docs(alarms): record native alarms verified working; add D.1 smoke

The 2026-04-30 alarm plan banners claimed worker-side native alarm subscription was blocked on a COM-bitness finding. That's stale: the mxaccessgw .NET client now has true MxAccess alarm-event support, and a live StreamAlarms check (+ new Skip-gated GatewayGalaxyAlarmFeedLiveTests through the lmxopcua consumer) confirms native alarms — operator comment, category, severity, timestamps — flow end-to-end. Reconcile both plan docs to reality and add docs/plans/alarms-d1-smoke-artifact.md as the D.1 alarm-source deliverable. Historian-write live smoke + full server->A&C round-trip remain (Windows parity rig only).
fix(adminui): wire Test Connect probes + live panels on admin-only nodes
2026-05-31 09:59:01 -04:00 · 2026-05-29 16:38:32 -04:00 · 2026-05-29 12:45:44 -04:00 · 2026-05-29 12:31:55 -04:00 · 2026-05-29 12:18:01 -04:00 · 2026-05-29 12:09:21 -04:00
161 changed files with 10339 additions and 828 deletions
@@ -21,6 +21,8 @@ desktop.ini
 # NuGet
 packages/
 *.nupkg
+# … but DO track repo-local feed for mxaccessgw client (not yet on public nuget.org).
+!nuget-packages/*.nupkg

 # Certificates
 *.pfx
@@ -150,3 +150,5 @@ dotnet run --project src/Client/ZB.MOM.WW.OtOpcUa.Client.CLI -- browse -u opc.tc
 dotnet run --project src/Client/ZB.MOM.WW.OtOpcUa.Client.CLI -- read -u opc.tcp://localhost:4840 -n "ns=2;s=SomeNode"
 dotnet run --project src/Client/ZB.MOM.WW.OtOpcUa.Client.CLI -- subscribe -u opc.tcp://localhost:4840 -n "ns=2;s=SomeNode" -i 500
 ```
+
+Address pickers in AdminUI support live browse for OpcUaClient and Galaxy drivers — see `docs/plans/2026-05-28-driver-browsers-design.md`.
@@ -33,7 +33,6 @@
    <PackageVersion Include="libplctag" Version="1.5.2" />
    <PackageVersion Include="LiteDB" Version="5.0.21" />
    <PackageVersion Include="MessagePack" Version="2.5.187" />
-    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.7" />
    <PackageVersion Include="Microsoft.AspNetCore.Authorization" Version="10.0.7" />
    <PackageVersion Include="Microsoft.AspNetCore.DataProtection" Version="10.0.7" />
    <PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="10.0.7" />
@@ -97,5 +96,7 @@
    <PackageVersion Include="xunit" Version="2.9.2" />
    <PackageVersion Include="xunit.runner.visualstudio" Version="3.0.2" />
    <PackageVersion Include="xunit.v3" Version="1.1.0" />
+    <PackageVersion Include="ZB.MOM.WW.MxGateway.Client" Version="0.1.0" />
+    <PackageVersion Include="ZB.MOM.WW.MxGateway.Contracts" Version="0.1.0" />
  </ItemGroup>
 </Project>
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <packageSources>
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
+    <add key="local-mxgw" value="./nuget-packages" />
+  </packageSources>
+</configuration>
@@ -21,6 +21,7 @@
  </Folder>
  <Folder Name="/src/Drivers/">
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.csproj" />
+    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Wonderware/ZB.MOM.WW.OtOpcUa.Driver.Historian.Wonderware.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Wonderware.Client/ZB.MOM.WW.OtOpcUa.Driver.Historian.Wonderware.Client.csproj" />
@@ -40,6 +41,7 @@
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Contracts/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Contracts.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts.csproj" />
+    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.csproj" />
  </Folder>
  <Folder Name="/src/Drivers/Driver CLIs/">
    <Project Path="src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common.csproj" />
@@ -80,6 +82,7 @@
  </Folder>
  <Folder Name="/tests/Drivers/">
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Tests.csproj" />
+    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser.Tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser.Tests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Wonderware.Tests/ZB.MOM.WW.OtOpcUa.Driver.Historian.Wonderware.Tests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Wonderware.Client.Tests/ZB.MOM.WW.OtOpcUa.Driver.Historian.Wonderware.Client.Tests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests.csproj" />
@@ -97,6 +100,8 @@
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.IntegrationTests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests.csproj" />
+    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.Tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.Tests.csproj" />
+    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.IntegrationTests.csproj" />
  </Folder>
  <Folder Name="/tests/Drivers/Driver CLIs/">
    <Project Path="tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common.Tests/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common.Tests.csproj" />
@@ -98,7 +98,7 @@ services:
      Security__Jwt__Issuer: "otopcua-dev"
      Security__Jwt__Audience: "otopcua-dev"
      Authentication__Ldap__DevStubMode: "true"
-      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua__UY_NKlBl3vWuZt8HD7usfZsU76eibMKB6CufwzabUI}"
+      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua2_GI7-tNozYE6cXGUSgEzL3AHDV7bYcYIHdMwKYgyHdX4}"

  admin-b:
    <<: *otopcua-host
@@ -115,7 +115,7 @@ services:
      Security__Jwt__Issuer: "otopcua-dev"
      Security__Jwt__Audience: "otopcua-dev"
      Authentication__Ldap__DevStubMode: "true"
-      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua__UY_NKlBl3vWuZt8HD7usfZsU76eibMKB6CufwzabUI}"
+      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua2_GI7-tNozYE6cXGUSgEzL3AHDV7bYcYIHdMwKYgyHdX4}"

  driver-a:
    <<: *otopcua-host
@@ -129,7 +129,7 @@ services:
      Cluster__Roles__0: "driver"
      # Resolved at runtime by GalaxyDriver.ResolveApiKey when a DriverInstance's
      # Gateway.ApiKeySecretRef = "env:GALAXY_MXGW_API_KEY".
-      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua__UY_NKlBl3vWuZt8HD7usfZsU76eibMKB6CufwzabUI}"
+      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua2_GI7-tNozYE6cXGUSgEzL3AHDV7bYcYIHdMwKYgyHdX4}"
    ports:
      - "4840:4840"

@@ -143,7 +143,7 @@ services:
      Cluster__PublicHostname: "driver-b"
      Cluster__SeedNodes__0: "akka.tcp://otopcua@admin-a:4053"
      Cluster__Roles__0: "driver"
-      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua__UY_NKlBl3vWuZt8HD7usfZsU76eibMKB6CufwzabUI}"
+      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua2_GI7-tNozYE6cXGUSgEzL3AHDV7bYcYIHdMwKYgyHdX4}"
    ports:
      - "4841:4840"

@@ -168,7 +168,7 @@ services:
      Security__Jwt__Issuer: "otopcua-dev"
      Security__Jwt__Audience: "otopcua-dev"
      Authentication__Ldap__DevStubMode: "true"
-      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua__UY_NKlBl3vWuZt8HD7usfZsU76eibMKB6CufwzabUI}"
+      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua2_GI7-tNozYE6cXGUSgEzL3AHDV7bYcYIHdMwKYgyHdX4}"
    ports:
      - "4842:4840"

@@ -191,7 +191,7 @@ services:
      Security__Jwt__Issuer: "otopcua-dev"
      Security__Jwt__Audience: "otopcua-dev"
      Authentication__Ldap__DevStubMode: "true"
-      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua__UY_NKlBl3vWuZt8HD7usfZsU76eibMKB6CufwzabUI}"
+      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua2_GI7-tNozYE6cXGUSgEzL3AHDV7bYcYIHdMwKYgyHdX4}"
    ports:
      - "4843:4840"

@@ -213,7 +213,7 @@ services:
      Security__Jwt__Issuer: "otopcua-dev"
      Security__Jwt__Audience: "otopcua-dev"
      Authentication__Ldap__DevStubMode: "true"
-      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua__UY_NKlBl3vWuZt8HD7usfZsU76eibMKB6CufwzabUI}"
+      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua2_GI7-tNozYE6cXGUSgEzL3AHDV7bYcYIHdMwKYgyHdX4}"
    ports:
      - "4844:4840"

@@ -236,7 +236,7 @@ services:
      Security__Jwt__Issuer: "otopcua-dev"
      Security__Jwt__Audience: "otopcua-dev"
      Authentication__Ldap__DevStubMode: "true"
-      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua__UY_NKlBl3vWuZt8HD7usfZsU76eibMKB6CufwzabUI}"
+      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua2_GI7-tNozYE6cXGUSgEzL3AHDV7bYcYIHdMwKYgyHdX4}"
    ports:
      - "4845:4840"

@@ -248,7 +248,7 @@ services:
      - --providers.file.watch=true
      - --api.insecure=true
    ports:
-      - "80:80"
+      - "9200:80"  # host port 9200 → traefik :80 entrypoint (80 conflicts with scadabridge-traefik)
      - "8089:8080"  # 8080 conflicts with the sister scadalink dev stack
    volumes:
      - ./traefik-dynamic.yml:/etc/traefik/dynamic.yml:ro
@@ -0,0 +1,313 @@
+# Live address browsers for OpcUaClient + Galaxy drivers — design
+
+> **Status:** approved 2026-05-28. Implementation plan to follow via `writing-plans`.
+> **Builds on:** PR that shipped driver-specific AdminUI pages (commit `0d3ec46`).
+> Both `OpcUaClientAddressPickerBody.razor` and `GalaxyAddressPickerBody.razor` were
+> intentionally shipped as static stubs ("enter the string manually") with live
+> browse deferred to this follow-up.
+
+**Goal:** Add lazy, ad-hoc browse trees to the OpcUaClient and Galaxy address pickers in the AdminUI, so operators can navigate the remote server's (or galaxy's) hierarchy and pick an address rather than typing it.
+
+**Architecture:** A new `IDriverBrowser` abstraction registered per driver type (parallel to the runtime's `IDriverProbe`), with implementations housed in sibling `*.Browser` projects under `src/Drivers/`. AdminUI owns the live browse sessions in-process via a `BrowseSessionRegistry` singleton with a 2-minute idle TTL and an `IHostedService` reaper. Razor picker bodies talk to a scoped `IBrowserSessionService`; no actor messages on the hot path.
+
+**Tech stack:** .NET 10 / Blazor Server / OPCFoundation.NetStandard.Opc.Ua.Client / `ZB.MOM.WW.MxGateway.Client` (sibling repo, lazy-browse API already shipped).
+
+---
+
+## 1. Architecture
+
+### Abstraction
+
+```csharp
+// Commons (shared)
+public interface IDriverBrowser {
+    string DriverType { get; }                                      // "OpcUaClient", "Galaxy", ...
+    Task<IBrowseSession> OpenAsync(string configJson, CancellationToken ct);
+}
+
+public interface IBrowseSession : IAsyncDisposable {
+    Guid Token { get; }
+    DateTime LastUsedUtc { get; }
+    Task<IReadOnlyList<BrowseNode>> RootAsync(CancellationToken ct);
+    Task<IReadOnlyList<BrowseNode>> ExpandAsync(string nodeId, CancellationToken ct);
+    Task<IReadOnlyList<AttributeInfo>> AttributesAsync(string nodeId, CancellationToken ct); // empty for OPC UA
+}
+
+public sealed record BrowseNode(
+    string NodeId,             // address persisted on commit
+    string DisplayName,
+    BrowseNodeKind Kind,       // Folder | Leaf
+    bool HasChildrenHint);
+
+public sealed record AttributeInfo(
+    string Name,               // e.g. "DownloadPath"
+    string DriverDataType,
+    bool   IsArray,
+    string SecurityClass);     // FreeAccess | Operate | Tune | Configure | ViewOnly
+
+public enum BrowseNodeKind { Folder, Leaf }
+```
+
+### Session lifecycle
+
+1. Razor picker body calls `BrowserSessionService.OpenAsync(driverType, formJson)`
+2. Service resolves `IDriverBrowser` from DI by driver type, calls `OpenAsync(json)`
+3. Returns `IBrowseSession`; service registers it in `BrowseSessionRegistry` under a new `Guid` token
+4. Razor stores token, calls `RootAsync(token)` to populate the initial tree
+5. Each subsequent expand-click calls `ExpandAsync(token, nodeId)`
+6. Picker body's `IAsyncDisposable.DisposeAsync` fires `CloseAsync(token)` on tear-down
+7. `BrowseSessionReaper` (`IHostedService`) ticks every 30s, evicts any session where `(UtcNow - LastUsedUtc) > 2 min`, awaits `DisposeAsync`
+
+The session genuinely has no value to other cluster nodes — it's tied to one circuit. Hosting it in-process avoids cross-cluster Ask latency on every folder click.
+
+---
+
+## 2. Components
+
+### New projects
+
+| Path | Purpose |
+|---|---|
+| `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser/` | OPC UA browser impl + session |
+| `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser/` | Galaxy browser impl + session |
+| `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.Tests/` | Unit tests (use opc-plc fixture) |
+| `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser.Tests/` | Unit tests (fake transport) |
+
+Driver-specific browsers live in **sibling** projects so AdminUI doesn't drag the runtime `Driver.*` projects (and their full SDK chains) through a transitive reference.
+
+### New abstractions
+
+| Path | Purpose |
+|---|---|
+| `src/Core/ZB.MOM.WW.OtOpcUa.Commons/Browsing/IDriverBrowser.cs` | Per-driver factory |
+| `src/Core/ZB.MOM.WW.OtOpcUa.Commons/Browsing/IBrowseSession.cs` | Session contract |
+| `src/Core/ZB.MOM.WW.OtOpcUa.Commons/Browsing/BrowseNode.cs` | + `BrowseNodeKind` enum + `AttributeInfo` |
+
+### AdminUI plumbing
+
+| Path | Purpose |
+|---|---|
+| `src/Server/.../AdminUI/Browsing/BrowseSessionRegistry.cs` | Singleton, `ConcurrentDictionary<Guid, IBrowseSession>` |
+| `src/Server/.../AdminUI/Browsing/BrowseSessionReaper.cs` | `IHostedService`, 30s tick, 2 min idle TTL |
+| `src/Server/.../AdminUI/Browsing/IBrowserSessionService.cs` | Scoped DI service for Razor |
+| `src/Server/.../AdminUI/Browsing/BrowserSessionService.cs` | Impl: resolve driver, register session, enforce per-call timeouts |
+| `src/Server/.../AdminUI/Components/Shared/Drivers/DriverBrowseTree.razor` | Shared lazy tree component with per-node text filter |
+
+### Modified files
+
+| Path | Change |
+|---|---|
+| `src/Server/.../Pickers/OpcUaClientAddressPickerBody.razor` | Add Browse button + DriverBrowseTree; keep manual entry |
+| `src/Server/.../Pickers/GalaxyAddressPickerBody.razor` | Same shape + side-panel for attribute pick |
+| `src/Server/.../AdminUI/Program.cs` | Register `IDriverBrowser` services + registry + reaper |
+| `src/Drivers/.../OpcUaClient.Contracts/NamespaceMap.cs` | Extract from runtime `Driver.OpcUaClient` for shared use |
+| `ZB.MOM.WW.OtOpcUa.slnx` | Add the four new projects |
+
+---
+
+## 3. Data flow
+
+**Open → tree → pick** (OpcUaClient as worked example; Galaxy identical except attribute side-panel before commit):
+
+```
+Razor picker body          BrowserSessionService          IDriverBrowser           Remote
+        |                          |                            |                       |
+   click Browse ────────► OpenAsync(driverType, json) ─► OpenAsync(json) ────────► connect + activate session
+        | ◄────────────────  token (Guid)               ◄───── ISession                  |
+        |                          |                            |                       |
+   render tree ─────────► RootAsync(token) ─────────────► session.RootAsync ─────► BrowseAsync(ObjectsFolder)
+        | ◄──────────────── BrowseNode[]                 ◄───── refs                     |
+        |                          |                            |                       |
+   click folder ────────► ExpandAsync(token, nodeId) ──► session.ExpandAsync ───► BrowseAsync(nodeId)
+        | ◄──────────────── BrowseNode[]                 ◄───── refs                     |
+        |                          |                            |                       |
+   click leaf + commit ─► CloseAsync(token) ─────────► session.DisposeAsync ───► CloseSession
+        |                          |                            |                       |
+```
+
+**Galaxy two-stage attribute pick:** after the user selects an object (Folder) in the tree, the picker body calls `AttributesAsync(token, tagName)` and renders the result as a side-panel. The user picks an attribute; the committed address is `tag_name.AttributeName`.
+
+**Stable address format:**
+- OpcUaClient: `nsu=<uri>;<localid>` via `NamespaceMap.ToStableReference` — survives remote namespace-table reorder across restarts
+- Galaxy: `tag_name` (the globally unique system name) — already stable by definition
+
+**Per-node text filter:** purely client-side over the already-loaded `node.Children`. No round-trip on filter input.
+
+---
+
+## 4. OpcUaClient browser specifics
+
+### Connection
+- Reuses `OpcUaClientDriverOptions` (deserialize with `UnmappedMemberHandling.Skip`)
+- Builds a **separate** `ApplicationConfiguration` from the runtime driver — PKI root at `%LocalAppData%/OtOpcUa/adminui-browse-pki/` (separate cert store)
+- `ApplicationName = "OtOpcUa AdminUI Browse"`, `ApplicationUri = "urn:OtOpcUa:AdminUI:Browse"`
+- Endpoint selection: same `DiscoveryClient.GetEndpointsAsync` → filter `(policy, mode)` as the runtime driver
+- One endpoint only (no failover) — interactive use; user retries with different URL on failure
+- Bounded by `OpcUaClientDriverOptions.PerEndpointConnectTimeout` (clamped [5, 30]s)
+
+### Namespace map
+- `NamespaceMap` class extracted to `OpcUaClient.Contracts` so both runtime and Browser projects share one impl
+- Browser builds the map from the live session on open; uses `ToStableReference` for outbound NodeIds; uses `TryResolve` for inbound
+
+### Lazy browse
+- One level per click using `Session.BrowseAsync` + `BrowseNextAsync` continuation-point loop
+- `BrowseDescriptionCollection` filters to `NodeClass.Object | NodeClass.Variable`, `ResultMask = BrowseName | DisplayName | NodeClass`
+- `BrowseNode.HasChildrenHint = (Kind == Folder)` — heuristic; saves a per-node round-trip
+- Inside-session calls guarded by `SemaphoreSlim _gate` (same pattern as runtime driver — OPC UA `Session.BrowseAsync` not thread-safe)
+
+### Cert handling
+- `AutoAcceptCertificates = true` honored with parity to runtime + log warning + per-session unwire on dispose
+- `AutoAcceptCertificates = false` + untrusted cert → `OpenAsync` fails with SDK error message in the UI
+
+### Reconnect handling
+- None. Browse sessions are short-lived (2 min idle TTL). Keep-alive failure → UI surfaces error chip → user re-clicks Browse.
+
+---
+
+## 5. Galaxy browser specifics
+
+### Connection
+- Reuses `GalaxyDriverOptions` (deserialize with `UnmappedMemberHandling.Skip`)
+- Opens `MxGatewaySession` with `ClientName = "OtOpcUa-AdminUI-Browse"` — distinct from runtime driver's name so the gateway can attribute load
+- Per-call gateway client built via `session.GalaxyRepository(opts.GalaxyName)`
+
+### Lazy browse
+- Root: `client.BrowseAsync(new BrowseChildrenOptions(), ct)` → `IReadOnlyList<LazyBrowseNode>`
+- Expand: cached `LazyBrowseNode` lookup by `tag_name`, then `node.ExpandAsync(ct)` (gateway client handles paging internally)
+- No internal gate — `LazyBrowseNode.ExpandAsync` already has its own lock; gateway client is thread-safe across distinct calls
+
+### Two-stage attribute pick
+- Galaxy `BrowseNode.Kind` is always `Folder` — leaves don't exist at tree level
+- When the user clicks an object node, picker body calls `AttributesAsync(token, tagName)` and shows the result as a side-panel listing `(Name, DriverDataType, IsArray, SecurityClass)`
+- On attribute click, committed address is `$"{tagName}.{attrName}"`
+- Backing call: either `BrowseChildrenOptions { IncludeAttributes = true }` filtered to the GobjectId, or a dedicated `GetAttributesAsync(GobjectId, ct)` — to be confirmed during plan write against the gateway client surface
+
+### Filters in v1
+- Per-node text filter (client-side) for tree navigation
+- Server-side filters (`TagNameGlob`, `AlarmBearingOnly`, `HistorizedOnly`) deferred to a follow-up — easy to add later without breaking the wire (the session is constructed today with `new BrowseChildrenOptions()`)
+
+---
+
+## 6. Error handling, timeouts, TTL
+
+### Failures
+- `OpenAsync` → catches `Exception`, logs Info, returns typed `BrowseOpenResult(Ok: false, Message, Token: Empty)`. UI shows red chip with truncated SDK message
+- `ExpandAsync` / `AttributesAsync` → same shape per-call. Failed branch shows error chip; rest of tree intact; session stays alive
+- `BrowseSessionNotFoundException` when token unknown (session reaped or never existed)
+
+### Timeouts
+- Per-call expand/attributes: **20 s** via `CTS.CreateLinkedTokenSource(callerCt)` in `BrowserSessionService`
+- Session open: **30 s** ceiling; OPC UA reuses `PerEndpointConnectTimeout` (default 10 s), Galaxy hardcodes 30 s for `MxGatewaySession.OpenAsync`
+
+### TTL & reaping
+- `LastUsedUtc` set on every `RootAsync`/`ExpandAsync`/`AttributesAsync`
+- Reaper: `IHostedService` with `PeriodicTimer(30s)`. On each tick: snapshot keys; for any session with `(UtcNow - LastUsedUtc) > 120s`: `TryRemove` then `await DisposeAsync` outside the dictionary
+- Concurrent `ExpandAsync` racing eviction → caller catches closed-session error → service translates to `BrowseSessionNotFoundException`
+- On AdminUI shutdown: `StopAsync` walks the registry once and disposes all sessions
+
+### Concurrency
+- `BrowseSessionRegistry` = `ConcurrentDictionary<Guid, IBrowseSession>` — no extra lock
+- OpcUaClient session serializes browse on `SemaphoreSlim`; Galaxy session relies on its internal locks
+
+### Component dispose
+- Razor picker body implements `IAsyncDisposable`
+- Fires `CloseAsync(token)` fire-and-forget (no await) so circuit teardown isn't blocked by a gRPC roundtrip
+- Reaper is the safety net if dispose doesn't fire
+
+### Logging
+- Serilog. Info at open + close, Debug at close-with-reason (`user-close | idle-ttl | shutdown`), Info on failure
+- No per-expand logging (noise)
+
+### Audit trail
+- None — browse is read-only and doesn't mutate config or driver state (matches probe pattern)
+
+---
+
+## 7. Security & auth
+
+### Role gating
+- Browse button gated by existing `DriverOperator` LDAP policy — same as Reconnect/Restart in `DriverStatusPanel`
+- Picker bodies check policy in `OnInitializedAsync` via `IAuthorizationService` and `AuthenticationStateProvider`
+- Manual entry stays available regardless of role
+
+### Credentials in JSON
+- Form JSON posted to `BrowserSessionService.OpenAsync` contains plaintext passwords / API keys — same as the existing `TestDriverConnect` probe
+- JSON is deserialized into typed Options → used to build SDK config → both released; no `_lastConfigJson` cached field anywhere in the registry or session impls
+- Browse session tokens are `Guid.NewGuid()` and only ever cross the authenticated Blazor circuit
+
+### Cert handling
+- `AutoAcceptCertificates = true` honored with log warning + per-session unwire on dispose
+- Browse PKI store separate from runtime PKI — browse-time accept doesn't poison the runtime driver's trust store
+
+### Rate limiting
+- None. DriverOperator role gating + 2-minute TTL is the budget. A bad actor with DriverOperator already has Reconnect/Restart capability
+
+### Multi-replica AdminUI
+- Sticky cookies (already configured via Traefik) pin a user to one replica → `BrowseSessionRegistry` is always co-located with the circuit that created the token
+- Failover → token invalid on new replica → UI re-opens gracefully
+
+---
+
+## 8. Testing
+
+### Unit tests — per-driver browsers
+- `tests/Drivers/.../OpcUaClient.Browser.Tests/`: against opc-plc at `opc.tcp://10.100.0.35:50000`. `OpcUaClientBrowseSessionTests`, `OpcUaClientDriverBrowserTests` (bad endpoint, auth rejected, bad JSON)
+- `tests/Drivers/.../Galaxy.Browser.Tests/`: fake `IGalaxyRepositoryClientTransport` (precedent in gateway-client repo). `GalaxyBrowseSessionTests`, `GalaxyDriverBrowserTests`
+
+### Unit tests — AdminUI plumbing (added to existing `tests/Server/AdminUI.Tests/`)
+- `BrowseSessionRegistryTests`: register/get/remove, concurrent registration
+- `BrowseSessionReaperTests`: virtual time, idle eviction, non-idle preservation, eviction-vs-in-flight-expand race
+- `BrowserSessionServiceTests`: open→root→expand→close, unknown driver type, per-call timeout enforced
+
+### Component tests
+- `DriverBrowseTree` lazy-expand contract with fake `IBrowserSessionService`; per-node filter filters DOM but does not call ExpandAsync; click caching
+- Picker bodies: Browse button hidden when `!_canOperate`; manual entry still works
+
+### Integration tests (opt-in, fixture-gated)
+- `tests/Drivers/.../OpcUaClient.Browser.IntegrationTests/`: end-to-end against opc-plc, 3-level expand + round-trip resolve. Skipped unless `OPCUA_SIM_ENDPOINT` set
+- No Galaxy integration suite in v1 (requires wonder-app-vd03; deferred)
+
+### Specific regression tests
+- Namespace-stable round-trip: open → browse → take returned NodeId string → `ExpandAsync(string)` → must resolve back to same NodeId
+- TTL reaper racing live ExpandAsync: `TryRemove` while expand is in-flight → safe, translates to `BrowseSessionNotFoundException`
+
+### Verification at PR time
+- `dotnet build ZB.MOM.WW.OtOpcUa.slnx` clean
+- `dotnet test tests/Server/.../AdminUI.Tests/` green (existing 51 + new ~12)
+- `dotnet test tests/Drivers/.../OpcUaClient.Browser.Tests/` with `lmxopcua-fix up opcuaclient`
+- `dotnet test tests/Drivers/.../Galaxy.Browser.Tests/` (no fixture)
+- Manual smoke: run AdminUI, edit an OpcUaClient driver, click Browse against opc-plc, pick a variable, verify the stored NodeId reads cleanly via Client CLI
+
+---
+
+## 9. Implementation sequencing (for plan-writing)
+
+Suggested phase split — each phase shippable + reviewable independently:
+
+1. **Phase 1 — Abstractions.** Add `IDriverBrowser`, `IBrowseSession`, `BrowseNode`, `AttributeInfo`, `BrowseNodeKind` to Commons. Empty build.
+2. **Phase 2 — Extract NamespaceMap.** Move from runtime `Driver.OpcUaClient` to `Driver.OpcUaClient.Contracts`; update runtime ref.
+3. **Phase 3 — OpcUaClient browser.** New `Driver.OpcUaClient.Browser` project; impl + unit tests against opc-plc.
+4. **Phase 4 — Galaxy browser.** New `Driver.Galaxy.Browser` project; impl + unit tests with fake transport. Confirm attribute-fetch API surface on `GalaxyRepositoryClient`.
+5. **Phase 5 — AdminUI plumbing.** `BrowseSessionRegistry`, `BrowseSessionReaper`, `BrowserSessionService`, DI wire-up in `Program.cs`. Unit tests.
+6. **Phase 6 — Shared `DriverBrowseTree.razor`.** Lazy tree component with per-node filter. Component tests with fake service.
+7. **Phase 7 — Wire pickers.** Update `OpcUaClientAddressPickerBody.razor` and `GalaxyAddressPickerBody.razor` to use `DriverBrowseTree` + DriverOperator gating + (Galaxy) attribute side-panel. Manual smoke test.
+8. **Phase 8 — Integration test + docs.** Opt-in opc-plc integration suite, design doc cross-references in `docs/`, `CLAUDE.md` (or `docs/security.md`) updates if needed.
+
+---
+
+## Decisions table
+
+| # | Decision | Rationale |
+|---|---|---|
+| 1 | Ad-hoc browse using form JSON | Mirrors `TestDriverConnect` probe; works for new drafts and existing drivers uniformly |
+| 2 | Tree + lazy load both drivers | Galaxy gateway just shipped `LazyBrowseNode.ExpandAsync` — symmetric UX possible |
+| 3 | AdminUI-hosted via `IDriverBrowser` factory | Browse is interactive (≥10 calls/session); cross-cluster Ask hop would multiply latency; session has no value to other nodes |
+| 4 | Sibling `*.Browser` projects | Keep AdminUI from pulling runtime `Driver.*` projects' SDK chains |
+| 5 | `NamespaceMap` to `OpcUaClient.Contracts` | Shared between runtime + browser, no new project needed |
+| 6 | Separate browse PKI store | Browse-time cert accept must not poison runtime driver's trust store |
+| 7 | Per-node client-side text filter (v1) | Quick UX win; server-side filters deferred |
+| 8 | 2 min idle TTL, 30s reaper tick | Matches typical user cadence; bounds resource exposure |
+| 9 | 20 s per-call / 30 s open timeouts | Interactive feel; longer hangs almost always mean broken remote |
+| 10 | DriverOperator role gating | Live remote connection is operationally privileged; matches Reconnect/Restart precedent |
+| 11 | No audit trail | Browse is read-only; matches probe pattern |
+| 12 | Galaxy two-stage attribute side-panel | One modal, no extra clicks vs. two-modal flow |
@@ -0,0 +1,24 @@
+{
+  "planPath": "docs/plans/2026-05-28-driver-browsers-plan.md",
+  "tasks": [
+    {"id": 1,  "subject": "Task 1: Phase 1 — Add IDriverBrowser/IBrowseSession/BrowseNode to Commons", "status": "pending"},
+    {"id": 2,  "subject": "Task 2: Phase 2 — Extract NamespaceMap to OpcUaClient.Contracts", "status": "pending", "blockedBy": [1]},
+    {"id": 3,  "subject": "Task 3: Phase 3a — Scaffold Driver.OpcUaClient.Browser project", "status": "pending", "blockedBy": [2]},
+    {"id": 4,  "subject": "Task 4: Phase 3b — Implement OpcUaClientBrowseSession", "status": "pending", "blockedBy": [3]},
+    {"id": 5,  "subject": "Task 5: Phase 3c — Implement OpcUaClientDriverBrowser factory", "status": "pending", "blockedBy": [4]},
+    {"id": 6,  "subject": "Task 6: Phase 3d — OpcUaClient.Browser tests (opc-plc fixture)", "status": "pending", "blockedBy": [5]},
+    {"id": 7,  "subject": "Task 7: Phase 4a — Scaffold Driver.Galaxy.Browser project", "status": "pending", "blockedBy": [1]},
+    {"id": 8,  "subject": "Task 8: Phase 4b — Implement GalaxyBrowseSession", "status": "pending", "blockedBy": [7]},
+    {"id": 9,  "subject": "Task 9: Phase 4c — Implement GalaxyDriverBrowser factory", "status": "pending", "blockedBy": [8]},
+    {"id": 10, "subject": "Task 10: Phase 4d — Galaxy.Browser tests (fake transport)", "status": "pending", "blockedBy": [9]},
+    {"id": 11, "subject": "Task 11: Phase 5a — BrowseSessionRegistry + reaper + service", "status": "pending", "blockedBy": [1]},
+    {"id": 12, "subject": "Task 12: Phase 5b — Wire DI in AddAdminUI()", "status": "pending", "blockedBy": [5, 9, 11]},
+    {"id": 13, "subject": "Task 13: Phase 5c — Tests for registry, reaper, service", "status": "pending", "blockedBy": [11]},
+    {"id": 14, "subject": "Task 14: Phase 6 — Shared DriverBrowseTree.razor", "status": "pending", "blockedBy": [12]},
+    {"id": 15, "subject": "Task 15: Phase 7a — Wire OpcUaClient picker to browser", "status": "pending", "blockedBy": [14]},
+    {"id": 16, "subject": "Task 16: Phase 7b — Wire Galaxy picker + attribute side-panel", "status": "pending", "blockedBy": [14]},
+    {"id": 17, "subject": "Task 17: Phase 8a — opc-plc integration test", "status": "pending", "blockedBy": [6]},
+    {"id": 18, "subject": "Task 18: Phase 8b — Manual smoke + CLAUDE.md update", "status": "pending", "blockedBy": [13, 15, 16, 17]}
+  ],
+  "lastUpdated": "2026-05-28T00:00:00Z"
+}
@@ -0,0 +1,132 @@
+# Design — Complete AdminUI deferred follow-ups
+
+**Date:** 2026-05-29
+**Status:** Approved (design); implementation plan to follow
+**Author:** Joseph Doherty (with Claude Code)
+
+## Background
+
+The AdminUI carried a family of "deferred / Phase C.2 follow-up" notes. A prior
+change stripped the stale *rendered roadmap banners* from the cluster list pages.
+Three remaining note groups were investigated to decide what real work they hide:
+
+- **Group 1 — driver-page inline notes** ("list-editor coming in a follow-up
+  phase" for tags/devices/endpoints; "typed-form-ifying Polly is a follow-up").
+  → **Real pending UI work.**
+- **Group 2 — RoleGrants** ("UI-driven editing of the mapping is deferred — it
+  implies a config-reload mechanism that doesn't exist yet"). → **Real work; half
+  the infra already exists.**
+- **Group 3 — source comments** (F15 Razor migration, F16 FleetStatusHub bridge,
+  "Phase 4" identity section, `TODO(3.3/3.4)` route collision). → **~90% stale**;
+  the referenced work already shipped (the F16 bridge is wired; the legacy
+  `DriverEdit.razor` no longer exists). Only the Polly typed form is real, and it
+  is already counted in Group 1.
+
+### Key facts established during exploration
+
+- **Driver-embedded tag/device lists in `DriverConfig` JSON are the runtime source
+  of truth.** Driver factories deserialize them and poll exactly those rows; the
+  canonical `Tag` table is orthogonal (OPC UA browse-tree only, never read by
+  drivers). So inline editors are meaningful, not redundant — editing them changes
+  what the driver polls on the next publish/reinitialize.
+- **Resilience** already has a strongly-typed model: `DriverResilienceOptions`
+  (`BulkheadMaxConcurrent`, `BulkheadMaxQueue`, `RecycleIntervalSeconds`,
+  `CapabilityPolicies: {DriverCapability → (TimeoutSeconds, RetryCount,
+  BreakerFailureThreshold)}`) with tier A/B/C defaults via `GetTierDefaults(tier)`
+  and a `DriverResilienceOptionsParser`. The stored JSON is an *override* shape;
+  null/absent keys fall back to tier defaults.
+- **LDAP role map**: the `LdapGroupRoleMapping` entity + migration +
+  `ILdapGroupRoleMappingService` (CRUD) already exist but are **not wired** into
+  login. `LdapAuthService` still reads the static appsettings `GroupToRole`
+  (`Dictionary<string,string>`). `RoleGrants.razor` is read-only.
+- **Testing**: no bUnit. Established pattern = test `FromOptions`/`ToOptions`
+  round-trips (xUnit + Shouldly in `AdminUI.Tests`) and services with in-memory EF
+  (`Configuration.Tests`).
+
+## Decisions
+
+- **Scope:** full build — all real follow-ups in Groups 1 & 2, plus Group 3
+  comment cleanup.
+- **List-editor UX:** modal-per-row with a shared shell component.
+- **LDAP reload semantics:** DB-backed, **live on the user's next sign-in**
+  (per-login DB query; no restart, no new infra). appsettings `GroupToRole` becomes
+  a bootstrap **fallback** layer.
+- **Roles are GLOBAL.** No cluster-level permissions / no per-cluster enforcement
+  (explicitly chosen for simplicity, reversing an earlier cluster-scoping answer).
+  Every `LdapGroupRoleMapping` row is `IsSystemWide=true`, `ClusterId=null`.
+
+## Workstreams
+
+### WS1 — Driver collection editors (modal-per-row + shared shell)
+
+- New generic `CollectionEditor<TRow>` component in `Components/Shared/Drivers/`:
+  compact read-only table + `[+ Add]` / per-row `Edit` / `Delete`, and a Bootstrap
+  modal editing a **working copy** of a row (commit on modal-Save, discard on
+  Cancel). Parameters: `List<TRow> Items` (bound), header fragment, read-only-cells
+  fragment, modal-body fragment, `NewRow` factory, optional `Validate` delegate.
+- Each driver page swaps its read-only `<pre>` for a `CollectionEditor` supplying
+  its own columns + modal fields. Edits mutate the in-memory `List<T>` already in
+  the page's `FormModel`; the page's existing **Save** serializes it into
+  `DriverConfig` — no new persistence path.
+- Coverage: tags (Modbus, AbCip, AbLegacy, TwinCAT, S7, FOCAS); devices (AbCip,
+  AbLegacy, TwinCAT, FOCAS); endpoints (OpcUaClient).
+- **Errors/validation:** required fields, duplicate Name within list,
+  driver-specific address format; delete confirm; list mutates only on valid commit.
+- **Testing:** per-driver `NewRow` factories + `Validate` methods unit-tested
+  directly; existing `*FormSerializationTests` extended for add/remove via the form
+  model. Modal interaction verified manually via `/run`.
+
+### WS2 — Resilience typed form
+
+- Replace the textarea in `DriverResilienceSection.razor` with a typed form bound to
+  a new mutable `ResilienceFormModel` (all fields nullable; null = tier default):
+  bulkhead concurrent/queue, recycle interval, and an 8-capability grid (Read,
+  Write, Discover, Subscribe, Probe, AlarmSubscribe, AlarmAcknowledge, HistoryRead)
+  of (timeout / retry / breaker-threshold).
+- `FromJson`/`ToJson` emit only non-null overrides (blank → `null`, preserving the
+  current "null = tier defaults" contract). The section gains a `DriverTier`
+  parameter; each driver page passes its known tier so `GetTierDefaults(tier)`
+  renders as placeholders. A collapsible "raw JSON" view remains as escape hatch.
+- **Errors:** non-negative / sane-range numeric validation; emitted JSON must
+  re-parse cleanly through `DriverResilienceOptionsParser`.
+- **Testing:** `ResilienceFormModel` round-trip tests in `AdminUI.Tests` —
+  blank→null, partial-override-preserved, emit→parse-back compatibility.
+
+### WS3 — Editable LDAP→role map (DB-backed, global, live on next sign-in)
+
+- `RoleGrants.razor` → full CRUD over `LdapGroupRoleMapping` via the existing
+  `ILdapGroupRoleMappingService`. **Global only**: `IsSystemWide=true`,
+  `ClusterId=null`; no cluster UI. Fields: LDAP group, `AdminRole`
+  (ConfigViewer/ConfigEditor/FleetAdmin), notes. A group may carry several roles
+  (multiple rows). Edit page gated to **FleetAdmin** (add a minimal FleetAdmin
+  authorization policy; confirm existing role-policy plumbing during plan-writing).
+- Wire the service into `LdapAuthService`: at login → resolve groups →
+  `GetByGroupsAsync` (indexed) → map roles → **merge appsettings `GroupToRole` as a
+  fallback layer** (used when no DB row covers a group). Edits take effect on the
+  user's next sign-in. DB rows authoritative + editable; appsettings entries shown
+  read-only as "fallback."
+- **Errors:** DB unreachable at login → catch, log, fall back to appsettings;
+  login never blocks. CRUD: no duplicate `(LdapGroup, Role)`; group/role required.
+- **Testing:** extend `LdapGroupRoleMappingServiceTests` (in-memory EF) for CRUD +
+  dedupe; new `RoleMapper` overload `Map(groups, dbRows, fallbackDict)` unit-tested
+  for merge + fallback precedence + DB-error fallback.
+
+### WS4 — Cleanup (runs last, after the features exist)
+
+- **Delete stale comments:** `FleetStatusHub.cs` ("passive channel / until the
+  bridge lands"), `EndpointRouteBuilderExtensions.cs` (F15), `DriverIdentitySection.razor`
+  ("Phase 4 / generic DriverEdit"), `DriverEditRouter.razor` + `DriverTypePicker.razor`
+  (`TODO(3.3/3.4)` + the "falls back to legacy DriverEdit" path — verify & clean,
+  legacy file is gone), and update `DriverResilienceSection.razor`'s comment.
+- **Strip rendered notes** now true: per-driver "list-editor coming in a follow-up
+  phase" notes, the OpcUaClient endpoint note, the resilience "typed-form-ifying
+  Polly is a follow-up" note, and the RoleGrants "UI-driven editing is deferred" note.
+
+## Cross-cutting
+
+- **No DB schema change** — `LdapGroupRoleMapping` migration already applied;
+  `DriverConfig`/`ResilienceConfig` columns unchanged.
+- **Definition of done:** build clean + `dotnet test` green + a `/run` pass
+  exercising the modal editors and role-map CRUD.
+- **Suggested sequence:** WS1 shared shell + Modbus tags as proof → remaining
+  drivers → WS2 → WS3 → WS4.
