docs(abcip): #592 native array-element write on Z35162 (_SEQ_EP[31], user-approved, restored)

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

CLAUDE.md

@@ -1087,7 +1087,7 @@ re-emit a concrete default. The defaults differ per driver (final review, 2026-1
   because the driver factory AND the admin-node Test Connect probe both read it. ⚠️ So **the upgrade restart
   alone moves no-key AbCip drivers to Native**; to stay on libplctag, set the node key — NOT a per-driver key
   through the old AdminUI, whose typed form drops unknown keys (#576). Evidence: AbCip reads proven on a real
-  CompactLogix (Z-35162); scalar native writes (DINT/BOOL/REAL) proven on it once (2026-10-09, user-approved one-off, restored) — and native UDT member writes (DINT/BIT/REAL, #611 gate, same day) and a native STRING write (hw5, same day, restored byte-exact); array (element), libplctag member and fragmented writes are `ab_server`-only (no logic-unreferenced array exists on Z-35162 — its `_SEQ_EP` arrays are aliased sequencer step registers). #566: a real Logix drops TCP on a connection idled past its timeout (no 0x0107/0x0203); the faulted session reopens on the next request.
+  CompactLogix (Z-35162); scalar native writes (DINT/BOOL/REAL) proven on it once (2026-10-09, user-approved one-off, restored) — and native UDT member writes (DINT/BIT/REAL, #611 gate, same day) and a native STRING write (hw5, same day, restored byte-exact); and a native array-element write (`EM01_PowerUnit._SEQ_EP[31]`, user-approved, an element no alias targets, restored; neighbours unchanged); libplctag member and fragmented writes are `ab_server`-only. #566: a real Logix drops TCP on a connection idled past its timeout (no 0x0107/0x0203); the faulted session reopens on the next request.
 - **AbLegacy: an absent key resolves to `Libplctag` for every family; `Native` is opt-in** (no node key). On
   a real MicroLogix 1400 (Z-33323, idle, 2026-10-09) native read S/N/F/B/T/C/R/ST/O/I incl. `S:0`, T/C/R
   sub-elements and status bits, and ST byte order, all correct, and wrote N/F8/B-bit (restored). libplctag (the default)

docs/drivers/AbCip.md

@@ -249,13 +249,14 @@ The driver has two interchangeable wire transports, selected by one `DriverConfi
   (DINT `test2`, BOOL `Program:UN01_Press.xxtest`, REAL `Program:ES03_EM03_Zone3._ff_test`: write, read back, restore, all
   Good), and the #611 gate added **native UDT member writes** (DINT, BIT and REAL members of `_EmptyTemperatureSegment`).
   hw5 (2026-10-09) added a **native STRING write** (`Program:ES03_TemperatureControl._StrTmp`, through the driver:
-  write, read back, restored byte-exact). Still ab_server-only: array (element) writes — no logic-unreferenced array
-  exists on Z-35162 (`_SEQ_EP` is aliased into live sequencer step registers) — libplctag member writes, and fragmented
-  writes. #566 is answered (the controller drops TCP; see "A target-closed CIP connection"). Mixed STRING/array/scalar
+  write, read back, restored byte-exact). A user-approved **native array-element write** followed: `Program:EM01_PowerUnit._SEQ_EP[31]`
+  0→4242→0 (the array's only alias targets `[1]`, no routine indexes or block-copies it; all 32 elements snapshotted
+  twice before, after the write and after the restore — only `[31]` changed). Still ab_server-only: whole-array
+  writes (the driver has none), libplctag member writes, and fragmented writes. #566 is answered (the controller drops TCP; see "A target-closed CIP connection"). Mixed STRING/array/scalar
   Multiple Service Packet reads (#582) are proven on the press (one 5-read MSP, values equal to single reads). Results:
   [native-ab-transport-gate-results](../plans/2026-10-07-native-ab-transport-gate-results.md).
 - **libplctag cannot be deleted yet.** Scalar, UDT-member and STRING native writes are proven on a CompactLogix
-  (2026-10-09); what remains is #567 (fragmented wide-struct writes), array element writes on hardware, and AbLegacy
+  (2026-10-09); what remains is #567 (fragmented wide-struct writes), whole-array writes on hardware, and AbLegacy
   native beyond the MicroLogix 1400 evidence.
 - UDT **member writes** (#611) are proven on a real CompactLogix on the **native** transport only (2026-10-09); the
   libplctag member-write path is `ab_server`-only. See [Member writes](#member-writes).

docs/plans/2026-10-07-native-ab-transport-gate-results.md

@@ -784,3 +784,16 @@ whole-array write at the driver layer (array tags are read-only, `DriverArrayWri
 128-byte array (or this 88-byte STRING) is a single Write Tag: `LogixTagClient.WriteAsync` fragments only when the request
 exceeds `MaxRequestBytes` (4000 B on the Large Forward Open this controller grants). A fragmented write needs a value of
 roughly 4 KB.
+
+### Native array-element write — 2026-10-09 (user-approved, Z-35162)
+
+`Program:EM01_PowerUnit._SEQ_EP` (DINT[32]). L5X check: its only alias is `_SEQ_EP01_AutoCycle -> _SEQ_EP[1]`; no routine references `_SEQ_EP` directly (no index, COP or FLL); no cross-program reference. AbCip CLI (native) from master `98c00904`, one element per read, two snapshots 30 s apart before writing. `[1]` = -1 is the idle auto-cycle step.
+
+```
+SNAP1: 0 -1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
+SNAP2: 0 -1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
+WRITE [31]=4242: Write Program:EM01_PowerUnit._SEQ_EP[31]: 0x00000000 (Good)
+AFTER: 0 -1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 4242
+RESTORE [31]=0: Write Program:EM01_PowerUnit._SEQ_EP[31]: 0x00000000 (Good)
+FINAL: 0 -1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
+```