Merge R2-09 Driver fleet batch (arch-review round 2) [PR #437]

Findings 05/STAB-3/4/5/8/12/16/17 + CONV-4 + onError (6 sub-batches, 29 tasks):
Modbus desync teardown, AbCip runtime lock, FOCAS concurrent caches, new
ConnectionBackoff + PollGroupEngine v2 (S7 poll fork deleted onto it, reconciled
with R2-01), fleet connect throttles, ResolveHost via resolver, TwinCAT replay
hardening. 29/29 tasks. S7 254/254 verified post-merge; build clean.

src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/ConnectionBackoff.cs

@@ -0,0 +1,93 @@
+namespace ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+/// <summary>
+///     Shared capped-exponential backoff for poll-based / lazy-reconnect drivers, extracted from
+///     the S7 driver's bespoke poll fork (05/STAB-8, CONV-1). Provides two surfaces:
+///     <list type="bullet">
+///         <item><see cref="ComputeDelay"/> — the pure schedule (base, 2×, 4×, … saturating at a
+///         cap) used by <c>PollGroupEngine</c> to stretch its retry cadence under sustained
+///         failure.</item>
+///         <item>The instance API (<see cref="ShouldAttempt"/> / <see cref="RecordFailure"/> /
+///         <see cref="RecordSuccess"/>) — a per-device connect-attempt throttle so a dead device
+///         is not hammered with a full reconnect on every data call / poll tick.</item>
+///     </list>
+/// </summary>
+/// <remarks>
+///     <para>
+///         <b>Not internally synchronized.</b> The instance methods mutate plain fields; every
+///         intended call site already serializes on its per-device gate (the driver's
+///         <c>ConnectGate</c> / connect semaphore / probe lock), so adding lock-free interlocked
+///         state would be needless complexity. Callers MUST invoke the instance under that gate.
+///     </para>
+///     <para>
+///         <see cref="ComputeDelay"/> is pure + thread-safe and may be called from anywhere.
+///     </para>
+/// </remarks>
+public sealed class ConnectionBackoff
+{
+    private readonly TimeSpan _baseDelay;
+    private readonly TimeSpan _maxDelay;
+    private int _consecutiveFailures;
+    private DateTime _nextAttemptUtc = DateTime.MinValue;
+
+    /// <summary>Initializes a new per-device attempt throttle.</summary>
+    /// <param name="baseDelay">The initial backoff window after the first failure.</param>
+    /// <param name="maxDelay">The upper bound the exponential growth saturates at.</param>
+    public ConnectionBackoff(TimeSpan baseDelay, TimeSpan maxDelay)
+    {
+        _baseDelay = baseDelay;
+        _maxDelay = maxDelay;
+    }
+
+    /// <summary>
+    ///     Capped exponential backoff schedule. <paramref name="consecutiveFailures"/> ≤ 0 returns
+    ///     <paramref name="baseInterval"/>; each subsequent failure doubles the wait up to
+    ///     <paramref name="cap"/>. Computed in ticks with an overflow guard so a large failure
+    ///     count saturates at the cap rather than wrapping negative. Ported verbatim from the S7
+    ///     poll fork's <c>ComputeBackoffDelay</c>.
+    /// </summary>
+    /// <param name="baseInterval">The base interval (returned when there are no failures).</param>
+    /// <param name="consecutiveFailures">The number of consecutive failures observed.</param>
+    /// <param name="cap">The maximum delay the schedule saturates at.</param>
+    /// <returns>The computed backoff delay.</returns>
+    public static TimeSpan ComputeDelay(TimeSpan baseInterval, int consecutiveFailures, TimeSpan cap)
+    {
+        if (consecutiveFailures <= 0) return baseInterval;
+        // Cap the shift to avoid overflow — at 30 the result already saturates the cap for any
+        // reasonable base interval.
+        var shift = Math.Min(consecutiveFailures - 1, 30);
+        var ticks = baseInterval.Ticks << shift;
+        if (ticks <= 0 || ticks > cap.Ticks) return cap;
+        return TimeSpan.FromTicks(ticks);
+    }
+
+    /// <summary>
+    ///     Returns <c>true</c> when <paramref name="nowUtc"/> is at or past the end of the current
+    ///     backoff window (i.e. a connect / create attempt is due). A fresh instance and a
+    ///     just-reset instance always return <c>true</c>.
+    /// </summary>
+    /// <param name="nowUtc">The current UTC time.</param>
+    /// <returns><c>true</c> when an attempt is permitted.</returns>
+    public bool ShouldAttempt(DateTime nowUtc) => nowUtc >= _nextAttemptUtc;
+
+    /// <summary>
+    ///     Records a failed attempt: increments the consecutive-failure count and opens a backoff
+    ///     window ending <see cref="ComputeDelay"/> from <paramref name="nowUtc"/>.
+    /// </summary>
+    /// <param name="nowUtc">The current UTC time (the window is measured from here).</param>
+    public void RecordFailure(DateTime nowUtc)
+    {
+        _consecutiveFailures++;
+        _nextAttemptUtc = nowUtc + ComputeDelay(_baseDelay, _consecutiveFailures, _maxDelay);
+    }
+
+    /// <summary>
+    ///     Records a successful attempt: resets the failure count and clears the window so the next
+    ///     attempt is permitted immediately. Recovery is never delayed by a residual backoff window.
+    /// </summary>
+    public void RecordSuccess()
+    {
+        _consecutiveFailures = 0;
+        _nextAttemptUtc = DateTime.MinValue;
+    }
+}

src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/PollGroupEngine.cs

@@ -35,6 +35,7 @@ public sealed class PollGroupEngine : IAsyncDisposable
     private readonly Action<ISubscriptionHandle, string, DataValueSnapshot> _onChange;
     private readonly Action<Exception>? _onError;
     private readonly TimeSpan _minInterval;
+    private readonly TimeSpan? _backoffCap;
     private readonly ConcurrentDictionary<long, SubscriptionState> _subscriptions = new();
     private long _nextId;
 
@@ -52,11 +53,17 @@ public sealed class PollGroupEngine : IAsyncDisposable
     ///     internal contract-violation throw) so the owning driver can route the failure to its
     ///     health surface. Defensive: an <c>onError</c> handler that
     ///     itself throws is silently absorbed so a buggy forwarder cannot crash the poll loop.</param>
+    /// <param name="backoffCap">Optional cap enabling capped-exponential failure backoff
+    ///     (05/STAB-8). When supplied, sustained reader failures stretch the retry cadence
+    ///     (interval, 2×, 4×, … saturating at this cap) instead of hammering a dead device every
+    ///     tick; a successful poll resets to the base interval. <c>null</c> (default) keeps the
+    ///     byte-identical fixed-interval cadence for consumers that have not opted in.</param>
     public PollGroupEngine(
         Func<IReadOnlyList<string>, CancellationToken, Task<IReadOnlyList<DataValueSnapshot>>> reader,
         Action<ISubscriptionHandle, string, DataValueSnapshot> onChange,
         TimeSpan? minInterval = null,
-        Action<Exception>? onError = null)
+        Action<Exception>? onError = null,
+        TimeSpan? backoffCap = null)
     {
         ArgumentNullException.ThrowIfNull(reader);
         ArgumentNullException.ThrowIfNull(onChange);
@@ -64,6 +71,7 @@ public sealed class PollGroupEngine : IAsyncDisposable
         _onChange = onChange;
         _onError = onError;
         _minInterval = minInterval ?? DefaultMinInterval;
+        _backoffCap = backoffCap;
     }
 
     /// <summary>Register a new polled subscription and start its background loop.</summary>
@@ -116,31 +124,54 @@ public sealed class PollGroupEngine : IAsyncDisposable
 
     private async Task PollLoopAsync(SubscriptionState state, CancellationToken ct)
     {
+        var consecutiveFailures = 0;
+
         // Initial-data push: every subscribed tag fires once at subscribe time regardless of
         // whether it has changed, satisfying OPC UA Part 4 initial-value semantics.
-        try { await PollOnceAsync(state, forceRaise: true, ct).ConfigureAwait(false); }
-        catch (OperationCanceledException) { return; }
+        try
+        {
+            await PollOnceAsync(state, forceRaise: true, ct).ConfigureAwait(false);
+            consecutiveFailures = 0;
+        }
+        // Only a teardown OCE (the loop's OWN token) exits the loop. A reader that throws OCE with
+        // the loop token un-cancelled — a driver-internal timeout CTS (the STAB-14/STAB-15 class) —
+        // must NOT tear the loop down: it falls through to the generic handler, is reported, and the
+        // loop retries with backoff. This is the guard that makes the S7 fork migration safe.
+        catch (OperationCanceledException) when (ct.IsCancellationRequested) { return; }
         catch (Exception ex) when (!IsFatal(ex))
         {
             // first-read error tolerated — loop continues; forward to driver health surface.
+            consecutiveFailures++;
             ReportError(ex);
         }
 
         while (!ct.IsCancellationRequested)
         {
-            try { await Task.Delay(state.Interval, ct).ConfigureAwait(false); }
+            // Fixed cadence by default; when a backoff cap is configured, sustained failures
+            // stretch the delay (capped exponential) and a success snaps it back to Interval.
+            var delay = _backoffCap is null
+                ? state.Interval
+                : ConnectionBackoff.ComputeDelay(state.Interval, consecutiveFailures, _backoffCap.Value);
+            try { await Task.Delay(delay, ct).ConfigureAwait(false); }
             catch (OperationCanceledException) { return; }
             // Defensive: the CTS may be disposed by Unsubscribe/DisposeAsync between the
             // cancellation check above and the Task.Delay touching the token. Treat that race
             // as a normal cancellation rather than a fatal exception.
             catch (ObjectDisposedException) { return; }
 
-            try { await PollOnceAsync(state, forceRaise: false, ct).ConfigureAwait(false); }
-            catch (OperationCanceledException) { return; }
+            try
+            {
+                await PollOnceAsync(state, forceRaise: false, ct).ConfigureAwait(false);
+                consecutiveFailures = 0;
+            }
+            // Only teardown (the loop token) exits; a reader OCE with ct un-cancelled backs off
+            // like any other failure instead of killing the loop (STAB-14 engine guard).
+            catch (OperationCanceledException) when (ct.IsCancellationRequested) { return; }
             catch (Exception ex) when (!IsFatal(ex))
             {
-                // transient poll error — loop continues, driver health surface logs it
-                // via the supplied onError callback.
+                // transient poll error — loop continues (with backoff when configured); driver
+                // health surface logs it via the supplied onError callback.
+                consecutiveFailures++;
                 ReportError(ex);
             }
         }