@@ -0,0 +1,26 @@
+{
+  "planPath": "docs/plans/2026-05-29-adminui-followups.md",
+  "branch": "feat/adminui-followups",
+  "tasks": [
+    {"id": 11, "plan": 1, "subject": "Task 1: Generic CollectionEditor<TRow> component", "status": "pending"},
+    {"id": 12, "plan": 2, "subject": "Task 2: Modbus tag editor (proof) + tests", "status": "pending", "blockedBy": [11]},
+    {"id": 13, "plan": 3, "subject": "Task 3: AbCip device+tag editors + tests", "status": "pending", "blockedBy": [11]},
+    {"id": 14, "plan": 4, "subject": "Task 4: AbLegacy device+tag editors + tests", "status": "pending", "blockedBy": [11]},
+    {"id": 15, "plan": 5, "subject": "Task 5: TwinCAT device+tag editors + tests", "status": "pending", "blockedBy": [11]},
+    {"id": 16, "plan": 6, "subject": "Task 6: FOCAS device+tag editors + tests", "status": "pending", "blockedBy": [11]},
+    {"id": 17, "plan": 7, "subject": "Task 7: S7 tag editor + tests", "status": "pending", "blockedBy": [11]},
+    {"id": 18, "plan": 8, "subject": "Task 8: OpcUaClient endpoint-URL editor + tests", "status": "pending", "blockedBy": [11]},
+    {"id": 19, "plan": 9, "subject": "Task 9: ResilienceFormModel + tests", "status": "pending"},
+    {"id": 20, "plan": 10, "subject": "Task 10: Typed resilience form in DriverResilienceSection", "status": "pending", "blockedBy": [19]},
+    {"id": 21, "plan": 11, "subject": "Task 11: RoleMapper.Merge overload + tests", "status": "pending"},
+    {"id": 22, "plan": 12, "subject": "Task 12: Register ILdapGroupRoleMappingService in DI", "status": "pending"},
+    {"id": 23, "plan": 13, "subject": "Task 13: Wire DB merge into AuthEndpoints.LoginAsync", "status": "pending", "blockedBy": [21, 22]},
+    {"id": 24, "plan": 14, "subject": "Task 14: Add FleetAdmin authorization policy", "status": "pending"},
+    {"id": 25, "plan": 15, "subject": "Task 15: RoleGrants.razor global CRUD (FleetAdmin-gated)", "status": "pending", "blockedBy": [22, 24]},
+    {"id": 26, "plan": 16, "subject": "Task 16: LdapGroupRoleMapping service tests (global CRUD)", "status": "pending"},
+    {"id": 27, "plan": 17, "subject": "Task 17: Delete stale source comments", "status": "pending", "blockedBy": [12, 13, 14, 15, 16, 17, 18, 20, 25]},
+    {"id": 28, "plan": 18, "subject": "Task 18: Strip now-true rendered notes", "status": "pending", "blockedBy": [12, 13, 14, 15, 16, 17, 18, 25]},
+    {"id": 29, "plan": 19, "subject": "Task 19: Full verification (build + test + /run)", "status": "pending", "blockedBy": [20, 23, 26, 27, 28]}
+  ],
+  "lastUpdated": "2026-05-29"
+}
@@ -0,0 +1,273 @@
+# Auth/login alignment with ScadaBridge — design
+
+> **Status:** approved 2026-05-29. Implementation plan to follow via `writing-plans`.
+> **Trigger:** browser hitting `http://localhost:9200/` rendered Chrome's `HTTP_RESPONSE_CODE_FAILURE` page because the cookie scheme's `OnRedirectToLogin` event was overridden to return 401 with no body, and the parallel JwtBearer scheme stamped `WWW-Authenticate: Bearer`. ScadaBridge sets `LoginPath` and lets the framework do its built-in browser-vs-AJAX heuristic; OtOpcUa diverged.
+
+**Goal:** Restore default browser-redirect ergonomics on protected GETs, retire the unused JwtBearer server-side scheme, and externalize cookie config — bringing OtOpcUa's auth structure into parity with ScadaBridge.
+
+**Architecture:** Single Cookie auth scheme. The JWT keeps minting (via `JwtTokenService`) and validating (in `CookieAuthenticationStateProvider`) as the **cookie payload only**; no `AddJwtBearer`, no parallel `Authorization: Bearer` validation. Cookie config (`Name`, `ExpiryMinutes`, `RequireHttpsCookie`) flows through the existing-but-unused `OtOpcUaCookieOptions` via a `Configure<IOptions<OtOpcUaCookieOptions>, ILoggerFactory>` PostConfigure step — same pattern ScadaBridge uses.
+
+**Tech stack:** .NET 10 / ASP.NET Core / `Microsoft.AspNetCore.Authentication.Cookies` only (drop `Microsoft.AspNetCore.Authentication.JwtBearer` from the wiring if its only remaining transitive use disappears with this change).
+
+---
+
+## 1. Architecture
+
+### Schemes
+
+| Before | After |
+|---|---|
+| Cookie (primary) + JwtBearer (parallel) | Cookie only |
+| `FallbackPolicy` lists both schemes | `FallbackPolicy` lists Cookie only |
+| `OnRedirectToLogin` overridden to 401 | default behavior: 302 for browsers, 401 for AJAX |
+| `OnRedirectToAccessDenied` overridden to 403 | default behavior: 302 to `/Account/AccessDenied` (404s today; matches ScadaBridge) |
+
+### Cookie config — externalized via `OtOpcUaCookieOptions`
+
+```csharp
+public sealed class OtOpcUaCookieOptions
+{
+    public const string SectionName = "Security:Cookie";
+
+    public string Name { get; set; } = "ZB.MOM.WW.OtOpcUa.Auth";
+    public int ExpiryMinutes { get; set; } = 30;
+    public bool RequireHttpsCookie { get; set; } = true;
+}
+```
+
+Wired into `CookieAuthenticationOptions` via:
+```csharp
+services.AddOptions<CookieAuthenticationOptions>(CookieAuthenticationDefaults.AuthenticationScheme)
+    .Configure<IOptions<OtOpcUaCookieOptions>, ILoggerFactory>((cookieOpts, ourOpts, lf) =>
+    {
+        cookieOpts.Cookie.Name        = ourOpts.Value.Name;
+        cookieOpts.ExpireTimeSpan     = TimeSpan.FromMinutes(ourOpts.Value.ExpiryMinutes);
+        cookieOpts.SlidingExpiration  = true;
+        cookieOpts.Cookie.SecurePolicy = ourOpts.Value.RequireHttpsCookie
+            ? CookieSecurePolicy.Always
+            : CookieSecurePolicy.SameAsRequest;
+        if (!ourOpts.Value.RequireHttpsCookie)
+        {
+            lf.CreateLogger("ZB.MOM.WW.OtOpcUa.Security").LogWarning(
+                "Security:Cookie:RequireHttpsCookie is DISABLED — auth cookie SecurePolicy is SameAsRequest. " +
+                "Cookie travels in cleartext over plain HTTP. Dev-only.");
+        }
+    });
+```
+
+### Endpoint surface — unchanged
+
+| Path | Auth | Behavior |
+|---|---|---|
+| `POST /auth/login` | AllowAnonymous | LDAP auth → SignInAsync(Cookie); JSON callers get 204 / 401 / 503, form posters get 302 + cookie |
+| `POST /auth/logout` | RequireAuthorization | SignOutAsync(Cookie) |
+| `GET /auth/ping` | AllowAnonymous (handler-returns 200/401) | Polled by Blazor every 60s |
+| `POST /auth/token` | RequireAuthorization | Mints JWT for hypothetical external callers (matches ScadaBridge — they keep this even without JwtBearer wired) |
+
+### Cookie rename
+
+Old: `OtOpcUa.Auth`. New: `ZB.MOM.WW.OtOpcUa.Auth`. Effect: all sessions in flight at deploy time are invisible to the new handler → users re-prompt for login on next protected GET. No security impact (the old cookie expires per its own sliding window; nothing reads it).
+
+---
+
+## 2. Components
+
+### Files modified
+
+| File | Change |
+|---|---|
+| `src/Server/.../Security/CookieOptions.cs` | Add `RequireHttpsCookie`; change `Name` default to `ZB.MOM.WW.OtOpcUa.Auth` |
+| `src/Server/.../Security/ServiceCollectionExtensions.cs` | Drop `using JwtBearer`; delete `ConfigureJwtBearerFromTokenService` class; drop `.AddJwtBearer` + its IPostConfigureOptions registration; drop `OnRedirectToLogin` / `OnRedirectToAccessDenied` overrides; add `LoginPath` + `LogoutPath`; add PostConfigure block consuming `OtOpcUaCookieOptions`; remove `JwtBearerDefaults.AuthenticationScheme` from `FallbackPolicy` builder |
+| `tests/Server/.../Security.Tests/AuthEndpointsIntegrationTests.cs` | Update the `Set-Cookie` assertion on the login-success test from `OtOpcUa.Auth=` → `ZB.MOM.WW.OtOpcUa.Auth=` |
+
+### Files NOT modified
+
+| File | Why |
+|---|---|
+| `Endpoints/AuthEndpoints.cs` | Endpoint contracts unchanged |
+| `Jwt/JwtTokenService.cs` | Still mints JWT into cookie payload |
+| `Blazor/CookieAuthenticationStateProvider.cs` | Still polls `/auth/ping` |
+| `Ldap/*` | Untouched |
+| Razor login page | POST target unchanged |
+| `appsettings*.json` | Defaults are production-safe; no required config edit |
+
+### Tests added
+
+Single new file or appended class in `tests/Server/.../Security.Tests/`:
+
+```csharp
+public class AuthChallengeTests : AuthEndpointsTestBase
+{
+    [Fact]
+    public async Task Root_anonymous_browser_GET_redirects_to_login()
+    {
+        var client = NewClient(allowAutoRedirect: false);
+        client.DefaultRequestHeaders.Accept.ParseAdd("text/html");
+        var resp = await client.GetAsync("/", Ct);
+        resp.StatusCode.ShouldBe(HttpStatusCode.Found);                       // 302
+        resp.Headers.Location!.ToString().ShouldContain("/login");
+        resp.Headers.Location.ToString().ShouldContain("ReturnUrl");
+    }
+
+    [Fact]
+    public async Task Root_anonymous_xhr_GET_returns_401()
+    {
+        var client = NewClient(allowAutoRedirect: false);
+        client.DefaultRequestHeaders.Add("X-Requested-With", "XMLHttpRequest");
+        var resp = await client.GetAsync("/", Ct);
+        resp.StatusCode.ShouldBe(HttpStatusCode.Unauthorized);
+        // Framework still writes a Location header alongside the 401 — AJAX clients ignore it.
+    }
+}
+```
+
+**Framework reality vs. earlier hypothesis:** The ASP.NET Core cookie handler's `IsAjaxRequest` heuristic checks ONLY the `X-Requested-With: XMLHttpRequest` header, NOT the `Accept` content type. A request with `Accept: application/json` but no XHR header is classified as a browser → 302. The third test originally proposed (`Root_anonymous_json_GET_returns_401`) was dropped because it tests behavior the framework doesn't have. ScadaBridge accepts the same framework reality (it doesn't override the heuristic either).
+
+### Package references
+
+`src/Server/ZB.MOM.WW.OtOpcUa.Security/ZB.MOM.WW.OtOpcUa.Security.csproj`: remove `<PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" />` if grep confirms `JwtTokenService` doesn't itself need it (it uses `Microsoft.IdentityModel.Tokens` for validation parameters, separate package).
+
+---
+
+## 3. Data flow
+
+### Anonymous browser hits `/`
+
+```
+Browser → GET /
+          Accept: text/html
+                              ┌──> AuthN: no cookie → unauthenticated
+                              ├──> AuthZ FallbackPolicy fails
+                              └──> Cookie HandleChallengeAsync:
+                                     - Accept: text/html → browser
+                                     - 302 Location: /login?ReturnUrl=%2F
+Browser → GET /login          ← redirect followed; login page renders (AllowAnonymous)
+[user submits form]
+Browser → POST /auth/login    Content-Type: application/x-www-form-urlencoded
+                              ─── LoginAsync:
+                                    - LDAP authenticate
+                                    - SignInAsync(Cookie)
+                                    - Set-Cookie: ZB.MOM.WW.OtOpcUa.Auth=...
+                                    - 302 Location: / (or ReturnUrl)
+Browser → GET /               cookie present → AuthZ passes → 200 + Razor render
+```
+
+### XHR / fetch hits a protected endpoint without cookie
+
+```
+fetch('/api/something')       Accept: application/json
+                              X-Requested-With: XMLHttpRequest
+                              ┌──> AuthN: no cookie → unauthenticated
+                              ├──> AuthZ FallbackPolicy fails
+                              └──> Cookie HandleChallengeAsync:
+                                     - not text/html → API client
+                                     - 401 (no body, no Location)
+```
+
+The cookie handler's built-in `IsAjaxRequest` heuristic is what makes this work — it looks for `X-Requested-With: XMLHttpRequest`. No custom event handler needed. Note: requests with only `Accept: application/json` (no XHR header) are classified as browsers → 302; AJAX callers should set the XHR header to get 401.
+
+### Logout
+
+```
+fetch('/auth/logout', POST)   cookie present
+                              ─── LogoutAsync (RequireAuthorization passes):
+                                    - SignOutAsync(Cookie)
+                                    - Set-Cookie: ZB.MOM.WW.OtOpcUa.Auth=; expires=...
+                                    - 204 (or browser-form: 302 /login)
+```
+
+### Old cookie ignored
+
+Browser holds stale `OtOpcUa.Auth` from a session that predates the deploy. Cookie scheme is now configured for `ZB.MOM.WW.OtOpcUa.Auth` — old cookie is invisible. User treated as anonymous → 302 to `/login`. Old cookie sits in jar until its own sliding window expires (max 30 min); no security risk because nothing reads it.
+
+### Blazor `/auth/ping` polling
+
+```
+CookieAuthenticationStateProvider → GET /auth/ping every 60s
+                              cookie present → 200
+                              cookie expired/missing → 401
+Blazor → invalidates auth state → re-render → root [Authorize] fails
+       → Cookie HandleChallengeAsync → 302 /login
+```
+
+Unchanged.
+
+---
+
+## 4. Error handling
+
+| Surface | Behavior |
+|---|---|
+| Unknown `Accept` (`*/*`, missing, JSON) | Framework default: treated as non-AJAX → 302 to `/login`. The cookie handler's `IsAjaxRequest` only looks at `X-Requested-With`, NOT `Accept`. CLI tools that want a 401 should set `X-Requested-With: XMLHttpRequest`. |
+| `LoginAsync` bad creds | JSON: `401`. Form: `302 /login?error=…&returnUrl=…`. Handler-returned, unaffected by middleware changes. |
+| `LoginAsync` LDAP throws | `503 ServiceUnavailable`. Handler-returned. |
+| `LoginAsync` success | JSON: `204`. Form: `302 /` (or `ReturnUrl`). |
+| Cookie expires mid-request | Treated as anonymous → 302 to `/login` (browser) or 401 (AJAX). Active users kept alive by `SlidingExpiration = true`. |
+| `RequireHttpsCookie = false` over HTTPS | Cookie marked `SecurePolicy = SameAsRequest`. Misconfiguration risk; startup logs Warning every boot so it's audible. No validator-refused boot — default is `true`; dev compose explicitly opts out. |
+| Missing `Security:Cookie` section in config | `.Bind()` no-ops; defaults take over (`Name = ZB.MOM.WW.OtOpcUa.Auth`, `ExpiryMinutes = 30`, `RequireHttpsCookie = true`). Production-safe. |
+| `[Authorize(Policy="DriverOperator")]` denied for authenticated non-operator | Cookie handler redirects to default `AccessDeniedPath = "/Account/AccessDenied"` which 404s in OtOpcUa. Matches ScadaBridge; rare enough not to be a P0. Follow-up: add a minimal `/access-denied` Razor page. |
+
+---
+
+## 5. Testing
+
+### Existing tests pass unchanged
+
+- `Login_with_invalid_credentials_returns_401` — handler-returned, unaffected
+- `Login_when_ldap_throws_returns_503` — handler-returned, unaffected
+- `Ping_anonymous_returns_401` — handler-returned, unaffected
+- `Ping_after_cookie_login_returns_200` — uses HttpClient cookie container, picks up renamed cookie automatically
+- `Login_with_cookie_credentials_returns_204_and_sets_cookie` — needs one assertion update (cookie name)
+
+### Tests added (3 new)
+
+- `Root_anonymous_browser_GET_redirects_to_login` — asserts 302 + `Location` contains `/login` + `ReturnUrl`
+- `Root_anonymous_ajax_GET_returns_401` — `X-Requested-With: XMLHttpRequest` → 401, no `Location`
+  (the originally planned `Root_anonymous_json_GET_returns_401` was dropped — see Section 3 framework-reality note above)
+
+### Removed/orphaned tests
+
+None expected. The explore phase found no test depending on `ConfigureJwtBearerFromTokenService` or the `WWW-Authenticate: Bearer` response. Grep at plan-write time to confirm.
+
+### Manual smoke (docker-dev stack)
+
+1. `http://localhost:9200/` anonymously → expect 302 to `/login?ReturnUrl=%2F` (was: Chrome error page)
+2. Sign in via the form
+3. `http://localhost:9200/` authenticated → expect Razor dashboard
+4. DevTools → Application → Cookies → confirm `ZB.MOM.WW.OtOpcUa.Auth`
+5. `curl -i http://localhost:9200/` → `302 Found`, Location: `/login?ReturnUrl=%2F`
+6. `curl -i -H "Accept: application/json" http://localhost:9200/` → `401 Unauthorized`
+
+### Verification gates at PR time
+
+- `dotnet build ZB.MOM.WW.OtOpcUa.slnx` — zero new errors (pre-existing 12 unchanged)
+- `dotnet test tests/Server/ZB.MOM.WW.OtOpcUa.Security.Tests/` — all green
+- `dotnet test tests/Server/ZB.MOM.WW.OtOpcUa.AdminUI.Tests/` — all green
+- Manual Chrome smoke above passes
+
+---
+
+## 6. Sequencing (for plan-writing)
+
+Single-PR feature, but split into reviewable phases:
+
+1. **Phase 1 — Options class.** Extend `OtOpcUaCookieOptions` with `RequireHttpsCookie` and new `Name` default. Tests unaffected.
+2. **Phase 2 — Wiring rewrite.** Edit `ServiceCollectionExtensions.cs`: drop JwtBearer, drop event overrides, add `LoginPath`/`LogoutPath`, add PostConfigure consumption of `OtOpcUaCookieOptions`. Update the one existing test assertion. Build + existing Security.Tests green.
+3. **Phase 3 — New challenge tests.** Add the 3 new redirect/401 tests.
+4. **Phase 4 — Package cleanup.** Remove `Microsoft.AspNetCore.Authentication.JwtBearer` from csproj if grep confirms no remaining consumer.
+5. **Phase 5 — Manual smoke + commit.** Restart admin-a/admin-b in docker-dev; verify in Chrome.
+
+---
+
+## Decisions table
+
+| # | Decision | Rationale |
+|---|---|---|
+| 1 | Drop JwtBearer server-side scheme | No in-repo consumer; brought non-redirect 401 + `WWW-Authenticate: Bearer` to browser GETs |
+| 2 | Keep `JwtTokenService` + `/auth/token` | Token-as-cookie-payload is load-bearing for Blazor; `/auth/token` matches ScadaBridge surface |
+| 3 | Rename cookie `OtOpcUa.Auth` → `ZB.MOM.WW.OtOpcUa.Auth` | Naming parity with ScadaBridge; one-time forced sign-out acceptable |
+| 4 | Externalize via existing `OtOpcUaCookieOptions` + PostConfigure | Mirrors ScadaBridge pattern; fixes pre-existing bug where options class was bound but ignored |
+| 5 | Drop both `OnRedirectToLogin` and `OnRedirectToAccessDenied` overrides | Restores framework's browser-vs-AJAX heuristic; ScadaBridge does the same |
+| 6 | Set `LoginPath = "/login"`, `LogoutPath = "/auth/logout"` | Required for the framework's default redirect to work |
+| 7 | Accept 404 on `/Account/AccessDenied` for v1 | Matches ScadaBridge; rare path; follow-up to add minimal page |
+| 8 | Warning-log when `RequireHttpsCookie = false` | Audible misconfig signal; same as ScadaBridge |
@@ -0,0 +1,652 @@
+# Auth/login alignment with ScadaBridge — implementation plan
+
+> **For Claude:** REQUIRED SUB-SKILL: Use `superpowers-extended-cc:executing-plans` or `superpowers-extended-cc:subagent-driven-development` to implement this plan task-by-task.
+
+**Goal:** Match ScadaBridge's single-Cookie auth pattern: drop the unused JwtBearer parallel scheme, restore the framework's default browser-vs-AJAX challenge heuristic, and externalize cookie config through the existing-but-unused `OtOpcUaCookieOptions`.
+
+**Architecture:** Cookie-only auth. `JwtTokenService` keeps minting JWTs as the cookie payload (Blazor circuit hydration depends on it). Cookie name + idle timeout + HTTPS policy flow through `OtOpcUaCookieOptions` via a `Configure<IOptions<OtOpcUaCookieOptions>, ILoggerFactory>` PostConfigure step. Endpoint surface (`/auth/login`, `/auth/logout`, `/auth/ping`, `/auth/token`) unchanged.
+
+**Tech stack:** .NET 10 / ASP.NET Core / `Microsoft.AspNetCore.Authentication.Cookies` / xUnit v3 + Shouldly / `Microsoft.AspNetCore.TestHost.TestServer`.
+
+**Design doc:** `docs/plans/2026-05-29-auth-alignment-design.md` (commit `bc4fce5`). Each task below cites the design section it implements.
+
+---
+
+## Sequencing
+
+```
+Task 1 (Options class)
+   └─► Task 2 (Wiring rewrite + test assertion update)
+          ├─► Task 3 (3 new challenge tests)
+          └─► Task 4 (csproj cleanup)
+                 └─► Task 5 (manual smoke + final commit)
+```
+
+Tasks 3 and 4 are parallelizable (disjoint files).
+
+---
+
+## Task 1 — Extend `OtOpcUaCookieOptions`
+
+**Classification:** trivial
+**Estimated implement time:** ~2 min
+**Parallelizable with:** none (Task 2 depends on this)
+
+**Files:**
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.Security/CookieOptions.cs`
+
+**Implements design:** Section 1 (Architecture, "Cookie config — externalized") + Section 2 (Components, file table row 1).
+
+### Step 1: Replace file contents
+
+Current file (12 lines):
+```csharp
+namespace ZB.MOM.WW.OtOpcUa.Security;
+
+public sealed class OtOpcUaCookieOptions
+{
+    public const string SectionName = "Security:Cookie";
+
+    /// <summary>Gets or sets the cookie name.</summary>
+    public string Name { get; set; } = "OtOpcUa.Auth";
+
+    /// <summary>Idle sliding window, in minutes (default 30).</summary>
+    public int ExpiryMinutes { get; set; } = 30;
+}
+```
+
+Replace with:
+```csharp
+namespace ZB.MOM.WW.OtOpcUa.Security;
+
+/// <summary>
+///     Auth-cookie configuration bound from <c>Security:Cookie</c>. Consumed by a
+///     <c>Configure&lt;IOptions&lt;OtOpcUaCookieOptions&gt;, ILoggerFactory&gt;</c> step inside
+///     <c>AddOtOpcUaAuth</c> that copies the values onto <c>CookieAuthenticationOptions</c>.
+/// </summary>
+public sealed class OtOpcUaCookieOptions
+{
+    /// <summary>Configuration section name (<c>Security:Cookie</c>).</summary>
+    public const string SectionName = "Security:Cookie";
+
+    /// <summary>
+    ///     Auth cookie name. Default uses the <c>ZB.MOM.WW</c> convention; mirrors ScadaBridge's
+    ///     <c>ZB.MOM.WW.ScadaBridge.Auth</c>. Changing this invalidates existing sessions on next
+    ///     deploy.
+    /// </summary>
+    public string Name { get; set; } = "ZB.MOM.WW.OtOpcUa.Auth";
+
+    /// <summary>Idle sliding-window length in minutes (default 30).</summary>
+    public int ExpiryMinutes { get; set; } = 30;
+
+    /// <summary>
+    ///     Require HTTPS for the auth cookie. Default <c>true</c>: cookie is marked
+    ///     <c>SecurePolicy = Always</c>. Set to <c>false</c> ONLY for local dev stacks running
+    ///     plain HTTP — emits a startup Warning when disabled so the misconfiguration is
+    ///     audible.
+    /// </summary>
+    public bool RequireHttpsCookie { get; set; } = true;
+}
+```
+
+### Step 2: Build
+
+Run:
+```bash
+cd /Users/dohertj2/Desktop/OtOpcUa
+dotnet build src/Server/ZB.MOM.WW.OtOpcUa.Security/
+```
+Expected: 0 errors, 0 warnings.
+
+### Step 3: Commit
+
+```bash
+git -C /Users/dohertj2/Desktop/OtOpcUa add src/Server/ZB.MOM.WW.OtOpcUa.Security/CookieOptions.cs
+git -C /Users/dohertj2/Desktop/OtOpcUa commit -m "feat(security): extend OtOpcUaCookieOptions with RequireHttpsCookie + ZB.MOM.WW cookie name default"
+```
+
+### Output report
+
+- Lines before / after
+- Build clean
+- Commit SHA
+
+### Self-review checklist
+
+- [ ] `Name` default is `"ZB.MOM.WW.OtOpcUa.Auth"` (NOT `"OtOpcUa.Auth"`)
+- [ ] `RequireHttpsCookie` field added with default `true` and XML doc explaining the dev-only opt-out
+- [ ] `ExpiryMinutes` default unchanged at 30
+- [ ] `SectionName` constant unchanged
+- [ ] Build clean
+
+---
+
+## Task 2 — Rewrite auth wiring in `ServiceCollectionExtensions.cs`
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none (Tasks 3 and 4 depend on this)
+
+**Files:**
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.Security/ServiceCollectionExtensions.cs`
+- Modify: `tests/Server/ZB.MOM.WW.OtOpcUa.Security.Tests/AuthEndpointsIntegrationTests.cs:93`
+
+**Implements design:** Section 1 + Section 2 file table rows 2 + 3.
+
+### Step 1: Read current file
+
+```bash
+cat /Users/dohertj2/Desktop/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.Security/ServiceCollectionExtensions.cs
+```
+
+Current shape (relevant excerpt):
+- `using Microsoft.AspNetCore.Authentication.JwtBearer;` at top
+- `internal sealed class ConfigureJwtBearerFromTokenService(JwtTokenService tokenService) : IPostConfigureOptions<JwtBearerOptions>` class (lines ~15-35)
+- `.AddCookie(o => { ... })` with `OnRedirectToLogin` / `OnRedirectToAccessDenied` overrides
+- `.AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, _ => { })` chained after AddCookie
+- `services.AddSingleton<IPostConfigureOptions<JwtBearerOptions>, ConfigureJwtBearerFromTokenService>()` after the AddAuthentication block
+- `FallbackPolicy` builder takes both Cookie + JwtBearer schemes
+
+### Step 2: Replace the file with the new shape
+
+The full target file:
+
+```csharp
+using Microsoft.AspNetCore.Authentication.Cookies;
+using Microsoft.AspNetCore.DataProtection;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using ZB.MOM.WW.OtOpcUa.Configuration;
+using ZB.MOM.WW.OtOpcUa.Security.Jwt;
+using ZB.MOM.WW.OtOpcUa.Security.Ldap;
+
+namespace ZB.MOM.WW.OtOpcUa.Security;
+
+/// <summary>
+///     DI registration for OtOpcUa auth. Single Cookie scheme (the JWT lives inside the
+///     cookie as its credential payload); no JwtBearer parallel scheme. Matches ScadaBridge
+///     structurally — see <c>docs/plans/2026-05-29-auth-alignment-design.md</c>.
+/// </summary>
+public static class ServiceCollectionExtensions
+{
+    /// <summary>Wires cookie authentication, DataProtection key persistence to ConfigDb,
+    /// LDAP services, and the LDAP-backed JwtTokenService. Browser flows redirect to
+    /// <c>/login</c>; AJAX/JSON callers receive 401 (handled by the framework's default
+    /// challenge heuristic).</summary>
+    /// <param name="services">The service collection.</param>
+    /// <param name="configuration">The application configuration root.</param>
+    public static IServiceCollection AddOtOpcUaAuth(this IServiceCollection services, IConfiguration configuration)
+    {
+        services.AddOptions<JwtOptions>().Bind(configuration.GetSection(JwtOptions.SectionName));
+        services.AddOptions<OtOpcUaCookieOptions>().Bind(configuration.GetSection(OtOpcUaCookieOptions.SectionName));
+        services.AddOptions<LdapOptions>().Bind(configuration.GetSection(LdapOptions.SectionName));
+
+        services.AddSingleton<JwtTokenService>();
+        // Singleton — LdapAuthService is stateless (creates an LdapConnection per call) and
+        // must be consumable by the Singleton LdapOpcUaUserAuthenticator on driver-role nodes.
+        services.AddSingleton<ILdapAuthService, LdapAuthService>();
+
+        services.AddDataProtection()
+            .PersistKeysToDbContext<OtOpcUaConfigDbContext>()
+            .SetApplicationName("OtOpcUa");
+
+        services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
+            .AddCookie(o =>
+            {
+                // Static fields only — Name / ExpireTimeSpan / SecurePolicy / SlidingExpiration
+                // are bound from OtOpcUaCookieOptions in the PostConfigure block below.
+                o.LoginPath = "/login";
+                o.LogoutPath = "/auth/logout";
+                o.Cookie.HttpOnly = true;
+                o.Cookie.SameSite = SameSiteMode.Strict;
+                // No OnRedirectToLogin / OnRedirectToAccessDenied overrides — let the framework's
+                // built-in IsAjaxRequest heuristic do its thing (302 for browsers, 401 for AJAX).
+            });
+
+        // Externalised cookie config — mirrors ScadaBridge's PostConfigure pattern. Fixes a
+        // pre-existing latent bug where OtOpcUaCookieOptions was bound but ignored.
+        services.AddOptions<CookieAuthenticationOptions>(CookieAuthenticationDefaults.AuthenticationScheme)
+            .Configure<IOptions<OtOpcUaCookieOptions>, ILoggerFactory>((cookieOpts, ourOpts, lf) =>
+            {
+                var v = ourOpts.Value;
+                cookieOpts.Cookie.Name = v.Name;
+                cookieOpts.ExpireTimeSpan = TimeSpan.FromMinutes(v.ExpiryMinutes);
+                cookieOpts.SlidingExpiration = true;
+                cookieOpts.Cookie.SecurePolicy = v.RequireHttpsCookie
+                    ? CookieSecurePolicy.Always
+                    : CookieSecurePolicy.SameAsRequest;
+
+                if (!v.RequireHttpsCookie)
+                {
+                    lf.CreateLogger("ZB.MOM.WW.OtOpcUa.Security").LogWarning(
+                        "Security:Cookie:RequireHttpsCookie is DISABLED — auth cookie SecurePolicy is " +
+                        "SameAsRequest. The cookie-embedded JWT will travel in cleartext over plain HTTP. " +
+                        "Intended for local dev only — set Security:Cookie:RequireHttpsCookie=true in production.");
+                }
+            });
+
+        services.AddAuthorization(o =>
+        {
+            o.FallbackPolicy = new Microsoft.AspNetCore.Authorization.AuthorizationPolicyBuilder(
+                    CookieAuthenticationDefaults.AuthenticationScheme)
+                .RequireAuthenticatedUser()
+                .Build();
+
+            // DriverOperator: may issue Reconnect/Restart commands against live driver instances
+            // from the Admin UI DriverStatusPanel. Map LDAP group → role via GroupToRole in
+            // appsettings (e.g. "ot-driver-operator": "DriverOperator").
+            o.AddPolicy("DriverOperator", policy =>
+                policy.RequireRole("DriverOperator", "FleetAdmin"));
+        });
+
+        return services;
+    }
+}
+```
+
+What's gone (vs. the original):
+- `using Microsoft.AspNetCore.Authentication.JwtBearer;`
+- `ConfigureJwtBearerFromTokenService` internal class entirely
+- `.AddJwtBearer(...)` chain after `.AddCookie(...)`
+- `services.AddSingleton<IPostConfigureOptions<JwtBearerOptions>, ConfigureJwtBearerFromTokenService>();`
+- `OnRedirectToLogin` / `OnRedirectToAccessDenied` event overrides
+- Hardcoded `o.Cookie.Name = "OtOpcUa.Auth"`, `o.SlidingExpiration = true`, `o.ExpireTimeSpan = TimeSpan.FromMinutes(30)`, `o.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest`
+- `JwtBearerDefaults.AuthenticationScheme` from the `FallbackPolicy` builder
+
+What's added:
+- `using Microsoft.Extensions.Logging;`
+- `o.LoginPath = "/login"`, `o.LogoutPath = "/auth/logout"` inside `.AddCookie(...)`
+- The `services.AddOptions<CookieAuthenticationOptions>(...).Configure<...>(...)` PostConfigure block
+
+### Step 3: Update the one existing test assertion
+
+In `tests/Server/ZB.MOM.WW.OtOpcUa.Security.Tests/AuthEndpointsIntegrationTests.cs` around line 93:
+
+```csharp
+// before
+response.Headers.GetValues("Set-Cookie").ShouldContain(c => c.StartsWith("OtOpcUa.Auth="));
+// after
+response.Headers.GetValues("Set-Cookie").ShouldContain(c => c.StartsWith("ZB.MOM.WW.OtOpcUa.Auth="));
+```
+
+### Step 4: Build + run security tests
+
+```bash
+cd /Users/dohertj2/Desktop/OtOpcUa
+dotnet build src/Server/ZB.MOM.WW.OtOpcUa.Security/
+dotnet test tests/Server/ZB.MOM.WW.OtOpcUa.Security.Tests/
+```
+
+Expected: build clean; all Security.Tests pass (the existing 5 AuthEndpointsIntegrationTests + JwtTokenServiceTests + LdapHelperTests + RoleMapperTests).
+
+### Step 5: Commit
+
+```bash
+git -C /Users/dohertj2/Desktop/OtOpcUa add \
+  src/Server/ZB.MOM.WW.OtOpcUa.Security/ServiceCollectionExtensions.cs \
+  tests/Server/ZB.MOM.WW.OtOpcUa.Security.Tests/AuthEndpointsIntegrationTests.cs
+git -C /Users/dohertj2/Desktop/OtOpcUa commit -m "$(cat <<'EOF'
+refactor(security): drop JwtBearer parallel scheme, externalize cookie config
+
+Single Cookie auth scheme; framework default challenge restores 302 → /login
+for browsers + 401 for AJAX. OtOpcUaCookieOptions now flows through to
+CookieAuthenticationOptions via PostConfigure (fixes a latent bug where the
+options class was bound but ignored). Cookie name moves to
+ZB.MOM.WW.OtOpcUa.Auth; existing sessions get a one-time forced sign-out.
+EOF
+)"
+```
+
+### Output report
+
+- Net LOC change (additions / deletions)
+- Build clean
+- Test count run / passed
+- Commit SHA
+- Anything unexpected
+
+### Self-review checklist
+
+- [ ] `using Microsoft.AspNetCore.Authentication.JwtBearer;` removed
+- [ ] `ConfigureJwtBearerFromTokenService` class deleted
+- [ ] `.AddJwtBearer(...)` call deleted
+- [ ] `IPostConfigureOptions<JwtBearerOptions>` singleton registration deleted
+- [ ] `OnRedirectToLogin` and `OnRedirectToAccessDenied` overrides deleted
+- [ ] `LoginPath = "/login"` and `LogoutPath = "/auth/logout"` added inside `.AddCookie(...)`
+- [ ] PostConfigure block added consuming `OtOpcUaCookieOptions`
+- [ ] Warning log fires when `RequireHttpsCookie == false`
+- [ ] `FallbackPolicy` now takes only `CookieAuthenticationDefaults.AuthenticationScheme`
+- [ ] `DriverOperator` policy unchanged
+- [ ] Test assertion updated to `ZB.MOM.WW.OtOpcUa.Auth=`
+- [ ] `dotnet test tests/Server/.../Security.Tests/` all green
+
+---
+
+## Task 3 — Add browser-vs-AJAX challenge tests
+
+**Classification:** small
+**Estimated implement time:** ~4 min
+**Parallelizable with:** Task 4
+
+**Files:**
+- Modify: `tests/Server/ZB.MOM.WW.OtOpcUa.Security.Tests/AuthEndpointsIntegrationTests.cs` (append 3 new test methods + 1 helper)
+
+**Implements design:** Section 5 "Tests added" + Section 4 "Auth challenge for unknown content type".
+
+### Context for the implementer
+
+`AuthEndpointsIntegrationTests` is `IAsyncLifetime`-backed and stands up a `TestServer` with `MapOtOpcUaAuth()` mounted (line 66). The `web.UseEndpoints(e => e.MapOtOpcUaAuth())` wires ONLY the four `/auth/*` endpoints — there is NO root `MapGet("/", ...)` registered. So an anonymous GET to `/` hits the routing pipeline, falls through to a 404 BEFORE auth middleware even challenges.
+
+**The test harness needs a protected root endpoint.** Add one in `InitializeAsync` inside the `web.UseEndpoints(...)` callback. Then the 3 new tests will exercise the cookie scheme's challenge for that protected route.
+
+### Step 1: Modify the test host setup
+
+In `AuthEndpointsIntegrationTests.cs`, change `web.UseEndpoints(...)` (around line 66) from:
+```csharp
+app.UseEndpoints(e => e.MapOtOpcUaAuth());
+```
+to:
+```csharp
+app.UseEndpoints(e =>
+{
+    e.MapOtOpcUaAuth();
+    // Protected root used by AuthChallengeTests below — exercises the cookie
+    // scheme's challenge heuristic without depending on the full Razor host.
+    e.MapGet("/", () => Results.Ok("authenticated")).RequireAuthorization();
+});
+```
+
+### Step 2: Add the three new test methods
+
+Append at the bottom of the class (before the closing brace), keeping the file's existing summary style and using `TestContext.Current.CancellationToken` via the existing `Ct` property:
+
+```csharp
+/// <summary>Anonymous browser GET of a protected route redirects to /login with a ReturnUrl.</summary>
+[Fact]
+public async Task Root_anonymous_browser_GET_redirects_to_login()
+{
+    var client = NewClientNoRedirect();
+    var req = new HttpRequestMessage(HttpMethod.Get, "/");
+    req.Headers.Accept.ParseAdd("text/html");
+    var resp = await client.SendAsync(req, Ct);
+
+    resp.StatusCode.ShouldBe(HttpStatusCode.Found);
+    resp.Headers.Location.ShouldNotBeNull();
+    resp.Headers.Location!.OriginalString.ShouldContain("/login");
+    resp.Headers.Location.OriginalString.ShouldContain("ReturnUrl");
+}
+
+/// <summary>Anonymous AJAX GET of a protected route returns 401 with no Location.</summary>
+[Fact]
+public async Task Root_anonymous_ajax_GET_returns_401()
+{
+    var client = NewClientNoRedirect();
+    var req = new HttpRequestMessage(HttpMethod.Get, "/");
+    req.Headers.Add("X-Requested-With", "XMLHttpRequest");
+    var resp = await client.SendAsync(req, Ct);
+
+    resp.StatusCode.ShouldBe(HttpStatusCode.Unauthorized);
+    resp.Headers.Location.ShouldBeNull();
+}
+
+/// <summary>Anonymous JSON GET of a protected route returns 401.</summary>
+[Fact]
+public async Task Root_anonymous_json_GET_returns_401()
+{
+    var client = NewClientNoRedirect();
+    var req = new HttpRequestMessage(HttpMethod.Get, "/");
+    req.Headers.Accept.ParseAdd("application/json");
+    var resp = await client.SendAsync(req, Ct);
+
+    resp.StatusCode.ShouldBe(HttpStatusCode.Unauthorized);
+}
+```
+
+### Step 3: Add the no-redirect client helper
+
+Right next to the existing `NewClient()` method (line 82):
+
+```csharp
+/// <summary>Creates a TestServer-backed HttpClient that does NOT auto-follow redirects.
+/// Used by challenge tests so we can assert on the 302 / Location directly.</summary>
+private HttpClient NewClientNoRedirect() => new(_server.CreateHandler())
+{
+    BaseAddress = _server.BaseAddress,
+};
+```
+
+### Step 4: Run the tests
+
+```bash
+cd /Users/dohertj2/Desktop/OtOpcUa
+dotnet test tests/Server/ZB.MOM.WW.OtOpcUa.Security.Tests/
+```
+
+Expected: existing 5 tests still pass + 3 new tests pass = 8+ total green.
+
+**If `Root_anonymous_browser_GET_redirects_to_login` returns 200 instead of 302**: HttpClient is still auto-following redirects. Two fixes to try in order:
+1. Confirm `NewClientNoRedirect` uses `_server.CreateHandler()` (not `CreateClient()`).
+2. If still wrong, swap to: `var handler = new HttpClientHandler { AllowAutoRedirect = false };` — but TestServer doesn't expose HttpClientHandler directly. The `CreateHandler()` path SHOULD return a non-redirecting handler; if it doesn't, the implementation may need a `DelegatingHandler` wrapper.
+
+**If `Root_anonymous_browser_GET_redirects_to_login` returns 401 instead of 302**: the cookie scheme isn't classifying `Accept: text/html` as a browser. Inspect Task 2's changes — `OnRedirectToLogin` may not have been fully removed, OR `LoginPath` was not set, OR an `Accept` parsing issue. Look at the response body — if it's empty + 401, the JwtBearer scheme or the override is still in play.
