feat(drivers): tag-set drift detection, gated on SupportsOnlineDiscovery

The second thing #516/§8.2 deliberately did not build. The original objection stands — Modbus, S7, MQTT, AbLegacy and Sql echo authored config from DiscoverAsync, so diffing discovered against authored is a tautology for them — but it is now ENCODED rather than used as a reason not to build. The discriminator already existed: ITagDiscovery.SupportsOnlineDiscovery is documented as "enumerates the tag set from the live backend rather than replaying pre-declared/authored tags", and it separates the fleet cleanly — FOCAS, TwinCAT, MTConnect and AbCip true; the five config-echo drivers explicitly false. The check runs only for a driver that is SupportsOnlineDiscovery AND reports the new AuthoredDiscoveryRefs. That is nullable rather than empty-by-default on purpose: an empty collection legitimately means "nothing authored, everything discovered is new", so conflating the two would report total drift for a driver that never opted in. Where the value is: AbCip and FOCAS browse a live backend but implement no IRediscoverable, so before this they had no change signal at all. A periodic compare is the only way to notice a PLC re-download. A finding that changed the design: FOCAS, TwinCAT and AbCip all re-emit their authored tags into the same DiscoverAsync stream as device-derived ones, so the browse picker can show an operator their existing tags. Discovered is therefore always a superset of authored, and a VANISHED tag can never appear missing — one whole direction is structurally undetectable for three of the four. Shipping a Vanished list that is permanently empty for them would have been the half-inert seam this whole exercise removes. So the driver declares DiscoveryStreamIncludesAuthoredTags, the detector does not compute the undetectable half, and the operator message says "missing-tag detection unavailable for this driver" rather than letting the absence of a missing-tag clause read as reassurance. MTConnect is the only driver where both directions work — its stream is purely probe-model-derived. Behaviour: a failed browse is not drift (an unreachable device would otherwise report every authored tag as vanished); a truncated capture is skipped for the same reason; an unchanged drift is reported once rather than re-stamping its timestamp; drift that resolves clears the prompt. Interval defaults to 5 minutes — it browses a real device, and a tag set changing is an engineering event, not a runtime one. It reuses the Stage-2 surfacing, raising the same /hosts re-browse prompt, and never rebuilds the served address space. Comparison logic is a pure, separately-tested type rather than actor-inline. 14 new tests. The gate was verified load-bearing by deleting the SupportsOnlineDiscovery half: the tautology-driver test goes red, and it asserts discovery was never invoked rather than merely "no prompt raised", which would have passed for the wrong reason if the timer never fired. Full suite green except the same three pre-existing fixture-gated integration suites, identical counts.
fix(drivers): complete the Sql + FOCAS in-place config re-parse (#516 )
2026-07-28 00:48:39 -04:00 · 2026-07-28 00:30:52 -04:00 · 2026-07-27 19:54:41 -04:00 · 2026-07-27 19:52:02 -04:00 · 2026-07-27 19:32:46 -04:00 · 2026-07-27 18:57:09 -04:00
427 changed files with 74903 additions and 5198 deletions
@@ -58,3 +58,6 @@ lib/
 # Session working notes — never stage (pending.md's own hard rule; R2-12/U-4)
 /pending.md
 /current.md
+
+# Subagent-driven-development git worktrees
+.worktrees/
@@ -55,6 +55,28 @@ about OtOpcUa changes here — remote/push status, the driver set, the Galaxy da
 shared-lib consumption, or per-project commands — update the **OtOpcUa entry in
 `../scadaproj/CLAUDE.md`** in the same change so the index never drifts from this repo.

+**The index edit belongs on `scadaproj`'s `main`, and must be pushed.** `scadaproj` is a
+separate repo with its own checkout, so committing there inherits whatever branch it
+happens to be on — which is usually *not* `main` and is often an unrelated feature branch
+with no upstream. That silently drifts the index for as long as that branch stays
+unmerged, which is the exact failure the rule above exists to prevent. Do this explicitly:
+
+```bash
+cd ~/Desktop/scadaproj
+git rev-parse --abbrev-ref HEAD            # note it, to restore afterwards
+git stash list                             # never commit onto a dirty unrelated branch
+git checkout main && git pull
+#   …edit the OtOpcUa entry in CLAUDE.md…
+git commit -am "docs(index): <what changed about OtOpcUa>"
+git push origin main
+git checkout -                             # restore the original branch
+```
+
+Observed 2026-07-27: the `Sql` poll driver's index entry had sat unpushed on an unrelated
+feature branch since 2026-07-24 because it was committed onto the current checkout, so the
+index disagreed with reality for three days despite this rule. If you find index commits
+stranded on a feature branch, cherry-pick them onto `main` rather than merging that branch.
+
 ## Architecture Overview

 ### Data Flow
@@ -131,7 +153,71 @@ Galaxy `mx_data_type` values map to OPC UA types (Boolean, Int32, Float, Double,

 ### Change Detection

-`DeployWatcher` (`src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy/Browse/DeployWatcher.cs`) polls the gateway's deploy-event signal and raises `IRediscoverable.OnRediscoveryNeeded` when the Galaxy redeploys. The server's `DriverHost` consumes the signal and rebuilds the address space.
+`DeployWatcher` (`src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy/Browse/DeployWatcher.cs`) polls the gateway's deploy-event signal and raises `IRediscoverable.OnRediscoveryNeeded` when the Galaxy redeploys.
+
+**The signal is consumed as an operator prompt, not as an address-space rebuild** (§8.2, 2026-07-27).
+`DriverInstanceActor` subscribes in `PreStart` and unsubscribes in `PostStop` — the detach is
+load-bearing, because the `IDriver` instance outlives the actor when the host respawns a child around
+the same driver object. A raise is recorded and rides the driver-health snapshot
+(`DriverHealthChanged.RediscoveryNeededUtc` / `.RediscoveryReason`) to the AdminUI `/hosts` page as a
+**"re-browse" chip**.
+
+⚠️ **It is advisory: a Galaxy redeploy still does NOT change the served address space.** v3 authors raw
+tags explicitly through the `/raw` browse-commit flow, so an operator must re-browse the device and
+commit. Injecting nodes at runtime would materialise nodes nobody approved and no deployment artifact
+records.
+
+Two gotchas if you touch this:
+
+- `PublishHealthSnapshot` dedups on a health fingerprint. The rediscovery timestamp **must** stay in
+  that tuple, or a raise on an otherwise-unchanged Healthy driver is swallowed and never reaches the
+  operator. Pinned by `DriverInstanceActorRediscoverySignalTests`.
+- The shared test `StubDriver.GetHealth()` returns `DateTime.UtcNow`, so its fingerprint differs on
+  every call and the dedup never engages — a test built on it passes vacuously. The rediscovery tests
+  use a stub with stable health for exactly this reason.
+
+**#507 is closed as superseded, and the injection path is deleted.** Its retained code read
+`EquipmentNode.DriverInstanceId` and `EquipmentTags`, both *structurally empty* in v3
+(`AddressSpaceComposer.cs`, `DeploymentArtifact.cs`), so removing the guard would have changed a log
+line and injected nothing. Gone with it: `HandleDiscoveredNodes`, `PartitionDiscoveredByDeviceHost`,
+`ApplyDiscoveredPlansForDriver`, the redeploy re-inject tail, `DiscoveredNodeMapper`,
+`AddressSpaceApplier.MaterialiseDiscoveredNodes`, the connect-time discovery loop
+(`StartDiscovery`/`RediscoverTick`/`DiscoveredNodesReady`/`TriggerRediscovery`), and the 18
+`DiscoveryInjectionDormantV3` tests — v2 characterization tests asserting an equipment-rooted graft
+(`EquipmentRootNodeId == "EQ-1"`) that v3 cannot produce. `ITagDiscovery` itself stays: the `/raw`
+browse picker drives it through `Commons/Browsing/DiscoveryDriverBrowser`, which never went through
+the actor.
+
+**Tag-set drift detection (2026-07-28) — the second signal, and it is GATED.** `DriverInstanceActor`
+re-browses on a slow timer (`DefaultDriftCheckInterval`, 5 min) and compares what the remote offers
+against what an operator authored, raising the same re-browse prompt. This matters most for **AbCip and
+FOCAS**, which browse a live backend but implement no `IRediscoverable`, so a periodic compare is their
+only way to notice a PLC re-download.
+
+⚠️ **It runs ONLY for a driver declaring `ITagDiscovery.SupportsOnlineDiscovery` AND reporting
+`AuthoredDiscoveryRefs` (nullable, default null = opt out).** Modbus, S7, MQTT, AbLegacy and Sql *echo
+authored config* from `DiscoverAsync` rather than browsing the device, so the diff for them is a
+tautology that would report "no drift" forever and read as coverage. A check that cannot fail is worse
+than no check. Note `AuthoredDiscoveryRefs` is **nullable, not empty-by-default** — an empty collection
+legitimately means "nothing authored, so everything discovered is new".
+
+⚠️ **One direction is structurally undetectable for most drivers.** FOCAS, TwinCAT and AbCip re-emit
+their authored tags into the same `DiscoverAsync` stream as device-derived ones (so the browse picker
+shows existing tags), which means discovered ⊇ authored **always** and a *vanished* tag can never appear
+missing. Those drivers declare `DiscoveryStreamIncludesAuthoredTags => true`, and the detector then
+reports only what it can see and **says so** in the operator message rather than implying a clean bill of
+health. **MTConnect is currently the only driver where both directions are detectable** — its stream is
+built purely from the Agent's probe model.
+
+Other properties worth knowing: a **failed browse is not drift** (an unreachable device would otherwise
+report every authored tag as vanished); a **truncated** capture is skipped for the same reason; an
+**unchanged** drift is reported once rather than re-stamping its timestamp every 5 min; and drift that
+resolves **clears** the prompt. The timer starts on Connected entry and is cancelled on every exit.
+
+⚠️ **`IHostConnectivityProbe` is still unconsumed.** `GetHostStatuses()` has no production call site and
+nothing ever writes a `DriverHostStatus` row (the table was re-created in the v3 initial migration, so
+confirm intent before deleting). The separable `OnHostStatusChanged` event is the useful half. Tracked
+as Gitea **#521**.

 ## mxaccessgw

@@ -168,13 +254,29 @@ central SQL Server.
 > recipes (S7 blackhole, GLAuth outage, HistorianGateway LiveIntegration), the integration-test
 > harness, the docker-dev rig, and the deploy setup. Start there; the sections below + `docs/v2/dev-environment.md` carry the detail.

-> **Migrated 2026-04-28**: Docker config + host moved off this dev VM (DESKTOP-6JL3KKO) onto the shared Linux Docker host (`DOCKER`, 10.100.0.35) so the dev VM could shed WSL2/Hyper-V and have its GPU re-attached via ESXi passthrough. Docker Desktop is no longer installed here. All checked-in `appsettings.json` defaults, fixture-class default endpoints, and `e2e-config.sample.json` were rewritten to target `10.100.0.35`. The driver fixture compose files under `tests/.../Docker/docker-compose.yml` now carry a `project: lmxopcua` label on every service. See `docs/v2/dev-environment.md` for the full rewrite (header dated 2026-04-28).
+> **Migrated 2026-04-28**: Docker config + host moved off this dev VM (DESKTOP-6JL3KKO) onto the shared Linux Docker host (`DOCKER`, 10.100.0.35) so the dev VM could shed WSL2/Hyper-V and have its GPU re-attached via ESXi passthrough. Docker Desktop is no longer installed here. All checked-in `appsettings.json` defaults, fixture-class default endpoints, and `e2e-config.sample.json` were rewritten to target `10.100.0.35`. See `docs/v2/dev-environment.md` for the full rewrite (header dated 2026-04-28).
+
+> ⚠️ **The `project: lmxopcua` label is aspirational, not universal.** This note used to claim every fixture compose file carries it. As of 2026-07-24 only the **MQTT** fixture actually does — `grep -rn "labels:" tests --include=*.yml` matches `Driver.Mqtt.IntegrationTests/Docker/docker-compose.yml` and nothing else. So `docker ps --filter label=project=lmxopcua` returns the MQTT fixture alone, not the fleet. Add the label when you touch an older fixture; until then enumerate by container name.

 Docker workloads run on a shared Linux host at **`10.100.0.35`** — not on this VM. Stacks live at `/opt/otopcua-<driver>/` on the host and carry the `project=lmxopcua` label so they're discoverable via `docker ps --filter label=project=lmxopcua`.

-**`docker -H ssh://...` does NOT work from this VM.** Windows OpenSSH ↔ docker.exe stdio bridging hangs (`docker system dial-stdio` runs server-side but no API data flows). Use the helper below — it SSHes into the docker host and runs `docker compose` server-side.
+**`docker -H ssh://...` does NOT work from the Windows VM.** Windows OpenSSH ↔ docker.exe stdio bridging hangs (`docker system dial-stdio` runs server-side but no API data flows). Use the helper below — it SSHes into the docker host and runs `docker compose` server-side.

-**Use `lmxopcua-fix.ps1` (in `~/bin`) to control fixtures from this VM:**
+> **On macOS there is no `lmxopcua-fix` — drive the host over SSH directly.** The helper is a Windows-VM
+> script; `~/bin` is empty on the Mac and the commands below will not resolve. Use passwordless SSH
+> (and `rsync` in place of `sync`), which is what `infra/README.md` §1 documents as the Mac path:
+>
+> ```bash
+> ssh dohertj2@10.100.0.35 'docker ps --format "{{.Names}}\t{{.Status}}"'
+> ssh dohertj2@10.100.0.35 'cd /opt/otopcua-mqtt && docker compose up -d'
+> rsync -av tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/Docker/ \
+>     dohertj2@10.100.0.35:/opt/otopcua-mqtt/          # the `sync` step, by hand
+> ```
+>
+> A local container runtime *does* exist on the Mac (OrbStack), so the `docker-dev/` rig itself runs
+> locally there — it is only the shared **fixtures** that live on `10.100.0.35`.
+
+**Use `lmxopcua-fix.ps1` (in `~/bin`) to control fixtures from the Windows VM:**

 ```powershell
 lmxopcua-fix ls                            # list all lmxopcua-tagged containers on the host
@@ -195,6 +297,16 @@ lmxopcua-fix sync modbus                   # rsync this repo's tests/.../Docker/
 - AB CIP: `10.100.0.35:44818` (`AB_SERVER_ENDPOINT`)
 - S7: `10.100.0.35:1102` (`S7_SIM_ENDPOINT`)
 - OPC UA reference (opc-plc): `opc.tcp://10.100.0.35:50000` (`OPCUA_SIM_ENDPOINT`)
+- MQTT (Mosquitto, **auth on both listeners — no anonymous fallback**): `10.100.0.35:8883` TLS+auth
+  (`MQTT_FIXTURE_ENDPOINT`) · `10.100.0.35:1883` plaintext-but-authenticated (`MQTT_FIXTURE_PLAIN_ENDPOINT`).
+  Also needs `MQTT_FIXTURE_USERNAME` / `MQTT_FIXTURE_PASSWORD`, and `MQTT_FIXTURE_CA_CERT` to pin the
+  fixture CA (`scp dohertj2@10.100.0.35:/opt/otopcua-mqtt/secrets/ca.crt`). A co-running publisher loops
+  JSON under `otopcua/fixture/…`.
+- MQTT **Sparkplug B**: the same broker, plus the `sparkplug` compose profile's `otopcua-sparkplug-sim`
+  (project-owned C# edge-node simulator) — group **`OtOpcUaSim`**, edge nodes **`EdgeA`**/**`EdgeB`**,
+  `EdgeA` device **`Filler1`**, ~2 s cadence. It subscribes to `spBv1.0/OtOpcUaSim/NCMD/{node}` and
+  re-births on request. **Births are never retained**, so `docker restart otopcua-sparkplug-sim` is how
+  you force a fresh one while a browse window is open.

 Override any endpoint via the env var to point at a real PLC. The local OtOpcUa server runs on this VM at `opc.tcp://localhost:4840` — **that's not on the docker host**.

@@ -221,18 +333,20 @@ The server supports non-transparent warm/hot redundancy via the `Redundancy` sec

 **Two corrections landed 2026-07-21 — both were total-outage or wrong-node defects, and both are worth knowing before touching this area.**

- **Downing is `auto-down`, not `keep-oldest`.** `Cluster:SplitBrainResolverStrategy` (default `auto-down`) selects the provider via `ServiceCollectionExtensions.BuildDowningHocon`; an unknown value fails host start. A two-node pair running the previous `keep-oldest` + `down-if-alone` **could not survive a crash of the oldest node**: Akka's `KeepOldest.OldestDecision` only lets `down-if-alone` rescue a side holding ≥ 2 members, so the 1-vs-1 survivor downs *itself* and exits. `down-if-alone` is a 3+-node feature. The accepted trade for `auto-down` is dual-active during a genuine network partition. **Its live gate is still open** — the pathology only appears 1-vs-1 and docker-dev is a single six-node mesh, so the crash-the-oldest drill is deferred to the per-cluster mesh work.
+- **Downing is `auto-down`, not `keep-oldest`.** `Cluster:SplitBrainResolverStrategy` (default `auto-down`) selects the provider via `ServiceCollectionExtensions.BuildDowningHocon`; an unknown value fails host start. A two-node pair running the previous `keep-oldest` + `down-if-alone` **could not survive a crash of the oldest node**: Akka's `KeepOldest.OldestDecision` only lets `down-if-alone` rescue a side holding ≥ 2 members, so the 1-vs-1 survivor downs *itself* and exits. `down-if-alone` is a 3+-node feature. The accepted trade for `auto-down` is dual-active during a genuine network partition. **Its live gate is CLOSED** — Phase 7 drill D4 (2026-07-24) ran the 1-vs-1 crash-the-oldest survival drill on the three-mesh docker-dev rig and every survivor stayed Up, never self-downing (`c50ebcf7`; `docs/plans/2026-07-24-mesh-phase7-failover-drills.md`).
 - **The Primary is the oldest Up `driver` member, not the role leader.** `RedundancyStateActor` previously used `ClusterState.RoleLeader("driver")` (lowest *address*), while `ClusterSingletonManager` places singletons on the *oldest*. They agree only on a freshly-formed cluster and diverge after any restart, so the Primary-gated data plane (writes, alarm acks, alerts emit, alarm-history drain) could enable on a node not hosting the singletons. `NodeRedundancyState.IsRoleLeaderForDriver` was renamed **`IsDriverPrimary`**.

 **A third bootstrap gap closed 2026-07-22 — downing was never the whole story, and the fix changed twice.** Even under `auto-down`, a node cold-starting while its peer was dead **never came Up**: Akka runs `FirstSeedNodeProcess` — the only bootstrap path that can form a *new* cluster when no peer answers `InitJoin` — exclusively when `seed-nodes[0]` is the node’s own address; every other node runs `JoinSeedNodeProcess` and retries `InitJoin` forever. **`Cluster:SeedNodes` is therefore ORDERED: every node that is one of its own seeds lists ITSELF first, partner second** (docker-dev `central-2` was swapped; site nodes list only `central-1` and are legitimately not seeds). `AkkaClusterOptionsValidator` (`AddValidatedOptions`/`ValidateOnStart` in `AddOtOpcUaCluster`) enforces it at boot — **conditionally** (self must be entry 0 only *if* self is in the list, or every site node would refuse to start), matching on `PublicHostname`+`Port`, never the `0.0.0.0` bind address. The earlier fix — a `Cluster:SelfFormAfter` timer calling `Cluster.Join(SelfAddress)` — is **deleted**: it sat outside Akka’s join handshake, so it could not tell "no seed answered" from "a seed answered and the join is in flight", and it islanded a manually-failed-over node live before a TCP reachability guard patched that one shape. Pinned by `SelfFirstSeedBootstrapTests` (real in-process clusters, incl. a falsifiability control proving peer-first ordering never forms) + `AkkaClusterOptionsValidatorTests`. See `docs/Redundancy.md` §"Bootstrap: self-first seed ordering".

+**Simultaneous cold-start splits — the bootstrap guard closes it (opt-in, `Cluster:BootstrapGuard:Enabled`, default OFF).** Self-first on BOTH nodes means when both cold-start at the same instant, each runs `FirstSeedNodeProcess`, times out, and forms its OWN 1-node cluster → two Primaries in one pair (the Phase 6 live gate reproduced this on docker; two separate clusters do NOT auto-merge). The guard prevents it without losing cold-start-alone: the lexicographically **lower** `host:port` node is the preferred founder (self-first, forms immediately); the **higher** node TCP-probes the partner's Akka port up to `PartnerProbeSeconds` (25s) — **reachable ⇒ peer-first (join the founder)**, **unreachable ⇒ self-first (partner dead, form alone)**. The order is chosen BEFORE the single `JoinSeedNodes`, from an explicit reachability signal — it never re-forms mid-handshake (the `SelfFormAfter` failure mode). When on, Akka gets NO config seeds (`BuildClusterOptions` empties `ClusterOptions.SeedNodes`) and `ClusterBootstrapCoordinator` drives the join. Residual trade (accepted, operator-visible via a warning + restart-recovers): the higher node hangs if the founder dies in the probe→join window. docker-dev: **site-a = guard demo** (guard on, serialization removed); **site-b = A/B control** (guard off, `depends_on: service_healthy` serialization). The guard is the production-faithful fix (compose `depends_on` doesn't exist on real VMs). Pinned by `ClusterBootstrapGuardTests` + `ClusterBootstrapCoordinatorTests` (real 2-node clusters, incl. the higher-node-cold-start-alone case). See `docs/Redundancy.md` §"Bootstrap guard".
+
 Assert the **effective** cluster config off a running `ActorSystem` (as `SplitBrainResolverActivationTests` does), never the typed options or the akka.conf text — several HOCON fragments compete and the losing one still reads correctly in the file.

 **RESOLVED by per-cluster mesh Phase 6 (2026-07-24) — no longer per-Akka-cluster.** The "one Primary across the whole Akka mesh" limitation described above is gone; see the Phase 6 paragraph immediately below.

 **Per-cluster mesh Phase 6 (2026-07-24) — the fleet is now three independent 2-node meshes, not one.** The single fleet-wide Akka mesh was split into one mesh per application `Cluster`: the central pair (`admin,driver,cluster-MAIN`), site-a (`driver,cluster-SITE-A`), site-b (`driver,cluster-SITE-B`) — same `ActorSystem` name, separated purely by per-pair self-first seeds (each node's `Cluster:SeedNodes` lists itself first, its own pair partner second, never a node from another cluster's pair). Consequences:

- **The redundancy singleton is cluster-scoped and spawned per driver node.** `RedundancyStateActor` is now a `cluster-{ClusterId}`-scoped singleton (falls back to plain `driver` for a legacy node), so each pair elects and publishes its **own** Primary on its own mesh's DPS. **Two or more Primaries exist fleet-wide, one per pair — by design, not a bug.**
+- **The redundancy singleton is cluster-scoped and spawned per driver node.** `RedundancyStateActor` is now a `cluster-{ClusterId}`-scoped singleton (falls back to plain `driver` for a legacy node), so each pair elects and publishes its **own** Primary on its own mesh's DPS. **Two or more Primaries exist fleet-wide, one per pair — by design, not a bug.** ⚠️ **Wiring landmine (fixed `3a4ed8dd`, caught by the live gate):** the singleton's cluster-role *scope* is computed at `AddAkka`-configurator time, so it must come from `AkkaClusterOptions` (config) — **never** by resolving `IClusterRoleInfo` from the SP there. `ClusterRoleInfo` depends on the `ActorSystem`, and that lambda runs *while the ActorSystem is being built*, so resolving it recurses into ActorSystem construction and **stack-overflows every node at boot** (compiles clean; the rehome tests passed a hand-built fake straight into the extension, mocking around the composition-root line). Keep `WithOtOpcUaClusterRedundancySingleton`/`BuildClusterRedundancySingletonOptions` taking `AkkaClusterOptions`.
 - `ClusterNodeAddressReconciler` is **own-cluster-scoped** — an admin node can only reconcile `ClusterNode` rows in its own cluster; it has no gossip visibility into another mesh.
 - `CentralCommunicationActor` creates **one `ClusterClient` per application `Cluster`** and fans commands across them (closing the `TODO(Phase 6)` Phase 2 left behind), rather than one fleet-wide client.
 - **`SplitTopologyTransportValidator` fails host start** on a node carrying a `cluster-{ClusterId}` role unless it also runs the split-safe transports: `MeshTransport:Mode=ClusterClient`, `Telemetry:Mode=Grpc` (driver), `TelemetryDial:Mode=Grpc` (admin). A DPS transport on a cluster-role node would try to gossip across a partition that no longer exists.
@@ -330,7 +444,7 @@ Flip only the site nodes with `OTOPCUA_CONFIG_MODE=FetchAndCache` at `docker com

 ## Live telemetry transport (`Telemetry` / `TelemetryDial`)

-Per-cluster mesh **Phase 5** (code-complete on `feat/mesh-phase5`, live gate pending) added a second
+Per-cluster mesh **Phase 5** (merged `35552a96`; live gate PASSED `f134935f`) added a second
 transport for the four live-observability channels the AdminUI's `/alerts`, `/script-log`, and
 `/hosts` panels feed on, selected by `Telemetry:Mode` (node/serve side) and `TelemetryDial:Mode`
 (central/dial side): `Dps` — the four existing DPS SignalR bridges, **the default**, today's
@@ -440,7 +554,8 @@ unaffected (it keeps ConfigDb via its admin role). Consequences:
 - **Scripted-alarm Part 9 condition state moved to LocalDb.** `LocalDbAlarmConditionStateStore`
  (replicated `alarm_condition_state` table, pair-local like the Phase-2 alarm S&F buffer) replaces
  `EfAlarmConditionStateStore` on every driver-role node, fused central included. The DB-backed
-  `ScriptedAlarmState` table is now unused (dropping it is a deferred follow-up, tracked as Task 9).
+  `ScriptedAlarmState` table **was dropped** (Task 9, `3a590a0c`, migration
+  `20260723183050_DropScriptedAlarmStateTable`); `EfAlarmConditionStateStore` is deleted.
 - **Central persists deploy acks.** `DriverHostActor` no longer writes `NodeDeploymentState` to SQL on
  a driver-only node — `ConfigPublishCoordinator.PersistNodeAck` (already fed by every ApplyAck) is
  the system of record.
@@ -449,8 +564,8 @@ unaffected (it keeps ConfigDb via its admin role). Consequences:
  `OtOpcUaGroupRoleMapper` falls back to the `Security:Ldap:GroupToRole` appsettings baseline only —
  the same rows a driver node never received via config either, so this is not a regression.

-Code-complete on `feat/mesh-phase4`; the table-drop (Task 9) and the live gate (Task 10) are still
-open. See `docs/plans/2026-07-23-mesh-phase4-cut-driver-configdb.md` and
+Merged to master (`26fad75c`); **live gate PASSED** (`1281aebf` — driver nodes run ConfigDb-free) and
+Task 9 landed (`3a590a0c`). See `docs/plans/2026-07-23-mesh-phase4-cut-driver-configdb.md` and
 `docs/plans/2026-07-22-per-cluster-mesh-program.md` §Phase 4.

 ## LDAP Authentication
@@ -75,8 +75,26 @@
    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
    <PackageVersion Include="Microsoft.Playwright" Version="1.51.0" />
    <PackageVersion Include="Moq" Version="4.20.72" />
+    <!--
+      MQTT client for the Mqtt / Sparkplug B driver. MQTTnet v5 is the first line shipping a
+      net10.0 TFM (lib/net10.0, and an EMPTY net10.0 dependency group — zero transitive
+      packages, so it cannot participate in a diamond under this repo's deliberately-OFF
+      CentralPackageTransitivePinningEnabled). Sparkplug B payloads are hand-rolled rather than
+      taken from SparkplugNet, whose newest release (1.3.10) still pins MQTTnet 4.3.6.1152 and
+      ships net6.0/net8.0 only.
+    -->
+    <PackageVersion Include="MQTTnet" Version="5.2.0.1603" />
+    <!-- Driver.MTConnect carries NO backend NuGet. The TrakHound MTConnect.NET-Common/-HTTP pins
+         Task 0 added were removed in Task 7 (2026-07-24): neither package can parse an MTConnect
+         document (the XML formatter ships in a third, unreferenced package) nor frame the /sample
+         multipart stream socket-free. The driver uses HttpClient + System.Xml.Linq only. See the
+         Task 0 CORRECTION block in docs/plans/2026-07-24-mtconnect-driver.md. -->
    <PackageVersion Include="Novell.Directory.Ldap.NETStandard" Version="3.6.0" />
    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Client" Version="1.5.378.106" />
+    <!-- Core carries Opc.Ua.StatusCodes, the oracle StatusCodeParityTests checks the drivers'
+         hard-coded uint constants against. Referenced by that TEST project only — the drivers
+         themselves stay SDK-free by design and keep spelling status codes as bare uints. -->
+    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Core" Version="1.5.378.106" />
    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Configuration" Version="1.5.378.106" />
    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Server" Version="1.5.378.106" />
    <!-- OpenTelemetry.Api < 1.15.3 has GHSA-g94r-2vxg-569j (header-parsing memory DoS). The trio
@@ -140,7 +158,7 @@
    <PackageVersion Include="xunit" Version="2.9.3" />
    <PackageVersion Include="xunit.runner.visualstudio" Version="3.0.2" />
    <PackageVersion Include="xunit.v3" Version="1.1.0" />
-    <PackageVersion Include="ZB.MOM.WW.Health" Version="0.1.0" />
+    <PackageVersion Include="ZB.MOM.WW.Health" Version="0.3.0" />
    <!--
      LocalDb: embedded SQLite node-local cache + optional 2-node gRPC replication. The core
      package floors the native SQLitePCLRaw.lib.e_sqlite3 at 2.1.12, so consumers inherit the
@@ -148,8 +166,8 @@
    -->
    <PackageVersion Include="ZB.MOM.WW.LocalDb" Version="0.1.3" />
    <PackageVersion Include="ZB.MOM.WW.LocalDb.Replication" Version="0.1.3" />
-    <PackageVersion Include="ZB.MOM.WW.Health.Akka" Version="0.1.0" />
-    <PackageVersion Include="ZB.MOM.WW.Health.EntityFrameworkCore" Version="0.1.0" />
+    <PackageVersion Include="ZB.MOM.WW.Health.Akka" Version="0.3.0" />
+    <PackageVersion Include="ZB.MOM.WW.Health.EntityFrameworkCore" Version="0.3.0" />
    <PackageVersion Include="ZB.MOM.WW.Telemetry" Version="0.1.0" />
    <PackageVersion Include="ZB.MOM.WW.Telemetry.Serilog" Version="0.1.0" />
    <PackageVersion Include="ZB.MOM.WW.MxGateway.Client" Version="0.1.1" />
@@ -1,6 +1,6 @@
 # OtOpcUa

-OPC UA server (.NET 10 AnyCPU) that exposes a fleet of industrial drivers as a single OPC UA address space. Drivers ship in-process for AVEVA System Platform Galaxy (via the sibling `mxaccessgw` repo), Modbus TCP, Siemens S7, Allen-Bradley CIP (ControlLogix / CompactLogix), Allen-Bradley Legacy (SLC 500 / MicroLogix), Beckhoff TwinCAT (ADS), FANUC FOCAS, and OPC UA Client (gateway).
+OPC UA server (.NET 10 AnyCPU) that exposes a fleet of industrial drivers as a single OPC UA address space. Drivers ship in-process for AVEVA System Platform Galaxy (via the sibling `mxaccessgw` repo), Modbus TCP, Siemens S7, Allen-Bradley CIP (ControlLogix / CompactLogix), Allen-Bradley Legacy (SLC 500 / MicroLogix), Beckhoff TwinCAT (ADS), FANUC FOCAS, OPC UA Client (gateway), and MQTT (broker subscribe; Sparkplug B in progress).

 A cross-platform client stack (.NET 10) — shared library, CLI, and Avalonia desktop app — connects to any OPC UA server.

@@ -15,7 +15,7 @@ A cross-platform client stack (.NET 10) — shared library, CLI, and Avalonia de
                    |   address space + capability fan-out|
                    +-------------------------------------+
                    |    |    |    |    |    |    |    |
-              Galaxy  Modbus  S7  AbCip AbLeg TwinCAT FOCAS OpcUaClient
+          Galaxy Modbus S7 AbCip AbLeg TwinCAT FOCAS OpcUaClient MQTT
                |
                v
       mxaccessgw (sibling repo, gRPC)
@@ -91,7 +91,7 @@ See [docs/Client.CLI.md](docs/Client.CLI.md) and [docs/Client.UI.md](docs/Client
 |---|---|
 | Driver specs (per-driver capability surface, config, addressing) | [docs/v2/driver-specs.md](docs/v2/driver-specs.md) |
 | Galaxy driver | [docs/drivers/Galaxy.md](docs/drivers/Galaxy.md) |
-| Modbus / S7 / AbCip / AbLegacy / TwinCAT / FOCAS / OpcUaClient | [docs/drivers/](docs/drivers/) |
+| Modbus / S7 / AbCip / AbLegacy / TwinCAT / FOCAS / OpcUaClient / MQTT | [docs/drivers/](docs/drivers/) |
 | Galaxy parity rig (mxaccessgw setup) | [docs/v2/Galaxy.ParityRig.md](docs/v2/Galaxy.ParityRig.md) |
 | Galaxy performance + tracing | [docs/v2/Galaxy.Performance.md](docs/v2/Galaxy.Performance.md) |

@@ -29,6 +29,11 @@
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ZB.MOM.WW.OtOpcUa.Driver.Modbus.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts.csproj" />
+    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/ZB.MOM.WW.OtOpcUa.Driver.Sql.csproj" />
+    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.csproj" />
+    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts.csproj" />
+    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.csproj" />
+    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7/ZB.MOM.WW.OtOpcUa.Driver.S7.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts/ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/ZB.MOM.WW.OtOpcUa.Driver.AbCip.csproj" />
@@ -42,6 +47,9 @@
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.csproj" />
+    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.csproj" />
+    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts.csproj" />
+    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser.csproj" />
  </Folder>
  <Folder Name="/src/Drivers/Driver CLIs/">
    <Project Path="src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common.csproj" />
@@ -90,6 +98,11 @@
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing.Tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing.Tests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.csproj" />
+    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests.csproj" />
+    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.Tests/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.Tests.csproj" />
+    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.Sql.IntegrationTests.csproj" />
+    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Tests/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Tests.csproj" />
+    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7.Tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Tests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.S7.IntegrationTests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests.csproj" />
@@ -104,6 +117,9 @@
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.Tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.Tests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.IntegrationTests.csproj" />
+    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests.csproj" />
+    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests.csproj" />
+    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/SparkplugSimulator/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.SparkplugSimulator.csproj" />
  </Folder>
  <Folder Name="/tests/Drivers/Driver CLIs/">
    <Project Path="tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common.Tests/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common.Tests.csproj" />
@@ -9,78 +9,110 @@
    },
    {
      "id": 1,
-      "subject": "RED: connect-timeout regression tests T1+T3 (read/write degrade instead of throwing OCE) — must FAIL at f6eaa267",
+      "subject": "RED: connect-timeout regression tests T1+T3 (read/write degrade instead of throwing OCE) \u2014 must FAIL at f6eaa267",
      "status": "completed",
-      "blockedBy": [0]
+      "blockedBy": [
+        0
+      ]
    },
    {
      "id": 2,
      "subject": "RED: poll-loop-survival test T2 (subscription survives connect-timeout outage) + caller-cancel pinning test T4",
      "status": "completed",
-      "blockedBy": [0, 1]
+      "blockedBy": [
+        0,
+        1
+      ]
    },
    {
      "id": 3,
      "subject": "GREEN: EnsureConnectedAsync + InitializeAsync connect-timeout OCE -> TimeoutException conversion (STAB-14 root fix)",
      "status": "completed",
-      "blockedBy": [1, 2]
+      "blockedBy": [
+        1,
+        2
+      ]
    },
    {
      "id": 4,
      "subject": "Defensive when-filters on ensure-wrapper OCE rethrows (:488/:1000) + poll-loop OCE catches (:1383/:1396/:1404)",
      "status": "completed",
-      "blockedBy": [3]
+      "blockedBy": [
+        3
+      ]
    },
    {
      "id": 5,
      "subject": "Finding-1 close gate: full S7 unit + CLI test-project sweep green",
      "status": "completed",
-      "blockedBy": [4]
+      "blockedBy": [
+        4
+      ]
    },
    {
      "id": 6,
-      "subject": "RED: framing-fault classification Theory T5 (TPKT/TPDU/WrongNumberOfBytes/PlcException-WrongNumberReceivedBytes reopen) — must FAIL",
+      "subject": "RED: framing-fault classification Theory T5 (TPKT/TPDU/WrongNumberOfBytes/PlcException-WrongNumberReceivedBytes reopen) \u2014 must FAIL",
      "status": "completed",
-      "blockedBy": [0]
+      "blockedBy": [
+        0
+      ]
    },
    {
      "id": 7,
      "subject": "GREEN: broaden IsS7ConnectionFatal to the ISO-on-TCP framing surface (NOT InvalidDataException) + xmldoc (STAB-15a)",
      "status": "completed",
-      "blockedBy": [6]
+      "blockedBy": [
+        6
+      ]
    },
    {
      "id": 8,
      "subject": "RED->GREEN: cancellation-during-I/O marks handle dead (T6 read + T7 write; per-item OCE catches set _plcDead before propagating)",
      "status": "completed",
-      "blockedBy": [7]
+      "blockedBy": [
+        7
+      ]
    },
    {
      "id": 9,
      "subject": "RED->GREEN: probe marks handle dead under the gate (T8 persistent probe fault + T9 probe timeout; ProbeLoopAsync inner catch restructure, STAB-15b)",
      "status": "completed",
-      "blockedBy": [8]
+      "blockedBy": [
+        8
+      ]
    },
    {
      "id": 10,
      "subject": "Doc: R2-09 connect-throttle seam note on EnsureConnectedAsync <remarks> (STAB-8 S7 part, note-only)",
      "status": "completed",
-      "blockedBy": [3]
+      "blockedBy": [
+        3
+      ]
    },
    {
      "id": 11,
      "subject": "Env-gated live connect-timeout outage test (S7_TIMEOUT_OUTAGE_START_CMD/STOP_CMD blackhole design; skips cleanly offline)",
-      "status": "deferred-live",
+      "status": "completed",
      "note": "env-gated; runs in serial live pass (integration suite; serialized heavy pass). Test authored + committed; verified it SKIPs cleanly offline.",
-      "blockedBy": [5]
+      "blockedBy": [
+        5
+      ],
+      "closureNote": "LIVE GATE CLOSED 2026-07-15 \u2014 S7 blackhole run via `docker pause` on the 10.100.0.35 s7_1500 fixture. Found + fixed a real read-leg wall-clock gap (PR #453). STATUS.md 'docker-dev live-/run pass'."
    },
    {
      "id": 12,
      "subject": "Close-out: whole-suite sweep + update archreview STATUS.md and 05 prior-finding table (STAB-14/15 FIXED, STAB-8 seam noted)",
      "status": "completed",
      "note": "S7 unit 246/246 green; S7 CLI 48/49 (1 pre-existing unrelated comment-scan failure, see deviations); solution BUILD clean (0 errors). Whole-solution dotnet test NOT run per controller memory-constraint (integration suites deferred to serial heavy pass).",
-      "blockedBy": [5, 7, 8, 9, 10, 11]
+      "blockedBy": [
+        5,
+        7,
+        8,
+        9,
+        10,
+        11
+      ]
    }
  ],
-  "lastUpdated": "2026-07-13"
+  "lastUpdated": "2026-07-27"
 }
@@ -1,25 +1,170 @@
 {
  "planPath": "archreview/plans/R2-02-resilience-config-hardening-plan.md",
  "tasks": [
-    { "id": 0, "subject": "S-6 brick-repro test (RED): parsed timeoutSeconds:0 / breakerFailureThreshold:1 must not brick capability calls — ResilienceConfigBrickTests, expect 2 failures on f6eaa267", "status": "completed", "blockedBy": [] },
-    { "id": 1, "subject": "Add ResiliencePolicyRanges constants to Core.Abstractions (single source of truth for parser/builder/AdminUI, derived from Polly.Core 8.6.6 validation)", "status": "completed", "blockedBy": [] },
-    { "id": 2, "subject": "S-6 parser: clamp timeout/retry/breaker overrides with appending diagnostics (timeout<=0 -> tier default; breaker==1 -> 2; caps) + 8 parser tests", "status": "completed", "blockedBy": [0, 1] },
-    { "id": 3, "subject": "S-6 builder: belt-and-braces clamp in Build so pipeline construction can never throw ValidationException + Build_NeverThrows_ForHostileDirectOptions (turns task 0 green)", "status": "completed", "blockedBy": [0, 1] },
-    { "id": 4, "subject": "S-6 production-wiring guard: DriverCapabilityInvokerFactory.Create with hostile JSON yields a working invoker + logged clamp diagnostic; re-run ResilienceInvokerFactoryRegistrationTests", "status": "completed", "blockedBy": [2, 3] },
-    { "id": 5, "subject": "S-6 AdminUI: ResilienceFormModel.Validate() range messages (via ResiliencePolicyRanges through the transitive Core.Abstractions ref) + warning block in DriverResilienceSection", "status": "completed", "blockedBy": [1] },
-    { "id": 6, "subject": "S-8 parser layer: force Write/AlarmAcknowledge retryCount overrides to 0 with diagnostic (spec invariant, honest dead-knob surfacing) + tests + GetTierDefaults doc", "status": "completed", "blockedBy": [2] },
-    { "id": 7, "subject": "S-8 dispatch layer: flip HandleWriteAsync to isIdempotent:false — RED the DriverInstanceActorResilienceWiringTests expectation first, then flip; full Runtime suite green", "status": "completed", "blockedBy": [6] },
-    { "id": 8, "subject": "S-8/P-4 invoker: cache the no-retry options snapshot once per invoker + add RecordCallStart/Complete tracker accounting to the non-idempotent arm + 2 CapabilityInvokerTests", "status": "completed", "blockedBy": [7] },
-    { "id": 9, "subject": "S-8 docs + form: fix WriteIdempotentAttribute's false 'reads via reflection' claim; note the non-idempotent production default; disable Write/Ack retry cells in the razor", "status": "completed", "blockedBy": [7, 5] },
-    { "id": 10, "subject": "U-6 delete (Core): remove BulkheadMaxConcurrent/MaxQueue from DriverResilienceOptions + parser shape/merge/doc-example; add BulkheadKeys_InStoredJson_AreIgnored (migration-free contract)", "status": "completed", "blockedBy": [2, 6] },
-    { "id": 11, "subject": "U-6 delete (AdminUI): strip bulkhead fields from ResilienceFormModel + the two razor inputs; update ResilienceFormModelTests", "status": "completed", "blockedBy": [5, 10] },
-    { "id": 12, "subject": "U-6 doc sweep (seam xmldocs, OTOPCUA0001 message + analyzer tests, operator docs; leave migrations/WedgeDetector/historical plans) + Options_properties_are_exactly_the_pipeline_wired_set knob-inertness guard", "status": "completed", "blockedBy": [10, 11] },
-    { "id": 13, "subject": "C-7 RED tests: unknown top-level key / unknown capability / unknown per-policy field survive round-trip; malformed JSON sets ParseFailed and ToJson returns the original text", "status": "completed", "blockedBy": [11] },
-    { "id": 14, "subject": "C-7 implement: JsonObject-bag FromJson/ToJson (TagConfigJson idiom), ParseFailed + RawStoredJson, blank->null contract preserved, parser-interop test green", "status": "completed", "blockedBy": [13] },
-    { "id": 15, "subject": "C-7 razor: ParseFailed warning banner + input lockout + explicit discard button; raw pane shows the stored ResilienceConfig; live-/run on docker-dev :9200 (rebuild BOTH centrals; SQL-mangle + unknown-key survival checks; also drive task 5 warnings and task 9 disabled cells)", "status": "deferred-live", "note": "docker-dev :9200 live-/run; serial live pass", "blockedBy": [14] },
-    { "id": 16, "subject": "S-7 builder: add options-generation to PipelineKey + GetOrCreate(optionsGeneration=0) + thread through CapabilityInvoker; StaleGeneration_ReCache_IsNotServed_ToNewGeneration", "status": "completed", "blockedBy": [3] },
-    { "id": 17, "subject": "S-7 factory: Interlocked per-Create generation stamp + Respawn_interleaved_with_old_invoker_call_still_applies_new_options wiring proof; update Invalidate comment (cleanup, not correctness)", "status": "completed", "blockedBy": [16] },
-    { "id": 18, "subject": "Wrap-up: whole-solution build (0 warnings, analyzer silent) + full dotnet test gate; record the pass + the two report anchor drifts in archreview/plans/STATUS.md", "status": "deferred-live", "note": "integration/full sweep; serialized heavy pass", "blockedBy": [4, 8, 9, 12, 15, 17] }
+    {
+      "id": 0,
+      "subject": "S-6 brick-repro test (RED): parsed timeoutSeconds:0 / breakerFailureThreshold:1 must not brick capability calls \u2014 ResilienceConfigBrickTests, expect 2 failures on f6eaa267",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": 1,
+      "subject": "Add ResiliencePolicyRanges constants to Core.Abstractions (single source of truth for parser/builder/AdminUI, derived from Polly.Core 8.6.6 validation)",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": 2,
+      "subject": "S-6 parser: clamp timeout/retry/breaker overrides with appending diagnostics (timeout<=0 -> tier default; breaker==1 -> 2; caps) + 8 parser tests",
+      "status": "completed",
+      "blockedBy": [
+        0,
+        1
+      ]
+    },
+    {
+      "id": 3,
+      "subject": "S-6 builder: belt-and-braces clamp in Build so pipeline construction can never throw ValidationException + Build_NeverThrows_ForHostileDirectOptions (turns task 0 green)",
+      "status": "completed",
+      "blockedBy": [
+        0,
+        1
+      ]
+    },
+    {
+      "id": 4,
+      "subject": "S-6 production-wiring guard: DriverCapabilityInvokerFactory.Create with hostile JSON yields a working invoker + logged clamp diagnostic; re-run ResilienceInvokerFactoryRegistrationTests",
+      "status": "completed",
+      "blockedBy": [
+        2,
+        3
+      ]
+    },
+    {
+      "id": 5,
+      "subject": "S-6 AdminUI: ResilienceFormModel.Validate() range messages (via ResiliencePolicyRanges through the transitive Core.Abstractions ref) + warning block in DriverResilienceSection",
+      "status": "completed",
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 6,
+      "subject": "S-8 parser layer: force Write/AlarmAcknowledge retryCount overrides to 0 with diagnostic (spec invariant, honest dead-knob surfacing) + tests + GetTierDefaults doc",
+      "status": "completed",
+      "blockedBy": [
+        2
+      ]
+    },
+    {
+      "id": 7,
+      "subject": "S-8 dispatch layer: flip HandleWriteAsync to isIdempotent:false \u2014 RED the DriverInstanceActorResilienceWiringTests expectation first, then flip; full Runtime suite green",
+      "status": "completed",
+      "blockedBy": [
+        6
+      ]
+    },
+    {
+      "id": 8,
+      "subject": "S-8/P-4 invoker: cache the no-retry options snapshot once per invoker + add RecordCallStart/Complete tracker accounting to the non-idempotent arm + 2 CapabilityInvokerTests",
+      "status": "completed",
+      "blockedBy": [
+        7
+      ]
+    },
+    {
+      "id": 9,
+      "subject": "S-8 docs + form: fix WriteIdempotentAttribute's false 'reads via reflection' claim; note the non-idempotent production default; disable Write/Ack retry cells in the razor",
+      "status": "completed",
+      "blockedBy": [
+        7,
+        5
+      ]
+    },
+    {
+      "id": 10,
+      "subject": "U-6 delete (Core): remove BulkheadMaxConcurrent/MaxQueue from DriverResilienceOptions + parser shape/merge/doc-example; add BulkheadKeys_InStoredJson_AreIgnored (migration-free contract)",
+      "status": "completed",
+      "blockedBy": [
+        2,
+        6
+      ]
+    },
+    {
+      "id": 11,
+      "subject": "U-6 delete (AdminUI): strip bulkhead fields from ResilienceFormModel + the two razor inputs; update ResilienceFormModelTests",
+      "status": "completed",
+      "blockedBy": [
+        5,
+        10
+      ]
+    },
+    {
+      "id": 12,
+      "subject": "U-6 doc sweep (seam xmldocs, OTOPCUA0001 message + analyzer tests, operator docs; leave migrations/WedgeDetector/historical plans) + Options_properties_are_exactly_the_pipeline_wired_set knob-inertness guard",
+      "status": "completed",
+      "blockedBy": [
+        10,
+        11
+      ]
+    },
+    {
+      "id": 13,
+      "subject": "C-7 RED tests: unknown top-level key / unknown capability / unknown per-policy field survive round-trip; malformed JSON sets ParseFailed and ToJson returns the original text",
+      "status": "completed",
+      "blockedBy": [
+        11
+      ]
+    },
+    {
+      "id": 14,
+      "subject": "C-7 implement: JsonObject-bag FromJson/ToJson (TagConfigJson idiom), ParseFailed + RawStoredJson, blank->null contract preserved, parser-interop test green",
+      "status": "completed",
+      "blockedBy": [
+        13
+      ]
+    },
+    {
+      "id": 15,
+      "subject": "C-7 razor: ParseFailed warning banner + input lockout + explicit discard button; raw pane shows the stored ResilienceConfig; live-/run on docker-dev :9200 (rebuild BOTH centrals; SQL-mangle + unknown-key survival checks; also drive task 5 warnings and task 9 disabled cells)",
+      "status": "completed",
+      "note": "docker-dev :9200 live-/run; serial live pass",
+      "blockedBy": [
+        14
+      ],
+      "closureNote": "LIVE GATE CLOSED 2026-07-13 \u2014 range-validation banner verified on the docker-dev Modbus driver's Resilience overrides (`timeoutSeconds:0`). STATUS.md 'docker-dev live-/run pass'."
+    },
+    {
+      "id": 16,
+      "subject": "S-7 builder: add options-generation to PipelineKey + GetOrCreate(optionsGeneration=0) + thread through CapabilityInvoker; StaleGeneration_ReCache_IsNotServed_ToNewGeneration",
+      "status": "completed",
+      "blockedBy": [
+        3
+      ]
+    },
+    {
+      "id": 17,
+      "subject": "S-7 factory: Interlocked per-Create generation stamp + Respawn_interleaved_with_old_invoker_call_still_applies_new_options wiring proof; update Invalidate comment (cleanup, not correctness)",
+      "status": "completed",
+      "blockedBy": [
+        16
+      ]
+    },
+    {
+      "id": 18,
+      "subject": "Wrap-up: whole-solution build (0 warnings, analyzer silent) + full dotnet test gate; record the pass + the two report anchor drifts in archreview/plans/STATUS.md",
+      "status": "completed",
+      "note": "integration/full sweep; serialized heavy pass",
+      "blockedBy": [
+        4,
+        8,
+        9,
+        12,
+        15,
+        17
+      ],
+      "closureNote": "LIVE GATE CLOSED 2026-07-13 \u2014 S-8 verified: Write and AlarmAcknowledge RETRIES cells disabled ('never'). STATUS.md 'docker-dev live-/run pass'."
+    }
  ],
-  "lastUpdated": "2026-07-12"
+  "lastUpdated": "2026-07-27"
 }
@@ -3,7 +3,7 @@
  "tasks": [
    {
      "id": "R2-03-T1",
-      "subject": "S13 stale-Good repro test at host level (RED — must fail on f6eaa267): fail-after-success evaluator, publish probe sees Good then expects Bad AttributeValueUpdate",
+      "subject": "S13 stale-Good repro test at host level (RED \u2014 must fail on f6eaa267): fail-after-success evaluator, publish probe sees Good then expects Bad AttributeValueUpdate",
      "status": "completed",
      "blockedBy": []
    },
@@ -62,7 +62,7 @@
    },
    {
      "id": "R2-03-T9",
-      "subject": "P7 wiring-guard rewrite (RED): ApplyVirtualTags clears the compile cache only when the expression set changes — identical redeploy must NOT clear; expression edit must; shared-expression removal must not",
+      "subject": "P7 wiring-guard rewrite (RED): ApplyVirtualTags clears the compile cache only when the expression set changes \u2014 identical redeploy must NOT clear; expression edit must; shared-expression removal must not",
      "status": "completed",
      "blockedBy": [
        "R2-03-T3"
@@ -86,7 +86,8 @@
        "R2-03-T8",
        "R2-03-T10"
      ],
-      "note": "integration/full sweep; serialized heavy pass (build clean, Runtime.Tests 372/372, RoslynVirtualTagEvaluatorTests 20/20 verified locally; whole-solution/cross-suite sweep deferred per controller memory constraint)"
+      "note": "integration/full sweep; serialized heavy pass (build clean, Runtime.Tests 372/372, RoslynVirtualTagEvaluatorTests 20/20 verified locally; whole-solution/cross-suite sweep deferred per controller memory constraint)",
+      "openNote": "STILL OPEN \u2014 live-blocked on a data-less rig: every materialised node reads Bad_WaitingForInitialData because no driver data flows, so a VT cannot be staged Good->Bad. Needs a reachable driver fixture feeding the VT. Unit-verified meanwhile."
    },
    {
      "id": "R2-03-T12",
@@ -95,8 +96,9 @@
      "blockedBy": [
        "R2-03-T11"
      ],
-      "note": "docker-dev live-/run; serial live pass"
+      "note": "docker-dev live-/run; serial live pass",
+      "openNote": "STILL OPEN \u2014 same blocker as T11. Confirmed still open 2026-07-27 (deferment.md \u00a78.5)."
    }
  ],
-  "lastUpdated": "2026-07-13"
+  "lastUpdated": "2026-07-27"
 }
@@ -1,22 +1,146 @@
 {
  "planPath": "archreview/plans/R2-05-adminui-authz-plan.md",
-  "lastUpdated": "2026-07-12",
+  "lastUpdated": "2026-07-27",
  "tasks": [
-    { "id": "T1", "subject": "Add AdminUiPolicies constants class (Security/Auth/AdminUiPolicies.cs)", "status": "completed", "blockedBy": [] },
-    { "id": "T2", "subject": "Policy-semantics unit test AdminUiPoliciesTests (RED: ConfigEditor/AuthenticatedRead unregistered)", "status": "completed", "blockedBy": ["T1"] },
-    { "id": "T3", "subject": "Reflection PageAuthorizationGuardTests (RED: must list ~35 ungated/mis-idiom pages)", "status": "completed", "blockedBy": ["T1"] },
-    { "id": "T4", "subject": "Register ConfigEditor + AuthenticatedRead policies; switch existing AddPolicy literals to constants (GREEN for T2)", "status": "completed", "blockedBy": ["T2"] },
-    { "id": "T5", "subject": "_Imports.razor usings (Authorization + Security.Auth) + de-dupe Deployments/Alerts in-file @using", "status": "completed", "blockedBy": ["T1"] },
-    { "id": "T6", "subject": "Gate UNS pages with ConfigEditor (GlobalUns, EquipmentPage)", "status": "completed", "blockedBy": ["T4", "T5"] },
-    { "id": "T7", "subject": "Gate cluster editors with ConfigEditor (NewCluster, ClusterEdit, NodeEdit, NamespaceEdit, AclEdit)", "status": "completed", "blockedBy": ["T4", "T5"] },
-    { "id": "T8", "subject": "Gate driver pages + routers with ConfigEditor (8 driver pages, DriverTypePicker, DriverEditRouter)", "status": "completed", "blockedBy": ["T4", "T5"] },
-    { "id": "T9", "subject": "Converge Deployments/Scripts/ScriptEdit from Roles-string to ConfigEditor policy", "status": "completed", "blockedBy": ["T4", "T5"] },
-    { "id": "T10", "subject": "Read pages to AuthenticatedRead (16 incl. Home insert) + RoleGrants to FleetAdmin constant", "status": "completed", "blockedBy": ["T4", "T5"] },
-    { "id": "T11", "subject": "Guard GREEN checkpoint + full AdminUI.Tests; commit the gate", "status": "completed", "blockedBy": ["T3", "T6", "T7", "T8", "T9", "T10"] },
-    { "id": "T12", "subject": "Converge non-page literals to constants (ScriptAnalysisEndpoints, imperative DriverOperator x4, Certificates FleetAdmin x2)", "status": "completed", "blockedBy": ["T11"] },
-    { "id": "T13", "subject": "Docs: CLAUDE.md ScriptAnalysis gate sentence, docs/security.md, STATUS.md R2-05 row", "status": "completed", "blockedBy": ["T11"] },
-    { "id": "T14", "subject": "Full-solution test sweep (dotnet test ZB.MOM.WW.OtOpcUa.slnx)", "status": "completed", "blockedBy": ["T12", "T13"], "note": "Impacted unit suites authoritative + green: AdminUI.Tests 517/517, Security.Tests 80/80. One whole-solution sweep ran BEFORE the controller's no-whole-solution/no-IntegrationTests constraint arrived; all failures are pre-existing/env and outside the R2-05 diff (Core.Abstractions.Tests InterfaceIndependence flags pre-existing Historian.* namespace types; Runtime historian retry timing; OpcUaClient.Browser needs a live OPC endpoint; AbCip/OpcUaServer/Host IntegrationTests need Docker fixtures). Will NOT be re-run per constraint." },
-    { "id": "T15", "subject": "Live /run positive pass on docker-dev :9200 (rebuild BOTH centrals; auto-admin drives all page tiers; negative proof stays in T2/T3)", "status": "deferred-live", "blockedBy": ["T14"], "note": "docker-dev live authz /run; serial live pass. Heavy integration/Playwright-dependent gate — controller runs serialized. docker-dev DisableLogin=true auto-authenticates as full-access admin, so role-deny differentiation is NOT observable there; the negative proof is CI-side (T2 AdminUiPoliciesTests + T3 PageAuthorizationGuardTests, both green). This pass only regression-checks over-gating (a typo'd policy name would render the deny slot even for the auto-admin)." },
-    { "id": "T16", "subject": "Merge + bookkeeping (flip 04/C-1 row, record Reservations/ClusterRedundancy corrections)", "status": "completed", "blockedBy": ["T15"] }
+    {
+      "id": "T1",
+      "subject": "Add AdminUiPolicies constants class (Security/Auth/AdminUiPolicies.cs)",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": "T2",
+      "subject": "Policy-semantics unit test AdminUiPoliciesTests (RED: ConfigEditor/AuthenticatedRead unregistered)",
+      "status": "completed",
+      "blockedBy": [
+        "T1"
+      ]
+    },
+    {
+      "id": "T3",
+      "subject": "Reflection PageAuthorizationGuardTests (RED: must list ~35 ungated/mis-idiom pages)",
+      "status": "completed",
+      "blockedBy": [
+        "T1"
+      ]
+    },
+    {
+      "id": "T4",
+      "subject": "Register ConfigEditor + AuthenticatedRead policies; switch existing AddPolicy literals to constants (GREEN for T2)",
+      "status": "completed",
+      "blockedBy": [
+        "T2"
+      ]
+    },
+    {
+      "id": "T5",
+      "subject": "_Imports.razor usings (Authorization + Security.Auth) + de-dupe Deployments/Alerts in-file @using",
+      "status": "completed",
+      "blockedBy": [
+        "T1"
+      ]
+    },
+    {
+      "id": "T6",
+      "subject": "Gate UNS pages with ConfigEditor (GlobalUns, EquipmentPage)",
+      "status": "completed",
+      "blockedBy": [
+        "T4",
+        "T5"
+      ]
+    },
+    {
+      "id": "T7",
+      "subject": "Gate cluster editors with ConfigEditor (NewCluster, ClusterEdit, NodeEdit, NamespaceEdit, AclEdit)",
+      "status": "completed",
+      "blockedBy": [
+        "T4",
+        "T5"
+      ]
+    },
+    {
+      "id": "T8",
+      "subject": "Gate driver pages + routers with ConfigEditor (8 driver pages, DriverTypePicker, DriverEditRouter)",
+      "status": "completed",
+      "blockedBy": [
+        "T4",
+        "T5"
+      ]
+    },
+    {
+      "id": "T9",
+      "subject": "Converge Deployments/Scripts/ScriptEdit from Roles-string to ConfigEditor policy",
+      "status": "completed",
+      "blockedBy": [
+        "T4",
+        "T5"
+      ]
+    },
+    {
+      "id": "T10",
+      "subject": "Read pages to AuthenticatedRead (16 incl. Home insert) + RoleGrants to FleetAdmin constant",
+      "status": "completed",
+      "blockedBy": [
+        "T4",
+        "T5"
+      ]
+    },
+    {
+      "id": "T11",
+      "subject": "Guard GREEN checkpoint + full AdminUI.Tests; commit the gate",
+      "status": "completed",
+      "blockedBy": [
+        "T3",
+        "T6",
+        "T7",
+        "T8",
+        "T9",
+        "T10"
+      ]
+    },
+    {
+      "id": "T12",
+      "subject": "Converge non-page literals to constants (ScriptAnalysisEndpoints, imperative DriverOperator x4, Certificates FleetAdmin x2)",
+      "status": "completed",
+      "blockedBy": [
+        "T11"
+      ]
+    },
+    {
+      "id": "T13",
+      "subject": "Docs: CLAUDE.md ScriptAnalysis gate sentence, docs/security.md, STATUS.md R2-05 row",
+      "status": "completed",
+      "blockedBy": [
+        "T11"
+      ]
+    },
+    {
+      "id": "T14",
+      "subject": "Full-solution test sweep (dotnet test ZB.MOM.WW.OtOpcUa.slnx)",
+      "status": "completed",
+      "blockedBy": [
+        "T12",
+        "T13"
+      ],
+      "note": "Impacted unit suites authoritative + green: AdminUI.Tests 517/517, Security.Tests 80/80. One whole-solution sweep ran BEFORE the controller's no-whole-solution/no-IntegrationTests constraint arrived; all failures are pre-existing/env and outside the R2-05 diff (Core.Abstractions.Tests InterfaceIndependence flags pre-existing Historian.* namespace types; Runtime historian retry timing; OpcUaClient.Browser needs a live OPC endpoint; AbCip/OpcUaServer/Host IntegrationTests need Docker fixtures). Will NOT be re-run per constraint."
