chore: organize solution into module folders (Core/Server/Drivers/Client/Tooling)

Group all 69 projects into category subfolders under src/ and tests/ so the
Rider Solution Explorer mirrors the module structure. Folders: Core, Server,
Drivers (with a nested Driver CLIs subfolder), Client, Tooling.

- Move every project folder on disk with git mv (history preserved as renames).
- Recompute relative paths in 57 .csproj files: cross-category ProjectReferences,
  the lib/ HintPath+None refs in Driver.Historian.Wonderware, and the external
  mxaccessgw refs in Driver.Galaxy and its test project.
- Rebuild ZB.MOM.WW.OtOpcUa.slnx with nested solution folders.
- Re-prefix project paths in functional scripts (e2e, compliance, smoke SQL,
  integration, install).

Build green (0 errors); unit tests pass. Docs left for a separate pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/AbCipCommandBase.cs

@@ -0,0 +1,59 @@
+using CliFx.Attributes;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli;
+
+/// <summary>
+///     Base for every AB CIP CLI command. Carries the libplctag endpoint options
+///     (<c>--gateway</c> + <c>--family</c>) and exposes <see cref="BuildOptions"/> so each
+///     command can synthesise an <see cref="AbCipDriverOptions"/> from CLI flags + its own
+///     tag list.
+/// </summary>
+public abstract class AbCipCommandBase : DriverCommandBase
+{
+    [CommandOption("gateway", 'g', Description =
+        "Canonical AB CIP gateway: ab://host[:port]/cip-path. Port defaults to 44818 " +
+        "(EtherNet/IP). cip-path is family-specific: ControlLogix / CompactLogix need " +
+        "'1,0' to reach slot 0 of the CPU chassis; Micro800 takes an empty path; " +
+        "GuardLogix typically '1,0' same as ControlLogix.",
+        IsRequired = true)]
+    public string Gateway { get; init; } = default!;
+
+    [CommandOption("family", 'f', Description =
+        "ControlLogix / CompactLogix / Micro800 / GuardLogix (default ControlLogix).")]
+    public AbCipPlcFamily Family { get; init; } = AbCipPlcFamily.ControlLogix;
+
+    [CommandOption("timeout-ms", Description = "Per-operation timeout in ms (default 5000).")]
+    public int TimeoutMs { get; init; } = 5000;
+
+    /// <inheritdoc />
+    public override TimeSpan Timeout
+    {
+        get => TimeSpan.FromMilliseconds(TimeoutMs);
+        init { /* driven by TimeoutMs */ }
+    }
+
+    /// <summary>
+    ///     Build an <see cref="AbCipDriverOptions"/> with the device + tag list a subclass
+    ///     supplies. Probe + alarm projection are disabled — CLI runs are one-shot; the
+    ///     probe loop would race the operator's own reads.
+    /// </summary>
+    protected AbCipDriverOptions BuildOptions(IReadOnlyList<AbCipTagDefinition> tags) => new()
+    {
+        Devices = [new AbCipDeviceOptions(
+            HostAddress: Gateway,
+            PlcFamily: Family,
+            DeviceName: $"cli-{Family}")],
+        Tags = tags,
+        Timeout = Timeout,
+        Probe = new AbCipProbeOptions { Enabled = false },
+        EnableControllerBrowse = false,
+        EnableAlarmProjection = false,
+    };
+
+    /// <summary>
+    ///     Short instance id used in Serilog output so operators running the CLI against
+    ///     multiple gateways in parallel can distinguish the logs.
+    /// </summary>
+    protected string DriverInstanceId => $"abcip-cli-{Gateway}";
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/Commands/ProbeCommand.cs

@@ -0,0 +1,58 @@
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli.Commands;
+
+/// <summary>
+///     Probes an AB CIP gateway: initialises the driver (connects via libplctag), reads a
+///     single tag, and prints health + the read result. Fastest way to answer "is the PLC
+///     up + reachable + speaking CIP via this path?".
+/// </summary>
+[Command("probe", Description = "Verify the AB CIP gateway is reachable and a sample tag reads.")]
+public sealed class ProbeCommand : AbCipCommandBase
+{
+    [CommandOption("tag", 't', Description =
+        "Tag path to probe. ControlLogix default is '@raw_cpu_type' (the canonical libplctag " +
+        "system tag); Micro800 takes a user-supplied global (e.g. '_SYSVA_CLOCK_HOUR').",
+        IsRequired = true)]
+    public string TagPath { get; init; } = default!;
+
+    [CommandOption("type", Description =
+        "Logix atomic type of the probe tag (default DInt).")]
+    public AbCipDataType DataType { get; init; } = AbCipDataType.DInt;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        var probeTag = new AbCipTagDefinition(
+            Name: "__probe",
+            DeviceHostAddress: Gateway,
+            TagPath: TagPath,
+            DataType: DataType,
+            Writable: false);
+        var options = BuildOptions([probeTag]);
+
+        await using var driver = new AbCipDriver(options, DriverInstanceId);
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+            var snapshot = await driver.ReadAsync(["__probe"], ct);
+            var health = driver.GetHealth();
+
+            await console.Output.WriteLineAsync($"Gateway:      {Gateway}");
+            await console.Output.WriteLineAsync($"Family:       {Family}");
+            await console.Output.WriteLineAsync($"Health:       {health.State}");
+            if (health.LastError is { } err)
+                await console.Output.WriteLineAsync($"Last error:   {err}");
+            await console.Output.WriteLineAsync();
+            await console.Output.WriteLineAsync(SnapshotFormatter.Format(TagPath, snapshot[0]));
+        }
+        finally
+        {
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/Commands/ReadCommand.cs

@@ -0,0 +1,60 @@
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli.Commands;
+
+/// <summary>
+///     Read one Logix tag by symbolic path. Operator specifies <c>--tag</c> + <c>--type</c>;
+///     the CLI synthesises a one-tag driver config, reads once, prints the snapshot, shuts
+///     down. UDT / Structure reads are out of scope here — those need the member layout
+///     declared, which belongs in a real driver config.
+/// </summary>
+[Command("read", Description = "Read a single Logix tag by symbolic path.")]
+public sealed class ReadCommand : AbCipCommandBase
+{
+    [CommandOption("tag", 't', Description =
+        "Logix symbolic path. Controller scope: 'Motor01_Speed'. Program scope: " +
+        "'Program:Main.Motor01_Speed'. Array element: 'Recipe[3]'. UDT member: " +
+        "'Motor01.Speed'.", IsRequired = true)]
+    public string TagPath { get; init; } = default!;
+
+    [CommandOption("type", Description =
+        "Bool / SInt / Int / DInt / LInt / USInt / UInt / UDInt / ULInt / Real / LReal / " +
+        "String / Dt / Structure (default DInt).")]
+    public AbCipDataType DataType { get; init; } = AbCipDataType.DInt;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        var tagName = SynthesiseTagName(TagPath, DataType);
+        var tag = new AbCipTagDefinition(
+            Name: tagName,
+            DeviceHostAddress: Gateway,
+            TagPath: TagPath,
+            DataType: DataType,
+            Writable: false);
+        var options = BuildOptions([tag]);
+
+        await using var driver = new AbCipDriver(options, DriverInstanceId);
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+            var snapshot = await driver.ReadAsync([tagName], ct);
+            await console.Output.WriteLineAsync(SnapshotFormatter.Format(TagPath, snapshot[0]));
+        }
+        finally
+        {
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+
+    /// <summary>
+    ///     Tag-name key the driver uses internally. The path + type pair is already unique
+    ///     so we use them verbatim — keeps tag-level diagnostics readable without mangling.
+    /// </summary>
+    internal static string SynthesiseTagName(string tagPath, AbCipDataType type)
+        => $"{tagPath}:{type}";
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/Commands/SubscribeCommand.cs

@@ -0,0 +1,81 @@
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli.Commands;
+
+/// <summary>
+///     Watch a Logix tag via polled subscription until Ctrl+C. Uses the driver's
+///     <c>ISubscribable</c> surface (PollGroupEngine under the hood). Prints each change
+///     event with an HH:mm:ss.fff timestamp.
+/// </summary>
+[Command("subscribe", Description = "Watch a Logix tag via polled subscription until Ctrl+C.")]
+public sealed class SubscribeCommand : AbCipCommandBase
+{
+    [CommandOption("tag", 't', Description =
+        "Logix symbolic path — same format as `read`.", IsRequired = true)]
+    public string TagPath { get; init; } = default!;
+
+    [CommandOption("type", Description =
+        "Bool / SInt / Int / DInt / LInt / USInt / UInt / UDInt / ULInt / Real / LReal / " +
+        "String / Dt (default DInt).")]
+    public AbCipDataType DataType { get; init; } = AbCipDataType.DInt;
+
+    [CommandOption("interval-ms", 'i', Description =
+        "Publishing interval in milliseconds (default 1000). PollGroupEngine floors " +
+        "sub-250ms values.")]
+    public int IntervalMs { get; init; } = 1000;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        var tagName = ReadCommand.SynthesiseTagName(TagPath, DataType);
+        var tag = new AbCipTagDefinition(
+            Name: tagName,
+            DeviceHostAddress: Gateway,
+            TagPath: TagPath,
+            DataType: DataType,
+            Writable: false);
+        var options = BuildOptions([tag]);
+
+        await using var driver = new AbCipDriver(options, DriverInstanceId);
+        ISubscriptionHandle? handle = null;
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+
+            driver.OnDataChange += (_, e) =>
+            {
+                var line = $"[{DateTime.UtcNow:HH:mm:ss.fff}] " +
+                    $"{e.FullReference} = {SnapshotFormatter.FormatValue(e.Snapshot.Value)} " +
+                    $"({SnapshotFormatter.FormatStatus(e.Snapshot.StatusCode)})";
+                console.Output.WriteLine(line);
+            };
+
+            handle = await driver.SubscribeAsync([tagName], TimeSpan.FromMilliseconds(IntervalMs), ct);
+
+            await console.Output.WriteLineAsync(
+                $"Subscribed to {TagPath} @ {IntervalMs}ms. Ctrl+C to stop.");
+            try
+            {
+                await Task.Delay(System.Threading.Timeout.InfiniteTimeSpan, ct);
+            }
+            catch (OperationCanceledException)
+            {
+                // Expected on Ctrl+C.
+            }
+        }
+        finally
+        {
+            if (handle is not null)
+            {
+                try { await driver.UnsubscribeAsync(handle, CancellationToken.None); }
+                catch { /* teardown best-effort */ }
+            }
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/Commands/WriteCommand.cs

@@ -0,0 +1,94 @@
+using System.Globalization;
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli.Commands;
+
+/// <summary>
+///     Write one value to a Logix tag by symbolic path. Mirrors <see cref="ReadCommand"/>'s
+///     flag shape + adds <c>--value</c>. Value parsing respects <c>--type</c> so you can
+///     write <c>--value 3.14 --type Real</c> without hex-encoding. GuardLogix safety tags
+///     are refused at the driver level (they're forced to ViewOnly by PR 12).
+/// </summary>
+[Command("write", Description = "Write a single Logix tag by symbolic path.")]
+public sealed class WriteCommand : AbCipCommandBase
+{
+    [CommandOption("tag", 't', Description =
+        "Logix symbolic path — same format as `read`.", IsRequired = true)]
+    public string TagPath { get; init; } = default!;
+
+    [CommandOption("type", Description =
+        "Bool / SInt / Int / DInt / LInt / USInt / UInt / UDInt / ULInt / Real / LReal / " +
+        "String / Dt (default DInt).")]
+    public AbCipDataType DataType { get; init; } = AbCipDataType.DInt;
+
+    [CommandOption("value", 'v', Description =
+        "Value to write. Parsed per --type (booleans accept true/false/1/0).",
+        IsRequired = true)]
+    public string Value { get; init; } = default!;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        if (DataType == AbCipDataType.Structure)
+            throw new CliFx.Exceptions.CommandException(
+                "Structure (UDT) writes need an explicit member layout — drop to the driver's " +
+                "config JSON for those. The CLI covers atomic types only.");
+
+        var tagName = ReadCommand.SynthesiseTagName(TagPath, DataType);
+        var tag = new AbCipTagDefinition(
+            Name: tagName,
+            DeviceHostAddress: Gateway,
+            TagPath: TagPath,
+            DataType: DataType,
+            Writable: true);
+        var options = BuildOptions([tag]);
+
+        var parsed = ParseValue(Value, DataType);
+
+        await using var driver = new AbCipDriver(options, DriverInstanceId);
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+            var results = await driver.WriteAsync([new WriteRequest(tagName, parsed)], ct);
+            await console.Output.WriteLineAsync(SnapshotFormatter.FormatWrite(TagPath, results[0]));
+        }
+        finally
+        {
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+
+    /// <summary>
+    ///     Parse the operator's <c>--value</c> string into the CLR type the driver expects
+    ///     for the declared <see cref="AbCipDataType"/>. Invariant culture everywhere.
+    /// </summary>
+    internal static object ParseValue(string raw, AbCipDataType type) => type switch
+    {
+        AbCipDataType.Bool => ParseBool(raw),
+        AbCipDataType.SInt => sbyte.Parse(raw, CultureInfo.InvariantCulture),
+        AbCipDataType.Int => short.Parse(raw, CultureInfo.InvariantCulture),
+        AbCipDataType.DInt or AbCipDataType.Dt => int.Parse(raw, CultureInfo.InvariantCulture),
+        AbCipDataType.LInt => long.Parse(raw, CultureInfo.InvariantCulture),
+        AbCipDataType.USInt => byte.Parse(raw, CultureInfo.InvariantCulture),
+        AbCipDataType.UInt => ushort.Parse(raw, CultureInfo.InvariantCulture),
+        AbCipDataType.UDInt => uint.Parse(raw, CultureInfo.InvariantCulture),
+        AbCipDataType.ULInt => ulong.Parse(raw, CultureInfo.InvariantCulture),
+        AbCipDataType.Real => float.Parse(raw, CultureInfo.InvariantCulture),
+        AbCipDataType.LReal => double.Parse(raw, CultureInfo.InvariantCulture),
+        AbCipDataType.String => raw,
+        _ => throw new CliFx.Exceptions.CommandException($"Unsupported DataType '{type}' for write."),
+    };
+
+    private static bool ParseBool(string raw) => raw.Trim().ToLowerInvariant() switch
+    {
+        "1" or "true" or "on" or "yes" => true,
+        "0" or "false" or "off" or "no" => false,
+        _ => throw new CliFx.Exceptions.CommandException(
+            $"Boolean value '{raw}' is not recognised. Use true/false, 1/0, on/off, or yes/no."),
+    };
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/Program.cs

@@ -0,0 +1,11 @@
+using CliFx;
+
+return await new CliApplicationBuilder()
+    .AddCommandsFromThisAssembly()
+    .SetExecutableName("otopcua-abcip-cli")
+    .SetDescription(
+        "OtOpcUa AB CIP test-client — ad-hoc probe + Logix symbolic reads/writes + polled " +
+        "subscriptions against ControlLogix / CompactLogix / Micro800 / GuardLogix families " +
+        "via libplctag. Second of four driver CLIs; mirrors otopcua-modbus-cli's shape.")
+    .Build()
+    .RunAsync(args);

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli.csproj

@@ -0,0 +1,29 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <OutputType>Exe</OutputType>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <LangVersion>latest</LangVersion>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+        <GenerateDocumentationFile>true</GenerateDocumentationFile>
+        <NoWarn>$(NoWarn);CS1591</NoWarn>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli</RootNamespace>
+        <AssemblyName>otopcua-abcip-cli</AssemblyName>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="CliFx" Version="2.3.6"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Driver.Cli.Common\ZB.MOM.WW.OtOpcUa.Driver.Cli.Common.csproj"/>
+        <ProjectReference Include="..\..\ZB.MOM.WW.OtOpcUa.Driver.AbCip\ZB.MOM.WW.OtOpcUa.Driver.AbCip.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli.Tests"/>
+    </ItemGroup>
+
+</Project>

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli/AbLegacyCommandBase.cs

@@ -0,0 +1,51 @@
+using CliFx.Attributes;
+using ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.PlcFamilies;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli;
+
+/// <summary>
+///     Base for every AB Legacy CLI command. Carries the PCCC-specific endpoint options
+///     (<c>--gateway</c> + <c>--plc-type</c>) on top of <see cref="DriverCommandBase"/>'s
+///     shared verbose + timeout + logging helpers.
+/// </summary>
+public abstract class AbLegacyCommandBase : DriverCommandBase
+{
+    [CommandOption("gateway", 'g', Description =
+        "Canonical AB Legacy gateway: ab://host[:port]/cip-path. Port defaults to 44818. " +
+        "cip-path depends on the family: SLC 5/05 + PLC-5 typically '1,0'; MicroLogix " +
+        "1100/1400 takes an empty path (direct EIP, no backplane).",
+        IsRequired = true)]
+    public string Gateway { get; init; } = default!;
+
+    [CommandOption("plc-type", 'P', Description =
+        "Slc500 / MicroLogix / Plc5 / LogixPccc (default Slc500).")]
+    public AbLegacyPlcFamily PlcType { get; init; } = AbLegacyPlcFamily.Slc500;
+
+    [CommandOption("timeout-ms", Description = "Per-operation timeout in ms (default 5000).")]
+    public int TimeoutMs { get; init; } = 5000;
+
+    /// <inheritdoc />
+    public override TimeSpan Timeout
+    {
+        get => TimeSpan.FromMilliseconds(TimeoutMs);
+        init { /* driven by TimeoutMs */ }
+    }
+
+    /// <summary>
+    ///     Build an <see cref="AbLegacyDriverOptions"/> with the device + tag list a subclass
+    ///     supplies. Probe disabled for CLI one-shot runs.
+    /// </summary>
+    protected AbLegacyDriverOptions BuildOptions(IReadOnlyList<AbLegacyTagDefinition> tags) => new()
+    {
+        Devices = [new AbLegacyDeviceOptions(
+            HostAddress: Gateway,
+            PlcFamily: PlcType,
+            DeviceName: $"cli-{PlcType}")],
+        Tags = tags,
+        Timeout = Timeout,
+        Probe = new AbLegacyProbeOptions { Enabled = false },
+    };
+
+    protected string DriverInstanceId => $"ablegacy-cli-{Gateway}";
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli/Commands/ProbeCommand.cs

@@ -0,0 +1,57 @@
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli.Commands;
+
+/// <summary>
+///     Probes an AB Legacy (PCCC) endpoint: reads one N-file word + reports driver health.
+///     Default probe address <c>N7:0</c> matches the integration-fixture seed so operators
+///     can point the CLI at the ab_server Docker container + real hardware interchangeably.
+/// </summary>
+[Command("probe", Description = "Verify the AB Legacy endpoint is reachable and a sample PCCC read succeeds.")]
+public sealed class ProbeCommand : AbLegacyCommandBase
+{
+    [CommandOption("address", 'a', Description =
+        "PCCC address to probe (default N7:0). Use S:0 for the status file when you want " +
+        "the pre-populated register every SLC / MicroLogix / PLC-5 ships with.")]
+    public string Address { get; init; } = "N7:0";
+
+    [CommandOption("type", Description =
+        "PCCC data type of the probe address (default Int — matches N files).")]
+    public AbLegacyDataType DataType { get; init; } = AbLegacyDataType.Int;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        var probeTag = new AbLegacyTagDefinition(
+            Name: "__probe",
+            DeviceHostAddress: Gateway,
+            Address: Address,
+            DataType: DataType,
+            Writable: false);
+        var options = BuildOptions([probeTag]);
+
+        await using var driver = new AbLegacyDriver(options, DriverInstanceId);
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+            var snapshot = await driver.ReadAsync(["__probe"], ct);
+            var health = driver.GetHealth();
+
+            await console.Output.WriteLineAsync($"Gateway:      {Gateway}");
+            await console.Output.WriteLineAsync($"PLC type:     {PlcType}");
+            await console.Output.WriteLineAsync($"Health:       {health.State}");
+            if (health.LastError is { } err)
+                await console.Output.WriteLineAsync($"Last error:   {err}");
+            await console.Output.WriteLineAsync();
+            await console.Output.WriteLineAsync(SnapshotFormatter.Format(Address, snapshot[0]));
+        }
+        finally
+        {
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli/Commands/ReadCommand.cs

@@ -0,0 +1,55 @@
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli.Commands;
+
+/// <summary>
+///     Read one PCCC address (N7:0, F8:0, B3:0/3, L19:0, ST17:0, T4:0.ACC, etc.).
+/// </summary>
+[Command("read", Description = "Read a single PCCC file address.")]
+public sealed class ReadCommand : AbLegacyCommandBase
+{
+    [CommandOption("address", 'a', Description =
+        "PCCC file address. File letter implies storage; bit-within-word via slash " +
+        "(B3:0/3 or N7:0/5). Sub-element access for timers/counters/controls uses " +
+        "dot notation (T4:0.ACC, C5:0.PRE, R6:0.LEN).",
+        IsRequired = true)]
+    public string Address { get; init; } = default!;
+
+    [CommandOption("type", 't', Description =
+        "Bit / Int / Long / Float / AnalogInt / String / TimerElement / CounterElement / " +
+        "ControlElement (default Int).")]
+    public AbLegacyDataType DataType { get; init; } = AbLegacyDataType.Int;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        var tagName = SynthesiseTagName(Address, DataType);
+        var tag = new AbLegacyTagDefinition(
+            Name: tagName,
+            DeviceHostAddress: Gateway,
+            Address: Address,
+            DataType: DataType,
+            Writable: false);
+        var options = BuildOptions([tag]);
+
+        await using var driver = new AbLegacyDriver(options, DriverInstanceId);
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+            var snapshot = await driver.ReadAsync([tagName], ct);
+            await console.Output.WriteLineAsync(SnapshotFormatter.Format(Address, snapshot[0]));
+        }
+        finally
+        {
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+
+    /// <summary>Tag-name key the driver uses internally. Address+type is already unique.</summary>
+    internal static string SynthesiseTagName(string address, AbLegacyDataType type)
+        => $"{address}:{type}";
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli/Commands/SubscribeCommand.cs

@@ -0,0 +1,78 @@
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli.Commands;
+
+/// <summary>
+///     Watch a PCCC file address via polled subscription until Ctrl+C. Mirrors the Modbus /
+///     AB CIP subscribe shape — PollGroupEngine handles the tick loop.
+/// </summary>
+[Command("subscribe", Description = "Watch a PCCC file address via polled subscription until Ctrl+C.")]
+public sealed class SubscribeCommand : AbLegacyCommandBase
+{
+    [CommandOption("address", 'a', Description = "PCCC file address — same format as `read`.", IsRequired = true)]
+    public string Address { get; init; } = default!;
+
+    [CommandOption("type", 't', Description =
+        "Bit / Int / Long / Float / AnalogInt / String / TimerElement / CounterElement / " +
+        "ControlElement (default Int).")]
+    public AbLegacyDataType DataType { get; init; } = AbLegacyDataType.Int;
+
+    [CommandOption("interval-ms", 'i', Description =
+        "Publishing interval in milliseconds (default 1000).")]
+    public int IntervalMs { get; init; } = 1000;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        var tagName = ReadCommand.SynthesiseTagName(Address, DataType);
+        var tag = new AbLegacyTagDefinition(
+            Name: tagName,
+            DeviceHostAddress: Gateway,
+            Address: Address,
+            DataType: DataType,
+            Writable: false);
+        var options = BuildOptions([tag]);
+
+        await using var driver = new AbLegacyDriver(options, DriverInstanceId);
+        ISubscriptionHandle? handle = null;
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+
+            driver.OnDataChange += (_, e) =>
+            {
+                var line = $"[{DateTime.UtcNow:HH:mm:ss.fff}] " +
+                    $"{e.FullReference} = {SnapshotFormatter.FormatValue(e.Snapshot.Value)} " +
+                    $"({SnapshotFormatter.FormatStatus(e.Snapshot.StatusCode)})";
+                console.Output.WriteLine(line);
+            };
+
+            handle = await driver.SubscribeAsync([tagName], TimeSpan.FromMilliseconds(IntervalMs), ct);
+
+            await console.Output.WriteLineAsync(
+                $"Subscribed to {Address} @ {IntervalMs}ms. Ctrl+C to stop.");
+            try
+            {
+                await Task.Delay(System.Threading.Timeout.InfiniteTimeSpan, ct);
+            }
+            catch (OperationCanceledException)
+            {
+                // Expected on Ctrl+C.
+            }
+        }
+        finally
+        {
+            if (handle is not null)
+            {
+                try { await driver.UnsubscribeAsync(handle, CancellationToken.None); }
+                catch { /* teardown best-effort */ }
+            }
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli/Commands/WriteCommand.cs

@@ -0,0 +1,81 @@
+using System.Globalization;
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli.Commands;
+
+/// <summary>
+///     Write one value to a PCCC file address. Writes to timer / counter / control
+///     sub-elements go through at the wire level but land on the integer field of the
+///     sub-element — the PLC's runtime semantics (edge-triggered EN/DN bits, preset reloads)
+///     are PLC-managed, not CLI-manipulable; write these with caution.
+/// </summary>
+[Command("write", Description = "Write a single PCCC file address.")]
+public sealed class WriteCommand : AbLegacyCommandBase
+{
+    [CommandOption("address", 'a', Description =
+        "PCCC file address — same format as `read`.", IsRequired = true)]
+    public string Address { get; init; } = default!;
+
+    [CommandOption("type", 't', Description =
+        "Bit / Int / Long / Float / AnalogInt / String / TimerElement / CounterElement / " +
+        "ControlElement (default Int).")]
+    public AbLegacyDataType DataType { get; init; } = AbLegacyDataType.Int;
+
+    [CommandOption("value", 'v', Description =
+        "Value to write. Parsed per --type (booleans accept true/false/1/0).",
+        IsRequired = true)]
+    public string Value { get; init; } = default!;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        var tagName = ReadCommand.SynthesiseTagName(Address, DataType);
+        var tag = new AbLegacyTagDefinition(
+            Name: tagName,
+            DeviceHostAddress: Gateway,
+            Address: Address,
+            DataType: DataType,
+            Writable: true);
+        var options = BuildOptions([tag]);
+
+        var parsed = ParseValue(Value, DataType);
+
+        await using var driver = new AbLegacyDriver(options, DriverInstanceId);
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+            var results = await driver.WriteAsync([new WriteRequest(tagName, parsed)], ct);
+            await console.Output.WriteLineAsync(SnapshotFormatter.FormatWrite(Address, results[0]));
+        }
+        finally
+        {
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+
+    /// <summary>Parse <c>--value</c> per <see cref="AbLegacyDataType"/>, invariant culture.</summary>
+    internal static object ParseValue(string raw, AbLegacyDataType type) => type switch
+    {
+        AbLegacyDataType.Bit => ParseBool(raw),
+        AbLegacyDataType.Int or AbLegacyDataType.AnalogInt => short.Parse(raw, CultureInfo.InvariantCulture),
+        AbLegacyDataType.Long => int.Parse(raw, CultureInfo.InvariantCulture),
+        AbLegacyDataType.Float => float.Parse(raw, CultureInfo.InvariantCulture),
+        AbLegacyDataType.String => raw,
+        AbLegacyDataType.TimerElement or AbLegacyDataType.CounterElement
+            or AbLegacyDataType.ControlElement => int.Parse(raw, CultureInfo.InvariantCulture),
+        _ => throw new CliFx.Exceptions.CommandException($"Unsupported DataType '{type}' for write."),
+    };
+
+    private static bool ParseBool(string raw) => raw.Trim().ToLowerInvariant() switch
+    {
+        "1" or "true" or "on" or "yes" => true,
+        "0" or "false" or "off" or "no" => false,
+        _ => throw new CliFx.Exceptions.CommandException(
+            $"Boolean value '{raw}' is not recognised. Use true/false, 1/0, on/off, or yes/no."),
+    };
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli/Program.cs

@@ -0,0 +1,11 @@
+using CliFx;
+
+return await new CliApplicationBuilder()
+    .AddCommandsFromThisAssembly()
+    .SetExecutableName("otopcua-ablegacy-cli")
+    .SetDescription(
+        "OtOpcUa AB Legacy test-client — ad-hoc probe + PCCC N/F/B/L-file reads/writes + " +
+        "polled subscriptions against SLC 500 / MicroLogix / PLC-5 devices via libplctag. " +
+        "Addresses use PCCC convention: N7:0, F8:0, B3:0/3, L19:0, ST17:0.")
+    .Build()
+    .RunAsync(args);

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli.csproj

@@ -0,0 +1,29 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <OutputType>Exe</OutputType>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <LangVersion>latest</LangVersion>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+        <GenerateDocumentationFile>true</GenerateDocumentationFile>
+        <NoWarn>$(NoWarn);CS1591</NoWarn>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli</RootNamespace>
+        <AssemblyName>otopcua-ablegacy-cli</AssemblyName>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="CliFx" Version="2.3.6"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Driver.Cli.Common\ZB.MOM.WW.OtOpcUa.Driver.Cli.Common.csproj"/>
+        <ProjectReference Include="..\..\ZB.MOM.WW.OtOpcUa.Driver.AbLegacy\ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli.Tests"/>
+    </ItemGroup>
+
+</Project>

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/DriverCommandBase.cs

@@ -0,0 +1,60 @@
+using CliFx;
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using Serilog;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+/// <summary>
+///     Shared base for every driver test-client command (Modbus / AB CIP / AB Legacy / S7 /
+///     TwinCAT). Carries the options that are meaningful regardless of protocol — verbose
+///     logging + the standard timeout — plus helpers every command implementation wants:
+///     Serilog configuration + cancellation-token capture.
+/// </summary>
+/// <remarks>
+///     <para>
+///         Each driver CLI sub-classes this with its own protocol-specific base (e.g.
+///         <c>ModbusCommandBase</c>) that adds host/port/unit-id + a <c>BuildDriver()</c>
+///         factory. That second layer is the point where the driver's <c>{Driver}DriverOptions</c>
+///         type plugs in; keeping it out of this common base lets each driver CLI stay a thin
+///         executable with no dependency on the other drivers' projects.
+///     </para>
+///     <para>
+///         Why a shared base at all — without this every CLI re-authored the same ~40 lines
+///         of Serilog wiring + cancel-token plumbing + verbose flag.
+///     </para>
+/// </remarks>
+public abstract class DriverCommandBase : ICommand
+{
+    /// <summary>
+    ///     Enable Serilog debug-level output. Leave off for clean one-line-per-call output;
+    ///     switch on when diagnosing a connect / PDU-framing / retry problem.
+    /// </summary>
+    [CommandOption("verbose", Description = "Enable verbose/debug Serilog output")]
+    public bool Verbose { get; init; }
+
+    /// <summary>
+    ///     Request-level timeout used by the driver's <c>Initialize</c> / <c>Read</c> /
+    ///     <c>Write</c> / probe calls. Defaults per-protocol (Modbus: 2s, AB: 5s, S7: 5s,
+    ///     TwinCAT: 5s) — each driver CLI overrides this property with the appropriate
+    ///     <c>[CommandOption]</c> default.
+    /// </summary>
+    public abstract TimeSpan Timeout { get; init; }
+
+    public abstract ValueTask ExecuteAsync(IConsole console);
+
+    /// <summary>
+    ///     Configures the process-global Serilog logger. Commands call this at the top of
+    ///     <see cref="ExecuteAsync"/> so driver-internal <c>Log.Logger</c> writes land on the
+    ///     same sink as the CLI's operator-facing output.
+    /// </summary>
+    protected void ConfigureLogging()
+    {
+        var config = new LoggerConfiguration();
+        if (Verbose)
+            config.MinimumLevel.Debug().WriteTo.Console();
+        else
+            config.MinimumLevel.Warning().WriteTo.Console();
+        Log.Logger = config.CreateLogger();
+    }
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/SnapshotFormatter.cs

@@ -0,0 +1,131 @@
+using System.Globalization;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+/// <summary>
+///     Renders <see cref="DataValueSnapshot"/> + <see cref="WriteResult"/> payloads as the
+///     plain-text lines every driver CLI prints to its console. Matches the one-field-per-line
+///     style the existing OPC UA <c>otopcua-cli</c> uses so combined runs (read a tag via both
+///     CLIs side-by-side) look coherent.
+/// </summary>
+public static class SnapshotFormatter
+{
+    /// <summary>
+    ///     Single-tag multi-line render. Shape:
+    ///     <code>
+    ///     Tag:         &lt;name&gt;
+    ///     Value:       &lt;value&gt;
+    ///     Status:      0x... (Good|BadCommunicationError|...)
+    ///     Source Time: 2026-04-21T12:34:56.789Z
+    ///     Server Time: 2026-04-21T12:34:56.790Z
+    ///     </code>
+    /// </summary>
+    public static string Format(string tagName, DataValueSnapshot snapshot)
+    {
+        ArgumentNullException.ThrowIfNull(snapshot);
+        var lines = new[]
+        {
+            $"Tag:         {tagName}",
+            $"Value:       {FormatValue(snapshot.Value)}",
+            $"Status:      {FormatStatus(snapshot.StatusCode)}",
+            $"Source Time: {FormatTimestamp(snapshot.SourceTimestampUtc)}",
+            $"Server Time: {FormatTimestamp(snapshot.ServerTimestampUtc)}",
+        };
+        return string.Join(Environment.NewLine, lines);
+    }
+
+    /// <summary>
+    ///     Write-result render, one line: <c>Write &lt;tag&gt;: 0x... (Good|...)</c>.
+    /// </summary>
+    public static string FormatWrite(string tagName, WriteResult result)
+    {
+        ArgumentNullException.ThrowIfNull(result);
+        return $"Write {tagName}: {FormatStatus(result.StatusCode)}";
+    }
+
+    /// <summary>
+    ///     Table-style render for batch reads. Emits an aligned 4-column layout:
+    ///     tag / value / status / source-time.
+    /// </summary>
+    public static string FormatTable(
+        IReadOnlyList<string> tagNames, IReadOnlyList<DataValueSnapshot> snapshots)
+    {
+        ArgumentNullException.ThrowIfNull(tagNames);
+        ArgumentNullException.ThrowIfNull(snapshots);
+        if (tagNames.Count != snapshots.Count)
+            throw new ArgumentException(
+                $"tagNames ({tagNames.Count}) and snapshots ({snapshots.Count}) must be the same length");
+
+        var rows = tagNames.Select((t, i) => new
+        {
+            Tag = t,
+            Value = FormatValue(snapshots[i].Value),
+            Status = FormatStatus(snapshots[i].StatusCode),
+            Time = FormatTimestamp(snapshots[i].SourceTimestampUtc),
+        }).ToArray();
+
+        int tagW = Math.Max("TAG".Length, rows.Max(r => r.Tag.Length));
+        int valW = Math.Max("VALUE".Length, rows.Max(r => r.Value.Length));
+        int statW = Math.Max("STATUS".Length, rows.Max(r => r.Status.Length));
+        // source-time column is fixed-width (ISO-8601 to ms) so no max-measurement needed.
+
+        var sb = new System.Text.StringBuilder();
+        sb.Append("TAG".PadRight(tagW)).Append("  ")
+          .Append("VALUE".PadRight(valW)).Append("  ")
+          .Append("STATUS".PadRight(statW)).Append("  ")
+          .Append("SOURCE TIME").AppendLine();
+        sb.Append(new string('-', tagW)).Append("  ")
+          .Append(new string('-', valW)).Append("  ")
+          .Append(new string('-', statW)).Append("  ")
+          .Append(new string('-', "SOURCE TIME".Length)).AppendLine();
+        foreach (var r in rows)
+        {
+            sb.Append(r.Tag.PadRight(tagW)).Append("  ")
+              .Append(r.Value.PadRight(valW)).Append("  ")
+              .Append(r.Status.PadRight(statW)).Append("  ")
+              .Append(r.Time).AppendLine();
+        }
+        return sb.ToString().TrimEnd();
+    }
+
+    public static string FormatValue(object? value) => value switch
+    {
+        null => "<null>",
+        bool b => b ? "true" : "false",
+        string s => $"\"{s}\"",
+        IFormattable f => f.ToString(null, CultureInfo.InvariantCulture),
+        _ => value.ToString() ?? "<null>",
+    };
+
+    public static string FormatStatus(uint statusCode)
+    {
+        // Match the OPC UA shorthand for the statuses most-likely to land in a CLI run.
+        // Anything outside this short-list surfaces as hex — operators can cross-reference
+        // against OPC UA Part 6 § 7.34 (StatusCode tables) or Core.Abstractions status mappers.
+        var name = statusCode switch
+        {
+            0x00000000u => "Good",
+            0x80000000u => "Bad",
+            0x80050000u => "BadCommunicationError",
+            0x80060000u => "BadTimeout",
+            0x80070000u => "BadNoCommunication",
+            0x80080000u => "BadWaitingForInitialData",
+            0x80340000u => "BadNodeIdUnknown",
+            0x80350000u => "BadNodeIdInvalid",
+            0x80740000u => "BadTypeMismatch",
+            0x40000000u => "Uncertain",
+            _ => null,
+        };
+        return name is null
+            ? $"0x{statusCode:X8}"
+            : $"0x{statusCode:X8} ({name})";
+    }
+
+    public static string FormatTimestamp(DateTime? ts)
+    {
+        if (ts is null) return "-";
+        var utc = ts.Value.Kind == DateTimeKind.Utc ? ts.Value : ts.Value.ToUniversalTime();
+        return utc.ToString("yyyy-MM-ddTHH:mm:ss.fffZ", CultureInfo.InvariantCulture);
+    }
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common.csproj

@@ -0,0 +1,24 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <LangVersion>latest</LangVersion>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+        <GenerateDocumentationFile>true</GenerateDocumentationFile>
+        <NoWarn>$(NoWarn);CS1591</NoWarn>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.Cli.Common</RootNamespace>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="CliFx" Version="2.3.6"/>
+        <PackageReference Include="Serilog" Version="4.2.0"/>
+        <PackageReference Include="Serilog.Sinks.Console" Version="6.0.0"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\..\..\Core\ZB.MOM.WW.OtOpcUa.Core.Abstractions\ZB.MOM.WW.OtOpcUa.Core.Abstractions.csproj"/>
+    </ItemGroup>
+
+</Project>

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Cli/Commands/ProbeCommand.cs

@@ -0,0 +1,57 @@
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Cli.Commands;
+
+/// <summary>
+///     Probes a Fanuc CNC: opens a FOCAS session + reads one PMC address. Uses the managed
+///     <c>WireFocasClient</c> on TCP:8193. Against an unreachable endpoint it surfaces
+///     <c>BadCommunicationError</c> which is still a useful signal that the CLI wire-up is
+///     correct. Also runs cleanly against the focas-mock Docker fixture in
+///     <c>tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.IntegrationTests/Docker/</c>.
+/// </summary>
+[Command("probe", Description = "Verify the CNC is reachable + a sample FOCAS read succeeds.")]
+public sealed class ProbeCommand : FocasCommandBase
+{
+    [CommandOption("address", 'a', Description =
+        "FOCAS address to probe (default R100 — PMC R-file register 100).")]
+    public string Address { get; init; } = "R100";
+
+    [CommandOption("type", Description = "Data type (default Int16).")]
+    public FocasDataType DataType { get; init; } = FocasDataType.Int16;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        var probeTag = new FocasTagDefinition(
+            Name: "__probe",
+            DeviceHostAddress: HostAddress,
+            Address: Address,
+            DataType: DataType,
+            Writable: false);
+        var options = BuildOptions([probeTag]);
+
+        await using var driver = new FocasDriver(options, DriverInstanceId);
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+            var snapshot = await driver.ReadAsync(["__probe"], ct);
+            var health = driver.GetHealth();
+
+            await console.Output.WriteLineAsync($"CNC:          {CncHost}:{CncPort}");
+            await console.Output.WriteLineAsync($"Series:       {Series}");
+            await console.Output.WriteLineAsync($"Health:       {health.State}");
+            if (health.LastError is { } err)
+                await console.Output.WriteLineAsync($"Last error:   {err}");
+            await console.Output.WriteLineAsync();
+            await console.Output.WriteLineAsync(SnapshotFormatter.Format(Address, snapshot[0]));
+        }
+        finally
+        {
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Cli/Commands/ReadCommand.cs

@@ -0,0 +1,52 @@
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Cli.Commands;
+
+/// <summary>
+///     Read one FOCAS address (PMC R/G/F file, parameter, macro, axis register).
+/// </summary>
+[Command("read", Description = "Read a single FOCAS address.")]
+public sealed class ReadCommand : FocasCommandBase
+{
+    [CommandOption("address", 'a', Description =
+        "FOCAS address. Examples: R100 (PMC R-file word); X0.0 (PMC X-bit); " +
+        "PARAM:1815/0 (parameter 1815, axis 0); MACRO:500 (macro variable 500).",
+        IsRequired = true)]
+    public string Address { get; init; } = default!;
+
+    [CommandOption("type", 't', Description =
+        "Bit / Byte / Int16 / Int32 / Float32 / Float64 / String (default Int16).")]
+    public FocasDataType DataType { get; init; } = FocasDataType.Int16;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        var tagName = SynthesiseTagName(Address, DataType);
+        var tag = new FocasTagDefinition(
+            Name: tagName,
+            DeviceHostAddress: HostAddress,
+            Address: Address,
+            DataType: DataType,
+            Writable: false);
+        var options = BuildOptions([tag]);
+
+        await using var driver = new FocasDriver(options, DriverInstanceId);
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+            var snapshot = await driver.ReadAsync([tagName], ct);
+            await console.Output.WriteLineAsync(SnapshotFormatter.Format(Address, snapshot[0]));
+        }
+        finally
+        {
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+
+    internal static string SynthesiseTagName(string address, FocasDataType type)
+        => $"{address}:{type}";
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Cli/Commands/SubscribeCommand.cs

@@ -0,0 +1,76 @@
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Cli.Commands;
+
+/// <summary>
+///     Watch a FOCAS address via polled subscription until Ctrl+C. FOCAS has no push
+///     model; <c>PollGroupEngine</c> handles the tick loop.
+/// </summary>
+[Command("subscribe", Description = "Watch a FOCAS address via polled subscription until Ctrl+C.")]
+public sealed class SubscribeCommand : FocasCommandBase
+{
+    [CommandOption("address", 'a', Description = "FOCAS address — same format as `read`.", IsRequired = true)]
+    public string Address { get; init; } = default!;
+
+    [CommandOption("type", 't', Description =
+        "Bit / Byte / Int16 / Int32 / Float32 / Float64 / String (default Int16).")]
+    public FocasDataType DataType { get; init; } = FocasDataType.Int16;
+
+    [CommandOption("interval-ms", 'i', Description = "Publishing interval ms (default 1000).")]
+    public int IntervalMs { get; init; } = 1000;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        var tagName = ReadCommand.SynthesiseTagName(Address, DataType);
+        var tag = new FocasTagDefinition(
+            Name: tagName,
+            DeviceHostAddress: HostAddress,
+            Address: Address,
+            DataType: DataType,
+            Writable: false);
+        var options = BuildOptions([tag]);
+
+        await using var driver = new FocasDriver(options, DriverInstanceId);
+        ISubscriptionHandle? handle = null;
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+
+            driver.OnDataChange += (_, e) =>
+            {
+                var line = $"[{DateTime.UtcNow:HH:mm:ss.fff}] " +
+                    $"{e.FullReference} = {SnapshotFormatter.FormatValue(e.Snapshot.Value)} " +
+                    $"({SnapshotFormatter.FormatStatus(e.Snapshot.StatusCode)})";
+                console.Output.WriteLine(line);
+            };
+
+            handle = await driver.SubscribeAsync([tagName], TimeSpan.FromMilliseconds(IntervalMs), ct);
+
+            await console.Output.WriteLineAsync(
+                $"Subscribed to {Address} @ {IntervalMs}ms. Ctrl+C to stop.");
+            try
+            {
+                await Task.Delay(System.Threading.Timeout.InfiniteTimeSpan, ct);
+            }
+            catch (OperationCanceledException)
+            {
+                // Expected on Ctrl+C.
+            }
+        }
+        finally
+        {
+            if (handle is not null)
+            {
+                try { await driver.UnsubscribeAsync(handle, CancellationToken.None); }
+                catch { /* teardown best-effort */ }
+            }
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Cli/Commands/WriteCommand.cs

@@ -0,0 +1,77 @@
+using System.Globalization;
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Cli.Commands;
+
+/// <summary>
+///     Write one value to a FOCAS address. PMC G/R writes are real — be careful
+///     which file you hit on a running machine. Parameter writes may require the
+///     CNC to be in MDI mode + the parameter-write switch enabled.
+/// </summary>
+[Command("write", Description = "Write a single FOCAS address.")]
+public sealed class WriteCommand : FocasCommandBase
+{
+    [CommandOption("address", 'a', Description = "FOCAS address — same format as `read`.", IsRequired = true)]
+    public string Address { get; init; } = default!;
+
+    [CommandOption("type", 't', Description =
+        "Bit / Byte / Int16 / Int32 / Float32 / Float64 / String (default Int16).")]
+    public FocasDataType DataType { get; init; } = FocasDataType.Int16;
+
+    [CommandOption("value", 'v', Description =
+        "Value to write. Parsed per --type (booleans accept true/false/1/0).",
+        IsRequired = true)]
+    public string Value { get; init; } = default!;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        var tagName = ReadCommand.SynthesiseTagName(Address, DataType);
+        var tag = new FocasTagDefinition(
+            Name: tagName,
+            DeviceHostAddress: HostAddress,
+            Address: Address,
+            DataType: DataType,
+            Writable: true);
+        var options = BuildOptions([tag]);
+
+        var parsed = ParseValue(Value, DataType);
+
+        await using var driver = new FocasDriver(options, DriverInstanceId);
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+            var results = await driver.WriteAsync([new WriteRequest(tagName, parsed)], ct);
+            await console.Output.WriteLineAsync(SnapshotFormatter.FormatWrite(Address, results[0]));
+        }
+        finally
+        {
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+
+    internal static object ParseValue(string raw, FocasDataType type) => type switch
+    {
+        FocasDataType.Bit => ParseBool(raw),
+        FocasDataType.Byte => sbyte.Parse(raw, CultureInfo.InvariantCulture),
+        FocasDataType.Int16 => short.Parse(raw, CultureInfo.InvariantCulture),
+        FocasDataType.Int32 => int.Parse(raw, CultureInfo.InvariantCulture),
+        FocasDataType.Float32 => float.Parse(raw, CultureInfo.InvariantCulture),
+        FocasDataType.Float64 => double.Parse(raw, CultureInfo.InvariantCulture),
+        FocasDataType.String => raw,
+        _ => throw new CliFx.Exceptions.CommandException($"Unsupported DataType '{type}' for write."),
+    };
+
+    private static bool ParseBool(string raw) => raw.Trim().ToLowerInvariant() switch
+    {
+        "1" or "true" or "on" or "yes" => true,
+        "0" or "false" or "off" or "no" => false,
+        _ => throw new CliFx.Exceptions.CommandException(
+            $"Boolean value '{raw}' is not recognised. Use true/false, 1/0, on/off, or yes/no."),
+    };
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Cli/FocasCommandBase.cs

@@ -0,0 +1,57 @@
+using CliFx.Attributes;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Cli;
+
+/// <summary>
+///     Base for every FOCAS CLI command. Carries the CNC endpoint options
+///     (host / port / series) + exposes <see cref="BuildOptions"/> so each command
+///     can synthesise a <see cref="FocasDriverOptions"/> with one device + one tag.
+/// </summary>
+public abstract class FocasCommandBase : DriverCommandBase
+{
+    [CommandOption("cnc-host", 'h', Description =
+        "CNC IP address or hostname. FOCAS-over-EIP listens on port 8193 by default.",
+        IsRequired = true)]
+    public string CncHost { get; init; } = default!;
+
+    [CommandOption("cnc-port", 'p', Description = "FOCAS TCP port (default 8193).")]
+    public int CncPort { get; init; } = 8193;
+
+    [CommandOption("series", 's', Description =
+        "CNC series: Unknown / Zero_i_D / Zero_i_F / Zero_i_MF / Zero_i_TF / Sixteen_i / " +
+        "Thirty_i / ThirtyOne_i / ThirtyTwo_i / PowerMotion_i (default Unknown).")]
+    public FocasCncSeries Series { get; init; } = FocasCncSeries.Unknown;
+
+    [CommandOption("timeout-ms", Description = "Per-operation timeout in ms (default 2000).")]
+    public int TimeoutMs { get; init; } = 2000;
+
+    /// <inheritdoc />
+    public override TimeSpan Timeout
+    {
+        get => TimeSpan.FromMilliseconds(TimeoutMs);
+        init { /* driven by TimeoutMs */ }
+    }
+
+    /// <summary>Canonical FOCAS host-address string, shape <c>focas://host:port</c>.</summary>
+    protected string HostAddress => $"focas://{CncHost}:{CncPort}";
+
+    /// <summary>
+    ///     Build a <see cref="FocasDriverOptions"/> with the CNC target this base collected
+    ///     + the tag list a subclass supplies. Probe disabled; the driver's default managed
+    ///     wire client opens a TCP:8193 session to the CNC and surfaces unreachable endpoints
+    ///     as <c>BadCommunicationError</c>.
+    /// </summary>
+    protected FocasDriverOptions BuildOptions(IReadOnlyList<FocasTagDefinition> tags) => new()
+    {
+        Devices = [new FocasDeviceOptions(
+            HostAddress: HostAddress,
+            DeviceName: $"cli-{CncHost}:{CncPort}",
+            Series: Series)],
+        Tags = tags,
+        Timeout = Timeout,
+        Probe = new FocasProbeOptions { Enabled = false },
+    };
+
+    protected string DriverInstanceId => $"focas-cli-{CncHost}:{CncPort}";
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Cli/Program.cs

@@ -0,0 +1,12 @@
+using CliFx;
+
+return await new CliApplicationBuilder()
+    .AddCommandsFromThisAssembly()
+    .SetExecutableName("otopcua-focas-cli")
+    .SetDescription(
+        "OtOpcUa FOCAS test-client — ad-hoc probe + PMC/param/macro reads + polled " +
+        "subscriptions against Fanuc CNCs via the FOCAS/2 protocol. Uses the managed " +
+        "WireFocasClient on TCP:8193 directly; no native dependencies. Addresses use " +
+        "FocasAddressParser syntax: R100, X0.0, PARAM:1815/0, MACRO:500.")
+    .Build()
+    .RunAsync(args);

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Cli/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Cli.csproj

@@ -0,0 +1,28 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <OutputType>Exe</OutputType>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <LangVersion>latest</LangVersion>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+        <GenerateDocumentationFile>true</GenerateDocumentationFile>
+        <NoWarn>$(NoWarn);CS1591</NoWarn>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Cli</RootNamespace>
+        <AssemblyName>otopcua-focas-cli</AssemblyName>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="CliFx" Version="2.3.6"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Driver.Cli.Common\ZB.MOM.WW.OtOpcUa.Driver.Cli.Common.csproj"/>
+        <ProjectReference Include="..\..\ZB.MOM.WW.OtOpcUa.Driver.FOCAS\ZB.MOM.WW.OtOpcUa.Driver.FOCAS.csproj"/>
+    </ItemGroup>
+
+    <!-- CLI runs the managed WireFocasClient and talks to the CNC over TCP:8193
+         directly — no Fwlib64.dll copy step needed. -->
+
+</Project>

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/Commands/ProbeCommand.cs

@@ -0,0 +1,55 @@
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli.Commands;
+
+/// <summary>
+///     Probes a Modbus-TCP endpoint: opens a socket via <see cref="ModbusDriver"/>'s
+///     <c>InitializeAsync</c>, issues a single FC03 at the configured probe address, and
+///     prints the driver's <c>GetHealth()</c>. Fastest way to answer "is the PLC up + talking
+///     Modbus on this host:port?".
+/// </summary>
+[Command("probe", Description = "Verify the Modbus-TCP endpoint is reachable and speaks Modbus.")]
+public sealed class ProbeCommand : ModbusCommandBase
+{
+    [CommandOption("probe-address", Description =
+        "Holding-register address used as the cheap-read probe (default 0). Some PLCs lock " +
+        "register 0 — set this to a known-good address on your device.")]
+    public ushort ProbeAddress { get; init; }
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        // Build with one probe tag + Probe.Enabled=false so InitializeAsync connects the
+        // transport, we issue a single read to verify the device responds, then shut down.
+        var probeTag = new ModbusTagDefinition(
+            Name: "__probe",
+            Region: ModbusRegion.HoldingRegisters,
+            Address: ProbeAddress,
+            DataType: ModbusDataType.UInt16);
+        var options = BuildOptions([probeTag]);
+
+        await using var driver = new ModbusDriver(options, DriverInstanceId);
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+            var snapshot = await driver.ReadAsync(["__probe"], ct);
+            var health = driver.GetHealth();
+
+            await console.Output.WriteLineAsync($"Host:         {Host}:{Port} (unit {UnitId})");
+            await console.Output.WriteLineAsync($"Health:       {health.State}");
+            if (health.LastError is { } err)
+                await console.Output.WriteLineAsync($"Last error:   {err}");
+            await console.Output.WriteLineAsync();
+            await console.Output.WriteLineAsync(
+                SnapshotFormatter.Format($"HR[{ProbeAddress}]", snapshot[0]));
+        }
+        finally
+        {
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/Commands/ReadCommand.cs

@@ -0,0 +1,95 @@
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli.Commands;
+
+/// <summary>
+///     Read one Modbus register / coil. Operator specifies the address via
+///     <c>--region</c> + <c>--address</c> + <c>--type</c>; the CLI synthesises a single
+///     <see cref="ModbusTagDefinition"/>, spins up the driver, reads once, prints the snapshot,
+///     and shuts down. Multi-register types (Int32 / Float32 / String / BCD32) respect
+///     <c>--byte-order</c> the same way real driver configs do.
+/// </summary>
+[Command("read", Description = "Read a single Modbus register or coil.")]
+public sealed class ReadCommand : ModbusCommandBase
+{
+    [CommandOption("region", 'r', Description =
+        "Coils / DiscreteInputs / InputRegisters / HoldingRegisters", IsRequired = true)]
+    public ModbusRegion Region { get; init; }
+
+    [CommandOption("address", 'a', Description =
+        "Zero-based address within the region.", IsRequired = true)]
+    public ushort Address { get; init; }
+
+    [CommandOption("type", 't', Description =
+        "Bool / Int16 / UInt16 / Int32 / UInt32 / Int64 / UInt64 / Float32 / Float64 / " +
+        "BitInRegister / String / Bcd16 / Bcd32", IsRequired = true)]
+    public ModbusDataType DataType { get; init; }
+
+    [CommandOption("byte-order", Description =
+        "BigEndian (default, spec ABCD) or WordSwap (CDAB). Ignored for single-register types.")]
+    public ModbusByteOrder ByteOrder { get; init; } = ModbusByteOrder.BigEndian;
+
+    [CommandOption("bit-index", Description =
+        "For type=BitInRegister: bit 0-15 LSB-first.")]
+    public byte BitIndex { get; init; }
+
+    [CommandOption("string-length", Description =
+        "For type=String: character count (2 per register, rounded up).")]
+    public ushort StringLength { get; init; }
+
+    [CommandOption("string-byte-order", Description =
+        "For type=String: HighByteFirst (standard) or LowByteFirst (DirectLOGIC et al).")]
+    public ModbusStringByteOrder StringByteOrder { get; init; } = ModbusStringByteOrder.HighByteFirst;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        var tagName = SynthesiseTagName(Region, Address, DataType);
+        var tag = new ModbusTagDefinition(
+            Name: tagName,
+            Region: Region,
+            Address: Address,
+            DataType: DataType,
+            Writable: false,
+            ByteOrder: ByteOrder,
+            BitIndex: BitIndex,
+            StringLength: StringLength,
+            StringByteOrder: StringByteOrder);
+        var options = BuildOptions([tag]);
+
+        await using var driver = new ModbusDriver(options, DriverInstanceId);
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+            var snapshot = await driver.ReadAsync([tagName], ct);
+            await console.Output.WriteLineAsync(SnapshotFormatter.Format(tagName, snapshot[0]));
+        }
+        finally
+        {
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+
+    /// <summary>
+    ///     Builds a human-readable tag name matching the operator's conceptual model
+    ///     (<c>HR[100]</c>, <c>Coil[5]</c>, <c>IR[42]</c>) — the driver treats the name
+    ///     purely as a lookup key, so any stable string works.
+    /// </summary>
+    internal static string SynthesiseTagName(
+        ModbusRegion region, ushort address, ModbusDataType type)
+    {
+        var prefix = region switch
+        {
+            ModbusRegion.Coils => "Coil",
+            ModbusRegion.DiscreteInputs => "DI",
+            ModbusRegion.InputRegisters => "IR",
+            ModbusRegion.HoldingRegisters => "HR",
+            _ => "Reg",
+        };
+        return $"{prefix}[{address}]:{type}";
+    }
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/Commands/SubscribeCommand.cs

@@ -0,0 +1,92 @@
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli.Commands;
+
+/// <summary>
+///     Long-running poll of one Modbus register via the driver's <c>ISubscribable</c> surface
+///     (under the hood: <c>PollGroupEngine</c>). Prints each data-change event until the
+///     operator Ctrl+C's the CLI. Useful for watching a changing PLC signal during
+///     commissioning or while reproducing a customer bug.
+/// </summary>
+[Command("subscribe", Description = "Watch a Modbus register via polled subscription until Ctrl+C.")]
+public sealed class SubscribeCommand : ModbusCommandBase
+{
+    [CommandOption("region", 'r', Description =
+        "Coils / DiscreteInputs / InputRegisters / HoldingRegisters", IsRequired = true)]
+    public ModbusRegion Region { get; init; }
+
+    [CommandOption("address", 'a', Description = "Zero-based address within the region.", IsRequired = true)]
+    public ushort Address { get; init; }
+
+    [CommandOption("type", 't', Description =
+        "Bool / Int16 / UInt16 / Int32 / UInt32 / Int64 / UInt64 / Float32 / Float64 / " +
+        "BitInRegister / String / Bcd16 / Bcd32", IsRequired = true)]
+    public ModbusDataType DataType { get; init; }
+
+    [CommandOption("interval-ms", 'i', Description =
+        "Publishing interval in milliseconds (default 1000). The PollGroupEngine enforces " +
+        "a floor of ~250ms; values below it get rounded up.")]
+    public int IntervalMs { get; init; } = 1000;
+
+    [CommandOption("byte-order", Description =
+        "BigEndian (default) or WordSwap.")]
+    public ModbusByteOrder ByteOrder { get; init; } = ModbusByteOrder.BigEndian;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        var tagName = ReadCommand.SynthesiseTagName(Region, Address, DataType);
+        var tag = new ModbusTagDefinition(
+            Name: tagName,
+            Region: Region,
+            Address: Address,
+            DataType: DataType,
+            Writable: false,
+            ByteOrder: ByteOrder);
+        var options = BuildOptions([tag]);
+
+        await using var driver = new ModbusDriver(options, DriverInstanceId);
+        ISubscriptionHandle? handle = null;
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+
+            // Route every data-change event to the CliFx console (not System.Console — the
+            // analyzer flags it + IConsole is the testable abstraction).
+            driver.OnDataChange += (_, e) =>
+            {
+                var line = $"[{DateTime.UtcNow:HH:mm:ss.fff}] " +
+                    $"{e.FullReference} = {SnapshotFormatter.FormatValue(e.Snapshot.Value)} " +
+                    $"({SnapshotFormatter.FormatStatus(e.Snapshot.StatusCode)})";
+                console.Output.WriteLine(line);
+            };
+
+            handle = await driver.SubscribeAsync([tagName], TimeSpan.FromMilliseconds(IntervalMs), ct);
+
+            await console.Output.WriteLineAsync(
+                $"Subscribed to {tagName} @ {IntervalMs}ms. Ctrl+C to stop.");
+            try
+            {
+                await Task.Delay(System.Threading.Timeout.InfiniteTimeSpan, ct);
+            }
+            catch (OperationCanceledException)
+            {
+                // Expected on Ctrl+C — fall through to the unsubscribe in finally.
+            }
+        }
+        finally
+        {
+            if (handle is not null)
+            {
+                try { await driver.UnsubscribeAsync(handle, CancellationToken.None); }
+                catch { /* teardown best-effort */ }
+            }
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/Commands/WriteCommand.cs