+
+### Step 5: Commit
+
+```bash
+git -C /Users/dohertj2/Desktop/OtOpcUa add tests/Server/ZB.MOM.WW.OtOpcUa.Security.Tests/AuthEndpointsIntegrationTests.cs
+git -C /Users/dohertj2/Desktop/OtOpcUa commit -m "test(security): add browser-vs-AJAX challenge tests for root path"
+```
+
+### Output report
+
+- 3 new tests + 1 helper + modified InitializeAsync
+- Build clean
+- Test count: existing N + 3 new = N+3 green
+- Commit SHA
+- Anything unexpected (e.g. redirect-following behavior of `_server.CreateHandler()`)
+
+### Self-review checklist
+
+- [ ] `MapGet("/", ...).RequireAuthorization()` added inside `web.UseEndpoints(...)`
+- [ ] `NewClientNoRedirect()` helper added
+- [ ] 3 new `[Fact]` methods added with `TestContext.Current.CancellationToken` via the `Ct` property
+- [ ] Each test asserts on the exact status + Location header (or absence)
+- [ ] All tests green
+- [ ] Existing 5 tests still pass
+
+---
+
+## Task 4 — Remove `Microsoft.AspNetCore.Authentication.JwtBearer` package reference
+
+**Classification:** trivial
+**Estimated implement time:** ~2 min
+**Parallelizable with:** Task 3
+
+**Files:**
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.Security/ZB.MOM.WW.OtOpcUa.Security.csproj` (delete one line)
+- Verify: `Directory.Packages.props` — leave the `<PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" ... />` entry in place (other projects may consume it).
+
+**Implements design:** Section 2 "Package references" + Section 6 phase 4.
+
+### Step 1: Confirm no remaining consumer in the Security project
+
+```bash
+grep -rn "Microsoft\.AspNetCore\.Authentication\.JwtBearer\|JwtBearer" \
+  /Users/dohertj2/Desktop/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.Security/ \
+  --include="*.cs"
+```
+
+Expected: zero matches. (Task 2 removed all uses.) If there are matches, STOP and report — Task 2 was incomplete.
+
+### Step 2: Remove the PackageReference
+
+In `src/Server/ZB.MOM.WW.OtOpcUa.Security/ZB.MOM.WW.OtOpcUa.Security.csproj`, find this line (currently around line 13):
+```xml
+<PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer"/>
+```
+Delete it. **Keep** these:
+```xml
+<PackageReference Include="Microsoft.IdentityModel.Tokens"/>
+<PackageReference Include="System.IdentityModel.Tokens.Jwt"/>
+```
+(`JwtTokenService` consumes those for `TokenValidationParameters` + JWT creation respectively — they're not from the JwtBearer authentication package.)
+
+### Step 3: Check whether ANY other project still references the package
+
+```bash
+grep -rn "Microsoft\.AspNetCore\.Authentication\.JwtBearer" \
+  /Users/dohertj2/Desktop/OtOpcUa/src/ /Users/dohertj2/Desktop/OtOpcUa/tests/ \
+  --include="*.csproj"
+```
+
+If zero results: also remove the `<PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" ...>` line from `Directory.Packages.props` (search for it). If one or more other projects still reference it, leave `Directory.Packages.props` alone.
+
+### Step 4: Restore + build
+
+```bash
+cd /Users/dohertj2/Desktop/OtOpcUa
+dotnet restore src/Server/ZB.MOM.WW.OtOpcUa.Security/
+dotnet build src/Server/ZB.MOM.WW.OtOpcUa.Security/
+dotnet build ZB.MOM.WW.OtOpcUa.slnx
+```
+
+Expected: 0 NEW errors. The known pre-existing 12 errors (OpcUaServer.Tests + Runtime.Tests + AbLegacy.Cli + S7.Cli) remain unchanged.
+
+### Step 5: Commit
+
+```bash
+git -C /Users/dohertj2/Desktop/OtOpcUa add \
+  src/Server/ZB.MOM.WW.OtOpcUa.Security/ZB.MOM.WW.OtOpcUa.Security.csproj \
+  Directory.Packages.props  # only if you also removed it from Directory.Packages.props
+git -C /Users/dohertj2/Desktop/OtOpcUa commit -m "chore(security): drop Microsoft.AspNetCore.Authentication.JwtBearer (unused)"
+```
+
+If only the csproj changed: omit `Directory.Packages.props` from the add.
+
+### Output report
+
+- Was Directory.Packages.props also touched? Justify based on whether other projects still reference the package.
+- Build clean (0 new errors)
+- Commit SHA
+
+### Self-review checklist
+
+- [ ] Confirmed zero `Microsoft.AspNetCore.Authentication.JwtBearer` or `JwtBearer` matches in `src/Server/ZB.MOM.WW.OtOpcUa.Security/**/*.cs` before deletion
+- [ ] PackageReference removed from Security.csproj
+- [ ] `Microsoft.IdentityModel.Tokens` and `System.IdentityModel.Tokens.Jwt` kept
+- [ ] Directory.Packages.props touched ONLY if no other project consumes the package
+- [ ] Full solution build adds zero new errors
+
+---
+
+## Task 5 — Manual smoke + final commit
+
+**Classification:** trivial
+**Estimated implement time:** ~3 min
+**Parallelizable with:** none
+
+**Files:** none (verification + optional cleanup commit)
+
+**Implements design:** Section 5 "Manual smoke" + Section 6 phase 5.
+
+### Step 1: Restart the docker-dev cluster
+
+The admin nodes need to pick up the new `Microsoft.AspNetCore.TestHost`-side code path AND the new cookie name. Since the in-cluster admin processes run a prior build, force a rebuild + recreate:
+
+```bash
+cd /Users/dohertj2/Desktop/OtOpcUa
+docker compose -f docker-dev/docker-compose.yml up -d --build admin-a admin-b
+```
+
+Wait ~15 s for warm-up. Then:
+
+```bash
+docker compose -f docker-dev/docker-compose.yml ps admin-a admin-b
+```
+
+Both should show `Up` and `(healthy)` (or `Up` if no healthcheck).
+
+### Step 2: curl smoke
+
+```bash
+# Anonymous browser-shaped GET → 302 to /login with ReturnUrl
+curl -i -H "Accept: text/html" http://localhost:9200/ 2>&1 | head -12
+# Expected: HTTP/1.1 302 Found, Location: /login?ReturnUrl=%2F
+
+# Anonymous AJAX GET → 401
+curl -i -H "X-Requested-With: XMLHttpRequest" http://localhost:9200/ 2>&1 | head -8
+# Expected: HTTP/1.1 401 Unauthorized
+
+# Anonymous JSON GET → 401
+curl -i -H "Accept: application/json" http://localhost:9200/ 2>&1 | head -8
+# Expected: HTTP/1.1 401 Unauthorized
+
+# Login form → 302 with Set-Cookie ZB.MOM.WW.OtOpcUa.Auth
+curl -i -X POST -d "username=alice&password=alice" \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  http://localhost:9200/auth/login 2>&1 | head -15
+# Expected: HTTP/1.1 302 Found, Set-Cookie: ZB.MOM.WW.OtOpcUa.Auth=... (the test stub user may differ — check docker-compose's GLAuth seed for a valid LDAP creds pair)
+```
+
+### Step 3: Chrome smoke (via the macbook browser instance from earlier in the session)
+
+1. Open `http://localhost:9200/` — should redirect to `/login?ReturnUrl=%2F` (not Chrome's error page)
+2. Sign in via the form
+3. DevTools → Application → Cookies → confirm cookie name is `ZB.MOM.WW.OtOpcUa.Auth`
+4. Navigate to `http://localhost:9200/` again — should render the AdminUI dashboard
+5. Click logout → confirm redirect back to `/login`
+
+### Step 4: Optional CLAUDE.md update
+
+If `CLAUDE.md` mentions the old `OtOpcUa.Auth` cookie name anywhere, update to the new `ZB.MOM.WW.OtOpcUa.Auth`. Run:
+
+```bash
+grep -n "OtOpcUa\.Auth" /Users/dohertj2/Desktop/OtOpcUa/CLAUDE.md
+```
+
+If matches: update them, otherwise skip.
+
+### Step 5: Final commit (only if Step 4 changed CLAUDE.md)
+
+```bash
+git -C /Users/dohertj2/Desktop/OtOpcUa add CLAUDE.md
+git -C /Users/dohertj2/Desktop/OtOpcUa commit -m "docs: update cookie name reference in CLAUDE.md"
+```
+
+### Output report
+
+- All 4 curl smoke checks passed?
+- Chrome smoke passed?
+- CLAUDE.md changed?
+- Final SHA on master (if any docs commit)
+- Commit count since this plan started (vs `bc4fce5`)
+
+### Self-review checklist
+
+- [ ] `docker compose up -d --build admin-a admin-b` succeeded
+- [ ] All 4 curl smoke checks return expected status codes
+- [ ] Chrome smoke shows redirect to `/login`, then dashboard after auth
+- [ ] Cookie name in DevTools matches `ZB.MOM.WW.OtOpcUa.Auth`
+- [ ] No new commits left uncommitted in the working tree
+
+---
+
+## Verification gates (apply at end of every task)
+
+- `dotnet build src/Server/ZB.MOM.WW.OtOpcUa.Security/` — 0 errors
+- `dotnet test tests/Server/ZB.MOM.WW.OtOpcUa.Security.Tests/` — all green (existing + new)
+- `dotnet build ZB.MOM.WW.OtOpcUa.slnx` — no NEW errors beyond the 12 pre-existing
+- No untracked files staged accidentally (especially `sql_login.txt`, `pki/`, doc-fix artifacts)
+
+---
+
+## Risk hot-spots for reviewers
+
+1. **TestServer's no-redirect HttpClient.** The plan assumes `new HttpClient(_server.CreateHandler()) { BaseAddress = _server.BaseAddress }` does NOT auto-follow redirects. If it does, the `Root_anonymous_browser_GET_redirects_to_login` test fails with 200 instead of 302. Fix path documented in Task 3 Step 4.
+2. **Framework default of `Accept: */*` → 302.** Curl's default Accept header is `*/*`, which the framework classifies as browser → 302. Documented behavior, mirrors ScadaBridge; reviewers should not flag the smoke step that uses `Accept: text/html` as redundant — it's the explicit "browser" assertion.
+3. **Cookie rename invalidates sessions.** The deploy effectively logs every currently-signed-in user out. Document in commit body; the cluster was just restarted on the new API key anyway, so the timing is opportune.
+4. **`Directory.Packages.props` change is conditional.** Don't touch it if other projects still consume the JwtBearer package. Task 4 has explicit grep guard.
+5. **`/Account/AccessDenied` 404.** Authenticated users hitting a `DriverOperator`-only route now get a generic 404 page instead of a clean access-denied message. Documented design choice; follow-up to add a Razor page if UX feedback demands it.
@@ -0,0 +1,11 @@
+{
+  "planPath": "docs/plans/2026-05-29-auth-alignment-plan.md",
+  "tasks": [
+    {"id": 1, "subject": "Task 1: Extend OtOpcUaCookieOptions", "status": "pending"},
+    {"id": 2, "subject": "Task 2: Rewrite auth wiring + update cookie-name assertion", "status": "pending", "blockedBy": [1]},
+    {"id": 3, "subject": "Task 3: Add browser-vs-AJAX challenge tests", "status": "pending", "blockedBy": [2]},
+    {"id": 4, "subject": "Task 4: Remove JwtBearer package reference", "status": "pending", "blockedBy": [2]},
+    {"id": 5, "subject": "Task 5: Manual smoke + final commit", "status": "pending", "blockedBy": [3, 4]}
+  ],
+  "lastUpdated": "2026-05-29T00:00:00Z"
+}
@@ -0,0 +1,100 @@
+# Alarms D.1 — smoke artifact
+
+> **Status (2026-05-29): alarm-source leg VERIFIED. Historian-write leg still
+> pending the Windows sidecar + live AVEVA Historian.**
+>
+> This is the D.1 deliverable called for by `docs/plans/alarms-worker-wiring-plan.md`
+> — captured evidence that a live Galaxy alarm reaches lmxopcua through the native
+> gateway path (not the sub-attribute fallback). It supersedes the "A.2 blocked"
+> banners in `alarms-over-gateway.md` / `alarms-worker-wiring-plan.md`, which were
+> written 2026-04-30 before the gateway's alarm feed was working.
+
+## What was verified
+
+The mxaccessgw gateway **does** serve native MxAccess alarms today, and the lmxopcua
+consumer ingests them with full fidelity — **including operator-comment**, the field
+the 2026-04-30 plan flagged as "the only v1 regression."
+
+Verified from the macOS dev box against the live gateway at `http://10.100.0.48:5120`
+(reachable; `nc -z` succeeds). No acknowledge / no writes were issued — read-only
+`StreamAlarms`.
+
+### 1. Gateway boundary — raw `StreamAlarms` (`ZB.MOM.WW.MxGateway.Client`)
+
+A standalone client streamed the active-alarm snapshot: **20 active alarms**, each
+carrying native metadata. Sample (one of 20):
+
+```json
+{ "alarmFullReference": "Galaxy!TestArea.TestMachine_001.TestAlarm001",
+  "sourceObjectReference": "TestMachine_001.TestAlarm001",
+  "alarmTypeName": "DSC", "severity": 500,
+  "currentState": "ALARM_CONDITION_STATE_ACTIVE", "category": "TestArea",
+  "lastTransitionTimestamp": "2026-05-24T16:04:10.856Z",
+  "operatorComment": "Test alarm #1" }
+```
+
+Followed by the `SnapshotComplete` marker. `operatorComment`, `category`, `severity`,
+`currentState`, and `lastTransitionTimestamp` are all populated.
+
+### 2. lmxopcua consumer — `GatewayGalaxyAlarmFeed` → `GalaxyAlarmTransition`
+
+The Skip-gated live test
+`Runtime/GatewayGalaxyAlarmFeedLiveTests.Live_gateway_delivers_native_alarm_transitions_through_the_consumer`
+wires the real `MxGatewayClient.StreamAlarmsAsync` into the production consumer seam
+and **passes**. Captured output (`D1_SMOKE_OUT`):
+
+```
+# consumer transitions observed: 2+
+Raise  Galaxy!TestArea.TestMachine_001.TestAlarm001 | sev=750(High) raw=500 | cat=TestArea | comment='Test alarm #1' | xitionUtc=2026-05-24T16:04:10.856Z
+Raise  Galaxy!TestArea.TestMachine_003.TestAlarm001 | sev=750(High) raw=500 | cat=TestArea | comment='Test alarm #1' | xitionUtc=2026-05-07T18:14:00.594Z
+```
+
+The consumer preserves `operatorComment` + `category` + transition timestamp and
+applies the OPC UA severity-bucket mapping (`MxAccessSeverityMapper`: raw 500 →
+OPC UA 750, bucket `High`).
+
+### 3. Full chain to the OPC UA Part 9 surface (code-path verified)
+
+`GalaxyDriver.OnAlarmFeedTransition` maps `GalaxyAlarmTransition` →
+`AlarmEventArgs`, carrying `OperatorComment`, `OriginalRaiseTimestampUtc`,
+`AlarmCategory`, and the severity bucket onto `IAlarmSource.OnAlarmEvent`.
+`AlarmEventArgs` already declares those fields — so the **E.7 contract extension is
+done**, not pending. The server's Part-9 condition layer consumes `IAlarmSource`
+via `AlarmSurfaceInvoker` → `GenericDriverNodeManager`. Unit coverage:
+`GalaxyDriverAlarmSourceTests`, `GatewayGalaxyAlarmFeedTests`.
+
+## How to re-run
+
+```bash
+export MXGW_ENDPOINT="http://10.100.0.48:5120"
+export GALAXY_MXGW_API_KEY="<dev key from docker-dev/docker-compose.yml>"
+export D1_SMOKE_OUT="/tmp/d1-consumer-transitions.txt"   # optional capture
+dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Tests \
+  --filter "FullyQualifiedName~GatewayGalaxyAlarmFeedLiveTests"
+```
+
+Without the env vars the test `Skip`s, so normal `dotnet test` runs are unaffected.
+
+## Not covered here (still open)
+
+1. **Scripted-alarm historian write-back → AVEVA Historian** (C.1's live leg). The
+   `SdkAlarmHistorianWriteBackend` (real `HistorianAccess.AddStreamedValue` path) is
+   implemented and unit-tested, but its `Live_*` write smoke needs the Windows
+   historian sidecar + a live AVEVA Historian — neither reachable from the macOS dev
+   box. Capture this leg on the Windows parity rig.
+2. **Running-server → OPC UA A&C client round-trip.** This artifact proves the driver
+   consumer end; it does not exercise a full OtOpcUa server surfacing the condition to
+   an OPC UA client, because the docker-dev stack stubs the Galaxy driver on Linux
+   (`DriverInstanceActor.ShouldStub`). Capture on the Windows parity rig (or a Linux
+   host with `ShouldStub` overridden to point the real driver at the gateway).
+
+## Mechanism — true MxAccess alarm-event support
+
+The gateway delivers these alarms via **true MxAccess alarm-event support** in the
+mxaccessgw .NET client — a real alarm-event subscription, **not** the value-driven
+sub-attribute fallback. (Confirmed by the gateway maintainer; the client-side stream
+check above can only observe the resulting feed, which is why this artifact records the
+mechanism here rather than inferring it.) So A.2 is implemented as originally specified:
+`MX_EVENT_FAMILY_ON_ALARM_TRANSITION` carries genuine native alarm-event metadata, and
+the operator-comment / original-raise-time / category fields are first-class — not
+reconstructed from attribute reads.
@@ -9,24 +9,41 @@
 > the new RPCs; the sub-attribute fallback path keeps Galaxy alarms
 > functional today.
 >
-> ⚠️ **Worker-side native alarm subscription blocked on a dev-rig
-> finding (2026-04-30):** the MXAccess COM Toolkit at
+> ✅ **UPDATE 2026-05-29 — native alarm feed VERIFIED working; the
+> 2026-04-30 "blocked" finding below is superseded.** A live
+> `StreamAlarms` check against the gateway at `10.100.0.48:5120`
+> returned the active-alarm snapshot (20 alarms) with full native
+> metadata — `severity`, `category`, `currentState`,
+> `lastTransitionTimestamp`, **and `operatorComment`** (the field the
+> note below called "the only v1 regression"). The lmxopcua consumer
+> (`GatewayGalaxyAlarmFeed` → `GalaxyAlarmTransition` →
+> `AlarmEventArgs` → `IAlarmSource`) ingests it with full fidelity and
+> the OPC UA severity-bucket mapping applied — proven by the passing
+> Skip-gated live test `GatewayGalaxyAlarmFeedLiveTests`. `AlarmEventArgs`
+> already carries operator-comment / original-raise-time / category, so
+> **E.7 is done too**. See `docs/plans/alarms-d1-smoke-artifact.md` for
+> the captured evidence. The gateway delivers this via **true MxAccess
+> alarm-event support** in the mxaccessgw .NET client (a real
+> alarm-event subscription — **not** the sub-attribute fallback), so A.2
+> is implemented as originally specified. Still open: the scripted-alarm
+> → AVEVA Historian write-back live smoke (C.1's `Live_*` leg) and a full
+> running-server → OPC UA A&C round-trip — both need the Windows parity rig.
+>
+> ⚠️ **[SUPERSEDED — kept for history] Worker-side native alarm
+> subscription blocked on a dev-rig finding (2026-04-30):** the MXAccess
+> COM Toolkit at
 > `C:\Program Files (x86)\ArchestrA\Framework\Bin\ArchestrA.MXAccess.dll`
-> exposes no alarm-event family — only `OnDataChange`,
-> `OnWriteComplete`, `OperationComplete`, `OnBufferedDataChange`.
+> exposed no alarm-event family — only `OnDataChange`,
+> `OnWriteComplete`, `OperationComplete`, `OnBufferedDataChange` — and
 > AVEVA's `aaAlarmManagedClient` / `ArchestrAAlarmsAndEvents.SDK`
-> assemblies are x64-only and incompatible with the worker's x86
-> bitness. **Operator decision needed before
-> `MX_EVENT_FAMILY_ON_ALARM_TRANSITION` carries any events:** either
-> accept the value-driven sub-attribute path as the production
-> architecture (operator-comment fidelity is the only v1 regression)
-> or add an x64 alarm-helper sub-process alongside the worker. See
-> `src/MxGateway.Worker/MxAccess/MxAccessAlarmEventSink.cs` in the
-> mxaccessgw repo for the architectural notes. Live
-> `aahClientManaged` alarm-event write call site
-> (`SdkAlarmHistorianWriteBackend` placeholder from PR C.1) and the
-> D.1 smoke artifact ship once those decisions resolve. The
-> remainder of this document is preserved as the design record.
+> assemblies are x64-only vs. the worker's x86 bitness. The operator
+> decision (accept the value-driven sub-attribute path, or add an x64
+> alarm-helper sub-process) has since been resolved on the gateway side
+> — `MX_EVENT_FAMILY_ON_ALARM_TRANSITION` now carries events (verified
+> above). The C.1 `SdkAlarmHistorianWriteBackend` is **no longer a
+> placeholder** — it writes through the real
+> `HistorianAccess.AddStreamedValue` path (only its live-rig write
+> smoke remains).

 Coordinated epic across two repos:

@@ -1,5 +1,18 @@
 # Alarms Worker Wiring Plan

+> ✅ **UPDATE 2026-05-29 — the blocker below is RESOLVED on the gateway side; this
+> plan is largely complete.** A live `StreamAlarms` check against `10.100.0.48:5120`
+> returns the active-alarm snapshot with full native metadata **including
+> `operatorComment`**, and the lmxopcua consumer ingests it end-to-end (passing live
+> test `GatewayGalaxyAlarmFeedLiveTests`). So **A.2 / A.3 / A.4** are functionally done
+> at the gateway boundary (the worker now emits native alarm transitions and the client
+> exposes `AcknowledgeAlarm` / `QueryActiveAlarms` RPCs). **C.1** ships real code
+> (`SdkAlarmHistorianWriteBackend` → `HistorianAccess.AddStreamedValue`). **D.1**'s
+> alarm-source leg is captured in `docs/plans/alarms-d1-smoke-artifact.md`. Only two
+> things remain, both needing the Windows parity rig: C.1's live historian-write smoke
+> and a full running-server → OPC UA A&C round-trip. The per-item detail below is kept
+> as the historical record of the original blocked state.
+>
 > **Context**: The alarms-over-gateway epic shipped 19 PRs across the
 > `lmxopcua` and `mxaccessgw` repos (merged 2026-04-30). Contracts are live;
 > the sub-attribute fallback path keeps Galaxy alarms functional today. Four
@@ -16,7 +29,7 @@

 ---

-## Dev-rig finding that blocks everything (2026-04-30)
+## Dev-rig finding that blocks everything (2026-04-30) — [SUPERSEDED 2026-05-29]

 During PR A.2 work the following was discovered on the dev box:

@@ -318,16 +331,20 @@ fallback as production).

 ## Summary of blocks

-| Item | Blocked by | Estimated effort once unblocked |
-|------|-----------|--------------------------------|
-| A.2 | Architectural decision (x64 alarm-helper vs. sub-attribute fallback as production) | 2–3 days implementation; 1 day tests |
-| A.3 | A.2 delivering WorkerEvent bodies | 1–2 days |
-| A.4 | A.2 (active-alarm query needs AlarmClient session) | 1 day |
-| C.1 | aahClientManaged SDK access (available on dev box); NOT blocked by A.2 | 1–2 days |
-| D.1 | A.2 + A.3 + C.1 all passing on parity rig | 0.5 day (smoke + artifact capture) |
+> **Resolved as of 2026-05-29** — see the update banner at the top and
+> `docs/plans/alarms-d1-smoke-artifact.md`. Original status table kept for history.

-C.1 can proceed in parallel with A.2 / A.3 since the sidecar's `aahClientManaged`
-is x64 and does not share the worker bitness constraint.
+| Item | Status (2026-05-29) | Original block |
+|------|--------------------|----------------|
+| A.2 | ✅ **True MxAccess alarm-event support** in the gateway client (real alarm-event subscription, not the sub-attribute fallback); verified via live `StreamAlarms` with operator-comment fidelity | Architectural decision (x64 alarm-helper vs. sub-attribute fallback) |
+| A.3 | ✅ Dispatch + `AcknowledgeAlarm` RPC present on the client surface | A.2 delivering WorkerEvent bodies |
+| A.4 | ✅ `QueryActiveAlarms` RPC present on the client surface | A.2 (active-alarm query needs AlarmClient session) |
+| C.1 | ✅ Code shipped (`AddStreamedValue` path); ⏳ live historian-write smoke needs the Windows rig | aahClientManaged SDK access |
+| D.1 | ◑ Alarm-source leg captured (`alarms-d1-smoke-artifact.md`); ⏳ historian-write leg + full server→A&C round-trip need the Windows rig | A.2 + A.3 + C.1 all passing on parity rig |
+
+The gateway delivers operator-comment fidelity through **true MxAccess alarm-event
+support** in the mxaccessgw .NET client — a real alarm-event subscription, not the
+value-driven sub-attribute path. The sub-attribute fallback is now legacy.

 ---

@@ -0,0 +1,32 @@
+namespace ZB.MOM.WW.OtOpcUa.Commons.Browsing;
+
+/// <summary>One node in a driver-agnostic browse tree.</summary>
+/// <param name="NodeId">Stable identifier passed back to the picker on commit. For OPC UA
+/// this is the <c>nsu=...;...</c> form; for Galaxy this is the <c>tag_name</c>.</param>
+/// <param name="DisplayName">Label shown in the tree.</param>
+/// <param name="Kind">Whether this node terminates the address (Leaf) or has children
+/// (Folder). Galaxy never returns Leaves; only the attribute side-panel terminates.</param>
+/// <param name="HasChildrenHint">When true, the UI renders an expand affordance before
+/// the children have been fetched.</param>
+public sealed record BrowseNode(
+    string NodeId,
+    string DisplayName,
+    BrowseNodeKind Kind,
+    bool HasChildrenHint);
+
+/// <summary>Discriminates terminal vs. expandable nodes for UI rendering.</summary>
+public enum BrowseNodeKind
+{
+    /// <summary>Expandable — has (or may have) children. UI shows expand affordance.</summary>
+    Folder,
+    /// <summary>Terminal — commit on select.</summary>
+    Leaf,
+}
+
+/// <summary>Metadata for an attribute of a Galaxy object (or the equivalent
+/// per-driver concept). Surfaced in the picker's attribute side-panel.</summary>
+public sealed record AttributeInfo(
+    string Name,
+    string DriverDataType,
+    bool   IsArray,
+    string SecurityClass);
@@ -0,0 +1,29 @@
+namespace ZB.MOM.WW.OtOpcUa.Commons.Browsing;
+
+/// <summary>
+///     A live, one-level-at-a-time browse over a remote address space. Owned by the
+///     AdminUI <c>BrowseSessionRegistry</c>; disposed by the registry's TTL reaper or
+///     the picker body on close.
+/// </summary>
+public interface IBrowseSession : IAsyncDisposable
+{
+    /// <summary>Opaque token identifying this session in the registry.</summary>
+    Guid Token { get; }
+
+    /// <summary>Wall-clock time of the most recent successful call. Refreshed on
+    /// <see cref="RootAsync"/>, <see cref="ExpandAsync"/>, and
+    /// <see cref="AttributesAsync"/>; used by the reaper for idle eviction.</summary>
+    DateTime LastUsedUtc { get; }
+
+    /// <summary>Returns the top-level browse nodes.</summary>
+    Task<IReadOnlyList<BrowseNode>> RootAsync(CancellationToken cancellationToken);
+
+    /// <summary>Returns the direct children of the node identified by
+    /// <paramref name="nodeId"/>.</summary>
+    Task<IReadOnlyList<BrowseNode>> ExpandAsync(string nodeId, CancellationToken cancellationToken);
+
+    /// <summary>Returns the attributes of the node identified by <paramref name="nodeId"/>.
+    /// Empty for drivers whose tree is uniform (OPC UA Client). Galaxy uses this to populate
+    /// the attribute side-panel after the user selects an object.</summary>
+    Task<IReadOnlyList<AttributeInfo>> AttributesAsync(string nodeId, CancellationToken cancellationToken);
+}
@@ -0,0 +1,19 @@
+namespace ZB.MOM.WW.OtOpcUa.Commons.Browsing;
+
+/// <summary>
+///     Per-driver factory that opens an ad-hoc browse session against the configuration
+///     supplied as JSON. Parallels <c>IDriverProbe</c> in the runtime — one implementation
+///     per driver type, registered in AdminUI DI and indexed by <see cref="DriverType"/>.
+/// </summary>
+public interface IDriverBrowser
+{
+    /// <summary>Driver type key, matching the AdminUI's persisted DriverType string
+    /// (e.g. "OpcUaClient", "Galaxy").</summary>
+    string DriverType { get; }
+
+    /// <summary>Opens a browse session against the supplied configuration.</summary>
+    /// <param name="configJson">Driver options serialized as JSON; same shape the runtime
+    /// driver would consume.</param>
+    /// <param name="cancellationToken">Cancellation for the connect phase only.</param>
+    Task<IBrowseSession> OpenAsync(string configJson, CancellationToken cancellationToken);
+}
@@ -1,6 +1,7 @@
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
+using ZB.MOM.WW.OtOpcUa.Configuration.Services;

 namespace ZB.MOM.WW.OtOpcUa.Configuration;

@@ -22,6 +23,16 @@ public static class ServiceCollectionExtensions
                $"Connection string '{ConnectionStringName}' is required. Add it to appsettings.json or the OTOPCUA_CONFIG_CONNECTION env var.");

        services.AddDbContextFactory<OtOpcUaConfigDbContext>(opt => opt.UseSqlServer(connectionString));
+
+        // AddDbContextFactory registers only the IDbContextFactory<> — it does NOT also register
+        // a scoped OtOpcUaConfigDbContext. Config services that take the context directly (e.g.
+        // LdapGroupRoleMappingService) need a scoped instance, so bridge one off the factory.
+        services.AddScoped(sp => sp.GetRequiredService<IDbContextFactory<OtOpcUaConfigDbContext>>().CreateDbContext());
+
+        // Config-DB services consumed by both the AdminUI (RoleGrants page) and the auth/login
+        // host (AuthEndpoints.LoginAsync). Scoped to match the request/render scope of both callers.
+        services.AddScoped<ILdapGroupRoleMappingService, LdapGroupRoleMappingService>();
+
        return services;
    }
 }
@@ -172,8 +172,8 @@ public static class DraftValidator

            var compat = ns.Kind switch
            {
-                NamespaceKind.SystemPlatform => di.DriverType == "Galaxy",
-                NamespaceKind.Equipment      => di.DriverType != "Galaxy",
+                NamespaceKind.SystemPlatform => di.DriverType == "GalaxyMxGateway",
+                NamespaceKind.Equipment      => di.DriverType != "GalaxyMxGateway",
                _                            => true,
            };

@@ -12,20 +12,20 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli.Commands;
 [Command("subscribe", Description = "Watch a PCCC file address via polled subscription until Ctrl+C.")]
 public sealed class SubscribeCommand : AbLegacyCommandBase
 {
-    [CommandOption("address", 'a', Description = "PCCC file address — same format as `read`.", IsRequired = true)]
    /// <summary>Gets or sets the PCCC file address to subscribe to.</summary>
+    [CommandOption("address", 'a', Description = "PCCC file address — same format as `read`.", IsRequired = true)]
    public string Address { get; init; } = default!;

+    /// <summary>Gets or sets the data type of the address.</summary>
    [CommandOption("type", 't', Description =
        "Bit / Int / Long / Float / AnalogInt / String / TimerElement / CounterElement / " +
        "ControlElement (default Int).")]
-    /// <summary>Gets or sets the data type of the address.</summary>
    public AbLegacyDataType DataType { get; init; } = AbLegacyDataType.Int;

+    /// <summary>Gets or sets the polling interval in milliseconds.</summary>
    [CommandOption("interval-ms", 'i', Description =
        "Publishing interval in milliseconds (default 1000). PollGroupEngine floors " +
        "sub-250ms values.")]
-    /// <summary>Gets or sets the polling interval in milliseconds.</summary>
    public int IntervalMs { get; init; } = 1000;

    /// <inheritdoc />
@@ -13,14 +13,14 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.S7.Cli.Commands;
 [Command("probe", Description = "Verify the S7 endpoint is reachable and a sample read succeeds.")]
 public sealed class ProbeCommand : S7CommandBase
 {
+    /// <summary>Gets or sets the S7 address to probe.</summary>
    [CommandOption("address", 'a', Description =
        "Probe address (default MW0 — merker word 0). DB1.DBW0 if your PLC project " +
        "reserves a fingerprint DB.")]
-    /// <summary>Gets or sets the S7 address to probe.</summary>
    public string Address { get; init; } = "MW0";

-    [CommandOption("type", Description = "Probe data type (default Int16).")]
    /// <summary>Gets or sets the data type of the probe address.</summary>
+    [CommandOption("type", Description = "Probe data type (default Int16).")]
    public S7DataType DataType { get; init; } = S7DataType.Int16;

    /// <inheritdoc />
@@ -0,0 +1,179 @@
+using System.Collections.Concurrent;
+using ZB.MOM.WW.MxGateway.Client;
+using ZB.MOM.WW.MxGateway.Contracts.Proto.Galaxy;
+using ZB.MOM.WW.OtOpcUa.Commons.Browsing;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser;
+
+/// <summary>
+///     Lazy Galaxy browse over <see cref="GalaxyRepositoryClient.BrowseAsync"/>.
+///     <see cref="RootAsync"/> returns the top-level <see cref="LazyBrowseNode"/>s
+///     directly from the gateway; <see cref="ExpandAsync"/> fetches the direct children
+///     of a previously-handed-out node via <see cref="LazyBrowseNode.ExpandAsync"/>
+///     (one wire call per click, paginated internally by the client). Attribute fetches
+///     are per-object via <c>DiscoverHierarchyAsync(MaxDepth=0, IncludeAttributes=true)</c>.
+///     Owns the supplied <see cref="GalaxyRepositoryClient"/> and disposes it best-effort.
+/// </summary>
+internal sealed class GalaxyBrowseSession : IBrowseSession
+{
+    private readonly GalaxyRepositoryClient _client;
+    private readonly ConcurrentDictionary<string, LazyBrowseNode> _byTagName = new(StringComparer.Ordinal);
+    private readonly SemaphoreSlim _rootGate = new(1, 1);
+    private volatile bool _disposed;
+    private IReadOnlyList<LazyBrowseNode>? _roots;
+
+    /// <summary>Opaque token identifying this session in the AdminUI registry.</summary>
+    public Guid Token { get; } = Guid.NewGuid();
+
+    /// <summary>Wall-clock time of the most recent successful Root/Expand/Attributes call.</summary>
+    public DateTime LastUsedUtc { get; private set; } = DateTime.UtcNow;
+
+    /// <summary>
+    ///     Initializes a new session wrapping a connected repository client. The factory
+    ///     in <c>GalaxyDriverBrowser</c> constructs the client via
+    ///     <see cref="GalaxyRepositoryClient.Create"/> and hands it off here for the
+    ///     session's lifetime.
+    /// </summary>
+    /// <param name="client">Galaxy repository client to query for browse and attributes.</param>
+    internal GalaxyBrowseSession(GalaxyRepositoryClient client)
+    {
+        _client = client ?? throw new ArgumentNullException(nameof(client));
+    }
+
+    /// <summary>
+    ///     Fetches the top-level <see cref="LazyBrowseNode"/>s from the gateway and
+    ///     returns them as <see cref="BrowseNode"/>s. Result is cached; a second call
+    ///     returns the cached roots without a re-fetch.
+    /// </summary>
+    public async Task<IReadOnlyList<BrowseNode>> RootAsync(CancellationToken cancellationToken)
+    {
+        ObjectDisposedException.ThrowIf(_disposed, this);
+        await _rootGate.WaitAsync(cancellationToken).ConfigureAwait(false);
+        try
+        {
+            _roots ??= await _client.BrowseAsync(new BrowseChildrenOptions(), cancellationToken)
+                .ConfigureAwait(false);
+
+            LastUsedUtc = DateTime.UtcNow;
+            return Project(_roots);
+        }
+        finally
+        {
+            _rootGate.Release();
+        }
+    }
+
+    /// <summary>
+    ///     Fetches the direct children of the cached node identified by
+    ///     <paramref name="nodeId"/> (the object's <c>TagName</c>) via
+    ///     <see cref="LazyBrowseNode.ExpandAsync"/>. Throws <see cref="ArgumentException"/>
+    ///     if the tag hasn't been handed out by a prior Root/Expand call.
+    /// </summary>
+    public async Task<IReadOnlyList<BrowseNode>> ExpandAsync(string nodeId, CancellationToken cancellationToken)
+    {
+        ObjectDisposedException.ThrowIf(_disposed, this);
+        if (!_byTagName.TryGetValue(nodeId, out var node))
+        {
+            throw new ArgumentException(
+                $"Galaxy object '{nodeId}' is not in the current browse-session cache. " +
+                "Re-open the browser or expand its parent first.", nameof(nodeId));
+        }
+
+        await node.ExpandAsync(cancellationToken).ConfigureAwait(false);
+        LastUsedUtc = DateTime.UtcNow;
+        return Project(node.Children);
+    }
+
+    /// <summary>
+    ///     Fetches the attributes of the Galaxy object identified by <paramref name="nodeId"/>
+    ///     via <c>DiscoverHierarchyAsync(MaxDepth=0, RootTagName=nodeId, IncludeAttributes=true)</c>.
+    ///     Returns an empty list if the gateway has no matching object.
+    /// </summary>
+    public async Task<IReadOnlyList<AttributeInfo>> AttributesAsync(string nodeId, CancellationToken cancellationToken)
+    {
+        ObjectDisposedException.ThrowIf(_disposed, this);
+        var rows = await _client.DiscoverHierarchyAsync(
+            new DiscoverHierarchyOptions
+            {
+                RootTagName = nodeId,
+                MaxDepth = 0,
+                IncludeAttributes = true,
+            }, cancellationToken).ConfigureAwait(false);
+
+        LastUsedUtc = DateTime.UtcNow;
+        var obj = rows.FirstOrDefault();
+        if (obj is null) return Array.Empty<AttributeInfo>();
+
+        var result = new List<AttributeInfo>(obj.Attributes.Count);
+        foreach (var attr in obj.Attributes)
+        {
+            var driverType = !string.IsNullOrEmpty(attr.DataTypeName)
+                ? attr.DataTypeName
+                : attr.MxDataType.ToString(System.Globalization.CultureInfo.InvariantCulture);
+            result.Add(new AttributeInfo(
+                Name: attr.AttributeName,
+                DriverDataType: driverType,
+                IsArray: attr.IsArray,
+                SecurityClass: MapSecurityClass(attr.SecurityClassification)));
+        }
+        return result;
+    }
+
+    /// <summary>
+    ///     Projects <see cref="LazyBrowseNode"/>s to <see cref="BrowseNode"/>s, caching
+    ///     each by <c>TagName</c> so a subsequent <see cref="ExpandAsync"/> can locate
+    ///     it. Galaxy nodes are always <see cref="BrowseNodeKind.Folder"/> — leaves only
+    ///     appear in the attribute side-panel.
+    /// </summary>
+    private IReadOnlyList<BrowseNode> Project(IReadOnlyList<LazyBrowseNode> nodes)
+    {
+        var result = new List<BrowseNode>(nodes.Count);
+        foreach (var n in nodes)
+        {
+            _byTagName[n.Object.TagName] = n;
+            var displayName = !string.IsNullOrEmpty(n.Object.ContainedName)
+                ? n.Object.ContainedName
+                : n.Object.TagName;
+            result.Add(new BrowseNode(
+                NodeId: n.Object.TagName,
+                DisplayName: displayName,
+                Kind: BrowseNodeKind.Folder,
+                HasChildrenHint: n.HasChildrenHint));
+        }
+        return result;
+    }
+
+    /// <summary>
+    ///     Maps the Galaxy raw security-classification integer to a display string.
+    ///     Buckets: 0=FreeAccess, 1=Operate, 2=Tune, 3=Configure, 4=ViewOnly;
+    ///     anything else surfaces as <c>Unknown(N)</c>.
+    /// </summary>
+    private static string MapSecurityClass(int raw) => raw switch
+    {
+        0 => "FreeAccess",
+        1 => "Operate",
+        2 => "Tune",
+        3 => "Configure",
+        4 => "ViewOnly",
+        _ => $"Unknown({raw})",
+    };
+
+    /// <summary>
+    ///     Idempotently tears down the underlying repository client. Swallows exceptions
+    ///     on shutdown — the registry's reaper may be racing a client-initiated close.
+    /// </summary>
+    public async ValueTask DisposeAsync()
+    {
+        if (_disposed) return;
+        _disposed = true;
+        _rootGate.Dispose();
+        try
+        {
+            await _client.DisposeAsync().ConfigureAwait(false);
+        }
+        catch
+        {
+            // Best-effort: a gateway-side close that hits a torn-down channel is normal.
+        }
+    }
+}
@@ -0,0 +1,194 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using ZB.MOM.WW.MxGateway.Client;
+using ZB.MOM.WW.OtOpcUa.Commons.Browsing;
+using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Config;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser;
+
+/// <summary>
+///     Opens transient gateway connections for the AdminUI address picker. Mirrors the
+///     runtime <c>GalaxyDriver.BuildClientOptions</c> pattern so the gateway sees the
+///     same option shape, but tweaks <see cref="MxGatewayClientOptions.ApiKey"/>
+///     resolution + the gateway-side client identity so browse sessions are
+///     distinguishable from the runtime driver's live MX session.
+/// </summary>
+public sealed class GalaxyDriverBrowser : IDriverBrowser
+{
+    /// <summary>
+    ///     Identifier used in gateway-side logs / metrics for AdminUI browse sessions.
+    ///     Distinct from any runtime driver's <c>MxAccess.ClientName</c> so an operator
+    ///     can tell the two apart when triaging.
