docs(mqtt): Sparkplug P2 live-verified; MQTT driver complete

Task 26 — the P2 milestone gate. Ran the live /run verification on an isolated
docker-dev rig (project otopcua-mqtt, ports 9210/4850-4851/14350, image built
from this branch) against the real Mosquitto TLS+auth broker and the C#
Sparkplug edge-node simulator on 10.100.0.35, and recorded the result.

The gate found three defects. Two are the same defect class the P1 gate found
twice — a hand-maintained AdminUI surface left behind by a driver-side feature —
and the third is a pre-existing cross-driver bug that only a Sparkplug flow
could surface.

  1. CRITICAL, FIXED — MqttDriverForm still shipped its P1 Sparkplug PLACEHOLDER.
     Switching Mode to SparkplugB rendered a "not available yet" notice and NO
     Group ID field, so with Sparkplug ingest fully shipped there was still no
     way to author a Sparkplug driver from the AdminUI at all. Sparkplug.GroupId
     is the driver's entire subscription filter (spBv1.0/{GroupId}/#): blank ⇒
     connected, Healthy, ingesting nothing. Now authors all five Sparkplug keys,
     MERGES over the existing sub-object rather than replacing it (so a key a
     newer driver adds inside it survives an older AdminUI), leaves it untouched
     in Plain mode, and validates the group id as the topic segment it is.
     Pinned by 8 MqttDriverFormModelTests cases, verified falsifiable — 8 RED
     with the fix stubbed out.

  2. PRE-EXISTING + CROSS-DRIVER, FIXED — every node label in the shared
     DriverBrowseTree was an <a href="#">. In a Blazor Web App, blazor.web.js's
     enhanced-navigation click interceptor resolves a bare "#" against
     <base href="/">, so clicking ANY browse-tree node label navigated the whole
     AdminUI to "/", tore down the circuit, and destroyed the hosting modal —
     losing the browse session AND the tag selection. @onclick:preventDefault
     does not help: it suppresses the browser's default action, not Blazor's own
     interceptor. Labels are now <button type="button">. Dates to the component's
     introduction (2026-05-28) and affects EVERY driver's picker; it surfaced
     only now because choosing a rebirth scope is the first flow that requires
     clicking a label rather than the ▶ toggle (always a button, always fine).

  3. FIXED (mitigation) — the browse tree rendered exactly once, at open, and
     never again, while OpenAsync returns as soon as the SUBSCRIBE is granted.
     On Sparkplug that means it is almost always empty forever, because births
     are never retained. Added a Refresh button that re-reads the root against
     the SAME session (nothing reconnects, nothing observed is lost, the tag
     selection is kept, only the armed rebirth scope is cleared).

Live gate result (all against the real broker + simulator, group OtOpcUaSim):

  - driver authored end-to-end through the fixed MqttDriverForm; blob is
    Mode:SparkplugB + Sparkplug.GroupId:OtOpcUaSim with enums as names
  - browse: BROWSER OPEN chip, Sparkplug-only rebirth panel, tree renders
    Group → EdgeNode → [Device] → Metric with the device folder Filler1 and
    node-level metric leaves SIDE BY SIDE, and "Node Control/Rebirth" as ONE
    leaf (the metric-name-is-not-a-topic-segment rule holding)
  - rebirth: group scope names the group + the 32-node cap, Cancel published
    NOTHING (simulator log unchanged); edge-node scope → "1 command published"
    and the simulator logged "rebirth NCMD #1 received; republishing metadata";
    group scope → "2 commands published", both edge nodes re-birthed; a device
    and a metric both resolve UP to "edge node EdgeA"; the panel does NOT render
    for a Plain MQTT device
  - browse-commit wrote bindable tuples with no topic/address key —
    {"groupId","edgeNodeId","metricName","deviceId"} for the device metric and
    deviceId ABSENT (not blank) for the node-level one, datatypes inherited from
    the birth (Int64 / Float)
  - deployed (Sealed), and both nodes served live changing values through OPC UA
    at the 2 s cadence — Good 0x00000000, no BadNodeIdUnknown
  - death→STALE: stopping the simulator drove both nodes to 0x80000000 with an
    empty value ~2 s later, and restarting it recovered them to Good on the new
    birth (FillCount back to its birth-declared 1000, then counting)
  - rediscovery fired exactly TWICE (once per authored scope: OtOpcUaSim/EdgeA
    7 metrics, OtOpcUaSim/EdgeA/Filler1 3 metrics) and was then gated across
    many subsequent births/rebirths — the anti-storm change gate working, and
    EdgeB correctly filtered out as an unauthored scope
  - tag editor: opens in SparkplugB (mode inference on reopen) with all four
    descriptor fields populated; blank group → "A Sparkplug group ID is
    required."; "Plant/1" rejected; "Node Control/Rebirth" ACCEPTED and saved
    with the slash whole; dataType override persists and its key is ABSENT again
    after selecting "(from birth certificate)"

Two things are NOT verified, and are recorded rather than claimed:

  - Rediscovery is INERT in v3 and this is a platform gap, not an MQTT one:
    nothing subscribes to IRediscoverable.OnRediscoveryNeeded and
    DriverHostActor.HandleDiscoveredNodes hard-returns. A DBIRTH introducing a
    metric does NOT change the OPC UA tree; redeploy. Verified from the driver's
    log line only, exactly as far as it can be verified.
  - A metric name containing "/" cannot be BROWSE-COMMITTED: the derived raw tag
    Name is a RawPath segment and may not contain "/", so the spec-mandatory
    "Node Control/Rebirth" is refused ("Row 3: Name must not contain '/'"). The
    refusal is loud and all-or-nothing, never a silently mis-bound tag, and
    Manual entry is the working path. Fixing it needs a name-sanitisation policy
    with a collision answer, so it was recorded rather than guessed at.