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipDriver.cs

@@ -133,10 +133,29 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
         _poll = new PollGroupEngine(
             reader: ReadAsync,
             onChange: (handle, tagRef, snapshot) =>
-                OnDataChange?.Invoke(this, new DataChangeEventArgs(handle, tagRef, snapshot)));
+                OnDataChange?.Invoke(this, new DataChangeEventArgs(handle, tagRef, snapshot)),
+            onError: HandlePollError,
+            backoffCap: PollBackoffCap);
         _alarmProjection = new AbCipAlarmProjection(this, _options.AlarmPollInterval, _logger);
     }
 
+    /// <summary>Upper bound on the poll-loop failure backoff — adopts the S7-proven 30 s cap fleet-wide (05/STAB-8).</summary>
+    private static readonly TimeSpan PollBackoffCap = TimeSpan.FromSeconds(30);
+
+    /// <summary>
+    ///     05/STAB-9 — routes a poll-loop reader failure to the driver health surface: logs it and
+    ///     degrades to <see cref="DriverState.Degraded"/> preserving <c>LastSuccessfulRead</c>.
+    ///     Never downgrades a <see cref="DriverState.Faulted"/> state (a stronger, config-level signal).
+    /// </summary>
+    /// <param name="ex">The exception caught by the poll engine.</param>
+    internal void HandlePollError(Exception ex)
+    {
+        _logger.LogWarning(ex, "AbCip poll reader failed. Driver={DriverInstanceId}", _driverInstanceId);
+        var current = _health;
+        if (current.State != DriverState.Faulted)
+            _health = new DriverHealth(DriverState.Degraded, current.LastSuccessfulRead, ex.Message);
+    }
+
     /// <summary>
     ///     Fetch + cache the shape of a Logix UDT by template instance id. First call reads
     ///     the Template Object off the controller; subsequent calls for the same
@@ -436,6 +455,8 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
                 }
                 await probeRuntime.ReadAsync(ct).ConfigureAwait(false);
                 success = probeRuntime.GetStatus() == 0;
+                if (success)
+                    state.Backoff.RecordSuccess(); // 05/STAB-8: device reachable — reset the data-path window
             }
             catch (OperationCanceledException) when (ct.IsCancellationRequested)
             {
@@ -452,6 +473,7 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
                 try { probeRuntime?.Dispose(); } catch { }
                 probeRuntime = null;
                 state.ProbeInitialized = false;
+                state.Backoff.RecordFailure(DateTime.UtcNow); // 05/STAB-8: keep the data-path window open
             }
 
             TransitionDeviceState(state, success ? HostState.Running : HostState.Stopped);
@@ -479,10 +501,19 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
 
     // ---- IPerCallHostResolver ----
 
-    /// <inheritdoc />
+    /// <summary>
+    ///     Resolve a read/write/subscribe reference to the device host that keys its per-host
+    ///     resilience (bulkhead / circuit breaker). CONV-4: routes through
+    ///     <see cref="EquipmentTagRefResolver{TDef}"/> so an equipment-tag reference (raw TagConfig
+    ///     JSON) resolves to its OWN authored device rather than the first-device fallback — else a
+    ///     broken device B would trip device A's breaker. The resolver caches parses, so this adds
+    ///     no per-call cost after first use.
+    /// </summary>
+    /// <param name="fullReference">The tag reference (authored name or equipment-tag JSON).</param>
+    /// <returns>The device host key.</returns>
     public string ResolveHost(string fullReference)
     {
-        if (_tagsByName.TryGetValue(fullReference, out var def))
+        if (_resolver.TryResolve(fullReference, out var def) && !string.IsNullOrEmpty(def.DeviceHostAddress))
             return def.DeviceHostAddress;
         return _options.Devices.FirstOrDefault()?.HostAddress ?? DriverInstanceId;
     }
@@ -542,37 +573,49 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
         try
         {
             var runtime = await EnsureTagRuntimeAsync(device, def, ct).ConfigureAwait(false);
-            await runtime.ReadAsync(ct).ConfigureAwait(false);
 
-            var status = runtime.GetStatus();
-            if (status != 0)
+            // Serialise Read → GetStatus → Decode against the shared runtime — the cached libplctag
+            // Tag handle is not concurrency-safe and GetStatus returns the LAST op's status (05/STAB-4).
+            var opLock = device.GetRuntimeLock(def.Name);
+            await opLock.WaitAsync(ct).ConfigureAwait(false);
+            try
             {
-                // Evict the stale handle so the next call re-creates it.
-                // A non-zero status can mean the controller dropped the connection or the tag
-                // handle became permanently invalid (e.g. after a PLC download). Evicting
-                // mirrors the probe loop's recreate-on-failure behaviour.
-                EvictRuntime(device, def.Name);
-                results[fb.OriginalIndex] = new DataValueSnapshot(null,
-                    AbCipStatusMapper.MapLibplctagStatus(status), null, now);
-                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead,
-                    $"libplctag status {status} reading {reference}");
-                _logger.LogWarning(
-                    "AbCip read returned non-zero libplctag status {LibplctagStatus} for tag {Tag} on device {Device}; " +
-                    "evicting cached runtime so next call re-creates it",
-                    status, reference, def.DeviceHostAddress);
-                return;
-            }
+                await runtime.ReadAsync(ct).ConfigureAwait(false);
 
-            var tagPath = AbCipTagPath.TryParse(def.TagPath);
-            var bitIndex = tagPath?.BitIndex;
-            // Review I-1 — an array tag (the EXPLICIT IsArray flag) decodes the whole buffer into an
-            // element-typed CLR array (int[]/float[]/bool[]/string[]…), INCLUDING a 1-element array
-            // (ElementCount 1). Scalar tags keep the single-value path.
-            var value = IsArrayTag(def)
-                ? runtime.DecodeArray(def.DataType, Math.Max(1, def.ElementCount))
-                : runtime.DecodeValue(def.DataType, bitIndex);
-            results[fb.OriginalIndex] = new DataValueSnapshot(value, AbCipStatusMapper.Good, now, now);
-            _health = new DriverHealth(DriverState.Healthy, now, null);
+                var status = runtime.GetStatus();
+                if (status != 0)
+                {
+                    // Evict the stale handle so the next call re-creates it.
+                    // A non-zero status can mean the controller dropped the connection or the tag
+                    // handle became permanently invalid (e.g. after a PLC download). Evicting
+                    // mirrors the probe loop's recreate-on-failure behaviour.
+                    EvictRuntime(device, def.Name);
+                    results[fb.OriginalIndex] = new DataValueSnapshot(null,
+                        AbCipStatusMapper.MapLibplctagStatus(status), null, now);
+                    _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead,
+                        $"libplctag status {status} reading {reference}");
+                    _logger.LogWarning(
+                        "AbCip read returned non-zero libplctag status {LibplctagStatus} for tag {Tag} on device {Device}; " +
+                        "evicting cached runtime so next call re-creates it",
+                        status, reference, def.DeviceHostAddress);
+                    return;
+                }
+
+                var tagPath = AbCipTagPath.TryParse(def.TagPath);
+                var bitIndex = tagPath?.BitIndex;
+                // Review I-1 — an array tag (the EXPLICIT IsArray flag) decodes the whole buffer into an
+                // element-typed CLR array (int[]/float[]/bool[]/string[]…), INCLUDING a 1-element array
+                // (ElementCount 1). Scalar tags keep the single-value path.
+                var value = IsArrayTag(def)
+                    ? runtime.DecodeArray(def.DataType, Math.Max(1, def.ElementCount))
+                    : runtime.DecodeValue(def.DataType, bitIndex);
+                results[fb.OriginalIndex] = new DataValueSnapshot(value, AbCipStatusMapper.Good, now, now);
+                _health = new DriverHealth(DriverState.Healthy, now, null);
+            }
+            finally
+            {
+                opLock.Release();
+            }
         }
         catch (OperationCanceledException)
         {
@@ -612,29 +655,41 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
         try
         {
             var runtime = await EnsureTagRuntimeAsync(device, parent, ct).ConfigureAwait(false);
-            await runtime.ReadAsync(ct).ConfigureAwait(false);
 
-            var status = runtime.GetStatus();
-            if (status != 0)
+            // Serialise the whole-UDT Read → GetStatus → per-member DecodeValueAt against the shared
+            // parent runtime — the members decode from that one handle's buffer (05/STAB-4).
+            var opLock = device.GetRuntimeLock(parent.Name);
+            await opLock.WaitAsync(ct).ConfigureAwait(false);
+            try
             {
-                EvictRuntime(device, parent.Name);
-                var mapped = AbCipStatusMapper.MapLibplctagStatus(status);
-                StampGroupStatus(group, results, now, mapped);
-                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead,
-                    $"libplctag status {status} reading UDT {group.ParentName}");
-                _logger.LogWarning(
-                    "AbCip whole-UDT read returned non-zero libplctag status {LibplctagStatus} for parent {Parent} " +
-                    "on device {Device}; {MemberCount} member values stamped with mapped status",
-                    status, group.ParentName, parent.DeviceHostAddress, group.Members.Count);
-                return;
-            }
+                await runtime.ReadAsync(ct).ConfigureAwait(false);
 
-            foreach (var member in group.Members)
-            {
-                var value = runtime.DecodeValueAt(member.Definition.DataType, member.Offset, bitIndex: null);
-                results[member.OriginalIndex] = new DataValueSnapshot(value, AbCipStatusMapper.Good, now, now);
+                var status = runtime.GetStatus();
+                if (status != 0)
+                {
+                    EvictRuntime(device, parent.Name);
+                    var mapped = AbCipStatusMapper.MapLibplctagStatus(status);
+                    StampGroupStatus(group, results, now, mapped);
+                    _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead,
+                        $"libplctag status {status} reading UDT {group.ParentName}");
+                    _logger.LogWarning(
+                        "AbCip whole-UDT read returned non-zero libplctag status {LibplctagStatus} for parent {Parent} " +
+                        "on device {Device}; {MemberCount} member values stamped with mapped status",
+                        status, group.ParentName, parent.DeviceHostAddress, group.Members.Count);
+                    return;
+                }
+
+                foreach (var member in group.Members)
+                {
+                    var value = runtime.DecodeValueAt(member.Definition.DataType, member.Offset, bitIndex: null);
+                    results[member.OriginalIndex] = new DataValueSnapshot(value, AbCipStatusMapper.Good, now, now);
+                }
+                _health = new DriverHealth(DriverState.Healthy, now, null);
+            }
+            finally
+            {
+                opLock.Release();
             }
-            _health = new DriverHealth(DriverState.Healthy, now, null);
         }
         catch (OperationCanceledException)
         {
@@ -706,10 +761,23 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
                 }
 
                 var runtime = await EnsureTagRuntimeAsync(device, def, cancellationToken).ConfigureAwait(false);
-                runtime.EncodeValue(def.DataType, parsedPath?.BitIndex, w.Value);
-                await runtime.WriteAsync(cancellationToken).ConfigureAwait(false);
 