+    },
+    {
+      "id": "T15",
+      "subject": "Live /run positive pass on docker-dev :9200 (rebuild BOTH centrals; auto-admin drives all page tiers; negative proof stays in T2/T3)",
+      "status": "completed",
+      "blockedBy": [
+        "T14"
+      ],
+      "note": "docker-dev live authz /run; serial live pass. Heavy integration/Playwright-dependent gate \u2014 controller runs serialized. docker-dev DisableLogin=true auto-authenticates as full-access admin, so role-deny differentiation is NOT observable there; the negative proof is CI-side (T2 AdminUiPoliciesTests + T3 PageAuthorizationGuardTests, both green). This pass only regression-checks over-gating (a typo'd policy name would render the deny slot even for the auto-admin).",
+      "closureNote": "LIVE GATE CLOSED 2026-07-13 (partial by design) \u2014 every config/read page renders under the all-roles multi-role-test session, so named-policy gating does not over-gate a legitimate admin. The DENY direction is unobservable on docker-dev (DisableLogin=true), as documented."
+    },
+    {
+      "id": "T16",
+      "subject": "Merge + bookkeeping (flip 04/C-1 row, record Reservations/ClusterRedundancy corrections)",
+      "status": "completed",
+      "blockedBy": [
+        "T15"
+      ]
+    }
  ]
 }
@@ -1,16 +1,16 @@
 {
  "planPath": "archreview/plans/R2-06-serverhistorian-failfast-plan.md",
-  "lastUpdated": "2026-07-12",
+  "lastUpdated": "2026-07-27",
  "tasks": [
    {
      "id": "T1",
-      "subject": "RED: misconfig repro test — HistorianGatewayClientAdapter.Create with empty/malformed Endpoint must throw a named InvalidOperationException (currently UriFormatException; test MUST fail on current code)",
+      "subject": "RED: misconfig repro test \u2014 HistorianGatewayClientAdapter.Create with empty/malformed Endpoint must throw a named InvalidOperationException (currently UriFormatException; test MUST fail on current code)",
      "status": "completed",
      "blockedBy": []
    },
    {
      "id": "T2",
-      "subject": "GREEN: adapter guard — Uri.TryCreate + InvalidOperationException naming ServerHistorian:Endpoint in HistorianGatewayClientAdapter.Create (defense in depth)",
+      "subject": "GREEN: adapter guard \u2014 Uri.TryCreate + InvalidOperationException naming ServerHistorian:Endpoint in HistorianGatewayClientAdapter.Create (defense in depth)",
      "status": "completed",
      "blockedBy": [
        "T1"
@@ -50,7 +50,7 @@
    },
    {
      "id": "T7",
-      "subject": "U-7 pin: GatewayTagProvisionerTests Boolean_definition_carries_explicit_Int1_presence (asserts HistorianDataType.Int1 AND HasDataType — 0.2.0 proto3-optional presence witness; pin, no RED phase)",
+      "subject": "U-7 pin: GatewayTagProvisionerTests Boolean_definition_carries_explicit_Int1_presence (asserts HistorianDataType.Int1 AND HasDataType \u2014 0.2.0 proto3-optional presence witness; pin, no RED phase)",
      "status": "completed",
      "blockedBy": []
    },
@@ -89,12 +89,13 @@
    {
      "id": "T12",
      "subject": "OPERATOR GATE: run Category=LiveIntegration on the VPN against a 0.2.0 gateway (all 6 tests, incl. Boolean EnsureTags + retype probe); record the observed retype policy back into docs/Historian.md + STATUS.md; also discharges 06/U-2's full documented run",
-      "status": "deferred-live",
+      "status": "completed",
      "blockedBy": [
        "T9",
        "T11"
      ],
-      "note": "DONE 2026-07-13 on VPN vs a real 0.2.0 gateway (deployed locally in Docker → real AVEVA historian on wonder-sql-vd03 + Runtime SQL). 5/6 green. Found+FIXED a real OtOpcUa bug (PR #439, master 666908d7): GatewayTagProvisioner sent StorageRateMs=0 → gateway EnsureTags threw ArgumentOutOfRangeException → ALL historized-tag provisioning silently failed; stamp 1000ms + regression test. U-7 retype policy ANSWERED: EnsureTags is a real upsert; in-place retype between SUPPORTED types is ACCEPTED (Float→Double=success); but Int1 (0.2.0 Boolean target) is NOT creatable on this histsdk (ProtocolEvidenceMissingException — Int1-only; Int2/UInt2/Int4/UInt4/Float/Double all provision), so a pre-bump Float Boolean asked to become Int1 FAILS the provision (not silently retyped/data-lost). The 1 red test (Boolean→Int1) is a gateway histsdk type-support gap, not OtOpcUa. Deployment fixes: FQDN host + libgssapi-krb5-2/gss-ntlmssp in the gateway image + wonderapp SQL login for Runtime. Full record in STATUS.md."
+      "note": "DONE 2026-07-13 on VPN vs a real 0.2.0 gateway (deployed locally in Docker \u2192 real AVEVA historian on wonder-sql-vd03 + Runtime SQL). 5/6 green. Found+FIXED a real OtOpcUa bug (PR #439, master 666908d7): GatewayTagProvisioner sent StorageRateMs=0 \u2192 gateway EnsureTags threw ArgumentOutOfRangeException \u2192 ALL historized-tag provisioning silently failed; stamp 1000ms + regression test. U-7 retype policy ANSWERED: EnsureTags is a real upsert; in-place retype between SUPPORTED types is ACCEPTED (Float\u2192Double=success); but Int1 (0.2.0 Boolean target) is NOT creatable on this histsdk (ProtocolEvidenceMissingException \u2014 Int1-only; Int2/UInt2/Int4/UInt4/Float/Double all provision), so a pre-bump Float Boolean asked to become Int1 FAILS the provision (not silently retyped/data-lost). The 1 red test (Boolean\u2192Int1) is a gateway histsdk type-support gap, not OtOpcUa. Deployment fixes: FQDN host + libgssapi-krb5-2/gss-ntlmssp in the gateway image + wonderapp SQL login for Runtime. Full record in STATUS.md.",
+      "closureNote": "LIVE GATE CLOSED 2026-07-13 (6/6) \u2014 vs. the local 0.2.0 gateway + real historian over VPN. STATUS.md 'docker-dev live-/run pass'."
    }
  ]
 }
@@ -1,6 +1,6 @@
 {
  "planPath": "archreview/plans/R2-07-surgical-pure-adds-plan.md",
-  "lastUpdated": "2026-07-12",
+  "lastUpdated": "2026-07-27",
  "tasks": [
    {
      "id": "T1",
@@ -45,20 +45,22 @@
    {
      "id": "T5",
      "subject": "Phase 1: over-the-wire SubscriptionSurvivalTests \u2014 subscribe, pure-add, item survives + new node browsable",
-      "status": "deferred-live",
+      "status": "completed",
      "blockedBy": [
        "T4b"
      ],
-      "note": "authored + compiles (dotnet build green); NOT run \u2014 *.IntegrationTests suite leaks ~16GB/run per the memory constraint. MUST run in the serial heavy integration pass (single-test, boots one in-process server + client)."
+      "note": "authored + compiles (dotnet build green); NOT run \u2014 *.IntegrationTests suite leaks ~16GB/run per the memory constraint. MUST run in the serial heavy integration pass (single-test, boots one in-process server + client).",
+      "closureNote": "LIVE GATE CLOSED 2026-07-13 \u2014 central-1 boot logged PureAdd (added=91, rebuild=False)."
    },
    {
      "id": "T6",
      "subject": "Phase 1: MANDATORY live-/run gate on docker-dev (rebuild BOTH centrals; Client.CLI subscribe survives +1-tag deploy; kind=PureAdd rebuild=False) \u2014 Phase 1 shippable boundary",
-      "status": "deferred-live",
+      "status": "completed",
      "blockedBy": [
        "T5"
      ],
-      "note": "docker-dev live /run surgical-path; serial heavy pass \u2014 F10b inertness risk, MUST run (subscribe survives +1-tag deploy; central log kind=PureAdd, rebuild=False; new node browsable/Good)."
+      "note": "docker-dev live /run surgical-path; serial heavy pass \u2014 F10b inertness risk, MUST run (subscribe survives +1-tag deploy; central log kind=PureAdd, rebuild=False; new node browsable/Good).",
+      "closureNote": "LIVE GATE CLOSED 2026-07-13 \u2014 deleting a UNS virtual tag logged PureRemove (removed=1, rebuild=False) and the node vanished from the address space."
    },
    {
      "id": "T7",
@@ -104,11 +106,12 @@
    {
      "id": "T12",
      "subject": "Phase 2: remove-side subscription-survival integration test + live-/run remove gate (kind=PureRemove rebuild=False) \u2014 Phase 2 shippable boundary",
-      "status": "deferred-live",
+      "status": "completed",
      "blockedBy": [
        "T11"
      ],
-      "note": "remove-side SubscriptionSurvivalTests authored + compiles (dotnet build green); NOT run \u2014 *.IntegrationTests memory constraint. Live docker-dev pure-remove gate (survivor subscription uninterrupted; central log kind=PureRemove, rebuild=False; removed node reads BadNodeIdUnknown) MUST run in the serial heavy pass \u2014 F10b inertness risk."
+      "note": "remove-side SubscriptionSurvivalTests authored + compiles (dotnet build green); NOT run \u2014 *.IntegrationTests memory constraint. Live docker-dev pure-remove gate (survivor subscription uninterrupted; central log kind=PureRemove, rebuild=False; removed node reads BadNodeIdUnknown) MUST run in the serial heavy pass \u2014 F10b inertness risk.",
+      "closureNote": "LIVE GATE CLOSED 2026-07-13 \u2014 surgical add AND remove both execute in prod with no full rebuild; the remove path's 3 new sink members are wired, not inert."
    },
    {
      "id": "T13",
@@ -121,11 +124,12 @@
    {
      "id": "T14",
      "subject": "Phase 3: mixed-deploy integration test + live-/run mixed gate + STATUS.md/P1 close-out \u2014 plan complete",
-      "status": "deferred-live",
+      "status": "completed",
      "blockedBy": [
        "T13"
      ],
-      "note": "mixed-deploy SubscriptionSurvivalTests authored + compiles (dotnet build green); docs close-out DONE (STATUS.md + 03/P1 marked REMEDIATED + plan deviations). Live docker-dev mixed gate (one deploy +1/-1; kind=AddRemoveMix, rebuild=False; survivor uninterrupted) MUST run in the serial heavy pass \u2014 F10b inertness risk."
+      "note": "mixed-deploy SubscriptionSurvivalTests authored + compiles (dotnet build green); docs close-out DONE (STATUS.md + 03/P1 marked REMEDIATED + plan deviations). Live docker-dev mixed gate (one deploy +1/-1; kind=AddRemoveMix, rebuild=False; survivor uninterrupted) MUST run in the serial heavy pass \u2014 F10b inertness risk.",
+      "closureNote": "LIVE GATE CLOSED 2026-07-13 \u2014 see T5/T6/T12. STATUS.md 'docker-dev live-/run pass'."
    }
  ]
 }
@@ -1,17 +1,94 @@
 {
  "planPath": "archreview/plans/R2-10-resilience-observability-plan.md",
-  "lastUpdated": "2026-07-12",
+  "lastUpdated": "2026-07-27",
  "tasks": [
-    { "id": "T1", "subject": "Tracker: LastBreakerClosedUtc + IsBreakerOpen + RecordBreakerClose (Core, TDD in DriverResilienceStatusTrackerTests)", "status": "completed", "blockedBy": [] },
-    { "id": "T2", "subject": "Builder: OnClosed records breaker-close on the tracker (TDD in DriverResiliencePipelineBuilderTests)", "status": "completed", "blockedBy": ["T1"] },
-    { "id": "T3", "subject": "Invoker: successful Execute* resets ConsecutiveFailures (TDD in CapabilityInvokerTests)", "status": "completed", "blockedBy": ["T1"] },
-    { "id": "T4", "subject": "Commons: DriverResilienceStatusChanged record + driver-resilience-status TopicName", "status": "completed", "blockedBy": [] },
-    { "id": "T5", "subject": "Host: DriverResilienceStatusPublisherService (BuildMessages mapping + 5s DPS timer shell; TDD mapping in Host.IntegrationTests)", "status": "completed", "blockedBy": ["T1", "T4"] },
-    { "id": "T6", "subject": "Host DI: register the publisher in AddOtOpcUaDriverFactories + ResilienceStatusReaderRegistrationTests wiring guard (tracker HAS a production reader)", "status": "completed", "blockedBy": ["T5"] },
-    { "id": "T7", "subject": "AdminUI: IDriverResilienceStatusStore + InMemory impl + AddOtOpcUaDriverStatusServices registration (TDD mirroring DriverStatusSnapshotStoreTests)", "status": "completed", "blockedBy": ["T4"] },
-    { "id": "T8", "subject": "AdminUI: DriverResilienceStatusBridge DPS actor + spawn in WithOtOpcUaSignalRBridges", "status": "completed", "blockedBy": ["T7"] },
-    { "id": "T9", "subject": "AdminUI: resilience chip section in DriverStatusPanel.razor (in-process store read; no bUnit — verified by T10)", "status": "completed", "blockedBy": ["T7"] },
-    { "id": "T10", "subject": "Live-/run gate on docker-dev: rebuild BOTH centrals, S7 dead-endpoint breaker-open, both-replica chips, recovery clear, staleness dim", "status": "deferred-live", "blockedBy": ["T6", "T8", "T9"] },
-    { "id": "T11", "subject": "Docs + review ledger: mark 03/U10 + 04/U-5 remediated; update STATUS.md + FOLLOWUP-10", "status": "completed", "blockedBy": ["T10"] }
+    {
+      "id": "T1",
+      "subject": "Tracker: LastBreakerClosedUtc + IsBreakerOpen + RecordBreakerClose (Core, TDD in DriverResilienceStatusTrackerTests)",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": "T2",
+      "subject": "Builder: OnClosed records breaker-close on the tracker (TDD in DriverResiliencePipelineBuilderTests)",
+      "status": "completed",
+      "blockedBy": [
+        "T1"
+      ]
+    },
+    {
+      "id": "T3",
+      "subject": "Invoker: successful Execute* resets ConsecutiveFailures (TDD in CapabilityInvokerTests)",
+      "status": "completed",
+      "blockedBy": [
+        "T1"
+      ]
+    },
+    {
+      "id": "T4",
+      "subject": "Commons: DriverResilienceStatusChanged record + driver-resilience-status TopicName",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": "T5",
+      "subject": "Host: DriverResilienceStatusPublisherService (BuildMessages mapping + 5s DPS timer shell; TDD mapping in Host.IntegrationTests)",
+      "status": "completed",
+      "blockedBy": [
+        "T1",
+        "T4"
+      ]
+    },
+    {
+      "id": "T6",
+      "subject": "Host DI: register the publisher in AddOtOpcUaDriverFactories + ResilienceStatusReaderRegistrationTests wiring guard (tracker HAS a production reader)",
+      "status": "completed",
+      "blockedBy": [
+        "T5"
+      ]
+    },
+    {
+      "id": "T7",
+      "subject": "AdminUI: IDriverResilienceStatusStore + InMemory impl + AddOtOpcUaDriverStatusServices registration (TDD mirroring DriverStatusSnapshotStoreTests)",
+      "status": "completed",
+      "blockedBy": [
+        "T4"
+      ]
+    },
+    {
+      "id": "T8",
+      "subject": "AdminUI: DriverResilienceStatusBridge DPS actor + spawn in WithOtOpcUaSignalRBridges",
+      "status": "completed",
+      "blockedBy": [
+        "T7"
+      ]
+    },
+    {
+      "id": "T9",
+      "subject": "AdminUI: resilience chip section in DriverStatusPanel.razor (in-process store read; no bUnit \u2014 verified by T10)",
+      "status": "completed",
+      "blockedBy": [
+        "T7"
+      ]
+    },
+    {
+      "id": "T10",
+      "subject": "Live-/run gate on docker-dev: rebuild BOTH centrals, S7 dead-endpoint breaker-open, both-replica chips, recovery clear, staleness dim",
+      "status": "deferred-live",
+      "blockedBy": [
+        "T6",
+        "T8",
+        "T9"
+      ],
+      "openNote": "PARTIAL \u2014 the resilience PIPELINE is live-verified (Polly CircuitBreaker -> Retry -> Timeout -> CapabilityInvoker in central-1 stack traces), but breaker-OPEN state was never forced: R2-09's ConnectionBackoff throttles retries so failures don't accumulate fast enough to open the Polly breaker. The reliable trigger is a rapid idempotent write to a dead endpoint. Confirmed still open 2026-07-27 (deferment.md \u00a78.5)."
+    },
+    {
+      "id": "T11",
+      "subject": "Docs + review ledger: mark 03/U10 + 04/U-5 remediated; update STATUS.md + FOLLOWUP-10",
+      "status": "completed",
+      "blockedBy": [
+        "T10"
+      ]
+    }
  ]
 }
@@ -1,30 +1,213 @@
 {
  "planPath": "archreview/plans/R2-11-tagconfig-consolidation-plan.md",
-  "lastUpdated": "2026-07-12",
+  "lastUpdated": "2026-07-27",
  "tasks": [
-    { "id": "T1",  "subject": "Golden TagConfig corpus + compose→encode→decode parity characterization test (Runtime.Tests, green on unmodified tree)", "status": "completed", "blockedBy": [] },
-    { "id": "T2",  "subject": "FullName-semantics characterization for EquipmentNodeWalker (Core.Tests) + DraftValidator Galaxy rule (Configuration.Tests)", "status": "completed", "blockedBy": [] },
-    { "id": "T3",  "subject": "TagConfigIntent + TagAlarmIntent in Commons/Types (TDD; port composer semantics verbatim + OpcUaServer ExtractTag* test tables)", "status": "completed", "blockedBy": [] },
-    { "id": "T4",  "subject": "DeviceConfigIntent (TryExtractHost/NormalizeHost) in Commons/Types (TDD)", "status": "completed", "blockedBy": [] },
-    { "id": "T5",  "subject": "AddressSpaceComposer swap: single TagConfigIntent.Parse per tag, delete 4 Extract* statics (P-1 parse-once)", "status": "completed", "blockedBy": ["T1", "T3"] },
-    { "id": "T6",  "subject": "Device-host re-home: composer TryExtractDeviceHost/NormalizeDeviceHost → DeviceConfigIntent; update DriverHostActor + DeploymentArtifact callers", "status": "completed", "blockedBy": ["T4", "T5"] },
-    { "id": "T7",  "subject": "DeploymentArtifact swap: delete 4 private mirrors, parse once per tag element via TagConfigIntent", "status": "completed", "blockedBy": ["T5"] },
-    { "id": "T8",  "subject": "DraftValidator swap: Configuration→Commons ProjectReference; ExtractTagConfigFullName → TagConfigIntent.ExplicitFullName (null-on-absent preserved)", "status": "completed", "blockedBy": ["T2", "T3"] },
-    { "id": "T9",  "subject": "EquipmentNodeWalker.ExtractFullName delegates to TagConfigIntent; repoint tree-wide canonical-parser doc cites", "status": "completed", "blockedBy": ["T2", "T3"] },
-    { "id": "T10", "subject": "Retire OpcUaServer.Tests ExtractTag*Tests (authority moved to Commons.Tests); verify zero 'MUST parse identically' hits", "status": "completed", "blockedBy": ["T3", "T5"] },
-    { "id": "T11", "subject": "TagConfigJson strict-capable readers in Core.Abstractions (TryReadEnum Absent/Valid/Invalid, ReadEnumOrDefault, ReadWritable, DescribeInvalidEnum) (TDD)", "status": "completed", "blockedBy": [] },
-    { "id": "T12", "subject": "Modbus equipment-tag parser: freeze test, shared readers, honour writable key, Inspect warnings", "status": "completed", "blockedBy": ["T11"] },
-    { "id": "T13", "subject": "S7 equipment-tag parser: freeze test, shared readers, honour writable key, Inspect warnings (+ amend Contracts banner)", "status": "completed", "blockedBy": ["T11"] },
-    { "id": "T14", "subject": "AbCip equipment-tag parser: freeze test, shared readers (writable already honoured), Inspect warnings", "status": "completed", "blockedBy": ["T11"] },
-    { "id": "T15", "subject": "AbLegacy equipment-tag parser: freeze test, shared readers, honour writable key, Inspect warnings", "status": "completed", "blockedBy": ["T11"] },
-    { "id": "T16", "subject": "TwinCAT equipment-tag parser: freeze test, shared readers, honour writable key, Inspect warnings", "status": "completed", "blockedBy": ["T11"] },
-    { "id": "T17", "subject": "FOCAS equipment-tag parser: force Writable:false (05/UNDER-1 correction), shared readers, Inspect warnings (+ amend Contracts banner)", "status": "completed", "blockedBy": ["T11"] },
-    { "id": "T18", "subject": "FOCAS capability-matrix pre-flight on the equipment-tag _parseRef resolve path (BadNodeIdUnknown on rejection)", "status": "completed", "blockedBy": ["T17"] },
-    { "id": "T19", "subject": "Modbus probe parses the factory DTO shape (timeoutMs round-trip; OpcUaClient parity rule)", "status": "completed", "blockedBy": [] },
-    { "id": "T20", "subject": "EquipmentTagConfigInspector DriverType-dispatch map in ControlPlane (+6 Contracts references)", "status": "completed", "blockedBy": ["T12", "T13", "T14", "T15", "T16", "T17"] },
-    { "id": "T21", "subject": "AdminOperationsActor deploy-gate wiring + Deployment:TagConfigValidationMode (Warn default | Error opt-in); actor-level consuming test", "status": "completed", "blockedBy": ["T20"] },
-    { "id": "T22", "subject": "AdminUI writable checkbox in the six driver-typed tag editors (models + razor; live /run verify at execution)", "status": "deferred-live", "blockedBy": [] },
-    { "id": "T23", "subject": "Docs + decision record: two-mode rollout, unknown-keys non-goal, FOCAS writable migration note, STATUS.md/00-INDEX.md entries + Phase-C follow-up", "status": "completed", "blockedBy": ["T17", "T21"] },
-    { "id": "T24", "subject": "Final sweep: zero parity-comment/ReadEnum-copy grep hits; whole-solution build + test gate", "status": "deferred-live", "blockedBy": ["T5", "T6", "T7", "T8", "T9", "T10", "T12", "T13", "T14", "T15", "T16", "T17", "T18", "T19", "T21", "T22", "T23"] }
+    {
+      "id": "T1",
+      "subject": "Golden TagConfig corpus + compose\u2192encode\u2192decode parity characterization test (Runtime.Tests, green on unmodified tree)",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": "T2",
+      "subject": "FullName-semantics characterization for EquipmentNodeWalker (Core.Tests) + DraftValidator Galaxy rule (Configuration.Tests)",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": "T3",
+      "subject": "TagConfigIntent + TagAlarmIntent in Commons/Types (TDD; port composer semantics verbatim + OpcUaServer ExtractTag* test tables)",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": "T4",
+      "subject": "DeviceConfigIntent (TryExtractHost/NormalizeHost) in Commons/Types (TDD)",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": "T5",
+      "subject": "AddressSpaceComposer swap: single TagConfigIntent.Parse per tag, delete 4 Extract* statics (P-1 parse-once)",
+      "status": "completed",
+      "blockedBy": [
+        "T1",
+        "T3"
+      ]
+    },
+    {
+      "id": "T6",
+      "subject": "Device-host re-home: composer TryExtractDeviceHost/NormalizeDeviceHost \u2192 DeviceConfigIntent; update DriverHostActor + DeploymentArtifact callers",
+      "status": "completed",
+      "blockedBy": [
+        "T4",
+        "T5"
+      ]
+    },
+    {
+      "id": "T7",
+      "subject": "DeploymentArtifact swap: delete 4 private mirrors, parse once per tag element via TagConfigIntent",
+      "status": "completed",
+      "blockedBy": [
+        "T5"
+      ]
+    },
+    {
+      "id": "T8",
+      "subject": "DraftValidator swap: Configuration\u2192Commons ProjectReference; ExtractTagConfigFullName \u2192 TagConfigIntent.ExplicitFullName (null-on-absent preserved)",
+      "status": "completed",
+      "blockedBy": [
+        "T2",
+        "T3"
+      ]
+    },
+    {
+      "id": "T9",
+      "subject": "EquipmentNodeWalker.ExtractFullName delegates to TagConfigIntent; repoint tree-wide canonical-parser doc cites",
+      "status": "completed",
+      "blockedBy": [
+        "T2",
+        "T3"
+      ]
+    },
+    {
+      "id": "T10",
+      "subject": "Retire OpcUaServer.Tests ExtractTag*Tests (authority moved to Commons.Tests); verify zero 'MUST parse identically' hits",
+      "status": "completed",
+      "blockedBy": [
+        "T3",
+        "T5"
+      ]
+    },
+    {
+      "id": "T11",
+      "subject": "TagConfigJson strict-capable readers in Core.Abstractions (TryReadEnum Absent/Valid/Invalid, ReadEnumOrDefault, ReadWritable, DescribeInvalidEnum) (TDD)",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": "T12",
+      "subject": "Modbus equipment-tag parser: freeze test, shared readers, honour writable key, Inspect warnings",
+      "status": "completed",
+      "blockedBy": [
+        "T11"
+      ]
+    },
+    {
+      "id": "T13",
+      "subject": "S7 equipment-tag parser: freeze test, shared readers, honour writable key, Inspect warnings (+ amend Contracts banner)",
+      "status": "completed",
+      "blockedBy": [
+        "T11"
+      ]
+    },
+    {
+      "id": "T14",
+      "subject": "AbCip equipment-tag parser: freeze test, shared readers (writable already honoured), Inspect warnings",
+      "status": "completed",
+      "blockedBy": [
+        "T11"
+      ]
+    },
+    {
+      "id": "T15",
+      "subject": "AbLegacy equipment-tag parser: freeze test, shared readers, honour writable key, Inspect warnings",
+      "status": "completed",
+      "blockedBy": [
+        "T11"
+      ]
+    },
+    {
+      "id": "T16",
+      "subject": "TwinCAT equipment-tag parser: freeze test, shared readers, honour writable key, Inspect warnings",
+      "status": "completed",
+      "blockedBy": [
+        "T11"
+      ]
+    },
+    {
+      "id": "T17",
+      "subject": "FOCAS equipment-tag parser: force Writable:false (05/UNDER-1 correction), shared readers, Inspect warnings (+ amend Contracts banner)",
+      "status": "completed",
+      "blockedBy": [
+        "T11"
+      ]
+    },
+    {
+      "id": "T18",
+      "subject": "FOCAS capability-matrix pre-flight on the equipment-tag _parseRef resolve path (BadNodeIdUnknown on rejection)",
+      "status": "completed",
+      "blockedBy": [
+        "T17"
+      ]
+    },
+    {
+      "id": "T19",
+      "subject": "Modbus probe parses the factory DTO shape (timeoutMs round-trip; OpcUaClient parity rule)",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": "T20",
+      "subject": "EquipmentTagConfigInspector DriverType-dispatch map in ControlPlane (+6 Contracts references)",
+      "status": "completed",
+      "blockedBy": [
+        "T12",
+        "T13",
+        "T14",
+        "T15",
+        "T16",
+        "T17"
+      ]
+    },
+    {
+      "id": "T21",
+      "subject": "AdminOperationsActor deploy-gate wiring + Deployment:TagConfigValidationMode (Warn default | Error opt-in); actor-level consuming test",
+      "status": "completed",
+      "blockedBy": [
+        "T20"
+      ]
+    },
+    {
+      "id": "T22",
+      "subject": "AdminUI writable checkbox in the six driver-typed tag editors (models + razor; live /run verify at execution)",
+      "status": "completed",
+      "blockedBy": [],
+      "closureNote": "LIVE GATE CLOSED 2026-07-13 \u2014 the typed Modbus tag editor shows the Writable toggle and saving persists `writable: yes`."
+    },
+    {
+      "id": "T23",
+      "subject": "Docs + decision record: two-mode rollout, unknown-keys non-goal, FOCAS writable migration note, STATUS.md/00-INDEX.md entries + Phase-C follow-up",
+      "status": "completed",
+      "blockedBy": [
+        "T17",
+        "T21"
+      ]
+    },
+    {
+      "id": "T24",
+      "subject": "Final sweep: zero parity-comment/ReadEnum-copy grep hits; whole-solution build + test gate",
+      "status": "completed",
+      "blockedBy": [
+        "T5",
+        "T6",
+        "T7",
+        "T8",
+        "T9",
+        "T10",
+        "T12",
+        "T13",
+        "T14",
+        "T15",
+        "T16",
+        "T17",
+        "T18",
+        "T19",
+        "T21",
+        "T22",
+        "T23"
+      ],
+      "closureNote": "LIVE GATE CLOSED 2026-07-13 \u2014 see T22. STATUS.md 'docker-dev live-/run pass'."
+    }
  ]
 }
@@ -0,0 +1,667 @@
+# Deferment register — new drivers, open issues, deferred work
+
+> **Scope.** A source-verified inventory of what is unfinished in this repo: the status of the
+> recently-added drivers, every open tracker issue, in-code deferrals, open live gates, and the
+> documentation that misstates any of it.
+>
+> **Method.** Five parallel agents swept the tree independently; every claim below was checked
+> against **source** (`src/`, `tests/`, `git log`), not against documentation. Where a doc and the
+> code disagreed, the code won and the doc is listed in §7. Findings that could not be verified
+> without hardware or a live rig are marked **CANNOT VERIFY** rather than asserted.
+>
+> **Baseline.** `master` @ `90bdaa44`, 2026-07-27. All local branches are merged into master; the
+> only unmerged remotes are three abandoned branches (`origin/auto/driver-gaps` 184 commits behind
+> since 2026-04-26, `origin/auto/driver-gaps-stash`, `origin/refactor/galaxy-mxgateway-client-rename`).
+
+---
+
+## 0. The short version
+
+The driver runtime is in good shape — **no new driver contains a stub, a `NotImplementedException`,
+or an unregistered factory.** What is unfinished clusters into four groups, in descending order of
+how much they should worry you:
+
+| # | Theme | Why it matters |
+|---|---|---|
+| **1** | **Three subsystems are fully authored, persisted, and shipped — and never executed.** Node ACLs, `IRediscoverable`/`IHostConnectivityProbe`, and `DriverTypeRegistry`. | An operator can author a rule, save it, deploy it green, and have it do **nothing**. §3 |
+| **2** | **AdminUI authoring-dispatch gaps.** Calculation is offered in the driver picker but has no config form; three drivers have no device form; CSV + browse-commit dispatch maps miss the new drivers. | The "registered but unauthorable" class that has now bitten twice. §1.2 |
+| **3** | **17 open issues, all confirmed still open**, several broader than filed. | §2 |
+| **4** | **Bookkeeping drift.** 8 `.tasks.json` files show ~140 "pending" tasks for work that shipped; 5 CLAUDE.md status claims are stale. | Someone follows the tracker and rebuilds a shipped driver. §6, §7 |
+
+Nothing here is a data-loss or outage defect. The sharpest edge is §3 — silent non-enforcement.
+
+---
+
+## 1. New drivers — source-verified status
+
+Cross-cutting facts, verified once: all 12 driver types register in one place
+(`src/Server/ZB.MOM.WW.OtOpcUa.Host/Drivers/DriverFactoryBootstrap.cs:147-164`); all 12 register a
+probe (`:119-130`) via `AddOtOpcUaDriverProbes()`, called from **both** the driver path (`:93`) and
+the admin path — **no probe is admin-node-missing**. `DriverTypeNames`
+(`src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverTypeNames.cs`) is guarded bidirectionally by
+reflection in `tests/Core/…Core.Abstractions.Tests/DriverTypeNamesGuardTests.cs`.
+
+### 1.1 Status table
+
+| Driver | Verdict | Merged | Capabilities | Notes |
+|---|---|---|---|---|
+| **MTConnect** | Complete-with-gaps | `90bdaa44` (#506) | `IDriver, IReadable, ISubscribable, ITagDiscovery, IHostConnectivityProbe, IRediscoverable` (`MTConnectDriver.cs:63`) | No `IWritable` **by design** (`:50`). No device form. |
+| **MQTT / Sparkplug B** | **Complete** | `c3a2b0f7` | `+ IRediscoverable, IAsyncDisposable` (`MqttDriver.cs:65-66`) | Cleanest of the five: picker + driver form + device form + tag editor all present. 8 open follow-up issues. |
+| **Sql** | Complete-with-gaps | `4ad54037`, follow-ups `28c28667` | `IDriver, ITagDiscovery, IReadable, ISubscribable, IHostConnectivityProbe` (`SqlDriver.cs:28-29`) | No device form; no browse-commit branch; stale comments. |
+| **Modbus RTU-over-TCP** | **Complete** | `0f38f486` (#495) | transport mode inside Modbus (`ModbusTransportMode.cs`, `ModbusRtuOverTcpTransport.cs`) | Parses transport **by name** (`ModbusDriverFactoryExtensions.cs:77-78`) — dodges the systemic numeric-enum authoring bug. |
+| **Calculation** | **Partial (authoring gap)** | pre-existing | `IDriver, IDependencyConsumer, ISubscribable, IReadable` (`CalculationDriver.cs:38`) | **Registered + offered in the picker, but has no config form.** See §1.2. |
+
+`IWritable` is absent from MTConnect, MQTT, Sql and Calculation. In all four this is **structural and
+documented**, not a stub (`MTConnectDriver.cs:50`, `MqttDriver.cs:483`, `SqlDriver.cs:15`).
+
+**Zero `NotImplementedException`** across all five drivers. Every `NotSupportedException` is either a
+`catch` filter or a deliberate domain error.
+
+### 1.2 Gaps found — AdminUI authoring & dispatch layer
+
+Every gap below is in the **authoring/dispatch layer, not driver runtime code**.
+
+| # | Gap | Evidence | Impact |
+|---|---|---|---|
+| G-1 | **`DriverConfigModal.razor` has no `Calculation` case** — falls to the `default` "No typed config form" warning; no `CalculationDriverForm.razor` exists | `DriverConfigModal.razor:34-72`, default arm `:69-71` | `CalculationDriverOptions.RunTimeout` (`CalculationDriverOptions.cs:19`) is **unauthorable via the UI**. Create/rename still work, so degraded — not a hard block. **This is the same class as the Sql picker defect, one modal further downstream.** |
+| G-2 | **`DeviceModal.razor` is missing Sql, MTConnect, Calculation** | `DeviceModal.razor:42-74`, default arm `:71-73` | Mitigated: Sql/MTConnect hold connection at the **driver** level, and Test Connect still works via `BuildMergedProbeConfig` (`:180-184`). |
+| G-3 | **`DriverConfigModal.razor:77` tells Sql/MTConnect operators the wrong thing** — the single-connection branch is hardcoded to `Galaxy or Mqtt`, so Sql/MTConnect users are told the endpoint lives on the *device* when they just authored it on the driver | `DriverConfigModal.razor:77`, `:86-88` | Actively misleading, compounds G-2. |
+| G-4 | **No parity test guards `DriverConfigModal` or `DeviceModal`** — `RawDriverTypeDialogCoverageTests`/`…ParityTests` assert `DriverTypeNames` ↔ **picker** parity only | — | **This is exactly why G-1 and G-2 survived review.** The guard pattern exists and simply was not extended to the two downstream dispatch maps. |
+| G-5 | **`CsvColumnMap` has no typed columns for Sql, MQTT, MTConnect** | `CsvColumnMap.cs:340-452` | CSV import/export degrades to the raw `TagConfigJson` fallback while the 7 older drivers get typed columns. |
+| G-6 | **`RawBrowseCommitMapper` has no Sql branch** — falls to the generic `WriteSingleKey("address", …)` whose comment claims "Browsable drivers are all handled above" | `RawBrowseCommitMapper.cs:121-141`, fallback `:145` | Untrue since `SqlDriverBrowser` was registered (`EndpointRouteBuilderExtensions.cs:83`). Same failure mode the MTConnect branch (`:135-139`) was added to avoid: typed editor opens empty, blanks the field on save. |
+| G-7 | **`EquipmentTagConfigInspector` covers only 6 driver types** | `:24-29` | Pre-existing (OpcUaClient + Galaxy absent too); no new driver was added. |
+
+### 1.3 Stale in-code comments (harmless at runtime, misleading to the next reader)
+
+- `DriverTypeNames.cs:22-25` — Calculation described as "not-yet-registered"; it registers at `DriverFactoryBootstrap.cs:149`.
+- `TagConfigEditorMap.cs:25-28` + `TagConfigValidator.cs:27-28` — "`DriverTypeNames.Sql` deliberately absent until Task 11"; the constant exists (`DriverTypeNames.cs:57`) and the values are identical, so behaviour is correct.
+- `RawDriverTypeDialog.razor:2-4, 59-60` — "its factory lands in Wave C".
+- `CsvColumnMap.cs:322-324` — hardcodes `CalculationDriverType = "Calculation"` "Not yet a `DriverTypeNames` constant"; it has been one since `DriverTypeNames.cs:54`.
+- ~~`SqlDriver.cs:218-220` — justifies not re-parsing config on the premise "the factory builds a fresh
+  instance", **disproved** by `DriverInstanceActor.cs:316` + `DriverHostActor.cs:2565`.~~ ✅ **Fixed** —
+  the comment now says the premise was false when written and is true *now* because a config change
+  respawns. See §9.
+
+---
+
+## 2. Open tracker issues — all 17 verified against source
+
+**No issue was found stale.** 11 CONFIRMED, 4 PARTIALLY (core claim holds, a sub-claim is wrong or
+incomplete), 2 CANNOT VERIFY (correctly filed as hardware/fixture-gated).
+
+| # | Title (abbrev.) | Verdict | Key evidence | Kind |
+|---|---|---|---|---|
+| **518** | `IRediscoverable` + `IHostConnectivityProbe` have no consumer; CLAUDE.md wrong | **CONFIRMED — worse than filed** | Only `+=` in `src/` are Galaxy self-wiring (`GalaxyDriver.cs:586`, `:221`). `GetHostStatuses()` has **zero call sites** outside the interface + implementations; `DriverHostStatuses` DbSet is referenced only by its declaration and a test. | Defect + doc error |
+| **507** | Discovered-node injection inert in v3 | **CONFIRMED** | `DriverHostActor.cs:986-1002` hard-`return;` + `#pragma warning disable CS0162` (restored `:1077`) | Deferred (deliberate guard) |
+| **519** | No Bad/Uncertain **sub-code** reaches a client | **CONFIRMED** | Collapse at `DriverInstanceActor.cs:1033-1041` (`statusCode >> 30`), re-expand at `OtOpcUaNodeManager.cs:3318-3322`. Enum is 3-state at `IOpcUaAddressSpaceSink.cs:165`. **Wider than filed** — `StatusFromQuality` also used at `:429/:506/:576/:761`, so alarm-condition Quality collapses too. | Design consequence |
+| **517** | Health published AFTER teardown | **CONFIRMED, fleet-wide** | `ModbusDriver.cs:244-250`, `MTConnectDriver.cs:579-590`, `S7Driver.cs:292-326` — all `Teardown…` then `WriteHealth(Unknown)`; `GetHealth()` is a plain field read | Defect (race) |
+| **516** | Driver config edits silently discarded | **CONFIRMED — survey now complete** | `DriverInstanceActor.cs:316` (only `_driver` assignment) + `DriverHostActor.cs:2565` (`Tell` existing child, no respawn) + `:653/:660` (green seal). **Affected: Modbus, FOCAS, OpcUaClient, + AbLegacy (issue missed it), + Sql (deliberate/documented).** AbCip/TwinCAT re-parse ✅; Galaxy fails **loud** (throws, `GalaxyDriver.cs:600-641`) | Defect |
+| **515** | Sparkplug `DataSet`/`Template`/`PropertySet` | **CONFIRMED** | `SparkplugCodec.cs:207-210` decode to `Unsupported` — visible refusal, not silent drop. *(`PropertySet` isn't a `ValueOneofCase`; it rides `metric.Properties`)* | Deferred feature |
+| **514** | Rebirth unarmable on a plant that hasn't birthed | **CONFIRMED** | `RawBrowseModal.razor:119-120` disabled; `_rebirthTarget` set only by tree-click handlers (`:432`, `:437`, `:439-451`). Empty tree ⇒ permanently disabled | Defect (chicken-and-egg) |
+| **513** | Meaningless `payloadFormat` in Sparkplug blob | **CONFIRMED** | `MqttTagConfigModel.cs:210` unconditional `Set`, vs. mode-aware `:216` | Defect (cosmetic) |
+| **512** | `.Browser` → `.Driver` layering | **CONFIRMED** | `…Mqtt.Browser.csproj:43` (**not :44**), boxed "KNOWN, DELIBERATE EXCEPTION" at `:16-42` | Deferred refactor |
+| **511** | `ActAsPrimaryHost` does nothing | **CONFIRMED** | Option at `MqttDriverOptions.cs:193`, round-tripped in the UI, handled only by a warning at `MqttDriver.cs:933-948`. No STATE publish, no Last Will | Deferred feature |
+| **510** | `_canRebirth` captured at browse-open | **CONFIRMED** | `RawBrowseModal.razor:377` sole `true` assignment; failure path `:516-539` never re-evaluates | Defect (stale affordance) |
+| **509** | Metric name with `/` unbrowse-committable | **CONFIRMED** | `RawBrowseCommitMapper.cs:63` uses browse name verbatim → `RawPaths.cs:39` rejects `/` → `RawTreeService.cs:976` **all-or-nothing** kills the whole batch | Defect |
+| **508** | MQTT write-through | **CONFIRMED** | `MqttDriver.cs:66` — no `IWritable`; consequence at `DriverInstanceActor.cs:673-677` | Deferred feature |
+| **507**→ see above | | | | |
+| **491** | Continuous-historization live gate | **CANNOT VERIFY** (needs VPN'd gateway) | Code **is** complete: `AddressSpaceApplier.cs:238`→`:540`→`ActorHistorizedTagSubscriptionSink.cs:27-38`→`ContinuousHistorizationRecorder.cs:84`, wired `ServiceCollectionExtensions.cs:435` | Deferred test |
+| **489** | Hot-rebind renamed raw tag | **CONFIRMED** | No implementation exists | Deferred feature |
+| **481** | Comms-loss → scripted-alarm quality (Layer 4) | **CONFIRMED** | `DriverHostActor.cs:1356-1379` iterates `_alarmNodeIdByDriverRef` only. **Issue is wrong that the per-driver ref set is missing** — `_nodeIdByDriverRef` exists at `:193`; only the fan-out into the mux is absent, so the work is *smaller* than filed | Deferred feature |
+| **468** | Wave-0 browser tree render | **CANNOT VERIFY** (fixture) | Code path present (`AbCipDriver.cs:1092-1095`, `LibplctagTagEnumerator.cs:29-37`); `ab_server` returns `ErrorUnsupported` for CIP Symbol Object enumeration | Deferred verification |
+
+### 2.1 Cross-cutting observations
+
+1. **#518 → #507 are the same failure, stacked.** The event has no subscriber *and* its downstream
+   handler hard-returns. **Fixing either alone changes nothing observable** — schedule them together.
+2. **#516 is a superset of part of #489.** For the five drivers that discard reinit config, the
+   renamed-tag-never-rebinds symptom follows mechanically (their `_tagsByRawPath` still keys on the
+   old RawPath). Re-scope #489 after #516.
+3. **#519 and #481 share the same `statusCode >> 30` collapse idiom** at three independent sites
+   (`DriverInstanceActor.cs:1033`, `ScriptedAlarmEngine.cs:745`, `:777`). Widening the status path
+   must cover all three.
+
+---
+
+## 3. Dead seams — authored, shipped, never executed
+
+**The most consequential category in this register**, and the one nothing in the code flags. Three
+subsystems are fully built and reachable by operators, but no production code path executes them.
+
+### 3.1 Node-level ACLs are authorable, deployed — and unenforced
+
+- `IPermissionEvaluator`, `TriePermissionEvaluator`, `PermissionTrieCache`, `PermissionTrieBuilder`
+  have **zero references outside `src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/` and their own
+  tests** (independently re-verified for this report: every other grep hit is a `bin/`/`obj/` XML doc artifact).
+- `OtOpcUaNodeManager` contains **no reference to `Permission` or `Evaluator` at all.**
+- Meanwhile `ClusterAcls.razor` + `AclEdit.razor` let operators author `NodeAcl` rows, and
+  **`ConfigComposer.cs:51` snapshots them into every deployment artifact.**
+
+**Impact:** an operator authors a deny rule, deploys it green, and it has no effect. Actual
+enforcement is coarse LDAP roles plus the realm-qualified `WriteOperate` gate in the node manager —
+and that is a **write** gate; reads carry no per-node ACL check.
+**`docs/ReadWriteOperations.md:13,21` states the opposite** (see §7.1) — it is the single
+highest-risk doc error found.
+
+### 3.2 `IRediscoverable` + `IHostConnectivityProbe` raise into the void
+
+Gitea #518/#507. Nine drivers raise; nothing consumes. `DriverHostStatus` table exists
+(`OtOpcUaConfigDbContext.cs:48`, migration `20260715230637_V3Initial.cs:108`) with a doc-comment
+claiming a writer — **nothing ever writes a row.**
+
+**Impact:** an Agent/PLC/Galaxy restart leaves a stale address space behind a Healthy driver, and the
+per-host connectivity table is permanently empty.
+
+### 3.3 `DriverTypeRegistry` is vestigial
+
+Independently verified for this report: `src/Core/…Core.Abstractions/DriverTypeRegistry.cs:20` is
+referenced **only** by `tests/Core/…/DriverTypeRegistryTests.cs`. Nothing registers metadata at
+startup; nothing validates `DriverInstance.DriverType` against it. Its `AllowedNamespaceKinds` field
+was retired with the v3 `Namespace` entity (`DriverTypeRegistry.cs:97`).
+
+**Knock-on:** the driver **stability tier** does not come from here either. The live source is
+`DriverFactoryRegistry.cs:46` (`DriverTier tier = DriverTier.A`) and **no factory in `src/Drivers/`
+passes a tier** — so all 12 drivers run Tier A, and the Tier-C-only protections are dormant for
+every driver: `MemoryRecycle.cs:54` (`when _tier == DriverTier.C`) and
+`ScheduledRecycleScheduler.cs:43` (refuses unless Tier C). `docs/v2/driver-stability.md` still
+assigns Galaxy and FOCAS to Tier C.
+
+### 3.4 Related dead/dormant code
+
+| Item | Evidence |
+|---|---|
+| `IDriverConfigEditor` — interface, zero implementors, zero production consumers | `Core.Abstractions/IDriverConfigEditor.cs:9`; superseded by `TagConfigEditorMap` / `DriverConfigModal` |
+| `GenericDriverNodeManager` — explicitly **not** a production dispatch path | `Core/OpcUa/GenericDriverNodeManager.cs:71` ("verified 07/#10: zero production references") |
+| `IDriverSupervisor` — Tier-C recycle machinery has **zero implementations**, yet the parser still validates `RecycleIntervalSeconds` | archreview 01/U-2 |
+| Resilience **bulkhead** — documented, defaulted, parsed, AdminUI-authorable; `Build` never adds a concurrency limiter | archreview 01/U-6 |
+| `WriteIdempotentAttribute` — zero readers; write dispatch hardcodes `isIdempotent: true` | archreview 01/S-8 = 03/S12 |
+| ~60 lines of unreachable code retained behind #507's guard | `DriverHostActor.cs:1002`, `#pragma warning disable CS0162` |
+| Three empty `Driver.Historian.Wonderware*` directories (0 `.cs`, no `.csproj`, absent from `.slnx`) | verified for this report — only stale `bin/`+`obj/` remain |
+
+---
+
+## 4. In-code deferrals by subsystem
+
+The tree is unusually clean on classic markers: **9 `TODO`s across 1,812 files; zero
+`FIXME`/`HACK`/`XXX`/`WORKAROUND`; zero `#if false`; zero `[Obsolete]` on project code; zero
+commented-out DI registrations.** Real deferred work lives in prose doc-comments and skipped tests.
+
+### 4.1 Highest-consequence
+
+| Item | Evidence |
+|---|---|
+| **Telemetry snapshot cache never evicted** — a decommissioned driver replays last-known Health/Resilience to new subscribers forever | `TelemetryLocalHub.cs:40` `TODO(mesh-phase5+)` — self-declared, bounded, "pre-production, accepted" |
+| **Device host recovered by string-matching instead of `DeviceConfig`** — 7 of the repo's 9 TODOs are this one item, across 4 drivers | `FocasDriver.cs:137,287`; `TwinCATDriver.cs:775`; `AbLegacyDriver.cs:557`; `AbCipDriver.cs:89,1272` + `AbCipDriverOptions.cs:130` — all `TODO(v3 WaveC)` |
+| **Galaxy writes can never confirm a COM commit** — empty status array ⇒ provisional Good, metered `galaxy.writes.unconfirmed` | `GatewayGalaxyDataWriter.cs:44,328,354` — **cross-repo**, blocked on mxaccessgw |
+| **Subscription liveness undetectable** — `ISubscriptionHandle` is opaque | `DriverInstanceActor.cs:527` (#488) — well-reasoned, deferred "until a real occurrence" |
+| **`/raw` "Browse device" is still a placeholder** despite the universal discovery browser landing | `RawTree.razor:15,426` — **verify**; may be reachable now via `DiscoveryDriverBrowser` |
+
+### 4.2 Per-driver
+
+- **S7** — array **writes** unsupported entirely (`S7Driver.cs:1139`); several array *read* types unsupported (`:386,404,413,419,428,442,465,807,959`) — all fail fast at config-validation; legacy C-area counter reinterpretation live-hardware-gated (`:759`); Counter BCD on S7-300/400 undecoded.
+- **AbCip** — ALMD-only alarm projection, ALMA deferred (`AbCipAlarmProjection.cs:16,324`); no CIP Template Object reader, UDT layouts declaration-driven (`AbCipDriverOptions.cs:172`); whole-UDT writer deferred (`LibplctagTagRuntime.cs:190`); `AckCmd` pulse must be wired client-side (`:30`).
+- **Sql** — `SqlTagModel.Query` deferred to P3, **enforced end-to-end** across parser, validator, planner and editor (`SqlProvider.cs:22,37`; `SqlEquipmentTagParser.cs:24,103`; `SqlGroupPlanner.cs:44,249`; `SqlTagConfigModel.cs:114`) — exemplary deferral discipline. Postgres/ODBC dialects deferred behind `ISqlDialect`.
+- **MTConnect** — `TIME_SERIES` vectors deferred to P1.5; `DATA_SET`/`TABLE` coded `BadNotSupported` with a null value rather than approximated (`MTConnectObservationIndex.cs:53,272`) — deliberately chosen over a Good-coded lie. `RawTagEntry.DeviceName` ignored for routing (two `/raw` Devices under one driver share an Agent connection) — "a design change, not a bug fix". No DataType-vs-blob validation at authoring.
+- **MQTT** — `MaxPayloadBytes` is a constructor knob, not operator-facing (`MqttSubscriptionManager.cs:170`).
+- **TwinCAT** — Flat-mode struct expansion carries a **LIVE RISK** note, unverified against a real TC3 target (`AdsTwinCATClient.cs:270`); VirtualTree-mode browse unverified; TC2 coverage, multi-hop AMS route and lab rig all hardware-blocked (`docs/v3/twincat-backlog.md`).
+- **FOCAS** — forces read-only regardless of authored `writable:true`; servo-load semantics inferred from the wire, unconfirmed against a real CNC (`FocasWireClient.cs:944`); `"Backend": "unimplemented"` is a **deliberate fail-fast stub**, not unfinished work.
+- **Historian.Gateway** — String/DateTime/Reference writes deferred, gated on the analog SQL write path; `UInt16 → Uint4` widening because the `UInt2` write path is deferred upstream (`HistorianTypeMapper.cs:27-51`).
+
+### 4.3 Fleet-wide OPC UA gaps
+
+- **Array writes deferred across all drivers**; **multi-dimensional arrays (`ValueRank>1`) unsupported**; **array historization** is an opaque blob with no per-element history (`docs/Uns.md:288-292`, `AddressSpaceApplier.cs:873`, `OtOpcUaNodeManager.cs:1764`).
+- **`HistoryUpdate`** — permission bit `1<<12` shipped but excluded from every composite bundle; no service surface (`NodePermissions.cs:34`).
+- **`Utils.Log*` is `[Obsolete]`** in SDK 1.5.378, suppressed at 8 sites in `OtOpcUaNodeManager` pending an `ITelemetryContext` rewire.
+
+### 4.4 Skipped tests — 36, from 4 reason constants
+
+| Count | Reason | Assessment |
+|---|---|---|
+| 18 | `DiscoveryInjectionDormantV3` | **Real** — blocked on #507 |
+| 13 | `EquipmentTagsDarkBatch4` | **STALE** — the reason says these unblock "at Batch 4"; Batch 4 shipped as v3.0 and the path was *retired* (`AddressSpaceApplier.cs:415` calls it "the vestigial equipment-tag path"). These will never unskip as written — delete or rewrite the reason. |
+| 4 + 1 | `EquipmentDeviceBindingRetired`, `DarkBatch4` | Intentional tombstones preserving retirement rationale — fine as-is |
+
+Plus **4 whole OpcUaClient test suites that are scaffold-only**, awaiting an in-process OPC UA server
+fixture that was never built (`OpcUaClientSubscribeAndProbeTests`, `…DiscoveryTests`,
+`…ReadWriteTests`, `…HistoryTests`, all `:10`).
+
+All env-gated integration suites **skip cleanly** when their vars are absent. The MTConnect gate is
+notably a **real `/probe` reachability + payload-shape check** (`MTConnectAgentFixture.cs:42`), not
+mere env-var presence, so it cannot pass vacuously.
+
+---
+
+## 5. Open live gates
+
+| Gate | Status | Evidence |
+|---|---|---|
+| **Continuous-historization value capture** (#491) | **OPEN** — code complete, unproven in production | `CLAUDE.md:710`; no gate-passed commit exists |
+| **Wave-0 universal discovery browser** full tree render (#468) | **OPEN** — fixture-blocked | tracking doc §Wave 0; named as blocking BACnet browse |
+| **archreview R2-03** — VT Good→Bad on a data-fed rig | **OPEN** — explicitly "live-blocked on this data-less rig" | `archreview/plans/STATUS.md` |
+| **archreview R2-10** — force breaker-OPEN live | **OPEN** — breaker-OPEN state never forced live | `archreview/plans/R2-10-*.tasks.json` |
+| **Driver-reconfigure-while-faulted** Task 3 | **OPEN** — task subject literally "DEFERRED" | `2026-07-14-driver-reconfigure-while-faulted-plan.md.tasks.json` |
+| Galaxy `ScanStateProbeParityTests` | **OPEN** — licence-gated (one `$WinPlatform` on this box) | `docs/v2/Galaxy.ParityRig.md:180` |
+| **v2 GA exit criteria** — FOCAS live-CNC wire smoke (#54), OPC UA CTT/compliance pass, Ignition 8.3 redundancy cutover | **OPEN** — manual/hardware/external-tool | `docs/v2/v2-release-readiness.md:105-120` |
+| mesh Phase 4 | ✅ **PASSED** `1281aebf` | CLAUDE.md said open — **corrected**, §7.2 |
+| mesh Phase 5 | ✅ **PASSED** `f134935f` | CLAUDE.md said pending — **corrected**, §7.2 |
+| auto-down 1-vs-1 crash-the-oldest | ✅ **PASSED** — Phase 7 drill D4, `c50ebcf7` | CLAUDE.md said open — **corrected**, §7.2 |
+
+**Note on the 14 archreview `deferred-live` tasks across 8 plans:** `archreview/plans/STATUS.md:242-305`
+records a 2026-07-13 live pass closing several (R2-02, R2-07, R2-11, R2-04, R2-05-partial) and
+2026-07-15 closures for R2-01/R2-08/R2-06 — **but the `.tasks.json` files were never updated.** Only
+R2-03 and R2-10 have no closure record anywhere.
+
+---
+
+## 6. Plan bookkeeping — stale vs. live
+
+**59 of 78 `docs/plans/*.tasks.json` are 100 % complete.** Of the remaining 19, most are stale
+bookkeeping, not backlog.
+
+### 6.1 STALE — work shipped, file never updated (~140 phantom "pending" tasks)
+
+| File | Recorded | Reality |
+|---|---|---|
+| `2026-07-24-mtconnect-driver.md.tasks.json` | 23 pending | Merged at master tip `90bdaa44`, 5-leg live gate PASSED |
+| `2026-07-24-mqtt-sparkplug-driver.md.tasks.json` | 27 pending | All 27 done, both phases live-gated |
+| `2026-07-24-sql-poll-driver.md.tasks.json` | 22 pending | Merged `4ad54037` + follow-ups `28c28667` |
+| `2026-07-24-modbus-rtu-driver.md.tasks.json` | 11 pending | Merged `0f38f486` (#495), live gate PASSED |
+| `2026-06-26-otopcua-historian-gateway-integration.md.tasks.json` | 21 pending | Shipped as PR #423, live-validated |
+| `2026-06-15/16-stillpending-phase-{0-1,2,3,4}.md.tasks.json` | 12+9+10+8 pending | Shipped — audit §D cites `1e95856b`, `ada01e1a`, `fc8121cb`, `3e609a2b`, `70e6d3d2`, `c236263e`, `bd8fee61`, `5e27b5f7`, `fcb38014` |
+| `2026-07-22-per-cluster-mesh-program.md.tasks.json` | Phase 2 in_progress, 3–7 pending | Plan body `:331-342` says **program COMPLETE** |
+| `2026-06-12-historian-tcp-transport.md.tasks.json` | 12 pending | **OBSOLETE** — targets the retired Wonderware sidecar |
+
+### 6.2 GENUINELY LIVE
+
+| File | Open | Note |
+|---|---|---|
+| **`2026-05-29-adminui-followups.md.tasks.json`** | **19 pending / 0 completed** | **The largest unexecuted plan in the tree.** Generic `CollectionEditor<TRow>`; per-driver device/tag editors ×7; typed resilience form; `RoleMapper.Merge` + DB-backed LDAP→role mapping + `RoleGrants.razor` + FleetAdmin authz. **Several items look superseded by v3's `TagConfigEditorMap` — verify overlap before executing.** |
+| `2026-06-19-followups-batch.md.tasks.json` | 4 pending + 1 partial | B4 F10b surgical DataType/IsArray writes and B5 alarm-severity `SetSeverity` are **OPEN-by-choice, not built** |
+| `2026-06-26-otopcua-fixedtree-followups.md.tasks.json` | 1 pending | Task 11 build + regression |
+| `2026-05-26-akka-hosting-alignment-plan.md.tasks.json` | 5 partial | F8/F9/F10/F13/F14 — oldest open items; **likely superseded by v3, verify** |
+| `2026-05-28-adminui-driver-pages-plan.md.tasks.json` | 1 partial | 10.4 manual smoke checklist |
+
+`docs/plans/2026-07-23-mesh-phase4-…tasks.json` Task 9 was the only `deferred`-flagged mesh task —
+**it has since landed** (`3a590a0c`), so that file is now stale too.