Also left open + documented: an empty browse tree cannot arm a rebirth (the
scope comes from a tree click, and the session side already accepts a bare
{group}/{edgeNode} — only a UI path is missing); _canRebirth is captured at
browse-open; the tag editor injects the Plain-only payloadFormat key into a
Sparkplug blob (cosmetic — the factory routes on the tuple).

Suites: offline 1528 passed / 0 failed (581 Driver.Mqtt + 809 AdminUI + 138
Core.Abstractions); live 15/15 against the broker + simulator.

Docs: docs/drivers/Mqtt.md brought fully up to date for P2 (Sparkplug config
sub-object, both tag shapes, the ingest state machine, rediscovery, browse +
rebirth + Refresh, a Known-gaps table); Mqtt-Test-Fixture.md gains the simulator
and drops its "Sparkplug has no fixture" claims; infra/README.md §3 gains the
simulator row; CLAUDE.md gains the simulator endpoint facts; the tracking doc
marks MQTT/Sparkplug COMPLETE. docker-dev/docker-compose.mqtt.yml is the
isolated-rig overlay the gate ran on.

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW

docs/drivers/Mqtt-Test-Fixture.md

@@ -2,15 +2,18 @@
 
 Coverage map + gap inventory for the MQTT driver's harness.
 
-**TL;DR:** the unit suite (266 tests) carries the mapping, indexing and failure-classification logic;
-the live suite (7 tests) proves the parts only a real broker can prove — TLS, real authentication, CA
-pinning in both directions, retained-message seeding, and that a rejected CONNACK is actually
-surfaced. Sparkplug B has **no fixture at all** — it is unimplemented (P2).
+**TL;DR:** the unit suite (581 tests) carries the mapping, indexing, Sparkplug state-machine and
+failure-classification logic; the live suite (15 tests) proves the parts only a real broker can prove
+— TLS, real authentication, CA pinning in both directions, retained-message seeding, that a rejected
+CONNACK is actually surfaced, and the Sparkplug birth/alias/rebirth/death path against a real
+edge-node simulator.
 
 ## What the fixture is
 
 `eclipse-mosquitto:2.0.22` plus a second container of the same image running `publisher/publish.sh`
-(the image ships `mosquitto_pub`, so no bespoke image is needed). Compose lives at
+(the image ships `mosquitto_pub`, so no bespoke image is needed), plus — behind the `sparkplug`
+compose profile — **`otopcua-sparkplug-sim`**, a project-owned C# Sparkplug-B edge-node simulator
+(`tests/Drivers/….Driver.Mqtt.IntegrationTests/SparkplugSimulator/`). Compose lives at
 `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/Docker/`; the deployed stack is
 `/opt/otopcua-mqtt` on the shared Docker host.
 
@@ -48,15 +51,38 @@ wrong password is rejected **and surfaced** (the MQTTnet-5 silent-`Healthy` defe
 subscribe→value under a RawPath; retained message seeds a value on subscribe; and an unauthored topic
 stays silent while an authored tag keeps flowing.
 
+### The Sparkplug simulator
+
+Group **`OtOpcUaSim`**; edge nodes **`EdgeA`** and **`EdgeB`**; `EdgeA` additionally publishes device
+**`Filler1`**. Node metrics `Temperature` (Float), `Pressure` (Double), `Count` (Int32), `Running`
+(Boolean), `Serial` (String) plus the mandatory `bdSeq` and **`Node Control/Rebirth`** — the last one
+deliberately carries a `/`, so it exercises the "a metric name is not a topic segment" rule. Device
+metrics: `Temperature` (Float), `FillCount` (Int64), `Jammed` (Boolean). Cadence ~2 s.
+
+It **subscribes to `spBv1.0/OtOpcUaSim/NCMD/{node}`** and re-births on a rebirth request, so it
+exercises the real NCMD round trip rather than simulating it. Births are not retained (per spec), so
+`docker restart otopcua-sparkplug-sim` is the way to force a fresh birth on demand:
+
+```bash
+ssh dohertj2@10.100.0.35 'cd /opt/otopcua-mqtt && docker compose --profile sparkplug up -d'
+ssh dohertj2@10.100.0.35 'docker restart otopcua-sparkplug-sim'   # force a birth
+ssh dohertj2@10.100.0.35 'docker logs -f otopcua-sparkplug-sim'
+```
+
 Live-gated end-to-end (2026-07-24, P1 milestone): deployed on the docker-dev rig against this fixture,
 both tags resolved and served changing values through OPC UA, and the AdminUI `#`-observation picker
-rendered the real topic tree.
+rendered the real topic tree. Re-gated for P2 (2026-07-25) against the Sparkplug simulator — see
+[Mqtt.md](Mqtt.md).
 
 ## What it does NOT cover
 
-### 1. Sparkplug B — entirely
-No edge-node simulator exists. Birth/alias/seq-gap/rebirth/death are P2 (Tasks 15–26) and the
-project-owned C# simulator is part of that work.
+### 1. Sparkplug primary-host STATE, and write-through
+The simulator never observes a Host Application `STATE`, because the driver never publishes one
+(`ActAsPrimaryHost` is unimplemented). Nor is there any DCMD/NCMD **command** coverage: rebirth is the
+only NCMD the driver ever sends, and `IWritable` is deferred.
+
+Sparkplug **seq-gap injection** is unit-proven only — the simulator always publishes a well-formed
+monotonic `seq`, so no live test drives the gap → rebirth path end-to-end.
 