+    /// </summary>
+    internal const string BrowseClientIdentity = "OtOpcUa-AdminUI-Browse";
+
+    /// <summary>Hard cap on the time we'll wait for the initial gateway handshake.</summary>
+    private static readonly TimeSpan ConnectBudget = TimeSpan.FromSeconds(30);
+
+    private static readonly JsonSerializerOptions JsonOpts = new()
+    {
+        UnmappedMemberHandling = JsonUnmappedMemberHandling.Skip,
+        PropertyNameCaseInsensitive = true,
+    };
+
+    private readonly ILogger<GalaxyDriverBrowser> _logger;
+
+    /// <summary>Creates a new browser. Logger defaults to <see cref="NullLogger{T}"/>.</summary>
+    /// <param name="logger">Optional logger; null is allowed for unit-test construction.</param>
+    public GalaxyDriverBrowser(ILogger<GalaxyDriverBrowser>? logger = null)
+    {
+        _logger = logger ?? NullLogger<GalaxyDriverBrowser>.Instance;
+    }
+
+    /// <summary>Driver type key — matches the AdminUI's persisted "GalaxyMxGateway" value.</summary>
+    // Hardcoded literal: this project references Driver.Galaxy.Contracts, not Driver.Galaxy,
+    // so GalaxyDriverFactoryExtensions.DriverTypeName isn't available here.
+    public string DriverType => "GalaxyMxGateway";
+
+    /// <summary>
+    ///     Deserializes a <see cref="GalaxyDriverOptions"/> blob, opens a transient
+    ///     <see cref="GalaxyRepositoryClient"/> against the configured gateway endpoint,
+    ///     and returns a browse session over it. The session owns the client and disposes
+    ///     it on <see cref="IBrowseSession.DisposeAsync"/>.
+    /// </summary>
+    /// <param name="configJson">Driver options serialized as JSON; same shape the runtime
+    /// driver would consume.</param>
+    /// <param name="cancellationToken">Cancellation for the connect phase only.</param>
+    /// <exception cref="InvalidOperationException">
+    ///     Thrown when the JSON deserialises to null, when <c>Gateway.Endpoint</c> is empty,
+    ///     or when <c>MxAccess.ClientName</c> is empty.
+    /// </exception>
+    public async Task<IBrowseSession> OpenAsync(string configJson, CancellationToken cancellationToken)
+    {
+        var opts = JsonSerializer.Deserialize<GalaxyDriverOptions>(configJson, JsonOpts)
+            ?? throw new InvalidOperationException("Galaxy options deserialized to null.");
+
+        if (string.IsNullOrWhiteSpace(opts.Gateway.Endpoint))
+            throw new InvalidOperationException("Galaxy browser requires Gateway.Endpoint.");
+
+        // The form persists MXAccess identity as ClientName (there is no separate
+        // "galaxy name" knob on the driver — the gateway picks the galaxy via its
+        // own GalaxyRepository config). Refuse a blank ClientName so the gateway side
+        // doesn't see anonymous browse sessions during triage.
+        if (string.IsNullOrWhiteSpace(opts.MxAccess.ClientName))
+            throw new InvalidOperationException("Galaxy browser requires MxAccess.ClientName.");
+
+        var clientOpts = BuildClientOptions(opts.Gateway);
+
+        // 30s wall-clock budget for the connect phase, linked to the caller's token so
+        // an AdminUI cancel still wins early.
+        using var connectCts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+        connectCts.CancelAfter(ConnectBudget);
+
+        GalaxyRepositoryClient? client = null;
+        try
+        {
+            client = GalaxyRepositoryClient.Create(clientOpts);
+
+            // TestConnectionAsync gives the gateway a chance to surface auth / TLS / DNS
+            // failures synchronously inside the connect budget rather than waiting for
+            // the first DiscoverHierarchyAsync call to fail. The client's own
+            // ConnectTimeout already bounds the underlying gRPC handshake; the linked
+            // CTS layered on top guarantees the AdminUI never blocks past 30s.
+            await client.TestConnectionAsync(connectCts.Token).ConfigureAwait(false);
+
+            _logger.LogInformation(
+                "AdminUI Galaxy browse session opened against {Endpoint} (admin-client={Identity}, runtime-client={RuntimeClient})",
+                opts.Gateway.Endpoint, BrowseClientIdentity, opts.MxAccess.ClientName);
+
+            var session = new GalaxyBrowseSession(client);
+            client = null; // Ownership transferred — keep finally from disposing.
+            return session;
+        }
+        catch
+        {
+            if (client is not null)
+            {
+                try
+                {
+                    await client.DisposeAsync().ConfigureAwait(false);
+                }
+                catch
+                {
+                    // Best-effort cleanup; the original exception is more useful.
+                }
+            }
+            throw;
+        }
+    }
+
+    /// <summary>
+    ///     Build the gateway client options from the form's Gateway section. Mirrors the
+    ///     runtime driver's <c>GalaxyDriver.BuildClientOptions</c> field-for-field so the
+    ///     gateway sees an identical option shape. The API-key reference is resolved
+    ///     inline (a slim version of <c>GalaxyDriver.ResolveApiKey</c>) because the
+    ///     Browser project doesn't reference Driver.Galaxy.
+    /// </summary>
+    private MxGatewayClientOptions BuildClientOptions(GalaxyGatewayOptions gw) => new()
+    {
+        Endpoint = new Uri(gw.Endpoint, UriKind.Absolute),
+        ApiKey = ResolveApiKey(gw.ApiKeySecretRef),
+        UseTls = gw.UseTls,
+        CaCertificatePath = gw.CaCertificatePath,
+        ConnectTimeout = TimeSpan.FromSeconds(gw.ConnectTimeoutSeconds),
+        DefaultCallTimeout = TimeSpan.FromSeconds(gw.DefaultCallTimeoutSeconds),
+        StreamTimeout = gw.StreamTimeoutSeconds > 0
+            ? TimeSpan.FromSeconds(gw.StreamTimeoutSeconds)
+            : null,
+    };
+
+    /// <summary>
+    ///     Resolves <c>env:NAME</c>, <c>file:PATH</c>, and <c>dev:KEY</c> prefixes;
+    ///     anything else is treated as a literal cleartext key with a startup warning.
+    ///     Slim mirror of <c>GalaxyDriver.ResolveApiKey</c> — the runtime version lives
+    ///     in a sibling project the Browser intentionally doesn't reference.
+    /// </summary>
+    /// <param name="secretRef">The secret reference string to resolve.</param>
+    private string ResolveApiKey(string secretRef)
+    {
+        ArgumentException.ThrowIfNullOrEmpty(secretRef);
+
+        if (secretRef.StartsWith("env:", StringComparison.OrdinalIgnoreCase))
+        {
+            var name = secretRef[4..];
+            var value = Environment.GetEnvironmentVariable(name);
+            return !string.IsNullOrEmpty(value)
+                ? value
+                : throw new InvalidOperationException(
+                    $"Galaxy.Gateway.ApiKeySecretRef='{secretRef}' resolves to env var '{name}', but it is unset.");
+        }
+
+        if (secretRef.StartsWith("file:", StringComparison.OrdinalIgnoreCase))
+        {
+            var path = secretRef[5..];
+            if (!File.Exists(path))
+            {
+                throw new InvalidOperationException(
+                    $"Galaxy.Gateway.ApiKeySecretRef='{secretRef}' points at '{path}', which doesn't exist.");
+            }
+            var contents = File.ReadAllText(path).Trim();
+            return !string.IsNullOrEmpty(contents)
+                ? contents
+                : throw new InvalidOperationException(
+                    $"Galaxy.Gateway.ApiKeySecretRef='{secretRef}' file '{path}' is empty.");
+        }
+
+        if (secretRef.StartsWith("dev:", StringComparison.OrdinalIgnoreCase))
+        {
+            // Explicit dev opt-in — no warning, the operator deliberately chose a
+            // cleartext literal (dev box, parity rig).
+            return secretRef[4..];
+        }
+
+        // Back-compat literal arm. An unprefixed string is treated as the literal
+        // API key — but emit a warning so an operator who accidentally committed a
+        // cleartext key into DriverConfig sees it when they open the address picker.
+        _logger.LogWarning(
+            "Galaxy.Gateway.ApiKeySecretRef is being treated as a literal cleartext API key. " +
+            "Prefer env:NAME, file:PATH, or the explicit dev:KEY prefix for dev rigs — " +
+            "a literal key in DriverConfig JSON is stored in cleartext in the central config DB.");
+        return secretRef;
+    }
+}
@@ -0,0 +1,20 @@
+<Project Sdk="Microsoft.NET.Sdk">
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    </PropertyGroup>
+    <ItemGroup>
+        <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Commons\ZB.MOM.WW.OtOpcUa.Commons.csproj" />
+        <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts.csproj" />
+    </ItemGroup>
+    <ItemGroup>
+        <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser.Tests" />
+    </ItemGroup>
+    <ItemGroup>
+        <PackageReference Include="ZB.MOM.WW.MxGateway.Client" />
+        <PackageReference Include="ZB.MOM.WW.MxGateway.Contracts" />
+        <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
+    </ItemGroup>
+</Project>
@@ -1,6 +1,6 @@
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Logging.Abstractions;
-using MxGateway.Contracts.Proto.Galaxy;
+using ZB.MOM.WW.MxGateway.Contracts.Proto.Galaxy;
 using ZB.MOM.WW.OtOpcUa.Core.Abstractions;

 namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browse;
@@ -1,4 +1,4 @@
-using MxGateway.Contracts.Proto.Galaxy;
+using ZB.MOM.WW.MxGateway.Contracts.Proto.Galaxy;
 using ZB.MOM.WW.OtOpcUa.Core.Abstractions;

 namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browse;
@@ -1,5 +1,5 @@
-using MxGateway.Client;
-using MxGateway.Contracts.Proto.Galaxy;
+using ZB.MOM.WW.MxGateway.Client;
+using ZB.MOM.WW.MxGateway.Contracts.Proto.Galaxy;

 namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browse;

@@ -1,5 +1,5 @@
-using MxGateway.Client;
-using MxGateway.Contracts.Proto.Galaxy;
+using ZB.MOM.WW.MxGateway.Client;
+using ZB.MOM.WW.MxGateway.Contracts.Proto.Galaxy;

 namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browse;

@@ -1,4 +1,4 @@
-using MxGateway.Contracts.Proto.Galaxy;
+using ZB.MOM.WW.MxGateway.Contracts.Proto.Galaxy;

 namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browse;

@@ -1,4 +1,4 @@
-using MxGateway.Contracts.Proto.Galaxy;
+using ZB.MOM.WW.MxGateway.Contracts.Proto.Galaxy;

 namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browse;

@@ -1,4 +1,4 @@
-using MxGateway.Contracts.Proto.Galaxy;
+using ZB.MOM.WW.MxGateway.Contracts.Proto.Galaxy;
 using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Runtime;

 namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browse;
@@ -1,7 +1,7 @@
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Logging.Abstractions;
-using MxGateway.Client;
-using MxGateway.Contracts.Proto;
+using ZB.MOM.WW.MxGateway.Client;
+using ZB.MOM.WW.MxGateway.Contracts.Proto;
 using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
 using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browse;
 using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Config;
@@ -528,7 +528,7 @@ public sealed class GalaxyDriver
        // If discovery hasn't run yet, build the client here so the watcher has a target.
        // Driver.Galaxy-009 fix: guard with ??= so if BuildDefaultHierarchySource later runs
        // it reuses this client rather than overwriting the field and leaking the first instance.
-        _ownedRepositoryClient ??= MxGateway.Client.GalaxyRepositoryClient.Create(
+        _ownedRepositoryClient ??= ZB.MOM.WW.MxGateway.Client.GalaxyRepositoryClient.Create(
            BuildClientOptions(_options.Gateway));

        var source = new GatewayGalaxyDeployWatchSource(_ownedRepositoryClient);
@@ -25,7 +25,7 @@ public sealed class GalaxyDriverProbe : IDriverProbe

    /// <inheritdoc />
    // Matches DriverInstance.DriverType strings set by the AdminUI's GalaxyDriverPage.
-    public string DriverType => "Galaxy";
+    public string DriverType => GalaxyDriverFactoryExtensions.DriverTypeName;

    /// <inheritdoc />
    public async Task<DriverProbeResult> ProbeAsync(string configJson, TimeSpan timeout, CancellationToken ct)
@@ -2,7 +2,7 @@ using System.Diagnostics.Metrics;
 using System.Threading.Channels;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Logging.Abstractions;
-using MxGateway.Contracts.Proto;
+using ZB.MOM.WW.MxGateway.Contracts.Proto;
 using ZB.MOM.WW.OtOpcUa.Core.Abstractions;

 namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Runtime;
@@ -1,6 +1,6 @@
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Logging.Abstractions;
-using MxGateway.Client;
+using ZB.MOM.WW.MxGateway.Client;
 using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Config;

 namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Runtime;
@@ -1,6 +1,6 @@
 using Microsoft.Extensions.Logging;
-using MxGateway.Client;
-using MxGateway.Contracts.Proto;
+using ZB.MOM.WW.MxGateway.Client;
+using ZB.MOM.WW.MxGateway.Contracts.Proto;

 namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Runtime;

@@ -1,7 +1,7 @@
 using System.Diagnostics.Metrics;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Logging.Abstractions;
-using MxGateway.Contracts.Proto;
+using ZB.MOM.WW.MxGateway.Contracts.Proto;

 namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Runtime;

@@ -1,8 +1,8 @@
 using System.Collections.Concurrent;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Logging.Abstractions;
-using MxGateway.Client;
-using MxGateway.Contracts.Proto;
+using ZB.MOM.WW.MxGateway.Client;
+using ZB.MOM.WW.MxGateway.Contracts.Proto;
 using ZB.MOM.WW.OtOpcUa.Core.Abstractions;

 namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Runtime;
@@ -1,5 +1,5 @@
-using MxGateway.Client;
-using MxGateway.Contracts.Proto;
+using ZB.MOM.WW.MxGateway.Client;
+using ZB.MOM.WW.MxGateway.Contracts.Proto;
 // Use the generated nested status enum for the SetBufferedUpdateInterval reply check.

 namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Runtime;
@@ -62,7 +62,7 @@ public sealed class GatewayGalaxySubscriber : IGalaxySubscriber
    ///     applied value and skip redundant calls.
    /// </summary>
    private async Task EnsureSessionIntervalAsync(
-        MxGateway.Client.MxGatewaySession session, int serverHandle, int intervalMs, CancellationToken cancellationToken)
+        ZB.MOM.WW.MxGateway.Client.MxGatewaySession session, int serverHandle, int intervalMs, CancellationToken cancellationToken)
    {
        lock (_intervalLock)
        {
@@ -1,4 +1,4 @@
-using MxGateway.Contracts.Proto;
+using ZB.MOM.WW.MxGateway.Contracts.Proto;

 namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Runtime;

@@ -1,5 +1,5 @@
 using Google.Protobuf.WellKnownTypes;
-using MxGateway.Contracts.Proto;
+using ZB.MOM.WW.MxGateway.Contracts.Proto;

 namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Runtime;

@@ -1,5 +1,5 @@
 using Google.Protobuf.WellKnownTypes;
-using MxGateway.Contracts.Proto;
+using ZB.MOM.WW.MxGateway.Contracts.Proto;

 namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Runtime;

@@ -1,6 +1,6 @@
 using Microsoft.Extensions.Logging;
-using MxGateway.Client;
-using MxGateway.Contracts.Proto;
+using ZB.MOM.WW.MxGateway.Client;
+using ZB.MOM.WW.MxGateway.Contracts.Proto;

 namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Runtime;

@@ -1,5 +1,5 @@
 using System.Runtime.CompilerServices;
-using MxGateway.Contracts.Proto;
+using ZB.MOM.WW.MxGateway.Contracts.Proto;

 namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Runtime;

@@ -19,34 +19,8 @@
    </ItemGroup>

    <ItemGroup>
-        <!-- Vendored mxaccessgw .NET client. Originally consumed via path-based
-             ProjectReference to the sibling repo, but the sibling repo restructured
-             and the MxGateway.Client.csproj path no longer exists. The DLLs in
-             libs/ are the last known-good build (May 2026); they reference proto
-             types from MxGateway.Contracts.dll using the pre-restructure namespace
-             (MxGateway.Contracts.Proto). See libs/README.md for the unwinding plan
-             once the sibling repo restores a client library or we migrate to the
-             new ZB.MOM.WW.MxGateway.Contracts.Proto namespace. -->
-        <Reference Include="MxGateway.Client">
-            <HintPath>libs\MxGateway.Client.dll</HintPath>
-            <Private>true</Private>
-        </Reference>
-        <Reference Include="MxGateway.Contracts">
-            <HintPath>libs\MxGateway.Contracts.dll</HintPath>
-            <Private>true</Private>
-        </Reference>
-    </ItemGroup>
-
-    <ItemGroup>
-        <!-- Transitive deps the vendored MxGateway.Client.dll was actually built
-             against (verified by reflecting GetReferencedAssemblies on the DLL —
-             see libs/README.md). Versions align with the sibling mxaccessgw repo's
-             current Server / Worker projects so binary-compat stays close to what
-             the team uses elsewhere. Pre-Driver.Galaxy-016 the csproj declared
-             `Polly` (the v7 API) instead of `Polly.Core` (the v8 API the DLL was
-             built against) — a package-name mistake, not just a version skew —
-             which would surface as a runtime MissingMethodException the first
-             time the client's retry pipeline ran. -->
+        <PackageReference Include="ZB.MOM.WW.MxGateway.Client" />
+        <PackageReference Include="ZB.MOM.WW.MxGateway.Contracts" />
        <PackageReference Include="Google.Protobuf" />
        <PackageReference Include="Grpc.Core.Api" />
        <PackageReference Include="Grpc.Net.Client" />
@@ -1,101 +0,0 @@
-# Vendored MxGateway client DLLs
-
-This directory holds binary copies of `MxGateway.Client.dll` and
-`MxGateway.Contracts.dll` from the sibling `mxaccessgw` repo's last known-good
-build (May 2026). The DLLs are referenced from the driver's csproj as
-`<Reference HintPath="…" />` items rather than `ProjectReference`.
-
-## Provenance
-
-Both DLLs are built from this team's own `mxaccessgw` source tree — they are
-not third-party binaries. The build commit + checksums below are recorded so
-future readers can verify the artefacts match the expected source without
-needing to ask the original author.
-
-| File | Source commit | SHA-256 |
-|---|---|---|
-| `MxGateway.Client.dll` | `dd7ca1634e2d2b8a866c81f0009bf87ee9427750` (mxaccessgw repo, pre-restructure) | `3507f770adc8c1b27b2fc4645079c6e4e02d5c65b9545c12d637cd2a080a00bd` |
-| `MxGateway.Contracts.dll` | `dd7ca1634e2d2b8a866c81f0009bf87ee9427750` (mxaccessgw repo, pre-restructure) | `437dc6cb6994c7c4d858c82f69af890732c7ffbfa0463fbd8a63ce7930d251b4` |
-
-The build commit is the same for both DLLs and is embedded as
-`AssemblyInformationalVersion` inside each binary — re-verify by running:
-`ilspycmd <dll> | grep AssemblyInformationalVersion`.
-
-To re-verify the checksums (e.g. after a clone):
-```bash
-sha256sum libs/MxGateway.Client.dll libs/MxGateway.Contracts.dll
-```
-
-If either SHA-256 or the embedded source commit no longer matches what's
-listed above, the artefact has been replaced — verify before trusting.
-
-## Why vendored
-
-The sibling `mxaccessgw` repo restructured: the `clients/dotnet/MxGateway.Client`
-project the driver previously referenced via path-based `ProjectReference` no
-longer exists, and the proto contracts moved from the `MxGateway.Contracts.Proto`
-namespace to `ZB.MOM.WW.MxGateway.Contracts.Proto`. The driver's source still
-expects the pre-restructure namespace, so re-pointing at the new contracts would
-require a global namespace rename across ~19 driver files PLUS reimplementing
-the `MxGatewayClient` / `MxGatewaySession` / `GalaxyRepositoryClient` types the
-old client library provided (the sibling repo dropped the client library
-entirely, keeping only the contracts).
-
-Vendoring the binaries unblocked the build in minutes instead of hours, freezes
-the gateway contract surface at a known-good version, and preserves the option
-to migrate properly later without an emergency rewrite.
-
-## What's vendored
-
-| File | Built against |
-|---|---|
-| `MxGateway.Client.dll` | net10.0, references `MxGateway.Contracts.dll` |
-| `MxGateway.Contracts.dll` | net10.0, proto namespace `MxGateway.Contracts.Proto[.Galaxy]` |
-
-The NuGet packages the vendored DLLs reference (verified by reflecting
-`Assembly.GetReferencedAssemblies()` against `MxGateway.Client.dll`) are
-declared as direct `PackageReference` in the driver csproj — when the dropped
-`ProjectReference` was in place those packages were transitively provided;
-with binary references the consumer must declare them explicitly:
-
-| Package | Reason |
-|---|---|
-| `Google.Protobuf` 3.34.1 | Proto message types in `MxGateway.Contracts.dll` |
-| `Grpc.Core.Api` 2.76.0 | Base gRPC client types in `MxGateway.Client.dll` |
-| `Grpc.Net.Client` 2.76.0 | HTTP/2 transport used by `MxGatewayClient` |
-| `Microsoft.Extensions.Logging.Abstractions` 10.0.7 | `ILogger` used by the client |
-| `Polly.Core` 8.6.6 | Retry pipeline used by `MxGatewayClient` |
-
-Versions match the sibling mxaccessgw repo's current Server / Worker
-projects (`ZB.MOM.WW.MxGateway.Server.csproj`,
-`ZB.MOM.WW.MxGateway.Worker.csproj`) so the runtime versions stay close to
-what the gateway team uses. The pre-Driver.Galaxy-016 declarations were
-incorrect — most visibly `Polly 8.5.2` was declared where the DLL actually
-needs `Polly.Core` (a different package: `Polly` v7 is the older fluent API;
-`Polly.Core` v8 is the modern resilience-pipeline API the gateway client was
-built against). A `Polly` reference would have failed at runtime with
-`MissingMethodException` the first time a retry pipeline ran.
-
-## Decompiled-source archive
-
-The vendored DLLs are byte-for-byte the build output. The full source can be
-recovered with `ilspycmd MxGateway.Client.dll > MxGateway.Client.cs` if a code
-review or audit needs it.
-
-## How to unwind
-
-Either path closes the vendored-binary debt:
-
-1. **Sibling repo restores `MxGateway.Client.csproj`** (or publishes a NuGet
-   package). Switch the csproj back to a `ProjectReference` / `PackageReference`,
-   delete this directory.
-2. **Driver migrates to the new `ZB.MOM.WW.MxGateway.Contracts.Proto`
-   namespace.** Global namespace rename across the ~19 consuming source files,
-   plus re-implementing `MxGatewayClient` / `MxGatewaySession` /
-   `GalaxyRepositoryClient` (≈2,200 LoC of behavioural client code) either
-   inlined into this driver or as a fresh sibling library. Delete this
-   directory.
-
-Either way: when unwinding, also drop the five `PackageReference` lines added
-to the csproj alongside the `<Reference>` items — the new ProjectReference /
-PackageReference will provide them transitively again.
@@ -0,0 +1,178 @@
+using Opc.Ua;
+using Opc.Ua.Client;
+using ZB.MOM.WW.OtOpcUa.Commons.Browsing;
+using ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser;
+
+/// <summary>
+///     Live one-level-per-call browse session over a remote OPC UA server. Created by
+///     <c>OpcUaClientBrowser</c> on picker open and owned by the AdminUI's
+///     <c>BrowseSessionRegistry</c>; the registry's TTL reaper disposes idle sessions.
+/// </summary>
+internal sealed class OpcUaClientBrowseSession : IBrowseSession
+{
+    private readonly ISession _session;
+    private readonly NamespaceMap _nsMap;
+    private readonly NodeId _rootNodeId;
+    private readonly SemaphoreSlim _gate = new(1, 1);
+    private volatile bool _disposed;
+
+    /// <summary>
+    ///     Construct a browse session bound to an already-connected <paramref name="session"/>.
+    /// </summary>
+    /// <param name="session">The OPC UA client session to browse against.</param>
+    /// <param name="nsMap">Namespace snapshot taken at connect time; used to render outbound
+    ///     NodeIds in the server-stable <c>nsu=…</c> form.</param>
+    /// <param name="rootNodeId">The node under which <see cref="RootAsync"/> browses one level.</param>
+    internal OpcUaClientBrowseSession(ISession session, NamespaceMap nsMap, NodeId rootNodeId)
+    {
+        _session = session;
+        _nsMap = nsMap;
+        _rootNodeId = rootNodeId;
+    }
+
+    /// <summary>Opaque token identifying this session in the AdminUI registry.</summary>
+    public Guid Token { get; } = Guid.NewGuid();
+
+    /// <summary>Wall-clock time of the most recent successful browse call; the reaper uses
+    /// this for idle eviction.</summary>
+    public DateTime LastUsedUtc { get; private set; } = DateTime.UtcNow;
+
+    /// <summary>Browse one level under the configured root node.</summary>
+    /// <param name="cancellationToken">Cancellation token.</param>
+    public Task<IReadOnlyList<BrowseNode>> RootAsync(CancellationToken cancellationToken)
+        => BrowseOneLevelAsync(_rootNodeId, cancellationToken);
+
+    /// <summary>Browse one level under the node identified by <paramref name="nodeId"/>,
+    /// which must be a stable reference produced by <see cref="NamespaceMap.ToStableReference"/>
+    /// (or a plain <c>ns=N;…</c> form).</summary>
+    /// <param name="nodeId">Stable reference string for the parent node.</param>
+    /// <param name="cancellationToken">Cancellation token.</param>
+    /// <exception cref="ArgumentException">Thrown when <paramref name="nodeId"/> cannot be
+    ///     resolved against the live session's namespace table.</exception>
+    public Task<IReadOnlyList<BrowseNode>> ExpandAsync(string nodeId, CancellationToken cancellationToken)
+    {
+        if (!NamespaceMap.TryResolve(_session, nodeId, out var resolved))
+            throw new ArgumentException(
+                $"Cannot resolve NodeId '{nodeId}' against the live session.", nameof(nodeId));
+        return BrowseOneLevelAsync(resolved, cancellationToken);
+    }
+
+    /// <summary>The OPC UA picker treats variables as terminal leaves and does not surface
+    /// a per-attribute side-panel, so this always returns empty.</summary>
+    /// <param name="nodeId">Ignored.</param>
+    /// <param name="cancellationToken">Ignored.</param>
+    public Task<IReadOnlyList<AttributeInfo>> AttributesAsync(string nodeId, CancellationToken cancellationToken)
+        => Task.FromResult<IReadOnlyList<AttributeInfo>>(Array.Empty<AttributeInfo>());
+
+    /// <summary>Issue a single-level Browse (plus continuation-point follow-ups) under the
+    /// given parent node. <see cref="Session.BrowseAsync"/> is not thread-safe, so all calls
+    /// serialize through <see cref="_gate"/>.</summary>
+    private async Task<IReadOnlyList<BrowseNode>> BrowseOneLevelAsync(NodeId parent, CancellationToken ct)
+    {
+        ObjectDisposedException.ThrowIf(_disposed, this);
+        await _gate.WaitAsync(ct).ConfigureAwait(false);
+        try
+        {
+            var descriptions = new BrowseDescriptionCollection
+            {
+                new()
+                {
+                    NodeId = parent,
+                    BrowseDirection = BrowseDirection.Forward,
+                    ReferenceTypeId = ReferenceTypeIds.HierarchicalReferences,
+                    IncludeSubtypes = true,
+                    NodeClassMask = (uint)(NodeClass.Object | NodeClass.Variable),
+                    ResultMask = (uint)(BrowseResultMask.BrowseName | BrowseResultMask.DisplayName
+                                        | BrowseResultMask.NodeClass),
+                },
+            };
+
+            var resp = await _session.BrowseAsync(
+                requestHeader: null,
+                view: null,
+                requestedMaxReferencesPerNode: 0,
+                nodesToBrowse: descriptions,
+                ct: ct).ConfigureAwait(false);
+
+            if (resp.Results.Count == 0)
+            {
+                LastUsedUtc = DateTime.UtcNow;
+                return Array.Empty<BrowseNode>();
+            }
+
+            var result = resp.Results[0];
+            var refs = result.References;
+
+            // Follow browse continuation points so folders larger than the server's per-call
+            // cap aren't silently truncated (same pattern as runtime
+            // Driver.OpcUaClient-003).
+            var cp = result.ContinuationPoint;
+            while (cp is { Length: > 0 })
+            {
+                var next = await _session.BrowseNextAsync(
+                    requestHeader: null,
+                    releaseContinuationPoints: false,
+                    continuationPoints: [cp],
+                    ct: ct).ConfigureAwait(false);
+
+                if (next.Results.Count == 0) break;
+                var nextResult = next.Results[0];
+                if (nextResult.References is { Count: > 0 })
+                    refs.AddRange(nextResult.References);
+                cp = nextResult.ContinuationPoint;
+            }
+
+            LastUsedUtc = DateTime.UtcNow;
+
+            var nodes = new List<BrowseNode>(refs.Count);
+            foreach (var rf in refs)
+                nodes.Add(ToBrowseNode(rf));
+            return nodes;
+        }
+        finally
+        {
+            _gate.Release();
+        }
+    }
+
+    /// <summary>Project a single <see cref="ReferenceDescription"/> into the driver-agnostic
+    /// <see cref="BrowseNode"/> shape, encoding the outbound NodeId in the stable
+    /// <c>nsu=…</c> form so the picker survives a remote namespace-table reorder.</summary>
+    private BrowseNode ToBrowseNode(ReferenceDescription rf)
+    {
+        var childId = ExpandedNodeId.ToNodeId(rf.NodeId, _session.NamespaceUris);
+        var isObject = rf.NodeClass == NodeClass.Object;
+        var displayName = rf.DisplayName?.Text
+                          ?? rf.BrowseName?.Name
+                          ?? childId.ToString()
+                          ?? "(unnamed)";
+        return new BrowseNode(
+            NodeId: _nsMap.ToStableReference(childId),
+            DisplayName: displayName,
+            Kind: isObject ? BrowseNodeKind.Folder : BrowseNodeKind.Leaf,
+            HasChildrenHint: isObject);
+    }
+
+    /// <summary>Idempotent best-effort dispose: closes the underlying session if it's a
+    /// concrete <see cref="Session"/>, disposes it, and disposes the gate. Close errors are
+    /// swallowed because the registry reaper may be racing a remote disconnect.</summary>
+    public async ValueTask DisposeAsync()
+    {
+        if (_disposed) return;
+        _disposed = true;
+
+        if (_session is Session s)
+        {
+            try { await s.CloseAsync().ConfigureAwait(false); }
+            catch { /* best-effort */ }
+        }
+
+        try { _session.Dispose(); }
+        catch { /* best-effort */ }
+
+        try { _gate.Dispose(); }
+        catch { /* best-effort */ }
+    }
+}
@@ -0,0 +1,234 @@
+using System.Text.Json;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Logging.Abstractions;
+using Opc.Ua;
+using Opc.Ua.Client;
+using Opc.Ua.Configuration;
+using ZB.MOM.WW.OtOpcUa.Commons.Browsing;
+using ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient;  // OpcUaClientDriverOptions + NamespaceMap
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser;
+
+/// <summary>
+///     Opens transient OPC UA sessions from form-supplied JSON for the AdminUI address picker.
+///     Mirrors the runtime driver's connect path but with a separate PKI store so browse-time
+///     trust decisions cannot poison the runtime driver's cert store.
+/// </summary>
+public sealed class OpcUaClientDriverBrowser : IDriverBrowser
+{
+    private static readonly JsonSerializerOptions JsonOpts = new()
+    {
+        UnmappedMemberHandling = System.Text.Json.Serialization.JsonUnmappedMemberHandling.Skip,
+        PropertyNameCaseInsensitive = true,
+    };
+
+    private readonly ILogger<OpcUaClientDriverBrowser> _logger;
+
+    /// <summary>Creates a new browser. Logger defaults to NullLogger when not supplied.</summary>
+    /// <param name="logger">Optional logger; defaults to <see cref="NullLogger{T}"/>.</param>
+    public OpcUaClientDriverBrowser(ILogger<OpcUaClientDriverBrowser>? logger = null)
+    {
+        _logger = logger ?? NullLogger<OpcUaClientDriverBrowser>.Instance;
+    }
+
+    /// <summary>Driver type key — matches the AdminUI's persisted "OpcUaClient" value.</summary>
+    public string DriverType => "OpcUaClient";
+
+    /// <summary>Opens a transient OPC UA session and returns a browse session over it.</summary>
+    /// <param name="configJson">Driver options serialized as JSON; same shape the runtime
+    ///     driver would consume.</param>
+    /// <param name="cancellationToken">Cancellation for the connect phase only.</param>
+    public async Task<IBrowseSession> OpenAsync(string configJson, CancellationToken cancellationToken)
+    {
+        var opts = JsonSerializer.Deserialize<OpcUaClientDriverOptions>(configJson, JsonOpts)
+            ?? throw new InvalidOperationException("OpcUaClient options deserialized to null.");
+
+        var endpoint = opts.EndpointUrls is { Count: > 0 } ? opts.EndpointUrls[0] : opts.EndpointUrl;
+        if (string.IsNullOrWhiteSpace(endpoint))
+            throw new InvalidOperationException("OpcUaClient browser requires EndpointUrl or EndpointUrls[0].");
+
+        if (opts.AuthType == OpcUaAuthType.Certificate)
+            throw new InvalidOperationException(
+                "Browser does not support OpcUaAuthType.Certificate in v1; use Anonymous or Username.");
+
+        if (opts.AutoAcceptCertificates)
+            _logger.LogWarning(
+                "AdminUI browse session opens against {Endpoint} with form's AutoAcceptCertificates=true — " +
+                "browse uses its own cert store and does NOT auto-accept; trust the cert via the runtime " +
+                "driver's PKI store instead.",
+                endpoint);
+
+        var appConfig = await BuildBrowseAppConfigurationAsync(cancellationToken).ConfigureAwait(false);
+        var identity = BuildBrowseUserIdentity(opts);
+
+        var perEndpointBudget = TimeSpan.FromSeconds(
+            Math.Clamp(opts.PerEndpointConnectTimeout.TotalSeconds, 5, 30));
+        using var connectCts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+        connectCts.CancelAfter(perEndpointBudget);
+
+        var endpointDesc = await SelectEndpointAsync(
+            appConfig, endpoint, opts.SecurityPolicy, opts.SecurityMode, connectCts.Token).ConfigureAwait(false);
+        var endpointCfg = EndpointConfiguration.Create(appConfig);
+        endpointCfg.OperationTimeout = (int)opts.Timeout.TotalMilliseconds;
+        var configuredEndpoint = new ConfiguredEndpoint(null, endpointDesc, endpointCfg);
+
+        var session = await new DefaultSessionFactory(telemetry: null!).CreateAsync(
+            appConfig,
+            configuredEndpoint,
+            updateBeforeConnect: false,
+            sessionName: "OtOpcUa AdminUI Browse",
+            (uint)opts.SessionTimeout.TotalMilliseconds,
+            identity,
+            preferredLocales: null,
+            connectCts.Token).ConfigureAwait(false);
+
+        try
+        {
+            var nsMap = NamespaceMap.FromSession(session);
+            var rootNodeId = string.IsNullOrEmpty(opts.BrowseRoot)
+                ? ObjectIds.ObjectsFolder
+                : NodeId.Parse(session.MessageContext, opts.BrowseRoot);
+
+            _logger.LogInformation(
+                "AdminUI OPC UA browse session opened against {Endpoint} (policy {Policy}, mode {Mode})",
+                endpoint, opts.SecurityPolicy, opts.SecurityMode);
+
+            return new OpcUaClientBrowseSession(session, nsMap, rootNodeId);
+        }
+        catch
+        {
+            try { if (session is Session s) await s.CloseAsync().ConfigureAwait(false); } catch { /* best-effort */ }
+            try { session.Dispose(); } catch { /* best-effort */ }
+            throw;
+        }
+    }
+
+    /// <summary>
+    ///     Build a minimal in-memory ApplicationConfiguration using a SEPARATE PKI root from
+    ///     the runtime driver (<c>%LocalAppData%/OtOpcUa/adminui-browse-pki/</c>). Browse
+    ///     trust decisions don't leak into the deployed driver's cert store.
+    /// </summary>
+    /// <param name="ct">Cancellation token for the configuration build.</param>
+    private static async Task<ApplicationConfiguration> BuildBrowseAppConfigurationAsync(CancellationToken ct)
+    {
+        // The default ctor is obsolete in favour of the ITelemetryContext overload; suppress
+        // locally rather than plumbing a telemetry context all the way through — the browser
+        // emits no per-request telemetry of its own and the SDK's internal fallback is fine
+        // for a transient picker session (mirrors the runtime driver's same suppression).
+#pragma warning disable CS0618
+        var app = new ApplicationInstance
+        {
+            ApplicationName = "OtOpcUa AdminUI Browse",
+            ApplicationType = ApplicationType.Client,
+        };
+#pragma warning restore CS0618
+
+        var pkiRoot = Path.Combine(
+            Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
+            "OtOpcUa", "adminui-browse-pki");
+
+        var config = new ApplicationConfiguration
+        {
+            ApplicationName = "OtOpcUa AdminUI Browse",
+            ApplicationType = ApplicationType.Client,
+            ApplicationUri = "urn:OtOpcUa:AdminUI:Browse",
+            SecurityConfiguration = new SecurityConfiguration
+            {
+                ApplicationCertificate = new CertificateIdentifier
+                {
+                    StoreType = CertificateStoreType.Directory,
+                    StorePath = Path.Combine(pkiRoot, "own"),
+                    SubjectName = "CN=OtOpcUa AdminUI Browse",
+                },
+                TrustedPeerCertificates = new CertificateTrustList
+                {
+                    StoreType = CertificateStoreType.Directory,
+                    StorePath = Path.Combine(pkiRoot, "trusted"),
+                },
+                TrustedIssuerCertificates = new CertificateTrustList
+                {
+                    StoreType = CertificateStoreType.Directory,
+                    StorePath = Path.Combine(pkiRoot, "issuers"),
+                },
+                RejectedCertificateStore = new CertificateTrustList
+                {
+                    StoreType = CertificateStoreType.Directory,
+                    StorePath = Path.Combine(pkiRoot, "rejected"),
+                },
+                AutoAcceptUntrustedCertificates = false,
+            },
+            TransportQuotas = new TransportQuotas { OperationTimeout = 30_000 },
+            ClientConfiguration = new ClientConfiguration { DefaultSessionTimeout = 60_000 },
+            DisableHiResClock = true,
+        };
+        await config.ValidateAsync(ApplicationType.Client, ct).ConfigureAwait(false);
+        app.ApplicationConfiguration = config;
+        await app.CheckApplicationInstanceCertificatesAsync(silent: true, lifeTimeInMonths: null, ct)
+            .ConfigureAwait(false);
+        return config;
+    }
+
+    /// <summary>Build the OPC UA user identity from the form's auth fields.</summary>
+    /// <param name="opts">Driver options carrying the form's auth fields.</param>
+    private static UserIdentity BuildBrowseUserIdentity(OpcUaClientDriverOptions opts) => opts.AuthType switch
+    {
+        OpcUaAuthType.Anonymous => new UserIdentity(new AnonymousIdentityToken()),
+        OpcUaAuthType.Username => new UserIdentity(
+            opts.Username ?? string.Empty,
+            System.Text.Encoding.UTF8.GetBytes(opts.Password ?? string.Empty)),
+        _ => new UserIdentity(new AnonymousIdentityToken()),
+    };
+
+    /// <summary>Select the endpoint matching the requested SecurityPolicy + SecurityMode pair.</summary>
+    /// <param name="appConfig">Application configuration used by the discovery client.</param>
+    /// <param name="url">Remote endpoint URL to query.</param>
+    /// <param name="policy">Required security policy.</param>
+    /// <param name="mode">Required message security mode.</param>
+    /// <param name="ct">Cancellation token for the discovery call.</param>
+    private static async Task<EndpointDescription> SelectEndpointAsync(
+        ApplicationConfiguration appConfig, string url,
+        OpcUaSecurityPolicy policy, OpcUaSecurityMode mode, CancellationToken ct)
+    {
+        using var client = await DiscoveryClient.CreateAsync(
+            appConfig, new Uri(url), DiagnosticsMasks.None, ct).ConfigureAwait(false);
+        var all = await client.GetEndpointsAsync(null, ct).ConfigureAwait(false);
+
+        var wantedPolicy = MapPolicy(policy);
+        var wantedMode = mode switch
+        {
+            OpcUaSecurityMode.None => MessageSecurityMode.None,
+            OpcUaSecurityMode.Sign => MessageSecurityMode.Sign,
+            OpcUaSecurityMode.SignAndEncrypt => MessageSecurityMode.SignAndEncrypt,
+            _ => throw new ArgumentOutOfRangeException(nameof(mode)),
+        };
+        var match = all.FirstOrDefault(e =>
+            e.SecurityPolicyUri == wantedPolicy && e.SecurityMode == wantedMode);
+        if (match is null)
+        {
+            var advertised = string.Join(", ", all.Select(e =>
+                $"{ShortName(e.SecurityPolicyUri)}/{e.SecurityMode}"));
+            throw new InvalidOperationException(
+                $"No endpoint at '{url}' matches SecurityPolicy={policy} + SecurityMode={mode}. " +
+                $"Server advertises: {advertised}");
+        }
+        return match;
+    }
+
+    /// <summary>Convert the driver options enum to the OPC UA policy URI.</summary>
+    /// <param name="p">The driver security policy to map.</param>
+    private static string MapPolicy(OpcUaSecurityPolicy p) => p switch
+    {
+        OpcUaSecurityPolicy.None => SecurityPolicies.None,
+        OpcUaSecurityPolicy.Basic128Rsa15 => SecurityPolicies.Basic128Rsa15,
+        OpcUaSecurityPolicy.Basic256 => SecurityPolicies.Basic256,
+        OpcUaSecurityPolicy.Basic256Sha256 => SecurityPolicies.Basic256Sha256,
+        OpcUaSecurityPolicy.Aes128_Sha256_RsaOaep => SecurityPolicies.Aes128_Sha256_RsaOaep,
+        OpcUaSecurityPolicy.Aes256_Sha256_RsaPss => SecurityPolicies.Aes256_Sha256_RsaPss,
+        _ => throw new ArgumentOutOfRangeException(nameof(p)),
+    };
+
+    /// <summary>Render an OPC UA security-policy URI as its short suffix for diag messages.</summary>
+    /// <param name="uri">Full policy URI to shorten.</param>
+    private static string ShortName(string uri) =>
+        uri?.Substring(uri.LastIndexOf('#') + 1) ?? "(null)";
+}
@@ -0,0 +1,17 @@
+<Project Sdk="Microsoft.NET.Sdk">
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    </PropertyGroup>
+    <ItemGroup>
+        <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Commons\ZB.MOM.WW.OtOpcUa.Commons.csproj" />
+        <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts.csproj" />
+    </ItemGroup>
+    <ItemGroup>
+        <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Client" />
+        <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Configuration" />
+        <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
+    </ItemGroup>
+</Project>
@@ -32,7 +32,7 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient;
 ///         direct parse against the current session.
