Merge branch 'feat/mqtt-sparkplug-driver'

# Conflicts:
#	src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverTypeNames.cs
#	src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/DriverConfigModal.razor
#	src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/EndpointRouteBuilderExtensions.cs
#	src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Uns/TagEditors/TagConfigEditorMap.cs
#	src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Uns/TagEditors/TagConfigValidator.cs
#	src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/ZB.MOM.WW.OtOpcUa.AdminUI.csproj
#	src/Server/ZB.MOM.WW.OtOpcUa.Host/Drivers/DriverFactoryBootstrap.cs

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Browsing/BrowserSessionService.cs

@@ -1,5 +1,8 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Components.Authorization;
 using Microsoft.Extensions.Logging;
 using ZB.MOM.WW.OtOpcUa.Commons.Browsing;
+using ZB.MOM.WW.OtOpcUa.Security.Auth;
 
 namespace ZB.MOM.WW.OtOpcUa.AdminUI.Browsing;
 
@@ -10,11 +13,19 @@ namespace ZB.MOM.WW.OtOpcUa.AdminUI.Browsing;
 ///     expand/attributes call in a 20-second linked CTS so a stuck driver cannot
 ///     stall the UI indefinitely.
 /// </summary>
+/// <param name="browsers">The bespoke per-driver browsers.</param>
+/// <param name="registry">The open-session registry.</param>
+/// <param name="logger">The logger.</param>
+/// <param name="universalBrowser">The Discover-backed fallback browser.</param>
+/// <param name="authorizationService">Policy evaluator for <see cref="RequestRebirthAsync"/>.</param>
+/// <param name="authenticationStateProvider">Supplies the calling circuit's user.</param>
 public sealed class BrowserSessionService(
     IEnumerable<IDriverBrowser> browsers,
     BrowseSessionRegistry registry,
     ILogger<BrowserSessionService> logger,
-    IUniversalDriverBrowser universalBrowser) : IBrowserSessionService
+    IUniversalDriverBrowser universalBrowser,
+    IAuthorizationService authorizationService,
+    AuthenticationStateProvider authenticationStateProvider) : IBrowserSessionService
 {
     /// <summary>Upper bound on a single root/expand/attributes call.</summary>
     public static readonly TimeSpan PerCallTimeout = TimeSpan.FromSeconds(20);
@@ -75,6 +86,64 @@ public sealed class BrowserSessionService(
     public Task<IReadOnlyList<AttributeInfo>> AttributesAsync(Guid token, string nodeId, CancellationToken ct) =>
         InvokeAsync<IReadOnlyList<AttributeInfo>>(token, ct, (s, c) => s.AttributesAsync(nodeId, c));
 
+    /// <inheritdoc />
+    /// <remarks>
+    ///     <para>
+    ///         <b>The authorization check is the point of routing this through the service at all.</b>
+    ///         Every other member here is read-only; this one causes the browse session to publish onto
+    ///         a live plant broker, so it is gated on the same <c>DriverOperator</c> policy the picker
+    ///         bodies evaluate before rendering their Browse affordance. A render-time check alone is
+    ///         not a control — it decides what a page draws, not what a circuit may invoke — so the
+    ///         check is made here, where the action actually happens, and it fails closed.
+    ///     </para>
+    ///     <para>
+    ///         Deliberately <b>not</b> wrapped in <see cref="PerCallTimeout"/>-style swallowing: unlike
+    ///         a failed expand, a failed or refused rebirth is something the operator must see, so the
+    ///         exception propagates to the caller for display.
+    ///     </para>
+    /// </remarks>
+    public async Task<int> RequestRebirthAsync(Guid token, string scope, CancellationToken ct)
+    {
+        if (!registry.TryGet(token, out var session))
+            throw new BrowseSessionNotFoundException(token);
+
+        if (session is not IRebirthCapableBrowseSession rebirthable)
+        {
+            throw new NotSupportedException(
+                $"Browse session {token} ({session.GetType().Name}) has no re-announce action.");
+        }
+
+        var state = await authenticationStateProvider.GetAuthenticationStateAsync().ConfigureAwait(false);
+        var authorized = await authorizationService
+            .AuthorizeAsync(state.User, resource: null, AdminUiPolicies.DriverOperator)
+            .ConfigureAwait(false);
+
+        if (!authorized.Succeeded)
+        {
+            logger.LogWarning(
+                "Rebirth request REFUSED for scope '{Scope}' on browse session {Token}: caller does not "
+                + "satisfy the {Policy} policy.", scope, token, AdminUiPolicies.DriverOperator);
+            throw new UnauthorizedAccessException(
+                $"Requesting a rebirth requires the {AdminUiPolicies.DriverOperator} policy.");
+        }
+
+        using var cts = CancellationTokenSource.CreateLinkedTokenSource(ct);
+        cts.CancelAfter(PerCallTimeout);
+
+        var published = await rebirthable.RequestRebirthAsync(scope, cts.Token).ConfigureAwait(false);
+
+        logger.LogInformation(
+            "Rebirth requested by {User} for scope '{Scope}' on browse session {Token}: {Published} "
+            + "message(s) published.",
+            state.User.Identity?.Name ?? "(anonymous)", scope, token, published);
+
+        return published;
+    }
+
+    /// <inheritdoc />
+    public bool CanRequestRebirth(Guid token) =>
+        registry.TryGet(token, out var session) && session is IRebirthCapableBrowseSession { RebirthAvailable: true };
+
     /// <inheritdoc />
     public async Task CloseAsync(Guid token)
     {

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Browsing/IBrowserSessionService.cs

@@ -50,6 +50,42 @@ public interface IBrowserSessionService
     /// <returns>The attributes of the node.</returns>
     Task<IReadOnlyList<AttributeInfo>> AttributesAsync(Guid token, string nodeId, CancellationToken ct);
 
+    /// <summary>
+    ///     Asks the remote peer(s) addressed by <paramref name="scope"/> to re-announce themselves, on
+    ///     a session whose driver offers that action (today: MQTT in Sparkplug B mode, where it is a
+    ///     Sparkplug rebirth-request NCMD).
+    /// </summary>
+    /// <param name="token">Registry handle for the open browse session.</param>
+    /// <param name="scope">The driver-specific target — for Sparkplug, a browse node id from the
+    /// session's own tree, or a bare <c>{group}/{edgeNode}</c>.</param>
+    /// <param name="ct">Cancellation token for the operation.</param>
+    /// <returns>The number of request messages published.</returns>
+    /// <remarks>
+    ///     <b>The only browse operation that writes to the device network</b>, and therefore the only
+    ///     one carrying an authorization check: the caller must satisfy the same
+    ///     <c>DriverOperator</c> policy that gates the picker's Browse affordance. Everything else on
+    ///     this facade is read-only.
+    /// </remarks>
+    /// <exception cref="BrowseSessionNotFoundException">The token is unknown (or was reaped).</exception>
+    /// <exception cref="UnauthorizedAccessException">The caller is not a DriverOperator.</exception>
+    /// <exception cref="NotSupportedException">This session's driver has no re-announce action.</exception>
+    Task<int> RequestRebirthAsync(Guid token, string scope, CancellationToken ct);
+
+    /// <summary>
+    ///     True when the open session behind <paramref name="token"/> can actually re-announce — i.e.
+    ///     <see cref="RequestRebirthAsync"/> is worth offering. Cheap (no I/O); never throws; false for
+    ///     an unknown/reaped token.
+    /// </summary>
+    /// <param name="token">Registry handle for the open browse session.</param>
+    /// <returns>True when the picker should draw a Request-rebirth affordance.</returns>
+    /// <remarks>
+    ///     A capability probe, <b>not</b> an authorization check — the DriverOperator gate lives on
+    ///     <see cref="RequestRebirthAsync"/> and fails closed there. The picker gates on both: this
+    ///     decides whether the action exists at all (a plain-MQTT window has none), the policy decides
+    ///     whether this operator may fire it.
+    /// </remarks>
+    bool CanRequestRebirth(Guid token);
+
     /// <summary>Removes the session from the registry and disposes it. No-op for unknown tokens.</summary>
     /// <param name="token">Registry handle for the browse session to close.</param>
     /// <returns>A task that represents the asynchronous operation.</returns>

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/DeviceForms/MqttDeviceForm.razor

@@ -0,0 +1,61 @@
+@* MQTT device form — informational only. An MQTT driver instance holds exactly one broker session,
+   configured on the DRIVER (MqttDriverForm), so there is no per-device connection endpoint to author;
+   devices are pure organisational grouping in the RawPath. The DeviceConfig is round-tripped verbatim,
+   and Test-connect uses the driver's broker settings via the merged config. Same shape as
+   GalaxyDeviceForm.
+
+   The warning below fires only for a pre-form deployment that authored the connection on the device:
+   DriverDeviceConfigMerger merges a SOLE device's keys up over the driver's, so those keys keep
+   winning over what the driver form shows. *@
+@using ZB.MOM.WW.OtOpcUa.AdminUI.Components.Shared.Drivers.DeviceForms
+
+<section class="panel notice rise" style="animation-delay:.04s">
+    <div class="panel-head">Connection</div>
+    <div style="padding:1rem" class="text-muted">
+        MQTT connects to a single broker configured on the <strong>driver</strong> — there is no per-device
+        endpoint to author here. Edit host / port / TLS / credentials on the driver's config. Devices under an
+        MQTT driver exist purely to group tags in the RawPath.
+    </div>
+</section>
+
+@if (_model.LegacyConnectionKeys.Count > 0)
+{
+    <section class="panel rise mt-3" style="animation-delay:.06s;border-color:var(--alert)">
+        <div class="panel-head">Legacy connection keys on this device</div>
+        <div style="padding:1rem">
+            <p class="mb-2 small">
+                This device's config still carries broker connection keys from before the driver form existed:
+                <span class="mono">@string.Join(", ", _model.LegacyConnectionKeys)</span>.
+            </p>
+            <p class="mb-0 small">
+                While this driver has <strong>exactly one</strong> device these keys are merged up and
+                <strong>override</strong> the driver form's values — so the driver form may not show what is
+                actually in effect. They are preserved (nothing is dropped), but the durable fix is to author the
+                connection on the driver and clear these keys: a second device on this driver stops the merge-up
+                entirely and the connection would vanish.
+            </p>
+        </div>
+    </section>
+}
+
+@code {
+    /// <summary>The device's DeviceConfig JSON (round-tripped verbatim — MQTT has no per-device endpoint).</summary>
+    [Parameter] public string DeviceConfigJson { get; set; } = "{}";
+    /// <summary>Fired when the (preserved) DeviceConfig changes — no-op UI, kept for the modal contract.</summary>
+    [Parameter] public EventCallback<string> DeviceConfigJsonChanged { get; set; }
+
+    private MqttDeviceModel _model = MqttDeviceModel.FromJson(null);
+    private string? _lastParsed;
+
+    protected override void OnParametersSet()
+    {
+        if (!string.Equals(_lastParsed, DeviceConfigJson, StringComparison.Ordinal))
+        {
+            _model = MqttDeviceModel.FromJson(DeviceConfigJson);
+            _lastParsed = DeviceConfigJson;
+        }
+    }
+
+    /// <summary>Serialises the (preserved) DeviceConfig JSON.</summary>
+    public string GetConfigJson() => _model.ToJson();
+}

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/DeviceForms/MqttDeviceModel.cs

@@ -0,0 +1,73 @@
+using ZB.MOM.WW.OtOpcUa.AdminUI.Uns.TagEditors;
+
+namespace ZB.MOM.WW.OtOpcUa.AdminUI.Components.Shared.Drivers.DeviceForms;
+
+/// <summary>
+///     Device model for the MQTT / Sparkplug B driver. An MQTT driver instance holds exactly <b>one</b>
+///     broker session, configured on the <b>driver</b> (<c>MqttDriverForm</c>) — so, like Galaxy, there
+///     is no per-device connection endpoint to author and this model round-trips the <c>DeviceConfig</c>
+///     JSON verbatim. Devices under an MQTT driver are pure organisational grouping in the RawPath.
+/// </summary>
+/// <remarks>
+///     <para>
+///     <b>Why the connection is not authored here.</b> <c>DriverDeviceConfigMerger</c> merges a device's
+///     keys up to the top level <i>only when the driver has exactly one device</i>. A broker connection
+///     authored on the device would therefore disappear from the merged blob the moment an operator adds
+///     a second device — a silent, deploy-time-invisible outage. Driver-level authoring is correct for
+///     0, 1 or N devices.
+///     </para>
+///     <para>
+///     <b><see cref="LegacyConnectionKeys"/> exists because that merge-up still happens.</b> A
+///     pre-form deployment (hand-authored or SQL-seeded, as the P1 live gate had to do) may carry
+///     <c>Host</c>/<c>Port</c>/… on a sole device's <c>DeviceConfig</c>, and those keys keep winning over
+///     the driver form's values. They are preserved (never silently dropped) and reported so the device
+///     form can tell the operator why the driver form's host is not the one in effect.
+///     </para>
+/// </remarks>
+public sealed class MqttDeviceModel
+{
+    /// <summary>
+    ///     <c>MqttDriverOptions</c> connection-surface key names that a legacy <c>DeviceConfig</c> may
+    ///     carry and that would merge up over the driver form's values.
+    /// </summary>
+    private static readonly string[] ConnectionKeyNames =
+    [
+        "Host", "Port", "ClientId", "UseTls", "AllowUntrustedServerCertificate",
+        "CaCertificatePath", "Username", "Password", "ProtocolVersion", "CleanSession",
+        "KeepAliveSeconds", "ConnectTimeoutSeconds", "ReconnectMinBackoffSeconds",
+        "ReconnectMaxBackoffSeconds",
+    ];
+
+    private System.Text.Json.Nodes.JsonObject _bag = new();
+
+    /// <summary>
+    ///     The connection keys this <c>DeviceConfig</c> actually carries, in the casing they were
+    ///     authored with — empty for the normal case. Non-empty means a sole-device merge-up will
+    ///     override the driver form for those keys.
+    /// </summary>
+    public IReadOnlyList<string> LegacyConnectionKeys { get; private set; } = [];
+
+    /// <summary>Loads a model from a <c>DeviceConfig</c> JSON string, retaining every original key.</summary>
+    /// <param name="json">The raw <c>DeviceConfig</c> JSON string, or <c>null</c> for a new/empty device.</param>
+    /// <returns>The populated <see cref="MqttDeviceModel"/>.</returns>
+    public static MqttDeviceModel FromJson(string? json)
+    {
+        var bag = TagConfigJson.ParseOrNew(json);
+        return new MqttDeviceModel
+        {
+            _bag = bag,
+            LegacyConnectionKeys = bag
+                .Select(p => p.Key)
+                .Where(k => ConnectionKeyNames.Contains(k, StringComparer.OrdinalIgnoreCase))
+                .ToList(),
+        };
+    }
+
+    /// <summary>Serialises the (preserved) <c>DeviceConfig</c> back to a JSON string.</summary>
+    /// <returns>The serialised <c>DeviceConfig</c> JSON string.</returns>
+    public string ToJson() => TagConfigJson.Serialize(_bag);
+
+    /// <summary>Validation hook; MQTT device rows carry no endpoint, so always valid.</summary>
+    /// <returns><c>null</c> — no per-device endpoint to validate.</returns>
+    public string? Validate() => null;
+}

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/DeviceModal.razor

@@ -65,6 +65,9 @@
                             case DriverTypeNames.Galaxy:
                                 <GalaxyDeviceForm @bind-DeviceConfigJson="_deviceConfigJson" />
                                 break;
+                            case DriverTypeNames.Mqtt:
+                                <MqttDeviceForm @bind-DeviceConfigJson="_deviceConfigJson" />
+                                break;
                             default:
                                 <div class="alert alert-warning">No typed device form for driver type <span class="mono">@_driverType</span>.</div>
                                 break;

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/DriverBrowseTree.razor

@@ -34,6 +34,12 @@
     /// <summary>Fired when the user clicks a leaf (or any node — caller decides what to do with it).</summary>
     [Parameter] public EventCallback<BrowseNode> OnNodeSelected { get; set; }
 
+    /// <summary>The same click as <see cref="OnNodeSelected"/>, plus the node's captured ancestor-folder
+    /// path (root→parent) — which is how a caller learns a node's DEPTH, and therefore what kind of thing
+    /// it is in a driver whose tree levels mean different things (MQTT/Sparkplug: group / edge node /
+    /// device). Both callbacks fire; wiring only the first is the existing behaviour.</summary>
+    [Parameter] public EventCallback<ZB.MOM.WW.OtOpcUa.AdminUI.Browsing.BrowseLeafSelection> OnNodeSelectedWithPath { get; set; }
+
     /// <summary>When true, leaves render a selection checkbox and clicking a leaf toggles it (WP6 "Browse
     /// device…" multi-select) instead of single-selecting. Folders still expand/navigate as usual. Default
     /// false preserves the single-select address-picker behavior.</summary>
@@ -93,10 +99,12 @@
         finally { item.Loading = false; StateHasChanged(); }
     }
 