-                var status = runtime.GetStatus();
+                // Serialise Encode → Write → GetStatus against the shared runtime — the same cached
+                // Tag handle may be in use by a concurrent ReadAsync or poll loop (05/STAB-4).
+                var opLock = device.GetRuntimeLock(def.Name);
+                await opLock.WaitAsync(cancellationToken).ConfigureAwait(false);
+                int status;
+                try
+                {
+                    runtime.EncodeValue(def.DataType, parsedPath?.BitIndex, w.Value);
+                    await runtime.WriteAsync(cancellationToken).ConfigureAwait(false);
+                    status = runtime.GetStatus();
+                }
+                finally
+                {
+                    opLock.Release();
+                }
+
                 if (status != 0)
                 {
                     EvictRuntime(device, def.Name);
@@ -844,6 +912,13 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
         return device.ParentRuntimes[parentTagName];
     }
 
+    /// <summary>
+    ///     Thrown when a per-device <see cref="ConnectionBackoff"/> window is still open (05/STAB-8)
+    ///     — a fail-fast that costs no wire traffic. Read/write map it to <c>BadCommunicationError</c>
+    ///     via their generic catch, exactly as a real Forward-Open failure.
+    /// </summary>
+    private sealed class ConnectionThrottledException(string message) : Exception(message);
+
     /// <summary>
     ///     Idempotently materialise the runtime handle for a tag definition. First call creates
     ///     + initialises the libplctag Tag; subsequent calls reuse the cached handle for the
@@ -858,6 +933,14 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
             ?? throw new InvalidOperationException(
                 $"AbCip tag '{def.Name}' has malformed TagPath '{def.TagPath}'.");
 
+        // 05/STAB-8: inside an open backoff window a data-path caller fails fast — no runtime
+        // create, no Forward-Open. The malformed-path config error above still surfaces (a permanent
+        // fault must never be masked by the window); only the expensive create+init is throttled. The
+        // probe loop bypasses this (its own runtime) and drives the failure/success recording.
+        if (!device.Backoff.ShouldAttempt(DateTime.UtcNow))
+            throw new ConnectionThrottledException(
+                $"AbCip runtime create for '{def.Name}' on {device.Options.HostAddress} throttled — backoff window open after a recent Forward-Open failure.");
+
         // Review I-1 — an array tag (the EXPLICIT IsArray flag, incl. a 1-element array) sets
         // libplctag's elem_count so the read pulls every element in one CIP transaction; the read
         // path then boxes them into a typed CLR array. Scalar tags pass count 1 + IsArray false.
@@ -871,8 +954,10 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
         catch
         {
             runtime.Dispose();
+            device.Backoff.RecordFailure(DateTime.UtcNow); // 05/STAB-8: open the backoff window
             throw;
         }
+        device.Backoff.RecordSuccess(); // 05/STAB-8: Forward-Open succeeded — reset the window
         // Two concurrent callers can both miss the cache + both initialize a runtime; only the
         // first TryAdd wins. Dispose the loser so it doesn't leak a native tag handle.
         if (device.Runtimes.TryAdd(def.Name, runtime))
@@ -1198,6 +1283,14 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
 
         /// <summary>Gets the lock object used for probe synchronization.</summary>
         public object ProbeLock { get; } = new();
+
+        /// <summary>
+        ///     Per-device connect-attempt throttle (05/STAB-8). After a failed runtime create
+        ///     (Forward-Open), data-path callers fail fast inside the backoff window instead of
+        ///     re-creating + re-initializing a runtime per tag per tick; the probe loop bypasses it
+        ///     (its own runtime) and drives failure/success so a recovered device resets the window.
+        /// </summary>
+        public ConnectionBackoff Backoff { get; } = new(TimeSpan.FromSeconds(1), TimeSpan.FromSeconds(30));
         /// <summary>Gets or sets the current host state of this device.</summary>
         public HostState HostState { get; set; } = HostState.Unknown;
         /// <summary>Gets or sets the UTC timestamp when the host state was last changed.</summary>
@@ -1243,6 +1336,24 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
         public SemaphoreSlim GetRmwLock(string parentTagName) =>
             _rmwLocks.GetOrAdd(parentTagName, _ => new SemaphoreSlim(1, 1));
 
+        private readonly System.Collections.Concurrent.ConcurrentDictionary<string, SemaphoreSlim> _runtimeLocks =
+            new(StringComparer.OrdinalIgnoreCase);
+
+        /// <summary>
+        ///     Per-runtime operation lock (05/STAB-4). A libplctag <c>Tag</c> handle is not safe for
+        ///     concurrent Read/GetStatus/DecodeValue (or Encode/Write/GetStatus) — the server read
+        ///     path, every poll-group loop, and the alarm-projection loop all call
+        ///     <see cref="AbCipDriver.ReadAsync"/> / <see cref="AbCipDriver.WriteAsync"/> against the
+        ///     same cached runtime, and <c>GetStatus</c> returns the <em>last</em> operation's status
+        ///     — so an unserialised overlap decodes a torn / cross-attributed value with Good status.
+        ///     Callers hold this lock around the whole op sequence. Keyed by tag name, which is also
+        ///     the <see cref="Runtimes"/> dictionary key. Mirrors the field-proven AbLegacy pattern.
+        /// </summary>
+        /// <param name="tagName">The tag name (the <see cref="Runtimes"/> key).</param>
+        /// <returns>The per-runtime operation semaphore.</returns>
+        public SemaphoreSlim GetRuntimeLock(string tagName) =>
+            _runtimeLocks.GetOrAdd(tagName, _ => new SemaphoreSlim(1, 1));
+
         /// <summary>
         ///     Compute the effective <see cref="AbCipTagCreateParams"/> for a
         ///     tag on this device. Combines the per-device options
@@ -1277,6 +1388,12 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
             Runtimes.Clear();
             foreach (var r in ParentRuntimes.Values) r.Dispose();
             ParentRuntimes.Clear();
+            // Dispose + clear the per-runtime/RMW gates so ReinitializeAsync cycles don't orphan
+            // their SemaphoreSlim instances (each leaks a wait handle once contended).
+            foreach (var sem in _runtimeLocks.Values) sem.Dispose();
+            _runtimeLocks.Clear();
+            foreach (var sem in _rmwLocks.Values) sem.Dispose();
+            _rmwLocks.Clear();
         }
     }
 }

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/AbLegacyDriver.cs

@@ -65,7 +65,26 @@ public sealed class AbLegacyDriver : IDriver, IReadable, IWritable, ITagDiscover
         _poll = new PollGroupEngine(
             reader: ReadAsync,
             onChange: (handle, tagRef, snapshot) =>
-                OnDataChange?.Invoke(this, new DataChangeEventArgs(handle, tagRef, snapshot)));
+                OnDataChange?.Invoke(this, new DataChangeEventArgs(handle, tagRef, snapshot)),
+            onError: HandlePollError,
+            backoffCap: PollBackoffCap);
+    }
+
+    /// <summary>Upper bound on the poll-loop failure backoff — adopts the S7-proven 30 s cap fleet-wide (05/STAB-8).</summary>
+    private static readonly TimeSpan PollBackoffCap = TimeSpan.FromSeconds(30);
+
+    /// <summary>
+    ///     05/STAB-9 — routes a poll-loop reader failure to the driver health surface: logs it and
+    ///     degrades to <see cref="DriverState.Degraded"/> preserving <c>LastSuccessfulRead</c>.
+    ///     Never downgrades a <see cref="DriverState.Faulted"/> state (a stronger, config-level signal).
+    /// </summary>
+    /// <param name="ex">The exception caught by the poll engine.</param>
+    internal void HandlePollError(Exception ex)
+    {
+        _logger.LogWarning(ex, "AbLegacy poll reader failed. Driver={DriverInstanceId}", _driverInstanceId);
+        var current = _health;
+        if (current.State != DriverState.Faulted)
+            _health = new DriverHealth(DriverState.Degraded, current.LastSuccessfulRead, ex.Message);
     }
 
     /// <inheritdoc />
@@ -492,10 +511,18 @@ public sealed class AbLegacyDriver : IDriver, IReadable, IWritable, ITagDiscover
 
     // ---- IPerCallHostResolver ----
 
-    /// <inheritdoc />
+    /// <summary>
+    ///     Resolve a reference to the device host that keys its per-host resilience
+    ///     (bulkhead / circuit breaker). CONV-4: routes through
+    ///     <see cref="EquipmentTagRefResolver{TDef}"/> so an equipment-tag reference (raw TagConfig
+    ///     JSON) resolves to its OWN authored device rather than the first-device fallback. The
+    ///     resolver caches parses, so this adds no per-call cost after first use.
+    /// </summary>
+    /// <param name="fullReference">The tag reference (authored name or equipment-tag JSON).</param>
+    /// <returns>The device host key.</returns>
     public string ResolveHost(string fullReference)
     {
-        if (_tagsByName.TryGetValue(fullReference, out var def))
+        if (_resolver.TryResolve(fullReference, out var def) && !string.IsNullOrEmpty(def.DeviceHostAddress))
             return def.DeviceHostAddress;
         return _options.Devices.FirstOrDefault()?.HostAddress ?? DriverInstanceId;
     }

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasDriver.cs

@@ -72,7 +72,27 @@ public sealed class FocasDriver : IDriver, IReadable, IWritable, ITagDiscovery,
         _poll = new PollGroupEngine(
             reader: ReadAsync,
             onChange: (handle, tagRef, snapshot) =>
-                OnDataChange?.Invoke(this, new DataChangeEventArgs(handle, tagRef, snapshot)));
+                OnDataChange?.Invoke(this, new DataChangeEventArgs(handle, tagRef, snapshot)),
+            onError: HandlePollError,
+            backoffCap: PollBackoffCap);
+    }
+
+    /// <summary>Upper bound on the poll-loop failure backoff — adopts the S7-proven 30 s cap fleet-wide (05/STAB-8).</summary>
+    private static readonly TimeSpan PollBackoffCap = TimeSpan.FromSeconds(30);
+
+    /// <summary>
+    ///     05/STAB-9 — routes a poll-loop reader failure to the driver health surface: logs it and
+    ///     degrades to <see cref="DriverState.Degraded"/> preserving <c>LastSuccessfulRead</c>.
+    ///     Never downgrades a <see cref="DriverState.Faulted"/> state (a stronger, config-level signal).
+    /// </summary>
+    /// <param name="ex">The exception caught by the poll engine.</param>
+    internal void HandlePollError(Exception ex)
+    {
+        _logger.LogWarning(ex, "FOCAS poll reader failed. Driver={DriverInstanceId}", _driverInstanceId);
+        var current = Volatile.Read(ref _health);
+        if (current.State != DriverState.Faulted)
+            Volatile.Write(ref _health,
+                new DriverHealth(DriverState.Degraded, current.LastSuccessfulRead, ex.Message));
     }
 