 ///     </para>
 /// </remarks>
-internal sealed class NamespaceMap
+public sealed class NamespaceMap
 {
    // index -> URI and URI -> index, as the upstream server published them at connect time.
    private readonly string[] _uris;
@@ -5,5 +5,7 @@
        <ImplicitUsings>enable</ImplicitUsings>
        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
    </PropertyGroup>
-    <!-- NO PackageReference. NO ProjectReference. -->
+    <ItemGroup>
+        <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Client" />
+    </ItemGroup>
 </Project>
@@ -0,0 +1,67 @@
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+
+namespace ZB.MOM.WW.OtOpcUa.AdminUI.Browsing;
+
+/// <summary>
+///     Background service that periodically evicts idle browse sessions from the
+///     <see cref="BrowseSessionRegistry"/>. Each tick takes a snapshot of the registry,
+///     removes any session that has been idle longer than <see cref="IdleTtl"/>, then
+///     disposes the evicted instance OUTSIDE the dictionary — so concurrent expand
+///     calls racing eviction fail cleanly via <see cref="BrowseSessionNotFoundException"/>.
+/// </summary>
+public sealed class BrowseSessionReaper(
+    BrowseSessionRegistry registry,
+    ILogger<BrowseSessionReaper> logger) : BackgroundService
+{
+    /// <summary>How long a session may be untouched before it becomes eligible for eviction.</summary>
+    public static readonly TimeSpan IdleTtl = TimeSpan.FromMinutes(2);
+
+    /// <summary>How often the reaper checks the registry.</summary>
+    public static readonly TimeSpan TickInterval = TimeSpan.FromSeconds(30);
+
+    /// <inheritdoc />
+    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
+    {
+        using var timer = new PeriodicTimer(TickInterval);
+        while (!stoppingToken.IsCancellationRequested &&
+               await timer.WaitForNextTickAsync(stoppingToken).ConfigureAwait(false))
+        {
+            try { await ReapOnceAsync(stoppingToken).ConfigureAwait(false); }
+            catch (Exception ex)
+            {
+                logger.LogWarning(ex, "Browse-session reaper iteration failed; will retry next tick.");
+            }
+        }
+        await DrainAllAsync().ConfigureAwait(false);
+    }
+
+    /// <summary>Evicts every session whose <see cref="Commons.Browsing.IBrowseSession.LastUsedUtc"/>
+    /// is older than <see cref="IdleTtl"/>. Internal so tests can drive a tick directly.</summary>
+    internal async Task ReapOnceAsync(CancellationToken ct)
+    {
+        var now = DateTime.UtcNow;
+        foreach (var (token, session) in registry.Snapshot())
+        {
+            if (now - session.LastUsedUtc < IdleTtl) continue;
+            if (!registry.TryRemove(token, out var taken)) continue;
+            try { await taken.DisposeAsync().ConfigureAwait(false); }
+            catch (Exception ex)
+            {
+                logger.LogDebug(ex,
+                    "Best-effort dispose of idle-evicted browse session {Token} failed.", token);
+            }
+            logger.LogDebug("Browse session {Token} closed reason=idle-ttl", token);
+        }
+    }
+
+    private async Task DrainAllAsync()
+    {
+        foreach (var (token, session) in registry.Snapshot())
+        {
+            if (!registry.TryRemove(token, out var taken)) continue;
+            try { await taken.DisposeAsync().ConfigureAwait(false); } catch { }
+            logger.LogDebug("Browse session {Token} closed reason=shutdown", token);
+        }
+    }
+}
@@ -0,0 +1,30 @@
+using System.Collections.Concurrent;
+using ZB.MOM.WW.OtOpcUa.Commons.Browsing;
+
+namespace ZB.MOM.WW.OtOpcUa.AdminUI.Browsing;
+
+/// <summary>
+///     Singleton in-process directory of live <see cref="IBrowseSession"/> instances,
+///     keyed by <see cref="IBrowseSession.Token"/>. Concurrency is provided by the
+///     underlying <see cref="ConcurrentDictionary{TKey, TValue}"/> alone — there are no
+///     additional locks; callers must dispose evicted sessions outside the dictionary.
+/// </summary>
+public sealed class BrowseSessionRegistry
+{
+    private readonly ConcurrentDictionary<Guid, IBrowseSession> _sessions = new();
+
+    /// <summary>Adds (or replaces) a session in the registry keyed by its token.</summary>
+    public void Register(IBrowseSession session) => _sessions[session.Token] = session;
+
+    /// <summary>Looks up a session by token without removing it.</summary>
+    public bool TryGet(Guid token, out IBrowseSession session) =>
+        _sessions.TryGetValue(token, out session!);
+
+    /// <summary>Atomically removes a session from the registry, returning it for disposal.</summary>
+    public bool TryRemove(Guid token, out IBrowseSession session) =>
+        _sessions.TryRemove(token, out session!);
+
+    /// <summary>Returns a point-in-time snapshot of all currently registered sessions.</summary>
+    public IReadOnlyList<(Guid Token, IBrowseSession Session)> Snapshot() =>
+        _sessions.Select(kv => (kv.Key, kv.Value)).ToList();
+}
@@ -0,0 +1,72 @@
+using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.OtOpcUa.Commons.Browsing;
+
+namespace ZB.MOM.WW.OtOpcUa.AdminUI.Browsing;
+
+/// <summary>
+///     Default <see cref="IBrowserSessionService"/> implementation. Indexes injected
+///     <see cref="IDriverBrowser"/>s by <see cref="IDriverBrowser.DriverType"/>
+///     (case-insensitive) at construction, registers opened sessions, and wraps each
+///     expand/attributes call in a 20-second linked CTS so a stuck driver cannot
+///     stall the UI indefinitely.
+/// </summary>
+public sealed class BrowserSessionService(
+    IEnumerable<IDriverBrowser> browsers,
+    BrowseSessionRegistry registry,
+    ILogger<BrowserSessionService> logger) : IBrowserSessionService
+{
+    /// <summary>Upper bound on a single root/expand/attributes call.</summary>
+    public static readonly TimeSpan PerCallTimeout = TimeSpan.FromSeconds(20);
+
+    private readonly IReadOnlyDictionary<string, IDriverBrowser> _browsersByType =
+        browsers.ToDictionary(b => b.DriverType, StringComparer.OrdinalIgnoreCase);
+
+    /// <inheritdoc />
+    public async Task<BrowseOpenResult> OpenAsync(string driverType, string configJson, CancellationToken ct)
+    {
+        if (!_browsersByType.TryGetValue(driverType, out var browser))
+            return new(false, $"No browser registered for driver type '{driverType}'.", Guid.Empty);
+        try
+        {
+            var session = await browser.OpenAsync(configJson, ct).ConfigureAwait(false);
+            registry.Register(session);
+            return new(true, null, session.Token);
+        }
+        catch (Exception ex)
+        {
+            logger.LogInformation(ex,
+                "Browser open failed for driverType={DriverType}: {Message}", driverType, ex.Message);
+            return new(false, ex.Message, Guid.Empty);
+        }
+    }
+
+    /// <inheritdoc />
+    public Task<IReadOnlyList<BrowseNode>> RootAsync(Guid token, CancellationToken ct) =>
+        InvokeAsync(token, ct, (s, c) => s.RootAsync(c));
+
+    /// <inheritdoc />
+    public Task<IReadOnlyList<BrowseNode>> ExpandAsync(Guid token, string nodeId, CancellationToken ct) =>
+        InvokeAsync(token, ct, (s, c) => s.ExpandAsync(nodeId, c));
+
+    /// <inheritdoc />
+    public Task<IReadOnlyList<AttributeInfo>> AttributesAsync(Guid token, string nodeId, CancellationToken ct) =>
+        InvokeAsync<IReadOnlyList<AttributeInfo>>(token, ct, (s, c) => s.AttributesAsync(nodeId, c));
+
+    /// <inheritdoc />
+    public async Task CloseAsync(Guid token)
+    {
+        if (!registry.TryRemove(token, out var session)) return;
+        try { await session.DisposeAsync().ConfigureAwait(false); } catch { }
+        logger.LogDebug("Browse session {Token} closed reason=user-close", token);
+    }
+
+    private async Task<T> InvokeAsync<T>(
+        Guid token, CancellationToken callerCt, Func<IBrowseSession, CancellationToken, Task<T>> op)
+    {
+        if (!registry.TryGet(token, out var session))
+            throw new BrowseSessionNotFoundException(token);
+        using var cts = CancellationTokenSource.CreateLinkedTokenSource(callerCt);
+        cts.CancelAfter(PerCallTimeout);
+        return await op(session, cts.Token).ConfigureAwait(false);
+    }
+}
@@ -0,0 +1,48 @@
+using ZB.MOM.WW.OtOpcUa.Commons.Browsing;
+
+namespace ZB.MOM.WW.OtOpcUa.AdminUI.Browsing;
+
+/// <summary>
+///     Outcome of <see cref="IBrowserSessionService.OpenAsync"/>. On success
+///     <paramref name="Ok"/> is <see langword="true"/> and <paramref name="Token"/> is the
+///     registry handle; on failure <paramref name="Message"/> carries a human-readable
+///     diagnostic for the UI's error chip.
+/// </summary>
+/// <param name="Ok">True iff the browse session was opened and registered.</param>
+/// <param name="Message">Failure diagnostic, or <see langword="null"/> on success.</param>
+/// <param name="Token">Registry handle on success; <see cref="Guid.Empty"/> on failure.</param>
+public sealed record BrowseOpenResult(bool Ok, string? Message, Guid Token);
+
+/// <summary>
+///     Scoped Razor-page facade over the in-process browse-session machinery. Owns
+///     driver-type dispatch on open and per-call timeout enforcement on expand/attributes.
+/// </summary>
+public interface IBrowserSessionService
+{
+    /// <summary>Opens a session against the named driver type using the given JSON config.
+    /// Never throws — all errors are surfaced via <see cref="BrowseOpenResult"/>.</summary>
+    Task<BrowseOpenResult> OpenAsync(string driverType, string configJson, CancellationToken ct);
+
+    /// <summary>Returns the root nodes of an open session. Throws
+    /// <see cref="BrowseSessionNotFoundException"/> if the token is unknown.</summary>
+    Task<IReadOnlyList<BrowseNode>> RootAsync(Guid token, CancellationToken ct);
+
+    /// <summary>Returns the direct children of <paramref name="nodeId"/> in an open session.
+    /// Throws <see cref="BrowseSessionNotFoundException"/> if the token is unknown.</summary>
+    Task<IReadOnlyList<BrowseNode>> ExpandAsync(Guid token, string nodeId, CancellationToken ct);
+
+    /// <summary>Returns the attributes of <paramref name="nodeId"/> in an open session. Throws
+    /// <see cref="BrowseSessionNotFoundException"/> if the token is unknown.</summary>
+    Task<IReadOnlyList<AttributeInfo>> AttributesAsync(Guid token, string nodeId, CancellationToken ct);
+
+    /// <summary>Removes the session from the registry and disposes it. No-op for unknown tokens.</summary>
+    Task CloseAsync(Guid token);
+}
+
+/// <summary>
+///     Raised by the service layer when a caller references a token that is not
+///     (or no longer) in the registry — typically because the reaper evicted it
+///     between calls.
+/// </summary>
+public sealed class BrowseSessionNotFoundException(Guid token)
+    : InvalidOperationException($"Browse session {token} not found (may have been reaped).");
@@ -4,11 +4,10 @@
   and the AB CIP ALMD bridge. *@
@attribute [Microsoft.AspNetCore.Authorization.Authorize]
@rendermode RenderMode.InteractiveServer
-@using Microsoft.AspNetCore.SignalR.Client
@using ZB.MOM.WW.OtOpcUa.AdminUI.Hubs
@using ZB.MOM.WW.OtOpcUa.Commons.Messages.Alerts
-@inject NavigationManager Nav
-@implements IAsyncDisposable
+@inject IInProcessBroadcaster<AlarmTransitionEvent> Alarms
+@implements IDisposable

 <div class="d-flex justify-content-between align-items-center mb-3">
    <h4 class="mb-0">Alerts</h4>
@@ -73,36 +72,26 @@ else
    private const int Capacity = 200;

    private readonly List<AlarmTransitionEvent> _rows = new();
-    private HubConnection? _hub;
    private bool _connected;

-    protected override async Task OnInitializedAsync()
+    protected override void OnInitialized()
    {
-        _hub = new HubConnectionBuilder()
-            .WithUrl(Nav.ToAbsoluteUri(AlertHub.Endpoint))
-            .WithAutomaticReconnect()
-            .Build();
+        // Live alarm tail straight from the in-process broadcaster (fed by AlertSignalRBridge off the
+        // 'alerts' DPS topic). A Blazor Server component can't self-connect a SignalR HubConnection
+        // behind a reverse proxy — see IInProcessBroadcaster — so we subscribe in-process instead.
+        Alarms.Received += OnAlarm;
+        _connected = true;
+    }

-        _hub.On<AlarmTransitionEvent>(AlertHub.MethodName, evt =>
+    private void OnAlarm(AlarmTransitionEvent evt) =>
+        // Marshal both the mutation and the re-render onto the circuit sync context so this can't
+        // race ClearAsync (which runs there) over the shared _rows list.
+        InvokeAsync(() =>
        {
            _rows.Insert(0, evt);
            if (_rows.Count > Capacity) _rows.RemoveAt(_rows.Count - 1);
-            InvokeAsync(StateHasChanged);
+            StateHasChanged();
        });
-        _hub.Closed += _ => { _connected = false; return InvokeAsync(StateHasChanged); };
-        _hub.Reconnected += _ => { _connected = true; return InvokeAsync(StateHasChanged); };
-
-        try
-        {
-            await _hub.StartAsync();
-            _connected = true;
-        }
-        catch
-        {
-            // Connection failures (admin-only deployment, hub not mapped, etc.) leave the page
-            // showing "disconnected" — operator action: reload or talk to the host operator.
-        }
-    }

    private async Task ClearAsync()
    {
@@ -119,8 +108,5 @@ else
        _ => "chip-idle",
    };

-    public async ValueTask DisposeAsync()
-    {
-        if (_hub is not null) await _hub.DisposeAsync();
-    }
+    public void Dispose() => Alarms.Received -= OnAlarm;
 }
@@ -21,9 +21,8 @@ else
 {
    <section class="panel notice rise" style="animation-delay:.02s">
        ACL rows grant LDAP groups specific <span class="mono">NodePermissions</span> on a scope
-        (a folder, an equipment, a tag). Q4 of the AdminUI rebuild plan dropped per-cluster role
-        grants in favour of fleet-wide LDAP-group → role mapping; ACLs here are the finer-grained
-        per-node scope. Live editing lands in a Phase C.2 follow-up.
+        (a folder, an equipment, a tag). Per-cluster role grants were dropped in favour of
+        fleet-wide LDAP-group → role mapping; ACLs here are the finer-grained per-node scope.
    </section>

    <section class="panel rise mt-3" style="animation-delay:.08s">
@@ -19,12 +19,6 @@
 }
 else
 {
-    <section class="panel notice rise" style="animation-delay:.02s">
-        Per Q1 of the AdminUI rebuild plan, typed driver editors (Modbus, FOCAS) are deferred.
-        The expanded view below shows raw JSON config. Live editing — including a generic JSON
-        editor and per-driver-type forms when operators ask — lands in a Phase C.2 follow-up.
-    </section>
-
    <section class="panel rise mt-3" style="animation-delay:.08s">
        <div class="panel-head">@_rows.Count driver instance@(_rows.Count == 1 ? "" : "s")</div>
        @if (_rows.Count == 0)
@@ -25,7 +25,7 @@ else
    <section class="panel notice rise" style="animation-delay:.02s">
        Equipment rows are scoped to a UNS line and bound to a single driver. EquipmentId is
        system-generated (decision #125); browse identifiers are MachineCode (operator) + ZTag
-        (ERP). Live editing lands in a Phase C.2 follow-up.
+        (ERP).
    </section>

    <section class="panel rise mt-3" style="animation-delay:.08s">
@@ -21,8 +21,7 @@ else
 {
    <section class="panel notice rise" style="animation-delay:.02s">
        Namespaces are content (decision #123) — they're served at the OPC UA endpoint and bound
-        to driver instances. NamespaceUri must be unique fleet-wide. Live editing lands in a
-        Phase C.2 follow-up.
+        to driver instances. NamespaceUri must be unique fleet-wide.
    </section>

    <section class="panel rise mt-3" style="animation-delay:.08s">
@@ -21,7 +21,7 @@ else
 {
    <section class="panel notice rise" style="animation-delay:.02s">
        Tags are bound to a driver instance and (optionally) an equipment + poll group. The view
-        below shows the first @PageSize tags by Name; full pagination + search land in Phase C.2.
+        below shows the first @PageSize tags by Name.
    </section>

    <div class="d-flex align-items-center mb-3 gap-2 mt-3">
@@ -20,8 +20,7 @@ else
 {
    <section class="panel notice rise" style="animation-delay:.02s">
        UNS levels: Enterprise (cluster) → Site (cluster) → Area → Line → Equipment. Areas and
-        lines are cluster-scoped; equipment hangs under a single line. Live editing lands in a
-        Phase C.2 follow-up.
+        lines are cluster-scoped; equipment hangs under a single line.
    </section>

    <section class="panel rise mt-3" style="animation-delay:.08s">
@@ -146,27 +146,65 @@ else
                </div>
            </section>

-            @* Devices — read-only JSON view *@
-            <section class="panel rise mt-3" style="animation-delay:.12s">
-                <div class="panel-head">Devices</div>
-                <div style="padding:1rem">
-                    <p class="form-text mb-2">
-                        Device list (host addresses, PLC family, packing overrides) — full list-editor coming in a follow-up phase. Each entry: <code>{ "hostAddress": "ab://gateway/1,0", "plcFamily": "ControlLogix" }</code>.
-                    </p>
-                    <pre class="form-control form-control-sm mono" style="min-height:4rem;overflow:auto;white-space:pre-wrap;">@_devicesJson</pre>
-                </div>
-            </section>
+            @* Devices *@
+            <CollectionEditor TRow="AbCipDeviceRow" Items="_devices" Title="Devices" ItemNoun="device"
+                              AnimationDelay=".12s"
+                              NewRow="@(() => new AbCipDeviceRow())" Clone="@(r => r.Clone())"
+                              Validate="AbCipDeviceRow.ValidateRow">
+                <HeaderTemplate>
+                    <tr><th>Host address</th><th>PLC family</th><th>Device name</th><th></th></tr>
+                </HeaderTemplate>
+                <RowTemplate Context="d">
+                    <td class="mono">@d.HostAddress</td><td>@d.PlcFamily</td>
+                    <td>@(string.IsNullOrWhiteSpace(d.DeviceName) ? "—" : d.DeviceName)</td>
+                </RowTemplate>
+                <EditTemplate Context="d">
+                    <div class="row g-3">
+                        <div class="col-md-6"><label class="form-label">Host address</label>
+                            <input class="form-control form-control-sm mono" @bind="d.HostAddress"
+                                   placeholder="ab://gateway/1,0" /></div>
+                        <div class="col-md-3"><label class="form-label">PLC family</label>
+                            <select class="form-select form-select-sm" @bind="d.PlcFamily">
+                                @foreach (var e in Enum.GetValues<AbCipPlcFamily>()) { <option value="@e">@e</option> }
+                            </select></div>
+                        <div class="col-md-3"><label class="form-label">Device name</label>
+                            <input class="form-control form-control-sm" @bind="d.DeviceName" /></div>
+                    </div>
+                </EditTemplate>
+            </CollectionEditor>

-            @* Tags — read-only JSON view *@
-            <section class="panel rise mt-3" style="animation-delay:.14s">
-                <div class="panel-head">Tags</div>
-                <div style="padding:1rem">
-                    <p class="form-text mb-2">
-                        Tag list — full list-editor coming in a follow-up phase. Edit via the Tag editor pages or export/import the driver config JSON.
-                    </p>
-                    <pre class="form-control form-control-sm mono" style="min-height:4rem;overflow:auto;white-space:pre-wrap;">@_tagsJson</pre>
-                </div>
-            </section>
+            @* Tags *@
+            <CollectionEditor TRow="AbCipTagRow" Items="_tags" Title="Tags" ItemNoun="tag"
+                              AnimationDelay=".14s"
+                              NewRow="@(() => new AbCipTagRow())" Clone="@(r => r.Clone())"
+                              Validate="AbCipTagRow.ValidateRow">
+                <HeaderTemplate>
+                    <tr><th>Name</th><th>Device</th><th>Tag path</th><th>Type</th><th>Writable</th><th></th></tr>
+                </HeaderTemplate>
+                <RowTemplate Context="t">
+                    <td class="mono">@t.Name</td><td class="mono">@t.DeviceHostAddress</td>
+                    <td class="mono">@t.TagPath</td><td>@t.DataType</td><td>@(t.Writable ? "yes" : "no")</td>
+                </RowTemplate>
+                <EditTemplate Context="t">
+                    <div class="row g-3">
+                        <div class="col-md-6"><label class="form-label">Name</label>
+                            <input class="form-control form-control-sm" @bind="t.Name" /></div>
+                        <div class="col-md-6"><label class="form-label">Device host address</label>
+                            <input class="form-control form-control-sm mono" @bind="t.DeviceHostAddress"
+                                   placeholder="ab://gateway/1,0" /></div>
+                        <div class="col-md-6"><label class="form-label">Tag path</label>
+                            <input class="form-control form-control-sm mono" @bind="t.TagPath"
+                                   placeholder="e.g. Program:Main.SomeTag" /></div>
+                        <div class="col-md-3"><label class="form-label">Data type</label>
+                            <select class="form-select form-select-sm" @bind="t.DataType">
+                                @foreach (var e in Enum.GetValues<AbCipDataType>()) { <option value="@e">@e</option> }
+                            </select></div>
+                        <div class="col-md-3"><div class="form-check form-switch mt-4">
+                            <input type="checkbox" class="form-check-input" @bind="t.Writable" id="tagWritable" />
+                            <label class="form-check-label" for="tagWritable">Writable</label></div></div>
+                    </div>
+                </EditTemplate>
+            </CollectionEditor>

            <DriverResilienceSection @bind-ResilienceConfig="_form.ResilienceConfig" />
        </DriverFormShell>
@@ -202,11 +240,9 @@ else

    private void OnAddressPicked(string address) => _pickedAddress = address;

-    // Collections are preserved through round-trip and shown as read-only JSON.
-    private IReadOnlyList<AbCipDeviceOptions> _devices = [];
-    private IReadOnlyList<AbCipTagDefinition> _tags = [];
-    private string _devicesJson = "[]";
-    private string _tagsJson = "[]";
+    // Held separately because Devices/Tags are collections — edited via the CollectionEditor modal.
+    private List<AbCipDeviceRow> _devices = [];
+    private List<AbCipTagRow> _tags = [];

    protected override async Task OnInitializedAsync()
    {
@@ -246,12 +282,10 @@ else
                _form = FormModel.FromOptions(opts);
                _form.ResilienceConfig = _existing.ResilienceConfig;
                _form.RowVersion = _existing.RowVersion;
-                _devices = opts.Devices;
-                _tags = opts.Tags;
+                _devices = opts.Devices.Select(AbCipDeviceRow.FromDefinition).ToList();
+                _tags = opts.Tags.Select(AbCipTagRow.FromDefinition).ToList();
            }
        }
-        _devicesJson = System.Text.Json.JsonSerializer.Serialize(_devices, _jsonOpts);
-        _tagsJson = System.Text.Json.JsonSerializer.Serialize(_tags, _jsonOpts);
        _loaded = true;
    }

@@ -260,7 +294,11 @@ else
        _busy = true; _error = null;
        try
        {
-            var configJson = System.Text.Json.JsonSerializer.Serialize(_form.ToOptions(_devices, _tags), _jsonOpts);
+            var configJson = System.Text.Json.JsonSerializer.Serialize(
+                _form.ToOptions(
+                    _devices.Select(r => r.ToDefinition()).ToList(),
+                    _tags.Select(r => r.ToDefinition()).ToList()),
+                _jsonOpts);
            await using var db = await DbFactory.CreateDbContextAsync();
            if (IsNew)
            {
@@ -331,7 +369,11 @@ else
    }

    private string SerializeCurrentConfig()
-        => System.Text.Json.JsonSerializer.Serialize(_form.ToOptions(_devices, _tags), _jsonOpts);
+        => System.Text.Json.JsonSerializer.Serialize(
+            _form.ToOptions(
+                _devices.Select(r => r.ToDefinition()).ToList(),
+                _tags.Select(r => r.ToDefinition()).ToList()),
+            _jsonOpts);

    private static AbCipDriverOptions? TryDeserialize(string json)
    {
@@ -339,6 +381,91 @@ else
        catch { return null; }
    }

+    // Mutable VM for the modal editor — AbCipDeviceOptions is an immutable record.
+    public sealed class AbCipDeviceRow
+    {
+        public string HostAddress { get; set; } = "";
+        public AbCipPlcFamily PlcFamily { get; set; } = AbCipPlcFamily.ControlLogix;
+        public string? DeviceName { get; set; }
+
+        // Original record (null for newly-added rows). Preserves fields the editor doesn't expose
+        // (AllowPacking, ConnectionSize) across a load→save.
+        private AbCipDeviceOptions? _source;
+
+        public AbCipDeviceRow Clone() => (AbCipDeviceRow)MemberwiseClone(); // _source is an immutable record ref — safe to share
+
+        public static AbCipDeviceRow FromDefinition(AbCipDeviceOptions d) => new()
+        {
+            HostAddress = d.HostAddress, PlcFamily = d.PlcFamily, DeviceName = d.DeviceName,
+            _source = d,
+        };
+
+        public AbCipDeviceOptions ToDefinition()
+        {
+            var baseDef = _source ?? new AbCipDeviceOptions(HostAddress.Trim(), PlcFamily);
+            return baseDef with
+            {
+                HostAddress = HostAddress.Trim(),
+                PlcFamily = PlcFamily,
+                DeviceName = string.IsNullOrWhiteSpace(DeviceName) ? null : DeviceName.Trim(),
+            };
+        }
+
+        public static string? ValidateRow(AbCipDeviceRow row, IReadOnlyList<AbCipDeviceRow> all, int? editIndex)
+        {
+            if (string.IsNullOrWhiteSpace(row.HostAddress)) return "Host address is required.";
+            for (var i = 0; i < all.Count; i++)
+                if (i != editIndex && string.Equals(all[i].HostAddress, row.HostAddress, StringComparison.OrdinalIgnoreCase))
+                    return $"Duplicate device host address '{row.HostAddress}'.";
+            return null;
+        }
+    }
+
+    // Mutable VM for the modal editor — AbCipTagDefinition is an immutable record.
+    public sealed class AbCipTagRow
+    {
+        public string Name { get; set; } = "";
+        public string DeviceHostAddress { get; set; } = "";
+        public string TagPath { get; set; } = "";
+        public AbCipDataType DataType { get; set; } = AbCipDataType.DInt;
+        public bool Writable { get; set; } = true;
+
+        // Original record (null for newly-added rows). Preserves fields the editor doesn't expose
+        // (WriteIdempotent, Members, SafetyTag) across a load→save.
+        private AbCipTagDefinition? _source;
+
+        public AbCipTagRow Clone() => (AbCipTagRow)MemberwiseClone(); // _source is an immutable record ref — safe to share
+
+        public static AbCipTagRow FromDefinition(AbCipTagDefinition d) => new()
+        {
+            Name = d.Name, DeviceHostAddress = d.DeviceHostAddress, TagPath = d.TagPath,
+            DataType = d.DataType, Writable = d.Writable,
+            _source = d,
+        };
+
+        public AbCipTagDefinition ToDefinition()
+        {
+            var baseDef = _source ?? new AbCipTagDefinition(Name.Trim(), DeviceHostAddress.Trim(), TagPath.Trim(), DataType);
+            return baseDef with
+            {
+                Name = Name.Trim(),
+                DeviceHostAddress = DeviceHostAddress.Trim(),
+                TagPath = TagPath.Trim(),
+                DataType = DataType,
+                Writable = Writable,
+            };
+        }
+
+        public static string? ValidateRow(AbCipTagRow row, IReadOnlyList<AbCipTagRow> all, int? editIndex)
+        {
+            if (string.IsNullOrWhiteSpace(row.Name)) return "Name is required.";
+            for (var i = 0; i < all.Count; i++)
+                if (i != editIndex && string.Equals(all[i].Name, row.Name, StringComparison.OrdinalIgnoreCase))
+                    return $"Duplicate tag name '{row.Name}'.";
+            return null;
+        }
+    }
+
    // Flat mutable model — all scalar properties settable for Blazor @bind-Value.
    // Collections (Devices, Tags) are kept on the component and passed in on ToOptions().
    public sealed class FormModel
@@ -112,30 +112,65 @@ else
                </div>
            </section>

-            @* Devices — read-only JSON view *@
-            <section class="panel rise mt-3" style="animation-delay:.10s">
-                <div class="panel-head">Devices</div>
-                <div style="padding:1rem">
-                    <p class="form-text mb-2">
-                        Device list (host addresses, PLC family) — full list-editor coming in a follow-up phase.
-                        Each entry: <code>{ "hostAddress": "...", "plcFamily": "Slc500" }</code>.
-                        PLC families: <code>Slc500</code>, <code>MicroLogix</code>, <code>Plc5</code>, <code>LogixPccc</code>.
-                    </p>
-                    <pre class="form-control form-control-sm mono" style="min-height:4rem;overflow:auto;white-space:pre-wrap;">@_devicesJson</pre>
-                </div>
-            </section>
+            @* Devices *@
+            <CollectionEditor TRow="AbLegacyDeviceRow" Items="_devices" Title="Devices" ItemNoun="device"
+                              AnimationDelay=".10s"
+                              NewRow="@(() => new AbLegacyDeviceRow())" Clone="@(r => r.Clone())"
+                              Validate="AbLegacyDeviceRow.ValidateRow">
+                <HeaderTemplate>
+                    <tr><th>Host address</th><th>PLC family</th><th>Device name</th><th></th></tr>
+                </HeaderTemplate>
+                <RowTemplate Context="d">
+                    <td class="mono">@d.HostAddress</td><td>@d.PlcFamily</td>
+                    <td>@(string.IsNullOrWhiteSpace(d.DeviceName) ? "—" : d.DeviceName)</td>
+                </RowTemplate>
+                <EditTemplate Context="d">
+                    <div class="row g-3">
+                        <div class="col-md-6"><label class="form-label">Host address</label>
+                            <input class="form-control form-control-sm mono" @bind="d.HostAddress"
+                                   placeholder="10.0.0.10" /></div>
+                        <div class="col-md-3"><label class="form-label">PLC family</label>
+                            <select class="form-select form-select-sm" @bind="d.PlcFamily">
+                                @foreach (var e in Enum.GetValues<AbLegacyPlcFamily>()) { <option value="@e">@e</option> }
+                            </select></div>
+                        <div class="col-md-3"><label class="form-label">Device name</label>
+                            <input class="form-control form-control-sm" @bind="d.DeviceName" /></div>
+                    </div>
+                </EditTemplate>
+            </CollectionEditor>

-            @* Tags — read-only JSON view *@
-            <section class="panel rise mt-3" style="animation-delay:.12s">
-                <div class="panel-head">Tags</div>
-                <div style="padding:1rem">
-                    <p class="form-text mb-2">
-                        Tag list — full list-editor coming in a follow-up phase. Edit via the Tag editor pages or export/import the driver config JSON.
-                        Each tag has a PCCC file address (e.g. <code>N7:0</code>, <code>F8:0</code>, <code>B3:0/0</code>).
-                    </p>
-                    <pre class="form-control form-control-sm mono" style="min-height:4rem;overflow:auto;white-space:pre-wrap;">@_tagsJson</pre>
-                </div>
-            </section>
+            @* Tags *@
+            <CollectionEditor TRow="AbLegacyTagRow" Items="_tags" Title="Tags" ItemNoun="tag"
+                              AnimationDelay=".12s"
+                              NewRow="@(() => new AbLegacyTagRow())" Clone="@(r => r.Clone())"
+                              Validate="AbLegacyTagRow.ValidateRow">
+                <HeaderTemplate>
+                    <tr><th>Name</th><th>Device</th><th>Address</th><th>Type</th><th>Writable</th><th></th></tr>
+                </HeaderTemplate>
+                <RowTemplate Context="t">
+                    <td class="mono">@t.Name</td><td class="mono">@t.DeviceHostAddress</td>
+                    <td class="mono">@t.Address</td><td>@t.DataType</td><td>@(t.Writable ? "yes" : "no")</td>
+                </RowTemplate>
+                <EditTemplate Context="t">
+                    <div class="row g-3">
+                        <div class="col-md-6"><label class="form-label">Name</label>
+                            <input class="form-control form-control-sm" @bind="t.Name" /></div>
+                        <div class="col-md-6"><label class="form-label">Device host address</label>
+                            <input class="form-control form-control-sm mono" @bind="t.DeviceHostAddress"
+                                   placeholder="10.0.0.10" /></div>
+                        <div class="col-md-6"><label class="form-label">Address</label>
+                            <input class="form-control form-control-sm mono" @bind="t.Address"
+                                   placeholder="e.g. N7:0, F8:0, B3:0/0" /></div>
+                        <div class="col-md-3"><label class="form-label">Data type</label>
+                            <select class="form-select form-select-sm" @bind="t.DataType">
+                                @foreach (var e in Enum.GetValues<AbLegacyDataType>()) { <option value="@e">@e</option> }
+                            </select></div>
+                        <div class="col-md-3"><div class="form-check form-switch mt-4">
+                            <input type="checkbox" class="form-check-input" @bind="t.Writable" id="tagWritable" />
+                            <label class="form-check-label" for="tagWritable">Writable</label></div></div>
+                    </div>
+                </EditTemplate>
+            </CollectionEditor>

            <DriverResilienceSection @bind-ResilienceConfig="_form.ResilienceConfig" />
        </DriverFormShell>
@@ -171,11 +206,9 @@ else

    private void OnAddressPicked(string address) => _pickedAddress = address;

-    // Collections are preserved through round-trip and shown as read-only JSON.
-    private IReadOnlyList<AbLegacyDeviceOptions> _devices = [];
-    private IReadOnlyList<AbLegacyTagDefinition> _tags = [];
-    private string _devicesJson = "[]";
-    private string _tagsJson = "[]";
+    // Held separately because Devices/Tags are collections — edited via the CollectionEditor modal.
+    private List<AbLegacyDeviceRow> _devices = [];
+    private List<AbLegacyTagRow> _tags = [];

    protected override async Task OnInitializedAsync()
    {
@@ -215,12 +248,10 @@ else
                _form = FormModel.FromOptions(opts);
                _form.ResilienceConfig = _existing.ResilienceConfig;
                _form.RowVersion = _existing.RowVersion;
-                _devices = opts.Devices;
-                _tags = opts.Tags;
+                _devices = opts.Devices.Select(AbLegacyDeviceRow.FromDefinition).ToList();
+                _tags = opts.Tags.Select(AbLegacyTagRow.FromDefinition).ToList();
            }
        }
-        _devicesJson = System.Text.Json.JsonSerializer.Serialize(_devices, _jsonOpts);
-        _tagsJson = System.Text.Json.JsonSerializer.Serialize(_tags, _jsonOpts);
        _loaded = true;
    }

@@ -229,7 +260,11 @@ else
        _busy = true; _error = null;
        try
        {
-            var configJson = System.Text.Json.JsonSerializer.Serialize(_form.ToOptions(_devices, _tags), _jsonOpts);
+            var configJson = System.Text.Json.JsonSerializer.Serialize(
+                _form.ToOptions(
+                    _devices.Select(r => r.ToDefinition()).ToList(),
+                    _tags.Select(r => r.ToDefinition()).ToList()),
+                _jsonOpts);
            await using var db = await DbFactory.CreateDbContextAsync();
            if (IsNew)
            {
@@ -300,7 +335,11 @@ else
    }

    private string SerializeCurrentConfig()
-        => System.Text.Json.JsonSerializer.Serialize(_form.ToOptions(_devices, _tags), _jsonOpts);
+        => System.Text.Json.JsonSerializer.Serialize(
+            _form.ToOptions(
+                _devices.Select(r => r.ToDefinition()).ToList(),
+                _tags.Select(r => r.ToDefinition()).ToList()),
+            _jsonOpts);

    private static AbLegacyDriverOptions? TryDeserialize(string json)
    {
@@ -308,6 +347,91 @@ else
        catch { return null; }
    }

+    // Mutable VM for the modal editor — AbLegacyDeviceOptions is an immutable record.
+    public sealed class AbLegacyDeviceRow
+    {
+        public string HostAddress { get; set; } = "";
+        public AbLegacyPlcFamily PlcFamily { get; set; } = AbLegacyPlcFamily.Slc500;
+        public string? DeviceName { get; set; }
+
+        // Original record (null for newly-added rows). Preserves fields the editor doesn't expose
+        // across a load→save.
+        private AbLegacyDeviceOptions? _source;
+
+        public AbLegacyDeviceRow Clone() => (AbLegacyDeviceRow)MemberwiseClone(); // _source is an immutable record ref — safe to share
+
+        public static AbLegacyDeviceRow FromDefinition(AbLegacyDeviceOptions d) => new()
+        {
+            HostAddress = d.HostAddress, PlcFamily = d.PlcFamily, DeviceName = d.DeviceName,
+            _source = d,
+        };
+
+        public AbLegacyDeviceOptions ToDefinition()
+        {
+            var baseDef = _source ?? new AbLegacyDeviceOptions(HostAddress.Trim(), PlcFamily);
+            return baseDef with
+            {
+                HostAddress = HostAddress.Trim(),
+                PlcFamily = PlcFamily,
+                DeviceName = string.IsNullOrWhiteSpace(DeviceName) ? null : DeviceName.Trim(),
+            };
+        }
+
+        public static string? ValidateRow(AbLegacyDeviceRow row, IReadOnlyList<AbLegacyDeviceRow> all, int? editIndex)
+        {
+            if (string.IsNullOrWhiteSpace(row.HostAddress)) return "Host address is required.";
+            for (var i = 0; i < all.Count; i++)
+                if (i != editIndex && string.Equals(all[i].HostAddress, row.HostAddress, StringComparison.OrdinalIgnoreCase))
+                    return $"Duplicate device host address '{row.HostAddress}'.";
+            return null;
+        }
+    }
+
+    // Mutable VM for the modal editor — AbLegacyTagDefinition is an immutable record.
+    public sealed class AbLegacyTagRow
+    {
+        public string Name { get; set; } = "";
+        public string DeviceHostAddress { get; set; } = "";
+        public string Address { get; set; } = "";
+        public AbLegacyDataType DataType { get; set; } = AbLegacyDataType.Int;
+        public bool Writable { get; set; } = true;
+
+        // Original record (null for newly-added rows). Preserves fields the editor doesn't expose
+        // (WriteIdempotent) across a load→save.
+        private AbLegacyTagDefinition? _source;
+
+        public AbLegacyTagRow Clone() => (AbLegacyTagRow)MemberwiseClone(); // _source is an immutable record ref — safe to share
+
+        public static AbLegacyTagRow FromDefinition(AbLegacyTagDefinition d) => new()
+        {
+            Name = d.Name, DeviceHostAddress = d.DeviceHostAddress, Address = d.Address,
+            DataType = d.DataType, Writable = d.Writable,
+            _source = d,
+        };
+
+        public AbLegacyTagDefinition ToDefinition()
+        {
+            var baseDef = _source ?? new AbLegacyTagDefinition(Name.Trim(), DeviceHostAddress.Trim(), Address.Trim(), DataType);
+            return baseDef with
+            {
+                Name = Name.Trim(),
+                DeviceHostAddress = DeviceHostAddress.Trim(),
+                Address = Address.Trim(),
+                DataType = DataType,
+                Writable = Writable,
+            };
+        }
+
+        public static string? ValidateRow(AbLegacyTagRow row, IReadOnlyList<AbLegacyTagRow> all, int? editIndex)
+        {
+            if (string.IsNullOrWhiteSpace(row.Name)) return "Name is required.";
+            for (var i = 0; i < all.Count; i++)
+                if (i != editIndex && string.Equals(all[i].Name, row.Name, StringComparison.OrdinalIgnoreCase))
+                    return $"Duplicate tag name '{row.Name}'.";
+            return null;
+        }
+    }
+
    // Flat mutable model — all scalar properties settable for Blazor @bind-Value.