@@ -0,0 +1,118 @@
+using System.Globalization;
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli.Commands;
+
+/// <summary>
+///     Write one value to a Modbus coil or holding register. Mirrors <see cref="ReadCommand"/>'s
+///     region / address / type flags + adds <c>--value</c>. Input parsing respects the
+///     declared <c>--type</c> so you can write <c>--value=3.14 --type=Float32</c> without
+///     hex-encoding floats. The write is non-idempotent by default (driver's
+///     <c>WriteIdempotent=false</c>) — replay is the operator's choice, not the driver's.
+/// </summary>
+[Command("write", Description = "Write a single Modbus coil or holding register.")]
+public sealed class WriteCommand : ModbusCommandBase
+{
+    [CommandOption("region", 'r', Description =
+        "Coils or HoldingRegisters (the only writable regions per the protocol spec).",
+        IsRequired = true)]
+    public ModbusRegion Region { get; init; }
+
+    [CommandOption("address", 'a', Description =
+        "Zero-based address within the region.", IsRequired = true)]
+    public ushort Address { get; init; }
+
+    [CommandOption("type", 't', Description =
+        "Bool / Int16 / UInt16 / Int32 / UInt32 / Int64 / UInt64 / Float32 / Float64 / " +
+        "BitInRegister / String / Bcd16 / Bcd32", IsRequired = true)]
+    public ModbusDataType DataType { get; init; }
+
+    [CommandOption("value", 'v', Description =
+        "Value to write. Parsed per --type (booleans accept true/false/0/1).",
+        IsRequired = true)]
+    public string Value { get; init; } = default!;
+
+    [CommandOption("byte-order", Description =
+        "BigEndian (default, ABCD) or WordSwap (CDAB). Ignored for single-register types.")]
+    public ModbusByteOrder ByteOrder { get; init; } = ModbusByteOrder.BigEndian;
+
+    [CommandOption("bit-index", Description =
+        "For type=BitInRegister: which bit of the holding register (0-15, LSB-first).")]
+    public byte BitIndex { get; init; }
+
+    [CommandOption("string-length", Description =
+        "For type=String: character count (2 per register, rounded up).")]
+    public ushort StringLength { get; init; }
+
+    [CommandOption("string-byte-order", Description =
+        "For type=String: HighByteFirst (standard) or LowByteFirst (DirectLOGIC).")]
+    public ModbusStringByteOrder StringByteOrder { get; init; } = ModbusStringByteOrder.HighByteFirst;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        if (Region is not (ModbusRegion.Coils or ModbusRegion.HoldingRegisters))
+            throw new CliFx.Exceptions.CommandException(
+                $"Region '{Region}' is read-only in the Modbus spec; writes require Coils or HoldingRegisters.");
+
+        var tagName = ReadCommand.SynthesiseTagName(Region, Address, DataType);
+        var tag = new ModbusTagDefinition(
+            Name: tagName,
+            Region: Region,
+            Address: Address,
+            DataType: DataType,
+            Writable: true,
+            ByteOrder: ByteOrder,
+            BitIndex: BitIndex,
+            StringLength: StringLength,
+            StringByteOrder: StringByteOrder);
+        var options = BuildOptions([tag]);
+
+        var parsed = ParseValue(Value, DataType);
+
+        await using var driver = new ModbusDriver(options, DriverInstanceId);
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+            var results = await driver.WriteAsync([new WriteRequest(tagName, parsed)], ct);
+            await console.Output.WriteLineAsync(SnapshotFormatter.FormatWrite(tagName, results[0]));
+        }
+        finally
+        {
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+
+    /// <summary>
+    ///     Parse the operator's <c>--value</c> string into the CLR type the driver expects
+    ///     for the declared <see cref="ModbusDataType"/>. Uses invariant culture everywhere
+    ///     so <c>3.14</c> and <c>3,14</c> don't swap meaning between runs.
+    /// </summary>
+    internal static object ParseValue(string raw, ModbusDataType type) => type switch
+    {
+        ModbusDataType.Bool or ModbusDataType.BitInRegister => ParseBool(raw),
+        ModbusDataType.Int16 => short.Parse(raw, CultureInfo.InvariantCulture),
+        ModbusDataType.UInt16 or ModbusDataType.Bcd16 => ushort.Parse(raw, CultureInfo.InvariantCulture),
+        ModbusDataType.Int32 => int.Parse(raw, CultureInfo.InvariantCulture),
+        ModbusDataType.UInt32 or ModbusDataType.Bcd32 => uint.Parse(raw, CultureInfo.InvariantCulture),
+        ModbusDataType.Int64 => long.Parse(raw, CultureInfo.InvariantCulture),
+        ModbusDataType.UInt64 => ulong.Parse(raw, CultureInfo.InvariantCulture),
+        ModbusDataType.Float32 => float.Parse(raw, CultureInfo.InvariantCulture),
+        ModbusDataType.Float64 => double.Parse(raw, CultureInfo.InvariantCulture),
+        ModbusDataType.String => raw,
+        _ => throw new CliFx.Exceptions.CommandException($"Unsupported DataType '{type}' for write."),
+    };
+
+    private static bool ParseBool(string raw) => raw.Trim().ToLowerInvariant() switch
+    {
+        "1" or "true" or "on" or "yes" => true,
+        "0" or "false" or "off" or "no" => false,
+        _ => throw new CliFx.Exceptions.CommandException(
+            $"Boolean value '{raw}' is not recognised. Use true/false, 1/0, on/off, or yes/no."),
+    };
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/ModbusCommandBase.cs

@@ -0,0 +1,60 @@
+using CliFx.Attributes;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli;
+
+/// <summary>
+///     Base for every Modbus CLI command. Carries the Modbus-TCP endpoint options
+///     (host / port / unit-id) on top of <see cref="DriverCommandBase"/>'s verbose + timeout
+///     + logging helpers, and exposes <see cref="BuildOptions"/> so each command can turn its
+///     parsed flags into a <see cref="ModbusDriverOptions"/> ready to hand to the driver ctor.
+/// </summary>
+public abstract class ModbusCommandBase : DriverCommandBase
+{
+    [CommandOption("host", 'h', Description = "Modbus-TCP server hostname or IP", IsRequired = true)]
+    public string Host { get; init; } = default!;
+
+    [CommandOption("port", 'p', Description = "Modbus-TCP port (default 502)")]
+    public int Port { get; init; } = 502;
+
+    [CommandOption("unit-id", 'U', Description = "Modbus unit / slave ID (1-247, default 1)")]
+    public byte UnitId { get; init; } = 1;
+
+    [CommandOption("timeout-ms", Description = "Per-PDU timeout in milliseconds (default 2000)")]
+    public int TimeoutMs { get; init; } = 2000;
+
+    [CommandOption("disable-reconnect", Description =
+        "Disable the built-in mid-transaction reconnect-and-retry. Matches the driver's " +
+        "AutoReconnect=false setting — use when diagnosing socket teardown behaviour.")]
+    public bool DisableAutoReconnect { get; init; }
+
+    /// <inheritdoc />
+    public override TimeSpan Timeout
+    {
+        get => TimeSpan.FromMilliseconds(TimeoutMs);
+        init { /* driven by TimeoutMs property; setter required to satisfy base's init contract */ }
+    }
+
+    /// <summary>
+    ///     Construct a <see cref="ModbusDriverOptions"/> with the endpoint fields this base
+    ///     collected + whatever <paramref name="tags"/> the subclass declares. Probe is
+    ///     disabled — CLI runs are one-shot, the probe loop would race the operator's
+    ///     command against its own keep-alive reads.
+    /// </summary>
+    protected ModbusDriverOptions BuildOptions(IReadOnlyList<ModbusTagDefinition> tags) => new()
+    {
+        Host = Host,
+        Port = Port,
+        UnitId = UnitId,
+        Timeout = Timeout,
+        AutoReconnect = !DisableAutoReconnect,
+        Tags = tags,
+        Probe = new ModbusProbeOptions { Enabled = false },
+    };
+
+    /// <summary>
+    ///     Short instance id used in Serilog output so operators running the CLI against
+    ///     multiple endpoints in parallel can distinguish the logs.
+    /// </summary>
+    protected string DriverInstanceId => $"modbus-cli-{Host}:{Port}";
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/Program.cs

@@ -0,0 +1,11 @@
+using CliFx;
+
+return await new CliApplicationBuilder()
+    .AddCommandsFromThisAssembly()
+    .SetExecutableName("otopcua-modbus-cli")
+    .SetDescription(
+        "OtOpcUa Modbus test-client — ad-hoc connectivity + register reads/writes + polled " +
+        "subscriptions against Modbus-TCP devices. Mirrors the otopcua-cli shape for v1-style " +
+        "manual validation against PLCs + the integration fixture. See docs/Driver.Modbus.Cli.md.")
+    .Build()
+    .RunAsync(args);

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli.csproj

@@ -0,0 +1,29 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <OutputType>Exe</OutputType>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <LangVersion>latest</LangVersion>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+        <GenerateDocumentationFile>true</GenerateDocumentationFile>
+        <NoWarn>$(NoWarn);CS1591</NoWarn>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli</RootNamespace>
+        <AssemblyName>otopcua-modbus-cli</AssemblyName>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="CliFx" Version="2.3.6"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Driver.Cli.Common\ZB.MOM.WW.OtOpcUa.Driver.Cli.Common.csproj"/>
+        <ProjectReference Include="..\..\ZB.MOM.WW.OtOpcUa.Driver.Modbus\ZB.MOM.WW.OtOpcUa.Driver.Modbus.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli.Tests"/>
+    </ItemGroup>
+
+</Project>

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli/Commands/ProbeCommand.cs

@@ -0,0 +1,56 @@
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.S7.Cli.Commands;
+
+/// <summary>
+///     Probes an S7 endpoint: connects via S7.Net, reads one merker word, prints health.
+///     If the PLC is fresh out of TIA Portal the probe will surface
+///     <c>BadNotSupported</c> — PUT/GET communication has to be enabled in the hardware
+///     config for any S7-1200/1500 for the driver to get past the handshake.
+/// </summary>
+[Command("probe", Description = "Verify the S7 endpoint is reachable and a sample read succeeds.")]
+public sealed class ProbeCommand : S7CommandBase
+{
+    [CommandOption("address", 'a', Description =
+        "Probe address (default MW0 — merker word 0). DB1.DBW0 if your PLC project " +
+        "reserves a fingerprint DB.")]
+    public string Address { get; init; } = "MW0";
+
+    [CommandOption("type", Description = "Probe data type (default Int16).")]
+    public S7DataType DataType { get; init; } = S7DataType.Int16;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        var probeTag = new S7TagDefinition(
+            Name: "__probe",
+            Address: Address,
+            DataType: DataType,
+            Writable: false);
+        var options = BuildOptions([probeTag]);
+
+        await using var driver = new S7Driver(options, DriverInstanceId);
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+            var snapshot = await driver.ReadAsync(["__probe"], ct);
+            var health = driver.GetHealth();
+
+            await console.Output.WriteLineAsync($"Host:         {Host}:{Port}");
+            await console.Output.WriteLineAsync($"CPU:          {CpuType} rack={Rack} slot={Slot}");
+            await console.Output.WriteLineAsync($"Health:       {health.State}");
+            if (health.LastError is { } err)
+                await console.Output.WriteLineAsync($"Last error:   {err}");
+            await console.Output.WriteLineAsync();
+            await console.Output.WriteLineAsync(SnapshotFormatter.Format(Address, snapshot[0]));
+        }
+        finally
+        {
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli/Commands/ReadCommand.cs

@@ -0,0 +1,61 @@
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.S7.Cli.Commands;
+
+/// <summary>
+///     Read one S7 address (DB / M / I / Q area). Addresses use S7.Net grammar — the driver
+///     parses them via <c>S7AddressParser</c> so whatever the server accepts the CLI accepts
+///     too.
+/// </summary>
+[Command("read", Description = "Read a single S7 address.")]
+public sealed class ReadCommand : S7CommandBase
+{
+    [CommandOption("address", 'a', Description =
+        "S7 address. Examples: DB1.DBW0 (DB1, word 0); M0.0 (merker bit); IW4 (input word 4); " +
+        "QD8 (output dword 8); DB2.DBD20 (DB2, dword 20); DB5.DBX4.3 (DB5, byte 4, bit 3); " +
+        "DB10.STRING[0] (DB10 string). Bit addresses use dot notation.",
+        IsRequired = true)]
+    public string Address { get; init; } = default!;
+
+    [CommandOption("type", 't', Description =
+        "Bool / Byte / Int16 / UInt16 / Int32 / UInt32 / Int64 / UInt64 / Float32 / Float64 / " +
+        "String / DateTime (default Int16).")]
+    public S7DataType DataType { get; init; } = S7DataType.Int16;
+
+    [CommandOption("string-length", Description =
+        "For type=String: S7-string max length (default 254, S7 max).")]
+    public int StringLength { get; init; } = 254;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        var tagName = SynthesiseTagName(Address, DataType);
+        var tag = new S7TagDefinition(
+            Name: tagName,
+            Address: Address,
+            DataType: DataType,
+            Writable: false,
+            StringLength: StringLength);
+        var options = BuildOptions([tag]);
+
+        await using var driver = new S7Driver(options, DriverInstanceId);
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+            var snapshot = await driver.ReadAsync([tagName], ct);
+            await console.Output.WriteLineAsync(SnapshotFormatter.Format(Address, snapshot[0]));
+        }
+        finally
+        {
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+
+    /// <summary>Tag-name key used internally. Address + type is already unique.</summary>
+    internal static string SynthesiseTagName(string address, S7DataType type)
+        => $"{address}:{type}";
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli/Commands/SubscribeCommand.cs

@@ -0,0 +1,76 @@
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.S7.Cli.Commands;
+
+/// <summary>
+///     Watch an S7 address via polled subscription until Ctrl+C. S7comm has no native push
+///     model so this goes through <c>PollGroupEngine</c> same as Modbus / AB.
+/// </summary>
+[Command("subscribe", Description = "Watch an S7 address via polled subscription until Ctrl+C.")]
+public sealed class SubscribeCommand : S7CommandBase
+{
+    [CommandOption("address", 'a', Description = "S7 address — same format as `read`.", IsRequired = true)]
+    public string Address { get; init; } = default!;
+
+    [CommandOption("type", 't', Description =
+        "Bool / Byte / Int16 / UInt16 / Int32 / UInt32 / Int64 / UInt64 / Float32 / Float64 / " +
+        "String / DateTime (default Int16).")]
+    public S7DataType DataType { get; init; } = S7DataType.Int16;
+
+    [CommandOption("interval-ms", 'i', Description = "Publishing interval ms (default 1000).")]
+    public int IntervalMs { get; init; } = 1000;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        var tagName = ReadCommand.SynthesiseTagName(Address, DataType);
+        var tag = new S7TagDefinition(
+            Name: tagName,
+            Address: Address,
+            DataType: DataType,
+            Writable: false);
+        var options = BuildOptions([tag]);
+
+        await using var driver = new S7Driver(options, DriverInstanceId);
+        ISubscriptionHandle? handle = null;
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+
+            driver.OnDataChange += (_, e) =>
+            {
+                var line = $"[{DateTime.UtcNow:HH:mm:ss.fff}] " +
+                    $"{e.FullReference} = {SnapshotFormatter.FormatValue(e.Snapshot.Value)} " +
+                    $"({SnapshotFormatter.FormatStatus(e.Snapshot.StatusCode)})";
+                console.Output.WriteLine(line);
+            };
+
+            handle = await driver.SubscribeAsync([tagName], TimeSpan.FromMilliseconds(IntervalMs), ct);
+
+            await console.Output.WriteLineAsync(
+                $"Subscribed to {Address} @ {IntervalMs}ms. Ctrl+C to stop.");
+            try
+            {
+                await Task.Delay(System.Threading.Timeout.InfiniteTimeSpan, ct);
+            }
+            catch (OperationCanceledException)
+            {
+                // Expected on Ctrl+C.
+            }
+        }
+        finally
+        {
+            if (handle is not null)
+            {
+                try { await driver.UnsubscribeAsync(handle, CancellationToken.None); }
+                catch { /* teardown best-effort */ }
+            }
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli/Commands/WriteCommand.cs

@@ -0,0 +1,89 @@
+using System.Globalization;
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.S7.Cli.Commands;
+
+/// <summary>
+///     Write one value to an S7 address. Mirrors <see cref="ReadCommand"/>'s flag shape.
+///     Writes to M (merker) bits or Q (output) coils that drive edge-triggered routines
+///     are real — be careful what you hit on a running PLC.
+/// </summary>
+[Command("write", Description = "Write a single S7 address.")]
+public sealed class WriteCommand : S7CommandBase
+{
+    [CommandOption("address", 'a', Description =
+        "S7 address — same format as `read`.", IsRequired = true)]
+    public string Address { get; init; } = default!;
+
+    [CommandOption("type", 't', Description =
+        "Bool / Byte / Int16 / UInt16 / Int32 / UInt32 / Int64 / UInt64 / Float32 / Float64 / " +
+        "String / DateTime (default Int16).")]
+    public S7DataType DataType { get; init; } = S7DataType.Int16;
+
+    [CommandOption("value", 'v', Description =
+        "Value to write. Parsed per --type (booleans accept true/false/1/0).",
+        IsRequired = true)]
+    public string Value { get; init; } = default!;
+
+    [CommandOption("string-length", Description =
+        "For type=String: S7-string max length (default 254).")]
+    public int StringLength { get; init; } = 254;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        var tagName = ReadCommand.SynthesiseTagName(Address, DataType);
+        var tag = new S7TagDefinition(
+            Name: tagName,
+            Address: Address,
+            DataType: DataType,
+            Writable: true,
+            StringLength: StringLength);
+        var options = BuildOptions([tag]);
+
+        var parsed = ParseValue(Value, DataType);
+
+        await using var driver = new S7Driver(options, DriverInstanceId);
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+            var results = await driver.WriteAsync([new WriteRequest(tagName, parsed)], ct);
+            await console.Output.WriteLineAsync(SnapshotFormatter.FormatWrite(Address, results[0]));
+        }
+        finally
+        {
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+
+    /// <summary>Parse <c>--value</c> per <see cref="S7DataType"/>, invariant culture throughout.</summary>
+    internal static object ParseValue(string raw, S7DataType type) => type switch
+    {
+        S7DataType.Bool => ParseBool(raw),
+        S7DataType.Byte => byte.Parse(raw, CultureInfo.InvariantCulture),
+        S7DataType.Int16 => short.Parse(raw, CultureInfo.InvariantCulture),
+        S7DataType.UInt16 => ushort.Parse(raw, CultureInfo.InvariantCulture),
+        S7DataType.Int32 => int.Parse(raw, CultureInfo.InvariantCulture),
+        S7DataType.UInt32 => uint.Parse(raw, CultureInfo.InvariantCulture),
+        S7DataType.Int64 => long.Parse(raw, CultureInfo.InvariantCulture),
+        S7DataType.UInt64 => ulong.Parse(raw, CultureInfo.InvariantCulture),
+        S7DataType.Float32 => float.Parse(raw, CultureInfo.InvariantCulture),
+        S7DataType.Float64 => double.Parse(raw, CultureInfo.InvariantCulture),
+        S7DataType.String => raw,
+        S7DataType.DateTime => DateTime.Parse(raw, CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind),
+        _ => throw new CliFx.Exceptions.CommandException($"Unsupported DataType '{type}' for write."),
+    };
+
+    private static bool ParseBool(string raw) => raw.Trim().ToLowerInvariant() switch
+    {
+        "1" or "true" or "on" or "yes" => true,
+        "0" or "false" or "off" or "no" => false,
+        _ => throw new CliFx.Exceptions.CommandException(
+            $"Boolean value '{raw}' is not recognised. Use true/false, 1/0, on/off, or yes/no."),
+    };
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli/Program.cs

@@ -0,0 +1,11 @@
+using CliFx;
+
+return await new CliApplicationBuilder()
+    .AddCommandsFromThisAssembly()
+    .SetExecutableName("otopcua-s7-cli")
+    .SetDescription(
+        "OtOpcUa S7 test-client — ad-hoc probe + S7comm reads/writes + polled subscriptions " +
+        "against Siemens S7-300 / S7-400 / S7-1200 / S7-1500 (and compatible soft-PLCs) via " +
+        "S7.Net / ISO-on-TCP port 102. Addresses use S7.Net syntax: DB1.DBW0, M0.0, IW4, QD8.")
+    .Build()
+    .RunAsync(args);

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli/S7CommandBase.cs

@@ -0,0 +1,61 @@
+using CliFx.Attributes;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+using S7NetCpuType = global::S7.Net.CpuType;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.S7.Cli;
+
+/// <summary>
+///     Base for every S7 CLI command. Carries the ISO-on-TCP endpoint options
+///     (host / port / CPU type / rack / slot) that S7.Net needs for its handshake +
+///     exposes <see cref="BuildOptions"/> so each command can synthesise an
+///     <see cref="S7DriverOptions"/> on demand.
+/// </summary>
+public abstract class S7CommandBase : DriverCommandBase
+{
+    [CommandOption("host", 'h', Description = "PLC IP address or hostname.", IsRequired = true)]
+    public string Host { get; init; } = default!;
+
+    [CommandOption("port", 'p', Description = "ISO-on-TCP port (default 102).")]
+    public int Port { get; init; } = 102;
+
+    [CommandOption("cpu", 'c', Description =
+        "S7 CPU family: S7200 / S7200Smart / S7300 / S7400 / S71200 / S71500 " +
+        "(default S71500). Determines the ISO-TSAP slot byte.")]
+    public S7NetCpuType CpuType { get; init; } = S7NetCpuType.S71500;
+
+    [CommandOption("rack", Description = "Rack number (default 0 — single-rack).")]
+    public short Rack { get; init; } = 0;
+
+    [CommandOption("slot", Description =
+        "CPU slot. S7-300 = 2, S7-400 = 2 or 3, S7-1200 / S7-1500 = 0 (default 0).")]
+    public short Slot { get; init; } = 0;
+
+    [CommandOption("timeout-ms", Description = "Per-operation timeout in ms (default 5000).")]
+    public int TimeoutMs { get; init; } = 5000;
+
+    /// <inheritdoc />
+    public override TimeSpan Timeout
+    {
+        get => TimeSpan.FromMilliseconds(TimeoutMs);
+        init { /* driven by TimeoutMs */ }
+    }
+
+    /// <summary>
+    ///     Build an <see cref="S7DriverOptions"/> with the endpoint fields this base
+    ///     collected + whatever <paramref name="tags"/> the subclass declares. Probe
+    ///     disabled — CLI runs are one-shot.
+    /// </summary>
+    protected S7DriverOptions BuildOptions(IReadOnlyList<S7TagDefinition> tags) => new()
+    {
+        Host = Host,
+        Port = Port,
+        CpuType = CpuType,
+        Rack = Rack,
+        Slot = Slot,
+        Timeout = Timeout,
+        Tags = tags,
+        Probe = new S7ProbeOptions { Enabled = false },
+    };
+
+    protected string DriverInstanceId => $"s7-cli-{Host}:{Port}";
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli.csproj

@@ -0,0 +1,29 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <OutputType>Exe</OutputType>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <LangVersion>latest</LangVersion>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+        <GenerateDocumentationFile>true</GenerateDocumentationFile>
+        <NoWarn>$(NoWarn);CS1591</NoWarn>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.S7.Cli</RootNamespace>
+        <AssemblyName>otopcua-s7-cli</AssemblyName>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="CliFx" Version="2.3.6"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Driver.Cli.Common\ZB.MOM.WW.OtOpcUa.Driver.Cli.Common.csproj"/>
+        <ProjectReference Include="..\..\ZB.MOM.WW.OtOpcUa.Driver.S7\ZB.MOM.WW.OtOpcUa.Driver.S7.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Driver.S7.Cli.Tests"/>
+    </ItemGroup>
+
+</Project>

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli/Commands/BrowseCommand.cs

@@ -0,0 +1,101 @@
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli.Commands;
+
+/// <summary>
+///     Walk the target's symbol table (ADS <c>SymbolLoaderFactory</c>, flat mode) and print every
+///     symbol the driver's atomic-type mapper recognizes. Same path <c>DiscoverAsync</c> takes
+///     when <c>EnableControllerBrowse = true</c> — structured UDTs / function-block instances
+///     won't appear because the driver filters to the supported primitive surface.
+/// </summary>
+[Command("browse", Description = "Enumerate controller symbols via the driver's DiscoverAsync walk.")]
+public sealed class BrowseCommand : TwinCATCommandBase
+{
+    [CommandOption("prefix", Description =
+        "Case-sensitive instance-path prefix to filter on (e.g. 'GVL_Fixture' or " +
+        "'MAIN.'). Empty (default) prints everything.")]
+    public string? Prefix { get; init; }
+
+    [CommandOption("max", Description =
+        "Maximum number of symbols to print. 0 = unbounded (default 500 for large " +
+        "controllers — flat-mode symbol counts easily top 10k).")]
+    public int Max { get; init; } = 500;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        // Browse-only — no declared tags. EnableControllerBrowse=true flips DiscoverAsync's
+        // symbol-walk on so every recognized primitive surfaces through the builder.
+        var options = new TwinCATDriverOptions
+        {
+            Devices = [new TwinCATDeviceOptions(Gateway, $"cli-{AmsNetId}:{AmsPort}")],
+            Tags = [],
+            Timeout = Timeout,
+            Probe = new TwinCATProbeOptions { Enabled = false },
+            UseNativeNotifications = !PollOnly,
+            EnableControllerBrowse = true,
+        };
+
+        await using var driver = new TwinCATDriver(options, DriverInstanceId);
+        var builder = new CollectingAddressSpaceBuilder();
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+            await driver.DiscoverAsync(builder, ct);
+        }
+        finally
+        {
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+
+        var matched = builder.Variables
+            .Where(v => string.IsNullOrEmpty(Prefix) || v.BrowseName.StartsWith(Prefix, StringComparison.Ordinal))
+            .ToList();
+        var printLimit = Max <= 0 ? matched.Count : Math.Min(Max, matched.Count);
+
+        await console.Output.WriteLineAsync($"AMS:          {AmsNetId}:{AmsPort}");
+        await console.Output.WriteLineAsync(
+            $"Symbols:      {matched.Count} matched ({builder.Variables.Count} total), showing {printLimit}");
+        await console.Output.WriteLineAsync();
+
+        foreach (var v in matched.Take(printLimit))
+        {
+            var access = v.Info.SecurityClass == SecurityClassification.ViewOnly ? "RO" : "RW";
+            await console.Output.WriteLineAsync($"  [{access}] {v.Info.DriverDataType,-8} {v.BrowseName}");
+        }
+
+        if (matched.Count > printLimit)
+            await console.Output.WriteLineAsync(
+                $"  … {matched.Count - printLimit} more — raise --max or tighten --prefix");
+    }
+
+    private sealed class CollectingAddressSpaceBuilder : IAddressSpaceBuilder
+    {
+        public List<(string BrowseName, DriverAttributeInfo Info)> Variables { get; } = [];
+
+        public IAddressSpaceBuilder Folder(string browseName, string displayName) => this;
+
+        public IVariableHandle Variable(string browseName, string displayName, DriverAttributeInfo info)
+        {
+            Variables.Add((browseName, info));
+            return new Handle(info.FullName);
+        }
+
+        public void AddProperty(string name, DriverDataType type, object? value) { }
+
+        private sealed class Handle(string fullRef) : IVariableHandle
+        {
+            public string FullReference => fullRef;
+            public IAlarmConditionSink MarkAsAlarmCondition(AlarmConditionInfo info) => new NullSink();
+        }
+
+        private sealed class NullSink : IAlarmConditionSink
+        {
+            public void OnTransition(AlarmEventArgs args) { }
+        }
+    }
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli/Commands/ProbeCommand.cs

@@ -0,0 +1,58 @@
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli.Commands;
+
+/// <summary>
+///     Probes a TwinCAT runtime: opens an ADS session, reads one symbol, prints driver health.
+///     Use this first after configuring a new AMS route — it'll surface "no route" /
+///     "port unreachable" / "AMS router down" errors up-front before you bring the OtOpcUa
+///     server near the endpoint.
+/// </summary>
+[Command("probe", Description = "Verify the TwinCAT runtime is reachable and a sample symbol reads.")]
+public sealed class ProbeCommand : TwinCATCommandBase
+{
+    [CommandOption("symbol", 's', Description =
+        "Symbol path to probe. System-global examples: " +
+        "'TwinCAT_SystemInfoVarList._AppInfo.OnlineChangeCnt', 'MAIN.bRunning'. " +
+        "User-project: a GVL or program variable.",
+        IsRequired = true)]
+    public string SymbolPath { get; init; } = default!;
+
+    [CommandOption("type", Description = "Data type (default DInt — TwinCAT DINT maps to int32).")]
+    public TwinCATDataType DataType { get; init; } = TwinCATDataType.DInt;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        var probeTag = new TwinCATTagDefinition(
+            Name: "__probe",
+            DeviceHostAddress: Gateway,
+            SymbolPath: SymbolPath,
+            DataType: DataType,
+            Writable: false);
+        var options = BuildOptions([probeTag]);
+
+        await using var driver = new TwinCATDriver(options, DriverInstanceId);
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+            var snapshot = await driver.ReadAsync(["__probe"], ct);
+            var health = driver.GetHealth();
+
+            await console.Output.WriteLineAsync($"AMS:          {AmsNetId}:{AmsPort}");
+            await console.Output.WriteLineAsync($"Health:       {health.State}");
+            if (health.LastError is { } err)
+                await console.Output.WriteLineAsync($"Last error:   {err}");
+            await console.Output.WriteLineAsync();
+            await console.Output.WriteLineAsync(SnapshotFormatter.Format(SymbolPath, snapshot[0]));
+        }
+        finally
+        {
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli/Commands/ReadCommand.cs

@@ -0,0 +1,54 @@
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli.Commands;
+
+/// <summary>
+///     Read one TwinCAT symbol by path. Structure writes/reads are out of scope — fan the
+///     member list into individual reads if you need them.
+/// </summary>
+[Command("read", Description = "Read a single TwinCAT symbol.")]
+public sealed class ReadCommand : TwinCATCommandBase
+{
+    [CommandOption("symbol", 's', Description =
+        "Symbol path. Program scope: 'MAIN.bStart'. Global: 'GVL.Counter'. " +
+        "Nested UDT member: 'Motor1.Status.Running'. Array element: 'Recipe[3]'.",
+        IsRequired = true)]
+    public string SymbolPath { get; init; } = default!;
+
+    [CommandOption("type", 't', Description =
+        "Bool / SInt / USInt / Int / UInt / DInt / UDInt / LInt / ULInt / Real / LReal / " +
+        "String / WString / Time / Date / DateTime / TimeOfDay (default DInt).")]
+    public TwinCATDataType DataType { get; init; } = TwinCATDataType.DInt;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        var tagName = SynthesiseTagName(SymbolPath, DataType);
+        var tag = new TwinCATTagDefinition(
+            Name: tagName,
+            DeviceHostAddress: Gateway,
+            SymbolPath: SymbolPath,
+            DataType: DataType,
+            Writable: false);
+        var options = BuildOptions([tag]);
+
+        await using var driver = new TwinCATDriver(options, DriverInstanceId);
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+            var snapshot = await driver.ReadAsync([tagName], ct);
+            await console.Output.WriteLineAsync(SnapshotFormatter.Format(SymbolPath, snapshot[0]));
+        }
+        finally
+        {
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+
+    internal static string SynthesiseTagName(string symbolPath, TwinCATDataType type)
+        => $"{symbolPath}:{type}";
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli/Commands/SubscribeCommand.cs

@@ -0,0 +1,78 @@
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli.Commands;
+
+/// <summary>
+///     Watch a TwinCAT symbol until Ctrl+C. Native ADS notifications by default (TwinCAT
+///     pushes on its own cycle); pass <c>--poll-only</c> to fall through to PollGroupEngine.
+/// </summary>
+[Command("subscribe", Description = "Watch a TwinCAT symbol via ADS notification or poll, until Ctrl+C.")]
+public sealed class SubscribeCommand : TwinCATCommandBase
+{
+    [CommandOption("symbol", 's', Description = "Symbol path — same format as `read`.", IsRequired = true)]
+    public string SymbolPath { get; init; } = default!;
+
+    [CommandOption("type", 't', Description =
+        "Bool / SInt / USInt / Int / UInt / DInt / UDInt / LInt / ULInt / Real / LReal / " +
+        "String / WString / Time / Date / DateTime / TimeOfDay (default DInt).")]
+    public TwinCATDataType DataType { get; init; } = TwinCATDataType.DInt;
+
+    [CommandOption("interval-ms", 'i', Description = "Publishing interval ms (default 1000).")]
+    public int IntervalMs { get; init; } = 1000;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        var tagName = ReadCommand.SynthesiseTagName(SymbolPath, DataType);
+        var tag = new TwinCATTagDefinition(
+            Name: tagName,
+            DeviceHostAddress: Gateway,
+            SymbolPath: SymbolPath,
+            DataType: DataType,
+            Writable: false);
+        var options = BuildOptions([tag]);
+
+        await using var driver = new TwinCATDriver(options, DriverInstanceId);
+        ISubscriptionHandle? handle = null;
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+
+            driver.OnDataChange += (_, e) =>
+            {
+                var line = $"[{DateTime.UtcNow:HH:mm:ss.fff}] " +
+                    $"{e.FullReference} = {SnapshotFormatter.FormatValue(e.Snapshot.Value)} " +
+                    $"({SnapshotFormatter.FormatStatus(e.Snapshot.StatusCode)})";
+                console.Output.WriteLine(line);
+            };
+
+            handle = await driver.SubscribeAsync([tagName], TimeSpan.FromMilliseconds(IntervalMs), ct);
+
+            var mode = PollOnly ? "polling" : "ADS notification";
+            await console.Output.WriteLineAsync(
+                $"Subscribed to {SymbolPath} @ {IntervalMs}ms ({mode}). Ctrl+C to stop.");
+            try
+            {
+                await Task.Delay(System.Threading.Timeout.InfiniteTimeSpan, ct);
+            }
+            catch (OperationCanceledException)
+            {
+                // Expected on Ctrl+C.
+            }
+        }
+        finally
+        {
+            if (handle is not null)
+            {
+                try { await driver.UnsubscribeAsync(handle, CancellationToken.None); }
+                catch { /* teardown best-effort */ }
+            }
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli/Commands/WriteCommand.cs

@@ -0,0 +1,94 @@
+using System.Globalization;
+using CliFx.Attributes;
+using CliFx.Infrastructure;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli.Commands;
+
+/// <summary>
+///     Write one value to a TwinCAT symbol. Structure writes refused — drop to driver config
+///     JSON for those.
+/// </summary>
+[Command("write", Description = "Write a single TwinCAT symbol.")]
+public sealed class WriteCommand : TwinCATCommandBase
+{
+    [CommandOption("symbol", 's', Description =
+        "Symbol path — same format as `read`.", IsRequired = true)]
+    public string SymbolPath { get; init; } = default!;
+
+    [CommandOption("type", 't', Description =
+        "Bool / SInt / USInt / Int / UInt / DInt / UDInt / LInt / ULInt / Real / LReal / " +
+        "String / WString / Time / Date / DateTime / TimeOfDay (default DInt).")]
+    public TwinCATDataType DataType { get; init; } = TwinCATDataType.DInt;
+
+    [CommandOption("value", 'v', Description =
+        "Value to write. Parsed per --type (booleans accept true/false/1/0).",
+        IsRequired = true)]
+    public string Value { get; init; } = default!;
+
+    public override async ValueTask ExecuteAsync(IConsole console)
+    {
+        ConfigureLogging();
+        var ct = console.RegisterCancellationHandler();
+
+        if (DataType == TwinCATDataType.Structure)
+            throw new CliFx.Exceptions.CommandException(
+                "Structure (UDT) writes need an explicit member layout — drop to the driver's " +
+                "config JSON for those. The CLI covers atomic types only.");
+
+        var tagName = ReadCommand.SynthesiseTagName(SymbolPath, DataType);
+        var tag = new TwinCATTagDefinition(
+            Name: tagName,
+            DeviceHostAddress: Gateway,
+            SymbolPath: SymbolPath,
+            DataType: DataType,
+            Writable: true);
+        var options = BuildOptions([tag]);
+
+        var parsed = ParseValue(Value, DataType);
+
+        await using var driver = new TwinCATDriver(options, DriverInstanceId);
+        try
+        {
+            await driver.InitializeAsync("{}", ct);
+            var results = await driver.WriteAsync([new WriteRequest(tagName, parsed)], ct);
+            await console.Output.WriteLineAsync(SnapshotFormatter.FormatWrite(SymbolPath, results[0]));
+        }
+        finally
+        {
+            await driver.ShutdownAsync(CancellationToken.None);
+        }
+    }
+
+    /// <summary>Parse <c>--value</c> per <see cref="TwinCATDataType"/>, invariant culture.</summary>
+    internal static object ParseValue(string raw, TwinCATDataType type) => type switch
+    {
+        TwinCATDataType.Bool => ParseBool(raw),
+        TwinCATDataType.SInt => sbyte.Parse(raw, CultureInfo.InvariantCulture),
+        TwinCATDataType.USInt => byte.Parse(raw, CultureInfo.InvariantCulture),
+        TwinCATDataType.Int => short.Parse(raw, CultureInfo.InvariantCulture),
+        TwinCATDataType.UInt => ushort.Parse(raw, CultureInfo.InvariantCulture),
+        TwinCATDataType.DInt => int.Parse(raw, CultureInfo.InvariantCulture),
+        TwinCATDataType.UDInt => uint.Parse(raw, CultureInfo.InvariantCulture),
+        TwinCATDataType.LInt => long.Parse(raw, CultureInfo.InvariantCulture),
+        TwinCATDataType.ULInt => ulong.Parse(raw, CultureInfo.InvariantCulture),
+        TwinCATDataType.Real => float.Parse(raw, CultureInfo.InvariantCulture),
+        TwinCATDataType.LReal => double.Parse(raw, CultureInfo.InvariantCulture),
+        TwinCATDataType.String or TwinCATDataType.WString => raw,
+        // IEC 61131-3 time/date types are stored as UDINT on the wire — accept a numeric raw
+        // value + let the caller handle the encoding semantics.
+        TwinCATDataType.Time or TwinCATDataType.Date
+            or TwinCATDataType.DateTime or TwinCATDataType.TimeOfDay
+            => uint.Parse(raw, CultureInfo.InvariantCulture),
+        _ => throw new CliFx.Exceptions.CommandException($"Unsupported DataType '{type}' for write."),
+    };
+
+    private static bool ParseBool(string raw) => raw.Trim().ToLowerInvariant() switch
+    {
+        "1" or "true" or "on" or "yes" => true,
+        "0" or "false" or "off" or "no" => false,
+        _ => throw new CliFx.Exceptions.CommandException(
+            $"Boolean value '{raw}' is not recognised. Use true/false, 1/0, on/off, or yes/no."),
+    };
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli/Program.cs

@@ -0,0 +1,12 @@
+using CliFx;
+
+return await new CliApplicationBuilder()
+    .AddCommandsFromThisAssembly()
+    .SetExecutableName("otopcua-twincat-cli")
+    .SetDescription(
+        "OtOpcUa TwinCAT test-client — ad-hoc probe + ADS symbolic reads/writes + " +
+        "subscriptions against Beckhoff TwinCAT 2/3 runtimes. Requires a reachable AMS " +
+        "router (local TwinCAT XAR or the Beckhoff.TwinCAT.Ads.TcpRouter NuGet). Addresses " +
+        "use symbolic paths: MAIN.bStart, GVL.Counter, Motor1.Status.Running.")
+    .Build()
+    .RunAsync(args);

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli/TwinCATCommandBase.cs

@@ -0,0 +1,62 @@
+using CliFx.Attributes;
+using ZB.MOM.WW.OtOpcUa.Driver.Cli.Common;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli;
+
+/// <summary>
+///     Base for every TwinCAT CLI command. Carries the AMS target options
+///     (<c>--ams-net-id</c> + <c>--ams-port</c>) + the notification-mode toggle that the
+///     driver itself takes. Exposes <see cref="BuildOptions"/> so each command can build a
+///     single-device / single-tag <see cref="TwinCATDriverOptions"/> from flag input.
+/// </summary>
+public abstract class TwinCATCommandBase : DriverCommandBase
+{
+    [CommandOption("ams-net-id", 'n', Description =
+        "AMS Net ID of the target runtime (e.g. '192.168.1.40.1.1' or '127.0.0.1.1.1' for local).",
+        IsRequired = true)]
+    public string AmsNetId { get; init; } = default!;
+
+    [CommandOption("ams-port", 'p', Description =
+        "AMS port. TwinCAT 3 PLC runtime defaults to 851; TwinCAT 2 uses 801.")]
+    public int AmsPort { get; init; } = 851;
+
+    [CommandOption("timeout-ms", Description = "Per-operation timeout in ms (default 5000).")]
+    public int TimeoutMs { get; init; } = 5000;
+
+    [CommandOption("poll-only", Description =
+        "Disable native ADS notifications and fall through to the shared PollGroupEngine " +
+        "(same as setting UseNativeNotifications=false in a real driver config).")]
+    public bool PollOnly { get; init; }
+
+    /// <inheritdoc />
+    public override TimeSpan Timeout
+    {
+        get => TimeSpan.FromMilliseconds(TimeoutMs);
+        init { /* driven by TimeoutMs */ }
+    }
+
+    /// <summary>
+    ///     Canonical TwinCAT gateway string the driver's <c>TwinCATAmsAddress.TryParse</c>
+    ///     consumes — shape <c>ads://{AmsNetId}:{AmsPort}</c>.
+    /// </summary>
+    protected string Gateway => $"ads://{AmsNetId}:{AmsPort}";
+
+    /// <summary>
+    ///     Build a <see cref="TwinCATDriverOptions"/> with the AMS target this base collected +
+    ///     the tag list a subclass supplies. Probe disabled, controller-browse disabled,
+    ///     native notifications toggled by <see cref="PollOnly"/>.
+    /// </summary>
+    protected TwinCATDriverOptions BuildOptions(IReadOnlyList<TwinCATTagDefinition> tags) => new()
+    {
+        Devices = [new TwinCATDeviceOptions(
+            HostAddress: Gateway,
+            DeviceName: $"cli-{AmsNetId}:{AmsPort}")],
+        Tags = tags,
+        Timeout = Timeout,
+        Probe = new TwinCATProbeOptions { Enabled = false },
+        UseNativeNotifications = !PollOnly,
+        EnableControllerBrowse = false,
+    };
+
+    protected string DriverInstanceId => $"twincat-cli-{AmsNetId}:{AmsPort}";
+}

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli.csproj

@@ -0,0 +1,29 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <OutputType>Exe</OutputType>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <LangVersion>latest</LangVersion>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+        <GenerateDocumentationFile>true</GenerateDocumentationFile>
+        <NoWarn>$(NoWarn);CS1591</NoWarn>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli</RootNamespace>
+        <AssemblyName>otopcua-twincat-cli</AssemblyName>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="CliFx" Version="2.3.6"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Driver.Cli.Common\ZB.MOM.WW.OtOpcUa.Driver.Cli.Common.csproj"/>
+        <ProjectReference Include="..\..\ZB.MOM.WW.OtOpcUa.Driver.TwinCAT\ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli.Tests"/>
+    </ItemGroup>
+
+</Project>

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipAlarmProjection.cs

@@ -0,0 +1,232 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Task #177 — projects AB Logix ALMD alarm instructions onto the OPC UA alarm surface by
+///     polling the ALMD UDT's <c>InFaulted</c> / <c>Acked</c> / <c>Severity</c> members at a
+///     configurable interval + translating state transitions into <c>OnAlarmEvent</c>
+///     callbacks on the owning <see cref="AbCipDriver"/>. Feature-flagged off by default via
+///     <see cref="AbCipDriverOptions.EnableAlarmProjection"/>; callers that leave the flag off
+///     get a no-op subscribe path so capability negotiation still works.
+/// </summary>
+/// <remarks>
+///     <para>ALMD-only in this pass. ALMA (analog alarm) projection is a follow-up because
+///     its threshold + limit semantics need more design — ALMD's "is the alarm active + has
+///     the operator acked" shape maps cleanly onto the driver-agnostic
+///     <see cref="IAlarmSource"/> contract without concessions.</para>
+///
+///     <para>Polling reuses <see cref="AbCipDriver.ReadAsync"/>, so ALMD reads get the #194
+///     whole-UDT optimization for free when the ALMD is declared with its standard members.
+///     One poll loop per subscription call; the loop batches every
+///     member read across the full source-node set into a single ReadAsync per tick.</para>
+///
+///     <para>ALMD <c>Acked</c> write semantics on Logix are rising-edge sensitive at the
+///     instruction level — writing <c>Acked=1</c> directly is honored by FT View + the
+///     standard HMI templates, but some PLC programs read <c>AckCmd</c> + look for the edge
+///     themselves. We pick the simpler <c>Acked</c> write for first pass; operators whose
+///     ladder watches <c>AckCmd</c> can wire a follow-up "AckCmd 0→1→0" pulse on the client
+///     side until a driver-level knob lands.</para>
+/// </remarks>
+internal sealed class AbCipAlarmProjection : IAsyncDisposable
+{
+    private readonly AbCipDriver _driver;
+    private readonly TimeSpan _pollInterval;
+    private readonly Dictionary<long, Subscription> _subs = new();
+    private readonly Lock _subsLock = new();
+    private long _nextId;
+
+    public AbCipAlarmProjection(AbCipDriver driver, TimeSpan pollInterval)
+    {
+        _driver = driver;
+        _pollInterval = pollInterval;
+    }
+
+    public async Task<IAlarmSubscriptionHandle> SubscribeAsync(
+        IReadOnlyList<string> sourceNodeIds, CancellationToken cancellationToken)
+    {
+        var id = Interlocked.Increment(ref _nextId);
+        var handle = new AbCipAlarmSubscriptionHandle(id);
+        var cts = new CancellationTokenSource();
+        var sub = new Subscription(handle, [..sourceNodeIds], cts);
+
+        lock (_subsLock) _subs[id] = sub;
+
+        sub.Loop = Task.Run(() => RunPollLoopAsync(sub, cts.Token), cts.Token);
+        await Task.CompletedTask;
+        return handle;
+    }
+
+    public async Task UnsubscribeAsync(IAlarmSubscriptionHandle handle, CancellationToken cancellationToken)
+    {
+        if (handle is not AbCipAlarmSubscriptionHandle h) return;
+        Subscription? sub;
+        lock (_subsLock)
+        {
+            if (!_subs.Remove(h.Id, out sub)) return;
+        }
+        try { sub.Cts.Cancel(); } catch { }
+        try { await sub.Loop.ConfigureAwait(false); } catch { }
+        sub.Cts.Dispose();
+    }
+
+    public async Task AcknowledgeAsync(
+        IReadOnlyList<AlarmAcknowledgeRequest> acknowledgements, CancellationToken cancellationToken)
+    {
+        if (acknowledgements.Count == 0) return;
+
+        // Write Acked=1 per request. IWritable isn't on AbCipAlarmProjection so route through
+        // the driver's public interface — delegating instead of re-implementing the write path
+        // keeps the bit-in-DINT + idempotency + per-call-host-resolve knobs intact.
+        var requests = acknowledgements
+            .Select(a => new WriteRequest($"{a.SourceNodeId}.Acked", true))
+            .ToArray();
+        // Best-effort — the driver's WriteAsync returns per-item status; individual ack
+        // failures don't poison the batch. Swallow the return so a single faulted ack
+        // doesn't bubble out of the caller's batch expectation.
+        _ = await _driver.WriteAsync(requests, cancellationToken).ConfigureAwait(false);
+    }
+
+    public async ValueTask DisposeAsync()
+    {
+        List<Subscription> snap;
+        lock (_subsLock) { snap = _subs.Values.ToList(); _subs.Clear(); }
+        foreach (var sub in snap)
+        {
+            try { sub.Cts.Cancel(); } catch { }
+            try { await sub.Loop.ConfigureAwait(false); } catch { }
+            sub.Cts.Dispose();
+        }
+    }
+
+    /// <summary>
+    ///     Poll-tick body — reads <c>InFaulted</c> + <c>Severity</c> for every source node id
+    ///     in the subscription, diffs each against last-seen state, fires raise/clear events.
+    ///     Extracted so tests can drive one tick without standing up the Task.Run loop.
+    /// </summary>
+    internal void Tick(Subscription sub, IReadOnlyList<DataValueSnapshot> results)
+    {
+        // results index layout: for each sourceNode, [InFaulted, Severity] in order.
+        for (var i = 0; i < sub.SourceNodeIds.Count; i++)
+        {
+            var nodeId = sub.SourceNodeIds[i];
+            var inFaultedDv = results[i * 2];
+            var severityDv = results[i * 2 + 1];
+            if (inFaultedDv.StatusCode != AbCipStatusMapper.Good) continue;
+
+            var nowFaulted = ToBool(inFaultedDv.Value);
+            var severity = ToInt(severityDv.Value);
+
+            var wasFaulted = sub.LastInFaulted.GetValueOrDefault(nodeId, false);
+            sub.LastInFaulted[nodeId] = nowFaulted;
+
+            if (!wasFaulted && nowFaulted)
+            {
+                _driver.InvokeAlarmEvent(new AlarmEventArgs(
+                    sub.Handle, nodeId, ConditionId: $"{nodeId}#active",
+                    AlarmType: "ALMD",
+                    Message: $"ALMD {nodeId} raised",
+                    Severity: MapSeverity(severity),
+                    SourceTimestampUtc: DateTime.UtcNow));
+            }
+            else if (wasFaulted && !nowFaulted)
+            {
+                _driver.InvokeAlarmEvent(new AlarmEventArgs(
+                    sub.Handle, nodeId, ConditionId: $"{nodeId}#active",
+                    AlarmType: "ALMD",
+                    Message: $"ALMD {nodeId} cleared",
+                    Severity: MapSeverity(severity),
+                    SourceTimestampUtc: DateTime.UtcNow));
+            }
+        }
+    }
+
+    private async Task RunPollLoopAsync(Subscription sub, CancellationToken ct)
+    {
+        var refs = new List<string>(sub.SourceNodeIds.Count * 2);
+        foreach (var nodeId in sub.SourceNodeIds)
+        {
+            refs.Add($"{nodeId}.InFaulted");
+            refs.Add($"{nodeId}.Severity");
+        }
+
+        while (!ct.IsCancellationRequested)
+        {
+            try
+            {
+                var results = await _driver.ReadAsync(refs, ct).ConfigureAwait(false);
+                Tick(sub, results);
+            }
+            catch (OperationCanceledException) when (ct.IsCancellationRequested) { break; }
+            catch { /* per-tick failures are non-fatal; next tick retries */ }
+
+            try { await Task.Delay(_pollInterval, ct).ConfigureAwait(false); }
+            catch (OperationCanceledException) { break; }
+        }
+    }
+
+    internal static AlarmSeverity MapSeverity(int raw) => raw switch
+    {
+        <= 250 => AlarmSeverity.Low,
+        <= 500 => AlarmSeverity.Medium,
+        <= 750 => AlarmSeverity.High,
+        _ => AlarmSeverity.Critical,
+    };
+
+    private static bool ToBool(object? v) => v switch
+    {
+        bool b => b,
+        int i => i != 0,
+        long l => l != 0,
+        _ => false,
+    };
+
+    private static int ToInt(object? v) => v switch
+    {
+        int i => i,
+        long l => (int)l,
+        short s => s,
+        byte b => b,
+        _ => 0,
+    };
+
+    internal sealed class Subscription
+    {
+        public Subscription(AbCipAlarmSubscriptionHandle handle, IReadOnlyList<string> sourceNodeIds, CancellationTokenSource cts)
+        {
+            Handle = handle; SourceNodeIds = sourceNodeIds; Cts = cts;
+        }
+        public AbCipAlarmSubscriptionHandle Handle { get; }
+        public IReadOnlyList<string> SourceNodeIds { get; }
+        public CancellationTokenSource Cts { get; }
+        public Task Loop { get; set; } = Task.CompletedTask;
+        public Dictionary<string, bool> LastInFaulted { get; } = new(StringComparer.Ordinal);
+    }
+}
+
+/// <summary>Handle returned by <see cref="AbCipAlarmProjection.SubscribeAsync"/>.</summary>
+public sealed record AbCipAlarmSubscriptionHandle(long Id) : IAlarmSubscriptionHandle
+{
+    public string DiagnosticId => $"abcip-alarm-sub-{Id}";
+}
+
+/// <summary>
+///     Detects the ALMD / ALMA signature in an <see cref="AbCipTagDefinition"/>'s declared
+///     members. Used by both discovery (to stamp <c>IsAlarm=true</c> on the emitted
+///     variable) + initial driver setup (to decide which tags the alarm projection owns).
+/// </summary>
+public static class AbCipAlarmDetector
+{
+    /// <summary>
+    ///     <c>true</c> when <paramref name="tag"/> is a Structure whose declared members match
+    ///     the ALMD signature (<c>InFaulted</c> + <c>Acked</c> present). ALMA detection
+    ///     (analog alarms with <c>HHLimit</c>/<c>HLimit</c>/<c>LLimit</c>/<c>LLLimit</c>)
+    ///     ships as a follow-up.
+    /// </summary>
+    public static bool IsAlmd(AbCipTagDefinition tag)
+    {
+        if (tag.DataType != AbCipDataType.Structure || tag.Members is null) return false;
+        var names = tag.Members.Select(m => m.Name).ToHashSet(StringComparer.OrdinalIgnoreCase);
+        return names.Contains("InFaulted") && names.Contains("Acked");
+    }
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipDataType.cs

@@ -0,0 +1,61 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Logix atomic + string data types, plus a <see cref="Structure"/> marker used when a tag
+///     references a UDT / predefined structure (Timer, Counter, Control). The concrete UDT
+///     shape is resolved via the CIP Template Object at discovery time (PR 5 / PR 6).
+/// </summary>
+/// <remarks>
+///     Mirrors the shape of <c>ModbusDataType</c>. Atomic Logix names (BOOL / SINT / INT / DINT /
+///     LINT / REAL / LREAL / STRING / DT) map one-to-one; BIT + BOOL-in-DINT collapse into
+///     <see cref="Bool"/> with the <c>.N</c> bit-index carried on the <see cref="AbCipTagPath"/>
+///     rather than the data type itself.
+/// </remarks>
+public enum AbCipDataType
+{
+    Bool,
+    SInt,   // signed 8-bit
+    Int,    // signed 16-bit
+    DInt,   // signed 32-bit
+    LInt,   // signed 64-bit
+    USInt,  // unsigned 8-bit (Logix 5000 post-V21)
+    UInt,   // unsigned 16-bit
+    UDInt,  // unsigned 32-bit
+    ULInt,  // unsigned 64-bit
+    Real,   // 32-bit IEEE-754
+    LReal,  // 64-bit IEEE-754
+    String, // Logix STRING (DINT Length + SINT[82] DATA — flattened to .NET string by libplctag)
+    Dt,     // Date/Time — Logix DT == DINT representing seconds-since-epoch per Rockwell conventions
+    /// <summary>
+    ///     UDT / Predefined Structure (Timer / Counter / Control / Message / Axis). Shape is
+    ///     resolved at discovery time; reads + writes fan out to member Variables unless the
+    ///     caller has explicitly opted into whole-UDT decode.
+    /// </summary>
+    Structure,
+}
+
+/// <summary>Map a Logix atomic type to the driver-surface <see cref="DriverDataType"/>.</summary>
+public static class AbCipDataTypeExtensions
+{
+    /// <summary>
+    ///     Map to the driver-agnostic type the server's address-space builder consumes. Unsigned
+    ///     Logix types widen into signed equivalents until <c>DriverDataType</c> picks up unsigned
+    ///     + 64-bit variants (Modbus has the same gap — see <c>ModbusDriver.MapDataType</c>
+    ///     comment re: PR 25).
+    /// </summary>
+    public static DriverDataType ToDriverDataType(this AbCipDataType t) => t switch
+    {
+        AbCipDataType.Bool => DriverDataType.Boolean,
+        AbCipDataType.SInt or AbCipDataType.Int or AbCipDataType.DInt => DriverDataType.Int32,
+        AbCipDataType.USInt or AbCipDataType.UInt or AbCipDataType.UDInt => DriverDataType.Int32,
+        AbCipDataType.LInt or AbCipDataType.ULInt => DriverDataType.Int32, // TODO: Int64 — matches Modbus gap
+        AbCipDataType.Real => DriverDataType.Float32,
+        AbCipDataType.LReal => DriverDataType.Float64,
+        AbCipDataType.String => DriverDataType.String,
+        AbCipDataType.Dt => DriverDataType.Int32, // epoch-seconds DINT
+        AbCipDataType.Structure => DriverDataType.String, // placeholder until UDT PR 6 introduces a structured kind
+        _ => DriverDataType.Int32,
+    };
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipDriver.cs

