Phase 3 PR 66 -- OPC UA Client (gateway) driver project scaffold + IDriver session lifecycle. First driver that CONSUMES OPC UA rather than PUBLISHES it -- connects to a remote server and re-exposes its address space through the local OtOpcUa server per driver-specs.md \u00A78. Uses the same OPCFoundation.NetStandard.Opc.Ua.Client package the existing Client.Shared ships (bumped to 1.5.378.106 to match). Builds its own ApplicationConfiguration (cert stores under %LocalAppData%/OtOpcUa/pki so multiple driver instances in one OtOpcUa server process share a trust anchor) rather than reusing Client.Shared -- Client.Shared is oriented at the interactive CLI with different session-lifetime needs (this driver is always-on, needs keep-alive + session transfer on reconnect + multi-year uptime). Navigated the post-refactor 1.5.378 SDK surface: every Session.Create* static is now [Obsolete] in favour of DefaultSessionFactory; CoreClientUtils.SelectEndpoint got the sync overloads deprecated in favour of SelectEndpointAsync with a required ITelemetryContext parameter. Driver passes telemetry: null! to both SelectEndpointAsync + new DefaultSessionFactory(telemetry: null!) -- the SDK's internal default sink handles null gracefully and plumbing a telemetry context through the driver options surface is out of scope (the driver emits its own logs via the DriverHealth surface anyway). ApplicationInstance default ctor is also obsolete; wrapped in #pragma warning disable CS0618 rather than migrate to the ITelemetryContext overload for the same reason. OpcUaClientDriverOptions models driver-specs.md \u00A78 settings: EndpointUrl (default opc.tcp://localhost:4840 IANA-assigned port), SecurityPolicy/SecurityMode/AuthType enums, Username/Password, SessionTimeout=120s + KeepAliveInterval=5s + ReconnectPeriod=5s (defaults from spec), AutoAcceptCertificates=false (production default; dev turns on for self-signed servers), ApplicationUri + SessionName knobs for certificate SAN matching and remote-server session-list identification. OpcUaClientDriver : IDriver: InitializeAsync builds the ApplicationConfiguration, resolves + creates cert if missing via app.CheckApplicationInstanceCertificatesAsync, selects endpoint via CoreClientUtils.SelectEndpointAsync, builds UserIdentity (Anonymous or Username with UTF-8-encoded password bytes -- the legacy string-password ctor went away; Certificate auth deferred), creates session via DefaultSessionFactory.CreateAsync. Health transitions Unknown -> Initializing -> Healthy on success or -> Faulted on failure with best-effort Session.CloseAsync cleanup. ShutdownAsync (async now, not Task.CompletedTask) closes the session + disposes. Internal Session + Gate expose to the test project via InternalsVisibleTo so PRs 67-69 can stack read/write/discovery/subscribe on the same serialization. Scaffold tests (OpcUaClientDriverScaffoldTests, 5 facts): Default_options_target_standard_opcua_port_and_anonymous_auth (4840 + None mode + Anonymous + AutoAccept=false production default), Default_timeouts_match_driver_specs_section_8 (120s/5s/5s), Driver_reports_type_and_id_before_connect (DriverType=OpcUaClient, DriverInstanceId round-trip, pre-init Unknown health), Initialize_against_unreachable_endpoint_transitions_to_Faulted_and_throws, Reinitialize_against_unreachable_endpoint_re_throws. Uses opc.tcp://127.0.0.1:1 as the 'guaranteed-unreachable' target -- RFC 5737 reserved IPs get black-holed and time out only after the SDK's internal retry/backoff fully elapses (~60s), while port 1 on loopback refuses immediately with TCP RST which keeps the test suite snappy (5 tests / 8s). 5/5 pass. dotnet build clean. Scope boundary: ITagDiscovery / IReadable / IWritable / ISubscribable / IHostConnectivityProbe deliberately NOT in this PR -- they need browse + namespace remapping + reference-counted MonitoredItem forwarding + keep-alive probing and land in PRs 67-69.