     /// <inheritdoc />
@@ -609,7 +629,9 @@ public sealed class FocasDriver : IDriver, IReadable, IWritable, ITagDiscovery,
             var success = false;
             try
             {
-                var client = await EnsureConnectedAsync(state, ct).ConfigureAwait(false);
+                // The probe bypasses the connect backoff — its own interval is the bounded recovery
+                // cadence, and a successful probe connect resets the window for the data + loop paths.
+                var client = await EnsureConnectedAsync(state, ct, bypassBackoff: true).ConfigureAwait(false);
                 // Apply Probe.Timeout so a hung CNC socket gets cancelled at the configured
                 // budget rather than blocking until the OS TCP timeout.
                 // TimeSpan.Zero / negative means "no per-probe timeout" — fall back to the loop
@@ -1092,18 +1114,42 @@ public sealed class FocasDriver : IDriver, IReadable, IWritable, ITagDiscovery,
 
     // ---- IPerCallHostResolver ----
 
-    /// <inheritdoc />
+    /// <summary>
+    ///     Resolve a reference to the device host that keys its per-host resilience
+    ///     (bulkhead / circuit breaker). CONV-4: routes through
+    ///     <see cref="EquipmentTagRefResolver{TDef}"/> so an equipment-tag reference (raw TagConfig
+    ///     JSON) resolves to its OWN authored device rather than the first-device fallback. The
+    ///     empty-host guard covers FOCAS's <c>?? ""</c> default so an address-less equipment tag
+    ///     falls back rather than keying an empty host. The resolver caches parses, so this adds no
+    ///     per-call cost after first use.
+    /// </summary>
+    /// <param name="fullReference">The tag reference (authored name or equipment-tag JSON).</param>
+    /// <returns>The device host key.</returns>
     public string ResolveHost(string fullReference)
     {
-        if (_tagsByName.TryGetValue(fullReference, out var def))
+        if (_resolver.TryResolve(fullReference, out var def) && !string.IsNullOrEmpty(def.DeviceHostAddress))
             return def.DeviceHostAddress;
         return _options.Devices.FirstOrDefault()?.HostAddress ?? DriverInstanceId;
     }
 
-    private async Task<IFocasClient> EnsureConnectedAsync(DeviceState device, CancellationToken ct)
+    /// <summary>
+    ///     Thrown when a per-device <see cref="ConnectionBackoff"/> window is still open (05/STAB-8)
+    ///     — a fail-fast that costs no wire traffic. Read/write map it to <c>BadCommunicationError</c>
+    ///     via their generic catch, exactly as a real connect failure.
+    /// </summary>
+    private sealed class ConnectionThrottledException(string message) : Exception(message);
+
+    private async Task<IFocasClient> EnsureConnectedAsync(
+        DeviceState device, CancellationToken ct, bool bypassBackoff = false)
     {
         if (device.Client is { IsConnected: true } c) return c;
 
+        // 05/STAB-8: inside an open backoff window a data-path / per-tick-loop caller fails fast — no
+        // socket create, no wire connect. The probe loop bypasses this and drives failure/success.
+        if (!bypassBackoff && !device.Backoff.ShouldAttempt(DateTime.UtcNow))
+            throw new ConnectionThrottledException(
+                $"FOCAS connect to {device.Options.HostAddress} throttled — backoff window open after a recent connect failure.");
+
         // Discard the existing client (if any) before creating a new one. A client that is
         // non-null but not connected may have been disposed by a HandleRecycle race or a prior
         // teardown — retrying ConnectAsync on a disposed FocasWireClient hits ThrowIfDisposed and
@@ -1128,8 +1174,10 @@ public sealed class FocasDriver : IDriver, IReadable, IWritable, ITagDiscovery,
         {
             device.Client.Dispose();
             device.Client = null;
+            device.Backoff.RecordFailure(DateTime.UtcNow); // 05/STAB-8: open the backoff window
             throw;
         }
+        device.Backoff.RecordSuccess(); // 05/STAB-8: recovery resets the window immediately
         return device.Client;
     }
 
@@ -1175,6 +1223,17 @@ public sealed class FocasDriver : IDriver, IReadable, IWritable, ITagDiscovery,
         /// <summary>Gets or sets the FOCAS client instance.</summary>
         public IFocasClient? Client { get; set; }
 
+        /// <summary>
+        ///     Per-device connect-attempt throttle (05/STAB-8). A dead CNC fails fast inside the
+        ///     backoff window instead of paying a full two-socket reconnect on every tick of each of
+        ///     the read / write / probe / fixed-tree / recycle loops; the probe loop bypasses it and a
+        ///     successful connect resets it. FOCAS's <c>EnsureConnectedAsync</c> is not gate-serialized
+        ///     (the loops already race the client swap by design), so this is best-effort — atomic
+        ///     enough on 64-bit for the int/DateTime state, and a benign extra/skipped attempt is the
+        ///     worst outcome of a race.
+        /// </summary>
+        public ConnectionBackoff Backoff { get; } = new(TimeSpan.FromSeconds(1), TimeSpan.FromSeconds(30));
+
         /// <summary>Gets the lock object for probe synchronization.</summary>
         public object ProbeLock { get; } = new();
         /// <summary>Gets or sets the current host connectivity state.</summary>
@@ -1195,17 +1254,17 @@ public sealed class FocasDriver : IDriver, IReadable, IWritable, ITagDiscovery,
         ///     scale applied at <see cref="PublishAxisSnapshot"/>; integer fields
         ///     (feed rate, spindle speed) widen to double on store.
         /// </summary>
-        public Dictionary<string, double> LastFixedSnapshots { get; } = new(StringComparer.OrdinalIgnoreCase);
+        public ConcurrentDictionary<string, double> LastFixedSnapshots { get; } = new(StringComparer.OrdinalIgnoreCase);
         /// <summary>Gets or sets the last program information snapshot.</summary>
         public FocasProgramInfo? LastProgramInfo { get; set; }
         /// <summary>Gets or sets the cached first-axis dynamic snapshot — feeds Program/Number, /MainNumber, /Sequence.</summary>
         public FocasDynamicSnapshot? LastProgramAxisRef { get; set; }
         /// <summary>Gets the last timer values by timer kind.</summary>
-        public Dictionary<FocasTimerKind, FocasTimer> LastTimers { get; } = [];
+        public ConcurrentDictionary<FocasTimerKind, FocasTimer> LastTimers { get; } = new();
         /// <summary>Gets the last servo load percentages by servo name.</summary>
-        public Dictionary<string, double> LastServoLoads { get; } = new(StringComparer.OrdinalIgnoreCase);
+        public ConcurrentDictionary<string, double> LastServoLoads { get; } = new(StringComparer.OrdinalIgnoreCase);
         /// <summary>Gets the last spindle load percentages by spindle index.</summary>
-        public Dictionary<int, int> LastSpindleLoads { get; } = [];
+        public ConcurrentDictionary<int, int> LastSpindleLoads { get; } = new();
         /// <summary>
         ///     Gets or sets the per-axis position decimal-place figures fetched once at init via
         ///     <c>cnc_getfigure</c> (parallel to the axis-name list; index = axis). An auto figure

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts/ModbusEquipmentTagParser.cs

@@ -55,10 +55,14 @@ public static class ModbusEquipmentTagParser
             // "writable" defaults to true when absent (today's value) — makes read-only equipment tags
             // authorable (UNDER-6). Node-level authz remains the effective write gate.
             var writable = TagConfigJson.ReadWritable(root);
+            // CONV-4: optional per-tag unitId (0–255). Absent ⇒ null ⇒ the driver-level UnitId via
+            // ModbusDriver.ResolveUnitId, so multi-unit equipment tags key their own per-host breaker.
+            // Scope: unitId ONLY — the remaining parser-strictness gaps are R2-11's.
+            var unitId = ReadOptionalByte(root, "unitId");
             def = new ModbusTagDefinition(
                 Name: reference, Region: region, Address: (ushort)address, DataType: dataType,
                 Writable: writable, ByteOrder: byteOrder, BitIndex: bitIndex, StringLength: stringLength,
-                ArrayCount: arrayCount);
+                ArrayCount: arrayCount, UnitId: unitId);
             return true;
         }
         catch (JsonException) { return false; }
@@ -109,6 +113,10 @@ public static class ModbusEquipmentTagParser
         => o.TryGetProperty(name, out var e) && e.ValueKind == JsonValueKind.Number
            && e.TryGetInt32(out var v) ? v : 0;
 
+    private static byte? ReadOptionalByte(JsonElement o, string name)
+        => o.TryGetProperty(name, out var e) && e.ValueKind == JsonValueKind.Number
+           && e.TryGetInt32(out var v) && v is >= 0 and <= 255 ? (byte)v : null;
+
     private static bool ReadBool(JsonElement o, string name)
         => o.TryGetProperty(name, out var e) && e.ValueKind == JsonValueKind.True;
 }

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusDriver.cs

@@ -118,13 +118,41 @@ public sealed class ModbusDriver
             {
                 if (!ShouldPublish(tagRef, snapshot)) return;
                 OnDataChange?.Invoke(this, new DataChangeEventArgs(handle, tagRef, snapshot));
-            });
+            },
+            onError: HandlePollError,
+            backoffCap: PollBackoffCap);
     }
 
-    /// <inheritdoc />
+    /// <summary>Upper bound on the poll-loop failure backoff — adopts the S7-proven 30 s cap fleet-wide (05/STAB-8).</summary>
+    private static readonly TimeSpan PollBackoffCap = TimeSpan.FromSeconds(30);
+
+    /// <summary>
+    ///     05/STAB-9 — routes a poll-loop reader failure to the driver health surface: logs it and
+    ///     degrades to <see cref="DriverState.Degraded"/> preserving <c>LastSuccessfulRead</c>.
+    ///     Never downgrades a <see cref="DriverState.Faulted"/> state (a stronger, config-level signal).
+    /// </summary>
+    /// <param name="ex">The exception caught by the poll engine.</param>
+    internal void HandlePollError(Exception ex)
+    {
+        _logger.LogWarning(ex, "Modbus poll reader failed. Driver={DriverInstanceId}", _driverInstanceId);
+        var current = ReadHealth();
+        if (current.State != DriverState.Faulted)
+            WriteHealth(new DriverHealth(DriverState.Degraded, current.LastSuccessfulRead, ex.Message));
+    }
+
+    /// <summary>
+    ///     Resolve a reference to the per-slave host key (<c>host:port/unitN</c>) that keys its
+    ///     per-host resilience (bulkhead / circuit breaker). CONV-4: routes through
+    ///     <see cref="EquipmentTagRefResolver{TDef}"/> so an equipment-tag reference (raw TagConfig
+    ///     JSON) keys its OWN authored unit — via the tag's optional <c>unitId</c> or the driver
+    ///     default — rather than the single-slave fallback. The resolver caches parses, so this adds
+    ///     no per-call cost after first use.
+    /// </summary>
+    /// <param name="fullReference">The tag reference (authored name or equipment-tag JSON).</param>
+    /// <returns>The per-slave host key.</returns>
     public string ResolveHost(string fullReference)
     {
-        if (_tagsByName.TryGetValue(fullReference, out var tag))
+        if (_resolver.TryResolve(fullReference, out var tag))
             return BuildSlaveHostName(ResolveUnitId(tag));
         // Unknown reference — fall back to driver-instance host (single-slave behaviour).
         return HostName;