@@ -0,0 +1,840 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip.PlcFamilies;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Allen-Bradley CIP / EtherNet-IP driver for ControlLogix / CompactLogix / Micro800 /
+///     GuardLogix families. Implements <see cref="IDriver"/> only for now — read/write/
+///     subscribe/discover capabilities ship in subsequent PRs (3–8) and family-specific quirk
+///     profiles ship in PRs 9–12.
+/// </summary>
+/// <remarks>
+///     <para>Wire layer is libplctag 1.6.x (plan decision #11). Per-device host addresses use
+///     the <c>ab://gateway[:port]/cip-path</c> canonical form parsed via
+///     <see cref="AbCipHostAddress.TryParse"/>; those strings become the <c>hostName</c> key
+///     for Polly bulkhead + circuit-breaker isolation per plan decision #144.</para>
+///
+///     <para>Tier A per plan decisions #143–145 — in-process, shares server lifetime, no
+///     sidecar. <see cref="ReinitializeAsync"/> is the Tier-B escape hatch for recovering
+///     from native-heap growth that the CLR allocator can't see; it tears down every
+///     <see cref="PlcTagHandle"/> and reconnects each device.</para>
+/// </remarks>
+public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery, ISubscribable,
+    IHostConnectivityProbe, IPerCallHostResolver, IAlarmSource, IDisposable, IAsyncDisposable
+{
+    private readonly AbCipDriverOptions _options;
+    private readonly string _driverInstanceId;
+    private readonly IAbCipTagFactory _tagFactory;
+    private readonly IAbCipTagEnumeratorFactory _enumeratorFactory;
+    private readonly IAbCipTemplateReaderFactory _templateReaderFactory;
+    private readonly AbCipTemplateCache _templateCache = new();
+    private readonly PollGroupEngine _poll;
+    private readonly Dictionary<string, DeviceState> _devices = new(StringComparer.OrdinalIgnoreCase);
+    private readonly Dictionary<string, AbCipTagDefinition> _tagsByName = new(StringComparer.OrdinalIgnoreCase);
+    private readonly AbCipAlarmProjection _alarmProjection;
+    private DriverHealth _health = new(DriverState.Unknown, null, null);
+
+    public event EventHandler<DataChangeEventArgs>? OnDataChange;
+    public event EventHandler<HostStatusChangedEventArgs>? OnHostStatusChanged;
+    public event EventHandler<AlarmEventArgs>? OnAlarmEvent;
+
+    /// <summary>Internal seam for the alarm projection to raise events through the driver.</summary>
+    internal void InvokeAlarmEvent(AlarmEventArgs args) => OnAlarmEvent?.Invoke(this, args);
+
+    public AbCipDriver(AbCipDriverOptions options, string driverInstanceId,
+        IAbCipTagFactory? tagFactory = null,
+        IAbCipTagEnumeratorFactory? enumeratorFactory = null,
+        IAbCipTemplateReaderFactory? templateReaderFactory = null)
+    {
+        ArgumentNullException.ThrowIfNull(options);
+        _options = options;
+        _driverInstanceId = driverInstanceId;
+        _tagFactory = tagFactory ?? new LibplctagTagFactory();
+        _enumeratorFactory = enumeratorFactory ?? new LibplctagTagEnumeratorFactory();
+        _templateReaderFactory = templateReaderFactory ?? new LibplctagTemplateReaderFactory();
+        _poll = new PollGroupEngine(
+            reader: ReadAsync,
+            onChange: (handle, tagRef, snapshot) =>
+                OnDataChange?.Invoke(this, new DataChangeEventArgs(handle, tagRef, snapshot)));
+        _alarmProjection = new AbCipAlarmProjection(this, _options.AlarmPollInterval);
+    }
+
+    /// <summary>
+    ///     Fetch + cache the shape of a Logix UDT by template instance id. First call reads
+    ///     the Template Object off the controller; subsequent calls for the same
+    ///     <c>(deviceHostAddress, templateInstanceId)</c> return the cached shape without
+    ///     additional network traffic. <c>null</c> on template-not-found / decode failure so
+    ///     callers can fall back to declaration-driven UDT fan-out.
+    /// </summary>
+    internal async Task<AbCipUdtShape?> FetchUdtShapeAsync(
+        string deviceHostAddress, uint templateInstanceId, CancellationToken cancellationToken)
+    {
+        var cached = _templateCache.TryGet(deviceHostAddress, templateInstanceId);
+        if (cached is not null) return cached;
+
+        if (!_devices.TryGetValue(deviceHostAddress, out var device)) return null;
+
+        var deviceParams = new AbCipTagCreateParams(
+            Gateway: device.ParsedAddress.Gateway,
+            Port: device.ParsedAddress.Port,
+            CipPath: device.ParsedAddress.CipPath,
+            LibplctagPlcAttribute: device.Profile.LibplctagPlcAttribute,
+            TagName: $"@udt/{templateInstanceId}",
+            Timeout: _options.Timeout);
+
+        try
+        {
+            using var reader = _templateReaderFactory.Create();
+            var buffer = await reader.ReadAsync(deviceParams, templateInstanceId, cancellationToken).ConfigureAwait(false);
+            var shape = CipTemplateObjectDecoder.Decode(buffer);
+            if (shape is not null)
+                _templateCache.Put(deviceHostAddress, templateInstanceId, shape);
+            return shape;
+        }
+        catch (OperationCanceledException) { throw; }
+        catch
+        {
+            // Template read failure — log via the driver's health surface so operators see it,
+            // but don't propagate since callers should fall back to declaration-driven UDT
+            // semantics rather than failing the whole discovery run.
+            return null;
+        }
+    }
+
+    /// <summary>Shared UDT template cache. Exposed for PR 6 (UDT reader) + diagnostics.</summary>
+    internal AbCipTemplateCache TemplateCache => _templateCache;
+
+    public string DriverInstanceId => _driverInstanceId;
+    public string DriverType => "AbCip";
+
+    public Task InitializeAsync(string driverConfigJson, CancellationToken cancellationToken)
+    {
+        _health = new DriverHealth(DriverState.Initializing, null, null);
+        try
+        {
+            foreach (var device in _options.Devices)
+            {
+                var addr = AbCipHostAddress.TryParse(device.HostAddress)
+                    ?? throw new InvalidOperationException(
+                        $"AbCip device has invalid HostAddress '{device.HostAddress}' — expected 'ab://gateway[:port]/cip-path'.");
+                var profile = AbCipPlcFamilyProfile.ForFamily(device.PlcFamily);
+                _devices[device.HostAddress] = new DeviceState(addr, device, profile);
+            }
+            foreach (var tag in _options.Tags)
+            {
+                _tagsByName[tag.Name] = tag;
+                if (tag.DataType == AbCipDataType.Structure && tag.Members is { Count: > 0 })
+                {
+                    foreach (var member in tag.Members)
+                    {
+                        var memberTag = new AbCipTagDefinition(
+                            Name: $"{tag.Name}.{member.Name}",
+                            DeviceHostAddress: tag.DeviceHostAddress,
+                            TagPath: $"{tag.TagPath}.{member.Name}",
+                            DataType: member.DataType,
+                            Writable: member.Writable,
+                            WriteIdempotent: member.WriteIdempotent);
+                        _tagsByName[memberTag.Name] = memberTag;
+                    }
+                }
+            }
+
+            // Probe loops — one per device when enabled + a ProbeTagPath is configured.
+            if (_options.Probe.Enabled && !string.IsNullOrWhiteSpace(_options.Probe.ProbeTagPath))
+            {
+                foreach (var state in _devices.Values)
+                {
+                    state.ProbeCts = new CancellationTokenSource();
+                    var ct = state.ProbeCts.Token;
+                    _ = Task.Run(() => ProbeLoopAsync(state, ct), ct);
+                }
+            }
+            _health = new DriverHealth(DriverState.Healthy, DateTime.UtcNow, null);
+        }
+        catch (Exception ex)
+        {
+            _health = new DriverHealth(DriverState.Faulted, null, ex.Message);
+            throw;
+        }
+        return Task.CompletedTask;
+    }
+
+    public async Task ReinitializeAsync(string driverConfigJson, CancellationToken cancellationToken)
+    {
+        await ShutdownAsync(cancellationToken).ConfigureAwait(false);
+        await InitializeAsync(driverConfigJson, cancellationToken).ConfigureAwait(false);
+    }
+
+    public async Task ShutdownAsync(CancellationToken cancellationToken)
+    {
+        await _alarmProjection.DisposeAsync().ConfigureAwait(false);
+        await _poll.DisposeAsync().ConfigureAwait(false);
+        foreach (var state in _devices.Values)
+        {
+            try { state.ProbeCts?.Cancel(); } catch { }
+            state.ProbeCts?.Dispose();
+            state.ProbeCts = null;
+            state.DisposeHandles();
+        }
+        _devices.Clear();
+        _tagsByName.Clear();
+        _health = new DriverHealth(DriverState.Unknown, _health.LastSuccessfulRead, null);
+    }
+
+    // ---- ISubscribable (polling overlay via shared engine) ----
+
+    public Task<ISubscriptionHandle> SubscribeAsync(
+        IReadOnlyList<string> fullReferences, TimeSpan publishingInterval, CancellationToken cancellationToken) =>
+        Task.FromResult(_poll.Subscribe(fullReferences, publishingInterval));
+
+    public Task UnsubscribeAsync(ISubscriptionHandle handle, CancellationToken cancellationToken)
+    {
+        _poll.Unsubscribe(handle);
+        return Task.CompletedTask;
+    }
+
+    // ---- IAlarmSource (ALMD projection, #177) ----
+
+    /// <summary>
+    ///     Subscribe to ALMD alarm transitions on <paramref name="sourceNodeIds"/>. Each id
+    ///     names a declared ALMD UDT tag; the projection polls the tag's <c>InFaulted</c> +
+    ///     <c>Severity</c> members at <see cref="AbCipDriverOptions.AlarmPollInterval"/> and
+    ///     fires <see cref="OnAlarmEvent"/> on 0→1 (raise) + 1→0 (clear) transitions.
+    ///     Feature-gated — when <see cref="AbCipDriverOptions.EnableAlarmProjection"/> is
+    ///     <c>false</c> (the default), returns a handle wrapping a no-op subscription so
+    ///     capability negotiation still works; <see cref="OnAlarmEvent"/> never fires.
+    /// </summary>
+    public Task<IAlarmSubscriptionHandle> SubscribeAlarmsAsync(
+        IReadOnlyList<string> sourceNodeIds, CancellationToken cancellationToken)
+    {
+        if (!_options.EnableAlarmProjection)
+        {
+            var disabled = new AbCipAlarmSubscriptionHandle(0);
+            return Task.FromResult<IAlarmSubscriptionHandle>(disabled);
+        }
+        return _alarmProjection.SubscribeAsync(sourceNodeIds, cancellationToken);
+    }
+
+    public Task UnsubscribeAlarmsAsync(IAlarmSubscriptionHandle handle, CancellationToken cancellationToken) =>
+        _options.EnableAlarmProjection
+            ? _alarmProjection.UnsubscribeAsync(handle, cancellationToken)
+            : Task.CompletedTask;
+
+    public Task AcknowledgeAsync(
+        IReadOnlyList<AlarmAcknowledgeRequest> acknowledgements, CancellationToken cancellationToken) =>
+        _options.EnableAlarmProjection
+            ? _alarmProjection.AcknowledgeAsync(acknowledgements, cancellationToken)
+            : Task.CompletedTask;
+
+    // ---- IHostConnectivityProbe ----
+
+    public IReadOnlyList<HostConnectivityStatus> GetHostStatuses() =>
+        [.. _devices.Values.Select(s => new HostConnectivityStatus(s.Options.HostAddress, s.HostState, s.HostStateChangedUtc))];
+
+    private async Task ProbeLoopAsync(DeviceState state, CancellationToken ct)
+    {
+        var probeParams = new AbCipTagCreateParams(
+            Gateway: state.ParsedAddress.Gateway,
+            Port: state.ParsedAddress.Port,
+            CipPath: state.ParsedAddress.CipPath,
+            LibplctagPlcAttribute: state.Profile.LibplctagPlcAttribute,
+            TagName: _options.Probe.ProbeTagPath!,
+            Timeout: _options.Probe.Timeout);
+
+        IAbCipTagRuntime? probeRuntime = null;
+        while (!ct.IsCancellationRequested)
+        {
+            var success = false;
+            try
+            {
+                probeRuntime ??= _tagFactory.Create(probeParams);
+                // Lazy-init on first attempt; re-init after a transport failure has caused the
+                // native handle to be destroyed.
+                if (!state.ProbeInitialized)
+                {
+                    await probeRuntime.InitializeAsync(ct).ConfigureAwait(false);
+                    state.ProbeInitialized = true;
+                }
+                await probeRuntime.ReadAsync(ct).ConfigureAwait(false);
+                success = probeRuntime.GetStatus() == 0;
+            }
+            catch (OperationCanceledException) when (ct.IsCancellationRequested)
+            {
+                break;
+            }
+            catch
+            {
+                // Wire / init error — tear down the probe runtime so the next tick re-creates it.
+                try { probeRuntime?.Dispose(); } catch { }
+                probeRuntime = null;
+                state.ProbeInitialized = false;
+            }
+
+            TransitionDeviceState(state, success ? HostState.Running : HostState.Stopped);
+
+            try { await Task.Delay(_options.Probe.Interval, ct).ConfigureAwait(false); }
+            catch (OperationCanceledException) { break; }
+        }
+
+        try { probeRuntime?.Dispose(); } catch { }
+    }
+
+    private void TransitionDeviceState(DeviceState state, HostState newState)
+    {
+        HostState old;
+        lock (state.ProbeLock)
+        {
+            old = state.HostState;
+            if (old == newState) return;
+            state.HostState = newState;
+            state.HostStateChangedUtc = DateTime.UtcNow;
+        }
+        OnHostStatusChanged?.Invoke(this,
+            new HostStatusChangedEventArgs(state.Options.HostAddress, old, newState));
+    }
+
+    // ---- IPerCallHostResolver ----
+
+    /// <summary>
+    ///     Resolve the device host address for a given tag full-reference. Per plan decision #144
+    ///     the Phase 6.1 resilience pipeline keys its bulkhead + breaker on
+    ///     <c>(DriverInstanceId, hostName)</c> so multi-PLC drivers get per-device isolation —
+    ///     one dead PLC trips only its own breaker. Unknown references fall back to the
+    ///     first configured device's host address rather than throwing — the invoker handles the
+    ///     mislookup at the capability level when the actual read returns BadNodeIdUnknown.
+    /// </summary>
+    public string ResolveHost(string fullReference)
+    {
+        if (_tagsByName.TryGetValue(fullReference, out var def))
+            return def.DeviceHostAddress;
+        return _options.Devices.FirstOrDefault()?.HostAddress ?? DriverInstanceId;
+    }
+
+    // ---- IReadable ----
+
+    /// <summary>
+    ///     Read each <c>fullReference</c> in order. Unknown tags surface as
+    ///     <c>BadNodeIdUnknown</c>; libplctag-layer failures map through
+    ///     <see cref="AbCipStatusMapper.MapLibplctagStatus"/>; any other exception becomes
+    ///     <c>BadCommunicationError</c>. The driver health surface is updated per-call so the
+    ///     Admin UI sees a tight feedback loop between read failures + the driver's state.
+    /// </summary>
+    public async Task<IReadOnlyList<DataValueSnapshot>> ReadAsync(
+        IReadOnlyList<string> fullReferences, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(fullReferences);
+        var now = DateTime.UtcNow;
+        var results = new DataValueSnapshot[fullReferences.Count];
+
+        // Task #194 — plan the batch: members of the same parent UDT get collapsed into one
+        // whole-UDT read + in-memory member decode; every other reference falls back to the
+        // per-tag path that's been here since PR 3. Planner is a pure function over the
+        // current tag map; BOOL/String/Structure members stay on the fallback path because
+        // declaration-only offsets can't place them under Logix alignment rules.
+        var plan = AbCipUdtReadPlanner.Build(fullReferences, _tagsByName);
+
+        foreach (var group in plan.Groups)
+            await ReadGroupAsync(group, results, now, cancellationToken).ConfigureAwait(false);
+
+        foreach (var fb in plan.Fallbacks)
+            await ReadSingleAsync(fb, fullReferences[fb.OriginalIndex], results, now, cancellationToken).ConfigureAwait(false);
+
+        return results;
+    }
+
+    private async Task ReadSingleAsync(
+        AbCipUdtReadFallback fb, string reference, DataValueSnapshot[] results, DateTime now, CancellationToken ct)
+    {
+        if (!_tagsByName.TryGetValue(reference, out var def))
+        {
+            results[fb.OriginalIndex] = new DataValueSnapshot(null, AbCipStatusMapper.BadNodeIdUnknown, null, now);
+            return;
+        }
+        if (!_devices.TryGetValue(def.DeviceHostAddress, out var device))
+        {
+            results[fb.OriginalIndex] = new DataValueSnapshot(null, AbCipStatusMapper.BadNodeIdUnknown, null, now);
+            return;
+        }
+
+        try
+        {
+            var runtime = await EnsureTagRuntimeAsync(device, def, ct).ConfigureAwait(false);
+            await runtime.ReadAsync(ct).ConfigureAwait(false);
+
+            var status = runtime.GetStatus();
+            if (status != 0)
+            {
+                results[fb.OriginalIndex] = new DataValueSnapshot(null,
+                    AbCipStatusMapper.MapLibplctagStatus(status), null, now);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead,
+                    $"libplctag status {status} reading {reference}");
+                return;
+            }
+
+            var tagPath = AbCipTagPath.TryParse(def.TagPath);
+            var bitIndex = tagPath?.BitIndex;
+            var value = runtime.DecodeValue(def.DataType, bitIndex);
+            results[fb.OriginalIndex] = new DataValueSnapshot(value, AbCipStatusMapper.Good, now, now);
+            _health = new DriverHealth(DriverState.Healthy, now, null);
+        }
+        catch (OperationCanceledException)
+        {
+            throw;
+        }
+        catch (Exception ex)
+        {
+            results[fb.OriginalIndex] = new DataValueSnapshot(null,
+                AbCipStatusMapper.BadCommunicationError, null, now);
+            _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
+        }
+    }
+
+    /// <summary>
+    ///     Task #194 — perform one whole-UDT read on the parent tag, then decode each
+    ///     grouped member from the runtime's buffer at its computed byte offset. A per-group
+    ///     failure (parent read raised, non-zero libplctag status, or missing device) stamps
+    ///     the mapped fault across every grouped member only — sibling groups + the
+    ///     per-tag fallback list are unaffected.
+    /// </summary>
+    private async Task ReadGroupAsync(
+        AbCipUdtReadGroup group, DataValueSnapshot[] results, DateTime now, CancellationToken ct)
+    {
+        var parent = group.ParentDefinition;
+
+        if (!_devices.TryGetValue(parent.DeviceHostAddress, out var device))
+        {
+            StampGroupStatus(group, results, now, AbCipStatusMapper.BadNodeIdUnknown);
+            return;
+        }
+
+        try
+        {
+            var runtime = await EnsureTagRuntimeAsync(device, parent, ct).ConfigureAwait(false);
+            await runtime.ReadAsync(ct).ConfigureAwait(false);
+
+            var status = runtime.GetStatus();
+            if (status != 0)
+            {
+                var mapped = AbCipStatusMapper.MapLibplctagStatus(status);
+                StampGroupStatus(group, results, now, mapped);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead,
+                    $"libplctag status {status} reading UDT {group.ParentName}");
+                return;
+            }
+
+            foreach (var member in group.Members)
+            {
+                var value = runtime.DecodeValueAt(member.Definition.DataType, member.Offset, bitIndex: null);
+                results[member.OriginalIndex] = new DataValueSnapshot(value, AbCipStatusMapper.Good, now, now);
+            }
+            _health = new DriverHealth(DriverState.Healthy, now, null);
+        }
+        catch (OperationCanceledException)
+        {
+            throw;
+        }
+        catch (Exception ex)
+        {
+            StampGroupStatus(group, results, now, AbCipStatusMapper.BadCommunicationError);
+            _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
+        }
+    }
+
+    private static void StampGroupStatus(
+        AbCipUdtReadGroup group, DataValueSnapshot[] results, DateTime now, uint statusCode)
+    {
+        foreach (var member in group.Members)
+            results[member.OriginalIndex] = new DataValueSnapshot(null, statusCode, null, now);
+    }
+
+    // ---- IWritable ----
+
+    /// <summary>
+    ///     Write each request in order. Writes are NOT auto-retried by the driver — per plan
+    ///     decisions #44, #45, #143 the caller opts in via <see cref="AbCipTagDefinition.WriteIdempotent"/>
+    ///     and the resilience pipeline (layered above the driver) decides whether to replay.
+    ///     Non-writable configurations surface as <c>BadNotWritable</c>; type-conversion failures
+    ///     as <c>BadTypeMismatch</c>; transport errors as <c>BadCommunicationError</c>.
+    /// </summary>
+    public async Task<IReadOnlyList<WriteResult>> WriteAsync(
+        IReadOnlyList<WriteRequest> writes, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(writes);
+        var results = new WriteResult[writes.Count];
+        var now = DateTime.UtcNow;
+
+        for (var i = 0; i < writes.Count; i++)
+        {
+            var w = writes[i];
+            if (!_tagsByName.TryGetValue(w.FullReference, out var def))
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadNodeIdUnknown);
+                continue;
+            }
+            if (!def.Writable || def.SafetyTag)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadNotWritable);
+                continue;
+            }
+            if (!_devices.TryGetValue(def.DeviceHostAddress, out var device))
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadNodeIdUnknown);
+                continue;
+            }
+
+            try
+            {
+                var parsedPath = AbCipTagPath.TryParse(def.TagPath);
+
+                // BOOL-within-DINT writes — per task #181, RMW against a parallel parent-DINT
+                // runtime. Dispatching here keeps the normal EncodeValue path clean; the
+                // per-parent lock prevents two concurrent bit writes to the same DINT from
+                // losing one another's update.
+                if (def.DataType == AbCipDataType.Bool && parsedPath?.BitIndex is int bit)
+                {
+                    results[i] = new WriteResult(
+                        await WriteBitInDIntAsync(device, parsedPath, bit, w.Value, cancellationToken)
+                            .ConfigureAwait(false));
+                    if (results[i].StatusCode == AbCipStatusMapper.Good)
+                        _health = new DriverHealth(DriverState.Healthy, now, null);
+                    continue;
+                }
+
+                var runtime = await EnsureTagRuntimeAsync(device, def, cancellationToken).ConfigureAwait(false);
+                runtime.EncodeValue(def.DataType, parsedPath?.BitIndex, w.Value);
+                await runtime.WriteAsync(cancellationToken).ConfigureAwait(false);
+
+                var status = runtime.GetStatus();
+                results[i] = new WriteResult(status == 0
+                    ? AbCipStatusMapper.Good
+                    : AbCipStatusMapper.MapLibplctagStatus(status));
+                if (status == 0) _health = new DriverHealth(DriverState.Healthy, now, null);
+            }
+            catch (OperationCanceledException)
+            {
+                throw;
+            }
+            catch (NotSupportedException nse)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadNotSupported);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, nse.Message);
+            }
+            catch (FormatException fe)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadTypeMismatch);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, fe.Message);
+            }
+            catch (InvalidCastException ice)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadTypeMismatch);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ice.Message);
+            }
+            catch (OverflowException oe)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadOutOfRange);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, oe.Message);
+            }
+            catch (Exception ex)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadCommunicationError);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
+            }
+        }
+
+        return results;
+    }
+
+    /// <summary>
+    ///     Read-modify-write one bit within a DINT parent. Creates / reuses a parallel
+    ///     parent-DINT runtime (distinct from the bit-selector handle) + serialises concurrent
+    ///     writers against the same parent via a per-parent <see cref="SemaphoreSlim"/>.
+    ///     Matches the Modbus BitInRegister + FOCAS PMC Bit pattern shipped in pass 1 of task #181.
+    /// </summary>
+    private async Task<uint> WriteBitInDIntAsync(
+        DeviceState device, AbCipTagPath bitPath, int bit, object? value, CancellationToken ct)
+    {
+        var parentPath = bitPath with { BitIndex = null };
+        var parentName = parentPath.ToLibplctagName();
+
+        var rmwLock = device.GetRmwLock(parentName);
+        await rmwLock.WaitAsync(ct).ConfigureAwait(false);
+        try
+        {
+            var parentRuntime = await EnsureParentRuntimeAsync(device, parentName, ct).ConfigureAwait(false);
+            await parentRuntime.ReadAsync(ct).ConfigureAwait(false);
+            var readStatus = parentRuntime.GetStatus();
+            if (readStatus != 0) return AbCipStatusMapper.MapLibplctagStatus(readStatus);
+
+            var current = Convert.ToInt32(parentRuntime.DecodeValue(AbCipDataType.DInt, bitIndex: null) ?? 0);
+            var updated = Convert.ToBoolean(value)
+                ? current | (1 << bit)
+                : current & ~(1 << bit);
+
+            parentRuntime.EncodeValue(AbCipDataType.DInt, bitIndex: null, updated);
+            await parentRuntime.WriteAsync(ct).ConfigureAwait(false);
+            var writeStatus = parentRuntime.GetStatus();
+            return writeStatus == 0
+                ? AbCipStatusMapper.Good
+                : AbCipStatusMapper.MapLibplctagStatus(writeStatus);
+        }
+        finally
+        {
+            rmwLock.Release();
+        }
+    }
+
+    /// <summary>
+    ///     Get or lazily create a parent-DINT runtime for a parent tag path, cached per-device
+    ///     so repeated bit writes against the same DINT share one handle.
+    /// </summary>
+    private async Task<IAbCipTagRuntime> EnsureParentRuntimeAsync(
+        DeviceState device, string parentTagName, CancellationToken ct)
+    {
+        if (device.ParentRuntimes.TryGetValue(parentTagName, out var existing)) return existing;
+
+        var runtime = _tagFactory.Create(new AbCipTagCreateParams(
+            Gateway: device.ParsedAddress.Gateway,
+            Port: device.ParsedAddress.Port,
+            CipPath: device.ParsedAddress.CipPath,
+            LibplctagPlcAttribute: device.Profile.LibplctagPlcAttribute,
+            TagName: parentTagName,
+            Timeout: _options.Timeout));
+        try
+        {
+            await runtime.InitializeAsync(ct).ConfigureAwait(false);
+        }
+        catch
+        {
+            runtime.Dispose();
+            throw;
+        }
+        device.ParentRuntimes[parentTagName] = runtime;
+        return runtime;
+    }
+
+    /// <summary>
+    ///     Idempotently materialise the runtime handle for a tag definition. First call creates
+    ///     + initialises the libplctag Tag; subsequent calls reuse the cached handle for the
+    ///     lifetime of the device.
+    /// </summary>
+    private async Task<IAbCipTagRuntime> EnsureTagRuntimeAsync(
+        DeviceState device, AbCipTagDefinition def, CancellationToken ct)
+    {
+        if (device.Runtimes.TryGetValue(def.Name, out var existing)) return existing;
+
+        var parsed = AbCipTagPath.TryParse(def.TagPath)
+            ?? throw new InvalidOperationException(
+                $"AbCip tag '{def.Name}' has malformed TagPath '{def.TagPath}'.");
+
+        var runtime = _tagFactory.Create(new AbCipTagCreateParams(
+            Gateway: device.ParsedAddress.Gateway,
+            Port: device.ParsedAddress.Port,
+            CipPath: device.ParsedAddress.CipPath,
+            LibplctagPlcAttribute: device.Profile.LibplctagPlcAttribute,
+            TagName: parsed.ToLibplctagName(),
+            Timeout: _options.Timeout));
+        try
+        {
+            await runtime.InitializeAsync(ct).ConfigureAwait(false);
+        }
+        catch
+        {
+            runtime.Dispose();
+            throw;
+        }
+        device.Runtimes[def.Name] = runtime;
+        return runtime;
+    }
+
+    public DriverHealth GetHealth() => _health;
+
+    /// <summary>
+    ///     CLR-visible allocation footprint only — libplctag's native heap is invisible to the
+    ///     GC. driver-specs.md §3 flags this: operators must watch whole-process RSS for the
+    ///     full picture, and <see cref="ReinitializeAsync"/> is the Tier-B remediation.
+    /// </summary>
+    public long GetMemoryFootprint() => 0;
+
+    public Task FlushOptionalCachesAsync(CancellationToken cancellationToken)
+    {
+        _templateCache.Clear();
+        return Task.CompletedTask;
+    }
+
+    // ---- ITagDiscovery ----
+
+    /// <summary>
+    ///     Stream the driver's tag set into the builder. Pre-declared tags from
+    ///     <see cref="AbCipDriverOptions.Tags"/> emit first; optionally, the
+    ///     <see cref="IAbCipTagEnumerator"/> walks each device's symbol table and adds
+    ///     controller-discovered tags under a <c>Discovered/</c> sub-folder. System / module /
+    ///     routine / task tags are hidden via <see cref="AbCipSystemTagFilter"/>.
+    /// </summary>
+    public async Task DiscoverAsync(IAddressSpaceBuilder builder, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(builder);
+        var root = builder.Folder("AbCip", "AbCip");
+
+        foreach (var device in _options.Devices)
+        {
+            var deviceLabel = device.DeviceName ?? device.HostAddress;
+            var deviceFolder = root.Folder(device.HostAddress, deviceLabel);
+
+            // Pre-declared tags — always emitted; the primary config path. UDT tags with declared
+            // Members fan out into a sub-folder + one Variable per member instead of a single
+            // Structure Variable (Structure has no useful scalar value + member-addressable paths
+            // are what downstream consumers actually want).
+            var preDeclared = _options.Tags.Where(t =>
+                string.Equals(t.DeviceHostAddress, device.HostAddress, StringComparison.OrdinalIgnoreCase));
+            foreach (var tag in preDeclared)
+            {
+                if (AbCipSystemTagFilter.IsSystemTag(tag.Name)) continue;
+
+                if (tag.DataType == AbCipDataType.Structure && tag.Members is { Count: > 0 })
+                {
+                    var udtFolder = deviceFolder.Folder(tag.Name, tag.Name);
+                    foreach (var member in tag.Members)
+                    {
+                        var memberFullName = $"{tag.Name}.{member.Name}";
+                        udtFolder.Variable(member.Name, member.Name, new DriverAttributeInfo(
+                            FullName: memberFullName,
+                            DriverDataType: member.DataType.ToDriverDataType(),
+                            IsArray: false,
+                            ArrayDim: null,
+                            SecurityClass: member.Writable
+                                ? SecurityClassification.Operate
+                                : SecurityClassification.ViewOnly,
+                            IsHistorized: false,
+                            IsAlarm: false,
+                            WriteIdempotent: member.WriteIdempotent));
+                    }
+                    continue;
+                }
+
+                deviceFolder.Variable(tag.Name, tag.Name, ToAttributeInfo(tag));
+            }
+
+            // Controller-discovered tags — opt-in via EnableControllerBrowse. The real @tags
+            // walker (LibplctagTagEnumerator) is the factory default since task #178 shipped,
+            // so leaving the flag off keeps the strict-config path for deployments where only
+            // declared tags should appear.
+            if (_options.EnableControllerBrowse && _devices.TryGetValue(device.HostAddress, out var state))
+            {
+                using var enumerator = _enumeratorFactory.Create();
+                var deviceParams = new AbCipTagCreateParams(
+                    Gateway: state.ParsedAddress.Gateway,
+                    Port: state.ParsedAddress.Port,
+                    CipPath: state.ParsedAddress.CipPath,
+                    LibplctagPlcAttribute: state.Profile.LibplctagPlcAttribute,
+                    TagName: "@tags",
+                    Timeout: _options.Timeout);
+
+                IAddressSpaceBuilder? discoveredFolder = null;
+                await foreach (var discovered in enumerator.EnumerateAsync(deviceParams, cancellationToken)
+                    .ConfigureAwait(false))
+                {
+                    if (discovered.IsSystemTag) continue;
+                    if (AbCipSystemTagFilter.IsSystemTag(discovered.Name)) continue;
+
+                    discoveredFolder ??= deviceFolder.Folder("Discovered", "Discovered");
+                    var fullName = discovered.ProgramScope is null
+                        ? discovered.Name
+                        : $"Program:{discovered.ProgramScope}.{discovered.Name}";
+                    discoveredFolder.Variable(fullName, discovered.Name, new DriverAttributeInfo(
+                        FullName: fullName,
+                        DriverDataType: discovered.DataType.ToDriverDataType(),
+                        IsArray: false,
+                        ArrayDim: null,
+                        SecurityClass: discovered.ReadOnly
+                            ? SecurityClassification.ViewOnly
+                            : SecurityClassification.Operate,
+                        IsHistorized: false,
+                        IsAlarm: false,
+                        WriteIdempotent: false));
+                }
+            }
+        }
+    }
+
+    private static DriverAttributeInfo ToAttributeInfo(AbCipTagDefinition tag) => new(
+        FullName: tag.Name,
+        DriverDataType: tag.DataType.ToDriverDataType(),
+        IsArray: false,
+        ArrayDim: null,
+        SecurityClass: (tag.Writable && !tag.SafetyTag)
+            ? SecurityClassification.Operate
+            : SecurityClassification.ViewOnly,
+        IsHistorized: false,
+        IsAlarm: false,
+        WriteIdempotent: tag.WriteIdempotent);
+
+    /// <summary>Count of registered devices — exposed for diagnostics + tests.</summary>
+    internal int DeviceCount => _devices.Count;
+
+    /// <summary>Looked-up device state for the given host address. Tests + later-PR capabilities hit this.</summary>
+    internal DeviceState? GetDeviceState(string hostAddress) =>
+        _devices.TryGetValue(hostAddress, out var s) ? s : null;
+
+    public void Dispose() => DisposeAsync().AsTask().GetAwaiter().GetResult();
+
+    public async ValueTask DisposeAsync()
+    {
+        await ShutdownAsync(CancellationToken.None).ConfigureAwait(false);
+    }
+
+    /// <summary>
+    ///     Per-device runtime state. Holds the parsed host address, family profile, and the
+    ///     live <see cref="PlcTagHandle"/> cache keyed by tag path. PRs 3–8 populate + consume
+    ///     this dict via libplctag.
+    /// </summary>
+    internal sealed class DeviceState(
+        AbCipHostAddress parsedAddress,
+        AbCipDeviceOptions options,
+        AbCipPlcFamilyProfile profile)
+    {
+        public AbCipHostAddress ParsedAddress { get; } = parsedAddress;
+        public AbCipDeviceOptions Options { get; } = options;
+        public AbCipPlcFamilyProfile Profile { get; } = profile;
+
+        public object ProbeLock { get; } = new();
+        public HostState HostState { get; set; } = HostState.Unknown;
+        public DateTime HostStateChangedUtc { get; set; } = DateTime.UtcNow;
+        public CancellationTokenSource? ProbeCts { get; set; }
+        public bool ProbeInitialized { get; set; }
+
+        public Dictionary<string, PlcTagHandle> TagHandles { get; } =
+            new(StringComparer.OrdinalIgnoreCase);
+
+        /// <summary>
+        ///     Per-tag runtime handles owned by this device. One entry per configured tag is
+        ///     created lazily on first read (see <see cref="AbCipDriver.EnsureTagRuntimeAsync"/>).
+        /// </summary>
+        public Dictionary<string, IAbCipTagRuntime> Runtimes { get; } =
+            new(StringComparer.OrdinalIgnoreCase);
+
+        /// <summary>
+        ///     Parent-DINT runtimes created on-demand by <see cref="AbCipDriver.EnsureParentRuntimeAsync"/>
+        ///     for BOOL-within-DINT RMW writes. Separate from <see cref="Runtimes"/> because a
+        ///     bit-selector tag name ("Motor.Flags.3") needs a distinct handle from the DINT
+        ///     parent ("Motor.Flags") used to do the read + write.
+        /// </summary>
+        public Dictionary<string, IAbCipTagRuntime> ParentRuntimes { get; } =
+            new(StringComparer.OrdinalIgnoreCase);
+
+        private readonly System.Collections.Concurrent.ConcurrentDictionary<string, SemaphoreSlim> _rmwLocks = new();
+
+        public SemaphoreSlim GetRmwLock(string parentTagName) =>
+            _rmwLocks.GetOrAdd(parentTagName, _ => new SemaphoreSlim(1, 1));
+
+        public void DisposeHandles()
+        {
+            foreach (var h in TagHandles.Values) h.Dispose();
+            TagHandles.Clear();
+            foreach (var r in Runtimes.Values) r.Dispose();
+            Runtimes.Clear();
+            foreach (var r in ParentRuntimes.Values) r.Dispose();
+            ParentRuntimes.Clear();
+        }
+    }
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipDriverFactoryExtensions.cs

@@ -0,0 +1,151 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using ZB.MOM.WW.OtOpcUa.Core.Hosting;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Static factory registration helper for <see cref="AbCipDriver"/>. Server's Program.cs
+///     calls <see cref="Register"/> once at startup; the bootstrapper (task #248) then
+///     materialises AB CIP DriverInstance rows from the central config DB into live driver
+///     instances. Mirrors <c>GalaxyProxyDriverFactoryExtensions</c>.
+/// </summary>
+public static class AbCipDriverFactoryExtensions
+{
+    public const string DriverTypeName = "AbCip";
+
+    public static void Register(DriverFactoryRegistry registry)
+    {
+        ArgumentNullException.ThrowIfNull(registry);
+        registry.Register(DriverTypeName, CreateInstance);
+    }
+
+    internal static AbCipDriver CreateInstance(string driverInstanceId, string driverConfigJson)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(driverInstanceId);
+        ArgumentException.ThrowIfNullOrWhiteSpace(driverConfigJson);
+
+        var dto = JsonSerializer.Deserialize<AbCipDriverConfigDto>(driverConfigJson, JsonOptions)
+            ?? throw new InvalidOperationException(
+                $"AB CIP driver config for '{driverInstanceId}' deserialised to null");
+
+        var options = new AbCipDriverOptions
+        {
+            Devices = dto.Devices is { Count: > 0 }
+                ? [.. dto.Devices.Select(d => new AbCipDeviceOptions(
+                    HostAddress: d.HostAddress ?? throw new InvalidOperationException(
+                        $"AB CIP config for '{driverInstanceId}' has a device missing HostAddress"),
+                    PlcFamily: ParseEnum<AbCipPlcFamily>(d.PlcFamily, "device", driverInstanceId, "PlcFamily",
+                        fallback: AbCipPlcFamily.ControlLogix),
+                    DeviceName: d.DeviceName))]
+                : [],
+            Tags = dto.Tags is { Count: > 0 }
+                ? [.. dto.Tags.Select(t => BuildTag(t, driverInstanceId))]
+                : [],
+            Probe = new AbCipProbeOptions
+            {
+                Enabled = dto.Probe?.Enabled ?? true,
+                Interval = TimeSpan.FromMilliseconds(dto.Probe?.IntervalMs ?? 5_000),
+                Timeout = TimeSpan.FromMilliseconds(dto.Probe?.TimeoutMs ?? 2_000),
+                ProbeTagPath = dto.Probe?.ProbeTagPath,
+            },
+            Timeout = TimeSpan.FromMilliseconds(dto.TimeoutMs ?? 2_000),
+            EnableControllerBrowse = dto.EnableControllerBrowse ?? false,
+            EnableAlarmProjection = dto.EnableAlarmProjection ?? false,
+            AlarmPollInterval = TimeSpan.FromMilliseconds(dto.AlarmPollIntervalMs ?? 1_000),
+        };
+
+        return new AbCipDriver(options, driverInstanceId);
+    }
+
+    private static AbCipTagDefinition BuildTag(AbCipTagDto t, string driverInstanceId) =>
+        new(
+            Name: t.Name ?? throw new InvalidOperationException(
+                $"AB CIP config for '{driverInstanceId}' has a tag missing Name"),
+            DeviceHostAddress: t.DeviceHostAddress ?? throw new InvalidOperationException(
+                $"AB CIP tag '{t.Name}' in '{driverInstanceId}' missing DeviceHostAddress"),
+            TagPath: t.TagPath ?? throw new InvalidOperationException(
+                $"AB CIP tag '{t.Name}' in '{driverInstanceId}' missing TagPath"),
+            DataType: ParseEnum<AbCipDataType>(t.DataType, t.Name, driverInstanceId, "DataType"),
+            Writable: t.Writable ?? true,
+            WriteIdempotent: t.WriteIdempotent ?? false,
+            Members: t.Members is { Count: > 0 }
+                ? [.. t.Members.Select(m => new AbCipStructureMember(
+                    Name: m.Name ?? throw new InvalidOperationException(
+                        $"AB CIP tag '{t.Name}' in '{driverInstanceId}' has a member missing Name"),
+                    DataType: ParseEnum<AbCipDataType>(m.DataType, t.Name, driverInstanceId,
+                        $"Members[{m.Name}].DataType"),
+                    Writable: m.Writable ?? true,
+                    WriteIdempotent: m.WriteIdempotent ?? false))]
+                : null,
+            SafetyTag: t.SafetyTag ?? false);
+
+    private static T ParseEnum<T>(string? raw, string? tagName, string driverInstanceId, string field,
+        T? fallback = null) where T : struct, Enum
+    {
+        if (string.IsNullOrWhiteSpace(raw))
+        {
+            if (fallback.HasValue) return fallback.Value;
+            throw new InvalidOperationException(
+                $"AB CIP tag '{tagName ?? "<unnamed>"}' in '{driverInstanceId}' missing {field}");
+        }
+        return Enum.TryParse<T>(raw, ignoreCase: true, out var v)
+            ? v
+            : throw new InvalidOperationException(
+                $"AB CIP tag '{tagName}' has unknown {field} '{raw}'. " +
+                $"Expected one of {string.Join(", ", Enum.GetNames<T>())}");
+    }
+
+    private static readonly JsonSerializerOptions JsonOptions = new()
+    {
+        PropertyNameCaseInsensitive = true,
+        ReadCommentHandling = JsonCommentHandling.Skip,
+        AllowTrailingCommas = true,
+    };
+
+    internal sealed class AbCipDriverConfigDto
+    {
+        public int? TimeoutMs { get; init; }
+        public bool? EnableControllerBrowse { get; init; }
+        public bool? EnableAlarmProjection { get; init; }
+        public int? AlarmPollIntervalMs { get; init; }
+        public List<AbCipDeviceDto>? Devices { get; init; }
+        public List<AbCipTagDto>? Tags { get; init; }
+        public AbCipProbeDto? Probe { get; init; }
+    }
+
+    internal sealed class AbCipDeviceDto
+    {
+        public string? HostAddress { get; init; }
+        public string? PlcFamily { get; init; }
+        public string? DeviceName { get; init; }
+    }
+
+    internal sealed class AbCipTagDto
+    {
+        public string? Name { get; init; }
+        public string? DeviceHostAddress { get; init; }
+        public string? TagPath { get; init; }
+        public string? DataType { get; init; }
+        public bool? Writable { get; init; }
+        public bool? WriteIdempotent { get; init; }
+        public List<AbCipMemberDto>? Members { get; init; }
+        public bool? SafetyTag { get; init; }
+    }
+
+    internal sealed class AbCipMemberDto
+    {
+        public string? Name { get; init; }
+        public string? DataType { get; init; }
+        public bool? Writable { get; init; }
+        public bool? WriteIdempotent { get; init; }
+    }
+
+    internal sealed class AbCipProbeDto
+    {
+        public bool? Enabled { get; init; }
+        public int? IntervalMs { get; init; }
+        public int? TimeoutMs { get; init; }
+        public string? ProbeTagPath { get; init; }
+    }
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipDriverOptions.cs

@@ -0,0 +1,143 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     AB CIP / EtherNet-IP driver configuration, bound from the driver's <c>DriverConfig</c>
+///     JSON at <c>DriverHost.RegisterAsync</c>. One instance supports N devices (PLCs) behind
+///     the same driver; per-device routing is keyed on <see cref="AbCipDeviceOptions.HostAddress"/>
+///     via <c>IPerCallHostResolver</c>.
+/// </summary>
+/// <remarks>
+///     Per v2 plan decisions #11 (libplctag), #41 (AbCip vs AbLegacy split), #143–144 (per-call
+///     host resolver + resilience keys), #144 (bulkhead keyed on <c>(DriverInstanceId, HostName)</c>).
+/// </remarks>
+public sealed class AbCipDriverOptions
+{
+    /// <summary>
+    ///     PLCs this driver instance talks to. Each device contributes its own <see cref="AbCipHostAddress"/>
+    ///     string as the <c>hostName</c> key used by resilience pipelines and the Admin UI.
+    /// </summary>
+    public IReadOnlyList<AbCipDeviceOptions> Devices { get; init; } = [];
+
+    /// <summary>Pre-declared tag map across all devices — AB discovery lands in PR 5.</summary>
+    public IReadOnlyList<AbCipTagDefinition> Tags { get; init; } = [];
+
+    /// <summary>Per-device probe settings. Falls back to defaults when omitted.</summary>
+    public AbCipProbeOptions Probe { get; init; } = new();
+
+    /// <summary>
+    ///     Default libplctag call timeout applied to reads/writes/discovery when the caller does
+    ///     not pass a more specific value. Matches the Modbus driver's 2-second default.
+    /// </summary>
+    public TimeSpan Timeout { get; init; } = TimeSpan.FromSeconds(2);
+
+    /// <summary>
+    ///     When <c>true</c>, <c>DiscoverAsync</c> walks each device's Logix symbol table via
+    ///     the <c>@tags</c> pseudo-tag + surfaces controller-resident globals under a
+    ///     <c>Discovered/</c> sub-folder. Pre-declared tags always emit regardless. Default
+    ///     <c>false</c> to keep the strict-config path for deployments where only declared tags
+    ///     should appear in the address space.
+    /// </summary>
+    public bool EnableControllerBrowse { get; init; }
+
+    /// <summary>
+    ///     Task #177 — when <c>true</c>, declared ALMD tags are surfaced as alarm conditions
+    ///     via <see cref="Core.Abstractions.IAlarmSource"/>; the driver polls each subscribed
+    ///     alarm's <c>InFaulted</c> + <c>Severity</c> members + fires <c>OnAlarmEvent</c> on
+    ///     state transitions. Default <c>false</c> — operators explicitly opt in because
+    ///     projection semantics don't exactly mirror Rockwell FT Alarm &amp; Events; shops
+    ///     running FT Live should keep this off + take alarms through the native route.
+    /// </summary>
+    public bool EnableAlarmProjection { get; init; }
+
+    /// <summary>
+    ///     Poll interval for the ALMD projection loop. Shorter intervals catch faster edges
+    ///     at the cost of PLC round-trips; edges shorter than this interval are invisible to
+    ///     the projection (a 0→1→0 transition within one tick collapses to no event). Default
+    ///     1 second — matches typical SCADA alarm-refresh conventions.
+    /// </summary>
+    public TimeSpan AlarmPollInterval { get; init; } = TimeSpan.FromSeconds(1);
+}
+
+/// <summary>
+///     One PLC endpoint. <see cref="HostAddress"/> must parse via
+///     <see cref="AbCipHostAddress.TryParse"/>; misconfigured devices fail driver
+///     initialization rather than silently connecting to nothing.
+/// </summary>
+/// <param name="HostAddress">Canonical <c>ab://gateway[:port]/cip-path</c> string.</param>
+/// <param name="PlcFamily">Which per-family profile to apply. Determines ConnectionSize,
+///     request-packing support, unconnected-only hint, and other quirks.</param>
+/// <param name="DeviceName">Optional display label for Admin UI. Falls back to <see cref="HostAddress"/>.</param>
+public sealed record AbCipDeviceOptions(
+    string HostAddress,
+    AbCipPlcFamily PlcFamily = AbCipPlcFamily.ControlLogix,
+    string? DeviceName = null);
+
+/// <summary>
+///     One AB-backed OPC UA variable. Mirrors the <c>ModbusTagDefinition</c> shape.
+/// </summary>
+/// <param name="Name">Tag name; becomes the OPC UA browse name and full reference.</param>
+/// <param name="DeviceHostAddress">Which device (<see cref="AbCipDeviceOptions.HostAddress"/>) this tag lives on.</param>
+/// <param name="TagPath">Logix symbolic path (controller or program scope).</param>
+/// <param name="DataType">Logix atomic type, or <see cref="AbCipDataType.Structure"/> for UDT-typed tags.</param>
+/// <param name="Writable">When <c>true</c> and the tag's ExternalAccess permits writes, IWritable routes writes here.</param>
+/// <param name="WriteIdempotent">Per plan decisions #44–#45, #143 — safe to replay on write timeout. Default <c>false</c>.</param>
+/// <param name="Members">For <see cref="AbCipDataType.Structure"/>-typed tags, the declared UDT
+///     member layout. When supplied, discovery fans out the UDT into a folder + one Variable per
+///     member (member TagPath = <c>{tag.TagPath}.{member.Name}</c>). When <c>null</c> on a Structure
+///     tag, the driver treats it as a black-box and relies on downstream configuration to address
+///     members individually via dotted <see cref="AbCipTagPath"/> syntax. Ignored for atomic types.</param>
+/// <param name="SafetyTag">GuardLogix safety-partition tag hint. When <c>true</c>, the driver
+///     forces <c>SecurityClassification.ViewOnly</c> on discovery regardless of
+///     <paramref name="Writable"/> — safety tags can only be written from the safety task of a
+///     GuardLogix controller; non-safety writes violate the safety-partition isolation and are
+///     rejected by the PLC anyway. Surfaces the intent explicitly instead of relying on the
+///     write attempt failing at runtime.</param>
+public sealed record AbCipTagDefinition(
+    string Name,
+    string DeviceHostAddress,
+    string TagPath,
+    AbCipDataType DataType,
+    bool Writable = true,
+    bool WriteIdempotent = false,
+    IReadOnlyList<AbCipStructureMember>? Members = null,
+    bool SafetyTag = false);
+
+/// <summary>
+///     One declared member of a UDT tag. Name is the member identifier on the PLC (e.g. <c>Speed</c>,
+///     <c>Status</c>), DataType is the atomic Logix type, Writable/WriteIdempotent mirror
+///     <see cref="AbCipTagDefinition"/>. Declaration-driven — the real CIP Template Object reader
+///     (class 0x6C) that would auto-discover member layouts lands as a follow-up PR.
+/// </summary>
+public sealed record AbCipStructureMember(
+    string Name,
+    AbCipDataType DataType,
+    bool Writable = true,
+    bool WriteIdempotent = false);
+
+/// <summary>Which AB PLC family the device is — selects the profile applied to connection params.</summary>
+public enum AbCipPlcFamily
+{
+    ControlLogix,
+    CompactLogix,
+    Micro800,
+    GuardLogix,
+}
+
+/// <summary>
+///     Background connectivity-probe settings. Enabled by default; the probe reads a cheap tag
+///     on the PLC at the configured interval to drive <see cref="Core.Abstractions.IHostConnectivityProbe"/>
+///     state transitions + Admin UI health status.
+/// </summary>
+public sealed class AbCipProbeOptions
+{
+    public bool Enabled { get; init; } = true;
+    public TimeSpan Interval { get; init; } = TimeSpan.FromSeconds(5);
+    public TimeSpan Timeout { get; init; } = TimeSpan.FromSeconds(2);
+
+    /// <summary>
+    ///     Tag path used for the probe. If null, the driver attempts to read a default
+    ///     system tag (PR 8 wires this up — the choice is family-dependent, e.g.
+    ///     <c>@raw_cpu_type</c> on ControlLogix or a user-configured probe tag on Micro800).
+    /// </summary>
+    public string? ProbeTagPath { get; init; }
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipHostAddress.cs

@@ -0,0 +1,68 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Parsed <c>ab://gateway[:port]/cip-path</c> host-address string used by the AbCip driver
+///     as the <c>hostName</c> key across <see cref="Core.Abstractions.IHostConnectivityProbe"/>,
+///     <see cref="Core.Abstractions.IPerCallHostResolver"/>, and the Polly bulkhead key
+///     <c>(DriverInstanceId, hostName)</c> per v2 plan decision #144.
+/// </summary>
+/// <remarks>
+///     <para>Format matches what libplctag's <c>gateway=...</c> + <c>path=...</c> attributes
+///     consume, so no translation is needed at the wire layer — the parsed <see cref="CipPath"/>
+///     is handed to the native library verbatim.</para>
+///     <list type="bullet">
+///         <item><c>ab://10.0.0.5/1,0</c> — single-chassis ControlLogix, CPU in slot 0.</item>
+///         <item><c>ab://10.0.0.5/1,4</c> — CPU in slot 4.</item>
+///         <item><c>ab://10.0.0.5/1,2,2,192.168.50.20,1,0</c> — bridged ControlLogix.</item>
+///         <item><c>ab://10.0.0.5/</c> (empty path) — Micro800 / MicroLogix without backplane routing.</item>
+///         <item><c>ab://10.0.0.5:44818/1,0</c> — explicit EIP port (default 44818).</item>
+///     </list>
+///     <para>Opaque to the rest of the stack: Admin UI, telemetry, and logs display the full
+///     string so an incident ticket can be matched to the exact gateway + CIP route.</para>
+/// </remarks>
+public sealed record AbCipHostAddress(string Gateway, int Port, string CipPath)
+{
+    /// <summary>Default EtherNet/IP TCP port — spec-reserved.</summary>
+    public const int DefaultEipPort = 44818;
+
+    /// <summary>Recompose the canonical <c>ab://...</c> form.</summary>
+    public override string ToString() => Port == DefaultEipPort
+        ? $"ab://{Gateway}/{CipPath}"
+        : $"ab://{Gateway}:{Port}/{CipPath}";
+
+    /// <summary>
+    ///     Parse <paramref name="value"/>. Returns <c>null</c> on any malformed input — callers
+    ///     should treat a null return as a config-validation failure rather than catching.
+    /// </summary>
+    public static AbCipHostAddress? TryParse(string? value)
+    {
+        if (string.IsNullOrWhiteSpace(value)) return null;
+        const string prefix = "ab://";
+        if (!value.StartsWith(prefix, StringComparison.OrdinalIgnoreCase)) return null;
+
+        var remainder = value[prefix.Length..];
+        var slashIdx = remainder.IndexOf('/');
+        if (slashIdx < 0) return null;
+
+        var authority = remainder[..slashIdx];
+        var cipPath = remainder[(slashIdx + 1)..];
+        if (string.IsNullOrEmpty(authority)) return null;
+
+        var port = DefaultEipPort;
+        var colonIdx = authority.LastIndexOf(':');
+        string gateway;
+        if (colonIdx >= 0)
+        {
+            gateway = authority[..colonIdx];
+            if (!int.TryParse(authority[(colonIdx + 1)..], out port) || port <= 0 || port > 65535)
+                return null;
+        }
+        else
+        {
+            gateway = authority;
+        }
+        if (string.IsNullOrEmpty(gateway)) return null;
+
+        return new AbCipHostAddress(gateway, port, cipPath);
+    }
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipStatusMapper.cs

@@ -0,0 +1,79 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Maps libplctag / CIP General Status codes to OPC UA StatusCodes. Mirrors the shape of
+///     <c>ModbusDriver.MapModbusExceptionToStatus</c> so Admin UI status displays stay
+///     uniform across drivers.
+/// </summary>
+/// <remarks>
+///     <para>Coverage: the CIP general-status values an AB PLC actually returns during normal
+///     driver operation. Full CIP Volume 1 Appendix B lists 50+ codes; the ones here are the
+///     ones that move the driver's status needle:</para>
+///     <list type="bullet">
+///         <item>0x00 success — OPC UA <c>Good (0)</c>.</item>
+///         <item>0x04 path segment error / 0x05 path destination unknown — <c>BadNodeIdUnknown</c>
+///             (tag doesn't exist).</item>
+///         <item>0x06 partial data transfer — <c>GoodMoreData</c> (fragmented read underway).</item>
+///         <item>0x08 service not supported — <c>BadNotSupported</c> (e.g. write on a safety
+///             partition tag from a non-safety task).</item>
+///         <item>0x0A / 0x13 attribute-list error / insufficient data — <c>BadOutOfRange</c>
+///             (type mismatch or truncated buffer).</item>
+///         <item>0x0B already in requested mode — benign, treated as <c>Good</c>.</item>
+///         <item>0x0E attribute not settable — <c>BadNotWritable</c>.</item>
+///         <item>0x10 device state conflict — <c>BadDeviceFailure</c> (program-mode protected
+///             writes during download / test-mode transitions).</item>
+///         <item>0x16 object does not exist — <c>BadNodeIdUnknown</c>.</item>
+///         <item>0x1E embedded service error — unwrap to the extended status when possible.</item>
+///         <item>any libplctag <c>PLCTAG_STATUS_*</c> below zero — wrapped as
+///             <c>BadCommunicationError</c> until fine-grained mapping lands (PR 3).</item>
+///     </list>
+/// </remarks>
+public static class AbCipStatusMapper
+{
+    public const uint Good = 0u;
+    public const uint GoodMoreData = 0x00A70000u;
+    public const uint BadInternalError = 0x80020000u;
+    public const uint BadNodeIdUnknown = 0x80340000u;
+    public const uint BadNotWritable = 0x803B0000u;
+    public const uint BadOutOfRange = 0x803C0000u;
+    public const uint BadNotSupported = 0x803D0000u;
+    public const uint BadDeviceFailure = 0x80550000u;
+    public const uint BadCommunicationError = 0x80050000u;
+    public const uint BadTimeout = 0x800A0000u;
+    public const uint BadTypeMismatch = 0x80730000u;
+
+    /// <summary>Map a CIP general-status byte to an OPC UA StatusCode.</summary>
+    public static uint MapCipGeneralStatus(byte status) => status switch
+    {
+        0x00 => Good,
+        0x04 or 0x05 => BadNodeIdUnknown,
+        0x06 => GoodMoreData,
+        0x08 => BadNotSupported,
+        0x0A or 0x13 => BadOutOfRange,
+        0x0B => Good,
+        0x0E => BadNotWritable,
+        0x10 => BadDeviceFailure,
+        0x16 => BadNodeIdUnknown,
+        _ => BadInternalError,
+    };
+
+    /// <summary>
+    ///     Map a libplctag return/status code (<c>PLCTAG_STATUS_*</c>) to an OPC UA StatusCode.
+    ///     libplctag uses <c>0 = PLCTAG_STATUS_OK</c>, positive values for pending, negative
+    ///     values for errors.
+    /// </summary>
+    public static uint MapLibplctagStatus(int status)
+    {
+        if (status == 0) return Good;
+        if (status > 0) return GoodMoreData; // PLCTAG_STATUS_PENDING
+        return status switch
+        {
+            -5 => BadTimeout,              // PLCTAG_ERR_TIMEOUT
+            -7 => BadCommunicationError,   // PLCTAG_ERR_BAD_CONNECTION
+            -14 => BadNodeIdUnknown,       // PLCTAG_ERR_NOT_FOUND
+            -16 => BadNotWritable,         // PLCTAG_ERR_NOT_ALLOWED / read-only tag
+            -17 => BadOutOfRange,          // PLCTAG_ERR_OUT_OF_BOUNDS
+            _ => BadCommunicationError,
+        };
+    }
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipSystemTagFilter.cs