ZB.MOM.WW.OtOpcUa.slnx

@@ -10,6 +10,7 @@
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ZB.MOM.WW.OtOpcUa.Driver.Modbus.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.S7/ZB.MOM.WW.OtOpcUa.Driver.S7.csproj"/>
+        <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Client.Shared/ZB.MOM.WW.OtOpcUa.Client.Shared.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Client.CLI/ZB.MOM.WW.OtOpcUa.Client.CLI.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Client.UI/ZB.MOM.WW.OtOpcUa.Client.UI.csproj"/>
@@ -28,6 +29,7 @@
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Tests.csproj"/>
+        <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Client.CLI.Tests/ZB.MOM.WW.OtOpcUa.Client.CLI.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Client.UI.Tests/ZB.MOM.WW.OtOpcUa.Client.UI.Tests.csproj"/>

src/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/OpcUaClientDriver.cs

@@ -0,0 +1,231 @@
+using Opc.Ua;
+using Opc.Ua.Client;
+using Opc.Ua.Configuration;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient;
+
+/// <summary>
+///     OPC UA Client (gateway) driver. Opens a <see cref="Session"/> against a remote OPC UA
+///     server and re-exposes its address space through the local OtOpcUa server. PR 66 ships
+///     the scaffold: <see cref="IDriver"/> only (connect / close / health). Browse, read,
+///     write, subscribe, and probe land in PRs 67-69.
+/// </summary>
+/// <remarks>
+///     <para>
+///         Builds its own <see cref="ApplicationConfiguration"/> rather than reusing
+///         <c>Client.Shared</c> — Client.Shared is oriented at the interactive CLI; this
+///         driver is an always-on service component with different session-lifetime needs
+///         (keep-alive monitor, session transfer on reconnect, multi-year uptime).
+///     </para>
+///     <para>
+///         <b>Session lifetime</b>: a single <see cref="Session"/> per driver instance.
+///         Subscriptions multiplex onto that session; SDK reconnect handler takes the session
+///         down and brings it back up on remote-server restart — the driver must re-send
+///         subscriptions + TransferSubscriptions on reconnect to avoid dangling
+///         monitored-item handles. That mechanic lands in PR 69.
+///     </para>
+/// </remarks>
+public sealed class OpcUaClientDriver(OpcUaClientDriverOptions options, string driverInstanceId)
+    : IDriver, IDisposable, IAsyncDisposable
+{
+    private readonly OpcUaClientDriverOptions _options = options;
+    private readonly SemaphoreSlim _gate = new(1, 1);
+
+    /// <summary>Active OPC UA session. Null until <see cref="InitializeAsync"/> returns cleanly.</summary>
+    internal ISession? Session { get; private set; }
+
+    /// <summary>Per-connection gate. PRs 67+ serialize read/write/browse on this.</summary>
+    internal SemaphoreSlim Gate => _gate;
+
+    private DriverHealth _health = new(DriverState.Unknown, null, null);
+    private bool _disposed;
+
+    public string DriverInstanceId => driverInstanceId;
+    public string DriverType => "OpcUaClient";
+
+    public async Task InitializeAsync(string driverConfigJson, CancellationToken cancellationToken)
+    {
+        _health = new DriverHealth(DriverState.Initializing, null, null);
+        try
+        {
+            var appConfig = await BuildApplicationConfigurationAsync(cancellationToken).ConfigureAwait(false);
+
+            // Endpoint selection: let the stack pick the best matching endpoint for the
+            // requested security policy/mode so the driver doesn't have to hand-validate.
+            // UseSecurity=false when SecurityMode=None shortcuts around cert validation
+            // entirely and is the typical dev-bench configuration.
+            var useSecurity = _options.SecurityMode != OpcUaSecurityMode.None;
+            // The non-obsolete SelectEndpointAsync overloads all require an ITelemetryContext
+            // parameter. Passing null is valid — the SDK falls through to its built-in default
+            // trace sink. Plumbing a telemetry context through every driver surface is out of
+            // scope; the driver emits its own logs via the health surface anyway.
+            var selected = await CoreClientUtils.SelectEndpointAsync(
+                appConfig, _options.EndpointUrl, useSecurity,
+                telemetry: null!,
+                ct: cancellationToken).ConfigureAwait(false);
+            var endpointConfig = EndpointConfiguration.Create(appConfig);
+            endpointConfig.OperationTimeout = (int)_options.Timeout.TotalMilliseconds;
+            var endpoint = new ConfiguredEndpoint(null, selected, endpointConfig);
+
+            var identity = _options.AuthType switch
+            {
+                OpcUaAuthType.Anonymous => new UserIdentity(new AnonymousIdentityToken()),
+                // The UserIdentity(string, string) overload was removed in favour of
+                // (string, byte[]) to make the password encoding explicit. UTF-8 is the
+                // overwhelmingly common choice for Basic256Sha256-secured sessions.