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusTcpTransport.cs

@@ -207,6 +207,27 @@ public sealed class ModbusTcpTransport : IModbusTransport
         }
     }
 
+    /// <summary>
+    ///     Executes exactly one Modbus transaction on the current socket.
+    /// </summary>
+    /// <remarks>
+    ///     <para>
+    ///         A per-op deadline (linked <see cref="CancellationTokenSource.CancelAfter(TimeSpan)"/>)
+    ///         and framing violations (TxId mismatch / truncated MBAP length) are treated as
+    ///         <b>connection-fatal</b>: the socket may have a half-read or still-in-flight response,
+    ///         so reusing it would read stale bytes and desynchronize the stream permanently. Such
+    ///         failures tear the socket down here (before propagating) and surface as
+    ///         <see cref="ModbusTransportDesyncException"/> — which, being an
+    ///         <see cref="IOException"/>, feeds <see cref="SendAsync"/>'s existing single reconnect
+    ///         retry with no extra plumbing.
+    ///     </para>
+    ///     <para>
+    ///         The timeout-vs-caller-cancel distinction is load-bearing: a <b>caller</b> cancellation
+    ///         (<c>ct.IsCancellationRequested</c>) is a legitimate shutdown and propagates as a plain
+    ///         <see cref="OperationCanceledException"/> with <b>no</b> teardown — only the linked
+    ///         per-op timeout (the caller token is NOT cancelled) is a desync.
+    ///     </para>
+    /// </remarks>
     private async Task<byte[]> SendOnceAsync(byte unitId, byte[] pdu, CancellationToken ct)
     {
         if (_stream is null) throw new InvalidOperationException("Transport not connected");
@@ -225,28 +246,53 @@ public sealed class ModbusTcpTransport : IModbusTransport
 
         using var cts = CancellationTokenSource.CreateLinkedTokenSource(ct);
         cts.CancelAfter(_timeout);
-        await _stream.WriteAsync(adu.AsMemory(), cts.Token).ConfigureAwait(false);
-        await _stream.FlushAsync(cts.Token).ConfigureAwait(false);
-
-        var header = new byte[7];
-        await ReadExactlyAsync(_stream, header, cts.Token).ConfigureAwait(false);
-        var respTxId = (ushort)((header[0] << 8) | header[1]);
-        if (respTxId != txId)
-            throw new InvalidDataException($"Modbus TxId mismatch: expected {txId} got {respTxId}");
-        var respLen = (ushort)((header[4] << 8) | header[5]);
-        if (respLen < 1) throw new InvalidDataException($"Modbus response length too small: {respLen}");
-        var respPdu = new byte[respLen - 1];
-        await ReadExactlyAsync(_stream, respPdu, cts.Token).ConfigureAwait(false);
-
-        // Exception PDU: function code has high bit set.
-        if ((respPdu[0] & 0x80) != 0)
+        try
         {
-            var fc = (byte)(respPdu[0] & 0x7F);
-            var ex = respPdu[1];
-            throw new ModbusException(fc, ex, $"Modbus exception fc={fc} code={ex}");
-        }
+            await _stream.WriteAsync(adu.AsMemory(), cts.Token).ConfigureAwait(false);
+            await _stream.FlushAsync(cts.Token).ConfigureAwait(false);
 
-        return respPdu;
+            var header = new byte[7];
+            await ReadExactlyAsync(_stream, header, cts.Token).ConfigureAwait(false);
+            var respTxId = (ushort)((header[0] << 8) | header[1]);
+            if (respTxId != txId)
+                throw new ModbusTransportDesyncException(
+                    ModbusTransportDesyncException.DesyncReason.TxIdMismatch,
+                    $"Modbus TxId mismatch: expected {txId} got {respTxId}");
+            var respLen = (ushort)((header[4] << 8) | header[5]);
+            if (respLen < 1)
+                throw new ModbusTransportDesyncException(
+                    ModbusTransportDesyncException.DesyncReason.TruncatedFrame,
+                    $"Modbus response length too small: {respLen}");
+            var respPdu = new byte[respLen - 1];
+            await ReadExactlyAsync(_stream, respPdu, cts.Token).ConfigureAwait(false);
+
+            // Exception PDU: function code has high bit set. This is a well-formed protocol-level
+            // error — the socket is still coherent, so it MUST propagate without teardown.
+            if ((respPdu[0] & 0x80) != 0)
+            {
+                var fc = (byte)(respPdu[0] & 0x7F);
+                var ex = respPdu[1];
+                throw new ModbusException(fc, ex, $"Modbus exception fc={fc} code={ex}");
+            }
+
+            return respPdu;
+        }
+        catch (ModbusTransportDesyncException)
+        {
+            // Framing violation: the socket is desynchronized — never reuse it.
+            await TearDownAsync().ConfigureAwait(false);
+            throw;
+        }
+        catch (OperationCanceledException) when (!ct.IsCancellationRequested)
+        {
+            // Per-op timeout fired (NOT the caller). The response is unknown / may still land later
+            // and corrupt the next read — tear the socket down and normalize as a desync so the
+            // reconnect retry / status mapping engages.
+            await TearDownAsync().ConfigureAwait(false);
+            throw new ModbusTransportDesyncException(
+                ModbusTransportDesyncException.DesyncReason.Timeout,
+                $"Modbus per-op response timeout after {_timeout.TotalMilliseconds:0}ms");
+        }
     }
 
     /// <summary>

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusTransportDesyncException.cs

@@ -0,0 +1,46 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus;
+
+/// <summary>
+///     Raised when a Modbus TCP transaction leaves the single-flight socket in an unknown /
+///     desynchronized state — a per-op response timeout, or a framing violation (transaction-id
+///     mismatch or truncated MBAP length). Unlike a Modbus <em>exception PDU</em> (a well-formed
+///     protocol-level error where the socket is still coherent and the request must simply
+///     propagate), a desync means bytes may still be in flight or half-read, so the socket is
+///     unusable and MUST be torn down before this is thrown.
+/// </summary>
+/// <remarks>
+///     Derives from <see cref="IOException"/> deliberately: the transport's existing
+///     reconnect-and-retry classifier (<c>IsSocketLevelFailure</c>) already treats
+///     <see cref="IOException"/> as socket-fatal, so with auto-reconnect enabled the transport
+///     transparently reconnects and resends once; with auto-reconnect disabled the (already torn
+///     down) socket is never reused and this surfaces to the driver's status mapping as a
+///     communication error.
+/// </remarks>
+public sealed class ModbusTransportDesyncException : IOException
+{
+    /// <summary>The reason the socket was classified desynchronized.</summary>
+    public enum DesyncReason
+    {
+        /// <summary>The per-op deadline (linked <c>CancelAfter</c>) fired — the response never arrived in time.</summary>
+        Timeout,
+
+        /// <summary>The response MBAP transaction id did not match the request's.</summary>
+        TxIdMismatch,
+
+        /// <summary>The response MBAP length field was below the mandatory minimum (truncated frame).</summary>
+        TruncatedFrame,
+    }
+
+    /// <summary>Gets the reason the socket was classified desynchronized.</summary>
+    public DesyncReason Reason { get; }
+
+    /// <summary>Initializes a new instance of the <see cref="ModbusTransportDesyncException"/> class.</summary>
+    /// <param name="reason">The desync reason.</param>
+    /// <param name="message">A human-readable description.</param>
+    /// <param name="inner">The originating exception, if any.</param>
+    public ModbusTransportDesyncException(DesyncReason reason, string message, Exception? inner = null)
+        : base(message, inner)
+    {
+        Reason = reason;
+    }
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7/S7Driver.cs

@@ -53,11 +53,21 @@ public sealed class S7Driver
         _resolver = new EquipmentTagRefResolver<S7TagDefinition>(
             r => _tagsByName.TryGetValue(r, out var t) ? t : null,
             r => S7EquipmentTagParser.TryParse(r, out var d) ? d : null);
+        // CONV-1: the polling overlay runs on the shared PollGroupEngine (structural array diff +
+        // drain-before-dispose + capped-exponential failure backoff + caller-token-filtered OCE),
+        // retiring the bespoke S7 poll fork. minInterval 100 ms matches the S7 scan-mailbox floor;
+        // backoffCap 30 s matches the retired fork's PollBackoffCap.
+        _poll = new PollGroupEngine(
+            reader: ReadAsync,
+            onChange: (handle, tagRef, snapshot) =>
+                OnDataChange?.Invoke(this, new DataChangeEventArgs(handle, tagRef, snapshot)),
+            minInterval: TimeSpan.FromMilliseconds(100),
+            onError: HandlePollError,
+            backoffCap: TimeSpan.FromSeconds(30));
     }
     // ---- ISubscribable + IHostConnectivityProbe state ----
 
-    private readonly ConcurrentDictionary<long, SubscriptionState> _subscriptions = new();
-    private long _nextSubscriptionId;
+    private readonly PollGroupEngine _poll;
     private readonly object _probeLock = new();
     private HostState _hostState = HostState.Unknown;
     private DateTime _hostStateChangedUtc = DateTime.UtcNow;
@@ -269,38 +279,28 @@ public sealed class S7Driver
         // then await all of them with a bounded timeout BEFORE disposing the shared semaphore
         // and CTS objects. Without the drain, a loop iteration mid-_gate would call Release()
         // on (or WaitAsync against) a disposed semaphore.
-        var drain = new List<Task>();
+        // Drain the polling overlay first — the engine cancels each loop and awaits it before
+        // disposing its CTS (drain-before-dispose, STAB-6-S7), so no poll iteration touches _gate
+        // after this returns.
+        await _poll.DisposeAsync().ConfigureAwait(false);
 
         var probeCts = _probeCts;
         var probeTask = _probeTask;
         try { probeCts?.Cancel(); } catch { }
-        if (probeTask is not null) drain.Add(probeTask);
-
-        var subscriptions = _subscriptions.Values.ToArray();
-        _subscriptions.Clear();
-        foreach (var state in subscriptions)
-        {
-            try { state.Cts.Cancel(); } catch { }
-            drain.Add(state.PollTask);
-        }
-
-        if (drain.Count > 0)
+        if (probeTask is not null)
         {
             try
             {
-                await Task.WhenAll(drain).WaitAsync(DrainTimeout, CancellationToken.None)
-                    .ConfigureAwait(false);
+                await probeTask.WaitAsync(DrainTimeout, CancellationToken.None).ConfigureAwait(false);
             }
-            catch (TimeoutException) { /* a wedged loop — proceed; better than leaking the teardown */ }
+            catch (TimeoutException) { /* a wedged probe loop — proceed; better than leaking the teardown */ }
             catch { /* loop faults are already surfaced via health; teardown continues */ }
         }
 