@@ -0,0 +1,49 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Filters system / infrastructure tags out of discovered tag sets. A Logix controller's
+///     symbol table exposes user tags alongside module-config objects, routine pointers, task
+///     pointers, and <c>__DEFVAL_*</c> stubs that are noise for the OPC UA address space.
+/// </summary>
+/// <remarks>
+///     Lifted from the filter conventions documented across Rockwell Knowledgebase article
+///     IC-12345 and the Logix 5000 Controllers General Instructions Reference. The list is
+///     conservative — when in doubt, a tag is surfaced rather than hidden so operators can
+///     see it and the config flow can explicitly hide it via UnsArea ACL.
+/// </remarks>
+public static class AbCipSystemTagFilter
+{
+    /// <summary>
+    ///     <c>true</c> when the tag name matches a well-known system-tag pattern the driver
+    ///     should hide from the default address space. Case-sensitive — Logix symbols are
+    ///     always preserved case and the system-tag prefixes are uppercase by convention.
+    /// </summary>
+    public static bool IsSystemTag(string tagName)
+    {
+        if (string.IsNullOrWhiteSpace(tagName)) return true;
+
+        // Internal backing store for tag defaults — never user-meaningful.
+        if (tagName.StartsWith("__DEFVAL_", StringComparison.Ordinal)) return true;
+        if (tagName.StartsWith("__DEFAULT_", StringComparison.Ordinal)) return true;
+
+        // Routine and Task pointer pseudo-tags.
+        if (tagName.StartsWith("Routine:", StringComparison.Ordinal)) return true;
+        if (tagName.StartsWith("Task:", StringComparison.Ordinal)) return true;
+
+        // Logix module-config auto-generated names — Local:1:I, Local:1:O, etc. Module data is
+        // exposed separately via the dedicated hardware mapping; the auto-generated symbol-table
+        // entries duplicate that.
+        if (tagName.StartsWith("Local:", StringComparison.Ordinal) && tagName.Contains(':')) return true;
+
+        // Map / Mapped IO alias tags (MainProgram.MapName pattern — dot-separated but prefixed
+        // with a reserved colon-carrying prefix to avoid false positives on user member access).
+        if (tagName.StartsWith("Map:", StringComparison.Ordinal)) return true;
+
+        // Axis / Cam / Motion-Group predefined structures — exposed separately through motion API.
+        if (tagName.StartsWith("Axis:", StringComparison.Ordinal)) return true;
+        if (tagName.StartsWith("Cam:", StringComparison.Ordinal)) return true;
+        if (tagName.StartsWith("MotionGroup:", StringComparison.Ordinal)) return true;
+
+        return false;
+    }
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipTagPath.cs

@@ -0,0 +1,132 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Parsed Logix-symbolic tag path. Handles controller-scope (<c>Motor1_Speed</c>),
+///     program-scope (<c>Program:MainProgram.StepIndex</c>), structured member access
+///     (<c>Motor1.Speed.Setpoint</c>), array subscripts (<c>Array[0]</c>, <c>Matrix[1,2]</c>),
+///     and bit-within-DINT access (<c>Flags.3</c>). Reassembles the canonical Logix syntax via
+///     <see cref="ToLibplctagName"/>, which is the exact string libplctag's <c>name=...</c>
+///     attribute consumes.
+/// </summary>
+/// <remarks>
+///     Scope + members + subscripts are captured structurally so PR 6 (UDT support) can walk
+///     the path against a cached template without re-parsing. <see cref="BitIndex"/> is
+///     non-null only when the trailing segment is a decimal integer between 0 and 31 that
+///     parses as a bit-selector — this is the <c>.N</c> syntax documented in the Logix 5000
+///     General Instructions Reference §Tags, and it applies only to DINT-typed parents. The
+///     parser does not validate the parent type (requires live template data) — it accepts the
+///     shape and defers type-correctness to the runtime.
+/// </remarks>
+public sealed record AbCipTagPath(
+    string? ProgramScope,
+    IReadOnlyList<AbCipTagPathSegment> Segments,
+    int? BitIndex)
+{
+    /// <summary>Rebuild the canonical Logix tag string.</summary>
+    public string ToLibplctagName()
+    {
+        var buf = new System.Text.StringBuilder();
+        if (ProgramScope is not null)
+            buf.Append("Program:").Append(ProgramScope).Append('.');
+
+        for (var i = 0; i < Segments.Count; i++)
+        {
+            if (i > 0) buf.Append('.');
+            var seg = Segments[i];
+            buf.Append(seg.Name);
+            if (seg.Subscripts.Count > 0)
+                buf.Append('[').Append(string.Join(",", seg.Subscripts)).Append(']');
+        }
+        if (BitIndex is not null) buf.Append('.').Append(BitIndex.Value);
+        return buf.ToString();
+    }
+
+    /// <summary>
+    ///     Parse a Logix-symbolic tag reference. Returns <c>null</c> on a shape the parser
+    ///     doesn't support — the driver surfaces that as a config-validation error rather than
+    ///     attempting a best-effort translation.
+    /// </summary>
+    public static AbCipTagPath? TryParse(string? value)
+    {
+        if (string.IsNullOrWhiteSpace(value)) return null;
+        var src = value.Trim();
+
+        string? programScope = null;
+        const string programPrefix = "Program:";
+        if (src.StartsWith(programPrefix, StringComparison.OrdinalIgnoreCase))
+        {
+            var afterPrefix = src[programPrefix.Length..];
+            var dotIdx = afterPrefix.IndexOf('.');
+            if (dotIdx <= 0) return null;
+            programScope = afterPrefix[..dotIdx];
+            src = afterPrefix[(dotIdx + 1)..];
+            if (string.IsNullOrEmpty(src)) return null;
+        }
+
+        // Split on dots, but preserve any [i,j] subscript runs that contain only digits + commas.
+        var parts = new List<string>();
+        var depth = 0;
+        var start = 0;
+        for (var i = 0; i < src.Length; i++)
+        {
+            var c = src[i];
+            if (c == '[') depth++;
+            else if (c == ']') depth--;
+            else if (c == '.' && depth == 0)
+            {
+                parts.Add(src[start..i]);
+                start = i + 1;
+            }
+        }
+        parts.Add(src[start..]);
+        if (depth != 0 || parts.Any(string.IsNullOrEmpty)) return null;
+
+        int? bitIndex = null;
+        if (parts.Count >= 2 && int.TryParse(parts[^1], out var maybeBit)
+            && maybeBit is >= 0 and <= 31
+            && !parts[^1].Contains('['))
+        {
+            bitIndex = maybeBit;
+            parts.RemoveAt(parts.Count - 1);
+        }
+
+        var segments = new List<AbCipTagPathSegment>(parts.Count);
+        foreach (var part in parts)
+        {
+            var bracketIdx = part.IndexOf('[');
+            if (bracketIdx < 0)
+            {
+                if (!IsValidIdent(part)) return null;
+                segments.Add(new AbCipTagPathSegment(part, []));
+                continue;
+            }
+            if (!part.EndsWith(']')) return null;
+            var name = part[..bracketIdx];
+            if (!IsValidIdent(name)) return null;
+            var inner = part[(bracketIdx + 1)..^1];
+            var subs = new List<int>();
+            foreach (var tok in inner.Split(','))
+            {
+                if (!int.TryParse(tok, out var n) || n < 0) return null;
+                subs.Add(n);
+            }
+            if (subs.Count == 0) return null;
+            segments.Add(new AbCipTagPathSegment(name, subs));
+        }
+        if (segments.Count == 0) return null;
+
+        return new AbCipTagPath(programScope, segments, bitIndex);
+    }
+
+    private static bool IsValidIdent(string s)
+    {
+        if (string.IsNullOrEmpty(s)) return false;
+        if (!char.IsLetter(s[0]) && s[0] != '_') return false;
+        for (var i = 1; i < s.Length; i++)
+            if (!char.IsLetterOrDigit(s[i]) && s[i] != '_') return false;
+        return true;
+    }
+}
+
+/// <summary>One path segment: a member name plus any numeric subscripts.</summary>
+public sealed record AbCipTagPathSegment(string Name, IReadOnlyList<int> Subscripts);

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipTemplateCache.cs

@@ -0,0 +1,55 @@
+using System.Collections.Concurrent;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Cache of UDT shape descriptors keyed by <c>(deviceHostAddress, templateInstanceId)</c>.
+///     Populated on demand during discovery + whole-UDT reads; flushed via
+///     <see cref="AbCipDriver.FlushOptionalCachesAsync"/> and on device
+///     <c>ReinitializeAsync</c>.
+/// </summary>
+/// <remarks>
+///     Template shape read (CIP Template Object class 0x6C, <c>GetAttributeList</c> +
+///     <c>Read Template</c>) lands with PR 6. This class ships the cache surface so PR 6 can
+///     drop the decoder in without reshaping any caller code.
+/// </remarks>
+public sealed class AbCipTemplateCache
+{
+    private readonly ConcurrentDictionary<(string device, uint instanceId), AbCipUdtShape> _shapes = new();
+
+    /// <summary>
+    ///     Retrieve a cached UDT shape, or <c>null</c> if not yet read.
+    /// </summary>
+    public AbCipUdtShape? TryGet(string deviceHostAddress, uint templateInstanceId) =>
+        _shapes.TryGetValue((deviceHostAddress, templateInstanceId), out var shape) ? shape : null;
+
+    /// <summary>Store a freshly-decoded UDT shape.</summary>
+    public void Put(string deviceHostAddress, uint templateInstanceId, AbCipUdtShape shape) =>
+        _shapes[(deviceHostAddress, templateInstanceId)] = shape;
+
+    /// <summary>Drop every cached shape — called on <see cref="AbCipDriver.FlushOptionalCachesAsync"/>.</summary>
+    public void Clear() => _shapes.Clear();
+
+    /// <summary>Count of cached shapes — exposed for diagnostics + tests.</summary>
+    public int Count => _shapes.Count;
+}
+
+/// <summary>
+///     Decoded shape of one Logix UDT — member list + each member's offset + type. Populated
+///     by PR 6's Template Object reader. At PR 5 time this is the cache's value type only;
+///     no reader writes to it yet.
+/// </summary>
+/// <param name="TypeName">UDT name as reported by the Template Object.</param>
+/// <param name="TotalSize">Bytes the UDT occupies in a whole-UDT read buffer.</param>
+/// <param name="Members">Ordered list of members, each with its byte offset + type.</param>
+public sealed record AbCipUdtShape(
+    string TypeName,
+    int TotalSize,
+    IReadOnlyList<AbCipUdtMember> Members);
+
+/// <summary>One member of a Logix UDT.</summary>
+public sealed record AbCipUdtMember(
+    string Name,
+    int Offset,
+    AbCipDataType DataType,
+    int ArrayLength);

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipUdtMemberLayout.cs

@@ -0,0 +1,78 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Computes byte offsets for declared UDT members under Logix natural-alignment rules so
+///     a single whole-UDT read (task #194) can decode each member from one buffer without
+///     re-reading per member. Declaration-driven — the caller supplies
+///     <see cref="AbCipStructureMember"/> rows; this helper produces the offset each member
+///     sits at in the parent tag's read buffer.
+/// </summary>
+/// <remarks>
+///     <para>Alignment rules applied per Rockwell "Logix 5000 Data Access" manual + the
+///     libplctag test fixtures: each member aligns to its natural boundary (SInt 1, Int 2,
+///     DInt/Real/Dt 4, LInt/ULInt/LReal 8), padding inserted before the member as needed.
+///     The total size is padded to the alignment of the largest member so arrays-of-UDT also
+///     work at element stride — though this helper is used only on single instances today.</para>
+///
+///     <para><see cref="TryBuild"/> returns <c>null</c> on unsupported member types
+///     (<see cref="AbCipDataType.Bool"/>, <see cref="AbCipDataType.String"/>,
+///     <see cref="AbCipDataType.Structure"/>). Whole-UDT grouping opts out of those groups
+///     and falls back to the per-tag read path — BOOL members are packed into a hidden host
+///     byte at the top of the UDT under Logix, so their offset can't be computed from
+///     declared-member order alone. The CIP Template Object reader produces a
+///     <see cref="AbCipUdtShape"/> that carries real offsets for BOOL + nested structs; when
+///     that shape is cached the driver can take the richer path instead.</para>
+/// </remarks>
+public static class AbCipUdtMemberLayout
+{
+    /// <summary>
+    ///     Try to compute member offsets for the supplied declared members. Returns <c>null</c>
+    ///     if any member type is unsupported for declaration-only layout.
+    /// </summary>
+    public static IReadOnlyDictionary<string, int>? TryBuild(
+        IReadOnlyList<AbCipStructureMember> members)
+    {
+        ArgumentNullException.ThrowIfNull(members);
+        if (members.Count == 0) return null;
+
+        var offsets = new Dictionary<string, int>(members.Count, StringComparer.OrdinalIgnoreCase);
+        var cursor = 0;
+
+        foreach (var member in members)
+        {
+            if (!TryGetSizeAlign(member.DataType, out var size, out var align))
+                return null;
+
+            if (cursor % align != 0)
+                cursor += align - (cursor % align);
+
+            offsets[member.Name] = cursor;
+            cursor += size;
+        }
+
+        return offsets;
+    }
+
+    /// <summary>
+    ///     Natural size + alignment for a Logix atomic type. <c>false</c> for types excluded
+    ///     from declaration-only grouping (Bool / String / Structure).
+    /// </summary>
+    private static bool TryGetSizeAlign(AbCipDataType type, out int size, out int align)
+    {
+        switch (type)
+        {
+            case AbCipDataType.SInt: case AbCipDataType.USInt:
+                size = 1; align = 1; return true;
+            case AbCipDataType.Int: case AbCipDataType.UInt:
+                size = 2; align = 2; return true;
+            case AbCipDataType.DInt: case AbCipDataType.UDInt:
+            case AbCipDataType.Real: case AbCipDataType.Dt:
+                size = 4; align = 4; return true;
+            case AbCipDataType.LInt: case AbCipDataType.ULInt:
+            case AbCipDataType.LReal:
+                size = 8; align = 8; return true;
+            default:
+                size = 0; align = 0; return false;
+        }
+    }
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipUdtReadPlanner.cs

@@ -0,0 +1,109 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Task #194 — groups a ReadAsync batch of full-references into whole-UDT reads where
+///     possible. A group is emitted for every parent UDT tag whose declared
+///     <see cref="AbCipStructureMember"/>s produced a valid offset map AND at least two of
+///     its members appear in the batch; every other reference stays in the per-tag fallback
+///     list that <see cref="AbCipDriver.ReadAsync"/> runs through its existing read path.
+///     Pure function — the planner never touches the runtime + never reads the PLC.
+/// </summary>
+public static class AbCipUdtReadPlanner
+{
+    /// <summary>
+    ///     Split <paramref name="requests"/> into whole-UDT groups + per-tag leftovers.
+    ///     <paramref name="tagsByName"/> is the driver's <c>_tagsByName</c> map — both parent
+    ///     UDT rows and their fanned-out member rows live there. Lookup is OrdinalIgnoreCase
+    ///     to match the driver's dictionary semantics.
+    /// </summary>
+    public static AbCipUdtReadPlan Build(
+        IReadOnlyList<string> requests,
+        IReadOnlyDictionary<string, AbCipTagDefinition> tagsByName)
+    {
+        ArgumentNullException.ThrowIfNull(requests);
+        ArgumentNullException.ThrowIfNull(tagsByName);
+
+        var fallback = new List<AbCipUdtReadFallback>(requests.Count);
+        var byParent = new Dictionary<string, List<AbCipUdtReadMember>>(StringComparer.OrdinalIgnoreCase);
+
+        for (var i = 0; i < requests.Count; i++)
+        {
+            var name = requests[i];
+            if (!tagsByName.TryGetValue(name, out var def))
+            {
+                fallback.Add(new AbCipUdtReadFallback(i, name));
+                continue;
+            }
+
+            var (parentName, memberName) = SplitParentMember(name);
+            if (parentName is null || memberName is null
+                || !tagsByName.TryGetValue(parentName, out var parent)
+                || parent.DataType != AbCipDataType.Structure
+                || parent.Members is not { Count: > 0 })
+            {
+                fallback.Add(new AbCipUdtReadFallback(i, name));
+                continue;
+            }
+
+            var offsets = AbCipUdtMemberLayout.TryBuild(parent.Members);
+            if (offsets is null || !offsets.TryGetValue(memberName, out var offset))
+            {
+                fallback.Add(new AbCipUdtReadFallback(i, name));
+                continue;
+            }
+
+            if (!byParent.TryGetValue(parentName, out var members))
+            {
+                members = new List<AbCipUdtReadMember>();
+                byParent[parentName] = members;
+            }
+            members.Add(new AbCipUdtReadMember(i, def, offset));
+        }
+
+        // A single-member group saves nothing (one whole-UDT read replaces one per-member read)
+        // — demote to fallback to avoid paying the cost of reading the full UDT buffer only to
+        // pull one field out.
+        var groups = new List<AbCipUdtReadGroup>(byParent.Count);
+        foreach (var (parentName, members) in byParent)
+        {
+            if (members.Count < 2)
+            {
+                foreach (var m in members)
+                    fallback.Add(new AbCipUdtReadFallback(m.OriginalIndex, m.Definition.Name));
+                continue;
+            }
+            groups.Add(new AbCipUdtReadGroup(parentName, tagsByName[parentName], members));
+        }
+
+        return new AbCipUdtReadPlan(groups, fallback);
+    }
+
+    private static (string? Parent, string? Member) SplitParentMember(string reference)
+    {
+        var dot = reference.IndexOf('.');
+        if (dot <= 0 || dot == reference.Length - 1) return (null, null);
+        return (reference[..dot], reference[(dot + 1)..]);
+    }
+}
+
+/// <summary>A planner output: grouped UDT reads + per-tag fallbacks.</summary>
+public sealed record AbCipUdtReadPlan(
+    IReadOnlyList<AbCipUdtReadGroup> Groups,
+    IReadOnlyList<AbCipUdtReadFallback> Fallbacks);
+
+/// <summary>One UDT parent whose members were batched into a single read.</summary>
+public sealed record AbCipUdtReadGroup(
+    string ParentName,
+    AbCipTagDefinition ParentDefinition,
+    IReadOnlyList<AbCipUdtReadMember> Members);
+
+/// <summary>
+///     One member inside an <see cref="AbCipUdtReadGroup"/>. <c>OriginalIndex</c> is the
+///     slot in the caller's request list so the decoded value lands at the correct output
+///     offset. <c>Definition</c> is the fanned-out member-level tag definition. <c>Offset</c>
+///     is the byte offset within the parent UDT buffer where this member lives.
+/// </summary>
+public sealed record AbCipUdtReadMember(int OriginalIndex, AbCipTagDefinition Definition, int Offset);
+
+/// <summary>A reference that falls back to the per-tag read path.</summary>
+public sealed record AbCipUdtReadFallback(int OriginalIndex, string Reference);

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/CipSymbolObjectDecoder.cs

@@ -0,0 +1,128 @@
+using System.Buffers.Binary;
+using System.Text;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Decoder for the CIP Symbol Object (class 0x6B) response returned by Logix controllers
+///     when a client reads the <c>@tags</c> pseudo-tag. Parses the concatenated tag-info
+///     entries into a sequence of <see cref="AbCipDiscoveredTag"/>s that the driver can stream
+///     into the address-space builder.
+/// </summary>
+/// <remarks>
+///     <para>Entry layout (little-endian) per Rockwell CIP Vol 1 + Logix 5000 CIP Programming
+///     Manual (1756-PM019 chapter "Symbol Object"), cross-checked against libplctag's
+///     <c>ab/cip.c</c> <c>handle_listed_tags_reply</c>:</para>
+///     <list type="table">
+///         <item><term>u32</term><description>Symbol Instance ID — opaque identifier for the tag.</description></item>
+///         <item><term>u16</term><description>Symbol Type — lower 12 bits = CIP type code (0xC1 BOOL,
+///             0xC2 SINT, …, 0xD0 STRING). Bit 12 = system-tag flag. Bit 13 = reserved.
+///             Bit 15 = struct flag; when set, the lower 12 bits are the template instance id
+///             (not a primitive type code).</description></item>
+///         <item><term>u16</term><description>Element length — bytes per element (e.g. 4 for DINT).</description></item>
+///         <item><term>u32 × 3</term><description>Array dimensions — zero for scalar tags.</description></item>
+///         <item><term>u16</term><description>Symbol name length in bytes.</description></item>
+///         <item><term>u8 × N</term><description>ASCII symbol name, padded to an even byte boundary.</description></item>
+///     </list>
+///
+///     <para><c>Program:</c>-scope tags arrive with their scope prefix baked into the name
+///     (<c>Program:MainProgram.StepIndex</c>); decoder strips the prefix + emits the scope
+///     separately so the driver's IAddressSpaceBuilder can organise them.</para>
+/// </remarks>
+public static class CipSymbolObjectDecoder
+{
+    // Fixed header size in bytes — instance-id(4) + symbol-type(2) + element-length(2)
+    // + array-dims(4×3) + name-length(2) = 22.
+    private const int FixedHeaderSize = 22;
+
+    private const ushort SymbolTypeSystemFlag = 0x1000;
+    private const ushort SymbolTypeStructFlag = 0x8000;
+    private const ushort SymbolTypeTypeCodeMask = 0x0FFF;
+
+    /// <summary>
+    ///     Decode the raw <c>@tags</c> blob into an enumerable sequence. Malformed entries at
+    ///     the tail cause decoding to stop gracefully — the caller gets whatever it could parse
+    ///     cleanly before the corruption.
+    /// </summary>
+    public static IEnumerable<AbCipDiscoveredTag> Decode(byte[] buffer)
+    {
+        ArgumentNullException.ThrowIfNull(buffer);
+        return DecodeImpl(buffer);
+    }
+
+    private static IEnumerable<AbCipDiscoveredTag> DecodeImpl(byte[] buffer)
+    {
+        var pos = 0;
+        while (pos + FixedHeaderSize <= buffer.Length)
+        {
+            var instanceId = BinaryPrimitives.ReadUInt32LittleEndian(buffer.AsSpan(pos));
+            var symbolType = BinaryPrimitives.ReadUInt16LittleEndian(buffer.AsSpan(pos + 4));
+            // element_length at pos+6 (u16) — useful for array sizing but not surfaced here
+            // array_dims at pos+8, pos+12, pos+16 — same (scalar-tag case has all zeros)
+            var nameLength = BinaryPrimitives.ReadUInt16LittleEndian(buffer.AsSpan(pos + 20));
+            pos += FixedHeaderSize;
+
+            if (pos + nameLength > buffer.Length) break;
+            var name = Encoding.ASCII.GetString(buffer, pos, nameLength);
+            pos += nameLength;
+            if ((pos & 1) != 0) pos++; // even-align for the next entry
+
+            if (string.IsNullOrWhiteSpace(name)) continue;
+
+            var isSystem = (symbolType & SymbolTypeSystemFlag) != 0;
+            var isStruct = (symbolType & SymbolTypeStructFlag) != 0;
+            var typeCode = symbolType & SymbolTypeTypeCodeMask;
+
+            var (programScope, simpleName) = SplitProgramScope(name);
+            var dataType = isStruct ? AbCipDataType.Structure : MapTypeCode((byte)typeCode);
+
+            yield return new AbCipDiscoveredTag(
+                Name: simpleName,
+                ProgramScope: programScope,
+                DataType: dataType ?? AbCipDataType.Structure, // unknown type code → treat as opaque
+                ReadOnly: false, // Symbol Object doesn't carry write-protection bits; lift via AccessControl Object later
+                IsSystemTag: isSystem);
+
+            _ = instanceId; // retained in the wire format for diagnostics; not surfaced to the driver today
+        }
+    }
+
+    /// <summary>
+    ///     Split a <c>Program:MainProgram.StepIndex</c>-style name into its scope + local
+    ///     parts. Names without the <c>Program:</c> prefix pass through unchanged.
+    /// </summary>
+    internal static (string? programScope, string simpleName) SplitProgramScope(string fullName)
+    {
+        const string prefix = "Program:";
+        if (!fullName.StartsWith(prefix, StringComparison.Ordinal)) return (null, fullName);
+        var afterPrefix = fullName[prefix.Length..];
+        var dot = afterPrefix.IndexOf('.');
+        if (dot <= 0) return (null, fullName); // malformed scope — surface the raw name
+        return (afterPrefix[..dot], afterPrefix[(dot + 1)..]);
+    }
+
+    /// <summary>
+    ///     Map a CIP atomic type code (lower 12 bits of the symbol-type field) to our
+    ///     <see cref="AbCipDataType"/> surface. Returns <c>null</c> for unrecognised codes —
+    ///     caller treats those as <see cref="AbCipDataType.Structure"/> so the symbol is still
+    ///     surfaced + downstream config can add a concrete type override.
+    /// </summary>
+    internal static AbCipDataType? MapTypeCode(byte typeCode) => typeCode switch
+    {
+        0xC1 => AbCipDataType.Bool,
+        0xC2 => AbCipDataType.SInt,
+        0xC3 => AbCipDataType.Int,
+        0xC4 => AbCipDataType.DInt,
+        0xC5 => AbCipDataType.LInt,
+        0xC6 => AbCipDataType.USInt,
+        0xC7 => AbCipDataType.UInt,
+        0xC8 => AbCipDataType.UDInt,
+        0xC9 => AbCipDataType.ULInt,
+        0xCA => AbCipDataType.Real,
+        0xCB => AbCipDataType.LReal,
+        0xCD => AbCipDataType.Dt,     // DATE
+        0xCF => AbCipDataType.Dt,     // DATE_AND_TIME
+        0xD0 => AbCipDataType.String,
+        _ => null,
+    };
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/CipTemplateObjectDecoder.cs

@@ -0,0 +1,140 @@
+using System.Buffers.Binary;
+using System.Text;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Decoder for the CIP Template Object (class 0x6C) blob returned by a <c>Read Template</c>
+///     service. Produces an <see cref="AbCipUdtShape"/> describing the UDT's name, total size,
+///     + ordered member list with per-member offset + type + array length.
+/// </summary>
+/// <remarks>
+///     <para>Wire format per Rockwell CIP Vol 1 §5A + Logix 5000 CIP Programming Manual
+///     1756-PM019 §"Template Object", cross-checked against libplctag's <c>ab/cip.c</c>
+///     <c>handle_read_template_reply</c>:</para>
+///
+///     <para>Header (fixed-size, little-endian):</para>
+///     <list type="table">
+///         <item><term>u16</term><description>Member count.</description></item>
+///         <item><term>u16</term><description>Struct handle (opaque id).</description></item>
+///         <item><term>u32</term><description>Instance size — bytes per structure instance.</description></item>
+///         <item><term>u32</term><description>Member-definition total size — not used here.</description></item>
+///     </list>
+///
+///     <para>Then <c>member_count</c> member blocks (8 bytes each):</para>
+///     <list type="table">
+///         <item><term>u16</term><description>Member info — type code + flags (same encoding
+///             as Symbol Object: bit 15 = struct, lower 12 = CIP type code).</description></item>
+///         <item><term>u16</term><description>Array size — 0 for scalar members.</description></item>
+///         <item><term>u32</term><description>Struct offset — byte offset from struct start.</description></item>
+///     </list>
+///
+///     <para>Then strings: UDT name followed by each member name, each terminated by a
+///     semicolon <c>;</c> followed by a null <c>\0</c>. The UDT name may itself contain the
+///     sequence <c>UDTName;0\0</c> where <c>0</c> after the semicolon is an ASCII flag byte.
+///     Decoder trims to the first semicolon.</para>
+/// </remarks>
+public static class CipTemplateObjectDecoder
+{
+    private const int HeaderSize = 12; // u16 + u16 + u32 + u32
+    private const int MemberBlockSize = 8; // u16 + u16 + u32
+
+    private const ushort MemberInfoStructFlag = 0x8000;
+    private const ushort MemberInfoTypeCodeMask = 0x0FFF;
+
+    /// <summary>
+    ///     Decode the raw Template Object blob. Returns <c>null</c> when the header indicates
+    ///     zero members or the buffer is too short to hold the fixed header.
+    /// </summary>
+    public static AbCipUdtShape? Decode(byte[] buffer)
+    {
+        ArgumentNullException.ThrowIfNull(buffer);
+        if (buffer.Length < HeaderSize) return null;
+
+        var memberCount = BinaryPrimitives.ReadUInt16LittleEndian(buffer.AsSpan(0));
+        // bytes 2-3: struct handle — opaque, not needed for the shape record
+        var instanceSize = BinaryPrimitives.ReadUInt32LittleEndian(buffer.AsSpan(4));
+        // bytes 8-11: member-definition total size — inferred from names list instead
+
+        if (memberCount == 0) return null;
+
+        var memberBlocksOffset = HeaderSize;
+        var namesOffset = memberBlocksOffset + MemberBlockSize * memberCount;
+        if (namesOffset > buffer.Length) return null;
+
+        var stringsSpan = buffer.AsSpan(namesOffset);
+        var names = ParseSemicolonTerminatedStrings(stringsSpan);
+        if (names.Count == 0) return null;
+
+        // Strings layout: UDT name first, then one per member (in the same order as the
+        // member-info blocks). Always consume the first entry as the UDT name; missing
+        // trailing member names get <member_N> placeholders below.
+        var udtName = names[0];
+        var memberNames = names.Skip(1).ToArray();
+
+        var members = new List<AbCipUdtMember>(memberCount);
+        for (var i = 0; i < memberCount; i++)
+        {
+            var blockOffset = memberBlocksOffset + (i * MemberBlockSize);
+            var info = BinaryPrimitives.ReadUInt16LittleEndian(buffer.AsSpan(blockOffset));
+            var arraySize = BinaryPrimitives.ReadUInt16LittleEndian(buffer.AsSpan(blockOffset + 2));
+            var offset = (int)BinaryPrimitives.ReadUInt32LittleEndian(buffer.AsSpan(blockOffset + 4));
+
+            var isStruct = (info & MemberInfoStructFlag) != 0;
+            var typeCode = (byte)(info & MemberInfoTypeCodeMask);
+            var dataType = isStruct
+                ? AbCipDataType.Structure
+                : (CipSymbolObjectDecoder.MapTypeCode(typeCode) ?? AbCipDataType.Structure);
+
+            var memberName = i < memberNames.Length ? memberNames[i] : $"<member_{i}>";
+            members.Add(new AbCipUdtMember(
+                Name: memberName,
+                Offset: offset,
+                DataType: dataType,
+                ArrayLength: arraySize == 0 ? 1 : arraySize));
+        }
+
+        return new AbCipUdtShape(
+            TypeName: udtName,
+            TotalSize: (int)instanceSize,
+            Members: members);
+    }
+
+    /// <summary>
+    ///     Walk a span of <c>NAME;\0NAME;\0…</c> byte sequences. Splits at each semicolon —
+    ///     the null byte after each semicolon is optional padding per Rockwell's string
+    ///     encoding convention. Stops at a trailing null / end of buffer.
+    /// </summary>
+    internal static List<string> ParseSemicolonTerminatedStrings(ReadOnlySpan<byte> span)
+    {
+        var result = new List<string>();
+        var start = 0;
+        for (var i = 0; i < span.Length; i++)
+        {
+            var b = span[i];
+            if (b == ';')
+            {
+                if (i > start)
+                    result.Add(Encoding.ASCII.GetString(span[start..i]));
+                // Skip the optional null/space padding following the semicolon.
+                while (i + 1 < span.Length && (span[i + 1] == '\0' || span[i + 1] == ' '))
+                    i++;
+                start = i + 1;
+            }
+            else if (b == 0 && start == i)
+            {
+                // Trailing null at a string boundary — done.
+                break;
+            }
+        }
+        // Trailing name without a semicolon (unlikely but observed on some firmwares).
+        if (start < span.Length)
+        {
+            var zeroAt = span[start..].IndexOf((byte)0);
+            var end = zeroAt < 0 ? span.Length : start + zeroAt;
+            if (end > start)
+                result.Add(Encoding.ASCII.GetString(span[start..end]));
+        }
+        return result;
+    }
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/IAbCipTagEnumerator.cs

@@ -0,0 +1,67 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Swappable scanner that walks a controller's symbol table (via libplctag's
+///     <c>@tags</c> pseudo-tag or the CIP Symbol Object class 0x6B) and yields the tags it
+///     finds. Defaults to <see cref="EmptyAbCipTagEnumeratorFactory"/> which returns no
+///     controller-side tags — the full <c>@tags</c> decoder lands as a follow-up PR once
+///     libplctag 1.5.2 either gains <c>TagInfoPlcMapper</c> upstream or we ship our own
+///     <c>IPlcMapper</c> for the Symbol Object byte layout (tracked via follow-up task; PR 5
+///     ships the abstraction + pre-declared-tag emission).
+/// </summary>
+public interface IAbCipTagEnumerator : IDisposable
+{
+    /// <summary>
+    ///     Enumerate the controller's tags for one device. Callers iterate asynchronously so
+    ///     large symbol tables don't require buffering the entire list.
+    /// </summary>
+    IAsyncEnumerable<AbCipDiscoveredTag> EnumerateAsync(
+        AbCipTagCreateParams deviceParams,
+        CancellationToken cancellationToken);
+}
+
+/// <summary>Factory for per-driver enumerators.</summary>
+public interface IAbCipTagEnumeratorFactory
+{
+    IAbCipTagEnumerator Create();
+}
+
+/// <summary>One tag yielded by <see cref="IAbCipTagEnumerator.EnumerateAsync"/>.</summary>
+/// <param name="Name">Logix symbolic name as returned by the Symbol Object.</param>
+/// <param name="ProgramScope">Program name if the tag is program-scoped; <c>null</c> for controller scope.</param>
+/// <param name="DataType">Detected data type; <see cref="AbCipDataType.Structure"/> when the tag
+///     is UDT-typed — the UDT shape lookup + per-member expansion ship with PR 6.</param>
+/// <param name="ReadOnly"><c>true</c> when the Symbol Object's External Access attribute forbids writes.</param>
+/// <param name="IsSystemTag">Hint from the enumerator that this is a system / infrastructure tag;
+///     the driver applies <see cref="AbCipSystemTagFilter"/> on top so the enumerator is not the
+///     single source of truth.</param>
+public sealed record AbCipDiscoveredTag(
+    string Name,
+    string? ProgramScope,
+    AbCipDataType DataType,
+    bool ReadOnly,
+    bool IsSystemTag = false);
+
+/// <summary>
+///     Default production enumerator — currently returns an empty sequence. The real <c>@tags</c>
+///     walk lands as a follow-up PR. Documented in <c>driver-specs.md §3</c> as the gap the
+///     Symbol Object walker closes.
+/// </summary>
+internal sealed class EmptyAbCipTagEnumerator : IAbCipTagEnumerator
+{
+    public async IAsyncEnumerable<AbCipDiscoveredTag> EnumerateAsync(
+        AbCipTagCreateParams deviceParams,
+        [System.Runtime.CompilerServices.EnumeratorCancellation] CancellationToken cancellationToken)
+    {
+        await Task.CompletedTask;
+        yield break;
+    }
+
+    public void Dispose() { }
+}
+
+/// <summary>Factory for <see cref="EmptyAbCipTagEnumerator"/>.</summary>
+internal sealed class EmptyAbCipTagEnumeratorFactory : IAbCipTagEnumeratorFactory
+{
+    public IAbCipTagEnumerator Create() => new EmptyAbCipTagEnumerator();
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/IAbCipTagRuntime.cs

@@ -0,0 +1,74 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Thin wire-layer abstraction over a single CIP tag. The driver holds one instance per
+///     <c>(device, tag path)</c> pair; the default implementation delegates to
+///     <see cref="LibplctagTagRuntime"/>. Tests swap in a fake via
+///     <see cref="IAbCipTagFactory"/> so the driver's read / write / status-mapping logic can
+///     be exercised without a running PLC or the native libplctag binary.
+/// </summary>
+public interface IAbCipTagRuntime : IDisposable
+{
+    /// <summary>Create the underlying native tag (equivalent to libplctag's <c>plc_tag_create</c>).</summary>
+    Task InitializeAsync(CancellationToken cancellationToken);
+
+    /// <summary>Issue a read; on completion the local buffer holds the current PLC value.</summary>
+    Task ReadAsync(CancellationToken cancellationToken);
+
+    /// <summary>Flush the local buffer to the PLC.</summary>
+    Task WriteAsync(CancellationToken cancellationToken);
+
+    /// <summary>
+    ///     Raw libplctag status code — mapped to an OPC UA StatusCode via
+    ///     <see cref="AbCipStatusMapper.MapLibplctagStatus"/>. Zero on success, negative on error.
+    /// </summary>
+    int GetStatus();
+
+    /// <summary>
+    ///     Decode the local buffer into a boxed .NET value per the tag's configured type.
+    ///     <paramref name="bitIndex"/> is non-null only for BOOL-within-DINT tags captured in
+    ///     the <c>.N</c> syntax at parse time.
+    /// </summary>
+    object? DecodeValue(AbCipDataType type, int? bitIndex);
+
+    /// <summary>
+    ///     Decode a value at an arbitrary byte offset in the local buffer. Task #194 —
+    ///     whole-UDT reads perform one <see cref="ReadAsync"/> on the parent UDT tag then
+    ///     call this per declared member with its computed offset, avoiding one libplctag
+    ///     round-trip per member. Implementations that do not support offset-aware decoding
+    ///     may fall back to <see cref="DecodeValue"/> when <paramref name="offset"/> is zero;
+    ///     offsets greater than zero against an unsupporting runtime should return <c>null</c>
+    ///     so the planner can skip grouping.
+    /// </summary>
+    object? DecodeValueAt(AbCipDataType type, int offset, int? bitIndex);
+
+    /// <summary>
+    ///     Encode <paramref name="value"/> into the local buffer per the tag's type. Callers
+    ///     pair this with <see cref="WriteAsync"/>.
+    /// </summary>
+    void EncodeValue(AbCipDataType type, int? bitIndex, object? value);
+}
+
+/// <summary>
+///     Factory for per-tag runtime handles. Instantiated once per driver, consumed per
+///     <c>(device, tag path)</c> pair at the first read/write.
+/// </summary>
+public interface IAbCipTagFactory
+{
+    IAbCipTagRuntime Create(AbCipTagCreateParams createParams);
+}
+
+/// <summary>Everything libplctag needs to materialise a tag handle.</summary>
+/// <param name="Gateway">Gateway IP / hostname parsed from <see cref="AbCipHostAddress.Gateway"/>.</param>
+/// <param name="Port">EtherNet/IP TCP port — default 44818.</param>
+/// <param name="CipPath">CIP route path, e.g. <c>1,0</c>. Empty for Micro800.</param>
+/// <param name="LibplctagPlcAttribute">libplctag <c>plc=...</c> attribute, per family profile.</param>
+/// <param name="TagName">Logix symbolic tag name as emitted by <see cref="AbCipTagPath.ToLibplctagName"/>.</param>
+/// <param name="Timeout">libplctag operation timeout (applies to Initialize / Read / Write).</param>
+public sealed record AbCipTagCreateParams(
+    string Gateway,
+    int Port,
+    string CipPath,
+    string LibplctagPlcAttribute,
+    string TagName,
+    TimeSpan Timeout);

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/IAbCipTemplateReader.cs

@@ -0,0 +1,26 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Reads the raw Template Object (class 0x6C) blob for a given UDT template instance id
+///     off a Logix controller. The default production implementation (see
+///     <see cref="LibplctagTemplateReader"/>) uses libplctag's <c>@udt/{id}</c> pseudo-tag.
+///     Tests swap in a fake via <see cref="IAbCipTemplateReaderFactory"/>.
+/// </summary>
+public interface IAbCipTemplateReader : IDisposable
+{
+    /// <summary>
+    ///     Read the raw template bytes for <paramref name="templateInstanceId"/>. Returns the
+    ///     full blob the Read Template service produced — the managed <see cref="CipTemplateObjectDecoder"/>
+    ///     parses it into an <see cref="AbCipUdtShape"/>.
+    /// </summary>
+    Task<byte[]> ReadAsync(
+        AbCipTagCreateParams deviceParams,
+        uint templateInstanceId,
+        CancellationToken cancellationToken);
+}
+
+/// <summary>Factory for <see cref="IAbCipTemplateReader"/>.</summary>
+public interface IAbCipTemplateReaderFactory
+{
+    IAbCipTemplateReader Create();
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/LibplctagTagEnumerator.cs

@@ -0,0 +1,63 @@
+using System.Runtime.CompilerServices;
+using libplctag;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Real <see cref="IAbCipTagEnumerator"/> that walks a Logix controller's symbol table by
+///     reading the <c>@tags</c> pseudo-tag via libplctag + decoding the CIP Symbol Object
+///     response with <see cref="CipSymbolObjectDecoder"/>.
+/// </summary>
+/// <remarks>
+///     <para>libplctag's <c>Tag.GetBuffer()</c> returns the raw Symbol Object bytes when the
+///     tag name is <c>@tags</c>. The decoder walks the concatenated entries + emits
+///     <see cref="AbCipDiscoveredTag"/> records matching our driver surface.</para>
+///
+///     <para>Task #178 closed the stub gap from PR 5 — <see cref="EmptyAbCipTagEnumerator"/>
+///     is still available for tests that don't want to touch the native library, but the
+///     production factory default now wires this implementation in.</para>
+/// </remarks>
+internal sealed class LibplctagTagEnumerator : IAbCipTagEnumerator
+{
+    private Tag? _tag;
+
+    public async IAsyncEnumerable<AbCipDiscoveredTag> EnumerateAsync(
+        AbCipTagCreateParams deviceParams,
+        [EnumeratorCancellation] CancellationToken cancellationToken)
+    {
+        // Build a tag specifically for the @tags pseudo — same gateway + path as the device,
+        // distinguished by the name alone.
+        _tag = new Tag
+        {
+            Gateway = deviceParams.Gateway,
+            Path = deviceParams.CipPath,
+            PlcType = MapPlcType(deviceParams.LibplctagPlcAttribute),
+            Protocol = Protocol.ab_eip,
+            Name = "@tags",
+            Timeout = deviceParams.Timeout,
+        };
+
+        await _tag.InitializeAsync(cancellationToken).ConfigureAwait(false);
+        await _tag.ReadAsync(cancellationToken).ConfigureAwait(false);
+
+        var buffer = _tag.GetBuffer();
+        foreach (var tag in CipSymbolObjectDecoder.Decode(buffer))
+            yield return tag;
+    }
+
+    public void Dispose() => _tag?.Dispose();
+
+    private static PlcType MapPlcType(string attribute) => attribute switch
+    {
+        "controllogix" => PlcType.ControlLogix,
+        "compactlogix" => PlcType.ControlLogix,
+        "micro800" => PlcType.Micro800,
+        _ => PlcType.ControlLogix,
+    };
+}
+
+/// <summary>Factory for <see cref="LibplctagTagEnumerator"/>.</summary>
+internal sealed class LibplctagTagEnumeratorFactory : IAbCipTagEnumeratorFactory
+{
+    public IAbCipTagEnumerator Create() => new LibplctagTagEnumerator();
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/LibplctagTagRuntime.cs

@@ -0,0 +1,140 @@
+using libplctag;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Default libplctag-backed <see cref="IAbCipTagRuntime"/>. Wraps a <see cref="Tag"/>
+///     instance + translates our <see cref="AbCipDataType"/> enum into the
+///     <c>GetInt32</c> / <c>GetFloat32</c> / <c>GetString</c> / <c>GetBit</c> calls libplctag
+///     exposes. One runtime instance per <c>(device, tag path)</c>; lifetime is owned by the
+///     driver's per-device state dict.
+/// </summary>
+internal sealed class LibplctagTagRuntime : IAbCipTagRuntime
+{
+    private readonly Tag _tag;
+
+    public LibplctagTagRuntime(AbCipTagCreateParams p)
+    {
+        _tag = new Tag
+        {
+            Gateway = p.Gateway,
+            Path = p.CipPath,
+            PlcType = MapPlcType(p.LibplctagPlcAttribute),
+            Protocol = Protocol.ab_eip,
+            Name = p.TagName,
+            Timeout = p.Timeout,
+        };
+    }
+
+    public Task InitializeAsync(CancellationToken cancellationToken) => _tag.InitializeAsync(cancellationToken);
+    public Task ReadAsync(CancellationToken cancellationToken) => _tag.ReadAsync(cancellationToken);
+    public Task WriteAsync(CancellationToken cancellationToken) => _tag.WriteAsync(cancellationToken);
+
+    public int GetStatus() => (int)_tag.GetStatus();
+
+    public object? DecodeValue(AbCipDataType type, int? bitIndex) => DecodeValueAt(type, 0, bitIndex);
+
+    public object? DecodeValueAt(AbCipDataType type, int offset, int? bitIndex) => type switch
+    {
+        AbCipDataType.Bool => bitIndex is int bit
+            ? _tag.GetBit(bit)
+            : _tag.GetInt8(offset) != 0,
+        AbCipDataType.SInt => (int)(sbyte)_tag.GetInt8(offset),
+        AbCipDataType.USInt => (int)_tag.GetUInt8(offset),
+        AbCipDataType.Int => (int)_tag.GetInt16(offset),
+        AbCipDataType.UInt => (int)_tag.GetUInt16(offset),
+        AbCipDataType.DInt => _tag.GetInt32(offset),
+        AbCipDataType.UDInt => (int)_tag.GetUInt32(offset),
+        AbCipDataType.LInt => _tag.GetInt64(offset),
+        AbCipDataType.ULInt => (long)_tag.GetUInt64(offset),
+        AbCipDataType.Real => _tag.GetFloat32(offset),
+        AbCipDataType.LReal => _tag.GetFloat64(offset),
+        AbCipDataType.String => _tag.GetString(offset),
+        AbCipDataType.Dt => _tag.GetInt32(offset),
+        AbCipDataType.Structure => null,
+        _ => null,
+    };
+
+    public void EncodeValue(AbCipDataType type, int? bitIndex, object? value)
+    {
+        switch (type)
+        {
+            case AbCipDataType.Bool:
+                if (bitIndex is int)
+                {
+                    // BOOL-within-DINT writes are routed at the driver level (AbCipDriver.
+                    // WriteBitInDIntAsync) via a parallel parent-DINT runtime so the RMW stays
+                    // serialised. If one reaches here it means the driver dispatch was bypassed —
+                    // throw so the error surfaces loudly rather than clobbering the whole DINT.
+                    throw new NotSupportedException(
+                        "BOOL-with-bitIndex writes must go through AbCipDriver.WriteBitInDIntAsync, not LibplctagTagRuntime.");
+                }
+                _tag.SetInt8(0, Convert.ToBoolean(value) ? (sbyte)1 : (sbyte)0);
+                break;
+            case AbCipDataType.SInt:
+                _tag.SetInt8(0, Convert.ToSByte(value));
+                break;
+            case AbCipDataType.USInt:
+                _tag.SetUInt8(0, Convert.ToByte(value));
+                break;
+            case AbCipDataType.Int:
+                _tag.SetInt16(0, Convert.ToInt16(value));
+                break;
+            case AbCipDataType.UInt:
+                _tag.SetUInt16(0, Convert.ToUInt16(value));
+                break;
+            case AbCipDataType.DInt:
+                _tag.SetInt32(0, Convert.ToInt32(value));
+                break;
+            case AbCipDataType.UDInt:
+                _tag.SetUInt32(0, Convert.ToUInt32(value));
+                break;
+            case AbCipDataType.LInt:
+                _tag.SetInt64(0, Convert.ToInt64(value));
+                break;
+            case AbCipDataType.ULInt:
+                _tag.SetUInt64(0, Convert.ToUInt64(value));
+                break;
+            case AbCipDataType.Real:
+                _tag.SetFloat32(0, Convert.ToSingle(value));
+                break;
+            case AbCipDataType.LReal:
+                _tag.SetFloat64(0, Convert.ToDouble(value));
+                break;
+            case AbCipDataType.String:
+                _tag.SetString(0, Convert.ToString(value) ?? string.Empty);
+                break;
+            case AbCipDataType.Dt:
+                _tag.SetInt32(0, Convert.ToInt32(value));
+                break;
+            case AbCipDataType.Structure:
+                throw new NotSupportedException("Whole-UDT writes land in PR 6.");
+            default:
+                throw new NotSupportedException($"AbCipDataType {type} not writable.");
+        }
+    }
+
+    public void Dispose() => _tag.Dispose();
+
+    private static PlcType MapPlcType(string attribute) => attribute switch
+    {
+        "controllogix" => PlcType.ControlLogix,
+        "compactlogix" => PlcType.ControlLogix, // libplctag treats CompactLogix under ControlLogix family
+        "micro800" => PlcType.Micro800,
+        "micrologix" => PlcType.MicroLogix,
+        "slc500" => PlcType.Slc500,
+        "plc5" => PlcType.Plc5,
+        "omron-njnx" => PlcType.Omron,
+        _ => PlcType.ControlLogix,
+    };
+}
+
+/// <summary>
+///     Default <see cref="IAbCipTagFactory"/> — creates a fresh <see cref="LibplctagTagRuntime"/>
+///     per call. Stateless; safe to share across devices.
+/// </summary>
+internal sealed class LibplctagTagFactory : IAbCipTagFactory
+{
+    public IAbCipTagRuntime Create(AbCipTagCreateParams createParams) =>
+        new LibplctagTagRuntime(createParams);
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/LibplctagTemplateReader.cs

@@ -0,0 +1,49 @@
+using libplctag;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     libplctag-backed <see cref="IAbCipTemplateReader"/>. Opens the <c>@udt/{templateId}</c>
+///     pseudo-tag libplctag exposes for Template Object reads, issues a <c>Read Template</c>
+///     internally via a normal read call, + returns the raw byte buffer so
+///     <see cref="CipTemplateObjectDecoder"/> can decode it.
+/// </summary>
+internal sealed class LibplctagTemplateReader : IAbCipTemplateReader
+{
+    private Tag? _tag;
+
+    public async Task<byte[]> ReadAsync(
+        AbCipTagCreateParams deviceParams,
+        uint templateInstanceId,
+        CancellationToken cancellationToken)
+    {
+        _tag?.Dispose();
+        _tag = new Tag
+        {
+            Gateway = deviceParams.Gateway,
+            Path = deviceParams.CipPath,
+            PlcType = MapPlcType(deviceParams.LibplctagPlcAttribute),
+            Protocol = Protocol.ab_eip,
+            Name = $"@udt/{templateInstanceId}",
+            Timeout = deviceParams.Timeout,
+        };
+        await _tag.InitializeAsync(cancellationToken).ConfigureAwait(false);
+        await _tag.ReadAsync(cancellationToken).ConfigureAwait(false);
+        return _tag.GetBuffer();
+    }
+
+    public void Dispose() => _tag?.Dispose();
+
+    private static PlcType MapPlcType(string attribute) => attribute switch
+    {
+        "controllogix" => PlcType.ControlLogix,
+        "compactlogix" => PlcType.ControlLogix,
+        "micro800" => PlcType.Micro800,
+        _ => PlcType.ControlLogix,
+    };
+}
+
+internal sealed class LibplctagTemplateReaderFactory : IAbCipTemplateReaderFactory
+{
+    public IAbCipTemplateReader Create() => new LibplctagTemplateReader();
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/PlcFamilies/AbCipPlcFamilyProfile.cs

@@ -0,0 +1,62 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.PlcFamilies;
+
+/// <summary>
+///     Per-family libplctag defaults. Picked up at device-initialization time so each PLC
+///     family gets the correct ConnectionSize, path semantics, and quirks applied without
+///     the caller having to know the protocol-level differences.
+/// </summary>
+/// <remarks>
+///     Mirrors the shape of the Modbus driver's per-family profiles (DL205, Siemens S7,
+///     Mitsubishi MELSEC). ControlLogix is the baseline; each subsequent family is a delta.
+///     Family-specific wire tests ship in PRs 9–12.
+/// </remarks>
+public sealed record AbCipPlcFamilyProfile(
+    string LibplctagPlcAttribute,
+    int DefaultConnectionSize,
+    string DefaultCipPath,
+    bool SupportsRequestPacking,
+    bool SupportsConnectedMessaging,
+    int MaxFragmentBytes)
+{
+    /// <summary>Look up the profile for a configured family.</summary>
+    public static AbCipPlcFamilyProfile ForFamily(AbCipPlcFamily family) => family switch
+    {
+        AbCipPlcFamily.ControlLogix => ControlLogix,
+        AbCipPlcFamily.CompactLogix => CompactLogix,
+        AbCipPlcFamily.Micro800 => Micro800,
+        AbCipPlcFamily.GuardLogix => GuardLogix,
+        _ => ControlLogix,
+    };
+
+    public static readonly AbCipPlcFamilyProfile ControlLogix = new(
+        LibplctagPlcAttribute: "controllogix",
+        DefaultConnectionSize: 4002, // Large Forward Open; FW20+
+        DefaultCipPath: "1,0",
+        SupportsRequestPacking: true,
+        SupportsConnectedMessaging: true,
+        MaxFragmentBytes: 4000);
+
+    public static readonly AbCipPlcFamilyProfile CompactLogix = new(
+        LibplctagPlcAttribute: "compactlogix",
+        DefaultConnectionSize: 504, // 5069-L3x narrower buffer; safe baseline that never over-shoots
+        DefaultCipPath: "1,0",
+        SupportsRequestPacking: true,
+        SupportsConnectedMessaging: true,
+        MaxFragmentBytes: 500);
+
+    public static readonly AbCipPlcFamilyProfile Micro800 = new(
+        LibplctagPlcAttribute: "micro800",
+        DefaultConnectionSize: 488, // Micro800 hard cap
+        DefaultCipPath: "",         // no backplane routing
+        SupportsRequestPacking: false,
+        SupportsConnectedMessaging: false, // unconnected-only on most models
+        MaxFragmentBytes: 484);
+
+    public static readonly AbCipPlcFamilyProfile GuardLogix = new(
+        LibplctagPlcAttribute: "controllogix", // wire protocol identical; safety partition is tag-level
+        DefaultConnectionSize: 4002,
+        DefaultCipPath: "1,0",
+        SupportsRequestPacking: true,
+        SupportsConnectedMessaging: true,
+        MaxFragmentBytes: 4000);
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/PlcTagHandle.cs

@@ -0,0 +1,59 @@
+using System.Runtime.InteropServices;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     <see cref="SafeHandle"/> wrapper around a libplctag native tag handle (an <c>int32</c>
+///     returned from <c>plc_tag_create_ex</c>). Owns lifetime of the native allocation so a
+///     leaked / GC-collected <see cref="PlcTagHandle"/> still calls <c>plc_tag_destroy</c>
+///     during finalization — necessary because native libplctag allocations are opaque to
+///     the driver's <see cref="Core.Abstractions.IDriver.GetMemoryFootprint"/>.
+/// </summary>
+/// <remarks>
+///     <para>Risk documented in driver-specs.md §3 ("Operational Stability Notes"): the CLR
+///     allocation tracker doesn't see libplctag's native heap, only whole-process RSS can.
+///     Every handle leaked past its useful life is a direct contributor to the Tier-B recycle
+///     trigger, so owning lifetime via SafeHandle is non-negotiable.</para>
+///
+///     <para><see cref="IsInvalid"/> is <c>true</c> when the native ID is &lt;= 0 — libplctag
+///     returns negative <c>PLCTAG_ERR_*</c> codes on <c>plc_tag_create_ex</c> failure, which
+///     we surface as an invalid handle rather than a disposable one (destroying a negative
+///     handle would be undefined behavior in the native library).</para>
+///
+///     <para>The actual <c>DllImport</c> for <c>plc_tag_destroy</c> is deferred to PR 3 when
+///     the driver first makes wire calls — PR 2 ships the lifetime scaffold + tests only.
+///     Until the P/Invoke lands, <see cref="ReleaseHandle"/> is a no-op; the finalizer still
+///     runs so the integration is correct as soon as the import is added.</para>
+/// </remarks>
+public sealed class PlcTagHandle : SafeHandle
+{
+    /// <summary>Construct an invalid handle placeholder (use <see cref="FromNative"/> once created).</summary>
+    public PlcTagHandle() : base(invalidHandleValue: IntPtr.Zero, ownsHandle: true) { }
+
+    private PlcTagHandle(int nativeId) : base(invalidHandleValue: IntPtr.Zero, ownsHandle: true)
+    {
+        SetHandle(new IntPtr(nativeId));
+    }
+
+    /// <summary>Handle is invalid when the native ID is zero or negative (libplctag error).</summary>
+    public override bool IsInvalid => handle.ToInt32() <= 0;
+
+    /// <summary>Integer ID libplctag issued on <c>plc_tag_create_ex</c>.</summary>
+    public int NativeId => handle.ToInt32();
+
+    /// <summary>Wrap a native tag ID returned from libplctag.</summary>
+    public static PlcTagHandle FromNative(int nativeId) => new(nativeId);
+
+    /// <summary>
+    ///     Destroy the native tag. No-op for PR 2 (the wire P/Invoke lands in PR 3). The base
+    ///     <see cref="SafeHandle"/> machinery still guarantees this runs exactly once per
+    ///     handle — either during <see cref="SafeHandle.Dispose()"/> or during finalization
+    ///     if the owner was GC'd without explicit Dispose.
+    /// </summary>
+    protected override bool ReleaseHandle()
+    {
+        if (IsInvalid) return true;
+        // PR 3: wire up plc_tag_destroy(handle.ToInt32()) once the DllImport lands.
+        return true;
+    }
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/ZB.MOM.WW.OtOpcUa.Driver.AbCip.csproj

@@ -0,0 +1,31 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <LangVersion>latest</LangVersion>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+        <GenerateDocumentationFile>true</GenerateDocumentationFile>
+        <NoWarn>$(NoWarn);CS1591</NoWarn>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.AbCip</RootNamespace>
+        <AssemblyName>ZB.MOM.WW.OtOpcUa.Driver.AbCip</AssemblyName>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Core.Abstractions\ZB.MOM.WW.OtOpcUa.Core.Abstractions.csproj"/>
+        <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Core\ZB.MOM.WW.OtOpcUa.Core.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <!-- libplctag managed wrapper (pulls in libplctag.NativeImport transitively).
+             Decision #11 — EtherNet/IP + CIP + Logix symbolic against ControlLogix / CompactLogix /
+             Micro800 / SLC500 / PLC-5. -->
+        <PackageReference Include="libplctag" Version="1.5.2"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests"/>
+    </ItemGroup>
+
+</Project>