    // Collections (Devices, Tags) are kept on the component and passed in on ToOptions().
    public sealed class FormModel
@@ -1,8 +1,6 @@
-@* Dispatch page: reads DriverInstance.DriverType and renders the matching typed editor
-   via <DynamicComponent>. Falls back to the legacy DriverEdit for any type not yet in
-   the map. The route collides with DriverEdit.razor's identical directive — that's
-   intentional. Task 3.4 removes the route from DriverEdit.razor. Blazor route conflicts
-   are runtime, not build-time, so the build succeeds now. *@
+@* Dispatch page: reads DriverInstance.DriverType and dispatches to the matching typed editor
+   via <DynamicComponent> using _componentMap. Shows an error panel when the driver type has
+   no registered typed page. *@
@page "/clusters/{ClusterId}/drivers/{DriverInstanceId}"
@attribute [Microsoft.AspNetCore.Authorization.Authorize]
@rendermode RenderMode.InteractiveServer
@@ -61,7 +59,7 @@ else
            ["TwinCat"]              = typeof(TwinCATDriverPage),
            ["Focas"]                = typeof(FocasDriverPage),
            ["OpcUaClient"]          = typeof(OpcUaClientDriverPage),
-            ["Galaxy"]               = typeof(GalaxyDriverPage),
+            ["GalaxyMxGateway"]      = typeof(GalaxyDriverPage),
            ["Historian.Wonderware"] = typeof(HistorianWonderwareDriverPage),
        };

@@ -1,6 +1,5 @@
-@* TODO(3.3): This route collides with DriverEdit.razor's @page "/clusters/{ClusterId}/drivers/new".
-   Task 3.3 removes the /drivers/new directive from DriverEdit.razor so this page takes over.
-   Blazor resolves route conflicts at runtime, not compile time, so the build succeeds now. *@
+@* Driver type picker — presents a card grid of registered driver types and links to the
+   per-type new-driver creation page (/clusters/{ClusterId}/drivers/new/{slug}). *@
@page "/clusters/{ClusterId}/drivers/new"
@attribute [Microsoft.AspNetCore.Authorization.Authorize]

@@ -189,43 +189,65 @@ else
                </div>
            </section>

-            @* Devices — read-only JSON view *@
-            <section class="panel rise mt-3" style="animation-delay:.20s">
-                <div class="panel-head">Devices</div>
-                <div style="padding:1rem">
-                    <div class="form-text mb-2">
-                        Each device represents one CNC. Device list editor (with CNC series selector) coming in a follow-up phase.
-                        Format: <code>[{"hostAddress":"192.168.0.10:8193","deviceName":"CNC1","series":"Thirty_i"}]</code>
+            @* Devices *@
+            <CollectionEditor TRow="FocasDeviceRow" Items="_devices" Title="Devices" ItemNoun="device"
+                              AnimationDelay=".20s"
+                              NewRow="@(() => new FocasDeviceRow())" Clone="@(r => r.Clone())"
+                              Validate="FocasDeviceRow.ValidateRow">
+                <HeaderTemplate>
+                    <tr><th>Host address</th><th>CNC series</th><th>Device name</th><th></th></tr>
+                </HeaderTemplate>
+                <RowTemplate Context="d">
+                    <td class="mono">@d.HostAddress</td><td>@d.Series</td>
+                    <td>@(string.IsNullOrWhiteSpace(d.DeviceName) ? "—" : d.DeviceName)</td>
+                </RowTemplate>
+                <EditTemplate Context="d">
+                    <div class="row g-3">
+                        <div class="col-md-6"><label class="form-label">Host address</label>
+                            <input class="form-control form-control-sm mono" @bind="d.HostAddress"
+                                   placeholder="192.168.0.10:8193" /></div>
+                        <div class="col-md-3"><label class="form-label">CNC series</label>
+                            <select class="form-select form-select-sm" @bind="d.Series">
+                                @foreach (var e in Enum.GetValues<FocasCncSeries>()) { <option value="@e">@e</option> }
+                            </select></div>
+                        <div class="col-md-3"><label class="form-label">Device name</label>
+                            <input class="form-control form-control-sm" @bind="d.DeviceName" /></div>
                    </div>
-                    @if (_form.DevicesJson is not null)
-                    {
-                        <pre class="form-control form-control-sm mono" style="min-height:4rem;max-height:12rem;overflow:auto;white-space:pre-wrap">@_form.DevicesJson</pre>
-                    }
-                    else
-                    {
-                        <p class="text-muted"><em>No devices configured.</em></p>
-                    }
-                </div>
-            </section>
+                </EditTemplate>
+            </CollectionEditor>

-            @* Tags — read-only JSON view *@
-            <section class="panel rise mt-3" style="animation-delay:.23s">
-                <div class="panel-head">Tags</div>
-                <div style="padding:1rem">
-                    <div class="form-text mb-2">
-                        Tag list editor coming in a follow-up phase. Tags reference device host addresses and FOCAS address strings
-                        (e.g. <code>X0.0</code>, <code>R100</code>, <code>PARAM:1815/0</code>, <code>MACRO:500</code>).
+            @* Tags *@
+            <CollectionEditor TRow="FocasTagRow" Items="_tags" Title="Tags" ItemNoun="tag"
+                              AnimationDelay=".23s"
+                              NewRow="@(() => new FocasTagRow())" Clone="@(r => r.Clone())"
+                              Validate="FocasTagRow.ValidateRow">
+                <HeaderTemplate>
+                    <tr><th>Name</th><th>Device</th><th>Address</th><th>Type</th><th>Writable</th><th></th></tr>
+                </HeaderTemplate>
+                <RowTemplate Context="t">
+                    <td class="mono">@t.Name</td><td class="mono">@t.DeviceHostAddress</td>
+                    <td class="mono">@t.Address</td><td>@t.DataType</td><td>@(t.Writable ? "yes" : "no")</td>
+                </RowTemplate>
+                <EditTemplate Context="t">
+                    <div class="row g-3">
+                        <div class="col-md-6"><label class="form-label">Name</label>
+                            <input class="form-control form-control-sm" @bind="t.Name" /></div>
+                        <div class="col-md-6"><label class="form-label">Device host address</label>
+                            <input class="form-control form-control-sm mono" @bind="t.DeviceHostAddress"
+                                   placeholder="192.168.0.10:8193" /></div>
+                        <div class="col-md-6"><label class="form-label">Address</label>
+                            <input class="form-control form-control-sm mono" @bind="t.Address"
+                                   placeholder="e.g. X0.0, R100, PARAM:1815/0, MACRO:500" /></div>
+                        <div class="col-md-3"><label class="form-label">Data type</label>
+                            <select class="form-select form-select-sm" @bind="t.DataType">
+                                @foreach (var e in Enum.GetValues<FocasDataType>()) { <option value="@e">@e</option> }
+                            </select></div>
+                        <div class="col-md-3"><div class="form-check form-switch mt-4">
+                            <input type="checkbox" class="form-check-input" @bind="t.Writable" id="tagWritable" />
+                            <label class="form-check-label" for="tagWritable">Writable</label></div></div>
                    </div>
-                    @if (_form.TagsJson is not null)
-                    {
-                        <pre class="form-control form-control-sm mono" style="min-height:4rem;max-height:12rem;overflow:auto;white-space:pre-wrap">@_form.TagsJson</pre>
-                    }
-                    else
-                    {
-                        <p class="text-muted"><em>No tags configured.</em></p>
-                    }
-                </div>
-            </section>
+                </EditTemplate>
+            </CollectionEditor>

            <DriverResilienceSection @bind-ResilienceConfig="_form.ResilienceConfig" />
        </DriverFormShell>
@@ -260,6 +282,10 @@ else

    private void OnAddressPicked(string address) => _pickedAddress = address;

+    // Held separately because Devices/Tags are collections — edited via the CollectionEditor modal.
+    private List<FocasDeviceRow> _devices = [];
+    private List<FocasTagRow> _tags = [];
+
    protected override async Task OnInitializedAsync()
    {
        await using var db = await DbFactory.CreateDbContextAsync();
@@ -290,6 +316,8 @@ else
                _form = FormModel.FromOptions(opts);
                _form.ResilienceConfig = _existing.ResilienceConfig;
                _form.RowVersion = _existing.RowVersion;
+                _devices = opts.Devices.Select(FocasDeviceRow.FromDefinition).ToList();
+                _tags = opts.Tags.Select(FocasTagRow.FromDefinition).ToList();
            }
        }
        _loaded = true;
@@ -300,7 +328,9 @@ else
        _busy = true; _error = null;
        try
        {
-            var opts = _form.ToOptions();
+            var opts = _form.ToOptions(
+                _devices.Select(r => r.ToDefinition()).ToList(),
+                _tags.Select(r => r.ToDefinition()).ToList());
            var configJson = System.Text.Json.JsonSerializer.Serialize(opts, _jsonOpts);
            await using var db = await DbFactory.CreateDbContextAsync();
            if (IsNew)
@@ -371,7 +401,11 @@ else
    }

    private string SerializeCurrentConfig()
-        => System.Text.Json.JsonSerializer.Serialize(_form.ToOptions(), _jsonOpts);
+        => System.Text.Json.JsonSerializer.Serialize(
+            _form.ToOptions(
+                _devices.Select(r => r.ToDefinition()).ToList(),
+                _tags.Select(r => r.ToDefinition()).ToList()),
+            _jsonOpts);

    private static FocasDriverOptions? TryDeserialize(string json)
    {
@@ -379,6 +413,93 @@ else
        catch { return null; }
    }

+    // Mutable VM for the modal editor — FocasDeviceOptions is an immutable record.
+    public sealed class FocasDeviceRow
+    {
+        public string HostAddress { get; set; } = "";
+        public FocasCncSeries Series { get; set; } = FocasCncSeries.Unknown;
+        public string? DeviceName { get; set; }
+
+        // Original record (null for newly-added rows). Preserves any fields the editor doesn't
+        // expose across a load→save.
+        private FocasDeviceOptions? _source;
+
+        public FocasDeviceRow Clone() => (FocasDeviceRow)MemberwiseClone(); // _source is an immutable record ref — safe to share
+
+        public static FocasDeviceRow FromDefinition(FocasDeviceOptions d) => new()
+        {
+            HostAddress = d.HostAddress, Series = d.Series, DeviceName = d.DeviceName,
+            _source = d,
+        };
+
+        public FocasDeviceOptions ToDefinition()
+        {
+            var baseDef = _source ?? new FocasDeviceOptions(HostAddress.Trim());
+            return baseDef with
+            {
+                HostAddress = HostAddress.Trim(),
+                Series = Series,
+                DeviceName = string.IsNullOrWhiteSpace(DeviceName) ? null : DeviceName.Trim(),
+            };
+        }
+
+        public static string? ValidateRow(FocasDeviceRow row, IReadOnlyList<FocasDeviceRow> all, int? editIndex)
+        {
+            if (string.IsNullOrWhiteSpace(row.HostAddress)) return "Host address is required.";
+            for (var i = 0; i < all.Count; i++)
+                if (i != editIndex && string.Equals(all[i].HostAddress, row.HostAddress, StringComparison.OrdinalIgnoreCase))
+                    return $"Duplicate device host address '{row.HostAddress}'.";
+            return null;
+        }
+    }
+
+    // Mutable VM for the modal editor — FocasTagDefinition is an immutable record.
+    public sealed class FocasTagRow
+    {
+        public string Name { get; set; } = "";
+        public string DeviceHostAddress { get; set; } = "";
+        public string Address { get; set; } = "";
+        public FocasDataType DataType { get; set; } = FocasDataType.Int32;
+        public bool Writable { get; set; } = true;
+
+        // Original record (null for newly-added rows). Preserves fields the editor doesn't expose
+        // (WriteIdempotent) across a load→save.
+        private FocasTagDefinition? _source;
+
+        public FocasTagRow Clone() => (FocasTagRow)MemberwiseClone(); // _source is an immutable record ref — safe to share
+
+        public static FocasTagRow FromDefinition(FocasTagDefinition d) => new()
+        {
+            Name = d.Name, DeviceHostAddress = d.DeviceHostAddress, Address = d.Address,
+            DataType = d.DataType, Writable = d.Writable,
+            _source = d,
+        };
+
+        public FocasTagDefinition ToDefinition()
+        {
+            var baseDef = _source ?? new FocasTagDefinition(Name.Trim(), DeviceHostAddress.Trim(), Address.Trim(), DataType);
+            return baseDef with
+            {
+                Name = Name.Trim(),
+                DeviceHostAddress = DeviceHostAddress.Trim(),
+                Address = Address.Trim(),
+                DataType = DataType,
+                Writable = Writable,
+            };
+        }
+
+        public static string? ValidateRow(FocasTagRow row, IReadOnlyList<FocasTagRow> all, int? editIndex)
+        {
+            if (string.IsNullOrWhiteSpace(row.Name)) return "Name is required.";
+            for (var i = 0; i < all.Count; i++)
+                if (i != editIndex && string.Equals(all[i].Name, row.Name, StringComparison.OrdinalIgnoreCase))
+                    return $"Duplicate tag name '{row.Name}'.";
+            return null;
+        }
+    }
+
+    // Flat mutable model — all scalar properties settable for Blazor @bind-Value.
+    // Collections (Devices, Tags) are kept on the component and passed in on ToOptions().
    public sealed class FormModel
    {
        // Connection
@@ -404,52 +525,30 @@ else
        public int FixedTreeProgramPollIntervalSeconds { get; set; } = 1;
        public int FixedTreeTimerPollIntervalSeconds { get; set; } = 30;

-        // Collections JSON view (read-only)
-        public string? DevicesJson { get; set; }
-        public string? TagsJson { get; set; }
-
-        // Preserved originals (round-tripped unchanged)
-        private IReadOnlyList<FocasDeviceOptions> _devices = [];
-        private IReadOnlyList<FocasTagDefinition> _tags = [];
-
        // Common
        public string? ResilienceConfig { get; set; }
        public byte[] RowVersion { get; set; } = [];

-        private static readonly System.Text.Json.JsonSerializerOptions _displayOpts = new()
+        public static FormModel FromOptions(FocasDriverOptions o) => new()
        {
-            WriteIndented = true,
-            PropertyNamingPolicy = System.Text.Json.JsonNamingPolicy.CamelCase,
+            TimeoutSeconds = (int)o.Timeout.TotalSeconds,
+            ProbeEnabled = o.Probe.Enabled,
+            ProbeIntervalSeconds = (int)o.Probe.Interval.TotalSeconds,
+            ProbeTimeoutSeconds = (int)o.Probe.Timeout.TotalSeconds,
+            AdminProbeTimeoutSeconds = o.ProbeTimeoutSeconds,
+            AlarmProjectionEnabled = o.AlarmProjection.Enabled,
+            AlarmProjectionPollIntervalSeconds = (int)o.AlarmProjection.PollInterval.TotalSeconds,
+            HandleRecycleEnabled = o.HandleRecycle.Enabled,
+            HandleRecycleIntervalMinutes = (int)o.HandleRecycle.Interval.TotalMinutes,
+            FixedTreeEnabled = o.FixedTree.Enabled,
+            FixedTreePollIntervalMs = (int)o.FixedTree.PollInterval.TotalMilliseconds,
+            FixedTreeProgramPollIntervalSeconds = (int)o.FixedTree.ProgramPollInterval.TotalSeconds,
+            FixedTreeTimerPollIntervalSeconds = (int)o.FixedTree.TimerPollInterval.TotalSeconds,
        };

-        public static FormModel FromOptions(FocasDriverOptions o)
-        {
-            var m = new FormModel
-            {
-                TimeoutSeconds = (int)o.Timeout.TotalSeconds,
-                ProbeEnabled = o.Probe.Enabled,
-                ProbeIntervalSeconds = (int)o.Probe.Interval.TotalSeconds,
-                ProbeTimeoutSeconds = (int)o.Probe.Timeout.TotalSeconds,
-                AdminProbeTimeoutSeconds = o.ProbeTimeoutSeconds,
-                AlarmProjectionEnabled = o.AlarmProjection.Enabled,
-                AlarmProjectionPollIntervalSeconds = (int)o.AlarmProjection.PollInterval.TotalSeconds,
-                HandleRecycleEnabled = o.HandleRecycle.Enabled,
-                HandleRecycleIntervalMinutes = (int)o.HandleRecycle.Interval.TotalMinutes,
-                FixedTreeEnabled = o.FixedTree.Enabled,
-                FixedTreePollIntervalMs = (int)o.FixedTree.PollInterval.TotalMilliseconds,
-                FixedTreeProgramPollIntervalSeconds = (int)o.FixedTree.ProgramPollInterval.TotalSeconds,
-                FixedTreeTimerPollIntervalSeconds = (int)o.FixedTree.TimerPollInterval.TotalSeconds,
-                _devices = o.Devices,
-                _tags = o.Tags,
-            };
-            m.DevicesJson = o.Devices.Count == 0 ? null
-                : System.Text.Json.JsonSerializer.Serialize(o.Devices, _displayOpts);
-            m.TagsJson = o.Tags.Count == 0 ? null
-                : System.Text.Json.JsonSerializer.Serialize(o.Tags, _displayOpts);
-            return m;
-        }
-
-        public FocasDriverOptions ToOptions() => new()
+        public FocasDriverOptions ToOptions(
+            IReadOnlyList<FocasDeviceOptions> devices,
+            IReadOnlyList<FocasTagDefinition> tags) => new()
        {
            Timeout = TimeSpan.FromSeconds(TimeoutSeconds),
            Probe = new FocasProbeOptions
@@ -476,8 +575,8 @@ else
                ProgramPollInterval = TimeSpan.FromSeconds(FixedTreeProgramPollIntervalSeconds),
                TimerPollInterval = TimeSpan.FromSeconds(FixedTreeTimerPollIntervalSeconds),
            },
-            Devices = _devices,
-            Tags = _tags,
+            Devices = devices,
+            Tags = tags,
        };
    }
 }
@@ -58,7 +58,8 @@ else
                             CurrentAddress="@_pickedAddress"
                             OnPickAddress="@OnAddressPicked">
                <GalaxyAddressPickerBody CurrentAddress="@_pickedAddress"
-                                         CurrentAddressChanged="@((s) => _pickedAddress = s)" />
+                                         CurrentAddressChanged="@((s) => _pickedAddress = s)"
+                                         GetConfigJson="@SerializeCurrentConfig" />
            </DriverTagPicker>

            @* mxaccessgw connection *@
@@ -207,13 +208,14 @@ else
    [Parameter] public string ClusterId { get; set; } = "";
    [Parameter] public string? DriverInstanceId { get; set; }

-    private const string DriverTypeKey = "Galaxy";
+    private const string DriverTypeKey = "GalaxyMxGateway";

    private bool IsNew => string.IsNullOrEmpty(DriverInstanceId);

    private static readonly System.Text.Json.JsonSerializerOptions _jsonOpts = new()
    {
        PropertyNamingPolicy = System.Text.Json.JsonNamingPolicy.CamelCase,
+        PropertyNameCaseInsensitive = true,
        UnmappedMemberHandling = System.Text.Json.Serialization.JsonUnmappedMemberHandling.Skip,
        WriteIndented = false,
    };
@@ -407,26 +409,36 @@ else
        // GalaxyDriverOptions top-level
        public int ProbeTimeoutSeconds { get; set; } = 30;

-        public static GalaxyFormModel FromRecord(GalaxyDriverOptions r) => new()
+        public static GalaxyFormModel FromRecord(GalaxyDriverOptions r)
        {
-            GatewayEndpoint = r.Gateway.Endpoint,
-            GatewayApiKeySecretRef = r.Gateway.ApiKeySecretRef,
-            GatewayUseTls = r.Gateway.UseTls,
-            GatewayCaCertificatePath = r.Gateway.CaCertificatePath,
-            GatewayConnectTimeoutSeconds = r.Gateway.ConnectTimeoutSeconds,
-            GatewayDefaultCallTimeoutSeconds = r.Gateway.DefaultCallTimeoutSeconds,
-            GatewayStreamTimeoutSeconds = r.Gateway.StreamTimeoutSeconds,
-            MxClientName = r.MxAccess.ClientName,
-            MxPublishingIntervalMs = r.MxAccess.PublishingIntervalMs,
-            MxWriteUserId = r.MxAccess.WriteUserId,
-            MxEventPumpChannelCapacity = r.MxAccess.EventPumpChannelCapacity,
-            RepositoryDiscoverPageSize = r.Repository.DiscoverPageSize,
-            RepositoryWatchDeployEvents = r.Repository.WatchDeployEvents,
-            ReconnectInitialBackoffMs = r.Reconnect.InitialBackoffMs,
-            ReconnectMaxBackoffMs = r.Reconnect.MaxBackoffMs,
-            ReconnectReplayOnSessionLost = r.Reconnect.ReplayOnSessionLost,
-            ProbeTimeoutSeconds = r.ProbeTimeoutSeconds,
-        };
+            // Null-coalesce each nested record to its default so that persisted configs
+            // that pre-date a section (e.g. no Reconnect key, or PascalCase keys that
+            // don't match the camelCase deserializer) don't cause a NullReferenceException.
+            var gw   = r.Gateway    ?? new GalaxyGatewayOptions("https://localhost:5001", "env:MX_API_KEY");
+            var mx   = r.MxAccess   ?? new GalaxyMxAccessOptions("OtOpcUa");
+            var repo = r.Repository ?? new GalaxyRepositoryOptions();
+            var rc   = r.Reconnect  ?? new GalaxyReconnectOptions();
+            return new()
+            {
+                GatewayEndpoint = gw.Endpoint,
+                GatewayApiKeySecretRef = gw.ApiKeySecretRef,
+                GatewayUseTls = gw.UseTls,
+                GatewayCaCertificatePath = gw.CaCertificatePath,
+                GatewayConnectTimeoutSeconds = gw.ConnectTimeoutSeconds,
+                GatewayDefaultCallTimeoutSeconds = gw.DefaultCallTimeoutSeconds,
+                GatewayStreamTimeoutSeconds = gw.StreamTimeoutSeconds,
+                MxClientName = mx.ClientName,
+                MxPublishingIntervalMs = mx.PublishingIntervalMs,
+                MxWriteUserId = mx.WriteUserId,
+                MxEventPumpChannelCapacity = mx.EventPumpChannelCapacity,
+                RepositoryDiscoverPageSize = repo.DiscoverPageSize,
+                RepositoryWatchDeployEvents = repo.WatchDeployEvents,
+                ReconnectInitialBackoffMs = rc.InitialBackoffMs,
+                ReconnectMaxBackoffMs = rc.MaxBackoffMs,
+                ReconnectReplayOnSessionLost = rc.ReplayOnSessionLost,
+                ProbeTimeoutSeconds = r.ProbeTimeoutSeconds,
+            };
+        }

        public GalaxyDriverOptions ToRecord() => new(
            Gateway: new GalaxyGatewayOptions(
@@ -273,16 +273,44 @@ else
                </div>
            </section>

-            @* Tags — read-only JSON view *@
-            <section class="panel rise mt-3" style="animation-delay:.18s">
-                <div class="panel-head">Tags</div>
-                <div style="padding:1rem">
-                    <p class="form-text mb-2">
-                        Tag list — full list-editor coming in a follow-up phase. Edit tags via the Tag editor pages or by exporting/importing the driver config JSON.
-                    </p>
-                    <pre class="form-control form-control-sm mono" style="min-height:4rem;overflow:auto;white-space:pre-wrap;">@_tagsJson</pre>
-                </div>
-            </section>
+            <CollectionEditor TRow="ModbusTagRow" Items="_tags" Title="Tags" ItemNoun="tag"
+                              NewRow="@(() => new ModbusTagRow())" Clone="@(r => r.Clone())"
+                              Validate="ModbusTagRow.ValidateRow">
+                <HeaderTemplate>
+                    <tr><th>Name</th><th>Region</th><th>Address</th><th>Type</th><th>Writable</th><th></th></tr>
+                </HeaderTemplate>
+                <RowTemplate Context="t">
+                    <td class="mono">@t.Name</td><td>@t.Region</td><td class="mono">@t.Address</td>
+                    <td>@t.DataType</td><td>@(t.Writable ? "yes" : "no")</td>
+                </RowTemplate>
+                <EditTemplate Context="t">
+                    <div class="row g-3">
+                        <div class="col-md-6"><label class="form-label">Name</label>
+                            <input class="form-control form-control-sm" @bind="t.Name" /></div>
+                        <div class="col-md-3"><label class="form-label">Region</label>
+                            <select class="form-select form-select-sm" @bind="t.Region">
+                                @foreach (var e in Enum.GetValues<ModbusRegion>()) { <option value="@e">@e</option> }
+                            </select></div>
+                        <div class="col-md-3"><label class="form-label">Address</label>
+                            <input type="number" class="form-control form-control-sm" @bind="t.Address" /></div>
+                        <div class="col-md-3"><label class="form-label">Data type</label>
+                            <select class="form-select form-select-sm" @bind="t.DataType">
+                                @foreach (var e in Enum.GetValues<ModbusDataType>()) { <option value="@e">@e</option> }
+                            </select></div>
+                        <div class="col-md-3"><label class="form-label">Byte order</label>
+                            <select class="form-select form-select-sm" @bind="t.ByteOrder">
+                                @foreach (var e in Enum.GetValues<ModbusByteOrder>()) { <option value="@e">@e</option> }
+                            </select></div>
+                        <div class="col-md-2"><label class="form-label">Bit index</label>
+                            <input type="number" class="form-control form-control-sm" @bind="t.BitIndex" /></div>
+                        <div class="col-md-2"><label class="form-label">String len</label>
+                            <input type="number" class="form-control form-control-sm" @bind="t.StringLength" /></div>
+                        <div class="col-md-2"><div class="form-check form-switch mt-4">
+                            <input type="checkbox" class="form-check-input" @bind="t.Writable" id="tagWritable" />
+                            <label class="form-check-label" for="tagWritable">Writable</label></div></div>
+                    </div>
+                </EditTemplate>
+            </CollectionEditor>

            <DriverResilienceSection @bind-ResilienceConfig="_form.ResilienceConfig" />
        </DriverFormShell>
@@ -318,9 +346,8 @@ else

    private void OnAddressPicked(string address) => _pickedAddress = address;

-    // Held separately because Tags is a collection — rendered as read-only JSON.
-    private IReadOnlyList<ModbusTagDefinition> _tags = [];
-    private string _tagsJson = "[]";
+    // Held separately because Tags is a collection — edited via the CollectionEditor modal.
+    private List<ModbusTagRow> _tags = [];

    protected override async Task OnInitializedAsync()
    {
@@ -360,10 +387,9 @@ else
                _form = FormModel.FromOptions(opts);
                _form.ResilienceConfig = _existing.ResilienceConfig;
                _form.RowVersion = _existing.RowVersion;
-                _tags = opts.Tags;
+                _tags = opts.Tags.Select(ModbusTagRow.FromDefinition).ToList();
            }
        }
-        _tagsJson = System.Text.Json.JsonSerializer.Serialize(_tags, _jsonOpts);
        _loaded = true;
    }

@@ -372,7 +398,7 @@ else
        _busy = true; _error = null;
        try
        {
-            var configJson = System.Text.Json.JsonSerializer.Serialize(_form.ToOptions(_tags), _jsonOpts);
+            var configJson = System.Text.Json.JsonSerializer.Serialize(_form.ToOptions(_tags.Select(r => r.ToDefinition()).ToList()), _jsonOpts);
            await using var db = await DbFactory.CreateDbContextAsync();
            if (IsNew)
            {
@@ -443,7 +469,7 @@ else
    }

    private string SerializeCurrentConfig()
-        => System.Text.Json.JsonSerializer.Serialize(_form.ToOptions(_tags), _jsonOpts);
+        => System.Text.Json.JsonSerializer.Serialize(_form.ToOptions(_tags.Select(r => r.ToDefinition()).ToList()), _jsonOpts);

    private static ModbusDriverOptions? TryDeserialize(string json)
    {
@@ -451,6 +477,60 @@ else
        catch { return null; }
    }

+    // Mutable VM for the modal editor — ModbusTagDefinition is an immutable record.
+    public sealed class ModbusTagRow
+    {
+        public string Name { get; set; } = "";
+        public ModbusRegion Region { get; set; } = ModbusRegion.HoldingRegisters;
+        public int Address { get; set; }
+        public ModbusDataType DataType { get; set; } = ModbusDataType.Int16;
+        public bool Writable { get; set; } = true;
+        public ModbusByteOrder ByteOrder { get; set; } = ModbusByteOrder.BigEndian;
+        public int BitIndex { get; set; }
+        public int StringLength { get; set; }
+        public bool WriteIdempotent { get; set; }
+
+        // Original record (null for newly-added rows). Preserves fields the editor doesn't expose
+        // (StringByteOrder, ArrayCount, Deadband, UnitId, CoalesceProhibited) across a load→save.
+        private ModbusTagDefinition? _source;
+
+        public ModbusTagRow Clone() => (ModbusTagRow)MemberwiseClone(); // _source is an immutable record ref — safe to share
+
+        public static ModbusTagRow FromDefinition(ModbusTagDefinition d) => new()
+        {
+            Name = d.Name, Region = d.Region, Address = d.Address, DataType = d.DataType,
+            Writable = d.Writable, ByteOrder = d.ByteOrder, BitIndex = d.BitIndex,
+            StringLength = d.StringLength, WriteIdempotent = d.WriteIdempotent,
+            _source = d,
+        };
+
+        public ModbusTagDefinition ToDefinition()
+        {
+            var baseDef = _source ?? new ModbusTagDefinition(Name.Trim(), Region, 0, DataType);
+            return baseDef with
+            {
+                Name = Name.Trim(),
+                Region = Region,
+                Address = (ushort)Math.Clamp(Address, 0, 65535),
+                DataType = DataType,
+                Writable = Writable,
+                ByteOrder = ByteOrder,
+                BitIndex = (byte)Math.Clamp(BitIndex, 0, 255),
+                StringLength = (ushort)Math.Clamp(StringLength, 0, 65535),
+                WriteIdempotent = WriteIdempotent,
+            };
+        }
+
+        public static string? ValidateRow(ModbusTagRow row, IReadOnlyList<ModbusTagRow> all, int? editIndex)
+        {
+            if (string.IsNullOrWhiteSpace(row.Name)) return "Name is required.";
+            for (var i = 0; i < all.Count; i++)
+                if (i != editIndex && string.Equals(all[i].Name, row.Name, StringComparison.OrdinalIgnoreCase))
+                    return $"Duplicate tag name '{row.Name}'.";
+            return null;
+        }
+    }
+
    // Flat mutable model — all scalars exposed as settable properties so Blazor @bind-Value works.
    // Collection (Tags) is kept on the component (_tags) and passed in when building the final Options.
    public sealed class FormModel
@@ -58,7 +58,8 @@ else
                             CurrentAddress="@_pickedAddress"
                             OnPickAddress="@OnAddressPicked">
                <OpcUaClientAddressPickerBody CurrentAddress="@_pickedAddress"
-                                              CurrentAddressChanged="@((s) => _pickedAddress = s)" />
+                                              CurrentAddressChanged="@((s) => _pickedAddress = s)"
+                                              GetConfigJson="@SerializeCurrentConfig" />
            </DriverTagPicker>

            @* Endpoint *@
@@ -130,11 +131,25 @@ else
                            <div class="form-text">Default 10.</div>
                        </div>
                    </div>
-                    @* Endpoint URLs list — read-only JSON view (full list-editor is a follow-up) *@
                    <div class="row g-3 mt-1">
                        <div class="col-12">
-                            <label class="form-label">Endpoint URLs (failover list — read-only; edit via raw JSON import or use Endpoint URL above)</label>
-                            <pre class="form-control form-control-sm mono" style="min-height:3rem;overflow:auto;white-space:pre-wrap;">@_endpointUrlsJson</pre>
+                            <CollectionEditor TRow="EndpointUrlRow" Items="_endpoints"
+                                              Title="Endpoint URLs" ItemNoun="endpoint" AnimationDelay=".07s"
+                                              NewRow="@(() => new EndpointUrlRow())" Clone="@(r => r.Clone())"
+                                              Validate="EndpointUrlRow.ValidateRow">
+                                <HeaderTemplate>
+                                    <tr><th>Endpoint URL (failover list — first reachable wins)</th><th></th></tr>
+                                </HeaderTemplate>
+                                <RowTemplate Context="e">
+                                    <td class="mono">@e.Url</td>
+                                </RowTemplate>
+                                <EditTemplate Context="e">
+                                    <label class="form-label">Endpoint URL</label>
+                                    <input class="form-control form-control-sm mono" @bind="e.Url"
+                                           placeholder="opc.tcp://plc.internal:4840" />
+                                    <div class="form-text">When this list is non-empty, the single Endpoint URL above is ignored.</div>
+                                </EditTemplate>
+                            </CollectionEditor>
                        </div>
                    </div>
                </div>
@@ -280,8 +295,10 @@ else

    private void OnAddressPicked(string address) => _pickedAddress = address;

-    // Read-only JSON snippets for collections that have no list editor yet.
-    private string _endpointUrlsJson = "[]";
+    // Held separately because EndpointUrls is a collection — edited via the CollectionEditor modal.
+    private List<EndpointUrlRow> _endpoints = [];
+
+    // Read-only JSON snippet for the UnsMappingTable, which has no list editor yet.
    private string _unsMappingTableJson = "{}";

    protected override async Task OnInitializedAsync()
@@ -321,7 +338,7 @@ else
                var opts = TryDeserialize(_existing.DriverConfig) ?? new OpcUaClientDriverOptions();
                _form = new FormModel();
                _form.OpcUa = OpcUaClientFormModel.FromRecord(opts);
-                _endpointUrlsJson = System.Text.Json.JsonSerializer.Serialize(opts.EndpointUrls, _jsonOpts);
+                _endpoints = opts.EndpointUrls.Select(EndpointUrlRow.FromUrl).ToList();
                _unsMappingTableJson = System.Text.Json.JsonSerializer.Serialize(opts.UnsMappingTable, _jsonOpts);
                _form.ResilienceConfig = _existing.ResilienceConfig;
                _form.RowVersion = _existing.RowVersion;
@@ -335,7 +352,7 @@ else
        _busy = true; _error = null;
        try
        {
-            var opts = _form.OpcUa.ToRecord();
+            var opts = _form.OpcUa.ToRecord(_endpoints.Select(r => r.ToUrl()).ToList());
            var configJson = System.Text.Json.JsonSerializer.Serialize(opts, _jsonOpts);
            await using var db = await DbFactory.CreateDbContextAsync();
            if (IsNew)
@@ -406,7 +423,8 @@ else
    }

    private string SerializeCurrentConfig()
-        => System.Text.Json.JsonSerializer.Serialize(_form.OpcUa.ToRecord(), _jsonOpts);
+        => System.Text.Json.JsonSerializer.Serialize(
+            _form.OpcUa.ToRecord(_endpoints.Select(r => r.ToUrl()).ToList()), _jsonOpts);

    private static OpcUaClientDriverOptions? TryDeserialize(string json)
    {
@@ -421,11 +439,36 @@ else
        public byte[] RowVersion { get; set; } = [];
    }

+    /// <summary>
+    ///     Mutable VM for a single endpoint URL row. EndpointUrls is a plain
+    ///     <c>List&lt;string&gt;</c> (a failover list) so the row is a thin wrapper the
+    ///     <see cref="CollectionEditor{TRow}"/> modal can bind to.
+    /// </summary>
+    public sealed class EndpointUrlRow
+    {
+        public string Url { get; set; } = "";
+        public EndpointUrlRow Clone() => (EndpointUrlRow)MemberwiseClone();
+        public static EndpointUrlRow FromUrl(string u) => new() { Url = u };
+        public string ToUrl() => Url.Trim();
+
+        public static string? ValidateRow(EndpointUrlRow row, IReadOnlyList<EndpointUrlRow> all, int? editIndex)
+        {
+            if (string.IsNullOrWhiteSpace(row.Url)) return "URL is required.";
+            if (!row.Url.Trim().StartsWith("opc.tcp://", StringComparison.OrdinalIgnoreCase))
+                return "Endpoint URL must start with opc.tcp://";
+            for (var i = 0; i < all.Count; i++)
+                if (i != editIndex && string.Equals(all[i].Url.Trim(), row.Url.Trim(), StringComparison.OrdinalIgnoreCase))
+                    return $"Duplicate endpoint '{row.Url}'.";
+            return null;
+        }
+    }
+
    /// <summary>
    ///     Mutable mirror of <see cref="OpcUaClientDriverOptions"/> with int wrappers for
    ///     TimeSpan fields so Blazor InputNumber can bind them.
-    ///     EndpointUrls and UnsMappingTable are shown as read-only JSON; they survive round-trip
-    ///     via the original deserialized record and are re-serialized unchanged.
+    ///     EndpointUrls is edited via the CollectionEditor (held on the page as a row list and
+    ///     threaded into <see cref="ToRecord"/>); UnsMappingTable is shown as read-only JSON and
+    ///     survives round-trip via the original deserialized record, re-serialized unchanged.
    /// </summary>
    public sealed class OpcUaClientFormModel
    {
@@ -460,8 +503,7 @@ else
        // Diagnostics
        public int ProbeTimeoutSeconds { get; set; } = 15;

-        // Preserved read-only collections (round-tripped unchanged from original record)
-        internal IReadOnlyList<string> _endpointUrls = [];
+        // Preserved read-only collection (round-tripped unchanged from original record)
        internal IReadOnlyDictionary<string, string> _unsMappingTable = new System.Collections.Generic.Dictionary<string, string>();

        public static OpcUaClientFormModel FromRecord(OpcUaClientDriverOptions r) => new()
@@ -487,14 +529,13 @@ else
            UserCertificatePassword = r.UserCertificatePassword,
            TargetNamespaceKind = r.TargetNamespaceKind,
            ProbeTimeoutSeconds = r.ProbeTimeoutSeconds,
-            _endpointUrls = r.EndpointUrls,
            _unsMappingTable = r.UnsMappingTable,
        };

-        public OpcUaClientDriverOptions ToRecord() => new()
+        public OpcUaClientDriverOptions ToRecord(IReadOnlyList<string> endpointUrls) => new()
        {
            EndpointUrl = EndpointUrl,
-            EndpointUrls = _endpointUrls,
+            EndpointUrls = endpointUrls,
            BrowseRoot = string.IsNullOrWhiteSpace(BrowseRoot) ? null : BrowseRoot,
            ApplicationUri = ApplicationUri,
            SessionName = SessionName,
@@ -145,23 +145,38 @@ else
                </div>
            </section>

-            @* Tags — read-only JSON view *@
-            <section class="panel rise mt-3" style="animation-delay:.11s">
-                <div class="panel-head">Tags</div>
-                <div style="padding:1rem">
-                    <div class="form-text mb-2">
-                        Tag list editor coming in a follow-up phase. To add/remove tags, edit the JSON directly in the raw driver config via the generic editor, or deploy via the import tooling.
+            @* Tags *@
+            <CollectionEditor TRow="S7TagRow" Items="_tags" Title="Tags" ItemNoun="tag"
+                              AnimationDelay=".11s"
+                              NewRow="@(() => new S7TagRow())" Clone="@(r => r.Clone())"
+                              Validate="S7TagRow.ValidateRow">
+                <HeaderTemplate>
+                    <tr><th>Name</th><th>Address</th><th>Type</th><th>Writable</th><th></th></tr>
+                </HeaderTemplate>
+                <RowTemplate Context="t">
+                    <td class="mono">@t.Name</td><td class="mono">@t.Address</td>
+                    <td>@t.DataType</td><td>@(t.Writable ? "yes" : "no")</td>
+                </RowTemplate>
+                <EditTemplate Context="t">
+                    <div class="row g-3">
+                        <div class="col-md-6"><label class="form-label">Name</label>
+                            <input class="form-control form-control-sm" @bind="t.Name" /></div>
+                        <div class="col-md-6"><label class="form-label">Address</label>
+                            <input class="form-control form-control-sm mono" @bind="t.Address"
+                                   placeholder="e.g. DB1.DBW0, M0.0, I0.0, QD4" /></div>
+                        <div class="col-md-3"><label class="form-label">Data type</label>
+                            <select class="form-select form-select-sm" @bind="t.DataType">
+                                @foreach (var e in Enum.GetValues<S7DataType>()) { <option value="@e">@e</option> }
+                            </select></div>
+                        <div class="col-md-3"><label class="form-label">String length</label>
+                            <input type="number" class="form-control form-control-sm" @bind="t.StringLength" />
+                            <div class="form-text">Only for String type. Max 254.</div></div>
+                        <div class="col-md-3"><div class="form-check form-switch mt-4">
+                            <input type="checkbox" class="form-check-input" @bind="t.Writable" id="tagWritable" />
+                            <label class="form-check-label" for="tagWritable">Writable</label></div></div>
                    </div>
-                    @if (_form.TagsJson is not null)
-                    {
-                        <pre class="form-control form-control-sm mono" style="min-height:4rem;max-height:12rem;overflow:auto;white-space:pre-wrap">@_form.TagsJson</pre>
-                    }
-                    else
-                    {
-                        <p class="text-muted"><em>No tags configured.</em></p>
-                    }
-                </div>
-            </section>
+                </EditTemplate>
+            </CollectionEditor>

            <DriverResilienceSection @bind-ResilienceConfig="_form.ResilienceConfig" />
        </DriverFormShell>
@@ -196,6 +211,9 @@ else

    private void OnAddressPicked(string address) => _pickedAddress = address;

+    // Held separately because Tags is a collection — edited via the CollectionEditor modal.
