Merge review R2 fixes: Galaxy subscribe-once deadline returns BadTimeout, S7 probe honours backoff, write success clears only write-side Faulted, null array elements rejected, S7_SIM_ALLOW_WRITES opt-in

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

docs/drivers/S7-Test-Fixture.md

@@ -20,6 +20,8 @@ python-snap7 `Server` via `Docker/docker-compose.yml --profile s7_1500`
 on `10.100.0.35:1102` (the shared Docker host; override via `S7_SIM_ENDPOINT`;
 pinned `python:3.12-slim-bookworm` base +
 `python-snap7>=2.0`). Docker is the only supported launch path.
+Tests that WRITE to the endpoint (currently `S7_1500ArrayWriteTests`) additionally require
+`S7_SIM_ALLOW_WRITES=1`, because `S7_SIM_ENDPOINT` can be pointed at a real CPU; they skip without it.
 `Snap7ServerFixture` probes the port at collection init + skips with a
 clear message when unreachable (matches the pymodbus pattern).
 `server.py` (baked into the image under `Docker/`) reads a JSON profile

docs/drivers/S7.md

@@ -252,7 +252,9 @@ is written as ONE contiguous `WriteBytesAsync` of `count x element-bytes` (the i
 decode), and the value must be an array of exactly `arrayLength` elements (else `BadTypeMismatch`, no
 health impact). **Writable `Bool` arrays are refused at init** (`NotSupportedException`): the array
 read is byte-granular, so a matching write would overwrite the 7 neighbouring bits of every byte it
-touches, and a safe bit-packed write needs read-modify-write. Mark Bool arrays `writable: false`.
+touches, and a safe bit-packed write needs read-modify-write. Mark Bool arrays `writable: false`. A `null` array element is rejected (`BadTypeMismatch`, nothing written)
+rather than coerced to 0. An array write larger than one PDU is split by S7.Net into several writes and is
+**not atomic** — a mid-write failure can leave the PLC array partly updated.
 Note the *server* still presents every array node read-only to OPC UA clients ([Uns.md §Array
 tags](../Uns.md#array-tags-1-d), #610 item 1) — the driver path is reachable today through the Client
 CLI / driver-level callers and is proven by the unit suite plus the snap7 fixture test