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/AbLegacyAddress.cs

@@ -0,0 +1,102 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy;
+
+/// <summary>
+///     Parsed PCCC file-based address: file letter + file number + word number, optionally a
+///     sub-element (<c>.ACC</c> on a timer) or bit index (<c>/0</c> on a bit file).
+/// </summary>
+/// <remarks>
+///     <para>Logix symbolic tags are parsed elsewhere (<see cref="AbLegacy"/> is for SLC / PLC-5 /
+///     MicroLogix — no symbol table; everything is file-letter + file-number + word-number).</para>
+///     <list type="bullet">
+///         <item><c>N7:0</c> — integer file 7, word 0 (signed 16-bit).</item>
+///         <item><c>N7:5</c> — integer file 7, word 5.</item>
+///         <item><c>F8:0</c> — float file 8, word 0 (32-bit IEEE754).</item>
+///         <item><c>B3:0/0</c> — bit file 3, word 0, bit 0.</item>
+///         <item><c>ST9:0</c> — string file 9, string 0 (82-byte fixed-length + length word).</item>
+///         <item><c>T4:0.ACC</c> — timer file 4, timer 0, accumulator sub-element.</item>
+///         <item><c>C5:0.PRE</c> — counter file 5, counter 0, preset sub-element.</item>
+///         <item><c>I:0/0</c> — input file, slot 0, bit 0 (no file-number for I/O).</item>
+///         <item><c>O:1/2</c> — output file, slot 1, bit 2.</item>
+///         <item><c>S:1</c> — status file, word 1.</item>
+///         <item><c>L9:0</c> — long-integer file (SLC 5/05+, 32-bit).</item>
+///     </list>
+///     <para>Pass the original string straight through to libplctag's <c>name=...</c> attribute —
+///     the PLC-side decoder handles the format. This parser only validates the shape + surfaces
+///     the structural pieces for driver-side routing (e.g. deciding whether a tag needs
+///     bit-level read-modify-write).</para>
+/// </remarks>
+public sealed record AbLegacyAddress(
+    string FileLetter,
+    int? FileNumber,
+    int WordNumber,
+    int? BitIndex,
+    string? SubElement)
+{
+    public string ToLibplctagName()
+    {
+        var file = FileNumber is null ? FileLetter : $"{FileLetter}{FileNumber}";
+        var wordPart = $"{file}:{WordNumber}";
+        if (SubElement is not null) wordPart += $".{SubElement}";
+        if (BitIndex is not null) wordPart += $"/{BitIndex}";
+        return wordPart;
+    }
+
+    public static AbLegacyAddress? TryParse(string? value)
+    {
+        if (string.IsNullOrWhiteSpace(value)) return null;
+        var src = value.Trim();
+
+        // BitIndex: trailing /N
+        int? bitIndex = null;
+        var slashIdx = src.IndexOf('/');
+        if (slashIdx >= 0)
+        {
+            if (!int.TryParse(src[(slashIdx + 1)..], out var bit) || bit < 0 || bit > 31) return null;
+            bitIndex = bit;
+            src = src[..slashIdx];
+        }
+
+        // SubElement: trailing .NAME (ACC / PRE / EN / DN / TT / CU / CD / FD / etc.)
+        string? subElement = null;
+        var dotIdx = src.LastIndexOf('.');
+        if (dotIdx >= 0)
+        {
+            var candidate = src[(dotIdx + 1)..];
+            if (candidate.Length > 0 && candidate.All(char.IsLetter))
+            {
+                subElement = candidate.ToUpperInvariant();
+                src = src[..dotIdx];
+            }
+        }
+
+        var colonIdx = src.IndexOf(':');
+        if (colonIdx <= 0) return null;
+        var filePart = src[..colonIdx];
+        var wordPart = src[(colonIdx + 1)..];
+        if (!int.TryParse(wordPart, out var word) || word < 0) return null;
+
+        // File letter + optional file number (single letter for I/O/S, letter+number otherwise).
+        if (filePart.Length == 0 || !char.IsLetter(filePart[0])) return null;
+        var letterEnd = 1;
+        while (letterEnd < filePart.Length && char.IsLetter(filePart[letterEnd])) letterEnd++;
+
+        var letter = filePart[..letterEnd].ToUpperInvariant();
+        int? fileNumber = null;
+        if (letterEnd < filePart.Length)
+        {
+            if (!int.TryParse(filePart[letterEnd..], out var fn) || fn < 0) return null;
+            fileNumber = fn;
+        }
+
+        // Reject unknown file letters — these cover SLC/ML/PLC-5 canonical families.
+        if (!IsKnownFileLetter(letter)) return null;
+
+        return new AbLegacyAddress(letter, fileNumber, word, bitIndex, subElement);
+    }
+
+    private static bool IsKnownFileLetter(string letter) => letter switch
+    {
+        "N" or "F" or "B" or "L" or "ST" or "T" or "C" or "R" or "I" or "O" or "S" or "A" => true,
+        _ => false,
+    };
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/AbLegacyDataType.cs

@@ -0,0 +1,45 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy;
+
+/// <summary>
+///     PCCC data types that map onto SLC / MicroLogix / PLC-5 files. Narrower than Logix — no
+///     symbolic UDTs; every type is file-typed and fixed-width.
+/// </summary>
+public enum AbLegacyDataType
+{
+    /// <summary>B-file single bit (<c>B3:0/0</c>) or bit-within-N-file (<c>N7:0/3</c>).</summary>
+    Bit,
+    /// <summary>N-file integer (signed 16-bit).</summary>
+    Int,
+    /// <summary>L-file long integer — SLC 5/05+ only (signed 32-bit).</summary>
+    Long,
+    /// <summary>F-file float (32-bit IEEE-754).</summary>
+    Float,
+    /// <summary>A-file analog integer — some older hardware (signed 16-bit, semantically like N).</summary>
+    AnalogInt,
+    /// <summary>ST-file string (82-byte fixed-length + length word header).</summary>
+    String,
+    /// <summary>Timer sub-element — caller addresses <c>.ACC</c>, <c>.PRE</c>, <c>.EN</c>, <c>.DN</c>, <c>.TT</c>.</summary>
+    TimerElement,
+    /// <summary>Counter sub-element — caller addresses <c>.ACC</c>, <c>.PRE</c>, <c>.CU</c>, <c>.CD</c>, <c>.DN</c>.</summary>
+    CounterElement,
+    /// <summary>Control sub-element — caller addresses <c>.LEN</c>, <c>.POS</c>, <c>.EN</c>, <c>.DN</c>, <c>.ER</c>.</summary>
+    ControlElement,
+}
+
+/// <summary>Map a PCCC data type to the driver-surface <see cref="DriverDataType"/>.</summary>
+public static class AbLegacyDataTypeExtensions
+{
+    public static DriverDataType ToDriverDataType(this AbLegacyDataType t) => t switch
+    {
+        AbLegacyDataType.Bit => DriverDataType.Boolean,
+        AbLegacyDataType.Int or AbLegacyDataType.AnalogInt => DriverDataType.Int32,
+        AbLegacyDataType.Long => DriverDataType.Int32,       // matches Modbus/AbCip 64→32 gap
+        AbLegacyDataType.Float => DriverDataType.Float32,
+        AbLegacyDataType.String => DriverDataType.String,
+        AbLegacyDataType.TimerElement or AbLegacyDataType.CounterElement
+            or AbLegacyDataType.ControlElement => DriverDataType.Int32,
+        _ => DriverDataType.Int32,
+    };
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/AbLegacyDriver.cs

@@ -0,0 +1,481 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.PlcFamilies;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy;
+
+/// <summary>
+///     AB Legacy / PCCC driver — SLC 500, MicroLogix, PLC-5, LogixPccc. Implements
+///     <see cref="IDriver"/> only at PR 1 time; read / write / discovery / subscribe / probe /
+///     host-resolver capabilities ship in PRs 2 and 3.
+/// </summary>
+public sealed class AbLegacyDriver : IDriver, IReadable, IWritable, ITagDiscovery, ISubscribable,
+    IHostConnectivityProbe, IPerCallHostResolver, IDisposable, IAsyncDisposable
+{
+    private readonly AbLegacyDriverOptions _options;
+    private readonly string _driverInstanceId;
+    private readonly IAbLegacyTagFactory _tagFactory;
+    private readonly PollGroupEngine _poll;
+    private readonly Dictionary<string, DeviceState> _devices = new(StringComparer.OrdinalIgnoreCase);
+    private readonly Dictionary<string, AbLegacyTagDefinition> _tagsByName = new(StringComparer.OrdinalIgnoreCase);
+    private DriverHealth _health = new(DriverState.Unknown, null, null);
+
+    public event EventHandler<DataChangeEventArgs>? OnDataChange;
+    public event EventHandler<HostStatusChangedEventArgs>? OnHostStatusChanged;
+
+    public AbLegacyDriver(AbLegacyDriverOptions options, string driverInstanceId,
+        IAbLegacyTagFactory? tagFactory = null)
+    {
+        ArgumentNullException.ThrowIfNull(options);
+        _options = options;
+        _driverInstanceId = driverInstanceId;
+        _tagFactory = tagFactory ?? new LibplctagLegacyTagFactory();
+        _poll = new PollGroupEngine(
+            reader: ReadAsync,
+            onChange: (handle, tagRef, snapshot) =>
+                OnDataChange?.Invoke(this, new DataChangeEventArgs(handle, tagRef, snapshot)));
+    }
+
+    public string DriverInstanceId => _driverInstanceId;
+    public string DriverType => "AbLegacy";
+
+    public Task InitializeAsync(string driverConfigJson, CancellationToken cancellationToken)
+    {
+        _health = new DriverHealth(DriverState.Initializing, null, null);
+        try
+        {
+            foreach (var device in _options.Devices)
+            {
+                var addr = AbLegacyHostAddress.TryParse(device.HostAddress)
+                    ?? throw new InvalidOperationException(
+                        $"AbLegacy device has invalid HostAddress '{device.HostAddress}' — expected 'ab://gateway[:port]/cip-path'.");
+                var profile = AbLegacyPlcFamilyProfile.ForFamily(device.PlcFamily);
+                _devices[device.HostAddress] = new DeviceState(addr, device, profile);
+            }
+            foreach (var tag in _options.Tags) _tagsByName[tag.Name] = tag;
+
+            // Probe loops — one per device when enabled + probe address configured.
+            if (_options.Probe.Enabled && !string.IsNullOrWhiteSpace(_options.Probe.ProbeAddress))
+            {
+                foreach (var state in _devices.Values)
+                {
+                    state.ProbeCts = new CancellationTokenSource();
+                    var ct = state.ProbeCts.Token;
+                    _ = Task.Run(() => ProbeLoopAsync(state, ct), ct);
+                }
+            }
+            _health = new DriverHealth(DriverState.Healthy, DateTime.UtcNow, null);
+        }
+        catch (Exception ex)
+        {
+            _health = new DriverHealth(DriverState.Faulted, null, ex.Message);
+            throw;
+        }
+        return Task.CompletedTask;
+    }
+
+    public async Task ReinitializeAsync(string driverConfigJson, CancellationToken cancellationToken)
+    {
+        await ShutdownAsync(cancellationToken).ConfigureAwait(false);
+        await InitializeAsync(driverConfigJson, cancellationToken).ConfigureAwait(false);
+    }
+
+    public async Task ShutdownAsync(CancellationToken cancellationToken)
+    {
+        await _poll.DisposeAsync().ConfigureAwait(false);
+        foreach (var state in _devices.Values)
+        {
+            try { state.ProbeCts?.Cancel(); } catch { }
+            state.ProbeCts?.Dispose();
+            state.ProbeCts = null;
+            state.DisposeRuntimes();
+        }
+        _devices.Clear();
+        _tagsByName.Clear();
+        _health = new DriverHealth(DriverState.Unknown, _health.LastSuccessfulRead, null);
+    }
+
+    public DriverHealth GetHealth() => _health;
+    public long GetMemoryFootprint() => 0;
+    public Task FlushOptionalCachesAsync(CancellationToken cancellationToken) => Task.CompletedTask;
+
+    internal int DeviceCount => _devices.Count;
+    internal DeviceState? GetDeviceState(string hostAddress) =>
+        _devices.TryGetValue(hostAddress, out var s) ? s : null;
+
+    // ---- IReadable ----
+
+    public async Task<IReadOnlyList<DataValueSnapshot>> ReadAsync(
+        IReadOnlyList<string> fullReferences, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(fullReferences);
+        var now = DateTime.UtcNow;
+        var results = new DataValueSnapshot[fullReferences.Count];
+
+        for (var i = 0; i < fullReferences.Count; i++)
+        {
+            var reference = fullReferences[i];
+            if (!_tagsByName.TryGetValue(reference, out var def))
+            {
+                results[i] = new DataValueSnapshot(null, AbLegacyStatusMapper.BadNodeIdUnknown, null, now);
+                continue;
+            }
+            if (!_devices.TryGetValue(def.DeviceHostAddress, out var device))
+            {
+                results[i] = new DataValueSnapshot(null, AbLegacyStatusMapper.BadNodeIdUnknown, null, now);
+                continue;
+            }
+
+            try
+            {
+                var runtime = await EnsureTagRuntimeAsync(device, def, cancellationToken).ConfigureAwait(false);
+                await runtime.ReadAsync(cancellationToken).ConfigureAwait(false);
+
+                var status = runtime.GetStatus();
+                if (status != 0)
+                {
+                    results[i] = new DataValueSnapshot(null,
+                        AbLegacyStatusMapper.MapLibplctagStatus(status), null, now);
+                    _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead,
+                        $"libplctag status {status} reading {reference}");
+                    continue;
+                }
+
+                var parsed = AbLegacyAddress.TryParse(def.Address);
+                var value = runtime.DecodeValue(def.DataType, parsed?.BitIndex);
+                results[i] = new DataValueSnapshot(value, AbLegacyStatusMapper.Good, now, now);
+                _health = new DriverHealth(DriverState.Healthy, now, null);
+            }
+            catch (OperationCanceledException) { throw; }
+            catch (Exception ex)
+            {
+                results[i] = new DataValueSnapshot(null,
+                    AbLegacyStatusMapper.BadCommunicationError, null, now);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
+            }
+        }
+
+        return results;
+    }
+
+    // ---- IWritable ----
+
+    public async Task<IReadOnlyList<WriteResult>> WriteAsync(
+        IReadOnlyList<WriteRequest> writes, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(writes);
+        var results = new WriteResult[writes.Count];
+
+        for (var i = 0; i < writes.Count; i++)
+        {
+            var w = writes[i];
+            if (!_tagsByName.TryGetValue(w.FullReference, out var def))
+            {
+                results[i] = new WriteResult(AbLegacyStatusMapper.BadNodeIdUnknown);
+                continue;
+            }
+            if (!def.Writable)
+            {
+                results[i] = new WriteResult(AbLegacyStatusMapper.BadNotWritable);
+                continue;
+            }
+            if (!_devices.TryGetValue(def.DeviceHostAddress, out var device))
+            {
+                results[i] = new WriteResult(AbLegacyStatusMapper.BadNodeIdUnknown);
+                continue;
+            }
+
+            try
+            {
+                var parsed = AbLegacyAddress.TryParse(def.Address);
+
+                // PCCC bit-within-word writes — task #181 pass 2. RMW against a parallel
+                // parent-word runtime (strip the /N bit suffix). Per-parent-word lock serialises
+                // concurrent bit writers. Applies to N-file bit-in-word (N7:0/3) + B-file bits
+                // (B3:0/0). T/C/R sub-elements don't hit this path because they're not Bit typed.
+                if (def.DataType == AbLegacyDataType.Bit && parsed?.BitIndex is int bit
+                    && parsed.FileLetter is not "B" and not "I" and not "O")
+                {
+                    results[i] = new WriteResult(
+                        await WriteBitInWordAsync(device, parsed, bit, w.Value, cancellationToken).ConfigureAwait(false));
+                    continue;
+                }
+
+                var runtime = await EnsureTagRuntimeAsync(device, def, cancellationToken).ConfigureAwait(false);
+                runtime.EncodeValue(def.DataType, parsed?.BitIndex, w.Value);
+                await runtime.WriteAsync(cancellationToken).ConfigureAwait(false);
+
+                var status = runtime.GetStatus();
+                results[i] = new WriteResult(status == 0
+                    ? AbLegacyStatusMapper.Good
+                    : AbLegacyStatusMapper.MapLibplctagStatus(status));
+            }
+            catch (OperationCanceledException) { throw; }
+            catch (NotSupportedException nse)
+            {
+                results[i] = new WriteResult(AbLegacyStatusMapper.BadNotSupported);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, nse.Message);
+            }
+            catch (Exception ex) when (ex is FormatException or InvalidCastException)
+            {
+                results[i] = new WriteResult(AbLegacyStatusMapper.BadTypeMismatch);
+            }
+            catch (OverflowException)
+            {
+                results[i] = new WriteResult(AbLegacyStatusMapper.BadOutOfRange);
+            }
+            catch (Exception ex)
+            {
+                results[i] = new WriteResult(AbLegacyStatusMapper.BadCommunicationError);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
+            }
+        }
+
+        return results;
+    }
+
+    // ---- ITagDiscovery ----
+
+    public Task DiscoverAsync(IAddressSpaceBuilder builder, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(builder);
+        var root = builder.Folder("AbLegacy", "AbLegacy");
+        foreach (var device in _options.Devices)
+        {
+            var label = device.DeviceName ?? device.HostAddress;
+            var deviceFolder = root.Folder(device.HostAddress, label);
+            var tagsForDevice = _options.Tags.Where(t =>
+                string.Equals(t.DeviceHostAddress, device.HostAddress, StringComparison.OrdinalIgnoreCase));
+            foreach (var tag in tagsForDevice)
+            {
+                deviceFolder.Variable(tag.Name, tag.Name, new DriverAttributeInfo(
+                    FullName: tag.Name,
+                    DriverDataType: tag.DataType.ToDriverDataType(),
+                    IsArray: false,
+                    ArrayDim: null,
+                    SecurityClass: tag.Writable
+                        ? SecurityClassification.Operate
+                        : SecurityClassification.ViewOnly,
+                    IsHistorized: false,
+                    IsAlarm: false,
+                    WriteIdempotent: tag.WriteIdempotent));
+            }
+        }
+        return Task.CompletedTask;
+    }
+
+    // ---- ISubscribable (polling overlay via shared engine) ----
+
+    public Task<ISubscriptionHandle> SubscribeAsync(
+        IReadOnlyList<string> fullReferences, TimeSpan publishingInterval, CancellationToken cancellationToken) =>
+        Task.FromResult(_poll.Subscribe(fullReferences, publishingInterval));
+
+    public Task UnsubscribeAsync(ISubscriptionHandle handle, CancellationToken cancellationToken)
+    {
+        _poll.Unsubscribe(handle);
+        return Task.CompletedTask;
+    }
+
+    // ---- IHostConnectivityProbe ----
+
+    public IReadOnlyList<HostConnectivityStatus> GetHostStatuses() =>
+        [.. _devices.Values.Select(s => new HostConnectivityStatus(s.Options.HostAddress, s.HostState, s.HostStateChangedUtc))];
+
+    private async Task ProbeLoopAsync(DeviceState state, CancellationToken ct)
+    {
+        var probeParams = new AbLegacyTagCreateParams(
+            Gateway: state.ParsedAddress.Gateway,
+            Port: state.ParsedAddress.Port,
+            CipPath: state.ParsedAddress.CipPath,
+            LibplctagPlcAttribute: state.Profile.LibplctagPlcAttribute,
+            TagName: _options.Probe.ProbeAddress!,
+            Timeout: _options.Probe.Timeout);
+
+        IAbLegacyTagRuntime? probeRuntime = null;
+        while (!ct.IsCancellationRequested)
+        {
+            var success = false;
+            try
+            {
+                probeRuntime ??= _tagFactory.Create(probeParams);
+                if (!state.ProbeInitialized)
+                {
+                    await probeRuntime.InitializeAsync(ct).ConfigureAwait(false);
+                    state.ProbeInitialized = true;
+                }
+                await probeRuntime.ReadAsync(ct).ConfigureAwait(false);
+                success = probeRuntime.GetStatus() == 0;
+            }
+            catch (OperationCanceledException) when (ct.IsCancellationRequested) { break; }
+            catch
+            {
+                try { probeRuntime?.Dispose(); } catch { }
+                probeRuntime = null;
+                state.ProbeInitialized = false;
+            }
+
+            TransitionDeviceState(state, success ? HostState.Running : HostState.Stopped);
+
+            try { await Task.Delay(_options.Probe.Interval, ct).ConfigureAwait(false); }
+            catch (OperationCanceledException) { break; }
+        }
+        try { probeRuntime?.Dispose(); } catch { }
+    }
+
+    private void TransitionDeviceState(DeviceState state, HostState newState)
+    {
+        HostState old;
+        lock (state.ProbeLock)
+        {
+            old = state.HostState;
+            if (old == newState) return;
+            state.HostState = newState;
+            state.HostStateChangedUtc = DateTime.UtcNow;
+        }
+        OnHostStatusChanged?.Invoke(this,
+            new HostStatusChangedEventArgs(state.Options.HostAddress, old, newState));
+    }
+
+    // ---- IPerCallHostResolver ----
+
+    public string ResolveHost(string fullReference)
+    {
+        if (_tagsByName.TryGetValue(fullReference, out var def))
+            return def.DeviceHostAddress;
+        return _options.Devices.FirstOrDefault()?.HostAddress ?? DriverInstanceId;
+    }
+
+    /// <summary>
+    ///     Read-modify-write one bit within a PCCC N-file word. Strips the /N bit suffix to
+    ///     form the parent-word address (N7:0/3 → N7:0), creates / reuses a parent-word runtime
+    ///     typed as Int16, serialises concurrent bit writers against the same parent via a
+    ///     per-parent <see cref="SemaphoreSlim"/>.
+    /// </summary>
+    private async Task<uint> WriteBitInWordAsync(
+        AbLegacyDriver.DeviceState device, AbLegacyAddress bitAddress, int bit, object? value, CancellationToken ct)
+    {
+        var parentAddress = bitAddress with { BitIndex = null };
+        var parentName = parentAddress.ToLibplctagName();
+
+        var rmwLock = device.GetRmwLock(parentName);
+        await rmwLock.WaitAsync(ct).ConfigureAwait(false);
+        try
+        {
+            var parentRuntime = await EnsureParentRuntimeAsync(device, parentName, ct).ConfigureAwait(false);
+            await parentRuntime.ReadAsync(ct).ConfigureAwait(false);
+            var readStatus = parentRuntime.GetStatus();
+            if (readStatus != 0) return AbLegacyStatusMapper.MapLibplctagStatus(readStatus);
+
+            var current = Convert.ToInt32(parentRuntime.DecodeValue(AbLegacyDataType.Int, bitIndex: null) ?? 0);
+            var updated = Convert.ToBoolean(value)
+                ? current | (1 << bit)
+                : current & ~(1 << bit);
+
+            parentRuntime.EncodeValue(AbLegacyDataType.Int, bitIndex: null, (short)updated);
+            await parentRuntime.WriteAsync(ct).ConfigureAwait(false);
+            var writeStatus = parentRuntime.GetStatus();
+            return writeStatus == 0
+                ? AbLegacyStatusMapper.Good
+                : AbLegacyStatusMapper.MapLibplctagStatus(writeStatus);
+        }
+        finally
+        {
+            rmwLock.Release();
+        }
+    }
+
+    private async Task<IAbLegacyTagRuntime> EnsureParentRuntimeAsync(
+        AbLegacyDriver.DeviceState device, string parentName, CancellationToken ct)
+    {
+        if (device.ParentRuntimes.TryGetValue(parentName, out var existing)) return existing;
+
+        var runtime = _tagFactory.Create(new AbLegacyTagCreateParams(
+            Gateway: device.ParsedAddress.Gateway,
+            Port: device.ParsedAddress.Port,
+            CipPath: device.ParsedAddress.CipPath,
+            LibplctagPlcAttribute: device.Profile.LibplctagPlcAttribute,
+            TagName: parentName,
+            Timeout: _options.Timeout));
+        try
+        {
+            await runtime.InitializeAsync(ct).ConfigureAwait(false);
+        }
+        catch
+        {
+            runtime.Dispose();
+            throw;
+        }
+        device.ParentRuntimes[parentName] = runtime;
+        return runtime;
+    }
+
+    private async Task<IAbLegacyTagRuntime> EnsureTagRuntimeAsync(
+        DeviceState device, AbLegacyTagDefinition def, CancellationToken ct)
+    {
+        if (device.Runtimes.TryGetValue(def.Name, out var existing)) return existing;
+
+        var parsed = AbLegacyAddress.TryParse(def.Address)
+            ?? throw new InvalidOperationException(
+                $"AbLegacy tag '{def.Name}' has malformed Address '{def.Address}'.");
+
+        var runtime = _tagFactory.Create(new AbLegacyTagCreateParams(
+            Gateway: device.ParsedAddress.Gateway,
+            Port: device.ParsedAddress.Port,
+            CipPath: device.ParsedAddress.CipPath,
+            LibplctagPlcAttribute: device.Profile.LibplctagPlcAttribute,
+            TagName: parsed.ToLibplctagName(),
+            Timeout: _options.Timeout));
+        try
+        {
+            await runtime.InitializeAsync(ct).ConfigureAwait(false);
+        }
+        catch
+        {
+            runtime.Dispose();
+            throw;
+        }
+        device.Runtimes[def.Name] = runtime;
+        return runtime;
+    }
+
+    public void Dispose() => DisposeAsync().AsTask().GetAwaiter().GetResult();
+    public async ValueTask DisposeAsync() => await ShutdownAsync(CancellationToken.None).ConfigureAwait(false);
+
+    internal sealed class DeviceState(
+        AbLegacyHostAddress parsedAddress,
+        AbLegacyDeviceOptions options,
+        AbLegacyPlcFamilyProfile profile)
+    {
+        public AbLegacyHostAddress ParsedAddress { get; } = parsedAddress;
+        public AbLegacyDeviceOptions Options { get; } = options;
+        public AbLegacyPlcFamilyProfile Profile { get; } = profile;
+        public Dictionary<string, IAbLegacyTagRuntime> Runtimes { get; } =
+            new(StringComparer.OrdinalIgnoreCase);
+
+        /// <summary>
+        ///     Parent-word runtimes for bit-within-word RMW writes (task #181). Keyed by the
+        ///     parent address (bit suffix stripped) — e.g. writes to N7:0/3 + N7:0/5 share a
+        ///     single parent runtime for N7:0.
+        /// </summary>
+        public Dictionary<string, IAbLegacyTagRuntime> ParentRuntimes { get; } =
+            new(StringComparer.OrdinalIgnoreCase);
+
+        private readonly System.Collections.Concurrent.ConcurrentDictionary<string, SemaphoreSlim> _rmwLocks = new();
+
+        public SemaphoreSlim GetRmwLock(string parentName) =>
+            _rmwLocks.GetOrAdd(parentName, _ => new SemaphoreSlim(1, 1));
+
+        public object ProbeLock { get; } = new();
+        public HostState HostState { get; set; } = HostState.Unknown;
+        public DateTime HostStateChangedUtc { get; set; } = DateTime.UtcNow;
+        public CancellationTokenSource? ProbeCts { get; set; }
+        public bool ProbeInitialized { get; set; }
+
+        public void DisposeRuntimes()
+        {
+            foreach (var r in Runtimes.Values) r.Dispose();
+            Runtimes.Clear();
+            foreach (var r in ParentRuntimes.Values) r.Dispose();
+            ParentRuntimes.Clear();
+        }
+    }
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/AbLegacyDriverFactoryExtensions.cs

@@ -0,0 +1,124 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using ZB.MOM.WW.OtOpcUa.Core.Hosting;
+using ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.PlcFamilies;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy;
+
+/// <summary>
+///     Static factory registration helper for <see cref="AbLegacyDriver"/>. Server's Program.cs
+///     calls <see cref="Register"/> once at startup; the bootstrapper (task #248) then
+///     materialises AB Legacy DriverInstance rows from the central config DB into live
+///     driver instances. Mirrors <c>GalaxyProxyDriverFactoryExtensions</c>.
+/// </summary>
+public static class AbLegacyDriverFactoryExtensions
+{
+    public const string DriverTypeName = "AbLegacy";
+
+    public static void Register(DriverFactoryRegistry registry)
+    {
+        ArgumentNullException.ThrowIfNull(registry);
+        registry.Register(DriverTypeName, CreateInstance);
+    }
+
+    internal static AbLegacyDriver CreateInstance(string driverInstanceId, string driverConfigJson)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(driverInstanceId);
+        ArgumentException.ThrowIfNullOrWhiteSpace(driverConfigJson);
+
+        var dto = JsonSerializer.Deserialize<AbLegacyDriverConfigDto>(driverConfigJson, JsonOptions)
+            ?? throw new InvalidOperationException(
+                $"AB Legacy driver config for '{driverInstanceId}' deserialised to null");
+
+        var options = new AbLegacyDriverOptions
+        {
+            Devices = dto.Devices is { Count: > 0 }
+                ? [.. dto.Devices.Select(d => new AbLegacyDeviceOptions(
+                    HostAddress: d.HostAddress ?? throw new InvalidOperationException(
+                        $"AB Legacy config for '{driverInstanceId}' has a device missing HostAddress"),
+                    PlcFamily: ParseEnum<AbLegacyPlcFamily>(d.PlcFamily, driverInstanceId, "PlcFamily",
+                        fallback: AbLegacyPlcFamily.Slc500),
+                    DeviceName: d.DeviceName))]
+                : [],
+            Tags = dto.Tags is { Count: > 0 }
+                ? [.. dto.Tags.Select(t => new AbLegacyTagDefinition(
+                    Name: t.Name ?? throw new InvalidOperationException(
+                        $"AB Legacy config for '{driverInstanceId}' has a tag missing Name"),
+                    DeviceHostAddress: t.DeviceHostAddress ?? throw new InvalidOperationException(
+                        $"AB Legacy tag '{t.Name}' in '{driverInstanceId}' missing DeviceHostAddress"),
+                    Address: t.Address ?? throw new InvalidOperationException(
+                        $"AB Legacy tag '{t.Name}' in '{driverInstanceId}' missing Address"),
+                    DataType: ParseEnum<AbLegacyDataType>(t.DataType, driverInstanceId, "DataType",
+                        tagName: t.Name),
+                    Writable: t.Writable ?? true,
+                    WriteIdempotent: t.WriteIdempotent ?? false))]
+                : [],
+            Probe = new AbLegacyProbeOptions
+            {
+                Enabled = dto.Probe?.Enabled ?? true,
+                Interval = TimeSpan.FromMilliseconds(dto.Probe?.IntervalMs ?? 5_000),
+                Timeout = TimeSpan.FromMilliseconds(dto.Probe?.TimeoutMs ?? 2_000),
+                ProbeAddress = dto.Probe?.ProbeAddress ?? "S:0",
+            },
+            Timeout = TimeSpan.FromMilliseconds(dto.TimeoutMs ?? 2_000),
+        };
+
+        return new AbLegacyDriver(options, driverInstanceId);
+    }
+
+    private static T ParseEnum<T>(string? raw, string driverInstanceId, string field,
+        string? tagName = null, T? fallback = null) where T : struct, Enum
+    {
+        if (string.IsNullOrWhiteSpace(raw))
+        {
+            if (fallback.HasValue) return fallback.Value;
+            throw new InvalidOperationException(
+                $"AB Legacy {(tagName is null ? "config" : $"tag '{tagName}'")} in '{driverInstanceId}' missing {field}");
+        }
+        return Enum.TryParse<T>(raw, ignoreCase: true, out var v)
+            ? v
+            : throw new InvalidOperationException(
+                $"AB Legacy {(tagName is null ? "config" : $"tag '{tagName}'")} has unknown {field} '{raw}'. " +
+                $"Expected one of {string.Join(", ", Enum.GetNames<T>())}");
+    }
+
+    private static readonly JsonSerializerOptions JsonOptions = new()
+    {
+        PropertyNameCaseInsensitive = true,
+        ReadCommentHandling = JsonCommentHandling.Skip,
+        AllowTrailingCommas = true,
+    };
+
+    internal sealed class AbLegacyDriverConfigDto
+    {
+        public int? TimeoutMs { get; init; }
+        public List<AbLegacyDeviceDto>? Devices { get; init; }
+        public List<AbLegacyTagDto>? Tags { get; init; }
+        public AbLegacyProbeDto? Probe { get; init; }
+    }
+
+    internal sealed class AbLegacyDeviceDto
+    {
+        public string? HostAddress { get; init; }
+        public string? PlcFamily { get; init; }
+        public string? DeviceName { get; init; }
+    }
+
+    internal sealed class AbLegacyTagDto
+    {
+        public string? Name { get; init; }
+        public string? DeviceHostAddress { get; init; }
+        public string? Address { get; init; }
+        public string? DataType { get; init; }
+        public bool? Writable { get; init; }
+        public bool? WriteIdempotent { get; init; }
+    }
+
+    internal sealed class AbLegacyProbeDto
+    {
+        public bool? Enabled { get; init; }
+        public int? IntervalMs { get; init; }
+        public int? TimeoutMs { get; init; }
+        public string? ProbeAddress { get; init; }
+    }
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/AbLegacyDriverOptions.cs

@@ -0,0 +1,44 @@
+using ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.PlcFamilies;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy;
+
+/// <summary>
+///     AB Legacy (PCCC) driver configuration. One instance supports N devices (SLC 500 /
+///     MicroLogix / PLC-5 / LogixPccc). Per plan decision #41 AbLegacy ships separately from
+///     AbCip because PCCC's file-based addressing (<c>N7:0</c>) and Logix's symbolic addressing
+///     (<c>Motor1.Speed</c>) pull the abstraction in different directions.
+/// </summary>
+public sealed class AbLegacyDriverOptions
+{
+    public IReadOnlyList<AbLegacyDeviceOptions> Devices { get; init; } = [];
+    public IReadOnlyList<AbLegacyTagDefinition> Tags { get; init; } = [];
+    public AbLegacyProbeOptions Probe { get; init; } = new();
+    public TimeSpan Timeout { get; init; } = TimeSpan.FromSeconds(2);
+}
+
+public sealed record AbLegacyDeviceOptions(
+    string HostAddress,
+    AbLegacyPlcFamily PlcFamily = AbLegacyPlcFamily.Slc500,
+    string? DeviceName = null);
+
+/// <summary>
+///     One PCCC-backed OPC UA variable. <paramref name="Address"/> is the canonical PCCC
+///     file-address string that parses via <see cref="AbLegacyAddress.TryParse"/>.
+/// </summary>
+public sealed record AbLegacyTagDefinition(
+    string Name,
+    string DeviceHostAddress,
+    string Address,
+    AbLegacyDataType DataType,
+    bool Writable = true,
+    bool WriteIdempotent = false);
+
+public sealed class AbLegacyProbeOptions
+{
+    public bool Enabled { get; init; } = true;
+    public TimeSpan Interval { get; init; } = TimeSpan.FromSeconds(5);
+    public TimeSpan Timeout { get; init; } = TimeSpan.FromSeconds(2);
+
+    /// <summary>Probe address — defaults to <c>S:0</c> (status file, first word) when null.</summary>
+    public string? ProbeAddress { get; init; } = "S:0";
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/AbLegacyHostAddress.cs

@@ -0,0 +1,53 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy;
+
+/// <summary>
+///     Parsed <c>ab://gateway[:port]/cip-path</c> host-address string for AB Legacy devices.
+///     Same format as AbCip — PCCC-over-EIP uses the same gateway + optional routing path as
+///     the CIP family (a PLC-5 bridged through a ControlLogix chassis takes the full CIP path;
+///     a direct-wired SLC 500 uses an empty path).
+/// </summary>
+/// <remarks>
+///     Parser duplicated from AbCipHostAddress rather than shared because the two drivers ship
+///     independently + a shared helper would force a reference between them. If a third AB
+///     driver appears, extract into Core.Abstractions.
+/// </remarks>
+public sealed record AbLegacyHostAddress(string Gateway, int Port, string CipPath)
+{
+    public const int DefaultEipPort = 44818;
+
+    public override string ToString() => Port == DefaultEipPort
+        ? $"ab://{Gateway}/{CipPath}"
+        : $"ab://{Gateway}:{Port}/{CipPath}";
+
+    public static AbLegacyHostAddress? TryParse(string? value)
+    {
+        if (string.IsNullOrWhiteSpace(value)) return null;
+        const string prefix = "ab://";
+        if (!value.StartsWith(prefix, StringComparison.OrdinalIgnoreCase)) return null;
+
+        var remainder = value[prefix.Length..];
+        var slashIdx = remainder.IndexOf('/');
+        if (slashIdx < 0) return null;
+
+        var authority = remainder[..slashIdx];
+        var cipPath = remainder[(slashIdx + 1)..];
+        if (string.IsNullOrEmpty(authority)) return null;
+
+        var port = DefaultEipPort;
+        var colonIdx = authority.LastIndexOf(':');
+        string gateway;
+        if (colonIdx >= 0)
+        {
+            gateway = authority[..colonIdx];
+            if (!int.TryParse(authority[(colonIdx + 1)..], out port) || port is <= 0 or > 65535)
+                return null;
+        }
+        else
+        {
+            gateway = authority;
+        }
+        if (string.IsNullOrEmpty(gateway)) return null;
+
+        return new AbLegacyHostAddress(gateway, port, cipPath);
+    }
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/AbLegacyStatusMapper.cs

@@ -0,0 +1,57 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy;
+
+/// <summary>
+///     Maps libplctag status codes + PCCC STS/EXT_STS bytes to OPC UA StatusCodes. Mirrors the
+///     AbCip mapper — PCCC errors roughly align with CIP general-status in shape but with a
+///     different byte vocabulary (PCCC STS nibble-low + EXT_STS on code 0x0F).
+/// </summary>
+public static class AbLegacyStatusMapper
+{
+    public const uint Good = 0u;
+    public const uint GoodMoreData = 0x00A70000u;
+    public const uint BadInternalError = 0x80020000u;
+    public const uint BadNodeIdUnknown = 0x80340000u;
+    public const uint BadNotWritable = 0x803B0000u;
+    public const uint BadOutOfRange = 0x803C0000u;
+    public const uint BadNotSupported = 0x803D0000u;
+    public const uint BadDeviceFailure = 0x80550000u;
+    public const uint BadCommunicationError = 0x80050000u;
+    public const uint BadTimeout = 0x800A0000u;
+    public const uint BadTypeMismatch = 0x80730000u;
+
+    /// <summary>
+    ///     Map libplctag return/status codes. Same polarity as the AbCip mapper — 0 success,
+    ///     positive pending, negative error families.
+    /// </summary>
+    public static uint MapLibplctagStatus(int status)
+    {
+        if (status == 0) return Good;
+        if (status > 0) return GoodMoreData;
+        return status switch
+        {
+            -5 => BadTimeout,
+            -7 => BadCommunicationError,
+            -14 => BadNodeIdUnknown,
+            -16 => BadNotWritable,
+            -17 => BadOutOfRange,
+            _ => BadCommunicationError,
+        };
+    }
+
+    /// <summary>
+    ///     Map a PCCC STS (status) byte. Common codes per AB PCCC reference:
+    ///     0x00 = success, 0x10 = illegal command, 0x20 = bad address, 0x30 = protected,
+    ///     0x40 = programmer busy, 0x50 = file locked, 0xF0 = extended status follows.
+    /// </summary>
+    public static uint MapPcccStatus(byte sts) => sts switch
+    {
+        0x00 => Good,
+        0x10 => BadNotSupported,
+        0x20 => BadNodeIdUnknown,
+        0x30 => BadNotWritable,
+        0x40 => BadDeviceFailure,
+        0x50 => BadDeviceFailure,
+        0xF0 => BadInternalError, // extended status not inspected at this layer
+        _ => BadCommunicationError,
+    };
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/IAbLegacyTagRuntime.cs

@@ -0,0 +1,29 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy;
+
+/// <summary>
+///     Wire-layer abstraction over a single PCCC tag. Mirrors <c>IAbCipTagRuntime</c>'s shape so
+///     the same test-fake pattern applies; the only meaningful difference is the protocol layer
+///     underneath (<c>ab_pccc</c> vs <c>ab_eip</c>).
+/// </summary>
+public interface IAbLegacyTagRuntime : IDisposable
+{
+    Task InitializeAsync(CancellationToken cancellationToken);
+    Task ReadAsync(CancellationToken cancellationToken);
+    Task WriteAsync(CancellationToken cancellationToken);
+    int GetStatus();
+    object? DecodeValue(AbLegacyDataType type, int? bitIndex);
+    void EncodeValue(AbLegacyDataType type, int? bitIndex, object? value);
+}
+
+public interface IAbLegacyTagFactory
+{
+    IAbLegacyTagRuntime Create(AbLegacyTagCreateParams createParams);
+}
+
+public sealed record AbLegacyTagCreateParams(
+    string Gateway,
+    int Port,
+    string CipPath,
+    string LibplctagPlcAttribute,
+    string TagName,
+    TimeSpan Timeout);

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/LibplctagLegacyTagRuntime.cs

@@ -0,0 +1,101 @@
+using libplctag;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy;
+
+/// <summary>
+///     Default libplctag-backed <see cref="IAbLegacyTagRuntime"/>. Uses <c>ab_pccc</c> protocol
+///     on top of EtherNet/IP — libplctag's PCCC layer handles the file-letter + word + bit +
+///     sub-element decoding internally, so our wrapper just has to forward the atomic type to
+///     the right Get/Set call.
+/// </summary>
+internal sealed class LibplctagLegacyTagRuntime : IAbLegacyTagRuntime
+{
+    private readonly Tag _tag;
+
+    public LibplctagLegacyTagRuntime(AbLegacyTagCreateParams p)
+    {
+        _tag = new Tag
+        {
+            Gateway = p.Gateway,
+            Path = p.CipPath,
+            PlcType = MapPlcType(p.LibplctagPlcAttribute),
+            Protocol = Protocol.ab_eip, // PCCC-over-EIP; libplctag routes via the PlcType-specific PCCC layer
+            Name = p.TagName,
+            Timeout = p.Timeout,
+        };
+    }
+
+    public Task InitializeAsync(CancellationToken cancellationToken) => _tag.InitializeAsync(cancellationToken);
+    public Task ReadAsync(CancellationToken cancellationToken) => _tag.ReadAsync(cancellationToken);
+    public Task WriteAsync(CancellationToken cancellationToken) => _tag.WriteAsync(cancellationToken);
+
+    public int GetStatus() => (int)_tag.GetStatus();
+
+    public object? DecodeValue(AbLegacyDataType type, int? bitIndex) => type switch
+    {
+        AbLegacyDataType.Bit => bitIndex is int bit
+            ? _tag.GetBit(bit)
+            : _tag.GetInt8(0) != 0,
+        AbLegacyDataType.Int or AbLegacyDataType.AnalogInt => (int)_tag.GetInt16(0),
+        AbLegacyDataType.Long => _tag.GetInt32(0),
+        AbLegacyDataType.Float => _tag.GetFloat32(0),
+        AbLegacyDataType.String => _tag.GetString(0),
+        AbLegacyDataType.TimerElement or AbLegacyDataType.CounterElement
+            or AbLegacyDataType.ControlElement => _tag.GetInt32(0),
+        _ => null,
+    };
+
+    public void EncodeValue(AbLegacyDataType type, int? bitIndex, object? value)
+    {
+        switch (type)
+        {
+            case AbLegacyDataType.Bit:
+                if (bitIndex is int)
+                    // Bit-within-word writes are routed at the driver level
+                    // (AbLegacyDriver.WriteBitInWordAsync) via a parallel parent-word runtime —
+                    // this branch only fires if dispatch was bypassed. Throw loudly rather than
+                    // silently clobbering the whole word.
+                    throw new NotSupportedException(
+                        "Bit-with-bitIndex writes must go through AbLegacyDriver.WriteBitInWordAsync.");
+                _tag.SetInt8(0, Convert.ToBoolean(value) ? (sbyte)1 : (sbyte)0);
+                break;
+            case AbLegacyDataType.Int:
+            case AbLegacyDataType.AnalogInt:
+                _tag.SetInt16(0, Convert.ToInt16(value));
+                break;
+            case AbLegacyDataType.Long:
+                _tag.SetInt32(0, Convert.ToInt32(value));
+                break;
+            case AbLegacyDataType.Float:
+                _tag.SetFloat32(0, Convert.ToSingle(value));
+                break;
+            case AbLegacyDataType.String:
+                _tag.SetString(0, Convert.ToString(value) ?? string.Empty);
+                break;
+            case AbLegacyDataType.TimerElement:
+            case AbLegacyDataType.CounterElement:
+            case AbLegacyDataType.ControlElement:
+                _tag.SetInt32(0, Convert.ToInt32(value));
+                break;
+            default:
+                throw new NotSupportedException($"AbLegacyDataType {type} not writable.");
+        }
+    }
+
+    public void Dispose() => _tag.Dispose();
+
+    private static PlcType MapPlcType(string attribute) => attribute switch
+    {
+        "slc500" => PlcType.Slc500,
+        "micrologix" => PlcType.MicroLogix,
+        "plc5" => PlcType.Plc5,
+        "logixpccc" => PlcType.LogixPccc,
+        _ => PlcType.Slc500,
+    };
+}
+
+internal sealed class LibplctagLegacyTagFactory : IAbLegacyTagFactory
+{
+    public IAbLegacyTagRuntime Create(AbLegacyTagCreateParams createParams) =>
+        new LibplctagLegacyTagRuntime(createParams);
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/PlcFamilies/AbLegacyPlcFamilyProfile.cs

@@ -0,0 +1,64 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.PlcFamilies;
+
+/// <summary>
+///     Per-family libplctag defaults for PCCC PLCs. SLC 500 / MicroLogix / PLC-5 / LogixPccc
+///     (Logix controller accessed via the PLC-5 compatibility layer — rare but real).
+/// </summary>
+public sealed record AbLegacyPlcFamilyProfile(
+    string LibplctagPlcAttribute,
+    string DefaultCipPath,
+    int MaxTagBytes,
+    bool SupportsStringFile,
+    bool SupportsLongFile)
+{
+    public static AbLegacyPlcFamilyProfile ForFamily(AbLegacyPlcFamily family) => family switch
+    {
+        AbLegacyPlcFamily.Slc500 => Slc500,
+        AbLegacyPlcFamily.MicroLogix => MicroLogix,
+        AbLegacyPlcFamily.Plc5 => Plc5,
+        AbLegacyPlcFamily.LogixPccc => LogixPccc,
+        _ => Slc500,
+    };
+
+    public static readonly AbLegacyPlcFamilyProfile Slc500 = new(
+        LibplctagPlcAttribute: "slc500",
+        DefaultCipPath: "1,0",
+        MaxTagBytes: 240,           // SLC 5/05 PCCC max packet data
+        SupportsStringFile: true,   // ST file available SLC 5/04+
+        SupportsLongFile: true);    // L file available SLC 5/05+
+
+    public static readonly AbLegacyPlcFamilyProfile MicroLogix = new(
+        LibplctagPlcAttribute: "micrologix",
+        DefaultCipPath: "",         // MicroLogix 1100/1400 use direct EIP, no backplane path
+        MaxTagBytes: 232,
+        SupportsStringFile: true,
+        SupportsLongFile: false);   // ML 1100/1200/1400 don't ship L files
+
+    public static readonly AbLegacyPlcFamilyProfile Plc5 = new(
+        LibplctagPlcAttribute: "plc5",
+        DefaultCipPath: "1,0",
+        MaxTagBytes: 240,           // DF1 full-duplex packet limit at 264 bytes, PCCC-over-EIP caps lower
+        SupportsStringFile: true,
+        SupportsLongFile: false);   // PLC-5 predates L files
+
+    /// <summary>
+    ///     Logix ControlLogix / CompactLogix accessed through the legacy PCCC compatibility layer.
+    ///     Rare but real — some legacy HMI integrations address Logix controllers as if they were
+    ///     PLC-5 via the PCCC-passthrough mechanism.
+    /// </summary>
+    public static readonly AbLegacyPlcFamilyProfile LogixPccc = new(
+        LibplctagPlcAttribute: "logixpccc",
+        DefaultCipPath: "1,0",
+        MaxTagBytes: 240,
+        SupportsStringFile: true,
+        SupportsLongFile: true);
+}
+
+/// <summary>Which PCCC PLC family the device is.</summary>
+public enum AbLegacyPlcFamily
+{
+    Slc500,
+    MicroLogix,
+    Plc5,
+    LogixPccc,
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.csproj

@@ -0,0 +1,31 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <LangVersion>latest</LangVersion>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+        <GenerateDocumentationFile>true</GenerateDocumentationFile>
+        <NoWarn>$(NoWarn);CS1591</NoWarn>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.AbLegacy</RootNamespace>
+        <AssemblyName>ZB.MOM.WW.OtOpcUa.Driver.AbLegacy</AssemblyName>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Core.Abstractions\ZB.MOM.WW.OtOpcUa.Core.Abstractions.csproj"/>
+        <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Core\ZB.MOM.WW.OtOpcUa.Core.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <!-- libplctag — ab_pccc protocol for SLC 500 / MicroLogix / PLC-5 / LogixPccc.
+             Decision #41 — AbLegacy split from AbCip since PCCC addressing (file-based N7:0) and
+             Logix addressing (symbolic Motor1.Speed) pull the abstraction in incompatible directions. -->
+        <PackageReference Include="libplctag" Version="1.5.2"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Tests"/>
+    </ItemGroup>
+
+</Project>

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasAddress.cs

@@ -0,0 +1,95 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     Parsed FOCAS address covering the three addressing spaces a driver touches:
+///     <see cref="FocasAreaKind.Pmc"/> (letter + byte + optional bit — <c>X0.0</c>, <c>R100</c>,
+///     <c>F20.3</c>), <see cref="FocasAreaKind.Parameter"/> (CNC parameter number —
+///     <c>PARAM:1020</c>, <c>PARAM:1815/0</c> for bit 0), and <see cref="FocasAreaKind.Macro"/>
+///     (macro variable number — <c>MACRO:100</c>, <c>MACRO:500</c>).
+/// </summary>
+/// <remarks>
+///     PMC letters: <c>X/Y</c> (IO), <c>F/G</c> (signals between PMC + CNC), <c>R</c> (internal
+///     relay), <c>D</c> (data table), <c>C</c> (counter), <c>K</c> (keep relay), <c>A</c>
+///     (message display), <c>E</c> (extended relay), <c>T</c> (timer). Byte numbering is 0-based;
+///     bit index when present is 0–7 and uses <c>.N</c> for PMC or <c>/N</c> for parameters.
+/// </remarks>
+public sealed record FocasAddress(
+    FocasAreaKind Kind,
+    string? PmcLetter,
+    int Number,
+    int? BitIndex)
+{
+    public string Canonical => Kind switch
+    {
+        FocasAreaKind.Pmc => BitIndex is null
+            ? $"{PmcLetter}{Number}"
+            : $"{PmcLetter}{Number}.{BitIndex}",
+        FocasAreaKind.Parameter => BitIndex is null
+            ? $"PARAM:{Number}"
+            : $"PARAM:{Number}/{BitIndex}",
+        FocasAreaKind.Macro => $"MACRO:{Number}",
+        _ => $"?{Number}",
+    };
+
+    public static FocasAddress? TryParse(string? value)
+    {
+        if (string.IsNullOrWhiteSpace(value)) return null;
+        var src = value.Trim();
+
+        if (src.StartsWith("PARAM:", StringComparison.OrdinalIgnoreCase))
+            return ParseScoped(src["PARAM:".Length..], FocasAreaKind.Parameter, bitSeparator: '/');
+
+        if (src.StartsWith("MACRO:", StringComparison.OrdinalIgnoreCase))
+            return ParseScoped(src["MACRO:".Length..], FocasAreaKind.Macro, bitSeparator: null);
+
+        // PMC path: letter + digits + optional .bit
+        if (src.Length < 2 || !char.IsLetter(src[0])) return null;
+        var letter = src[0..1].ToUpperInvariant();
+        if (!IsValidPmcLetter(letter)) return null;
+
+        var remainder = src[1..];
+        int? bit = null;
+        var dotIdx = remainder.IndexOf('.');
+        if (dotIdx >= 0)
+        {
+            if (!int.TryParse(remainder[(dotIdx + 1)..], out var bitValue) || bitValue is < 0 or > 7)
+                return null;
+            bit = bitValue;
+            remainder = remainder[..dotIdx];
+        }
+        if (!int.TryParse(remainder, out var number) || number < 0) return null;
+        return new FocasAddress(FocasAreaKind.Pmc, letter, number, bit);
+    }
+
+    private static FocasAddress? ParseScoped(string body, FocasAreaKind kind, char? bitSeparator)
+    {
+        int? bit = null;
+        if (bitSeparator is char sep)
+        {
+            var slashIdx = body.IndexOf(sep);
+            if (slashIdx >= 0)
+            {
+                if (!int.TryParse(body[(slashIdx + 1)..], out var bitValue) || bitValue is < 0 or > 31)
+                    return null;
+                bit = bitValue;
+                body = body[..slashIdx];
+            }
+        }
+        if (!int.TryParse(body, out var number) || number < 0) return null;
+        return new FocasAddress(kind, PmcLetter: null, number, bit);
+    }
+
+    private static bool IsValidPmcLetter(string letter) => letter switch
+    {
+        "X" or "Y" or "F" or "G" or "R" or "D" or "C" or "K" or "A" or "E" or "T" => true,
+        _ => false,
+    };
+}
+
+/// <summary>Addressing-space kinds the driver understands.</summary>
+public enum FocasAreaKind
+{
+    Pmc,
+    Parameter,
+    Macro,
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasAlarmProjection.cs

@@ -0,0 +1,195 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     Polls each device's CNC active-alarm list via <see cref="IFocasClient.ReadAlarmsAsync"/>
+///     on a timer and translates raise / clear transitions into <see cref="IAlarmSource"/>
+///     events on the owning <see cref="FocasDriver"/>. One poll loop per subscription; the
+///     loop fans out across every configured device and diffs the (<c>AlarmNumber</c>,
+///     <c>Type</c>) keyed active-alarm set between ticks.
+/// </summary>
+/// <remarks>
+///     FOCAS alarms are flat per session — the CNC exposes a single active-alarm list via
+///     <c>cnc_rdalmmsg2</c>, not per-node structures the way Galaxy / AbCip ALMD do. So the
+///     projection ignores <c>sourceNodeIds</c> at the member level: every alarm event is
+///     raised with <c>SourceNodeId=device-host-address</c>. Callers that want per-device
+///     filtering can pass the specific host addresses as <c>sourceNodeIds</c> and the
+///     projection will skip devices not listed.
+/// </remarks>
+internal sealed class FocasAlarmProjection : IAsyncDisposable
+{
+    private readonly FocasDriver _driver;
+    private readonly TimeSpan _pollInterval;
+    private readonly Dictionary<long, Subscription> _subs = new();
+    private readonly Lock _subsLock = new();
+    private long _nextId;
+
+    public FocasAlarmProjection(FocasDriver driver, TimeSpan pollInterval)
+    {
+        _driver = driver;
+        _pollInterval = pollInterval;
+    }
+
+    public Task<IAlarmSubscriptionHandle> SubscribeAsync(
+        IReadOnlyList<string> sourceNodeIds, CancellationToken cancellationToken)
+    {
+        var id = Interlocked.Increment(ref _nextId);
+        var handle = new FocasAlarmSubscriptionHandle(id);
+        var cts = new CancellationTokenSource();
+        // Empty filter = listen to every configured device. Otherwise only devices whose
+        // host address appears in sourceNodeIds are polled.
+        var filter = sourceNodeIds.Count == 0
+            ? null
+            : new HashSet<string>(sourceNodeIds, StringComparer.OrdinalIgnoreCase);
+        var sub = new Subscription(handle, filter, cts);
+
+        lock (_subsLock) _subs[id] = sub;
+
+        sub.Loop = Task.Run(() => RunPollLoopAsync(sub, cts.Token), cts.Token);
+        return Task.FromResult<IAlarmSubscriptionHandle>(handle);
+    }
+
+    public async Task UnsubscribeAsync(IAlarmSubscriptionHandle handle, CancellationToken cancellationToken)
+    {
+        if (handle is not FocasAlarmSubscriptionHandle h) return;
+        Subscription? sub;
+        lock (_subsLock)
+        {
+            if (!_subs.Remove(h.Id, out sub)) return;
+        }
+        try { sub.Cts.Cancel(); } catch { }
+        try { await sub.Loop.ConfigureAwait(false); } catch { }
+        sub.Cts.Dispose();
+    }
+
+    /// <summary>
+    ///     FOCAS has no ack wire call — the CNC clears alarms on its own when the underlying
+    ///     condition resolves. Swallow the request so capability negotiation succeeds, rather
+    ///     than surfacing a confusing "not supported" error to the operator.
+    /// </summary>
+    public Task AcknowledgeAsync(
+        IReadOnlyList<AlarmAcknowledgeRequest> acknowledgements, CancellationToken cancellationToken) =>
+        Task.CompletedTask;
+
+    public async ValueTask DisposeAsync()
+    {
+        List<Subscription> snap;
+        lock (_subsLock) { snap = [.. _subs.Values]; _subs.Clear(); }
+        foreach (var sub in snap)
+        {
+            try { sub.Cts.Cancel(); } catch { }
+            try { await sub.Loop.ConfigureAwait(false); } catch { }
+            sub.Cts.Dispose();
+        }
+    }
+
+    /// <summary>
+    ///     One poll-tick for one device. Diffs the new alarm list against the previous snapshot,
+    ///     emits raise + clear events. Extracted so tests can drive a tick without spinning up
+    ///     the full Task.Run loop.
+    /// </summary>
+    internal void Tick(Subscription sub, string deviceHostAddress, IReadOnlyList<FocasActiveAlarm> current)
+    {
+        var prev = sub.LastByDevice.GetValueOrDefault(deviceHostAddress) ?? [];
+        var nowKeys = current.Select(a => AlarmKey(a)).ToHashSet();
+        var prevKeys = prev.Select(a => AlarmKey(a)).ToHashSet();
+
+        foreach (var a in current)
+        {
+            if (prevKeys.Contains(AlarmKey(a))) continue;
+            _driver.InvokeAlarmEvent(new AlarmEventArgs(
+                sub.Handle,
+                SourceNodeId: deviceHostAddress,
+                ConditionId: $"{deviceHostAddress}#{AlarmKey(a)}",
+                AlarmType: MapAlarmType(a.Type),
+                Message: a.Message,
+                Severity: MapSeverity(a.Type),
+                SourceTimestampUtc: DateTime.UtcNow));
+        }
+
+        foreach (var a in prev)
+        {
+            if (nowKeys.Contains(AlarmKey(a))) continue;
+            _driver.InvokeAlarmEvent(new AlarmEventArgs(
+                sub.Handle,
+                SourceNodeId: deviceHostAddress,
+                ConditionId: $"{deviceHostAddress}#{AlarmKey(a)}",
+                AlarmType: MapAlarmType(a.Type),
+                Message: $"{a.Message} (cleared)",
+                Severity: MapSeverity(a.Type),
+                SourceTimestampUtc: DateTime.UtcNow));
+        }
+
+        sub.LastByDevice[deviceHostAddress] = [.. current];
+    }
+
+    private async Task RunPollLoopAsync(Subscription sub, CancellationToken ct)
+    {
+        while (!ct.IsCancellationRequested)
+        {
+            try
+            {
+                foreach (var (host, alarms) in await _driver.ReadActiveAlarmsAcrossDevicesAsync(sub.DeviceFilter, ct).ConfigureAwait(false))
+                {
+                    Tick(sub, host, alarms);
+                }
+            }
+            catch (OperationCanceledException) when (ct.IsCancellationRequested) { break; }
+            catch { /* per-tick failures are non-fatal — next tick retries */ }
+
+            try { await Task.Delay(_pollInterval, ct).ConfigureAwait(false); }
+            catch (OperationCanceledException) { break; }
+        }
+    }
+
+    private static string AlarmKey(FocasActiveAlarm a) => $"{a.Type}:{a.AlarmNumber}";
+
+    /// <summary>Map FOCAS type to a human-readable category; falls back to the numeric type.</summary>
+    internal static string MapAlarmType(short type) => type switch
+    {
+        FocasAlarmType.Parameter   => "Parameter",
+        FocasAlarmType.PulseCode   => "PulseCode",
+        FocasAlarmType.Overtravel  => "Overtravel",
+        FocasAlarmType.Overheat    => "Overheat",
+        FocasAlarmType.Servo       => "Servo",
+        FocasAlarmType.DataIo      => "DataIo",
+        FocasAlarmType.MemoryCheck => "MemoryCheck",
+        FocasAlarmType.MacroAlarm  => "MacroAlarm",
+        _                          => $"Type{type}",
+    };
+
+    /// <summary>
+    ///     Project FOCAS alarm types into the driver-agnostic 4-band severity. Overtravel /
+    ///     Servo / Emergency-equivalents are Critical; Parameter + Macro are Medium; rest land
+    ///     at High (everything else on a CNC is safety-relevant).
+    /// </summary>
+    internal static AlarmSeverity MapSeverity(short type) => type switch
+    {
+        FocasAlarmType.Overtravel => AlarmSeverity.Critical,
+        FocasAlarmType.Servo      => AlarmSeverity.Critical,
+        FocasAlarmType.PulseCode  => AlarmSeverity.Critical,
+        FocasAlarmType.Parameter  => AlarmSeverity.Medium,
+        FocasAlarmType.MacroAlarm => AlarmSeverity.Medium,
+        _                         => AlarmSeverity.High,
+    };
+
+    internal sealed class Subscription(
+        FocasAlarmSubscriptionHandle handle,
+        HashSet<string>? deviceFilter,
+        CancellationTokenSource cts)
+    {
+        public FocasAlarmSubscriptionHandle Handle { get; } = handle;
+        public HashSet<string>? DeviceFilter { get; } = deviceFilter;
+        public CancellationTokenSource Cts { get; } = cts;
+        public Task Loop { get; set; } = Task.CompletedTask;
+        public Dictionary<string, IReadOnlyList<FocasActiveAlarm>> LastByDevice { get; } =
+            new(StringComparer.OrdinalIgnoreCase);
+    }
+}
+
+/// <summary>Handle returned by <see cref="FocasAlarmProjection.SubscribeAsync"/>.</summary>
+public sealed record FocasAlarmSubscriptionHandle(long Id) : IAlarmSubscriptionHandle
+{
+    public string DiagnosticId => $"focas-alarm-sub-{Id}";
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasCapabilityMatrix.cs

