Merge #610: server-side array writes gated per driver capability (DriverArrayWriteSupport); ArrayWritable on the surgical whitelist + UNS Backing; shape/IndexRange refusal; ValueRank>1 out of scope

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

# Conflicts:
#	docs/drivers/S7.md

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaNodeManager.cs

@@ -1928,7 +1928,7 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
         // synchronously so the SDK never applies it (no optimistic-Good-then-revert round-trip + no needless
         // device dispatch). Runs AFTER the authz gate (so we never leak structure detail to an unauthorised
         // caller) but BEFORE the optimistic dispatch below.
-        var structure = EvaluateEquipmentWriteStructure(value, node);
+        var structure = EvaluateEquipmentWriteRange(indexRange) ?? EvaluateEquipmentWriteStructure(value, node);
         if (structure is not null) return structure;
 
         // Capture the optimistic value + the REAL prior value/status BEFORE the SDK applies the write
@@ -2045,6 +2045,25 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
             return new ServiceResult(StatusCodes.BadTypeMismatch, "null value write rejected");
         }
 
+        // Gitea #610 — an array node (writable only when its driver encodes whole-array writes) takes a whole
+        // 1-D array of its declared length: every array-capable driver refuses a short or long block (Modbus
+        // FC15/FC16, S7's contiguous block), so a wrong shape is rejected here instead of being optimistically
+        // applied, dispatched, refused and reverted. ArrayDimensions [0] / absent means unbounded ⇒ any length.
+        if (node is BaseDataVariableState { ValueRank: ValueRanks.OneDimension } arrayNode)
+        {
+            if (value is not Array { Rank: 1 } array)
+            {
+                return new ServiceResult(StatusCodes.BadTypeMismatch, "a 1-D array node takes a 1-D array value");
+            }
+            var declared = arrayNode.ArrayDimensions is { Count: > 0 } dims ? dims[0] : 0u;
+            if (declared > 0 && array.Length != declared)
+            {
+                return new ServiceResult(
+                    StatusCodes.BadTypeMismatch,
+                    $"array write of {array.Length} element(s) to a {declared}-element array node");
+            }
+        }
+
         // Cheap, confidence-gated built-in-type compatibility check. Only when the node is a value variable
         // with a concretely-resolvable expected built-in type AND the payload's built-in type is also cheaply
         // resolvable do we compare; otherwise proceed and let the SDK's WriteValue coercion be authoritative.
@@ -2072,6 +2091,20 @@ public sealed class OtOpcUaNodeManager : CustomNodeManager2
         return null;
     }
 
+    /// <summary>
+    ///     Gitea #610 — an equipment-tag write must be a WHOLE-value write. A partial (IndexRange) write to an
+    ///     array node is refused: every array-capable driver writes the whole block, so honouring a range would
+    ///     mean a read-modify-write of the device array the server does not hold authoritatively (the node value
+    ///     can be stale or optimistic), and the SDK would apply the range to the node before the device answered.
+    ///     A range on a scalar node is meaningless and refused the same way. Pure + static.
+    /// </summary>
+    /// <param name="indexRange">The write's parsed IndexRange (<see cref="NumericRange.Empty"/> when absent).</param>
+    /// <returns><c>null</c> to proceed; otherwise <c>BadWriteNotSupported</c>.</returns>
+    internal static ServiceResult? EvaluateEquipmentWriteRange(NumericRange indexRange) =>
+        indexRange == NumericRange.Empty
+            ? null
+            : new ServiceResult(StatusCodes.BadWriteNotSupported, "IndexRange writes are not supported; write the whole array");
+
     /// <summary>
     ///     Conservative built-in-type compatibility test for <see cref="EvaluateEquipmentWriteStructure"/>.
     ///     Returns true (compatible — allow through) unless there is a confident mismatch. Exact matches pass;