-    private async Task SelectAsync(TreeItem item)
+    private async Task SelectAsync(TreeItem item, IReadOnlyList<string> ancestorPath)
     {
         _selectedNodeIdLocal = item.Node.NodeId;
         await OnNodeSelected.InvokeAsync(item.Node);
+        await OnNodeSelectedWithPath.InvokeAsync(
+            new ZB.MOM.WW.OtOpcUa.AdminUI.Browsing.BrowseLeafSelection(item.Node, ancestorPath));
     }
 
     private async Task ToggleLeafAsync(TreeItem item, IReadOnlyList<string> ancestorPath)
@@ -133,17 +141,27 @@
             {
                 <span style="width:18px"></span>
             }
+            @* BUTTONS, NOT <a href="#">. This is a Blazor Web App: blazor.web.js installs a
+               document-level click interceptor for enhanced navigation, and it resolves a bare "#"
+               against <base href="/"> rather than the current URL — so clicking a node label
+               navigated the whole AdminUI to "/", tore down the circuit, and destroyed whatever modal
+               the tree was hosted in (losing the browse session AND the tag selection with it).
+               @onclick:preventDefault does not help: it suppresses the BROWSER's default action, not
+               Blazor's own interceptor. A <button> is never a navigation candidate, so the handler is
+               the only thing that runs. Found by the MQTT/Sparkplug P2 live gate — the Request-rebirth
+               scope is chosen by clicking a FOLDER label, which is the first feature that ever
+               required clicking a label rather than the ▶ toggle (a button, which always worked). *@
             @if (isMultiLeaf)
             {
                 <input type="checkbox" class="form-check-input" checked="@IsLeafSelected(item.Node.NodeId)"
                        @onchange="@(() => ToggleLeafAsync(item, ancestorPath))" />
-                <a href="#" @onclick="@(() => ToggleLeafAsync(item, ancestorPath))" @onclick:preventDefault
-                   class="text-decoration-none mono small">@item.Node.DisplayName</a>
+                <button type="button" @onclick="@(() => ToggleLeafAsync(item, ancestorPath))"
+                        class="btn btn-link btn-sm p-0 text-decoration-none mono small text-start">@item.Node.DisplayName</button>
             }
             else
             {
-                <a href="#" @onclick="@(() => SelectAsync(item))" @onclick:preventDefault
-                   class="text-decoration-none mono small">@item.Node.DisplayName</a>
+                <button type="button" @onclick="@(() => SelectAsync(item, ancestorPath))"
+                        class="btn btn-link btn-sm p-0 text-decoration-none mono small text-start">@item.Node.DisplayName</button>
             }
             @if (item.Node.Kind == BrowseNodeKind.Leaf)
             {

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/DriverConfigModal.razor

@@ -60,14 +60,30 @@
                             case DriverTypeNames.Sql:
                                 <SqlDriverForm @bind-DriverConfigJson="_driverConfigJson" @bind-ResilienceConfig="_resilienceConfig" />
                                 break;
+                            case DriverTypeNames.Mqtt:
+                                <MqttDriverForm @bind-DriverConfigJson="_driverConfigJson" @bind-ResilienceConfig="_resilienceConfig" />
+                                break;
                             default:
                                 <div class="alert alert-warning">No typed config form for driver type <span class="mono">@_driverType</span>.</div>
                                 break;
                         }
 
-                        <p class="form-text mt-3 mb-0">
-                            The connection endpoint + Test-connect live on the driver's <strong>device</strong> — open the device modal to author host/port and verify connectivity.
-                        </p>
+                        @* Galaxy + MQTT hold ONE connection per driver instance, so they author it here and
+                           their device forms are informational. Every other driver splits the endpoint onto
+                           the device (the v3 endpoint→DeviceConfig split). *@
+                        @if (_driverType is DriverTypeNames.Galaxy or DriverTypeNames.Mqtt)
+                        {
+                            <p class="form-text mt-3 mb-0">
+                                This driver holds a single connection, authored above. Test-connect lives on its
+                                <strong>device</strong> — open the device modal to verify connectivity.
+                            </p>
+                        }
+                        else
+                        {
+                            <p class="form-text mt-3 mb-0">
+                                The connection endpoint + Test-connect live on the driver's <strong>device</strong> — open the device modal to author host/port and verify connectivity.
+                            </p>
+                        }
 
                         @if (_saveError is not null)
                         {

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/Forms/MqttDriverForm.razor

@@ -0,0 +1,331 @@
+@* Embeddable MQTT / Sparkplug B driver config form body. Hosted by DriverConfigModal.
+
+   UNLIKE Modbus / S7 / OPC UA Client, the connection is authored HERE, not on the device: an MQTT
+   driver instance holds exactly ONE broker session, so MqttDeviceForm is informational (the Galaxy
+   precedent). DriverDeviceConfigMerger only merges a device's keys up when the driver has exactly one
+   device, so a device-authored broker connection would silently vanish the moment a second device
+   exists. All parsing/serialisation goes through the ONE shared MqttJson.Options instance, via the
+   pure MqttDriverFormModel — enums must round-trip by NAME (this repo's systemic driver-enum bug).
+
+   The Sparkplug sub-object (groupId / hostId / actAsPrimaryHost / requestRebirthOnGap /
+   birthObservationWindowSeconds) is authored by the Mode == SparkplugB branch below. It is MERGED over
+   whatever the inbound blob had rather than replacing it, and in Plain mode it is not touched at all —
+   see MqttDriverFormModel.ToJson. Until the P2 live gate this branch was a "not implemented yet"
+   placeholder, which left the group id — the driver's entire subscription filter — unauthorable from
+   the UI after Sparkplug ingest had shipped. *@
+@using ZB.MOM.WW.OtOpcUa.AdminUI.Components.Shared.Drivers
+@using ZB.MOM.WW.OtOpcUa.Driver.Mqtt
+
+@* Broker connection *@
+<section class="panel rise mt-3" style="animation-delay:.06s">
+    <div class="panel-head">Broker connection</div>
+    <div style="padding:1rem">
+        <div class="row g-3">
+            <div class="col-md-5">
+                <label class="form-label" for="mqtt-host">Host</label>
+                <InputText id="mqtt-host" @bind-Value="_form.Host" @bind-Value:after="EmitAsync" class="form-control form-control-sm mono" placeholder="broker.internal" />
+                <div class="form-text">Broker hostname or IP. The connection lives on the driver — MQTT has one broker session per driver.</div>
+            </div>
+            <div class="col-md-3">
+                <label class="form-label" for="mqtt-port">Port</label>
+                <InputNumber id="mqtt-port" @bind-Value="_form.Port" @bind-Value:after="EmitAsync" class="form-control form-control-sm" />
+                <div class="form-text">8883 for TLS, 1883 for plaintext.</div>
+            </div>
+            <div class="col-md-4">
+                <label class="form-label" for="mqtt-client-id">Client ID <span class="badge bg-secondary">leave blank</span></label>
+                <InputText id="mqtt-client-id" @bind-Value="_form.ClientId" @bind-Value:after="EmitAsync" class="form-control form-control-sm mono" placeholder="(auto-generated — recommended)" />
+                <div class="form-text">Blank lets the client generate a unique id per connection. That is the correct setting.</div>
+            </div>
+            @if (!string.IsNullOrWhiteSpace(_form.ClientId))
+            {
+                <div class="col-12">
+                    <div class="alert alert-warning py-2 px-3 mb-0 small" role="alert">
+                        <strong>Fixed client ID set.</strong> @MqttDriverFormModel.ClientIdPairWarning
+                    </div>
+                </div>
+            }
+        </div>
+    </div>
+</section>
+
+@* Transport security *@
+<section class="panel rise mt-3" style="animation-delay:.08s">
+    <div class="panel-head">Transport security</div>
+    <div style="padding:1rem">
+        <div class="row g-3">
+            <div class="col-md-3">
+                <div class="form-check form-switch mt-4">
+                    <InputCheckbox @bind-Value="_form.UseTls" @bind-Value:after="EmitAsync" class="form-check-input" id="mqtt-use-tls" />
+                    <label class="form-check-label" for="mqtt-use-tls">Use TLS</label>
+                </div>
+                <div class="form-text mt-0">Default on. Must match the broker's listener.</div>
+            </div>
+            <div class="col-md-4">
+                <div class="form-check form-switch mt-4">
+                    <InputCheckbox @bind-Value="_form.AllowUntrustedServerCertificate" @bind-Value:after="EmitAsync" class="form-check-input" id="mqtt-allow-untrusted" />
+                    <label class="form-check-label" for="mqtt-allow-untrusted">
+                        Allow untrusted server certificate <span class="badge bg-warning text-dark">Dev / on-prem only</span>
+                    </label>
+                </div>
+                <div class="form-text mt-0">Accepts any self-signed broker cert.</div>
+            </div>
+            <div class="col-md-5">
+                <label class="form-label" for="mqtt-ca-path">CA certificate path (optional)</label>
+                <InputText id="mqtt-ca-path" @bind-Value="_form.CaCertificatePath" @bind-Value:after="EmitAsync" class="form-control form-control-sm mono" placeholder="/etc/ssl/certs/broker-ca.pem" />
+                <div class="form-text">PEM file pinning the broker's chain. Blank uses the OS trust store.</div>
+            </div>
+            @if (_form.UseTls && _form.AllowUntrustedServerCertificate)
+            {
+                <div class="col-12">
+                    <div class="alert alert-warning py-2 px-3 mb-0 small" role="alert">
+                        <strong>Not safe for production.</strong> Accepting an untrusted broker certificate defeats
+                        TLS server authentication — a machine-in-the-middle on the broker connection will succeed.
+                        Pin the broker's chain with a CA certificate path instead.
+                    </div>
+                </div>
+            }
+            @if (!_form.UseTls)
+            {
+                <div class="col-12">
+                    <div class="alert alert-warning py-2 px-3 mb-0 small" role="alert">
+                        <strong>TLS is off.</strong> The broker credentials below are sent in cleartext. Use a
+                        plaintext listener only on a trusted on-prem segment.
+                    </div>
+                </div>
+            }
+        </div>
+    </div>
+</section>
+
+@* Authentication *@
+<section class="panel rise mt-3" style="animation-delay:.10s">
+    <div class="panel-head">Authentication</div>
+    <div style="padding:1rem">
+        <div class="row g-3">
+            <div class="col-md-4">
+                <label class="form-label" for="mqtt-username">Username</label>
+                <InputText id="mqtt-username" @bind-Value="_form.Username" @bind-Value:after="EmitAsync" class="form-control form-control-sm" autocomplete="off" />
+                <div class="form-text">Blank connects without credentials.</div>
+            </div>
+            <div class="col-md-4">
+                <label class="form-label" for="mqtt-password">Password</label>
+                <InputText id="mqtt-password" @bind-Value="_form.Password" @bind-Value:after="EmitAsync" type="password" class="form-control form-control-sm" autocomplete="new-password" />
+                <div class="form-text">Stored in the driver config and carried in the deployment artifact. Never written to a log.</div>
+            </div>
+        </div>
+    </div>
+</section>
+
+@* Session *@
+<section class="panel rise mt-3" style="animation-delay:.12s">
+    <div class="panel-head">Session</div>
+    <div style="padding:1rem">
+        <div class="row g-3">
+            <div class="col-md-3">
+                <label class="form-label" for="mqtt-protocol-version">Protocol version</label>
+                <InputSelect id="mqtt-protocol-version" @bind-Value="_form.ProtocolVersion" @bind-Value:after="EmitAsync" class="form-select form-select-sm">
+                    @foreach (var v in Enum.GetValues<MqttProtocolVersion>())
+                    {
+                        <option value="@v">@v</option>
+                    }
+                </InputSelect>
+                <div class="form-text">Default V500 (MQTT 5.0).</div>
+            </div>
+            <div class="col-md-3">
+                <div class="form-check form-switch mt-4">
+                    <InputCheckbox @bind-Value="_form.CleanSession" @bind-Value:after="EmitAsync" class="form-check-input" id="mqtt-clean-session" />
+                    <label class="form-check-label" for="mqtt-clean-session">Clean session / clean start</label>
+                </div>
+            </div>
+            <div class="col-md-3">
+                <label class="form-label" for="mqtt-keepalive">Keep-alive (seconds)</label>
+                <InputNumber id="mqtt-keepalive" @bind-Value="_form.KeepAliveSeconds" @bind-Value:after="EmitAsync" class="form-control form-control-sm" />
+                <div class="form-text">Default 30 s.</div>
+            </div>
+            <div class="col-md-3">
+                <label class="form-label" for="mqtt-connect-timeout">Connect timeout (seconds)</label>
+                <InputNumber id="mqtt-connect-timeout" @bind-Value="_form.ConnectTimeoutSeconds" @bind-Value:after="EmitAsync" class="form-control form-control-sm" />
+                <div class="form-text">Default 15 s. Must be at least 1 — also bounds Test connect.</div>
+            </div>
+            <div class="col-md-3">
+                <label class="form-label" for="mqtt-backoff-min">Reconnect min backoff (seconds)</label>
+                <InputNumber id="mqtt-backoff-min" @bind-Value="_form.ReconnectMinBackoffSeconds" @bind-Value:after="EmitAsync" class="form-control form-control-sm" />
+                <div class="form-text">Default 1 s.</div>
+            </div>
+            <div class="col-md-3">
+                <label class="form-label" for="mqtt-backoff-max">Reconnect max backoff (seconds)</label>
+                <InputNumber id="mqtt-backoff-max" @bind-Value="_form.ReconnectMaxBackoffSeconds" @bind-Value:after="EmitAsync" class="form-control form-control-sm" />
+                <div class="form-text">Default 30 s. Caps the exponential backoff.</div>
+            </div>
+        </div>
+    </div>
+</section>
+
+@* Ingest *@
+<section class="panel rise mt-3" style="animation-delay:.14s">
+    <div class="panel-head">Ingest</div>
+    <div style="padding:1rem">
+        <div class="row g-3">
+            <div class="col-md-3">
+                <label class="form-label" for="mqtt-mode">Mode</label>
+                <InputSelect id="mqtt-mode" @bind-Value="_form.Mode" @bind-Value:after="EmitAsync" class="form-select form-select-sm">
+                    @foreach (var v in Enum.GetValues<MqttMode>())
+                    {
+                        <option value="@v">@v</option>
+                    }
+                </InputSelect>
+                <div class="form-text">Plain = topic-bound tags. Sparkplug B = birth-described metrics under one group.</div>
+            </div>
+            <div class="col-md-3">
+                <label class="form-label" for="mqtt-max-payload">Max payload bytes</label>
+                <InputNumber id="mqtt-max-payload" @bind-Value="_form.MaxPayloadBytes" @bind-Value:after="EmitAsync" class="form-control form-control-sm" />
+                <div class="form-text">Default 1048576 (1 MiB). A larger message is refused before decode.</div>
+            </div>
+
+            @if (_form.Mode == MqttMode.Plain)
+            {
+                <div class="col-md-3">
+                    <label class="form-label" for="mqtt-topic-prefix">Topic prefix (optional)</label>
+                    <InputText id="mqtt-topic-prefix" @bind-Value="_form.TopicPrefix" @bind-Value:after="EmitAsync" class="form-control form-control-sm mono" placeholder="otopcua/fixture/" />
+                    <div class="form-text">Scopes browse/discovery. Per-tag topics are authored explicitly and unaffected.</div>
+                </div>
+                <div class="col-md-3">
+                    <label class="form-label" for="mqtt-default-qos">Default QoS</label>
+                    @* A plain select, not InputSelect: InputSelect<T> natively parses string + enum only,
+                       and QoS is an int. Same control shape MqttTagConfigEditor uses for per-tag QoS. *@
+                    <select id="mqtt-default-qos" class="form-select form-select-sm" value="@_form.DefaultQos"
+                            @onchange="@(e => OnDefaultQosChangedAsync(e.Value))">
+                        <option value="0" selected="@(_form.DefaultQos == 0)">0 — at most once</option>
+                        <option value="1" selected="@(_form.DefaultQos == 1)">1 — at least once</option>
+                        <option value="2" selected="@(_form.DefaultQos == 2)">2 — exactly once</option>
+                    </select>
+                    <div class="form-text">Applied when a tag's own QoS is unset.</div>
+                </div>
+            }
+            else
+            {
+                @* Sparkplug B. The group id is the ONE mandatory field: it is the driver's entire
+                   subscription filter (spBv1.0/{GroupId}/#), so a blank one leaves the driver connected,
+                   Healthy, and ingesting nothing. Validate() surfaces that inline; like every other knob
+                   on this form it is ADVISORY — DriverConfigModal saves regardless — which is why the
+                   model clamps on serialize instead of relying on the operator reading the notice. *@
+                <div class="col-md-3">
+                    <label class="form-label" for="mqtt-spb-group">Group ID</label>
+                    <InputText id="mqtt-spb-group" @bind-Value="_form.SparkplugGroupId" @bind-Value:after="EmitAsync" class="form-control form-control-sm mono" placeholder="Plant1" />
+                    <div class="form-text">
+                        Subscribes <code class="mono">spBv1.0/@(string.IsNullOrWhiteSpace(_form.SparkplugGroupId) ? "{GroupId}" : _form.SparkplugGroupId)/#</code>.
+                        No <code>/</code>, <code>+</code>, or <code>#</code>.
+                    </div>
+                </div>
+                <div class="col-md-3">
+                    <label class="form-label" for="mqtt-spb-window">Birth observation window (seconds)</label>
+                    <InputNumber id="mqtt-spb-window" @bind-Value="_form.SparkplugBirthObservationWindowSeconds" @bind-Value:after="EmitAsync" class="form-control form-control-sm" />
+                    <div class="form-text">Default 15 s. How long browse/discovery collects births before calling the metric set stable.</div>
+                </div>
+                <div class="col-md-3">
+                    <label class="form-label" for="mqtt-spb-host">Host ID (optional)</label>
+                    <InputText id="mqtt-spb-host" @bind-Value="_form.SparkplugHostId" @bind-Value:after="EmitAsync" class="form-control form-control-sm mono" placeholder="scada-primary" />
+                    <div class="form-text">Sparkplug Host Application identity. Receive-only in this version.</div>
+                </div>
+                <div class="col-md-3 d-flex flex-column justify-content-center">
+                    <div class="form-check form-switch">
+                        <InputCheckbox id="mqtt-spb-rebirth" @bind-Value="_form.SparkplugRequestRebirthOnGap" @bind-Value:after="EmitAsync" class="form-check-input" />
+                        <label class="form-check-label" for="mqtt-spb-rebirth">Request rebirth on sequence gap</label>
+                    </div>
+                    <div class="form-text mb-2">A detected seq gap asks the edge node to re-announce (NCMD), rather than running on stale metric state.</div>
+                    <div class="form-check form-switch">
+                        <InputCheckbox id="mqtt-spb-primary" @bind-Value="_form.SparkplugActAsPrimaryHost" @bind-Value:after="EmitAsync" class="form-check-input" />
+                        <label class="form-check-label" for="mqtt-spb-primary">
+                            Act as Primary Host
+                            <span class="badge text-bg-warning">not implemented</span>
+                        </label>
+                    </div>
+                </div>
+
+                @if (_form.SparkplugActAsPrimaryHost)
+                {
+                    @* Shown rather than the flag being hidden: an operator who needs a primary host must
+                       learn it is absent HERE, not from a plant that never sees a STATE message. The
+                       driver logs the same warning at startup so the two cannot drift. *@
+                    <div class="col-12">
+                        <div class="alert alert-warning py-2 px-3 mb-0 small" role="alert">
+                            <strong>Primary-host STATE publishing is not implemented.</strong> This driver is
+                            receive-only: it will not publish <code class="mono">spBv1.0/STATE/@(string.IsNullOrWhiteSpace(_form.SparkplugHostId) ? "{HostId}" : _form.SparkplugHostId)</code>,
+                            so edge nodes will not treat it as their primary host. The driver logs a warning at
+                            startup rather than being silently inert. Leave this off unless you are staging
+                            configuration ahead of that feature.
+                        </div>
+                    </div>
+                }
+
+                <div class="col-12">
+                    <div class="alert alert-info py-2 px-3 mb-0 small" role="alert">
+                        Sparkplug tags bind by the <code class="mono">group / edge node / device / metric</code>
+                        tuple, not by topic — author them with <strong>Browse device…</strong> on a device under
+                        this driver, which builds its tree from observed birth certificates.
+                        <strong>MQTT tags are read-only</strong> (write-through is not implemented).
+                    </div>
+                </div>
+            }
+        </div>
+    </div>
+</section>
+
+@if (_validationError is not null)
+{
+    <div class="panel notice mt-3" style="border-color:var(--alert)">@_validationError</div>
+}
+
+<DriverResilienceSection ResilienceConfig="@ResilienceConfig" ResilienceConfigChanged="OnResilienceChanged" />
+
+@code {
+    /// <summary>The driver-level DriverConfig JSON (broker connection + ingest mode).</summary>
+    [Parameter] public string DriverConfigJson { get; set; } = "{}";
+    /// <summary>Fired whenever a field changes — enables @bind-DriverConfigJson.</summary>
+    [Parameter] public EventCallback<string> DriverConfigJsonChanged { get; set; }
+    /// <summary>The per-instance resilience-pipeline overrides JSON, or null.</summary>
+    [Parameter] public string? ResilienceConfig { get; set; }
+    /// <summary>Fired when the resilience overrides change.</summary>
+    [Parameter] public EventCallback<string?> ResilienceConfigChanged { get; set; }
+
+    private MqttDriverFormModel _form = MqttDriverFormModel.FromJson(null);
+    private string? _lastParsed;
+    private string? _validationError;
+
+    protected override void OnParametersSet()
+    {
+        // Re-parse only when the inbound value actually changed, so an unrelated parent re-render
+        // cannot clobber an in-progress edit.
+        if (!string.Equals(_lastParsed, DriverConfigJson, StringComparison.Ordinal))
+        {
+            _form = MqttDriverFormModel.FromJson(DriverConfigJson);
+            _validationError = _form.Validate();
+            _lastParsed = DriverConfigJson;
+        }
+    }
+
+    /// <summary>Serialises the current config to DriverConfig JSON (PascalCase keys, enums as names).</summary>
+    public string GetConfigJson() => _form.ToJson();
+
+    // TryParse so a bad/empty change value can never throw into the Blazor circuit — it falls back to
+    // the driver's own default QoS rather than poisoning the config.
+    private Task OnDefaultQosChangedAsync(object? value)
+    {
+        _form.DefaultQos = int.TryParse(value?.ToString(), out var qos) ? qos : 1;
+        return EmitAsync();
+    }
+
+    private async Task EmitAsync()
+    {
+        _validationError = _form.Validate();
+        var json = GetConfigJson();
+        _lastParsed = json;
+        await DriverConfigJsonChanged.InvokeAsync(json);
+    }
+
+    private async Task OnResilienceChanged(string? r)
+    {
+        ResilienceConfig = r;
+        await ResilienceConfigChanged.InvokeAsync(r);
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/Forms/MqttDriverFormModel.cs