 ### 2. Broker-side failure injection
 No test kills the broker mid-session, partitions the network, or forces a SUBACK failure against a
@@ -87,14 +113,17 @@ test. No automated coverage asserts that two concurrent drivers coexist.
 | Does the driver ignore unauthored traffic? | ✅ yes |
 | Does it survive a broker restart / flapping link? | ❌ unit-only |
 | Does it hold up at plant tag counts? | ❌ no |
-| Anything Sparkplug B | ❌ not implemented |
+| Does a Sparkplug birth → alias → DATA → death cycle work? | ✅ yes (live, vs. the simulator) |
+| Does an NCMD rebirth request actually get answered? | ✅ yes (the simulator subscribes + re-births) |
+| Sparkplug seq-gap → rebirth | ❌ unit-only (the sim never skips a seq) |
+| Sparkplug primary-host STATE / DCMD writes | ❌ not implemented |
 
 ## Follow-up candidates
 
 1. Broker-restart / SUBACK-failure live tests (closes gap 2).
 2. A live wildcard-across-reconnect test (closes gap 3).
 3. A concurrent-two-driver test pinning the client-id hazard (closes gap 6).
-4. The Sparkplug edge-node simulator + its rebirth/seq-gap/death matrix (P2).
+4. A seq-gap injection switch on the simulator, closing the last unit-only Sparkplug leg.
 
 ## Key fixture / config files
 

docs/drivers/Mqtt.md

@@ -4,11 +4,19 @@ In-process MQTT **broker-subscribe** driver. It holds one MQTTnet 5 client again
 subscribes to the topics its authored tags name, and forwards each PUBLISH straight to
 `ISubscribable.OnDataChange`. Ingest is **push, not poll**, and **one-way** — there is no `IWritable`.
 
-Sparkplug B is **P2** and not implemented: `mode: SparkplugB` is a placeholder everywhere it appears.
+**Two ingest shapes, selected by the driver's `Mode`:** `Plain` binds a tag to a concrete MQTT topic;
+`SparkplugB` binds it to a `group / edge node / device? / metric` tuple and decodes Eclipse-Tahu
+protobuf under one `spBv1.0/{GroupId}/#` subscription. Both run over the same single client.
+
 See [Mqtt-Test-Fixture.md](Mqtt-Test-Fixture.md) for the harness and
 [`../plans/2026-07-15-mqtt-sparkplug-driver-design.md`](../plans/2026-07-15-mqtt-sparkplug-driver-design.md)
 for the design.
 
+> **Status.** P1 (plain MQTT) and P2 (Sparkplug B ingest) are both shipped and live-gated against the
+> Mosquitto + Sparkplug-simulator fixture. Write-through (`IWritable` — NCMD/DCMD/plain publish) is
+> **deferred**; every MQTT node materializes read-only. See
+> [Known gaps](#known-gaps) for what is wired but not yet end-to-end observable.
+
 ## Project Layout
 
 | Project | Holds |
@@ -33,15 +41,15 @@ public sealed class MqttDriver
 | Capability | Entry point | Notes |
 |---|---|---|
 | `IDriver` | `InitializeAsync` / `ReinitializeAsync` / `ShutdownAsync` / `GetHealth` | Order **register → attach → connect** is contractual. `ReinitializeAsync` applies a tag-only delta in place, and rebuilds the session when the broker identity changed |
-| `ITagDiscovery` | `DiscoverAsync` | Replays **only the authored `rawTags`** into an `Mqtt` folder. `SupportsOnlineDiscovery => false`, `RediscoverPolicy => Once` — *a broker's live topic set is not a tag catalogue* |
+| `ITagDiscovery` | `DiscoverAsync` | Replays **only the authored `rawTags`** into an `Mqtt` folder. `SupportsOnlineDiscovery => false`. `RediscoverPolicy` is `Once` in Plain and **`UntilStable` in Sparkplug** (half of what a Sparkplug tag needs — its datatype — is only knowable from a birth) |
 | `ISubscribable` | `SubscribeAsync` / `OnDataChange` | One SUBSCRIBE per distinct authored topic. **`publishingInterval` is ignored** — MQTT is push-based; this driver neither polls nor throttles |
 | `IReadable` | `ReadAsync` | Serves the last received/retained value from `LastValueCache`; never throws. A never-seen tag reads `BadWaitingForInitialData` |
 | `IHostConnectivityProbe` | `GetHostStatuses` | 1-second poll of `MqttConnection.State`; `HostName` is `"{host}:{port}"` |
-| `IRediscoverable` | `OnRediscoveryNeeded` | **Seam only** — nothing raises it in Plain mode. Sparkplug DBIRTH will |
+| `IRediscoverable` | `OnRediscoveryNeeded` | Nothing raises it in Plain mode. **Sparkplug raises it** when a birth for an *authored* scope carries a metric-name set different from the last one seen for that scope — both conditions are anti-storm, see [Rediscovery](#rediscovery-sparkplug) |
 
 **Not implemented:** `IWritable`, `IPerCallHostResolver`, `IAlarmSource`, `IHistoryProvider`.
 Materialized nodes are `SecurityClassification.ViewOnly`, `IsAlarm: false`, `IsHistorized: false` —
-*"MQTT ingest is one-way in P1 … ViewOnly rather than an Operate node whose writes would silently vanish."*
+*"MQTT ingest is one-way … ViewOnly rather than an Operate node whose writes would silently vanish."*
 
 Driver-type string: **`Mqtt`** (`DriverTypeNames.Mqtt`).
 