+                OpcUaAuthType.Username => new UserIdentity(
+                    _options.Username ?? string.Empty,
+                    System.Text.Encoding.UTF8.GetBytes(_options.Password ?? string.Empty)),
+                OpcUaAuthType.Certificate => throw new NotSupportedException(
+                    "Certificate authentication lands in a follow-up PR; for now use Anonymous or Username"),
+                _ => new UserIdentity(new AnonymousIdentityToken()),
+            };
+
+            // All Session.Create* static methods are marked [Obsolete] in SDK 1.5.378; the
+            // non-obsolete path is DefaultSessionFactory.Instance.CreateAsync (which is the
+            // 8-arg signature matching our driver config — ApplicationConfiguration +
+            // ConfiguredEndpoint, no transport-waiting-connection or reverse-connect-manager
+            // required for the standard opc.tcp direct-connect case).
+            // DefaultSessionFactory's parameterless ctor is also obsolete in 1.5.378; the
+            // current constructor requires an ITelemetryContext. Passing null is tolerated —
+            // the factory falls back to its internal default sink, same as the telemetry:null
+            // on SelectEndpointAsync above.
+            var session = await new DefaultSessionFactory(telemetry: null!).CreateAsync(
+                appConfig,
+                endpoint,
+                false,                                              // updateBeforeConnect
+                _options.SessionName,
+                (uint)_options.SessionTimeout.TotalMilliseconds,
+                identity,
+                null,                                               // preferredLocales
+                cancellationToken).ConfigureAwait(false);
+
+            session.KeepAliveInterval = (int)_options.KeepAliveInterval.TotalMilliseconds;
+
+            Session = session;
+            _health = new DriverHealth(DriverState.Healthy, DateTime.UtcNow, null);
+        }
+        catch (Exception ex)
+        {
+            try { if (Session is Session s) await s.CloseAsync().ConfigureAwait(false); } catch { }
+            Session = null;
+            _health = new DriverHealth(DriverState.Faulted, null, ex.Message);
+            throw;
+        }
+    }
+
+    /// <summary>
+    ///     Build a minimal in-memory <see cref="ApplicationConfiguration"/>. Certificates live
+    ///     under the OS user profile — on Windows that's <c>%LocalAppData%\OtOpcUa\pki</c>
+    ///     — so multiple driver instances in the same OtOpcUa server process share one
+    ///     certificate store without extra config.
+    /// </summary>
+    private async Task<ApplicationConfiguration> BuildApplicationConfigurationAsync(CancellationToken ct)
+    {
+        // The default ctor is obsolete in favour of the ITelemetryContext overload; suppress
+        // locally rather than plumbing a telemetry context all the way through the driver
+        // surface — the driver emits no per-request telemetry of its own and the SDK's
+        // internal fallback is fine for a gateway use case.