@@ -0,0 +1,430 @@
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using ZB.MOM.WW.OtOpcUa.AdminUI.Uns.TagEditors;
+using ZB.MOM.WW.OtOpcUa.Driver.Mqtt;
+
+namespace ZB.MOM.WW.OtOpcUa.AdminUI.Components.Shared.Drivers.Forms;
+
+/// <summary>
+///     Typed working model behind <c>MqttDriverForm</c> — the MQTT driver's whole broker-connection and
+///     ingest surface, as authored in the <c>/raw</c> driver-config modal. Kept as a plain class (not
+///     nested in the razor) so every rule here is unit-testable; the razor is a thin shell over it.
+/// </summary>
+/// <remarks>
+///     <para>
+///     <b>The connection lives on the DRIVER, not the device.</b> MQTT holds exactly one broker session
+///     per driver instance, so <c>MqttDeviceForm</c> is informational (the Galaxy precedent) and this
+///     form owns host/port/TLS/credentials. Authoring them on the device would work only while the
+///     driver has exactly ONE device — <c>DriverDeviceConfigMerger</c> merges a sole device's keys up to
+///     the top level and stops doing so the moment a second device exists, at which point the broker
+///     connection would silently vanish from the merged blob.
+///     </para>
+///     <para>
+///     <b>One JSON instance, always <see cref="MqttJson.Options"/>.</b> Every MQTT config seam — the
+///     runtime factory, the Test-connect probe, the driver's re-parse, the address-picker browser and
+///     now this form — parses and serialises through that single shared instance. Divergent per-seam
+///     options are this repo's documented systemic driver-enum bug: a form that wrote
+///     <c>"mode": 1</c> would be accepted by a seam carrying a <c>JsonStringEnumConverter</c> and fault
+///     the one that does not, so "Test connect" goes green and the deployed driver dies. Consequently
+///     the emitted keys are <b>PascalCase</b> (the shared instance carries no camelCase naming policy)
+///     and enum values are <b>names</b>.
+///     </para>
+///     <para>
+///     <b>Preserving what this form does not author.</b> The inbound blob's keys are retained in a bag
+///     and the typed fields are written over it, so (a) the <c>Sparkplug</c> sub-object — P2, Task 21+ —
+///     survives a load→save untouched, and (b) any key a newer driver adds is not silently dropped by an
+///     older AdminUI. <c>RawTags</c> is the one key deliberately REMOVED: the deploy artifact injects it
+///     via <c>DriverDeviceConfigMerger</c>, and a form-authored copy would be dead weight.
+///     </para>
+/// </remarks>
+public sealed class MqttDriverFormModel
+{
+    /// <summary>
+    ///     The <see cref="MqttDriverOptions"/> property name the deploy artifact owns; never authored
+    ///     here and stripped from the emitted blob.
+    /// </summary>
+    private const string RawTagsKey = nameof(MqttDriverOptions.RawTags);
+
+    /// <summary>
+    ///     The <see cref="MqttDriverOptions"/> property name for the Sparkplug sub-object. Authored here
+    ///     in <see cref="MqttMode.SparkplugB"/> mode and otherwise preserved verbatim from the inbound
+    ///     blob — see <see cref="ToJson"/> for why the mode decides which of the two happens.
+    /// </summary>
+    private const string SparkplugKey = nameof(MqttDriverOptions.Sparkplug);
+
+    /// <summary>
+    ///     Characters that cannot appear in a Sparkplug group id. It is a literal MQTT topic segment
+    ///     inside the driver's one subscription filter <c>spBv1.0/{GroupId}/#</c>, so a <c>/</c> would
+    ///     silently widen the filter and a <c>+</c>/<c>#</c> is not even legal mid-segment. Mirrors
+    ///     <c>MqttTagConfigModel</c>'s identical rule on the tag side, so the driver and the tags bound
+    ///     to it cannot disagree about what a group id may be.
+    /// </summary>
+    private static readonly char[] SparkplugGroupIdIllegalChars = ['/', '+', '#'];
+
+    // --- Broker connection ----------------------------------------------------------------------
+
+    /// <summary>Broker hostname or IP address.</summary>
+    public string Host { get; set; } = "localhost";
+
+    /// <summary>Broker TCP port (8883 TLS / 1883 plaintext by convention).</summary>
+    public int Port { get; set; } = 8883;
+
+    /// <summary>
+    ///     MQTT client identifier sent at CONNECT. <b>Blank is the correct default</b> — see
+    ///     <see cref="ClientIdPairWarning"/>.
+    /// </summary>
+    public string ClientId { get; set; } = "";
+
+    // --- Transport security ---------------------------------------------------------------------
+
+    /// <summary>Connect over TLS. Defaults <c>true</c>; this driver ships no plaintext-by-default posture.</summary>
+    public bool UseTls { get; set; } = true;
+
+    /// <summary>Accept any self-signed / untrusted broker certificate. Dev / on-prem escape hatch only.</summary>
+    public bool AllowUntrustedServerCertificate { get; set; }
+
+    /// <summary>PEM CA file pinning the broker's TLS chain; blank uses the OS trust store.</summary>
+    public string CaCertificatePath { get; set; } = "";
+
+    // --- Authentication -------------------------------------------------------------------------
+
+    /// <summary>Username for broker authentication; blank connects without one.</summary>
+    public string Username { get; set; } = "";
+
+    /// <summary>
+    ///     Password for broker authentication. Stored in the driver's config blob and carried in the
+    ///     deployment artifact — the same plaintext-round-trip posture the OPC UA Client driver form
+    ///     uses. Never logged: <see cref="MqttDriverOptions"/> redacts it in its own member printer.
+    /// </summary>
+    public string Password { get; set; } = "";
+
+    // --- Session --------------------------------------------------------------------------------
+
+    /// <summary>MQTT protocol version negotiated at CONNECT.</summary>
+    public MqttProtocolVersion ProtocolVersion { get; set; } = MqttProtocolVersion.V500;
+
+    /// <summary>Request a clean session (v3.1.1) / clean start (v5.0) at CONNECT.</summary>
+    public bool CleanSession { get; set; } = true;
+
+    /// <summary>Keep-alive interval, in seconds, sent at CONNECT.</summary>
+    public int KeepAliveSeconds { get; set; } = 30;
+
+    /// <summary>Bounded connect deadline, in seconds — the driver never hangs past this.</summary>
+    public int ConnectTimeoutSeconds { get; set; } = 15;
+
+    /// <summary>Initial reconnect backoff, in seconds, after a connection drop.</summary>
+    public int ReconnectMinBackoffSeconds { get; set; } = 1;
+
+    /// <summary>Cap on the exponential reconnect backoff, in seconds.</summary>
+    public int ReconnectMaxBackoffSeconds { get; set; } = 30;
+
+    // --- Ingest ---------------------------------------------------------------------------------
+
+    /// <summary>Selects the ingest shape — Plain topics or Sparkplug B (the latter is P2).</summary>
+    public MqttMode Mode { get; set; } = MqttMode.Plain;
+
+    /// <summary>Ceiling on an inbound message body, in bytes; a larger message is refused before decode.</summary>
+    public int MaxPayloadBytes { get; set; } = 1024 * 1024;
+
+    /// <summary>Plain mode: optional prefix used when the driver composes a topic (e.g. browse scoping).</summary>
+    public string TopicPrefix { get; set; } = "";
+
+    /// <summary>Plain mode: default subscription QoS applied when a tag's own <c>qos</c> is unset.</summary>
+    public int DefaultQos { get; set; } = 1;
+
+    // --- Sparkplug B ----------------------------------------------------------------------------
+
+    /// <summary>
+    ///     Sparkplug mode: the group id. <b>Required</b> — it is the driver's entire subscription scope
+    ///     (<c>spBv1.0/{GroupId}/#</c>), so a blank one subscribes to nothing and the driver ingests
+    ///     nothing while still reporting a healthy broker connection.
+    /// </summary>
+    public string SparkplugGroupId { get; set; } = "";
+
+    /// <summary>
+    ///     Sparkplug mode: the Host Application identity. Optional, and <b>receive-only</b> in this
+    ///     version — see <see cref="SparkplugActAsPrimaryHost"/>.
+    /// </summary>
+    public string SparkplugHostId { get; set; } = "";
+
+    /// <summary>
+    ///     Sparkplug mode: claim the Primary Host Application role. <b>Not implemented</b> — STATE
+    ///     publishing is out of scope, and the driver logs a warning rather than being silently inert
+    ///     when this is set. Surfaced (rather than hidden) so an operator who needs it learns that from
+    ///     the form instead of from a quiet plant.
+    /// </summary>
+    public bool SparkplugActAsPrimaryHost { get; set; }
+
+    /// <summary>Sparkplug mode: answer a detected sequence-number gap with a rebirth request (NCMD).</summary>
+    public bool SparkplugRequestRebirthOnGap { get; set; } = true;
+
+    /// <summary>Sparkplug mode: how long browse/discovery collects births before calling the set stable.</summary>
+    public int SparkplugBirthObservationWindowSeconds { get; set; } = 15;
+
+    /// <summary>
+    ///     The inbound blob's keys, retained so any key a newer driver adds survives a load→save.
+    /// </summary>
+    private JsonObject _bag = new();
+
+    /// <summary>
+    ///     The operator-facing consequence of pinning <see cref="ClientId"/>, surfaced by the form
+    ///     whenever it is non-blank. Observed live during the P1 gate: MQTT requires client ids to be
+    ///     unique per broker, and both nodes of a redundant pair run the driver — so a fixed id makes
+    ///     them evict each other in a few-second reconnect loop <i>while both still report Healthy</i>.
+    /// </summary>
+    public const string ClientIdPairWarning =
+        "Both nodes of a redundant pair run this driver. MQTT client ids must be unique per broker, so a "
+        + "fixed client id makes the two nodes evict each other forever — they reconnect every few seconds "
+        + "while both still report Healthy. Leave this blank unless exactly one node will ever connect.";
+
+    /// <summary>
+    ///     Loads a model from a <c>DriverConfig</c> JSON string. Typed values are bound through
+    ///     <see cref="MqttJson.Options"/> (the same instance the runtime factory uses, so what this form
+    ///     shows is what the driver would see); the raw key bag is retained alongside for preservation.
+    ///     Never throws — a blank/malformed blob degrades to the driver's own defaults.
+    /// </summary>
+    /// <param name="json">The raw <c>DriverConfig</c> JSON string, or <c>null</c> for a new driver.</param>
+    /// <returns>The populated <see cref="MqttDriverFormModel"/>.</returns>
+    public static MqttDriverFormModel FromJson(string? json)
+    {
+        var bag = TagConfigJson.ParseOrNew(json);
+        var o = TryDeserialize(json) ?? new MqttDriverOptions();
+
+        return new MqttDriverFormModel
+        {
+            Host = o.Host,
+            Port = o.Port,
+            ClientId = o.ClientId ?? "",
+            UseTls = o.UseTls,
+            AllowUntrustedServerCertificate = o.AllowUntrustedServerCertificate,
+            CaCertificatePath = o.CaCertificatePath ?? "",
+            Username = o.Username ?? "",
+            Password = o.Password ?? "",
+            ProtocolVersion = o.ProtocolVersion,
+            CleanSession = o.CleanSession,
+            KeepAliveSeconds = o.KeepAliveSeconds,
+            ConnectTimeoutSeconds = o.ConnectTimeoutSeconds,
+            ReconnectMinBackoffSeconds = o.ReconnectMinBackoffSeconds,
+            ReconnectMaxBackoffSeconds = o.ReconnectMaxBackoffSeconds,
+            Mode = o.Mode,
+            MaxPayloadBytes = o.MaxPayloadBytes,
+            TopicPrefix = o.Plain?.TopicPrefix ?? "",
+            DefaultQos = o.Plain?.DefaultQos ?? new MqttPlainOptions().DefaultQos,
+            SparkplugGroupId = o.Sparkplug?.GroupId ?? "",
+            SparkplugHostId = o.Sparkplug?.HostId ?? "",
+            SparkplugActAsPrimaryHost = o.Sparkplug?.ActAsPrimaryHost ?? false,
+            // Defaulted from the record, not from a literal, so the form shows the driver's own default
+            // for a blob that has no Sparkplug sub-object at all.
+            SparkplugRequestRebirthOnGap =
+                o.Sparkplug?.RequestRebirthOnGap ?? new MqttSparkplugOptions().RequestRebirthOnGap,
+            SparkplugBirthObservationWindowSeconds =
+                o.Sparkplug?.BirthObservationWindowSeconds
+                ?? new MqttSparkplugOptions().BirthObservationWindowSeconds,
+            _bag = bag,
+        };
+    }
+
+    /// <summary>
+    ///     Builds the typed options this form authors. Every numeric knob is <b>clamped</b> into the
+    ///     range <see cref="MqttDriverOptions"/> declares, so an operator who ignores
+    ///     <see cref="Validate"/> and saves anyway still cannot persist a driver-bricking blob — a
+    ///     <c>connectTimeoutSeconds: 0</c> is exactly the operator-authorable brick this repo has hit
+    ///     before. <see cref="MqttDriverOptions.RawTags"/> stays empty (the deploy artifact owns it) and
+    ///     <see cref="MqttDriverOptions.Sparkplug"/> is emitted only in
+    ///     <see cref="MqttMode.SparkplugB"/> mode; both are finished by <see cref="ToJson"/>.
+    /// </summary>
+    /// <returns>The clamped, driver-legal options record.</returns>
+    public MqttDriverOptions ToOptions() => new()
+    {
+        Host = Host.Trim(),
+        Port = Math.Clamp(Port, 1, 65535),
+        ClientId = Blank(ClientId),
+        UseTls = UseTls,
+        AllowUntrustedServerCertificate = AllowUntrustedServerCertificate,
+        CaCertificatePath = Blank(CaCertificatePath),
+        Username = Blank(Username),
+        Password = Password,
+        ProtocolVersion = ProtocolVersion,
+        CleanSession = CleanSession,
+        KeepAliveSeconds = Math.Max(1, KeepAliveSeconds),
+        ConnectTimeoutSeconds = Math.Max(1, ConnectTimeoutSeconds),
+        ReconnectMinBackoffSeconds = Math.Max(1, ReconnectMinBackoffSeconds),
+        ReconnectMaxBackoffSeconds = Math.Max(1, ReconnectMaxBackoffSeconds),
+        Mode = Mode,
+        MaxPayloadBytes = Math.Max(1, MaxPayloadBytes),
+        Plain = new MqttPlainOptions
+        {
+            TopicPrefix = TopicPrefix.Trim(),
+            DefaultQos = Math.Clamp(DefaultQos, 0, 2),
+        },
+        // Null in Plain mode so ToJson leaves whatever the inbound blob had; see its remarks.
+        Sparkplug = Mode == MqttMode.SparkplugB
+            ? new MqttSparkplugOptions
+            {
+                GroupId = SparkplugGroupId.Trim(),
+                HostId = SparkplugHostId.Trim(),
+                ActAsPrimaryHost = SparkplugActAsPrimaryHost,
+                RequestRebirthOnGap = SparkplugRequestRebirthOnGap,
+                BirthObservationWindowSeconds = Math.Max(1, SparkplugBirthObservationWindowSeconds),
+            }
+            : null,
+    };
+
+    /// <summary>
+    ///     Serialises the authored fields over the preserved key bag and returns the <c>DriverConfig</c>
+    ///     JSON. Keys are PascalCase and enums are names, because the serialisation runs through
+    ///     <see cref="MqttJson.Options"/> — see the type remarks. <c>RawTags</c> is removed (the deploy
+    ///     artifact owns it).
+    /// </summary>
+    /// <remarks>
+    ///     <b><c>Sparkplug</c> is merged, never replaced, and only in Sparkplug mode.</b> In
+    ///     <see cref="MqttMode.Plain"/> the sub-object is left exactly as the inbound blob had it, so an
+    ///     operator who flips a Sparkplug driver to Plain to look at it and flips back does not lose the
+    ///     group id. In <see cref="MqttMode.SparkplugB"/> the five fields this form owns are written
+    ///     <i>over</i> the existing sub-object rather than replacing it, so a key a newer driver adds
+    ///     inside <c>Sparkplug</c> survives an older AdminUI — the same preserve-what-you-do-not-author
+    ///     discipline the top-level bag applies.
+    /// </remarks>
+    /// <returns>The serialised <c>DriverConfig</c> JSON string.</returns>
+    public string ToJson()
+    {
+        var typed = JsonSerializer.SerializeToNode(ToOptions(), MqttJson.Options)!.AsObject();
+
+        // Never let this form's always-empty placeholder overwrite what it does not own.
+        typed.Remove(RawTagsKey);
+
+        // Pulled out of the flat copy loop below: unlike every other key, this one merges.
+        var authoredSparkplug = TakeIgnoringCase(typed, SparkplugKey) as JsonObject;
+
+        foreach (var (key, value) in typed.ToList())
+        {
+            // Case-insensitive replace: MqttJson.Options binds a hand-edited camelCase blob happily, so
+            // the bag may hold "host" while we emit "Host" — writing both would leave two keys fighting.
+            RemoveIgnoringCase(_bag, key);
+            _bag[key] = value?.DeepClone();
+        }
+
+        if (authoredSparkplug is not null)
+        {
+            // Merge over whatever was already there, under the key name the bag already uses so a
+            // camelCase hand-edited blob does not end up with both "sparkplug" and "Sparkplug".
+            var existingKey = FindIgnoringCase(_bag, SparkplugKey) ?? SparkplugKey;
+            if (_bag[existingKey] is not JsonObject target)
+            {
+                target = new JsonObject();
+                _bag[existingKey] = target;
+            }
+
+            foreach (var (key, value) in authoredSparkplug.ToList())
+            {
+                RemoveIgnoringCase(target, key);
+                target[key] = value?.DeepClone();
+            }
+        }
+
+        RemoveIgnoringCase(_bag, RawTagsKey);
+        return TagConfigJson.Serialize(_bag);
+    }
+
+    /// <summary>
+    ///     Client-side validation surfaced inline by the form. Returns the first error, or <c>null</c>
+    ///     when the model is valid. Every bound mirrors a <c>[Range]</c> on
+    ///     <see cref="MqttDriverOptions"/> (or, for QoS, on <see cref="MqttPlainOptions"/>), so the
+    ///     authoring surface accepts exactly what the driver accepts.
+    /// </summary>
+    /// <returns>An error message describing the validation failure, or <c>null</c> when valid.</returns>
+    public string? Validate()
+    {
+        if (string.IsNullOrWhiteSpace(Host)) { return "A broker host is required."; }
+        if (Port is < 1 or > 65535) { return "Port must be between 1 and 65535."; }
+        if (KeepAliveSeconds < 1) { return "Keep-alive must be at least 1 second."; }
+        if (ConnectTimeoutSeconds < 1)
+        {
+            return "Connect timeout must be at least 1 second — 0 would make every connect attempt "
+                 + "expire instantly and the driver would never come up.";
+        }
+        if (ReconnectMinBackoffSeconds < 1) { return "Minimum reconnect backoff must be at least 1 second."; }
+        if (ReconnectMaxBackoffSeconds < 1) { return "Maximum reconnect backoff must be at least 1 second."; }
+        if (ReconnectMaxBackoffSeconds < ReconnectMinBackoffSeconds)
+        {
+            return "Maximum reconnect backoff must not be below the minimum.";
+        }
+        if (MaxPayloadBytes < 1) { return "Max payload bytes must be at least 1."; }
+        if (DefaultQos is < 0 or > 2) { return "Default QoS must be 0, 1 or 2."; }
+
+        if (Mode == MqttMode.SparkplugB)
+        {
+            var groupId = SparkplugGroupId.Trim();
+            if (groupId.Length == 0)
+            {
+                return "A Sparkplug group ID is required — it is the driver's whole subscription scope "
+                     + "(spBv1.0/{GroupId}/#), so a blank one ingests nothing.";
+            }
+
+            if (groupId.IndexOfAny(SparkplugGroupIdIllegalChars) >= 0)
+            {
+                return $"Sparkplug group ID '{groupId}' contains a character ('/', '+', or '#') that "
+                     + "cannot appear in an MQTT topic segment.";
+            }
+
+            if (SparkplugBirthObservationWindowSeconds < 1)
+            {
+                return "Birth observation window must be at least 1 second.";
+            }
+        }
+
+        return null;
+    }
+
+    /// <summary>Blank ⇒ <c>null</c> so the key is omitted and the driver's own default applies.</summary>
+    /// <param name="value">The raw form value.</param>
+    /// <returns>The trimmed value, or <c>null</c> when blank.</returns>
+    private static string? Blank(string? value)
+        => string.IsNullOrWhiteSpace(value) ? null : value.Trim();
+
+    /// <summary>Removes every key matching <paramref name="name"/> case-insensitively.</summary>
+    /// <param name="o">The object to mutate.</param>
+    /// <param name="name">The key name to remove.</param>
+    private static void RemoveIgnoringCase(JsonObject o, string name)
+    {
+        foreach (var key in o.Select(p => p.Key)
+                     .Where(k => string.Equals(k, name, StringComparison.OrdinalIgnoreCase))
+                     .ToList())
+        {
+            o.Remove(key);
+        }
+    }
+
+    /// <summary>The actual key in <paramref name="o"/> matching <paramref name="name"/> case-insensitively.</summary>
+    /// <param name="o">The object to search.</param>
+    /// <param name="name">The key name to look for.</param>
+    /// <returns>The matching key as it is spelled in <paramref name="o"/>, or <c>null</c>.</returns>
+    private static string? FindIgnoringCase(JsonObject o, string name)
+        => o.Select(p => p.Key)
+            .FirstOrDefault(k => string.Equals(k, name, StringComparison.OrdinalIgnoreCase));
+
+    /// <summary>Removes and returns the value of a case-insensitively matched key.</summary>
+    /// <param name="o">The object to mutate.</param>
+    /// <param name="name">The key name to take.</param>
+    /// <returns>The detached value, or <c>null</c> when the key was absent (or its value was null).</returns>
+    private static JsonNode? TakeIgnoringCase(JsonObject o, string name)
+    {
+        if (FindIgnoringCase(o, name) is not { } key) { return null; }
+
+        var value = o[key];
+        o.Remove(key);
+
+        // Detached before return: a node still parented to `typed` cannot be re-parented into the bag.
+        return value?.DeepClone();
+    }
+
+    /// <summary>Binds the blob through the shared options; <c>null</c> on blank/malformed input.</summary>
+    /// <param name="json">The raw <c>DriverConfig</c> JSON.</param>
+    /// <returns>The bound options, or <c>null</c>.</returns>
+    private static MqttDriverOptions? TryDeserialize(string? json)
+    {
+        if (string.IsNullOrWhiteSpace(json)) { return null; }
+        try { return JsonSerializer.Deserialize<MqttDriverOptions>(json, MqttJson.Options); }
+        catch (JsonException) { return null; }
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Raw/RawBrowseModal.razor