@@ -89,8 +97,38 @@ driver are pure organisational grouping in the RawPath.
 {}
 ```
 
-The form never writes `RawTags` (the deploy artifact owns it) and never touches `Sparkplug` (P2) — an
-existing `Sparkplug` object, and any key a newer driver adds, survive a load→save untouched.
+### `Sparkplug` sub-object (`Mode: "SparkplugB"`)
+
+```jsonc
+{
+  "Mode": "SparkplugB",
+  "Sparkplug": {
+    "GroupId": "OtOpcUaSim",            // REQUIRED — the driver's whole subscription scope
+    "HostId": "",                       // Host Application identity; receive-only (see below)
+    "ActAsPrimaryHost": false,          // NOT IMPLEMENTED — logs a warning when true
+    "RequestRebirthOnGap": true,        // a seq gap asks the edge node to re-announce (NCMD)
+    "BirthObservationWindowSeconds": 15 // how long discovery collects births before calling it stable
+  }
+}
+```
+
+| Key | Default | Notes |
+|---|---|---|
+| `GroupId` | `""` | **Required.** The driver subscribes exactly `spBv1.0/{GroupId}/#`. Blank ⇒ it connects, reports `Healthy`, and ingests **nothing**. It is a literal topic segment, so `/`, `+`, `#` are refused by the form |
+| `HostId` | `""` | Sparkplug Host Application identity. **Receive-only** — the driver observes `STATE` and never publishes one |
+| `ActAsPrimaryHost` | `false` | **Not implemented.** Setting it logs a startup **warning** rather than being silently inert — being a primary host is a three-part contract (retained `ONLINE`, a matching `OFFLINE` registered as the MQTT Will *at connect time*, an explicit `OFFLINE` on clean shutdown), and shipping the `ONLINE` half without the Will is strictly worse than shipping neither: a crashed node would leave a retained `ONLINE` asserting forever that a dead host is alive |
+| `RequestRebirthOnGap` | `true` | On a detected sequence-number gap, publish a rebirth-request NCMD instead of running on stale metric state |
+| `BirthObservationWindowSeconds` | `15` | Discovery's birth-collection window. Must be ≥ 1 |
+
+`MqttDriverForm` authors all five in Sparkplug mode. The sub-object is **merged, never replaced** (a
+key a newer driver adds inside it survives an older AdminUI), and in `Plain` mode it is not touched at
+all — so flipping a driver to Plain to look at it and back does not lose the group id. The form never
+writes `RawTags`; the deploy artifact owns it.
+
+> **This was a live-gate finding.** Through the P2 implementation `MqttDriverForm` still carried its P1
+> placeholder — switching Mode to `SparkplugB` rendered a "not available yet" notice and **no group-id
+> field**, so once Sparkplug ingest shipped there was no way to author a Sparkplug driver from the
+> AdminUI at all. Pinned by `MqttDriverFormModelTests`' Sparkplug cases.
 
 Every key has a default, so nothing is strictly required by the binder. Notable ones:
 `port` **8883**, `useTls` **true**, `protocolVersion` **V500**, `cleanSession` **true**,
@@ -113,6 +151,14 @@ a `connectTimeoutSeconds: 0` driver-brick.
 
 ## Tag Configuration
 
+A tag binds in **one of two shapes**, and which one is decided by *which keys are present*, not by a
+`mode` key on the tag. `MqttTagDefinitionFactory` reads the Sparkplug tuple when any Sparkplug
+descriptor key is set, and the topic otherwise; the AdminUI's "Tag shape" selector infers the same way
+on reopen. The key names are single-sourced in `MqttTagConfigKeys` so the browse-commit mapper and the
+factory cannot drift.
+
+### Plain shape
+
 | Key | Type | Default | Notes |
 |---|---|---|---|
 | `topic` | string | — | **Required.** Absent/blank rejects the tag ⇒ `BadNodeIdUnknown` |
@@ -141,6 +187,69 @@ deliberately stricter than the driver, because one Tag holds one value and a wil
 from many source topics. Wildcard tags are indexed **by filter**, not by concrete topic, so they
 survive a reconnect; a message fans out to *every* matching tag, and unauthored topics are dropped.
 
+### Sparkplug shape
+
+| Key | Type | Default | Notes |
+|---|---|---|---|
+| `groupId` | string | — | **Required.** Must match the driver's `Sparkplug.GroupId` to ever receive a message |
+| `edgeNodeId` | string | — | **Required.** |
+| `deviceId` | string | *absent* | **Omit** for a metric published by the edge node itself (NBIRTH/NDATA). Absent is meaningfully different from `""` |
+| `metricName` | string | — | **Required.** The tag's stable binding key across rebirths. **May contain `/`** — `Node Control/Rebirth` and `Properties/Serial Number` are canonical Sparkplug names, and the whole name is one value, never split |
+| `dataType` | `DriverDataType` | *from the birth* | **Optional override.** Absent ⇒ take whatever type the birth certificate declared. The AdminUI's "(from birth certificate)" option removes the key entirely |
+| `isHistorized` / `historianTagname` | — | — | Server-side historization, unchanged from Plain |
+
+`payloadFormat`, `jsonPath`, `qos` and `retainSeed` are **Plain-only** and meaningless here: a
+Sparkplug body is protobuf, and the subscription is one driver-wide `spBv1.0/{GroupId}/#`, not a
+per-tag filter.
+
+`groupId` / `edgeNodeId` / `deviceId` are literal MQTT topic segments, so the AdminUI editor refuses
+`/`, `+` and `#` in them — a decoded incoming id can never contain one, so such a tag could never
+bind. `metricName` is deliberately **exempt**: it is not a topic segment.
+
+```jsonc
+// A device metric.
+{"groupId":"OtOpcUaSim","edgeNodeId":"EdgeA","deviceId":"Filler1","metricName":"FillCount"}
+
