17 Commits

Author	SHA1	Message	Date
Joseph Doherty	67059e479f	docs(#655): history is server-side only; rewrite OPC-009 and stale driver-history references ... Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe	2026-10-08 23:36:25 -04:00
Joseph Doherty	52708bff52	fix(address-space): numeric array writes convert (checked) to the node element type; array-to-scalar refusal only for Modbus/S7 (#610 review R6) ... MAJOR-1: R4's exact element-type match refused ScadaBridge's CLR-list writes (its element types are only Boolean/Int32/Float/Double/String/ DateTime) to every Int16/UInt16/Byte/UInt32/Int64/UInt64 array node and a Double list to a Float array. EvaluateEquipmentWriteStructure now converts a numeric array of another numeric element type element-wise, CHECKED, into the node's element type and hands the converted array back through OnEquipmentTagWrite's ref value, so the node stores and the driver receives the node's own type. Any out-of-range, fractional-to-integer, NaN/Inf-to- integer or Float-overflowing element refuses the whole write BadTypeMismatch (nothing dispatched) - so the UInt32 -> Int32 bit reinterpretation stays closed. Non-numeric mismatches stay refused. The wrong 'no client relies on a looser rule' comment is corrected. MINOR-1: the array-value-to-scalar-node refusal broke writes back to browse-committed array tags (committed scalar, isArray never set) on pass-through drivers. It now applies only when the owning driver's scalar encoder cannot take an array (DriverArrayWriteSupport. RefusesArrayValueOnScalarTag: Modbus, S7), carried RawTagPlan. ScalarRefusesArrayValue / UnsReferenceVariable.BackingScalarRefusesArrayValue -> EnsureVariable(refuseArrayOnScalar) -> a per-node set in the node manager. OpcUaClient/Galaxy/others keep pre-#610 dispatch. Not on the classifier whitelist (driver-type edit rebuilds); a mirror whose flag changes is recreated, not updated in place. Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe	2026-10-08 08:31:46 -04:00
Joseph Doherty	dabd8eb955	fix(address-space): exact element-type check for array writes + array-capability shape edges (#610 review R4) ... MAJOR-1: the SDK skips TypeInfo.IsInstanceOfDataType on any node with an OnWriteValue handler (every writable equipment node), and the node manager's fail-fast treated numeric<->numeric as compatible, so a UInt32[] to a Galaxy Int32 array matched MxValueEncoder's int[] arm by CLR covariance and was written bit-reinterpreted with a Good result. EvaluateEquipmentWriteStructure now matches an ARRAY write's element type exactly (Byte[]/ByteString the only equivalence; Variant[]/object[] refused) -> BadTypeMismatch, nothing dispatched. MxValueEncoder's int[]/long[] arms are exact-type guarded too, and the Galaxy parity test's false "the SDK refuses" premise is corrected (the UInt32/UInt64 exclusion is now the encoder's own answer). Scalar writes keep numeric widening by decision: consumers write CLR-typed values (Double to a Float node) and every driver's scalar encoder range-checks. MINOR: Modbus row honours maxRegistersPerWrite (smallest of DriverConfig / the tag's DeviceConfig, default 123) and FC15's 1968-coil ceiling, and requires region + numeric address; Modbus/S7/Galaxy require isArray + integer arrayLength >= 1 (Galaxy: an unbounded node would let a short write resize the attribute); an array value to a scalar node is refused inline. Docs: Uns.md array-write rules + upgrade note (ReadWrite array tags become client-writable on first boot), Modbus.md, Galaxy.md. Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe	2026-10-08 08:07:36 -04:00
Joseph Doherty	7c4c7f9653	fix(galaxy): seam hardening - advise unmark on throw, dup attributeRef surfaced, bounded subscribe-once read; delete dormant historian connection probe (#605) ... Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe	2026-10-08 06:52:21 -04:00