@@ -11,6 +11,8 @@
    SupportsOnlineDiscovery (AbCip/TwinCAT/FOCAS); otherwise browse is unavailable and the modal grays out
    with a tooltip. *@
 @implements IAsyncDisposable
+@using Microsoft.AspNetCore.Authorization
+@using Microsoft.AspNetCore.Components.Authorization
 @using ZB.MOM.WW.OtOpcUa.AdminUI.Browsing
 @using ZB.MOM.WW.OtOpcUa.AdminUI.Components.Shared.Drivers
 @using ZB.MOM.WW.OtOpcUa.AdminUI.Uns
@@ -18,6 +20,8 @@
 @inject IBrowserSessionService BrowserService
 @inject IRawTreeService Svc
 @inject RawTagCsvExportReader ExportReader
+@inject AuthenticationStateProvider AuthState
+@inject IAuthorizationService AuthorizationService
 
 @if (Visible)
 {
@@ -66,7 +70,22 @@
                         else
                         {
                             <div class="d-flex align-items-center justify-content-between mb-2">
-                                <span class="chip chip-ok">Browser open</span>
+                                <div class="d-flex align-items-center gap-2">
+                                    <span class="chip chip-ok">Browser open</span>
+                                    @* An observation window ACCUMULATES — the session keeps recording every
+                                       message after the tree was first rendered — but the tree itself loads
+                                       exactly once, when it is created. Without this the operator sees the
+                                       t=0 snapshot forever: on MQTT the first render is usually empty (a
+                                       topic that has not published yet is invisible) and on Sparkplug it is
+                                       almost always empty, because births are never retained. Re-keying the
+                                       tree re-runs its root load against the SAME session, so nothing
+                                       reconnects and nothing already observed is lost. *@
+                                    <button type="button" class="btn btn-outline-secondary btn-sm"
+                                            title="Re-read what this session has observed since it opened"
+                                            @onclick="RefreshTree">
+                                        Refresh
+                                    </button>
+                                </div>
                                 <div class="form-check form-switch mb-0">
                                     <input class="form-check-input" type="checkbox" id="raw-browse-mirror"
                                            checked="@_createGroups" @onchange="@(e => _createGroups = e.Value is true)" />
@@ -76,8 +95,90 @@
                                 </div>
                             </div>
 
-                            <DriverBrowseTree SessionToken="_token" MultiSelect="true"
-                                              SelectedLeafIds="_selectedIds" OnLeafToggled="OnLeafToggledAsync" />
+                            <DriverBrowseTree @key="_treeGeneration" SessionToken="_token" MultiSelect="true"
+                                              SelectedLeafIds="_selectedIds" OnLeafToggled="OnLeafToggledAsync"
+                                              OnNodeSelectedWithPath="OnScopeNodeSelected" />
+
+                            @if (_canRebirth && _canOperate)
+                            {
+                                @* Sparkplug only: births are never retained, so a quiet-but-healthy plant
+                                   shows an EMPTY tree until one lands. This is the only way to fill it on
+                                   demand — and the only browse action that publishes to the live broker,
+                                   hence the explicit confirm step. *@
+                                <div class="border rounded p-2 mt-2 bg-body-tertiary">
+                                    <div class="d-flex align-items-center justify-content-between gap-2">
+                                        <div class="small">
+                                            <strong>Request rebirth</strong>
+                                            <span class="text-muted">
+                                                &mdash; asks edge nodes to republish their metric set, so this tree fills
+                                                without waiting for a natural birth.
+                                            </span>
+                                        </div>
+                                        @if (!_rebirthConfirming)
+                                        {
+                                            <button type="button" class="btn btn-outline-warning btn-sm text-nowrap"
+                                                    disabled="@(_rebirthTarget is null || _rebirthBusy)"
+                                                    @onclick="BeginRebirth">
+                                                Request rebirth&hellip;
+                                            </button>
+                                        }
+                                    </div>
+
+                                    @if (_rebirthTarget is null)
+                                    {
+                                        <div class="small text-muted mt-1">
+                                            Click a group, edge node, device or metric in the tree above to choose the scope.
+                                        </div>
+                                    }
+                                    else
+                                    {
+                                        <div class="small mt-1">
+                                            Scope: <strong>@_rebirthTarget.Kind</strong>
+                                            <code class="mono ms-1">@_rebirthTarget.Scope</code>
+                                        </div>
+                                        <div class="small text-muted">@_rebirthTarget.Detail</div>
+                                    }
+
+                                    @if (_rebirthConfirming && _rebirthTarget is not null)
+                                    {
+                                        <div class="alert alert-warning py-2 mt-2 mb-0">
+                                            <div class="small">
+                                                This <strong>publishes to the live broker</strong>: a Sparkplug
+                                                rebirth-request command addressed to @_rebirthTarget.Kind
+                                                (<code class="mono">@_rebirthTarget.Scope</code>).
+                                                @if (_rebirthTarget.IsGroup)
+                                                {
+                                                    <text>
+                                                        Every edge node observed in this group is addressed; a group with
+                                                        more than @MqttGroupRebirthNodeCap observed edge nodes is refused
+                                                        outright, and nothing is published.
+                                                    </text>
+                                                }
+                                            </div>
+                                            <div class="d-flex gap-2 mt-2">
+                                                <button type="button" class="btn btn-warning btn-sm"
+                                                        disabled="@_rebirthBusy" @onclick="ConfirmRebirthAsync">
+                                                    @if (_rebirthBusy) { <span class="spinner-border spinner-border-sm me-1"></span> }
+                                                    Publish rebirth request
+                                                </button>
+                                                <button type="button" class="btn btn-outline-secondary btn-sm"
+                                                        disabled="@_rebirthBusy" @onclick="CancelRebirth">
+                                                    Cancel
+                                                </button>
+                                            </div>
+                                        </div>
+                                    }
+
+                                    @if (_rebirthOutcome is not null)
+                                    {
+                                        <div class="small text-success mt-1">@_rebirthOutcome</div>
+                                    }
+                                    @if (_rebirthError is not null)
+                                    {
+                                        <div class="alert alert-danger py-2 mt-2 mb-0 small">@_rebirthError</div>
+                                    }
+                                </div>
+                            }
 