+
+### 6.3 Review-directory state
+
+- **`code-reviews/`** — 51 modules, **zero Open findings**. One textual "Left Open pending a decision"
+  survives in a finding body (`Configuration/findings.md:254`, LDAP collation) whose status field
+  reads Deferred — the only index inconsistency.
+- **`code-reviews/` coverage gap** — **10 shipped source projects have never been reviewed**:
+  `Driver.Calculation`, `Driver.Historian.Gateway`, `Driver.Mqtt` (+`.Browser`, `.Contracts`),
+  `Driver.MTConnect` (+`.Contracts`), `Driver.Sql` (+`.Browser`, `.Contracts`). Meanwhile three
+  modules review the **retired** Wonderware backend.
+- **`archreview/`** — `00-OVERALL.md:60-79` carries an explicit "Carried open … no remediation branch
+  targeted them" block. The largest coherent batch is the **failure-visibility trio**: 01/S-1
+  (`AddressSpaceApplier` swallows every sink failure, deploy reports Applied even when broken), 03/S4
+  (primary gate default-allow on unknown role), 06/S-1 (Galaxy optimistic write success).
+- **`stillpending.md` does not exist** — the backlog is `docs/plans/2026-06-18-stillpending-backlog-audit.md`.
+
+---
+
+## 7. Documentation corrections
+
+### 7.1 Applied in this pass
+
+| File | Was | Now |
+|---|---|---|
+| `CLAUDE.md` §Change Detection (`:156`) | "The server's `DriverHost` consumes the signal and rebuilds the address space" | ⚠️ nothing consumes it; names `DriverHostActor.cs:986`, #518/#507, and the four affected drivers |
+| `CLAUDE.md` §Redundancy (`:272`) | auto-down "live gate is still open … docker-dev is a single six-node mesh" | gate **CLOSED** by Phase 7 drill D4 (`c50ebcf7`); the six-node-mesh claim also contradicted CLAUDE.md's own Phase 6 paragraph |
+| `CLAUDE.md` §Telemetry (`:383`) | Phase 5 "code-complete on `feat/mesh-phase5`, live gate pending" | merged `35552a96`; live gate PASSED `f134935f` |
+| `CLAUDE.md` §Phase 4 (`:493`, `:502-503`) | `ScriptedAlarmState` "dropping it is a deferred follow-up, tracked as Task 9"; "Task 9 and the live gate (Task 10) are still open" | table **dropped** (`3a590a0c`, migration `20260723183050_DropScriptedAlarmStateTable`); live gate PASSED `1281aebf` |
+| `docs/plans/2026-07-24-driver-expansion-tracking.md` | Modbus RTU "pending merge"; SQL poll "📝 Plan ready (22 tasks)"; **an "Executing a plan" table instructing you to rebuild both** | both marked ✅ Done with merge SHAs; the two shipped rows struck from the command table; Wave 1/2 headings and §Next actions corrected |
+| `docs/drivers/README.md` | `DriverTypeRegistry` "registered at startup"; "namespace kinds (Equipment + SystemPlatform)"; no Sql/Calculation rows; "Modbus TCP" only | registry marked vestigial + tier truth; namespace line corrected to Raw+UNS; Sql + Calculation rows added; Modbus row covers RTU-over-TCP |
+| `docs/drivers/TwinCAT.md` (`:95`, `:99-103`, `:151`) | "so the address space is rebuilt" / "so Core rebuilds the address space" | raises-but-unconsumed caveat, mirroring the wording `Mqtt.md`/`MTConnect.md` already use correctly |
+| `docs/drivers/Galaxy.md` (`:73`) | `IRediscoverable` row with no caveat | same caveat added |
+| `docs/v2/Runtime.md` (`:106`) | "named-pipe IPC to the Wonderware historian sidecar + `SqliteStoreAndForwardSink`" | gRPC to HistorianGateway + `LocalDbStoreAndForwardSink` |
+| **`docs/ReadWriteOperations.md`** (`:13`, `:21` + banner) | "ACL enforcement (`WriteAuthzPolicy` + `AuthorizationGate`) runs before the source branch"; "**A denied read never hits the driver**" | Both struck through and corrected; banner states plainly that **no per-node ACL gate exists on any operation** and that `GenericDriverNodeManager` is test scaffolding. **This was the highest-risk doc error found.** |
+| **`docs/IncrementalSync.md`** (banner) | whole "Rebuild flow" + generation-publish path presented as current | Banner: `GenericDriverNodeManager` is non-production, rediscovery has no consumer, `sp_PublishGeneration`/`sp_ComputeGenerationDiff` `RAISERROR`, `DraftRevisionToken` gone; names the one live path (deploy artifact) |
+| **`docs/AddressSpace.md`** (banner) | "single custom namespace"; `Phase7Applier`/`Phase7Composer`/`GalaxyTagPlan`; `SystemPlatform` | Banner: two namespaces w/ `V3NodeIds`, the `AddressSpace*` rename (`40e8a23e`), `AddressSpaceComposition` as the result type, `SystemPlatform` retired |
+| `docs/v2/phase-7-status.md`, `v2-release-readiness.md`, `redundancy-interop-playbook.md`, `AdminUI-rebuild-plan.md` (banners) | present-tense claims about types that no longer exist | Dated "⚠️ Historical" banners naming the specific dead types. `v2-release-readiness.md`'s banner also flags that its `:41` "ACL enforcement Closed" row is false, while noting its unchecked GA exit criteria **are** still live. (`docs/StatusDashboard.md` already self-declares Superseded — left alone.) |
+| `docs/OpcUaServer.md` (`:14`, `:51`), `docs/README.md` (`:65`), `docs/drivers/OpcUaClient-Test-Fixture.md` (`:127`) | `WriteAlarmState`; `LdapUserAuthenticator` ×2; `RedundancyCoordinator` | `WriteAlarmCondition`; `LdapOpcUaUserAuthenticator`; `RedundancyStateActor` + `IRedundancyRoleView` |
+| `docs/Historian.md` | no mention of #491 or the provisioning gap | ⚠️ block added: continuous value capture is **code-complete but unproven in production**, with the wiring chain; plus the `EnsureTags`-skips-existing-tags gap |
+
+### 7.2 Recorded, NOT applied — needs a decision or a rewrite, not a line edit
+
+The three highest-priority items in this list were **bannered rather than rewritten** in this pass
+(cheap, stops the misleading, preserves the record) — the underlying rewrite is still owed. They now
+appear in §7.1 as well.
+
+| Priority | File | Problem |
+|---|---|---|
+| **1 (security-relevant)** | `docs/ReadWriteOperations.md:13,21` | **Bannered + struck through.** Claimed ACL enforcement via `WriteAuthzPolicy` + `AuthorizationGate` + `NodeScopeResolver` and that "a denied read never hits the driver". All four names have zero hits in `src/`; §3.1 shows there is no read-path ACL gate at all. **Still owed:** a proper §-rewrite against the real node-manager write gate. Same false claim at `docs/v2/v2-release-readiness.md:41` (bannered). |
+| **2** | `docs/IncrementalSync.md` | **Bannered.** Entire "Rebuild flow" (`:37-47`) built on non-production `GenericDriverNodeManager`; `:26-34` cites `sp_PublishGeneration`/`sp_ComputeGenerationDiff`, both retired stubs that `RAISERROR` (`20260715230637_V3Initial.StoredProcedures.cs:194`); `:31` cites `DraftRevisionToken` (0 hits); `:49-51` describes a `ScopeHint` no consumer reads. **Still owed:** rewrite around the deploy-artifact path, or archive to `docs/v1/`. |
+| **2** | `docs/AddressSpace.md` | **Bannered.** v2-era throughout: `:7,42` claim a single namespace (v3 has two); `:7,48,70` cite `Phase7Applier` + `GalaxyTagPlan` + a nonexistent file path; `:62-64` repeats the rediscovery claim. **Still owed:** rewrite §"Root folder" + §"NodeId scheme" against `V3NodeIds` / `AddressSpaceRealm`. |
+| 3 | 6 docs, ~20 citations | **`Phase7*` → `AddressSpace*`** rename (`40e8a23e`). Mostly mechanical, **except three that are not renames** and need the real member identified first: `Phase7CompositionResult` → **`AddressSpaceComposition`** (`AddressSpaceComposer.cs:13`, verified for this report); `Phase7Composer.ExtractTagFullName` → nearest live seam is `ScriptTagCatalog.ExtractFullNameFromTagConfig`; **`Phase7EngineComposer.RouteToHistorianAsync` is simply gone** — the real seam is `HistorianAdapterActor` → `IAlarmHistorianSink`. |
+| 3 | `docs/v2/driver-specs.md` | Covers 8 of 12 drivers (missing MQTT, MTConnect, Sql, Calculation, and the Modbus `Transport` selector) while `docs/drivers/README.md` calls it authoritative "for **every** driver". Either add four sections or downgrade the claim. |
+| 3 | `docs/v2/driver-stability.md:47-54` | Puts Galaxy and FOCAS in Tier C; `docs/drivers/README.md` says Tier A for both. **Moot at runtime** — see §3.3 — but the two docs contradict each other. |
+| 3 | `docs/drivers/Sql.md`, `docs/drivers/Calculation.md` | **Do not exist.** Sql is documented only in design/plan/research files; Calculation only at `docs/Raw.md:66-69`. |
+| — | `docs/operations/2026-07-16-secrets-clustered-master-key.md:38` | `NoOpSecretReplicator` exists **only** in a test. **Investigate before editing** — the sentence makes a security-relevant claim ("no built-in cross-node replication today"), so it needs the real behaviour identified, not a rename. Left untouched deliberately. |
+| — | `docs/v2/driver-specs.md` §2 | `docs/drivers/Modbus.md:10-11` points readers here for the Modbus config shape, and this file omits the `Transport` selector. Folded into the driver-specs item above. |
+
+---
+
+## 8. Recommended sequencing
+
+1. ~~**§3.1 ACL enforcement** — decide: wire `IPermissionEvaluator` into `OtOpcUaNodeManager`, or
+   remove the authoring UI and say plainly that ACLs are not enforced. Either way fix
+   `docs/ReadWriteOperations.md` first; it is the one that could mislead a security review.~~
+   ✅ **Done** — decided *make non-enforcement explicit*; wire-up tracked as Gitea **#520**. See §9.
+   (`docs/ReadWriteOperations.md` was **not** the sharpest one — `docs/security.md` was.)
+2. ~~**#518 + #507 together** — neither fix is observable alone.~~ ✅ **Done.** The framing was right
+   that they had to be handled together, but wrong about the resolution: **#507 was not revivable**,
+   so it was deleted rather than fixed. See §9.
+3. ~~**#516** — silent config discard on 5 drivers; then re-scope #489, which it partly subsumes.~~
+   ✅ **Done.** See §9. #489 is still open and should now be re-scoped.
+4. ~~**G-4** — extend the existing picker-parity test to `DriverConfigModal` + `DeviceModal`; it would
+   have caught G-1 and G-2 for free, and this class has now recurred twice.~~ ✅ **Done**, together with
+   G-1, G-2, G-3, G-5 and G-6. See §9.
+5. ~~**Bookkeeping sweep** — mark the 8 stale `.tasks.json` files complete so the 19-task AdminUI plan
+   (§6.2) is visible as the real backlog it is.~~ ✅ **Done.** See §9.
+6. ~~**§3.3 tier truth** — either pass real tiers at factory registration or delete the Tier-C
+   machinery; today it is documented, authorable and dormant.~~ ✅ **Documented**; the keep-or-delete
+   code decision is Gitea **#522**. See §9.
+
+---
+
+## 9. Execution log
+
+Remediation of §8, on branch `feat/deferment-remediation`. Status is updated in the **same commit** as
+the work, so this register never disagrees with the tree.
+
+| §8 item | Status | Commit |
+|---|---|---|
+| 1. ACL enforcement decision | ✅ **Done** — decided *make non-enforcement explicit*; Gitea **#520** tracks the wire-up | `d1e88dc4` |
+| 2. #518 + #507 | ✅ **Done** — `IRediscoverable` consumed as a re-browse prompt; #507's injection path **deleted**; `IHostConnectivityProbe` half split to Gitea **#521** | `09a401b8`, `97c9f4b4` |
+| 3. #516 config discard | ✅ **Done** — seam respawn + re-parse on 3 drivers; Sql/FOCAS deliberately respawn-only | `2dc19f30` |
+| 4. G-4 dispatch-map parity | ✅ **Done** — G-1…G-6 all closed, live-verified on docker-dev | `abacf4cf` |
+| 5. Bookkeeping sweep | ✅ **Done** — 13 plan files closed, 11 archreview gates written back | `03658c2e` |
+| 6. Tier truth | ✅ **Done** — docs reconciled; keep-or-delete is Gitea **#522** | `03658c2e` |
+
+### 2026-07-27 — §8.1 ACL non-enforcement made explicit
+
+Decision: **do not wire the evaluator, do not delete it** — state plainly that it does not run, and
+track the wire-up as **Gitea #520**.
+
+Applied:
+
+- `docs/security.md` — the `NodeScope`/`PermissionTrie`/"Dispatch gate" block now leads with a
+  **What is enforced today** table (the three real checks) before the design material, which is
+  labelled *Designed but not wired*.
+- `docs/ReadWriteOperations.md` — **rewritten**, not bannered.
+- `docs/v2/acl-design.md` — ⚠️ NEVER WIRED banner.
+- `docs/v2/v2-release-readiness.md` §"Security — Phase 6.2 dispatch wiring" — the CLOSED claim marked
+  as not holding.
+- `ClusterAcls.razor` + `AclEdit.razor` — warning alerts stating rules are stored and deployed but
+  never evaluated.
+
+**Four things this pass found that §7 and the original audit missed** — all worse than what was
+already recorded:
+
+1. **`docs/security.md` was the highest-risk doc, not `ReadWriteOperations.md`.** `:115` claimed an
+   anonymous session is "default-denie[d] any node a session has no ACL grant for". The opposite is
+   true: an anonymous session can Browse, Read, Subscribe and HistoryRead the **entire** address
+   space. It is refused only writes and alarm acks — and only because it carries no roles.
+2. **Three of the five documented data-plane role strings do nothing.** `OpcUaDataPlaneRoles` declares
+   exactly `WriteOperate` and `AlarmAck`. `ReadOnly`, `WriteTune` and `WriteConfigure` are compared
+   against nowhere in `src/`, so mapping a group to `WriteTune` grants nothing and mapping one to
+   `ReadOnly` restricts nothing. The doc called all five "exact, case-insensitive, and **code-true**".
+3. **`ReadWriteOperations.md` was fiction well beyond the ACL claims.** `OnReadValue` has **zero**
+   occurrences in `src/` — the whole documented read path did not exist. Reads never reach a driver at
+   all: the node manager is push-model and the SDK serves a client Read from the cached pushed value.
+   `WriteAuthzPolicy`, `_sourceByFullRef`, `_writeIdempotentByFullRef` and `IRoleBearer` are likewise
+   zero-hit, and `CapabilityInvoker` is not referenced by the `OpcUaServer` project at all.
+4. **`v2-release-readiness.md` claimed a whole enforcement layer shipped.** Beyond the `:41` row §7.1
+   already flagged, `:46-50` describe `FilterBrowseReferences`, `GateCallMethodRequests`,
+   `MapCallOperation`, `AuthorizationBootstrap` and `Node:Authorization:*` config keys as Closed or
+   Partial. None of them exist. Whatever landed on the v2 branch did not survive into the shipped tree.
+
+Also recorded in #520 and not previously known: every existing evaluator unit test runs in
+`PermissionTrieBuilder`'s no-`scopePaths` *deterministic test mode*, so the production hierarchy path
+is effectively untested; and `NodeAcl.ScopeId` has no FK or existence check, so scope ids dangle
+silently.
+
+### 2026-07-27 — §8.2 rediscovery as a signal; injection deleted
+
+Decision: **signal, not mutation.**
+
+`DriverInstanceActor` now consumes `IRediscoverable.OnRediscoveryNeeded` (attach in `PreStart`, detach
+in `PostStop`) and carries it on the driver-health snapshot to `/hosts` as a **re-browse chip**. It is
+advisory — the served address space is unchanged, because v3 authors raw tags through `/raw`
+browse-commit and a runtime graft would materialise nodes nobody approved.
+
+**#507's injection path was deleted, not fixed.** §2 recorded it as a "deferred (deliberate guard)".
+That was too generous: its two inputs — `EquipmentNode.DriverInstanceId` and `EquipmentTags` — are
+*structurally empty* in v3, so removing the guard would have changed a log line and injected nothing.
+Deleted with it: `HandleDiscoveredNodes`, `PartitionDiscoveredByDeviceHost`,
+`ApplyDiscoveredPlansForDriver`, the redeploy re-inject tail, `DiscoveredNodeMapper`,
+`AddressSpaceApplier.MaterialiseDiscoveredNodes`, `OpcUaPublishActor.MaterialiseDiscoveredNodes`, the
+connect-time discovery loop, and 4 files' worth of tests. `ITagDiscovery` stays — the `/raw` browse
+picker drives it through `Commons/Browsing/DiscoveryDriverBrowser`, which never went through the actor.
+
+**§4.4's "18 `DiscoveryInjectionDormantV3` — Real, blocked on #507" was wrong.** They were v2
+characterization tests asserting an equipment-rooted graft (`EquipmentRootNodeId == "EQ-1"`) that v3
+cannot produce. They could never have unskipped as written; they are deleted. Skipped tests in
+`Runtime.Tests` went 31 → 13.
+
+**The planned drift detector was deliberately NOT built.** The plan proposed diffing each connect-time
+discovery pass against the authored raw tags. Reading the drivers killed it: **Modbus, S7, MQTT,
+AbLegacy and Sql all echo authored config from `DiscoverAsync`** rather than browsing the device, so
+the diff is permanently empty for them. It would have been another plausible-looking inert seam —
+precisely the class this register exists to remove. That also removed the last consumer of the
+connect-time loop, which is why the loop went too: it was browsing real devices up to ~15× per connect
+and dropping the result.
+
+Two traps worth keeping:
+
+- `PublishHealthSnapshot` dedups on a health fingerprint, and a rediscovery raise changes none of the
+  four fields it hashed. The timestamp had to join the tuple or the dedup swallows the signal.
+  **Verified by reverting the one line — 3 of the 5 new tests go red.**
+- The shared `StubDriver.GetHealth()` returns `DateTime.UtcNow`, so its fingerprint differs every call
+  and the dedup never engages. A dedup test built on it would pass whether or not the fix is present;
+  the new tests use a stub with stable health.
+
+`IHostConnectivityProbe` was **not** resolved — it is a keep-or-delete decision, and the
+`DriverHostStatus` table was re-created deliberately in the v3 initial migration, so deleting on
+inference would be wrong. Split to Gitea **#521** with both options costed.
+
+### 2026-07-27 — §8.5 bookkeeping + §8.6 tier truth
+
+**13 plan files closed.** The 8 the register named, plus `mesh-phase4` (Task 9 landed `3a590a0c`), the
+4th `stillpending` phase file, and `historian-tcp-transport` closed as **OBSOLETE** (it targets the
+retired Wonderware sidecar; there is no Wonderware backend in the tree). Each carries a `closureNote`
+naming the evidence, so the next reader can check rather than trust.
+
+**11 archreview live gates written back** from `STATUS.md`, which had recorded them passed since
+2026-07-13/15 without ever updating the `.tasks.json` files: R2-01 #11, R2-02 #15/#18, R2-05 T15,
+R2-06 T12, R2-07 T5/T6/T12/T14, R2-11 T22/T24.
+
+**R2-03 and R2-10 were NOT closed** — and reading `STATUS.md` rather than trusting its own headline
+("Every Round-2 live gate is now GREEN") is what kept that honest. Its per-item detail says R2-03 is
+"live-blocked on this data-less rig" and R2-10 verified the pipeline but "breaker-OPEN state not
+forced". Both now carry an `openNote` recording the blocker: R2-03 needs a reachable driver fixture
+feeding a VT; R2-10 needs a rapid idempotent write to a dead endpoint, because R2-09's
+`ConnectionBackoff` throttles retries so failures never accumulate fast enough to open the Polly breaker.
+
+**Net effect (the point of the sweep):** ~140 phantom pending tasks are gone, so the genuinely
+unexecuted **19-task AdminUI follow-ups plan** is now the largest open item in `docs/plans/` rather than
+being buried. The remaining open plans are 8, and one of those (`mesh-phase6` Task 6) is a documented
+`resolved-no-flip` decision rather than work.
+
+**Tier truth:** `docs/v2/driver-stability.md` now states plainly that its tier table is aspirational —
+every driver runs Tier A, and `MemoryRecycle` / `ScheduledRecycleScheduler` have never engaged. It also
+corrects a second stale claim the register did not flag: the **separate-Windows-service hosting** it
+describes for Tier C no longer exists (Galaxy went to the mxaccessgw sidecar in PR 7.2; FOCAS went
+in-process when its managed wire client landed). No runtime change — turning recycle on for two live
+drivers deserves its own live gate, not a docs-pass side effect. Tracked as Gitea **#522**.
+
+### 2026-07-28 — the two things §8.3 deliberately did NOT build (1 of 2)
+
+**Sql and FOCAS now re-parse in place too.** The first pass excluded them for a real reason — each derives
+more than options from config, so adopting new options alone would run a **new tag set against an old
+connection/backend**, and a half-applied change is worse than a discarded one because it looks like it
+worked. Rather than accept that, the blocker itself is fixed: each factory now exposes a **`ParseBinding`**
+that returns *every* config-derived dependency as one value, and the driver adopts them **atomically**.
+
+| Driver | What one parse now yields | Adopted by |
+|---|---|---|
+| Sql | options + `ISqlDialect` + resolved connection string | `ApplyBinding`, which also rebuilds the provider factory, `Endpoint` and the `SqlPollReader` that captures all three |
+| FOCAS | options + the `IFocasClientFactory` the `Backend` key selects | one assignment pair in `InitializeAsync` |
+
+Details worth keeping:
+
+- **Sql adopts BEFORE `BuildTagTable`**, so the tag table and the connection it will be polled over always
+  come from the same revision.
+- **A test-injected `DbProviderFactory` survives a rebind** (`_explicitFactory`), so a re-derived dialect
+  cannot silently displace what a test passed in.
+- **Re-resolving the connection string on reinit is a side benefit**: a rotated credential is picked up
+  without a process restart.
+- A driver constructed **directly** gets no rebinder and keeps its constructor-supplied binding — every
+  existing `"{}"`-passing lifecycle test is unaffected by construction, not by luck.
+
+**The tests pin ATOMICITY, not merely "a re-parse happened"** — a test that only checked options would have
+passed against the broken version. Verified by simulating the *half-fix* (adopt options, skip the backend):
+2 of the 3 FOCAS tests go red. Reverting Sql's rebind turns its connection-string test red. Sql also asserts
+that a reinit which **cannot resolve** its new connection leaves the previous binding whole, rather than
+half-adopting.
+
+All 12 drivers now honour a changed config in place; `DriverSpawnPlanner`'s stop + respawn remains the outer
+guarantee. Sql.Tests 226 / FOCAS.Tests 275 pass.
+
+### 2026-07-28 — the two things §8.3 deliberately did NOT build (2 of 2)
+
+**The discovery-drift detector is built, and gated.** The original objection stands and is now *encoded*
+rather than used as a reason not to build: Modbus, S7, MQTT, AbLegacy and Sql echo authored config from
+`DiscoverAsync`, so a diff for them is a tautology. The missing piece was a discriminator — and the
+codebase already had one. `ITagDiscovery.SupportsOnlineDiscovery` is documented as "enumerates the tag set
+from the **live backend** rather than replaying pre-declared/authored tags", and it separates the fleet
+cleanly: **FOCAS, TwinCAT, MTConnect, AbCip** true; the five config-echo drivers explicitly false.
+
+The check runs only for a driver that is `SupportsOnlineDiscovery` **and** reports the new
+`AuthoredDiscoveryRefs` (**nullable**, default null = opt out — an *empty* collection legitimately means
+"nothing authored, everything discovered is new", and conflating the two would report total drift for a
+driver that simply never opted in).
+
+**Where the value is:** AbCip and FOCAS browse a live backend but implement **no `IRediscoverable`**, so
+before this they had *no* change signal at all — a periodic compare is the only way to notice a PLC
+re-download. TwinCAT and MTConnect already have native signals (symbol-version, agent instanceId); drift
+detection is complementary there.
+
+**A finding that changed the design.** FOCAS, TwinCAT and AbCip all **re-emit their authored tags into the
+same `DiscoverAsync` stream** as the device-derived ones, so the browse picker can show an operator their
+existing tags. That means discovered ⊇ authored *always*, and a **vanished** tag can never appear missing
+— one whole direction is structurally undetectable for three of the four. Shipping a `Vanished` list that
+is permanently empty for them would have been exactly the half-inert seam this register exists to remove.
+So the driver declares `DiscoveryStreamIncludesAuthoredTags`, the detector does not compute the
+undetectable half, and the operator message **says** "missing-tag detection unavailable for this driver"
+rather than letting the absence of a missing-tag clause read as reassurance. **MTConnect is the only
+driver where both directions work** — its stream is purely probe-model-derived.
+
+Behavioural details: a **failed browse is not drift** (an unreachable device would otherwise report every
+authored tag as vanished — the health surface already covers unreachability); a **truncated** capture is
+skipped for the same reason; an **unchanged** drift is reported once rather than re-stamping its timestamp
+every interval; drift that **resolves** clears the prompt so the next one is not deduped against a stale
+signature. Interval defaults to 5 minutes — it browses a real device, and a tag set changing is an
+engineering event, not a runtime one.
+
+The comparison is a pure, separately-tested type (`TagSetDriftDetector`) rather than actor-inline logic.
+14 new tests. The gate was verified load-bearing by deleting the `SupportsOnlineDiscovery` half — the
+tautology-driver test goes red, and it asserts discovery was **never invoked** rather than merely "no
+prompt raised", which would have passed for the wrong reason if the timer simply never fired.
+
+### 2026-07-27 — §8.4 dispatch-map parity (G-1 … G-6)
+
+**The maps had to become data before they could be guarded.** A Razor `@switch` compiles into
+`BuildRenderTree`'s IL, so nothing can enumerate its cases — that is the whole reason G-1 and G-2
+survived review while the sibling picker guard stayed green (the picker test works only because
+`RawDriverTypeDialog` keeps its data in a *field* the markup enumerates). Both modals now render from
+`DriverConfigFormMap` / `DeviceFormMap` via `<DynamicComponent>`, and being `public` those maps need
+none of the picker test's `BindingFlags.NonPublic` fragility.
+
+| Gap | Resolution |
+|---|---|
+| G-1 | `CalculationDriverForm.razor` added — `RunTimeout` was unauthorable through the UI. |
+| G-2 | Sql / MTConnect / Calculation are declared **single-connection** rather than given hollow device forms — each holds one connection at the driver level, so a per-device endpoint editor would be meaningless. |
+| G-3 | `DriverConfigModal`'s hardcoded `Galaxy or Mqtt` replaced by `DeviceFormMap.IsSingleConnection`. |
+| G-4 | `DriverFormMapParityTests` (5 cases, both directions) + `DriverDispatchMapParityTests` (3). |
+| G-5 | `CsvColumnMap` entries for Sql, Mqtt, MTConnect. |
+| G-6 | `RawBrowseCommitMapper` Sql branch — **and the browser end too**, which the register missed. |
+
+**G-6 was bigger than filed.** The register said the mapper lacked a Sql branch. It also turned out that
+`SqlBrowseSession` emitted **no `AddressFields` at all**, so a browsed leaf carried only a column name —
+and a column name alone cannot address a Sql tag, which needs its table. The browser now travels
+schema/table/column and the mapper builds a `WideRow` `SqlTagConfigModel` from them. A branch alone
+would have produced a half-built blob.
+
+**Two extra findings while writing the guards:**
+
+- The G-6 test found **Modbus and Calculation** also fall through to the generic `{"address": …}` key.
+  Both are correct — neither is browsable — so the test asserts the fall-through set **equals** a
+  documented non-browsable list, in both directions. A one-way check would let a newly-browsable driver
+  be quietly added to the exclusion list instead of getting a branch.
+- `TagConfigDriverTypeNameGuardTests` was **hollow**: it enumerated a hand-written `TheoryData` that had
+  already drifted (omitting Galaxy, Sql and Mqtt), so it guarded against renames but not gaps — a new
+  `DriverTypeNames` constant would simply never appear. Now enumerated from the map, paired with a
+  coverage test in the other direction.
+
+**Live-verified on docker-dev** (`localhost:9200`, central pair rebuilt), because this repo has no bUnit
+and no unit test can cover Blazor parameter binding: opened Calculation's config — the form renders where
+it previously showed "No typed config form" — typed `3500`, saved, reopened, and the value **persisted**,
+proving the `DynamicComponent` two-way binding round-trips. Sql's form renders fully (regression check on
+the conversion) and now reads "This driver holds a single connection, authored above" (G-3). The rebuilt
+image also showed `RediscoveryNeededUtc`/`RediscoveryReason` on the wire, confirming §8.2 end-to-end.
+
+### 2026-07-27 — §8.3 #516 driver config edits silently discarded
+
+Decision: **both** — per-driver re-parse *and* the seam respawn. Reading the drivers split the
+"per-driver" half in two, which the register did not anticipate:
+
+- **Re-parse in place** (`Modbus`, `AbLegacy`, `OpcUaClient`) — `ParseOptions` extracted from each
+  factory, called from `InitializeAsync` behind a `HasConfigBody` guard so `"{}"` still keeps the
+  constructor options.
+- **Respawn-only, deliberately NOT re-parsed** (`Sql`, `FOCAS`) — each builds **more than options**
+  from config: Sql's `ISqlDialect` + resolved connection string, FOCAS's client-factory backend, both
+  injected at construction. Adopting new options alone would run a **new tag set against an old
+  connection**. Half a re-parse is worse than none. Their doc-comments now say so.
+
+**The seam respawn is the load-bearing half.** `DriverSpawnPlanner` now routes a changed
+`DriverConfig` to `ToStop` + `ToSpawn`, making the factory the single parse authority.
+`ToApplyDelta` is consequently always empty from the reconcile path. This **reverses the deliberate
+decision documented at `DriverSpawnPlan.cs:49-50`** ("a pure DriverConfig change stays an in-place
+delta — no reconnect"). That reasoning was right about resilience and wrong about the driver; the
+accepted price is a reconnect on every config edit.
+
+Two seals removed from `ApplyChildDelta`: it overwrote the cached `Spec` **synchronously, before the
+child had dequeued the message**, so the host immediately believed the new config was live and the
+next reconcile computed no delta — sealing the drift permanently; and it `Tell`d with no
+`Receive<ApplyResult>` registered, so a failed reinit (including Galaxy's deliberate
+`NotSupportedException`) dead-lettered.
+
+**A new visibility gap this change exposed, not created:** a factory throw is a *config* error
+(`TryCreate` is pure parsing; device I/O happens later), and `SpawnChild` catches it and silently
+substitutes a stub. Previously only a brand-new driver could hit it; now an ordinary config edit can.
+Raised from `Warning` to `Error` with an actionable message. It still does **not** fail the
+deployment — making it do so would let one malformed driver block a fleet deploy, so that is a
+deliberate follow-up rather than a drive-by change.
+
+**Tests.** Every pre-existing reinit test in the five suites passes `"{}"` — precisely the input a
+guarded re-parser treats as "keep the constructor options", so they were blind to this defect *by
+construction*. The new tests pass **changed** JSON. The Modbus one was verified falsifiable by
+deleting the re-parse line (goes red). Two existing tests asserted the old behaviour and were
+rewritten: `DriverSpawnPlannerTests` (two cases), and
+`DriverHostActorUnreadableArtifactTests.Dropping_a_drivers_last_tag_does_clear_its_subscription` —
+a **positive control** for a sibling absence assertion, whose observable moved from `UnsubscribeAsync`
+to `ShutdownAsync` because the teardown now happens by stopping the child rather than emptying its
+desired set. Same event, different route; the control still calibrates the settle window.
+
+Full-solution run: only pre-existing environment failures remain — `Host.IntegrationTests` (3,
+verified identical on the pre-change tree) and `Driver.AbLegacy.IntegrationTests` (4, docker
+fixture-gated, and notably these **fail rather than skip**, unlike every other fixture-gated suite).
+
+---
+
+*Generated 2026-07-27 against `master` @ `90bdaa44` by five parallel source-verification agents.
+Every `path:line` reference was read from source. Items marked CANNOT VERIFY require hardware, a
+VPN'd gateway, or a live rig and are listed as unproven rather than assumed.*
@@ -100,9 +100,11 @@ The `-v` drops the SQL volume; remove it to keep ConfigDb state across restarts.

 ## Failover smoke

-1. Watch the Traefik dashboard at `http://localhost:8089`. Both `central-1` and `central-2` should be listed as healthy in the `otopcua-admin` service.
-2. `docker compose -f docker-dev/docker-compose.yml stop central-1` — `central-2` should pick up the admin role-leader within ~15 s (Akka split-brain stable-after). Traefik will route traffic to `central-2` once its `/health/active` returns 200.
-3. `docker compose -f docker-dev/docker-compose.yml start central-1` — `central-1` rejoins as a follower; `central-2` keeps the leader role until something disturbs it.
+1. Watch the Traefik dashboard at `http://localhost:8089`. Exactly ONE of `central-1` / `central-2` is UP in the `otopcua-admin` service — the admin role-leader. The standby is DOWN by design: `/health/active` answers 503 on it, which is how Traefik pins browser traffic to the leader. (Before `ZB.MOM.WW.Health` 0.2.1 the standby answered 200, so both showed UP and this pinning silently never worked — see `lmxopcua#494`.)
+2. `docker compose -f docker-dev/docker-compose.yml stop central-1` — `central-2` picks up the admin role-leader within ~15 s (Akka split-brain stable-after) and Traefik flips it to UP. Verified 2026-07-24: the swap completed inside 20 s with **no gap** — `http://localhost:9200/` answered 200 continuously across the failover.
+3. `docker compose -f docker-dev/docker-compose.yml start central-1` — `central-1` rejoins and **reclaims** the admin role-leader, and Traefik flips back. It does not stay with `central-2`: Akka's `RoleLeader` is the lowest-address member, so the outcome is deterministic rather than sticky.
+
+> **Cold-boot caveat.** Starting both central nodes simultaneously from stopped can leave each self-forming its own 1-member cluster (self-first seed lists), in which case BOTH are their own role-leader and both answer `/health/active` 200. Check `entries["akka"].data.memberCount` on `/health/ready` — it should read 2. Restarting either node makes it join the survivor.

 ## Resource limits & dev logging

@@ -0,0 +1,34 @@
+# Isolated MQTT/Sparkplug live-gate overlay (Task 26).
+#
+# Runs the MAIN central pair ONLY, from this worktree's image, under its own
+# compose project + offset host ports, so the shared `otopcua-dev` rig and the
+# sibling driver worktrees that share `otopcua-host:dev` are untouched.
+#
+#   docker build -f docker-dev/Dockerfile --target runtime -t otopcua-host:mqtt .
+#   docker compose -p otopcua-mqtt -f docker-dev/docker-compose.yml \
+#                  -f docker-dev/docker-compose.mqtt.yml \
+#                  up -d sql migrator cluster-seed central-1 central-2
+#
+#   AdminUI  -> http://localhost:9210   (login disabled; auto-admin)
+#   OPC UA   -> opc.tcp://localhost:4850 (central-1) / :4851 (central-2)
+#   SQL      -> localhost,14350
+#
+# `!override` on every `ports` list: compose MERGES list-valued keys by
+# appending, so a plain re-declaration keeps the base file's "14330:1433" /
+# "4840:4840" and collides with the running `otopcua-dev` rig.
+services:
+
+  sql:
+    ports: !override
+      - "14350:1433"
+
+  central-1:
+    image: otopcua-host:mqtt
+    ports: !override
+      - "4850:4840"
+      - "9210:9000"
+
+  central-2:
+    image: otopcua-host:mqtt
+    ports: !override
+      - "4851:4840"
@@ -0,0 +1,45 @@
+# Isolated MTConnect live-gate overlay (Task 21).
+#
+# Runs the MAIN central pair ONLY, from this worktree's image, under its own
+# compose project + offset host ports, so the shared `otopcua-dev` rig and the
+# three sibling driver worktrees that share `otopcua-host:dev` are untouched.
+# Mirrors how the mqtt-sparkplug worktree isolated itself (`otopcua-host:mqtt`,
+# project `otopcua-mqtt`, ports 9210/4850).
+#
+#   docker build -f docker-dev/Dockerfile --target runtime -t otopcua-host:mtconnect .
+#   docker compose -p otopcua-mtc -f docker-dev/docker-compose.yml \
+#                  -f docker-dev/docker-compose.mtconnect.yml \
+#                  up -d sql migrator cluster-seed central-1 central-2
+#
+#   AdminUI  -> http://localhost:9220   (login disabled; auto-admin)
+#   OPC UA   -> opc.tcp://localhost:4860 (central-1) / :4861 (central-2)
+#   SQL      -> localhost,14340
+#
+# Both MAIN nodes run because `cluster-seed` declares MAIN as a 2-node cluster:
+# ConfigPublishCoordinator sources its expected-ack set from enabled ClusterNode
+# rows, so deploying with one node down fails at the apply deadline.
+#
+# Traefik is deliberately not started — central-1 publishes its AdminUI port
+# directly, which removes the :9200 round-robin that otherwise makes it
+# ambiguous which node served a request.
+
+# NOTE: `!override` is required on every `ports` list. Compose MERGES list-valued
+# keys by appending, so a plain re-declaration would keep the base file's
+# "14330:1433" / "4840:4840" alongside the offsets and collide with the running
+# `otopcua-dev` rig ("Bind for 0.0.0.0:14330 failed: port is already allocated").
+services:
+
+  sql:
+    ports: !override
+      - "14340:1433"
+
+  central-1:
+    image: otopcua-host:mtconnect
+    ports: !override
+      - "4860:4840"
+      - "9220:9000"
+
+  central-2:
+    image: otopcua-host:mtconnect
+    ports: !override
+      - "4861:4840"
@@ -49,14 +49,19 @@
 #   site-a-1, site-a-2     OTOPCUA_ROLES=driver,cluster-SITE-A — driver-only
 #   site-b-1, site-b-2     OTOPCUA_ROLES=driver,cluster-SITE-B — members of their
 #                          OWN 2-node mesh (self-first seeded within the pair, NOT
-#                          off central). They serve no UI and authenticate no
-#                          users; central manages + deploys to them over the
+#                          off central). They serve no UI, but they DO expose OPC UA
+#                          data-plane endpoints (4842-4845) and authenticate those
+#                          users against the same shared GLAuth (via the *ldap-env
+#                          anchor); central manages + deploys to them over the
 #                          ClusterClient/gRPC/FetchAndCache transports above, not
 #                          gossip.
 #
 #   Auth is real LDAP against the shared GLAuth on the Linux Docker host
 #   (10.100.0.35:3893, dc=zb,dc=local) — there is no LDAP container here.
-#   Only the admin-role central nodes carry the Security__Ldap__* block.
+#   EVERY host node carries the Security__Ldap__* block (shared *ldap-env anchor):
+#   the driver-only site nodes serve OPC UA endpoints too, and LDAP options are
+#   validated at boot on all of them (a node with no LDAP config crashes with
+#   OptionsValidationException — transport None + AllowInsecure false).
 #   Sign in `multi-role` / `password`.
 #
 #   traefik    PathPrefix(`/`) → central-1 / central-2 (the single UI route).
@@ -126,6 +131,43 @@ x-secrets-env: &secrets-env
  Secrets__Replication__AnnounceInterval: "00:00:05"
  ZB_SECRETS_MASTER_KEY: "${OTOPCUA_SECRETS_KEK:-ZYGhIX0luS/XsevpCB2W18jYHMcqO6AjM9oXy+T6Zp4=}"

+# EVERY node that serves an OPC UA endpoint authenticates data-plane users against the shared GLAuth —
+# that includes the driver-only site nodes (ports 4842-4845), not just the admin/central pair. LDAP
+# options are validated at host start on ALL of them (Enabled=true by appsettings default, Transport=None,
+# AllowInsecure=false ⇒ OptionsValidationException), so a node that carries no LDAP config crashes at boot.
+# This anchor is merged into every host node's environment (via `<<: [*secrets-env, *ldap-env]`). Central
+# still also lists the block inline for readability; the explicit keys win over the merge, same values.
+x-ldap-env: &ldap-env
+  Security__Ldap__Enabled: "true"
+  Security__Ldap__DevStubMode: "false"
+  Security__Ldap__Server: "10.100.0.35"
+  Security__Ldap__Port: "3893"
+  Security__Ldap__Transport: "None"
+  Security__Ldap__AllowInsecure: "true"
+  Security__Ldap__SearchBase: "dc=zb,dc=local"
+  Security__Ldap__ServiceAccountDn: "cn=serviceaccount,dc=zb,dc=local"
+  Security__Ldap__ServiceAccountPassword: "serviceaccount123"
+  Security__Ldap__GroupToRole__ReadOnly: "ReadOnly"
+  Security__Ldap__GroupToRole__WriteOperate: "WriteOperate"
+  Security__Ldap__GroupToRole__WriteTune: "WriteTune"
+  Security__Ldap__GroupToRole__WriteConfigure: "WriteConfigure"
+  Security__Ldap__GroupToRole__AlarmAck: "AlarmAck"
+
+# Readiness gate for a pair FOUNDER node (site-a-1 / site-b-1): passes once its Akka port 4053 is bound.
+# The partner (site-a-2 / site-b-2) waits on this via `depends_on: { condition: service_healthy }` so the
+# founder forms its 2-node mesh FIRST and the partner JOINS it — instead of both self-first seeds racing
+# and each forming its own single-node cluster (the split brain the Phase 6 live gate observed: 250/250,
+# both Primary). `service_started` is NOT enough — it fires the instant the container launches, long
+# before Akka binds. The image ships bash but no nc/curl, so the probe uses bash's /dev/tcp. start_period
+# gives the founder a head start to not just bind but FORM (a 1-node cluster forms within the same second
+# as the bind), so the partner's InitJoin lands on an existing cluster and is ack'd.
+x-akka-founder-healthcheck: &akka-founder-healthcheck
+  test: ["CMD-SHELL", "bash -c '</dev/tcp/localhost/4053' || exit 1"]
+  interval: 3s
+  timeout: 2s
+  retries: 20
+  start_period: 8s
+
 services:

  sql:
@@ -226,10 +268,16 @@ services:
      sql: { condition: service_healthy }
      migrator: { condition: service_completed_successfully }
    environment:
-      <<: *secrets-env
+      <<: [*secrets-env, *ldap-env]
      OTOPCUA_ROLES: "admin,driver,cluster-MAIN"
      ASPNETCORE_URLS: "http://+:9000"
      ConnectionStrings__ConfigDb: "Server=sql,1433;Database=OtOpcUa;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
+      # Sql poll driver — the named connection string a Sql driver instance references by
+      # `connectionStringRef: "DevSql"`. Resolved in-process by SqlConnectionStringResolver (driver
+      # node) and SqlDriverBrowser (AdminUI browse), env-only, never persisted to ConfigDb. Points at
+      # the rig's own `sql` container, a SEPARATE `DevSql` database seeded with dbo.TagValues (KeyValue)
+      # + dbo.LatestStatus (WideRow). Committed-dev-secret exception, same as ConfigDb above.
+      Sql__ConnectionStrings__DevSql: "Server=sql,1433;Database=DevSql;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
      Cluster__Hostname: "0.0.0.0"
      Cluster__Port: "4053"
      Cluster__PublicHostname: "central-1"
@@ -345,10 +393,16 @@ services:
      central-1: { condition: service_started }
      migrator: { condition: service_completed_successfully }
    environment:
-      <<: *secrets-env
+      <<: [*secrets-env, *ldap-env]
      OTOPCUA_ROLES: "admin,driver,cluster-MAIN"
      ASPNETCORE_URLS: "http://+:9000"
      ConnectionStrings__ConfigDb: "Server=sql,1433;Database=OtOpcUa;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
+      # Sql poll driver — the named connection string a Sql driver instance references by
+      # `connectionStringRef: "DevSql"`. Resolved in-process by SqlConnectionStringResolver (driver
+      # node) and SqlDriverBrowser (AdminUI browse), env-only, never persisted to ConfigDb. Points at
+      # the rig's own `sql` container, a SEPARATE `DevSql` database seeded with dbo.TagValues (KeyValue)
+      # + dbo.LatestStatus (WideRow). Committed-dev-secret exception, same as ConfigDb above.
+      Sql__ConnectionStrings__DevSql: "Server=sql,1433;Database=DevSql;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
      Cluster__Hostname: "0.0.0.0"
      Cluster__Port: "4053"
      Cluster__PublicHostname: "central-2"
@@ -438,6 +492,7 @@ services:

  site-a-1:
    <<: *otopcua-host
+    healthcheck: *akka-founder-healthcheck
    depends_on:
      sql: { condition: service_healthy }
      central-1: { condition: service_started }
@@ -473,6 +528,12 @@ services:
      # FetchAndCache, never gossip; central and site-a share no seed list.
      Cluster__SeedNodes__0: "akka.tcp://otopcua@site-a-1:4053"
      Cluster__SeedNodes__1: "akka.tcp://otopcua@site-a-2:4053"
+      # Simultaneous-cold-start split-brain guard (SITE-A enablement demo). With the pair no longer
+      # startup-serialized, this is what stops both self-first seeds forming their own 1-node cluster:
+      # the lower-address node (site-a-1) founds immediately; the higher (site-a-2) probes site-a-1 and
+      # joins it when reachable, or forms alone only if site-a-1 is truly down. Akka gets NO config
+      # seeds when this is on (BuildClusterOptions); ClusterBootstrapCoordinator issues JoinSeedNodes.
+      Cluster__BootstrapGuard__Enabled: "true"
      Cluster__Roles__0: "driver"
      Cluster__Roles__1: "cluster-SITE-A"
      # Mesh command transport (per-cluster mesh Phase 2, made mandatory by Phase 6) — see
@@ -487,7 +548,7 @@ services:
      MeshTransport__Mode: "${OTOPCUA_MESH_MODE:-ClusterClient}"
      MeshTransport__CentralContactPoints__0: "akka.tcp://otopcua@central-1:4053"
      MeshTransport__CentralContactPoints__1: "akka.tcp://otopcua@central-2:4053"
-      <<: *secrets-env
+      <<: [*secrets-env, *ldap-env]
      # Quiet EF/AspNetCore SQL flood — see central-1 (Serilog override). mem_limit/
      # mem_reservation are inherited from the *otopcua-host anchor.
      Serilog__MinimumLevel__Override__Microsoft.EntityFrameworkCore: "Warning"
@@ -545,6 +606,11 @@ services:
      sql: { condition: service_healthy }
      central-1: { condition: service_started }
      migrator: { condition: service_completed_successfully }
+      # SITE-A is the BOOTSTRAP-GUARD enablement demo: NO startup serialization on the pair — both
+      # nodes start simultaneously (the exact race that split-brained in the Phase 6 gate). The
+      # Cluster:BootstrapGuard (enabled in both site-a env blocks) is the ONLY thing preventing the
+      # split: it makes the lower-address node the founder and the higher-address node probe-then-join.
+      # site-b keeps the depends_on:service_healthy serialization + guard OFF, as the A/B control.
    environment:
      OTOPCUA_ROLES: "driver,cluster-SITE-A"
      # Per-cluster mesh Phase 4: no ConfigDb string on driver-only site nodes (see site-a-1).
@@ -567,6 +633,9 @@ services:
      # second) — it no longer seeds off central-1.
      Cluster__SeedNodes__0: "akka.tcp://otopcua@site-a-2:4053"
      Cluster__SeedNodes__1: "akka.tcp://otopcua@site-a-1:4053"
+      # Bootstrap-guard enablement demo — see site-a-1. site-a-2 is the HIGHER address, so the guard
+      # makes it probe site-a-1 and join it (peer-first) rather than race-form its own cluster.
+      Cluster__BootstrapGuard__Enabled: "true"
      Cluster__Roles__0: "driver"
      Cluster__Roles__1: "cluster-SITE-A"
      # Mesh command transport (per-cluster mesh Phase 2, made mandatory by Phase 6) — see
@@ -580,7 +649,7 @@ services:
      MeshTransport__Mode: "${OTOPCUA_MESH_MODE:-ClusterClient}"
      MeshTransport__CentralContactPoints__0: "akka.tcp://otopcua@central-1:4053"
      MeshTransport__CentralContactPoints__1: "akka.tcp://otopcua@central-2:4053"
-      <<: *secrets-env
+      <<: [*secrets-env, *ldap-env]
      Serilog__MinimumLevel__Override__Microsoft.EntityFrameworkCore: "Warning"
      Serilog__MinimumLevel__Override__Microsoft.AspNetCore: "Warning"
      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua2_GI7-tNozYE6cXGUSgEzL3AHDV7bYcYIHdMwKYgyHdX4}"
@@ -628,6 +697,7 @@ services:

  site-b-1:
    <<: *otopcua-host
+    healthcheck: *akka-founder-healthcheck
    depends_on:
      sql: { condition: service_healthy }
      central-1: { condition: service_started }
@@ -667,7 +737,7 @@ services:
      MeshTransport__Mode: "${OTOPCUA_MESH_MODE:-ClusterClient}"
      MeshTransport__CentralContactPoints__0: "akka.tcp://otopcua@central-1:4053"
      MeshTransport__CentralContactPoints__1: "akka.tcp://otopcua@central-2:4053"
-      <<: *secrets-env
+      <<: [*secrets-env, *ldap-env]
      Serilog__MinimumLevel__Override__Microsoft.EntityFrameworkCore: "Warning"
      Serilog__MinimumLevel__Override__Microsoft.AspNetCore: "Warning"
      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua2_GI7-tNozYE6cXGUSgEzL3AHDV7bYcYIHdMwKYgyHdX4}"
@@ -700,6 +770,10 @@ services:
      sql: { condition: service_healthy }
      central-1: { condition: service_started }
      migrator: { condition: service_completed_successfully }
+      # Serialize the SITE-B pair's startup so site-b-1 forms the mesh first and site-b-2 JOINS it — see
+      # the identical comment on site-a-2. Without this both self-first seeds form their own single-node
+      # cluster on simultaneous start (split brain).
+      site-b-1: { condition: service_healthy }
    environment:
      OTOPCUA_ROLES: "driver,cluster-SITE-B"
      # Per-cluster mesh Phase 4: no ConfigDb string on driver-only site nodes (see site-a-1).
@@ -735,7 +809,7 @@ services:
      MeshTransport__Mode: "${OTOPCUA_MESH_MODE:-ClusterClient}"
      MeshTransport__CentralContactPoints__0: "akka.tcp://otopcua@central-1:4053"
      MeshTransport__CentralContactPoints__1: "akka.tcp://otopcua@central-2:4053"
-      <<: *secrets-env
+      <<: [*secrets-env, *ldap-env]
      Serilog__MinimumLevel__Override__Microsoft.EntityFrameworkCore: "Warning"
      Serilog__MinimumLevel__Override__Microsoft.AspNetCore: "Warning"
      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua2_GI7-tNozYE6cXGUSgEzL3AHDV7bYcYIHdMwKYgyHdX4}"
@@ -106,6 +106,28 @@ IF NOT EXISTS (SELECT 1 FROM dbo.ClusterNode WHERE NodeId = 'site-b-2:4053')
        (NodeId, ClusterId, Host, OpcUaPort, DashboardPort, AkkaPort, GrpcPort, ApplicationUri, ServiceLevelBase, Enabled, CreatedBy)
    VALUES ('site-b-2:4053', 'SITE-B', 'site-b-2', 4840, 8081, 4053, 4056, 'urn:OtOpcUa:site-b-2', 150, 1, 'docker-dev-seed');

+------------------------------------------------------------------------------
+-- Backfill: GrpcPort on rows that predate the column (#493)
+--
+-- Every insert above is INSERT-if-not-exists, which is the right shape for a re-runnable seed
+-- but means a *new nullable* column never reaches rows created by an earlier version of this
+-- file. On a persisted volume that is exactly what happened when Phase 5 added GrpcPort: the
+-- six ClusterNode rows already existed, so they kept NULL, TelemetryNodeSource found no dial
+-- targets, and TelemetryDial:Mode=Grpc silently connected to nothing (throttled Warning per
+-- node — the code degrades gracefully, so nothing failed loudly).
+--
+-- Backfills NULL only. It must not overwrite a port an operator set deliberately on a
+-- long-lived dev volume; a NULL is the unambiguous "this row predates the column" marker.
+--
+-- AkkaPort deliberately has no equivalent here: it is NOT NULL with a default of 4053, so
+-- pre-existing rows already carry a usable value and there is nothing to backfill.
+------------------------------------------------------------------------------
+
+UPDATE dbo.ClusterNode
+   SET GrpcPort = 4056          -- matches Telemetry__GrpcListenPort on all six nodes in docker-compose.yml
+ WHERE GrpcPort IS NULL
+   AND CreatedBy = 'docker-dev-seed';
+
 ------------------------------------------------------------------------------
 -- Galaxy MxAccess gateway — INTENTIONALLY NOT SEEDED (retired 2026-06-15)
 --
@@ -1,5 +1,27 @@
 # Address Space

+> ⚠️ **Accuracy warning (audited 2026-07-27) — this page is v2-era and contradicts the shipped v3
+> address space.** Corrections, in order of how badly they mislead:
+>
+> - **There is no "single custom namespace".** v3 exposes **two**:
+>   `https://zb.com/otopcua/raw` (`s=<RawPath>`) and `https://zb.com/otopcua/uns`
+>   (`s=<Area>/<Line>/<Equipment>/<EffectiveName>`), registered together at
+>   `OtOpcUaNodeManager.cs:45`. Identity authority is `V3NodeIds` + `AddressSpaceRealm`. The retired
+>   `https://zb.com/otopcua/ns` survives only in a comment marking it retired (`V3NodeIds.cs:17`).
+> - **`Phase7Applier` / `Phase7Composer` / `GalaxyTagPlan` do not exist**, nor do the file paths cited
+>   for them. Renamed by `40e8a23e` to `AddressSpaceApplier` / `AddressSpaceComposer`
+>   (`src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/`); the composition result type is
+>   `AddressSpaceComposition` (`AddressSpaceComposer.cs:13`).
+> - **The `SystemPlatform` namespace kind is retired** — Galaxy is a standard Equipment-kind driver.
+> - **`GenericDriverNodeManager` is test scaffolding**, not a production dispatch path
+>   (`GenericDriverNodeManager.cs:71`).
+> - **The §Rediscovery section is wrong**: nothing consumes `OnRediscoveryNeeded`
+>   ([#518](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/518)), and the driver list is stale
+>   (MQTT and MTConnect now raise it too).
+>
+> For the current design see the "v3 OPC UA Address Space (Batch 4)" section of `CLAUDE.md`,
+> `docs/Raw.md`, and `docs/Uns.md`.
+
 Address-space construction is a two-layer system. The **driver-facing layer** is the streaming builder: a driver implements `ITagDiscovery.DiscoverAsync` (`src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/ITagDiscovery.cs`) and emits `Folder` / `Variable` / `AddProperty` calls into an `IAddressSpaceBuilder` as it walks its backend — no buffering of the whole tree. `GenericDriverNodeManager` (`src/Core/ZB.MOM.WW.OtOpcUa.Core/OpcUa/GenericDriverNodeManager.cs`) wraps that builder to capture alarm-condition sinks and routes alarm events from the driver to them. The **SDK materialization layer** turns the resulting node descriptions into live OPC UA nodes: `OpcUaPublishActor` drives the write-only `IOpcUaAddressSpaceSink`, whose production binding `SdkAddressSpaceSink` (`src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/SdkAddressSpaceSink.cs`) forwards to `OtOpcUaNodeManager` (`src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaNodeManager.cs`), a `CustomNodeManager2` subclass that owns the `FolderState` / `BaseDataVariableState` instances. The same code path serves Galaxy object hierarchies, Modbus PLC registers, AB CIP tags, TwinCAT symbols, FOCAS CNC parameters, and OPC UA Client aggregations — Galaxy is one driver of seven, not the driver.

 ## Root folder
@@ -114,6 +114,21 @@ source it from there.
 > hardcodes OPC-DA Good, `192`). Capturing real per-node quality will not persist until the gateway honors
 > the field — see `GatewayHistorianValueWriter`'s remarks (archreview 06/C-7).

+> ⚠️ **Continuous value capture is code-complete but UNPROVEN IN PRODUCTION
+> ([#491](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/491)).** The recorder, the FasterLog
+> outbox, the gateway value-writer and the deploy-time historized-ref feed
+> (`AddressSpaceApplier.FeedHistorizedRefs` → `ActorHistorizedTagSubscriptionSink` →
+> `ContinuousHistorizationRecorder.UpdateHistorizedRefs`) are all wired, and the recorder converges to
+> the deployed ref set from the first deploy onward. What has **not** run is the end-to-end live gate
+> (deploy → dependency-mux value delta → outbox append → `WriteLiveValues`) plus a restart-convergence
+> test. **Reads and alarm-writes are live-validated; treat value capture as unproven rather than
+> absent.** See the "KNOWN LIMITATION 2" section of `CLAUDE.md`.
+>
+> **Related, separately open:** `EnsureTags` provisioning fires only for **newly-added** historized
+> tags (`AddressSpaceApplier` iterates the added set), so flipping an **existing** tag to
+> `"isHistorized": true` never provisions it — see
+> `docs/plans/2026-06-27-historian-gateway-integration-issues.md` Issue 5.
+
 ---

 ## Tag auto-provisioning (EnsureTags)
@@ -1,5 +1,26 @@
 # Incremental Sync

+> ⚠️ **Accuracy warning (audited 2026-07-27) — most of this page describes machinery that is retired
+> or was never wired.** Read it as v2-era design history, not as current behaviour.
+>
+> - **"Rebuild flow" (below) is not a production path.** It is built on `GenericDriverNodeManager`,
+>   which is Core test scaffolding with **zero production references**
+>   (`GenericDriverNodeManager.cs:71`). Its `_variablesByFullRef` / `_sourceByFullRef` fields do not
+>   exist in `src/`.
+> - **Driver-backend rediscovery has no consumer.** Nothing in `src/Server/` or `src/Core/`
+>   subscribes to `IRediscoverable.OnRediscoveryNeeded`; `DriverHostActor.HandleDiscoveredNodes`
+>   (`DriverHostActor.cs:986-1002`) short-circuits unconditionally. The `ScopeHint` is read by
+>   nothing. Drivers that raise it today: Galaxy, TwinCAT, MQTT/Sparkplug, MTConnect
+>   ([#518](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/518),
+>   [#507](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/507)).
+> - **The generation-publish path is retired.** `sp_PublishGeneration` and
+>   `sp_ComputeGenerationDiff` are stubs that `RAISERROR`
+>   (`20260715230637_V3Initial.StoredProcedures.cs:194`); `DraftRevisionToken` does not exist.
+>
+> **The one live rebuild path in v3** is the deploy artifact: `ConfigComposer` →
+> `Deployment.ArtifactBlob` → `DriverHostActor` apply → `AddressSpaceComposer` /
+> `AddressSpaceApplier` diff-apply.
+
 Two distinct change-detection paths feed the running server: driver-backend rediscovery (Galaxy's `time_of_last_deploy`, TwinCAT's symbol-version-changed) and generation-level config publishes from the Admin UI. Both flow into re-runs of `ITagDiscovery.DiscoverAsync`, but they originate differently.