+// A node-level metric — note deviceId is ABSENT, not blank.
+{"groupId":"OtOpcUaSim","edgeNodeId":"EdgeA","metricName":"Temperature"}
+```
+
+## Sparkplug B Ingest
+
+One subscription (`spBv1.0/{GroupId}/#`) feeds a per-edge-node state machine
+(`SparkplugIngestor` + `SparkplugCodec` / `AliasTable` / `BirthCache` / `SequenceTracker`):
+
+- **Births are the only self-describing message.** NBIRTH/DBIRTH name every metric and assign its
+  alias; NDATA/DDATA carry an **alias and no name at all**. So the alias table is rebuilt *per birth*
+  and tags bind **by name**, never by alias — aliases are per-birth and may be reused for a different
+  metric after a rebirth.
+- **NBIRTH is node-scoped, DBIRTH is device-scoped**, and routing a DBIRTH through the node path
+  wipes `bdSeq`. They are handled separately on purpose.
+- **Sequence tracking**: `seq` is a wrapping 0–255 counter. A detected gap raises a rebirth request
+  when `RequestRebirthOnGap` is on, rather than silently continuing on stale metric state.
+- **Death → STALE.** An NDEATH whose `bdSeq` matches the live session (the bdSeq tie is what stops a
+  stale death from killing a fresh session) marks every metric under that edge node `Bad` /
+  `BadNoCommunication`. A DDEATH does the same for one device. The next birth restores them.
+- **Unsupported datatypes are skipped with a warning, never guessed**: `DataSet`, `Template`,
+  `PropertySet`, `PropertySetList`, `Unknown`. `Int8`→`Int16` and `UInt8`→`UInt16` widen; `*Array`
+  variants map to the element type with the array bit set.
+- **Ingest state is reset at every session/authoring seam** — a reconnect or a `ReinitializeAsync`
+  must not carry a previous session's alias table into a new one.
+
+### Rediscovery (Sparkplug)
+
+`OnRediscoveryNeeded` fires only when a birth is **for an authored scope** *and* its metric-name set
+**differs** from the last one seen for that scope (order-insensitive, ordinal). Both conditions are
+anti-storm, not optimisations: rediscovery triggers an address-space rebuild, and an edge node
+re-births freely — on its own schedule, on every reconnect, and once per rebirth NCMD.
+
+> ⚠️ **Nothing consumes the signal today.** No runtime component subscribes to
+> `IRediscoverable.OnRediscoveryNeeded`, and `DriverHostActor.HandleDiscoveredNodes` hard-returns —
+> discovered-node injection is dormant in v3. The served address space comes from the deploy artifact,
+> so **a DBIRTH introducing a new metric does not change the OPC UA tree**; you must redeploy. The
+> driver's decision is observable only as an Information log line
+> (`… requesting rediscovery.`). This is a v3 platform gap, not an MQTT one.
+
 ## Connection + Failure Semantics
 
 `MqttConnectionState`: `Disconnected → Connected → Reconnecting → Faulted → Disposed`.
@@ -213,6 +322,32 @@ and only** browse action that publishes anything.
 - Offered only for a Sparkplug session (`IRebirthCapableBrowseSession.RebirthAvailable`); a Plain
   MQTT window publishes nothing, ever.
 
+### Refresh
+
+An observation window **accumulates**, but the tree renders **once**, when it is created — and
+`OpenAsync` returns as soon as the SUBSCRIBE is granted, without waiting for the birth-observation
+window. So the first render is normally empty on Plain (a topic that has not published yet is
+invisible) and *almost always* empty on Sparkplug (births are never retained). **Refresh** re-reads
+the root against the same session: nothing reconnects, nothing already observed is lost, and the tag
+selection is kept. Only the armed rebirth scope is cleared, because the node it named may no longer be
+in the rebuilt tree.
+
+> **Also fixed by this gate, and not MQTT-specific:** every node label in the shared
+> `DriverBrowseTree` was an `<a href="#">`. `blazor.web.js`'s enhanced-navigation click interceptor
+> resolves a bare `#` against `<base href="/">`, so clicking a node **label** navigated the whole
+> AdminUI to `/` and destroyed the hosting modal (`@onclick:preventDefault` suppresses the browser's
+> default action, not Blazor's interceptor). The labels are now `<button type="button">`. This
+> affected **every** driver's picker since 2026-05-28; it surfaced here because choosing a rebirth
+> scope is the first flow that requires clicking a label rather than the ▶ toggle.
+
+> ⚠️ **Known gap — a completely empty tree cannot arm a rebirth.** The rebirth scope is taken from the
+> last node clicked *in the tree*, so on a plant that has not birthed since the window opened there is
+> nothing to click and `Request rebirth…` stays disabled — the exact case the affordance exists for.
+> `MqttBrowseSession.ResolveRebirthTargets` already accepts a bare `{group}/{edgeNode}` for a node the
+> window has never seen (it calls that "the prime rebirth target"); what is missing is a UI path to
+> enter one, or to default the scope to the driver's own configured `GroupId`. Until then: use
+> **Refresh** after any birth, or author the tags by **Manual entry**, which is always available.
+
 ## Test Connect
 
 `MqttDriverProbe` performs **one CONNECT** (no SUBSCRIBE, no publish) under a `-probe-` client id and
@@ -222,17 +357,36 @@ identical words. See [TestConnectProbes.md](TestConnectProbes.md).
 
 ## Testing
 
-- **Unit** — `tests/Drivers/…Driver.Mqtt.Tests` (266 tests): tag-config mapping, JSONPath subset,
-  strict-enum rejection, subscription indexing (incl. the wildcard-by-filter case), reconnect/rebuild
