docs(drivers): B/I/O + BOOL-within-word bit writes (RMW)

docs/drivers/TwinCAT.md

@@ -62,6 +62,14 @@ mirrors IEC 61131-3 structured-text identifiers: global-variable-list
 (`Motor1.Status.Running`), array subscripts (`Data[5]`, `Matrix[1,2]`), and
 bit-access (`Flags.0`).
 
+**BOOL-within-word writes** — writing a bit-access path (e.g. `MAIN.Flags.3`)
+is a driver-level parent-word read-modify-write: the driver reads the parent
+word as `UDInt`, flips the target bit, and writes the word back, under a
+per-parent lock. The lock serialises the driver's own concurrent bit-writers
+against the same word, but cannot guard against the PLC program writing that
+word between the driver's read and write — this is an inherent limitation of
+any software-level RMW.
+
 ## Tag discovery
 
 `DiscoverAsync` always emits the pre-declared `Tags` as the authoritative config
@@ -79,7 +87,7 @@ discovery.
 | Capability | Path | Notes |
 |------------|------|-------|
 | `IReadable` | `ReadAsync` → ADS `ReadValueAsync` | Per-device client, lazily connected and serialized per device |
-| `IWritable` | `WriteAsync` → ADS `WriteValueAsync` | Read-only tags return `BadNotWritable` |
+| `IWritable` | `WriteAsync` → ADS `WriteValueAsync` | BOOL-within-word writes (e.g. `MAIN.Flags.3`) use a driver-level parent-word read-modify-write (read as UDInt, flip bit, write back) under a per-parent lock. Read-only tags return `BadNotWritable`. |
 | `ITagDiscovery` | `DiscoverAsync` | Pre-declared tags + opt-in controller symbol browse |
 | `ISubscribable` | native ADS notifications (default), poll fallback | `UseNativeNotifications=true` registers device notifications so the PLC pushes changes; `false` uses the shared `PollGroupEngine` |
 | `IHostConnectivityProbe` | per-device probe loop | One `HostConnectivityStatus` per configured device; `Running`/`Stopped` transitions raise `OnHostStatusChanged` |