@@ -0,0 +1,139 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     Documented-API capability matrix — per CNC series, what ranges each
+///     <see cref="FocasAreaKind"/> supports. Authoritative source for the driver's
+///     pre-flight validation in <see cref="FocasDriver.InitializeAsync"/>.
+/// </summary>
+/// <remarks>
+///     <para>Ranges come from the Fanuc FOCAS Developer Kit documentation matrix
+///     (see <c>docs/v2/focas-version-matrix.md</c> for the authoritative copy with
+///     per-function citations). Numbers chosen to match what the FOCAS library
+///     accepts — a read against an address outside the documented range returns
+///     <c>EW_NUMBER</c> or <c>EW_PARAM</c> at the wire, which this driver maps to
+///     BadOutOfRange. Catching at init time surfaces the mismatch as a config
+///     error before any session is opened.</para>
+///     <para><see cref="FocasCncSeries.Unknown"/> is treated permissively: every
+///     address passes validation. Pre-matrix configs don't break on upgrade; new
+///     deployments are encouraged to declare a series in the device options.</para>
+/// </remarks>
+public static class FocasCapabilityMatrix
+{
+    /// <summary>
+    ///     Check whether <paramref name="address"/> is accepted by a CNC of
+    ///     <paramref name="series"/>. Returns <c>null</c> on pass + a failure reason
+    ///     on reject — the driver surfaces the reason string verbatim when failing
+    ///     <c>InitializeAsync</c> so operators see the specific out-of-range without
+    ///     guessing.
+    /// </summary>
+    public static string? Validate(FocasCncSeries series, FocasAddress address)
+    {
+        if (series == FocasCncSeries.Unknown) return null;
+
+        return address.Kind switch
+        {
+            FocasAreaKind.Macro     => ValidateMacro(series, address.Number),
+            FocasAreaKind.Parameter => ValidateParameter(series, address.Number),
+            FocasAreaKind.Pmc       => ValidatePmc(series, address.PmcLetter, address.Number),
+            _ => null,
+        };
+    }
+
+    /// <summary>Macro variable number accepted by a CNC series. Cites
+    /// <c>cnc_rdmacro</c>/<c>cnc_wrmacro</c> in the Developer Kit.</summary>
+    internal static (int min, int max) MacroRange(FocasCncSeries series) => series switch
+    {
+        // Common macros 1-33 + 100-199 + 500-999 universally; extended 10000+ only on
+        // higher-end series. Using the extended ceiling per series per DevKit notes.
+        FocasCncSeries.Sixteen_i    => (0, 999),
+        FocasCncSeries.Zero_i_D     => (0, 999),
+        FocasCncSeries.Zero_i_F or
+        FocasCncSeries.Zero_i_MF or
+        FocasCncSeries.Zero_i_TF    => (0, 9999),
+        FocasCncSeries.Thirty_i or
+        FocasCncSeries.ThirtyOne_i or
+        FocasCncSeries.ThirtyTwo_i  => (0, 99999),
+        FocasCncSeries.PowerMotion_i => (0, 999),
+        _ => (0, int.MaxValue),
+    };
+
+    /// <summary>Parameter number accepted; from <c>cnc_rdparam</c>/<c>cnc_wrparam</c>.
+    /// Ranges reflect the highest-numbered parameter documented per series.</summary>
+    internal static (int min, int max) ParameterRange(FocasCncSeries series) => series switch
+    {
+        FocasCncSeries.Sixteen_i    => (0, 9999),
+        FocasCncSeries.Zero_i_D or
+        FocasCncSeries.Zero_i_F or
+        FocasCncSeries.Zero_i_MF or
+        FocasCncSeries.Zero_i_TF    => (0, 14999),
+        FocasCncSeries.Thirty_i or
+        FocasCncSeries.ThirtyOne_i or
+        FocasCncSeries.ThirtyTwo_i  => (0, 29999),
+        FocasCncSeries.PowerMotion_i => (0, 29999),
+        _ => (0, int.MaxValue),
+    };
+
+    /// <summary>PMC letters accepted per series. Legacy controllers omit F/M/C
+    /// signal groups that 30i-family ladder programs use.</summary>
+    internal static IReadOnlySet<string> PmcLetters(FocasCncSeries series) => series switch
+    {
+        FocasCncSeries.Sixteen_i     => new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "X", "Y", "R", "D" },
+        FocasCncSeries.Zero_i_D      => new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "X", "Y", "R", "D", "E", "A" },
+        FocasCncSeries.Zero_i_F or
+        FocasCncSeries.Zero_i_MF or
+        FocasCncSeries.Zero_i_TF     => new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "X", "Y", "F", "G", "R", "D", "E", "A", "M", "C" },
+        FocasCncSeries.Thirty_i or
+        FocasCncSeries.ThirtyOne_i or
+        FocasCncSeries.ThirtyTwo_i   => new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "X", "Y", "F", "G", "R", "D", "E", "A", "M", "C", "K", "T" },
+        FocasCncSeries.PowerMotion_i => new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "X", "Y", "R", "D" },
+        _ => new HashSet<string>(StringComparer.OrdinalIgnoreCase),
+    };
+
+    /// <summary>PMC address-number ceiling per series. Multiplied by 8 to get bit
+    /// count since PMC addresses are byte-addressed on read + bit-addressed on
+    /// write — FocasAddress carries the bit separately.</summary>
+    internal static int PmcMaxNumber(FocasCncSeries series) => series switch
+    {
+        FocasCncSeries.Sixteen_i    => 999,
+        FocasCncSeries.Zero_i_D     => 1999,
+        FocasCncSeries.Zero_i_F or
+        FocasCncSeries.Zero_i_MF or
+        FocasCncSeries.Zero_i_TF    => 9999,
+        FocasCncSeries.Thirty_i or
+        FocasCncSeries.ThirtyOne_i or
+        FocasCncSeries.ThirtyTwo_i  => 59999,
+        FocasCncSeries.PowerMotion_i => 1999,
+        _ => int.MaxValue,
+    };
+
+    private static string? ValidateMacro(FocasCncSeries series, int number)
+    {
+        var (min, max) = MacroRange(series);
+        return (number < min || number > max)
+            ? $"Macro variable #{number} is outside the documented range [{min}, {max}] for {series}."
+            : null;
+    }
+
+    private static string? ValidateParameter(FocasCncSeries series, int number)
+    {
+        var (min, max) = ParameterRange(series);
+        return (number < min || number > max)
+            ? $"Parameter #{number} is outside the documented range [{min}, {max}] for {series}."
+            : null;
+    }
+
+    private static string? ValidatePmc(FocasCncSeries series, string? letter, int number)
+    {
+        if (string.IsNullOrEmpty(letter)) return "PMC address is missing its letter prefix.";
+        var letters = PmcLetters(series);
+        if (!letters.Contains(letter))
+        {
+            var letterList = string.Join(", ", letters);
+            return $"PMC letter '{letter}' is not supported on {series}. Accepted: {{{letterList}}}.";
+        }
+        var max = PmcMaxNumber(series);
+        return number > max
+            ? $"PMC address {letter}{number} is outside the documented range [0, {max}] for {series}."
+            : null;
+    }
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasCncSeries.cs

@@ -0,0 +1,47 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     Fanuc CNC controller series. Used by <see cref="FocasCapabilityMatrix"/> to
+///     gate which FOCAS addresses + value ranges the driver accepts against a given
+///     CNC — the FOCAS API surface varies meaningfully between series (macro ranges,
+///     PMC address letters, parameter numbers). A tag reference that's valid on a
+///     30i might be out-of-range on an 0i-MF; validating at driver
+///     <c>InitializeAsync</c> time surfaces the mismatch as a fast config error
+///     instead of a runtime read failure after the server's already running.
+/// </summary>
+/// <remarks>
+///     <para>Values chosen from the Fanuc FOCAS Developer Kit documented series
+///     matrix. Add a new entry + a row to <see cref="FocasCapabilityMatrix"/> when
+///     a new controller is targeted — the driver will refuse the device until both
+///     sides of the enum are filled in.</para>
+///     <para>Defaults to <see cref="Unknown"/> when the operator doesn't specify;
+///     the capability matrix treats Unknown as permissive (no range validation,
+///     same as pre-matrix behaviour) so old configs don't break on upgrade.</para>
+/// </remarks>
+public enum FocasCncSeries
+{
+    /// <summary>No series declared; capability matrix is permissive (legacy behaviour).</summary>
+    Unknown = 0,
+
+    /// <summary>Series 0i-D — compact CNC, narrow macro + PMC ranges.</summary>
+    Zero_i_D,
+    /// <summary>Series 0i-F — successor to 0i-D; widened macro range, added Plus variant.</summary>
+    Zero_i_F,
+    /// <summary>Series 0i-MF / 0i-MF Plus — machining-centre variants of 0i-F.</summary>
+    Zero_i_MF,
+    /// <summary>Series 0i-TF / 0i-TF Plus — turning-centre variants of 0i-F.</summary>
+    Zero_i_TF,
+
+    /// <summary>Series 16i / 18i / 21i — mid-range legacy; narrow ranges, limited PMC letters.</summary>
+    Sixteen_i,
+
+    /// <summary>Series 30i — high-end; widest macro / PMC / parameter ranges.</summary>
+    Thirty_i,
+    /// <summary>Series 31i — subset of 30i (fewer axes, same FOCAS surface).</summary>
+    ThirtyOne_i,
+    /// <summary>Series 32i — compact 30i variant.</summary>
+    ThirtyTwo_i,
+
+    /// <summary>Power Motion i — motion-control variant; atypical macro coverage.</summary>
+    PowerMotion_i,
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasDataType.cs

@@ -0,0 +1,39 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     FOCAS atomic data types. Narrower than Logix/IEC — FANUC CNCs expose mostly integer +
+///     floating-point data with no UDT concept; macro variables are double-precision floats
+///     and PMC reads return byte / signed word / signed dword.
+/// </summary>
+public enum FocasDataType
+{
+    /// <summary>Single bit (PMC bit, or bit within a CNC parameter).</summary>
+    Bit,
+    /// <summary>8-bit signed byte (PMC 1-byte read).</summary>
+    Byte,
+    /// <summary>16-bit signed word (PMC 2-byte read, or CNC parameter as short).</summary>
+    Int16,
+    /// <summary>32-bit signed int (PMC 4-byte read, or CNC parameter as int).</summary>
+    Int32,
+    /// <summary>32-bit IEEE-754 float (rare; some CNC macro variables).</summary>
+    Float32,
+    /// <summary>64-bit IEEE-754 double (most macro variables are double-precision).</summary>
+    Float64,
+    /// <summary>ASCII string (alarm text, parameter names, some PMC string areas).</summary>
+    String,
+}
+
+public static class FocasDataTypeExtensions
+{
+    public static DriverDataType ToDriverDataType(this FocasDataType t) => t switch
+    {
+        FocasDataType.Bit => DriverDataType.Boolean,
+        FocasDataType.Byte or FocasDataType.Int16 or FocasDataType.Int32 => DriverDataType.Int32,
+        FocasDataType.Float32 => DriverDataType.Float32,
+        FocasDataType.Float64 => DriverDataType.Float64,
+        FocasDataType.String => DriverDataType.String,
+        _ => DriverDataType.Int32,
+    };
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasDriver.cs

@@ -0,0 +1,933 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     FOCAS driver for Fanuc CNC controllers (FS 0i / 16i / 18i / 21i / 30i / 31i / 32i / Series
+///     35i / Power Mate i). Talks to the CNC via the Fanuc FOCAS/2 FWLIB protocol through an
+///     <see cref="IFocasClient"/> the deployment supplies — FWLIB itself is Fanuc-proprietary
+///     and cannot be redistributed.
+/// </summary>
+/// <remarks>
+///     PR 1 ships <see cref="IDriver"/> only; read / write / discover / subscribe / probe / host-
+///     resolver capabilities land in PRs 2 and 3. The <see cref="IFocasClient"/> abstraction
+///     shipped here lets PR 2 onward stay license-clean — all tests run against a fake client
+///     + the default <see cref="UnimplementedFocasClientFactory"/> makes misconfigured servers
+///     fail fast.
+/// </remarks>
+public sealed class FocasDriver : IDriver, IReadable, IWritable, ITagDiscovery, ISubscribable,
+    IHostConnectivityProbe, IPerCallHostResolver, IAlarmSource, IDisposable, IAsyncDisposable
+{
+    private readonly FocasDriverOptions _options;
+    private readonly string _driverInstanceId;
+    private readonly IFocasClientFactory _clientFactory;
+    private readonly PollGroupEngine _poll;
+    private readonly Dictionary<string, DeviceState> _devices = new(StringComparer.OrdinalIgnoreCase);
+    private readonly Dictionary<string, FocasTagDefinition> _tagsByName = new(StringComparer.OrdinalIgnoreCase);
+    private FocasAlarmProjection? _alarmProjection;
+    private DriverHealth _health = new(DriverState.Unknown, null, null);
+
+    public event EventHandler<DataChangeEventArgs>? OnDataChange;
+    public event EventHandler<HostStatusChangedEventArgs>? OnHostStatusChanged;
+    public event EventHandler<AlarmEventArgs>? OnAlarmEvent;
+
+    public FocasDriver(FocasDriverOptions options, string driverInstanceId,
+        IFocasClientFactory? clientFactory = null)
+    {
+        ArgumentNullException.ThrowIfNull(options);
+        _options = options;
+        _driverInstanceId = driverInstanceId;
+        _clientFactory = clientFactory ?? new Wire.WireFocasClientFactory();
+        _poll = new PollGroupEngine(
+            reader: ReadAsync,
+            onChange: (handle, tagRef, snapshot) =>
+                OnDataChange?.Invoke(this, new DataChangeEventArgs(handle, tagRef, snapshot)));
+    }
+
+    public string DriverInstanceId => _driverInstanceId;
+    public string DriverType => "FOCAS";
+
+    public Task InitializeAsync(string driverConfigJson, CancellationToken cancellationToken)
+    {
+        _health = new DriverHealth(DriverState.Initializing, null, null);
+        try
+        {
+            foreach (var device in _options.Devices)
+            {
+                var addr = FocasHostAddress.TryParse(device.HostAddress)
+                    ?? throw new InvalidOperationException(
+                        $"FOCAS device has invalid HostAddress '{device.HostAddress}' — expected 'focas://{{ip}}[:{{port}}]'.");
+                _devices[device.HostAddress] = new DeviceState(addr, device);
+            }
+            // Pre-flight: validate every tag's address against the declared CNC
+            // series so misconfigured addresses fail at init (clear config error)
+            // instead of producing BadOutOfRange on every read at runtime.
+            // Series=Unknown short-circuits the matrix; pre-matrix configs stay permissive.
+            foreach (var tag in _options.Tags)
+            {
+                var parsed = FocasAddress.TryParse(tag.Address)
+                    ?? throw new InvalidOperationException(
+                        $"FOCAS tag '{tag.Name}' has invalid Address '{tag.Address}'. " +
+                        $"Expected forms: R100, R100.3, PARAM:1815/0, MACRO:500.");
+                if (_devices.TryGetValue(tag.DeviceHostAddress, out var device)
+                    && FocasCapabilityMatrix.Validate(device.Options.Series, parsed) is { } reason)
+                {
+                    throw new InvalidOperationException(
+                        $"FOCAS tag '{tag.Name}' ({tag.Address}) rejected by capability matrix: {reason}");
+                }
+                _tagsByName[tag.Name] = tag;
+            }
+
+            if (_options.Probe.Enabled)
+            {
+                foreach (var state in _devices.Values)
+                {
+                    state.ProbeCts = new CancellationTokenSource();
+                    var ct = state.ProbeCts.Token;
+                    _ = Task.Run(() => ProbeLoopAsync(state, ct), ct);
+                }
+            }
+
+            if (_options.HandleRecycle.Enabled)
+            {
+                foreach (var state in _devices.Values)
+                {
+                    state.RecycleCts = new CancellationTokenSource();
+                    var ct = state.RecycleCts.Token;
+                    _ = Task.Run(() => RecycleLoopAsync(state, ct), ct);
+                }
+            }
+
+            if (_options.AlarmProjection.Enabled)
+                _alarmProjection = new FocasAlarmProjection(this, _options.AlarmProjection.PollInterval);
+
+            if (_options.FixedTree.Enabled)
+            {
+                foreach (var state in _devices.Values)
+                {
+                    state.FixedTreeCts = new CancellationTokenSource();
+                    var ct = state.FixedTreeCts.Token;
+                    _ = Task.Run(() => FixedTreeLoopAsync(state, ct), ct);
+                }
+            }
+
+            _health = new DriverHealth(DriverState.Healthy, DateTime.UtcNow, null);
+        }
+        catch (Exception ex)
+        {
+            _health = new DriverHealth(DriverState.Faulted, null, ex.Message);
+            throw;
+        }
+        return Task.CompletedTask;
+    }
+
+    public async Task ReinitializeAsync(string driverConfigJson, CancellationToken cancellationToken)
+    {
+        await ShutdownAsync(cancellationToken).ConfigureAwait(false);
+        await InitializeAsync(driverConfigJson, cancellationToken).ConfigureAwait(false);
+    }
+
+    public async Task ShutdownAsync(CancellationToken cancellationToken)
+    {
+        await _poll.DisposeAsync().ConfigureAwait(false);
+        if (_alarmProjection is { } proj)
+        {
+            await proj.DisposeAsync().ConfigureAwait(false);
+            _alarmProjection = null;
+        }
+        foreach (var state in _devices.Values)
+        {
+            try { state.ProbeCts?.Cancel(); } catch { }
+            state.ProbeCts?.Dispose();
+            state.ProbeCts = null;
+            try { state.RecycleCts?.Cancel(); } catch { }
+            state.RecycleCts?.Dispose();
+            state.RecycleCts = null;
+            try { state.FixedTreeCts?.Cancel(); } catch { }
+            state.FixedTreeCts?.Dispose();
+            state.FixedTreeCts = null;
+            state.DisposeClient();
+        }
+        _devices.Clear();
+        _tagsByName.Clear();
+        _health = new DriverHealth(DriverState.Unknown, _health.LastSuccessfulRead, null);
+    }
+
+    public DriverHealth GetHealth() => _health;
+    public long GetMemoryFootprint() => 0;
+    public Task FlushOptionalCachesAsync(CancellationToken cancellationToken) => Task.CompletedTask;
+
+    internal int DeviceCount => _devices.Count;
+    internal DeviceState? GetDeviceState(string hostAddress) =>
+        _devices.TryGetValue(hostAddress, out var s) ? s : null;
+
+    // ---- IReadable ----
+
+    public async Task<IReadOnlyList<DataValueSnapshot>> ReadAsync(
+        IReadOnlyList<string> fullReferences, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(fullReferences);
+        var now = DateTime.UtcNow;
+        var results = new DataValueSnapshot[fullReferences.Count];
+
+        for (var i = 0; i < fullReferences.Count; i++)
+        {
+            var reference = fullReferences[i];
+
+            // Fixed-tree T1 — fixed-tree references are synthesized from the cached
+            // dynamic snapshot + sysinfo; no P/Invoke per Read since the poll loop
+            // already fires them on cadence.
+            if (_options.FixedTree.Enabled && TryReadFixedTree(reference, now) is { } fx)
+            {
+                results[i] = fx;
+                continue;
+            }
+
+            if (!_tagsByName.TryGetValue(reference, out var def))
+            {
+                results[i] = new DataValueSnapshot(null, FocasStatusMapper.BadNodeIdUnknown, null, now);
+                continue;
+            }
+            if (!_devices.TryGetValue(def.DeviceHostAddress, out var device))
+            {
+                results[i] = new DataValueSnapshot(null, FocasStatusMapper.BadNodeIdUnknown, null, now);
+                continue;
+            }
+
+            try
+            {
+                var client = await EnsureConnectedAsync(device, cancellationToken).ConfigureAwait(false);
+                var parsed = FocasAddress.TryParse(def.Address)
+                    ?? throw new InvalidOperationException($"FOCAS tag '{def.Name}' has malformed Address '{def.Address}'.");
+                var (value, status) = await client.ReadAsync(parsed, def.DataType, cancellationToken).ConfigureAwait(false);
+
+                results[i] = new DataValueSnapshot(value, status, now, now);
+                if (status == FocasStatusMapper.Good)
+                    _health = new DriverHealth(DriverState.Healthy, now, null);
+                else
+                    _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead,
+                        $"FOCAS status 0x{status:X8} reading {reference}");
+            }
+            catch (OperationCanceledException) { throw; }
+            catch (Exception ex)
+            {
+                results[i] = new DataValueSnapshot(null, FocasStatusMapper.BadCommunicationError, null, now);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
+            }
+        }
+
+        return results;
+    }
+
+    // ---- IWritable ----
+
+    public async Task<IReadOnlyList<WriteResult>> WriteAsync(
+        IReadOnlyList<WriteRequest> writes, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(writes);
+        var results = new WriteResult[writes.Count];
+
+        for (var i = 0; i < writes.Count; i++)
+        {
+            var w = writes[i];
+            if (!_tagsByName.TryGetValue(w.FullReference, out var def))
+            {
+                results[i] = new WriteResult(FocasStatusMapper.BadNodeIdUnknown);
+                continue;
+            }
+            if (!def.Writable)
+            {
+                results[i] = new WriteResult(FocasStatusMapper.BadNotWritable);
+                continue;
+            }
+            if (!_devices.TryGetValue(def.DeviceHostAddress, out var device))
+            {
+                results[i] = new WriteResult(FocasStatusMapper.BadNodeIdUnknown);
+                continue;
+            }
+
+            try
+            {
+                var client = await EnsureConnectedAsync(device, cancellationToken).ConfigureAwait(false);
+                var parsed = FocasAddress.TryParse(def.Address)
+                    ?? throw new InvalidOperationException($"FOCAS tag '{def.Name}' has malformed Address '{def.Address}'.");
+                var status = await client.WriteAsync(parsed, def.DataType, w.Value, cancellationToken).ConfigureAwait(false);
+                results[i] = new WriteResult(status);
+            }
+            catch (OperationCanceledException) { throw; }
+            catch (NotSupportedException nse)
+            {
+                results[i] = new WriteResult(FocasStatusMapper.BadNotSupported);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, nse.Message);
+            }
+            catch (Exception ex) when (ex is FormatException or InvalidCastException)
+            {
+                results[i] = new WriteResult(FocasStatusMapper.BadTypeMismatch);
+            }
+            catch (OverflowException)
+            {
+                results[i] = new WriteResult(FocasStatusMapper.BadOutOfRange);
+            }
+            catch (Exception ex)
+            {
+                results[i] = new WriteResult(FocasStatusMapper.BadCommunicationError);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
+            }
+        }
+
+        return results;
+    }
+
+    // ---- ITagDiscovery ----
+
+    public Task DiscoverAsync(IAddressSpaceBuilder builder, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(builder);
+        var root = builder.Folder("FOCAS", "FOCAS");
+        foreach (var device in _options.Devices)
+        {
+            var label = device.DeviceName ?? device.HostAddress;
+            var deviceFolder = root.Folder(device.HostAddress, label);
+
+            // Fixed-tree T1 — Identity + Axes subtrees, populated once per session
+            // from cnc_sysinfo + cnc_rdaxisname at init time and kept in DeviceState.
+            if (_options.FixedTree.Enabled
+                && _devices.TryGetValue(device.HostAddress, out var state)
+                && state.FixedTreeCache is { } cache)
+            {
+                var identity = deviceFolder.Folder("Identity", "Identity");
+                EmitIdentityVariable(identity, device.HostAddress, "SeriesNumber", FocasDriverDataType.String);
+                EmitIdentityVariable(identity, device.HostAddress, "Version", FocasDriverDataType.String);
+                EmitIdentityVariable(identity, device.HostAddress, "MaxAxes", FocasDriverDataType.Int32);
+                EmitIdentityVariable(identity, device.HostAddress, "CncType", FocasDriverDataType.String);
+                EmitIdentityVariable(identity, device.HostAddress, "MtType", FocasDriverDataType.String);
+                EmitIdentityVariable(identity, device.HostAddress, "AxisCount", FocasDriverDataType.Int32);
+
+                var axesFolder = deviceFolder.Folder("Axes", "Axes");
+                foreach (var axis in cache.Axes)
+                {
+                    var axisFolder = axesFolder.Folder(axis.Display, axis.Display);
+                    EmitAxisVariable(axisFolder, device.HostAddress, axis.Display, "AbsolutePosition");
+                    EmitAxisVariable(axisFolder, device.HostAddress, axis.Display, "MachinePosition");
+                    EmitAxisVariable(axisFolder, device.HostAddress, axis.Display, "RelativePosition");
+                    EmitAxisVariable(axisFolder, device.HostAddress, axis.Display, "DistanceToGo");
+                    if (cache.Capabilities.ServoLoad)
+                        EmitAxisVariable(axisFolder, device.HostAddress, axis.Display, "ServoLoad");
+                }
+                EmitAxisVariable(axesFolder, device.HostAddress, "FeedRate", "Actual");
+                EmitAxisVariable(axesFolder, device.HostAddress, "SpindleSpeed", "Actual");
+
+                // Spindle subtree — one folder per discovered spindle, suppressed
+                // entirely on series that don't export cnc_rdspdlname. Per-spindle
+                // Load + MaxRpm each gated on their own capability probe.
+                if (cache.Capabilities.Spindles)
+                {
+                    var spindleRoot = deviceFolder.Folder("Spindle", "Spindle");
+                    for (var i = 0; i < cache.Spindles.Count; i++)
+                    {
+                        var s = cache.Spindles[i];
+                        var name = string.IsNullOrEmpty(s.Display) ? $"S{i + 1}" : s.Display;
+                        var spindleFolder = spindleRoot.Folder(name, name);
+                        if (cache.Capabilities.SpindleLoad)
+                            EmitFixedVariable(spindleFolder, device.HostAddress, $"Spindle/{name}", "Load", DriverDataType.Int32);
+                        if (cache.Capabilities.SpindleMaxRpm && i < cache.SpindleMaxRpms.Count)
+                            EmitFixedVariable(spindleFolder, device.HostAddress, $"Spindle/{name}", "MaxRpm", DriverDataType.Int32);
+                    }
+                }
+
+                // Fixed-tree T2 — Program + OperationMode subtrees (gated on capability).
+                if (cache.Capabilities.ProgramInfo)
+                {
+                    var program = deviceFolder.Folder("Program", "Program");
+                    EmitFixedVariable(program, device.HostAddress, "Program", "Name", DriverDataType.String);
+                    EmitFixedVariable(program, device.HostAddress, "Program", "ONumber", DriverDataType.Int32);
+                    EmitFixedVariable(program, device.HostAddress, "Program", "Number", DriverDataType.Int32);
+                    EmitFixedVariable(program, device.HostAddress, "Program", "MainNumber", DriverDataType.Int32);
+                    EmitFixedVariable(program, device.HostAddress, "Program", "Sequence", DriverDataType.Int32);
+                    EmitFixedVariable(program, device.HostAddress, "Program", "BlockCount", DriverDataType.Int32);
+
+                    var opMode = deviceFolder.Folder("OperationMode", "OperationMode");
+                    EmitFixedVariable(opMode, device.HostAddress, "OperationMode", "Mode", DriverDataType.Int32);
+                    EmitFixedVariable(opMode, device.HostAddress, "OperationMode", "ModeText", DriverDataType.String);
+                }
+
+                // Fixed-tree T3 — Timers subtree (power-on / operating / cutting / cycle).
+                if (cache.Capabilities.Timers)
+                {
+                    var timers = deviceFolder.Folder("Timers", "Timers");
+                    EmitFixedVariable(timers, device.HostAddress, "Timers", "PowerOnSeconds", DriverDataType.Float64);
+                    EmitFixedVariable(timers, device.HostAddress, "Timers", "OperatingSeconds", DriverDataType.Float64);
+                    EmitFixedVariable(timers, device.HostAddress, "Timers", "CuttingSeconds", DriverDataType.Float64);
+                    EmitFixedVariable(timers, device.HostAddress, "Timers", "CycleSeconds", DriverDataType.Float64);
+                }
+            }
+
+            var tagsForDevice = _options.Tags.Where(t =>
+                string.Equals(t.DeviceHostAddress, device.HostAddress, StringComparison.OrdinalIgnoreCase));
+            foreach (var tag in tagsForDevice)
+            {
+                deviceFolder.Variable(tag.Name, tag.Name, new DriverAttributeInfo(
+                    FullName: tag.Name,
+                    DriverDataType: tag.DataType.ToDriverDataType(),
+                    IsArray: false,
+                    ArrayDim: null,
+                    SecurityClass: tag.Writable
+                        ? SecurityClassification.Operate
+                        : SecurityClassification.ViewOnly,
+                    IsHistorized: false,
+                    IsAlarm: false,
+                    WriteIdempotent: tag.WriteIdempotent));
+            }
+        }
+        return Task.CompletedTask;
+    }
+
+    private enum FocasDriverDataType { String, Int32, Float64 }
+
+    private static void EmitIdentityVariable(
+        IAddressSpaceBuilder folder, string deviceHost, string field, FocasDriverDataType type)
+    {
+        var fullName = FixedTreeReference(deviceHost, $"Identity/{field}");
+        folder.Variable(field, field, new DriverAttributeInfo(
+            FullName: fullName,
+            DriverDataType: type switch
+            {
+                FocasDriverDataType.Int32 => DriverDataType.Int32,
+                FocasDriverDataType.Float64 => DriverDataType.Float64,
+                _ => DriverDataType.String,
+            },
+            IsArray: false,
+            ArrayDim: null,
+            SecurityClass: SecurityClassification.ViewOnly,
+            IsHistorized: false,
+            IsAlarm: false,
+            WriteIdempotent: false));
+    }
+
+    private static void EmitAxisVariable(
+        IAddressSpaceBuilder folder, string deviceHost, string axisName, string field)
+    {
+        var fullName = FixedTreeReference(deviceHost, $"Axes/{axisName}/{field}");
+        folder.Variable(field, field, new DriverAttributeInfo(
+            FullName: fullName,
+            DriverDataType: DriverDataType.Float64,
+            IsArray: false,
+            ArrayDim: null,
+            SecurityClass: SecurityClassification.ViewOnly,
+            IsHistorized: false,
+            IsAlarm: false,
+            WriteIdempotent: false));
+    }
+
+    /// <summary>
+    ///     Emit a variable under a named fixed-tree folder (Program, OperationMode,
+    ///     …). Full-reference shape is <c>{deviceHost}/{folderPath}/{field}</c>.
+    /// </summary>
+    private static void EmitFixedVariable(
+        IAddressSpaceBuilder folder, string deviceHost, string folderPath,
+        string field, DriverDataType type)
+    {
+        var fullName = FixedTreeReference(deviceHost, $"{folderPath}/{field}");
+        folder.Variable(field, field, new DriverAttributeInfo(
+            FullName: fullName,
+            DriverDataType: type,
+            IsArray: false,
+            ArrayDim: null,
+            SecurityClass: SecurityClassification.ViewOnly,
+            IsHistorized: false,
+            IsAlarm: false,
+            WriteIdempotent: false));
+    }
+
+    /// <summary>
+    ///     Canonical full-reference shape for a fixed-tree node. Keeps the device
+    ///     host as a prefix so multi-device configs don't collide, and the rest is
+    ///     the path inside the tree. Matches what poll-loop snapshots publish +
+    ///     what <see cref="ReadAsync"/> looks up.
+    /// </summary>
+    internal static string FixedTreeReference(string deviceHost, string path) =>
+        $"{deviceHost}/{path}";
+
+    // ---- ISubscribable (polling overlay via shared engine) ----
+
+    public Task<ISubscriptionHandle> SubscribeAsync(
+        IReadOnlyList<string> fullReferences, TimeSpan publishingInterval, CancellationToken cancellationToken) =>
+        Task.FromResult(_poll.Subscribe(fullReferences, publishingInterval));
+
+    public Task UnsubscribeAsync(ISubscriptionHandle handle, CancellationToken cancellationToken)
+    {
+        _poll.Unsubscribe(handle);
+        return Task.CompletedTask;
+    }
+
+    // ---- IHostConnectivityProbe ----
+
+    public IReadOnlyList<HostConnectivityStatus> GetHostStatuses() =>
+        [.. _devices.Values.Select(s => new HostConnectivityStatus(s.Options.HostAddress, s.HostState, s.HostStateChangedUtc))];
+
+    private async Task ProbeLoopAsync(DeviceState state, CancellationToken ct)
+    {
+        while (!ct.IsCancellationRequested)
+        {
+            var success = false;
+            try
+            {
+                var client = await EnsureConnectedAsync(state, ct).ConfigureAwait(false);
+                success = await client.ProbeAsync(ct).ConfigureAwait(false);
+            }
+            catch (OperationCanceledException) when (ct.IsCancellationRequested) { break; }
+            catch { /* connect-failure path already disposed + cleared the client */ }
+
+            TransitionDeviceState(state, success ? HostState.Running : HostState.Stopped);
+
+            try { await Task.Delay(_options.Probe.Interval, ct).ConfigureAwait(false); }
+            catch (OperationCanceledException) { break; }
+        }
+    }
+
+    /// <summary>
+    ///     Per-device fixed-tree poll loop. First tick resolves sysinfo + axis names
+    ///     (once) so <see cref="DiscoverAsync"/> can render the subtree on its next
+    ///     invocation; every tick thereafter fires a <c>cnc_rddynamic2</c> per axis
+    ///     and publishes OnDataChange for the axis positions + feed rate + spindle
+    ///     speed.
+    /// </summary>
+    private async Task FixedTreeLoopAsync(DeviceState state, CancellationToken ct)
+    {
+        // Bootstrap: identity + axis names + per-optional-API capability probe.
+        // Each optional call is attempted once; failures (EW_FUNC / EW_NOOPT / EW_VERSION)
+        // record the capability as unsupported and suppress the corresponding nodes
+        // in DiscoverAsync + the poll loop.
+        while (!ct.IsCancellationRequested && state.FixedTreeCache is null)
+        {
+            try
+            {
+                var client = await EnsureConnectedAsync(state, ct).ConfigureAwait(false);
+                var sys = await client.GetSysInfoAsync(ct).ConfigureAwait(false);
+                var axes = await client.GetAxisNamesAsync(ct).ConfigureAwait(false);
+
+                // Optional-API probes — each returns empty / throws when unsupported.
+                var spindles = await SafeProbe(() => client.GetSpindleNamesAsync(ct), []);
+                var spindleMaxRpms = await SafeProbe(() => client.GetSpindleMaxRpmsAsync(ct), []);
+                var servoLoads = await SafeProbe(() => client.GetServoLoadsAsync(ct), []);
+                var programInfo = await SafeTryProbe(() => client.GetProgramInfoAsync(ct));
+                var timer = await SafeTryProbe(() => client.GetTimerAsync(FocasTimerKind.PowerOn, ct));
+                var spindleLoad = await SafeProbe(() => client.GetSpindleLoadsAsync(ct), []);
+
+                var caps = new FocasFixedTreeCapabilities(
+                    Spindles: spindles.Count > 0,
+                    SpindleLoad: spindleLoad.Count > 0,
+                    SpindleMaxRpm: spindleMaxRpms.Count > 0,
+                    ServoLoad: servoLoads.Count > 0,
+                    ProgramInfo: programInfo is not null,
+                    Timers: timer is not null);
+
+                state.FixedTreeCache = new FocasFixedTreeCache(
+                    sys, [.. axes], [.. spindles], [.. spindleMaxRpms], caps);
+            }
+            catch (OperationCanceledException) when (ct.IsCancellationRequested) { return; }
+            catch
+            {
+                try { await Task.Delay(TimeSpan.FromSeconds(2), ct).ConfigureAwait(false); }
+                catch (OperationCanceledException) { return; }
+            }
+        }
+
+        // Prime the spindle-loads cache from bootstrap if supported — avoids a
+        // "tree is there but reads say BadNodeIdUnknown" window on startup.
+        if (state.FixedTreeCache?.Capabilities is { SpindleLoad: true })
+        {
+            try
+            {
+                var client2 = await EnsureConnectedAsync(state, ct).ConfigureAwait(false);
+                var loads = await client2.GetSpindleLoadsAsync(ct).ConfigureAwait(false);
+                for (var i = 0; i < loads.Count; i++) state.LastSpindleLoads[i] = loads[i];
+            }
+            catch { /* first-tick poll will retry */ }
+        }
+
+        var programPollDue = DateTime.MinValue;
+        var timerPollDue = DateTime.MinValue;
+        while (!ct.IsCancellationRequested)
+        {
+            try
+            {
+                var client = await EnsureConnectedAsync(state, ct).ConfigureAwait(false);
+                var cache = state.FixedTreeCache;
+                if (cache is null) break;
+                FocasDynamicSnapshot? firstAxisSnap = null;
+                for (var i = 0; i < cache.Axes.Count; i++)
+                {
+                    var axisIndex = i + 1; // FOCAS uses 1-based axis indexing
+                    var axis = cache.Axes[i];
+                    var snap = await client.ReadDynamicAsync(axisIndex, ct).ConfigureAwait(false);
+                    PublishAxisSnapshot(state, axis, snap);
+                    if (i == 0) { firstAxisSnap = snap; PublishRateSnapshot(state, snap); }
+                }
+
+                // Servo loads + spindle loads — both return bulk arrays, so folding
+                // into the axis cadence is cheap. Each is gated by the bootstrap
+                // capability probe — unsupported on this series = silent skip.
+                if (cache.Capabilities.ServoLoad)
+                {
+                    try
+                    {
+                        var loads = await client.GetServoLoadsAsync(ct).ConfigureAwait(false);
+                        PublishServoLoads(state, loads);
+                    }
+                    catch { /* transient — next tick retries */ }
+                }
+                if (cache.Capabilities.SpindleLoad)
+                {
+                    try
+                    {
+                        var loads = await client.GetSpindleLoadsAsync(ct).ConfigureAwait(false);
+                        for (var i = 0; i < loads.Count; i++) state.LastSpindleLoads[i] = loads[i];
+                    }
+                    catch { /* transient */ }
+                }
+
+                // Program-info poll runs on its own cadence — much slower than the axis
+                // poll because program / mode transitions are operator-driven.
+                var programInterval = _options.FixedTree.ProgramPollInterval;
+                if (cache.Capabilities.ProgramInfo
+                    && programInterval > TimeSpan.Zero && DateTime.UtcNow >= programPollDue)
+                {
+                    try
+                    {
+                        var program = await client.GetProgramInfoAsync(ct).ConfigureAwait(false);
+                        state.LastProgramInfo = program;
+                        if (firstAxisSnap is { } s) state.LastProgramAxisRef = s;
+                    }
+                    catch { /* transient — next tick retries */ }
+                    programPollDue = DateTime.UtcNow + programInterval;
+                }
+
+                // Timers — slowest cadence. Fires 4 FWLIB calls per tick (one per kind).
+                var timerInterval = _options.FixedTree.TimerPollInterval;
+                if (cache.Capabilities.Timers
+                    && timerInterval > TimeSpan.Zero && DateTime.UtcNow >= timerPollDue)
+                {
+                    foreach (FocasTimerKind kind in Enum.GetValues<FocasTimerKind>())
+                    {
+                        try
+                        {
+                            var t = await client.GetTimerAsync(kind, ct).ConfigureAwait(false);
+                            state.LastTimers[kind] = t;
+                        }
+                        catch { /* per-kind failures are non-fatal */ }
+                    }
+                    timerPollDue = DateTime.UtcNow + timerInterval;
+                }
+            }
+            catch (OperationCanceledException) when (ct.IsCancellationRequested) { break; }
+            catch { /* next tick retries — transient blips are expected */ }
+
+            try { await Task.Delay(_options.FixedTree.PollInterval, ct).ConfigureAwait(false); }
+            catch (OperationCanceledException) { break; }
+        }
+    }
+
+    /// <summary>
+    ///     Cache a fresh axis snapshot. The poll loop doesn't fire <c>OnDataChange</c>
+    ///     directly — subscribers go through the normal <c>SubscribeAsync</c> →
+    ///     <see cref="PollGroupEngine"/> → <see cref="ReadAsync"/> path, which hits
+    ///     <see cref="TryReadFixedTree"/> and returns these cached values.
+    /// </summary>
+    private static void PublishAxisSnapshot(DeviceState state, FocasAxisName axis, FocasDynamicSnapshot snap)
+    {
+        var host = state.Options.HostAddress;
+        state.LastFixedSnapshots[FixedTreeReference(host, $"Axes/{axis.Display}/AbsolutePosition")] = snap.AbsolutePosition;
+        state.LastFixedSnapshots[FixedTreeReference(host, $"Axes/{axis.Display}/MachinePosition")] = snap.MachinePosition;
+        state.LastFixedSnapshots[FixedTreeReference(host, $"Axes/{axis.Display}/RelativePosition")] = snap.RelativePosition;
+        state.LastFixedSnapshots[FixedTreeReference(host, $"Axes/{axis.Display}/DistanceToGo")] = snap.DistanceToGo;
+    }
+
+    private static void PublishRateSnapshot(DeviceState state, FocasDynamicSnapshot snap)
+    {
+        var host = state.Options.HostAddress;
+        state.LastFixedSnapshots[FixedTreeReference(host, "Axes/FeedRate/Actual")] = snap.ActualFeedRate;
+        state.LastFixedSnapshots[FixedTreeReference(host, "Axes/SpindleSpeed/Actual")] = snap.ActualSpindleSpeed;
+    }
+
+    /// <summary>
+    ///     Cache servo-load percentages keyed by axis name. Stored separately from
+    ///     <c>LastFixedSnapshots</c> (which is int-typed) so the double-valued load
+    ///     values don't need casting on every read.
+    /// </summary>
+    private static void PublishServoLoads(DeviceState state, IReadOnlyList<FocasServoLoad> loads)
+    {
+        foreach (var load in loads)
+            state.LastServoLoads[load.AxisName] = load.LoadPercent;
+    }
+
+    private static object? TimerValue(DeviceState state, FocasTimerKind kind) =>
+        state.LastTimers.TryGetValue(kind, out var t) ? (object)t.TotalSeconds : null;
+
+    /// <summary>
+    ///     Call an optional probe that returns a collection; swallow any exception
+    ///     and return <paramref name="fallback"/>. Used by bootstrap to capture
+    ///     per-series capability without letting one failed probe take down the
+    ///     entire bootstrap sequence.
+    /// </summary>
+    private static async Task<IReadOnlyList<T>> SafeProbe<T>(
+        Func<Task<IReadOnlyList<T>>> probe, IReadOnlyList<T> fallback)
+    {
+        try { return await probe().ConfigureAwait(false); }
+        catch { return fallback; }
+    }
+
+    /// <summary>
+    ///     Nullable variant — probe returns a single object or null on failure.
+    /// </summary>
+    private static async Task<T?> SafeTryProbe<T>(Func<Task<T>> probe) where T : class
+    {
+        try { return await probe().ConfigureAwait(false); }
+        catch { return null; }
+    }
+
+    /// <summary>
+    ///     Read cached last-fixed-tree snapshots. Returns the projected value when
+    ///     the reference looks like a fixed-tree FullName; null when it doesn't
+    ///     (callers fall through to the user-authored tag path).
+    /// </summary>
+    private DataValueSnapshot? TryReadFixedTree(string reference, DateTime now)
+    {
+        foreach (var state in _devices.Values)
+        {
+            if (!reference.StartsWith(state.Options.HostAddress + "/", StringComparison.OrdinalIgnoreCase)) continue;
+            if (state.LastFixedSnapshots.TryGetValue(reference, out var raw))
+                return new DataValueSnapshot((double)raw, FocasStatusMapper.Good, now, now);
+
+            // Servo-load match: reference shape is "{host}/Axes/{name}/ServoLoad"
+            var suffixFull = reference[(state.Options.HostAddress.Length + 1)..];
+            if (suffixFull.StartsWith("Axes/", StringComparison.Ordinal) && suffixFull.EndsWith("/ServoLoad", StringComparison.Ordinal))
+            {
+                var axisName = suffixFull["Axes/".Length..^"/ServoLoad".Length];
+                if (state.LastServoLoads.TryGetValue(axisName, out var load))
+                    return new DataValueSnapshot(load, FocasStatusMapper.Good, now, now);
+            }
+
+            // Spindle matches: "{host}/Spindle/{name}/Load" + "{host}/Spindle/{name}/MaxRpm"
+            if (suffixFull.StartsWith("Spindle/", StringComparison.Ordinal)
+                && state.FixedTreeCache is { } spindleCache)
+            {
+                var tail = suffixFull["Spindle/".Length..];
+                var slash = tail.IndexOf('/');
+                if (slash > 0)
+                {
+                    var spindleName = tail[..slash];
+                    var field = tail[(slash + 1)..];
+                    var idx = -1;
+                    for (var i = 0; i < spindleCache.Spindles.Count; i++)
+                    {
+                        var s = spindleCache.Spindles[i];
+                        var display = string.IsNullOrEmpty(s.Display) ? $"S{i + 1}" : s.Display;
+                        if (string.Equals(display, spindleName, StringComparison.OrdinalIgnoreCase)) { idx = i; break; }
+                    }
+                    if (idx >= 0)
+                    {
+                        object? value = field switch
+                        {
+                            "Load" => state.LastSpindleLoads.TryGetValue(idx, out var l) ? (object)l : null,
+                            "MaxRpm" => idx < spindleCache.SpindleMaxRpms.Count ? (object)spindleCache.SpindleMaxRpms[idx] : null,
+                            _ => null,
+                        };
+                        if (value is not null)
+                            return new DataValueSnapshot(value, FocasStatusMapper.Good, now, now);
+                    }
+                }
+            }
+            // Identity strings + program / op-mode fields aren't cached as doubles —
+            // re-derive from the struct caches.
+            if (state.FixedTreeCache is { } cache)
+            {
+                var suffix = reference[(state.Options.HostAddress.Length + 1)..];
+                var value = suffix switch
+                {
+                    "Identity/SeriesNumber" => (object)cache.SysInfo.Series,
+                    "Identity/Version" => cache.SysInfo.Version,
+                    "Identity/MaxAxes" => cache.SysInfo.MaxAxis,
+                    "Identity/CncType" => cache.SysInfo.CncType,
+                    "Identity/MtType" => cache.SysInfo.MtType,
+                    "Identity/AxisCount" => cache.SysInfo.AxesCount,
+                    "Program/Name" => (object?)state.LastProgramInfo?.Name,
+                    "Program/ONumber" => state.LastProgramInfo?.ONumber,
+                    "Program/BlockCount" => state.LastProgramInfo?.BlockCount,
+                    "Program/Number" => state.LastProgramAxisRef?.ProgramNumber,
+                    "Program/MainNumber" => state.LastProgramAxisRef?.MainProgramNumber,
+                    "Program/Sequence" => state.LastProgramAxisRef?.SequenceNumber,
+                    "OperationMode/Mode" => state.LastProgramInfo?.Mode,
+                    "OperationMode/ModeText" => state.LastProgramInfo is { } pi
+                        ? FocasOpMode.ToText(pi.Mode) : null,
+                    "Timers/PowerOnSeconds" => TimerValue(state, FocasTimerKind.PowerOn),
+                    "Timers/OperatingSeconds" => TimerValue(state, FocasTimerKind.Operating),
+                    "Timers/CuttingSeconds" => TimerValue(state, FocasTimerKind.Cutting),
+                    "Timers/CycleSeconds" => TimerValue(state, FocasTimerKind.Cycle),
+                    _ => null,
+                };
+                if (value is not null)
+                    return new DataValueSnapshot(value, FocasStatusMapper.Good, now, now);
+            }
+        }
+        return null;
+    }
+
+    private async Task RecycleLoopAsync(DeviceState state, CancellationToken ct)
+    {
+        while (!ct.IsCancellationRequested)
+        {
+            try { await Task.Delay(_options.HandleRecycle.Interval, ct).ConfigureAwait(false); }
+            catch (OperationCanceledException) { break; }
+
+            // Close the current handle — the next Read / Write / Probe call triggers
+            // EnsureConnectedAsync, which reopens a fresh one. We don't block here on
+            // reconnect because the goal is just to release the FWLIB handle slot; a
+            // readable tick one probe cycle later is an acceptable cost.
+            try { state.DisposeClient(); }
+            catch { /* already disposed or race — next EnsureConnected recovers */ }
+        }
+    }
+
+    private void TransitionDeviceState(DeviceState state, HostState newState)
+    {
+        HostState old;
+        lock (state.ProbeLock)
+        {
+            old = state.HostState;
+            if (old == newState) return;
+            state.HostState = newState;
+            state.HostStateChangedUtc = DateTime.UtcNow;
+        }
+        OnHostStatusChanged?.Invoke(this,
+            new HostStatusChangedEventArgs(state.Options.HostAddress, old, newState));
+    }
+
+    // ---- IAlarmSource ----
+
+    public Task<IAlarmSubscriptionHandle> SubscribeAlarmsAsync(
+        IReadOnlyList<string> sourceNodeIds, CancellationToken cancellationToken)
+    {
+        if (_alarmProjection is null)
+            throw new NotSupportedException(
+                "FOCAS alarm projection is disabled — set FocasDriverOptions.AlarmProjection.Enabled=true to opt in.");
+        return _alarmProjection.SubscribeAsync(sourceNodeIds, cancellationToken);
+    }
+
+    public Task UnsubscribeAlarmsAsync(IAlarmSubscriptionHandle handle, CancellationToken cancellationToken) =>
+        _alarmProjection is { } p ? p.UnsubscribeAsync(handle, cancellationToken) : Task.CompletedTask;
+
+    public Task AcknowledgeAsync(
+        IReadOnlyList<AlarmAcknowledgeRequest> acknowledgements, CancellationToken cancellationToken) =>
+        _alarmProjection is { } p ? p.AcknowledgeAsync(acknowledgements, cancellationToken) : Task.CompletedTask;
+
+    internal void InvokeAlarmEvent(AlarmEventArgs args) => OnAlarmEvent?.Invoke(this, args);
+
+    /// <summary>
+    ///     Poll every configured device's active-alarm list in one pass. Used by the alarm
+    ///     projection — kept <c>internal</c> rather than <c>public</c> because callers that
+    ///     want alarm events should subscribe through <c>IAlarmSource</c> instead.
+    /// </summary>
+    internal async Task<IReadOnlyList<(string HostAddress, IReadOnlyList<FocasActiveAlarm> Alarms)>>
+        ReadActiveAlarmsAcrossDevicesAsync(HashSet<string>? deviceFilter, CancellationToken ct)
+    {
+        var result = new List<(string, IReadOnlyList<FocasActiveAlarm>)>();
+        foreach (var state in _devices.Values)
+        {
+            if (deviceFilter is not null && !deviceFilter.Contains(state.Options.HostAddress)) continue;
+            try
+            {
+                var client = await EnsureConnectedAsync(state, ct).ConfigureAwait(false);
+                var alarms = await client.ReadAlarmsAsync(ct).ConfigureAwait(false);
+                result.Add((state.Options.HostAddress, alarms));
+            }
+            catch (OperationCanceledException) when (ct.IsCancellationRequested) { break; }
+            catch { /* surface a device-local fault on the next tick */ }
+        }
+        return result;
+    }
+
+    // ---- IPerCallHostResolver ----
+
+    public string ResolveHost(string fullReference)
+    {
+        if (_tagsByName.TryGetValue(fullReference, out var def))
+            return def.DeviceHostAddress;
+        return _options.Devices.FirstOrDefault()?.HostAddress ?? DriverInstanceId;
+    }
+
+    private async Task<IFocasClient> EnsureConnectedAsync(DeviceState device, CancellationToken ct)
+    {
+        if (device.Client is { IsConnected: true } c) return c;
+        device.Client ??= _clientFactory.Create();
+        try
+        {
+            await device.Client.ConnectAsync(device.ParsedAddress, _options.Timeout, ct).ConfigureAwait(false);
+        }
+        catch
+        {
+            device.Client.Dispose();
+            device.Client = null;
+            throw;
+        }
+        return device.Client;
+    }
+
+    public void Dispose() => DisposeAsync().AsTask().GetAwaiter().GetResult();
+    public async ValueTask DisposeAsync() => await ShutdownAsync(CancellationToken.None).ConfigureAwait(false);
+
+    /// <summary>
+    ///     Per-device fixed-tree cache populated once at first successful connect and
+    ///     read-only thereafter. Used by <see cref="DiscoverAsync"/> to render the
+    ///     tree + by <see cref="TryReadFixedTree"/> for synchronous Identity/* reads.
+    /// </summary>
+    internal sealed record FocasFixedTreeCache(
+        FocasSysInfo SysInfo,
+        IReadOnlyList<FocasAxisName> Axes,
+        IReadOnlyList<FocasSpindleName> Spindles,
+        IReadOnlyList<int> SpindleMaxRpms,
+        FocasFixedTreeCapabilities Capabilities);
+
+    /// <summary>
+    ///     Per-device optional-API capability flags — which of the "this may or may not
+    ///     exist on this CNC series" calls succeeded at bootstrap. Drives per-series
+    ///     node suppression so a 16i that doesn't export <c>cnc_rdspmaxrpm</c> simply
+    ///     doesn't get a <c>Spindle/{name}/MaxRpm</c> node (instead of surfacing
+    ///     <c>BadDeviceFailure</c> on every read).
+    /// </summary>
+    internal sealed record FocasFixedTreeCapabilities(
+        bool Spindles,          // cnc_rdspdlname returned 1+ spindle names
+        bool SpindleLoad,       // cnc_rdspload bootstrap probe succeeded
+        bool SpindleMaxRpm,     // cnc_rdspmaxrpm bootstrap probe succeeded
+        bool ServoLoad,         // cnc_rdsvmeter bootstrap probe returned data
+        bool ProgramInfo,       // cnc_exeprgname2 + cnc_rdblkcount + cnc_rdopmode work
+        bool Timers);           // cnc_rdtimer works for at least PowerOn
+
+    internal sealed class DeviceState(FocasHostAddress parsedAddress, FocasDeviceOptions options)
+    {
+        public FocasHostAddress ParsedAddress { get; } = parsedAddress;
+        public FocasDeviceOptions Options { get; } = options;
+        public IFocasClient? Client { get; set; }
+
+        public object ProbeLock { get; } = new();
+        public HostState HostState { get; set; } = HostState.Unknown;
+        public DateTime HostStateChangedUtc { get; set; } = DateTime.UtcNow;
+        public CancellationTokenSource? ProbeCts { get; set; }
+        public CancellationTokenSource? RecycleCts { get; set; }
+        public CancellationTokenSource? FixedTreeCts { get; set; }
+        public FocasFixedTreeCache? FixedTreeCache { get; set; }
+        public Dictionary<string, int> LastFixedSnapshots { get; } = new(StringComparer.OrdinalIgnoreCase);
+        public FocasProgramInfo? LastProgramInfo { get; set; }
+        /// <summary>Cached first-axis dynamic snapshot — feeds Program/Number, /MainNumber, /Sequence.</summary>
+        public FocasDynamicSnapshot? LastProgramAxisRef { get; set; }
+        public Dictionary<FocasTimerKind, FocasTimer> LastTimers { get; } = [];
+        public Dictionary<string, double> LastServoLoads { get; } = new(StringComparer.OrdinalIgnoreCase);
+        public Dictionary<int, int> LastSpindleLoads { get; } = [];
+
+        public void DisposeClient()
+        {
+            Client?.Dispose();
+            Client = null;
+        }
+    }
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasDriverFactoryExtensions.cs