-  branches, CONNACK classification.
-- **Live (env-gated)** — `tests/Drivers/…Driver.Mqtt.IntegrationTests` (7 tests) against the Mosquitto
-  fixture; skips cleanly when `MQTT_FIXTURE_ENDPOINT` is unset. See
-  [Mqtt-Test-Fixture.md](Mqtt-Test-Fixture.md) and `infra/README.md` §3.
+- **Unit** — `tests/Drivers/…Driver.Mqtt.Tests` (**581 tests**): tag-config mapping (both shapes),
+  JSONPath subset, strict-enum rejection, subscription indexing (incl. the wildcard-by-filter case),
+  reconnect/rebuild branches, CONNACK classification, and the Sparkplug half — golden-payload decode,
+  topic parse/format, datatype map, alias/birth-cache rebuild, sequence + bdSeq-death ties, the
+  rediscovery change gate, and the browse session's "publishes nothing" assertion.
+- **Live (env-gated)** — `tests/Drivers/…Driver.Mqtt.IntegrationTests` (**15 tests**) against the
+  Mosquitto broker + the C# Sparkplug edge-node simulator; skips cleanly when `MQTT_FIXTURE_ENDPOINT`
+  is unset. See [Mqtt-Test-Fixture.md](Mqtt-Test-Fixture.md) and `infra/README.md` §3.
+- **AdminUI** — `MqttDriverFormModelTests` / `MqttTagConfigModelTests` cover both editors'
+  round-trip, mode inference and validation. AdminUI has no bUnit, so the razor shells themselves are
+  only ever proven by a live `/run` gate.
 
 ## Operational Notes
 
-- **Read-only.** No writes reach the broker; every node is ViewOnly.
+- **Read-only.** No writes reach the broker; every node is ViewOnly. Sparkplug NCMD is used for
+  **rebirth requests only** — never to command a device.
 - **No alarms, no driver-side history.** Historization is a server-side concern (`isHistorized`).
 - **Both pair nodes subscribe independently** — MQTT fan-out is per-connection, and the Primary gate
-  applies downstream, not to ingest.
+  applies downstream, not to ingest. This is also why `clientId` must stay unset (above).
 - **Unauthored traffic is ignored.** A busy broker is normal; the driver never auto-provisions a tag.
+
+## Known gaps
+
+| Gap | Effect | Notes |
+|---|---|---|
+| **Write-through (`IWritable`)** | Every MQTT node is read-only | Deferred to P3 — NCMD/DCMD + plain publish, optimistic-Good + self-correct on echo |
+| **Rediscovery is inert** | A DBIRTH introducing a metric does not change the OPC UA tree; redeploy to pick it up | v3 platform gap — nothing subscribes to `OnRediscoveryNeeded` and `DriverHostActor.HandleDiscoveredNodes` hard-returns. Driver-side decision is log-observable |
+| **Rebirth needs a non-empty tree** | `Request rebirth…` cannot be armed on a plant that has not birthed since the window opened | See [Refresh](#refresh). Session side already supports a bare `{group}/{edgeNode}` scope |
+| **`_canRebirth` is captured at browse-open** | A session reaped for idleness (2 min) still draws the button, and using it errors | The error is shown, not swallowed; reopen the browser |
+| **Primary-host STATE publishing** | `ActAsPrimaryHost` does nothing | Logs a startup warning rather than being silently inert — see the `Sparkplug` sub-object table |
+| **A metric whose name contains `/` cannot be browse-committed** | The commit is refused **whole**, in words (`Row N: Name must not contain '/'`) | The derived **tag Name** is a RawPath segment and may not contain `/`, while `metricName` legitimately may. This blocks the spec-mandatory `Node Control/Rebirth`. **Workaround: Manual entry** — author the tag with a `/`-free name and type the slashed `metricName` into the Sparkplug editor, which accepts it. Nothing is silently mis-bound |
+| **`DataSet` / `Template` / `PropertySet` metrics** | Skipped with a warning | v1-unsupported; never coerced into a guessed type |
+| **The tag editor writes `payloadFormat` into a Sparkplug blob** | Cosmetic only | `payloadFormat` is Plain-only; the factory routes on the Sparkplug keys and ignores it. Noise in the blob, not a mis-binding |

docs/plans/2026-07-24-driver-expansion-tracking.md

@@ -33,7 +33,7 @@ it reaches 📝.
 | **1** | Modbus RTU (extend Modbus) | [design](2026-07-15-modbus-rtu-driver-design.md) | [plan](2026-07-24-modbus-rtu-driver.md) · [tasks](2026-07-24-modbus-rtu-driver.md.tasks.json) | 📝 **Plan ready** (11 tasks) | **S (lowest)** | `pymodbus` `rtu_over_tcp` — CI-simulatable, no new infra |
 | **1** | SQL poll | [design](2026-07-15-sql-poll-driver-design.md) | [plan](2026-07-24-sql-poll-driver.md) · [tasks](2026-07-24-sql-poll-driver.md.tasks.json) | 📝 **Plan ready** (22 tasks) | S–M | **existing central SQL Server** `10.100.0.35,14330` + SQLite unit |
 | **2** | MTConnect Agent | [design](2026-07-15-mtconnect-driver-design.md) | [plan](2026-07-24-mtconnect-driver.md) · [tasks](2026-07-24-mtconnect-driver.md.tasks.json) | 📝 **Plan ready** (23 tasks) | S–M | Dockerized `mtconnect/cppagent` — CI-simulatable |
-| **2** | MQTT / Sparkplug B | [design](2026-07-15-mqtt-sparkplug-driver-design.md) | [plan](2026-07-24-mqtt-sparkplug-driver.md) · [tasks](2026-07-24-mqtt-sparkplug-driver.md.tasks.json) | ✅ **P1 done** (Tasks 0–14, live-gated) · 📝 P2 Sparkplug plan ready (Tasks 15–26) | M–L | Mosquitto TLS+auth fixture **live** at `10.100.0.35:8883` |
+| **2** | MQTT / Sparkplug B | [design](2026-07-15-mqtt-sparkplug-driver-design.md) | [plan](2026-07-24-mqtt-sparkplug-driver.md) · [tasks](2026-07-24-mqtt-sparkplug-driver.md.tasks.json) | ✅ **COMPLETE** — P1 + P2 shipped, both live-gated (Tasks 0–26) | M–L | Mosquitto TLS+auth **+ C# Sparkplug edge-node simulator**, live at `10.100.0.35:8883` |
 