+    private List<S7TagRow> _tags = [];
+
    protected override async Task OnInitializedAsync()
    {
        await using var db = await DbFactory.CreateDbContextAsync();
@@ -226,6 +244,7 @@ else
                _form = FormModel.FromOptions(opts);
                _form.ResilienceConfig = _existing.ResilienceConfig;
                _form.RowVersion = _existing.RowVersion;
+                _tags = opts.Tags.Select(S7TagRow.FromDefinition).ToList();
            }
        }
        _loaded = true;
@@ -236,7 +255,7 @@ else
        _busy = true; _error = null;
        try
        {
-            var opts = _form.ToOptions();
+            var opts = _form.ToOptions(_tags.Select(r => r.ToDefinition()).ToList());
            var configJson = System.Text.Json.JsonSerializer.Serialize(opts, _jsonOpts);
            await using var db = await DbFactory.CreateDbContextAsync();
            if (IsNew)
@@ -307,7 +326,8 @@ else
    }

    private string SerializeCurrentConfig()
-        => System.Text.Json.JsonSerializer.Serialize(_form.ToOptions(), _jsonOpts);
+        => System.Text.Json.JsonSerializer.Serialize(
+            _form.ToOptions(_tags.Select(r => r.ToDefinition()).ToList()), _jsonOpts);

    private static S7DriverOptions? TryDeserialize(string json)
    {
@@ -315,6 +335,53 @@ else
        catch { return null; }
    }

+    // Mutable VM for the modal editor — S7TagDefinition is an immutable record.
+    public sealed class S7TagRow
+    {
+        public string Name { get; set; } = "";
+        public string Address { get; set; } = "";
+        public S7DataType DataType { get; set; } = S7DataType.Int16;
+        public bool Writable { get; set; } = true;
+        public int StringLength { get; set; } = 254;
+
+        // Original record (null for newly-added rows). Preserves fields the editor doesn't expose
+        // (WriteIdempotent) across a load→save.
+        private S7TagDefinition? _source;
+
+        public S7TagRow Clone() => (S7TagRow)MemberwiseClone(); // _source is an immutable record ref — safe to share
+
+        public static S7TagRow FromDefinition(S7TagDefinition d) => new()
+        {
+            Name = d.Name, Address = d.Address, DataType = d.DataType,
+            Writable = d.Writable, StringLength = d.StringLength,
+            _source = d,
+        };
+
+        public S7TagDefinition ToDefinition()
+        {
+            var baseDef = _source ?? new S7TagDefinition(Name.Trim(), Address.Trim(), DataType);
+            return baseDef with
+            {
+                Name = Name.Trim(),
+                Address = Address.Trim(),
+                DataType = DataType,
+                Writable = Writable,
+                StringLength = StringLength,
+            };
+        }
+
+        public static string? ValidateRow(S7TagRow row, IReadOnlyList<S7TagRow> all, int? editIndex)
+        {
+            if (string.IsNullOrWhiteSpace(row.Name)) return "Name is required.";
+            for (var i = 0; i < all.Count; i++)
+                if (i != editIndex && string.Equals(all[i].Name, row.Name, StringComparison.OrdinalIgnoreCase))
+                    return $"Duplicate tag name '{row.Name}'.";
+            return null;
+        }
+    }
+
+    // Flat mutable model — all scalar properties settable for Blazor @bind-Value.
+    // Collection (Tags) is kept on the component (_tags) and passed in on ToOptions().
    public sealed class FormModel
    {
        // Connection
@@ -331,43 +398,25 @@ else
        public int ProbeTimeoutSeconds { get; set; } = 2;
        public int AdminProbeTimeoutSeconds { get; set; } = 5;

-        // Tags JSON view (read-only)
-        public string? TagsJson { get; set; }
-
-        // Preserved originals (round-tripped unchanged from original options)
-        private IReadOnlyList<S7TagDefinition> _tags = [];
-
        // Common
        public string? ResilienceConfig { get; set; }
        public byte[] RowVersion { get; set; } = [];

-        public static FormModel FromOptions(S7DriverOptions o)
+        public static FormModel FromOptions(S7DriverOptions o) => new()
        {
-            string? tagsJson = o.Tags.Count == 0 ? null
-                : System.Text.Json.JsonSerializer.Serialize(o.Tags,
-                    new System.Text.Json.JsonSerializerOptions
-                    {
-                        PropertyNamingPolicy = System.Text.Json.JsonNamingPolicy.CamelCase,
-                        WriteIndented = true,
-                    });
-            return new FormModel
-            {
-                Host = o.Host,
-                Port = o.Port,
-                CpuType = o.CpuType,
-                Rack = o.Rack,
-                Slot = o.Slot,
-                TimeoutSeconds = (int)o.Timeout.TotalSeconds,
-                ProbeEnabled = o.Probe.Enabled,
-                ProbeIntervalSeconds = (int)o.Probe.Interval.TotalSeconds,
-                ProbeTimeoutSeconds = (int)o.Probe.Timeout.TotalSeconds,
-                AdminProbeTimeoutSeconds = o.ProbeTimeoutSeconds,
-                TagsJson = tagsJson,
-                _tags = o.Tags,
-            };
-        }
+            Host = o.Host,
+            Port = o.Port,
+            CpuType = o.CpuType,
+            Rack = o.Rack,
+            Slot = o.Slot,
+            TimeoutSeconds = (int)o.Timeout.TotalSeconds,
+            ProbeEnabled = o.Probe.Enabled,
+            ProbeIntervalSeconds = (int)o.Probe.Interval.TotalSeconds,
+            ProbeTimeoutSeconds = (int)o.Probe.Timeout.TotalSeconds,
+            AdminProbeTimeoutSeconds = o.ProbeTimeoutSeconds,
+        };

-        public S7DriverOptions ToOptions() => new()
+        public S7DriverOptions ToOptions(IReadOnlyList<S7TagDefinition> tags) => new()
        {
            Host = Host,
            Port = Port,
@@ -382,7 +431,7 @@ else
                Timeout = TimeSpan.FromSeconds(ProbeTimeoutSeconds),
            },
            ProbeTimeoutSeconds = AdminProbeTimeoutSeconds,
-            Tags = _tags,
+            Tags = tags,
        };
    }
 }
@@ -132,42 +132,61 @@ else
                </div>
            </section>

-            @* Devices — read-only JSON view *@
-            <section class="panel rise mt-3" style="animation-delay:.11s">
-                <div class="panel-head">Devices</div>
-                <div style="padding:1rem">
-                    <div class="form-text mb-2">
-                        Each device is identified by AMS Net Id + port. Device list editor coming in a follow-up phase.
-                        Format: <code>[{"hostAddress":"192.168.0.1.1.1:851","deviceName":"PLC1"}]</code>
+            @* Devices *@
+            <CollectionEditor TRow="TwinCATDeviceRow" Items="_devices" Title="Devices" ItemNoun="device"
+                              AnimationDelay=".11s"
+                              NewRow="@(() => new TwinCATDeviceRow())" Clone="@(r => r.Clone())"
+                              Validate="TwinCATDeviceRow.ValidateRow">
+                <HeaderTemplate>
+                    <tr><th>Host address</th><th>Device name</th><th></th></tr>
+                </HeaderTemplate>
+                <RowTemplate Context="d">
+                    <td class="mono">@d.HostAddress</td>
+                    <td>@(string.IsNullOrWhiteSpace(d.DeviceName) ? "—" : d.DeviceName)</td>
+                </RowTemplate>
+                <EditTemplate Context="d">
+                    <div class="row g-3">
+                        <div class="col-md-6"><label class="form-label">Host address (AMS Net Id:port)</label>
+                            <input class="form-control form-control-sm mono" @bind="d.HostAddress"
+                                   placeholder="192.168.0.1.1.1:851" /></div>
+                        <div class="col-md-6"><label class="form-label">Device name</label>
+                            <input class="form-control form-control-sm" @bind="d.DeviceName" /></div>
                    </div>
-                    @if (_form.DevicesJson is not null)
-                    {
-                        <pre class="form-control form-control-sm mono" style="min-height:4rem;max-height:12rem;overflow:auto;white-space:pre-wrap">@_form.DevicesJson</pre>
-                    }
-                    else
-                    {
-                        <p class="text-muted"><em>No devices configured.</em></p>
-                    }
-                </div>
-            </section>
+                </EditTemplate>
+            </CollectionEditor>

-            @* Tags — read-only JSON view *@
-            <section class="panel rise mt-3" style="animation-delay:.14s">
-                <div class="panel-head">Tags</div>
-                <div style="padding:1rem">
-                    <div class="form-text mb-2">
-                        Tag list editor coming in a follow-up phase. Tags reference device host addresses and TwinCAT symbol paths.
+            @* Tags *@
+            <CollectionEditor TRow="TwinCATTagRow" Items="_tags" Title="Tags" ItemNoun="tag"
+                              AnimationDelay=".14s"
+                              NewRow="@(() => new TwinCATTagRow())" Clone="@(r => r.Clone())"
+                              Validate="TwinCATTagRow.ValidateRow">
+                <HeaderTemplate>
+                    <tr><th>Name</th><th>Device</th><th>Symbol path</th><th>Type</th><th>Writable</th><th></th></tr>
+                </HeaderTemplate>
+                <RowTemplate Context="t">
+                    <td class="mono">@t.Name</td><td class="mono">@t.DeviceHostAddress</td>
+                    <td class="mono">@t.SymbolPath</td><td>@t.DataType</td><td>@(t.Writable ? "yes" : "no")</td>
+                </RowTemplate>
+                <EditTemplate Context="t">
+                    <div class="row g-3">
+                        <div class="col-md-6"><label class="form-label">Name</label>
+                            <input class="form-control form-control-sm" @bind="t.Name" /></div>
+                        <div class="col-md-6"><label class="form-label">Device host address</label>
+                            <input class="form-control form-control-sm mono" @bind="t.DeviceHostAddress"
+                                   placeholder="192.168.0.1.1.1:851" /></div>
+                        <div class="col-md-6"><label class="form-label">Symbol path</label>
+                            <input class="form-control form-control-sm mono" @bind="t.SymbolPath"
+                                   placeholder="e.g. MAIN.bStart, GVL.Counter" /></div>
+                        <div class="col-md-3"><label class="form-label">Data type</label>
+                            <select class="form-select form-select-sm" @bind="t.DataType">
+                                @foreach (var e in Enum.GetValues<TwinCATDataType>()) { <option value="@e">@e</option> }
+                            </select></div>
+                        <div class="col-md-3"><div class="form-check form-switch mt-4">
+                            <input type="checkbox" class="form-check-input" @bind="t.Writable" id="tagWritable" />
+                            <label class="form-check-label" for="tagWritable">Writable</label></div></div>
                    </div>
-                    @if (_form.TagsJson is not null)
-                    {
-                        <pre class="form-control form-control-sm mono" style="min-height:4rem;max-height:12rem;overflow:auto;white-space:pre-wrap">@_form.TagsJson</pre>
-                    }
-                    else
-                    {
-                        <p class="text-muted"><em>No tags configured.</em></p>
-                    }
-                </div>
-            </section>
+                </EditTemplate>
+            </CollectionEditor>

            <DriverResilienceSection @bind-ResilienceConfig="_form.ResilienceConfig" />
        </DriverFormShell>
@@ -202,6 +221,10 @@ else

    private void OnAddressPicked(string address) => _pickedAddress = address;

+    // Held separately because Devices/Tags are collections — edited via the CollectionEditor modal.
+    private List<TwinCATDeviceRow> _devices = [];
+    private List<TwinCATTagRow> _tags = [];
+
    protected override async Task OnInitializedAsync()
    {
        await using var db = await DbFactory.CreateDbContextAsync();
@@ -232,6 +255,8 @@ else
                _form = FormModel.FromOptions(opts);
                _form.ResilienceConfig = _existing.ResilienceConfig;
                _form.RowVersion = _existing.RowVersion;
+                _devices = opts.Devices.Select(TwinCATDeviceRow.FromDefinition).ToList();
+                _tags = opts.Tags.Select(TwinCATTagRow.FromDefinition).ToList();
            }
        }
        _loaded = true;
@@ -242,8 +267,11 @@ else
        _busy = true; _error = null;
        try
        {
-            var opts = _form.ToOptions();
-            var configJson = System.Text.Json.JsonSerializer.Serialize(opts, _jsonOpts);
+            var configJson = System.Text.Json.JsonSerializer.Serialize(
+                _form.ToOptions(
+                    _devices.Select(r => r.ToDefinition()).ToList(),
+                    _tags.Select(r => r.ToDefinition()).ToList()),
+                _jsonOpts);
            await using var db = await DbFactory.CreateDbContextAsync();
            if (IsNew)
            {
@@ -313,7 +341,11 @@ else
    }

    private string SerializeCurrentConfig()
-        => System.Text.Json.JsonSerializer.Serialize(_form.ToOptions(), _jsonOpts);
+        => System.Text.Json.JsonSerializer.Serialize(
+            _form.ToOptions(
+                _devices.Select(r => r.ToDefinition()).ToList(),
+                _tags.Select(r => r.ToDefinition()).ToList()),
+            _jsonOpts);

    private static TwinCATDriverOptions? TryDeserialize(string json)
    {
@@ -321,6 +353,91 @@ else
        catch { return null; }
    }

+    // Mutable VM for the modal editor — TwinCATDeviceOptions is an immutable record.
+    public sealed class TwinCATDeviceRow
+    {
+        public string HostAddress { get; set; } = "";
+        public string? DeviceName { get; set; }
+
+        // Original record (null for newly-added rows). Preserves any fields the editor doesn't
+        // expose across a load→save.
+        private TwinCATDeviceOptions? _source;
+
+        public TwinCATDeviceRow Clone() => (TwinCATDeviceRow)MemberwiseClone(); // _source is an immutable record ref — safe to share
+
+        public static TwinCATDeviceRow FromDefinition(TwinCATDeviceOptions d) => new()
+        {
+            HostAddress = d.HostAddress, DeviceName = d.DeviceName,
+            _source = d,
+        };
+
+        public TwinCATDeviceOptions ToDefinition()
+        {
+            var baseDef = _source ?? new TwinCATDeviceOptions(HostAddress.Trim());
+            return baseDef with
+            {
+                HostAddress = HostAddress.Trim(),
+                DeviceName = string.IsNullOrWhiteSpace(DeviceName) ? null : DeviceName.Trim(),
+            };
+        }
+
+        public static string? ValidateRow(TwinCATDeviceRow row, IReadOnlyList<TwinCATDeviceRow> all, int? editIndex)
+        {
+            if (string.IsNullOrWhiteSpace(row.HostAddress)) return "Host address is required.";
+            for (var i = 0; i < all.Count; i++)
+                if (i != editIndex && string.Equals(all[i].HostAddress, row.HostAddress, StringComparison.OrdinalIgnoreCase))
+                    return $"Duplicate device host address '{row.HostAddress}'.";
+            return null;
+        }
+    }
+
+    // Mutable VM for the modal editor — TwinCATTagDefinition is an immutable record.
+    public sealed class TwinCATTagRow
+    {
+        public string Name { get; set; } = "";
+        public string DeviceHostAddress { get; set; } = "";
+        public string SymbolPath { get; set; } = "";
+        public TwinCATDataType DataType { get; set; } = TwinCATDataType.DInt;
+        public bool Writable { get; set; } = true;
+
+        // Original record (null for newly-added rows). Preserves fields the editor doesn't expose
+        // (WriteIdempotent) across a load→save.
+        private TwinCATTagDefinition? _source;
+
+        public TwinCATTagRow Clone() => (TwinCATTagRow)MemberwiseClone(); // _source is an immutable record ref — safe to share
+
+        public static TwinCATTagRow FromDefinition(TwinCATTagDefinition d) => new()
+        {
+            Name = d.Name, DeviceHostAddress = d.DeviceHostAddress, SymbolPath = d.SymbolPath,
+            DataType = d.DataType, Writable = d.Writable,
+            _source = d,
+        };
+
+        public TwinCATTagDefinition ToDefinition()
+        {
+            var baseDef = _source ?? new TwinCATTagDefinition(Name.Trim(), DeviceHostAddress.Trim(), SymbolPath.Trim(), DataType);
+            return baseDef with
+            {
+                Name = Name.Trim(),
+                DeviceHostAddress = DeviceHostAddress.Trim(),
+                SymbolPath = SymbolPath.Trim(),
+                DataType = DataType,
+                Writable = Writable,
+            };
+        }
+
+        public static string? ValidateRow(TwinCATTagRow row, IReadOnlyList<TwinCATTagRow> all, int? editIndex)
+        {
+            if (string.IsNullOrWhiteSpace(row.Name)) return "Name is required.";
+            for (var i = 0; i < all.Count; i++)
+                if (i != editIndex && string.Equals(all[i].Name, row.Name, StringComparison.OrdinalIgnoreCase))
+                    return $"Duplicate tag name '{row.Name}'.";
+            return null;
+        }
+    }
+
+    // Flat mutable model — all scalar properties settable for Blazor @bind-Value.
+    // Collections (Devices, Tags) are kept on the component and passed in on ToOptions().
    public sealed class FormModel
    {
        // Options
@@ -335,47 +452,25 @@ else
        public int ProbeTimeoutSeconds { get; set; } = 2;
        public int AdminProbeTimeoutSeconds { get; set; } = 10;

-        // Collections JSON view (read-only)
-        public string? DevicesJson { get; set; }
-        public string? TagsJson { get; set; }
-
-        // Preserved originals (round-tripped unchanged)
-        private IReadOnlyList<TwinCATDeviceOptions> _devices = [];
-        private IReadOnlyList<TwinCATTagDefinition> _tags = [];
-
        // Common
        public string? ResilienceConfig { get; set; }
        public byte[] RowVersion { get; set; } = [];

-        private static readonly System.Text.Json.JsonSerializerOptions _displayOpts = new()
+        public static FormModel FromOptions(TwinCATDriverOptions o) => new()
        {
-            WriteIndented = true,
-            PropertyNamingPolicy = System.Text.Json.JsonNamingPolicy.CamelCase,
+            TimeoutSeconds = (int)o.Timeout.TotalSeconds,
+            UseNativeNotifications = o.UseNativeNotifications,
+            EnableControllerBrowse = o.EnableControllerBrowse,
+            NotificationMaxDelayMs = o.NotificationMaxDelayMs,
+            ProbeEnabled = o.Probe.Enabled,
+            ProbeIntervalSeconds = (int)o.Probe.Interval.TotalSeconds,
+            ProbeTimeoutSeconds = (int)o.Probe.Timeout.TotalSeconds,
+            AdminProbeTimeoutSeconds = o.ProbeTimeoutSeconds,
        };

-        public static FormModel FromOptions(TwinCATDriverOptions o)
-        {
-            var m = new FormModel
-            {
-                TimeoutSeconds = (int)o.Timeout.TotalSeconds,
-                UseNativeNotifications = o.UseNativeNotifications,
-                EnableControllerBrowse = o.EnableControllerBrowse,
-                NotificationMaxDelayMs = o.NotificationMaxDelayMs,
-                ProbeEnabled = o.Probe.Enabled,
-                ProbeIntervalSeconds = (int)o.Probe.Interval.TotalSeconds,
-                ProbeTimeoutSeconds = (int)o.Probe.Timeout.TotalSeconds,
-                AdminProbeTimeoutSeconds = o.ProbeTimeoutSeconds,
-                _devices = o.Devices,
-                _tags = o.Tags,
-            };
-            m.DevicesJson = o.Devices.Count == 0 ? null
-                : System.Text.Json.JsonSerializer.Serialize(o.Devices, _displayOpts);
-            m.TagsJson = o.Tags.Count == 0 ? null
-                : System.Text.Json.JsonSerializer.Serialize(o.Tags, _displayOpts);
-            return m;
-        }
-
-        public TwinCATDriverOptions ToOptions() => new()
+        public TwinCATDriverOptions ToOptions(
+            IReadOnlyList<TwinCATDeviceOptions> devices,
+            IReadOnlyList<TwinCATTagDefinition> tags) => new()
        {
            Timeout = TimeSpan.FromSeconds(TimeoutSeconds),
            UseNativeNotifications = UseNativeNotifications,
@@ -388,8 +483,8 @@ else
                Timeout = TimeSpan.FromSeconds(ProbeTimeoutSeconds),
            },
            ProbeTimeoutSeconds = AdminProbeTimeoutSeconds,
-            Devices = _devices,
-            Tags = _tags,
+            Devices = devices,
+            Tags = tags,
        };
    }
 }
@@ -3,5 +3,4 @@
 <PageTitle>OtOpcUa</PageTitle>

 <h1>OtOpcUa Admin</h1>
-<p>v2 fused host. Use the nav above to manage deployments.</p>
-<p class="text-muted">Most v1 admin pages were removed by the live-edit migration — see follow-up F15 for the per-page restoration plan.</p>
+<p>Use the nav above to configure clusters, drivers, and tags, then deploy.</p>
@@ -1,33 +1,21 @@
@page "/role-grants"
-@* Per Q4 of the AdminUI rebuild plan, v2 replaced v1's per-cluster RoleGrants table with a
-   fleet-wide LDAP-group → role map. This page surfaces the mapping read-only; the source of
-   truth is Authentication:Ldap:GroupToRole in appsettings (editable on the host filesystem, not
-   from the UI yet). *@
-@attribute [Microsoft.AspNetCore.Authorization.Authorize]
+@attribute [Microsoft.AspNetCore.Authorization.Authorize(Policy = "FleetAdmin")]
@rendermode RenderMode.InteractiveServer
@using Microsoft.Extensions.Options
+@using ZB.MOM.WW.OtOpcUa.Configuration.Entities
+@using ZB.MOM.WW.OtOpcUa.Configuration.Enums
+@using ZB.MOM.WW.OtOpcUa.Configuration.Services
@using ZB.MOM.WW.OtOpcUa.Security.Ldap
@inject IOptionsSnapshot<LdapOptions> Ldap
+@inject ILdapGroupRoleMappingService RoleMappings

 <div class="d-flex justify-content-between align-items-center mb-3">
    <h4 class="mb-0">Role grants</h4>
 </div>

-<section class="panel notice rise" style="animation-delay:.02s">
-    LDAP group membership determines fleet roles. Edit the mapping in
-    <span class="mono">appsettings.json</span> under <span class="mono">Authentication:Ldap:GroupToRole</span>
-    and restart the admin node (or sign out + back in for cached claims to refresh). UI-driven
-    editing of the mapping is deferred — it implies a config-reload mechanism that doesn't exist
-    yet.
-</section>
-
-@if (_options is null)
+@if (_options is not null)
 {
-    <p>Loading…</p>
-}
-else
-{
-    <section class="card-grid rise mt-3" style="animation-delay:.08s">
+    <section class="card-grid rise" style="animation-delay:.02s">
        <div class="metric-card">
            <div class="panel-head">LDAP binding</div>
            <div class="kv"><span class="k">Enabled</span><span class="v">@(_options.Enabled ? "yes" : "no")</span></div>
@@ -40,16 +28,61 @@ else
            }
        </div>
    </section>
+}

+<section class="panel rise mt-3" style="animation-delay:.08s">
+    <div class="panel-head">Group → role (database)</div>
+    <div style="padding:1rem">
+        <div class="d-flex gap-2 align-items-center flex-wrap">
+            <input class="form-control form-control-sm mono" style="max-width:32rem"
+                   @bind="_newGroup" placeholder="cn=fleet-admin,ou=groups,..." />
+            <select class="form-select form-select-sm" style="max-width:14rem" @bind="_newRole">
+                @foreach (var role in Enum.GetValues<AdminRole>())
+                {
+                    <option value="@role">@role</option>
+                }
+            </select>
+            <button class="btn btn-sm btn-primary" @onclick="AddAsync" disabled="@_busy">Add</button>
+        </div>
+        @if (_error is not null)
+        {
+            <div class="text-danger small mt-2">@_error</div>
+        }
+    </div>
+    <div class="table-wrap">
+        <table class="data-table">
+            <thead><tr><th>LDAP group</th><th>Role</th><th></th></tr></thead>
+            <tbody>
+                @if (_rows.Count == 0)
+                {
+                    <tr><td colspan="3" class="text-muted">No database role grants. Authentication falls back to the appsettings map below.</td></tr>
+                }
+                else
+                {
+                    @foreach (var r in _rows)
+                    {
+                        <tr>
+                            <td><span class="mono">@r.LdapGroup</span></td>
+                            <td><span class="chip chip-idle">@r.Role</span></td>
+                            <td><button class="btn btn-sm btn-link text-danger" @onclick="() => DeleteAsync(r.Id)" disabled="@_busy">Delete</button></td>
+                        </tr>
+                    }
+                }
+            </tbody>
+        </table>
+    </div>
+</section>
+
+@if (_options is not null)
+{
    <section class="panel rise mt-3" style="animation-delay:.14s">
-        <div class="panel-head">Group → role mapping (@(_options.GroupToRole?.Count ?? 0))</div>
+        <div class="panel-head">Fallback (appsettings) (@(_options.GroupToRole?.Count ?? 0))</div>
+        <div style="padding:1rem 1rem 0" class="text-muted small">
+            These <span class="mono">Authentication:Ldap:GroupToRole</span> entries apply when a group has no database row above.
+        </div>
        @if (_options.GroupToRole is null || _options.GroupToRole.Count == 0)
        {
-            <div style="padding:1rem" class="text-muted">
-                No mapping configured. Every authenticated user lands with zero roles —
-                the fallback authorization policy will refuse every request. Add a
-                <span class="mono">GroupToRole</span> entry before deploying.
-            </div>
+            <div style="padding:1rem" class="text-muted">No appsettings fallback mapping configured.</div>
        }
        else
        {
@@ -73,9 +106,47 @@ else

@code {
    private LdapOptions? _options;
+    private IReadOnlyList<LdapGroupRoleMapping> _rows = [];
+    private string _newGroup = "";
+    private AdminRole _newRole = AdminRole.ConfigViewer;
+    private string? _error;
+    private bool _busy;

-    protected override void OnInitialized()
+    protected override async Task OnInitializedAsync()
    {
        _options = Ldap.Value;
+        await ReloadAsync();
+    }
+
+    private async Task ReloadAsync()
+        => _rows = (await RoleMappings.ListAllAsync(default)).Where(r => r.IsSystemWide).ToList();
+
+    private async Task AddAsync()
+    {
+        _error = null;
+        if (string.IsNullOrWhiteSpace(_newGroup)) { _error = "LDAP group is required."; return; }
+        _busy = true;
+        StateHasChanged();
+        try
+        {
+            await RoleMappings.CreateAsync(new LdapGroupRoleMapping
+            {
+                LdapGroup = _newGroup.Trim(), Role = _newRole, IsSystemWide = true, ClusterId = null,
+            }, default);
+            _newGroup = "";
+            _newRole = AdminRole.ConfigViewer;
+            await ReloadAsync();
+        }
+        catch (Exception ex) { _error = ex.Message; }
+        finally { _busy = false; }
+    }
+
+    private async Task DeleteAsync(Guid id)
+    {
+        _error = null; _busy = true;
+        StateHasChanged();
+        try { await RoleMappings.DeleteAsync(id, default); await ReloadAsync(); }
+        catch (Exception ex) { _error = ex.Message; }
+        finally { _busy = false; }
    }
 }
@@ -3,11 +3,10 @@
   VirtualTagActor / ScriptedAlarmActor script execution. Engine emit lands with F8 + F9. *@
@attribute [Microsoft.AspNetCore.Authorization.Authorize]
@rendermode RenderMode.InteractiveServer
-@using Microsoft.AspNetCore.SignalR.Client
@using ZB.MOM.WW.OtOpcUa.AdminUI.Hubs
@using ZB.MOM.WW.OtOpcUa.Commons.Messages.Logging
-@inject NavigationManager Nav
-@implements IAsyncDisposable
+@inject IInProcessBroadcaster<ScriptLogEntry> ScriptLogs
+@implements IDisposable

 <div class="d-flex justify-content-between align-items-center mb-3">
    <h4 class="mb-0">Script log</h4>
@@ -87,7 +86,6 @@ else
    private const int Capacity = 500;

    private readonly List<ScriptLogEntry> _rows = new();
-    private HubConnection? _hub;
    private bool _connected;
    private string _levelFilter = "";
    private string _scriptFilter = "";
@@ -115,32 +113,24 @@ else
        }
    }

-    protected override async Task OnInitializedAsync()
+    protected override void OnInitialized()
    {
-        _hub = new HubConnectionBuilder()
-            .WithUrl(Nav.ToAbsoluteUri(ScriptLogHub.Endpoint))
-            .WithAutomaticReconnect()
-            .Build();
+        // Live tail straight from the in-process broadcaster (fed by ScriptLogSignalRBridge off the
+        // 'script-logs' DPS topic). Blazor Server can't self-connect a SignalR HubConnection behind
+        // a reverse proxy — see IInProcessBroadcaster — so we subscribe in-process instead.
+        ScriptLogs.Received += OnEntry;
+        _connected = true;
+    }

-        _hub.On<ScriptLogEntry>(ScriptLogHub.MethodName, entry =>
+    private void OnEntry(ScriptLogEntry entry) =>
+        // Marshal both the mutation and the re-render onto the circuit sync context so this can't
+        // race ClearAsync (which runs there) over the shared _rows list.
+        InvokeAsync(() =>
        {
            _rows.Insert(0, entry);
            if (_rows.Count > Capacity) _rows.RemoveAt(_rows.Count - 1);
-            InvokeAsync(StateHasChanged);
+            StateHasChanged();
        });
-        _hub.Closed += _ => { _connected = false; return InvokeAsync(StateHasChanged); };
-        _hub.Reconnected += _ => { _connected = true; return InvokeAsync(StateHasChanged); };
-
-        try
-        {
-            await _hub.StartAsync();
-            _connected = true;
-        }
-        catch
-        {
-            // Connection error — page shows "disconnected".
-        }
-    }

    private async Task ClearAsync()
    {
@@ -156,8 +146,5 @@ else
        _ => "chip-idle",
    };

-    public async ValueTask DisposeAsync()
-    {
-        if (_hub is not null) await _hub.DisposeAsync();
-    }
+    public void Dispose() => ScriptLogs.Received -= OnEntry;
 }
@@ -20,7 +20,7 @@ else
    <section class="panel notice rise" style="animation-delay:.02s">
        Virtual tags evaluate a script per equipment instance and publish the result as an OPC UA
        variable. ChangeTriggered = re-evaluate when any dependency changes; TimerIntervalMs
-        re-evaluates on a periodic timer. Live editing lands in a Phase C.2-equivalent follow-up.
+        re-evaluates on a periodic timer.
    </section>

    <section class="panel rise mt-3" style="animation-delay:.08s">
@@ -0,0 +1,129 @@
+@* Generic modal-per-row list editor. The parent owns the List<TRow> (a MUTABLE row VM,
+   because driver contracts are immutable records). This renders a read-only table with
+   Add/Edit/Delete and a modal that edits a CLONED working copy — commit on Save, discard
+   on Cancel. NewRow builds a default VM; Clone copies one for the working copy; Validate
+   (optional) returns an error string to block commit or null to allow. *@
+@typeparam TRow
+
+<section class="panel rise mt-3" style="@_styleDelay">
+    <div class="panel-head d-flex align-items-center">
+        <span>@Title (@Items.Count)</span>
+        <button type="button" class="btn btn-sm btn-outline-primary ms-auto" @onclick="Add">+ Add @ItemNoun</button>
+    </div>
+    @if (Items.Count == 0)
+    {
+        <div style="padding:1rem" class="text-muted">No @ItemNoun.ToLowerInvariant() rows.</div>
+    }
+    else
+    {
+        <div class="table-wrap">
+            <table class="data-table">
+                <thead>@HeaderTemplate</thead>
+                <tbody>
+                    @for (var i = 0; i < Items.Count; i++)
+                    {
+                        var idx = i;
+                        <tr @key="Items[idx]">
+                            @RowTemplate(Items[idx])
+                            <td class="text-end" style="white-space:nowrap">
+                                <button type="button" class="btn btn-sm btn-link p-0 me-2" @onclick="() => Edit(idx)">Edit</button>
+                                <button type="button" class="btn btn-sm btn-link p-0 text-danger" @onclick="() => Delete(idx)">Delete</button>
+                            </td>
+                        </tr>
+                    }
+                </tbody>
+            </table>
+        </div>
+    }
+</section>
+
+@if (_modalOpen && _working is not null)
+{
+    <div class="modal-backdrop fade show" style="display:block"></div>
+    <div class="modal fade show" tabindex="-1" role="dialog" style="display:block">
+        <div class="modal-dialog modal-lg" role="document">
+            <div class="modal-content">
+                <div class="modal-header">
+                    <h5 class="modal-title">@(_editIndex is null ? $"Add {ItemNoun}" : $"Edit {ItemNoun}")</h5>
+                    <button type="button" class="btn-close" aria-label="Close" @onclick="Cancel"></button>
+                </div>
+                <div class="modal-body">
+                    @EditTemplate(_working)
+                    @if (!string.IsNullOrEmpty(_validationError))
+                    {
+                        <div class="text-danger small mt-2">@_validationError</div>
+                    }
+                </div>
+                <div class="modal-footer">
+                    <button type="button" class="btn btn-outline-secondary" @onclick="Cancel">Cancel</button>
+                    <button type="button" class="btn btn-primary" @onclick="Commit">Save</button>
+                </div>
+            </div>
+        </div>
+    </div>
+}
+
+@code {
+    [Parameter, EditorRequired] public List<TRow> Items { get; set; } = default!;
+    [Parameter] public EventCallback ItemsChanged { get; set; }
+    [Parameter] public string Title { get; set; } = "Items";
+    [Parameter] public string ItemNoun { get; set; } = "row";
+    [Parameter] public string AnimationDelay { get; set; } = ".18s";
+    [Parameter, EditorRequired] public RenderFragment HeaderTemplate { get; set; } = default!;
+    [Parameter, EditorRequired] public RenderFragment<TRow> RowTemplate { get; set; } = default!;
+    [Parameter, EditorRequired] public RenderFragment<TRow> EditTemplate { get; set; } = default!;
+    [Parameter, EditorRequired] public Func<TRow> NewRow { get; set; } = default!;
+    [Parameter, EditorRequired] public Func<TRow, TRow> Clone { get; set; } = default!;
+    [Parameter] public Func<TRow, IReadOnlyList<TRow>, int?, string?>? Validate { get; set; }
+
+    private string _styleDelay => $"animation-delay:{AnimationDelay}";
+    private bool _modalOpen;
+    private int? _editIndex;
+    private TRow? _working;
+    private string? _validationError;
+
+    private void Add()
+    {
+        _editIndex = null;
+        _working = NewRow();
+        _validationError = null;
+        _modalOpen = true;
+    }
+
+    private void Edit(int index)
+    {
+        _editIndex = index;
+        _working = Clone(Items[index]);
+        _validationError = null;
+        _modalOpen = true;
+    }
+
+    private async Task Delete(int index)
+    {
+        Items.RemoveAt(index);
+        await ItemsChanged.InvokeAsync();
+    }
+
+    private void Cancel()
+    {
+        _modalOpen = false;
+        _working = default;
+        _editIndex = null;
+        _validationError = null;
+    }
+
+    private async Task Commit()
+    {
+        if (_working is null) return;
+        _validationError = Validate?.Invoke(_working, Items, _editIndex);
+        if (_validationError is not null) return;
+
+        if (_editIndex is int i) Items[i] = _working;
+        else Items.Add(_working);
+
+        _modalOpen = false;
+        _working = default;
+        _editIndex = null;
+        await ItemsChanged.InvokeAsync();
+    }
+}
@@ -0,0 +1,160 @@
+@* Lazy tree component with per-node text filter. Driver-agnostic — consumes
+   IBrowserSessionService for root/expand. Selected node is bound back to parent
+   via OnNodeSelected EventCallback. *@
+@using ZB.MOM.WW.OtOpcUa.AdminUI.Browsing
+@using ZB.MOM.WW.OtOpcUa.Commons.Browsing
+@inject IBrowserSessionService BrowserService
+
+<div class="border rounded p-2" style="max-height:420px; overflow:auto; min-height:240px">
+    @if (_loading)
+    {
+        <div class="text-muted small"><span class="spinner-border spinner-border-sm me-1"></span>Loading&hellip;</div>
+    }
+    else if (_error is not null)
+    {
+        <div class="text-danger small">@_error</div>
+    }
+    else if (_roots is null || _roots.Count == 0)
+    {
+        <div class="text-muted small">No nodes.</div>
+    }
+    else
+    {
+        @foreach (var n in _roots) { @RenderNode(n, 0) }
+    }
+</div>
+
+@code {
+    /// <summary>The browse-session token returned by IBrowserSessionService.OpenAsync.</summary>
+    [Parameter, EditorRequired] public Guid SessionToken { get; set; }
+
+    /// <summary>The currently-selected node's NodeId, for visual selection highlighting.</summary>
+    [Parameter] public string SelectedNodeId { get; set; } = "";
+
+    /// <summary>Fired when the user clicks a leaf (or any node — caller decides what to do with it).</summary>
+    [Parameter] public EventCallback<BrowseNode> OnNodeSelected { get; set; }
+
+    private bool _loading = true;
+    private string? _error;
+    private List<TreeItem>? _roots;
+    private string _selectedNodeIdLocal = "";
+
+    protected override void OnParametersSet()
+    {
+        _selectedNodeIdLocal = SelectedNodeId ?? "";
+    }
+
+    protected override async Task OnInitializedAsync()
+    {
+        await LoadRootAsync();
+    }
+
+    private async Task LoadRootAsync()
+    {
+        try
+        {
+            var roots = await BrowserService.RootAsync(SessionToken, default);
+            _roots = roots.Select(n => new TreeItem(n)).ToList();
+        }
+        catch (Exception ex) { _error = ex.Message; }
+        finally { _loading = false; }
+    }
+
+    private async Task ToggleAsync(TreeItem item)
+    {
+        item.Expanded = !item.Expanded;
+        if (item.Expanded && !item.Loaded) await ExpandAsync(item);
+    }
+
+    private async Task ExpandAsync(TreeItem item)
+    {
+        if (item.Loaded || item.Loading) return;
+        item.Loading = true; StateHasChanged();
+        try
+        {
+            var kids = await BrowserService.ExpandAsync(SessionToken, item.Node.NodeId, default);
+            item.Children = kids.Select(k => new TreeItem(k)).ToList();
+            item.Loaded = true;
+        }
+        catch (Exception ex) { item.Error = ex.Message; }
+        finally { item.Loading = false; StateHasChanged(); }
+    }
+
+    private async Task SelectAsync(TreeItem item)
+    {
+        _selectedNodeIdLocal = item.Node.NodeId;
+        await OnNodeSelected.InvokeAsync(item.Node);
+    }
+
+    private RenderFragment RenderNode(TreeItem item, int depth) => __builder =>
+    {
+        var indent = $"padding-left:{depth * 18}px";
+        var selectedCls = _selectedNodeIdLocal == item.Node.NodeId ? "bg-primary-subtle" : "";
+        <div class="d-flex align-items-center gap-1 py-1 @selectedCls" style="@indent">
+            @if (item.Node.Kind == BrowseNodeKind.Folder && item.Node.HasChildrenHint)
+            {
+                <button type="button" class="btn btn-sm btn-link p-0"
+                        @onclick="@(() => ToggleAsync(item))" style="width:18px">
+                    @(item.Expanded ? "▼" : "▶")
+                </button>
+            }
+            else
+            {
+                <span style="width:18px"></span>
+            }
+            <a href="#" @onclick="@(() => SelectAsync(item))" @onclick:preventDefault
+               class="text-decoration-none mono small">@item.Node.DisplayName</a>
+            @if (item.Node.Kind == BrowseNodeKind.Leaf)
+            {
+                <span class="chip chip-idle ms-1" style="font-size:0.7rem">leaf</span>
+            }
+        </div>
+        @if (item.Expanded && item.Loading)
+        {
+            <div class="small text-muted" style="@($"padding-left:{(depth + 1) * 18}px")">
+                <span class="spinner-border spinner-border-sm me-1"></span>Loading&hellip;
+            </div>
+        }
+        else if (item.Expanded && item.Error is not null)
+        {
+            <div class="small text-danger" style="@($"padding-left:{(depth + 1) * 18}px")">
+                @item.Error
+            </div>
+        }
+        else if (item.Expanded && item.Loaded && item.Children is { Count: > 0 })
+        {
+            <input type="text" class="form-control form-control-sm mt-1"
+                   placeholder="filter children..."