-        // Loops have now observed cancellation and released _gate — safe to dispose the CTSs.
+        // The probe loop has now observed cancellation and released _gate — safe to dispose the CTS.
         probeCts?.Dispose();
         _probeCts = null;
         _probeTask = null;
-        foreach (var state in subscriptions)
-            state.Cts.Dispose();
 
         _initialized = false;
         _plcDead = false;
@@ -1215,9 +1215,14 @@ public sealed class S7Driver
     ///         While the PLC is down every data call and probe tick pays a full connect attempt
     ///         bounded only by <c>_options.Timeout</c> (STAB-8). This method is the single
     ///         choke-point all S7 reconnects flow through (already gate-serialized), so the
-    ///         fleet-wide connect-attempt throttle planned in R2-09 plugs in here: a
-    ///         last-failed-attempt timestamp checked at the top of the slow path. Deliberately NOT
-    ///         implemented driver-locally — see
+    ///         fleet-wide connect-attempt throttle plugs in here. R2-09 (sub-batch B3/B4) shipped the
+    ///         shared <see cref="ConnectionBackoff"/> primitive
+    ///         (<c>src/Core/…/Core.Abstractions/ConnectionBackoff.cs</c>) — the S7 wiring is a
+    ///         per-driver <c>ConnectionBackoff</c> field consulted with <c>ShouldAttempt(now)</c> at
+    ///         the top of the slow path (fail fast + degrade inside the window) plus
+    ///         <c>RecordFailure</c>/<c>RecordSuccess</c> around the connect, all under <c>_gate</c>
+    ///         (which satisfies the primitive's caller-synchronized contract; TwinCAT/FOCAS/AbCip
+    ///         already wire it this way). Deliberately NOT implemented driver-locally here — owned by
     ///         <c>archreview/plans/R2-01-s7-fault-hardening-plan.md</c> Finding 3.
     ///     </para>
     /// </remarks>
@@ -1397,180 +1402,29 @@ public sealed class S7Driver
     /// <inheritdoc />
     public Task<ISubscriptionHandle> SubscribeAsync(
         IReadOnlyList<string> fullReferences, TimeSpan publishingInterval, CancellationToken cancellationToken)
-    {
-        var id = Interlocked.Increment(ref _nextSubscriptionId);
-        var cts = new CancellationTokenSource();
-        // Floor at 100 ms — S7 CPUs scan 2-10 ms but the comms mailbox is processed at most
-        // once per scan; sub-100 ms polling just queues wire-side with worse latency.
-        var interval = publishingInterval < TimeSpan.FromMilliseconds(100)
-            ? TimeSpan.FromMilliseconds(100)
-            : publishingInterval;
-        var handle = new S7SubscriptionHandle(id);
-        var state = new SubscriptionState(handle, [.. fullReferences], interval, cts);
-        _subscriptions[id] = state;
-        // Track the poll Task so ShutdownAsync can await it after cancelling — a poll
-        // iteration mid-_gate would otherwise race the semaphore's disposal.
-        state.PollTask = Task.Run(() => PollLoopAsync(state, cts.Token), CancellationToken.None);
-        return Task.FromResult<ISubscriptionHandle>(handle);
-    }
+        => Task.FromResult(_poll.Subscribe(fullReferences, publishingInterval));
 
     /// <inheritdoc />
     public Task UnsubscribeAsync(ISubscriptionHandle handle, CancellationToken cancellationToken)
     {
-        if (handle is S7SubscriptionHandle h && _subscriptions.TryRemove(h.Id, out var state))
-        {
-            state.Cts.Cancel();
-            state.Cts.Dispose();
-        }
+        _poll.Unsubscribe(handle);
         return Task.CompletedTask;
     }
 
     /// <summary>
-    ///     Upper bound on the poll-loop backoff window. After enough consecutive failures the
-    ///     loop waits this long between retries instead of <see cref="SubscriptionState.Interval"/>,
-    ///     so a subscription against a dropped / uninitialised driver doesn't spin.
+    ///     05/STAB-9 — routes a poll-loop reader failure (surfaced by the shared
+    ///     <see cref="PollGroupEngine"/>'s onError sink) to the driver health surface: logs it and
+    ///     degrades to <see cref="DriverState.Degraded"/> preserving <c>LastSuccessfulRead</c>. Never
+    ///     downgrades a <see cref="DriverState.Faulted"/> state (e.g. PUT/GET-denied set by ReadAsync)
+    ///     — Faulted is the stronger, permanent-config signal. Replaces the retired fork's
+    ///     <c>HandlePollFailure</c>; the engine now owns the consecutive-failure count + backoff.
     /// </summary>
-    private static readonly TimeSpan PollBackoffCap = TimeSpan.FromSeconds(30);
-
-    /// <summary>
-    ///     Number of consecutive poll failures before the loop transitions the driver's
-    ///     health to <see cref="DriverState.Degraded"/>. One stray failure can be transient;
-    ///     a sustained run indicates the operator should see it. Threshold of 1 because the
-    ///     first failure already lives in the LastError surface.
-    /// </summary>
-    private const int PollFailureHealthThreshold = 1;
-
-    private async Task PollLoopAsync(SubscriptionState state, CancellationToken ct)
+    /// <param name="ex">The exception caught by the poll engine.</param>
+    private void HandlePollError(Exception ex)
     {
-        var consecutiveFailures = 0;
-
-        // Initial-data push per OPC UA Part 4 convention.
-        try
-        {
-            await PollOnceAsync(state, forceRaise: true, ct).ConfigureAwait(false);
-            consecutiveFailures = 0;
-        }
-        // Only a teardown OCE (the loop's own token) exits the loop; any other OCE (e.g. a
-        // connect-timeout that slipped past the wrapper filter) falls to the backoff path below
-        // so the loop lives (STAB-14 defense-in-depth).
-        catch (OperationCanceledException) when (ct.IsCancellationRequested) { return; }
-        catch (Exception ex)
-        {
-            // First-read error — polling continues; log so the operator has an event trail.
-            consecutiveFailures++;
-            HandlePollFailure(ex, consecutiveFailures, initial: true);
-        }
-
-        while (!ct.IsCancellationRequested)
-        {
-            // Capped exponential backoff: Interval, 2×, 4×, ... up to PollBackoffCap. Healthy
-            // ticks reset consecutiveFailures back to 0 so the cadence snaps back to Interval.
-            var delay = ComputeBackoffDelay(state.Interval, consecutiveFailures);
-            try { await Task.Delay(delay, ct).ConfigureAwait(false); }
-            // Task.Delay can only observe ct-triggered OCE, so this filter is purely for uniformity.
-            catch (OperationCanceledException) when (ct.IsCancellationRequested) { return; }
-
-            try
-            {
-                await PollOnceAsync(state, forceRaise: false, ct).ConfigureAwait(false);
-                consecutiveFailures = 0;
-            }
-            // Only teardown exits; any non-teardown OCE (e.g. a slipped-through connect timeout)
-            // backs off instead of killing the loop (STAB-14 defense-in-depth).
-            catch (OperationCanceledException) when (ct.IsCancellationRequested) { return; }
-            catch (Exception ex)
-            {
-                // Sustained polling error — loop continues with backoff; log + update health.
-                consecutiveFailures++;
-                HandlePollFailure(ex, consecutiveFailures, initial: false);
-            }
-        }
-    }
-
-    /// <summary>
-    ///     Logs the swallowed poll exception and, once <see cref="PollFailureHealthThreshold"/>
-    ///     consecutive failures have accumulated, degrades the driver health so the failure
-    ///     surfaces on the dashboard. The probe loop owns Running/Stopped
-    ///     transitions for the host-connectivity surface, so we touch <see cref="_health"/>
-    ///     rather than the probe state.
-    /// </summary>
-    private void HandlePollFailure(Exception ex, int consecutiveFailures, bool initial)
-    {
-        if (initial)
-            _logger.LogWarning(ex, "S7 poll initial-read failed. Driver={DriverInstanceId} ConsecutiveFailures={Count}",
-                _driverInstanceId, consecutiveFailures);
-        else
-            _logger.LogWarning(ex, "S7 poll tick failed. Driver={DriverInstanceId} ConsecutiveFailures={Count}",
-                _driverInstanceId, consecutiveFailures);
-
-        if (consecutiveFailures >= PollFailureHealthThreshold)
-        {
-            // Don't downgrade a Faulted state (e.g. PUT/GET-denied set by ReadAsync) — Faulted
-            // is a stronger signal than Degraded and is reserved for permanent config faults.
-            if (_health.State != DriverState.Faulted)
-                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
-        }
-    }
-
-    /// <summary>
-    ///     Capped exponential backoff. <c>consecutiveFailures == 0</c> returns the configured
-    ///     <paramref name="interval"/>; each subsequent failure doubles the wait up to
-    ///     <see cref="PollBackoffCap"/>. Computed in ticks to avoid overflow at large counts.
-    /// </summary>
-    /// <param name="interval">Base polling interval.</param>
-    /// <param name="consecutiveFailures">Number of consecutive failures.</param>
-    /// <returns>The computed backoff delay.</returns>
-    internal static TimeSpan ComputeBackoffDelay(TimeSpan interval, int consecutiveFailures)
-    {
-        if (consecutiveFailures <= 0) return interval;
-        // Cap the shift to avoid overflow — at 30 the result already saturates PollBackoffCap
-        // for any reasonable Interval.
-        var shift = Math.Min(consecutiveFailures - 1, 30);
-        var ticks = interval.Ticks << shift;
-        if (ticks <= 0 || ticks > PollBackoffCap.Ticks) return PollBackoffCap;
-        return TimeSpan.FromTicks(ticks);
-    }
-
-    private async Task PollOnceAsync(SubscriptionState state, bool forceRaise, CancellationToken ct)
-    {
-#pragma warning disable OTOPCUA0001 // Driver-INTERNAL self-call: S7Driver's own poll loop reading via its own ReadAsync; CapabilityInvoker wraps the driver from the dispatch layer OUTWARD, so the driver's internal poll must NOT re-wrap. Intentional, not a dispatch gap.
-        var snapshots = await ReadAsync(state.TagReferences, ct).ConfigureAwait(false);
-#pragma warning restore OTOPCUA0001
-        for (var i = 0; i < state.TagReferences.Count; i++)
-        {
-            var tagRef = state.TagReferences[i];
-            var current = snapshots[i];
-            var lastSeen = state.LastValues.TryGetValue(tagRef, out var prev) ? prev : default;
-
-            if (forceRaise || !Equals(lastSeen?.Value, current.Value) || lastSeen?.StatusCode != current.StatusCode)
-            {
-                state.LastValues[tagRef] = current;
-                OnDataChange?.Invoke(this, new DataChangeEventArgs(state.Handle, tagRef, current));
-            }
-        }
-    }
-
-    private sealed record SubscriptionState(
-        S7SubscriptionHandle Handle,
-        IReadOnlyList<string> TagReferences,
-        TimeSpan Interval,
-        CancellationTokenSource Cts)
-    {
-        /// <summary>Gets the last known values for subscribed tags.</summary>
-        public ConcurrentDictionary<string, DataValueSnapshot> LastValues { get; }
-            = new(StringComparer.OrdinalIgnoreCase);
-
-        /// <summary>
-        ///     Handle to this subscription's poll loop. Tracked so <see cref="ShutdownAsync"/>
-        ///     can await it after cancelling.
-        /// </summary>
-        public Task PollTask { get; set; } = Task.CompletedTask;
-    }
-
-    private sealed record S7SubscriptionHandle(long Id) : ISubscriptionHandle
-    {
-        /// <inheritdoc />
-        public string DiagnosticId => $"s7-sub-{Id}";
+        _logger.LogWarning(ex, "S7 poll reader failed. Driver={DriverInstanceId}", _driverInstanceId);
+        if (_health.State != DriverState.Faulted)
+            _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
     }
 