 ## Driver-backend rediscovery — IRediscoverable
@@ -11,7 +11,7 @@ In v2 the Server and Admin processes were fused into a single role-gated `ZB.MOM
 - `CreateMasterNodeManager` constructs one `OtOpcUaNodeManager` (`src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaNodeManager.cs`) — a `CustomNodeManager2` subclass that owns the writable address space under the namespace `https://zb.com/otopcua/ns` and a single `OtOpcUa` root folder organized under the standard `Objects` folder. It is wrapped in a `MasterNodeManager` with no additional core managers.
 - `OtOpcUaSdkServer.NodeManager` exposes the live node manager after `StartAsync`, so the hosting layer can wrap it in a `SdkAddressSpaceSink` (`src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/SdkAddressSpaceSink.cs`) and hand it to `OpcUaPublishActor`.

-Address-space population is push-driven: drivers stream discovery and data-change events through the Akka actor system (`DriverInstanceActor` → `OpcUaPublishActor`), and `OpcUaPublishActor` writes them into the node manager through the `IOpcUaAddressSpaceSink` seam. `OtOpcUaNodeManager.EnsureFolder` / `EnsureVariable` materialize the UNS folder + variable hierarchy; `WriteValue` / `WriteAlarmState` push runtime values and fire `ClearChangeMasks` so subscribed clients see updates.
+Address-space population is push-driven: drivers stream discovery and data-change events through the Akka actor system (`DriverInstanceActor` → `OpcUaPublishActor`), and `OpcUaPublishActor` writes them into the node manager through the `IOpcUaAddressSpaceSink` seam. `OtOpcUaNodeManager.EnsureFolder` / `EnsureVariable` materialize the UNS folder + variable hierarchy; `WriteValue` / `WriteAlarmCondition` push runtime values and fire `ClearChangeMasks` so subscribed clients see updates.

 The driver-agnostic walk that turns a driver's discovery into folder/variable calls lives in `GenericDriverNodeManager` (`src/Core/ZB.MOM.WW.OtOpcUa.Core/OpcUa/GenericDriverNodeManager.cs`): it walks `ITagDiscovery.DiscoverAsync` into an `IAddressSpaceBuilder`, captures alarm-condition sinks for variables flagged via `IVariableHandle.MarkAsAlarmCondition`, subscribes to `IAlarmSource.OnAlarmEvent`, and routes each alarm transition to the sink registered for its `SourceNodeId`.

@@ -48,7 +48,7 @@ The server binds a TCP endpoint at `opc.tcp://{PublicHostname}:{OpcUaPort}/OtOpc

 `OpcUaApplicationHost` subscribes to `SessionManager.ImpersonateUser` after `ApplicationInstance.Start`. The handler (`HandleImpersonation`) deals with the token types as follows:

- `UserNameIdentityToken` → the password is decrypted, then `IOpcUaUserAuthenticator.AuthenticateUserNameAsync` validates the credential (`LdapUserAuthenticator` in production, a stub in tests). On success a `UserIdentity` carrying the token is attached and the LDAP-derived roles are logged; on failure `ImpersonateEventArgs.IdentityValidationError` is set to `BadIdentityTokenRejected`.
+- `UserNameIdentityToken` → the password is decrypted, then `IOpcUaUserAuthenticator.AuthenticateUserNameAsync` validates the credential (`LdapOpcUaUserAuthenticator` in production, a stub in tests). On success a `UserIdentity` carrying the token is attached and the LDAP-derived roles are logged; on failure `ImpersonateEventArgs.IdentityValidationError` is set to `BadIdentityTokenRejected`.
 - `AnonymousIdentityToken` and X.509 tokens → the handler returns without intervening, so the SDK's default validation stands.

 Decryption failures and authenticator exceptions also map to `BadIdentityTokenRejected`.
@@ -62,7 +62,7 @@ For Modbus / S7 / AB CIP / AB Legacy / TwinCAT / FOCAS / OPC UA Client specifics
 | [Configuration.md](v1/Configuration.md) | appsettings bootstrap + Config DB + Admin UI draft/publish (v1 archive — `OTOPCUA_GALAXY_*` env vars now live in mxaccessgw config) |
 | [Uns.md](Uns.md) | The global `/uns` master tree — manage Area/Line/Equipment/Tag/VirtualTag fleet-wide; replaces the per-cluster UNS/Equipment/Tags tabs |
 | [security.md](security.md) | Transport security profiles, LDAP auth, ACL trie, role grants, OTOPCUA0001 analyzer |
-| [Redundancy.md](Redundancy.md) | `RedundancyCoordinator`, `ServiceLevelCalculator`, apply-lease, Prometheus metrics |
+| [Redundancy.md](Redundancy.md) | `RedundancyStateActor` (cluster-scoped singleton), `ServiceLevelCalculator`, `IRedundancyRoleView`, per-cluster meshes, Prometheus metrics |
 | [Reservations.md](Reservations.md) | Fleet-wide ZTag / SAPID external-ID reservations — publish-time claim, release flow |
 | [ServiceHosting.md](ServiceHosting.md) | Single fused `OtOpcUa.Host` binary install/uninstall with `OTOPCUA_ROLES` gating; the historian backend is the external HistorianGateway |
 | [StatusDashboard.md](StatusDashboard.md) | Pointer — superseded by [v2/admin-ui.md](v2/admin-ui.md) |
@@ -1,67 +1,120 @@
 # Read/Write Operations

-The v2 server routes OPC UA Read and Write operations to each driver's `IReadable` and `IWritable` capabilities through `CapabilityInvoker` so the Polly pipeline (retry / timeout / breaker) applies uniformly across Galaxy, Modbus, S7, AB CIP, AB Legacy, TwinCAT, FOCAS, and OPC UA Client drivers. The per-variable `OnReadValue` and `OnWriteValue` hooks described in the sections below live in `DriverNodeManager` (the planned ADR-002 Phase 7 Stream G successor to the v1 `DriverNodeManager`); `GenericDriverNodeManager` (`src/Core/ZB.MOM.WW.OtOpcUa.Core/OpcUa/GenericDriverNodeManager.cs`) handles address-space population and alarm routing during discovery. The current `OtOpcUaNodeManager` (`src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaNodeManager.cs`) is a push-model `CustomNodeManager2` that receives values from the Akka actor layer via `WriteValue`; OPC UA client reads return the cached pushed value.
+> **Rewritten 2026-07-27** against `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaNodeManager.cs`.
+> The previous revision described a v2-era `DriverNodeManager` with per-variable `OnReadValue` hooks,
+> an `AuthorizationGate`/`WriteAuthzPolicy` ACL pair and a `NodeSourceKind` dispatch switch. **None of
+> those exist** — `OnReadValue`, `WriteAuthzPolicy`, `_sourceByFullRef`, `_writeIdempotentByFullRef`
+> and `IRoleBearer` all have zero occurrences in `src/`. The read path in particular worked nothing
+> like the way it was documented. See `deferment.md` §3.1 and §7.

-## Driver vs virtual dispatch
+## The shape of it: push for reads, pull for writes

-Per [ADR-002](v2/implementation/adr-002-driver-vs-virtual-dispatch.md), a single `DriverNodeManager` routes reads and writes across both driver-sourced and virtual (scripted) tags. At discovery time each variable registers a `NodeSourceKind` (`src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverAttributeInfo.cs`) in the manager's `_sourceByFullRef` lookup; the read/write hooks pattern-match on that value to pick the backend:
+The live server is `OtOpcUaNodeManager`, a **push-model** `CustomNodeManager2`. This asymmetry is the
+single most important thing on this page:

- `NodeSourceKind.Driver` — dispatches to the driver's `IReadable` / `IWritable` through `CapabilityInvoker` (the rest of this doc).
- `NodeSourceKind.Virtual` — dispatches to `VirtualTagSource` (`src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/VirtualTagSource.cs`), which wraps `VirtualTagEngine`. Writes are rejected with `BadUserAccessDenied` before the branch per Phase 7 decision #6 — scripts are the only write path into virtual tags.
- `NodeSourceKind.ScriptedAlarm` — dispatches to the Phase 7 `ScriptedAlarmReadable` shim.
+- **Reads never reach a driver.** There is no `Read` override and no `OnReadValue` / `OnSimpleReadValue`
+  handler anywhere in the node manager. Driver values are *pushed in* from the Akka actor layer
+  (`DriverInstanceActor` polls or subscribes, `DriverHostActor` fans the value to the raw NodeId and
+  every referencing UNS NodeId), and a client Read is served by the OPC UA SDK straight from the
+  cached node value. A client read therefore costs nothing on the wire to the device, and cannot fail
+  with a device error — it returns whatever quality was last pushed.
+- **Writes are synchronous pull-through.** A client write runs `OnWriteValue` → role gate → driver.

-ACL enforcement (`WriteAuthzPolicy` + `AuthorizationGate`) runs before the source branch, so the gates below apply uniformly to all three source kinds.
+Everything the old page said about `CapabilityInvoker` wrapping OPC UA reads was misplaced: the
+invoker is real, but it lives on the **driver-actor** side wrapping the poll/subscribe calls. The
+`OpcUaServer` project does not reference it at all.

-## OnReadValue
+## Read path

-The hook is registered on every `BaseDataVariableState` created by the `IAddressSpaceBuilder.Variable(...)` call during discovery. When the stack dispatches a Read for a node in this namespace:
+1. The SDK resolves the NodeId in the Raw (`ns=2`) or UNS (`ns=3`) namespace.
+2. It returns the cached `DataValue` — value, `StatusCode` and source timestamp as last pushed.
+3. **No authorization check runs.** Not a per-node ACL, not a role check, nothing. Any admitted
+   session — including an Anonymous one — can read every node in the address space. The only gating is
+   the `AccessLevels` bitmask set at materialization, which is a per-node *capability* declaration, not
+   a per-user decision.

-1. If the driver does not implement `IReadable`, the hook returns `BadNotReadable`.
-2. The node's `NodeId.Identifier` is used directly as the driver-side full reference — it matches `DriverAttributeInfo.FullName` registered at discovery time.
-3. (Phase 6.2) If an `AuthorizationGate` + `NodeScopeResolver` are wired, the gate is consulted first via `IsAllowed(identity, OpcUaOperation.Read, scope)`. A denied read never hits the driver.
-4. The call is wrapped by `_invoker.ExecuteAsync(DriverCapability.Read, ResolveHostFor(fullRef), …)`. The resolved host is `IPerCallHostResolver.ResolveHost(fullRef)` for multi-host drivers; single-host drivers fall back to `DriverInstanceId` (decision #144).
-5. The first `DataValueSnapshot` from the batch populates the outgoing `value` / `statusCode` / `timestamp`. An empty batch surfaces `BadNoData`; any exception surfaces `BadInternalError`.
+Authored `NodeAcl` deny rules have **no effect on reads** (or on anything else — see
+[docs/security.md](security.md) § Data-Plane Authorization).

-The hook is synchronous — the async invoker call is bridged with `AsTask().GetAwaiter().GetResult()` because the OPC UA SDK's value-hook signature is sync. Idempotent-by-construction reads mean this bridge is safe to retry inside the Polly pipeline.
+## Write path — `OnEquipmentTagWrite`

-## OnWriteValue
+The handler is attached in `EnsureVariable` **only when the tag was materialized `writable`**, and
+re-attached or cleared by `UpdateTagAttributes` on an in-place edit. A non-writable node has no
+handler, so the SDK rejects the write before any of this runs.

-`OnWriteValue` follows the same shape with two additional concerns: authorization and idempotence.
+1. **Role gate.** `EvaluateEquipmentWriteGate(identity, gatewayWired)` requires the session identity to
+   be a `RoleCarryingUserIdentity` carrying the `WriteOperate` role. No identity or no role ⇒
+   `BadUserAccessDenied`, fail-closed. Gate passed but no write gateway wired (admin-only node,
+   pre-boot) ⇒ `BadNotWritable`.
+   - This is a **server-wide** check. It takes no node and no realm: a session that may write one tag
+     may write every writable tag on that node.
+   - `WriteTune` and `WriteConfigure` are **never checked**. `OpcUaDataPlaneRoles` declares only
+     `WriteOperate` and `AlarmAck`; the classification tiers exist in the permission vocabulary but no
+     code path reads them.
+2. **Optimistic local apply.** The new value is written to the node so subscribers see it immediately.
+3. **Realm-qualified dispatch.** `RealmOf(node.NodeId)` selects Raw or UNS, and the value routes to the
+   backing driver ref through the node write gateway. Both NodeIds for a fanned value resolve to the
+   same driver ref, so a write via either one reaches the same device point.
+4. **Write-outcome self-correction.** If the device write fails, the optimistic value is **reverted**
+   on the raw NodeId and every referencing UNS NodeId through the shared fan-out, so a failed write
+   cannot leave a phantom Good value behind. (Galaxy is the exception: its write is fire-and-forget, so
+   it can never surface a write failure.)

-### Authorization (two layers)
+`OnWriteValue` is invoked by the SDK **while holding the node-manager `Lock`**, so the handler must not
+block. Anything asynchronous is dispatched fire-and-forget with the revert wired as a continuation.

-1. **SecurityClassification gate.** Every variable stores its `SecurityClassification` in `_securityByFullRef` at registration time (populated from `DriverAttributeInfo.SecurityClass`). `WriteAuthzPolicy.IsAllowed(classification, userRoles)` runs first, consulting the session's roles via `context.UserIdentity is IRoleBearer`. `FreeAccess` passes anonymously, `ViewOnly` denies everyone, and `Operate / Tune / Configure / SecuredWrite / VerifiedWrite` require `WriteOperate / WriteTune / WriteConfigure` roles respectively. Denial returns `BadUserAccessDenied` without consulting the driver — drivers never enforce ACLs themselves; they only report classification as discovery metadata (see `docs/security.md`).
-2. **Phase 6.2 permission-trie gate.** When `AuthorizationGate` is wired, it re-runs with the operation derived from `WriteAuthzPolicy.ToOpcUaOperation(classification)`. The gate consults the per-cluster permission trie loaded from `NodeAcl` rows, enforcing fine-grained per-tag ACLs on top of the role-based classification policy. See `docs/v2/acl-design.md`.
+## Alarm method calls

-### Dispatch
-
-`_invoker.ExecuteWriteAsync(host, isIdempotent, callSite, …)` honors the `WriteIdempotentAttribute` semantics per decisions #44-45 and #143:
-
- `isIdempotent = true` (tag flagged `WriteIdempotent` in the Config DB) → runs through the standard `DriverCapability.Write` pipeline; retry may apply per the tier configuration.
- `isIdempotent = false` (default) → the invoker builds a one-off pipeline with `RetryCount = 0`. A timeout may fire after the device already accepted the pulse / alarm-ack / counter-increment; replay is the caller's decision, not the server's.
-
-The `_writeIdempotentByFullRef` lookup is populated at discovery time from the `DriverAttributeInfo.WriteIdempotent` field.
-
-### Per-write status
-
-`IWritable.WriteAsync` returns `IReadOnlyList<WriteResult>` — one numeric `StatusCode` per requested write. A non-zero code is surfaced directly to the client; exceptions become `BadInternalError`. The OPC UA stack's pattern of batching per-service is preserved through the full chain.
-
-## Array element writes
-
-Array-element writes via OPC UA `IndexRange` are driver-specific. The OPC UA stack hands the dispatch an unwrapped `NumericRange` on the `indexRange` parameter of `OnWriteValue`; `DriverNodeManager` passes the full `value` object to `IWritable.WriteAsync` and the driver decides whether to support partial writes. Galaxy performs a read-modify-write inside the Galaxy driver (MXAccess has no element-level writes); other drivers generally accept only full-array writes today.
+Part 9 condition methods (Acknowledge / Confirm / AddComment / OneShotShelve / TimedShelve / Unshelve)
+are gated by a second role check requiring `AlarmAck` — one role covering all five methods; the
+`operation` argument is passed to the router but the gate does not consult it. Scripted alarms go
+through `HandleAlarmCommand`, driver-fed native alarms through `HandleNativeAlarmAck`; both fail closed
+with `BadUserAccessDenied`.

 ## HistoryRead

-`DriverNodeManager.HistoryReadRawModified`, `HistoryReadProcessed`, `HistoryReadAtTime`, and `HistoryReadEvents` route through the driver's `IHistoryProvider` capability with `DriverCapability.HistoryRead`. Drivers without `IHistoryProvider` surface `BadHistoryOperationUnsupported` per node. See `docs/v1/HistoricalDataAccess.md`.
+Four overrides — `HistoryReadRawModified`, `HistoryReadProcessed`, `HistoryReadAtTime`,
+`HistoryReadEvents` — route to the **server-wide** `IHistorianDataSource` (the HistorianGateway-backed
+reader, or `NullHistorianDataSource` when `ServerHistorian:Enabled=false`, which returns `GoodNoData`).
+This is not a per-driver `IHistoryProvider` dispatch.
+
+**No authorization check runs on any of the four.** Unlike `OnWriteValue`, the SDK does *not* hold the
+node-manager `Lock` while invoking them, so these paths may await.
+
+See [docs/Historian.md](Historian.md).

 ## Failure isolation

-Per decision #12, exceptions in the driver's capability call are logged and converted to a per-node `BadInternalError` — they never unwind into the master node manager. This keeps one driver's outage from disrupting sibling drivers in the same server process.
+Exceptions in a driver capability call are logged and converted to a per-node bad status rather than
+unwinding into the master node manager, so one driver's outage cannot disrupt sibling drivers in the
+same process.
+
+## What is *not* enforced anywhere
+
+Collected here because the previous revision of this page claimed several of these:
+
+| Surface | Check |
+|---|---|
+| Read, Browse, TranslateBrowsePaths | none |
+| CreateMonitoredItems / Subscribe / TransferSubscriptions | none |
+| HistoryRead (all four variants) | none |
+| Non-Value attribute writes | none (the handler is on `OnWriteValue`) |
+| Value write | `WriteOperate` role, server-wide |
+| Alarm methods | `AlarmAck` role, server-wide |
+| Per-node ACLs (`NodeAcl` / `PermissionTrie`) | **authored and deployed, never evaluated** |

 ## Key source files

- `src/Core/ZB.MOM.WW.OtOpcUa.Core/OpcUa/GenericDriverNodeManager.cs` — address-space population and alarm routing during discovery
- `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaNodeManager.cs` — push-model `CustomNodeManager2`; `EnsureVariable` / `WriteValue` are the v2 read/write path
- `src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/` — permission trie + evaluator (`PermissionTrie`, `PermissionTrieCache`, `TriePermissionEvaluator`) that gates Read/Write/Subscribe per the session's resolved LDAP groups
- `src/Core/ZB.MOM.WW.OtOpcUa.Core/Resilience/CapabilityInvoker.cs` — `ExecuteAsync` / `ExecuteWriteAsync`
- `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/IReadable.cs`, `IWritable.cs`, `WriteIdempotentAttribute.cs`
+- `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaNodeManager.cs` — the live node manager;
+  `EnsureVariable` / `WriteValue` / `OnEquipmentTagWrite` / `EvaluateEquipmentWriteGate` and the four
+  HistoryRead overrides
+- `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/Security/RoleCarryingUserIdentity.cs`,
+  `Security/OpcUaDataPlaneRoles.cs` — how roles reach the gates
+- `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/AddressSpaceApplier.cs` — materialization; where the write
+  handler is attached per realm
+- `src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DriverHostActor.cs` — the push side: value fan-out to
+  raw + UNS NodeIds
+- `src/Core/ZB.MOM.WW.OtOpcUa.Core/Resilience/CapabilityInvoker.cs` — driver-side resilience pipeline
+  (**not** on the OPC UA read path)
+- `src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/` — the permission trie + evaluator, built and
+  unit-tested but with **zero production consumers**
@@ -401,11 +401,61 @@ Comparing against `Cluster:Hostname` would be worse than wrong: in docker-dev it
 no seed URI anywhere, so the rule would silently exempt the entire rig.

 Sequential recovery is island-free by construction: a `FirstSeedNodeProcess` node self-joins only when **no**
-seed answered, so a peer booting after the survivor formed simply joins it as the youngest member. Both
-nodes cold-starting *simultaneously* converge on one cluster while they are mutually reachable — the
-`InitJoin` handshake resolves it before either self-join deadline expires. The residual risk is a boot-time
-**partition** (both cold-starting, mutually unreachable): both form, which is the same dual-active class the
-`auto-down` strategy already accepts, with the same recovery (restart one side).
+seed answered, so a peer booting after the survivor formed simply joins it as the youngest member.
+
+**Simultaneous cold-start CAN split — this is the residual gap the bootstrap guard below closes.** When
+BOTH nodes start from nothing at the same instant, each runs `FirstSeedNodeProcess`, and if neither has
+formed before the other's `seed-node-timeout` expires, EACH self-joins and forms its own single-node
+cluster — two Primaries in one pair. On in-process loopback the `InitJoin` handshake usually resolves fast
+enough to converge, but the Phase 6 live gate reproduced the split reliably on the docker-dev rig (real
+container start timing + DNS): both nodes logged `JOINING itself … forming a new cluster` and both advertised
+ServiceLevel 250. Two independent clusters do **not** auto-merge, so the split persists until an operator
+restarts one side.
+
+### Bootstrap guard (`Cluster:BootstrapGuard`, opt-in)
+
+The guard eliminates the simultaneous-start split without giving up cold-start-alone. It is a **dark switch,
+default off** — a node with `Cluster:BootstrapGuard:Enabled=false` (the default) keeps Akka's config-driven
+self-first auto-join exactly as above.
+
+When enabled, the node is given **no config seed nodes** (so Akka does not auto-join), and
+`ClusterBootstrapCoordinator` picks the join order from a deterministic address tie-break plus a reachability
+probe:
+
+- The node with the lexicographically **lower** canonical `host:port` is the **preferred founder**: it joins
+  self-first and forms immediately if no peer answers — no probe, no delay.
+- The **higher** node probes its partner's Akka port (a plain TCP connect; the partner binds its port well
+  before it forms) for up to `PartnerProbeSeconds` (default 25 s): **reachable ⇒ peer-first** (it joins the
+  founder, never races it); **unreachable after the window ⇒ self-first** (the partner is genuinely down, so
+  it forms alone — cold-start-alone preserved for the higher node too).
+
+The order is decided **before** issuing a single `Cluster.JoinSeedNodes`, from an explicit reachability
+signal — it never re-decides mid-handshake, the failure mode that retired the `SelfFormAfter` watchdog.
+
+**Residual trade-off (accepted, operator-visible):** once the higher node commits peer-first it cannot
+self-form (Akka's `JoinSeedNodeProcess` retries forever). If the founder dies in the small probe→join window,
+the higher node hangs unjoined; the coordinator logs a clear WARNING after a bounded grace, and a **restart
+recovers it** (the guard re-runs, finds the founder down, and forms alone). Config keys:
+
+| Key | Default | Notes |
+|---|---|---|
+| `Cluster:BootstrapGuard:Enabled` | `false` | Dark switch. Only meaningful on a node that is one of its own two pair seeds; inert elsewhere. |
+| `Cluster:BootstrapGuard:PartnerProbeSeconds` | `25` | Higher node's probe window. Must comfortably exceed the founder's process-start-to-Akka-bind time, or a slow-but-alive founder is mistaken for dead and the split re-opens. Validated `> 0` at boot. |
+| `Cluster:BootstrapGuard:PartnerProbeIntervalMs` | `500` | Interval between probes. |
+| `Cluster:BootstrapGuard:ProbeConnectTimeoutMs` | `1000` | Per-probe TCP connect timeout. |
+
+On the docker-dev rig the **site-a pair is the enablement demo** (guard on, startup serialization removed so
+both nodes cold-start simultaneously); **site-b keeps the `depends_on: service_healthy` startup serialization
+with the guard off**, as the A/B control. Either mechanism prevents the split; the guard is the one that also
+works on production hardware, where compose `depends_on` does not exist.
+
+The alternative to the guard is **operational**: stagger the two VMs' service-manager start, or bring the
+designated founder VM up first — see the Phase 7 co-located operator runbook
+(`docs/plans/2026-07-24-mesh-phase7-failover-drills.md`).
+
+The residual risk that remains even with the guard is a boot-time **partition** (both cold-starting, mutually
+unreachable from the start): both form, which is the same dual-active class the `auto-down` strategy already
+accepts, with the same recovery (restart one side).

 Pinned by `SelfFirstSeedBootstrapTests` (`tests/Core/ZB.MOM.WW.OtOpcUa.Cluster.Tests/`), which starts real
 in-process clusters through the production bootstrap at production failure-detection timings: a lone
@@ -102,6 +102,45 @@ Persisted scope per plan decision #14: `Enabled`, `Acked`, `Confirmed`, `Shelvin

 Every mutation the state machine produces is immediately persisted inside the engine's `_evalGate` semaphore, so the store's view is always consistent with the in-memory state.

+### Post-(re)load condition-node re-assert (#487)
+
+A deploy that triggers a **full address-space rebuild** clears `_alarmConditions` and re-materialises every
+condition node fresh — inactive, acked, confirmed, unshelved. The engine, reloading in parallel, restores each
+alarm's persisted state and re-derives `Active` from the predicate, so it ends up *correct*; but a still-active
+alarm has **no transition to report**, so `LoadAsync` yields `EmissionKind.None` and `OnEngineEmission` drops it.
+Nothing then writes the node. Before this fix, an active alarm with static dependencies read **normal** to every
+OPC UA client after such a deploy, until its next real transition — which for a static-dependency alarm may
+never come.
+
+`ScriptedAlarmHostActor.ReassertConditionNodes` closes it. After each load completes it reads
+`ScriptedAlarmEngine.GetProjections()` — a plain read returning `ScriptedAlarmProjection` (condition state +
+the definition's severity + the resolved message template + last-observed worst-input quality) — and sends one
+`OpcUaPublishActor.AlarmStateUpdate` per alarm that is **not** in the Part 9 no-event position.
+
+Four properties are load-bearing:
+
+- **Node-only.** It sends `AlarmStateUpdate` and nothing else — never the `alerts` topic, never the telemetry
+  hub. `alerts` is the historization path, so an alerts row per alarm per deploy would append a duplicate
+  historian / AVEVA record every time anyone deploys. This is why the re-assert reads a projection instead of
+  re-emitting: `ScriptedAlarmProjection` carries no `EmissionKind`, so there is nothing for the emission
+  machinery — or a future refactor — to mistake for a transition.
+- **Only non-normal alarms.** An alarm in the no-event position (enabled, inactive, acked, confirmed,
+  unshelved) already matches what the materialise built, so it is skipped. That keeps a never-fired alarm
+  byte-identical to a deploy without this pass — including its Message, which the materialise seeds with the
+  alarm's display name — and writes nothing at all on the common all-normal deploy.
+- **Ordering.** `DriverHostActor` tells `RebuildAddressSpace` to the publish actor *before* it tells
+  `ApplyScriptedAlarms` to the host, and the re-assert runs later still (after an awaited `LoadAsync` pipes
+  back). Both are local `Tell`s, which enqueue synchronously, so the re-materialise is already queued ahead of
+  these writes.
+- **No duplicate Part 9 events.** `WriteAlarmCondition`'s delta-gate compares the incoming snapshot against
+  the node's *current* state: a re-assert onto a freshly materialised (normal) node is a genuine delta and
+  fires exactly one condition event — correct, since the rebuild reset what clients see — while a re-assert
+  onto a surgically-preserved node that already holds the same state is suppressed. The write is ungated by
+  redundancy role, like every other node write here; the Secondary keeps its address space warm for failover.
+
+The timestamp carried is the condition's own `LastTransitionUtc`, **not** the deploy instant, so a client
+reading `Time` / `ReceiveTime` after a rebuild still sees when the alarm actually went active.
+
 ## Source integration

 `ScriptedAlarmSource` (`ScriptedAlarmSource.cs`) adapts the engine to the driver-agnostic `IAlarmSource` interface. The existing `AlarmSurfaceInvoker` + `GenericDriverNodeManager` fan-out consumes it the same way it consumes Galaxy / AB CIP / FOCAS sources — there is no scripted-alarm-specific code path in the server plumbing. From that point on, the flow into `AlarmConditionState` nodes, the `AlarmAck` session check, and the Historian sink is shared — see [AlarmTracking.md](AlarmTracking.md).
@@ -128,6 +128,39 @@ transports. ScadaBridge itself has since closed that gap with this identical
 interceptor pattern, so Phase 5 ships authenticated from the start rather than deferring auth to a
 later hardening pass. See the design doc's superseded note for the full history.

+## Upgrading an existing deployment: populate `ClusterNode.GrpcPort` first (#493)
+
+`GrpcPort` is a **nullable column added by Phase 5**, and nothing backfills it onto rows that
+already existed. On an upgraded deployment every `ClusterNode` row therefore carries `NULL`,
+central finds **no dial targets**, and flipping `TelemetryDial:Mode` to `Grpc` connects to
+nothing. Fresh installs are unaffected. `AkkaPort` did not have this problem only because it is
+`NOT NULL` with a default of 4053.
+
+Nothing fails loudly, which is what makes this worth stating up front — the code degrades
+gracefully, once per node, throttled:
+
+```
+ClusterNode <id> has no GrpcPort; it exposes no telemetry stream and is skipped in this dial refresh
+(further skips of this node are silent)
+```
+
+Other symptoms: no `ESTABLISHED` sockets on the telemetry port (a `LISTEN` but nothing else in
+`docker exec <node> cat /proc/net/tcp6`), and the `/alerts` / `/script-log` pill never turning
+live in `Grpc` mode.
+
+**Before flipping any node to `Grpc`**, set each driver node's `GrpcPort` to that node's own
+`Telemetry:GrpcListenPort` — via the AdminUI node editor, or directly:
+
+```sql
+UPDATE dbo.ClusterNode SET GrpcPort = <that node's Telemetry:GrpcListenPort> WHERE NodeId = '<node>';
+```
+
+There is deliberately **no EF data migration** backfilling this. The correct value is that node's
+own listener port, which is per-deployment configuration the database cannot derive; a migration
+could only invent one, and a *wrong* dial target is worse than the `NULL` the dialer already skips
+explicitly. The docker-dev seed does backfill (`GrpcPort IS NULL AND CreatedBy = 'docker-dev-seed'`
+→ 4056) because there the port is fixed by `docker-compose.yml` and therefore actually knowable.
+
 ## Reconnect and reliability

 Central's `TelemetryDialSupervisor` (an admin-role actor) runs **one reconnecting dialer per
@@ -70,7 +70,7 @@ Project root files:
 | Capability | Implementation entry point |
 |------------|---------------------------|
 | `ITagDiscovery` | `Browse/GalaxyDiscoverer.cs` |
-| `IRediscoverable` | `Browse/DeployWatcher.cs` |
+| `IRediscoverable` | `Browse/DeployWatcher.cs` — consumed as an **operator prompt**: a Galaxy redeploy raises a "re-browse" chip on `/hosts`. ⚠️ It does **not** rebuild the address space — re-browse the device under `/raw` and commit ([#518](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/518)) |
 | `IReadable` | `Runtime/GalaxyMxSession.cs` |
 | `IWritable` | `Runtime/GatewayGalaxyDataWriter.cs` |
 | `ISubscribable` | `Runtime/GatewayGalaxySubscriber.cs` (driven by `EventPump`) |
@@ -0,0 +1,349 @@
+# MTConnect Driver
+
+Getting-started guide for the MTConnect Agent driver (P1 Agent MVP). This is
+the short path — for the full design rationale read
+[`docs/plans/2026-07-15-mtconnect-driver-design.md`](../plans/2026-07-15-mtconnect-driver-design.md)
+and the build-vs-plan record in
+[`docs/plans/2026-07-24-mtconnect-driver.md`](../plans/2026-07-24-mtconnect-driver.md); for the
+fixture recipe read
+[`tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests/Docker/README.md`](../../tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests/Docker/README.md)
+(not duplicated here).
+
+> **Live gate:** see the LIVE-GATE RESULT note in the plan's Task 21
+> (`docs/plans/2026-07-24-mtconnect-driver.md`) for the docker-dev `/run` verification outcome
+> (browse picker / typed editor / deploy / read / subscribe against the real Agent fixture).
+
+## What it talks to
+
+A **MTConnect Agent** — the vendor-neutral read-only telemetry endpoint that
+front-ends a machine tool (or fronts an adapter that itself talks to the
+machine over SHDR). The driver speaks plain HTTP + XML against the Agent's
+three standard REST paths:
+
+- `/probe` — the static device model (Device → Component → DataItem tree)
+- `/current` — a snapshot of every DataItem's latest observation
+- `/sample` — a `multipart/x-mixed-replace` long-poll stream of observation
+  deltas, keyed by a monotonic sequence number
+
+v1 is **agent-first and read-only** — Discover + Read + Subscribe, no Write —
+because the mainstream Agent surface has no "set value" operation.
+
+## Built vs. planned — read this before trusting the design doc's §2
+
+The design doc ([`2026-07-15-mtconnect-driver-design.md`](../plans/2026-07-15-mtconnect-driver-design.md))
+picked the **TrakHound `MTConnect.NET-Common` / `-HTTP`** NuGet packages (MIT,
+`netstandard2.0`) as the primary path, with a hand-rolled fallback. **The
+hand-rolled fallback is what shipped.** Task 6/7 of the implementation plan
+found by reflection + live invocation that the pinned TrakHound packages
+ship **no XML formatter** (`Document Formatter Not found for "xml"` — the
+formatter lives in a separate `MTConnect.NET-XML` package the design didn't
+pin) and that `MTConnectHttpClientStream` exposes no injectable `HttpClient`
+handler, so it cannot be unit-tested behind the driver's `IMTConnectAgentClient`
+seam. Both package references were dropped. There is **no TrakHound
+dependency anywhere in the shipped driver** — probe/current/sample parsing is
+hand-rolled `System.Xml.Linq` plus a multipart boundary reader, entirely
+behind `IMTConnectAgentClient`. See the CORRECTION block under Task 0 of the
+implementation plan for the full record.
+
+**Namespace-agnostic parsing.** Every parser matches XML elements on
+`LocalName` only, ignoring the document's XML namespace entirely, so
+MTConnect 1.3 through 2.x documents all parse without a schema-version
+branch. This is deliberate, not sloppy: a real Agent injects vendor-extension
+`Component`s in a foreign namespace whose child `DataItems` elements inherit
+the *default* namespace, and namespace-strict matching would silently drop
+the whole vendor component (and every DataItem beneath it) rather than fail
+loudly. Attributes are read **unqualified** for the same reason — so an
+`xsi:type` attribute is never mistaken for a DataItem's own `type`.
+
+## Project split
+
+| Project | Target | Role |
+|---------|--------|------|
+| `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect/` | net10.0 | In-process driver — `MTConnectDriver`, the hand-rolled `IMTConnectAgentClient` (probe/current/sample), the observation index, the factory |
+| `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts/` | net10.0 | `MTConnectDriverOptions`, `MTConnectTagDefinition`, and the pure `MTConnectDataTypeInference` table shared by the driver, browse-commit, and the AdminUI typed editor |
+
+No `.Browser` project — browse comes free from the Wave-0 universal
+discovery browser (see [Browse](#browse--free-via-the-universal-browser)
+below).
+
+## Capability surface
+
+`MTConnectDriver : IDriver, IReadable, ISubscribable, ITagDiscovery, IHostConnectivityProbe, IRediscoverable`
+(`src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect/MTConnectDriver.cs`).
+
+Deliberately **not** `IWritable` — the Agent surface is read-only by design.
+Write-back exists only via optional, rarely-deployed MTConnect *Interfaces*
+(a request/response handshake, not a "set value" operation), and is out of
+scope for this build — see [Deferred](#deferred-not-in-this-build).
+
+| Capability | Path | Notes |
+|------------|------|-------|
+| `ITagDiscovery` | `DiscoverAsync` — streams `/probe`'s Device→Component→DataItem tree into the address-space builder | `SupportsOnlineDiscovery = true`, `RediscoverPolicy = Once` |
+| `IReadable` | `ReadAsync` → one `/current` per call | **Not the production data path** — see below |
+| `ISubscribable` | `SubscribeAsync`/`OnDataChange` — the shared `/sample` long-poll pump | **The production data path** |
+| `IHostConnectivityProbe` | periodic `/probe` under `Probe.*` | No consumer wires it today — see [Known limitations](#known-limitations) |
+| `IRediscoverable` | watches the Agent's `Header.instanceId` | No consumer wires it today — see [Known limitations](#known-limitations) |
+
+**`IReadable.ReadAsync` is never called by the running server.** The
+production data plane is entirely `ISubscribable` — `DriverInstanceActor`
+subscribes once and lives off `OnDataChange`. `ReadAsync` exists for the
+Client CLI (`... read -n ...`) and for the unit/integration suites; it is
+correct and tested, just not on the hot path.
+
+## Minimum deployment
+
+```jsonc
+"Drivers": {
+  "mtconnect-1": {
+    "Type": "MTConnect",
+    "Config": {
+      "AgentUri": "http://10.100.0.35:5000",
+      "DeviceName": null,
+      "RequestTimeoutMs": 5000,
+      "SampleIntervalMs": 1000,
+      "SampleCount": 1000,
+      "HeartbeatMs": 10000,
+      "Probe":     { "Enabled": true, "IntervalMs": 5000, "TimeoutMs": 2000 },
+      "Reconnect": { "MinBackoffMs": 0, "MaxBackoffMs": 30000, "BackoffMultiplier": 2.0 },
+      "Tags": []
+    }
+  }
+}
+```
+
+`RawTags[]` is not authored by hand — `DriverDeviceConfigMerger` injects it
+at deploy time from the tags authored on the `/raw` tree.
+
+### Config keys
+
+Read off `MTConnectDriverOptions` / `MTConnectDriverConfigDto`
+(`src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts/MTConnectDriverOptions.cs`,
+`src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect/MTConnectDriver.cs`):
+
+| Key | Default | Notes |
+|---|---|---|
+| `AgentUri` | — (required) | Agent base URI; the driver appends `/probe`, `/current`, `/sample` |
+| `DeviceName` | `null` | Scopes requests to `{AgentUri}/{DeviceName}/...`; `null` = whole Agent |
+| `RequestTimeoutMs` | `5000` | Per-call deadline for `/probe` and `/current` |
+| `SampleIntervalMs` | `1000` | The Agent's `/sample?interval=` query param |
+| `SampleCount` | `1000` | The Agent's `/sample?count=` query param |
+| `HeartbeatMs` | `10000` | The Agent's `/sample?heartbeat=` query param — also the watchdog's liveness window |
+| `Probe.Enabled` / `Probe.IntervalMs` / `Probe.TimeoutMs` | `true` / `5000` / `2000` | Background connectivity-probe knobs (mirrors `ModbusProbeOptions`) |
+| `Reconnect.MinBackoffMs` / `MaxBackoffMs` / `BackoffMultiplier` | `0` / `30000` / `2.0` | Geometric backoff after a failed request or a dropped `/sample` stream |
+| `Tags[]` | `[]` | Pre-v3 / CLI authoring surface — one `MTConnectTagDefinition` per DataItem `id` |
+| `RawTags[]` | `[]` (deploy-injected) | The v3 data-plane binding — see below |
+
+**All timing knobs are validated strictly positive** at `InitializeAsync`
+(`RequirePositive`, mirroring the arch-review 01/S-6 lesson: a `0` timeout
+does not mean "wait forever," it faults the driver). This applies to
+`RequestTimeoutMs`, `HeartbeatMs`, `SampleIntervalMs`, `SampleCount`, and
+(when the probe is enabled) `Probe.Interval` / `Probe.Timeout`.
+
+**No save-time gate on a blank `AgentUri` in the AdminUI.** The driver form
+renders an inline validation notice (`_form.Validate()`), but
+`DriverConfigModal.SaveAsync` has no per-form validation seam to block the
+Save button on it — no sibling driver form has one either. A blank
+`AgentUri` saves cleanly and fails at deploy with the driver's own error
+message, not at authoring time.
+
+## Data plane
+
+### FullName == DataItem `id`
+
+`FullName` (both `MTConnectTagDefinition.FullName` and every `RawTags[]`
+blob's identifier) is the MTConnect `DataItem@id` attribute — the value the
+universal browser commits and the key the driver resolves reads/subscribes
+against. `MTConnectTagConfigModel.FromJson` (the AdminUI typed editor) tries
+three spellings in order — `fullName` → `dataItemId` → `address` — and takes
+the first non-blank one, normalising onto `fullName` on save. `address` is
+accepted because that's the field name `RawBrowseCommitMapper` writes for a
+driver with no typed editor path, so a browse-committed tag stays readable
+even before the editor round-trips it.
+
+### Coercion-type precedence
+
+The driver keys its data plane by **RawPath** (the v3 raw-tag identity), not
+by DataItem id directly, resolving RawPath → dataItemId internally. Each raw
+tag's coercion type (the `DriverDataType` its Agent observation is parsed
+into) is resolved in this order, first non-null wins:
+
+1. The `RawTags[]` blob's `driverDataType` or `dataType` field (both
+   spellings accepted — the typed editor writes `dataType`, the driver's own
+   `tags[]` shape uses `driverDataType`).
+2. A matching `Tags[]` entry naming the same DataItem id.
+3. The Agent's own `/probe` declaration, via `MTConnectDataTypeInference.Infer`
+   (category/type/units/representation → `DriverDataType`).
+4. `DriverDataType.String` — the coercion that cannot fail.
+
+### Quality mapping
+
+`UNAVAILABLE` — MTConnect's one explicit "I have no value" sentinel — maps to
+**`BadNoCommunication`** (`0x80310000`). This is deliberately distinct from
+the fleet-standard `BadCommunicationError` (`0x80050000`, used elsewhere for
+the driver's *own* transport failure to the Agent): `UNAVAILABLE` means the
+Agent is reachable and answered, it just has no device-backed value for that
+item. A `CONDITION` observation's value is taken from its **element name**
+(`<Normal/>` → the string `"Normal"`, `<Fault/>` → `"Fault"`); a `<Unavailable/>`
+condition element normalises onto the same `UNAVAILABLE` sentinel as every
+other category so one comparison covers all three.
+
+Other status codes an observation can surface:
+
+| Code | Meaning |
+|---|---|
+| `BadTypeMismatch` (`0x80740000`) | The Agent's text isn't a value of the tag's coerced type at all |
+| `BadOutOfRange` (`0x803C0000`) | The Agent reported a number the coerced type can't represent |
+| `BadNotSupported` (`0x803D0000`) | A shape this build doesn't materialize — a `TIME_SERIES` vector, or a structured `DATA_SET`/`TABLE` observation (deferred to P1.5; see [Known limitations](#known-limitations)) |
+| `BadWaitingForInitialData` | Tag is authored but the Agent hasn't reported it yet |
+| `BadNodeIdUnknown` | DataItem id is neither authored nor ever observed |
+
+### Subscribe — the `/sample` pump
+
+One shared `/sample` long-poll stream per driver instance (the Agent streams
+the whole device model regardless of which subset is subscribed, so
+per-tag streams would be wasted round-trips), run under a heartbeat
+watchdog — `HttpClient.Timeout` cannot bound a long-lived stream, so a
+missing chunk **and** missing keep-alive heartbeat within
+`HeartbeatMs × N` is what detects a frozen peer.
+
+Ring-buffer overflow (the Agent's circular observation buffer wrapped past
+what the driver's cursor expects) is detected **two ways**, both triggering a
+`/current` re-baseline before the stream resumes:
+
+1. `IMTConnectAgentClient.IsSequenceGap` — the next chunk's `firstSequence`
+   is newer than the driver's expected cursor.
+2. An `MTConnectError` document reporting `OUT_OF_RANGE` — real Agents return
+   this both under HTTP 200 (a normal MTConnect error document) and as a bare
+   HTTP 400, and the client handles both.
+
+**An Agent `instanceId` change means the Agent restarted**, and is checked
+**before** the sequence-gap check (a restart also usually trips the gap, so
+the two need disambiguating, not just OR-ing together). On a changed
+`instanceId` the driver clears its cached probe model and raises
+`OnRediscoveryNeeded`, which surfaces a **re-browse prompt** on the AdminUI
+`/hosts` page — see [Known limitations](#known-limitations) for what that does
+and does not do.
+
+## Browse — free via the universal browser
+
+MTConnect ships **no bespoke browser project**. Setting
+`ITagDiscovery.SupportsOnlineDiscovery => true` is the entire integration:
+the Wave-0 `DiscoveryDriverBrowser` sees a driver whose `TryCreate` succeeds
+and whose instance reports online discovery, renders the AdminUI **Browse**
+button, constructs the driver, runs `InitializeAsync` (the `/probe` connect)
+ `DiscoverAsync` into a `CapturingAddressSpaceBuilder`, then tears the
+throwaway instance down. Each captured leaf's NodeId is the DataItem `id`,
+committed directly as `TagConfig.FullName` on pick. See
+[`docs/plans/2026-07-15-universal-discovery-browser-design.md`](../plans/2026-07-15-universal-discovery-browser-design.md).
+
+## CONDITION modelling (v1: plain String)
+
+Each `CONDITION` DataItem materializes as a `String` variable whose value is
+the current state word — `Normal` / `Warning` / `Fault` / `UNAVAILABLE`.
+There is no native OPC UA Part 9 alarm plumbing in this build;
+`DriverAttributeInfo.IsAlarm = true` is still stamped on a CONDITION leaf so
+the browse side-panel flags it and a future upgrade to native alarms doesn't
+need re-authoring. See [Deferred](#deferred-not-in-this-build).
+
+## Known limitations
+
+These are real, not placeholders — read them before relying on the driver
+for anything beyond values-and-conditions.
+
+1. **A restarted Agent prompts an operator; it does not re-shape the address
+   space.** `DriverInstanceActor` now consumes `OnRediscoveryNeeded`
+   (2026-07-27), so a changed `instanceId` raises a "re-browse" chip against
+   this driver on `/hosts` carrying the reason. It is **advisory**: v3 authors
+   raw tags through the `/raw` browse-commit flow, so until an operator
+   re-browses the Agent and commits, any DataItem that appeared or vanished is
+   not reflected in the served tree. A runtime graft was deliberately rejected
+   — it would materialise nodes nobody approved and no deployment artifact
+   records.
+
+   **`IHostConnectivityProbe` is still unconsumed** — `GetHostStatuses()` has
+   no production call site and nothing writes a `DriverHostStatus` row. That
+   half remains a fleet-wide gap affecting every driver that implements it
+   (Gitea #521).
+2. **`RawTagEntry.DeviceName` is accepted on the wire shape but ignored for
+   routing.** One driver instance owns exactly one Agent client scoped by
+   `MTConnectDriverOptions.DeviceName` (the top-level config key); the
+   per-tag `RawTagEntry.DeviceName` field the v3 raw-tag identity carries is
+   never read by the driver. Two `/raw` Devices authored under one MTConnect
+   driver instance both resolve to the same one Agent connection. Real
+   per-device routing (a client per device) would be a design change, not a
+   bug fix.
+3. **Nothing validates a raw tag's declared OPC UA `DataType` against the
+   blob's coercion type.** The `/probe`-sourced inference
+   (`MTConnectDataTypeInference`) narrows how often an author picks a wrong
+   type, but it doesn't close the gap — an authored `DataType` mismatched
+   against the actual Agent observation still surfaces as `BadTypeMismatch`
+   /`BadOutOfRange` at runtime rather than at authoring time.
+4. **`sampleCount` is not a legal `DataItem` attribute.** It belongs on a
+   `TIME_SERIES` *observation*, not the device-model declaration. A real
+   Agent that meets `sampleCount` on a `DataItem` declaration logs `The
+   following keys were present and not expected: sampleCount` and **drops
+   the entire data item** from the served model. A live TIME_SERIES tag
+   therefore always resolves to `ArrayDim = null` (variable-length array) in
+   practice — the fixture's canned `probe.xml`/`Devices.xml`, which does
+   declare a `sampleCount`, is unrealistic on this point and exists only to
+   pin the parsing rule itself.
+5. **CONDITION is a plain `String`, not a native Part 9 alarm** (see above).
+6. **`TIME_SERIES` arrays and structured `DATA_SET`/`TABLE` observations
+   surface as `BadNotSupported`**, not an approximation — see the Quality
+   mapping table.
+
+## Deferred (not in this build)
+
+- **Write-back (MTConnect Interfaces).** Design
+  [§3.6](../plans/2026-07-15-mtconnect-driver-design.md#36-iwritable--not-implemented-v1):
+  the mainstream Agent surface is read-only by design; Interfaces is a rare,
+  optional request/response handshake that would mislead if modelled as
+  `IWritable`. Revisit only on a concrete deployment need.
+- **P1.5 fast-follow** (design
+  [§9](../plans/2026-07-15-mtconnect-driver-design.md#9-phasing--effort)):
+  CONDITION → native OPC UA Part 9 alarms via `IAlarmSource` (the Galaxy
+  native-alarm pattern); `TIME_SERIES` SAMPLE arrays materialized as real
+  OPC UA arrays; EVENT controlled-vocabulary values → OPC UA enumerations.
+- **P2 (on demand): SHDR adapter ingest.** A `SourceMode: "Agent" | "Shdr"`
+  switch that opens the raw pipe-delimited SHDR TCP socket directly. Loses
+  auto-discovery (no device model without an Agent in front, so
+  `SupportsOnlineDiscovery` would have to report `false` and tags would be
+  authored by hand, like Modbus). Niche; not built.
+
+## Testing
+
+- **Unit tests** — `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Tests/`
+  (canned-XML fixtures, no network) — 491/491 at time of writing. Covers
+  discovery tree shape, `MTConnectDataTypeInference`, observation indexing,
+  `UNAVAILABLE` → `BadNoCommunication`, CONDITION state-word mapping,
+  multipart chunk framing, and ring-buffer re-baseline paging (both the
+  sequence-gap and the `OUT_OF_RANGE` legs).
+- **Integration tests** —
+  `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests/` — env-gated
+  on `MTCONNECT_AGENT_ENDPOINT` (default `http://10.100.0.35:5000`), skips
+  cleanly (12 Skipped) when the fixture is unreachable, 12/12 against a real
+  Agent. Read the fixture's own
+  [`Docker/README.md`](../../tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests/Docker/README.md)
+  for the full recipe — summary only, here:
+  - Image is **`mtconnect/agent:2.7.0.12`** — not `mtconnect/cppagent`, which
+    does not exist on Docker Hub (the design's original assumption).
+  - The stack is **two services**: the Agent plus a stdlib-only SHDR adapter
+    (`Docker/adapter.py`, on `python:3.13-alpine`). An Agent with no adapter
+    reports every observation `UNAVAILABLE` forever, which proves nothing.
+  - Deployed at `/opt/otopcua-mtconnect/` on the shared docker host
+    (`10.100.0.35`, `project=lmxopcua` label). Endpoint
+    `http://10.100.0.35:5000`.
+  - `agent.cfg` must be **pure ASCII** — one non-ASCII byte anywhere,
+    including a comment, makes the config parser reject the whole file with
+    a bare `Failed / Stopped at line: N`.
+  - Bring-up: `lmxopcua-fix sync mtconnect` then `lmxopcua-fix up mtconnect`
+    (PowerShell helper, Windows-only) — or, directly on the docker host,
+    `rsync` the repo's `Docker/` dir to `/opt/otopcua-mtconnect/` and run
+    `docker compose up -d --wait`.
+
+## Further reading
+
+- [`docs/plans/2026-07-15-mtconnect-driver-design.md`](../plans/2026-07-15-mtconnect-driver-design.md) — full design: capability wiring, browse reconciliation, typed-editor spec, resilience/timeout rules, phasing
+- [`docs/plans/2026-07-24-mtconnect-driver.md`](../plans/2026-07-24-mtconnect-driver.md) — the executable implementation plan and the task-by-task build record, including where it diverged from the design (TrakHound → hand-rolled)
+- [`docs/plans/2026-07-24-driver-expansion-tracking.md`](../plans/2026-07-24-driver-expansion-tracking.md) — Wave-2 program tracking
+- [Docker fixture README](../../tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests/Docker/README.md) — the authoritative fixture recipe (seeded device model, endpoint, Mac AirPlay port-5000 gotcha)
@@ -0,0 +1,133 @@
+# MQTT test fixture
+
+Coverage map + gap inventory for the MQTT driver's harness.
+
+**TL;DR:** the unit suite (581 tests) carries the mapping, indexing, Sparkplug state-machine and
+failure-classification logic; the live suite (15 tests) proves the parts only a real broker can prove
+— TLS, real authentication, CA pinning in both directions, retained-message seeding, that a rejected
+CONNACK is actually surfaced, and the Sparkplug birth/alias/rebirth/death path against a real
+edge-node simulator.
+
+## What the fixture is
+
+`eclipse-mosquitto:2.0.22` plus a second container of the same image running `publisher/publish.sh`
+(the image ships `mosquitto_pub`, so no bespoke image is needed), plus — behind the `sparkplug`
+compose profile — **`otopcua-sparkplug-sim`**, a project-owned C# Sparkplug-B edge-node simulator
+(`tests/Drivers/….Driver.Mqtt.IntegrationTests/SparkplugSimulator/`). Compose lives at
+`tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/Docker/`; the deployed stack is
+`/opt/otopcua-mqtt` on the shared Docker host.
+
+**Two authenticated listeners, no anonymous fallback** (`allow_anonymous false`) — deliberate: an
+anonymous broker would let a broken auth config pass every test.
+
+| Listener | Endpoint | Env var |
+|---|---|---|
+| TLS + auth | `10.100.0.35:8883` | `MQTT_FIXTURE_ENDPOINT` |
+| plaintext + auth | `10.100.0.35:1883` | `MQTT_FIXTURE_PLAIN_ENDPOINT` |
+
+`MqttFixture` gates the suite on `MQTT_FIXTURE_ENDPOINT` / `MQTT_FIXTURE_USERNAME` /
+`MQTT_FIXTURE_PASSWORD` (+ `MQTT_FIXTURE_CA_CERT`, `MQTT_FIXTURE_TOPIC_PREFIX`) and **skips cleanly**
+when they are absent, so the suite is safe to run offline.
+
+**Unlike every other fixture it needs generated material first** — `./gen-fixture-material.sh` writes
+the gitignored `secrets/` (password file, CA, server cert/key). The broker will not start without it.
+Bring-up and the CA-fetch recipe are in [`infra/README.md`](../../infra/README.md) §3.
+
+### Published topics
+
+| Topic | Shape | Retain | Why it exists |
+|---|---|---|---|
+| `otopcua/fixture/retained/seed` | `{"value":42.5,…}` | ✅ **published exactly once** | The only way to prove retained *seeding*. On a republished topic a retained seed is indistinguishable from a fast live publish |
+| `otopcua/fixture/line1/temperature` | `{"value":…,"unit":"C","seq":n}` | ✅ | JSON + JSONPath extraction |
+| `otopcua/fixture/line1/counter` | `{"value":n}` | ✅ | Monotonic, for ordering |
+| `otopcua/fixture/line1/state` | `RUNNING` (bare text) | ✅ | Non-JSON `Raw`/`Scalar` payloads |
+| `otopcua/fixture/noise/chatter` | JSON | ❌ | **Never authored as a tag** — a broker carrying unauthored traffic is the normal case and the driver must stay silent about it |
+
+## What it actually covers
+
+The 7 live tests: TLS+auth connect; connect pinned to the fixture CA; connect pinned to a *foreign*
+CA is **rejected** (the falsifiability control — a pinning test that only ever passes proves nothing);
+wrong password is rejected **and surfaced** (the MQTTnet-5 silent-`Healthy` defect); plain
+subscribe→value under a RawPath; retained message seeds a value on subscribe; and an unauthored topic
+stays silent while an authored tag keeps flowing.
+
+### The Sparkplug simulator
+
+Group **`OtOpcUaSim`**; edge nodes **`EdgeA`** and **`EdgeB`**; `EdgeA` additionally publishes device
+**`Filler1`**. Node metrics `Temperature` (Float), `Pressure` (Double), `Count` (Int32), `Running`
+(Boolean), `Serial` (String) plus the mandatory `bdSeq` and **`Node Control/Rebirth`** — the last one
+deliberately carries a `/`, so it exercises the "a metric name is not a topic segment" rule. Device
+metrics: `Temperature` (Float), `FillCount` (Int64), `Jammed` (Boolean). Cadence ~2 s.
+
+It **subscribes to `spBv1.0/OtOpcUaSim/NCMD/{node}`** and re-births on a rebirth request, so it
+exercises the real NCMD round trip rather than simulating it. Births are not retained (per spec), so
+`docker restart otopcua-sparkplug-sim` is the way to force a fresh birth on demand:
+
+```bash
+ssh dohertj2@10.100.0.35 'cd /opt/otopcua-mqtt && docker compose --profile sparkplug up -d'
+ssh dohertj2@10.100.0.35 'docker restart otopcua-sparkplug-sim'   # force a birth
+ssh dohertj2@10.100.0.35 'docker logs -f otopcua-sparkplug-sim'
+```
+
+Live-gated end-to-end (2026-07-24, P1 milestone): deployed on the docker-dev rig against this fixture,
+both tags resolved and served changing values through OPC UA, and the AdminUI `#`-observation picker
+rendered the real topic tree. Re-gated for P2 (2026-07-25) against the Sparkplug simulator — see
+[Mqtt.md](Mqtt.md).
+
+## What it does NOT cover
+
+### 1. Sparkplug primary-host STATE, and write-through
+The simulator never observes a Host Application `STATE`, because the driver never publishes one
+(`ActAsPrimaryHost` is unimplemented). Nor is there any DCMD/NCMD **command** coverage: rebirth is the
+only NCMD the driver ever sends, and `IWritable` is deferred.
+
+Sparkplug **seq-gap injection** is unit-proven only — the simulator always publishes a well-formed
+monotonic `seq`, so no live test drives the gap → rebirth path end-to-end.
+
+### 2. Broker-side failure injection
+No test kills the broker mid-session, partitions the network, or forces a SUBACK failure against a
+real broker. Reconnect, backoff and per-topic degradation are **unit-proven only**.
+
+### 3. Wildcard tags against a live broker
+The by-filter indexing fix that keeps wildcard tags alive across a reconnect is covered by unit tests;
+no live test authors a `+`/`#` tag and bounces the connection.
+
+### 4. QoS 2 delivery semantics
+The fixture publishes at QoS 0/1. QoS 2's exactly-once handshake is never exercised end-to-end.
+
+### 5. Scale
+One publisher, five topics, a ~2 s cadence. Nothing probes the 50 000-node browse cap, the 1 MiB
+payload cap, or thousands of authored tags.
+
+### 6. Redundant-pair client-id collision
+Found by hand during the P1 gate (a fixed `clientId` makes pair nodes evict each other), **not** by a
+test. No automated coverage asserts that two concurrent drivers coexist.
+
+## When to trust the MQTT fixture, when to reach for a real broker
+
+| Question | Fixture answers it? |
+|---|---|
+| Does TLS + auth work, and does bad auth fail loudly? | ✅ yes |
+| Is a retained message seeded on subscribe? | ✅ yes |
+| Does JSONPath extraction + coercion behave? | ✅ yes (unit + live) |
+| Does the driver ignore unauthored traffic? | ✅ yes |
+| Does it survive a broker restart / flapping link? | ❌ unit-only |
+| Does it hold up at plant tag counts? | ❌ no |
+| Does a Sparkplug birth → alias → DATA → death cycle work? | ✅ yes (live, vs. the simulator) |
+| Does an NCMD rebirth request actually get answered? | ✅ yes (the simulator subscribes + re-births) |
+| Sparkplug seq-gap → rebirth | ❌ unit-only (the sim never skips a seq) |
+| Sparkplug primary-host STATE / DCMD writes | ❌ not implemented |
+
+## Follow-up candidates
+
+1. Broker-restart / SUBACK-failure live tests (closes gap 2).
+2. A live wildcard-across-reconnect test (closes gap 3).
+3. A concurrent-two-driver test pinning the client-id hazard (closes gap 6).
+4. A seq-gap injection switch on the simulator, closing the last unit-only Sparkplug leg.
+
+## Key fixture / config files
+
+- `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/Docker/docker-compose.yml`
+- `tests/Drivers/…/Docker/mosquitto.conf` · `Docker/gen-fixture-material.sh` · `Docker/publisher/publish.sh`
+- `tests/Drivers/…/MqttFixture.cs` · `PlainMqttLiveTests.cs`
+- [`infra/README.md`](../../infra/README.md) §3 — bring-up, endpoints, CA fetch
@@ -0,0 +1,397 @@
+# MQTT Driver
+
+In-process MQTT **broker-subscribe** driver. It holds one MQTTnet 5 client against one broker,
+subscribes to the topics its authored tags name, and forwards each PUBLISH straight to
+`ISubscribable.OnDataChange`. Ingest is **push, not poll**, and **one-way** — there is no `IWritable`.
