrange guard
+
+        var applied = nm.UpdateTagAttributes("eq-1/sp", writable: false, historianTagname: null,
+            dataType: "Int32", isArray: false, arrayLength: null);
+
+        applied.ShouldBeTrue();
+        node.DataType.ShouldBe(DataTypeIds.Int32);                      // swapped in place
+        node.ValueRank.ShouldBe(ValueRanks.Scalar);
+        node.Value.ShouldBeNull();                                     // stale Float value dropped
+        node.StatusCode.ShouldBe((StatusCode)StatusCodes.BadWaitingForInitialData);
+
+        await host.DisposeAsync();
+    }
+
+    /// <summary>A scalar → array flip swaps ValueRank to OneDimension + ArrayDimensions=[len] in place and
+    /// resets the value.</summary>
+    [Fact]
+    public async Task Scalar_to_array_flip_swaps_value_rank_and_resets_value()
+    {
+        var (host, server) = await BootAsync();
+        var nm = server.NodeManager!;
+
+        nm.EnsureVariable("eq-1/buf", parentFolderNodeId: null, displayName: "Buf", dataType: "Int16", writable: false);
+        nm.WriteValue("eq-1/buf", (short)42, OpcUaQuality.Good, DateTime.UtcNow);
+        var node = nm.TryGetVariable("eq-1/buf")!;
+        node.ValueRank.ShouldBe(ValueRanks.Scalar); // arrange guard
+
+        var applied = nm.UpdateTagAttributes("eq-1/buf", writable: false, historianTagname: null,
+            dataType: "Int16", isArray: true, arrayLength: 8u);
+
+        applied.ShouldBeTrue();
+        node.ValueRank.ShouldBe(ValueRanks.OneDimension);
+        node.ArrayDimensions.ShouldNotBeNull();
+        node.ArrayDimensions[0].ShouldBe(8u);
+        node.Value.ShouldBeNull();                                     // stale scalar value dropped
+        node.StatusCode.ShouldBe((StatusCode)StatusCodes.BadWaitingForInitialData);
+
+        await host.DisposeAsync();
+    }
+
+    /// <summary>An array-to-array LENGTH change (rank stays OneDimension, only ArrayDimensions[0] differs) is
+    /// still treated as a shape change — the dimension is updated and the (now wrong-length) value reset.</summary>
+    [Fact]
+    public async Task Array_length_change_swaps_dimension_and_resets_value()
+    {
+        var (host, server) = await BootAsync();
+        var nm = server.NodeManager!;
+
+        nm.EnsureVariable("eq-1/buf", parentFolderNodeId: null, displayName: "Buf", dataType: "Int16",
+            writable: false, historianTagname: null, isArray: true, arrayLength: 4u);
+        nm.WriteValue("eq-1/buf", new short[] { 1, 2, 3, 4 }, OpcUaQuality.Good, DateTime.UtcNow);
+        var node = nm.TryGetVariable("eq-1/buf")!;
+        node.ArrayDimensions![0].ShouldBe(4u); // arrange guard
+
+        var applied = nm.UpdateTagAttributes("eq-1/buf", writable: false, historianTagname: null,
+            dataType: "Int16", isArray: true, arrayLength: 8u);
+
+        applied.ShouldBeTrue();
+        node.ArrayDimensions[0].ShouldBe(8u);
+        node.Value.ShouldBeNull();
+        node.StatusCode.ShouldBe((StatusCode)StatusCodes.BadWaitingForInitialData);
+
+        await host.DisposeAsync();
+    }
+
+    /// <summary>The symmetric array → scalar flip: ValueRank drops back to Scalar, ArrayDimensions clears to
+    /// null, and the (now wrong-shaped) array value is reset.</summary>
+    [Fact]
+    public async Task Array_to_scalar_flip_clears_dimensions_and_resets_value()
+    {
+        var (host, server) = await BootAsync();
+        var nm = server.NodeManager!;
+
+        nm.EnsureVariable("eq-1/buf", parentFolderNodeId: null, displayName: "Buf", dataType: "Int16",
+            writable: false, historianTagname: null, isArray: true, arrayLength: 4u);
+        nm.WriteValue("eq-1/buf", new short[] { 1, 2, 3, 4 }, OpcUaQuality.Good, DateTime.UtcNow);
+        var node = nm.TryGetVariable("eq-1/buf")!;
+        node.ValueRank.ShouldBe(ValueRanks.OneDimension); // arrange guard
+
+        var applied = nm.UpdateTagAttributes("eq-1/buf", writable: false, historianTagname: null,
+            dataType: "Int16", isArray: false, arrayLength: null);
+
+        applied.ShouldBeTrue();
+        node.ValueRank.ShouldBe(ValueRanks.Scalar);
+        node.ArrayDimensions.ShouldBeNull();
+        node.Value.ShouldBeNull();
+        node.StatusCode.ShouldBe((StatusCode)StatusCodes.BadWaitingForInitialData);
+
+        await host.DisposeAsync();
+    }
+
+    /// <summary>A scalar → array flip with a null arrayLength defaults ArrayDimensions to [0] — mirroring
+    /// <see cref="OtOpcUaNodeManager.EnsureVariable"/>'s fresh-node default for an unspecified length.</summary>
+    [Fact]
+    public async Task Array_flip_with_null_length_defaults_dimension_to_zero()
+    {
+        var (host, server) = await BootAsync();
+        var nm = server.NodeManager!;
+
+        nm.EnsureVariable("eq-1/buf", parentFolderNodeId: null, displayName: "Buf", dataType: "Int16", writable: false);
+        var node = nm.TryGetVariable("eq-1/buf")!;
+
+        var applied = nm.UpdateTagAttributes("eq-1/buf", writable: false, historianTagname: null,
+            dataType: "Int16", isArray: true, arrayLength: null);
+
+        applied.ShouldBeTrue();
+        node.ValueRank.ShouldBe(ValueRanks.OneDimension);
+        node.ArrayDimensions.ShouldNotBeNull();
+        node.ArrayDimensions[0].ShouldBe(0u); // null length ⇒ [0], same as EnsureVariable
+
+        await host.DisposeAsync();
+    }
+
+    // ───────────────────────────── Backward compatibility (shape unchanged) ─────────────────────────────
+
+    /// <summary>A Writable-only change (DataType + array-ness identical to the live node) must NOT reset the
+    /// value — the original surgical behaviour stands. AccessLevel flips to ReadWrite; the prior Good value
+    /// survives untouched.</summary>
+    [Fact]
+    public async Task Writable_only_change_keeps_value_and_does_not_reset()
+    {
+        var (host, server) = await BootAsync();
+        var nm = server.NodeManager!;
+
+        nm.EnsureVariable("eq-1/sp", parentFolderNodeId: null, displayName: "Sp", dataType: "Float", writable: false);
+        nm.WriteValue("eq-1/sp", 7.0f, OpcUaQuality.Good, DateTime.UtcNow);
+        var node = nm.TryGetVariable("eq-1/sp")!;
+
+        // Same DataType ("Float") + same scalar shape — only Writable flips false → true.