                             <div class="mt-2 small">
                                 <strong>@_selected.Count</strong> tag@(_selected.Count == 1 ? "" : "s") selected.
@@ -116,6 +217,11 @@
     /// type (the OPC UA Client tree). Driver-typed browsers (AbCip/TwinCAT/FOCAS) report the real type.</summary>
     private const string DefaultDataType = "Double";
 
+    /// <summary>Mirrors <c>MqttBrowseSession.MaxGroupRebirthNodes</c> for the confirm-step wording. The
+    /// session owns the rule and refuses whole past it; this is the operator-facing number, and a drift
+    /// only ever makes the warning less precise, never the refusal wrong.</summary>
+    private const int MqttGroupRebirthNodeCap = 32;
+
     /// <summary>Whether the modal is shown. Two-way (@bind-Visible) so the modal can self-close.</summary>
     [Parameter] public bool Visible { get; set; }
 
@@ -154,9 +260,32 @@
     private bool _busy;
     private List<string> _commitErrors = new();
 
+    /// <summary>
+    ///     Bumped to force a fresh <c>DriverBrowseTree</c> against the same session — see the Refresh
+    ///     button's remarks. Seeded from the session so re-opening a modal always starts a new generation.
+    /// </summary>
+    private int _treeGeneration;
+
+    // Request-rebirth affordance (MQTT/Sparkplug only). _canOperate is defence in depth — the real gate
+    // is server-side in BrowserSessionService.RequestRebirthAsync, which fails closed.
+    private bool _canOperate;
+    private bool _canRebirth;
+    private RebirthTarget? _rebirthTarget;
+    private bool _rebirthConfirming;
+    private bool _rebirthBusy;
+    private string? _rebirthOutcome;
+    private string? _rebirthError;
+
     private readonly Dictionary<string, SelectedLeaf> _selected = new(StringComparer.Ordinal);
     private readonly HashSet<string> _selectedIds = new(StringComparer.Ordinal);
 
+    protected override async Task OnInitializedAsync()
+    {
+        var auth = await AuthState.GetAuthenticationStateAsync();
+        var result = await AuthorizationService.AuthorizeAsync(auth.User, null, AdminUiPolicies.DriverOperator);
+        _canOperate = result.Succeeded;
+    }
+
     protected override async Task OnParametersSetAsync()
     {
         if (!Visible)
@@ -185,6 +314,8 @@
         _groupPrefix = null;
         _canBrowse = false;
         _disabledReason = null;
+        ResetRebirthState();
+        _canRebirth = false;
 
         _resolving = true;
         StateHasChanged();
@@ -238,7 +369,13 @@
         try
         {
             var result = await BrowserService.OpenAsync(_driverType, _mergedConfig, default);
-            if (result.Ok) { _token = result.Token; }
+            if (result.Ok)
+            {
+                _token = result.Token;
+                // Capability, not authorization: a plain-MQTT window (and every non-MQTT browser) has no
+                // re-announce action at all, so the affordance must not be drawn for it.
+                _canRebirth = BrowserService.CanRequestRebirth(_token);
+            }
             else { _openError = result.Message; }
         }
         finally
@@ -263,6 +400,7 @@
         // the display name + the default data type.
         string name = sel.Leaf.DisplayName;
         string? driverDataType = null;
+        IReadOnlyDictionary<string, string>? addressFields = null;
         try
         {
             var attrs = await BrowserService.AttributesAsync(_token, nodeId, default);
@@ -270,15 +408,164 @@
             {
                 name = string.IsNullOrWhiteSpace(attrs[0].Name) ? sel.Leaf.DisplayName : attrs[0].Name;
                 driverDataType = attrs[0].DriverDataType;
+                // The STRUCTURED address, for a driver whose binding is a tuple (MQTT/Sparkplug). Never
+                // reconstructed from the node id: a metric name may contain '/', so the id cannot be
+                // split back into (group, edgeNode, device?, metric) — see RawBrowseCommitMapper.
+                addressFields = attrs[0].AddressFields;
             }
         }
         catch
         {
             // Attribute lookup is best-effort — a leaf is still selectable with display-name + default type.
+            // For a tuple-addressed driver that also means "no address", which CommitAsync refuses in words.
         }
 
         _selectedIds.Add(nodeId);
-        _selected[nodeId] = new SelectedLeaf(nodeId, name, driverDataType, sel.FolderPath);
+        _selected[nodeId] = new SelectedLeaf(nodeId, name, driverDataType, sel.FolderPath, addressFields);
+
+        // A metric is also a legal rebirth scope (it resolves up to its owning edge node), so a toggle
+        // moves the scope the same way a folder click does.
+        SetRebirthTarget(sel.Leaf, sel.FolderPath);
+    }
+
+    /// <summary>Tracks the tree click that defines the Request-rebirth scope (folders and metrics alike).</summary>
+    private void OnScopeNodeSelected(BrowseLeafSelection sel) => SetRebirthTarget(sel.Leaf, sel.FolderPath);
+
+    /// <summary>
+    ///     Re-derives the rebirth scope from the clicked node, and — because the scope changed — drops any
+    ///     pending confirmation. A confirm step that survived a selection change would publish to a target
+    ///     the operator is no longer looking at.
+    /// </summary>
+    private void SetRebirthTarget(BrowseNode node, IReadOnlyList<string> ancestorPath)
+    {
+        if (!_canRebirth) { return; }
+
+        var target = DescribeRebirthTarget(node, ancestorPath);
+        if (_rebirthTarget?.Scope == target.Scope) { return; }
+
+        _rebirthTarget = target;
+        _rebirthConfirming = false;
+        _rebirthOutcome = null;
+        _rebirthError = null;
+    }
+
+    /// <summary>
+    ///     Names what a clicked node means as a rebirth scope. The DEPTH comes from the captured ancestor
+    ///     path, not from splitting the node id — the id is the session's own key and the AdminUI must not
+    ///     reverse-engineer its shape.
+    /// </summary>
+    /// <param name="node">The clicked browse node; its NodeId is passed to the session verbatim.</param>
+    /// <param name="ancestorPath">The node's ancestor display names, root→parent.</param>
+    /// <returns>The described target.</returns>
+    private static RebirthTarget DescribeRebirthTarget(BrowseNode node, IReadOnlyList<string> ancestorPath)
+    {
+        var depth = ancestorPath.Count;
+        var name = node.DisplayName;
+
+        // Sparkplug has no device- or metric-scoped rebirth: an NCMD addresses an EDGE NODE, so a
+        // deeper selection resolves upward. Say so, rather than letting the operator assume the
+        // narrower scope they clicked.
+        if (node.Kind == BrowseNodeKind.Leaf && depth >= 2)
+        {
+            return new RebirthTarget(
+                node.NodeId,
+                $"edge node {ancestorPath[1]}",
+                $"Selected the metric '{name}'. Sparkplug addresses rebirth at the edge node, so "
+                + $"{ancestorPath[1]} republishes its whole metric set.",
+                IsGroup: false);
+        }
+
+        return depth switch
+        {
+            0 => new RebirthTarget(
+                node.NodeId,
+                $"group {name}",
+                $"Every edge node observed in group '{name}' is asked to republish.",
+                IsGroup: true),
+            1 => new RebirthTarget(
+                node.NodeId,
+                $"edge node {name}",
+                $"Edge node '{name}' in group '{ancestorPath[0]}' republishes its whole metric set.",
+                IsGroup: false),
+            2 => new RebirthTarget(
+                node.NodeId,
+                $"edge node {ancestorPath[1]}",
+                $"Selected the device '{name}'. Sparkplug addresses rebirth at the edge node, so "
+                + $"{ancestorPath[1]} republishes its whole metric set.",
+                IsGroup: false),
+            _ => new RebirthTarget(node.NodeId, "the selected node", "", IsGroup: false),
+        };
+    }
+
+    /// <summary>Arms the confirm step. Publishing is deliberately two clicks — it reaches a live plant broker.</summary>
+    private void BeginRebirth()
+    {
+        _rebirthOutcome = null;
+        _rebirthError = null;
+        _rebirthConfirming = true;
+    }
+
+    /// <summary>Disarms the confirm step without publishing anything.</summary>
+    private void CancelRebirth() => _rebirthConfirming = false;
+
+    /// <summary>
+    ///     The one browse action that publishes. Exceptions are SHOWN, not swallowed: a refusal (an
+    ///     over-wide group scope, a missing DriverOperator grant, an unresolvable scope) is exactly what
+    ///     the operator needs to read, and nothing was published in any of those cases.
+    /// </summary>
+    private async Task ConfirmRebirthAsync()
+    {
+        if (_rebirthTarget is null) { return; }
+        _rebirthBusy = true;
+        _rebirthOutcome = null;
+        _rebirthError = null;
+        StateHasChanged();
+        try
+        {
+            var published = await BrowserService.RequestRebirthAsync(_token, _rebirthTarget.Scope, default);
+            _rebirthOutcome =
+                $"Rebirth requested for {_rebirthTarget.Kind} — {published} command"
+                + (published == 1 ? "" : "s")
+                + " published. Re-expand the tree in a few seconds to see the republished metrics.";
+            _rebirthConfirming = false;
+        }
+        catch (Exception ex)
+        {
+            _rebirthError = ex.Message;
+        }
+        finally
+        {
+            _rebirthBusy = false;
+            StateHasChanged();
+        }
+    }
+
+    /// <summary>
+    ///     Re-reads the root of the open session's observed tree. Only the tree is rebuilt: the session,
+    ///     its broker connection and everything it has recorded are untouched, so this is strictly a
+    ///     re-render and never re-observes from scratch.
+    /// </summary>
+    /// <remarks>
+    ///     The tag <b>selection</b> is deliberately kept — <c>_selectedIds</c> is keyed by browse node id
+    ///     and a refresh does not renumber anything, so an operator who ticked leaves, waited for more
+    ///     of the plant to appear, and refreshed does not silently lose the ticks. The rebirth scope IS
+    ///     cleared, because the node it pointed at may no longer be in the rebuilt tree and a stale
+    ///     armed scope is exactly the thing that panel's two-click confirm exists to prevent.
+    /// </remarks>
+    private void RefreshTree()
+    {
+        _treeGeneration++;
+        ResetRebirthState();
+    }
+
+    /// <summary>Clears every rebirth-panel field (modal re-open, browser close).</summary>
+    private void ResetRebirthState()
+    {
+        _rebirthTarget = null;
+        _rebirthConfirming = false;
+        _rebirthBusy = false;
+        _rebirthOutcome = null;
+        _rebirthError = null;
     }
 
     private async Task CommitAsync()
@@ -288,10 +575,21 @@
         StateHasChanged();
         try
         {
+            // Refuse a selection the driver could not bind, IN WORDS — for a tuple-addressed driver
+            // (MQTT/Sparkplug) a leaf whose attribute lookup returned nothing carries no address, and
+            // committing it would produce a tag that deploys clean and then reports BadNodeIdUnknown
+            // forever with nothing to point at.
+            _commitErrors = _selected.Values
+                .Select(s => RawBrowseCommitMapper.DescribeUncommittableLeaf(_driverType, s.Name, s.AddressFields))
+                .Where(e => e is not null)
+                .Select(e => e!)
+                .ToList();
+            if (_commitErrors.Count > 0) { return; }
+
             var rows = _selected.Values
                 .Select(s => RawBrowseCommitMapper.MapLeaf(
                     _driverType, s.NodeId, s.Name, s.DriverDataType, DefaultDataType,
-                    _groupPrefix, s.FolderPath, _createGroups))
+                    _groupPrefix, s.FolderPath, _createGroups, s.AddressFields))
                 .ToList();
 
             var outcome = await Svc.ImportTagsAsync(_effectiveDeviceId, rows);
@@ -314,6 +612,8 @@
     {
         var t = _token;
         _token = Guid.Empty;
+        _canRebirth = false;
+        ResetRebirthState();
         Visible = false;
         _open = false;
         await VisibleChanged.InvokeAsync(false);
@@ -335,5 +635,19 @@
         return ValueTask.CompletedTask;
     }
 
-    private sealed record SelectedLeaf(string NodeId, string Name, string? DriverDataType, IReadOnlyList<string> FolderPath);
+    /// <param name="AddressFields">The structured address the browse session stated for this leaf, for a
+    /// driver whose binding is a tuple rather than the NodeId itself; null for every other driver.</param>
+    private sealed record SelectedLeaf(
+        string NodeId,
+        string Name,
+        string? DriverDataType,
+        IReadOnlyList<string> FolderPath,
+        IReadOnlyDictionary<string, string>? AddressFields = null);
+
+    /// <summary>A described Request-rebirth scope: what gets published, and to what.</summary>
+    /// <param name="Scope">The browse node id handed to the session verbatim.</param>
+    /// <param name="Kind">What the scope resolves to, in operator words (e.g. "edge node EdgeA").</param>
+    /// <param name="Detail">The one-line consequence, spelled out before the confirm step.</param>
+    /// <param name="IsGroup">True for a whole-group fan-out — the bounded, all-or-nothing case.</param>
+    private sealed record RebirthTarget(string Scope, string Kind, string Detail, bool IsGroup);
 }

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Raw/RawDriverTypeDialog.razor

@@ -67,6 +67,7 @@
         ("TwinCAT", DriverTypeNames.TwinCAT),
         ("FOCAS", DriverTypeNames.FOCAS),
         ("OpcUaClient", DriverTypeNames.OpcUaClient),
+        ("MQTT", DriverTypeNames.Mqtt),
         ("Galaxy", DriverTypeNames.Galaxy),
         ("Sql", DriverTypeNames.Sql),
         ("Calculation", "Calculation"),

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Uns/TagEditors/MqttTagConfigEditor.razor