 > Waves 3+ (BACnet/IP, Omron) and the deferred MELSEC are tracked in the program design doc §6/§8,
 > not here. Omron CIP is the program's sole real-hardware wire gate; BACnet's broadcast/BBMD leg is
@@ -130,46 +130,76 @@ Both CI-simulatable on the shared docker host, no hardware.
   integration fixture (env-gated). Depends on Wave 0's browse seam being live-verified (#468).
 - **Effort:** S–M (≈1–1.5 wk with TrakHound, ≈2.5–3 wk hand-rolled).
 
-### MQTT / Sparkplug B — ✅ P1 done (live-gated) · 📝 P2 plan ready
+### MQTT / Sparkplug B — ✅ **COMPLETE** (P1 + P2, both live-gated)
 - **Design:** [`2026-07-15-mqtt-sparkplug-driver-design.md`](2026-07-15-mqtt-sparkplug-driver-design.md)
-- **Implementation plan:** [`2026-07-24-mqtt-sparkplug-driver.md`](2026-07-24-mqtt-sparkplug-driver.md) · [`.tasks.json`](2026-07-24-mqtt-sparkplug-driver.md.tasks.json) — **27 tasks** (P1 plain MQTT = Tasks 0–14, a complete shippable milestone; P2 Sparkplug B = Tasks 15–26). Task 0 is the mandatory MQTTnet-5/net10 + central-pinning validation spike.
-- **Scope:** P1 plain MQTT (MQTTnet-5 connect/TLS/auth + hand-rolled reconnect, subscribe→
+- **Implementation plan:** [`2026-07-24-mqtt-sparkplug-driver.md`](2026-07-24-mqtt-sparkplug-driver.md) · [`.tasks.json`](2026-07-24-mqtt-sparkplug-driver.md.tasks.json) — **27 tasks, all done** (P1 plain MQTT = Tasks 0–14; P2 Sparkplug B = Tasks 15–26).
+- **Scope delivered:** P1 plain MQTT (MQTTnet-5 connect/TLS/auth + hand-rolled reconnect, subscribe→
   `OnDataChange`, retained last-value read, `#`-observation browser); P2 Sparkplug B ingest
-  (vendored Tahu proto, birth/alias/seq-gap/rebirth state machine, death→STALE).
+  (vendored Tahu proto + `Grpc.Tools` codegen, birth/alias/seq-gap/rebirth state machine,
+  death→STALE, birth-driven browse tree, scoped Request-rebirth NCMD, typed tag editor).
+  **Write-through (`IWritable`) is deferred to P3** — every MQTT node materializes read-only.
 - **Fixture:** Mosquitto TLS+auth broker + JSON publisher sidecar, **live** at `10.100.0.35:8883`
   (`:1883` plaintext-but-authenticated); stack `/opt/otopcua-mqtt`, compose in
   `tests/Drivers/…​.Driver.Mqtt.IntegrationTests/Docker/`. Env-gated live suite
-  (`MQTT_FIXTURE_ENDPOINT`, see `infra/README.md` §3). The **C# Sparkplug edge-node simulator** is P2
-  work and does not exist yet.
-- **P1 status (2026-07-24):** Tasks 0–14 complete. `.Contracts`/`.Driver`/`.Browser` triad + factory,
-  `DriverTypeNames.Mqtt`, host factory/probe registration, AdminUI typed tag editor + bespoke
-  `#`-observation browser. **Offline 1131 passed / 0 failed** (266 driver · 727 AdminUI · 138
-  Core.Abstractions); **live 7/7** against the fixture.
-- **P1 live gate found two AdminUI authoring gaps** (the gate's whole point — both were invisible to
-  266 green unit tests, because AdminUI has no bUnit and nothing tied these hand-maintained lists to
+  (`MQTT_FIXTURE_ENDPOINT`, see `infra/README.md` §3). The **project-owned C# Sparkplug edge-node
+  simulator** (`--profile sparkplug`, group `OtOpcUaSim`, nodes `EdgeA`/`EdgeB`, `EdgeA` device
+  `Filler1`) shipped with P2 and answers rebirth NCMDs.
+- **P2 status (2026-07-25):** Tasks 15–26 complete. **Offline 1528 passed / 0 failed**
+  (581 driver · 809 AdminUI · 138 Core.Abstractions); **live 15/15** against the broker + simulator.
+- **P1 live gate found two AdminUI authoring gaps** (the gate's whole point — both invisible to green
+  unit tests, because AdminUI has no bUnit and nothing tied these hand-maintained lists to
   `DriverTypeNames`):
   1. **FIXED —** `RawDriverTypeDialog`'s option array never got an MQTT row, so **no operator could
      create an MQTT driver at all**. Fixed, plus a reflection parity guard
-     (`RawDriverTypeDialogParityTests`, 3 tests) that fails for *any* future `DriverTypeNames` entry
-     missing from the picker — so the next driver fails a test instead of a live gate.
-  2. **OPEN — `MqttDriverForm` / `MqttDeviceForm` do not exist.** `DriverConfigModal` and
-     `DeviceModal` dispatch on `DriverType` and fall through to *"No typed config form for driver
-     type Mqtt"* — and **neither modal has a raw-JSON fallback**, unlike the `/uns` TagModal. So an
-     operator can create an MQTT driver but cannot author its broker host/port/TLS/credentials
-     through the AdminUI at all. The P1 gate authored `DriverConfig`/`DeviceConfig` by direct SQL to
-     get past this. **P1 is not operator-complete until these two razor forms land** (a
-     `MqttDriverForm` + `MqttDeviceForm` pair modelled on the OpcUaClient ones, plus their
-     serialization tests). This is a plan omission, not a regression: no task ever covered the
-     driver/device forms — Task 6's "typed editor" was the *tag* editor.
-- **Redundant-pair hazard worth knowing (documented, not a code change):** both nodes of a pair run
-  the driver, so a **fixed `clientId` makes them evict each other forever** — the broker logs
+     (`RawDriverTypeDialogParityTests`) that fails for *any* future `DriverTypeNames` entry
+     missing from the picker.
+  2. **FIXED —** `MqttDriverForm` / `MqttDeviceForm` did not exist, so the broker connection was
+     unauthorable from the AdminUI. Both shipped after the P1 gate.
+- **P2 live gate found a third one, of the same family — FIXED:** `MqttDriverForm` still carried its
+  P1 Sparkplug **placeholder**. Switching Mode to `SparkplugB` rendered a *"not available yet"* notice