     // ---- IHostConnectivityProbe ----
@@ -1693,34 +1547,22 @@ public sealed class S7Driver
     /// </summary>
     private void SynchronousTeardown()
     {
-        var drain = new List<Task>();
+        // Drain the polling overlay (drain-before-dispose, STAB-6-S7).
+        try { _poll.DisposeAsync().AsTask().Wait(DrainTimeout); }
+        catch { /* timeouts/loop faults are tolerated — teardown continues */ }
 
         var probeCts = _probeCts;
         var probeTask = _probeTask;
         try { probeCts?.Cancel(); } catch { }
-        if (probeTask is not null) drain.Add(probeTask);
-
-        var subscriptions = _subscriptions.Values.ToArray();
-        _subscriptions.Clear();
-        foreach (var state in subscriptions)
+        if (probeTask is not null)
         {
-            try { state.Cts.Cancel(); } catch { }
-            drain.Add(state.PollTask);
-        }
-
-        if (drain.Count > 0)
-        {
-            try { Task.WhenAll(drain).Wait(DrainTimeout); }
+            try { probeTask.Wait(DrainTimeout); }
             catch { /* timeouts/loop faults are tolerated — teardown continues */ }
         }
 
         probeCts?.Dispose();
         _probeCts = null;
         _probeTask = null;
-        foreach (var state in subscriptions)
-        {
-            try { state.Cts.Dispose(); } catch { }
-        }
 
         _initialized = false;
         _plcDead = false;

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT/TwinCATDriver.cs

@@ -69,7 +69,26 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
         _poll = new PollGroupEngine(
             reader: ReadAsync,
             onChange: (handle, tagRef, snapshot) =>
-                OnDataChange?.Invoke(this, new DataChangeEventArgs(handle, tagRef, snapshot)));
+                OnDataChange?.Invoke(this, new DataChangeEventArgs(handle, tagRef, snapshot)),
+            onError: HandlePollError,
+            backoffCap: PollBackoffCap);
+    }
+
+    /// <summary>Upper bound on the poll-loop failure backoff — adopts the S7-proven 30 s cap fleet-wide (05/STAB-8).</summary>
+    private static readonly TimeSpan PollBackoffCap = TimeSpan.FromSeconds(30);
+
+    /// <summary>
+    ///     05/STAB-9 — routes a poll-loop reader failure to the driver health surface: logs it and
+    ///     degrades to <see cref="DriverState.Degraded"/> preserving <c>LastSuccessfulRead</c>.
+    ///     Never downgrades a <see cref="DriverState.Faulted"/> state (a stronger, config-level signal).
+    /// </summary>
+    /// <param name="ex">The exception caught by the poll engine.</param>
+    internal void HandlePollError(Exception ex)
+    {
+        _logger.LogWarning(ex, "TwinCAT poll reader failed. Driver={DriverInstanceId}", _driverInstanceId);
+        var current = _health;
+        if (current.State != DriverState.Faulted)
+            _health = new DriverHealth(DriverState.Degraded, current.LastSuccessfulRead, ex.Message);
     }
 
     /// <inheritdoc />
@@ -474,9 +493,14 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
                 var reg = new NativeRegistration(
                     Interlocked.Increment(ref _nextRegId), device, reference, symbolName,
                     def.DataType, bitIndex, publishingInterval,
-                    (_, value) => OnDataChange?.Invoke(this,
+                    onChange: (_, value) => OnDataChange?.Invoke(this,
                         new DataChangeEventArgs(handle, reference, new DataValueSnapshot(
-                            value, TwinCATStatusMapper.Good, DateTime.UtcNow, DateTime.UtcNow))));
+                            value, TwinCATStatusMapper.Good, DateTime.UtcNow, DateTime.UtcNow))),
+                    // 05/STAB-16: when the handle goes dead (a failed replay) push a Bad snapshot so
+                    // subscribers see the tag go Bad instead of a frozen-Good-stale value.
+                    onUnavailable: () => OnDataChange?.Invoke(this,
+                        new DataChangeEventArgs(handle, reference, new DataValueSnapshot(
+                            null, TwinCATStatusMapper.BadCommunicationError, null, DateTime.UtcNow))));
 
                 await RegisterNotificationAsync(device, reg, cancellationToken).ConfigureAwait(false);
                 registrations.Add(reg);
@@ -574,8 +598,22 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
         /// <summary>Value-change callback (closes over the owning subscription handle + reference).</summary>
         public Action<string, object?> OnChange { get; }
 
+        /// <summary>
+        ///     Bad-quality callback (05/STAB-16). Invoked when this registration's handle goes dead
+        ///     (a failed replay) so subscribers observe the tag go Bad instead of frozen-Good-stale —
+        ///     the <see cref="OnChange"/> shape has no quality channel. Closes over the same
+        ///     (handle, reference) pair as <see cref="OnChange"/>.
+        /// </summary>
+        public Action OnUnavailable { get; }
+
         private ITwinCATNotificationHandle? _handle;
 
+        /// <summary>
+        ///     True while this registration holds a live notification handle. False after a failed
+        ///     replay marks it dead (05/STAB-16) — the probe-tick retry re-registers such handles.
+        /// </summary>
+        public bool HasLiveHandle => Volatile.Read(ref _handle) is not null;
+
         /// <summary>Initializes a new instance of the <see cref="NativeRegistration"/> class.</summary>
         /// <param name="id">Globally-unique registration id (registry key on the device).</param>
         /// <param name="device">The device this notification is registered against.</param>
@@ -585,8 +623,10 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
         /// <param name="bitIndex">Bit index for a BOOL-within-word symbol; null otherwise.</param>
         /// <param name="interval">Requested notification interval.</param>
         /// <param name="onChange">Value-change callback (closes over the owning subscription handle + reference).</param>
+        /// <param name="onUnavailable">Bad-quality callback fired when the handle goes dead (05/STAB-16).</param>
         public NativeRegistration(long id, DeviceState device, string reference, string symbolName,
-            TwinCATDataType dataType, int? bitIndex, TimeSpan interval, Action<string, object?> onChange)
+            TwinCATDataType dataType, int? bitIndex, TimeSpan interval, Action<string, object?> onChange,
+            Action onUnavailable)
         {
             Id = id;
             Device = device;
@@ -596,6 +636,7 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
             BitIndex = bitIndex;
             Interval = interval;
             OnChange = onChange;
+            OnUnavailable = onUnavailable;
         }
 
         /// <summary>Installs a freshly-registered handle and returns the previous one (null on first set).</summary>
@@ -604,6 +645,15 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
         public ITwinCATNotificationHandle? SwapHandle(ITwinCATNotificationHandle newHandle) =>
             Interlocked.Exchange(ref _handle, newHandle);
 
+        /// <summary>
+        ///     Atomically clears the live handle and returns the previous one (05/STAB-16). The caller
+        ///     disposes the returned (already-dead) handle best-effort. After this
+        ///     <see cref="HasLiveHandle"/> is false until a retry re-registers.
+        /// </summary>
+        /// <returns>The previous handle, or null.</returns>
+        public ITwinCATNotificationHandle? MarkHandleDead() =>
+            Interlocked.Exchange(ref _handle, null);
+
         /// <summary>Removes this registration from its device and disposes its live handle.</summary>
         public void Dispose()
         {
@@ -628,7 +678,9 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
             {
                 // Probe-initiated connects honor TwinCATProbeOptions.Timeout — distinct from
                 // the driver-wide _options.Timeout used by reads/writes.
-                var client = await EnsureConnectedAsync(state, ct, _options.Probe.Timeout)
+                // The probe bypasses the connect backoff — its own interval is the bounded recovery
+                // cadence, and a successful probe connect resets the window for the data path.
+                var client = await EnsureConnectedAsync(state, ct, _options.Probe.Timeout, bypassBackoff: true)
                     .ConfigureAwait(false);
                 success = await client.ProbeAsync(ct).ConfigureAwait(false);
 
@@ -637,15 +689,21 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
                 // this the IsConnected fast-path would keep handing back the dead client forever
                 // (the compounding bug — native pushes would never recover).
                 if (!success)
-                    await RecycleClientAsync(state).ConfigureAwait(false);
+                    await RecycleClientAsync(state, ct).ConfigureAwait(false);
+                else
+                    // 05/STAB-16: on a healthy tick, re-register any notifications whose replay
+                    // failed (a transient AddNotification blip) so they recover without a client swap.
+                    await RetryDeadRegistrationsAsync(state, ct).ConfigureAwait(false);
             }
             catch (OperationCanceledException) when (ct.IsCancellationRequested) { break; }
             catch
             {
                 // Probe threw — the connect-failure path clears the client only when the CONNECT
                 // failed; a throw from ProbeAsync on an already-connected client would leave it in
-                // place, so force a recycle to guarantee the next tick rebuilds + replays.
-                await RecycleClientAsync(state).ConfigureAwait(false);
+                // place, so force a recycle to guarantee the next tick rebuilds + replays. A shutdown
+                // racing this recycle cancels the gate wait (STAB-12) — exit the loop cleanly.
+                try { await RecycleClientAsync(state, ct).ConfigureAwait(false); }
+                catch (OperationCanceledException) when (ct.IsCancellationRequested) { break; }
             }
 
             TransitionDeviceState(state, success ? HostState.Running : HostState.Stopped);
@@ -685,10 +743,20 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
     /// </summary>
     public const string UnresolvedHostSentinel = "";
 