@@ -0,0 +1,212 @@
+@* Typed TagConfig editor for the Mqtt driver. Same (ConfigJson/ConfigJsonChanged/DriverType/
+   GetDriverConfigJson) parameter shape every typed editor takes; the last two are accepted for
+   dispatch uniformity and unused here (MQTT has no address-builder picker — topics are discovered
+   through the /raw browse tree, not composed from parts).
+
+   The shape switch is real (it drives which field group renders and what Validate() applies) but it
+   is a UI-only choice derived from the blob, never serialised — the driver takes Plain vs SparkplugB
+   from its DRIVER config, and the tag blob has no 'mode' key. A SparkplugB tag survives a save→reopen
+   because its descriptor keys (groupId/edgeNodeId/deviceId/metricName) re-infer the mode on load —
+   there is nothing else that needs to persist. *@
+@using ZB.MOM.WW.OtOpcUa.AdminUI.Uns.TagEditors
+@using ZB.MOM.WW.OtOpcUa.Core.Abstractions
+@using ZB.MOM.WW.OtOpcUa.Driver.Mqtt
+
+<div class="row g-2">
+    <div class="col-md-4">
+        <label class="form-label" for="mqtt-mode">Tag shape</label>
+        <select id="mqtt-mode" class="form-select form-select-sm" value="@_m.Mode"
+                @onchange="@(e => Update(() => _m.Mode = ParseEnum(e.Value, MqttMode.Plain)))">
+            @foreach (var v in Enum.GetValues<MqttMode>()) { <option value="@v">@v</option> }
+        </select>
+    </div>
+
+    @if (_m.Mode == MqttMode.Plain)
+    {
+        <div class="col-md-8">
+            <label class="form-label" for="mqtt-topic">Topic</label>
+            <input id="mqtt-topic" type="text" class="form-control form-control-sm mono"
+                   placeholder="factory/oven/temp" value="@_m.Topic"
+                   @onchange="@(e => Update(() => _m.Topic = e.Value?.ToString() ?? ""))" />
+            <div class="form-text">Concrete topic — MQTT wildcards (+ / #) are not valid for a tag.</div>
+        </div>
+        <div class="col-md-4">
+            <label class="form-label" for="mqtt-payload-format">Payload format</label>
+            <select id="mqtt-payload-format" class="form-select form-select-sm" value="@_m.PayloadFormat"
+                    @onchange="@(e => Update(() => _m.PayloadFormat = ParseEnum(e.Value, MqttPayloadFormat.Json)))">
+                @foreach (var v in Enum.GetValues<MqttPayloadFormat>()) { <option value="@v">@v</option> }
+            </select>
+        </div>
+        @if (_m.PayloadFormat == MqttPayloadFormat.Json)
+        {
+            <div class="col-md-4">
+                <label class="form-label" for="mqtt-json-path">JSON path</label>
+                <input id="mqtt-json-path" type="text" class="form-control form-control-sm mono"
+                       placeholder="$.value" value="@_m.JsonPath"
+                       @onchange="@(e => Update(() => _m.JsonPath = e.Value?.ToString() ?? ""))" />
+                <div class="form-text">Use <code>$</code> for the whole document.</div>
+            </div>
+        }
+        <div class="col-md-4">
+            <label class="form-label" for="mqtt-data-type">Data type</label>
+            @* The driver's own DriverDataType members — authoring anything outside this set produces a
+               blob the driver's strict parser rejects at deploy (there is no 'Double'; it is Float64). *@
+            <select id="mqtt-data-type" class="form-select form-select-sm" value="@_m.DataType"
+                    @onchange="@(e => Update(() => _m.DataType = ParseEnum(e.Value, DriverDataType.String)))">
+                @foreach (var v in Enum.GetValues<DriverDataType>()) { <option value="@v">@v</option> }
+            </select>
+        </div>
+        <div class="col-md-4">
+            <label class="form-label" for="mqtt-qos">QoS</label>
+            <select id="mqtt-qos" class="form-select form-select-sm" value="@(_m.Qos?.ToString() ?? "")"
+                    @onchange="@(e => Update(() => _m.Qos = ParseNullableInt(e.Value)))">
+                <option value="">(driver default)</option>
+                <option value="0">0 — at most once</option>
+                <option value="1">1 — at least once</option>
+                <option value="2">2 — exactly once</option>
+            </select>
+        </div>
+        <div class="col-md-4">
+            <label class="form-label" for="mqtt-retain-seed">Retained-message seed</label>
+            <select id="mqtt-retain-seed" class="form-select form-select-sm"
+                    value="@(_m.RetainSeed is null ? "" : _m.RetainSeed.Value ? "true" : "false")"
+                    @onchange="@(e => Update(() => _m.RetainSeed = ParseNullableBool(e.Value)))">
+                <option value="">(driver default)</option>
+                <option value="true">Seed from retained message</option>
+                <option value="false">Wait for a live publish</option>
+            </select>
+        </div>
+    }
+    else
+    {
+        <div class="col-md-4">
+            <label class="form-label" for="mqtt-sp-group">Group ID</label>
+            <input id="mqtt-sp-group" type="text" class="form-control form-control-sm mono"
+                   placeholder="Plant1" value="@_m.GroupId"
+                   @onchange="@(e => Update(() => _m.GroupId = e.Value?.ToString() ?? ""))" />
+            <div class="form-text">The driver subscribes <code>spBv1.0/@(string.IsNullOrEmpty(_m.GroupId) ? "{GroupId}" : _m.GroupId)/#</code>. No <code>/</code>, <code>+</code>, or <code>#</code>.</div>
+        </div>
+        <div class="col-md-4">
+            <label class="form-label" for="mqtt-sp-node">Edge node ID</label>
+            <input id="mqtt-sp-node" type="text" class="form-control form-control-sm mono"
+                   placeholder="EdgeA" value="@_m.EdgeNodeId"
+                   @onchange="@(e => Update(() => _m.EdgeNodeId = e.Value?.ToString() ?? ""))" />
+            <div class="form-text">The publishing edge node's id.</div>
+        </div>
+        <div class="col-md-4">
+            <label class="form-label" for="mqtt-sp-device">Device ID <span class="text-muted">(optional)</span></label>
+            <input id="mqtt-sp-device" type="text" class="form-control form-control-sm mono"
+                   placeholder="(node-level metric)" value="@_m.DeviceId"
+                   @onchange="@(e => Update(() => _m.DeviceId = e.Value?.ToString() ?? ""))" />
+            <div class="form-text">Leave blank for a metric published by the edge node itself.</div>
+        </div>
+        <div class="col-md-6">
+            <label class="form-label" for="mqtt-sp-metric">Metric name</label>
+            <input id="mqtt-sp-metric" type="text" class="form-control form-control-sm mono"
+                   placeholder="Node Control/Rebirth" value="@_m.MetricName"
+                   @onchange="@(e => Update(() => _m.MetricName = e.Value?.ToString() ?? ""))" />
+            <div class="form-text">The metric's stable name from the birth certificate — unlike the ids above, this MAY contain <code>/</code> (e.g. <code>Properties/Hardware Make</code>).</div>
+        </div>
+        <div class="col-md-3">
+            <label class="form-label" for="mqtt-sp-data-type">Data type override</label>
+            @* Same DriverDataType set as Plain's field — the factory reads a Sparkplug 'dataType' key as
+               a DriverDataType override, not the raw wire SparkplugDataType. Absent ⇒ take whatever type
+               the birth certificate declares (the driver's UntilStable discovery). *@
+            <select id="mqtt-sp-data-type" class="form-select form-select-sm" value="@(_m.MetricDataType?.ToString() ?? "")"
+                    @onchange="@(e => Update(() => _m.MetricDataType = ParseNullableEnum<DriverDataType>(e.Value)))">
+                <option value="">(from birth certificate)</option>
+                @foreach (var v in Enum.GetValues<DriverDataType>()) { <option value="@v">@v</option> }
+            </select>
+        </div>
+        <div class="col-md-3">
+            <label class="form-label" for="mqtt-sp-qos">QoS</label>
+            <select id="mqtt-sp-qos" class="form-select form-select-sm" value="@(_m.Qos?.ToString() ?? "")"
+                    @onchange="@(e => Update(() => _m.Qos = ParseNullableInt(e.Value)))">
+                <option value="">(driver default)</option>
+                <option value="0">0 — at most once</option>
+                <option value="1">1 — at least once</option>
+                <option value="2">2 — exactly once</option>
+            </select>
+        </div>
+        <div class="col-md-3">
+            <label class="form-label" for="mqtt-sp-retain-seed">Retained-message seed</label>
+            <select id="mqtt-sp-retain-seed" class="form-select form-select-sm"
+                    value="@(_m.RetainSeed is null ? "" : _m.RetainSeed.Value ? "true" : "false")"
+                    @onchange="@(e => Update(() => _m.RetainSeed = ParseNullableBool(e.Value)))">
+                <option value="">(driver default)</option>
+                <option value="true">Seed from retained message</option>
+                <option value="false">Wait for a live publish</option>
+            </select>
+        </div>
+    }
+
+    @if (_validationError is not null)
+    {
+        <div class="col-12"><div class="text-danger small">@_validationError</div></div>
+    }
+</div>
+
+@code {
+    /// <summary>The tag's TagConfig JSON, owned by the host modal.</summary>
+    [Parameter] public string? ConfigJson { get; set; }
+    /// <summary>Raised with the re-serialised TagConfig JSON after every field edit.</summary>
+    [Parameter] public EventCallback<string> ConfigJsonChanged { get; set; }
+    /// <summary>DriverType of the owning driver — accepted for dispatch uniformity; unused here.</summary>
+    [Parameter] public string DriverType { get; set; } = "";
+    /// <summary>Live accessor for the owning driver's DriverConfig JSON — accepted for dispatch uniformity; unused here.</summary>
+    [Parameter] public Func<string> GetDriverConfigJson { get; set; } = () => "{}";
+
+    private MqttTagConfigModel _m = new();
+    private string? _lastConfigJson;
+    private string? _validationError;
+
+    // Re-parse only when the incoming JSON actually changes, so an unrelated parent re-render
+    // (Blazor Server live-status pushes do this) can't reset the user's in-progress edits.
+    protected override void OnParametersSet()
+    {
+        if (ConfigJson == _lastConfigJson) { return; }
+        _lastConfigJson = ConfigJson;
+        _m = MqttTagConfigModel.FromJson(ConfigJson);
+        _validationError = _m.Validate();
+    }
+
+    // TryParse so a bad/empty change value can never throw into the Blazor circuit — it falls back.
+    private static TEnum ParseEnum<TEnum>(object? v, TEnum fallback) where TEnum : struct, Enum
+        => Enum.TryParse<TEnum>(v?.ToString(), out var r) ? r : fallback;
+
+    // "" (the "(from birth certificate)" sentinel option) ⇒ null ⇒ the key is omitted.
+    private static TEnum? ParseNullableEnum<TEnum>(object? v) where TEnum : struct, Enum
+        => Enum.TryParse<TEnum>(v?.ToString(), out var r) ? r : null;
+
+    // "" ⇒ null ⇒ the key is omitted and the driver's own default applies.
+    private static int? ParseNullableInt(object? v)
+        => int.TryParse(v?.ToString(), out var i) ? i : null;
+
+    private static bool? ParseNullableBool(object? v)
+        => bool.TryParse(v?.ToString(), out var b) ? b : null;
+
+    private async Task Update(Action apply)
+    {
+        apply();
+        _validationError = _m.Validate();
+        var json = _m.ToJson();
+
+        // Keep the OnParametersSet guard in step with what we just emitted, so the host echoing the new
+        // JSON straight back as a parameter cannot re-parse and clobber an in-progress edit.
+        //
+        // WHY THIS DIVERGES FROM THE MODBUS TEMPLATE (which does not do this): the general landmine is a
+        // DERIVED, NON-PERSISTED UI FIELD INFERRED FROM BLOB CONTENT. Mode is exactly that — it is
+        // re-inferred by FromJson from the Sparkplug keys and never serialised, so a plain re-parse of
+        // our own output would silently reset the operator's shape selection to Plain on the very next
+        // render. Modbus has no such field, which is why it needs no guard. Task 24's Sparkplug field
+        // group will be tempted to add more of them; each one needs this guard to hold.
+        //
+        // TRADE (does not manifest today): the editor will not pick up a change the HOST makes to the
+        // JSON while it is open. That is safe only because RawTagModal/RawManualTagEntryModal mutate
+        // _form.TagConfig exclusively through this callback. A host-side feature that rewrites the blob
+        // out-of-band — a "reformat JSON" action, a bulk address re-pick — would reintroduce staleness
+        // here and must re-key the guard (e.g. compare against a host-supplied revision, not the text).
+        _lastConfigJson = json;
+        await ConfigJsonChanged.InvokeAsync(json);
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/EndpointRouteBuilderExtensions.cs

@@ -10,6 +10,7 @@ using ZB.MOM.WW.OtOpcUa.AdminUI.Uns;
 using ZB.MOM.WW.OtOpcUa.Commons.Browsing;
 using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
 using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser;
+using ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser;
 using ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser;
 using ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser;
 using ZB.MOM.WW.Secrets.Ui;
@@ -80,6 +81,7 @@ public static class EndpointRouteBuilderExtensions
         // for Sql: SqlDriver.CanBrowse is false, and this bespoke IDriverBrowser wins by construction
         // (BrowserSessionService indexes bespoke browsers by DriverType before falling back to universal).
         services.AddSingleton<IDriverBrowser, SqlDriverBrowser>();
+        services.AddSingleton<IDriverBrowser, MqttDriverBrowser>();
         // Universal Discover-backed fallback browser (Wave 0). IDriverFactory is bound by the
         // fused Host's DriverFactoryBootstrap; a standalone AdminUI has none → NullDriverFactory
         // → CanBrowse false → pickers gracefully stay manual-entry (design §6).

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Uns/RawBrowseCommitMapper.cs

@@ -3,6 +3,7 @@ using ZB.MOM.WW.OtOpcUa.AdminUI.Uns.TagEditors;
 using ZB.MOM.WW.OtOpcUa.Commons.Types;
 using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
 using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.Mqtt;
 
 namespace ZB.MOM.WW.OtOpcUa.AdminUI.Uns;
 
@@ -33,6 +34,9 @@ public static class RawBrowseCommitMapper
     /// <param name="folderPath">The captured browse-folder nesting above the leaf (root→parent display
     /// names); mirrored onto nested TagGroups only when <paramref name="createGroups"/> is true.</param>
     /// <param name="createGroups">When true, mirror <paramref name="folderPath"/> as nested TagGroups.</param>
+    /// <param name="addressFields">The leaf's structured address (<see cref="AttributeInfo.AddressFields"/>),
+    /// for a driver whose binding is a tuple rather than a single reference string; null for every driver
+    /// whose address is the <paramref name="fullName"/> itself.</param>
     /// <returns>The assembled import row.</returns>
     public static RawTagImportRow MapLeaf(
         string driverType,
@@ -42,10 +46,11 @@ public static class RawBrowseCommitMapper
         string defaultDataType,
         string? groupPrefix,
         IReadOnlyList<string>? folderPath,
-        bool createGroups)
+        bool createGroups,
+        IReadOnlyDictionary<string, string>? addressFields = null)
     {
         var dataType = MapDataType(driverDataType) ?? defaultDataType;
-        var tagConfig = BuildTagConfig(driverType, fullName);
+        var tagConfig = BuildTagConfig(driverType, fullName, addressFields);
         var mirrored = createGroups && folderPath is { Count: > 0 }
             ? string.Join(RawPaths.Separator, folderPath)
             : null;
@@ -96,13 +101,25 @@ public static class RawBrowseCommitMapper
     /// address field to <paramref name="fullName"/> and leaving every other field at its model default. Reuses
     /// the <c>&lt;Driver&gt;TagConfigModel</c> for driver types that have a typed editor; the model-less Galaxy
     /// driver gets the canonical camelCase <c>attributeRef</c> key directly.
+    /// <para>
+    /// <b>MQTT is the one driver whose address is not a single string</b> — a Sparkplug tag binds by a
+    /// <c>(group, edgeNode, device?, metric)</c> tuple — so it is built from the browse session's stated
+    /// <paramref name="addressFields"/> instead. See <see cref="BuildMqttTagConfig"/>.
+    /// </para>
     /// </summary>
     /// <param name="driverType">The owning device's driver type.</param>
     /// <param name="fullName">The leaf's driver-side full reference to write into the address field.</param>
+    /// <param name="addressFields">The leaf's structured address, when the driver binds by a tuple —
+    /// see <see cref="BuildMqttTagConfig"/>. Ignored by every single-reference driver.</param>
     /// <returns>The serialised driver-typed <c>TagConfig</c> JSON.</returns>
-    public static string BuildTagConfig(string driverType, string fullName)
+    public static string BuildTagConfig(
+        string driverType,
+        string fullName,
+        IReadOnlyDictionary<string, string>? addressFields = null)
     {
         var address = fullName ?? "";
+        if (Is(driverType, DriverTypeNames.Mqtt))
+            return BuildMqttTagConfig(address, addressFields);
         if (Is(driverType, DriverTypeNames.OpcUaClient))
             return new OpcUaClientTagConfigModel { NodeId = address }.ToJson();
         if (Is(driverType, DriverTypeNames.AbCip))
@@ -123,6 +140,103 @@ public static class RawBrowseCommitMapper
         return WriteSingleKey("address", address);
     }
 