+  and **no Group ID field** — so once Sparkplug ingest shipped there was still **no way to author a
+  Sparkplug driver from the AdminUI**, and `Sparkplug.GroupId` is the driver's entire subscription
+  filter (`spBv1.0/{GroupId}/#`): blank ⇒ connected, `Healthy`, ingesting nothing. Fixed (all five
+  Sparkplug keys, merge-not-replace on save, group-id segment validation) + 8 falsifiable
+  `MqttDriverFormModelTests` cases. **Three gates, three instances of the same defect class: a
+  hand-maintained AdminUI surface left behind by a driver-side feature.**
+- **P2 live gate — two open UI gaps, documented not fixed** (see `docs/drivers/Mqtt.md` §Known gaps):
+  - **A completely empty browse tree cannot arm a rebirth.** The scope comes from a tree click, so on
+    a plant that has not birthed since the window opened `Request rebirth…` stays disabled — the very
+    case the affordance exists for. `MqttBrowseSession.ResolveRebirthTargets` already accepts a bare
+    `{group}/{edgeNode}` ("the prime rebirth target"); only a UI path to enter one is missing.
+    Mitigation shipped: a **Refresh** button on the browse tree (it re-reads the same session, which
+    previously rendered exactly once at open and never again).
+- **P2 live gate also found a PRE-EXISTING, cross-driver AdminUI defect — FIXED:** every node label in
+  the shared `DriverBrowseTree` was an `<a href="#">`. In a Blazor Web App, `blazor.web.js`'s
+  enhanced-navigation click interceptor resolves a bare `#` against `<base href="/">`, so **clicking
+  any browse-tree node label navigated the whole AdminUI to `/`**, tore down the circuit and destroyed
+  the hosting modal — losing the browse session and the tag selection. `@onclick:preventDefault` does
+  not help: it suppresses the browser's default action, not Blazor's own interceptor. The labels are
+  now `<button type="button">`. It dates to the component's introduction (2026-05-28) and affects
+  **every** driver's picker; it only surfaced now because Sparkplug's Request-rebirth is the first
+  feature that requires clicking a *label* rather than the ▶ toggle (always a `<button>`, always fine).
+  - **A metric name containing `/` cannot be browse-committed.** The derived raw **tag Name** is a
+    RawPath segment and may not contain `/`, while `metricName` legitimately may — so the
+    spec-mandatory `Node Control/Rebirth` is refused at commit (`Row N: Name must not contain '/'`).
+    The refusal is loud and all-or-nothing, never a silently mis-bound tag, and **Manual entry** is
+    the working path (the Sparkplug tag editor accepts a slashed metric name). Fixing it needs a
+    name-sanitisation policy with a collision answer, so it was recorded rather than guessed at.
+  - `_canRebirth` is captured at browse-open, so a reaped session still draws the button.
+  - The tag editor injects the Plain-only `payloadFormat` key into a Sparkplug blob — cosmetic; the
+    factory routes on the Sparkplug tuple and ignores it.
+- **Rediscovery is inert in v3 (platform gap, not MQTT's).** The Sparkplug driver raises
+  `OnRediscoveryNeeded` on a changed birth metric-set, but **nothing subscribes to it** and
+  `DriverHostActor.HandleDiscoveredNodes` hard-returns. A DBIRTH introducing a metric does **not**
+  change the OPC UA tree — redeploy. Driver-side behaviour is log-observable only.
+- **Redundant-pair hazard (documented, not a code change):** both nodes of a pair run the driver, so a
+  **fixed `clientId` makes them evict each other forever** — the broker logs
   `already connected, closing old connection` and both nodes reconnect every ~2 s while still
-  reporting `Healthy`. Leaving `clientId` unset (the default) is correct. Observed live; captured in
-  `docs/drivers/Mqtt.md`. A future `MqttDriverForm` should not offer a free-text client id without
-  this warning.
-- **Effort:** M–L. **Top risks (P2):** Sparkplug state-machine correctness; MQTTnet-5/net10 + the repo's
-  fragile central pinning (mitigated by hand-rolling Tahu over one MQTTnet-5 client) — the pinning risk
-  is **retired**: P1 shipped on MQTTnet 5 with the repo's central pinning intact.
+  reporting `Healthy`. Unset (the default) is correct. `MqttDriverForm` warns inline the moment a
+  value is typed.
+- **Effort:** M–L, delivered. The MQTTnet-5/net10 + central-pinning risk is **retired** (Task 0's
+  spike held through both phases); Sparkplug state-machine correctness was carried by golden-payload
+  vectors + the live simulator.
 
 ---
 
@@ -179,8 +209,8 @@ Both CI-simulatable on the shared docker host, no hardware.
 2. **Build Wave 1** — Modbus RTU first (lowest effort, no new infra), then SQL poll. Both plans are
    📝 ready; run the command from the [Executing a plan](#executing-a-plan-git-worktree--subagent-per-task)
    table (subagent-driven-development in a git worktree).
-3. **Build Wave 2** — MTConnect's browse leg wants #468 closed first. **MQTT P1 is done and
-   live-gated**; the remaining MQTT work is **P2 Sparkplug B** (Tasks 15–26), whose first step is the
-   vendored Tahu proto + the project-owned C# edge-node simulator the P1 fixture does not include.
+3. **Build Wave 2** — MTConnect's browse leg wants #468 closed first. **MQTT / Sparkplug B is
+   COMPLETE** (P1 + P2, both live-gated); its only remaining work is optional — P3 write-through
+   (`IWritable`: NCMD/DCMD + plain publish) and the two browse-UI gaps recorded above.
 
 Update this file's Summary table and per-wave status whenever a deliverable changes state.