+
+**Two ingest shapes, selected by the driver's `Mode`:** `Plain` binds a tag to a concrete MQTT topic;
+`SparkplugB` binds it to a `group / edge node / device? / metric` tuple and decodes Eclipse-Tahu
+protobuf under one `spBv1.0/{GroupId}/#` subscription. Both run over the same single client.
+
+See [Mqtt-Test-Fixture.md](Mqtt-Test-Fixture.md) for the harness and
+[`../plans/2026-07-15-mqtt-sparkplug-driver-design.md`](../plans/2026-07-15-mqtt-sparkplug-driver-design.md)
+for the design.
+
+> **Status.** P1 (plain MQTT) and P2 (Sparkplug B ingest) are both shipped and live-gated against the
+> Mosquitto + Sparkplug-simulator fixture. Write-through (`IWritable` — NCMD/DCMD/plain publish) is
+> **deferred** ([#508](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/508)); every MQTT node
+> materializes read-only. See [Known gaps](#known-gaps) — every entry there carries a tracking issue
+> (#507–#515).
+
+## Project Layout
+
+| Project | Holds |
+|---|---|
+| `Driver.Mqtt.Contracts` | Config records, enums, `MqttTagDefinition` + the pure `MqttTagDefinitionFactory`, and the one shared `MqttJson.Options`. **Deliberately transport-free** — no MQTTnet reference |
+| `Driver.Mqtt` | Runtime: `MqttDriver`, `MqttConnection` (connect + reconnect supervisor), `MqttSubscriptionManager`, `LastValueCache`, factory registration, `MqttDriverProbe` |
+| `Driver.Mqtt.Browser` | `MqttDriverBrowser` + `MqttBrowseSession` — the AdminUI address picker's `#`-observation session |
+
+> `.Browser` references `.Driver` (not just `.Contracts`) — a **documented, deliberate exception**
+> so browse can reuse `MqttConnection.BuildClientOptions` (TLS / CA-pin / credentials / protocol
+> mapping). Its cost is pulling `Core` into the AdminUI graph. The csproj carries a boxed warning;
+> do not copy the pattern into a new driver's browser. The clean fix — extract the pure
+> options builder down into `.Contracts` — is tracked as
+> [#512](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/512).
+
+## Capability Surface
+
+```csharp
+public sealed class MqttDriver
+    : IDriver, ITagDiscovery, ISubscribable, IReadable, IHostConnectivityProbe, IRediscoverable, IAsyncDisposable, IDisposable
+```
+
+| Capability | Entry point | Notes |
+|---|---|---|
+| `IDriver` | `InitializeAsync` / `ReinitializeAsync` / `ShutdownAsync` / `GetHealth` | Order **register → attach → connect** is contractual. `ReinitializeAsync` applies a tag-only delta in place, and rebuilds the session when the broker identity changed |
+| `ITagDiscovery` | `DiscoverAsync` | Replays **only the authored `rawTags`** into an `Mqtt` folder. `SupportsOnlineDiscovery => false`. `RediscoverPolicy` is `Once` in Plain and **`UntilStable` in Sparkplug** (half of what a Sparkplug tag needs — its datatype — is only knowable from a birth) |
+| `ISubscribable` | `SubscribeAsync` / `OnDataChange` | One SUBSCRIBE per distinct authored topic. **`publishingInterval` is ignored** — MQTT is push-based; this driver neither polls nor throttles |
+| `IReadable` | `ReadAsync` | Serves the last received/retained value from `LastValueCache`; never throws. A never-seen tag reads `BadWaitingForInitialData` |
+| `IHostConnectivityProbe` | `GetHostStatuses` | 1-second poll of `MqttConnection.State`; `HostName` is `"{host}:{port}"` |
+| `IRediscoverable` | `OnRediscoveryNeeded` | Nothing raises it in Plain mode. **Sparkplug raises it** when a birth for an *authored* scope carries a metric-name set different from the last one seen for that scope — both conditions are anti-storm, see [Rediscovery](#rediscovery-sparkplug) |
+
+**Not implemented:** `IWritable`, `IPerCallHostResolver`, `IAlarmSource`, `IHistoryProvider`.
+Materialized nodes are `SecurityClassification.ViewOnly`, `IsAlarm: false`, `IsHistorized: false` —
+*"MQTT ingest is one-way … ViewOnly rather than an Operate node whose writes would silently vanish."*
+
+Driver-type string: **`Mqtt`** (`DriverTypeNames.Mqtt`).
+
+## Configuration
+
+Bound through `MqttJson.Options` — **case-insensitive**, enums by **name**, unknown members skipped.
+
+**The whole connection is authored on the DRIVER** (`DriverConfig`), via `MqttDriverForm` in the `/raw`
+driver-config modal. Unlike Modbus / S7 / OPC UA Client, MQTT does **not** use the v3
+endpoint→`DeviceConfig` split: an MQTT driver instance holds exactly one broker session, so
+`MqttDeviceForm` is informational (the same shape as `GalaxyDeviceForm`) and devices under an MQTT
+driver are pure organisational grouping in the RawPath.
+
+> **Why not the device.** `DriverDeviceConfigMerger` merges a device's keys up to the top level *only
+> when the driver has exactly one device*. A device-authored broker connection therefore disappears
+> from the merged blob the moment a second device is added — a silent outage with nothing to see at
+> deploy time. Driver-level authoring is correct for 0, 1 or N devices. A pre-form deployment that put
+> the connection on a sole device still works (merge-up wins over the driver's keys) and
+> `MqttDeviceForm` flags those keys so the mismatch is visible; move them to the driver.
+
+`DriverDeviceConfigMerger` still merges driver + device and injects `rawTags`.
+
+```jsonc
+// DriverConfig — authored by MqttDriverForm. PascalCase keys, enums as names.
+{
+  "Host": "10.100.0.35",
+  "Port": 8883,
+  "UseTls": true,
+  "AllowUntrustedServerCertificate": false,
+  "CaCertificatePath": null,      // pins the chain; null = OS trust store
+  "Username": "otopcua",
+  "Password": "",                 // never commit
+  "ProtocolVersion": "V500",
+  "CleanSession": true,
+  "KeepAliveSeconds": 30,
+  "ConnectTimeoutSeconds": 15,
+  "ReconnectMinBackoffSeconds": 1,
+  "ReconnectMaxBackoffSeconds": 30,
+  "MaxPayloadBytes": 1048576,
+  "Mode": "Plain",
+  "Plain": { "TopicPrefix": "", "DefaultQos": 1 }
+}
+
+// DeviceConfig — empty; MQTT has no per-device endpoint.
+{}
+```
+
+### `Sparkplug` sub-object (`Mode: "SparkplugB"`)
+
+```jsonc
+{
+  "Mode": "SparkplugB",
+  "Sparkplug": {
+    "GroupId": "OtOpcUaSim",            // REQUIRED — the driver's whole subscription scope
+    "HostId": "",                       // Host Application identity; receive-only (see below)
+    "ActAsPrimaryHost": false,          // NOT IMPLEMENTED — logs a warning when true
+    "RequestRebirthOnGap": true,        // a seq gap asks the edge node to re-announce (NCMD)
+    "BirthObservationWindowSeconds": 15 // how long discovery collects births before calling it stable
+  }
+}
+```
+
+| Key | Default | Notes |
+|---|---|---|
+| `GroupId` | `""` | **Required.** The driver subscribes exactly `spBv1.0/{GroupId}/#`. Blank ⇒ it connects, reports `Healthy`, and ingests **nothing**. It is a literal topic segment, so `/`, `+`, `#` are refused by the form |
+| `HostId` | `""` | Sparkplug Host Application identity. **Receive-only** — the driver observes `STATE` and never publishes one |
+| `ActAsPrimaryHost` | `false` | **Not implemented.** Setting it logs a startup **warning** rather than being silently inert — being a primary host is a three-part contract (retained `ONLINE`, a matching `OFFLINE` registered as the MQTT Will *at connect time*, an explicit `OFFLINE` on clean shutdown), and shipping the `ONLINE` half without the Will is strictly worse than shipping neither: a crashed node would leave a retained `ONLINE` asserting forever that a dead host is alive |
+| `RequestRebirthOnGap` | `true` | On a detected sequence-number gap, publish a rebirth-request NCMD instead of running on stale metric state |
+| `BirthObservationWindowSeconds` | `15` | Discovery's birth-collection window. Must be ≥ 1 |
+
+`MqttDriverForm` authors all five in Sparkplug mode. The sub-object is **merged, never replaced** (a
+key a newer driver adds inside it survives an older AdminUI), and in `Plain` mode it is not touched at
+all — so flipping a driver to Plain to look at it and back does not lose the group id. The form never
+writes `RawTags`; the deploy artifact owns it.
+
+> **This was a live-gate finding.** Through the P2 implementation `MqttDriverForm` still carried its P1
+> placeholder — switching Mode to `SparkplugB` rendered a "not available yet" notice and **no group-id
+> field**, so once Sparkplug ingest shipped there was no way to author a Sparkplug driver from the
+> AdminUI at all. Pinned by `MqttDriverFormModelTests`' Sparkplug cases.
+
+Every key has a default, so nothing is strictly required by the binder. Notable ones:
+`port` **8883**, `useTls` **true**, `protocolVersion` **V500**, `cleanSession` **true**,
+`keepAliveSeconds` **30**, `connectTimeoutSeconds` **15**,
+`reconnectMinBackoffSeconds` **1** / `reconnectMaxBackoffSeconds` **30**,
+`maxPayloadBytes` **1 MiB**, `allowUntrustedServerCertificate` **false**.
+
+> ⚠️ **Leave `clientId` unset on a redundant pair.** Both nodes of a pair run the driver. MQTT
+> requires client ids to be unique per broker, so a *fixed* `clientId` makes the two nodes evict each
+> other forever — the broker logs `Client <id> already connected, closing old connection` and both
+> nodes reconnect every few seconds while still reporting `Healthy`. Unset (the default) lets MQTTnet
+> generate a unique id per connection, which is correct. This was observed live during the P1 gate.
+> (The probe and browser already self-uniquify with `-probe-` / `-browse-` suffixes.) `MqttDriverForm`
+> defaults the field blank and raises this warning inline the moment a value is typed.
+
+The form validates every knob against the driver's own `[Range]` bounds (port 1–65535, keep-alive /
+connect-timeout / backoffs ≥ 1 s, max-backoff ≥ min-backoff, `maxPayloadBytes` ≥ 1, QoS 0–2) and
+additionally **clamps** on serialize, so an operator who ignores the inline error still cannot persist
+a `connectTimeoutSeconds: 0` driver-brick.
+
+## Tag Configuration
+
+A tag binds in **one of two shapes**, and which one is decided by *which keys are present*, not by a
+`mode` key on the tag. `MqttTagDefinitionFactory` reads the Sparkplug tuple when any Sparkplug
+descriptor key is set, and the topic otherwise; the AdminUI's "Tag shape" selector infers the same way
+on reopen. The key names are single-sourced in `MqttTagConfigKeys` so the browse-commit mapper and the
+factory cannot drift.
+
+### Plain shape
+
+| Key | Type | Default | Notes |
+|---|---|---|---|
+| `topic` | string | — | **Required.** Absent/blank rejects the tag ⇒ `BadNodeIdUnknown` |
+| `payloadFormat` | `Json` \| `Raw` \| `Scalar` | `Json` | **Strict** — a typo'd value rejects the tag |
+| `jsonPath` | string | `"$"` | Absent *or empty* ⇒ document root. `Json` only |
+| `dataType` | `DriverDataType` | `String` | **Strict.** `Float64`, not `Double` — see below |
+| `qos` | int 0–2 | driver's `defaultQos` | **Strict** — a malformed value rejects rather than silently weakening delivery |
+| `retainSeed` | bool | `true` | Seed this tag from the broker's retained message on subscribe |
+
+There is **no `mode` key** — the AdminUI's "Tag shape" selector is UI-only, inferred from the blob and
+never serialized.
+
+**`dataType` uses `DriverDataType`, which has `Float64` and has no `Double`.** Authoring `"Double"` is
+a strict-enum rejection, not a fallback.
+
+Payload handling: `Json` selects via JSONPath then coerces (miss ⇒ `BadDecodingError`, coerce fail ⇒
+`BadTypeMismatch`); `Raw` returns the payload's UTF-8 text verbatim and **ignores `dataType`**;
+`Scalar` decodes then coerces. The JSONPath subset is `$`, `$.a.b`, `$['a']`, `$.a[0]` — **no
+filters, slices, wildcards or recursive descent**.
+
+### Wildcards
+
+The **runtime accepts** a `+`/`#` topic (it is ambiguous, not unparseable) and the deploy-time
+`Inspect` pass **warns**. The **AdminUI editor rejects** it outright — the one place the editor is
+deliberately stricter than the driver, because one Tag holds one value and a wildcard would feed it
+from many source topics. Wildcard tags are indexed **by filter**, not by concrete topic, so they
+survive a reconnect; a message fans out to *every* matching tag, and unauthored topics are dropped.
+
+### Sparkplug shape
+
+| Key | Type | Default | Notes |
+|---|---|---|---|
+| `groupId` | string | — | **Required.** Must match the driver's `Sparkplug.GroupId` to ever receive a message |
+| `edgeNodeId` | string | — | **Required.** |
+| `deviceId` | string | *absent* | **Omit** for a metric published by the edge node itself (NBIRTH/NDATA). Absent is meaningfully different from `""` |
+| `metricName` | string | — | **Required.** The tag's stable binding key across rebirths. **May contain `/`** — `Node Control/Rebirth` and `Properties/Serial Number` are canonical Sparkplug names, and the whole name is one value, never split |
+| `dataType` | `DriverDataType` | *from the birth* | **Optional override.** Absent ⇒ take whatever type the birth certificate declared. The AdminUI's "(from birth certificate)" option removes the key entirely |
+| `isHistorized` / `historianTagname` | — | — | Server-side historization, unchanged from Plain |
+
+`payloadFormat`, `jsonPath`, `qos` and `retainSeed` are **Plain-only** and meaningless here: a
+Sparkplug body is protobuf, and the subscription is one driver-wide `spBv1.0/{GroupId}/#`, not a
+per-tag filter.
+
+`groupId` / `edgeNodeId` / `deviceId` are literal MQTT topic segments, so the AdminUI editor refuses
+`/`, `+` and `#` in them — a decoded incoming id can never contain one, so such a tag could never
+bind. `metricName` is deliberately **exempt**: it is not a topic segment.
+
+```jsonc
+// A device metric.
+{"groupId":"OtOpcUaSim","edgeNodeId":"EdgeA","deviceId":"Filler1","metricName":"FillCount"}
+
+// A node-level metric — note deviceId is ABSENT, not blank.
+{"groupId":"OtOpcUaSim","edgeNodeId":"EdgeA","metricName":"Temperature"}
+```
+
+## Sparkplug B Ingest
+
+One subscription (`spBv1.0/{GroupId}/#`) feeds a per-edge-node state machine
+(`SparkplugIngestor` + `SparkplugCodec` / `AliasTable` / `BirthCache` / `SequenceTracker`):
+
+- **Births are the only self-describing message.** NBIRTH/DBIRTH name every metric and assign its
+  alias; NDATA/DDATA carry an **alias and no name at all**. So the alias table is rebuilt *per birth*
+  and tags bind **by name**, never by alias — aliases are per-birth and may be reused for a different
+  metric after a rebirth.
+- **NBIRTH is node-scoped, DBIRTH is device-scoped**, and routing a DBIRTH through the node path
+  wipes `bdSeq`. They are handled separately on purpose.
+- **Sequence tracking**: `seq` is a wrapping 0–255 counter. A detected gap raises a rebirth request
+  when `RequestRebirthOnGap` is on, rather than silently continuing on stale metric state.
+- **Death → STALE.** An NDEATH whose `bdSeq` matches the live session (the bdSeq tie is what stops a
+  stale death from killing a fresh session) marks every metric under that edge node `Bad` /
+  `BadNoCommunication`. A DDEATH does the same for one device. The next birth restores them.
+- **Unsupported datatypes are skipped with a warning, never guessed**: `DataSet`, `Template`,
+  `PropertySet`, `PropertySetList`, `Unknown`. `Int8`→`Int16` and `UInt8`→`UInt16` widen; `*Array`
+  variants map to the element type with the array bit set.
+- **Ingest state is reset at every session/authoring seam** — a reconnect or a `ReinitializeAsync`
+  must not carry a previous session's alias table into a new one.
+
+### Rediscovery (Sparkplug)
+
+`OnRediscoveryNeeded` fires only when a birth is **for an authored scope** *and* its metric-name set
+**differs** from the last one seen for that scope (order-insensitive, ordinal). Both conditions are
+anti-storm, not optimisations: rediscovery triggers an address-space rebuild, and an edge node
+re-births freely — on its own schedule, on every reconnect, and once per rebirth NCMD.
+
+> ⚠️ **Nothing consumes the signal today.** No runtime component subscribes to
+> `IRediscoverable.OnRediscoveryNeeded`, and `DriverHostActor.HandleDiscoveredNodes` hard-returns —
+> discovered-node injection is dormant in v3. The served address space comes from the deploy artifact,
+> so **a DBIRTH introducing a new metric does not change the OPC UA tree**; you must redeploy. The
+> driver's decision is observable only as an Information log line
+> (`… requesting rediscovery.`). This is a v3 platform gap, not an MQTT one.
+
+## Connection + Failure Semantics
+
+`MqttConnectionState`: `Disconnected → Connected → Reconnecting → Faulted → Disposed`.
+A broker that is merely down stays **`Reconnecting` indefinitely** — unreachable is never a fault.
+Backoff is exponential between the two `reconnectBackoff` bounds.
+
+**MQTTnet 5 does not throw on a rejected CONNACK** — it returns the code and leaves the client
+disconnected. Left unhandled, a wrong password produced a `Healthy` driver that never received a
+value. `MqttConnection` therefore raises `MqttConnectRejectedException`:
+
+- **Unrecoverable ⇒ `Faulted`, supervisor stops** (retrying cannot help): `MalformedPacket`,
+  `ProtocolError`, `UnsupportedProtocolVersion`, `ClientIdentifierNotValid`, `BadUserNameOrPassword`,
+  `NotAuthorized`, `Banned`, `BadAuthenticationMethod`, `TopicNameInvalid`, `PacketTooLarge`,
+  `PayloadFormatInvalid`, `RetainNotSupported`, `QoSNotSupported`, `ServerMoved`.
+- **Everything else is transient** and keeps retrying — including `UnspecifiedError` and any future
+  code. (`ServerMoved` is permanent, `UseAnotherServer` is temporary — per the MQTT 5 spec.)
+
+A reconnect that completes without re-subscribing would be a healthy-looking connection that receives
+nothing forever, so `OnReconnectedAsync` **throws** when zero filters are granted, tearing the session
+down rather than swallowing it. A SUBACK failure degrades just the affected RawPaths to
+`BadCommunicationError`.
+
+## Browse
+
+`MqttDriverBrowser` opens a **read-only observation session**: it subscribes at QoS 0 to `#` (or
+`{topicPrefix}/#`) under a `-browse-`-suffixed client id and builds a `/`-segment tree from whatever
+publishes. **Nothing is ever published.** It is *inherently incomplete* — a topic that stays silent
+during the window is invisible — so manual entry remains the escape hatch.
+
+Bounds: 50 000 nodes (then `⚠ Observation truncated`), 1024-char topics / 256-char segments (then
+`⚠ Some topics were too long`), 512-byte payload inspection. Sessions are reaped after 2 minutes idle.
+
+**Sparkplug B browse serves a different tree from the same passive window**: observed NBIRTH/DBIRTH
+certificates are decoded into `Group → EdgeNode → [Device] → Metric` (a birth is the only Sparkplug
+message that names its metrics). Same node cap, same bounds, same "publishes nothing" guarantee.
+
+The bespoke browser wins over the universal `DiscoveryDriverBrowser`, which would decline MQTT anyway
+(`SupportsOnlineDiscovery` is `false`).
+
+### Browse-commit writes the address the factory reads
+
+A committed leaf's address is a **descriptor**, not a single reference string, so
+`RawBrowseCommitMapper` reads it from the `AttributeInfo.AddressFields` the session states — Plain
+emits `topic`; Sparkplug emits `groupId` / `edgeNodeId` / `deviceId?` / `metricName`, the names
+`MqttTagConfigKeys` single-sources for both the mapper and `MqttTagDefinitionFactory`.
+
+**It is never parsed out of the browse node id.** A Sparkplug node id is
+`{group}/{node}[/{device}]::{metric}` and a metric name legitimately contains `/`
+(`Node Control/Rebirth`), so splitting the id cannot recover the tuple. Which keys the session emits
+is also how the mapper learns the shape — the driver *type* reaching it is just `Mqtt`, and the mode
+lives on the driver config. A leaf whose attribute lookup returned nothing carries no address and is
+refused **at commit, in words**, rather than committed as a tag that deploys clean and then reports
+`BadNodeIdUnknown` forever.
+
+### Request rebirth (Sparkplug only)
+
+Births are never retained, so a healthy but quiet plant shows an **empty** picker tree until one
+lands. The `Request rebirth` affordance in the browse modal is the way to fill it on demand: it
+publishes a Sparkplug rebirth-request NCMD (`Node Control/Rebirth`) to the selected scope — the **one
+and only** browse action that publishes anything.
+
+- **Scope** is the last node clicked in the tree. A device or metric resolves **up to its owning edge
+  node** (Sparkplug has no device-scoped rebirth); a group fans out to every observed edge node
+  beneath it and is refused **whole** past 32, publishing nothing.
+- **Two clicks, never one** — `Request rebirth…` arms a confirm panel naming the resolved scope and
+  its consequence; changing the selection disarms it.
+- **Gated on `DriverOperator`**, enforced server-side in `BrowserSessionService.RequestRebirthAsync`
+  (fail-closed) before the session is touched; the UI gate is defence in depth. A refusal — policy,
+  over-wide group, unresolvable scope — is **shown**, not swallowed.
+- Offered only for a Sparkplug session (`IRebirthCapableBrowseSession.RebirthAvailable`); a Plain
+  MQTT window publishes nothing, ever.
+
+### Refresh
+
+An observation window **accumulates**, but the tree renders **once**, when it is created — and
+`OpenAsync` returns as soon as the SUBSCRIBE is granted, without waiting for the birth-observation
+window. So the first render is normally empty on Plain (a topic that has not published yet is
+invisible) and *almost always* empty on Sparkplug (births are never retained). **Refresh** re-reads
+the root against the same session: nothing reconnects, nothing already observed is lost, and the tag
+selection is kept. Only the armed rebirth scope is cleared, because the node it named may no longer be
+in the rebuilt tree.
+
+> **Also fixed by this gate, and not MQTT-specific:** every node label in the shared
+> `DriverBrowseTree` was an `<a href="#">`. `blazor.web.js`'s enhanced-navigation click interceptor
+> resolves a bare `#` against `<base href="/">`, so clicking a node **label** navigated the whole
+> AdminUI to `/` and destroyed the hosting modal (`@onclick:preventDefault` suppresses the browser's
+> default action, not Blazor's interceptor). The labels are now `<button type="button">`. This
+> affected **every** driver's picker since 2026-05-28; it surfaced here because choosing a rebirth
+> scope is the first flow that requires clicking a label rather than the ▶ toggle.
+
+> ⚠️ **Known gap — a completely empty tree cannot arm a rebirth.** The rebirth scope is taken from the
+> last node clicked *in the tree*, so on a plant that has not birthed since the window opened there is
+> nothing to click and `Request rebirth…` stays disabled — the exact case the affordance exists for.
+> `MqttBrowseSession.ResolveRebirthTargets` already accepts a bare `{group}/{edgeNode}` for a node the
+> window has never seen (it calls that "the prime rebirth target"); what is missing is a UI path to
+> enter one, or to default the scope to the driver's own configured `GroupId`. Until then: use
+> **Refresh** after any birth, or author the tags by **Manual entry**, which is always available.
+
+## Test Connect
+
+`MqttDriverProbe` performs **one CONNECT** (no SUBSCRIBE, no publish) under a `-probe-` client id and
+disconnects. Success message: `"MQTT CONNECT OK"`. A rejected CONNACK is described by the same
+`DescribeConnackRejection` the running driver uses, so the button and the driver report a rejection in
+identical words. See [TestConnectProbes.md](TestConnectProbes.md).
+
+## Testing
+
+- **Unit** — `tests/Drivers/…Driver.Mqtt.Tests` (**581 tests**): tag-config mapping (both shapes),
+  JSONPath subset, strict-enum rejection, subscription indexing (incl. the wildcard-by-filter case),
+  reconnect/rebuild branches, CONNACK classification, and the Sparkplug half — golden-payload decode,
+  topic parse/format, datatype map, alias/birth-cache rebuild, sequence + bdSeq-death ties, the
+  rediscovery change gate, and the browse session's "publishes nothing" assertion.
+- **Live (env-gated)** — `tests/Drivers/…Driver.Mqtt.IntegrationTests` (**15 tests**) against the
+  Mosquitto broker + the C# Sparkplug edge-node simulator; skips cleanly when `MQTT_FIXTURE_ENDPOINT`
+  is unset. See [Mqtt-Test-Fixture.md](Mqtt-Test-Fixture.md) and `infra/README.md` §3.
+- **AdminUI** — `MqttDriverFormModelTests` / `MqttTagConfigModelTests` cover both editors'
+  round-trip, mode inference and validation. AdminUI has no bUnit, so the razor shells themselves are
+  only ever proven by a live `/run` gate.
+
+## Operational Notes
+
+- **Read-only.** No writes reach the broker; every node is ViewOnly. Sparkplug NCMD is used for
+  **rebirth requests only** — never to command a device.
+- **No alarms, no driver-side history.** Historization is a server-side concern (`isHistorized`).
+- **Both pair nodes subscribe independently** — MQTT fan-out is per-connection, and the Primary gate
+  applies downstream, not to ingest. This is also why `clientId` must stay unset (above).
+- **Unauthored traffic is ignored.** A busy broker is normal; the driver never auto-provisions a tag.
+
+## Known gaps
+
+Every row is tracked. None is a silent failure — each either refuses in words or logs.
+
+| Gap | Issue | Effect | Notes |
+|---|:---:|---|---|
+| **Write-through (`IWritable`)** | [#508](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/508) | Every MQTT node is read-only | Deferred to P3 — NCMD/DCMD + plain publish, optimistic-Good + self-correct on echo |
+| **Rediscovery is inert** | [#507](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/507) | A DBIRTH introducing a metric does not change the OPC UA tree; redeploy to pick it up | v3 **platform** gap, not MQTT-specific — nothing subscribes to `OnRediscoveryNeeded` and `DriverHostActor.HandleDiscoveredNodes` hard-returns. Also affects Galaxy / TwinCAT / AbCip. Driver-side decision is log-observable |
+| **Rebirth needs a non-empty tree** | [#514](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/514) | `Request rebirth…` cannot be armed on a plant that has not birthed since the window opened | See [Refresh](#refresh). Session side already supports a bare `{group}/{edgeNode}` scope |
+| **`_canRebirth` is captured at browse-open** | [#510](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/510) | A session reaped for idleness (2 min) still draws the button, and using it errors | The error is shown, not swallowed; reopen the browser |
+| **Primary-host STATE publishing** | [#511](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/511) | `ActAsPrimaryHost` does nothing | Logs a startup warning rather than being silently inert — see the `Sparkplug` sub-object table |
+| **A metric whose name contains `/` cannot be browse-committed** | [#509](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/509) | The commit is refused **whole**, in words (`Row N: Name must not contain '/'`) | The derived **tag Name** is a RawPath segment and may not contain `/`, while `metricName` legitimately may. This blocks the spec-mandatory `Node Control/Rebirth`. **Workaround: Manual entry** — author the tag with a `/`-free name and type the slashed `metricName` into the Sparkplug editor, which accepts it. Nothing is silently mis-bound |
+| **`DataSet` / `Template` / `PropertySet` metrics** | [#515](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/515) | Skipped with a warning | v1-unsupported; never coerced into a guessed type |
+| **The tag editor writes `payloadFormat` into a Sparkplug blob** | [#513](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/513) | Cosmetic only | `payloadFormat` is Plain-only; the factory routes on the Sparkplug keys and ignores it. Noise in the blob, not a mis-binding |
+| **`.Browser` references `.Driver`, not just `.Contracts`** | [#512](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/512) | A documented layering exception | Taken to reuse `MqttConnection.BuildClientOptions` rather than duplicate TLS/CA-pin logic — see the note at the top of this doc |
@@ -124,7 +124,7 @@ ConditionType events (non-base `BaseEventType`) is not verified.
 - Anonymous, UserName/Password, X509 cert tokens — each is contract-tested
  but not exchanged against a server that actually enforces each.
 - LDAP-backed `UserName` (matching this repo's server-side
-  `LdapUserAuthenticator`) requires a live LDAP round-trip; not tested.
+  `LdapOpcUaUserAuthenticator`) requires a live LDAP round-trip; not tested.

 ## When to trust OpcUaClient tests, when to reach for a server

@@ -1,6 +1,6 @@
 # Drivers

-OtOpcUa is a multi-driver OPC UA server. The Core (`ZB.MOM.WW.OtOpcUa.Core` + `Core.Abstractions` + `Server`) owns the OPC UA stack, address space, session/security/subscription machinery, resilience pipeline, and namespace kinds (Equipment + SystemPlatform). Drivers plug in through **capability interfaces** defined in `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/`:
+OtOpcUa is a multi-driver OPC UA server. The Core (`ZB.MOM.WW.OtOpcUa.Core` + `Core.Abstractions` + `Server`) owns the OPC UA stack, address space, session/security/subscription machinery, resilience pipeline, and the two v3 OPC UA namespaces (Raw + UNS — see `V3NodeIds` / `AddressSpaceRealm`). Drivers plug in through **capability interfaces** defined in `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/`:

 - `IDriver` — lifecycle (`InitializeAsync`, `ReinitializeAsync`, `ShutdownAsync`, `GetHealth`)
 - `IReadable` / `IWritable` — one-shot reads and writes
@@ -15,20 +15,28 @@ OtOpcUa is a multi-driver OPC UA server. The Core (`ZB.MOM.WW.OtOpcUa.Core` + `C

 Each driver opts into only the capabilities it supports. Every async capability call at the Server dispatch layer goes through `CapabilityInvoker` (`Core/Resilience/CapabilityInvoker.cs`), which wraps it in a Polly pipeline keyed on `(DriverInstanceId, HostName, DriverCapability)`. The `OTOPCUA0001` analyzer enforces the wrap at build time. Drivers themselves never depend on Polly; they just implement the capability interface and let the Core wrap it.

-Driver type metadata is registered at startup in `DriverTypeRegistry` (`src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverTypeRegistry.cs`). The registry records each type's allowed namespace kinds (`Equipment` / `SystemPlatform` / `Simulated`), its JSON Schema for `DriverConfig` / `DeviceConfig` / `TagConfig` columns, and its stability tier per [docs/v2/driver-stability.md](../v2/driver-stability.md).
+Driver **factories** are registered at startup in `DriverFactoryRegistry` (`src/Core/ZB.MOM.WW.OtOpcUa.Core/Hosting/DriverFactoryRegistry.cs`) — all 12 in one place, `src/Server/ZB.MOM.WW.OtOpcUa.Host/Drivers/DriverFactoryBootstrap.cs:147-164`. Type names are the `DriverTypeNames` constants (`src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverTypeNames.cs`), guarded bidirectionally by `DriverTypeNamesGuardTests`.
+
+> ⚠️ **`DriverTypeRegistry` / `DriverTypeMetadata` are vestigial.** No production code constructs or reads them — the class is referenced only by its own unit tests. Its `AllowedNamespaceKinds` field was retired along with the v3 `Namespace` entity (`DriverTypeRegistry.cs:97`), and the `SystemPlatform` namespace kind no longer exists.
+>
+> **Stability tier** likewise does not come from that registry: it is the `DriverTier tier = DriverTier.A` parameter on `DriverFactoryRegistry.cs:46`, and **no factory in `src/Drivers/` passes a tier**, so every shipped driver runs Tier A. The Tier-C-only protections described in [docs/v2/driver-stability.md](../v2/driver-stability.md) — `MemoryRecycle` hard-breach kill (`MemoryRecycle.cs:54`) and `ScheduledRecycleScheduler` (`:43`) — are therefore dormant for every driver.

 ## Ground-truth driver list

 | Driver | Project path | Tier | Wire / library | Capabilities | Notable quirk |
 |--------|--------------|:----:|----------------|--------------|---------------|
 | [Galaxy](Galaxy.md) | `Driver.Galaxy` (+ `.Browser`, `.Contracts`) | A | gRPC to the external `mxaccessgw` gateway (the gateway owns MXAccess COM + the Galaxy Repository SQL reader) | IDriver, ITagDiscovery, IReadable, IWritable, ISubscribable, IAlarmSource, IRediscoverable, IHostConnectivityProbe | In-process .NET 10 driver — the COM bitness constraint lives in the gateway's x86 net48 worker, not here. PR 7.2 retired the legacy in-process `Galaxy.{Shared, Host, Proxy}` + named-pipe Windows service. Native MxAccess alarms work end-to-end |
-| [Modbus TCP](Modbus.md) | `Driver.Modbus` | A | NModbus-derived in-house client | IDriver, ITagDiscovery, IReadable, IWritable, ISubscribable, IHostConnectivityProbe, IPerCallHostResolver | Polled subscriptions via the shared `PollGroupEngine`. DL205 PLCs are covered by `AddressFormat=DL205` (octal V/X/Y/C/T/CT translation) — no separate driver |
+| [Modbus TCP / RTU-over-TCP](Modbus.md) | `Driver.Modbus` (+ `.Addressing`, `.Contracts`) | A | NModbus-derived in-house client; `Transport` selects MBAP (TCP) or RTU CRC-16 framing over a socket | IDriver, ITagDiscovery, IReadable, IWritable, ISubscribable, IHostConnectivityProbe, IPerCallHostResolver | Polled subscriptions via the shared `PollGroupEngine`. DL205 PLCs are covered by `AddressFormat=DL205` (octal V/X/Y/C/T/CT translation) — no separate driver. `Transport=RtuOverTcp` (`ModbusTransportMode`, default `Tcp`) targets serial→Ethernet gateways via `ModbusRtuOverTcpTransport` + `ModbusRtuFraming` + `ModbusCrc`, with `ModbusTransportDesyncException` carrying distinct CrcMismatch/UnitMismatch reasons; **direct-serial transport is descoped**. Merged `0f38f486` (#495) |
 | [Siemens S7](S7.md) | `Driver.S7` | A | [S7netplus](https://github.com/S7NetPlus/s7netplus) | IDriver, ITagDiscovery, IReadable, IWritable, ISubscribable, IHostConnectivityProbe | Single S7netplus `Plc` instance per PLC serialized with `SemaphoreSlim` — the S7 CPU's comm mailbox is scanned at most once per cycle, so parallel reads don't help |
 | [AB CIP](AbCip.md) | `Driver.AbCip` | A | libplctag CIP | IDriver, ITagDiscovery, IReadable, IWritable, ISubscribable, IHostConnectivityProbe, IPerCallHostResolver, IAlarmSource | ControlLogix / CompactLogix. Tag discovery uses the `@tags` walker to enumerate controller-scoped + program-scoped symbols; UDT member resolution via the UDT template reader |
 | [AB Legacy](AbLegacy.md) | `Driver.AbLegacy` | A | libplctag PCCC | IDriver, ITagDiscovery, IReadable, IWritable, ISubscribable, IHostConnectivityProbe, IPerCallHostResolver | SLC 500 / MicroLogix. File-based addressing (`N7:0`, `F8:0`) — no symbol table, tag list is user-authored in the config DB |
 | [TwinCAT](TwinCAT.md) | `Driver.TwinCAT` | B | Beckhoff `TwinCAT.Ads` (`TcAdsClient`) | IDriver, ITagDiscovery, IReadable, IWritable, ISubscribable, IHostConnectivityProbe, IPerCallHostResolver, IRediscoverable | The only native-notification driver outside Galaxy — ADS delivers `ValueChangedCallback` events the driver forwards straight to `ISubscribable.OnDataChange` without polling. Symbol tree uploaded via `SymbolLoaderFactory` |
 | [FOCAS](FOCAS.md) | `Driver.FOCAS` | A | Pure-managed `FocasWireClient` — FOCAS/2 Ethernet binary protocol on TCP:8193, inlined into the driver assembly | IDriver, ITagDiscovery, IReadable, IWritable, ISubscribable, IHostConnectivityProbe, IPerCallHostResolver, IAlarmSource | `IWritable` is implemented but read-only by design — `WriteAsync` returns `BadNotWritable` for every point. CNC-shaped data model (axes, spindle, PMC, macros, alarms) not a flat tag map. Previously Tier-C (Host + P/Invoke + shim DLL); retired in the 2026-04-24 migration when the managed wire client landed |
 | [OPC UA Client](OpcUaClient.md) | `Driver.OpcUaClient` | B | OPCFoundation `Opc.Ua.Client` | IDriver, ITagDiscovery, IReadable, IWritable, ISubscribable, IAlarmSource, IHistoryProvider, IHostConnectivityProbe | Gateway/aggregation driver — the only driver implementing driver-side `IHistoryProvider` (forwards HistoryRead to the upstream server). Opens a single `Session` against a remote OPC UA server and re-exposes its address space. Owns its own `ApplicationConfiguration` (distinct from `Client.Shared`) because it's always-on with keep-alive + `TransferSubscriptions` across SDK reconnect, not an interactive CLI |
+| [MQTT](Mqtt.md) | `Driver.Mqtt` (+ `.Browser`, `.Contracts`) | A | [MQTTnet 5](https://github.com/dotnet/MQTTnet) | IDriver, ITagDiscovery, IReadable, ISubscribable, IHostConnectivityProbe, IRediscoverable | **Push, not poll, and read-only** — the broker delivers PUBLISH frames the driver forwards straight to `ISubscribable.OnDataChange`; `IReadable` serves the last retained/received value from cache, and there is **no `IWritable`** (nothing publishes back). Subscriptions are indexed **by topic filter, not by topic**, so wildcard tags survive a reconnect. A rejected CONNACK throws `MqttConnectRejectedException`: unrecoverable codes → `Faulted` + supervisor stop, transient → retry. **Two modes:** `Plain` binds a tag to a concrete topic + JSON path; `SparkplugB` decodes vendored Eclipse-Tahu protobuf under one `spBv1.0/{groupId}/#` subscription and binds by the `group/edgeNode/device?/metric` tuple (birth/alias/seq-gap state machine, death→STALE, scoped rebirth NCMD). `IRediscoverable` fires on a DBIRTH but is **inert platform-side** — see [#507](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/507) |
+| [MTConnect](MTConnect.md) | `Driver.MTConnect` (+ `.Contracts`) | — | Hand-rolled `System.Xml.Linq` HTTP/XML client against a vendor-neutral MTConnect Agent (`/probe`, `/current`, `/sample`) — no TrakHound dependency (dropped; see the driver doc) | IDriver, ITagDiscovery, IReadable, ISubscribable, IHostConnectivityProbe, IRediscoverable | Read-only by design (no `IWritable`). Production data plane is entirely `ISubscribable`/`OnDataChange` — `IReadable` is CLI/test-only. Browse is free via the Wave-0 universal discovery browser, no bespoke browser project. `IRediscoverable`/`IHostConnectivityProbe` have no server-side consumer yet — a pre-existing fleet-wide gap, not MTConnect-specific |
+| **Sql** (no dedicated page — see [design](../plans/2026-07-15-sql-poll-driver-design.md)) | `Driver.Sql` (+ `.Browser`, `.Contracts`) | A | `Microsoft.Data.SqlClient` behind an `ISqlDialect` seam (`SqlServerDialect` shipped; Postgres/ODBC deferred) | IDriver, ITagDiscovery, IReadable, ISubscribable, IHostConnectivityProbe | Read-only DB-poll driver with a bespoke schema browser. **Credentials are never persisted** — the deploy gate rejects a stored `connectionString` (#498) and catalog identifiers are validated against the live catalog's own spelling (#496). `SupportsOnlineDiscovery => false` by design (the bespoke browser wins). `SqlTagModel.Query` is deferred to P3 and rejected end-to-end by parser, validator, planner and editor. Merged `4ad54037` |
+| **Calculation** (see [Raw.md](../Raw.md#the-calculation-driver)) | `Driver.Calculation` | A | none — computes from other tags' RawPaths | IDriver, IDependencyConsumer, ISubscribable, IReadable | **Pseudo-driver**, not a wire protocol: signal-level tags computed from other tags via a script, with deploy-time `scriptId`-existence + Tarjan cycle gates. Its probe is parse-only (no backend to reach). ⚠️ **No typed config form** — `DriverConfigModal` has no `Calculation` case, so `RunTimeout` is currently unauthorable through the AdminUI |
 | [Historian.Gateway](../Historian.md) | `Driver.Historian.Gateway` | — | `ZB.MOM.WW.HistorianGateway.Client` gRPC (`historian_gateway.v1`) | IHistorianDataSource (server-side read backend) + alarm `SendEvent` writer + `WriteLiveValues` recorder + `IHistorianProvisioning` | Not a tag driver — the sole historian backend. Registers `GatewayHistorianDataSource : IHistorianDataSource` for HistoryRead and serves alarm-write + continuous historization through the gateway. No `IDriver`/`ITagDiscovery` surface. (The retired Wonderware sidecar backend it replaced is documented at [Historian.Wonderware.md](Historian.Wonderware.md).) |

 ## Per-driver documentation
@@ -40,13 +48,18 @@ Driver type metadata is registered at startup in `DriverTypeRegistry` (`src/Core
 - **FOCAS** has a short getting-started doc because the backend-selection env var + alarm projection opt-in need explaining up front:
  - [FOCAS.md](FOCAS.md) — deployment, config, capability surface, alarm projection, troubleshooting

- **Modbus TCP**, **AB CIP**, **AB Legacy**, **Siemens S7**, **TwinCAT**, and **OPC UA Client** each have a per-driver overview page:
+- **Modbus TCP**, **AB CIP**, **AB Legacy**, **Siemens S7**, **TwinCAT**, **OPC UA Client**, and **MQTT** each have a per-driver overview page:
  - [Modbus.md](Modbus.md) — in-process Modbus-TCP driver: address formats, polled subscription model, DL205 octal mapping
  - [AbCip.md](AbCip.md) — AB CIP / EtherNet-IP driver (ControlLogix / CompactLogix / Micro800 / GuardLogix): tag discovery, UDT resolution, alarm source
  - [AbLegacy.md](AbLegacy.md) — AB Legacy PCCC driver (SLC 500 / MicroLogix / PLC-5): file-based addressing, user-authored tag list
  - [S7.md](S7.md) — Siemens S7 driver (S7-300/400/1200/1500 + S7-200): getting started, config, data-block addressing, serialized single-connection model
  - [TwinCAT.md](TwinCAT.md) — Beckhoff TwinCAT (ADS) driver: getting started, native-notification subscription, symbol-tree upload
  - [OpcUaClient.md](OpcUaClient.md) — OPC UA Client (gateway/aggregation) driver: remote-server session, driver-side HistoryRead forwarding, reconnect behaviour
+  - [Mqtt.md](Mqtt.md) — MQTT broker-subscribe driver: broker/TLS/auth config, topic + JSON-path tag binding, retained-value seeding, `#`-observation browser, CONNACK-rejection semantics, **Sparkplug B** (birth/alias/seq/rebirth state machine, birth-driven browse picker, death→STALE), and the **Known gaps** table
+
+- **MTConnect** has a short getting-started doc because the hand-rolled-vs-TrakHound divergence, the
+  data-plane precedence rules, and a non-trivial known-limitations list need explaining up front:
+  - [MTConnect.md](MTConnect.md) — Agent config, `FullName`==DataItem `id`, `UNAVAILABLE`→`BadNoCommunication`, CONDITION-as-`String`, browse-via-universal-browser, fixture recipe, deferred write-back

 - **Historian.Gateway** (server-side historian backend, not a tag driver) is documented in the main guide:
  - [../Historian.md](../Historian.md) — HistorianGateway backend: read-path registration, HistoryRead dispatch, alarm store-and-forward (`SendEvent`), continuous historization (`WriteLiveValues`), `EnsureTags` provisioning, config keys, deployment prerequisites. (The retired Wonderware sidecar backend it replaced: [Historian.Wonderware.md](Historian.Wonderware.md).)
@@ -64,12 +77,14 @@ Each driver has a dedicated fixture doc that lays out what the integration / uni
 - [TwinCAT](TwinCAT-Test-Fixture.md) — XAR-VM integration scaffolding (task #221); three smoke tests skip when VM unreachable. Unit via `FakeTwinCATClient` with native-notification harness
 - [FOCAS](FOCAS-Test-Fixture.md) — no integration fixture, unit-only via `FakeFocasClient`; Tier C out-of-process isolation scoped but not shipped
 - [OPC UA Client](OpcUaClient-Test-Fixture.md) — Dockerized `opc-plc` integration suite (task #215): real Secure Channel + Session, read + subscribe verified end-to-end; write not yet exercised in the integration suite; exhaustive capability matrix (reconnect, failover, cert-auth, history, alarms) via unit suite with mocked `Session`
+- [MQTT](Mqtt-Test-Fixture.md) — Dockerized `eclipse-mosquitto` with **TLS + real auth on both listeners (no anonymous fallback)** + a JSON-publisher sidecar; env-gated live suite (**15 tests**) — 7 plain (TLS/auth connect, CA pinning both ways, subscribe→value, retained seeding, wrong-password rejection) + 8 Sparkplug against a **project-owned C# edge-node simulator** on the `sparkplug` compose profile (birth→alias bind, DDATA, NDEATH→STALE, rebirth NCMD round-trip). Births are never retained, so `docker restart otopcua-sparkplug-sim` is how you force a fresh one
 - [Galaxy](../v1/drivers/Galaxy-Test-Fixture.md) — richest harness: gateway E2E + ZB SQL live-smoke + MXAccess opt-in (v1 archive)
+- [MTConnect](../../tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests/Docker/README.md) — Dockerized `mtconnect/agent` + stdlib SHDR adapter (two services, the Agent alone reports everything `UNAVAILABLE`); 12/12 against the real Agent, canned XML unit fixtures cover the bulk (491/491)

 ## Related cross-driver docs

 - [HistoricalDataAccess.md](../v1/HistoricalDataAccess.md) — `IHistoryProvider` dispatch, aggregate mapping, continuation points. The OPC UA Client driver is the only driver that implements driver-side `IHistoryProvider` (it forwards HistoryRead to the upstream server); the AVEVA Historian path is served server-side by the HistorianGateway-backed `IHistorianDataSource` instead. Other drivers do not implement the interface and return `BadHistoryOperationUnsupported`.
- [AlarmTracking.md](../AlarmTracking.md) — `IAlarmSource` event model and filtering. Implemented by Galaxy (native MxAccess alarms, working end-to-end), OPC UA Client, AB CIP, and FOCAS; AB Legacy, Modbus, S7, and TwinCAT have no alarm source.
+- [AlarmTracking.md](../AlarmTracking.md) — `IAlarmSource` event model and filtering. Implemented by Galaxy (native MxAccess alarms, working end-to-end), OPC UA Client, AB CIP, and FOCAS; AB Legacy, Modbus, S7, TwinCAT, and MQTT have no alarm source.
 - [Subscriptions.md](../v1/Subscriptions.md) — how the Server multiplexes subscriptions onto `ISubscribable.OnDataChange`.
 - [docs/v2/driver-stability.md](../v2/driver-stability.md) — tier system (A / B / C), shared `CapabilityPolicy` defaults per tier × capability, `MemoryTracking` hybrid formula, and process-level recycle rules.
 - [docs/v2/plan.md](../v2/plan.md) — authoritative vision, architecture decisions, migration strategy.
@@ -49,6 +49,7 @@ with a human-readable explanation rather than a false-green TCP-open tick.
 | **TwinCAT** | `AdsClient.Connect` + `ReadStateAsync`. See [degrade semantics](#twincat-degrade) below. | `"ADS state: {state}"` | Deferred — no ADS target |
 | **FOCAS** | `cnc_allclibhndl3` via a direct `DllImport("fwlib32")` in the probe. See [degrade semantics](#focas-degrade) below. | `"FOCAS handle OK"` | Deferred — no CNC + FWLIB |
 | **Galaxy** | gRPC unary call to `GalaxyRepository.TestConnection` on the configured mxaccessgw endpoint. See [auth-rejection rule](#galaxy-auth-rejection) below. | `"gateway gRPC OK"` | `http://10.100.0.48:5120` (mxaccessgw) |
+| **MQTT** | One MQTT `CONNECT` (no SUBSCRIBE, no publish) under a `-probe-`-suffixed client id, then disconnect. **A rejected CONNACK is a returned result code, not an exception** — MQTTnet 5 does not throw — so the probe inspects `ResultCode` and reuses the driver's own `DescribeConnackRejection`, making the button and the running driver word a rejection identically. | `"MQTT CONNECT OK"` | `10.100.0.35:8883` (Mosquitto TLS+auth fixture) |

 **Historian.Wonderware** had a TCP `Hello`→`HelloAck` handshake probe before Phase 5, but the
 Wonderware historian backend (and its driver-type / probe) has since been **retired** — the historian
@@ -133,6 +134,7 @@ above. (Live verification on `10.100.0.48:5120` with no key returns
 | S7 | Verified | python-snap7 `10.100.0.35:1102` |
 | AbCip | Verified | CIP sim `10.100.0.35:44818` |
 | Galaxy | Verified | mxaccessgw `10.100.0.48:5120`; `Unauthenticated` reply counts as Ok |
+| MQTT | Verified | Mosquitto `10.100.0.35:8883`; live suite covers TLS+auth Ok, foreign-CA rejection, and wrong-password rejection surfacing rather than reporting healthy |
 | AbLegacy | Deferred | No PLC5/SLC sim; unit-proven + code path identical to AbCip |
 | TwinCAT | Deferred | No ADS target; unit-proven + degrade guard tested |
 | FOCAS | Deferred | No CNC + FWLIB on dev host; degrade guard is the CI-observable path |
@@ -92,7 +92,7 @@ discovery.
 | `ISubscribable` | native ADS notifications (default), poll fallback | `UseNativeNotifications=true` registers device notifications so the PLC pushes changes; `false` uses the shared `PollGroupEngine` |
 | `IHostConnectivityProbe` | per-device probe loop | One `HostConnectivityStatus` per configured device; `Running`/`Stopped` transitions raise `OnHostStatusChanged` |
 | `IPerCallHostResolver` | `ResolveHost` lookup in the tag map | Routes each call to the device of the referenced tag; returns an empty-string sentinel when unresolved |
-| `IRediscoverable` | symbol-version-changed callback | A PLC re-download fires `OnRediscoveryNeeded` so the address space is rebuilt |
+| `IRediscoverable` | symbol-version-changed callback | A PLC re-download fires `OnRediscoveryNeeded`. ⚠️ **No consumer wires it today** ([#518](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/518), [#507](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/507)) — the address space does **not** rebuild; a config redeploy is required. Driver-side behaviour is log-observable only |

 ### Rediscovery on PLC re-download

@@ -100,8 +100,15 @@ discovery.
 `DeviceSymbolVersionInvalid` (1809 / 0x0711) — the documented TwinCAT
 symbol-version-changed signal, raised when a PLC program is re-downloaded —
 every symbol and notification handle is invalidated. The driver raises
-`OnRediscoveryNeeded` with a `TwinCAT` scope hint so Core rebuilds the address
-space rather than treating it as a transient connection error.
+`OnRediscoveryNeeded` with a `TwinCAT` scope hint, so that the signal is treated
+as an address-space change rather than a transient connection error.
+
+⚠️ **That is the intended design, not present behaviour.** No consumer subscribes
+to `OnRediscoveryNeeded` anywhere in `src/`, and the scope hint is read by nothing
+([#518](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/518),
+[#507](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/507)). Today the
+signal is observable only in the driver log; after a PLC re-download the served
+address space changes only on a config redeploy.

 ### Native notifications

@@ -148,7 +155,7 @@ fixture is down during normal dev.
 **Live-verify** — integration-fixture-gated (requires the TwinCAT Docker fixture / AMS router).

 **Deferrals** — array *writes* (`ADS WriteValueAsync` for an array), multi-dimensional
-arrays, per-element historization.  `IRediscoverable` still fires and rebuilds array nodes
+arrays, per-element historization.  `IRediscoverable` fires and now surfaces a `/hosts` re-browse prompt, but still does not rebuild the address space (#518)
 on PLC re-download (unchanged semantics from scalar nodes).

 See [Uns.md §Array tags](../Uns.md#array-tags-1-d) for the cross-driver coverage matrix
@@ -1,18 +1,116 @@
 {
  "planPath": "docs/plans/2026-06-12-historian-tcp-transport.md",
  "tasks": [
-    {"id": 0, "nativeTaskId": 296, "subject": "Task 0: Create feature branch", "status": "pending"},
-    {"id": 1, "nativeTaskId": 297, "subject": "Task 1: Add TCP/TLS fields to client options", "status": "pending", "blockedBy": [0]},
-    {"id": 2, "nativeTaskId": 298, "subject": "Task 2: Client TCP connect factory + FrameChannel rename", "status": "pending", "blockedBy": [1]},
-    {"id": 3, "nativeTaskId": 299, "subject": "Task 3: Switch client default ctor to TCP", "status": "pending", "blockedBy": [2]},
-    {"id": 4, "nativeTaskId": 300, "subject": "Task 4: Host config binding (Host/Port/TLS)", "status": "pending", "blockedBy": [1]},
-    {"id": 5, "nativeTaskId": 301, "subject": "Task 5: Sidecar TcpFrameServer", "status": "pending", "blockedBy": [0]},
-    {"id": 6, "nativeTaskId": 302, "subject": "Task 6: Sidecar Program.cs — TCP bootstrap + env", "status": "pending", "blockedBy": [5]},
-    {"id": 7, "nativeTaskId": 303, "subject": "Task 7: Remove dead pipe code + finalize options shape", "status": "pending", "blockedBy": [3, 4, 6]},
-    {"id": 8, "nativeTaskId": 304, "subject": "Task 8: Deploy scripts — env block + firewall + cert", "status": "pending", "blockedBy": [7]},
-    {"id": 9, "nativeTaskId": 305, "subject": "Task 9: AdminUI Test-Connect probe to host/port/TLS", "status": "pending", "blockedBy": [7]},
-    {"id": 10, "nativeTaskId": 306, "subject": "Task 10: Docs — TCP transport", "status": "pending", "blockedBy": [7]},
-    {"id": 11, "nativeTaskId": 307, "subject": "Task 11: Verification (build + test + live)", "status": "pending", "blockedBy": [8, 9, 10]}
+    {
+      "id": 0,
+      "nativeTaskId": 296,
+      "subject": "Task 0: Create feature branch",
+      "status": "completed"
+    },
+    {
+      "id": 1,
+      "nativeTaskId": 297,
+      "subject": "Task 1: Add TCP/TLS fields to client options",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 2,
+      "nativeTaskId": 298,
+      "subject": "Task 2: Client TCP connect factory + FrameChannel rename",
+      "status": "completed",
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 3,
+      "nativeTaskId": 299,
+      "subject": "Task 3: Switch client default ctor to TCP",
+      "status": "completed",
+      "blockedBy": [
+        2
+      ]
+    },
+    {
+      "id": 4,
+      "nativeTaskId": 300,
+      "subject": "Task 4: Host config binding (Host/Port/TLS)",
+      "status": "completed",
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 5,
+      "nativeTaskId": 301,
+      "subject": "Task 5: Sidecar TcpFrameServer",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 6,
+      "nativeTaskId": 302,
+      "subject": "Task 6: Sidecar Program.cs \u2014 TCP bootstrap + env",
+      "status": "completed",
+      "blockedBy": [
+        5
+      ]
+    },
+    {
+      "id": 7,
+      "nativeTaskId": 303,
+      "subject": "Task 7: Remove dead pipe code + finalize options shape",
+      "status": "completed",
+      "blockedBy": [
+        3,
+        4,
+        6
+      ]
+    },
+    {
+      "id": 8,
+      "nativeTaskId": 304,
+      "subject": "Task 8: Deploy scripts \u2014 env block + firewall + cert",
+      "status": "completed",
+      "blockedBy": [
+        7
+      ]
+    },
+    {
+      "id": 9,
+      "nativeTaskId": 305,
+      "subject": "Task 9: AdminUI Test-Connect probe to host/port/TLS",
+      "status": "completed",
+      "blockedBy": [
+        7
+      ]
+    },
+    {
+      "id": 10,
+      "nativeTaskId": 306,
+      "subject": "Task 10: Docs \u2014 TCP transport",
+      "status": "completed",
+      "blockedBy": [
+        7
+      ]
+    },
+    {
+      "id": 11,
+      "nativeTaskId": 307,
+      "subject": "Task 11: Verification (build + test + live)",
+      "status": "completed",
+      "blockedBy": [
+        8,
+        9,
+        10
+      ]
+    }
  ],
-  "lastUpdated": "2026-06-12"
+  "lastUpdated": "2026-07-27",
+  "closureNote": "OBSOLETE \u2014 targets the bespoke Wonderware TCP/ArchestrA historian sidecar, retired when HistorianGateway became the sole historian backend. There is no Wonderware backend in the tree. Closed as obsolete 2026-07-27 (deferment.md \u00a78.5)."
 }
@@ -1,18 +1,111 @@
 {
  "planPath": "docs/plans/2026-06-15-stillpending-phase-0-1.md",
  "tasks": [
-    {"id": 402, "subject": "SP Task 0: Feature branch feat/stillpending-phase-0-1", "status": "pending"},
-    {"id": 403, "subject": "SP Task 1: Phase 0 — correct 7 stale code comments", "status": "pending", "blockedBy": [402]},
-    {"id": 404, "subject": "SP Task 2: Phase 0 — fix docs/security.md + benign-residue comments", "status": "pending", "blockedBy": [402]},
-    {"id": 405, "subject": "SP Task 3: Phase 0 — mark shipped .tasks.json completed", "status": "pending", "blockedBy": [402]},
-    {"id": 406, "subject": "SP Task 4: Phase 1 H1a — Phase7Applier rebuilds on Changed*", "status": "pending", "blockedBy": [402]},
-    {"id": 407, "subject": "SP Task 5: Phase 1 H1b — VirtualTagHostActor respawns changed child", "status": "pending", "blockedBy": [402]},
-    {"id": 408, "subject": "SP Task 6: Phase 1 H5a — EquipmentVirtualTagPlan.Historize + composer", "status": "pending", "blockedBy": [402]},
-    {"id": 409, "subject": "SP Task 7: Phase 1 H5b — DeploymentArtifact decodes Historize (byte-parity)", "status": "pending", "blockedBy": [408]},
-    {"id": 410, "subject": "SP Task 8: Phase 1 H5c — VirtualTagHostActor invokes IHistoryWriter", "status": "pending", "blockedBy": [407, 409]},
-    {"id": 411, "subject": "SP Task 9: Phase 1 H5d — thread IHistoryWriter through DriverHostActor + DI", "status": "pending", "blockedBy": [410, 403]},
-    {"id": 412, "subject": "SP Task 10: Phase 1 — docs + follow-up bookkeeping", "status": "pending", "blockedBy": [411]},
-    {"id": 413, "subject": "SP Task 11: Phase 0+1 — full build + test + integration review", "status": "pending", "blockedBy": [403, 404, 405, 406, 407, 408, 409, 410, 411, 412]}
+    {
+      "id": 402,
+      "subject": "SP Task 0: Feature branch feat/stillpending-phase-0-1",
+      "status": "completed"
+    },
+    {
+      "id": 403,
+      "subject": "SP Task 1: Phase 0 \u2014 correct 7 stale code comments",
+      "status": "completed",
+      "blockedBy": [
+        402
+      ]
+    },
+    {
+      "id": 404,
+      "subject": "SP Task 2: Phase 0 \u2014 fix docs/security.md + benign-residue comments",
+      "status": "completed",
+      "blockedBy": [
+        402
+      ]
+    },
+    {
+      "id": 405,
+      "subject": "SP Task 3: Phase 0 \u2014 mark shipped .tasks.json completed",
+      "status": "completed",
+      "blockedBy": [
+        402
+      ]
+    },
+    {
+      "id": 406,
+      "subject": "SP Task 4: Phase 1 H1a \u2014 Phase7Applier rebuilds on Changed*",
+      "status": "completed",
+      "blockedBy": [
+        402
+      ]
+    },
+    {
+      "id": 407,
+      "subject": "SP Task 5: Phase 1 H1b \u2014 VirtualTagHostActor respawns changed child",
+      "status": "completed",
+      "blockedBy": [
+        402
+      ]
+    },
+    {
+      "id": 408,
+      "subject": "SP Task 6: Phase 1 H5a \u2014 EquipmentVirtualTagPlan.Historize + composer",
+      "status": "completed",
+      "blockedBy": [
+        402
+      ]
+    },
+    {
+      "id": 409,
+      "subject": "SP Task 7: Phase 1 H5b \u2014 DeploymentArtifact decodes Historize (byte-parity)",
+      "status": "completed",
+      "blockedBy": [
+        408
+      ]
+    },
+    {
+      "id": 410,
+      "subject": "SP Task 8: Phase 1 H5c \u2014 VirtualTagHostActor invokes IHistoryWriter",
+      "status": "completed",
+      "blockedBy": [
+        407,
+        409
+      ]
+    },
+    {
+      "id": 411,
+      "subject": "SP Task 9: Phase 1 H5d \u2014 thread IHistoryWriter through DriverHostActor + DI",
+      "status": "completed",
+      "blockedBy": [
+        410,
+        403
+      ]
+    },
+    {
+      "id": 412,
+      "subject": "SP Task 10: Phase 1 \u2014 docs + follow-up bookkeeping",
+      "status": "completed",
+      "blockedBy": [
+        411
+      ]
+    },
+    {
+      "id": 413,
+      "subject": "SP Task 11: Phase 0+1 \u2014 full build + test + integration review",
+      "status": "completed",
+      "blockedBy": [
+        403,
+        404,
+        405,
+        406,
+        407,
+        408,
+        409,
+        410,
+        411,
+        412
+      ]
+    }
  ],
-  "lastUpdated": "2026-06-15"
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Shipped \u2014 the stillpending backlog audit cites the landing commits (1e95856b, ada01e1a, fc8121cb, 3e609a2b, 70e6d3d2, c236263e, bd8fee61, 5e27b5f7, fcb38014). Marked complete 2026-07-27 (deferment.md \u00a78.5)."