+#pragma warning disable CS0618
+        var app = new ApplicationInstance
+        {
+            ApplicationName = _options.SessionName,
+            ApplicationType = ApplicationType.Client,
+        };
+#pragma warning restore CS0618
+
+        var pkiRoot = Path.Combine(
+            Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
+            "OtOpcUa", "pki");
+
+        var config = new ApplicationConfiguration
+        {
+            ApplicationName = _options.SessionName,
+            ApplicationType = ApplicationType.Client,
+            ApplicationUri = _options.ApplicationUri,
+            SecurityConfiguration = new SecurityConfiguration
+            {
+                ApplicationCertificate = new CertificateIdentifier
+                {
+                    StoreType = CertificateStoreType.Directory,
+                    StorePath = Path.Combine(pkiRoot, "own"),
+                    SubjectName = $"CN={_options.SessionName}",
+                },
+                TrustedPeerCertificates = new CertificateTrustList
+                {
+                    StoreType = CertificateStoreType.Directory,
+                    StorePath = Path.Combine(pkiRoot, "trusted"),
+                },
+                TrustedIssuerCertificates = new CertificateTrustList
+                {
+                    StoreType = CertificateStoreType.Directory,
+                    StorePath = Path.Combine(pkiRoot, "issuers"),
+                },
+                RejectedCertificateStore = new CertificateTrustList
+                {
+                    StoreType = CertificateStoreType.Directory,
+                    StorePath = Path.Combine(pkiRoot, "rejected"),
+                },
+                AutoAcceptUntrustedCertificates = _options.AutoAcceptCertificates,
+            },
+            TransportQuotas = new TransportQuotas { OperationTimeout = (int)_options.Timeout.TotalMilliseconds },
+            ClientConfiguration = new ClientConfiguration
+            {
+                DefaultSessionTimeout = (int)_options.SessionTimeout.TotalMilliseconds,
+            },
+            DisableHiResClock = true,
+        };
+
+        await config.ValidateAsync(ApplicationType.Client, ct).ConfigureAwait(false);
+
+        // Attach a cert-validator handler that honours the AutoAccept flag. Without this,
+        // AutoAcceptUntrustedCertificates on the config alone isn't always enough in newer
+        // SDK versions — the validator raises an event the app has to handle.
+        if (_options.AutoAcceptCertificates)
+        {
+            config.CertificateValidator.CertificateValidation += (s, e) =>
+            {
+                if (e.Error.StatusCode == StatusCodes.BadCertificateUntrusted)
+                    e.Accept = true;
+            };
+        }
+
+        // Ensure an application certificate exists. The SDK auto-generates one if missing.
+        app.ApplicationConfiguration = config;
+        await app.CheckApplicationInstanceCertificatesAsync(silent: true, lifeTimeInMonths: null, ct)
+            .ConfigureAwait(false);
+
+        return config;
+    }
+
+    public async Task ReinitializeAsync(string driverConfigJson, CancellationToken cancellationToken)
+    {
+        await ShutdownAsync(cancellationToken).ConfigureAwait(false);
+        await InitializeAsync(driverConfigJson, cancellationToken).ConfigureAwait(false);
+    }
+
+    public async Task ShutdownAsync(CancellationToken cancellationToken)
+    {
+        try { if (Session is Session s) await s.CloseAsync(cancellationToken).ConfigureAwait(false); }
+        catch { /* best-effort */ }
+        try { Session?.Dispose(); } catch { }
+        Session = null;
+        _health = new DriverHealth(DriverState.Unknown, _health.LastSuccessfulRead, null);
+    }
+
+    public DriverHealth GetHealth() => _health;
+    public long GetMemoryFootprint() => 0;
+    public Task FlushOptionalCachesAsync(CancellationToken cancellationToken) => Task.CompletedTask;
+
+    public void Dispose() => DisposeAsync().AsTask().GetAwaiter().GetResult();
+
+    public async ValueTask DisposeAsync()
+    {
+        if (_disposed) return;
+        _disposed = true;
+        try { await ShutdownAsync(CancellationToken.None).ConfigureAwait(false); }
+        catch { /* disposal is best-effort */ }
+        _gate.Dispose();
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/OpcUaClientDriverOptions.cs

@@ -0,0 +1,81 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient;
+
+/// <summary>
+///     OPC UA Client (gateway) driver configuration. Bound from <c>DriverConfig</c> JSON at
+///     driver-host registration time. Models the settings documented in
+///     <c>docs/v2/driver-specs.md</c> §8.
+/// </summary>
+/// <remarks>
+///     This driver connects to a REMOTE OPC UA server and re-exposes its address space
+///     through the local OtOpcUa server — the opposite direction from the usual "server
+///     exposes PLC data" flow. Tier A (pure managed, OPC Foundation reference SDK); universal
+///     protections cover it.