-    /// <inheritdoc />
+    /// <summary>
+    ///     Resolve a reference to the device host that keys its per-host resilience
+    ///     (bulkhead / circuit breaker). CONV-4: routes through
+    ///     <see cref="EquipmentTagRefResolver{TDef}"/> so an equipment-tag reference (raw TagConfig
+    ///     JSON) resolves to its OWN authored device rather than the first-device fallback. The
+    ///     empty-host guard keeps an address-less equipment tag on the fallback rather than keying
+    ///     the <see cref="UnresolvedHostSentinel"/>. The resolver caches parses, so this adds no
+    ///     per-call cost after first use.
+    /// </summary>
+    /// <param name="fullReference">The tag reference (authored name or equipment-tag JSON).</param>
+    /// <returns>The device host key.</returns>
     public string ResolveHost(string fullReference)
     {
-        if (_tagsByName.TryGetValue(fullReference, out var def))
+        if (_resolver.TryResolve(fullReference, out var def) && !string.IsNullOrEmpty(def.DeviceHostAddress))
             return def.DeviceHostAddress;
         // First device's HostAddress when one exists; otherwise the unresolved sentinel —
         // intentionally NOT DriverInstanceId, which is a config-DB key, not a host address.
@@ -704,7 +772,7 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
     ///     also what docs/v2/driver-specs.md recommends.
     /// </summary>
     private async Task<ITwinCATClient> EnsureConnectedAsync(
-        DeviceState device, CancellationToken ct, TimeSpan? timeoutOverride = null)
+        DeviceState device, CancellationToken ct, TimeSpan? timeoutOverride = null, bool bypassBackoff = false)
     {
         // Fast path — already connected, no gate needed.
         if (device.Client is { IsConnected: true } fast) return fast;
@@ -712,7 +780,7 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
         await device.ConnectGate.WaitAsync(ct).ConfigureAwait(false);
         try
         {
-            return await EnsureConnectedUnderGateAsync(device, ct, timeoutOverride).ConfigureAwait(false);
+            return await EnsureConnectedUnderGateAsync(device, ct, timeoutOverride, bypassBackoff).ConfigureAwait(false);
         }
         finally
         {
@@ -720,6 +788,13 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
         }
     }
 
+    /// <summary>
+    ///     Thrown by the connect path when a per-device <see cref="ConnectionBackoff"/> window is
+    ///     still open (05/STAB-8) — a fail-fast that costs no wire traffic. Read/write map it to
+    ///     <c>BadCommunicationError</c> via their generic catch, exactly as a real connect failure.
+    /// </summary>
+    private sealed class ConnectionThrottledException(string message) : Exception(message);
+
     /// <summary>
     ///     The connect-or-reconnect core, assuming the caller already holds
     ///     <see cref="DeviceState.ConnectGate"/>. When it installs a NEW client (a genuine
@@ -729,11 +804,18 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
     ///     through here under the same gate, so a replay can never race a register.
     /// </summary>
     private async Task<ITwinCATClient> EnsureConnectedUnderGateAsync(
-        DeviceState device, CancellationToken ct, TimeSpan? timeoutOverride)
+        DeviceState device, CancellationToken ct, TimeSpan? timeoutOverride, bool bypassBackoff = false)
     {
         // Re-check under the gate: another caller may have connected while we waited.
         if (device.Client is { IsConnected: true } c) return c;
 
+        // 05/STAB-8: inside an open backoff window a data-path caller fails fast — no client
+        // create, no wire connect. The probe loop bypasses this (its interval is the recovery
+        // cadence) and drives the failure/success recording.
+        if (!bypassBackoff && !device.Backoff.ShouldAttempt(DateTime.UtcNow))
+            throw new ConnectionThrottledException(
+                $"TwinCAT connect to {device.Options.HostAddress} throttled — backoff window open after a recent connect failure.");
+
         // Discard a stale (created-but-disconnected) client before making a fresh one.
         if (device.Client is { IsConnected: false } stale)
         {
@@ -763,9 +845,11 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
                 _driverInstanceId, device.Options.HostAddress);
             client.OnSymbolVersionChanged -= HandleSymbolVersionChanged;
             client.Dispose();
+            device.Backoff.RecordFailure(DateTime.UtcNow); // 05/STAB-8: open the backoff window
             throw;
         }
         device.Client = client;
+        device.Backoff.RecordSuccess(); // 05/STAB-8: recovery resets the window immediately
 
         // Re-register every native notification onto the fresh client. Native ADS is push, so
         // (unlike the poll fallback) it cannot self-heal by re-reading — without this the
@@ -796,6 +880,15 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
                     _options.NotificationMaxDelayMs, reg.OnChange, ct).ConfigureAwait(false);
                 var old = reg.SwapHandle(newHandle);
                 try { old?.Dispose(); } catch { /* dead handle from the disposed client */ }
+                // 05/STAB-17: an UnsubscribeAsync (gate-free) can race this replay — if it removed the
+                // registration between the intents snapshot and this swap, the fresh handle is
+                // ownerless. Retract it immediately so the ADS notification isn't leaked live.
+                if (!device.NativeRegistrations.ContainsKey(reg.Id))
+                {
+                    var orphan = reg.MarkHandleDead();
+                    try { orphan?.Dispose(); } catch { /* best-effort */ }
+                    continue;
+                }
                 replayed++;
             }
             catch (Exception ex)
@@ -804,6 +897,16 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
                     "TwinCAT driver '{DriverInstanceId}' failed to replay native notification " +
                     "'{Symbol}' on device '{HostAddress}' after reconnect",
                     _driverInstanceId, reg.SymbolName, device.Options.HostAddress);
+
+                // 05/STAB-16: the intent has no live handle now — mark it dead so the probe-tick
+                // retry re-registers it, surface Bad quality to subscribers (the OnChange shape has
+                // no quality channel), and degrade health preserving the last successful read.
+                var dead = reg.MarkHandleDead();
+                try { dead?.Dispose(); } catch { /* already-dead handle from the disposed client */ }
+                try { reg.OnUnavailable(); } catch { /* never let a subscriber callback abort recovery of the rest */ }
+                if (_health.State != DriverState.Faulted)
+                    _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead,
+                        $"native-notification replay failed for '{reg.SymbolName}' on {device.Options.HostAddress}");
             }
         }
 
@@ -813,6 +916,65 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
             _driverInstanceId, replayed, intents.Length, device.Options.HostAddress);
     }
 
+    /// <summary>
+    ///     05/STAB-16: re-registers every dead (failed-replay) <see cref="NativeRegistration"/> onto
+    ///     the device's currently-connected client. Runs under <see cref="DeviceState.ConnectGate"/>
+    ///     (shared with the replay so it can't race a register/unsubscribe). Called from the probe
+    ///     loop after a successful probe — a bounded retry cadence (the probe interval) with no extra
+    ///     timers. A registration that fails again just stays dead for the next tick. Recovery of the
+    ///     value itself arrives via ADS's initial-notification push on register, exactly as the
+    ///     initial subscribe relies on.
+    /// </summary>
+    private async Task RetryDeadRegistrationsAsync(DeviceState device, CancellationToken ct)
+    {
+        if (device.NativeRegistrations.IsEmpty) return;
+
+        await device.ConnectGate.WaitAsync(ct).ConfigureAwait(false);
+        try
+        {
+            if (device.Client is not { IsConnected: true } client) return;
+
+            var recovered = 0;
+            foreach (var reg in device.NativeRegistrations.Values)
+            {
+                if (reg.HasLiveHandle) continue;
+                try
+                {
+                    var newHandle = await client.AddNotificationAsync(
+                        reg.SymbolName, reg.DataType, reg.BitIndex, reg.Interval,
+                        _options.NotificationMaxDelayMs, reg.OnChange, ct).ConfigureAwait(false);
+                    reg.SwapHandle(newHandle);
+                    // STAB-17 ownership re-check — see ReplayNativeRegistrationsAsync.
+                    if (!device.NativeRegistrations.ContainsKey(reg.Id))
+                    {
+                        var orphan = reg.MarkHandleDead();
+                        try { orphan?.Dispose(); } catch { /* best-effort */ }
+                        continue;
+                    }
+                    recovered++;
+                }
+                catch (OperationCanceledException) when (ct.IsCancellationRequested) { throw; }
+                catch (Exception ex)
+                {
+                    _logger.LogDebug(ex,
+                        "TwinCAT driver '{DriverInstanceId}' probe-tick retry of dead notification " +
+                        "'{Symbol}' on device '{HostAddress}' failed; will retry next tick",
+                        _driverInstanceId, reg.SymbolName, device.Options.HostAddress);
+                }
+            }
+
+            if (recovered > 0)
+                _logger.LogInformation(
+                    "TwinCAT driver '{DriverInstanceId}' recovered {Recovered} dead native notification(s) " +
+                    "on device '{HostAddress}' via probe-tick retry",
+                    _driverInstanceId, recovered, device.Options.HostAddress);
+        }
+        finally
+        {
+            device.ConnectGate.Release();
+        }
+    }
+
     /// <summary>
     ///     Disposes + nulls a device's client under <see cref="DeviceState.ConnectGate"/> so the
     ///     next <see cref="EnsureConnectedAsync"/> rebuilds it (and replays notifications). Called
@@ -821,9 +983,12 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
     ///     liveness, so without this forced recycle a wire-dead-but-port-open client would keep
     ///     being reused and native pushes would never recover.
     /// </summary>
-    private async Task RecycleClientAsync(DeviceState device)
+    private async Task RecycleClientAsync(DeviceState device, CancellationToken ct)
     {
-        await device.ConnectGate.WaitAsync(CancellationToken.None).ConfigureAwait(false);
+        // 05/STAB-12 (compounded part): honor the probe token so a connect wedged under the gate
+        // (TwinCAT's blocking SDK Connect — the un-fixed root, carried) can't hang the probe loop
+        // beyond cancellation. Was CancellationToken.None.
+        await device.ConnectGate.WaitAsync(ct).ConfigureAwait(false);
         try
         {
             if (device.Client is { } c)
@@ -911,6 +1076,15 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
         ///     create-or-dispose for this device.</summary>
         public SemaphoreSlim ConnectGate { get; } = new(1, 1);
 
+        /// <summary>
+        ///     Per-device connect-attempt throttle (05/STAB-8). A dead device fails fast inside the
+        ///     backoff window instead of paying a full connect on every data call; the probe loop
+        ///     bypasses it and a successful connect resets it. Consulted + mutated only under
+        ///     <see cref="ConnectGate"/>, satisfying <see cref="ConnectionBackoff"/>'s
+        ///     caller-synchronized contract.
+        /// </summary>
+        public ConnectionBackoff Backoff { get; } = new(TimeSpan.FromSeconds(1), TimeSpan.FromSeconds(30));
+
         /// <summary>
         ///     Live native-notification registrations against this device, keyed by registration id.
         ///     Holds the <b>replayable intent</b> (symbol / type / bit / interval / callback), not just