 }
@@ -2,15 +2,72 @@
  "planPath": "docs/plans/2026-06-15-stillpending-phase-2-servicelevel.md",
  "branch": "feat/stillpending-phase-2-servicelevel",
  "tasks": [
-    {"id": 414, "subject": "P2 Task 1: Move ServiceLevelCalculator to Core.Cluster", "status": "pending"},
-    {"id": 415, "subject": "P2 Task 2a: OpcUaPublishActor calculator path (DB+stale+leader+Detached guard, legacy seam)", "status": "pending", "blockedBy": [414]},
-    {"id": 416, "subject": "P2 Task 2b: OpcUaProbeOk from peer-probes-me (freshness + debounce)", "status": "pending", "blockedBy": [415]},
-    {"id": 417, "subject": "P2 Task 3: HealthTick — periodic DB Ask/PipeTo + PreStart immediate refresh", "status": "pending", "blockedBy": [416]},
-    {"id": 418, "subject": "P2 Task 4: PeerProbeSupervisor — one peer probe per driver peer", "status": "pending"},
-    {"id": 419, "subject": "P2 Task 5: Wire WithOtOpcUaRuntimeActors (dbHealth ref + spawn supervisor)", "status": "pending", "blockedBy": [417, 418]},
-    {"id": 420, "subject": "P2 Task 6: docs/Redundancy.md — calculator is WIRED", "status": "pending"},
-    {"id": 421, "subject": "P2 Task 7: Full build + test + final integration review", "status": "pending", "blockedBy": [419, 420]},
-    {"id": 422, "subject": "P2 Task 8: Live /run on the 2-node rig (acceptance gate)", "status": "pending", "blockedBy": [421]}
+    {
+      "id": 414,
+      "subject": "P2 Task 1: Move ServiceLevelCalculator to Core.Cluster",
+      "status": "completed"
+    },
+    {
+      "id": 415,
+      "subject": "P2 Task 2a: OpcUaPublishActor calculator path (DB+stale+leader+Detached guard, legacy seam)",
+      "status": "completed",
+      "blockedBy": [
+        414
+      ]
+    },
+    {
+      "id": 416,
+      "subject": "P2 Task 2b: OpcUaProbeOk from peer-probes-me (freshness + debounce)",
+      "status": "completed",
+      "blockedBy": [
+        415
+      ]
+    },
+    {
+      "id": 417,
+      "subject": "P2 Task 3: HealthTick \u2014 periodic DB Ask/PipeTo + PreStart immediate refresh",
+      "status": "completed",
+      "blockedBy": [
+        416
+      ]
+    },
+    {
+      "id": 418,
+      "subject": "P2 Task 4: PeerProbeSupervisor \u2014 one peer probe per driver peer",
+      "status": "completed"
+    },
+    {
+      "id": 419,
+      "subject": "P2 Task 5: Wire WithOtOpcUaRuntimeActors (dbHealth ref + spawn supervisor)",
+      "status": "completed",
+      "blockedBy": [
+        417,
+        418
+      ]
+    },
+    {
+      "id": 420,
+      "subject": "P2 Task 6: docs/Redundancy.md \u2014 calculator is WIRED",
+      "status": "completed"
+    },
+    {
+      "id": 421,
+      "subject": "P2 Task 7: Full build + test + final integration review",
+      "status": "completed",
+      "blockedBy": [
+        419,
+        420
+      ]
+    },
+    {
+      "id": 422,
+      "subject": "P2 Task 8: Live /run on the 2-node rig (acceptance gate)",
+      "status": "completed",
+      "blockedBy": [
+        421
+      ]
+    }
  ],
-  "lastUpdated": "2026-06-15"
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Shipped \u2014 the stillpending backlog audit cites the landing commits (1e95856b, ada01e1a, fc8121cb, 3e609a2b, 70e6d3d2, c236263e, bd8fee61, 5e27b5f7, fcb38014). Marked complete 2026-07-27 (deferment.md \u00a78.5)."
 }
@@ -2,16 +2,80 @@
  "planPath": "docs/plans/2026-06-15-stillpending-phase-3-opcua-standards.md",
  "branch": "feat/stillpending-phase-3-opcua-standards",
  "tasks": [
-    {"id": 423, "subject": "P3 Task 1: H2-bit — NodePermissions.HistoryUpdate + evaluator mapping", "status": "pending"},
-    {"id": 424, "subject": "P3 Task 2: H6a — mark native conditions (isNative through the sink)", "status": "pending"},
-    {"id": 425, "subject": "P3 Task 3: H4 — wire OnEnableDisable over OPC UA", "status": "pending", "blockedBy": [424]},
-    {"id": 426, "subject": "P3 Task 4: H6b — AlarmAcknowledgeRequest.OperatorUser + Galaxy/ScriptedAlarmSource", "status": "pending"},
-    {"id": 427, "subject": "P3 Task 5: H6c — NativeAlarmAckRouter seam + native OnAcknowledge routing", "status": "pending", "blockedBy": [424]},
-    {"id": 428, "subject": "P3 Task 6: H6d — DriverHostActor inverse map + native-ack route to driver", "status": "pending", "blockedBy": [426, 427]},
-    {"id": 429, "subject": "P3 Task 7: H6e — wire NativeAlarmAckRouter in host DI", "status": "pending", "blockedBy": [427, 428]},
-    {"id": 430, "subject": "P3 Task 8: Docs — Enable/Disable + native-ack→AVEVA + HistoryUpdate bit", "status": "pending"},
-    {"id": 431, "subject": "P3 Task 9: Full build + test + final integration review", "status": "pending", "blockedBy": [423, 425, 429, 430]},
-    {"id": 432, "subject": "P3 Task 10: Live /run — H4 Enable/Disable + H6 native-ack route", "status": "pending", "blockedBy": [431]}
+    {
+      "id": 423,
+      "subject": "P3 Task 1: H2-bit \u2014 NodePermissions.HistoryUpdate + evaluator mapping",
+      "status": "completed"
+    },
+    {
+      "id": 424,
+      "subject": "P3 Task 2: H6a \u2014 mark native conditions (isNative through the sink)",
+      "status": "completed"
+    },
+    {
+      "id": 425,
+      "subject": "P3 Task 3: H4 \u2014 wire OnEnableDisable over OPC UA",
+      "status": "completed",
+      "blockedBy": [
+        424
+      ]
+    },
+    {
+      "id": 426,
+      "subject": "P3 Task 4: H6b \u2014 AlarmAcknowledgeRequest.OperatorUser + Galaxy/ScriptedAlarmSource",
+      "status": "completed"
+    },
+    {
+      "id": 427,
+      "subject": "P3 Task 5: H6c \u2014 NativeAlarmAckRouter seam + native OnAcknowledge routing",
+      "status": "completed",
+      "blockedBy": [
+        424
+      ]
+    },
+    {
+      "id": 428,
+      "subject": "P3 Task 6: H6d \u2014 DriverHostActor inverse map + native-ack route to driver",
+      "status": "completed",
+      "blockedBy": [
+        426,
+        427
+      ]
+    },
+    {
+      "id": 429,
+      "subject": "P3 Task 7: H6e \u2014 wire NativeAlarmAckRouter in host DI",
+      "status": "completed",
+      "blockedBy": [
+        427,
+        428
+      ]
+    },
+    {
+      "id": 430,
+      "subject": "P3 Task 8: Docs \u2014 Enable/Disable + native-ack\u2192AVEVA + HistoryUpdate bit",
+      "status": "completed"
+    },
+    {
+      "id": 431,
+      "subject": "P3 Task 9: Full build + test + final integration review",
+      "status": "completed",
+      "blockedBy": [
+        423,
+        425,
+        429,
+        430
+      ]
+    },
+    {
+      "id": 432,
+      "subject": "P3 Task 10: Live /run \u2014 H4 Enable/Disable + H6 native-ack route",
+      "status": "completed",
+      "blockedBy": [
+        431
+      ]
+    }
  ],
-  "lastUpdated": "2026-06-15"
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Shipped \u2014 the stillpending backlog audit cites the landing commits (1e95856b, ada01e1a, fc8121cb, 3e609a2b, 70e6d3d2, c236263e, bd8fee61, 5e27b5f7, fcb38014). Marked complete 2026-07-27 (deferment.md \u00a78.5)."
 }
@@ -2,14 +2,68 @@
  "planPath": "docs/plans/2026-06-16-stillpending-phase-4-driver-datatypes.md",
  "branch": "feat/stillpending-phase-4-driver-datatypes",
  "tasks": [
-    {"id": 433, "subject": "P4 Task 1: Modbus Int64/UInt64 node DataType (MapDataType split)", "status": "pending"},
-    {"id": 434, "subject": "P4 Task 2: FOCAS fail-fast factory (EnsureUsable at init)", "status": "pending"},
-    {"id": 435, "subject": "P4 Task 3: FOCAS position scaling (PositionDecimalPlaces)", "status": "pending", "blockedBy": [434]},
-    {"id": 436, "subject": "P4 Task 4: Historian Total aggregate (client-side Average x interval-seconds)", "status": "pending"},
-    {"id": 437, "subject": "P4 Task 5: Historian poison-event dead-letter cap (maxAttempts)", "status": "pending"},
-    {"id": 438, "subject": "P4 Task 6: Docs + bookkeeping", "status": "pending", "blockedBy": [433, 434, 435, 436, 437]},
-    {"id": 439, "subject": "P4 Task 7: Full build + test + final integration review", "status": "pending", "blockedBy": [433, 434, 435, 436, 437, 438]},
-    {"id": 440, "subject": "P4 Task 8: Live /run — Modbus Int64 (acceptance gate)", "status": "pending", "blockedBy": [439]}
+    {
+      "id": 433,
+      "subject": "P4 Task 1: Modbus Int64/UInt64 node DataType (MapDataType split)",
+      "status": "completed"
+    },
+    {
+      "id": 434,
+      "subject": "P4 Task 2: FOCAS fail-fast factory (EnsureUsable at init)",
+      "status": "completed"
+    },
+    {
+      "id": 435,
+      "subject": "P4 Task 3: FOCAS position scaling (PositionDecimalPlaces)",
+      "status": "completed",
+      "blockedBy": [
+        434
+      ]
+    },
+    {
+      "id": 436,
+      "subject": "P4 Task 4: Historian Total aggregate (client-side Average x interval-seconds)",
+      "status": "completed"
+    },
+    {
+      "id": 437,
+      "subject": "P4 Task 5: Historian poison-event dead-letter cap (maxAttempts)",
+      "status": "completed"
+    },
+    {
+      "id": 438,
+      "subject": "P4 Task 6: Docs + bookkeeping",
+      "status": "completed",
+      "blockedBy": [
+        433,
+        434,
+        435,
+        436,
+        437
+      ]
+    },
+    {
+      "id": 439,
+      "subject": "P4 Task 7: Full build + test + final integration review",
+      "status": "completed",
+      "blockedBy": [
+        433,
+        434,
+        435,
+        436,
+        437,
+        438
+      ]
+    },
+    {
+      "id": 440,
+      "subject": "P4 Task 8: Live /run \u2014 Modbus Int64 (acceptance gate)",
+      "status": "completed",
+      "blockedBy": [
+        439
+      ]
+    }
  ],
-  "lastUpdated": "2026-06-16"
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Shipped \u2014 the stillpending backlog audit cites the landing commits (1e95856b, ada01e1a, fc8121cb, 3e609a2b, 70e6d3d2, c236263e, bd8fee61, 5e27b5f7, fcb38014). Marked complete 2026-07-27 (deferment.md \u00a78.5)."
 }
@@ -4,16 +4,61 @@
  "designCommit": "f90017bc",
  "baseMaster": "c081917a",
  "branch": "feat/stillpending-phase-4b-driver-gaps (merged to master 08a65513, deleted)",
-  "executionState": "COMPLETE — shipped + pushed to master 08a65513 (ff). Final integration review = SHIP. Build clean; AdminUI 450, Galaxy 279(+3 skip), FOCAS 200, Modbus 277, DriverProbeRegistration 2 — all green. Live: Modbus typed editor + Build-address proven on the rig's seeded MAIN-modbus-eq (Modbus reconcile, conclusive); Galaxy browse rendered a nested hierarchical root via the real driver path (corroborated, unit-proven 8 ways); FOCAS unit-proven (no CNC).",
-  "nativeTaskIds": {"1": 482, "2": 483, "3a": 484, "3b": 485, "4": 486, "5": 487, "6": 488},
+  "executionState": "COMPLETE \u2014 shipped + pushed to master 08a65513 (ff). Final integration review = SHIP. Build clean; AdminUI 450, Galaxy 279(+3 skip), FOCAS 200, Modbus 277, DriverProbeRegistration 2 \u2014 all green. Live: Modbus typed editor + Build-address proven on the rig's seeded MAIN-modbus-eq (Modbus reconcile, conclusive); Galaxy browse rendered a nested hierarchical root via the real driver path (corroborated, unit-proven 8 ways); FOCAS unit-proven (no CNC).",
+  "nativeTaskIds": {
+    "1": 482,
+    "2": 483,
+    "3a": 484,
+    "3b": 485,
+    "4": 486,
+    "5": 487,
+    "6": 488
+  },
  "tasks": [
-    {"id": 1, "subject": "Task 1: Modbus driver-type-string reconcile (canonicalize on \"Modbus\")", "status": "completed", "commit": "8b4675b1", "reviewFixCommit": "a40c77de"},
-    {"id": 2, "subject": "Task 2: Galaxy nested gobject hierarchy", "status": "completed", "commit": "21c7645d", "reviewFixCommit": "bec37848"},
-    {"id": "3a", "subject": "Task 3a: IFocasClient.GetPositionFiguresAsync (cnc_getfigure binding)", "status": "completed", "commit": "3fcbc70c"},
-    {"id": "3b", "subject": "Task 3b: FOCAS driver auto-scale wiring (auto wins, manual fallback)", "status": "completed", "commit": "6855be28"},
-    {"id": 4, "subject": "Task 4: Docs + bookkeeping", "status": "completed", "commit": "08a65513"},
-    {"id": 5, "subject": "Task 5: Full build + test + final integration review", "status": "completed", "note": "final integration review = SHIP (no Critical/Important); 3 Minor non-blocking notes recorded"},
-    {"id": 6, "subject": "Task 6: Live /run verification", "status": "completed", "note": "Modbus typed editor live-proven on rig; Galaxy nested root corroborated; FOCAS unit-proven"}
+    {
+      "id": 1,
+      "subject": "Task 1: Modbus driver-type-string reconcile (canonicalize on \"Modbus\")",
+      "status": "completed",
+      "commit": "8b4675b1",
+      "reviewFixCommit": "a40c77de"
+    },
+    {
+      "id": 2,
+      "subject": "Task 2: Galaxy nested gobject hierarchy",
+      "status": "completed",
+      "commit": "21c7645d",
+      "reviewFixCommit": "bec37848"
+    },
+    {
+      "id": "3a",
+      "subject": "Task 3a: IFocasClient.GetPositionFiguresAsync (cnc_getfigure binding)",
+      "status": "completed",
+      "commit": "3fcbc70c"
+    },
+    {
+      "id": "3b",
+      "subject": "Task 3b: FOCAS driver auto-scale wiring (auto wins, manual fallback)",
+      "status": "completed",
+      "commit": "6855be28"
+    },
+    {
+      "id": 4,
+      "subject": "Task 4: Docs + bookkeeping",
+      "status": "completed",
+      "commit": "08a65513"
+    },
+    {
+      "id": 5,
+      "subject": "Task 5: Full build + test + final integration review",
+      "status": "completed",
+      "note": "final integration review = SHIP (no Critical/Important); 3 Minor non-blocking notes recorded"
+    },
+    {
+      "id": 6,
+      "subject": "Task 6: Live /run verification",
+      "status": "completed",
+      "note": "Modbus typed editor live-proven on rig; Galaxy nested root corroborated; FOCAS unit-proven"
+    }
  ],
  "reviewFollowUps": [
    "FOCAS minor: no upper-bound clamp on a misbehaving cnc_getfigure value (Math.Pow overflow; same latent risk the manual path had)",
@@ -21,5 +66,6 @@
    "FOCAS: live auto-fetch on the real backend needs a cnc_getfigure command added to the managed FocasWireClient wire protocol (WireFocasClient returns empty today)",
    "Galaxy minor: 3-node chain cycle provably-correct but not directly tested (2-node mutual cycle is tested)"
  ],
-  "lastUpdated": "2026-06-16"
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Shipped \u2014 the stillpending backlog audit cites the landing commits (1e95856b, ada01e1a, fc8121cb, 3e609a2b, 70e6d3d2, c236263e, bd8fee61, 5e27b5f7, fcb38014). Marked complete 2026-07-27 (deferment.md \u00a78.5)."
 }
@@ -4,28 +4,121 @@
  "designCommit": "efccd8d1",
  "baseMaster": "050164b2",
  "branch": "feat/stillpending-phase-4c-array-support (merged to master 0f92e9e2, deleted)",
-  "executionState": "COMPLETE — shipped + pushed to master 0f92e9e2 (ff, 23 commits). Big-bang all 5 drivers + full AbLegacy. Build clean; OpcUaServer 230, Runtime 272, AdminUI 472, Modbus 289, AbCip 292, TwinCAT 153, S7 143, AbLegacy 188 — all green. Bundle integration review caught the cross-driver isArray-gating divergence (C-1/C-2 Modbus+AbLegacy ignored isArray; I-1/I-2/I-3 the arrayLength=1 edge); final integration review = SHIP WITH MINOR FOLLOW-UPS (I-1 S7 clarity, I-2 AbCip degenerate-scalar, I-3 AbLegacy >256 author-validation, M-1 array nodes read-only) — all closed. LIVE /run PASS: a Modbus array equipment tag (HR[0..3], UInt16[4]) materialises as ValueRank=OneDimension/ArrayDimensions=[4] and a Good array value flows end-to-end from the live sim (read over the wire, Status 0x00000000, Value System.UInt16[]); the address-100 first attempt correctly surfaced the sim's Illegal-Data-Address as Bad (faithful device status). S7/AbCip/TwinCAT/AbLegacy unit-proven (fixtures down).",
+  "executionState": "COMPLETE \u2014 shipped + pushed to master 0f92e9e2 (ff, 23 commits). Big-bang all 5 drivers + full AbLegacy. Build clean; OpcUaServer 230, Runtime 272, AdminUI 472, Modbus 289, AbCip 292, TwinCAT 153, S7 143, AbLegacy 188 \u2014 all green. Bundle integration review caught the cross-driver isArray-gating divergence (C-1/C-2 Modbus+AbLegacy ignored isArray; I-1/I-2/I-3 the arrayLength=1 edge); final integration review = SHIP WITH MINOR FOLLOW-UPS (I-1 S7 clarity, I-2 AbCip degenerate-scalar, I-3 AbLegacy >256 author-validation, M-1 array nodes read-only) \u2014 all closed. LIVE /run PASS: a Modbus array equipment tag (HR[0..3], UInt16[4]) materialises as ValueRank=OneDimension/ArrayDimensions=[4] and a Good array value flows end-to-end from the live sim (read over the wire, Status 0x00000000, Value System.UInt16[]); the address-100 first attempt correctly surfaced the sim's Illegal-Data-Address as Bad (faithful device status). S7/AbCip/TwinCAT/AbLegacy unit-proven (fixtures down).",
  "scope": "Big-bang all 5 drivers (AskUserQuestion) + full AbLegacy array read (AskUserQuestion). 1-D read-surface only; array writes / multi-dim / array historization out of scope (array nodes forced read-only at the applier per review M-1).",
-  "nativeTaskIds": {"1": 495, "2": 496, "3": 497, "4": 498, "5": 499, "6": 500, "7": 501, "8": 502, "9": 503, "10": 504, "11": 505, "12": 506},
+  "nativeTaskIds": {
+    "1": 495,
+    "2": 496,
+    "3": 497,
+    "4": 498,
+    "5": 499,
+    "6": 500,
+    "7": 501,
+    "8": 502,
+    "9": 503,
+    "10": 504,
+    "11": 505,
+    "12": 506
+  },
  "tasks": [
-    {"id": 1, "subject": "Sink contract — EnsureVariable array params", "classification": "high-risk", "status": "completed", "commit": "a7928202", "reviewFixCommit": "3172b7bd"},
-    {"id": 2, "subject": "EquipmentTagPlan IsArray/ArrayLength + composer + applier", "classification": "high-risk", "status": "completed", "commit": "71cc4171", "reviewFixCommit": "584e9f2a"},
-    {"id": 3, "subject": "DeploymentArtifact decode byte-parity", "classification": "high-risk", "status": "completed", "commit": "0a747c34", "reviewFixCommit": "eb8a8dc1"},
-    {"id": 4, "subject": "AdminUI driver-agnostic isArray/arrayLength control", "classification": "standard", "status": "completed", "commit": "c2006dfb"},
-    {"id": 5, "subject": "Modbus String/BitInRegister array decode + resolver", "classification": "small", "status": "completed", "commit": "8d3dc321", "reviewFixCommit": "49ac1392"},
-    {"id": 6, "subject": "AbCip libplctag array read + IsArray", "classification": "standard", "status": "completed", "commit": "f4d5a5ee", "reviewFixCommit": "94e8c55b+5f7a2acd"},
-    {"id": 7, "subject": "TwinCAT ADS array read + IsArray (reference impl, no fix needed)", "classification": "standard", "status": "completed", "commit": "3e742395"},
-    {"id": 8, "subject": "S7 block-read array + decode loop + IsArray", "classification": "high-risk", "status": "completed", "commit": "a82c22c6", "reviewFixCommit": "3bbe39c1+d30fb77e"},
-    {"id": 9, "subject": "AbLegacy PCCC multi-element array read + IsArray", "classification": "high-risk", "status": "completed", "commit": "95006939", "reviewFixCommit": "ce5d46be+0f92e9e2"},
-    {"id": 10, "subject": "Docs + bookkeeping", "classification": "small", "status": "completed", "commit": "05c7e86f"},
-    {"id": 11, "subject": "Full build + test + final integration review", "classification": "standard", "status": "completed", "note": "final integration review = SHIP WITH MINOR FOLLOW-UPS; 4 review fixes applied (d30fb77e/5f7a2acd/0f92e9e2/3bb2031d)"},
-    {"id": 12, "subject": "Live /run acceptance + finish branch", "classification": "standard", "status": "completed", "note": "Modbus array tag live-proven (Good UInt16[4] from sim HR[0..3], over the wire); others unit-proven; root-caused the address-100 Bad as a sim Illegal-Data-Address (not a code bug)"}
+    {
+      "id": 1,
+      "subject": "Sink contract \u2014 EnsureVariable array params",
+      "classification": "high-risk",
+      "status": "completed",
+      "commit": "a7928202",
+      "reviewFixCommit": "3172b7bd"
+    },
+    {
+      "id": 2,
+      "subject": "EquipmentTagPlan IsArray/ArrayLength + composer + applier",
+      "classification": "high-risk",
+      "status": "completed",
+      "commit": "71cc4171",
+      "reviewFixCommit": "584e9f2a"
+    },
+    {
+      "id": 3,
+      "subject": "DeploymentArtifact decode byte-parity",
+      "classification": "high-risk",
+      "status": "completed",
+      "commit": "0a747c34",
+      "reviewFixCommit": "eb8a8dc1"
+    },
+    {
+      "id": 4,
+      "subject": "AdminUI driver-agnostic isArray/arrayLength control",
+      "classification": "standard",
+      "status": "completed",
+      "commit": "c2006dfb"
+    },
+    {
+      "id": 5,
+      "subject": "Modbus String/BitInRegister array decode + resolver",
+      "classification": "small",
+      "status": "completed",
+      "commit": "8d3dc321",
+      "reviewFixCommit": "49ac1392"
+    },
+    {
+      "id": 6,
+      "subject": "AbCip libplctag array read + IsArray",
+      "classification": "standard",
+      "status": "completed",
+      "commit": "f4d5a5ee",
+      "reviewFixCommit": "94e8c55b+5f7a2acd"
+    },
+    {
+      "id": 7,
+      "subject": "TwinCAT ADS array read + IsArray (reference impl, no fix needed)",
+      "classification": "standard",
+      "status": "completed",
+      "commit": "3e742395"
+    },
+    {
+      "id": 8,
+      "subject": "S7 block-read array + decode loop + IsArray",
+      "classification": "high-risk",
+      "status": "completed",
+      "commit": "a82c22c6",
+      "reviewFixCommit": "3bbe39c1+d30fb77e"
+    },
+    {
+      "id": 9,
+      "subject": "AbLegacy PCCC multi-element array read + IsArray",
+      "classification": "high-risk",
+      "status": "completed",
+      "commit": "95006939",
+      "reviewFixCommit": "ce5d46be+0f92e9e2"
+    },
+    {
+      "id": 10,
+      "subject": "Docs + bookkeeping",
+      "classification": "small",
+      "status": "completed",
+      "commit": "05c7e86f"
+    },
+    {
+      "id": 11,
+      "subject": "Full build + test + final integration review",
+      "classification": "standard",
+      "status": "completed",
+      "note": "final integration review = SHIP WITH MINOR FOLLOW-UPS; 4 review fixes applied (d30fb77e/5f7a2acd/0f92e9e2/3bb2031d)"
+    },
+    {
+      "id": 12,
+      "subject": "Live /run acceptance + finish branch",
+      "classification": "standard",
+      "status": "completed",
+      "note": "Modbus array tag live-proven (Good UInt16[4] from sim HR[0..3], over the wire); others unit-proven; root-caused the address-100 Bad as a sim Illegal-Data-Address (not a code bug)"
+    }
  ],
  "reviewFollowUps": [
-    "Foundation array test asserts in-process variable.Value only — add a wire-level Session.ReadValueAsync assertion over an array node (the live /run proved it works, but it's not unit-covered)",
-    "Client.CLI read/subscribe prints an array value's type name (System.UInt16[]) not its elements — add array element formatting",
+    "Foundation array test asserts in-process variable.Value only \u2014 add a wire-level Session.ReadValueAsync assertion over an array node (the live /run proved it works, but it's not unit-covered)",
+    "Client.CLI read/subscribe prints an array value's type name (System.UInt16[]) not its elements \u2014 add array element formatting",
    "Array WRITES (inbound client->device), multi-dimensional arrays, array historization remain out of scope (named deferrals)",
    "Live array read for S7/AbCip/TwinCAT/AbLegacy is fixture-gated/operator-gated (unit-proven only); the 5 AbLegacy libplctag PCCC array-read assumptions need a real SLC/MicroLogix to confirm"
  ],
-  "lastUpdated": "2026-06-16"
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Shipped \u2014 the stillpending backlog audit cites the landing commits (1e95856b, ada01e1a, fc8121cb, 3e609a2b, 70e6d3d2, c236263e, bd8fee61, 5e27b5f7, fcb38014). Marked complete 2026-07-27 (deferment.md \u00a78.5)."
 }
@@ -271,7 +271,7 @@ public sealed class GatewayQualityMapperTests
 {
    [Theory]
    [InlineData(192, 0x00000000u)] // Good
-    [InlineData(216, 0x00D80000u)] // Good_LocalOverride
+    [InlineData(216, 0x00960000u)] // Good_LocalOverride
    [InlineData(64,  0x40000000u)] // Uncertain
    [InlineData(0,   0x80000000u)] // Bad
    [InlineData(8,   0x808A0000u)] // Bad_NotConnected
@@ -307,7 +307,7 @@ public sealed class SampleMapperTests
    {
        var a = new HistorianAggregateSample { Tag = "T", /* Value unset */ EndTime = Ts(2026,1,1,0,0,0) };
        var snap = SampleMapper.ToAggregateSnapshot(a);
-        Assert.Equal(0x800E0000u, snap.StatusCode); // BadNoData
+        Assert.Equal(0x809B0000u, snap.StatusCode); // BadNoData
        Assert.Null(snap.Value);
    }
    // Ts(...) builds a Google.Protobuf.WellKnownTypes.Timestamp from UTC parts.
@@ -323,7 +323,7 @@ public sealed class SampleMapperTests
  - `StatusCode`: `GatewayQualityMapper.Map((byte)s.OpcQuality)` (prefer `opc_quality`; if zero/unset and `quality` carries the OPC-DA byte, fall back to `quality` — match whatever the gateway populates; document the choice).
  - `SourceTimestampUtc`: `s.Timestamp.ToDateTime()` (UTC kind).
  - `ServerTimestampUtc`: `DateTime.UtcNow`.
- `SampleMapper.ToAggregateSnapshot(HistorianAggregateSample)` → null aggregate value ⇒ `StatusCode 0x800E0000` (BadNoData), non-null ⇒ Good (`0x00000000`) with the value; `SourceTimestampUtc` ← the bucket end/start timestamp (match the Wonderware `ToAggregateSnapshots` convention — it stamps the bucket timestamp). Provide `IReadOnlyList<>` batch helpers too.
+- `SampleMapper.ToAggregateSnapshot(HistorianAggregateSample)` → null aggregate value ⇒ `StatusCode 0x809B0000` (BadNoData), non-null ⇒ Good (`0x00000000`) with the value; `SourceTimestampUtc` ← the bucket end/start timestamp (match the Wonderware `ToAggregateSnapshots` convention — it stamps the bucket timestamp). Provide `IReadOnlyList<>` batch helpers too.

 **Step 4: run, expect PASS.**

@@ -1,27 +1,185 @@
 {
  "planPath": "docs/plans/2026-06-26-otopcua-historian-gateway-integration.md",
  "tasks": [
-    { "id": 0,  "subject": "Task 1: Consume gateway packages + scaffold Gateway driver project", "status": "pending", "blockedBy": [] },
-    { "id": 1,  "subject": "Task 2: HistoryAggregateType->RetrievalMode mapper (matrix-guarded)", "status": "pending", "blockedBy": [0] },
-    { "id": 2,  "subject": "Task 3: DriverDataType->HistorianDataType mapper + write-gap fallbacks (matrix-guarded)", "status": "pending", "blockedBy": [0] },
-    { "id": 3,  "subject": "Task 4: HistorianSample/Aggregate->DataValueSnapshot + quality mapper", "status": "pending", "blockedBy": [0] },
-    { "id": 4,  "subject": "Task 5: HistorianEvent->HistoricalEvent mapper (+ severity)", "status": "pending", "blockedBy": [0] },
-    { "id": 5,  "subject": "Task 6: AlarmHistorianEvent->HistorianEvent mapper (SendEvent)", "status": "pending", "blockedBy": [0] },
-    { "id": 6,  "subject": "Task 7: GatewayHistorianDataSource read paths (raw/processed/at-time)", "status": "pending", "blockedBy": [1, 3] },
-    { "id": 7,  "subject": "Task 8: GetHealthSnapshot via Probe/GetConnectionStatus", "status": "pending", "blockedBy": [6] },
-    { "id": 8,  "subject": "Task 9: Reshape ServerHistorianOptions to gateway form", "status": "pending", "blockedBy": [0] },
-    { "id": 9,  "subject": "Task 10: Swap AddServerHistorian factory in Program.cs (READ CUTOVER)", "status": "pending", "blockedBy": [6, 8] },
-    { "id": 10, "subject": "Task 11: ReadEventsAsync alarm-history on the data source", "status": "pending", "blockedBy": [6, 4] },
-    { "id": 11, "subject": "Task 12: GatewayAlarmHistorianWriter (SendEvent + outcome mapping)", "status": "pending", "blockedBy": [9, 5] },
-    { "id": 12, "subject": "Task 13: Swap AddAlarmHistorian factory in Program.cs", "status": "pending", "blockedBy": [11] },
-    { "id": 13, "subject": "Task 14: IHistorianProvisioning + GatewayTagProvisioner (EnsureTags)", "status": "pending", "blockedBy": [9, 2] },
-    { "id": 14, "subject": "Task 15: Hook provisioning into AddressSpaceApplier.Apply()", "status": "pending", "blockedBy": [13] },
-    { "id": 15, "subject": "Task 16: FasterLog historization outbox store", "status": "pending", "blockedBy": [9] },
-    { "id": 16, "subject": "Task 17: ContinuousHistorizationRecorder actor", "status": "pending", "blockedBy": [15, 9] },
-    { "id": 17, "subject": "Task 18: Wire recorder into DI + hosted lifecycle", "status": "pending", "blockedBy": [16] },
-    { "id": 18, "subject": "Task 19: Retire Wonderware historian projects", "status": "pending", "blockedBy": [9, 12, 17, 19] },
-    { "id": 19, "subject": "Task 20: Env-gated live validation vs wonder-sql-vd03", "status": "pending", "blockedBy": [9, 10, 12, 17] },
-    { "id": 20, "subject": "Task 21: Documentation (CLAUDE.md, appsettings, README)", "status": "pending", "blockedBy": [18] }
+    {
+      "id": 0,
+      "subject": "Task 1: Consume gateway packages + scaffold Gateway driver project",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": 1,
+      "subject": "Task 2: HistoryAggregateType->RetrievalMode mapper (matrix-guarded)",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 2,
+      "subject": "Task 3: DriverDataType->HistorianDataType mapper + write-gap fallbacks (matrix-guarded)",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 3,
+      "subject": "Task 4: HistorianSample/Aggregate->DataValueSnapshot + quality mapper",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 4,
+      "subject": "Task 5: HistorianEvent->HistoricalEvent mapper (+ severity)",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 5,
+      "subject": "Task 6: AlarmHistorianEvent->HistorianEvent mapper (SendEvent)",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 6,
+      "subject": "Task 7: GatewayHistorianDataSource read paths (raw/processed/at-time)",
+      "status": "completed",
+      "blockedBy": [
+        1,
+        3
+      ]
+    },
+    {
+      "id": 7,
+      "subject": "Task 8: GetHealthSnapshot via Probe/GetConnectionStatus",
+      "status": "completed",
+      "blockedBy": [
+        6
+      ]
+    },
+    {
+      "id": 8,
+      "subject": "Task 9: Reshape ServerHistorianOptions to gateway form",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 9,
+      "subject": "Task 10: Swap AddServerHistorian factory in Program.cs (READ CUTOVER)",
+      "status": "completed",
+      "blockedBy": [
+        6,
+        8
+      ]
+    },
+    {
+      "id": 10,
+      "subject": "Task 11: ReadEventsAsync alarm-history on the data source",
+      "status": "completed",
+      "blockedBy": [
+        6,
+        4
+      ]
+    },
+    {
+      "id": 11,
+      "subject": "Task 12: GatewayAlarmHistorianWriter (SendEvent + outcome mapping)",
+      "status": "completed",
+      "blockedBy": [
+        9,
+        5
+      ]
+    },
+    {
+      "id": 12,
+      "subject": "Task 13: Swap AddAlarmHistorian factory in Program.cs",
+      "status": "completed",
+      "blockedBy": [
+        11
+      ]
+    },
+    {
+      "id": 13,
+      "subject": "Task 14: IHistorianProvisioning + GatewayTagProvisioner (EnsureTags)",
+      "status": "completed",
+      "blockedBy": [
+        9,
+        2
+      ]
+    },
+    {
+      "id": 14,
+      "subject": "Task 15: Hook provisioning into AddressSpaceApplier.Apply()",
+      "status": "completed",
+      "blockedBy": [
+        13
+      ]
+    },
+    {
+      "id": 15,
+      "subject": "Task 16: FasterLog historization outbox store",
+      "status": "completed",
+      "blockedBy": [
+        9
+      ]
+    },
+    {
+      "id": 16,
+      "subject": "Task 17: ContinuousHistorizationRecorder actor",
+      "status": "completed",
+      "blockedBy": [
+        15,
+        9
+      ]
+    },
+    {
+      "id": 17,
+      "subject": "Task 18: Wire recorder into DI + hosted lifecycle",
+      "status": "completed",
+      "blockedBy": [
+        16
+      ]
+    },
+    {
+      "id": 18,
+      "subject": "Task 19: Retire Wonderware historian projects",
+      "status": "completed",
+      "blockedBy": [
+        9,
+        12,
+        17,
+        19
+      ]
+    },
+    {
+      "id": 19,
+      "subject": "Task 20: Env-gated live validation vs wonder-sql-vd03",
+      "status": "completed",
+      "blockedBy": [
+        9,
+        10,
+        12,
+        17
+      ]
+    },
+    {
+      "id": 20,
+      "subject": "Task 21: Documentation (CLAUDE.md, appsettings, README)",
+      "status": "completed",
+      "blockedBy": [
+        18
+      ]
+    }
  ],
-  "lastUpdated": "2026-06-26"
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Shipped as PR #423 and live-validated against the gateway on wonder-sql-vd03. Marked complete 2026-07-27 (deferment.md \u00a78.5)."
 }
@@ -26,7 +26,9 @@ OpcUaClient, Historian.Gateway (`src/Drivers/`).

 ## 2. Document map

-**Program:** this file.
+**Program:** this file (architecture / shared contract / build order).
+**Progress tracker (Waves 0–2):** [`2026-07-24-driver-expansion-tracking.md`](2026-07-24-driver-expansion-tracking.md)
+— per-deliverable status + links to each design doc and implementation plan.

 **Research reports** (`docs/research/drivers/`, index: [`README.md`](../research/drivers/README.md)):
 - [`mtconnect-agent.md`](../research/drivers/mtconnect-agent.md) ·
@@ -98,7 +98,7 @@ Pure function in `.Contracts` (shared by driver, browser-commit, and the typed e
 | `EVENT` free text (`Program`, `Block`, `Message`) | `String` |
 | `CONDITION` | `String` (state word; §3.6) |

-**Quality mapping (`DataValueSnapshot.StatusCode`):** an observation value of `UNAVAILABLE` (MTConnect's explicit no-data sentinel) → **`BadNoCommunication` (`0x80310000u`)** with a null value, not the literal string — this is *the* UNAVAILABLE code, used everywhere in this design (read, subscribe, and the §8 fixtures). Rationale + fleet fit: semantically, `UNAVAILABLE` means the Agent is reachable but has no device-backed value (the adapter↔device link is down or the item has never reported) — exactly OPC UA's `BadNoCommunication` ("communication to the data source has failed"). The fleet grep shows no competing convention for this case: every existing driver's `BadCommunicationError` (`0x80050000u`, Modbus/FOCAS/TwinCAT/OpcUaClient/S7/AbCip/AbLegacy/Galaxy) marks the **driver's own transport failure** to its peer — a different failure (and the code this driver also uses when the *Agent* HTTP call fails, per §7) — while `BadNoData` (`0x800E0000u`) is historian-domain only (`Historian.Gateway/Mapping/SampleMapper.cs`). `BadNoCommunication` is already in the CLI's `SnapshotFormatter` name table (`src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/SnapshotFormatter.cs`), so it renders by name, not hex. Declare it as a `private const uint` in `MTConnectDriver` (the Modbus `StatusBadCommunicationError` pattern). Missing dataItem / empty condition → `Bad`. `observation.timestamp` → `SourceTimestamp` (not a separate node).
+**Quality mapping (`DataValueSnapshot.StatusCode`):** an observation value of `UNAVAILABLE` (MTConnect's explicit no-data sentinel) → **`BadNoCommunication` (`0x80310000u`)** with a null value, not the literal string — this is *the* UNAVAILABLE code, used everywhere in this design (read, subscribe, and the §8 fixtures). Rationale + fleet fit: semantically, `UNAVAILABLE` means the Agent is reachable but has no device-backed value (the adapter↔device link is down or the item has never reported) — exactly OPC UA's `BadNoCommunication` ("communication to the data source has failed"). The fleet grep shows no competing convention for this case: every existing driver's `BadCommunicationError` (`0x80050000u`, Modbus/FOCAS/TwinCAT/OpcUaClient/S7/AbCip/AbLegacy/Galaxy) marks the **driver's own transport failure** to its peer — a different failure (and the code this driver also uses when the *Agent* HTTP call fails, per §7) — while `BadNoData` (`0x809B0000u`) is historian-domain only (`Historian.Gateway/Mapping/SampleMapper.cs`). `BadNoCommunication` is already in the CLI's `SnapshotFormatter` name table (`src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/SnapshotFormatter.cs`), so it renders by name, not hex. Declare it as a `private const uint` in `MTConnectDriver` (the Modbus `StatusBadCommunicationError` pattern). Missing dataItem / empty condition → `Bad`. `observation.timestamp` → `SourceTimestamp` (not a separate node).

 ### 3.4 `IReadable` — `/current`

@@ -588,6 +588,40 @@ SQL Server client works cross-platform, so `Sql` runs on macOS dev too (unlike G
  `dialect.QuoteIdentifier` (which escapes/rejects embedded quote characters). A table/column string
  in a `TagConfig` is validated against the live catalog (or an allow-list) before it's ever quoted
  into text; an unknown identifier rejects the tag (→ `BadNodeIdUnknown`) rather than executing.
+
+  **Implemented (Gitea #496).** `SqlCatalogGate` + `SqlCatalogLoader`, run from
+  `SqlDriver.InitializeAsync` after the liveness check and before the driver reports Healthy. Shape,
+  and the decisions worth knowing before touching it:
+
+  - **The catalog's spelling is substituted, not merely checked.** An accepted identifier is rewritten
+    to the string the catalog returned, so the text quoted into a poll query is one this driver read
+    back out of `ListSchemas`/`ListTables`/`ListColumns` — not operator input. Matching is
+    exact-ordinal first, then a *unique* case-insensitive hit (SQL Server's default collation is CI, so
+    case variants have always worked and rejecting them would break valid configs); an ambiguous CI
+    match under a case-sensitive collation is refused rather than guessed, because picking one would
+    publish another column's data under the operator's node.
+  - **Charset check first, catalog lookup second.** Each identifier goes through `QuoteIdentifier` for
+    its rejection rules *before* being looked up, so a name carrying a control or Unicode format
+    character is rejected **without its value being echoed** into a log line (Trojan-Source). A name
+    that passes is safe to render, which is why catalog-miss messages *do* name it — an operator
+    hunting a typo has to see what they wrote.
+  - **Rejection is per-tag and keeps the node.** The rejected tag is dropped from the *polled* table
+    but stays in the *authored* table, so it still materializes as a node and reads
+    `BadNodeIdUnknown` (§8.1's specified outcome) instead of vanishing from the address space. Every
+    drop is logged at Warning with the tag, the field and the reason.
+  - **A catalog that cannot be read faults Initialize; it does not reject every tag.** An unreadable
+    catalog is the *absence* of evidence about the tags, not evidence against them — rejecting all of
+    them would serve a confidently-empty address space and send the operator hunting typos that do not
+    exist. Zero visible schemas is treated the same way, because that is what a missing GRANT looks
+    like. Faulting lands `DriverInstanceActor` in Reconnecting with its retry timer running.
+  - **Bounded load:** one schema-list query, one default-schema scalar (`ISqlDialect.DefaultSchemaSql`,
+    added for this — an unqualified `TagValues` must resolve in whatever schema the *server* says, not
+    a guessed `dbo`), then one `ListTables` per distinct authored schema and one `ListColumns` per
+    distinct authored relation. It never enumerates the whole catalog, and the load runs under the same
+    wall-clock bound as the liveness check (R2-01 / STAB-14).
+  - **Accepted v1 limitation:** a 3-part `db.schema.table` (or a linked-server name) addresses a
+    catalog this connection cannot enumerate, so it cannot be allow-listed and is rejected with a
+    message pointing at the fix — expose the data through a view in the connected database.
 - **Treat any code path that builds SQL by string-concatenating a tag field as a defect** — enforce
  with a review checklist item + a unit test that feeds a malicious `keyValue`/`table`
  (`'; DROP TABLE …`) and asserts it either binds harmlessly (value) or is rejected (identifier),
@@ -607,8 +641,15 @@ comment) and the env-overridable ConfigDb connection string:
  file. Direct env read (not `IConfiguration`) is deliberate: the factory registry materializes
  drivers via a static `(id, json)` closure (Modbus pattern) with no `IConfiguration` in reach, so
  this keeps the factory shape unchanged.
- If an inline `connectionString` is ever permitted (dev convenience only), the AdminUI **redacts** it
-  in display/logging and flags it dev-only.
+- **An inline `connectionString` is not permitted at all** — the earlier "dev convenience, redacted in
+  the UI" carve-out is withdrawn (Gitea #498). Redaction only hides a credential that has *already been
+  written* to the config DB and replicated to every node's artifact cache. `SqlDriverConfigDto` has no
+  such property and `UnmappedMemberHandling.Skip` drops the key on read, but that protects only the read
+  path; config blobs are schemaless JSON columns, so nothing stopped the key being **written**.
+  `DraftValidator.ValidateSqlConnectionStringNotPersisted` now fails the deploy
+  (`SqlConnectionStringPersisted`) for a `connectionString` key at the top level of a Sql driver's
+  `DriverConfig` **or** of the `DeviceConfig` of any device beneath it (the two are merged before the DTO
+  sees them). The key is matched case-insensitively, and the error text never echoes the value.
 - **Never log the resolved connection string.** Log only provider + server host + database name.
 - Prefer integrated/managed auth where the estate supports it (`Integrated Security=true` / Azure AD /
  Kerberos) so no password transits config at all.
@@ -94,7 +94,14 @@ dual-namespace + event-delivery), Runtime 377 (+ VT reassert regression), AdminU

 ## Documented follow-ups (non-blocking)

- **Scripted-alarm redeploy recovery (CONFIRMED pre-existing bug, deferred — deserves its own careful fix). Filed as issue #487.**
+- **Scripted-alarm redeploy recovery — FIXED (issue #487), see `docs/ScriptedAlarms.md` §"Post-(re)load
+  condition-node re-assert".** Landed as the proposed shape below: `ScriptedAlarmHostActor.ReassertConditionNodes`
+  in `OnAlarmsLoaded`, node-only, never the `alerts` topic. Two deviations from the sketch, both deliberate:
+  it reads a new `ScriptedAlarmEngine.GetProjections()` rather than `GetState(alarmId)` + `LoadedAlarmIds`
+  (a projection also carries the definition's severity, the resolved message template, and the last-observed
+  worst-input quality — `GetState` alone would have clobbered severity/message on the node); and it skips
+  alarms sitting in the Part 9 no-event position, so a deploy where nothing is in alarm writes no condition
+  nodes at all. The original deferral text follows for context.
  The scripted-alarm Part 9 condition node has the same redeploy-reset race the VT `ReassertValue` fix closed:
  `RebuildAddressSpace` clears `_alarmConditions` and `MaterialiseScriptedAlarms` recreates each condition
  fresh/normal, but `ScriptedAlarmEngine.LoadAsync` reloads from the persisted state and yields
@@ -339,4 +339,4 @@ resource sizing on the site VMs should be checked once both products run the ful
 | 4 cut driver ConfigDb | **DONE 2026-07-23 — live gate PASSED** on `feat/mesh-phase4` (Tasks 0–8 + 1b + 10–11; Task 9 table-drop deferred). ConfigDb admin-only; driver-only ⇒ FetchAndCache (validator); `DbHealthProbeActor` not spawned driver-only (client-visible ServiceLevel 240/250 with central SQL down — proven live); alarm condition state in replicated LocalDb `alarm_condition_state`; central persists acks; `OpcUaPublish` guard split fixes the driver-only address-space wipe; driver-only LDAP maps from appsettings only (6th consumer found mid-phase). Gate: deploy sealed green w/ 4 DB-less site nodes acking, ServiceLevel held 240 w/ SQL down, restart booted last-known-good from the LocalDb pointer. See `2026-07-23-mesh-phase4-cut-driver-configdb.md` + `2026-07-23-mesh-phase4-live-gate.md`. |
 | 5 gRPC telemetry | **DONE 2026-07-23 — live gate PASSED** on `feat/mesh-phase5`. 4-channel scope (`alerts`/`script-logs`/`driver-health`/`driver-resilience-status`), 3 deferred with rationale (`redundancy-state`, `fleet-status`, `deployment-acks`); dark switch `Telemetry:Mode`/`TelemetryDial:Mode` (Dps default); node hosts server / central dials; auth-from-day-one fail-closed bearer key, superseding design §6.3. Gate: full 12-stream mesh formed in Grpc mode (2 inbound per driver node, 6 outbound per central), AdminUI pill live (data path proven), kill-and-reconnect of a node recovered its stream in ~5s; Dps baseline dials nothing. Surfaced an upgrade gotcha — `ClusterNode.GrpcPort` must be populated on existing deployments (fresh installs seed it; nullable column doesn't backfill) — which live-validated the graceful null-`GrpcPort` skip. See `docs/Telemetry.md`, `2026-07-23-mesh-phase5-grpc-telemetry-stream.md` + `2026-07-23-mesh-phase5-live-gate.md`. |
 | 6 mesh partition + co-location | **DONE 2026-07-24** — three independent 2-node meshes (central/site-a/site-b), `cluster-{ClusterId}` roles, per-pair self-first seeds, cluster-scoped `RedundancyStateActor` singleton (two+ Primaries fleet-wide, by design), one `ClusterClient` per `Cluster`, `SplitTopologyTransportValidator`, pair-local secrets replication, compiled transport defaults intentionally kept `Dps`. See `2026-07-24-mesh-phase6-partition-and-colocation.md`. |
-| 7 drill + live gates | not started |
+| 7 drill + live gates | **DONE 2026-07-24 — all 6 drills PASSED** on the docker-dev three-mesh rig. D1 MAIN graceful manual-failover via the AdminUI button (Primary leaves, peer→250, restarts+rejoins no split); D2 SITE-A auto-down failover both directions; D3 SITE-B crash-the-oldest; D4 **auto-down 1-vs-1 survival (closes the gate deferred since Phase 0a)** — every survivor stayed Up; D5 **self-first cold-start-alone (gate b)** — a node boots alone and forms its mesh; D6 recovery/rejoin. Manual-failover button confirmed MAIN-only by construction (site pairs are driver-only, fail over via auto-down). One-page co-located operator runbook shipped. Carried Phase-6 finding: simultaneous cold-start of both pair VMs can split — operational mitigation (staggered start) in the runbook; product-level guard is a candidate follow-up, not shipped. See `2026-07-24-mesh-phase7-failover-drills.md`. **Per-cluster mesh program COMPLETE.** |
@@ -2,14 +2,69 @@
  "planPath": "docs/plans/2026-07-22-per-cluster-mesh-program.md",
  "note": "PROGRAM plan: each task = write that phase's detailed plan (writing-plans), execute it (executing-plans), run its exit gate, update the tracking tables. Prereq task 0 is the separate selfform-fallback plan in this repo.",
  "tasks": [
-    {"id": 0, "subject": "Prereq: execute 2026-07-22-selfform-fallback-and-manual-failover.md (7 tasks)", "status": "completed", "note": "Shipped as self-first seed ordering + AkkaClusterOptionsValidator, NOT the planned SelfFormAfter watchdog (live gate caught it islanding a failed-over node). Merged a78425ea."},
-    {"id": 1, "subject": "Phase 1: ClusterNode Akka+gRPC address columns; ConfigPublishCoordinator ack set from DB", "status": "completed", "note": "Merged 7654f24d. Escape hatch is ClusterNode.MaintenanceMode, not Enabled=0."},
-    {"id": 2, "subject": "Phase 2: comm actors + receptionist + ClusterClient transport (deploy notify/acks, driver-control)", "status": "in_progress", "blockedBy": [1]},
-    {"id": 3, "subject": "Phase 3: config fetch-and-cache from central; LocalDb steady-state config store (live gate)", "status": "pending", "blockedBy": [2]},
-    {"id": 4, "subject": "Phase 4: cut driver-side ConfigDb — EfAlarmConditionStateStore to LocalDb, DbHealthProbeActor ServiceLevel input, OpcUaPublishActor audit (live gate)", "status": "pending", "blockedBy": [3]},
-    {"id": 5, "subject": "Phase 5: gRPC oneof stream contract; migrate 7 observability topics; AdminUI reconnect story", "status": "pending", "blockedBy": [2]},
-    {"id": 6, "subject": "Phase 6: mesh partition — per-pair seeds, cluster-scoped roles/singletons, co-location rig rewrite, secrets replication re-scope", "status": "pending", "blockedBy": [0, 4, 5]},
-    {"id": 7, "subject": "Phase 7: failover drill per pair (incl. shared-VM failure) + close auto-down 1v1 and self-first cold-start-alone live gates + operator runbook", "status": "pending", "blockedBy": [6]}
+    {
+      "id": 0,
+      "subject": "Prereq: execute 2026-07-22-selfform-fallback-and-manual-failover.md (7 tasks)",
+      "status": "completed",
+      "note": "Shipped as self-first seed ordering + AkkaClusterOptionsValidator, NOT the planned SelfFormAfter watchdog (live gate caught it islanding a failed-over node). Merged a78425ea."
+    },
+    {
+      "id": 1,
+      "subject": "Phase 1: ClusterNode Akka+gRPC address columns; ConfigPublishCoordinator ack set from DB",
+      "status": "completed",
+      "note": "Merged 7654f24d. Escape hatch is ClusterNode.MaintenanceMode, not Enabled=0."
+    },
+    {
+      "id": 2,
+      "subject": "Phase 2: comm actors + receptionist + ClusterClient transport (deploy notify/acks, driver-control)",
+      "status": "completed",
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 3,
+      "subject": "Phase 3: config fetch-and-cache from central; LocalDb steady-state config store (live gate)",
+      "status": "completed",
+      "blockedBy": [
+        2
+      ]
+    },
+    {
+      "id": 4,
+      "subject": "Phase 4: cut driver-side ConfigDb \u2014 EfAlarmConditionStateStore to LocalDb, DbHealthProbeActor ServiceLevel input, OpcUaPublishActor audit (live gate)",
+      "status": "completed",
+      "blockedBy": [
+        3
+      ]
+    },
+    {
+      "id": 5,
+      "subject": "Phase 5: gRPC oneof stream contract; migrate 7 observability topics; AdminUI reconnect story",
+      "status": "completed",
+      "blockedBy": [
+        2
+      ]
+    },
+    {
+      "id": 6,
+      "subject": "Phase 6: mesh partition \u2014 per-pair seeds, cluster-scoped roles/singletons, co-location rig rewrite, secrets replication re-scope",
+      "status": "completed",
+      "blockedBy": [
+        0,
+        4,
+        5
+      ]
+    },
+    {
+      "id": 7,
+      "subject": "Phase 7: failover drill per pair (incl. shared-VM failure) + close auto-down 1v1 and self-first cold-start-alone live gates + operator runbook",
+      "status": "completed",
+      "blockedBy": [
+        6
+      ]
+    }
  ],
-  "lastUpdated": "2026-07-22T00:00:00Z"
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Program COMPLETE (Phases 0a-7 + bootstrap guard), origin/master d1dac87f. Marked complete 2026-07-27 (deferment.md \u00a78.5)."
 }
@@ -100,7 +100,7 @@
    {
      "id": 9,
      "subject": "Task 9: Drop dead ConfigDb ScriptedAlarmState table + retire EfAlarmConditionStateStore",
-      "status": "deferred",
+      "status": "completed",
      "blockedBy": [
        6
      ],
@@ -128,5 +128,6 @@
      "result": "LIVE GATE PASSED \u2014 deploy sealed green w/ 4 DB-less site nodes acking; ServiceLevel 240 w/ central SQL down; restart booted last-known-good from LocalDb pointer; grep proof; alarm_condition_state table live+replicated. Doc: 2026-07-23-mesh-phase4-live-gate.md"
    }
  ],
-  "lastUpdated": "2026-07-23"
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Task 9 landed 3a590a0c; live gate PASSED 1281aebf. Marked complete 2026-07-27 (deferment.md \u00a78.5)."
 }
@@ -0,0 +1,261 @@
+# Driver-expansion — Waves 0–2 tracking
+
+> **Living status tracker** for the driver-expansion program (Waves 0, 1, 2). One row per
+> deliverable, each pointing at its **design doc**, its **implementation plan** (once written),
+> and its current **status**. The authoritative *architecture* index is the program design doc;
+> this file is the authoritative *progress* index.
+>
+> **Program design (architecture / shared contract / build order):**
+> [`2026-07-15-driver-expansion-program-design.md`](2026-07-15-driver-expansion-program-design.md)
+>
+> Last updated: 2026-07-27.
+
+## Legend
+
+| Status | Meaning |
+|---|---|
+| ✅ **Done** | Merged to master, tests green. |
+| 🟡 **Live gate open** | Code merged; a live `/run` or hardware-gated verification still outstanding. |
+| 📝 **Plan ready** | Executable implementation plan (`*-implementation.md` + `.tasks.json`) written; not yet built. |
+| 📐 **Design only** | Design doc exists; **no** implementation plan yet — writing-plans is the next step. |
+| ⛔ **Not started** | No design, no plan. |
+
+**Doc types** (per the writing-plans skill): a *design* states architecture, decisions, and risks;
+an *implementation plan* is the bite-sized, TDD, file-path-level task list the subagent-driven
+executor runs off, with a co-located `.tasks.json` for resume. A deliverable is only buildable once
+it reaches 📝.