+/// </remarks>
+public sealed class OpcUaClientDriverOptions
+{
+    /// <summary>Remote OPC UA endpoint URL, e.g. <c>opc.tcp://plc.internal:4840</c>.</summary>
+    public string EndpointUrl { get; init; } = "opc.tcp://localhost:4840";
+
+    /// <summary>Security policy. One of <c>None</c>, <c>Basic256Sha256</c>, <c>Aes128_Sha256_RsaOaep</c>.</summary>
+    public string SecurityPolicy { get; init; } = "None";
+
+    /// <summary>Security mode.</summary>
+    public OpcUaSecurityMode SecurityMode { get; init; } = OpcUaSecurityMode.None;
+
+    /// <summary>Authentication type.</summary>
+    public OpcUaAuthType AuthType { get; init; } = OpcUaAuthType.Anonymous;
+
+    /// <summary>User name (required only for <see cref="OpcUaAuthType.Username"/>).</summary>
+    public string? Username { get; init; }
+
+    /// <summary>Password (required only for <see cref="OpcUaAuthType.Username"/>).</summary>
+    public string? Password { get; init; }
+
+    /// <summary>Server-negotiated session timeout. Default 120s per driver-specs.md §8.</summary>
+    public TimeSpan SessionTimeout { get; init; } = TimeSpan.FromSeconds(120);
+
+    /// <summary>Client-side keep-alive interval.</summary>
+    public TimeSpan KeepAliveInterval { get; init; } = TimeSpan.FromSeconds(5);
+
+    /// <summary>Initial reconnect delay after a session drop.</summary>
+    public TimeSpan ReconnectPeriod { get; init; } = TimeSpan.FromSeconds(5);
+
+    /// <summary>
+    ///     When <c>true</c>, the driver accepts any self-signed / untrusted server certificate.
+    ///     Dev-only — must be <c>false</c> in production so MITM attacks against the opc.tcp
+    ///     channel fail closed.
+    /// </summary>
+    public bool AutoAcceptCertificates { get; init; } = false;
+
+    /// <summary>
+    ///     Application URI the driver reports during session creation. Must match the
+    ///     subject-alt-name on the client certificate if one is used, which is why it's a
+    ///     config knob rather than hard-coded.
+    /// </summary>
+    public string ApplicationUri { get; init; } = "urn:localhost:OtOpcUa:GatewayClient";
+
+    /// <summary>
+    ///     Friendly name sent to the remote server for diagnostics. Shows up in the remote
+    ///     server's session-list so operators can identify which gateway instance is calling.
+    /// </summary>
+    public string SessionName { get; init; } = "OtOpcUa-Gateway";
+
+    /// <summary>Connect + per-operation timeout.</summary>
+    public TimeSpan Timeout { get; init; } = TimeSpan.FromSeconds(10);
+}
+
+/// <summary>OPC UA message security mode.</summary>
+public enum OpcUaSecurityMode
+{
+    None,
+    Sign,
+    SignAndEncrypt,
+}
+
+/// <summary>User authentication type sent to the remote server.</summary>
+public enum OpcUaAuthType
+{
+    Anonymous,
+    Username,
+    Certificate,
+}

src/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj

@@ -0,0 +1,28 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <LangVersion>latest</LangVersion>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+        <GenerateDocumentationFile>true</GenerateDocumentationFile>
+        <NoWarn>$(NoWarn);CS1591</NoWarn>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient</RootNamespace>
+        <AssemblyName>ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient</AssemblyName>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Core.Abstractions\ZB.MOM.WW.OtOpcUa.Core.Abstractions.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Client" Version="1.5.378.106"/>
+        <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Configuration" Version="1.5.378.106"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests"/>
+    </ItemGroup>
+
+</Project>

tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests/OpcUaClientDriverScaffoldTests.cs

@@ -0,0 +1,90 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests;
+
+/// <summary>
+///     Scaffold-level tests for <see cref="OpcUaClientDriver"/> that don't require a live
+///     remote OPC UA server. PR 67+ adds IReadable/IWritable/ITagDiscovery/ISubscribable
+///     tests against a local in-process OPC UA server fixture.
