AB CIP PR 2 — scaffolding + Core (AbCipDriver skeleton + libplctag binding + host / tag-path / data-type / status-code parsers + per-family profiles + SafeHandle wrapper + test harness). Ships everything needed to stand up the driver project as a compiling assembly with no wire calls yet — PR 3 adds IReadable against ab_server which is the first PR that actually touches the native library. Project reference shape matches Modbus / OpcUaClient / S7 (only Core.Abstractions, no Core / Configuration / Polly) so the driver stays lean and doesn't drag EF Core into every deployment that wants AB support. libplctag 1.5.2 pinned (1.6.x only exists as alpha — stable 1.5 series covers ControlLogix / CompactLogix / Micro800 / SLC500 / PLC-5 / MicroLogix which matches plan decision #11 family coverage). libplctag.NativeImport arrives transitively. AbCipHostAddress parses ab://gateway[:port]/cip-path canonical strings end-to-end: handles hostname or IP gateway, optional explicit port (default 44818 EtherNet-IP reserved), CIP path including bridged routes (1,2,2,10.0.0.10,1,0), empty path for Micro800 / MicroLogix without backplane routing, case-insensitive scheme, default-port stripping in canonical form for round-trip stability. Opaque string survives straight into libplctag's gateway / path attributes so no translation layer at wire time. AbCipTagPath handles the full Logix symbolic tag surface — controller-scope (Motor1_Speed), program-scope (Program:MainProgram.StepIndex), structured member access (Motor1.Speed.Setpoint), multi-dim array subscripts (Matrix[1,2,3]), bit-within-DINT via .N syntax (Flags.3, Motor.Status.12) with valid range 0-31 per Logix 5000 General Instructions Reference. Structural capture so PR 6 UDT work can walk the path against a cached template without reparsing. Rejects malformed shapes (empty scopes, ident starting with digit, spaces, empty/negative/non-numeric subscripts, unbalanced brackets, leading / trailing dots). Round-trips via ToLibplctagName producing the exact string libplctag's name attribute expects. AbCipDataType mirrors ModbusDataType shape — atomic Bool / SInt / Int / DInt / LInt / USInt / UInt / UDInt / ULInt / Real / LReal / String / Dt plus a Structure marker for UDT-typed tags (resolved via CIP Template Object at discovery time in PR 5/6). ToDriverDataType adapter follows the Modbus widening convention for unsigned + 64-bit until DriverDataType picks those up. AbCipStatusMapper covers the CIP general-status values an AB PLC actually returns during normal operation (0x00/0x04/0x05/0x06/0x08/0x0A/0x0B/0x0E/0x10/0x13/0x16) + libplctag PLCTAG_STATUS_* codes (0, >0 pending, negative error families). Mirrors ModbusDriver.MapModbusExceptionToStatus so Admin UI status displays stay uniform across drivers. PlcTagHandle is a SafeHandle around the int32 native tag ID with plc_tag_destroy slot wired as a no-op for PR 2 (P/Invoke DllImport arrives with PR 3 when the wire calls land). Lifetime guaranteed by the SafeHandle finalizer — every leaked handle gets cleaned up even when the owner is GC'd without explicit Dispose. IsInvalid when native ID <= 0 so destroying a negative (error) handle never happens. Critical because driver-specs.md §3 flags libplctag native heap as invisible to GetMemoryFootprint — leaked handles directly feed the Tier-B recycle trigger. AbCipDriverOptions captures the multi-device shape — one driver instance can talk to N PLCs via Devices[] (each with HostAddress + PlcFamily + optional DeviceName); Tags[] references devices by HostAddress as the cross-key; AbCipProbeOptions + driver-wide Timeout. AbCipDriver implements IDriver only — InitializeAsync parses every device's HostAddress and selects its PlcFamilyProfile (fails fast on malformed strings via InvalidOperationException → Faulted health), per-device state cached in a DeviceState record with parsed address + profile + empty TagHandles dict for later PRs. ReinitializeAsync is the Tier-B escape hatch — shuts down every device, disposes every PlcTagHandle via SafeHandle lifetime, reinitializes from options. ShutdownAsync clears the device dict and flips health to Unknown. PlcFamilies/AbCipPlcFamilyProfile gives four baseline profiles — ControlLogix (4002 ConnectionSize, path 1,0, Large Forward Open + request packing + connected