AB CIP PR 9-12 — Per-PLC-family profile tests + GuardLogix safety-tag support. Consolidates PRs 9/10/11/12 from the plan (ControlLogix / CompactLogix / Micro800 / GuardLogix integration suites) into a single PR because the per-family work that actually ships without a live ab_server binary is profile-metadata assertion + unit-level driver-option binding. Per-family integration tests that require a running simulator are deferred to the ab_server-CI follow-up already tracked from PR 3 (download prebuilt Windows binary as GitHub release asset). ControlLogix — baseline profile asserted (controllogix attribute, 4002 LFO ConnectionSize, 1,0 default path, request-packing + connected-messaging, 4000B max fragment). CompactLogix — narrower 504 ConnectionSize for 5069-L3x safety, 500B max fragment, lib attribute compactlogix which libplctag maps to the ControlLogix family internally but via our profile chain we surface it as a distinct knob so future quirk handling (5069 narrow-window regression cases) hangs off the compactlogix attribute. Micro800 — empty CIP path for no-backplane routing, 488B ConnectionSize, 484B fragment cap, request packing + connected messaging both disabled (most models reject Forward_Open), micro800 lib attribute. Test asserts the driver correctly parses an ab://192.168.1.20/ host address with empty path + forwards the empty path through AbCipTagCreateParams so libplctag sees the unconnected-only configuration. GuardLogix — wire protocol identical to ControlLogix (safety partition is a per-tag concern, not a wire-layer distinction) so profile defaults match ControlLogix. New AbCipTagDefinition.SafetyTag field — when true, the driver forces SecurityClassification.ViewOnly in discovery regardless of the Writable flag, and IWritable rejects the write upfront with BadNotWritable. Matches the Rockwell safety-partition isolation model where non-safety-task writes to safety tags would be rejected by the PLC anyway — surfacing the intent at the driver surface prevents wasted wire round-trips + gives Admin UI users a correct ViewOnly rendering. 14 new unit tests in AbCipPlcFamilyTests covering — ControlLogix profile defaults + correct profile selection at Initialize, CompactLogix narrower-than-ControlLogix ConnectionSize + fragment cap, Micro800 empty path parses + SupportsConnectedMessaging=false + SupportsRequestPacking=false + read forwards empty path + micro800 attribute through to libplctag, GuardLogix wire-protocol parity with ControlLogix, GuardLogix safety tag surfaces as ViewOnly in discovery even when Writable=true, GuardLogix safety-tag write rejected with BadNotWritable even when Writable=true, ForFamily theory (4 families → correct libplctag attribute). Total AbCip unit tests now 161/161 passing (+14 from PR 8's 147). Modbus + other drivers untouched; full solution builds 0 errors. PR 13 (IAlarmSource via tag-projected ALMA/ALMD blocks) remains deferred per the plan — feature-flagged pattern not needed before go-live.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipDriver.cs

@@ -316,7 +316,7 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
                 results[i] = new WriteResult(AbCipStatusMapper.BadNodeIdUnknown);
                 continue;
             }
-            if (!def.Writable)
+            if (!def.Writable || def.SafetyTag)
             {
                 results[i] = new WriteResult(AbCipStatusMapper.BadNotWritable);
                 continue;
@@ -521,7 +521,7 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
         DriverDataType: tag.DataType.ToDriverDataType(),
         IsArray: false,
         ArrayDim: null,
-        SecurityClass: tag.Writable
+        SecurityClass: (tag.Writable && !tag.SafetyTag)
             ? SecurityClassification.Operate
             : SecurityClassification.ViewOnly,
         IsHistorized: false,

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipDriverOptions.cs

@@ -59,6 +59,12 @@ public sealed record AbCipDeviceOptions(
 ///     member (member TagPath = <c>{tag.TagPath}.{member.Name}</c>). When <c>null</c> on a Structure
 ///     tag, the driver treats it as a black-box and relies on downstream configuration to address
 ///     members individually via dotted <see cref="AbCipTagPath"/> syntax. Ignored for atomic types.</param>
+/// <param name="SafetyTag">GuardLogix safety-partition tag hint. When <c>true</c>, the driver
+///     forces <c>SecurityClassification.ViewOnly</c> on discovery regardless of
+///     <paramref name="Writable"/> — safety tags can only be written from the safety task of a
+///     GuardLogix controller; non-safety writes violate the safety-partition isolation and are
+///     rejected by the PLC anyway. Surfaces the intent explicitly instead of relying on the
+///     write attempt failing at runtime.</param>
 public sealed record AbCipTagDefinition(
     string Name,
     string DeviceHostAddress,
@@ -66,7 +72,8 @@ public sealed record AbCipTagDefinition(
     AbCipDataType DataType,
     bool Writable = true,
     bool WriteIdempotent = false,
-    IReadOnlyList<AbCipStructureMember>? Members = null);
+    IReadOnlyList<AbCipStructureMember>? Members = null,
+    bool SafetyTag = false);
 
 /// <summary>
 ///     One declared member of a UDT tag. Name is the member identifier on the PLC (e.g. <c>Speed</c>,