Joseph Doherty	c51c59987b	fix(galaxy): publish an unrepresentable value as BadTypeMismatch, not a good null ... Reverses the conservative call from the previous commit at the user's direction, and they were right: "surface it on a counter first" left the wire lying. An MXAccess event can carry Good quality while its payload is a kind MxValueDecoder has no mapping for, so the old behaviour published null-under-Good — which a client cannot tell apart from a genuine null reading. A value the gateway DID send would be consumed as a value it did not, with the only evidence in a log nobody is tailing. Bad data is the honest wire representation of lost data. BadTypeMismatch is an existing StatusCodeMap constant, deliberately reused rather than written inline: StatusCodeParityTests finds status constants by reflecting over Good/Uncertain/Bad-prefixed uint fields and checking them against the pinned SDK, so an inline literal would be invisible to that guard (Gitea #497, where 16 wrong constants had accumulated across 6 drivers exactly this way). Logging is now once per DISTINCT value kind rather than once per pump. The set is bounded by the MxValue oneof enum so a broken producer still cannot flood, but a second unrepresentable kind appearing later gets its own line — warn-once-per-pump would have silently swallowed it, which is the same class of bug as the null this commit fixes. The test's fixture matters more than its assertion: the undecodable event carries Quality = 192 (OPC DA Good), so a decoder that gave up silently would publish Good and fail. Paired with a positive control — a decodable value at the same quality must still publish Good — so it cannot be satisfied by a pump that marks everything Bad. Falsified by reverting the status to Good: the test reds, and only that test. Verified: 331 Galaxy tests green, Core.Abstractions 298 (the parity guard), solution builds 0 errors. Docs corrected in the two places that recorded the old decision as deliberate.	2026-08-12 03:03:51 -04:00
Joseph Doherty	4769044f88	feat(galaxy): handle the replay-gap sentinel and sparse-array values ... Closes the two follow-ups left open by the MxGateway 0.2.0 bump. Reading the gateway's own contract first changed what each of them is, and one of my earlier claims was simply wrong -- both corrections are recorded below. Replay gap ---------- A sentinel MxEvent carries family = UNSPECIFIED, so it fell through EventPump's family switch into the default drop: we silently ignored a documented MUST ("you missed events -- discard local state and re-snapshot"). It is now intercepted and answered by re-issuing SubscribeBulk for every tracked subscription, since MXAccess delivers an initial value per item on subscribe -- re-subscribing IS the re-snapshot. It does not restart the event pump (the stream carrying the sentinel is healthy, and the handler runs on that stream's own read loop, so disposing the pump from there would deadlock on itself), it does not block the read loop, and re-entry is gated so a burst collapses to one pass instead of a subscribe storm per sentinel. Handled on the READ loop, not in the dispatch loop, because everything past that point is subject to newest-dropped channel pressure -- and "you missed events" is the one signal whose loss is unrecoverable. Pinned by a test that fills the channel and still expects the sentinel. ⚠️ This cannot fire in the shipped configuration, and I did not pretend otherwise or paper over it by enabling resume. The gateway emits the sentinel only for a stream opened with after_worker_sequence > 0; GatewayGalaxySubscriber passes 0, which the gateway treats as "fresh stream, not a resume -- plain attach, no replay, no sentinel". Enabling resume is a larger and genuinely delicate change: the sequence is only meaningful within ONE gateway session, our reconnect recreates the session, and replaying a remembered sequence against a fresh session sets the server's live watermark ABOVE every event it is about to send -- silencing the stream instead of recovering it. That deserves its own change with a live gate, which I cannot run from here. Sparse arrays -- correcting the last commit message --------------------------------------------------- I wrote that the bump "makes handling it possible" on the decode path. That is wrong: MxSparseArray is documented write-only, the gateway expands it before forwarding, and "the worker never receives or produces it". So the decode path is unreachable by contract and the write path has no use for it either -- it is a wire compaction for a WHOLE-array write, not a partial