@@ -0,0 +1,165 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using ZB.MOM.WW.OtOpcUa.Core.Hosting;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Wire;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     Static factory registration helper for <see cref="FocasDriver"/>. Server's
+///     Program.cs calls <see cref="Register"/> once at startup; the bootstrapper
+///     then materialises FOCAS DriverInstance rows from the central config DB
+///     into live driver instances.
+/// </summary>
+/// <remarks>
+///     The DriverConfig JSON selects the <see cref="IFocasClientFactory"/> backend:
+///     <list type="bullet">
+///         <item><c>"Backend": "wire"</c> (default) — pure-managed FOCAS2 wire
+///         client (<see cref="WireFocasClientFactory"/>) speaking directly to
+///         the CNC on TCP:8193.</item>
+///         <item><c>"Backend": "unimplemented"</c> / <c>"none"</c> / <c>"stub"</c>
+///         — returns the no-op factory; useful for scaffolding DriverInstance
+///         rows before the CNC endpoint is reachable.</item>
+///     </list>
+///     Devices / Tags / Probe / Timeout / Series come from the same JSON and
+///     feed directly into <see cref="FocasDriverOptions"/>.
+/// </remarks>
+public static class FocasDriverFactoryExtensions
+{
+    public const string DriverTypeName = "FOCAS";
+
+    /// <summary>
+    ///     Register the FOCAS driver factory in the supplied <see cref="DriverFactoryRegistry"/>.
+    ///     Throws if 'FOCAS' is already registered — single-instance per process.
+    /// </summary>
+    public static void Register(DriverFactoryRegistry registry)
+    {
+        ArgumentNullException.ThrowIfNull(registry);
+        registry.Register(DriverTypeName, CreateInstance);
+    }
+
+    internal static FocasDriver CreateInstance(string driverInstanceId, string driverConfigJson)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(driverInstanceId);
+        ArgumentException.ThrowIfNullOrWhiteSpace(driverConfigJson);
+
+        var dto = JsonSerializer.Deserialize<FocasDriverConfigDto>(driverConfigJson, JsonOptions)
+            ?? throw new InvalidOperationException(
+                $"FOCAS driver config for '{driverInstanceId}' deserialised to null");
+
+        // Eager-validate top-level Series so a typo fails fast regardless of whether Devices
+        // are populated yet (common during rollout when rows are seeded before CNCs arrive).
+        _ = ParseSeries(dto.Series);
+
+        var options = new FocasDriverOptions
+        {
+            Devices = dto.Devices is { Count: > 0 }
+                ? [.. dto.Devices.Select(d => new FocasDeviceOptions(
+                    HostAddress: d.HostAddress ?? throw new InvalidOperationException(
+                        $"FOCAS config for '{driverInstanceId}' has a device missing HostAddress"),
+                    DeviceName: d.DeviceName,
+                    Series: ParseSeries(d.Series ?? dto.Series)))]
+                : [],
+            Tags = dto.Tags is { Count: > 0 }
+                ? [.. dto.Tags.Select(t => new FocasTagDefinition(
+                    Name: t.Name ?? throw new InvalidOperationException(
+                        $"FOCAS config for '{driverInstanceId}' has a tag missing Name"),
+                    DeviceHostAddress: t.DeviceHostAddress ?? throw new InvalidOperationException(
+                        $"FOCAS tag '{t.Name}' in '{driverInstanceId}' missing DeviceHostAddress"),
+                    Address: t.Address ?? throw new InvalidOperationException(
+                        $"FOCAS tag '{t.Name}' in '{driverInstanceId}' missing Address"),
+                    DataType: ParseDataType(t.DataType, t.Name!, driverInstanceId),
+                    Writable: t.Writable ?? true,
+                    WriteIdempotent: t.WriteIdempotent ?? false))]
+                : [],
+            Probe = new FocasProbeOptions
+            {
+                Enabled = dto.Probe?.Enabled ?? true,
+                Interval = TimeSpan.FromMilliseconds(dto.Probe?.IntervalMs ?? 5_000),
+                Timeout = TimeSpan.FromMilliseconds(dto.Probe?.TimeoutMs ?? 2_000),
+            },
+            Timeout = TimeSpan.FromMilliseconds(dto.TimeoutMs ?? 2_000),
+        };
+
+        var clientFactory = BuildClientFactory(dto, driverInstanceId);
+        return new FocasDriver(options, driverInstanceId, clientFactory);
+    }
+
+    internal static IFocasClientFactory BuildClientFactory(
+        FocasDriverConfigDto dto, string driverInstanceId)
+    {
+        var backend = (dto.Backend ?? "wire").Trim().ToLowerInvariant();
+        return backend switch
+        {
+            "wire" => new WireFocasClientFactory(),
+            "unimplemented" or "none" or "stub" => new UnimplementedFocasClientFactory(),
+            _ => throw new InvalidOperationException(
+                $"FOCAS driver config for '{driverInstanceId}' has unknown Backend '{dto.Backend}'. " +
+                "Expected one of: wire, unimplemented. " +
+                "(The legacy 'ipc' / 'fwlib' backends were retired in the Wire migration — " +
+                "see docs/drivers/FOCAS.md.)"),
+        };
+    }
+
+    private static FocasCncSeries ParseSeries(string? raw)
+    {
+        if (string.IsNullOrWhiteSpace(raw)) return FocasCncSeries.Unknown;
+        return Enum.TryParse<FocasCncSeries>(raw, ignoreCase: true, out var s)
+            ? s
+            : throw new InvalidOperationException(
+                $"FOCAS Series '{raw}' is not one of {string.Join(", ", Enum.GetNames<FocasCncSeries>())}");
+    }
+
+    private static FocasDataType ParseDataType(string? raw, string tagName, string driverInstanceId)
+    {
+        if (string.IsNullOrWhiteSpace(raw))
+            throw new InvalidOperationException(
+                $"FOCAS tag '{tagName}' in '{driverInstanceId}' missing DataType");
+        return Enum.TryParse<FocasDataType>(raw, ignoreCase: true, out var dt)
+            ? dt
+            : throw new InvalidOperationException(
+                $"FOCAS tag '{tagName}' has unknown DataType '{raw}'. " +
+                $"Expected one of {string.Join(", ", Enum.GetNames<FocasDataType>())}");
+    }
+
+    private static readonly JsonSerializerOptions JsonOptions = new()
+    {
+        PropertyNameCaseInsensitive = true,
+        ReadCommentHandling = JsonCommentHandling.Skip,
+        AllowTrailingCommas = true,
+    };
+
+    internal sealed class FocasDriverConfigDto
+    {
+        public string? Backend { get; init; }
+        public string? Series { get; init; }
+        public int? TimeoutMs { get; init; }
+        public List<FocasDeviceDto>? Devices { get; init; }
+        public List<FocasTagDto>? Tags { get; init; }
+        public FocasProbeDto? Probe { get; init; }
+    }
+
+    internal sealed class FocasDeviceDto
+    {
+        public string? HostAddress { get; init; }
+        public string? DeviceName { get; init; }
+        public string? Series { get; init; }
+    }
+
+    internal sealed class FocasTagDto
+    {
+        public string? Name { get; init; }
+        public string? DeviceHostAddress { get; init; }
+        public string? Address { get; init; }
+        public string? DataType { get; init; }
+        public bool? Writable { get; init; }
+        public bool? WriteIdempotent { get; init; }
+    }
+
+    internal sealed class FocasProbeDto
+    {
+        public bool? Enabled { get; init; }
+        public int? IntervalMs { get; init; }
+        public int? TimeoutMs { get; init; }
+    }
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasDriverOptions.cs

@@ -0,0 +1,115 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     FOCAS driver configuration. One instance supports N CNC devices. Per plan decision #144
+///     each device gets its own <c>(DriverInstanceId, HostAddress)</c> bulkhead key at the
+///     Phase 6.1 resilience layer.
+/// </summary>
+public sealed class FocasDriverOptions
+{
+    public IReadOnlyList<FocasDeviceOptions> Devices { get; init; } = [];
+    public IReadOnlyList<FocasTagDefinition> Tags { get; init; } = [];
+    public FocasProbeOptions Probe { get; init; } = new();
+    public TimeSpan Timeout { get; init; } = TimeSpan.FromSeconds(2);
+    public FocasAlarmProjectionOptions AlarmProjection { get; init; } = new();
+    public FocasHandleRecycleOptions HandleRecycle { get; init; } = new();
+    public FocasFixedTreeOptions FixedTree { get; init; } = new();
+}
+
+/// <summary>
+///     Fixed-node tree exposed by FOCAS per <c>docs/v2/driver-specs.md §7</c> —
+///     <c>Identity/</c>, <c>Axes/{name}/</c>, etc. populated from
+///     <c>cnc_sysinfo</c> / <c>cnc_rdaxisname</c> / <c>cnc_rddynamic2</c>. Disabled by
+///     default so existing configs that only use user-authored tags don't grow new
+///     nodes on upgrade.
+/// </summary>
+public sealed class FocasFixedTreeOptions
+{
+    /// <summary>Enable the fixed-node tree for every configured device.</summary>
+    public bool Enabled { get; init; } = false;
+
+    /// <summary>
+    ///     Poll cadence for <c>cnc_rddynamic2</c>. Each tick calls the API once per
+    ///     configured axis + publishes OnDataChange for the axis subtree. Real CNCs
+    ///     serve ~100ms loops comfortably; the default is conservative.
+    /// </summary>
+    public TimeSpan PollInterval { get; init; } = TimeSpan.FromMilliseconds(250);
+
+    /// <summary>
+    ///     Poll cadence for program + operation-mode info. Slower than the axis
+    ///     poll because program / mode transitions happen on operator timescales.
+    ///     Zero / negative disables the program poll entirely.
+    /// </summary>
+    public TimeSpan ProgramPollInterval { get; init; } = TimeSpan.FromSeconds(1);
+
+    /// <summary>
+    ///     Poll cadence for timers (power-on / operating / cutting / cycle).
+    ///     These change at human timescales — default is 30s. Zero / negative
+    ///     disables the timer poll entirely.
+    /// </summary>
+    public TimeSpan TimerPollInterval { get; init; } = TimeSpan.FromSeconds(30);
+}
+
+/// <summary>
+///     Proactive session-recycle cadence. Fanuc CNCs have a finite FWLIB handle pool
+///     (~5–10 concurrent connections) and certain series have documented handle-leak bugs
+///     that manifest after long uptime. When <see cref="Enabled"/> is <c>true</c> the
+///     driver closes + reopens each device's session on the <see cref="Interval"/> cadence,
+///     forcing FWLIB to release its handle slot back to the pool. Reads / writes during
+///     recycle wait for the reconnect rather than failing — worst case an operator sees a
+///     brief read latency spike once per cadence.
+/// </summary>
+/// <remarks>
+///     Disabled by default because a healthy CNC + driver doesn't need it. Enable when
+///     field experience shows handle exhaustion against a specific series / firmware.
+///     Typical tuning: 30 min for sites running multiple OtOpcUa instances against the
+///     same CNC (they share the pool); 6 h for a single-client deployment.
+/// </remarks>
+public sealed class FocasHandleRecycleOptions
+{
+    public bool Enabled { get; init; } = false;
+    public TimeSpan Interval { get; init; } = TimeSpan.FromHours(1);
+}
+
+/// <summary>
+///     Controls the CNC active-alarm polling projection that surfaces FOCAS alarms via
+///     <c>IAlarmSource</c>. Disabled by default — operators opt in by setting
+///     <see cref="Enabled"/> in <c>appsettings.json</c>.
+/// </summary>
+public sealed class FocasAlarmProjectionOptions
+{
+    public bool Enabled { get; init; } = false;
+
+    /// <summary>Poll cadence. One <c>cnc_rdalmmsg2</c> call per device per tick.</summary>
+    public TimeSpan PollInterval { get; init; } = TimeSpan.FromSeconds(2);
+}
+
+/// <summary>
+///     One CNC the driver talks to. <paramref name="Series"/> enables per-series
+///     address validation at <see cref="FocasDriver.InitializeAsync"/>; leave as
+///     <see cref="FocasCncSeries.Unknown"/> to skip validation (legacy behaviour).
+/// </summary>
+public sealed record FocasDeviceOptions(
+    string HostAddress,
+    string? DeviceName = null,
+    FocasCncSeries Series = FocasCncSeries.Unknown);
+
+/// <summary>
+///     One FOCAS-backed OPC UA variable. <paramref name="Address"/> is the canonical FOCAS
+///     address string that parses via <see cref="FocasAddress.TryParse"/> —
+///     <c>X0.0</c> / <c>R100</c> / <c>PARAM:1815/0</c> / <c>MACRO:500</c>.
+/// </summary>
+public sealed record FocasTagDefinition(
+    string Name,
+    string DeviceHostAddress,
+    string Address,
+    FocasDataType DataType,
+    bool Writable = true,
+    bool WriteIdempotent = false);
+
+public sealed class FocasProbeOptions
+{
+    public bool Enabled { get; init; } = true;
+    public TimeSpan Interval { get; init; } = TimeSpan.FromSeconds(5);
+    public TimeSpan Timeout { get; init; } = TimeSpan.FromSeconds(2);
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasHostAddress.cs

@@ -0,0 +1,41 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     Parsed FOCAS target address — IP + TCP port. Canonical <c>focas://{ip}[:{port}]</c>.
+///     Default port 8193 (Fanuc-reserved FOCAS Ethernet port).
+/// </summary>
+public sealed record FocasHostAddress(string Host, int Port)
+{
+    /// <summary>Fanuc-reserved TCP port for FOCAS Ethernet.</summary>
+    public const int DefaultPort = 8193;
+
+    public override string ToString() => Port == DefaultPort
+        ? $"focas://{Host}"
+        : $"focas://{Host}:{Port}";
+
+    public static FocasHostAddress? TryParse(string? value)
+    {
+        if (string.IsNullOrWhiteSpace(value)) return null;
+        const string prefix = "focas://";
+        if (!value.StartsWith(prefix, StringComparison.OrdinalIgnoreCase)) return null;
+
+        var body = value[prefix.Length..];
+        if (string.IsNullOrEmpty(body)) return null;
+
+        var colonIdx = body.LastIndexOf(':');
+        string host;
+        var port = DefaultPort;
+        if (colonIdx >= 0)
+        {
+            host = body[..colonIdx];
+            if (!int.TryParse(body[(colonIdx + 1)..], out port) || port is <= 0 or > 65535)
+                return null;
+        }
+        else
+        {
+            host = body;
+        }
+        if (string.IsNullOrEmpty(host)) return null;
+        return new FocasHostAddress(host, port);
+    }
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasStatusMapper.cs

@@ -0,0 +1,48 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     Maps FOCAS / FWLIB return codes to OPC UA StatusCodes. The FWLIB C API uses an
+///     <c>EW_*</c> constant family per the Fanuc FOCAS/1 and FOCAS/2 documentation
+///     (<c>EW_OK = 0</c>, <c>EW_NUMBER</c>, <c>EW_SOCKET</c>, etc.). Mirrors the shape of the
+///     AbCip / TwinCAT mappers so Admin UI status displays stay uniform across drivers.
+/// </summary>
+public static class FocasStatusMapper
+{
+    public const uint Good = 0u;
+    public const uint BadInternalError = 0x80020000u;
+    public const uint BadNodeIdUnknown = 0x80340000u;
+    public const uint BadNotWritable = 0x803B0000u;
+    public const uint BadOutOfRange = 0x803C0000u;
+    public const uint BadNotSupported = 0x803D0000u;
+    public const uint BadDeviceFailure = 0x80550000u;
+    public const uint BadCommunicationError = 0x80050000u;
+    public const uint BadTimeout = 0x800A0000u;
+    public const uint BadTypeMismatch = 0x80730000u;
+
+    /// <summary>
+    ///     Map common FWLIB <c>EW_*</c> return codes. The values below match Fanuc's published
+    ///     numeric conventions (EW_OK=0, EW_FUNC=1, EW_NUMBER=3, EW_LENGTH=4, EW_ATTRIB=7,
+    ///     EW_DATA=8, EW_NOOPT=6, EW_PROT=5, EW_OVRFLOW=2, EW_PARITY=9, EW_PASSWD=11,
+    ///     EW_BUSY=-1, EW_HANDLE=-8, EW_VERSION=-9, EW_UNEXP=-10, EW_SOCKET=-16).
+    /// </summary>
+    public static uint MapFocasReturn(int ret) => ret switch
+    {
+        0 => Good,
+        1 => BadNotSupported,          // EW_FUNC — CNC does not support this function
+        2 => BadOutOfRange,            // EW_OVRFLOW
+        3 => BadOutOfRange,            // EW_NUMBER
+        4 => BadOutOfRange,            // EW_LENGTH
+        5 => BadNotWritable,           // EW_PROT
+        6 => BadNotSupported,          // EW_NOOPT — optional CNC feature missing
+        7 => BadTypeMismatch,          // EW_ATTRIB
+        8 => BadNodeIdUnknown,         // EW_DATA — invalid data address
+        9 => BadCommunicationError,    // EW_PARITY
+        11 => BadNotWritable,          // EW_PASSWD
+        -1 => BadDeviceFailure,        // EW_BUSY
+        -8 => BadInternalError,        // EW_HANDLE — CNC handle not available
+        -9 => BadNotSupported,         // EW_VERSION — FWLIB vs CNC version mismatch
+        -10 => BadCommunicationError,  // EW_UNEXP
+        -16 => BadCommunicationError,  // EW_SOCKET
+        _ => BadCommunicationError,
+    };
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/IFocasClient.cs

@@ -0,0 +1,287 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     Wire-layer abstraction over one FOCAS session to a CNC. The driver holds one per
+///     configured device; lifetime matches the device.
+/// </summary>
+/// <remarks>
+///     <para>The default implementation is <see cref="Wire.WireFocasClient"/> — a pure-managed
+///     FOCAS/2 Ethernet client that speaks the wire protocol directly on TCP:8193. No
+///     P/Invoke, no native DLLs, no out-of-process isolation.</para>
+///
+///     <para><see cref="UnimplementedFocasClientFactory"/> is a scaffolding backend that
+///     throws on <see cref="IFocasClientFactory.Create"/> — selected by
+///     <c>"Backend": "unimplemented"</c> so a DriverInstance row can be seeded before the CNC
+///     endpoint is reachable without silently reading stale data.</para>
+/// </remarks>
+public interface IFocasClient : IDisposable
+{
+    /// <summary>Open the FWLIB handle + TCP session. Idempotent.</summary>
+    Task ConnectAsync(FocasHostAddress address, TimeSpan timeout, CancellationToken cancellationToken);
+
+    /// <summary>True when the FWLIB handle is valid + the socket is up.</summary>
+    bool IsConnected { get; }
+
+    /// <summary>
+    ///     Read the value at <paramref name="address"/> in the requested
+    ///     <paramref name="type"/>. Returns a boxed .NET value + the OPC UA status mapped
+    ///     through <see cref="FocasStatusMapper"/>.
+    /// </summary>
+    Task<(object? value, uint status)> ReadAsync(
+        FocasAddress address,
+        FocasDataType type,
+        CancellationToken cancellationToken);
+
+    /// <summary>
+    ///     Write <paramref name="value"/> to <paramref name="address"/>. Returns the mapped
+    ///     OPC UA status (0 = Good).
+    /// </summary>
+    Task<uint> WriteAsync(
+        FocasAddress address,
+        FocasDataType type,
+        object? value,
+        CancellationToken cancellationToken);
+
+    /// <summary>
+    ///     Cheap health probe — e.g. <c>cnc_rdcncstat</c>. Returns <c>true</c> when the CNC
+    ///     responds with any valid status.
+    /// </summary>
+    Task<bool> ProbeAsync(CancellationToken cancellationToken);
+
+    /// <summary>
+    ///     Read active alarm messages from the CNC via <c>cnc_rdalmmsg2</c>. Returns
+    ///     zero-or-more active alarms. Null / empty list means "no alarms currently
+    ///     active". IAlarmSource projection polls this at a configurable interval +
+    ///     emits transitions (raise / clear) on the driver's <c>OnAlarmEvent</c>.
+    /// </summary>
+    Task<IReadOnlyList<FocasActiveAlarm>> ReadAlarmsAsync(CancellationToken cancellationToken);
+
+    // ---- Fixed-tree T1 (identity + axis discovery + fast-poll dynamic bundle) ----
+
+    /// <summary>
+    ///     Read CNC identity via <c>cnc_sysinfo</c>. Populates the <c>Identity/*</c>
+    ///     subtree of the fixed-node surface. Callable once at session open; the
+    ///     values don't change across the session.
+    /// </summary>
+    Task<FocasSysInfo> GetSysInfoAsync(CancellationToken cancellationToken);
+
+    /// <summary>
+    ///     Read the CNC's configured axis names via <c>cnc_rdaxisname</c>. The driver
+    ///     uses these to build the <c>Axes/{name}/</c> subtree and to index
+    ///     <see cref="ReadDynamicAsync"/> calls.
+    /// </summary>
+    Task<IReadOnlyList<FocasAxisName>> GetAxisNamesAsync(CancellationToken cancellationToken);
+
+    /// <summary>
+    ///     Read the CNC's configured spindle names via <c>cnc_rdspdlname</c>. Drives
+    ///     the <c>Spindle/{name}/</c> subtree.
+    /// </summary>
+    Task<IReadOnlyList<FocasSpindleName>> GetSpindleNamesAsync(CancellationToken cancellationToken);
+
+    /// <summary>
+    ///     Read the fast-poll dynamic bundle for one axis via <c>cnc_rddynamic2</c>.
+    ///     Returns the current position quadruple (absolute / machine / relative /
+    ///     distance-to-go) plus actual feed rate + actual spindle speed + alarm
+    ///     flags + program / sequence numbers — one network round-trip per call.
+    /// </summary>
+    Task<FocasDynamicSnapshot> ReadDynamicAsync(int axisIndex, CancellationToken cancellationToken);
+
+    // ---- Fixed-tree T2 (program + operation mode) ----
+
+    /// <summary>
+    ///     Aggregate program + operation-mode snapshot. One wire round-trip per
+    ///     underlying FWLIB call — <c>cnc_rdblkcount</c>, <c>cnc_exeprgname2</c>,
+    ///     <c>cnc_rdopmode</c>. The driver polls this on a slower cadence than
+    ///     <see cref="ReadDynamicAsync"/> since program / mode transitions happen
+    ///     on human-operator timescales.
+    /// </summary>
+    Task<FocasProgramInfo> GetProgramInfoAsync(CancellationToken cancellationToken);
+
+    // ---- Fixed-tree T3 (timers) ----
+
+    /// <summary>
+    ///     Read one CNC cumulative timer. Kind selects PowerOn / Operating / Cutting /
+    ///     Cycle. Values are seconds — the managed side already converted the native
+    ///     minute+msec representation so downstream nodes display uniform units.
+    /// </summary>
+    Task<FocasTimer> GetTimerAsync(FocasTimerKind kind, CancellationToken cancellationToken);
+
+    // ---- Fixed-tree T3.5 (servo meters) ----
+
+    /// <summary>
+    ///     Read the servo-load meter percentages across all configured axes.
+    ///     Values are percentages (scaled by <c>10^Dec</c>). Empty list on a
+    ///     disconnected session or unsupported CNC.
+    /// </summary>
+    Task<IReadOnlyList<FocasServoLoad>> GetServoLoadsAsync(CancellationToken cancellationToken);
+
+    // ---- Fixed-tree T3.6 (spindle meters) ----
+
+    /// <summary>
+    ///     Read per-spindle load percentages. Result list index corresponds to
+    ///     spindle index from <see cref="GetSpindleNamesAsync"/>. Empty list on a
+    ///     disconnected session or when the CNC doesn't support the call (older
+    ///     series like 16i may return EW_FUNC).
+    /// </summary>
+    Task<IReadOnlyList<int>> GetSpindleLoadsAsync(CancellationToken cancellationToken);
+
+    /// <summary>
+    ///     Read per-spindle maximum RPM values. Static configuration, fetched once at
+    ///     bootstrap. Index alignment as per <see cref="GetSpindleLoadsAsync"/>.
+    /// </summary>
+    Task<IReadOnlyList<int>> GetSpindleMaxRpmsAsync(CancellationToken cancellationToken);
+}
+
+/// <summary>One servo-meter entry — one axis's current load percentage.</summary>
+public sealed record FocasServoLoad(string AxisName, double LoadPercent);
+
+/// <summary>Which cumulative counter <see cref="IFocasClient.GetTimerAsync"/> reads.</summary>
+public enum FocasTimerKind
+{
+    /// <summary>Machine power-on hours — resets never.</summary>
+    PowerOn = 0,
+    /// <summary>Cycle operating time — resets when the operator clears the counter.</summary>
+    Operating = 1,
+    /// <summary>Cutting time — only counts while in cutting feed.</summary>
+    Cutting = 2,
+    /// <summary>Cycle time since the last program start.</summary>
+    Cycle = 3,
+}
+
+/// <summary>One cumulative timer reading. <see cref="TotalSeconds"/> is the canonical unit.</summary>
+public sealed record FocasTimer(FocasTimerKind Kind, int Minutes, int Milliseconds)
+{
+    /// <summary>Cumulative time in seconds — <c>Minutes * 60 + Milliseconds / 1000</c>.</summary>
+    public double TotalSeconds => Minutes * 60.0 + Milliseconds / 1000.0;
+}
+
+/// <summary>
+///     CNC identity snapshot from <c>cnc_sysinfo</c>. Strings are trimmed ASCII.
+/// </summary>
+public sealed record FocasSysInfo(
+    int AddInfo,
+    int MaxAxis,
+    string CncType,   // "M" (mill) / "T" (lathe)
+    string MtType,
+    string Series,    // e.g. "30i"
+    string Version,   // e.g. "A1.0"
+    int AxesCount);
+
+/// <summary>One configured axis name (e.g. "X", "X1").</summary>
+public sealed record FocasAxisName(string Name, string Suffix)
+{
+    /// <summary>
+    ///     Display name — name + suffix concatenated, trimmed. Empty suffix yields
+    ///     just the name (the common case on single-channel CNCs).
+    /// </summary>
+    public string Display => string.IsNullOrEmpty(Suffix) ? Name : $"{Name}{Suffix}";
+}
+
+/// <summary>One configured spindle name (e.g. "S1").</summary>
+public sealed record FocasSpindleName(string Name, string Suffix1, string Suffix2, string Suffix3)
+{
+    public string Display
+    {
+        get
+        {
+            var s = Name + Suffix1 + Suffix2 + Suffix3;
+            return s.TrimEnd('\0', ' ');
+        }
+    }
+}
+
+/// <summary>
+///     Fast-poll bundle for one axis. Position values are scaled integers; the caller
+///     divides by <c>10^DecimalPlaces</c> to get the decimal value. DecimalPlaces is
+///     currently left to the caller to supply (via device config or a future
+///     <c>cnc_getfigure</c> path once that export lands).
+/// </summary>
+/// <summary>
+///     Program + operation-mode snapshot. Name is the currently-executing
+///     program filename (e.g. "O0001.NC"); ONumber is its Fanuc O-number (1-9999).
+///     Mode is the numeric code from <c>cnc_rdopmode</c> — see <see cref="FocasOpMode"/>.
+/// </summary>
+public sealed record FocasProgramInfo(
+    string Name,
+    int ONumber,
+    int BlockCount,
+    int Mode);
+
+/// <summary>Human-readable text for the <see cref="FocasProgramInfo.Mode"/> integer.</summary>
+public static class FocasOpMode
+{
+    public static string ToText(int mode) => mode switch
+    {
+        0 => "MDI",
+        1 => "AUTO",
+        2 => "TJOG",
+        3 => "EDIT",
+        4 => "HANDLE",
+        5 => "JOG",
+        6 => "TEACH_IN_HANDLE",
+        7 => "REFERENCE",
+        8 => "REMOTE",
+        9 => "TEST",
+        _ => $"Mode{mode}",
+    };
+}
+
+public sealed record FocasDynamicSnapshot(
+    int AxisIndex,
+    int AlarmFlags,
+    int ProgramNumber,
+    int MainProgramNumber,
+    int SequenceNumber,
+    int ActualFeedRate,
+    int ActualSpindleSpeed,
+    int AbsolutePosition,
+    int MachinePosition,
+    int RelativePosition,
+    int DistanceToGo);
+
+/// <summary>
+///     One active alarm surfaced by <see cref="IFocasClient.ReadAlarmsAsync"/>. Shape
+///     mirrors <c>ODBALMMSG2</c> but normalises the message bytes to a .NET string.
+/// </summary>
+public sealed record FocasActiveAlarm(
+    int AlarmNumber,
+    short Type,
+    short Axis,
+    string Message);
+
+/// <summary>Factory for <see cref="IFocasClient"/>s. One client per configured device.</summary>
+public interface IFocasClientFactory
+{
+    IFocasClient Create();
+}
+
+/// <summary>
+///     Scaffolding factory — throws on <see cref="Create"/> so a DriverInstance row can be
+///     seeded ahead of the CNC endpoint being reachable without silently reading stale data.
+///     Select via <c>"Backend": "unimplemented"</c> in driver config. Flip to
+///     <c>"Backend": "wire"</c> once the CNC is provisioned.
+/// </summary>
+public sealed class UnimplementedFocasClientFactory : IFocasClientFactory
+{
+    public IFocasClient Create() => throw new NotSupportedException(
+        "FOCAS driver backend is 'unimplemented'. Switch to 'Backend: \"wire\"' in driver config " +
+        "once the CNC is provisioned — see docs/drivers/FOCAS.md.");
+}
+
+/// <summary>
+///     Well-known FOCAS alarm types from <c>fwlib32.h</c> <c>ALM_TYPE_*</c>. Narrow subset —
+///     the full list is ~15 types per model; these cover the universally-present categories.
+/// </summary>
+public static class FocasAlarmType
+{
+    /// <summary>Pass to <see cref="IFocasClient.ReadAlarmsAsync"/>-equivalent to mean "any type".</summary>
+    public const int All = -1;
+    public const int Parameter = 0;   // ALM_P
+    public const int PulseCode = 1;   // ALM_Y (servo)
+    public const int Overtravel = 2;  // ALM_O
+    public const int Overheat = 3;    // ALM_H
+    public const int Servo = 4;       // ALM_S
+    public const int DataIo = 5;      // ALM_T
+    public const int MemoryCheck = 6; // ALM_M
+    public const int MacroAlarm = 13; // ALM_MC — used by #3006 etc.
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/Wire/FocasConstants.cs

@@ -0,0 +1,120 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Wire;
+
+/// <summary>
+///     PMC address-letter → FOCAS <c>ADR_*</c> numeric code. Values are the FOCAS/2 wire
+///     constants passed as the <c>area</c> argument on <c>pmc_rdpmcrng</c>
+///     (G=0, F=1, Y=2, X=3, A=4, R=5, T=6, K=7, C=8, D=9, E=10).
+/// </summary>
+public enum FocasPmcArea : short
+{
+    G = 0,
+    F = 1,
+    Y = 2,
+    X = 3,
+    A = 4,
+    R = 5,
+    T = 6,
+    K = 7,
+    C = 8,
+    D = 9,
+    E = 10,
+}
+
+/// <summary>
+///     PMC data-type numeric codes per FOCAS/2: <c>Byte=0</c>, <c>Word=1</c>, <c>Long=2</c>,
+///     <c>Real=4</c>, <c>Double=5</c>. Passed as the <c>data_type</c> argument on
+///     <c>pmc_rdpmcrng</c>.
+/// </summary>
+public enum FocasPmcDataType : short
+{
+    Byte = 0,
+    Word = 1,
+    Long = 2,
+    Real = 4,
+    Double = 5,
+}
+
+/// <summary>
+///     CNC operation mode as reported by <c>cnc_rdopmode</c>. Values are the FOCAS-defined
+///     mode codes; see <see cref="FocasOperationModeExtensions.ToText"/> for the canonical
+///     operator-facing labels.
+/// </summary>
+public enum FocasOperationMode : short
+{
+    Mdi = 0,
+    Auto = 1,
+    TJog = 2,
+    Edit = 3,
+    Handle = 4,
+    Jog = 5,
+    TeachInHandle = 6,
+    Reference = 7,
+    Remote = 8,
+    Test = 9,
+}
+
+/// <summary>Extension helpers over <see cref="FocasOperationMode"/>.</summary>
+public static class FocasOperationModeExtensions
+{
+    /// <summary>
+    ///     Canonical operator-facing label for an operation mode (e.g. <c>"AUTO"</c>,
+    ///     <c>"EDIT"</c>). Unknown codes fall back to the raw numeric value as a string
+    ///     so the UI still shows something interpretable.
+    /// </summary>
+    public static string ToText(this FocasOperationMode mode) => mode switch
+    {
+        FocasOperationMode.Mdi => "MDI",
+        FocasOperationMode.Auto => "AUTO",
+        FocasOperationMode.TJog => "T-JOG",
+        FocasOperationMode.Edit => "EDIT",
+        FocasOperationMode.Handle => "HANDLE",
+        FocasOperationMode.Jog => "JOG",
+        FocasOperationMode.TeachInHandle => "TEACH-IN-HANDLE",
+        FocasOperationMode.Reference => "REFERENCE",
+        FocasOperationMode.Remote => "REMOTE",
+        FocasOperationMode.Test => "TEST",
+        _ => ((short)mode).ToString(),
+    };
+}
+
+/// <summary>
+///     Letter → <see cref="FocasPmcArea"/> lookup. Used by <see cref="WireFocasClient"/> to
+///     translate a parsed <see cref="FocasAddress.PmcLetter"/> into the wire code expected by
+///     <c>pmc_rdpmcrng</c>.
+/// </summary>
+internal static class FocasPmcAreaLookup
+{
+    public static FocasPmcArea? FromLetter(string letter) => letter.ToUpperInvariant() switch
+    {
+        "G" => FocasPmcArea.G,
+        "F" => FocasPmcArea.F,
+        "Y" => FocasPmcArea.Y,
+        "X" => FocasPmcArea.X,
+        "A" => FocasPmcArea.A,
+        "R" => FocasPmcArea.R,
+        "T" => FocasPmcArea.T,
+        "K" => FocasPmcArea.K,
+        "C" => FocasPmcArea.C,
+        "D" => FocasPmcArea.D,
+        "E" => FocasPmcArea.E,
+        _ => null,
+    };
+}
+
+/// <summary>
+///     <see cref="FocasDataType"/> → <see cref="FocasPmcDataType"/> mapping for wire PMC
+///     reads. Bit reads collapse to byte — the caller extracts the bit from the returned
+///     value.
+/// </summary>
+internal static class FocasPmcDataTypeLookup
+{
+    public static FocasPmcDataType FromFocasDataType(FocasDataType t) => t switch
+    {
+        FocasDataType.Bit or FocasDataType.Byte => FocasPmcDataType.Byte,
+        FocasDataType.Int16 => FocasPmcDataType.Word,
+        FocasDataType.Int32 => FocasPmcDataType.Long,
+        FocasDataType.Float32 => FocasPmcDataType.Real,
+        FocasDataType.Float64 => FocasPmcDataType.Double,
+        _ => FocasPmcDataType.Byte,
+    };
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/Wire/FocasWireClient.cs

@@ -0,0 +1,883 @@
+using System.Buffers.Binary;
+using System.Net.Sockets;
+using Microsoft.Extensions.Logging;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Wire;
+
+/// <summary>
+///     Pure-managed read-only FOCAS/2 Ethernet wire client. Speaks the proprietary Fanuc
+///     binary protocol on TCP:8193 directly — no P/Invoke, no <c>Fwlib64.dll</c>, no
+///     out-of-process Host. One instance owns two TCP sockets for the duration of a CNC
+///     session; <see cref="ConnectAsync(string, int, int, CancellationToken)"/> runs the
+///     two-socket initiate handshake and a setup request, subsequent reads reuse
+///     <c>socket 2</c> serialised through an internal semaphore.
+/// </summary>
+/// <remarks>
+///     <para><b>Read surface.</b> Covers every FOCAS call OtOpcUa's managed driver issues:
+///     sysinfo, status, axis + spindle names, the <c>cnc_rddynamic2</c> fast-poll bundle,
+///     parameters (typed + raw-bytes overloads), macros, PMC ranges, alarms, operation mode,
+///     executing program, block count, timers, and servo / spindle meters. Writes are
+///     intentionally out of scope.</para>
+///     <para><b>Concurrency.</b> Callers may issue reads concurrently from multiple threads
+///     — <c>socket 2</c> is guarded by a <see cref="SemaphoreSlim"/> so at most one
+///     request/response pair is in flight at a time. <see cref="ConnectAsync(string, int, int, CancellationToken)"/>
+///     and <see cref="DisposeAsync"/> share a second semaphore to stop the two racing.</para>
+///     <para><b>Transient failures.</b> When cancellation or a socket-level error happens
+///     mid-request the client closes both sockets and throws
+///     <see cref="FocasWireException"/> with <see cref="FocasWireException.IsTransient"/>
+///     set — the caller must reconnect before issuing the next request. The transport is
+///     left deliberately torn down rather than half-open so a truncated response never
+///     desynchronises the next caller's read.</para>
+/// </remarks>
+public sealed class FocasWireClient : IAsyncDisposable, IDisposable
+{
+    private readonly ILogger<FocasWireClient>? _logger;
+    private readonly SemaphoreSlim _requestGate = new(1, 1);
+    private readonly SemaphoreSlim _lifetimeGate = new(1, 1);
+    private TcpClient? _socket1;
+    private TcpClient? _socket2;
+    private NetworkStream? _stream1;
+    private NetworkStream? _stream2;
+    private bool _connected;
+    private bool _disposed;
+    private FocasResult<WireSysInfo>? _sysInfo;
+
+    /// <summary>
+    ///     Construct a disconnected client. Optional <paramref name="logger"/> receives
+    ///     <c>Debug</c>-level entries per response block (command ID, RC, payload length).
+    /// </summary>
+    public FocasWireClient(ILogger<FocasWireClient>? logger = null)
+    {
+        _logger = logger;
+    }
+
+    /// <summary>
+    ///     Default <c>PathId</c> applied when no per-call override is supplied. Relevant for
+    ///     multi-path CNCs; single-path controllers leave this at the default of <c>1</c>.
+    /// </summary>
+    public ushort PathId { get; set; } = 1;
+
+    /// <summary>True when the two-socket handshake has completed and the transport is live.</summary>
+    public bool IsConnected => _connected;
+
+    /// <summary>
+    ///     Open the FOCAS session using an integer-seconds timeout. Idempotent — a second
+    ///     call while already connected is a no-op. Sub-second timeouts require the
+    ///     <see cref="ConnectAsync(string, int, TimeSpan, CancellationToken)"/> overload.
+    /// </summary>
+    public Task ConnectAsync(
+        string host,
+        int port,
+        int timeoutSeconds = 10,
+        CancellationToken cancellationToken = default)
+        => ConnectCoreAsync(
+            host,
+            port,
+            timeoutSeconds > 0 ? TimeSpan.FromSeconds(timeoutSeconds) : null,
+            cancellationToken);
+
+    /// <summary>
+    ///     Open the FOCAS session with a <see cref="TimeSpan"/> timeout. Pass
+    ///     <see cref="TimeSpan.Zero"/> to disable the timeout entirely (rely on the caller's
+    ///     <paramref name="cancellationToken"/> instead). Idempotent.
+    /// </summary>
+    public Task ConnectAsync(
+        string host,
+        int port,
+        TimeSpan timeout,
+        CancellationToken cancellationToken = default)
+        => ConnectCoreAsync(host, port, timeout == TimeSpan.Zero ? null : timeout, cancellationToken);
+
+    private async Task ConnectCoreAsync(
+        string host,
+        int port,
+        TimeSpan? timeoutValue,
+        CancellationToken cancellationToken)
+    {
+        await _lifetimeGate.WaitAsync(cancellationToken).ConfigureAwait(false);
+        try
+        {
+            ThrowIfDisposed();
+            if (_connected) return;
+
+            using var timeout = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+            if (timeoutValue is { } value) timeout.CancelAfter(value);
+
+            try
+            {
+                _socket1 = await ConnectSocketAsync(host, port, timeout.Token).ConfigureAwait(false);
+                _stream1 = _socket1.GetStream();
+                await SendPduAsync(_stream1, FocasWireProtocol.TypeInitiate, FocasWireProtocol.BuildInitiateBody(1), timeout.Token).ConfigureAwait(false);
+                await ReadExpectedPduAsync(_stream1, FocasWireProtocol.TypeInitiate, timeout.Token).ConfigureAwait(false);
+
+                _socket2 = await ConnectSocketAsync(host, port, timeout.Token).ConfigureAwait(false);
+                _stream2 = _socket2.GetStream();
+                await SendPduAsync(_stream2, FocasWireProtocol.TypeInitiate, FocasWireProtocol.BuildInitiateBody(2), timeout.Token).ConfigureAwait(false);
+                await ReadExpectedPduAsync(_stream2, FocasWireProtocol.TypeInitiate, timeout.Token).ConfigureAwait(false);
+
+                _connected = true;
+                // Cache the sysinfo payload from the setup exchange so later
+                // ReadSysInfoAsync calls are a lookup rather than a wire hit.
+                var sysInfoBlock = await SendSingleRequestAsync(timeout.Token, new RequestBlock(0x0018, PathId: PathId)).ConfigureAwait(false);
+                _sysInfo = ToResult(sysInfoBlock, ParseSysInfo);
+                // Kick the cached path/session metadata request the DLL sends
+                // right after initiate. The result is ignored; the CNC uses it to
+                // populate internal state the subsequent reads depend on.
+                await SendRequestAsync(timeout.Token, new RequestBlock(0x000e, 0x26f0, 0x26f0, PathId: PathId)).ConfigureAwait(false);
+            }
+            catch (Exception ex) when (IsTransientException(ex))
+            {
+                CloseTransport();
+                throw new FocasWireException("FOCAS wire connect failed.", ex, isTransient: true);
+            }
+        }
+        finally
+        {
+            _lifetimeGate.Release();
+        }
+    }
+
+    /// <summary>
+    ///     Synchronous dispose — sends the close PDU when connected and tears down both
+    ///     sockets. Idempotent. Callers on an async context should prefer
+    ///     <see cref="DisposeAsync"/>.
+    /// </summary>
+    public void Dispose()
+    {
+        _lifetimeGate.Wait();
+        try
+        {
+            if (_disposed) return;
+
+            _disposed = true;
+            if (_stream2 is not null && _connected)
+            {
+                try
+                {
+                    SendPdu(_stream2, FocasWireProtocol.TypeClose, ReadOnlySpan<byte>.Empty);
+                    _ = FocasWireProtocol.ReadPdu(_stream2);
+                }
+                catch
+                {
+                    // Close best-effort — don't let teardown failure hide a caller's real error.
+                }
+            }
+            CloseTransport();
+        }
+        finally
+        {
+            _lifetimeGate.Release();
+        }
+    }
+
+    /// <summary>
+    ///     Async dispose — sends the close PDU when connected and tears down both sockets.
+    ///     Idempotent.
+    /// </summary>
+    public async ValueTask DisposeAsync()
+    {
+        await _lifetimeGate.WaitAsync(CancellationToken.None).ConfigureAwait(false);
+        try
+        {
+            if (_disposed) return;
+
+            _disposed = true;
+            if (_stream2 is not null && _connected)
+            {
+                try
+                {
+                    await SendPduAsync(_stream2, FocasWireProtocol.TypeClose, ReadOnlyMemory<byte>.Empty, CancellationToken.None).ConfigureAwait(false);
+                    await FocasWireProtocol.ReadPduAsync(_stream2, CancellationToken.None).ConfigureAwait(false);
+                }
+                catch
+                {
+                    // Close best-effort — don't let teardown failure hide a caller's real error.
+                }
+            }
+            CloseTransport();
+        }
+        finally
+        {
+            _lifetimeGate.Release();
+        }
+    }
+
+    /// <summary>
+    ///     Read CNC identity via <c>cnc_sysinfo</c>. Cached from the connect-time exchange
+    ///     unless a per-call <paramref name="pathId"/> override is supplied.
+    /// </summary>
+    public async Task<FocasResult<WireSysInfo>> ReadSysInfoAsync(
+        CancellationToken cancellationToken = default,
+        TimeSpan? timeout = null,
+        ushort? pathId = null)
+    {
+        if (pathId is null && _sysInfo is { } cached) return cached;
+
+        using var callTimeout = CreateCallTimeout(cancellationToken, timeout);
+        return await ReadSingleAsync(0x0018, ParseSysInfo, EffectivePathId(pathId), cancellationToken: callTimeout.Token).ConfigureAwait(false);
+    }
+
+    /// <summary>Read CNC status bits via <c>cnc_statinfo</c> (3 command blocks aggregated into one <see cref="WireStatus"/>).</summary>
+    public async Task<FocasResult<WireStatus>> ReadStatusAsync(
+        CancellationToken cancellationToken = default,
+        TimeSpan? timeout = null,
+        ushort? pathId = null)
+    {
+        using var callTimeout = CreateCallTimeout(cancellationToken, timeout);
+        var requestPathId = EffectivePathId(pathId);
+        var blocks = await SendRequestAsync(
+            callTimeout.Token,
+            new RequestBlock(0x0019, PathId: requestPathId),
+            new RequestBlock(0x00e1, PathId: requestPathId),
+            new RequestBlock(0x0098, PathId: requestPathId)).ConfigureAwait(false);
+
+        var rc = AggregateRc(blocks);
+        if (rc != 0) return new FocasResult<WireStatus>(rc, null);
+
+        var primary = FindPayload(blocks, 0x0019);
+        RequireLength(primary, 14, "cnc_statinfo");
+        var tmModePayload = FindPayload(blocks, 0x0098);
+        var tmMode = tmModePayload.Length >= 2 ? ReadInt16(tmModePayload, 0) : (short)0;
+
+        return new FocasResult<WireStatus>(
+            rc,
+            new WireStatus(
+                Auto: ReadInt16(primary, 0),
+                Run: ReadInt16(primary, 2),
+                Motion: ReadInt16(primary, 4),
+                Mstb: ReadInt16(primary, 6),
+                Emergency: ReadInt16(primary, 8),
+                Alarm: ReadInt16(primary, 10),
+                Edit: ReadInt16(primary, 12),
+                TmMode: tmMode));
+    }
+
+    /// <summary>Read configured axis names via <c>cnc_rdaxisname</c> (command <c>0x0089</c>).</summary>
+    public async Task<FocasResult<IReadOnlyList<WireAxisRecord>>> ReadAxisNamesAsync(
+        short maxCount = 32,
+        CancellationToken cancellationToken = default,
+        TimeSpan? timeout = null,
+        ushort? pathId = null)
+    {
+        using var callTimeout = CreateCallTimeout(cancellationToken, timeout);
+        var block = await SendSingleRequestAsync(callTimeout.Token, new RequestBlock(0x0089, PathId: EffectivePathId(pathId))).ConfigureAwait(false);
+        return ToResult(block, payload => ReadNameRecords(payload, maxCount, (index, name) => new WireAxisRecord(index, name)));
+    }
+
+    /// <summary>Read configured spindle names via <c>cnc_rdspdlname</c> (command <c>0x008a</c>).</summary>
+    public async Task<FocasResult<IReadOnlyList<WireSpindleRecord>>> ReadSpindleNamesAsync(
+        short maxCount = 8,
+        CancellationToken cancellationToken = default,
+        TimeSpan? timeout = null,
+        ushort? pathId = null)
+    {
+        using var callTimeout = CreateCallTimeout(cancellationToken, timeout);
+        var block = await SendSingleRequestAsync(callTimeout.Token, new RequestBlock(0x008a, PathId: EffectivePathId(pathId))).ConfigureAwait(false);
+        return ToResult(block, payload => ReadNameRecords(payload, maxCount, (index, name) => new WireSpindleRecord(index, name)));
+    }
+
+    /// <summary>
+    ///     Fast-poll bundle for one axis via <c>cnc_rddynamic2</c>. Sends 9 request blocks in
+    ///     one PDU and aggregates the replies — alarm flags, program/sequence numbers, feed
+    ///     and spindle actuals, plus the four-slot position quadruple.
+    /// </summary>
+    public async Task<FocasResult<WireDynamic>> ReadDynamic2Async(
+        short axis = 1,
+        CancellationToken cancellationToken = default,
+        TimeSpan? timeout = null,
+        ushort? pathId = null)
+    {
+        using var callTimeout = CreateCallTimeout(cancellationToken, timeout);
+        var requestPathId = EffectivePathId(pathId);
+        var blocks = await SendRequestAsync(
+            callTimeout.Token,
+            new RequestBlock(0x001a, PathId: requestPathId),
+            new RequestBlock(0x001c, PathId: requestPathId),
+            new RequestBlock(0x001d, PathId: requestPathId),
+            new RequestBlock(0x0024, PathId: requestPathId),
+            new RequestBlock(0x0025, PathId: requestPathId),
+            new RequestBlock(0x0026, 4, axis, PathId: requestPathId),
+            new RequestBlock(0x0026, 1, axis, PathId: requestPathId),
+            new RequestBlock(0x0026, 6, axis, PathId: requestPathId),
+            new RequestBlock(0x0026, 7, axis, PathId: requestPathId)).ConfigureAwait(false);
+
+        var rc = AggregateRc(blocks);
+        if (rc != 0) return new FocasResult<WireDynamic>(rc, null);
+
+        var programPayload = FindPayload(blocks, 0x001c);
+        return new FocasResult<WireDynamic>(
+            rc,
+            new WireDynamic(
+                ReadFirstInt32(blocks, 0x001a),
+                programPayload.Length >= 4 ? ReadInt32(programPayload, 0) : 0,
+                programPayload.Length >= 8 ? ReadInt32(programPayload, 4) : 0,
+                ReadFirstInt32(blocks, 0x001d),
+                ReadFirstInt32(blocks, 0x0024),
+                ReadFirstInt32(blocks, 0x0025),
+                new WireAxisPosition(
+                    ReadSelectorPosition(blocks, 0x0026, 0),
+                    ReadSelectorPosition(blocks, 0x0026, 1),
+                    ReadSelectorPosition(blocks, 0x0026, 2),
+                    ReadSelectorPosition(blocks, 0x0026, 3))));
+    }
+
+    /// <summary>Read servo-meter load percentages via <c>cnc_rdsvmeter</c> (command <c>0x0056</c>).</summary>
+    public async Task<FocasResult<IReadOnlyList<WireServoMeter>>> ReadServoMeterAsync(
+        short maxCount = 32,
+        CancellationToken cancellationToken = default,
+        TimeSpan? timeout = null,
+        ushort? pathId = null)
+    {
+        using var callTimeout = CreateCallTimeout(cancellationToken, timeout);
+        var requestPathId = EffectivePathId(pathId);
+        var blocks = await SendRequestAsync(
+            callTimeout.Token,
+            new RequestBlock(0x0056, 1, PathId: requestPathId),
+            new RequestBlock(0x0089, PathId: requestPathId)).ConfigureAwait(false);
+
+        var rc = AggregateRc(blocks);
+        if (rc != 0) return new FocasResult<IReadOnlyList<WireServoMeter>>(rc, null);
+
+        var payload = FindPayload(blocks, 0x0056);
+        var result = new List<WireServoMeter>();
+        for (var offset = 0; offset + 12 <= payload.Length && result.Count < maxCount; offset += 12)
+        {
+            var name = FocasWireProtocol.ReadNameRecord(payload.AsSpan(offset + 8, 4));
+            result.Add(new WireServoMeter(
+                (short)(result.Count + 1),
+                name,
+                ReadInt32(payload, offset),
+                ReadInt16(payload, offset + 4),
+                ReadInt16(payload, offset + 6)));
+        }
+
+        return new FocasResult<IReadOnlyList<WireServoMeter>>(rc, result);
+    }
+
+    /// <summary>Read per-spindle load percentages via <c>cnc_rdspload</c> (command <c>0x0040</c> with arg1=0).</summary>
+    public Task<FocasResult<IReadOnlyList<WireSpindleMetric>>> ReadSpindleLoadAsync(
+        short spindleSelector = -1,
+        CancellationToken cancellationToken = default,
+        TimeSpan? timeout = null,
+        ushort? pathId = null)
+        => ReadSpindleMetricAsync(0, spindleSelector, cancellationToken, timeout, pathId);
+
+    /// <summary>Read per-spindle maximum RPMs via <c>cnc_rdspmaxrpm</c> (command <c>0x0040</c> with arg1=1).</summary>
+    public Task<FocasResult<IReadOnlyList<WireSpindleMetric>>> ReadSpindleMaxRpmAsync(
+        short spindleSelector = -1,
+        CancellationToken cancellationToken = default,
+        TimeSpan? timeout = null,
+        ushort? pathId = null)
+        => ReadSpindleMetricAsync(1, spindleSelector, cancellationToken, timeout, pathId);
+
+    /// <summary>
+    ///     Raw-bytes parameter read via <c>cnc_rdparam</c>. Caller marshals the returned
+    ///     payload to the type declared in the per-series parameter catalog. <paramref name="axis"/>
+    ///     selects an axis-scoped parameter; <c>0</c> means global.
+    /// </summary>
+    public async Task<FocasResult<byte[]>> ReadParameterBytesAsync(
+        short dataNumber,
+        short axis = 0,
+        CancellationToken cancellationToken = default,
+        TimeSpan? timeout = null,
+        ushort? pathId = null)
+    {
+        using var callTimeout = CreateCallTimeout(cancellationToken, timeout);
+        var secondArg = axis == 0 ? dataNumber : axis;
+        var block = await SendSingleRequestAsync(callTimeout.Token, new RequestBlock(0x000e, dataNumber, secondArg, PathId: EffectivePathId(pathId))).ConfigureAwait(false);
+        return ToResult(block, payload => payload);
+    }
+
+    /// <summary>Typed Int32 parameter read — convenience over <see cref="ReadParameterBytesAsync"/>.</summary>
+    public async Task<FocasResult<WireParameter>> ReadParameterAsync(
+        short dataNumber,
+        short type = 0,
+        CancellationToken cancellationToken = default,
+        TimeSpan? timeout = null,
+        ushort? pathId = null)
+    {
+        var result = await ReadParameterBytesAsync(dataNumber, cancellationToken: cancellationToken, timeout: timeout, pathId: pathId).ConfigureAwait(false);
+        if (!result.IsOk || result.Value is null) return new FocasResult<WireParameter>(result.Rc, null);
+        return new FocasResult<WireParameter>(
+            result.Rc,
+            new WireParameter(dataNumber, type, result.Value.Length >= 4 ? ReadInt32(result.Value, 0) : 0));
+    }
+
+    /// <summary>Typed 8-bit parameter read.</summary>
+    public async Task<FocasResult<byte>> ReadParameterByteAsync(short dataNumber, short axis = 0, CancellationToken cancellationToken = default, TimeSpan? timeout = null, ushort? pathId = null)
+    {
+        var result = await ReadParameterBytesAsync(dataNumber, axis, cancellationToken, timeout, pathId).ConfigureAwait(false);
+        return !result.IsOk || result.Value is null
+            ? new FocasResult<byte>(result.Rc, default)
+            : new FocasResult<byte>(result.Rc, result.Value.Length >= 1 ? result.Value[0] : default);
+    }
+
+    /// <summary>Typed 16-bit parameter read.</summary>
+    public async Task<FocasResult<short>> ReadParameterInt16Async(short dataNumber, short axis = 0, CancellationToken cancellationToken = default, TimeSpan? timeout = null, ushort? pathId = null)
+    {
+        var result = await ReadParameterBytesAsync(dataNumber, axis, cancellationToken, timeout, pathId).ConfigureAwait(false);
+        return !result.IsOk || result.Value is null
+            ? new FocasResult<short>(result.Rc, default)
+            : new FocasResult<short>(result.Rc, result.Value.Length >= 2 ? ReadInt16(result.Value, 0) : default);
+    }
+
+    /// <summary>Typed 32-bit parameter read.</summary>
+    public async Task<FocasResult<int>> ReadParameterInt32Async(short dataNumber, short axis = 0, CancellationToken cancellationToken = default, TimeSpan? timeout = null, ushort? pathId = null)
+    {
+        var result = await ReadParameterBytesAsync(dataNumber, axis, cancellationToken, timeout, pathId).ConfigureAwait(false);
+        return !result.IsOk || result.Value is null
+            ? new FocasResult<int>(result.Rc, default)
+            : new FocasResult<int>(result.Rc, result.Value.Length >= 4 ? ReadInt32(result.Value, 0) : default);
+    }
+
+    /// <summary>Typed IEEE-754 single-precision parameter read.</summary>
+    public async Task<FocasResult<float>> ReadParameterFloat32Async(short dataNumber, short axis = 0, CancellationToken cancellationToken = default, TimeSpan? timeout = null, ushort? pathId = null)
+    {
+        var result = await ReadParameterBytesAsync(dataNumber, axis, cancellationToken, timeout, pathId).ConfigureAwait(false);
+        return !result.IsOk || result.Value is null || result.Value.Length < 4
+            ? new FocasResult<float>(result.Rc, default)
+            : new FocasResult<float>(result.Rc, BitConverter.Int32BitsToSingle(ReadInt32(result.Value, 0)));
+    }
+
+    /// <summary>Typed IEEE-754 double-precision parameter read.</summary>
+    public async Task<FocasResult<double>> ReadParameterFloat64Async(short dataNumber, short axis = 0, CancellationToken cancellationToken = default, TimeSpan? timeout = null, ushort? pathId = null)
+    {
+        var result = await ReadParameterBytesAsync(dataNumber, axis, cancellationToken, timeout, pathId).ConfigureAwait(false);
+        return !result.IsOk || result.Value is null || result.Value.Length < 8
+            ? new FocasResult<double>(result.Rc, default)
+            : new FocasResult<double>(result.Rc, BitConverter.Int64BitsToDouble(BinaryPrimitives.ReadInt64BigEndian(result.Value.AsSpan(0, 8))));
+    }
+
+    /// <summary>Read a single macro variable via <c>cnc_rdmacro</c> (command <c>0x0015</c>).</summary>
+    public Task<FocasResult<WireMacro>> ReadMacroAsync(
+        short number,
+        CancellationToken cancellationToken = default,
+        TimeSpan? timeout = null,
+        ushort? pathId = null)
+        => ReadSingleWithTimeoutAsync(
+            0x0015,
+            payload => new WireMacro(number, payload.Length >= 4 ? ReadInt32(payload, 0) : 0, payload.Length >= 6 ? ReadInt16(payload, 4) : (short)0),
+            cancellationToken, timeout, EffectivePathId(pathId), number, number);
+
+    /// <summary>
+    ///     Read a PMC range via <c>pmc_rdpmcrng</c>. <paramref name="area"/> is the numeric
+    ///     address-letter code (see <see cref="FocasPmcArea"/>); <paramref name="dataType"/>
+    ///     is the width code (see <see cref="FocasPmcDataType"/>). Payload is decoded into
+    ///     <see cref="WirePmcRange.Values"/> — one entry per slot of the requested width.
+    /// </summary>
+    public async Task<FocasResult<WirePmcRange>> ReadPmcRangeAsync(
+        short area,
+        short dataType,
+        ushort start,
+        ushort end,
+        CancellationToken cancellationToken = default,
+        TimeSpan? timeout = null,
+        ushort? pathId = null)
+    {
+        if (end < start)
+            throw new ArgumentOutOfRangeException(nameof(end), "PMC end address must be greater than or equal to start.");
+
+        using var callTimeout = CreateCallTimeout(cancellationToken, timeout);
+        var block = await SendSingleRequestAsync(
+            callTimeout.Token,
+            new RequestBlock(0x8001, start, end, area, dataType, RequestClass: 2, PathId: EffectivePathId(pathId))).ConfigureAwait(false);
+
+        return ToResult(block, payload =>
+        {
+            var width = dataType switch
+            {
+                1 => 2,
+                2 or 4 => 4,
+                5 => 8,
+                _ => 1,
+            };
+
+            var values = new List<long>();
+            for (var offset = 0; offset + width <= payload.Length; offset += width)
+            {
+                values.Add(width switch
+                {
+                    1 => payload[offset],
+                    2 => ReadInt16(payload, offset),
+                    4 => ReadInt32(payload, offset),
+                    8 => BinaryPrimitives.ReadInt64BigEndian(payload.AsSpan(offset, 8)),
+                    _ => 0,
+                });
+            }
+
+            return new WirePmcRange(area, dataType, start, end, values);
+        });
+    }
+
+    /// <summary>Typed overload for <see cref="ReadPmcRangeAsync(short, short, ushort, ushort, CancellationToken, TimeSpan?, ushort?)"/>.</summary>
+    public Task<FocasResult<WirePmcRange>> ReadPmcRangeAsync(
+        FocasPmcArea area,
+        FocasPmcDataType dataType,
+        ushort start,
+        ushort end,
+        CancellationToken cancellationToken = default,
+        TimeSpan? timeout = null,
+        ushort? pathId = null)
+        => ReadPmcRangeAsync((short)area, (short)dataType, start, end, cancellationToken, timeout, pathId);
+
+    /// <summary>
+    ///     Read active alarms via <c>cnc_rdalmmsg2</c> (command <c>0x0023</c>). Parses both
+    ///     the 76-byte vendor <c>ODBALMMSG2_data</c> layout and the 80-byte legacy wire
+    ///     shape so the same managed surface works across firmware revisions.
+    /// </summary>
+    public async Task<FocasResult<IReadOnlyList<WireAlarm>>> ReadAlarmsAsync(
+        short type = -1,
+        short count = 32,
+        CancellationToken cancellationToken = default,
+        TimeSpan? timeout = null,
+        ushort? pathId = null)
+    {
+        using var callTimeout = CreateCallTimeout(cancellationToken, timeout);
+        var block = await SendSingleRequestAsync(
+            callTimeout.Token,
+            new RequestBlock(0x0023, type, count, 2, 0x40, PathId: EffectivePathId(pathId))).ConfigureAwait(false);
+
+        return ToResult(block, payload => ParseAlarms(payload, count));
+    }
+
+    /// <summary>Read operation mode via <c>cnc_rdopmode</c>, returned as the typed <see cref="FocasOperationMode"/>.</summary>
+    public Task<FocasResult<FocasOperationMode>> ReadOperationModeAsync(
+        CancellationToken cancellationToken = default,
+        TimeSpan? timeout = null,
+        ushort? pathId = null)
+        => ReadSingleWithTimeoutAsync(
+            0x0057,
+            payload => (FocasOperationMode)(payload.Length >= 2 ? ReadInt16(payload, 0) : (short)0),
+            cancellationToken, timeout, EffectivePathId(pathId));
+
+    /// <summary>
+    ///     Raw-code variant of <see cref="ReadOperationModeAsync"/> — returns the underlying
+    ///     FOCAS <c>short</c> so callers storing the raw mode code (e.g. OtOpcUa's
+    ///     <c>FocasProgramInfo.Mode</c> int field) don't have to cast the enum.
+    /// </summary>
+    public Task<FocasResult<short>> ReadOperationModeCodeAsync(
+        CancellationToken cancellationToken = default,
+        TimeSpan? timeout = null,
+        ushort? pathId = null)
+        => ReadSingleWithTimeoutAsync(
+            0x0057,
+            payload => payload.Length >= 2 ? ReadInt16(payload, 0) : (short)0,
+            cancellationToken, timeout, EffectivePathId(pathId));
+
+    /// <summary>Read the currently-executing program name + O-number via <c>cnc_exeprgname2</c> (command <c>0x00fc</c>).</summary>
+    public Task<FocasResult<WireProgramName>> ReadExecutingProgramNameAsync(
+        CancellationToken cancellationToken = default,
+        TimeSpan? timeout = null,
+        ushort? pathId = null)
+        => ReadSingleWithTimeoutAsync(0x00fc, ParseProgramName, cancellationToken, timeout, EffectivePathId(pathId));
+
+    /// <summary>Read the executed block count via <c>cnc_rdblkcount</c>.</summary>
+    public Task<FocasResult<int>> ReadBlockCountAsync(
+        CancellationToken cancellationToken = default,
+        TimeSpan? timeout = null,
+        ushort? pathId = null)
+        => ReadSingleWithTimeoutAsync(
+            0x0035,
+            payload => payload.Length >= 4 ? ReadInt32(payload, 0) : 0,
+            cancellationToken, timeout, EffectivePathId(pathId));
+
+    /// <summary>
+    ///     Read one cumulative timer via <c>cnc_rdtimer</c>. <paramref name="type"/> selects
+    ///     PowerOn / Operating / Cutting / Cycle per the FOCAS spec (0..3).
+    /// </summary>
+    public Task<FocasResult<WireTimer>> ReadTimerAsync(
+        short type,
+        CancellationToken cancellationToken = default,
+        TimeSpan? timeout = null,
+        ushort? pathId = null)
+        => ReadSingleWithTimeoutAsync(
+            0x0120,
+            payload => new WireTimer(type, payload.Length >= 4 ? ReadInt32(payload, 0) : 0, payload.Length >= 8 ? ReadInt32(payload, 4) : 0),
+            cancellationToken, timeout, EffectivePathId(pathId), type);
+
+    // ---- internal plumbing ------------------------------------------------------------
+
+    private async Task<FocasResult<IReadOnlyList<WireSpindleMetric>>> ReadSpindleMetricAsync(
+        int metric, short spindleSelector, CancellationToken cancellationToken, TimeSpan? timeout, ushort? pathId)
+    {
+        using var callTimeout = CreateCallTimeout(cancellationToken, timeout);
+        var block = await SendSingleRequestAsync(
+            callTimeout.Token,
+            new RequestBlock(0x0040, metric, spindleSelector, PathId: EffectivePathId(pathId))).ConfigureAwait(false);
+
+        return ToResult<IReadOnlyList<WireSpindleMetric>>(block, payload =>
+        {
+            var values = new List<WireSpindleMetric>();
+            for (var offset = 0; offset + 8 <= payload.Length; offset += 8)
+                values.Add(new WireSpindleMetric((short)(values.Count + 1), ReadInt32(payload, offset)));
+            return values;
+        });
+    }
+
+    private async Task<FocasResult<T>> ReadSingleAsync<T>(
+        ushort command,
+        Func<byte[], T> parser,
+        ushort? pathId = null,
+        int arg1 = 0,
+        int arg2 = 0,
+        int arg3 = 0,
+        int arg4 = 0,
+        CancellationToken cancellationToken = default)
+    {
+        var block = await SendSingleRequestAsync(cancellationToken, new RequestBlock(command, arg1, arg2, arg3, arg4, PathId: EffectivePathId(pathId))).ConfigureAwait(false);
+        return ToResult(block, parser);
+    }
+
+    private async Task<FocasResult<T>> ReadSingleWithTimeoutAsync<T>(
+        ushort command,
+        Func<byte[], T> parser,
+        CancellationToken cancellationToken,
+        TimeSpan? timeout,
+        ushort pathId,
+        int arg1 = 0,
+        int arg2 = 0,
+        int arg3 = 0,
+        int arg4 = 0)
+    {
+        using var callTimeout = CreateCallTimeout(cancellationToken, timeout);
+        return await ReadSingleAsync(command, parser, pathId, arg1, arg2, arg3, arg4, callTimeout.Token).ConfigureAwait(false);
+    }
+
+    private async Task<ResponseBlock> SendSingleRequestAsync(CancellationToken cancellationToken, RequestBlock block)
+    {
+        var blocks = await SendRequestAsync(cancellationToken, block).ConfigureAwait(false);
+        return blocks.Count == 0 ? new ResponseBlock(block.Command, 0, Array.Empty<byte>()) : blocks[0];
+    }
+
+    private async Task<IReadOnlyList<ResponseBlock>> SendRequestAsync(CancellationToken cancellationToken, params RequestBlock[] blocks)
+    {
+        EnsureConnected();
+        await _requestGate.WaitAsync(cancellationToken).ConfigureAwait(false);
+        var requestStarted = false;
+        try
+        {
+            var body = FocasWireProtocol.BuildRequestBody(blocks);
+            requestStarted = true;
+            await SendPduAsync(_stream2!, FocasWireProtocol.TypeData, body, cancellationToken).ConfigureAwait(false);
+            var response = await ReadExpectedPduAsync(_stream2!, FocasWireProtocol.TypeData, cancellationToken).ConfigureAwait(false);
+            var responseBlocks = FocasWireProtocol.ParseResponseBlocks(response.Body);
+            foreach (var block in responseBlocks)
+                _logger?.LogDebug("FOCAS response command=0x{Command:x4} rc={Rc} payloadLength={PayloadLength}", block.Command, block.Rc, block.Payload.Length);
+            return responseBlocks;
+        }
+        catch (Exception ex) when (requestStarted && IsTransientException(ex))
+        {
+            // A cancelled or failed mid-request write leaves the wire in an undefined state —
+            // tear the connection down so the next caller reconnects cleanly instead of
+            // consuming a stale response.
+            CloseTransport();
+            throw new FocasWireException("FOCAS wire request failed; connection was closed to avoid response desynchronization.", ex, isTransient: true);
+        }
+        finally
+        {
+            _requestGate.Release();
+        }
+    }
+
+    private static async Task<TcpClient> ConnectSocketAsync(string host, int port, CancellationToken cancellationToken)
+    {
+        var socket = new TcpClient { NoDelay = true };
+        try
+        {
+            await WithCancellation(socket.ConnectAsync(host, port), cancellationToken).ConfigureAwait(false);
+            return socket;
+        }
+        catch
+        {
+            socket.Dispose();
+            throw;
+        }
+    }
+
+    private static async Task SendPduAsync(NetworkStream stream, byte type, ReadOnlyMemory<byte> body, CancellationToken cancellationToken)
+    {
+        var pdu = FocasWireProtocol.BuildPdu(type, FocasWireProtocol.DirectionRequest, body.Span);
+        await stream.WriteAsync(pdu, 0, pdu.Length, cancellationToken).ConfigureAwait(false);
+        await stream.FlushAsync(cancellationToken).ConfigureAwait(false);
+    }
+
+    private static void SendPdu(NetworkStream stream, byte type, ReadOnlySpan<byte> body)
+    {
+        var pdu = FocasWireProtocol.BuildPdu(type, FocasWireProtocol.DirectionRequest, body);
+        stream.Write(pdu, 0, pdu.Length);
+        stream.Flush();
+    }
+
+    private void ThrowIfDisposed()
+    {
+        if (_disposed) throw new ObjectDisposedException(nameof(FocasWireClient));
+    }
+
+    private static async Task WithCancellation(Task task, CancellationToken cancellationToken)
+    {
+        if (!cancellationToken.CanBeCanceled)
+        {
+            await task.ConfigureAwait(false);
+            return;
+        }
+
+        var cancellation = new TaskCompletionSource<bool>();
+        using var registration = cancellationToken.Register(static state => ((TaskCompletionSource<bool>)state!).TrySetResult(true), cancellation);
+        if (task != await Task.WhenAny(task, cancellation.Task).ConfigureAwait(false))
+            throw new OperationCanceledException(cancellationToken);
+        await task.ConfigureAwait(false);
+    }
+
+    private static CancellationTokenSource CreateCallTimeout(CancellationToken cancellationToken, TimeSpan? timeout)
+    {
+        var source = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+        if (timeout is { } value) source.CancelAfter(value);
+        return source;
+    }
+
+    private static async Task<Pdu> ReadExpectedPduAsync(NetworkStream stream, byte expectedType, CancellationToken cancellationToken)
+    {
+        var pdu = await FocasWireProtocol.ReadPduAsync(stream, cancellationToken).ConfigureAwait(false);
+        if (pdu.Type != expectedType || pdu.Direction != FocasWireProtocol.DirectionResponse)
+            throw new FocasWireException($"Unexpected FOCAS PDU type 0x{pdu.Type:x2}, direction 0x{pdu.Direction:x2}.", rc: null);
+        return pdu;
+    }
+
+    private void EnsureConnected()
+    {
+        ThrowIfDisposed();
+        if (!_connected || _stream2 is null)
+            throw new FocasWireException("FOCAS wire client is not connected.", rc: null, isTransient: true);
+    }
+
+    private void CloseTransport()
+    {
+        _connected = false;
+        _sysInfo = null;
+        _stream1?.Dispose();
+        _stream2?.Dispose();
+        _socket1?.Dispose();
+        _socket2?.Dispose();
+        _stream1 = null;
+        _stream2 = null;
+        _socket1 = null;
+        _socket2 = null;
+    }
+
+    private ushort EffectivePathId(ushort? pathId) => pathId ?? PathId;
+
+    private static FocasResult<T> ToResult<T>(ResponseBlock block, Func<byte[], T> parser)
+        => block.Rc != 0
+            ? new FocasResult<T>(block.Rc, default)
+            : new FocasResult<T>(block.Rc, parser(block.Payload));
+
+    private static short AggregateRc(IReadOnlyList<ResponseBlock> blocks)
+        => blocks.FirstOrDefault(block => block.Rc != 0)?.Rc ?? 0;
+
+    private static byte[] FindPayload(IReadOnlyList<ResponseBlock> blocks, ushort command)
+        => blocks.FirstOrDefault(block => block.Command == command)?.Payload ?? Array.Empty<byte>();
+
+    private static int ReadFirstInt32(IReadOnlyList<ResponseBlock> blocks, ushort command)
+    {
+        var payload = FindPayload(blocks, command);
+        return payload.Length >= 4 ? ReadInt32(payload, 0) : 0;
+    }
+
+    private static int ReadSelectorPosition(IReadOnlyList<ResponseBlock> blocks, ushort command, int selectorIndex)
+    {
+        var seen = 0;
+        foreach (var block in blocks)
+        {
+            if (block.Command != command) continue;
+            if (seen == selectorIndex)
+                return block.Payload.Length >= 4 ? ReadInt32(block.Payload, 0) : 0;
+            seen++;
+        }
+        return 0;
+    }
+
+    private static WireSysInfo ParseSysInfo(byte[] payload)
+    {
+        RequireLength(payload, 16, "cnc_sysinfo");
+        return new WireSysInfo(
+            ReadInt16(payload, 0),
+            ReadInt16(payload, 2),
+            FocasWireProtocol.ReadAscii(payload.AsSpan(4, 2)),
+            FocasWireProtocol.ReadAscii(payload.AsSpan(6, 2)),
+            FocasWireProtocol.ReadAscii(payload.AsSpan(8, 4)),
+            FocasWireProtocol.ReadAscii(payload.AsSpan(12, 4)),
+            payload.Length >= 18 ? FocasWireProtocol.ReadAscii(payload.AsSpan(16, 2)) : string.Empty);
+    }
+
+    private static WireProgramName ParseProgramName(byte[] payload)
+    {
+        var nameLength = payload.Length >= 40 ? 36 : payload.Length;
+        var name = FocasWireProtocol.ReadAscii(payload.AsSpan(0, nameLength));
+        var number = payload.Length >= 40 ? ReadInt32(payload, 36) : (int?)null;
+        return new WireProgramName(name, number);
+    }
+
+    private static IReadOnlyList<WireAlarm> ParseAlarms(byte[] payload, short count)
+        => payload.Length % 76 == 0
+            ? ParseVendorAlarms(payload, count)
+            : ParseLegacyWireAlarms(payload, count);
+
+    private static IReadOnlyList<WireAlarm> ParseVendorAlarms(byte[] payload, short count)
+    {
+        var alarms = new List<WireAlarm>();
+        for (var offset = 0; offset + 76 <= payload.Length && alarms.Count < count; offset += 76)
+        {
+            var messageLength = ReadInt16(payload, offset + 10);
+            alarms.Add(new WireAlarm(
+                ReadInt32(payload, offset),
+                ReadInt16(payload, offset + 4),
+                ReadInt16(payload, offset + 6),
+                messageLength,
+                FocasWireProtocol.ReadAscii(payload.AsSpan(offset + 12, 64))));
+        }
+        return alarms;
+    }
+
+    private static IReadOnlyList<WireAlarm> ParseLegacyWireAlarms(byte[] payload, short count)
+    {
+        var alarms = new List<WireAlarm>();
+        for (var offset = 0; offset + 80 <= payload.Length && alarms.Count < count; offset += 80)
+        {
+            alarms.Add(new WireAlarm(
+                ReadInt32(payload, offset),
+                (short)ReadInt32(payload, offset + 4),
+                (short)ReadInt32(payload, offset + 8),
+                (short)ReadInt32(payload, offset + 12),
+                FocasWireProtocol.ReadAscii(payload.AsSpan(offset + 16, 64))));
+        }
+        return alarms;
+    }
+
+    private static IReadOnlyList<T> ReadNameRecords<T>(byte[] payload, short maxCount, Func<short, string, T> factory)
+    {
+        var names = new List<T>();
+        for (var offset = 0; offset + 4 <= payload.Length && offset / 4 < maxCount; offset += 4)
+        {
+            var name = FocasWireProtocol.ReadNameRecord(payload.AsSpan(offset, 4));
+            if (!string.IsNullOrWhiteSpace(name))
+                names.Add(factory((short)((offset / 4) + 1), name));
+        }
+        return names;
+    }
+
+    private static void RequireLength(byte[] payload, int length, string call)
+    {
+        if (payload.Length < length)
+            throw new FocasWireException($"{call} returned {payload.Length} bytes; expected at least {length}.", rc: null);
+    }
+
+    private static bool IsTransientException(Exception exception)
+        => exception is IOException or SocketException or TimeoutException or OperationCanceledException
+            || exception.InnerException is IOException or SocketException or TimeoutException or OperationCanceledException;
+
+    private static short ReadInt16(byte[] bytes, int offset)
+        => BinaryPrimitives.ReadInt16BigEndian(bytes.AsSpan(offset, 2));
+
+    private static int ReadInt32(byte[] bytes, int offset)
+        => BinaryPrimitives.ReadInt32BigEndian(bytes.AsSpan(offset, 4));
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/Wire/FocasWireException.cs