+    /// <summary>
+    /// Builds the <c>TagConfig</c> for a browse-committed <b>MQTT</b> leaf, whose address is a
+    /// <i>descriptor</i> rather than a single reference string: <c>topic</c> in Plain mode, and the
+    /// <c>groupId</c>/<c>edgeNodeId</c>/<c>deviceId?</c>/<c>metricName</c> tuple in Sparkplug B mode.
+    /// </summary>
+    /// <param name="fullName">The leaf's browse node id — the Plain-mode fallback address only.</param>
+    /// <param name="addressFields">The structured address the browse session stated.</param>
+    /// <returns>The serialised <c>TagConfig</c> JSON.</returns>
+    /// <remarks>
+    ///     <para>
+    ///     <b>The address is read from <paramref name="addressFields"/>, never parsed out of
+    ///     <paramref name="fullName"/>.</b> A Sparkplug browse node id is
+    ///     <c>{group}/{node}[/{device}]::{metric}</c>, and a metric name legitimately contains <c>/</c>
+    ///     (<c>Node Control/Rebirth</c>) — so splitting the id cannot recover the tuple in general, and a
+    ///     mapper that guessed would silently bind the wrong metric. The session that decoded the birth
+    ///     already holds the decomposition and hands it over; this method only picks the keys it knows.
+    ///     </para>
+    ///     <para>
+    ///     <b>Plain vs Sparkplug is likewise stated, not inferred</b> — the driver <i>type</i> reaching
+    ///     here is just <c>Mqtt</c>, and the mode lives on the driver config, not on the tag. The
+    ///     producing session knows its own mode and says so by which keys it emits: a
+    ///     <c>metricName</c> ⇒ Sparkplug, a <c>topic</c> ⇒ Plain. (The blob deliberately carries no
+    ///     <c>mode</c> key: <c>MqttTagDefinitionFactory</c> takes the shape from the driver's mode and
+    ///     would ignore one, and <c>MqttTagConfigModel</c> re-infers it from these same keys.)
+    ///     </para>
+    ///     <para>
+    ///     Keys are <b>whitelisted</b>, not splatted: these values came off a broker, and everything
+    ///     beyond the address (payload format, JSONPath, QoS, dataType) stays at the driver's own
+    ///     defaults for the operator to author afterwards. A leaf with no stated address at all is
+    ///     rejected before this is reached — see <see cref="DescribeUncommittableLeaf"/>.
+    ///     </para>
+    /// </remarks>
+    private static string BuildMqttTagConfig(string fullName, IReadOnlyDictionary<string, string>? addressFields)
+    {
+        if (TryGetField(addressFields, MqttTagConfigKeys.MetricName) is { } metricName)
+        {
+            var o = new JsonObject
+            {
+                [MqttTagConfigKeys.GroupId] = TryGetField(addressFields, MqttTagConfigKeys.GroupId) ?? "",
+                [MqttTagConfigKeys.EdgeNodeId] = TryGetField(addressFields, MqttTagConfigKeys.EdgeNodeId) ?? "",
+                [MqttTagConfigKeys.MetricName] = metricName,
+            };
+
+            // Absent, not blank, for a node-level metric — the two describe the same scope to the
+            // factory, but only the absent form says "this metric has no device" to a reader.
+            if (TryGetField(addressFields, MqttTagConfigKeys.DeviceId) is { } deviceId)
+                o[MqttTagConfigKeys.DeviceId] = deviceId;
+
+            return o.ToJsonString();
+        }
+
+        // Plain: the session states the topic; the node id is the same value and is the fallback for a
+        // session that stated nothing (a shape DescribeUncommittableLeaf refuses upstream).
+        return WriteSingleKey(
+            MqttTagConfigKeys.Topic,
+            TryGetField(addressFields, MqttTagConfigKeys.Topic) ?? fullName);
+    }
+
+    /// <summary>
+    /// Describes why a selected browse leaf cannot be committed as a working tag, or <c>null</c> when it
+    /// can. The AdminUI calls this before mapping so an unbindable selection fails <b>at commit, in
+    /// words</b>.
+    /// </summary>
+    /// <param name="driverType">The owning device's driver type.</param>
+    /// <param name="browseName">The leaf's browse name, for the message.</param>
+    /// <param name="addressFields">The structured address the browse session stated, if any.</param>
+    /// <returns>The operator-facing reason, or <c>null</c> when the leaf is committable.</returns>
+    /// <remarks>
+    ///     Only MQTT can fail this today, and only in one shape: a leaf whose attribute lookup returned
+    ///     nothing, so no address was stated. Committing it anyway is the defect this whole seam exists
+    ///     to close — a Sparkplug tuple cannot be reconstructed from the node id, so the row would deploy
+    ///     clean and then report <c>BadNodeIdUnknown</c> forever with nothing to point at. Every
+    ///     single-reference driver is unaffected: its address IS the node id.
+    /// </remarks>
+    public static string? DescribeUncommittableLeaf(
+        string driverType,
+        string browseName,
+        IReadOnlyDictionary<string, string>? addressFields)
+    {
+        if (!Is(driverType, DriverTypeNames.Mqtt)) return null;
+        if (TryGetField(addressFields, MqttTagConfigKeys.MetricName) is not null) return null;
+        if (TryGetField(addressFields, MqttTagConfigKeys.Topic) is not null) return null;
+
+        return $"'{browseName}' could not be committed: the browse session reported no MQTT address for it "
+             + "(its attribute lookup returned nothing). Re-open the browser and re-select it, or author "
+             + "the tag manually.";
+    }
+
+    /// <summary>Reads one non-blank address field, or <c>null</c> when it is absent or blank.</summary>
+    /// <param name="fields">The stated address fields, or null.</param>
+    /// <param name="key">The field to read.</param>
+    /// <returns>The trimmed value, or <c>null</c>.</returns>
+    private static string? TryGetField(IReadOnlyDictionary<string, string>? fields, string key)
+        => fields is not null && fields.TryGetValue(key, out var v) && !string.IsNullOrWhiteSpace(v)
+            ? v.Trim()
+            : null;
+
     /// <summary>
     /// Combines a target-group path prefix with an optional mirrored sub-path, matching the WP5 CSV import
     /// combine semantics: blank collapses to null, and a present prefix + suffix join with the RawPath

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Uns/TagEditors/MqttTagConfigModel.cs