update (unmentioned indices are RESET, deliberately, because the gateway cannot read-modify-write without racing the provider). It is therefore the wrong primitive for an OPC UA IndexRange write, which expects untouched elements preserved -- and WriteRequest carries no IndexRange in the first place. It is decoded anyway, as contract defence: the alternative if a future gateway ever emits one is a silent null published under Good quality. Fill semantics mirror the gateway's own SparseArrayExpander exactly (epoch for Time, empty string, Integer widening to long[] when any element is int64) so a value that round-trips through a write reads back as the same CLR array. Also: the decoder is now total by contract, since it runs inside the dispatch loop where an escaping exception kills dispatch for the life of the pump. A malformed payload degrades instead of throwing. A real defect found in the same code ------------------------------------ A stream the GATEWAY completes -- a closed or evicted session -- ends the RPC without an error, so nothing threw, the supervisor was never notified, and the pump exited silently. GetHealth() kept reporting Healthy, which also means the #527 comms-loss watchdog could never trip, because it requires a non-Healthy state. The driver went permanently deaf with no signal anywhere. This one is live, unlike the two above. Now reported as a fault; the falsification control is the existing CleanShutdown_DoesNotInvokeOnStreamFault, since our own disposal also ends the stream and must NOT be reported. Value kinds we cannot represent are now counted and warned once rather than published as an indistinguishable null. The status is deliberately NOT downgraded to Bad: nothing can reach that branch today, and changing what an OPC UA client sees for a live shape is not a change to make without a gate. The counter exists so the next person has evidence instead of a guess. Verified: 330 Galaxy tests green (12 new), plus Galaxy.Browser 21, Runtime 558, Core 351; full solution builds 0 errors with the warning census unchanged. Every new test was falsified first -- disabling the gap interception reds 3 of 4 (the throwing-callback test passes vacuously when the callback never runs, by construction), disabling sparse decode plus the representability signal reds all 7 decoder tests, and both were restored and re-verified green. Docs: the Galaxy.Performance invariant was stated as received = dispatched + dropped + in-flight, which this breaks -- a sentinel is received but never enters the channel -- so it now reads + replay_gaps. Galaxy.md gains the three operational notes; DriverLifecycle.md records that "reaches a non-Healthy state" is an obligation a driver can silently fail to meet, which is the general shape of the clean-end bug.	2026-08-12 02:56:17 -04:00
Joseph Doherty	adce27e7fa	refactor(drivers): delete the dead discovered-node injection path (§8.2, #507) ... #507 was filed as "injection inert in v3, re-migrate onto the raw subtree". Reading it, the retained code is not revivable: it resolves equipment from EquipmentNode.DriverInstanceId UNION EquipmentTags, and BOTH are structurally empty in v3 (AddressSpaceComposer always constructs EquipmentNode with a null DriverInstanceId; DeploymentArtifact hard-codes an empty EquipmentTags set). Removing the guard would have changed a log line and injected nothing. So it is deleted rather than fixed, and #507 closes as superseded by /raw browse-commit. Removed: HandleDiscoveredNodes, PartitionDiscoveredByDeviceHost, ShouldWarnPartition, PlansRoutingEqual, ApplyDiscoveredPlansForDriver, _discoveredByDriver, the redeploy re-inject tail, DiscoveredNodeMapper, DiscoveredInjection, AddressSpaceApplier.MaterialiseDiscoveredNodes, OpcUaPublishActor.MaterialiseDiscoveredNodes, and the Runtime-local copies of CapturingAddressSpaceBuilder/DiscoveredNode. The connect-time discovery loop goes too (StartDiscovery, RediscoverTick, HandleRediscoverAsync, DiscoveredNodesReady, TriggerRediscovery). With injection gone it had no consumer, and leaving it would either dead-letter or keep browsing real devices up to ~15x per connect to drop the result. ITagDiscovery itself stays — the /raw browse picker drives it through