+
+## Summary
+
+| Wave | Deliverable | Design | Impl. plan | Status | Effort | Fixture / hardware |
+|---|---|---|---|---|---|---|
+| **0** | Universal Discover-backed browser | [design](2026-07-15-universal-discovery-browser-design.md) | [plan](2026-07-15-universal-discovery-browser-implementation.md) · [tasks](2026-07-15-universal-discovery-browser-implementation.md.tasks.json) | 🟡 **Live gate open** | S–M | none (retrofits shipped drivers) |
+| **1** | Modbus RTU (extend Modbus) | [design](2026-07-15-modbus-rtu-driver-design.md) | [plan](2026-07-24-modbus-rtu-driver.md) · [tasks](2026-07-24-modbus-rtu-driver.md.tasks.json) | ✅ **Done** — merged to master `0f38f486` (#495), 11 tasks, live gate PASSED | **S (lowest)** | `pymodbus` `rtu_over_tcp` — CI-simulatable, no new infra |
+| **1** | SQL poll | [design](2026-07-15-sql-poll-driver-design.md) | [plan](2026-07-24-sql-poll-driver.md) · [tasks](2026-07-24-sql-poll-driver.md.tasks.json) | ✅ **Done** — merged to master `4ad54037`, 22 tasks, live gate PASSED; follow-ups #496/#497/#498 closed in `28c28667` | S–M | **existing central SQL Server** `10.100.0.35,14330` + SQLite unit |
+| **2** | MTConnect Agent | [design](2026-07-15-mtconnect-driver-design.md) | [plan](2026-07-24-mtconnect-driver.md) · [tasks](2026-07-24-mtconnect-driver.md.tasks.json) | ✅ **COMPLETE** — P1 Agent MVP, all 23 tasks + the 5-leg live gate PASSED (branch `feat/mtconnect-driver`, PR #506) | S–M | Dockerized `mtconnect/agent:2.7.0.12` (not `cppagent`) — CI-simulatable, live at `10.100.0.35:5000` |
+| **2** | MQTT / Sparkplug B | [design](2026-07-15-mqtt-sparkplug-driver-design.md) | [plan](2026-07-24-mqtt-sparkplug-driver.md) · [tasks](2026-07-24-mqtt-sparkplug-driver.md.tasks.json) | ✅ **COMPLETE** — P1 + P2 shipped, both live-gated (Tasks 0–26) | M–L | Mosquitto TLS+auth **+ C# Sparkplug edge-node simulator**, live at `10.100.0.35:8883` |
+
+> Waves 3+ (BACnet/IP, Omron) and the deferred MELSEC are tracked in the program design doc §6/§8,
+> not here. Omron CIP is the program's sole real-hardware wire gate; BACnet's broadcast/BBMD leg is
+> env-gated live. Both are out of this file's scope until they're pulled forward.
+
+---
+
+## Executing a plan (git worktree + subagent-per-task)
+
+Each 📝 plan is executed with the **subagent-driven-development** skill: it sets up an isolated
+**git worktree** first (via `using-git-worktrees`), then dispatches a **fresh subagent per task**,
+running the classification-driven review chain (`trivial` = implement only … `high-risk` =
+spec-review → code-review → integration review) between tasks. The `.tasks.json` next to each plan
+tracks progress and lets a later session resume.
+
+> ⚠️ **All four plans below have been executed and merged.** This table is retained as the *pattern*
+> for executing a future driver plan — do **not** run these four commands, they would rebuild shipped
+> drivers in a fresh worktree. (Their `.tasks.json` files still read `pending`; that is stale
+> bookkeeping, not backlog — see `deferment.md` §6.1.)
+
+| Deliverable | Status | Command (pattern only — do not re-run) |
+|---|---|---|
+| Modbus RTU (Wave 1) | ✅ merged `0f38f486` | ~~`… execute docs/plans/2026-07-24-modbus-rtu-driver.md …`~~ |
+| SQL poll (Wave 1) | ✅ merged `4ad54037` | ~~`… execute docs/plans/2026-07-24-sql-poll-driver.md …`~~ |
+| MTConnect (Wave 2) | ✅ merged `90bdaa44` (#506) | ~~`… execute docs/plans/2026-07-24-mtconnect-driver.md …`~~ |
+| MQTT/Sparkplug (Wave 2) | ✅ merged `c3a2b0f7` | ~~`… execute docs/plans/2026-07-24-mqtt-sparkplug-driver.md …`~~ |
+
+For a **new** driver the invocation shape is:
+`Use superpowers-extended-cc:subagent-driven-development to execute <plan-path> in a new git worktree`
+
+- **Slash-command form** (equivalent): `/superpowers-extended-cc:subagent-driven-development <plan-path>`.
+- **Parallel-session / resume form** (batch execution with checkpoints, no fresh-subagent-per-task):
+  `/superpowers-extended-cc:executing-plans <plan-path>` — reads the same `.tasks.json` and continues
+  from the first pending task.
+- **Order (historical):** the four were built lowest-effort-first — Modbus RTU → SQL poll → MTConnect
+  → MQTT/Sparkplug. All are merged; nothing in this list remains to schedule. Run one plan per
+  worktree; independent plans may run concurrently in separate worktrees.
+
+---
+
+## Wave 0 — Universal Discover-backed browser 🟡
+
+**What it is.** One generic `DiscoveryDriverBrowser` (+ `CapturingAddressSpaceBuilder`,
+`CapturedTreeBrowseSession`, `BrowserSessionService` fallback, and the
+`ITagDiscovery.SupportsOnlineDiscovery` gate) that turns any driver's `ITagDiscovery.DiscoverAsync`
+into an AdminUI browse tree. It is the **Wave-0 gate**: every browsable new driver depends on this
+seam, and it retrofits browse to the already-shipped AbCip / TwinCAT / FOCAS drivers for near-zero
+marginal cost.
+
+- **Design:** [`2026-07-15-universal-discovery-browser-design.md`](2026-07-15-universal-discovery-browser-design.md)
+- **Implementation plan:** [`2026-07-15-universal-discovery-browser-implementation.md`](2026-07-15-universal-discovery-browser-implementation.md) · [`.tasks.json`](2026-07-15-universal-discovery-browser-implementation.md.tasks.json)
+- **Status: 🟡 code-complete + merged, live gate open.**
+  - Merged to master — `056887d6` (*Merge feat/universal-discovery-browser — Wave-0 universal Discover-backed browser*), 2026-07-15.
+  - Implementation plan: **19 / 19 tasks completed.**
+  - Lit up AbCip / TwinCAT / FOCAS pickers with zero per-driver browse code.
+- **Outstanding:** the full tree-render live `/run` gate is **fixture-blocked** — tracked as **Gitea #468**. Complete this before leaning on browse in Wave 2/3.
+
+---
+
+## Wave 1 — low-effort / high-leverage pair ✅
+
+Both are **fully CI-simulatable with zero new hardware**; Modbus RTU needs no new infra at all, and
+SQL poll reuses the always-on central SQL Server. **Both shipped.**
+
+### Modbus RTU — ✅ Done (merged `0f38f486` / #495, live gate PASSED)
+- **Design:** [`2026-07-15-modbus-rtu-driver-design.md`](2026-07-15-modbus-rtu-driver-design.md)
+- **Implementation plan:** [`2026-07-24-modbus-rtu-driver.md`](2026-07-24-modbus-rtu-driver.md) · [`.tasks.json`](2026-07-24-modbus-rtu-driver.md.tasks.json) — **11 tasks** (1 trivial / 5 small / 2 standard / 3 high-risk), all complete via subagent-driven-development.
+- **Scope:** extend the existing Modbus driver with a `Transport` selector (RTU CRC-16 + FC-aware
+  length, no TxId) + a `rtu_over_tcp` `pymodbus` docker profile + the AdminUI selector.
+  **Direct-serial transport is descoped** (user, 2026-07-15) — RTU-over-TCP via a serial→Ethernet
+  gateway is the only shipped mode, so there is no serial hardware gate.
+- **Fixture:** added the `rtu_over_tcp` profile (`framer=rtu`, host `:5021`, co-runs with `standard`)
+  to the Modbus integration fixture. **Unknown confirmed:** pymodbus 3.13's simulator DOES honour
+  `framer=rtu` on a TCP server (wire-probed a pure RTU FC03 response, no MBAP) — so the simple profile
+  path was taken; **no stdlib fallback server was needed.**
+- **Verification (all green):** unit suite **344/344**; full solution build 0 errors; the 2 RTU
+  integration tests pass **live** against the real `framer=rtu` fixture (read HR5→5, write+readback
+  HR200←4242). Per-task review chain (spec + code reviewers) + a final whole-branch review, all
+  approved-to-merge.
+- **Live `/run` gate — PASSED (2026-07-24, docker-dev rebuilt from this branch):**
+  - AdminUI `/raw` Modbus **driver** config modal renders the new **Transport** selector (with the
+    operator hint) — set to `RtuOverTcp`, saved.
+  - **Device Test Connect → `OK · 23 MS`** — the probe built a `ModbusRtuOverTcpTransport` via the
+    factory and spoke **FC03 over real RTU framing** to `10.100.0.35:5021`.
+  - Authored raw tags HR5 (r/o) + HR200 (r/w) → **deployment `06ec1632` Sealed** (all 6 nodes acked).
+  - Client.CLI on `opc.tcp://localhost:4840` (`multi-role`/`password`): **read** `ns=2;s=rtu-gate/Device1/HR5`
+    → **5, Good**; **write** `ns=2;s=rtu-gate/Device1/HR200` = 4242 → readback **4242, Good**.
+- **Effort:** **S — the lowest on the roadmap.** Delivered first, as recommended.
+
+### SQL poll — ✅ Done (merged `4ad54037`, live gate PASSED)
+- **Design:** [`2026-07-15-sql-poll-driver-design.md`](2026-07-15-sql-poll-driver-design.md)
+- **Implementation plan:** [`2026-07-24-sql-poll-driver.md`](2026-07-24-sql-poll-driver.md) · [`.tasks.json`](2026-07-24-sql-poll-driver.md.tasks.json) — **22 tasks, all done**. `ISqlDialect` + `SqlServerDialect` shipped; Postgres/ODBC remain deferred to P2/P3 behind the same seam.
+- **Post-merge follow-ups closed** in `28c28667`: #496 catalog identifier-validation gate
+  (`4dc2ad80`), #497 wrong status-code constants across six drivers, #498 deploy-gate rejection of a
+  persisted `connectionString` (`1919a8e5`).
+- **Scope:** a bespoke schema-browser driver polling a SQL table into equipment tags (SQL Server
+  shipped; Postgres/ODBC deferred behind `ISqlDialect`).
+- **Fixture:** SQLite unit fixture (primary) + an **env-gated integration fixture against the
+  existing central SQL Server** (`10.100.0.35,14330`) with a seeded `SqlPollFixture` DB. The
+  blackhole/timeout live-gate pauses a **dedicated** `mssql` container — **never** the shared
+  central SQL Server (it hosts `ConfigDb`).
+- **Effort:** S–M.
+
+---
+
+## Wave 2 — strategic telemetry / UNS pair ✅
+
+Both CI-simulatable on the shared docker host, no hardware.
+
+### MTConnect Agent — ✅ Done (P1 Agent MVP)
+- **Design:** [`2026-07-15-mtconnect-driver-design.md`](2026-07-15-mtconnect-driver-design.md)
+- **Implementation plan:** [`2026-07-24-mtconnect-driver.md`](2026-07-24-mtconnect-driver.md) · [`.tasks.json`](2026-07-24-mtconnect-driver.md.tasks.json) — **23 tasks; 22 built, Task 21 (live `/run` gate) tracked separately in the plan file.**
+- **Driver guide:** [`docs/drivers/MTConnect.md`](../drivers/MTConnect.md) — config keys, capability
+  surface, data-plane precedence rules, quality-code mapping, and (most load-bearing) the **Known
+  limitations** section.
+- **Scope shipped:** `IDriver`+`ITagDiscovery`+`IReadable`+`ISubscribable`+`IHostConnectivityProbe`+`IRediscoverable`
+  (deliberately no `IWritable` — read-only Agent surface), browse **free via the Wave-0 universal
+  browser** (`SupportsOnlineDiscovery=true`, no browser project), typed AdminUI tag editor,
+  `UNAVAILABLE→BadNoCommunication` mapping, CONDITION-as-`String`, ring-buffer re-baseline paging
+  (both the sequence-gap and `OUT_OF_RANGE` legs).
+- **Diverged from the design:** Task 0/6/7 dropped the planned TrakHound `MTConnect.NET-Common`/`-HTTP`
+  dependency entirely — the pinned packages ship no XML formatter and the HTTP stream client has no
+  injectable handler to test behind the driver's seam. Parsing is hand-rolled `System.Xml.Linq`,
+  matching on `LocalName` only (namespace-agnostic, so 1.3–2.x all parse). See the driver guide's
+  "Built vs. planned" section.
+- **Test results:** MTConnect unit suite 491/491; integration suite 12/12 against a real Agent
+  (`mtconnect/agent:2.7.0.12`, **not** `mtconnect/cppagent` — that Docker Hub repo doesn't exist);
+  skips cleanly (12 Skipped) offline. AdminUI 749/749; full solution 0 build errors.
+- **Deferred (documented, not built):** write-back via MTConnect Interfaces (design §3.6); P1.5
+  CONDITION→native Part-9 alarms, `TIME_SERIES` array materialization, EVENT→enum vocab (design §9);
+  P2 SHDR adapter ingest (design §9). Also two pre-existing fleet-wide gaps this build surfaced
+  rather than caused: `IRediscoverable`/`IHostConnectivityProbe` have no server-side consumer (eight
+  drivers besides Galaxy), and no driver form blocks Save on a required-field validation error.
+- **Fixture:** canned XML unit fixtures (bulk of coverage) + a dockerized `mtconnect/agent` +
+  stdlib-SHDR-adapter integration fixture (env-gated), deployed at `/opt/otopcua-mtconnect/` on the
+  shared docker host. See the fixture's own
+  [`Docker/README.md`](../../tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests/Docker/README.md).
+- **Effort:** S–M, hand-rolled (the TrakHound estimate in the design doc did not apply once that
+  path was ruled out).
+
+### MQTT / Sparkplug B — ✅ **COMPLETE** (P1 + P2, both live-gated)
+- **Design:** [`2026-07-15-mqtt-sparkplug-driver-design.md`](2026-07-15-mqtt-sparkplug-driver-design.md)
+- **Implementation plan:** [`2026-07-24-mqtt-sparkplug-driver.md`](2026-07-24-mqtt-sparkplug-driver.md) · [`.tasks.json`](2026-07-24-mqtt-sparkplug-driver.md.tasks.json) — **27 tasks, all done** (P1 plain MQTT = Tasks 0–14; P2 Sparkplug B = Tasks 15–26).
+- **Scope delivered:** P1 plain MQTT (MQTTnet-5 connect/TLS/auth + hand-rolled reconnect, subscribe→
+  `OnDataChange`, retained last-value read, `#`-observation browser); P2 Sparkplug B ingest
+  (vendored Tahu proto + `Grpc.Tools` codegen, birth/alias/seq-gap/rebirth state machine,
+  death→STALE, birth-driven browse tree, scoped Request-rebirth NCMD, typed tag editor).
+  **Write-through (`IWritable`) is deferred to P3** — every MQTT node materializes read-only.
+- **Fixture:** Mosquitto TLS+auth broker + JSON publisher sidecar, **live** at `10.100.0.35:8883`
+  (`:1883` plaintext-but-authenticated); stack `/opt/otopcua-mqtt`, compose in
+  `tests/Drivers/….Driver.Mqtt.IntegrationTests/Docker/`. Env-gated live suite
+  (`MQTT_FIXTURE_ENDPOINT`, see `infra/README.md` §3). The **project-owned C# Sparkplug edge-node
+  simulator** (`--profile sparkplug`, group `OtOpcUaSim`, nodes `EdgeA`/`EdgeB`, `EdgeA` device
+  `Filler1`) shipped with P2 and answers rebirth NCMDs.
+- **P2 status (2026-07-25):** Tasks 15–26 complete. **Offline 1528 passed / 0 failed**
+  (581 driver · 809 AdminUI · 138 Core.Abstractions); **live 15/15** against the broker + simulator.
+- **P1 live gate found two AdminUI authoring gaps** (the gate's whole point — both invisible to green
+  unit tests, because AdminUI has no bUnit and nothing tied these hand-maintained lists to
+  `DriverTypeNames`):
+  1. **FIXED —** `RawDriverTypeDialog`'s option array never got an MQTT row, so **no operator could
+     create an MQTT driver at all**. Fixed, plus a reflection parity guard
+     (`RawDriverTypeDialogParityTests`) that fails for *any* future `DriverTypeNames` entry
+     missing from the picker.
+  2. **FIXED —** `MqttDriverForm` / `MqttDeviceForm` did not exist, so the broker connection was
+     unauthorable from the AdminUI. Both shipped after the P1 gate.
+- **P2 live gate found a third one, of the same family — FIXED:** `MqttDriverForm` still carried its
+  P1 Sparkplug **placeholder**. Switching Mode to `SparkplugB` rendered a *"not available yet"* notice
+  and **no Group ID field** — so once Sparkplug ingest shipped there was still **no way to author a
+  Sparkplug driver from the AdminUI**, and `Sparkplug.GroupId` is the driver's entire subscription
+  filter (`spBv1.0/{GroupId}/#`): blank ⇒ connected, `Healthy`, ingesting nothing. Fixed (all five
+  Sparkplug keys, merge-not-replace on save, group-id segment validation) + 8 falsifiable
+  `MqttDriverFormModelTests` cases. **Three gates, three instances of the same defect class: a
+  hand-maintained AdminUI surface left behind by a driver-side feature.**
+- **P2 live gate — two open UI gaps, documented not fixed** (see `docs/drivers/Mqtt.md` §Known gaps):
+  - **A completely empty browse tree cannot arm a rebirth.** The scope comes from a tree click, so on
+    a plant that has not birthed since the window opened `Request rebirth…` stays disabled — the very
+    case the affordance exists for. `MqttBrowseSession.ResolveRebirthTargets` already accepts a bare
+    `{group}/{edgeNode}` ("the prime rebirth target"); only a UI path to enter one is missing.
+    Mitigation shipped: a **Refresh** button on the browse tree (it re-reads the same session, which
+    previously rendered exactly once at open and never again).
+- **P2 live gate also found a PRE-EXISTING, cross-driver AdminUI defect — FIXED:** every node label in
+  the shared `DriverBrowseTree` was an `<a href="#">`. In a Blazor Web App, `blazor.web.js`'s
+  enhanced-navigation click interceptor resolves a bare `#` against `<base href="/">`, so **clicking
+  any browse-tree node label navigated the whole AdminUI to `/`**, tore down the circuit and destroyed
+  the hosting modal — losing the browse session and the tag selection. `@onclick:preventDefault` does
+  not help: it suppresses the browser's default action, not Blazor's own interceptor. The labels are
+  now `<button type="button">`. It dates to the component's introduction (2026-05-28) and affects
+  **every** driver's picker; it only surfaced now because Sparkplug's Request-rebirth is the first
+  feature that requires clicking a *label* rather than the ▶ toggle (always a `<button>`, always fine).
+  - **A metric name containing `/` cannot be browse-committed.** The derived raw **tag Name** is a
+    RawPath segment and may not contain `/`, while `metricName` legitimately may — so the
+    spec-mandatory `Node Control/Rebirth` is refused at commit (`Row N: Name must not contain '/'`).
+    The refusal is loud and all-or-nothing, never a silently mis-bound tag, and **Manual entry** is
+    the working path (the Sparkplug tag editor accepts a slashed metric name). Fixing it needs a
+    name-sanitisation policy with a collision answer, so it was recorded rather than guessed at.
+  - `_canRebirth` is captured at browse-open, so a reaped session still draws the button.
+  - The tag editor injects the Plain-only `payloadFormat` key into a Sparkplug blob — cosmetic; the
+    factory routes on the Sparkplug tuple and ignores it.
+- **Rediscovery is inert in v3 (platform gap, not MQTT's).** The Sparkplug driver raises
+  `OnRediscoveryNeeded` on a changed birth metric-set, but **nothing subscribes to it** and
+  `DriverHostActor.HandleDiscoveredNodes` hard-returns. A DBIRTH introducing a metric does **not**
+  change the OPC UA tree — redeploy. Driver-side behaviour is log-observable only.
+- **Redundant-pair hazard (documented, not a code change):** both nodes of a pair run the driver, so a
+  **fixed `clientId` makes them evict each other forever** — the broker logs
+  `already connected, closing old connection` and both nodes reconnect every ~2 s while still
+  reporting `Healthy`. Unset (the default) is correct. `MqttDriverForm` warns inline the moment a
+  value is typed.
+- **Effort:** M–L, delivered. The MQTTnet-5/net10 + central-pinning risk is **retired** (Task 0's
+  spike held through both phases); Sparkplug state-machine correctness was carried by golden-payload
+  vectors + the live simulator.
+
+---
+
+## Next actions
+
+1. **Close the Wave-0 live gate** (Gitea #468) — unblocks browse verification for BACnet (MTConnect
+   shipped its own Task-21 live `/run` gate independently — see the plan file).
+2. **Wave 1 is done.** Both deliverables shipped and live-gated: **Modbus RTU-over-TCP** (merged
+   `0f38f486` / #495) and **SQL poll** (merged `4ad54037`; follow-ups #496/#497/#498 closed in
+   `28c28667`). Remaining SQL work is optional follow-on — Postgres/ODBC dialects behind
+   `ISqlDialect`, and `SqlTagModel.Query` (P3, currently rejected end-to-end by design).
+3. **Wave 2 is done.** Both deliverables shipped and live-gated: **MQTT / Sparkplug B** (P1 + P2) and **MTConnect Agent** (P1 Agent MVP, PR #506). Remaining work on both is optional follow-on — MQTT P3 write-through (`IWritable`: NCMD/DCMD + plain publish) plus its two browse-UI
+   gaps, and MTConnect write-back (deliberately deferred; the Agent surface is read-only).
+
+Update this file's Summary table and per-wave status whenever a deliverable changes state.
@@ -0,0 +1,132 @@
+# Per-cluster mesh Phase 6 — live gate record
+
+> **Exit gate for Phase 6** (mesh partition). Bring up the rewritten docker-dev rig
+> (three independent 2-node Akka meshes) against **merged master** and prove every
+> previously-live-gated behaviour *per pair*, plus the split itself.
+>
+> Merge landed first (`origin/master` @ `2839deb5`, "merge now, gate after"); this gate
+> runs against the merged code and **fixes forward on master** if anything surfaces.
+
+**Rig topology** (docker-dev, local OrbStack):
+
+| Mesh | Nodes | Roles | OPC UA (host) | Seeds (self-first, pair-local) |
+|---|---|---|---|---|
+| MAIN | central-1, central-2 | `admin,driver,cluster-MAIN` | 4840 / 4841 | own pair only |
+| SITE-A | site-a-1, site-a-2 | `driver,cluster-SITE-A` | 4842 / 4843 | own pair only |
+| SITE-B | site-b-1, site-b-2 | `driver,cluster-SITE-B` | 4844 / 4845 | own pair only |
+
+- Akka port 4053 (per container); telemetry gRPC `:4056`; ConfigServe `:4055` (central);
+  LocalDb sync `:9001` (site-a); AdminUI `http://localhost:9200` (Traefik → central-1/2).
+- Transports: `MeshTransport__Mode=ClusterClient` (all), `Telemetry__Mode=Grpc` (all six),
+  `TelemetryDial__Mode=Grpc` (central pair). Secrets replication pair-local.
+- Deploy: `POST http://localhost:9200/api/deployments`, header `X-Api-Key: docker-dev-deploy-key`.
+
+---
+
+## Legs
+
+| # | Leg | Status | Evidence |
+|---|---|---|---|
+| 1 | Three meshes form — each node sees ONLY its own pair (2 members) | ✅ PASS | each node handshakes ONLY its pair partner |
+| 2 | Two+ Primaries, one per pair; ServiceLevel 250/240 within each pair | ✅ PASS | MAIN central-2=250/central-1=240; SITE-A site-a-1=250/site-a-2=240; SITE-B site-b-1=250/site-b-2=240 |
+| 3 | Deploy reaches all clusters over per-cluster ClusterClient; seals green | ✅ PASS | "Deployment 019dbd99… sealed (acks=6)"; all 6 NodeDeploymentState rows acked; one ClusterClient per site cluster |
+| 4 | Telemetry per cluster over gRPC (:4056); pills live; kill/reconnect ~5s | ✅ PASS | central-1 6 outbound :4056 dials, each site node 2 inbound (both admin dial in), 0 failures/30s; site-b restart failed→recovered the streams |
+| 5 | Reconciler quiet — no `EnabledRowNotInCluster` for foreign rows | ✅ PASS | central-2 reconciler: "reconcile with cluster membership (2 driver members)" — own MAIN pair only; 0 foreign-row errors |
+| 6 | Secrets pair-local — no cross-mesh replication / no unreachable-peer errors | ✅ PASS (by fallback criterion) | 0 secret errors fleet-wide; DPS topic rides each pair's isolated mesh (Leg 1) ⇒ structurally pair-local |
+| 7 | Split validator — a site node flipped to `MeshTransport__Mode=Dps` refuses to boot | ✅ PASS | "Cluster:Roles declares a cluster-SITE-B role … MeshTransport:Mode is 'Dps' … set MeshTransport:Mode=ClusterClient" |
+| 8 | Failover within a pair — kill a Primary, Secondary takes over (auto-down 1-vs-1) | ✅ PASS | killed site-a-1 (Primary); site-a-2 auto-downed it, took the singleton, 240→250, survived alone (auto-down 1-vs-1 = deferred Phase 0a gate, now proven) |
+
+**Phase 6 exit gate: MET.** All 8 legs pass. Three findings fixed forward on master (`3a4ed8dd` product
+boot-crash, `792f28ec` rig LDAP + split-brain serialization). One test-methodology note: the Leg 7
+`compose run … site-b-2` throwaway shares the `site-b-2` network alias and briefly disrupted the SITE-B
+Akka association — restart the affected pair after that probe (done), or run the validator check via a
+container that does not join the compose network alias.
+
+---
+
+## Findings
+
+### FINDING 1 (fix-forward on master) — boot-crash: `StackOverflowException` on EVERY node
+
+**Symptom.** First `up` of the fresh Phase-6 images: all six nodes crash at startup with
+`Stack overflow.` — an infinite recursion entering through
+`ZB.MOM.WW.OtOpcUa.Cluster.ServiceCollectionExtensions.WithOtOpcUaClusterBootstrap`.
+
+**Root cause (Phase 6, Task 2 wiring).** `Program.cs` resolved `IClusterRoleInfo` **eagerly, inside
+the `AddAkka` configurator lambda**:
+
+```csharp
+ab.WithOtOpcUaClusterRedundancySingleton(sp.GetRequiredService<IClusterRoleInfo>());  // line 385
+```
+
+That lambda runs *while the `ActorSystem` is being constructed*, but `ClusterRoleInfo`'s ctor
+**depends on the `ActorSystem`** (it is a live `Cluster.State` view). Resolving it there forces a
+nested `ActorSystem` build → re-runs the same configurator → `sp.GetRequiredService<IClusterRoleInfo>()`
+again → ∞. The cycle:
+`WithOtOpcUaClusterBootstrap → GetService<IClusterRoleInfo> → ActorSystemFactory → WithOtOpcUaClusterBootstrap → …`
+
+**Why merge + build + tests + reviews all missed it.** It compiles cleanly (a *runtime* DI cycle,
+not a compile error). `RedundancyStateSingletonRehomeTests` boots a real host but passes a hand-built
+`FakeClusterRoleInfo` **directly** into the extension — it never exercised the `sp.GetRequiredService`
+line in the composition root that overflows. The bug lived in `Program.cs`, which every test mocked
+around. Only a real boot of the shipped image surfaces it — precisely the live gate's job.
+
+**Fix.** Derive the singleton's cluster-role scope from `AkkaClusterOptions` (pure config, no
+ActorSystem) instead of `IClusterRoleInfo`:
+- `BuildClusterRedundancySingletonOptions(AkkaClusterOptions)` + `WithOtOpcUaClusterRedundancySingleton(AkkaClusterOptions)`
+  — derive `Role = clusterOptions.Roles.FirstOrDefault(RoleParser.IsClusterRole) ?? RoleParser.Driver`
+  (identical to `ClusterRoleInfo.ClusterRole`, which derives from the same config).
+- `Program.cs` passes `sp.GetRequiredService<IOptions<AkkaClusterOptions>>().Value` — `IOptions<>` has
+  no ActorSystem dependency, breaking the cycle.
+- Tests updated to pass `AkkaClusterOptions { Roles = … }`. 5/5 rehome tests pass; Host builds clean.
+
+Files: `Program.cs`, `ControlPlane/ServiceCollectionExtensions.cs`, `RedundancyStateSingletonRehomeTests.cs`.
+Status: **FIXED + live-verified** — rebuilt image boots with zero stack-overflow lines; all six nodes
+start; cluster singletons form (`redundancy-state` identified per mesh). 5/5 rehome tests pass.
+
+### FINDING 2 (fix-forward on master) — driver-only site nodes crash: LDAP options fail validation
+
+**Symptom.** site-a-1/site-a-2/site-b-1/site-b-2 crash at `Host.StartAsync` with
+`OptionsValidationException: LDAP transport is None (plaintext) but AllowInsecure is false`.
+
+**Root cause (Task 7 rig).** Only central-1/central-2 carried the `Security__Ldap__*` env block; the
+compose even asserted "Only the admin-role central nodes carry" it. But the site nodes serve OPC UA
+endpoints (4842-4845) and LDAP options are validated at boot on every node (appsettings default
+`Enabled=true`, `Transport=None`, `AllowInsecure=false` ⇒ throw). The site nodes overrode `environment`
+wholesale (YAML `<<:` does not deep-merge `environment`), so they inherited no LDAP config. `docker
+compose config` validates the file but never boots the app, so this passed the Task 7 acceptance check.
+
+**Fix (rig).** Extracted the LDAP block to a shared `&ldap-env` anchor merged into **every** host node
+(`<<: [*secrets-env, *ldap-env]`); corrected the two misleading header comments. Site nodes now boot.
+
+### FINDING 3 (fix-forward on master) — site pairs split-brain at simultaneous startup (250/250)
+
+**Symptom.** Both nodes of each site pair logged `is JOINING itself ... and forming a new cluster` and
+each elected itself Primary → ServiceLevel **250/250** instead of 250/240. Each pair was two independent
+1-node clusters, not one 2-node mesh.
+
+**Root cause (Task 7 rig — a startup race, not a code defect).** Both pair nodes are self-first seeds
+(`seed[0]=self`), so both run Akka's `FirstSeedNodeProcess` and can form alone. The partner
+(site-a-2/site-b-2) only `depends_on` sql/central/migrator — **not its pair founder** — so the pair
+started simultaneously and each formed its own cluster before discovering the other. The central pair
+avoids this only because central-2 `depends_on central-1` (and even then won the InitJoin race by luck).
+`depends_on: service_started` is insufficient — it fires when the container launches, before Akka binds.
+This is an inherent property of symmetric self-first seeding (present for central since #459), now
+extended to sites; **carry to Phase 7** as a production concern (simultaneous cold-start of both pair
+VMs). NOTE: two separate 1-node clusters do NOT merge via SBR — auto-down resolves partitions of one
+cluster, not two independent clusters.
+
+**Fix (rig).** Added an `&akka-founder-healthcheck` (bash `/dev/tcp` probe of Akka port 4053; the image
+has no nc/curl) to site-a-1/site-b-1, and switched site-a-2/site-b-2 to `depends_on: { site-a-1:
+service_healthy }`. The founder now binds + forms its mesh before the partner starts, so the partner
+JOINS it. Verified: site-a-2/site-b-2 log `Welcome from <founder>` (joined), ServiceLevel 250/240.
+
+---
+
+## Evidence log
+
+- **Leg 1** — join handshakes: central-1↔central-2, site-a-1↔site-a-2, site-b-1↔site-b-2; no node
+  handshakes a node outside its pair. central *dials* site nodes over ClusterClient/telemetry (Akka
+  association + gRPC), which is the split-topology transport, NOT gossip membership.
+- **Leg 2** — `Client.CLI redundancy` per endpoint: 4840 central-1=240, 4841 central-2=250, 4842
+  site-a-1=250, 4843 site-a-2=240, 4844 site-b-1=250, 4845 site-b-2=240. One Primary per pair.
@@ -18,7 +18,7 @@
    {"id": 6, "subject": "Task 6: compiled transport-mode defaults",                                    "classification": "small",     "status": "resolved-no-flip", "note": "DECIDED not to flip — blast-radius assessment: high-risk (breaks all integration tests + appsettings profiles + docker-dev site nodes), low-value (Task 5 validator already enforces split-correctness fail-closed). Documented in plan Task 6 + Configuration.md."},
    {"id": 7, "subject": "Task 7: rewrite docker-dev rig into three 2-node meshes",                     "classification": "standard",  "status": "completed", "commit": "741ab97b", "note": "3 meshes, per-pair self-first seeds, cluster roles, transports flipped (ClusterClient/Grpc), pair-local secrets note; docker compose config validates; seed SQL already correct (GrpcPort=4056)"},
    {"id": 8, "subject": "Task 8: docs sweep — status tables, caveat removal, pair-local secrets note", "classification": "small",     "status": "completed", "commit": "8a173bba", "note": "all 7 edits (Redundancy/Config/CLAUDE/2 plans/IManualFailoverService/ClusterRedundancy.razor); subagent died at commit step, edits reviewed+committed by controller; full-solution build clean (0 errors)"},
-    {"id": 9, "subject": "Task 9: live gate — three meshes, per-pair redundancy, cross-mesh transports","classification": "high-risk", "status": "in-progress", "note": "local OrbStack docker up; full-solution build verified clean; building images"}
+    {"id": 9, "subject": "Task 9: live gate — three meshes, per-pair redundancy, cross-mesh transports","classification": "high-risk", "status": "completed", "note": "PASSED — all 8 legs green (docs/plans/2026-07-24-mesh-phase6-live-gate.md). Caught + fixed-forward 3 defects: (1) product boot-crash StackOverflow — cluster-redundancy singleton resolved IClusterRoleInfo eagerly inside the AddAkka lambda while the ActorSystem was building (fix 3a4ed8dd: derive scope from AkkaClusterOptions); (2) rig — site nodes crashed on LDAP options (no Security__Ldap__* block); (3) rig — site pairs split-brained on simultaneous start (both self-first seeds), fixed with a founder healthcheck + service_healthy gating (2+3 in 792f28ec). Legs: 3 isolated meshes, one Primary/pair 250/240, deploy sealed acks=6 over per-cluster ClusterClient, telemetry gRPC :4056 up + reconnect, reconciler own-cluster-scoped, secrets pair-local, split validator refuses Dps, failover+auto-down-1v1 survival proven. Master 792f28ec."}
  ],
-  "lastUpdated": "2026-07-24T00:00:00Z"
+  "lastUpdated": "2026-07-24T11:10:00Z"
 }
@@ -0,0 +1,94 @@
+# Per-cluster mesh Phase 7 — failover drills + closing live gates
+
+> **Final phase of the per-cluster mesh program.** Run the failover drill per pair type, close the two
+> outstanding live gates (auto-down 1-vs-1 crash-the-oldest; self-first cold-start-alone), re-verify the
+> manual-failover button, and ship a one-page co-located operator runbook.
+>
+> Runs against merged master on the docker-dev three-mesh rig (same rig as the Phase 6 gate).
+
+## Scope clarified by recon
+
+- **Failover mechanism is the same for every pair**: the oldest Up `driver` member leaves/dies, the peer
+  becomes oldest, takes the `cluster-{ClusterId}` redundancy singleton, and advertises ServiceLevel 250.
+- **Manual-failover button (`IManualFailoverService`) is MAIN-scoped by construction** — it acts on the
+  local node's `Cluster.State` (graceful `Leave` of the oldest Up driver), and the AdminUI runs only on
+  the central (MAIN) pair. Site pairs are **driver-only, no UI**; they fail over via **auto-down** (kill)
+  only. This is the documented pair-local caveat from Phase 6, not a gap to fix.
+- **Graceful (`docker stop`, SIGTERM → CoordinatedShutdown → cluster Leave) vs. ungraceful (`docker kill`,
+  SIGKILL → peer auto-downs)** are the two failover paths. Manual failover = graceful Leave; a crashed
+  node = auto-down.
+
+## Drills
+
+| # | Drill | Status | Evidence |
+|---|---|---|---|
+| D1 | MAIN graceful failover (manual-failover path) — Primary leaves, peer takes over | ✅ PASS | AdminUI "Trigger failover" on `/clusters/MAIN/redundancy`: central-2 "Exiting completed" → central-1 became Primary (250) → central-2 restarted, "Welcome from central-1" (rejoined, no split). Roles swapped 250↔240 |
+| D2 | SITE-A auto-down failover, BOTH directions (kill Primary, then kill new Primary) | ✅ PASS | leg 8 killed site-a-1→site-a-2 Primary; D2 killed site-a-2→site-a-1 Primary (250), survived alone |
+| D3 | SITE-B auto-down failover (crash-the-oldest) | ✅ PASS | killed site-b-1 (Primary/oldest) → site-b-2 "Member removed [site-b-1]", BecomingOldest→Oldest, 250 |
+| D4 | Gate (a): auto-down 1-vs-1 crash-the-oldest — survivor stays Up, does not self-down | ✅ PASS | every survivor across D2/D3/D5/leg8 stayed Up (e.g. site-a-1 "Up 49 minutes", site-b-2 "Up 56 minutes") — no self-down. Closes the gate deferred since Phase 0a |
+| D5 | Gate (b): self-first cold-start-alone — a node boots ALONE (partner down) and forms its mesh | ✅ PASS | stopped both site-b, started only site-b-1: "JOINING itself … forming a new cluster" → leader → Up → serves 250 as sole Primary |
+| D6 | Recovery — a downed/restarted node rejoins its pair as Secondary (240) | ✅ PASS | central-2, site-a-2, site-b-2 all restarted → "Welcome from <founder>" → rejoined 240 |
+
+**Phase 7 exit gate: MET.** All 6 drills pass on every pair type. Final fleet: three healthy 2-node
+pairs, each one Primary (250) + one Secondary (240). Roles are wherever the last drill left them — each
+pair has exactly one Primary, which is what matters.
+
+## Findings / notes
+
+- **Manual-failover button is MAIN-only, by construction** (acts on the local `Cluster.State`; AdminUI
+  runs only on central). The UI now correctly states "this application Cluster's own Primary … each
+  cluster's redundant pair runs its own independent 2-node Akka mesh" (Phase 6 text, verified live).
+  Site pairs (driver-only, no UI) fail over via auto-down (crash) only — there is no manual-failover
+  surface for them, and that is correct for the topology.
+- **Graceful failover restarts the node in-place and it rejoins** (no split), because a single peer that
+  is already Up answers the restarting node's InitJoin. The **simultaneous cold-start** split (Phase 6
+  finding) only bites when BOTH pair nodes start from nothing at once — see the runbook mitigation.
+- **Carried Phase-6 finding — simultaneous cold-start of both pair VMs — NOW CLOSED by a product guard
+  (`279d1d0f`).** On the real co-located VMs a site's two VMs can power-cycle together; two self-first
+  seeds can then each form a 1-node cluster (split brain, two Primaries in one pair). Two mitigations now
+  exist: (1) **operational** — stagger the two VMs' service-manager start / start the founder first (the
+  docker-dev `depends_on: service_healthy` serialization, still used by site-b); (2) **product** — the
+  opt-in `Cluster:BootstrapGuard` (default off), which makes the lower-address node the founder and the
+  higher node probe-then-join, arbitrating the race inside the join decision. Live-gated on the site-a
+  pair (guard on, serialization removed): simultaneous start → 250/240, no split; higher-node cold-start
+  -alone → self-forms → 250. See `docs/Redundancy.md` §"Bootstrap guard". The guard does NOT need the
+  compose `depends_on` that production hardware lacks — it is the production-faithful fix.
+
+---
+
+## Operator runbook — co-located OtOpcUa + ScadaBridge site failover (one page)
+
+**Topology.** Each site = 2 Windows VMs. Each VM runs **one OtOpcUa driver node** (`driver,cluster-SITE-X`,
+Akka `:4053`, OPC UA `:4840`) **and one ScadaBridge site node** — two independent 2-node Akka clusters
+sharing the hardware, never a shared mesh. Central = 2 VMs, each an OtOpcUa `admin,driver,cluster-MAIN`
+node (hosts the AdminUI) + a ScadaBridge central node.
+
+**Normal state.** Each pair: one node Primary (OPC UA ServiceLevel **250**), one Secondary (**240**).
+Check from any OPC UA client: `otopcua-cli redundancy -u opc.tcp://<node>:4840`.
+
+**Planned failover (move the Primary off a VM — e.g. for patching):**
+- *Central (MAIN) pair:* AdminUI → **Clusters → MAIN → Redundancy → Trigger failover → Confirm**. The
+  Primary gracefully leaves, restarts, rejoins as Secondary; its peer becomes Primary (250) in a few
+  seconds. OPC UA clients re-select the new Primary automatically.
+- *Site pairs (SITE-A/SITE-B):* no UI (driver-only). Stop the OtOpcUa service on the Primary VM
+  (graceful SIGTERM) — the peer auto-downs it and becomes Primary. Restart the service to rejoin.
+
+**Unplanned failover (a VM dies).** The peer detects the loss (~10-15 s: failure detector + auto-down),
+removes the dead node, takes the redundancy singleton, and advertises 250. **A 1-node pair keeps
+serving** (auto-down 1-vs-1 survival — verified). Because the VM is shared, **both products fail over
+together**: confirm the ScadaBridge site node on the surviving VM also took over (its own runbook).
+
+**Recovery.** Bring the dead VM back. The OtOpcUa node cold-starts, finds its peer Up, and rejoins as
+Secondary (240) — "Welcome from <peer>" in its log. No manual step.
+
+**⚠️ Both VMs down at once (site power event).** Start the VMs **staggered**, or bring the **designated
+founder VM up first** and wait for its OtOpcUa node to reach ServiceLevel 250 before starting the second
+VM. Starting both OtOpcUa services simultaneously can split the pair into two 1-node clusters (two
+Primaries). If that happens: stop the OtOpcUa service on the non-founder VM, confirm the founder is the
+lone Primary (250), then restart the non-founder — it rejoins as Secondary.
+
+**Health checks.**
+- ServiceLevel per node: `otopcua-cli redundancy -u opc.tcp://<node>:4840` (250 Primary / 240 Secondary).
+- MAIN membership + Primary: AdminUI → Clusters → MAIN → Redundancy.
+- A pair showing **250/250** = split brain — apply the "both VMs down" recovery above.
+- A pair showing **240/240 or a lone 240** = no Primary elected — check the singleton host is Up.
@@ -0,0 +1,729 @@
+# Modbus RTU Driver Implementation Plan
+
+> **For Claude:** REQUIRED SUB-SKILL: Use superpowers-extended-cc:executing-plans (or subagent-driven-development) to implement this plan task-by-task.
+
+**Goal:** Add a Modbus **RTU-over-TCP** transport (RTU CRC-16 framing tunnelled to a serial→Ethernet gateway) to the existing `ModbusDriver`, selected by a new `Transport` config field — reusing every codec/planner/health/materialisation surface unchanged.
+
+**Architecture:** Purely additive behind the existing `IModbusTransport` seam. The application protocol (function codes, codecs, planner, coalescing, write path, probe, materialisation, HistoryRead) is byte-for-byte identical across TCP and RTU — only the wire framing differs (`[addr][PDU][CRC-16]`, no MBAP, no TxId). Work = a CRC-16 helper + a length-less FC-aware framer + one new socket transport that composes a socket lifecycle extracted from `ModbusTcpTransport` + a transport-mode selector on the config + one AdminUI field. **Zero** changes to codecs/planner/health.
+
+**Tech Stack:** existing `ZB.MOM.WW.OtOpcUa.Driver.Modbus` (+ `.Contracts`, `.Addressing`), xUnit + Shouldly, `pymodbus[simulator]==3.13.0` Docker fixture (RTU-framed-TCP profile; stdlib fallback server modelled on `exception_injector.py`), Blazor `ModbusDriverForm.razor` (AdminUI). No new NuGet dependency.
+
+**Source design:** docs/plans/2026-07-15-modbus-rtu-driver-design.md
+**Program design:** docs/plans/2026-07-15-driver-expansion-program-design.md (§3 shared contract, §7 fixtures) — this is **Wave 1**.
+**Progress tracker:** docs/plans/2026-07-24-driver-expansion-tracking.md
+
+## Scope (P1 shippable v1 only)
+
+RTU-over-TCP via a serial→Ethernet gateway (Moxa/Digi/Lantronix), RTU CRC-16 (poly `0xA001`) + FC-aware length framing, a `Transport` selector (`Tcp` | `RtuOverTcp`) on the Modbus config, the `rtu_over_tcp` pymodbus docker profile, and the AdminUI selector. Read **and** write supported (same as TCP).
+
+## Deferred / out of scope
+
+- **Direct-serial transport** (`ModbusRtuTransport` / `System.IO.Ports`) — descoped (user, 2026-07-15). RTU buses are reached exclusively via a serial→Ethernet gateway. Design record kept in **design §2b / §9 P2**; the `ModbusRtuFraming` built here is byte-stream-agnostic so a future serial leg would reuse it unchanged. Do **not** number-squat an `Rtu` enum member for it.
+- **Modbus ASCII** — a third framing (`:`-delimited hex + LRC); would be another `IModbusTransport` if ever needed (design §2c). Not planned.
+- **Per-tag `TagConfig` changes** — none. `ModbusTagDefinition`/`ModbusTagDto` already carry the per-tag `UnitId` override that makes an RS-485 multi-drop bus work; the read planner already refuses to coalesce across UnitIds. Additions are **driver-level only** (design §4).
+- **`ModbusDriver.BuildSlaveHostName` change** — NOT needed. It already emits `host:port/unit{n}`, the correct per-slave resilience key for a gateway (design §6). The design §1 table listed it only for the descoped serial (COM) case.
+
+## Cross-cutting rules (program §3.1 — mandatory)
+
+- **Enum-serialization trap** — `Transport` MUST round-trip as a **name string**, never a number, on both the AdminUI serializer (`ModbusDriverForm._jsonOpts` already carries `JsonStringEnumConverter`) and the factory (DTO field typed `string?`, parsed via the existing `ParseEnum<T>` — mirror `Family`/`MelsecSubFamily`; **do not** type the DTO field as the enum). Guarded by an explicit `"transport":"RtuOverTcp"` string assertion (design §5).
+- **Per-op deadline (R2-01)** — the RTU transport MUST run every transaction under a linked-CTS `CancelAfter(Options.Timeout)` — a frozen gateway must never wedge a poll. There is **no MBAP length field to trust**; FC-aware sizing is the only length signal, so getting it right (or timing out) is the top correctness risk (design §7).
+- **Single-flight mandatory on RTU** — no TxId means at most one transaction on the bus at a time. Keep the `_gate` `SemaphoreSlim` in the new transport.
+- **Ctor is connection-free** — the transport constructor must not connect; all I/O happens in `ConnectAsync`/`SendAsync`.
+- **Live-verify discipline** — the picker/editor + deploy path get a docker-dev `/run` before trust (Task 10).
+
+---
+
+## Task 0: Add the `ModbusTransportMode` enum
+
+**Classification:** trivial
+**Estimated implement time:** ~3 min
+**Parallelizable with:** Task 1, Task 3
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts/ModbusTransportMode.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusTransportModeTests.cs`
+
+The enum lives in `.Contracts` (backend-dep-free), namespace `ZB.MOM.WW.OtOpcUa.Driver.Modbus` — same namespace as `ModbusDriverOptions`.
+
+**Step 1 — failing test:**
+```csharp
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+public sealed class ModbusTransportModeTests
+{
+    [Fact]
+    public void Tcp_is_the_default_zero_member()
+        => ((ModbusTransportMode)0).ShouldBe(ModbusTransportMode.Tcp);
+
+    [Fact]
+    public void Exactly_two_members_ship_in_v1()
+        => Enum.GetNames<ModbusTransportMode>().ShouldBe(["Tcp", "RtuOverTcp"]);
+}
+```
+
+**Step 2 — run & expect FAIL** (type does not exist / does not compile):
+`dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests --filter "FullyQualifiedName~ModbusTransportModeTests"`
+
+**Step 3 — minimal impl:**
+```csharp
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus;
+
+/// <summary>
+///     Wire transport for a Modbus driver instance. <see cref="Tcp"/> = Modbus/TCP (MBAP + TxId);
+///     <see cref="RtuOverTcp"/> = RTU framing (address + CRC-16, no MBAP) tunnelled over a socket to
+///     a serial→Ethernet gateway. Default <see cref="Tcp"/> — existing configs omit the field.
+///     A direct-serial <c>Rtu</c> member is intentionally NOT reserved here (descoped 2026-07-15);
+///     do not number-squat it.
+/// </summary>
+public enum ModbusTransportMode
+{
+    /// <summary>Modbus/TCP — 7-byte MBAP header + transaction id (the historical default).</summary>
+    Tcp,
+
+    /// <summary>RTU framing (<c>[addr][PDU][CRC-16]</c>) tunnelled over a socket to a serial→Ethernet gateway.</summary>
+    RtuOverTcp,
+}
+```
+
+**Step 4 — run & expect PASS.**
+
+**Step 5 — commit:**
+`git commit -am "feat(modbus-rtu): add ModbusTransportMode enum (Tcp | RtuOverTcp)
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Task 1: `ModbusCrc` — CRC-16 (poly 0xA001) helper + golden vectors
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 0, Task 3
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusCrc.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusCrcTests.cs`
+
+CRC-16/MODBUS: reflected poly `0xA001`, init `0xFFFF`, appended **low byte first**. This is the top-of-stack of the length-less framer — golden vectors are the whole point.
+
+**Step 1 — failing test** (table-driven against published Modbus CRC vectors):
+```csharp
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+public sealed class ModbusCrcTests
+{
+    // Known CRC-16/MODBUS vectors (init 0xFFFF, poly 0xA001). CRC returned as ushort;
+    // on the wire it is appended low-byte-first.
+    [Theory]
+    // FC03 read HR: unit 1, addr 0, qty 1  -> CRC 0x0A84  (bytes 84 0A on the wire)
+    [InlineData(new byte[] { 0x01, 0x03, 0x00, 0x00, 0x00, 0x01 }, (ushort)0x0A84)]
+    // "123456789" canonical check value for CRC-16/MODBUS = 0x4B37
+    [InlineData(new byte[] { 0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39 }, (ushort)0x4B37)]
+    public void Compute_matches_known_vectors(byte[] frame, ushort expected)
+        => ModbusCrc.Compute(frame).ShouldBe(expected);
+
+    [Fact]
+    public void AppendLowByteFirst_writes_lo_then_hi()
+    {
+        var body = new byte[] { 0x01, 0x03, 0x00, 0x00, 0x00, 0x01 };
+        var withCrc = ModbusCrc.Append(body);
+        withCrc.Length.ShouldBe(body.Length + 2);
+        withCrc[^2].ShouldBe((byte)0x84); // CRC low byte
+        withCrc[^1].ShouldBe((byte)0x0A); // CRC high byte
+    }
+}
+```
+
+**Step 2 — run & expect FAIL:**
+`dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests --filter "FullyQualifiedName~ModbusCrcTests"`
+
+**Step 3 — minimal impl** (`ModbusCrc.cs`): a `static ushort Compute(ReadOnlySpan<byte>)` (init `0xFFFF`, xor byte, 8× shift-right, xor `0xA001` on carry) and `static byte[] Append(ReadOnlySpan<byte> body)` returning `body + [crc & 0xFF, crc >> 8]`. ~30 lines. If a golden vector disagrees, fix the CRC math — never the vector.
+
+**Step 4 — run & expect PASS.**
+
+**Step 5 — commit:**
+`git commit -am "feat(modbus-rtu): add ModbusCrc CRC-16/MODBUS helper + golden vectors
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Task 2: `ModbusRtuFraming` — ADU build + FC-aware length-less deframe
+
+**Classification:** high-risk (framing)
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusRtuFraming.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusRtuFramingTests.cs`
+
+The one genuinely new correctness risk (design §2a/§7): RTU frames carry **no length field**, so response size is parsed from the function code. Read `addr(1)`+`fc(1)`, then: **exception** (`fc & 0x80`) → `excCode(1)+CRC(2)`; **reads FC01/02/03/04** → `byteCount(1)` then `byteCount + CRC(2)`; **write echoes FC05/06/15/16** → fixed `4 + CRC(2)`. Validate trailing CRC, strip `addr`+`CRC`, return the bare PDU `[fc, ...data]`. CRC mismatch / truncation → `ModbusTransportDesyncException`; exception PDU (after CRC-validate) → `ModbusException`. Test directly against an in-memory `MemoryStream` of canned bytes.
+
+**Step 1 — failing test:**
+```csharp
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+public sealed class ModbusRtuFramingTests
+{
+    private static MemoryStream Canned(params byte[] frame) => new(frame);
+
+    [Fact]
+    public void BuildAdu_prefixes_unit_and_appends_crc()
+    {
+        var adu = ModbusRtuFraming.BuildAdu(0x01, new byte[] { 0x03, 0x00, 0x00, 0x00, 0x01 });
+        adu.ShouldBe(new byte[] { 0x01, 0x03, 0x00, 0x00, 0x00, 0x01, 0x84, 0x0A });
+    }
+
+    [Fact]
+    public async Task ReadResponse_FC03_returns_bare_pdu()
+    {
+        // addr=01 fc=03 byteCount=02 data=00 0A  + CRC(lo,hi)
+        var body = new byte[] { 0x01, 0x03, 0x02, 0x00, 0x0A };
+        var frame = ModbusCrc.Append(body);
+        await using var s = Canned(frame);
+        var pdu = await ModbusRtuFraming.ReadResponsePduAsync(s, 0x01, TestContext.Current.CancellationToken);
+        pdu.ShouldBe(new byte[] { 0x03, 0x02, 0x00, 0x0A }); // fc + byteCount + data, no addr/CRC
+    }
+
+    [Fact]
+    public async Task ReadResponse_exception_frame_throws_ModbusException()
+    {
+        // addr=01 fc=0x83 exc=0x02 + CRC
+        var frame = ModbusCrc.Append(new byte[] { 0x01, 0x83, 0x02 });
+        await using var s = Canned(frame);
+        var ex = await Should.ThrowAsync<ModbusException>(
+            ModbusRtuFraming.ReadResponsePduAsync(s, 0x01, TestContext.Current.CancellationToken));
+        ex.FunctionCode.ShouldBe((byte)0x03);
+        ex.ExceptionCode.ShouldBe((byte)0x02);
+    }
+
+    [Fact]
+    public async Task ReadResponse_bad_crc_throws_desync()
+    {
+        var frame = ModbusCrc.Append(new byte[] { 0x01, 0x03, 0x02, 0x00, 0x0A });
+        frame[^1] ^= 0xFF; // corrupt CRC high byte
+        await using var s = Canned(frame);
+        await Should.ThrowAsync<ModbusTransportDesyncException>(
+            ModbusRtuFraming.ReadResponsePduAsync(s, 0x01, TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task ReadResponse_FC06_write_echo_returns_four_byte_pdu()
+    {
+        // addr=01 fc=06 addr=00 07 value=00 2A + CRC  -> PDU = 06 00 07 00 2A
+        var frame = ModbusCrc.Append(new byte[] { 0x01, 0x06, 0x00, 0x07, 0x00, 0x2A });
+        await using var s = Canned(frame);
+        var pdu = await ModbusRtuFraming.ReadResponsePduAsync(s, 0x01, TestContext.Current.CancellationToken);
+        pdu.ShouldBe(new byte[] { 0x06, 0x00, 0x07, 0x00, 0x2A });
+    }
+}
+```
+
+**Step 2 — run & expect FAIL:**
+`dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests --filter "FullyQualifiedName~ModbusRtuFramingTests"`
+
+**Step 3 — minimal impl** (`ModbusRtuFraming.cs`): `static byte[] BuildAdu(byte unitId, ReadOnlySpan<byte> pdu)` = `ModbusCrc.Append([unitId, ..pdu])`; `static async Task<byte[]> ReadResponsePduAsync(Stream, byte expectedUnit, CancellationToken)` doing the FC-aware read described above with a `ReadExactlyAsync` helper (mirror `ModbusTcpTransport.ReadExactlyAsync`). Reuse `ModbusException` + `ModbusTransportDesyncException` (both already in the project). Keep framing byte-stream-agnostic (no socket knowledge) so a future serial transport can reuse it.
+
+**Step 4 — run & expect PASS.**
+
+**Step 5 — commit:**
+`git commit -am "feat(modbus-rtu): add ModbusRtuFraming (ADU build + FC-aware length-less deframe)
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Task 3: Extract `ModbusSocketLifecycle` from `ModbusTcpTransport` (behaviour-preserving)
+
+**Classification:** high-risk (transport / concurrency)
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 0, Task 1, Task 2
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusSocketLifecycle.cs`
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusTcpTransport.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusSocketLifecycleTests.cs`
+
+Mechanical refactor: move the IPv4-preference connect (`ConnectAsync`), `EnableKeepAlive`/`ClampToWholeSeconds`, `ConnectWithBackoffAsync`, `TearDownAsync`, and the `_lastSuccessUtc`/idle-disconnect tracking out of `ModbusTcpTransport` into a reusable `ModbusSocketLifecycle` that exposes the current `NetworkStream`. `ModbusTcpTransport` keeps its MBAP `SendOnceAsync` and composes the lifecycle. **Behaviour must be byte-for-byte unchanged** — the existing `ModbusTcpReconnectTests` + `ModbusConnectionOptionsTests` are the regression net; run the whole Modbus.Tests suite green before committing.
+
+**Step 1 — failing test** (pins the extracted surface; `ClampToWholeSeconds` moves with it):
+```csharp
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+public sealed class ModbusSocketLifecycleTests
+{
+    [Theory]
+    [InlineData(0.4, 1)]   // sub-second rounds up to 1 (the int-cast truncation guard)
+    [InlineData(2.0, 2)]
+    [InlineData(-5.0, 1)]  // negative clamps to 1
+    public void ClampToWholeSeconds_rounds_up_min_one(double seconds, int expected)
+        => ModbusSocketLifecycle.ClampToWholeSeconds(TimeSpan.FromSeconds(seconds)).ShouldBe(expected);
+
+    [Fact]
+    public async Task Connect_to_dead_port_surfaces_socket_failure()
+    {
+        var life = new ModbusSocketLifecycle("127.0.0.1", 1, TimeSpan.FromMilliseconds(300),
+            autoReconnect: false);
+        await Should.ThrowAsync<System.Net.Sockets.SocketException>(
+            life.ConnectAsync(TestContext.Current.CancellationToken));
+    }
+}
+```
+
+**Step 2 — run & expect FAIL:**
+`dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests --filter "FullyQualifiedName~ModbusSocketLifecycleTests"`
+
+**Step 3 — minimal impl:** create `ModbusSocketLifecycle` holding `_host/_port/_timeout/_autoReconnect/_keepAlive/_idleDisconnect/_reconnect`, the `TcpClient`/`NetworkStream`, and `_lastSuccessUtc`; expose `ConnectAsync`, `ConnectWithBackoffAsync`, `TearDownAsync`, `Stream` (current), `MarkSuccess()`, `ShouldReconnectForIdle()`, and the `static int ClampToWholeSeconds`. Re-point `ModbusTcpTransport` to delegate connect/reconnect/teardown/idle to it while keeping MBAP `SendOnceAsync` in place. Move (don't duplicate) `ClampToWholeSeconds` — update its one internal caller/test reference.
+
+**Step 4 — run & expect PASS** — then run the **whole** suite to prove no regression:
+`dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests`
+
+**Step 5 — commit:**
+`git commit -am "refactor(modbus): extract ModbusSocketLifecycle from ModbusTcpTransport (behaviour-preserving)
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Task 4: `ModbusRtuOverTcpTransport` — RTU framing over the socket lifecycle
+
+**Classification:** high-risk (framing / transport / concurrency)
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusRtuOverTcpTransport.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusRtuOverTcpTransportTests.cs`
+
+`IModbusTransport` implementation: composes `ModbusSocketLifecycle` (Task 3) for connect/reconnect/keepalive/idle and `ModbusRtuFraming` (Task 2) for send/receive. Delta from `ModbusTcpTransport`: CRC framing instead of MBAP, **no TxId**. Keep the `_gate` `SemaphoreSlim` single-flight (mandatory — no TxId), the single reconnect-retry shape, and a linked-CTS `CancelAfter(Options.Timeout)` per-op deadline (design §7, R2-01). **Seam choice for unit test:** add an `internal` test ctor accepting a pre-connected `Stream` (an in-memory duplex fake) that bypasses `ConnectAsync` — this is "the fake one level below the `IModbusTransport` fakes" the design §8 calls for, and lets the send/receive orchestration + single-flight + deadline be tested with no socket.
+
+**Step 1 — failing test** (duplex fake: canned response stream + capture of written request bytes):
+```csharp
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+public sealed class ModbusRtuOverTcpTransportTests
+{
+    [Fact]
+    public async Task SendAsync_writes_rtu_adu_and_returns_deframed_pdu()
+    {
+        // Response the fake gateway will emit: FC03, 1 reg = 0x000A.