+                   style="@($"width:calc(100% - {(depth + 2) * 18}px); margin-left:{(depth + 2) * 18}px")"
+                   @bind="item.Filter" @bind:event="oninput" />
+            @foreach (var c in FilterChildren(item))
+            {
+                @RenderNode(c, depth + 1)
+            }
+        }
+    };
+
+    private static IEnumerable<TreeItem> FilterChildren(TreeItem item)
+    {
+        if (item.Children is null) yield break;
+        var f = item.Filter?.Trim();
+        foreach (var c in item.Children)
+        {
+            if (string.IsNullOrEmpty(f)) { yield return c; continue; }
+            if (c.Node.DisplayName.Contains(f, StringComparison.OrdinalIgnoreCase) ||
+                c.Node.NodeId.Contains(f, StringComparison.OrdinalIgnoreCase))
+                yield return c;
+        }
+    }
+
+    private sealed class TreeItem(BrowseNode node)
+    {
+        public BrowseNode Node { get; } = node;
+        public bool Expanded { get; set; }
+        public bool Loaded { get; set; }
+        public bool Loading { get; set; }
+        public string? Error { get; set; }
+        public List<TreeItem>? Children { get; set; }
+        public string? Filter { get; set; }
+    }
+}
@@ -1,7 +1,5 @@
-@* Identity section shared across the generic DriverEdit page and the typed driver pages (Phase 4).
-   The parent page owns the <EditForm> and all data loading/persistence — this component is
-   purely a section of inputs.
-   Set ShowDriverType=true on the generic editor; typed pages leave it false (type is fixed). *@
+@* Identity section shared by the typed driver pages. The parent page owns the <EditForm> and all
+   data loading/persistence — this component is purely a section of inputs. *@
@using System.ComponentModel.DataAnnotations
@using ZB.MOM.WW.OtOpcUa.Configuration.Entities

@@ -37,7 +35,7 @@
                        <option value="TwinCat">TwinCat</option>
                        <option value="Focas">Focas</option>
                        <option value="OpcUaClient">OpcUaClient</option>
-                        <option value="Galaxy">Galaxy</option>
+                        <option value="GalaxyMxGateway">Galaxy</option>
                        <option value="Historian.Wonderware">Historian.Wonderware</option>
                    </InputSelect>
                    <div class="form-text">Cannot be changed after creation — drives the actor type that owns this instance.</div>
@@ -1,16 +1,42 @@
-@* Resilience overrides — JSON textarea. Typed-form-ifying Polly is a follow-up; for now this
-   matches the legacy DriverEdit.razor behaviour exactly. *@
+@using ZB.MOM.WW.OtOpcUa.AdminUI.Components.Shared.Drivers

 <section class="panel rise mt-3" style="animation-delay:.14s">
    <div class="panel-head">Resilience overrides (optional)</div>
    <div style="padding:1rem">
-        <InputTextArea Value="@ResilienceConfig"
-                       ValueExpression="() => ResilienceConfig"
-                       ValueChanged="OnChangedAsync"
-                       rows="6"
-                       class="form-control form-control-sm mono"
-                       placeholder="Leave blank to use tier defaults" />
-        <div class="form-text">Polly pipeline overrides per docs/v2/driver-stability.md — bulkhead, retry counts, breaker thresholds. Null = use the driver type's tier defaults.</div>
+        <p class="form-text mb-3">Blank fields use the driver type's stability-tier defaults
+            (see <span class="mono">docs/v2/driver-stability.md</span>). Set only what you need to override.</p>
+
+        <div class="row g-3">
+            <div class="col-md-4"><label class="form-label">Bulkhead max concurrent</label>
+                <input type="number" class="form-control form-control-sm" @bind="_m.BulkheadMaxConcurrent" @bind:after="EmitAsync" placeholder="tier default" /></div>
+            <div class="col-md-4"><label class="form-label">Bulkhead max queue</label>
+                <input type="number" class="form-control form-control-sm" @bind="_m.BulkheadMaxQueue" @bind:after="EmitAsync" placeholder="tier default" /></div>
+            <div class="col-md-4"><label class="form-label">Recycle interval (s, Tier C only)</label>
+                <input type="number" class="form-control form-control-sm" @bind="_m.RecycleIntervalSeconds" @bind:after="EmitAsync" placeholder="none" /></div>
+        </div>
+
+        <div class="table-wrap mt-3">
+            <table class="data-table">
+                <thead><tr><th>Capability</th><th>Timeout (s)</th><th>Retries</th><th>Breaker threshold</th></tr></thead>
+                <tbody>
+                    @foreach (var cap in ResilienceFormModel.Capabilities)
+                    {
+                        var row = _m.Policies[cap];
+                        <tr>
+                            <td class="mono">@cap</td>
+                            <td><input type="number" class="form-control form-control-sm" @bind="row.TimeoutSeconds" @bind:after="EmitAsync" placeholder="default" /></td>
+                            <td><input type="number" class="form-control form-control-sm" @bind="row.RetryCount" @bind:after="EmitAsync" placeholder="default" /></td>
+                            <td><input type="number" class="form-control form-control-sm" @bind="row.BreakerFailureThreshold" @bind:after="EmitAsync" placeholder="default" /></td>
+                        </tr>
+                    }
+                </tbody>
+            </table>
+        </div>
+
+        <details class="mt-3">
+            <summary class="small text-muted">Raw JSON (advanced)</summary>
+            <pre class="form-control form-control-sm mono mt-2" style="white-space:pre-wrap;min-height:3rem;">@(_m.ToJson() ?? "(null — all tier defaults)")</pre>
+        </details>
    </div>
 </section>

@@ -18,9 +44,24 @@
    [Parameter] public string? ResilienceConfig { get; set; }
    [Parameter] public EventCallback<string?> ResilienceConfigChanged { get; set; }

-    private async Task OnChangedAsync(string? newValue)
+    private ResilienceFormModel _m = new();
+    private string? _lastParsed;
+
+    protected override void OnParametersSet()
    {
-        ResilienceConfig = newValue;
-        await ResilienceConfigChanged.InvokeAsync(newValue);
+        // Re-parse only when the inbound value actually changed (avoid clobbering edits on re-render).
+        if (!string.Equals(_lastParsed, ResilienceConfig, StringComparison.Ordinal))
+        {
+            _m = ResilienceFormModel.FromJson(ResilienceConfig);
+            _lastParsed = ResilienceConfig;
+        }
+    }
+
+    private async Task EmitAsync()
+    {
+        var json = _m.ToJson();
+        _lastParsed = json;
+        ResilienceConfig = json;
+        await ResilienceConfigChanged.InvokeAsync(json);
    }
 }
@@ -4,14 +4,14 @@
   DriverOperator-gated Reconnect/Restart buttons appear for authorised users. *@
@implements IAsyncDisposable
@using Microsoft.AspNetCore.Authorization
-@using Microsoft.AspNetCore.SignalR.Client
+@using ZB.MOM.WW.OtOpcUa.AdminUI.Hubs
@using ZB.MOM.WW.OtOpcUa.Commons.Interfaces
@using ZB.MOM.WW.OtOpcUa.Commons.Messages.Admin
@using ZB.MOM.WW.OtOpcUa.Commons.Messages.Drivers
-@inject NavigationManager Nav
@inject AuthenticationStateProvider AuthState
@inject IAuthorizationService AuthorizationService
@inject IAdminOperationsClient AdminOps
+@inject IDriverStatusSnapshotStore StatusStore

 <section class="panel rise mt-3" style="animation-delay:.04s; @(_stale ? "opacity:0.5;" : "")">
    <div class="panel-head d-flex align-items-center gap-2">
@@ -139,7 +139,6 @@
    [Parameter] public string ClusterId { get; set; } = "";
    [Parameter] public bool Enabled { get; set; } = true;

-    private HubConnection? _hub;
    private DriverHealthChanged? _snapshot;
    private DateTime _lastUpdateUtc = DateTime.MinValue;
    private bool _stale;
@@ -180,30 +179,44 @@
            InvokeAsync(StateHasChanged);
        }, null, TimeSpan.FromSeconds(5), TimeSpan.FromSeconds(5));

-        _hub = new HubConnectionBuilder()
-            .WithUrl(Nav.ToAbsoluteUri("/hubs/driverstatus"))
-            .WithAutomaticReconnect()
-            .Build();
-
-        _hub.On<DriverHealthChanged>("status", snap =>
-        {
-            _snapshot = snap;
-            _lastUpdateUtc = DateTime.UtcNow;
-            _stale = false;
-            InvokeAsync(StateHasChanged);
-        });
-
+        // Read live status straight from the in-process snapshot store rather than opening a
+        // self-targeted SignalR connection. This component runs server-side (Blazor
+        // InteractiveServer), so a HubConnection to the browser's public URL (e.g.
+        // http://localhost:9200 behind Traefik) would dial that port from *inside* the container —
+        // where only Kestrel's :9000 listens — and fail with "Connection refused". The store is fed
+        // on every admin node by DriverStatusSignalRBridge (a per-node DistributedPubSub
+        // subscriber), so the local singleton is always current regardless of which replica serves
+        // this circuit.
        try
        {
-            await _hub.StartAsync();
-            _connecting = false;
-            await _hub.InvokeAsync("JoinDriver", DriverInstanceId);
+            StatusStore.SnapshotChanged += OnSnapshotChanged;
+            if (StatusStore.TryGet(DriverInstanceId, out var snap))
+            {
+                _snapshot = snap;
+                _lastUpdateUtc = DateTime.UtcNow;
+            }
        }
        catch (Exception ex)
        {
-            _connecting = false;
            _error = ex.Message;
        }
+        finally
+        {
+            _connecting = false;
+        }
+    }
+
+    // Invoked by the snapshot store (on the bridge actor's thread) for every driver instance;
+    // ignore snapshots for other instances and marshal onto the render sync context.
+    private void OnSnapshotChanged(DriverHealthChanged snap)
+    {
+        if (!string.Equals(snap.DriverInstanceId, DriverInstanceId, StringComparison.Ordinal))
+            return;
+
+        _snapshot = snap;
+        _lastUpdateUtc = DateTime.UtcNow;
+        _stale = false;
+        InvokeAsync(StateHasChanged);
    }

    private async Task ReconnectAsync()
@@ -285,12 +298,13 @@

    public async ValueTask DisposeAsync()
    {
-        // Drain BOTH timers first so an in-flight callback can't invoke StateHasChanged on
-        // a component whose hub has already been released. System.Threading.Timer's async
-        // dispose awaits any in-flight callback (.NET 6+).
+        // Unsubscribe first so the singleton store can't invoke a handler on a disposed component.
+        StatusStore.SnapshotChanged -= OnSnapshotChanged;
+        // Drain BOTH timers so an in-flight callback can't invoke StateHasChanged on a component
+        // that's already gone. System.Threading.Timer's async dispose awaits any in-flight
+        // callback (.NET 6+).
        if (_timer is not null) await _timer.DisposeAsync();
        if (_opResultClearTimer is not null) await _opResultClearTimer.DisposeAsync();
-        if (_hub is not null) await _hub.DisposeAsync();
    }

    // Map DriverState string → chip CSS class using the 4 defined theme variants.
@@ -1,10 +1,15 @@
-@* Static Galaxy address builder: tag_name.AttributeName free text → verbatim.
-   Live Galaxy browse deferred to a follow-up phase. *@
-
-<div class="alert alert-info py-2 px-3 mb-3 small">
-    <strong>Note:</strong> Live Galaxy browse is deferred to a follow-up phase.
-    Enter the tag and attribute name manually below.
-</div>
+@* Galaxy address picker:
+     1. Manual tag/attribute entry (always available).
+     2. (DriverOperator-gated) Live browse: object tree on the left,
+        attribute side-panel on the right. Clicking an attribute commits
+        tag_name.AttributeName into the result. *@
+@implements IAsyncDisposable
+@using Microsoft.AspNetCore.Authorization
+@using ZB.MOM.WW.OtOpcUa.AdminUI.Browsing
+@using ZB.MOM.WW.OtOpcUa.Commons.Browsing
+@inject IBrowserSessionService BrowserService
+@inject AuthenticationStateProvider AuthState
+@inject IAuthorizationService AuthorizationService

 <div class="row g-3">
    <div class="col-md-5">
@@ -21,6 +26,70 @@
    </div>
 </div>

+@if (_canOperate)
+{
+    <div class="mt-3 d-flex align-items-center gap-2">
+        @if (_token == Guid.Empty)
+        {
+            <button type="button" class="btn btn-outline-primary btn-sm" disabled="@_opening"
+                    @onclick="OpenBrowseAsync">
+                @if (_opening) { <span class="spinner-border spinner-border-sm me-1"></span> }
+                Browse galaxy
+            </button>
+        }
+        else
+        {
+            <span class="chip chip-ok">Browser open</span>
+            <button type="button" class="btn btn-outline-secondary btn-sm" @onclick="CloseBrowseAsync">Close</button>
+        }
+        @if (_openError is not null) { <span class="chip chip-bad" title="@_openError">@TruncatedError()</span> }
+    </div>
+
+    @if (_token != Guid.Empty)
+    {
+        <div class="row g-3 mt-1">
+            <div class="col-md-7">
+                <label class="form-label small">Objects</label>
+                <DriverBrowseTree SessionToken="_token" OnNodeSelected="OnObjectSelectAsync"
+                                  SelectedNodeId="_tagName" />
+            </div>
+            <div class="col-md-5">
+                <label class="form-label small">Attributes of @(string.IsNullOrEmpty(_tagName) ? "—" : _tagName)</label>
+                <div class="border rounded p-2" style="max-height:420px; overflow:auto; min-height:240px">
+                    @if (_attrsLoading)
+                    {
+                        <span class="spinner-border spinner-border-sm me-1"></span>
+                    }
+                    else if (_attrsError is not null)
+                    {
+                        <span class="text-danger small">@_attrsError</span>
+                    }
+                    else if (_attrs is null)
+                    {
+                        <span class="text-muted small">Pick an object.</span>
+                    }
+                    else if (_attrs.Count == 0)
+                    {
+                        <span class="text-muted small">No attributes.</span>
+                    }
+                    else
+                    {
+                        @foreach (var a in _attrs)
+                        {
+                            var sel = _attributeName == a.Name ? "bg-primary-subtle" : "";
+                            <div class="d-flex justify-content-between align-items-center py-1 @sel"
+                                 style="cursor:pointer" @onclick="@(() => SelectAttributeAsync(a))">
+                                <span class="mono small">@a.Name</span>
+                                <span class="text-muted small">@a.DriverDataType@(a.IsArray ? "[]" : "") · @a.SecurityClass</span>
+                            </div>
+                        }
+                    }
+                </div>
+            </div>
+        </div>
+    }
+}
+
 <div class="mt-3">
    <span class="text-muted small">Result:</span>
    <code class="mono ms-2">@_built</code>
@@ -29,15 +98,77 @@
@code {
    [Parameter] public string CurrentAddress { get; set; } = "";
    [Parameter] public EventCallback<string> CurrentAddressChanged { get; set; }
+    [Parameter, EditorRequired] public Func<string> GetConfigJson { get; set; } = () => "{}";

    private string _tagName = "";
    private string _attributeName = "";
    private string _built = "";
+    private Guid _token = Guid.Empty;
+    private bool _opening;
+    private bool _attrsLoading;
+    private bool _canOperate;
+    private string? _openError;
+    private string? _attrsError;
+    private IReadOnlyList<AttributeInfo>? _attrs;

-    protected override void OnInitialized()
+    protected override async Task OnInitializedAsync()
    {
+        var auth = await AuthState.GetAuthenticationStateAsync();
+        var authResult = await AuthorizationService.AuthorizeAsync(auth.User, null, "DriverOperator");
+        _canOperate = authResult.Succeeded;
        _built = Build();
-        _ = CurrentAddressChanged.InvokeAsync(_built);
+        await CurrentAddressChanged.InvokeAsync(_built);
+    }
+
+    private async Task OpenBrowseAsync()
+    {
+        _opening = true; _openError = null; StateHasChanged();
+        try
+        {
+            var json = GetConfigJson() ?? "{}";
+            var result = await BrowserService.OpenAsync("GalaxyMxGateway", json, default);
+            if (result.Ok) _token = result.Token;
+            else _openError = result.Message;
+        }
+        finally { _opening = false; StateHasChanged(); }
+    }
+
+    private async Task CloseBrowseAsync()
+    {
+        var t = _token;
+        _token = Guid.Empty;
+        _attrs = null;
+        StateHasChanged();
+        if (t != Guid.Empty) await BrowserService.CloseAsync(t);
+    }
+
+    private async Task OnObjectSelectAsync(BrowseNode node)
+    {
+        _tagName = node.NodeId;
+        _attributeName = "";
+        _attrs = null;
+        _attrsLoading = true;
+        _attrsError = null;
+        StateHasChanged();
+        try
+        {
+            _attrs = await BrowserService.AttributesAsync(_token, _tagName, default);
+        }
+        catch (Exception ex)
+        {
+            _attrsError = ex.Message;
+        }
+        finally
+        {
+            _attrsLoading = false;
+            await OnChangedAsync();
+        }
+    }
+
+    private async Task SelectAttributeAsync(AttributeInfo a)
+    {
+        _attributeName = a.Name;
+        await OnChangedAsync();
    }

    private async Task OnChangedAsync()
@@ -54,4 +185,17 @@
            return _tagName;
        return $"{_tagName}.{_attributeName}";
    }
+
+    private string TruncatedError() =>
+        _openError is null ? "" : (_openError.Length > 60 ? _openError[..60] + "…" : _openError);
+
+    public ValueTask DisposeAsync()
+    {
+        if (_token != Guid.Empty)
+        {
+            // Fire-and-forget — don't block circuit teardown on a slow remote.
+            _ = BrowserService.CloseAsync(_token);
+        }
+        return ValueTask.CompletedTask;
+    }
 }
@@ -1,22 +1,57 @@
-@* Static OPC UA Client address builder: NodeId free text → verbatim.
-   Live browse deferred to a follow-up phase. *@
-
-<div class="alert alert-info py-2 px-3 mb-3 small">
-    <strong>Note:</strong> Live OPC UA node browse is deferred to a follow-up phase.
-    Enter the NodeId string manually below.
-</div>
+@* OPC UA Client address picker:
+     1. Manual NodeId entry (always available)
+     2. (DriverOperator-gated) Browse remote server with live tree, lazy expand. *@
+@implements IAsyncDisposable
+@using Microsoft.AspNetCore.Authorization
+@using ZB.MOM.WW.OtOpcUa.AdminUI.Browsing
+@using ZB.MOM.WW.OtOpcUa.Commons.Browsing
+@inject IBrowserSessionService BrowserService
+@inject AuthenticationStateProvider AuthState
+@inject IAuthorizationService AuthorizationService

 <div class="row g-3">
    <div class="col-md-10">
        <label class="form-label">NodeId</label>
-        <input type="text" class="form-control form-control-sm mono" placeholder="ns=2;s=Channel.Device.Tag"
+        <input type="text" class="form-control form-control-sm mono"
+               placeholder="ns=2;s=Channel.Device.Tag"
               @bind="_nodeId" @bind:after="OnChangedAsync" />
        <div class="form-text">
-            OPC UA NodeId string, e.g. <code>ns=2;s=Channel.Device.Tag</code> or <code>i=1001</code>.
+            OPC UA NodeId string, e.g. <code>ns=2;s=Channel.Device.Tag</code> or
+            <code>i=1001</code>. Use Browse to navigate the remote server.
        </div>
    </div>
 </div>

+@if (_canOperate)
+{
+    <div class="mt-3 d-flex align-items-center gap-2">
+        @if (_token == Guid.Empty)
+        {
+            <button type="button" class="btn btn-outline-primary btn-sm"
+                    disabled="@_opening" @onclick="OpenBrowseAsync">
+                @if (_opening) { <span class="spinner-border spinner-border-sm me-1"></span> }
+                Browse remote server
+            </button>
+        }
+        else
+        {
+            <span class="chip chip-ok">Browser open</span>
+            <button type="button" class="btn btn-outline-secondary btn-sm" @onclick="CloseBrowseAsync">
+                Close
+            </button>
+        }
+        @if (_openError is not null) { <span class="chip chip-bad" title="@_openError">@TruncatedError()</span> }
+    </div>
+
+    @if (_token != Guid.Empty)
+    {
+        <div class="mt-2">
+            <DriverBrowseTree SessionToken="_token" OnNodeSelected="OnTreeSelectAsync"
+                              SelectedNodeId="_nodeId" />
+        </div>
+    }
+}
+
 <div class="mt-3">
    <span class="text-muted small">Result:</span>
    <code class="mono ms-2">@_built</code>
@@ -25,14 +60,47 @@
@code {
    [Parameter] public string CurrentAddress { get; set; } = "";
    [Parameter] public EventCallback<string> CurrentAddressChanged { get; set; }
+    [Parameter, EditorRequired] public Func<string> GetConfigJson { get; set; } = () => "{}";

    private string _nodeId = "";
    private string _built = "";
+    private Guid _token = Guid.Empty;
+    private bool _opening;
+    private bool _canOperate;
+    private string? _openError;

-    protected override void OnInitialized()
+    protected override async Task OnInitializedAsync()
    {
+        var auth = await AuthState.GetAuthenticationStateAsync();
+        var authResult = await AuthorizationService.AuthorizeAsync(auth.User, null, "DriverOperator");
+        _canOperate = authResult.Succeeded;
        _built = _nodeId;
-        _ = CurrentAddressChanged.InvokeAsync(_built);
+        await CurrentAddressChanged.InvokeAsync(_built);
+    }
+
+    private async Task OpenBrowseAsync()
+    {
+        _opening = true; _openError = null; StateHasChanged();
+        try
+        {
+            var json = GetConfigJson() ?? "{}";
+            var result = await BrowserService.OpenAsync("OpcUaClient", json, default);
+            if (result.Ok) _token = result.Token;
+            else _openError = result.Message;
+        }
+        finally { _opening = false; StateHasChanged(); }
+    }
+
+    private async Task CloseBrowseAsync()
+    {
+        var t = _token; _token = Guid.Empty; StateHasChanged();
+        if (t != Guid.Empty) await BrowserService.CloseAsync(t);
+    }
+
+    private async Task OnTreeSelectAsync(BrowseNode node)
+    {
+        _nodeId = node.NodeId;
+        await OnChangedAsync();
    }

    private async Task OnChangedAsync()
@@ -40,4 +108,17 @@
        _built = _nodeId;
        await CurrentAddressChanged.InvokeAsync(_built);
    }
+
+    private string TruncatedError() =>
+        _openError is null ? "" : (_openError.Length > 60 ? _openError[..60] + "…" : _openError);
+
+    public ValueTask DisposeAsync()
+    {
+        if (_token != Guid.Empty)
+        {
+            // Fire-and-forget — don't block circuit teardown on a slow remote.
+            _ = BrowserService.CloseAsync(_token);
+        }
+        return ValueTask.CompletedTask;
+    }
 }
@@ -0,0 +1,104 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+
+namespace ZB.MOM.WW.OtOpcUa.AdminUI.Components.Shared.Drivers;
+
+/// <summary>
+///     Mutable, all-nullable form model for the driver resilience override. Binds the typed
+///     fields in DriverResilienceSection; null/blank = "use the driver's tier default", so a
+///     blank form serializes back to null (preserving DriverInstance.ResilienceConfig = null).
+///     Emits / reads the exact override JSON shape DriverResilienceOptionsParser consumes.
+/// </summary>
+public sealed class ResilienceFormModel
+{
+    public static readonly string[] Capabilities =
+        ["Read", "Write", "Discover", "Subscribe", "Probe", "AlarmSubscribe", "AlarmAcknowledge", "HistoryRead"];
+
+    public int? BulkheadMaxConcurrent { get; set; }
+    public int? BulkheadMaxQueue { get; set; }
+    public int? RecycleIntervalSeconds { get; set; }
+
+    // capability name -> (timeout, retry, breaker), each nullable.
+    public Dictionary<string, CapabilityRow> Policies { get; set; } =
+        Capabilities.ToDictionary(c => c, _ => new CapabilityRow(), StringComparer.OrdinalIgnoreCase);
+
+    public sealed class CapabilityRow
+    {
+        public int? TimeoutSeconds { get; set; }
+        public int? RetryCount { get; set; }
+        public int? BreakerFailureThreshold { get; set; }
+        public bool IsEmpty => TimeoutSeconds is null && RetryCount is null && BreakerFailureThreshold is null;
+    }
+
+    private static readonly JsonSerializerOptions ReadOpts = new() { PropertyNameCaseInsensitive = true };
+    private static readonly JsonSerializerOptions WriteOpts = new()
+    {
+        PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+        DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
+    };
+
+    public static ResilienceFormModel FromJson(string? json)
+    {
+        var model = new ResilienceFormModel();
+        if (string.IsNullOrWhiteSpace(json)) return model;
+
+        Shape? shape;
+        try { shape = JsonSerializer.Deserialize<Shape>(json, ReadOpts); }
+        catch (JsonException) { return model; }   // malformed -> empty form; raw view (next task) shows the text
+        if (shape is null) return model;
+
+        model.BulkheadMaxConcurrent = shape.BulkheadMaxConcurrent;
+        model.BulkheadMaxQueue = shape.BulkheadMaxQueue;
+        model.RecycleIntervalSeconds = shape.RecycleIntervalSeconds;
+        if (shape.CapabilityPolicies is not null)
+            foreach (var (cap, p) in shape.CapabilityPolicies)
+                if (model.Policies.TryGetValue(cap, out var row))
+                {
+                    row.TimeoutSeconds = p.TimeoutSeconds;
+                    row.RetryCount = p.RetryCount;
+                    row.BreakerFailureThreshold = p.BreakerFailureThreshold;
+                }
+        return model;
+    }
+
+    /// <summary>Emit only the non-null overrides; returns null when nothing is overridden.</summary>
+    public string? ToJson()
+    {
+        var caps = Policies
+            .Where(kv => !kv.Value.IsEmpty)
+            .ToDictionary(kv => kv.Key, kv => new PolicyShape
+            {
+                TimeoutSeconds = kv.Value.TimeoutSeconds,
+                RetryCount = kv.Value.RetryCount,
+                BreakerFailureThreshold = kv.Value.BreakerFailureThreshold,
+            });
+
+        var hasAny = BulkheadMaxConcurrent is not null || BulkheadMaxQueue is not null
+                     || RecycleIntervalSeconds is not null || caps.Count > 0;
+        if (!hasAny) return null;
+
+        var shape = new Shape
+        {
+            BulkheadMaxConcurrent = BulkheadMaxConcurrent,
+            BulkheadMaxQueue = BulkheadMaxQueue,
+            RecycleIntervalSeconds = RecycleIntervalSeconds,
+            CapabilityPolicies = caps.Count > 0 ? caps : null,
+        };
+        return JsonSerializer.Serialize(shape, WriteOpts);
+    }
+
+    private sealed class Shape
+    {
+        public int? BulkheadMaxConcurrent { get; set; }
+        public int? BulkheadMaxQueue { get; set; }
+        public int? RecycleIntervalSeconds { get; set; }
+        public Dictionary<string, PolicyShape>? CapabilityPolicies { get; set; }
+    }
+
+    private sealed class PolicyShape
+    {
+        public int? TimeoutSeconds { get; set; }
+        public int? RetryCount { get; set; }
+        public int? BreakerFailureThreshold { get; set; }
+    }
+}
@@ -4,6 +4,9 @@ using Microsoft.AspNetCore.Components.Web;
 using Microsoft.AspNetCore.Routing;
 using Microsoft.Extensions.DependencyInjection;
 using ZB.MOM.WW.OtOpcUa.AdminUI.Hubs;
+using ZB.MOM.WW.OtOpcUa.Commons.Browsing;
+using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser;
+using ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser;

 namespace ZB.MOM.WW.OtOpcUa.AdminUI;

@@ -12,11 +15,6 @@ public static class EndpointRouteBuilderExtensions
    /// <summary>
    /// Mounts the AdminUI Razor components and the AdminUI static asset pipeline at the root.
    /// Call from the fused Host's Program.cs alongside <c>app.MapOtOpcUaAuth()</c>.
-    ///
-    /// Razor component migration from legacy <c>OtOpcUa.Admin/Components/</c> is staged for
-    /// follow-up F15 — 47 .razor files plus codebehind. Until then this extension wires the
-    /// Blazor pipeline but the only built-in components are the v2-native ones added in this
-    /// library (e.g. <c>Deployments</c>, Task 52).
    /// </summary>
    /// <typeparam name="TApp">The root component type for Razor pages.</typeparam>
    /// <param name="app">The endpoint route builder.</param>
@@ -39,6 +37,14 @@ public static class EndpointRouteBuilderExtensions
    {
        services.AddRazorComponents().AddInteractiveServerComponents();
        services.AddOtOpcUaDriverStatusServices();
+
+        // Browse pipeline — see docs/plans/2026-05-28-driver-browsers-design.md
+        services.AddSingleton<Browsing.BrowseSessionRegistry>();
+        services.AddHostedService<Browsing.BrowseSessionReaper>();
+        services.AddScoped<Browsing.IBrowserSessionService, Browsing.BrowserSessionService>();
+        services.AddSingleton<IDriverBrowser, OpcUaClientDriverBrowser>();
+        services.AddSingleton<IDriverBrowser, GalaxyDriverBrowser>();
+
        return services;
    }
 }
@@ -17,22 +17,26 @@ public sealed class AlertSignalRBridge : ReceiveActor
    public const string TopicName = "alerts";

    private readonly IHubContext<AlertHub> _hub;
+    private readonly IInProcessBroadcaster<AlarmTransitionEvent> _broadcaster;
    private readonly ILoggingAdapter _log = Context.GetLogger();

    /// <summary>
    /// Creates actor props for the AlertSignalRBridge.
    /// </summary>
    /// <param name="hub">The SignalR hub context to send alerts to.</param>
-    public static Props Props(IHubContext<AlertHub> hub) =>
-        Akka.Actor.Props.Create(() => new AlertSignalRBridge(hub));
+    /// <param name="broadcaster">In-process fan-out read directly by the Blazor Server Alerts page.</param>
+    public static Props Props(IHubContext<AlertHub> hub, IInProcessBroadcaster<AlarmTransitionEvent> broadcaster) =>
+        Akka.Actor.Props.Create(() => new AlertSignalRBridge(hub, broadcaster));

    /// <summary>
    /// Initializes a new instance of the AlertSignalRBridge actor.
    /// </summary>
    /// <param name="hub">The SignalR hub context to send alerts to.</param>
-    public AlertSignalRBridge(IHubContext<AlertHub> hub)
+    /// <param name="broadcaster">In-process fan-out read directly by the Blazor Server Alerts page.</param>
+    public AlertSignalRBridge(IHubContext<AlertHub> hub, IInProcessBroadcaster<AlarmTransitionEvent> broadcaster)
    {
        _hub = hub;
+        _broadcaster = broadcaster;
        ReceiveAsync<AlarmTransitionEvent>(ForwardAsync);
        Receive<SubscribeAck>(_ => { /* DPS confirmation */ });
    }
@@ -43,6 +47,9 @@ public sealed class AlertSignalRBridge : ReceiveActor

    private async Task ForwardAsync(AlarmTransitionEvent msg)
    {
+        // In-process fan-out first — this is what the Blazor Server Alerts page reads. The hub push
+        // is kept for any out-of-process (e.g. WASM) SignalR client.
+        _broadcaster.Publish(msg);
        try
        {
            await _hub.Clients.All.SendAsync(AlertHub.MethodName, msg);
@@ -7,9 +7,8 @@ namespace ZB.MOM.WW.OtOpcUa.AdminUI.Hubs;
 /// Browser-facing fleet-status push channel. Subscribers receive <see cref="FleetStatusChanged"/>
 /// snapshots whenever the admin-role <c>FleetStatusBroadcaster</c> publishes a diff.
 ///
-/// Server-side bridge from <c>FleetStatusBroadcaster.broadcast</c> → <c>IHubContext&lt;FleetStatusHub&gt;</c>
-/// is staged for follow-up F16. For now the hub is a passive channel; SignalR clients connect
-/// and stay idle until the bridge lands.
+/// Server pushes fleet-status updates to connected clients via <c>FleetStatusSignalRBridge</c>
+/// (DistributedPubSub 'fleet-status' → <c>IHubContext&lt;FleetStatusHub&gt;</c>).
 /// </summary>
 public sealed class FleetStatusHub : Hub
 {
@@ -13,14 +13,21 @@ public static class HubServiceCollectionExtensions
    public const string DriverStatusSignalRBridgeName = "driver-status-signalr-bridge";

    /// <summary>
-    ///     Registers services required by the driver-status hub pipeline:
-    ///     <see cref="IDriverStatusSnapshotStore"/> as a singleton backed by
-    ///     <see cref="InMemoryDriverStatusSnapshotStore"/>.
+    ///     Registers the in-process live-push services the AdminUI's Blazor Server panels read
+    ///     directly (instead of self-connecting a SignalR <c>HubConnection</c>, which fails behind a
+    ///     reverse proxy — see <see cref="IInProcessBroadcaster{T}"/>):
+    ///     <list type="bullet">
+    ///       <item><see cref="IDriverStatusSnapshotStore"/> — last-value snapshot per driver.</item>
+    ///       <item><see cref="IInProcessBroadcaster{T}"/> — append-stream fan-out (alarm
+    ///       transitions, script-log lines). Registered as an open generic so each closed type
+    ///       resolves to its own singleton shared by the bridge actor and the consuming component.</item>
+    ///     </list>
    /// </summary>
    /// <param name="services">The service collection.</param>
    public static IServiceCollection AddOtOpcUaDriverStatusServices(this IServiceCollection services)
    {
        services.AddSingleton<IDriverStatusSnapshotStore, InMemoryDriverStatusSnapshotStore>();
+        services.AddSingleton(typeof(IInProcessBroadcaster<>), typeof(InProcessBroadcaster<>));
        return services;
    }

@@ -48,11 +55,13 @@ public static class HubServiceCollectionExtensions
            registry.Register<FleetStatusSignalRBridgeKey>(fleetBridge);

            var alertHub = resolver.GetService<IHubContext<AlertHub>>();
-            var alertBridge = system.ActorOf(AlertSignalRBridge.Props(alertHub), AlertSignalRBridgeName);
+            var alertBroadcaster = resolver.GetService<IInProcessBroadcaster<Commons.Messages.Alerts.AlarmTransitionEvent>>();
+            var alertBridge = system.ActorOf(AlertSignalRBridge.Props(alertHub, alertBroadcaster), AlertSignalRBridgeName);
            registry.Register<AlertSignalRBridgeKey>(alertBridge);

            var scriptLogHub = resolver.GetService<IHubContext<ScriptLogHub>>();
-            var scriptLogBridge = system.ActorOf(ScriptLogSignalRBridge.Props(scriptLogHub), ScriptLogSignalRBridgeName);
+            var scriptLogBroadcaster = resolver.GetService<IInProcessBroadcaster<Commons.Messages.Logging.ScriptLogEntry>>();
+            var scriptLogBridge = system.ActorOf(ScriptLogSignalRBridge.Props(scriptLogHub, scriptLogBroadcaster), ScriptLogSignalRBridgeName);
            registry.Register<ScriptLogSignalRBridgeKey>(scriptLogBridge);

            var driverStatusHub = resolver.GetService<IHubContext<DriverStatusHub>>();
@@ -6,10 +6,21 @@ namespace ZB.MOM.WW.OtOpcUa.AdminUI.Hubs;
 ///     Singleton last-snapshot-per-instance cache. Populated by
 ///     <c>DriverStatusSignalRBridge</c> as it forwards DPS messages; read by
 ///     <see cref="DriverStatusHub.JoinDriver"/> so newly-joined clients see current state
-///     without waiting for the next change event.
+///     without waiting for the next change event, and subscribed to directly by the Blazor
+///     Server <c>DriverStatusPanel</c> via <see cref="SnapshotChanged"/>.
 /// </summary>
 public interface IDriverStatusSnapshotStore
 {
    void Upsert(DriverHealthChanged snapshot);
    bool TryGet(string driverInstanceId, out DriverHealthChanged snapshot);
+
+    /// <summary>
+    ///     Raised after every <see cref="Upsert"/> with the just-stored snapshot. Lets in-process
+    ///     consumers (the Blazor Server <c>DriverStatusPanel</c>) receive live updates by reading
+    ///     this singleton directly instead of opening a self-targeted SignalR connection — which a
+    ///     server-side Blazor component cannot reach when the public URL (e.g. a reverse-proxy port)
+    ///     differs from the local Kestrel bind. Handlers run on the caller's thread (the bridge
+    ///     actor), so subscribers must marshal to their own sync context.
+    /// </summary>
+    event Action<DriverHealthChanged>? SnapshotChanged;
 }
@@ -0,0 +1,41 @@
+namespace ZB.MOM.WW.OtOpcUa.AdminUI.Hubs;
+
+/// <summary>
+///     A singleton, in-process fan-out for live event streams (alarm transitions, script-log
+///     lines). A per-node SignalR bridge actor subscribes to the cluster's DistributedPubSub topic
+///     and calls <see cref="Publish"/>; Blazor Server components subscribe to <see cref="Received"/>
+///     to render the live tail.
+///     <para>
+///     This exists because the AdminUI runs as Blazor <em>Server</em>: a component opening a
+///     SignalR <c>HubConnection</c> to its own hub would dial the browser's public URL from
+///     server-side code, which is unreachable behind a reverse proxy (e.g. Traefik mapping host
+///     :9200 → container :9000) and so fails with "Connection refused". Reading this in-process
+///     broadcaster instead avoids the network hop entirely. Mirrors the
+///     <c>IDriverStatusSnapshotStore.SnapshotChanged</c> pattern for stream (vs. last-value) feeds.
+///     </para>
+/// </summary>
+/// <typeparam name="T">The event payload type (e.g. AlarmTransitionEvent, ScriptLogEntry).</typeparam>
+public interface IInProcessBroadcaster<T>
+{
+    /// <summary>
+    ///     Raised once per <see cref="Publish"/> with the published item. Handlers run on the
+    ///     caller's thread (the bridge actor), so subscribers must marshal to their own sync
+    ///     context (Blazor's <c>InvokeAsync</c>).
+    /// </summary>
+    event Action<T>? Received;
+
+    /// <summary>Fan the item out to all current <see cref="Received"/> subscribers.</summary>
+    void Publish(T item);
+}
+
+/// <summary>Thread-safe singleton implementation of <see cref="IInProcessBroadcaster{T}"/>.</summary>
+/// <typeparam name="T">The event payload type.</typeparam>
+public sealed class InProcessBroadcaster<T> : IInProcessBroadcaster<T>
+{
+    /// <inheritdoc />
+    public event Action<T>? Received;
+
+    /// <inheritdoc />
+    // Capture-then-invoke (via ?.) so a concurrent unsubscribe can't null the delegate mid-raise.
+    public void Publish(T item) => Received?.Invoke(item);
+}
@@ -11,9 +11,16 @@ public sealed class InMemoryDriverStatusSnapshotStore : IDriverStatusSnapshotSto
 {
    private readonly ConcurrentDictionary<string, DriverHealthChanged> _byInstance = new();

+    /// <inheritdoc />
+    public event Action<DriverHealthChanged>? SnapshotChanged;
+
    /// <inheritdoc />
    public void Upsert(DriverHealthChanged snapshot)
-        => _byInstance[snapshot.DriverInstanceId] = snapshot;
+    {
+        _byInstance[snapshot.DriverInstanceId] = snapshot;
+        // Capture-then-invoke so a concurrent unsubscribe can't null the delegate mid-raise.
+        SnapshotChanged?.Invoke(snapshot);
+    }

    /// <inheritdoc />
    public bool TryGet(string driverInstanceId, out DriverHealthChanged snapshot)
@@ -15,18 +15,22 @@ public sealed class ScriptLogSignalRBridge : ReceiveActor
    public const string TopicName = "script-logs";

    private readonly IHubContext<ScriptLogHub> _hub;
+    private readonly IInProcessBroadcaster<ScriptLogEntry> _broadcaster;
    private readonly ILoggingAdapter _log = Context.GetLogger();

    /// <summary>Creates a Props instance for the ScriptLogSignalRBridge.</summary>
    /// <param name="hub">The SignalR hub context for sending messages to clients.</param>
-    public static Props Props(IHubContext<ScriptLogHub> hub) =>
-        Akka.Actor.Props.Create(() => new ScriptLogSignalRBridge(hub));
+    /// <param name="broadcaster">In-process fan-out read directly by the Blazor Server Script log page.</param>
+    public static Props Props(IHubContext<ScriptLogHub> hub, IInProcessBroadcaster<ScriptLogEntry> broadcaster) =>
+        Akka.Actor.Props.Create(() => new ScriptLogSignalRBridge(hub, broadcaster));

    /// <summary>Initializes a new instance of the <see cref="ScriptLogSignalRBridge"/> class.</summary>
    /// <param name="hub">The SignalR hub context for sending messages to clients.</param>
-    public ScriptLogSignalRBridge(IHubContext<ScriptLogHub> hub)
+    /// <param name="broadcaster">In-process fan-out read directly by the Blazor Server Script log page.</param>
+    public ScriptLogSignalRBridge(IHubContext<ScriptLogHub> hub, IInProcessBroadcaster<ScriptLogEntry> broadcaster)
    {
        _hub = hub;
+        _broadcaster = broadcaster;
        ReceiveAsync<ScriptLogEntry>(ForwardAsync);
        Receive<SubscribeAck>(_ => { /* DPS confirmation */ });
    }
@@ -37,6 +41,9 @@ public sealed class ScriptLogSignalRBridge : ReceiveActor

    private async Task ForwardAsync(ScriptLogEntry msg)
    {
+        // In-process fan-out first — this is what the Blazor Server Script log page reads. The hub
+        // push is kept for any out-of-process (e.g. WASM) SignalR client.
+        _broadcaster.Publish(msg);
        try
        {
            await _hub.Clients.All.SendAsync(ScriptLogHub.MethodName, msg);
--- a/Show More
+++ b/Show More