Commons/Browsing/DiscoveryDriverBrowser, which never went through the actor, so the picker is unaffected. deferment.md §4.4 called the 18 DiscoveryInjectionDormantV3 tests "Real — blocked on #507". They are not: they assert an equipment-rooted graft (EquipmentRootNodeId == "EQ-1") that v3 cannot produce, so they could never have unskipped as written. Deleted along with DiscoveredNodeMapperTests, the CapturingAddressSpaceBuilder tests, and the MaterialiseDiscoveredNodes tests in AddressSpaceApplierTests/OpcUaPublishActorTests. Runtime.Tests skipped: 31 -> 13. IHostConnectivityProbe is deliberately NOT resolved here. GetHostStatuses() has no production call site and nothing writes a DriverHostStatus row, but the table was re-created in the v3 initial migration, so deleting on inference would be wrong. Split to Gitea #521 with both options costed. CLAUDE.md, docs/drivers/{Galaxy,TwinCAT,MTConnect}.md updated — they described the seam as dead. Build clean; Runtime.Tests 476 passed / 13 skipped; OpcUaServer.Tests 362 passed / 4 skipped.	2026-07-27 18:57:09 -04:00
Joseph Doherty	e08855fb9d	docs: source-verified deferment register + correct 17 drifted docs ... Adds deferment.md — a source-verified inventory of new-driver status, all 17 open issues, in-code deferrals, open live gates and plan bookkeeping. Every claim was checked against src/ and git, not against documentation. Headline finding: three subsystems are authored, persisted and shipped but never executed — * Node ACLs: IPermissionEvaluator/TriePermissionEvaluator have zero production consumers and OtOpcUaNodeManager never references them, yet ClusterAcls.razor authors NodeAcl rows and ConfigComposer.cs:51 ships them in every artifact. An authored deny rule has no effect. * IRediscoverable / IHostConnectivityProbe raise into the void (#518/#507); nothing ever writes a DriverHostStatus row. * DriverTypeRegistry is vestigial, so no factory passes a tier and every driver runs Tier A with the Tier-C protections dormant. Also records the Calculation driver as picker-visible but unauthorable (DriverConfigModal has no case) — the "registered but unauthorable" class recurring after the Sql picker defect — and notes that no parity test guards DriverConfigModal/DeviceModal, which is why it survived review. Documentation corrections (source-verified): * ReadWriteOperations.md claimed "a denied read never hits the driver" via four types that do not exist in src/. Bannered + struck through; a security review reading that page would have concluded a per-node ACL gate exists. * CLAUDE.md: the Change Detection sentence was false (DriverHost consumes nothing); the mesh Phase 4 and Phase 5 live gates and the auto-down 1-vs-1 gate had all PASSED; the ScriptedAlarmState table was already dropped. * driver-expansion tracking: Modbus RTU and SQL poll are merged, not pending — its command table would have made someone rebuild two shipped drivers in a fresh worktree. * drivers/README.md: dead DriverTypeRegistry paragraph, retired SystemPlatform namespace kind, missing Sql + Calculation rows, missing Modbus RTU-over-TCP transport. * TwinCAT.md/Galaxy.md promised an address-space rebuild that never happens. * Historian.md gained the #491 unproven-value-capture pointer. * IncrementalSync.md and AddressSpace.md bannered as wholesale v2-era (the rewrite is recorded as still owed, not done here); four v2 status docs bannered as historical; three wrong-name-for-a-live-type fixes. Left deliberately untouched: the secrets NoOpSecretReplicator line, which makes a security claim and needs the real behaviour identified rather than a rename.	2026-07-27 17:26:20 -04:00
Joseph Doherty	08a6551360	docs(phase4b): Modbus driver-type canonical + Galaxy nesting + FOCAS auto-scale (managed-backend caveat)	2026-06-16 19:58:11 -04:00
Joseph Doherty	d2cc4a1222	test+docs(galaxy): verify alarm acknowledger recovers after transient fault; document alarm-client reconnect	2026-06-11 11:12:49 -04:00
Joseph Doherty	521ee75355	docs: redundancy primary-only alarm emission/historization, redundancy-state NodeId+heartbeat fixes, Galaxy reconnect, live-pill	2026-06-11 10:18:25 -04:00
