Auto: s7-f — Optimized DB / S7Plus decision (Track 1+3 docs-only)

Closes #304

docs/drivers/S7-Test-Fixture.md

@@ -88,6 +88,18 @@ real PLC latency is not exercised.
 S7-1200 vs S7-1500 vs S7-300/400 connection semantics (PG vs OP vs S7-Basic)
 not differentiated at test time.
 
+**Optimized DB / S7Plus** is the variant-shaped gap with the biggest field
+impact. snap7 happens to behave like a classic-S7comm-only PLC, so the
+integration suite cannot reproduce the shape that an S7-1500 with default
+"Optimized block access" checked would return (`BadDeviceFailure` on every
+absolute-offset read). The decision is documented at
+[`docs/v2/s7.md` § Optimized DB constraint (S7Plus)](../v2/s7.md#optimized-db-constraint-s7plus)
+and tracked in [`docs/featuregaps.md`](../featuregaps.md) row #1; the
+project ships **Track 1** (operator unchecks Optimized block access in TIA
+Portal) and **Track 3** (bridge via the `OpcUaClient` driver against the
+CPU's onboard OPC UA server). A custom S7Plus implementation is out of
+scope.
+
 ### 5. Data types beyond the scalars
 
 `STRING` with length-prefix quirks, `DTL` / `DATE_AND_TIME`, arrays of
@@ -162,7 +174,36 @@ configured, which is parked as a follow-up.
    runner with the lab rig executes. The classifier branch
    (`S7PreflightClassifier.IsPutGetDisabled`) is unit-tested without a
    network in `S7PreflightTests.Classifier_matches_only_PUT_GET_disabled_error_codes`.
-5. **PR-S7-E1 — live SZL test against a real S7-1500.** snap7 doesn't
+5. **Live-firmware Optimized-block-access toggle (PR-S7-F / [#304](https://github.com/dohertj2/lmxopcua/issues/304)).**
+   snap7 happens to behave like a classic-S7comm CPU, so the integration
+   profile cannot reproduce the failure that a default new TIA Portal V14+
+   project produces (`BadDeviceFailure` on `DB1.DBW0` against an Optimized
+   DB). A manual smoke test on the lab rig, gated behind `--with-real-plc`,
+   would close that loop. Suggested checklist on a real S7-1500 V2.5+:
+   1. Create `DB1` in TIA Portal with three INT members at offsets 0, 2, 4.
+      Leave **Optimized block access checked** (the default).
+   2. Compile + download to the PLC.
+   3. Drive the OtOpcUa S7 driver against `DB1.DBW0` — assert that the read
+      returns `BadDeviceFailure` (the Track-1-not-applied symptom). This is
+      the failure shape the docs warn about.
+   4. Open `DB1`'s properties → **uncheck Optimized block access** →
+      compile → download. Re-run the read; assert it returns the seeded
+      INT value at offset 0. (Track 1 verified end-to-end.)
+   5. **Track 3 verification (separate run on the same rig):** with
+      Optimized access re-enabled on `DB1`, activate the CPU's onboard
+      OPC UA server in TIA Portal, expose `DB1.<MemberName>` through a
+      Server interface, register an `OpcUaClient` driver against
+      `opc.tcp://<plc-ip>:4840`, and assert the symbolic read returns the
+      same seeded value. This proves the bridge path against a real
+      Optimized DB without the operator having to disable Optimized
+      access.
+
+   The test must stay manual: TIA Portal compile + download cannot be
+   automated from CI without a Siemens engineering toolchain license, and
+   download-with-CPU-stop is destructive on a shared lab rig. Document
+   results inline in PR descriptions when the rig is available.
+
+6. **PR-S7-E1 — live SZL test against a real S7-1500.** snap7 doesn't
    implement SZL at all, and S7netplus 0.20 doesn't expose a public
    `ReadSzlAsync`, so the `@System.*` virtual address surface currently
    answers `BadNotSupported` against every backend. The parser