@@ -0,0 +1,396 @@
+using System.Text.Json.Nodes;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.Mqtt;
+
+namespace ZB.MOM.WW.OtOpcUa.AdminUI.Uns.TagEditors;
+
+/// <summary>
+///     Typed working model for an MQTT tag's TagConfig JSON — the driver-specific binding fields
+///     (name / access level / writability live on the Tag entity). Preserves unrecognised JSON keys
+///     across a load→save.
+/// </summary>
+/// <remarks>
+///     <para>
+///     The authoritative consumer of the produced blob is
+///     <c>MqttTagDefinitionFactory.FromTagConfig</c> (<c>Driver.Mqtt.Contracts</c>); every key name and
+///     strictness rule here mirrors that factory rather than inventing an editor-side schema.
+///     </para>
+///     <para>
+///     <b>There is deliberately no <c>FullName</c> (or any other identity) key.</b> Under the v3
+///     identity contract a tag is identified by its <b>RawPath</b> — the factory keys the produced
+///     definition's <c>Name</c> off the RawPath it is handed, and the TagConfig is a pure address blob.
+///     Writing a composed identity key here would be dead weight nothing reads.
+///     </para>
+///     <para>
+///     <see cref="Mode"/> is a <b>UI-only</b> sub-shape selector, inferred from the blob (the presence
+///     of any Sparkplug descriptor key) and never serialised — the driver takes its
+///     <c>Plain</c>/<c>SparkplugB</c> mode from the <em>driver</em> config, not from a tag, so
+///     persisting a per-tag <c>mode</c> key would add a field the contract does not define.
+///     Consequently a SparkplugB tag survives a save→reopen purely because the descriptor keys it
+///     writes (<see cref="GroupId"/>/<see cref="EdgeNodeId"/>/<see cref="DeviceId"/>/
+///     <see cref="MetricName"/>) re-infer the mode on the next load — there is nothing else to persist.
+///     </para>
+/// </remarks>
+public sealed class MqttTagConfigModel
+{
+    private const string TopicKey = "topic";
+    private const string PayloadFormatKey = "payloadFormat";
+    private const string JsonPathKey = "jsonPath";
+    private const string DataTypeKey = "dataType";
+    private const string QosKey = "qos";
+    private const string RetainSeedKey = "retainSeed";
+    private const string GroupIdKey = "groupId";
+    private const string EdgeNodeIdKey = "edgeNodeId";
+    private const string DeviceIdKey = "deviceId";
+    private const string MetricNameKey = "metricName";
+
+    /// <summary>
+    ///     The JSONPath the driver applies when the blob omits <c>jsonPath</c> — the document root.
+    ///     Seeded into an unauthored tag's field so the "no extraction needed" case is one click away
+    ///     rather than something the operator has to know.
+    /// </summary>
+    private const string RootJsonPath = "$";
+
+    /// <summary>The Sparkplug B descriptor keys — any non-blank one marks a tag SparkplugB (see <see cref="InferMode"/>).</summary>
+    private static readonly string[] SparkplugKeys = [GroupIdKey, EdgeNodeIdKey, DeviceIdKey, MetricNameKey];
+
+    /// <summary>The MQTT wildcard characters; a tag's subscription topic must be concrete.</summary>
+    private static readonly char[] TopicWildcards = ['+', '#'];
+
+    /// <summary>
+    ///     Characters illegal in a Sparkplug group/edge-node/device id. <c>/</c> is rejected because
+    ///     these ids are literal MQTT topic segments — a decoded incoming id can never contain one
+    ///     (the broker has already split the topic into segments before the driver sees it), so an
+    ///     authored id containing <c>/</c> could never match a real birth: a permanently dead binding,
+    ///     not an ambiguous one. <c>+</c>/<c>#</c> are rejected for the same "no legitimate
+    ///     interpretation" reason the Plain topic wildcard check uses — here doubly so, since
+    ///     <see cref="MqttDriverOptions.GroupId"/>'s only consumer builds the literal subscription
+    ///     filter <c>spBv1.0/{GroupId}/#</c>, and embedding a wildcard character mid-segment is not
+    ///     even legal there. <b>Not enforced by <c>MqttTagDefinitionFactory.FromSparkplugTagConfig</c></b>
+    ///     — this is an editor-side rule stricter than the runtime parser, the same shape as the Plain
+    ///     topic-wildcard rule below.
+    /// </summary>
+    private static readonly char[] SparkplugSegmentIllegalChars = ['/', '+', '#'];
+
+    /// <summary>
+    ///     Which ingest shape this tag is authored under — inferred from the blob, never serialised.
+    /// </summary>
+    public MqttMode Mode { get; set; } = MqttMode.Plain;
+
+    /// <summary>The concrete MQTT topic the tag subscribes to (Plain mode). Required; no wildcards.</summary>
+    public string Topic { get; set; } = "";
+
+    /// <summary>How the received payload is decoded (Plain mode).</summary>
+    public MqttPayloadFormat PayloadFormat { get; set; } = MqttPayloadFormat.Json;
+
+    /// <summary>
+    ///     JSONPath selecting the value inside a <see cref="MqttPayloadFormat.Json"/> payload. Blank is
+    ///     legal and NOT a validation failure — the key is omitted and the driver applies the document
+    ///     root (<c>$</c>), which is the real "publisher puts a bare JSON scalar on the topic" case.
+    ///     An <b>unauthored</b> tag is seeded with <c>$</c> by <see cref="FromJson"/> so that common case
+    ///     is visible and one click away; see <see cref="RootJsonPath"/>.
+    /// </summary>
+    public string JsonPath { get; set; } = "";
+
+    /// <summary>The tag's declared value type (Plain mode; always written). The driver's <see cref="DriverDataType"/> set.</summary>
+    public DriverDataType DataType { get; set; } = DriverDataType.String;
+
+    /// <summary>
+    ///     Per-tag subscription QoS (0–2), or <c>null</c> to omit the key and inherit the driver-level
+    ///     default. An absent key stays absent through a load→save. Shared by both modes —
+    ///     <c>MqttTagDefinitionFactory</c> reads <c>qos</c> identically for Plain and Sparkplug.
+    /// </summary>
+    public int? Qos { get; set; }
+
+    /// <summary>
+    ///     Whether the broker's retained message seeds the tag's initial value, or <c>null</c> to omit
+    ///     the key and inherit the driver's default (<c>true</c>). An absent key stays absent. Shared by
+    ///     both modes — <c>MqttTagDefinitionFactory</c> reads <c>retainSeed</c> identically for Plain and
+    ///     Sparkplug.
+    /// </summary>
+    public bool? RetainSeed { get; set; }
+
+    /// <summary>The Sparkplug group id (Sparkplug mode). Required; becomes part of the subscription filter.</summary>
+    public string GroupId { get; set; } = "";
+
+    /// <summary>The Sparkplug edge-node id (Sparkplug mode). Required.</summary>
+    public string EdgeNodeId { get; set; } = "";
+
+    /// <summary>
+    ///     The Sparkplug device id (Sparkplug mode), or blank for a metric published by the edge node
+    ///     itself rather than a device beneath it. Optional.
+    /// </summary>
+    public string DeviceId { get; set; } = "";
+
+    /// <summary>
+    ///     The Sparkplug metric's stable name (Sparkplug mode). Required. Unlike
+    ///     <see cref="GroupId"/>/<see cref="EdgeNodeId"/>/<see cref="DeviceId"/> this is NOT a topic
+    ///     segment — it is read from the birth/data payload — so it is deliberately unrestricted and MAY
+    ///     contain <c>/</c> (the canonical Sparkplug examples do: <c>Node Control/Rebirth</c>,
+    ///     <c>Properties/Hardware Make</c>).
+    /// </summary>
+    public string MetricName { get; set; } = "";
+
+    /// <summary>
+    ///     Sparkplug-mode data-type OVERRIDE (Sparkplug mode only), or <c>null</c> to omit the key and
+    ///     let the tag take whatever type the metric's birth certificate declares — the whole point of
+    ///     the driver's <c>UntilStable</c> discovery. Distinct from <see cref="DataType"/>, which is the
+    ///     always-written Plain-mode field; both read/write the same <c>dataType</c> JSON key
+    ///     (<c>MqttTagDefinitionFactory.FromSparkplugTagConfig</c> reads it as a <see cref="DriverDataType"/>
+    ///     override, strictly, when present — the same enum Plain mode uses, not the raw wire
+    ///     <c>SparkplugDataType</c>).
+    /// </summary>
+    public DriverDataType? MetricDataType { get; set; }
+
+    private JsonObject _bag = new();
+
+    /// <summary>
+    ///     Loads a model from a TagConfig JSON string, defaulting any absent field and retaining every
+    ///     original key (so fields this editor doesn't expose — history intent, array/alarm objects, and
+    ///     the Sparkplug descriptor keys — survive a load→save).
+    /// </summary>
+    /// <remarks>
+    ///     An <b>unauthored</b> Plain tag — no <c>topic</c> AND no <c>jsonPath</c>, i.e. a brand-new tag
+    ///     rather than an existing one the operator deliberately left path-less — has its
+    ///     <see cref="JsonPath"/> seeded to <see cref="RootJsonPath"/>. The condition is deliberately
+    ///     narrow: an existing tag that carries a topic and no <c>jsonPath</c> keeps the key ABSENT
+    ///     through a load→save, so this can never rewrite already-deployed blobs.
+    /// </remarks>
+    /// <param name="json">The raw TagConfig JSON string, or <c>null</c> for a new/empty config.</param>
+    /// <returns>The populated <see cref="MqttTagConfigModel"/>.</returns>
+    public static MqttTagConfigModel FromJson(string? json)
+    {
+        var o = TagConfigJson.ParseOrNew(json);
+        var topic = TagConfigJson.GetString(o, TopicKey) ?? "";
+        var jsonPath = TagConfigJson.GetString(o, JsonPathKey) ?? "";
+        var mode = InferMode(o);
+        if (mode == MqttMode.Plain && topic.Length == 0 && jsonPath.Length == 0) { jsonPath = RootJsonPath; }
+
+        return new MqttTagConfigModel
+        {
+            Mode = mode,
+            Topic = topic,
+            PayloadFormat = TagConfigJson.GetEnum(o, PayloadFormatKey, MqttPayloadFormat.Json),
+            JsonPath = jsonPath,
+            DataType = TagConfigJson.GetEnum(o, DataTypeKey, DriverDataType.String),
+            Qos = GetIntNullable(o, QosKey),
+            RetainSeed = TagConfigJson.GetBoolNullable(o, RetainSeedKey),
+            GroupId = TagConfigJson.GetString(o, GroupIdKey) ?? "",
+            EdgeNodeId = TagConfigJson.GetString(o, EdgeNodeIdKey) ?? "",
+            DeviceId = TagConfigJson.GetString(o, DeviceIdKey) ?? "",
+            MetricName = TagConfigJson.GetString(o, MetricNameKey) ?? "",
+            // Same "dataType" key as Plain's DataType above, read as an optional override — see the
+            // MetricDataType doc comment for why there are two typed fields over one JSON key.
+            MetricDataType = GetEnumNullable<DriverDataType>(o, DataTypeKey),
+            _bag = o,
+        };
+    }
+
+    /// <summary>
+    ///     Serialises this model back to a TagConfig JSON string over the preserved key bag. Enums are
+    ///     written as their <b>names</b> (the driver reads them strictly by name; an ordinal would be
+    ///     rejected outright), and blank/null optionals are written as an absent key so the driver's own
+    ///     defaults apply.
+    /// </summary>
+    /// <remarks>
+    ///     <c>dataType</c> is the one key both modes write, from two different typed fields
+    ///     (<see cref="DataType"/> for Plain — always present; <see cref="MetricDataType"/> for
+    ///     Sparkplug — omitted unless the operator set an override): which field wins is decided by
+    ///     <see cref="Mode"/> at write time. Every other key is unconditional — mode-inapplicable keys
+    ///     (e.g. <c>topic</c> while Sparkplug, or <c>groupId</c> while Plain) are written/cleared exactly
+    ///     as their typed field says, which naturally preserves a retyped tag's other-mode leftovers
+    ///     untouched until the operator edits that field too.
+    /// </remarks>
+    /// <returns>The serialised TagConfig JSON string.</returns>
+    public string ToJson()
+    {
+        // Blank ⇒ omit, like every other optional here: toggling the shape dropdown on an untouched tag
+        // must not leave a stray "topic":"" behind.
+        TagConfigJson.Set(_bag, TopicKey, string.IsNullOrWhiteSpace(Topic) ? null : Topic.Trim());
+        TagConfigJson.Set(_bag, PayloadFormatKey, PayloadFormat);
+        TagConfigJson.Set(_bag, JsonPathKey, string.IsNullOrWhiteSpace(JsonPath) ? null : JsonPath.Trim());
+        TagConfigJson.Set(_bag, QosKey, Qos);
+        TagConfigJson.Set(_bag, RetainSeedKey, RetainSeed);
+
+        // Mode-dependent: Plain always writes DataType; Sparkplug writes MetricDataType (null ⇒ omitted,
+        // "take the birth's declared type").
+        TagConfigJson.Set(_bag, DataTypeKey, Mode == MqttMode.SparkplugB ? MetricDataType : DataType);
+
+        TagConfigJson.Set(_bag, GroupIdKey, string.IsNullOrWhiteSpace(GroupId) ? null : GroupId.Trim());
+        TagConfigJson.Set(_bag, EdgeNodeIdKey, string.IsNullOrWhiteSpace(EdgeNodeId) ? null : EdgeNodeId.Trim());
+        TagConfigJson.Set(_bag, DeviceIdKey, string.IsNullOrWhiteSpace(DeviceId) ? null : DeviceId.Trim());
+        TagConfigJson.Set(_bag, MetricNameKey, string.IsNullOrWhiteSpace(MetricName) ? null : MetricName.Trim());
+        return TagConfigJson.Serialize(_bag);
+    }
+
+    /// <summary>
+    ///     Client-side validation run by <see cref="TagConfigValidator"/> before a tag is saved.
+    ///     Returns the first error, or <c>null</c> when the config is valid.
+    /// </summary>
+    /// <remarks>
+    ///     <para>
+    ///     Exactly ONE rule is deliberately <b>stricter</b> than the runtime parser: a wildcard topic,
+    ///     which the runtime accepts and <c>Inspect</c> only warns about at deploy. It earns the
+    ///     strictness because a wildcard has no legitimate single-Tag interpretation — one Tag holds one
+    ///     value, and <c>+</c>/<c>#</c> would feed it from many source topics. Everything else —
+    ///     required topic, strict enums, QoS 0–2 — matches <c>MqttTagDefinitionFactory</c> exactly.
+    ///     </para>
+    ///     <para>
+    ///     A blank <c>jsonPath</c> under a <c>Json</c> payload is explicitly <b>accepted</b>, matching
+    ///     the runtime's document-root default. Rejecting it would make this editor refuse a config the
+    ///     driver handles happily — inverting the "authoring surface accepts ⇔ publish accepts"
+    ///     principle — and, because this validator also gates the CSV-import review grid
+    ///     (<c>RawManualTagEntryModal</c>), would block whole import batches over a sane default. The
+    ///     operator is guided by the seeded <c>$</c> from <see cref="FromJson"/> instead of a blocker.
+    ///     </para>
+    ///     <para>
+    ///     The strict enum/QoS checks read the ORIGINAL key bag, not the defaulted typed fields, so a
+    ///     blob that never went through this editor (e.g. a CSV import) cannot pass validation while the
+    ///     driver would reject it.
+    ///     </para>
+    ///     <para>
+    ///     <b>Sparkplug rules mirror <c>MqttTagDefinitionFactory.FromSparkplugTagConfig</c></b>:
+    ///     <c>groupId</c>/<c>edgeNodeId</c>/<c>metricName</c> required (blank rejected exactly as the
+    ///     factory hard-rejects them), <c>deviceId</c> optional, <c>dataType</c> and <c>qos</c> read
+    ///     strictly but ONLY when present (matching <c>TryReadEnumStrict</c>'s absent/valid/invalid
+    ///     split — a Sparkplug tag legitimately omits <c>dataType</c> and takes whatever the birth
+    ///     certificate declares). Plain-only fields (<c>topic</c>, <c>payloadFormat</c>, <c>jsonPath</c>)
+    ///     are NOT checked in this mode, matching the factory's "Plain-shape keys are read but not
+    ///     required" stance for a retyped blob's leftovers.
+    ///     </para>
+    ///     <para>
+    ///     ONE Sparkplug rule is likewise stricter than the factory: <c>groupId</c>/<c>edgeNodeId</c>/
+    ///     <c>deviceId</c> reject <c>/</c>, <c>+</c>, and <c>#</c> — see
+    ///     <see cref="SparkplugSegmentIllegalChars"/> for why (a decoded incoming id can never contain
+    ///     one, so an authored id that does is a permanently dead binding, and <c>+</c>/<c>#</c> would
+    ///     corrupt the driver's own subscription filter). <c>metricName</c> carries NO such restriction —
+    ///     it is not a topic segment, and Sparkplug's own canonical metric names use <c>/</c> (e.g.
+    ///     <c>Node Control/Rebirth</c>); rejecting it would block legitimate authoring.
+    ///     </para>
+    /// </remarks>
+    /// <returns>An error message describing the validation failure, or <c>null</c> when valid.</returns>
+    public string? Validate()
+    {
+        if (Mode == MqttMode.SparkplugB) { return ValidateSparkplug(); }
+
+        if (DescribeInvalidEnum<MqttPayloadFormat>(_bag, PayloadFormatKey) is { } pfError) { return pfError; }
+        if (DescribeInvalidEnum<DriverDataType>(_bag, DataTypeKey) is { } dtError) { return dtError; }
+        if (DescribeInvalidQos(_bag) is { } qosError) { return qosError; }
+
+        var topic = Topic.Trim();
+        if (string.IsNullOrEmpty(topic)) { return "A topic is required."; }
+        if (topic.IndexOfAny(TopicWildcards) >= 0)
+        {
+            return $"Topic '{topic}' contains an MQTT wildcard (+ or #); a tag's topic must be concrete, "
+                 + "or the tag would be fed by every matching topic.";
+        }
+
+        // NB no jsonPath rule — see the remarks above. A blank path is the driver's document-root
+        // default, not an authoring error.
+        return null;
+    }
+
+    /// <summary>Sparkplug-mode half of <see cref="Validate"/> — see its remarks for the full rationale.</summary>
+    /// <returns>An error message describing the validation failure, or <c>null</c> when valid.</returns>
+    private string? ValidateSparkplug()
+    {
+        // Same DriverDataType enum + same strict absent/valid/invalid split as Plain's DataType check —
+        // dataType is one JSON key read by both FromTagConfig and FromSparkplugTagConfig identically.
+        if (DescribeInvalidEnum<DriverDataType>(_bag, DataTypeKey) is { } dtError) { return dtError; }
+        if (DescribeInvalidQos(_bag) is { } qosError) { return qosError; }
+
+        var groupId = GroupId.Trim();
+        var edgeNodeId = EdgeNodeId.Trim();
+        var deviceId = DeviceId.Trim();
+        var metricName = MetricName.Trim();
+
+        if (string.IsNullOrEmpty(groupId)) { return "A Sparkplug group ID is required."; }
+        if (string.IsNullOrEmpty(edgeNodeId)) { return "A Sparkplug edge node ID is required."; }
+        if (string.IsNullOrEmpty(metricName)) { return "A Sparkplug metric name is required."; }
+
+        if (DescribeInvalidSparkplugSegment("group ID", groupId) is { } gErr) { return gErr; }
+        if (DescribeInvalidSparkplugSegment("edge node ID", edgeNodeId) is { } eErr) { return eErr; }
+        // deviceId is optional — only validated when the operator actually supplied one.
+        if (deviceId.Length > 0 && DescribeInvalidSparkplugSegment("device ID", deviceId) is { } dErr) { return dErr; }
+
+        return null;
+    }
+
+    /// <summary>
+    ///     Describes an <paramref name="value"/> that is illegal as a Sparkplug group/edge-node/device
+    ///     id segment (see <see cref="SparkplugSegmentIllegalChars"/>), or <c>null</c> when clean.
+    /// </summary>
+    /// <param name="fieldLabel">The human-readable field name for the error message.</param>
+    /// <param name="value">The trimmed, non-blank field value to check.</param>
+    /// <returns>The error text, or <c>null</c>.</returns>
+    private static string? DescribeInvalidSparkplugSegment(string fieldLabel, string value)
+        => value.IndexOfAny(SparkplugSegmentIllegalChars) >= 0
+            ? $"Sparkplug {fieldLabel} '{value}' contains a character ('/', '+', or '#') that cannot appear " +
+              "in an MQTT topic segment; a decoded incoming id can never contain one, so this could never bind."
+            : null;
+
+    /// <summary>
+    ///     Infers the editor's sub-shape from the blob: any non-blank Sparkplug descriptor key marks a
+    ///     Sparkplug tag, otherwise Plain.
+    /// </summary>
+    /// <param name="o">The parsed TagConfig key bag.</param>
+    /// <returns>The inferred mode.</returns>
+    private static MqttMode InferMode(JsonObject o)
+        => SparkplugKeys.Any(k => !string.IsNullOrWhiteSpace(TagConfigJson.GetString(o, k)))
+            ? MqttMode.SparkplugB
+            : MqttMode.Plain;
+
+    /// <summary>Reads an int value, or <c>null</c> when absent/null/not an integer (so an absent key stays absent).</summary>
+    /// <param name="o">The JSON object to read from.</param>
+    /// <param name="name">The property name to read.</param>
+    /// <returns>The int value, or <c>null</c>.</returns>
+    private static int? GetIntNullable(JsonObject o, string name)
+        => o.TryGetPropertyValue(name, out var n) && n is JsonValue v && v.TryGetValue<int>(out var i) ? i : null;
+
+    /// <summary>
+    ///     Reads an enum by its serialised name, or <c>null</c> when absent/unparseable — the nullable
+    ///     counterpart of <see cref="TagConfigJson.GetEnum{TEnum}"/>, used for <see cref="MetricDataType"/>
+    ///     so "the key is absent" (take the birth's declared type) is distinguishable from any real member.
+    /// </summary>
+    /// <typeparam name="TEnum">The enum type to parse.</typeparam>
+    /// <param name="o">The JSON object to read from.</param>
+    /// <param name="name">The property name to read.</param>
+    /// <returns>The parsed enum value, or <c>null</c>.</returns>
+    private static TEnum? GetEnumNullable<TEnum>(JsonObject o, string name) where TEnum : struct, Enum
+        => TagConfigJson.GetString(o, name) is { } s && Enum.TryParse<TEnum>(s, ignoreCase: true, out var v) ? v : null;
+
+    /// <summary>
+    ///     Describes a present-but-invalid enum field, or <c>null</c> when it is absent or valid.
+    ///     Mirrors <c>TagConfigJson.TryReadEnum</c>'s absent/valid/invalid split exactly — including its
+    ///     treatment of a present-but-non-string value as ABSENT — so the editor never blocks a blob the
+    ///     driver would happily default.
+    /// </summary>
+    /// <typeparam name="TEnum">The enum type expected.</typeparam>
+    /// <param name="o">The TagConfig key bag.</param>
+    /// <param name="name">The property name to describe.</param>
+    /// <returns>The error text, or <c>null</c>.</returns>
+    private static string? DescribeInvalidEnum<TEnum>(JsonObject o, string name) where TEnum : struct, Enum
+    {
+        if (!o.TryGetPropertyValue(name, out var n) || n is not JsonValue v || !v.TryGetValue<string>(out var raw))
+        {
+            return null;
+        }
+        return Enum.TryParse<TEnum>(raw, ignoreCase: true, out _)
+            ? null
+            : $"'{raw}' is not a valid {name}; valid: {string.Join(", ", Enum.GetNames<TEnum>())}.";
+    }
+
+    /// <summary>
+    ///     Describes a present-but-invalid <c>qos</c> field, or <c>null</c> when it is absent or a legal
+    ///     MQTT QoS. Matches the factory's strict read: absent ⇒ fine; a JSON integer 0–2 ⇒ fine;
+    ///     anything else present (non-number, non-integer, out of range) ⇒ rejected.
+    /// </summary>
+    /// <param name="o">The TagConfig key bag.</param>
+    /// <returns>The error text, or <c>null</c>.</returns>
+    private static string? DescribeInvalidQos(JsonObject o)
+    {
+        if (!o.TryGetPropertyValue(QosKey, out var n) || n is null) { return null; }
+        if (n is JsonValue v && v.TryGetValue<int>(out var i) && i is >= 0 and <= 2) { return null; }
+        return $"'{n.ToJsonString()}' is not a valid QoS; valid: 0, 1, 2.";
+    }
+}

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Uns/TagEditors/TagConfigEditorMap.cs

@@ -26,6 +26,7 @@ public static class TagConfigEditorMap
             // constant is deliberately absent until Task 11 wires the factory (DriverTypeNamesGuardTests
             // asserts bidirectional parity). Task 11 repoints all Sql keys onto DriverTypeNames.Sql.
             [SqlDriver.DriverTypeName]     = typeof(Components.Shared.Uns.TagEditors.SqlTagConfigEditor),
+            [DriverTypeNames.Mqtt]        = typeof(Components.Shared.Uns.TagEditors.MqttTagConfigEditor),
         };
 
     /// <summary>Returns the editor component type for a driver type, or null if none is registered.</summary>

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Uns/TagEditors/TagConfigValidator.cs

@@ -26,6 +26,7 @@ public static class TagConfigValidator
             [DriverTypeNames.Calculation] = j => CalculationTagConfigModel.FromJson(j).Validate(),
             // Keyed off SqlDriver.DriverTypeName (= "Sql") — see the note in TagConfigEditorMap.
             [SqlDriver.DriverTypeName]     = j => SqlTagConfigModel.FromJson(j).Validate(),
+            [DriverTypeNames.Mqtt]        = j => MqttTagConfigModel.FromJson(j).Validate(),
         };
 
     /// <summary>

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/ZB.MOM.WW.OtOpcUa.AdminUI.csproj

@@ -43,6 +43,7 @@
              Driver.Sql + .Contracts + Microsoft.Data.SqlClient transitively — reviewed/accepted, see
              the Browser project's own csproj comment (AdminUI already carries SqlClient for ConfigDb). -->
         <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser\ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.csproj"/>
+        <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser\ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser.csproj"/>
     </ItemGroup>
 
 </Project>

src/Server/ZB.MOM.WW.OtOpcUa.Host/Drivers/DriverFactoryBootstrap.cs

@@ -19,6 +19,7 @@ using OpcUaProbe     = Driver.OpcUaClient.OpcUaClientDriverProbe;
 using GalaxyProbe    = Driver.Galaxy.GalaxyDriverProbe;
 using CalculationProbe = Driver.Calculation.CalculationDriverProbe;
 using SqlProbe       = Driver.Sql.SqlDriverProbe;
+using MqttProbe      = Driver.Mqtt.MqttDriverProbe;
 
 /// <summary>
 ///     Wires every cross-platform driver assembly's <c>Register(registry, loggerFactory)</c>
@@ -124,6 +125,7 @@ public static class DriverFactoryBootstrap
         services.TryAddEnumerable(ServiceDescriptor.Singleton<IDriverProbe, GalaxyProbe>());
         services.TryAddEnumerable(ServiceDescriptor.Singleton<IDriverProbe, CalculationProbe>());
         services.TryAddEnumerable(ServiceDescriptor.Singleton<IDriverProbe, SqlProbe>());
+        services.TryAddEnumerable(ServiceDescriptor.Singleton<IDriverProbe, MqttProbe>());
 
         return services;
     }
@@ -146,6 +148,7 @@ public static class DriverFactoryBootstrap
         Driver.FOCAS.FocasDriverFactoryExtensions.Register(registry);
         Driver.Galaxy.GalaxyDriverFactoryExtensions.Register(registry, secretResolver, loggerFactory);
         Driver.Modbus.ModbusDriverFactoryExtensions.Register(registry, loggerFactory);
+        Driver.Mqtt.MqttDriverFactoryExtensions.Register(registry, loggerFactory);
         Driver.OpcUaClient.OpcUaClientDriverFactoryExtensions.Register(registry, loggerFactory, secretResolver);
         Driver.S7.S7DriverFactoryExtensions.Register(registry);
         Driver.Sql.SqlDriverFactoryExtensions.Register(registry, loggerFactory);

src/Server/ZB.MOM.WW.OtOpcUa.Host/ZB.MOM.WW.OtOpcUa.Host.csproj

@@ -74,6 +74,7 @@
         <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.Galaxy\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.csproj"/>
         <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway\ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway.csproj"/>
         <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.Modbus\ZB.MOM.WW.OtOpcUa.Driver.Modbus.csproj"/>
+        <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.Mqtt\ZB.MOM.WW.OtOpcUa.Driver.Mqtt.csproj"/>
         <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj"/>
         <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.S7\ZB.MOM.WW.OtOpcUa.Driver.S7.csproj"/>
         <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.Sql\ZB.MOM.WW.OtOpcUa.Driver.Sql.csproj"/>