messaging, FW20+ baseline), CompactLogix (narrower 504 default for 5069-L3x safety), Micro800 (488 cap, empty path, unconnected-only, no request packing), GuardLogix (shares ControlLogix wire protocol — safety partition is tag-level, surfaced as ViewOnly in PR 12). Tests — 76 new cases across 4 test classes — AbCipHostAddressTests (10 valid shapes, 10 invalid shapes, ToString canonicalization, round-trip stability), AbCipTagPathTests (18 cases including multi-scope / multi-member / multi-subscript / bit-in-DINT / rejected shapes / underscore idents / round-trip), AbCipStatusMapperTests (12 CIP + 8 libplctag codes), AbCipDriverTests (IDriver lifecycle + multi-device init + malformed-address fault + per-family profile lookup + PlcTagHandle invalid/dispose idempotency + AbCipDataType mapping). Full solution builds 0 errors; 254 warnings are pre-existing xUnit1051 CancellationToken hints outside this PR. Solution file updated to include both new projects. Unblocks PR 3 (IReadable against ab_server) which is the first PR to exercise the native library end-to-end.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/PlcTagHandle.cs

@@ -0,0 +1,59 @@
+using System.Runtime.InteropServices;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     <see cref="SafeHandle"/> wrapper around a libplctag native tag handle (an <c>int32</c>
+///     returned from <c>plc_tag_create_ex</c>). Owns lifetime of the native allocation so a
+///     leaked / GC-collected <see cref="PlcTagHandle"/> still calls <c>plc_tag_destroy</c>
+///     during finalization — necessary because native libplctag allocations are opaque to
+///     the driver's <see cref="Core.Abstractions.IDriver.GetMemoryFootprint"/>.
+/// </summary>
+/// <remarks>
+///     <para>Risk documented in driver-specs.md §3 ("Operational Stability Notes"): the CLR
+///     allocation tracker doesn't see libplctag's native heap, only whole-process RSS can.
+///     Every handle leaked past its useful life is a direct contributor to the Tier-B recycle
+///     trigger, so owning lifetime via SafeHandle is non-negotiable.</para>
+///
+///     <para><see cref="IsInvalid"/> is <c>true</c> when the native ID is &lt;= 0 — libplctag
+///     returns negative <c>PLCTAG_ERR_*</c> codes on <c>plc_tag_create_ex</c> failure, which
+///     we surface as an invalid handle rather than a disposable one (destroying a negative
+///     handle would be undefined behavior in the native library).</para>
+///
+///     <para>The actual <c>DllImport</c> for <c>plc_tag_destroy</c> is deferred to PR 3 when
+///     the driver first makes wire calls — PR 2 ships the lifetime scaffold + tests only.
+///     Until the P/Invoke lands, <see cref="ReleaseHandle"/> is a no-op; the finalizer still
+///     runs so the integration is correct as soon as the import is added.</para>
+/// </remarks>
+public sealed class PlcTagHandle : SafeHandle
+{
+    /// <summary>Construct an invalid handle placeholder (use <see cref="FromNative"/> once created).</summary>
+    public PlcTagHandle() : base(invalidHandleValue: IntPtr.Zero, ownsHandle: true) { }
+
+    private PlcTagHandle(int nativeId) : base(invalidHandleValue: IntPtr.Zero, ownsHandle: true)
+    {
+        SetHandle(new IntPtr(nativeId));
+    }
+
+    /// <summary>Handle is invalid when the native ID is zero or negative (libplctag error).</summary>
+    public override bool IsInvalid => handle.ToInt32() <= 0;
+
+    /// <summary>Integer ID libplctag issued on <c>plc_tag_create_ex</c>.</summary>
+    public int NativeId => handle.ToInt32();
+
+    /// <summary>Wrap a native tag ID returned from libplctag.</summary>
+    public static PlcTagHandle FromNative(int nativeId) => new(nativeId);
+
+    /// <summary>
+    ///     Destroy the native tag. No-op for PR 2 (the wire P/Invoke lands in PR 3). The base
+    ///     <see cref="SafeHandle"/> machinery still guarantees this runs exactly once per
+    ///     handle — either during <see cref="SafeHandle.Dispose()"/> or during finalization
+    ///     if the owner was GC'd without explicit Dispose.
+    /// </summary>
+    protected override bool ReleaseHandle()
+    {
+        if (IsInvalid) return true;
+        // PR 3: wire up plc_tag_destroy(handle.ToInt32()) once the DllImport lands.
+        return true;
+    }
+}