Joseph Doherty	d731ed98fa	docs(audit): drivers/Galaxy.md — interface list + accuracy pass ... CODE-REALITY (known defect): the capability-surface declaration line omitted IAlarmSource and IAsyncDisposable. GalaxyDriver.cs:39 actually declares: IDriver, ITagDiscovery, IReadable, IWritable, ISubscribable, IRediscoverable, IHostConnectivityProbe, IAlarmSource, IDisposable, IAsyncDisposable. Doc line corrected to match exactly, and an IAlarmSource row added to the capability table (Runtime/GatewayGalaxyAlarmFeed.cs + Runtime/GatewayGalaxyAlarmAcknowledger.cs). STALE-STATUS: the v1-doc move note claimed Galaxy-Repository.md / Galaxy-Test-Fixture.md 'are being moved to docs/v1/ by a parallel cleanup track' — that move is complete; they live at docs/v1/drivers/. Rewrote to present tense and linked the real targets. Verified against source: deploy-watch is a gRPC stream (GatewayGalaxyDeployWatchSource forwards WatchDeployEventsAsync via GalaxyRepositoryClient, not a direct DB poll); contained-name<->tag-name translation (GalaxyDiscoverer.cs:49,60); DataTypeMap at Browse/DataTypeMap.cs; IGalaxyHierarchySource / IGalaxyDeployWatchSource / DeployWatcher all present. check_links.py: zero rows for docs/drivers/Galaxy.md.	2026-06-03 15:58:32 -04:00
Joseph Doherty	969b0847a1	docs: update path references for module-folder reorganization ... Rewrite src/ and tests/ project paths in docs, CLAUDE.md, README.md, and test-fixture READMEs to the new module-folder layout (Core/Server/Drivers/ Client/Tooling). References to retired v1 projects (Galaxy.Host/Proxy/Shared, the legacy monolithic test projects) are left untouched. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-17 02:10:29 -04:00
Joseph Doherty	89004c052c	docs: alarms-over-gateway completion banner + AlarmTracking v2 (PR B.5) ... Sixteenth PR of the alarms-over-gateway epic (docs/plans/alarms-over-gateway.md). Closes the documentation sweep the plan calls for. - docs/AlarmTracking.md — promoted top-level v2-final architecture doc (was a worktree-only draft pre-epic). Covers the three alarm sources (Galaxy MxAccess driver-native / Galaxy sub-attribute fallback / scripted alarms), how they converge on AlarmConditionService, the Acknowledge routing decision in DriverNodeManager (driver-native preferred over IWritable sub-attribute fallback), the sidecar historian write-back path for non-Galaxy producers, and cross-references to the plan + v1 archive. - docs/v1/AlarmTracking.md — banner pointing readers at the v2 doc; preserved as historical record. - docs/drivers/Galaxy.md — capability list updated to include IAlarmSource (now eight capabilities, restored by B.2). Replaced the "IAlarmSource retired in 7.2" sentence with the restoration note + cross-link to docs/AlarmTracking.md. - docs/plans/alarms-over-gateway.md — completion banner at the top of the plan, marking 14 of 16 PRs shipped 2026-04-30 and noting that A.2 + A.4 + D.1 are the hardware-gated follow-up. Memory entries updated separately: - project_alarms_over_gateway_epic.md (new) — epic summary + per-PR digest. - project_galaxy_via_mxgateway.md — added "Alarms restored" bullet pointing at the new architecture. - project_server_history_alarm_subsystems.md — bullet 2 updated to describe the new ack-routing decision (B.3) + bullet 3 added describing the historian write-back path that B.4 + C.1 + C.2 light up. - MEMORY.md index — new pointer entry. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-30 21:09:04 -04:00
Joseph Doherty	006af51768	docs: post-PR-7.2 cleanup — audit + three-track scrub ... Audit (three parallel agent passes) found 43 markdown files carrying stale references to the deleted Galaxy.Host/Proxy/Shared projects after the v2-mxgw merge. This commit lands the prioritized fixes. Track 1 — high-traffic in-place rewrites (3 files, ~454 lines deleted) - README.md (202 → 91 lines): drops .NET 4.8 / x86 / TopShelf install text; leads with the multi-driver .NET 10 server identity and points at scripts/install/Install-Services.ps1 and the parity rig. - docs/v2/driver-specs.md §1 Galaxy (~289 → ~66 lines): replaces the Tier-C out-of-process spec with a Tier-A in-process description matching the current GalaxyDriver code, with the four-section GalaxyDriverOptions JSON shape pulled verbatim from Config/GalaxyDriverOptions.cs. - docs/drivers/Galaxy.md (211 → 92 lines): full rewrite around the current Browse/Runtime/Health/Config sub-folders. Track 2 — historical banners (5 files) - lmx_mxgw.md, lmx_mxgw_impl.md, lmx_backend.md, docs/v2/Galaxy.ParityMatrix.md, docs/v2/implementation/phase-2-galaxy-out-of-process.md each get a "✅ Completed 2026-04-30 — historical record" banner block. lmx_mxgw.md also fixes two dead links (`docs/Galaxy.Driver.md` and `docs/v2/Galaxy.Driver.md`) → `docs/drivers/Galaxy.md`. Track 3 — v1 archive sweep (10 git mv + 1 new index + 2 in-place scrubs) - Moved 10 v1 docs under docs/v1/ preserving subpath structure: AlarmTracking, Configuration, DataTypeMapping, HistoricalDataAccess, Subscriptions (top-level); drivers/Galaxy-Repository, drivers/Galaxy-Test-Fixture; reqs/GalaxyRepositoryReqs, reqs/MxAccessClientReqs, reqs/ServiceHostReqs. - New docs/v1/README.md is the shared archive banner + per-file table. - docs/README.md repointed to the v1 paths and updated to reflect the v2 two-process deploy shape (Server + Admin + optional OtOpcUaWonderwareHistorian). - docs/v2/Galaxy.ParityRig.md got a historical banner + four inline scrubs marking the OtOpcUaGalaxyHost service / Driver.Galaxy.Host EXE / Driver.Galaxy.ParityTests project as deleted-in-PR-7.2. The repo's live-reading surface (README + CLAUDE.md + docs/v2/) now describes only the post-PR-7.2 architecture. v1 docs are preserved as a labelled archive under docs/v1/. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-30 08:59:59 -04:00
Joseph Doherty	d11dd0520b	Galaxy IPC unblock — live dev-box E2E path ... Three root-cause fixes to get an elevated dev-box shell past session open through to real MXAccess reads: 1. PipeAcl — drop BUILTIN\Administrators deny ACE. UAC's filtered token carries the Admins SID as deny-only, so the deny fired even from non-elevated admin-account shells. The per-connection SID check in PipeServer.VerifyCaller remains the real authorization boundary. 2. PipeServer — swap the Hello-read / VerifyCaller order. ImpersonateNamedPipeClient returns ERROR_CANNOT_IMPERSONATE until at least one frame has been read from the pipe; reading Hello first satisfies that rule. Previously the ACL deny-first path masked this race — removing the deny ACE exposed it. 3. GalaxyIpcClient — add a background reader + single pending-response slot. A RuntimeStatusChange event between OpenSessionRequest and OpenSessionResponse used to satisfy the caller's single ReadFrameAsync and fail CallAsync with "Expected OpenSessionResponse, got RuntimeStatusChange". The reader now routes response kinds (and ErrorResponse) to the pending TCS and everything else to a handler the driver registers in InitializeAsync. The Proxy was already set up to raise managed events from RaiseDataChange / RaiseAlarmEvent / OnHostConnectivityUpdate — those helpers had no caller until now. 4. RedundancyPublisherHostedService — swallow BadServerHalted while polling host.Server.CurrentInstance. StandardServer throws that code during startup rather than returning null, so the first poll attempt crashed the BackgroundService (and the host) before OnServerStarted ran. This race was latent behind the Galaxy init failure above. Updates docs that described the Admins deny ACE + mandatory non-elevated shells, and drops the admin-skip guards from every Galaxy integration + E2E fixture that had them (IpcHandshakeIntegrationTests, EndToEndIpcTests, ParityFixture, LiveStackFixture, HostSubprocessParityTests). Adds GalaxyIpcClientRoutingTests covering the router's request/response match, ErrorResponse, event-between-call, idle event, and peer-close paths. Verified live on the dev box against the p7-smoke cluster (gen 6): driver registered=1 failedInit=0, Phase 7 bridge subscribed, OPC UA server up on 4840, MXAccess read round-trip returns real data with Status=0x00000000. Task #112 — partial: Galaxy live stack is functional end-to-end. The supplied test-galaxy.ps1 script still fails because the UNS walker encodes TagConfig JSON as the tag's NodeId instead of the seeded TagId (pre-existing; separate issue from this commit). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-24 16:30:16 -04:00