+/// </summary>
+[Trait("Category", "Unit")]
+public sealed class OpcUaClientDriverScaffoldTests
+{
+    [Fact]
+    public void Default_options_target_standard_opcua_port_and_anonymous_auth()
+    {
+        var opts = new OpcUaClientDriverOptions();
+        opts.EndpointUrl.ShouldBe("opc.tcp://localhost:4840", "4840 is the IANA-assigned OPC UA port");
+        opts.SecurityMode.ShouldBe(OpcUaSecurityMode.None);
+        opts.AuthType.ShouldBe(OpcUaAuthType.Anonymous);
+        opts.AutoAcceptCertificates.ShouldBeFalse("production default must reject untrusted server certs");
+    }
+
+    [Fact]
+    public void Default_timeouts_match_driver_specs_section_8()
+    {
+        var opts = new OpcUaClientDriverOptions();
+        opts.SessionTimeout.ShouldBe(TimeSpan.FromSeconds(120));
+        opts.KeepAliveInterval.ShouldBe(TimeSpan.FromSeconds(5));
+        opts.ReconnectPeriod.ShouldBe(TimeSpan.FromSeconds(5));
+    }
+
+    [Fact]
+    public void Driver_reports_type_and_id_before_connect()
+    {
+        using var drv = new OpcUaClientDriver(new OpcUaClientDriverOptions(), "opcua-test");
+        drv.DriverType.ShouldBe("OpcUaClient");
+        drv.DriverInstanceId.ShouldBe("opcua-test");
+        drv.GetHealth().State.ShouldBe(DriverState.Unknown);
+    }
+
+    [Fact]
+    public async Task Initialize_against_unreachable_endpoint_transitions_to_Faulted_and_throws()
+    {
+        // RFC 5737 reserved-for-documentation IP; won't route anywhere. Pick opc.tcp:// so
+        // endpoint selection hits the transport-layer connection rather than a DNS lookup.
+        var opts = new OpcUaClientDriverOptions
+        {
+            // Port 1 on loopback is effectively guaranteed to be closed — the OS responds
+            // with TCP RST immediately instead of hanging on connect, which keeps the
+            // unreachable-host tests snappy. Don't use an RFC 5737 reserved IP; those get
+            // routed to a black-hole + time out only after the SDK's internal retry/backoff
+            // fully elapses (~60s even with Options.Timeout=500ms).
+            EndpointUrl = "opc.tcp://127.0.0.1:1",
+            Timeout = TimeSpan.FromMilliseconds(500),
+            AutoAcceptCertificates = true, // dev-mode to bypass cert validation in the test
+        };
+        using var drv = new OpcUaClientDriver(opts, "opcua-unreach");
+
+        await Should.ThrowAsync<Exception>(async () =>
+            await drv.InitializeAsync("{}", TestContext.Current.CancellationToken));
+
+        var health = drv.GetHealth();
+        health.State.ShouldBe(DriverState.Faulted);
+        health.LastError.ShouldNotBeNull();
+    }
+
+    [Fact]
+    public async Task Reinitialize_against_unreachable_endpoint_re_throws()
+    {
+        var opts = new OpcUaClientDriverOptions
+        {
+            // Port 1 on loopback is effectively guaranteed to be closed — the OS responds
+            // with TCP RST immediately instead of hanging on connect, which keeps the
+            // unreachable-host tests snappy. Don't use an RFC 5737 reserved IP; those get
+            // routed to a black-hole + time out only after the SDK's internal retry/backoff
+            // fully elapses (~60s even with Options.Timeout=500ms).
+            EndpointUrl = "opc.tcp://127.0.0.1:1",
+            Timeout = TimeSpan.FromMilliseconds(500),
+            AutoAcceptCertificates = true,
+        };
+        using var drv = new OpcUaClientDriver(opts, "opcua-reinit");
+
+        await Should.ThrowAsync<Exception>(async () =>
+            await drv.InitializeAsync("{}", TestContext.Current.CancellationToken));
+        await Should.ThrowAsync<Exception>(async () =>
+            await drv.ReinitializeAsync("{}", TestContext.Current.CancellationToken));
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests.csproj

@@ -0,0 +1,31 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <IsPackable>false</IsPackable>
+        <IsTestProject>true</IsTestProject>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests</RootNamespace>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="xunit.v3" Version="1.1.0"/>
+        <PackageReference Include="Shouldly" Version="4.3.0"/>
+        <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0"/>
+        <PackageReference Include="xunit.runner.visualstudio" Version="3.0.2">
+            <PrivateAssets>all</PrivateAssets>
+            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+        </PackageReference>
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\..\src\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-37gx-xxp4-5rgx"/>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-w3x6-4m5h-cxqf"/>
+    </ItemGroup>
+
+</Project>