@@ -0,0 +1,51 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Wire;
+
+/// <summary>
+///     Thrown by the wire client when a FOCAS request fails — either at the protocol layer
+///     (invalid PDU magic, desynchronised response framing, connection dropped mid-request)
+///     or when the CNC returns a non-zero <c>EW_*</c> return code.
+/// </summary>
+/// <remarks>
+///     <para>Callers distinguish the two classes via <see cref="IsTransient"/>: <c>true</c>
+///     when the transport is gone (socket closed, timeout, cancellation mid-write) and the
+///     wire client has already torn the sockets down, so a reconnect is required before any
+///     further call. <c>false</c> for protocol-level errors where the connection is still
+///     usable.</para>
+///     <para><see cref="Rc"/> carries the wire-level FOCAS return code when the exception
+///     came from a parsed response block. Null when the failure happened before a response
+///     was received (e.g. connect-time handshake errors).</para>
+/// </remarks>
+public class FocasWireException : Exception
+{
+    /// <summary>FOCAS <c>EW_*</c> return code from the response block, when available.</summary>
+    public short? Rc { get; }
+
+    /// <summary>
+    ///     True when the transport was closed as a side effect of this failure — the caller
+    ///     must reconnect before issuing the next request.
+    /// </summary>
+    public bool IsTransient { get; }
+
+    public FocasWireException(string message)
+        : base(message)
+    {
+    }
+
+    public FocasWireException(string message, short? rc, bool isTransient = false)
+        : base(message)
+    {
+        Rc = rc;
+        IsTransient = isTransient;
+    }
+
+    public FocasWireException(string message, Exception innerException)
+        : base(message, innerException)
+    {
+    }
+
+    public FocasWireException(string message, Exception innerException, bool isTransient)
+        : base(message, innerException)
+    {
+        IsTransient = isTransient;
+    }
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/Wire/FocasWireModels.cs

@@ -0,0 +1,131 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Wire;
+
+/// <summary>
+///     Return envelope over a parsed wire response. <see cref="Rc"/> carries the FOCAS
+///     <c>EW_*</c> code from the response block — <c>0</c> / <see cref="IsOk"/> means the
+///     call succeeded and <see cref="Value"/> is populated; non-zero means the CNC rejected
+///     the call and <see cref="Value"/> is <c>default</c>. Callers use the RC to distinguish
+///     "feature missing on this series" (<c>EW_FUNC</c> / <c>EW_NOOPT</c>) from genuine
+///     failures.
+/// </summary>
+public readonly record struct FocasResult<T>(short Rc, T? Value)
+{
+    /// <summary>True when <see cref="Rc"/> is zero (<c>EW_OK</c>).</summary>
+    public bool IsOk => Rc == 0;
+}
+
+/// <summary>CNC identity payload returned by <c>cnc_sysinfo</c>.</summary>
+public sealed record WireSysInfo(
+    short AddInfo,
+    short MaxAxis,
+    string CncType,
+    string MachineType,
+    string Series,
+    string Version,
+    string Axes);
+
+/// <summary>Coarse CNC state bits returned by <c>cnc_statinfo</c> — the seven-word status block plus TM mode.</summary>
+public sealed record WireStatus(
+    short Auto,
+    short Run,
+    short Motion,
+    short Mstb,
+    short Emergency,
+    short Alarm,
+    short Edit,
+    short TmMode);
+
+/// <summary>Four-slot position quadruple for one axis: absolute / machine / relative / distance-to-go.</summary>
+public sealed record WireAxisPosition(
+    int Absolute,
+    int Machine,
+    int Relative,
+    int Distance);
+
+/// <summary>
+///     Fast-poll bundle for one axis from <c>cnc_rddynamic2</c> — alarm flags, active program
+///     numbers, sequence number, actual feed rate, actual spindle speed, and the position
+///     quadruple.
+/// </summary>
+public sealed record WireDynamic(
+    int Alarm,
+    int ProgramNumber,
+    int MainProgramNumber,
+    int SequenceNumber,
+    int FeedRate,
+    int SpindleSpeed,
+    WireAxisPosition Axis);
+
+/// <summary>One servo-meter entry from <c>cnc_rdsvmeter</c> — per-axis load percentage (scale by 10^<see cref="Decimal"/>).</summary>
+public sealed record WireServoMeter(
+    short Index,
+    string Name,
+    int Value,
+    short Decimal,
+    short Unit);
+
+/// <summary>One spindle metric slot from <c>cnc_rdspload</c> / <c>cnc_rdspmaxrpm</c>.</summary>
+public sealed record WireSpindleMetric(
+    short Index,
+    int Value);
+
+/// <summary>
+///     One axis-name slot from <c>cnc_rdaxisname</c>. <see cref="Index"/> is the 1-based
+///     axis index (preserved even when the name is empty so callers can pass it to
+///     <c>cnc_rddynamic2</c>).
+/// </summary>
+public readonly record struct WireAxisRecord(short Index, string Name);
+
+/// <summary>One spindle-name slot from <c>cnc_rdspdlname</c>.</summary>
+public readonly record struct WireSpindleRecord(short Index, string Name);
+
+/// <summary>Parameter value returned by <c>cnc_rdparam</c>, interpreted as a scalar Int32.</summary>
+public sealed record WireParameter(
+    short DataNumber,
+    short Type,
+    int Value);
+
+/// <summary>
+///     Macro variable from <c>cnc_rdmacro</c>. Scaled decimal: the callable value is
+///     <c>Value / 10^Decimal</c>.
+/// </summary>
+public sealed record WireMacro(
+    short Number,
+    int Value,
+    short Decimal);
+
+/// <summary>PMC range read-back from <c>pmc_rdpmcrng</c>: one or more values of the requested width.</summary>
+public sealed record WirePmcRange(
+    short Area,
+    short DataType,
+    ushort Start,
+    ushort End,
+    IReadOnlyList<long> Values);
+
+/// <summary>
+///     One active alarm from <c>cnc_rdalmmsg2</c>. Mirrors the vendor <c>ODBALMMSG2</c>
+///     layout; <see cref="AlarmGroup"/> is populated when the wire responder carries it
+///     (currently <c>null</c> for both the 76-byte vendor shape and the 80-byte legacy
+///     shape).
+/// </summary>
+public sealed record WireAlarm(
+    int AlarmNumber,
+    short Type,
+    short Axis,
+    short MessageLength,
+    string Message,
+    int? AlarmGroup = null);
+
+/// <summary>
+///     Executing-program identity from <c>cnc_exeprgname2</c>: the NUL-terminated name and
+///     the trailing 32-bit O-number (null when the wire responder omits the trailing int).
+/// </summary>
+public sealed record WireProgramName(
+    string Name,
+    int? ONumber);
+
+/// <summary>One cumulative timer reading from <c>cnc_rdtimer</c> (minutes + fractional milliseconds).</summary>
+public sealed record WireTimer(
+    short Type,
+    int Minutes,
+    int Milliseconds);

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/Wire/FocasWireProtocol.cs

@@ -0,0 +1,250 @@
+using System.Buffers.Binary;
+using System.Net.Sockets;
+using System.Text;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Wire;
+
+/// <summary>
+///     Framing primitives for the FOCAS/2 Ethernet wire protocol — magic-prefixed PDU
+///     header + request/response block envelopes. Read-only subset: every call OtOpcUa
+///     issues maps to one of the command IDs documented in
+///     <c>docs/v2/implementation/focas-wire-protocol.md</c>.
+/// </summary>
+/// <remarks>
+///     <para>All multi-byte integer fields are big-endian on the wire. The 10-byte header is
+///     <c>a0 a0 a0 a0</c> magic + 2-byte version + type byte + direction byte + 2-byte body
+///     length. Version 1 is the only version this implementation supports.</para>
+///     <para>Type <c>0x01</c> is the initiate handshake, <c>0x02</c> is the session close,
+///     <c>0x21</c> is a request/response data PDU carrying one or more request blocks.</para>
+/// </remarks>
+internal static class FocasWireProtocol
+{
+    public const ushort Version = 1;
+    public const byte DirectionRequest = 0x01;
+    public const byte DirectionResponse = 0x02;
+    public const byte TypeInitiate = 0x01;
+    public const byte TypeClose = 0x02;
+    public const byte TypeData = 0x21;
+
+    private static readonly byte[] Magic = [0xa0, 0xa0, 0xa0, 0xa0];
+
+    /// <summary>Assemble a full PDU (10-byte header + body) for transmission.</summary>
+    public static byte[] BuildPdu(byte type, byte direction, ReadOnlySpan<byte> body)
+    {
+        if (body.Length > ushort.MaxValue)
+            throw new ArgumentOutOfRangeException(nameof(body), "FOCAS PDU body is limited to 65535 bytes.");
+
+        var bytes = new byte[10 + body.Length];
+        Magic.CopyTo(bytes, 0);
+        BinaryPrimitives.WriteUInt16BigEndian(bytes.AsSpan(4, 2), Version);
+        bytes[6] = type;
+        bytes[7] = direction;
+        BinaryPrimitives.WriteUInt16BigEndian(bytes.AsSpan(8, 2), (ushort)body.Length);
+        body.CopyTo(bytes.AsSpan(10));
+        return bytes;
+    }
+
+    /// <summary>
+    ///     Initiate-body shape — just the 2-byte socket index (1 or 2). <c>cnc_allclibhndl3</c>
+    ///     opens two TCP sockets in sequence and each sends its own initiate PDU carrying its
+    ///     index.
+    /// </summary>
+    public static byte[] BuildInitiateBody(ushort socketIndex)
+    {
+        var body = new byte[2];
+        BinaryPrimitives.WriteUInt16BigEndian(body, socketIndex);
+        return body;
+    }
+
+    /// <summary>Assemble a type-<c>0x21</c> body carrying one or more request blocks.</summary>
+    public static byte[] BuildRequestBody(IReadOnlyList<RequestBlock> blocks)
+    {
+        if (blocks.Count > ushort.MaxValue)
+            throw new ArgumentOutOfRangeException(nameof(blocks), "Too many request blocks.");
+
+        var blockBytes = blocks.Select(BuildRequestBlock).ToArray();
+        var bodyLength = 2 + blockBytes.Sum(block => block.Length);
+        if (bodyLength > ushort.MaxValue)
+            throw new ArgumentOutOfRangeException(nameof(blocks), "FOCAS request body is too large.");
+
+        var body = new byte[bodyLength];
+        BinaryPrimitives.WriteUInt16BigEndian(body.AsSpan(0, 2), (ushort)blocks.Count);
+        var offset = 2;
+        foreach (var block in blockBytes)
+        {
+            block.CopyTo(body.AsSpan(offset));
+            offset += block.Length;
+        }
+        return body;
+    }
+
+    /// <summary>Async read of one full PDU off a stream. Throws <see cref="FocasWireException"/> on invalid magic / version / truncation.</summary>
+    public static async Task<Pdu> ReadPduAsync(NetworkStream stream, CancellationToken cancellationToken)
+    {
+        var header = new byte[10];
+        await ReadExactlyAsync(stream, header, cancellationToken).ConfigureAwait(false);
+
+        if (!header.AsSpan(0, 4).SequenceEqual(Magic))
+            throw new FocasWireException("Invalid FOCAS PDU magic.");
+
+        var version = BinaryPrimitives.ReadUInt16BigEndian(header.AsSpan(4, 2));
+        if (version != Version)
+            throw new FocasWireException($"Unsupported FOCAS PDU version {version}.");
+
+        var bodyLength = BinaryPrimitives.ReadUInt16BigEndian(header.AsSpan(8, 2));
+        var body = new byte[bodyLength];
+        if (bodyLength > 0)
+            await ReadExactlyAsync(stream, body, cancellationToken).ConfigureAwait(false);
+
+        return new Pdu(header[6], header[7], body);
+    }
+
+    /// <summary>Synchronous counterpart to <see cref="ReadPduAsync"/> — used by <see cref="FocasWireClient"/>'s sync dispose.</summary>
+    public static Pdu ReadPdu(NetworkStream stream)
+    {
+        var header = new byte[10];
+        ReadExactly(stream, header);
+
+        if (!header.AsSpan(0, 4).SequenceEqual(Magic))
+            throw new FocasWireException("Invalid FOCAS PDU magic.");
+
+        var version = BinaryPrimitives.ReadUInt16BigEndian(header.AsSpan(4, 2));
+        if (version != Version)
+            throw new FocasWireException($"Unsupported FOCAS PDU version {version}.");
+
+        var bodyLength = BinaryPrimitives.ReadUInt16BigEndian(header.AsSpan(8, 2));
+        var body = new byte[bodyLength];
+        if (bodyLength > 0)
+            ReadExactly(stream, body);
+
+        return new Pdu(header[6], header[7], body);
+    }
+
+    private static async Task ReadExactlyAsync(NetworkStream stream, byte[] buffer, CancellationToken cancellationToken)
+    {
+        var offset = 0;
+        while (offset < buffer.Length)
+        {
+            var read = await stream.ReadAsync(buffer, offset, buffer.Length - offset, cancellationToken).ConfigureAwait(false);
+            if (read == 0)
+                throw new EndOfStreamException("FOCAS socket closed before the expected number of bytes were read.");
+            offset += read;
+        }
+    }
+
+    private static void ReadExactly(NetworkStream stream, byte[] buffer)
+    {
+        var offset = 0;
+        while (offset < buffer.Length)
+        {
+            var read = stream.Read(buffer, offset, buffer.Length - offset);
+            if (read == 0)
+                throw new EndOfStreamException("FOCAS socket closed before the expected number of bytes were read.");
+            offset += read;
+        }
+    }
+
+    /// <summary>
+    ///     Unpack a type-<c>0x21</c> response body into its constituent response blocks. Each
+    ///     block carries the command ID, the FOCAS <c>EW_*</c> return code, and the payload
+    ///     bytes.
+    /// </summary>
+    public static IReadOnlyList<ResponseBlock> ParseResponseBlocks(ReadOnlySpan<byte> body)
+    {
+        if (body.Length < 2)
+            return Array.Empty<ResponseBlock>();
+
+        var count = BinaryPrimitives.ReadUInt16BigEndian(body.Slice(0, 2));
+        var blocks = new List<ResponseBlock>(count);
+        var offset = 2;
+        for (var index = 0; index < count; index++)
+        {
+            if (offset + 2 > body.Length)
+                throw new FocasWireException("Truncated FOCAS response block length.");
+
+            var blockLength = BinaryPrimitives.ReadUInt16BigEndian(body.Slice(offset, 2));
+            if (blockLength < 0x10 || offset + blockLength > body.Length)
+                throw new FocasWireException($"Invalid FOCAS response block length {blockLength}.");
+
+            var block = body.Slice(offset, blockLength);
+            var command = BinaryPrimitives.ReadUInt16BigEndian(block.Slice(6, 2));
+            var payloadLength = BinaryPrimitives.ReadUInt16BigEndian(block.Slice(14, 2));
+            if (0x10 + payloadLength > blockLength)
+                throw new FocasWireException("Invalid FOCAS response payload length.");
+
+            var rc = BinaryPrimitives.ReadInt16BigEndian(block.Slice(8, 2));
+            blocks.Add(new ResponseBlock(command, rc, block.Slice(16, payloadLength).ToArray()));
+            offset += blockLength;
+        }
+
+        return blocks;
+    }
+
+    /// <summary>Read an ASCII string out of a payload span, stopping at the first NUL and trimming trailing spaces.</summary>
+    public static string ReadAscii(ReadOnlySpan<byte> bytes)
+    {
+        var end = bytes.IndexOf((byte)0);
+        if (end >= 0) bytes = bytes.Slice(0, end);
+        return Encoding.ASCII.GetString(bytes.ToArray()).TrimEnd(' ', '\0');
+    }
+
+    /// <summary>
+    ///     Read an axis/spindle name record — the first 2 bytes of a 2-byte (axis) or 4-byte
+    ///     (spindle) slot. Trailing spaces and NULs are stripped so <c>"X "</c> becomes
+    ///     <c>"X"</c>.
+    /// </summary>
+    public static string ReadNameRecord(ReadOnlySpan<byte> bytes)
+    {
+        if (bytes.Length < 2) return string.Empty;
+        var buffer = bytes.Slice(0, Math.Min(2, bytes.Length)).ToArray();
+        return Encoding.ASCII.GetString(buffer).TrimEnd(' ', '\0');
+    }
+
+    private static byte[] BuildRequestBlock(RequestBlock request)
+    {
+        var extra = request.ExtraPayload ?? Array.Empty<byte>();
+        if (extra.Length > ushort.MaxValue)
+            throw new ArgumentOutOfRangeException(nameof(request), "FOCAS request extra payload is too large.");
+
+        var blockLength = 0x1c + extra.Length;
+        if (blockLength > ushort.MaxValue)
+            throw new ArgumentOutOfRangeException(nameof(request), "FOCAS request block is too large.");
+
+        var block = new byte[blockLength];
+        BinaryPrimitives.WriteUInt16BigEndian(block.AsSpan(0, 2), (ushort)blockLength);
+        BinaryPrimitives.WriteUInt16BigEndian(block.AsSpan(2, 2), request.RequestClass);
+        BinaryPrimitives.WriteUInt16BigEndian(block.AsSpan(4, 2), request.PathId);
+        BinaryPrimitives.WriteUInt16BigEndian(block.AsSpan(6, 2), request.Command);
+        BinaryPrimitives.WriteInt32BigEndian(block.AsSpan(8, 4), request.Arg1);
+        BinaryPrimitives.WriteInt32BigEndian(block.AsSpan(12, 4), request.Arg2);
+        BinaryPrimitives.WriteInt32BigEndian(block.AsSpan(16, 4), request.Arg3);
+        BinaryPrimitives.WriteInt32BigEndian(block.AsSpan(20, 4), request.Arg4);
+        BinaryPrimitives.WriteUInt16BigEndian(block.AsSpan(24, 2), request.Arg5);
+        BinaryPrimitives.WriteUInt16BigEndian(block.AsSpan(26, 2), (ushort)extra.Length);
+        extra.CopyTo(block.AsSpan(28));
+        return block;
+    }
+}
+
+/// <summary>One raw PDU off the wire — header bytes plus the body.</summary>
+internal sealed record Pdu(byte Type, byte Direction, byte[] Body);
+
+/// <summary>
+///     One request block within a type-<c>0x21</c> PDU body. <see cref="Command"/> is the
+///     FOCAS command ID (e.g. <c>0x0018</c> for sysinfo); <see cref="Arg1"/>..<see cref="Arg5"/>
+///     are the command-specific scalar arguments; <see cref="ExtraPayload"/> carries the
+///     optional extra bytes for writes.
+/// </summary>
+internal sealed record RequestBlock(
+    ushort Command,
+    int Arg1 = 0,
+    int Arg2 = 0,
+    int Arg3 = 0,
+    int Arg4 = 0,
+    ushort Arg5 = 0,
+    ushort RequestClass = 1,
+    ushort PathId = 1,
+    byte[]? ExtraPayload = null);
+
+/// <summary>One response block — command ID + FOCAS return code + payload bytes.</summary>
+internal sealed record ResponseBlock(ushort Command, short Rc, byte[] Payload);

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/Wire/WireFocasClient.cs

@@ -0,0 +1,333 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Wire;
+
+/// <summary>
+///     <see cref="IFocasClient"/> implementation backed by the in-tree managed
+///     <see cref="FocasWireClient"/>. No P/Invoke, no <c>Fwlib64.dll</c>, no out-of-process
+///     Host — the wire client dials the CNC on TCP:8193 directly and speaks the FOCAS/2
+///     Ethernet binary protocol.
+/// </summary>
+/// <remarks>
+///     OtOpcUa is read-only against FOCAS. <see cref="WriteAsync"/> returns
+///     <see cref="FocasStatusMapper.BadNotWritable"/> for every address — the managed wire
+///     client intentionally does not expose <c>cnc_wrparam</c> / <c>pmc_wrpmcrng</c> /
+///     <c>cnc_wrmacro</c>.
+/// </remarks>
+public sealed class WireFocasClient : IFocasClient
+{
+    private readonly FocasWireClient _wire = new();
+    private FocasHostAddress? _address;
+
+    public bool IsConnected => _wire.IsConnected;
+
+    public async Task ConnectAsync(FocasHostAddress address, TimeSpan timeout, CancellationToken cancellationToken)
+    {
+        if (_wire.IsConnected) return;
+        _address = address;
+        // FocasWireClient.ConnectAsync interprets TimeSpan.Zero as "no timeout" — clamp the
+        // driver's default TimeSpan to at least 1s so a caller passing TimeSpan.Zero gets a
+        // sane fail-fast instead of hanging indefinitely.
+        var effective = timeout <= TimeSpan.Zero ? TimeSpan.FromSeconds(1) : timeout;
+        await _wire.ConnectAsync(address.Host, address.Port, effective, cancellationToken).ConfigureAwait(false);
+    }
+
+    public async Task<(object? value, uint status)> ReadAsync(
+        FocasAddress address, FocasDataType type, CancellationToken cancellationToken)
+    {
+        if (!_wire.IsConnected) return (null, FocasStatusMapper.BadCommunicationError);
+        cancellationToken.ThrowIfCancellationRequested();
+
+        return address.Kind switch
+        {
+            FocasAreaKind.Pmc => await ReadPmcAsync(address, type, cancellationToken).ConfigureAwait(false),
+            FocasAreaKind.Parameter => await ReadParameterAsync(address, type, cancellationToken).ConfigureAwait(false),
+            FocasAreaKind.Macro => await ReadMacroAsync(address, cancellationToken).ConfigureAwait(false),
+            _ => (null, FocasStatusMapper.BadNotSupported),
+        };
+    }
+
+    public Task<uint> WriteAsync(
+        FocasAddress address, FocasDataType type, object? value, CancellationToken cancellationToken)
+        => Task.FromResult(FocasStatusMapper.BadNotWritable);
+
+    public async Task<bool> ProbeAsync(CancellationToken cancellationToken)
+    {
+        if (!_wire.IsConnected) return false;
+        try
+        {
+            var result = await _wire.ReadStatusAsync(cancellationToken).ConfigureAwait(false);
+            return result.IsOk;
+        }
+        catch (FocasWireException)
+        {
+            return false;
+        }
+    }
+
+    public async Task<IReadOnlyList<FocasActiveAlarm>> ReadAlarmsAsync(CancellationToken cancellationToken)
+    {
+        if (!_wire.IsConnected) return [];
+        try
+        {
+            var result = await _wire.ReadAlarmsAsync(FocasAlarmType.All, 32, cancellationToken).ConfigureAwait(false);
+            if (!result.IsOk || result.Value is null) return [];
+            return result.Value.Select(Map).ToList();
+        }
+        catch (FocasWireException)
+        {
+            return [];
+        }
+
+        static FocasActiveAlarm Map(WireAlarm a) => new(
+            AlarmNumber: a.AlarmNumber,
+            Type: a.Type,
+            Axis: a.Axis,
+            Message: a.Message ?? string.Empty);
+    }
+
+    public async Task<FocasSysInfo> GetSysInfoAsync(CancellationToken cancellationToken)
+    {
+        RequireConnected();
+        var result = await _wire.ReadSysInfoAsync(cancellationToken).ConfigureAwait(false);
+        ThrowIfRcNonZero(result.Rc, "cnc_sysinfo", result.IsOk);
+        var info = result.Value!;
+        // Fanuc right-pads the ASCII axis count with spaces; fall back to MaxAxis if the
+        // text field isn't interpretable as an integer.
+        var axesCount = int.TryParse(info.Axes?.Trim(), out var parsed) ? parsed : info.MaxAxis;
+        return new FocasSysInfo(
+            AddInfo: info.AddInfo,
+            MaxAxis: info.MaxAxis,
+            CncType: info.CncType ?? string.Empty,
+            MtType: info.MachineType ?? string.Empty,
+            Series: info.Series ?? string.Empty,
+            Version: info.Version ?? string.Empty,
+            AxesCount: axesCount);
+    }
+
+    public async Task<IReadOnlyList<FocasAxisName>> GetAxisNamesAsync(CancellationToken cancellationToken)
+    {
+        if (!_wire.IsConnected) return [];
+        var result = await _wire.ReadAxisNamesAsync(32, cancellationToken).ConfigureAwait(false);
+        if (!result.IsOk || result.Value is null) return [];
+        return result.Value.Select(SplitAxis).Where(n => n.Name.Length > 0).ToList();
+
+        // FocasWireClient returns axis records as a single Name string (e.g. "X" or "X1").
+        // IFocasClient wants Name + Suffix split — the first char is the axis letter, the
+        // rest is the multi-channel suffix.
+        static FocasAxisName SplitAxis(WireAxisRecord r)
+        {
+            var n = r.Name ?? string.Empty;
+            return n.Length == 0
+                ? new FocasAxisName(string.Empty, string.Empty)
+                : new FocasAxisName(n[..1], n.Length > 1 ? n[1..] : string.Empty);
+        }
+    }
+
+    public async Task<IReadOnlyList<FocasSpindleName>> GetSpindleNamesAsync(CancellationToken cancellationToken)
+    {
+        if (!_wire.IsConnected) return [];
+        var result = await _wire.ReadSpindleNamesAsync(8, cancellationToken).ConfigureAwait(false);
+        if (!result.IsOk || result.Value is null) return [];
+        return result.Value.Select(SplitSpindle).Where(n => n.Name.Length > 0).ToList();
+
+        static FocasSpindleName SplitSpindle(WireSpindleRecord r)
+        {
+            var n = r.Name ?? string.Empty;
+            return new FocasSpindleName(
+                Name: n.Length > 0 ? n[..1] : string.Empty,
+                Suffix1: n.Length > 1 ? n[1..2] : string.Empty,
+                Suffix2: n.Length > 2 ? n[2..3] : string.Empty,
+                Suffix3: n.Length > 3 ? n[3..4] : string.Empty);
+        }
+    }
+
+    public async Task<FocasDynamicSnapshot> ReadDynamicAsync(int axisIndex, CancellationToken cancellationToken)
+    {
+        RequireConnected();
+        var result = await _wire.ReadDynamic2Async((short)axisIndex, cancellationToken).ConfigureAwait(false);
+        ThrowIfRcNonZero(result.Rc, "cnc_rddynamic2", result.IsOk);
+        var d = result.Value!;
+        var pos = d.Axis ?? new WireAxisPosition(0, 0, 0, 0);
+        return new FocasDynamicSnapshot(
+            AxisIndex: axisIndex,
+            AlarmFlags: d.Alarm,
+            ProgramNumber: d.ProgramNumber,
+            MainProgramNumber: d.MainProgramNumber,
+            SequenceNumber: d.SequenceNumber,
+            ActualFeedRate: d.FeedRate,
+            ActualSpindleSpeed: d.SpindleSpeed,
+            AbsolutePosition: pos.Absolute,
+            MachinePosition: pos.Machine,
+            RelativePosition: pos.Relative,
+            DistanceToGo: pos.Distance);
+    }
+
+    public async Task<FocasProgramInfo> GetProgramInfoAsync(CancellationToken cancellationToken)
+    {
+        RequireConnected();
+        var nameResult = await _wire.ReadExecutingProgramNameAsync(cancellationToken).ConfigureAwait(false);
+        var blkResult = await _wire.ReadBlockCountAsync(cancellationToken).ConfigureAwait(false);
+        // Use the raw short variant — FocasProgramInfo.Mode stores the integer code so the
+        // managed ToText path in FocasOpMode can map it for display.
+        var modeResult = await _wire.ReadOperationModeCodeAsync(cancellationToken).ConfigureAwait(false);
+
+        var wireName = nameResult.Value;
+        return new FocasProgramInfo(
+            Name: wireName?.Name ?? string.Empty,
+            ONumber: wireName?.ONumber ?? 0,
+            BlockCount: blkResult.IsOk ? blkResult.Value : 0,
+            Mode: modeResult.IsOk ? modeResult.Value : 0);
+    }
+
+    public async Task<FocasTimer> GetTimerAsync(FocasTimerKind kind, CancellationToken cancellationToken)
+    {
+        RequireConnected();
+        var result = await _wire.ReadTimerAsync((short)kind, cancellationToken).ConfigureAwait(false);
+        ThrowIfRcNonZero(result.Rc, $"cnc_rdtimer kind={kind}", result.IsOk);
+        var t = result.Value!;
+        return new FocasTimer(kind, t.Minutes, t.Milliseconds);
+    }
+
+    public async Task<IReadOnlyList<FocasServoLoad>> GetServoLoadsAsync(CancellationToken cancellationToken)
+    {
+        if (!_wire.IsConnected) return [];
+        var result = await _wire.ReadServoMeterAsync(32, cancellationToken).ConfigureAwait(false);
+        if (!result.IsOk || result.Value is null) return [];
+        return result.Value
+            .Select(m => new FocasServoLoad(m.Name ?? string.Empty, m.Value / Math.Pow(10.0, m.Decimal)))
+            .Where(s => s.AxisName.Length > 0)
+            .ToList();
+    }
+
+    public Task<IReadOnlyList<int>> GetSpindleLoadsAsync(CancellationToken cancellationToken) =>
+        ReadSpindleMetricAsync((sel, ct) => _wire.ReadSpindleLoadAsync(sel, ct), cancellationToken);
+
+    public Task<IReadOnlyList<int>> GetSpindleMaxRpmsAsync(CancellationToken cancellationToken) =>
+        ReadSpindleMetricAsync((sel, ct) => _wire.ReadSpindleMaxRpmAsync(sel, ct), cancellationToken);
+
+    private static async Task<IReadOnlyList<int>> ReadSpindleMetricAsync(
+        Func<short, CancellationToken, Task<FocasResult<IReadOnlyList<WireSpindleMetric>>>> call,
+        CancellationToken cancellationToken)
+    {
+        var result = await call(-1, cancellationToken).ConfigureAwait(false);
+        if (!result.IsOk || result.Value is null) return [];
+        var list = new List<int>();
+        foreach (var m in result.Value)
+        {
+            // Fanuc pads unused spindle slots with 0 — stop at the first trailing zero so the
+            // list length matches the configured spindle count.
+            if (m.Value == 0 && list.Count > 0) break;
+            list.Add(m.Value);
+        }
+        return list;
+    }
+
+    public void Dispose() => _wire.Dispose();
+
+    // ---- PMC / Parameter / Macro read paths ------------------------------------------
+
+    private async Task<(object? value, uint status)> ReadPmcAsync(
+        FocasAddress address, FocasDataType type, CancellationToken cancellationToken)
+    {
+        var area = FocasPmcAreaLookup.FromLetter(address.PmcLetter ?? string.Empty);
+        if (area is null) return (null, FocasStatusMapper.BadNodeIdUnknown);
+        var dataType = FocasPmcDataTypeLookup.FromFocasDataType(type);
+        var start = (ushort)address.Number;
+        var end = start;
+
+        try
+        {
+            var result = await _wire.ReadPmcRangeAsync(area.Value, dataType, start, end, cancellationToken)
+                .ConfigureAwait(false);
+            if (!result.IsOk || result.Value is null)
+                return (null, FocasStatusMapper.MapFocasReturn(result.Rc));
+            var values = result.Value.Values;
+            if (values.Count == 0) return (null, FocasStatusMapper.BadOutOfRange);
+            var raw = values[0];
+            var mapped = type switch
+            {
+                FocasDataType.Bit => (object)(((long)raw >> (address.BitIndex ?? 0) & 1L) != 0),
+                FocasDataType.Byte => (object)(sbyte)(raw & 0xFFL),
+                FocasDataType.Int16 => (object)(short)raw,
+                FocasDataType.Int32 => (object)(int)raw,
+                FocasDataType.Float32 => (object)BitConverter.Int32BitsToSingle((int)raw),
+                FocasDataType.Float64 => (object)BitConverter.Int64BitsToDouble(raw),
+                _ => (object)raw,
+            };
+            return (mapped, FocasStatusMapper.Good);
+        }
+        catch (FocasWireException ex)
+        {
+            return (null, ex.Rc is short rc ? FocasStatusMapper.MapFocasReturn(rc) : FocasStatusMapper.BadCommunicationError);
+        }
+    }
+
+    private async Task<(object? value, uint status)> ReadParameterAsync(
+        FocasAddress address, FocasDataType type, CancellationToken cancellationToken)
+    {
+        try
+        {
+            switch (type)
+            {
+                case FocasDataType.Byte:
+                    var b = await _wire.ReadParameterByteAsync((short)address.Number, 0, cancellationToken).ConfigureAwait(false);
+                    return b.IsOk ? ((object)(sbyte)b.Value, FocasStatusMapper.Good) : (null, FocasStatusMapper.MapFocasReturn(b.Rc));
+                case FocasDataType.Int16:
+                    var s = await _wire.ReadParameterInt16Async((short)address.Number, 0, cancellationToken).ConfigureAwait(false);
+                    return s.IsOk ? ((object)s.Value, FocasStatusMapper.Good) : (null, FocasStatusMapper.MapFocasReturn(s.Rc));
+                case FocasDataType.Float32:
+                    var f = await _wire.ReadParameterFloat32Async((short)address.Number, 0, cancellationToken).ConfigureAwait(false);
+                    return f.IsOk ? ((object)f.Value, FocasStatusMapper.Good) : (null, FocasStatusMapper.MapFocasReturn(f.Rc));
+                case FocasDataType.Float64:
+                    var d = await _wire.ReadParameterFloat64Async((short)address.Number, 0, cancellationToken).ConfigureAwait(false);
+                    return d.IsOk ? ((object)d.Value, FocasStatusMapper.Good) : (null, FocasStatusMapper.MapFocasReturn(d.Rc));
+                case FocasDataType.Bit when address.BitIndex is int bit:
+                    var bi = await _wire.ReadParameterInt32Async((short)address.Number, 0, cancellationToken).ConfigureAwait(false);
+                    if (!bi.IsOk) return (null, FocasStatusMapper.MapFocasReturn(bi.Rc));
+                    return ((object)((bi.Value >> bit & 1) != 0), FocasStatusMapper.Good);
+                default:
+                    var i = await _wire.ReadParameterInt32Async((short)address.Number, 0, cancellationToken).ConfigureAwait(false);
+                    return i.IsOk ? ((object)i.Value, FocasStatusMapper.Good) : (null, FocasStatusMapper.MapFocasReturn(i.Rc));
+            }
+        }
+        catch (FocasWireException ex)
+        {
+            return (null, ex.Rc is short rc ? FocasStatusMapper.MapFocasReturn(rc) : FocasStatusMapper.BadCommunicationError);
+        }
+    }
+
+    private async Task<(object? value, uint status)> ReadMacroAsync(
+        FocasAddress address, CancellationToken cancellationToken)
+    {
+        try
+        {
+            var result = await _wire.ReadMacroAsync((short)address.Number, cancellationToken).ConfigureAwait(false);
+            if (!result.IsOk || result.Value is null)
+                return (null, FocasStatusMapper.MapFocasReturn(result.Rc));
+            var m = result.Value;
+            // Macro value is scaled-decimal: the real value is Value / 10^Decimal.
+            var scaled = m.Value / Math.Pow(10.0, m.Decimal);
+            return ((object)scaled, FocasStatusMapper.Good);
+        }
+        catch (FocasWireException ex)
+        {
+            return (null, ex.Rc is short rc ? FocasStatusMapper.MapFocasReturn(rc) : FocasStatusMapper.BadCommunicationError);
+        }
+    }
+
+    private void RequireConnected()
+    {
+        if (!_wire.IsConnected)
+            throw new InvalidOperationException("FOCAS wire session not connected.");
+    }
+
+    private static void ThrowIfRcNonZero(short rc, string call, bool isOk)
+    {
+        if (!isOk) throw new InvalidOperationException($"{call} failed EW_{rc}.");
+    }
+}
+
+/// <summary>Factory producing <see cref="WireFocasClient"/> instances — one per configured device.</summary>
+public sealed class WireFocasClientFactory : IFocasClientFactory
+{
+    public IFocasClient Create() => new WireFocasClient();
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.csproj

@@ -0,0 +1,29 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <LangVersion>latest</LangVersion>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+        <GenerateDocumentationFile>true</GenerateDocumentationFile>
+        <NoWarn>$(NoWarn);CS1591</NoWarn>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.FOCAS</RootNamespace>
+        <AssemblyName>ZB.MOM.WW.OtOpcUa.Driver.FOCAS</AssemblyName>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Core.Abstractions\ZB.MOM.WW.OtOpcUa.Core.Abstractions.csproj"/>
+        <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Core\ZB.MOM.WW.OtOpcUa.Core.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.0"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests"/>
+        <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Driver.FOCAS.IntegrationTests"/>
+    </ItemGroup>
+
+</Project>

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy/Browse/AlarmRefBuilder.cs

@@ -0,0 +1,51 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browse;
+
+/// <summary>
+///     Populates the five sub-attribute references on <see cref="AlarmConditionInfo"/>
+///     by Galaxy convention. The server-level <c>AlarmConditionService</c> (PR 2.2) uses
+///     these to subscribe to live alarm-state attributes and to route ack writes back to
+///     the alarm tag.
+/// </summary>
+/// <remarks>
+///     Galaxy alarms expose four runtime attributes plus a write-only ack target,
+///     consistently named on every alarm-bearing object:
+///     <list type="bullet">
+///       <item><c>&lt;tag&gt;.&lt;attr&gt;.InAlarm</c></item>
+///       <item><c>&lt;tag&gt;.&lt;attr&gt;.Priority</c></item>
+///       <item><c>&lt;tag&gt;.&lt;attr&gt;.DescAttrName</c></item>
+///       <item><c>&lt;tag&gt;.&lt;attr&gt;.Acked</c></item>
+///       <item><c>&lt;tag&gt;.&lt;attr&gt;.AckMsg</c></item>
+///     </list>
+///     This is the same convention the legacy <c>GalaxyAlarmTracker</c> hard-coded; we
+///     concentrate it here so PR 2.2's service receives complete <c>AlarmConditionInfo</c>
+///     rows during discovery without the server needing to know the convention.
+/// </remarks>
+internal static class AlarmRefBuilder
+{
+    private const string InAlarmSuffix = ".InAlarm";
+    private const string PrioritySuffix = ".Priority";
+    private const string DescAttrNameSuffix = ".DescAttrName";
+    private const string AckedSuffix = ".Acked";
+    private const string AckMsgSuffix = ".AckMsg";
+
+    /// <summary>
+    ///     Build an <see cref="AlarmConditionInfo"/> for an alarm-bearing attribute with all
+    ///     five sub-attribute references populated. <paramref name="fullReference"/> is the
+    ///     attribute's full reference (e.g. <c>"Tank1.Level.HiHi"</c>); the convention prefixes
+    ///     each suffix to it.
+    /// </summary>
+    public static AlarmConditionInfo Build(
+        string fullReference,
+        AlarmSeverity initialSeverity = AlarmSeverity.Medium,
+        string? initialDescription = null) => new(
+            SourceName: fullReference,
+            InitialSeverity: initialSeverity,
+            InitialDescription: initialDescription,
+            InAlarmRef: fullReference + InAlarmSuffix,
+            PriorityRef: fullReference + PrioritySuffix,
+            DescAttrNameRef: fullReference + DescAttrNameSuffix,
+            AckedRef: fullReference + AckedSuffix,
+            AckMsgWriteRef: fullReference + AckMsgSuffix);
+}

src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy/Browse/DataTypeMap.cs

@@ -0,0 +1,23 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browse;
+
+/// <summary>
+///     Maps Galaxy <c>mx_data_type</c> integer codes to <see cref="DriverDataType"/>.
+///     Ported from the legacy <c>GalaxyProxyDriver.MapDataType</c> with the same fallback
+///     to <see cref="DriverDataType.String"/> for unknown codes — keeps wire compatibility
+///     with deployed configs while we tighten this through the parity matrix.
+/// </summary>
+internal static class DataTypeMap
+{
+    public static DriverDataType Map(int mxDataType) => mxDataType switch
+    {
+        0 => DriverDataType.Boolean,
+        1 => DriverDataType.Int32,
+        2 => DriverDataType.Float32,
+        3 => DriverDataType.Float64,
+        4 => DriverDataType.String,
+        5 => DriverDataType.DateTime,
+        _ => DriverDataType.String,
+    };
+}