Joseph Doherty	71339307fa	Doc refresh (task #203) — driver docs split + drivers index + IHistoryProvider-aware HistoricalDataAccess ... Restructure the driver-facing docs to match the OtOpcUa v2 multi-driver reality (Galaxy, Modbus, S7, AB CIP, AB Legacy, TwinCAT, FOCAS, OPC UA Client — 8 drivers total; Galaxy ships as three projects) and the capability-interface architecture where every driver opts into IDriver + whichever of IReadable / IWritable / ITagDiscovery / ISubscribable / IHostConnectivityProbe / IPerCallHostResolver / IAlarmSource / IHistoryProvider / IRediscoverable it supports. Doc scope follows the code: one-driver-specific docs scoped to that driver, cross-driver concerns live once at the top level, per-driver specs cross-link to docs/v2/driver-specs.md rather than duplicate. What changed per file: - docs/MxAccessBridge.md -> docs/drivers/Galaxy.md (git mv + rewrite): retitled "Galaxy Driver", reframed as one of seven drivers. Added Project Split table (Shared .NET Standard 2.0 / Host .NET 4.8 x86 / Proxy .NET 10) and Why Out-of-Process section citing both the MXAccess bitness constraint and Tier C stability isolation per docs/v2/plan.md section 4. Added IPC Transport section covering pipe naming, MessagePack framing, DACL that denies Admins, shared-secret handshake, heartbeat, and CallAsync<TReq,TResp> dispatch. Moved file paths from src/ZB.MOM.WW.LmxOpcUa.Host/MxAccess/* to src/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host/Backend/MxAccess/* and added the Shared + Proxy key-file tables. Added CapabilityInvoker + OTOPCUA0001 analyzer callout. Cross-linked to drivers/README.md, Galaxy-Repository.md, HistoricalDataAccess.md. - docs/GalaxyRepository.md -> docs/drivers/Galaxy-Repository.md (git mv + rewrite): retitled "Galaxy Repository — Tag Discovery for the Galaxy Driver", opened with a comparison table showing how every driver's ITagDiscovery source is different (AB CIP @tags walker, TwinCAT SymbolLoaderFactory, FOCAS CNC queries, OPC UA Client Session.Browse, etc). Repositioned GalaxyRepositoryService as the Galaxy driver's ITagDiscovery.DiscoverAsync implementation. Updated paths to Driver.Galaxy.Host/Backend/GalaxyRepository/*. Added IRediscoverable section covering the on-change-redeploy IPC path. - docs/drivers/README.md (new): index with ground-truth driver table — project path, stability tier, wire library, capability-interface list, and one notable quirk per driver. Verified against the driver csproj files and class declarations on focas-pr3-remaining-capabilities (the most recent branch containing every driver). Galaxy gets its own dedicated docs; the other seven drivers cross-link to docs/v2/driver-specs.md. Lists the full Core.Abstractions capability surface, DriverTypeRegistry, CapabilityInvoker, and OTOPCUA0001 analyzer. - docs/HistoricalDataAccess.md (rewrite): reframed around IHistoryProvider as a per-driver optional capability interface. Replaced v1 HistorianPluginLoader / AvevaHistorianPluginEntry plugin architecture with the v2 story — Historian.Aveva was merged into Driver.Galaxy.Host/Backend/Historian/ and IPC-forwarded through GalaxyProxyDriver. Documented all four IHistoryProvider methods (ReadRawAsync / ReadProcessedAsync / ReadAtTimeAsync / ReadEventsAsync), CapabilityInvoker wrapping with DriverCapability.HistoryRead, and the per-driver coverage matrix (Galaxy + OPC UA Client implement; the six protocol drivers don't and return BadHistoryOperationUnsupported). Kept the cluster-failover + health-counter + quality-mapping detail for the Galaxy Historian implementation. Flagged one gap: Proxy forwards all four history message kinds but the Host-side HistoryAggregateType -> AnalogSummary column mapping may surface GalaxyIpcException{Code="not-implemented"} on a given branch until the Phase 2 Galaxy out-of-process gate lands. Driver list built against ground truth (src on focas-pr3-remaining-capabilities): Driver.Galaxy.{Shared,Host,Proxy}, Driver.Modbus, Driver.S7, Driver.AbCip, Driver.AbLegacy, Driver.TwinCAT, Driver.FOCAS, Driver.OpcUaClient. Capability interface lists verified against each *Driver.cs class declaration. Aveva Historian ported to Driver.Galaxy.Host/Backend/Historian/; no separate Historian.Aveva assembly on v2 branches. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-20 01:33:53 -04:00