+        var applied = nm.UpdateTagAttributes("eq-1/sp", writable: true, historianTagname: null,
+            dataType: "Float", isArray: false, arrayLength: null);
+
+        applied.ShouldBeTrue();
+        node.Value.ShouldBe(7.0f);                                    // value preserved (NOT reset)
+        node.StatusCode.ShouldBe((StatusCode)StatusCodes.Good);       // status preserved
+        node.DataType.ShouldBe(DataTypeIds.Float);
+        // ReadWrite ⇒ CurrentRead | CurrentWrite.
+        node.AccessLevel.ShouldBe((byte)(AccessLevels.CurrentRead | AccessLevels.CurrentWrite));
+
+        await host.DisposeAsync();
+    }
+
+    /// <summary>An unknown node id (rebuilt/removed in the interim) returns false so the caller falls back to a
+    /// full rebuild; it must not throw.</summary>
+    [Fact]
+    public async Task Missing_node_returns_false()
+    {
+        var (host, server) = await BootAsync();
+        var nm = server.NodeManager!;
+
+        bool result = true;
+        Should.NotThrow(() => result = nm.UpdateTagAttributes("eq-1/gone", writable: false, historianTagname: null,
+            dataType: "Int32", isArray: false, arrayLength: null));
+        result.ShouldBeFalse();
+
+        await host.DisposeAsync();
+    }
+
+    // ───────────────────────────── GeneralModelChangeEvent builder ─────────────────────────────
+
+    /// <summary>The built model-change event announces the affected node with verb DataTypeChanged and the
+    /// node's TypeDefinition as AffectedType — what model-aware clients consume to re-read the definition.</summary>
+    [Fact]
+    public async Task Built_model_change_event_reflects_the_affected_node()
+    {
+        var (host, server) = await BootAsync();
+        var nm = server.NodeManager!;
+
+        nm.EnsureVariable("eq-1/sp", parentFolderNodeId: null, displayName: "Sp", dataType: "Float", writable: false);
+        var node = nm.TryGetVariable("eq-1/sp")!;
+
+        var e = nm.BuildNodeShapeChangedEvent(node);
+
+        e.ShouldNotBeNull();
+        e.Changes.ShouldNotBeNull();
+        var changes = e.Changes.Value;
+        changes.Length.ShouldBe(1);
+        changes[0].Affected.ShouldBe(node.NodeId);
+        changes[0].AffectedType.ShouldBe(VariableTypeIds.BaseDataVariableType);
+        changes[0].Verb.ShouldBe((byte)ModelChangeStructureVerbMask.DataTypeChanged);
+
+        await host.DisposeAsync();
+    }
+
+    private async Task<(OpcUaApplicationHost Host, OtOpcUaSdkServer Server)> BootAsync()
+    {
+        var host = new OpcUaApplicationHost(
+            new OpcUaApplicationHostOptions
+            {
+                ApplicationName = "OtOpcUa.SurgicalShapeTest",
+                ApplicationUri = $"urn:OtOpcUa.SurgicalShapeTest:{Guid.NewGuid():N}",
+                OpcUaPort = AllocateFreePort(),
+                PublicHostname = "localhost",
+                PkiStoreRoot = _pkiRoot,
+            },
+            Microsoft.Extensions.Logging.Abstractions.NullLogger<OpcUaApplicationHost>.Instance);
+
+        var server = new OtOpcUaSdkServer();
+        await host.StartAsync(server, Ct);
+        return (host, server);
+    }
+
+    private static int AllocateFreePort()
+    {
+        using var listener = new System.Net.Sockets.TcpListener(System.Net.IPAddress.Loopback, 0);
+        listener.Start();
+        var port = ((System.Net.IPEndPoint)listener.LocalEndpoint).Port;
+        listener.Stop();
+        return port;
+    }
+
+    /// <summary>Cleans up the PKI root directory.</summary>
+    public void Dispose()
+    {
+        if (Directory.Exists(_pkiRoot))
+        {
+            try { Directory.Delete(_pkiRoot, recursive: true); }
+            catch { /* best-effort cleanup */ }
+        }
+    }
+}