+        var response = ModbusCrc.Append(new byte[] { 0x01, 0x03, 0x02, 0x00, 0x0A });
+        var fake = new CapturingDuplexStream(response);
+
+        await using var transport = ModbusRtuOverTcpTransport.ForTest(fake, TimeSpan.FromSeconds(2));
+        var pdu = await transport.SendAsync(0x01, new byte[] { 0x03, 0x00, 0x00, 0x00, 0x01 },
+            TestContext.Current.CancellationToken);
+
+        pdu.ShouldBe(new byte[] { 0x03, 0x02, 0x00, 0x0A });
+        // The request went out as an RTU ADU: unit + pdu + CRC, NO MBAP header.
+        fake.Written.ShouldBe(new byte[] { 0x01, 0x03, 0x00, 0x00, 0x00, 0x01, 0x84, 0x0A });
+    }
+
+    [Fact]
+    public async Task SendAsync_exception_pdu_surfaces_ModbusException()
+    {
+        var response = ModbusCrc.Append(new byte[] { 0x01, 0x83, 0x02 });
+        var fake = new CapturingDuplexStream(response);
+        await using var transport = ModbusRtuOverTcpTransport.ForTest(fake, TimeSpan.FromSeconds(2));
+        await Should.ThrowAsync<ModbusException>(
+            transport.SendAsync(0x01, new byte[] { 0x03, 0x00, 0x00, 0x00, 0x01 },
+                TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task SendAsync_stalled_gateway_hits_per_op_deadline()
+    {
+        var fake = new CapturingDuplexStream(respondBytes: Array.Empty<byte>(), stall: true);
+        await using var transport = ModbusRtuOverTcpTransport.ForTest(fake, TimeSpan.FromMilliseconds(200));
+        await Should.ThrowAsync<ModbusTransportDesyncException>(
+            transport.SendAsync(0x01, new byte[] { 0x03, 0x00, 0x00, 0x00, 0x01 },
+                TestContext.Current.CancellationToken));
+    }
+}
+```
+(The `CapturingDuplexStream` test double — a `Stream` that records writes and replays `respondBytes` on read, or blocks forever when `stall` — lives in the test file.)
+
+**Step 2 — run & expect FAIL:**
+`dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests --filter "FullyQualifiedName~ModbusRtuOverTcpTransportTests"`
+
+**Step 3 — minimal impl:** production ctor takes the same connection params as `ModbusTcpTransport` and builds a `ModbusSocketLifecycle`; `internal static ForTest(Stream, TimeSpan)` injects a pre-connected stream. `SendAsync`: `_gate.WaitAsync`; idle-reconnect check (skipped in test seam); write `ModbusRtuFraming.BuildAdu(unitId, pdu)`, flush, `ModbusRtuFraming.ReadResponsePduAsync(...)` under a linked `CancelAfter(_timeout)`; timeout-vs-caller-cancel distinction + teardown mirror `ModbusTcpTransport.SendOnceAsync`; single reconnect-retry on socket-level failure.
+
+**Step 4 — run & expect PASS.**
+
+**Step 5 — commit:**
+`git commit -am "feat(modbus-rtu): add ModbusRtuOverTcpTransport (RTU framing over socket lifecycle)
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Task 5: `ModbusTransportFactory.Create` — switch on `Transport`
+
+**Classification:** small
+**Estimated implement time:** ~4 min
+**Parallelizable with:** Task 6
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusTransportFactory.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusTransportFactoryTests.cs`
+
+One place that maps `ModbusDriverOptions` → the right `IModbusTransport`, consumed by both the driver default closure (Task 7) and the probe (Task 7). `Tcp` → `ModbusTcpTransport`, `RtuOverTcp` → `ModbusRtuOverTcpTransport`; both get `Host/Port/Timeout/AutoReconnect/KeepAlive/IdleDisconnect/Reconnect`.
+
+**Step 1 — failing test:**
+```csharp
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+public sealed class ModbusTransportFactoryTests
+{
+    [Fact]
+    public void Tcp_mode_builds_tcp_transport()
+        => ModbusTransportFactory.Create(new ModbusDriverOptions { Transport = ModbusTransportMode.Tcp })
+            .ShouldBeOfType<ModbusTcpTransport>();
+
+    [Fact]
+    public void RtuOverTcp_mode_builds_rtu_transport()
+        => ModbusTransportFactory.Create(new ModbusDriverOptions { Transport = ModbusTransportMode.RtuOverTcp })
+            .ShouldBeOfType<ModbusRtuOverTcpTransport>();
+
+    [Fact]
+    public void Default_options_build_tcp_transport()
+        => ModbusTransportFactory.Create(new ModbusDriverOptions())
+            .ShouldBeOfType<ModbusTcpTransport>();
+}
+```
+(Depends on Task 6's `Transport` property existing on `ModbusDriverOptions` — sequence Task 6 or add the property first. If Task 5 lands before Task 6, add the property in this task instead.)
+
+**Step 2 — run & expect FAIL.**
+`dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests --filter "FullyQualifiedName~ModbusTransportFactoryTests"`
+
+**Step 3 — minimal impl:** `static IModbusTransport Create(ModbusDriverOptions o)` = `switch (o.Transport) { RtuOverTcp => new ModbusRtuOverTcpTransport(...), _ => new ModbusTcpTransport(...) }`, passing the shared connection params.
+
+**Step 4 — run & expect PASS.**
+
+**Step 5 — commit:**
+`git commit -am "feat(modbus-rtu): add ModbusTransportFactory switch on Transport mode
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Task 6: Add `Transport` to options + DTO + factory (string-enum guard)
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 5
+**Files:**
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts/ModbusDriverOptions.cs`
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusDriverFactoryExtensions.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusTransportConfigRoundTripTests.cs`
+
+Add `public ModbusTransportMode Transport { get; init; } = ModbusTransportMode.Tcp;` to `ModbusDriverOptions`. On the DTO: add `public string? Transport { get; init; }` (typed **`string?`**, per the Modbus factory pattern — design §5) and map it with the existing `ParseEnum<ModbusTransportMode>(...)` helper, defaulting to `Tcp` when null. The guard test asserts the string wire form.
+
+**Step 1 — failing test:**
+```csharp
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+public sealed class ModbusTransportConfigRoundTripTests
+{
+    // Mirrors the AdminUI ModbusDriverForm serializer: camelCase + string enums.
+    private static readonly JsonSerializerOptions _adminOpts = new()
+    {
+        PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+        Converters = { new JsonStringEnumConverter() },
+    };
+
+    [Fact]
+    public void Transport_serializes_as_a_string_not_a_number()
+    {
+        var opts = new ModbusDriverOptions { Host = "10.20.0.50", Port = 4001, Transport = ModbusTransportMode.RtuOverTcp };
+        var json = JsonSerializer.Serialize(opts, _adminOpts);
+        json.ShouldContain("\"transport\":\"RtuOverTcp\"");
+        json.ShouldNotContain("\"transport\":1", Case.Sensitive);
+    }
+
+    [Fact]
+    public void Factory_binds_RtuOverTcp_from_string_config()
+    {
+        const string json = """{ "host": "10.20.0.50", "port": 4001, "transport": "RtuOverTcp" }""";
+        using var driver = ModbusDriverFactoryExtensions.CreateInstance("mb-rtu", json);
+        var opts = (ModbusDriverOptions)typeof(ModbusDriver)
+            .GetField("_options", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
+            .GetValue(driver)!;
+        opts.Transport.ShouldBe(ModbusTransportMode.RtuOverTcp);
+    }
+
+    [Fact]
+    public void Factory_defaults_Transport_to_Tcp_when_omitted()
+    {
+        const string json = """{ "host": "10.0.0.10" }""";
+        using var driver = ModbusDriverFactoryExtensions.CreateInstance("mb-tcp", json);
+        var opts = (ModbusDriverOptions)typeof(ModbusDriver)
+            .GetField("_options", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
+            .GetValue(driver)!;
+        opts.Transport.ShouldBe(ModbusTransportMode.Tcp);
+    }
+}
+```
+
+**Step 2 — run & expect FAIL:**
+`dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests --filter "FullyQualifiedName~ModbusTransportConfigRoundTripTests"`
+
+**Step 3 — minimal impl:** add the `Transport` property (options) + DTO `string?` field + factory mapping `Transport = dto.Transport is null ? ModbusTransportMode.Tcp : ParseEnum<ModbusTransportMode>(dto.Transport, "<driver-level>", driverInstanceId, "Transport")`.
+
+**Step 4 — run & expect PASS.**
+
+**Step 5 — commit:**
+`git commit -am "feat(modbus-rtu): bind Transport mode on options/DTO/factory (string-enum guard)
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Task 7: Wire the driver default closure + probe to `ModbusTransportFactory`
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 8
+**Files:**
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusDriver.cs`
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusDriverProbe.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusTransportWiringTests.cs`
+
+Replace the driver ctor's hardcoded `new ModbusTcpTransport(...)` default closure with `o => ModbusTransportFactory.Create(o)`. In the probe, replace the hardcoded `new ModbusTcpTransport(host, port, timeout, autoReconnect: false)` (line ~77) with a factory build carrying `Transport` (parse it into `ProbeTarget` from the DTO), `autoReconnect: false`. Now an `RtuOverTcp`-authored config probes over RTU framing — matching how it will actually run.
+
+**Step 1 — failing test** (the default closure honours the mode; the probe carries it):
+```csharp
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+public sealed class ModbusTransportWiringTests
+{
+    private static IModbusTransport BuildDefaultTransport(ModbusDriverOptions opts)
+    {
+        using var driver = new ModbusDriver(opts, "wire-test");
+        var factory = (Func<ModbusDriverOptions, IModbusTransport>)typeof(ModbusDriver)
+            .GetField("_transportFactory", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
+            .GetValue(driver)!;
+        return factory(opts);
+    }
+
+    [Fact]
+    public void Default_closure_builds_rtu_transport_for_RtuOverTcp()
+        => BuildDefaultTransport(new ModbusDriverOptions { Transport = ModbusTransportMode.RtuOverTcp })
+            .ShouldBeOfType<ModbusRtuOverTcpTransport>();
+
+    [Fact]
+    public void Default_closure_builds_tcp_transport_for_Tcp()
+        => BuildDefaultTransport(new ModbusDriverOptions())
+            .ShouldBeOfType<ModbusTcpTransport>();
+}
+```
+(If `_transportFactory` reflection proves brittle, assert instead that a `RtuOverTcp` driver initialised against an unreachable host degrades without ever constructing an MBAP frame — but the closure-reflection test is the tightest.)
+
+**Step 2 — run & expect FAIL:**
+`dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests --filter "FullyQualifiedName~ModbusTransportWiringTests"`
+
+**Step 3 — minimal impl:** driver ctor default = `?? (o => ModbusTransportFactory.Create(o))`; probe: add `ModbusTransportMode Transport` to `ProbeTarget`, parse `dto.Transport` via `ParseEnum`, and build the probe transport through `ModbusTransportFactory.Create(new ModbusDriverOptions { Host, Port, Timeout, Transport, AutoReconnect = false })`.
+
+**Step 4 — run & expect PASS** (+ run the full Modbus.Tests suite green).
+
+**Step 5 — commit:**
+`git commit -am "feat(modbus-rtu): route driver + probe transports through ModbusTransportFactory
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Task 8: AdminUI — `Transport` selector on `ModbusDriverForm`
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 7
+**Files:**
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/Forms/ModbusDriverForm.razor`
+- Test: `tests/Server/ZB.MOM.WW.OtOpcUa.AdminUI.Tests/Uns/ModbusDriverFormModelTests.cs`
+
+Add a `Transport` `<InputSelect>` to the **Protocol** panel (design's target `ModbusDriverPage.razor` is retired; `ModbusDriverForm.razor` is the live host — it serializes `ModbusDriverOptions` directly through `_jsonOpts`, which already carries `JsonStringEnumConverter`, so `Transport` emits as a name string automatically; `Transport` is **not** an endpoint key so it is not stripped by `GetConfigJson`). Add `public ModbusTransportMode Transport { get; set; } = ModbusTransportMode.Tcp;` to `FormModel`, map it in `FromOptions`/`ToOptions`. Host/Port stay on `ModbusDeviceForm` — a `RtuOverTcp` gateway uses the same `host:port` shape. Extend the existing `ModbusDriverFormModelTests` (round-trip + string-enum guard).
+
+**Step 1 — failing test** (append to `ModbusDriverFormModelTests`):
+```csharp
+    [Fact]
+    public void Round_trip_preserves_Transport_mode()
+    {
+        var form = new ModbusDriverForm.FormModel { Transport = ModbusTransportMode.RtuOverTcp };
+        var json = JsonSerializer.Serialize(form.ToOptions(), JsonOpts);
+        var back = ModbusDriverForm.FormModel.FromOptions(
+            JsonSerializer.Deserialize<ModbusDriverOptions>(json, JsonOpts)!);
+        back.Transport.ShouldBe(ModbusTransportMode.RtuOverTcp);
+        json.ShouldContain("\"transport\":\"RtuOverTcp\""); // name string, never a number
+    }
+```
+
+**Step 2 — run & expect FAIL:**
+`dotnet test tests/Server/ZB.MOM.WW.OtOpcUa.AdminUI.Tests --filter "FullyQualifiedName~ModbusDriverFormModelTests"`
+
+**Step 3 — minimal impl:** add the `Transport` `FormModel` property + `FromOptions`/`ToOptions` mapping, and an `<InputSelect @bind-Value="_form.Transport" @bind-Value:after="EmitAsync">` looping `Enum.GetValues<ModbusTransportMode>()` in the Protocol panel, with a form-text hint: "RtuOverTcp = talk raw RTU frames to a serial→Ethernet gateway; must match the gateway's mode."
+
+**Step 4 — run & expect PASS.** (AdminUI has no bUnit — the razor binding itself is proven live in Task 10; this model test is the reflection substitute per the AdminUI live-verify memory.)
+
+**Step 5 — commit:**
+`git commit -am "feat(modbus-rtu): add Transport selector to the AdminUI Modbus driver form
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Task 9: Docker `rtu_over_tcp` fixture + RTU-over-TCP integration test
+
+**Classification:** standard (new component / multi-file)
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Docker/profiles/rtu_over_tcp.json`
+- Modify: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Docker/docker-compose.yml`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/ModbusRtuOverTcpFixture.cs`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/ModbusRtuOverTcpTests.cs`
+- Modify (only if the pymodbus RTU-framer confirmation fails): `Docker/Dockerfile` + `Docker/rtu_over_tcp_server.py`
+
+**FIRST sub-step — confirm the unknown (design §8 #1):** verify the pymodbus simulator actually exposes the RTU framer on a TCP server. The checked-in `profiles/standard.json` already sets `server_list.srv.framer: "socket"`, so the knob exists; the RTU profile sets `"framer": "rtu"` (comm stays `"tcp"`). Bring it up and probe with the new driver:
+```bash
+lmxopcua-fix sync modbus
+lmxopcua-fix up modbus rtu_over_tcp
+# then run the integration test (below) against MODBUS_RTU_SIM_ENDPOINT=10.100.0.35:5021
+```
+If pymodbus 3.13's simulator does **not** honour `framer=rtu` on a TCP server (garbled/MBAP-framed replies), **fall back** to a stdlib `rtu_over_tcp_server.py` modelled on the existing `exception_injector.py` (same asyncio TCP-server shape, but frame with `[addr][PDU][CRC-16]` via a Python CRC-16/MODBUS instead of the MBAP header) + a `COPY rtu_over_tcp_server.py` line in the Dockerfile and a `command:` override on the service. Record which path was taken in the test-class summary.
+
+Fixture details: bind host port **`5021`** (NOT the shared `:5020` — the `rtu_over_tcp` service must co-run with `standard` and sidestep the shared-port stale-container trap). Add `labels: { project: lmxopcua }` per the program fixture convention (existing services carry none — `lmxopcua-fix sync` normally owns the label host-side, but add it in-file for this service so it is discoverable). `ModbusRtuOverTcpFixture` mirrors `ModbusSimulatorFixture` but reads `MODBUS_RTU_SIM_ENDPOINT` (default `10.100.0.35:5021`) with the same skip-clean pattern.
+
+**Step 1 — failing test** (`ModbusRtuOverTcpTests.cs` — read + write round-trip over RTU-over-TCP):
+```csharp
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests;
+
+[Collection(ModbusRtuOverTcpCollection.Name)]
+[Trait("Category", "Integration")]
+[Trait("Device", "RtuOverTcp")]
+public sealed class ModbusRtuOverTcpTests(ModbusRtuOverTcpFixture sim)
+{
+    [Fact]
+    public async Task Reads_a_seeded_holding_register_over_rtu_framing()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        var opts = new ModbusDriverOptions
+        {
+            Host = sim.Host, Port = sim.Port, UnitId = 1,
+            Transport = ModbusTransportMode.RtuOverTcp,
+            Timeout = TimeSpan.FromSeconds(2),
+            Probe = new ModbusProbeOptions { Enabled = false },
+            RawTags = ModbusRawTags.Entries([
+                new ModbusTagDefinition("HR5", ModbusRegion.HoldingRegisters, Address: 5,
+                    DataType: ModbusDataType.UInt16, Writable: false),
+            ]),
+        };
+        await using var driver = new ModbusDriver(opts, "modbus-rtu-int");
+        await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await driver.ReadAsync(["HR5"], TestContext.Current.CancellationToken);
+
+        results[0].StatusCode.ShouldBe(0u);       // Good
+        results[0].Value.ShouldBe((ushort)5);     // HR[5] seeded = address-as-value
+    }
+
+    [Fact]
+    public async Task Writes_and_reads_back_a_holding_register_over_rtu_framing()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        var opts = new ModbusDriverOptions
+        {
+            Host = sim.Host, Port = sim.Port, UnitId = 1,
+            Transport = ModbusTransportMode.RtuOverTcp,
+            Timeout = TimeSpan.FromSeconds(2),
+            Probe = new ModbusProbeOptions { Enabled = false },
+            RawTags = ModbusRawTags.Entries([
+                new ModbusTagDefinition("HR200", ModbusRegion.HoldingRegisters, Address: 200,
+                    DataType: ModbusDataType.UInt16, Writable: true),
+            ]),
+        };
+        await using var driver = new ModbusDriver(opts, "modbus-rtu-int-w");
+        await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var writes = await driver.WriteAsync([new WriteRequest("HR200", (ushort)4242)],
+            TestContext.Current.CancellationToken);
+        writes[0].StatusCode.ShouldBe(0u);
+
+        var back = await driver.ReadAsync(["HR200"], TestContext.Current.CancellationToken);
+        back[0].Value.ShouldBe((ushort)4242);
+    }
+}
+```
+(Seed `rtu_over_tcp.json` with the same `HR[0..31]=address-as-value` + `HR[200..209]=scratch` layout as `standard.json` so these addresses resolve.)
+
+**Step 2 — run & expect FAIL / SKIP** without the fixture, then bring it up:
+```bash
+lmxopcua-fix sync modbus && lmxopcua-fix up modbus rtu_over_tcp
+MODBUS_RTU_SIM_ENDPOINT=10.100.0.35:5021 dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests --filter "FullyQualifiedName~ModbusRtuOverTcpTests"
+```
+
+**Step 3 — minimal impl:** the `rtu_over_tcp.json` profile + compose service (+ stdlib server fallback only if the framer confirmation failed) + the fixture class. Iterate until both facts hold on the wire.
+
+**Step 4 — run & expect PASS** against the live fixture.
+
+**Step 5 — commit:**
+`git commit -am "test(modbus-rtu): add rtu_over_tcp pymodbus fixture + RTU-over-TCP integration tests
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Task 10: Live `/run` verification on docker-dev
+
+**Classification:** standard (live gate)
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Modify (docs only): `docs/plans/2026-07-24-driver-expansion-tracking.md` (record Wave-1 Modbus-RTU live-gate result)
+
+No new code — the live-verify discipline (program §3.1) proves the Razor binding + deploy path that unit tests can't. Against the local docker-dev rig (AdminUI `http://localhost:9200`, login disabled — drive it yourself; do not wait for the user to sign in):
+
+1. Bring up the `rtu_over_tcp` fixture (`lmxopcua-fix up modbus rtu_over_tcp`, host `:5021`).
+2. In `/raw`, author a Modbus device pointing Host/Port at the docker host `:5021`, and set the driver **Transport = RtuOverTcp** in the driver-config modal (the Task 8 selector). Run **Test Connect** — expect green (the probe now runs FC03 over RTU framing).
+3. Author a holding-register raw tag (e.g. `HR5`), reference it into a UNS equipment, and deploy.
+4. Read it back via Client.CLI against the local server, or the `/uns` value panel:
+   `dotnet run --project src/Client/ZB.MOM.WW.OtOpcUa.Client.CLI -- read -u opc.tcp://localhost:4840 -n "ns=2;s=<RawPath-of-HR5>"`
+   — expect Good quality + the seeded value.
+5. Write to a writable register (`HR200`) via Client.CLI `write` and confirm it round-trips.
+6. Record PASS/FAIL + evidence in the tracking doc.
+
+**Step 5 — commit:**
+`git commit -am "docs(modbus-rtu): record Wave-1 RTU-over-TCP live /run gate result
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Ordering summary
+
+Framer/CRC unit layer (Tasks 0–2) → transport (Tasks 3–4) → factory + config + driver/probe wiring (Tasks 5–7) → AdminUI selector (Task 8) → docker integration fixture (Task 9) → live `/run` (Task 10). Tasks 1 & 3 can run alongside Task 0; Task 5 alongside Task 6; Task 7 alongside Task 8. Commit after every task. DRY: `ModbusRtuFraming` and `ModbusSocketLifecycle` are each written once and composed; no codec/planner/health code is touched. YAGNI: no direct-serial, no ASCII, no per-tag config, no `BuildSlaveHostName` change.
@@ -0,0 +1,91 @@
+{
+  "planPath": "docs/plans/2026-07-24-modbus-rtu-driver.md",
+  "tasks": [
+    {
+      "id": 0,
+      "subject": "Task 0: Add the ModbusTransportMode enum (Tcp | RtuOverTcp)",
+      "status": "completed"
+    },
+    {
+      "id": 1,
+      "subject": "Task 1: ModbusCrc CRC-16/MODBUS helper + golden vectors",
+      "status": "completed"
+    },
+    {
+      "id": 2,
+      "subject": "Task 2: ModbusRtuFraming ADU build + FC-aware length-less deframe",
+      "status": "completed",
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 3,
+      "subject": "Task 3: Extract ModbusSocketLifecycle from ModbusTcpTransport (behaviour-preserving)",
+      "status": "completed"
+    },
+    {
+      "id": 4,
+      "subject": "Task 4: ModbusRtuOverTcpTransport (RTU framing over socket lifecycle)",
+      "status": "completed",
+      "blockedBy": [
+        2,
+        3
+      ]
+    },
+    {
+      "id": 5,
+      "subject": "Task 5: ModbusTransportFactory.Create switch on Transport mode",
+      "status": "completed",
+      "blockedBy": [
+        0,
+        4
+      ]
+    },
+    {
+      "id": 6,
+      "subject": "Task 6: Bind Transport on options/DTO/factory (string-enum guard)",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 7,
+      "subject": "Task 7: Route driver default closure + probe through ModbusTransportFactory",
+      "status": "completed",
+      "blockedBy": [
+        5,
+        6
+      ]
+    },
+    {
+      "id": 8,
+      "subject": "Task 8: AdminUI Transport selector on ModbusDriverForm",
+      "status": "completed",
+      "blockedBy": [
+        6
+      ]
+    },
+    {
+      "id": 9,
+      "subject": "Task 9: Docker rtu_over_tcp fixture + RTU-over-TCP integration test",
+      "status": "completed",
+      "blockedBy": [
+        4,
+        7
+      ]
+    },
+    {
+      "id": 10,
+      "subject": "Task 10: Live /run verification on docker-dev",
+      "status": "completed",
+      "blockedBy": [
+        8,
+        9
+      ]
+    }
+  ],
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Merged 0f38f486 (#495); live gate PASSED. Marked complete 2026-07-27 (deferment.md \u00a78.5)."
+}
@@ -0,0 +1,969 @@
+# MQTT / Sparkplug B Driver Implementation Plan
+
+> **For Claude:** REQUIRED SUB-SKILL: Use superpowers-extended-cc:executing-plans (or subagent-driven-development) to implement this plan task-by-task.
+
+**Goal:** Ship a standard Equipment-kind `Mqtt` driver that ingests plain MQTT (P1) then Sparkplug B (P2) into the OtOpcUa dual-namespace address space, with a bespoke observation browser, typed AdminUI editor, and TLS+auth-enforced fixtures.
+**Architecture:** Three new `net10.0` projects mirror the OpcUaClient triad — `.Contracts` (transport-free options/DTOs/parser/enums), `.Driver` (subscribe-first `IDriver` holding one live MQTTnet-5 client for its whole lifetime, raising `OnDataChange` from the receive callback, with a hand-rolled reconnect loop since v5 dropped `ManagedMqttClient`), and `.Browser` (a passive `#`/birth observation-window `IBrowseSession`). Sparkplug B decodes vendored Eclipse Tahu protobuf via `Google.Protobuf`/`Grpc.Tools` over that same single client — no SparkplugNet.
+**Tech Stack:** MQTTnet v5 (MIT, .NET Foundation, ships `net10.0`), vendored Eclipse Tahu `sparkplug_b.proto` + `Google.Protobuf` (already pinned 3.34.1) + `Grpc.Tools` (already pinned 2.76.0, build-time), bespoke browser.
+**Source design:** docs/plans/2026-07-15-mqtt-sparkplug-driver-design.md
+
+**Phases:** P1 (plain MQTT) = Tasks 0–14 (a complete shippable milestone); P2 (Sparkplug B ingest) = Tasks 15–26 (built on the P1 skeleton). Write-through (NCMD/DCMD/plain-publish) is deferred — see "Deferred / out of scope".
+
+---
+
+## Cross-cutting rules (apply to every task — program design §3.1)
+
+- **Enum-serialization trap (systemic bug):** every JSON seam that (de)serializes `MqttDriverOptions` or a tag config — factory, probe, browser, **and** the AdminUI driver-config page + probe DTO — MUST share a `JsonSerializerOptions` carrying `new JsonStringEnumConverter()` + `PropertyNameCaseInsensitive=true` + `UnmappedMemberHandling=Skip`. `MqttMode`, `MqttPayloadFormat`, `protocolVersion` are enums; serialize them as **names**. Mirror `OpcUaClientDriverFactoryExtensions`.
+- **Per-op deadline (R2-01 frozen-peer lesson):** every network call (connect / subscribe / probe / rebirth-publish) has a bounded linked-CTS deadline. No unbounded waits on a dead broker.
+- **Ctor is connection-free:** `MqttDriver`/`MqttDriverBrowser` constructors touch no network; all connects happen in `InitializeAsync`/`OpenAsync` (the universal-browser `CanBrowse` throwaway-instance pattern depends on this).
+- **Secrets from env:** broker `password` is blank in committed JSON, supplied via env (mirror `ServerHistorian__ApiKey`). Never commit or log creds.
+- **Broker security — never ship anonymous/public-broker defaults:** default `useTls=true`, real auth. `allowUntrustedServerCertificate` + `caCertificatePath` mirror the ServerHistorian TLS knobs (dev/on-prem escape hatch, off by default). Fixtures run auth+TLS.
+- **DriverType string is `"Mqtt"`** everywhere (driver page, probe, factory, editor map, validator, browser). One constant `DriverTypeNames.Mqtt`; grep to enforce (heed the `ModbusTcp`/`Modbus` mismatch lesson).
+- **Live-verify discipline:** Razor binding + deploy-inertness bugs pass unit tests. Every picker/editor/deploy path gets a docker-dev `/run` live-verify (Tasks 14 + 26).
+- **New-project csproj:** `net10.0`, `Nullable` + `ImplicitUsings` enabled, `TreatWarningsAsErrors=true` opted in per-csproj (not global).
+
+---
+
+## Task 0 (P1): Dependency-validation spike — MQTTnet-5 pin + net10 restore/build
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none (this is the gate — the design's #1 dependency risk; nothing else starts until it is green)
+**Files:**
+- Modify: `Directory.Packages.props` (add `<PackageVersion Include="MQTTnet" Version="5.x" />`)
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts.csproj` (temporary spike form — references `MQTTnet` only to prove the graph restores; the transport ref is removed in Task 1, `.Contracts` is transport-free)
+- Modify: `ZB.MOM.WW.OtOpcUa.slnx` (add the project)
+
+**Why first:** The design (§2.1, §10) makes this the top dependency risk — the repo uses central package management with `CentralPackageTransitivePinningEnabled` **deliberately OFF** (Roslyn 5.0.0/4.12.0 split, `Directory.Packages.props:103` comment + "Transitive pinning breaks Roslyn build" memory). We must prove **MQTTnet v5 restores and builds clean on net10 in this exact pinning configuration** before writing any driver code. Fresh-restore red-vs-local-green (the NU1903 memory) also means we validate a clean restore, not just an incremental one.
+
+### Steps
+1. Confirm on NuGet the exact latest **MQTTnet v5** version carrying a `net10.0` TFM; pin that exact version in `Directory.Packages.props` (alphabetical position near `MessagePack`).
+2. Scaffold the `.Contracts` csproj (net10.0, nullable, implicit usings, TWAE) with a single `<PackageReference Include="MQTTnet" />` (no `Version` — central management supplies it). Add to `slnx`.
+3. Re-verify the two external-library record claims (design §2.1 checkbox): (a) MQTTnet v5 net10.0 TFM exists; (b) SparkplugNet still transitively pins MQTTnet 4.3.x with no net10.0 TFM. Record the confirmed versions in the tasks.json note. The hand-roll decision does not hinge on (b) — it is a confirm-the-record check.
+4. Prove a **clean** restore + build:
+```bash
+dotnet restore src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts   # expect: no NU1605/NU1608 version-conflict, no NU1903 audit error
+dotnet build   src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts   # expect: Build succeeded, 0 warnings (TWAE on)
+rm -rf ~/.nuget/packages/mqttnet && dotnet restore src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts  # fresh-restore proof
+```
+**Expected:** all three succeed with zero version-conflict / transitive-pin / audit errors. If restore fails on a 4/5 diamond or a missing net10 TFM, STOP — the hand-roll-Tahu decision (§2.1) is vindicated but the MQTTnet-5 pin itself is the blocker; resolve the exact version before proceeding.
+5. Commit:
+```bash
+git commit -am "feat(mqtt): validate MQTTnet-5/net10 restore under central pinning (spike, P1 gate)
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"
+```
+
+---
+
+## Task 1 (P1): `.Contracts` — enums + `MqttDriverOptions` DTO
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none (Task 2 depends on this)
+**Files:**
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts.csproj` (drop the temporary MQTTnet ref from Task 0 — `.Contracts` is transport-free; reference only `Core.Abstractions`)
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/MqttMode.cs` (`Plain | SparkplugB`)
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/MqttPayloadFormat.cs` (`Json | Raw | Scalar`)
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/MqttProtocolVersion.cs` (`V311 | V500`)
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/MqttDriverOptions.cs` (broker conn + mode + `sparkplug`/`plain` sub-objects, §5.1)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests.csproj` (net10, xUnit + Shouldly)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttDriverOptionsTests.cs`
+- Modify: `ZB.MOM.WW.OtOpcUa.slnx`
+
+### Steps (TDD)
+1. Write the failing test — options round-trip enum-as-name:
+```csharp
+public sealed class MqttDriverOptionsTests
+{
+    private static readonly JsonSerializerOptions J = new()
+    {
+        PropertyNameCaseInsensitive = true,
+        UnmappedMemberHandling = JsonUnmappedMemberHandling.Skip,
+        Converters = { new JsonStringEnumConverter() },
+    };
+
+    [Fact]
+    public void Deserialize_SparkplugConfig_ReadsModeAndSubObject()
+    {
+        const string json = """
+        { "host":"10.100.0.35","port":8883,"useTls":true,"mode":"SparkplugB",
+          "sparkplug":{"groupId":"Plant1","hostId":"h1","requestRebirthOnGap":true} }
+        """;
+        var o = JsonSerializer.Deserialize<MqttDriverOptions>(json, J)!;
+        o.Mode.ShouldBe(MqttMode.SparkplugB);
+        o.UseTls.ShouldBeTrue();
+        o.Sparkplug!.GroupId.ShouldBe("Plant1");
+        o.Plain.ShouldBeNull();
+    }
+
+    [Fact]
+    public void Serialize_WritesEnumsAsNames_NotOrdinals()
+    {
+        var s = JsonSerializer.Serialize(new MqttDriverOptions { Mode = MqttMode.Plain }, J);
+        s.ShouldContain("\"Plain\"");
+        s.ShouldNotContain("\"mode\":0");
+    }
+}
+```
+2. Run — expect FAIL (types don't exist):
+```bash
+dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests   # RED
+```
+3. Implement the enums + `MqttDriverOptions` (with nested `MqttSparkplugOptions` / `MqttPlainOptions`) matching §5.1 defaults (`useTls=true`, `connectTimeoutSeconds=15`, `reconnectMin/MaxBackoffSeconds=1/30`). Wire the test csproj into `slnx`.
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): Contracts options DTO + enums (name-serialized)"` (+ session trailer).
+
+---
+
+## Task 2 (P1): `.Contracts` — `MqttTagDefinition` + `MqttEquipmentTagParser` (plain)
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none (Task 6 depends on the resolver)
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/MqttTagDefinition.cs` (parsed per-tag descriptor — carries plain OR sparkplug variant fields; plain fields populated in P1)
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/MqttEquipmentTagParser.cs` (`TryParse(reference, out def)` + `Inspect(reference)`, mirrors `ModbusEquipmentTagParser` / `ModbusTagDefinitionFactory`)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttEquipmentTagParserTests.cs`
+
+### Steps (TDD)
+1. Failing tests — parse a plain TagConfig blob, reject a typo'd enum (strict), and reject a wildcard topic:
+```csharp
+[Fact]
+public void TryParse_PlainJsonBlob_PopulatesTopicAndPath()
+{
+    const string r = """{"topic":"factory/oven/temp","payloadFormat":"Json","jsonPath":"$.value","dataType":"Double","qos":1}""";
+    MqttEquipmentTagParser.TryParse(r, out var def).ShouldBeTrue();
+    def!.Topic.ShouldBe("factory/oven/temp");
+    def.PayloadFormat.ShouldBe(MqttPayloadFormat.Json);
+    def.Name.ShouldBe(r);   // the def Name == reference string (forward-router key)
+}
+
+[Fact]
+public void TryParse_TypoedPayloadFormat_RejectsStrict()
+    => MqttEquipmentTagParser.TryParse(
+        """{"topic":"a/b","payloadFormat":"Jason","dataType":"Double"}""", out _).ShouldBeFalse();
+
+[Fact]
+public void Inspect_WildcardTopic_ReturnsWarning()
+    => MqttEquipmentTagParser.Inspect("""{"topic":"a/+/c","payloadFormat":"Raw"}""").ShouldNotBeEmpty();
+```
+2. Run — expect FAIL.
+3. Implement: a leading `{` marks a TagConfig blob; use `TagConfigJson.TryReadEnumStrict` for `payloadFormat`/`dataType` (typo → `false` → `BadNodeIdUnknown` upstream). `def.Name = reference`. `Inspect` returns a deploy-time warning list for present-but-invalid enums / unparseable blobs / wildcard tag-topics. Leave Sparkplug-descriptor parsing as a stub the P2 tasks fill (`groupId`/`edgeNodeId`/`deviceId`/`metricName`).
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): plain tag parser + strict-enum descriptor"` (+ trailer).
+
+---
+
+## Task 3 (P1): `.Driver` project + `MqttConnection` connect/TLS/auth (bounded)
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none (Task 4 extends `MqttConnection`)
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.csproj` (net10, refs `.Contracts` + `Core.Abstractions` + `Core` + `MQTTnet`)
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/MqttConnection.cs` (MQTTnet-5 client wrapper: build options from `MqttDriverOptions` incl. TLS + CA-pin + credentials; `ConnectAsync(ct)` under `connectTimeoutSeconds` linked-CTS)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttConnectionTests.cs`
+- Modify: `ZB.MOM.WW.OtOpcUa.slnx`
+
+### Steps (TDD)
+1. Failing test — bounded connect against a dead endpoint fails fast (no hang), and TLS-option assembly honours the knobs. Use a closed loopback port for the deadline test:
+```csharp
+[Fact]
+public async Task ConnectAsync_DeadBroker_FailsWithinDeadline_NoHang()
+{
+    var opts = new MqttDriverOptions { Host = "127.0.0.1", Port = 1, UseTls = false, ConnectTimeoutSeconds = 2 };
+    var conn = new MqttConnection(opts, driverId: "t", logger: null);
+    var sw = Stopwatch.StartNew();
+    await Should.ThrowAsync<Exception>(() => conn.ConnectAsync(CancellationToken.None));
+    sw.Elapsed.ShouldBeLessThan(TimeSpan.FromSeconds(5));   // deadline honoured, not wedged
+}
+
+[Fact]
+public void BuildClientOptions_UseTlsWithCaPin_SetsTlsAndValidatesChain()
+{
+    var opts = new MqttDriverOptions { Host="h", Port=8883, UseTls=true,
+        AllowUntrustedServerCertificate=false, CaCertificatePath="/tmp/ca.pem" };
+    var built = MqttConnection.BuildClientOptions(opts, clientIdSuffix: null);
+    built.ChannelOptions.ShouldBeOfType<MqttClientTcpOptions>().TlsOptions.UseTls.ShouldBeTrue();
+}
+```
+2. Run — expect FAIL.
+3. Implement `MqttConnection`: static `BuildClientOptions(opts, clientIdSuffix)` (host/port, protocol version, clientId + optional suffix, keep-alive, clean-session, credentials, TLS with `AllowUntrustedServerCertificate` → custom cert validator, `CaCertificatePath` → chain pin). `ConnectAsync(ct)` links `ct` with a `connectTimeoutSeconds` CTS. Ctor stores options only — connection-free.
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): MqttConnection connect/TLS/auth under bounded deadline"` (+ trailer).
+
+---
+
+## Task 4 (P1): `MqttConnection` hand-rolled reconnect loop (backoff + resubscribe)
+
+**Classification:** high-risk
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/MqttConnection.cs` (reconnect loop: exponential backoff `min→max`; on `DisconnectedAsync` schedule reconnect; on reconnect fire a `Reconnected` callback so the driver re-subscribes; expose `State` = Connected/Reconnecting/Faulted + `LastMessageAgeUtc`)
+- Modify: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttConnectionTests.cs`
+
+**Why high-risk:** MQTTnet v5 dropped v4's `ManagedMqttClient` (§8) — there is no library-managed reconnect. Subscriptions do not survive a clean session; a reconnect that forgets to re-subscribe silently goes dark. Backoff that ignores its cap can hot-loop a dead broker.
+
+### Steps (TDD)
+1. Failing tests — backoff schedule is bounded + monotone-to-cap, and a `Reconnected` event drives a re-subscribe callback. Test the backoff calculator as a pure function (no live broker):
+```csharp
+[Theory]
+[InlineData(0, 1)] [InlineData(1, 2)] [InlineData(2, 4)] [InlineData(10, 30)]  // caps at max=30
+public void NextBackoff_IsExponentialClampedToMax(int attempt, int expectedSeconds)
+    => MqttConnection.NextBackoff(attempt, minSeconds: 1, maxSeconds: 30)
+        .ShouldBe(TimeSpan.FromSeconds(expectedSeconds));
+
+[Fact]
+public async Task OnReconnect_InvokesResubscribeCallback()
+{
+    var conn = new MqttConnection(new MqttDriverOptions(), "t", null);
+    var fired = 0; conn.Reconnected += () => { fired++; return Task.CompletedTask; };
+    await conn.RaiseReconnectedForTest();   // test seam
+    fired.ShouldBe(1);
+}
+```
+2. Run — expect FAIL.
+3. Implement: `NextBackoff(attempt, min, max)` pure; a reconnect worker that loops on disconnect with backoff, honours `cleanSession`/session-expiry, re-subscribes via the `Reconnected` callback (idempotent insurance even for persistent sessions), and (Sparkplug, P2) re-requests rebirth. `State` transitions Connected↔Reconnecting; Faulted only on unrecoverable config. Never block the MQTTnet dispatcher thread.
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): hand-rolled reconnect loop with bounded backoff + resubscribe"` (+ trailer).
+
+---
+
+## Task 5 (P1): `LastValueCache` + `IReadable`
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 6
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/LastValueCache.cs` (`FullReference → DataValueSnapshot`, thread-safe)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/LastValueCacheTests.cs`
+
+### Steps (TDD)
+1. Failing test — unseen reference returns a per-ref `GoodNoData`/uncertain snapshot (never throws the batch); a seeded ref returns last value:
+```csharp
+[Fact]
+public void Read_UnseenRef_ReturnsPerRefNoData_DoesNotThrow()
+{
+    var c = new LastValueCache();
+    var snap = c.Read("factory/oven/temp#$.value");
+    snap.StatusCode.ShouldBe(StatusCodes.GoodNoData);   // or Uncertain — per IReadable contract, per-ref status
+}
+
+[Fact]
+public void Update_ThenRead_ReturnsLastValue()
+{
+    var c = new LastValueCache();
+    c.Update("k", DataValueSnapshot.Good(42.0, DateTime.UtcNow));
+    c.Read("k").Value.ShouldBe(42.0);
+}
+```
+2. Run — expect FAIL.
+3. Implement `LastValueCache` (concurrent dict); `MqttDriver.ReadAsync` (Task 7) returns `references.Select(cache.Read)` — batch never throws, per-ref `StatusCode` carries "not yet observed".
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): last-value cache backing IReadable (per-ref no-data)"` (+ trailer).
+
+---
+
+## Task 6 (P1): `ISubscribable` — plain topic subscribe → `OnDataChange` + retained seed
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 5
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/MqttSubscriptionManager.cs` (registers `FullReference → MqttTagDefinition` via the shared `EquipmentTagRefResolver<MqttTagDefinition>`; dedupes/coalesces topics; on message: match topic → authored tag(s), extract value at `jsonPath`/raw/scalar, raise `OnDataChange`; seed from retained message on subscribe)
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/MqttConnection.cs` (expose `SubscribeAsync(filters, ct)` under a bounded deadline + a message-received event)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttSubscriptionManagerTests.cs`
+
+### Steps (TDD)
+1. Failing test — feed a synthetic received message through the manager (no live broker); assert routing + JSONPath extraction fire `OnDataChange` with the right `FullReference`:
+```csharp
+[Fact]
+public void OnMessage_MatchingTopic_RaisesDataChangeAtJsonPath()
+{
+    var mgr = new MqttSubscriptionManager();
+    var handle = mgr.Register(new[] { """{"topic":"f/oven/temp","payloadFormat":"Json","jsonPath":"$.value","dataType":"Double"}""" });
+    string? gotRef = null; object? gotVal = null;
+    mgr.OnDataChange += (_, e) => { gotRef = e.FullReference; gotVal = e.Snapshot.Value; };
+    mgr.HandleMessage("f/oven/temp", """{"value":21.5}"""u8.ToArray(), retained: false);
+    gotVal.ShouldBe(21.5);
+    gotRef.ShouldContain("f/oven/temp");
+}
+
+[Fact]
+public void OnMessage_UnauthoredTopic_RaisesNothing()  // chatty broker must not auto-provision
+{
+    var mgr = new MqttSubscriptionManager();
+    mgr.Register(Array.Empty<string>());
+    var fired = false; mgr.OnDataChange += (_, _) => fired = true;
+    mgr.HandleMessage("random/topic", "1"u8.ToArray(), retained: false);
+    fired.ShouldBeFalse();
+}
+```
+2. Run — expect FAIL.
+3. Implement using `EquipmentTagRefResolver<MqttTagDefinition>` (parse-once cache, as Modbus does). `HandleMessage` matches topic → tag(s), extracts (Json→JSONPath token→typed value; Raw→bytes-as-string; Scalar→parse), updates `LastValueCache`, raises `OnDataChange`. Retained-flagged messages seed initial value. `SubscribeAsync` returns an `ISubscriptionHandle` whose `DiagnosticId` names mode+filter; completes under a bounded SUBACK deadline (SUBACK failure → per-ref Bad, not hang).
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): plain subscribe→OnDataChange with retained seed + ref resolver"` (+ trailer).
+
+---
+
+## Task 7 (P1): `MqttDriver` shell — `IDriver` + authored-only `ITagDiscovery` + `IHostConnectivityProbe`
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none (Task 8/9 wire it)
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/MqttDriver.cs` (`IDriver, ITagDiscovery, ISubscribable, IReadable, IHostConnectivityProbe, IRediscoverable`; composes `MqttConnection` + `MqttSubscriptionManager` + `LastValueCache`)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttDriverDiscoveryTests.cs`
+
+### Steps (TDD)
+1. Failing test — `DiscoverAsync` streams **only authored tags** into a capturing `IAddressSpaceBuilder`; plain-mode `RediscoverPolicy == Once`; `SupportsOnlineDiscovery == false`:
+```csharp
+[Fact]
+public async Task DiscoverAsync_Plain_StreamsAuthoredTagsOnly_PolicyOnce()
+{
+    var driver = new MqttDriver(new MqttDriverOptions { Mode = MqttMode.Plain }, "d", null);
+    driver.SetAuthoredTagsForTest(new[] { """{"topic":"f/t","payloadFormat":"Raw","dataType":"String"}""" });
+    var b = new CapturingAddressSpaceBuilder();
+    await driver.DiscoverAsync(b, CancellationToken.None);
+    b.Variables.Count.ShouldBe(1);
+    driver.RediscoverPolicy.ShouldBe(DiscoveryRediscoverPolicy.Once);
+    ((ITagDiscovery)driver).SupportsOnlineDiscovery.ShouldBeFalse();
+}
+```
+2. Run — expect FAIL.
+3. Implement: `InitializeAsync` deserializes options (shared `JsonSerializerOptions`), builds + connects `MqttConnection`, subscribes the mode-appropriate filter. `ReinitializeAsync` applies deltas in place (never crash → Faulted). `ShutdownAsync` disconnects/disposes. `GetHealth` = Connected/Reconnecting/Faulted + last-message-age. `GetMemoryFootprint` = caches; `FlushOptionalCachesAsync` = no-op (birth/alias are correctness state — forbidden to flush; last-value backs `IReadable`). `DiscoverAsync` replays authored tags only; `RediscoverPolicy => Once` (plain). `IRediscoverable.OnRediscoveryNeeded` never fires in plain mode.
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): MqttDriver shell — lifecycle + authored-only discovery (Once)"` (+ trailer).
+
+---
+
+## Task 8 (P1): `MqttDriverProbe` — CONNECT handshake
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 10
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/MqttDriverProbe.cs` (`IDriverProbe`, `DriverType => "Mqtt"`; parse config with the shared options, open a CONNECT under the timeout, green + latency on CONNACK-accepted, targeted error on refused/TLS/auth/timeout — mirrors `ModbusDriverProbe`)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttDriverProbeTests.cs`
+
+### Steps (TDD)
+1. Failing test — `DriverType` is `"Mqtt"`; a dead endpoint yields a failed (not thrown) probe result within the deadline:
+```csharp
+[Fact]
+public void DriverType_IsCanonicalMqtt() => new MqttDriverProbe().DriverType.ShouldBe("Mqtt");
+
+[Fact]
+public async Task ProbeAsync_DeadBroker_ReturnsFailedResult_WithinDeadline()
+{
+    var r = await new MqttDriverProbe().ProbeAsync(
+        """{"host":"127.0.0.1","port":1,"useTls":false,"connectTimeoutSeconds":2}""", CancellationToken.None);
+    r.Success.ShouldBeFalse();
+    r.Message.ShouldNotBeNullOrEmpty();
+}
+```
+2. Run — expect FAIL.
+3. Implement; CONNACK-accepted is the MQTT "device is answering" proof. Use the **shared** `JsonSerializerOptions` (enum-as-name).
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): MqttDriverProbe CONNECT handshake"` (+ trailer).
+
+---
+
+## Task 9 (P1): Factory + `DriverTypeNames.Mqtt` + Host registration
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/MqttDriverFactoryExtensions.cs` (`DriverTypeName = "Mqtt"`, shared `JsonSerializerOptions`, `Register(registry, loggerFactory)` — mirror `OpcUaClientDriverFactoryExtensions`)
+- Modify: `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverTypeNames.cs` (add `public const string Mqtt = "Mqtt";` + append to the `All` list)
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.Host/Drivers/DriverFactoryBootstrap.cs` (add `Driver.Mqtt.MqttDriverFactoryExtensions.Register(registry, loggerFactory);` in `Register(...)` near line 146; add `using MqttProbe = Driver.Mqtt.MqttDriverProbe;` + `services.TryAddEnumerable(ServiceDescriptor.Singleton<IDriverProbe, MqttProbe>());` in `AddOtOpcUaDriverProbes` near line 124)
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.Host/ZB.MOM.WW.OtOpcUa.Host.csproj` (ProjectReference the `.Driver` assembly)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttDriverFactoryExtensionsTests.cs`
+
+### Steps (TDD)
+1. Failing test — `Register` binds the `"Mqtt"` type, and the factory builds an `MqttDriver` from JSON with string enums:
+```csharp
+[Fact]
+public void Register_ThenCreate_BuildsMqttDriver()
+{
+    var registry = new DriverFactoryRegistry();
+    MqttDriverFactoryExtensions.Register(registry);
+    var d = registry.Create("Mqtt", "d1", """{"host":"h","port":1883,"mode":"Plain"}""");
+    d.ShouldBeOfType<MqttDriver>();
+}
+
+[Fact]
+public void DriverTypeName_MatchesConstant()
+    => MqttDriverFactoryExtensions.DriverTypeName.ShouldBe(DriverTypeNames.Mqtt);
+```
+2. Run — expect FAIL.
+3. Implement + wire both host sites. Build the whole solution to confirm registration compiles:
+```bash
+dotnet build ZB.MOM.WW.OtOpcUa.slnx   # expect: Build succeeded
+```
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): factory + DriverTypeNames.Mqtt + host factory/probe registration"` (+ trailer).
+
+---
+
+## Task 10 (P1): `.Browser` — bespoke `#`-observation browser (passive)
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 8
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser.csproj` (net10, refs `.Contracts` + `Commons(.Browsing)` + `MQTTnet`)
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser/MqttDriverBrowser.cs` (`IDriverBrowser`, `DriverType => "Mqtt"`; `OpenAsync` connects with a `{clientId}-browse-{guid8}` suffix under a clamped 5–30 s budget; subscribes `#`/`{topicPrefix}#`; returns `MqttBrowseSession`; **publishes nothing**)
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser/MqttBrowseSession.cs` (`IBrowseSession` over a thread-safe accumulating observed tree; `RootAsync`/`ExpandAsync` split topic segments on `/`, leaf = `Kind=Leaf`; `AttributesAsync` = synthetic attribute w/ inferred type + last payload snippet; `DisposeAsync` disconnects best-effort)
+- Modify: `ZB.MOM.WW.OtOpcUa.slnx`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttBrowseSessionTests.cs`
+
+### Steps (TDD)
+1. Failing test — feed observed topics into the session's accumulating tree (test seam, no live broker); assert `RootAsync`/`ExpandAsync` build the segment tree and **no publish** occurs on any browse call:
+```csharp
+[Fact]
+public async Task ExpandAsync_BuildsTopicSegmentTree_FromObservedTopics()
+{
+    var s = new MqttBrowseSession(MqttMode.Plain);
+    s.ObserveTopicForTest("factory/line3/oven/temp");
+    var root = await s.RootAsync(CancellationToken.None);
+    root.ShouldContain(n => n.BrowseName == "factory");
+    var lvl2 = await s.ExpandAsync("factory", CancellationToken.None);
+    lvl2.ShouldContain(n => n.BrowseName == "line3");
+}
+
+[Fact]
+public async Task BrowseCalls_PublishNothing()   // browse is read-only
+{
+    var s = new MqttBrowseSession(MqttMode.Plain);
+    await s.RootAsync(CancellationToken.None);
+    s.PublishCountForTest.ShouldBe(0);
+}
+```
+2. Run — expect FAIL.
+3. Implement the accumulating tree + passive `OpenAsync`. In P1 only the plain `#` path is live; leave a Sparkplug hook the P2 tasks fill (`Group→EdgeNode→Device→Metric` + `RequestRebirthAsync`).
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): bespoke passive #-observation browser (plain)"` (+ trailer).
+
+---
+
+## Task 11 (P1): Register the bespoke browser (overrides universal fallback)
+
+**Classification:** trivial
+**Estimated implement time:** ~3 min
+**Parallelizable with:** Task 12
+**Files:**
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/EndpointRouteBuilderExtensions.cs` (add `services.AddSingleton<IDriverBrowser, MqttDriverBrowser>();` alongside the existing two near line 75–76)
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/ZB.MOM.WW.OtOpcUa.AdminUI.csproj` (ProjectReference `.Browser`)
+
+### Steps
+1. Add the registration + project reference. Registering for `DriverType="Mqtt"` overrides the universal fallback (`BrowserSessionService` resolves bespoke-first).
+2. Build: `dotnet build src/Server/ZB.MOM.WW.OtOpcUa.AdminUI` — expect success.
+3. Commit: `git commit -am "feat(mqtt): register MqttDriverBrowser (bespoke-first for Mqtt)"` (+ trailer).
+
+---
+
+## Task 12 (P1): Typed AdminUI editor + validator (plain shape)
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 11
+**Files:**
+- Create: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Uns/TagEditors/MqttTagConfigModel.cs` (thin typed model over a preserved `JsonObject` key bag; `FromJson`/`ToJson`/`Validate`, preserves unknown keys incl. history keys; carries a `Mode` field selecting sub-shape — P1 implements Plain `Validate`, Sparkplug stub filled in Task 24)
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Uns/TagEditors/TagConfigEditorMap.cs` (`[DriverTypeNames.Mqtt] = typeof(Components.Shared.Uns.TagEditors.MqttTagConfigEditor)`)
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Uns/TagEditors/TagConfigValidator.cs` (`[DriverTypeNames.Mqtt] = j => MqttTagConfigModel.FromJson(j).Validate()`)
+- Create: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Uns/TagEditors/MqttTagConfigEditor.razor` (copy the Modbus editor template — mode-switch at top, per-mode field group, client-side `Validate()`)
+- Create: `tests/Server/.../MqttTagConfigModelTests.cs` (co-locate with the existing AdminUI test project — verify path with `find tests/Server -name "*TagConfigModel*Tests.cs"`)
+
+### Steps (TDD)
+1. Failing test — round-trip preserves unknown/history keys; plain `Validate` requires concrete topic + jsonPath-when-Json; re-derives `FullName`:
+```csharp
+[Fact]
+public void FromJson_ToJson_PreservesUnknownKeys()
+{
+    var m = MqttTagConfigModel.FromJson("""{"topic":"a/b","payloadFormat":"Raw","dataType":"String","isHistorized":true}""");
+    m.ToJson().ShouldContain("isHistorized");
+}
+
+[Fact]
+public void Validate_PlainWildcardTopic_Fails()
+    => MqttTagConfigModel.FromJson("""{"topic":"a/+/c","payloadFormat":"Raw","dataType":"String"}""")
+        .Validate().ShouldNotBeEmpty();
+
+[Fact]
+public void Validate_JsonWithoutPath_Fails()
+    => MqttTagConfigModel.FromJson("""{"topic":"a/b","payloadFormat":"Json","dataType":"Double"}""")
+        .Validate().ShouldNotBeEmpty();
+```
+2. Run — expect FAIL.
+3. Implement the model (mirror `OpcUaClientTagConfigModel`); `ToJson` writes PascalCase `FullName` re-derived from descriptor (`{topic}#{jsonPath}` plain). Build the `.razor`. Register both map entries.
+4. Run — expect PASS + `dotnet build src/Server/ZB.MOM.WW.OtOpcUa.AdminUI`.
+5. Commit: `git commit -am "feat(mqtt): typed tag editor + validator (plain mode)"` (+ trailer).
+
+---
+
+## Task 13 (P1): Mosquitto + JSON-publisher fixture (TLS+auth) + env-gated live suite
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests.csproj`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/Docker/docker-compose.yml` (`eclipse-mosquitto` with **auth + TLS** on `:8883`, plain `:1883` for smoke only; a JSON-publisher container emitting `retain=true` JSON on a few topics — `mosquitto_pub` loop or `paho-mqtt` script; `project=lmxopcua` label applied host-side)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/Docker/mosquitto.conf` + password/cert material generator script (creds via env, never real secrets committed)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/PlainMqttLiveTests.cs` (category `LiveIntegration`, gated on `MQTT_FIXTURE_ENDPOINT` — skips clean when unset → macOS-offline-safe)
+- Modify: `ZB.MOM.WW.OtOpcUa.slnx`
+
+### Steps
+1. Write the compose with **auth + TLS** (never anonymous). Add the JSON publisher with `retain=true`.
+2. Write env-gated tests: connect/TLS/auth; plain subscribe + retained-read seed; unauthored-topic silence. `[SkippableFact]` reading `MQTT_FIXTURE_ENDPOINT`.
+3. Confirm offline skip:
+```bash
+dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests   # expect: all Skipped (no env var)
+```
+4. Deploy the fixture to the docker host and run live (design §9):
+```bash
+lmxopcua-fix sync mqtt && lmxopcua-fix up mqtt
+export MQTT_FIXTURE_ENDPOINT=10.100.0.35:8883
+dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests --filter "Category=LiveIntegration"   # expect: PASS
+```
+5. Commit: `git commit -am "test(mqtt): Mosquitto TLS+auth fixture + env-gated plain live suite"` (+ trailer).
+
+---
+
+## Task 14 (P1): Live `/run` verify on docker-dev — **P1 MILESTONE COMPLETE**
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Modify: `CLAUDE.md` (add the MQTT fixture endpoint to the Docker Workflow endpoint list: `10.100.0.35:1883/8883`, `MQTT_FIXTURE_ENDPOINT`)
+- Modify: `docs/plans/2026-07-15-driver-expansion-tracking.md` (mark MQTT P1 code-complete)
+
+### Steps
+1. On docker-dev (`:9200`, login disabled — run it yourself, do not defer): author an `Mqtt` driver (Plain mode) + a tag via the `/uns` picker (bespoke `#`-observation browser) or the typed editor; deploy.
+2. Confirm via Client.CLI the node carries live broker values:
+```bash
+dotnet run --project src/Client/ZB.MOM.WW.OtOpcUa.Client.CLI -- read -u opc.tcp://localhost:4840 -n "ns=2;s=<RawPath>"
+```
+3. Confirm the typed editor renders (Razor binding bugs pass unit tests — live-verify is mandatory). Update CLAUDE.md + tracking doc.
+4. Commit: `git commit -am "docs(mqtt): P1 plain-MQTT milestone live-verified; endpoint recorded"` (+ trailer).
+
+---
+
+# ── P2: Sparkplug B ingest (builds on the P1 skeleton) ──
+
+## Task 15 (P2): Vendor Tahu proto + `Grpc.Tools` codegen
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none (P2 root)
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/Protos/sparkplug_b.proto` (vendored Eclipse Tahu `sparkplug_b.proto`, pinned to a known Tahu commit with a provenance comment header)
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts.csproj` (add `Google.Protobuf` + build-time `Grpc.Tools` (`PrivateAssets=all`); `<Protobuf Include="Protos/sparkplug_b.proto" GrpcServices="None" />` — message-only codegen, this repo's first in-repo protoc step)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/SparkplugProtoCodegenTests.cs`
+
+### Steps (TDD)
+1. Failing test — the generated `Payload`/`Metric` types exist and round-trip a hand-built payload:
+```csharp
+[Fact]
+public void GeneratedPayload_RoundTrips()
+{
+    var p = new Org.Eclipse.Tahu.Protobuf.Payload { Seq = 3 };
+    p.Metrics.Add(new Org.Eclipse.Tahu.Protobuf.Payload.Types.Metric { Name = "Temperature", Alias = 5 });
+    var back = Org.Eclipse.Tahu.Protobuf.Payload.Parser.ParseFrom(p.ToByteArray());
+    back.Seq.ShouldBe(3ul);
+    back.Metrics[0].Alias.ShouldBe(5ul);
+}
+```
+2. Run — expect FAIL (no generated types).
+3. Vendor the proto (provenance comment: Tahu commit hash + URL); wire `Grpc.Tools`. If in-repo protoc proves objectionable, fall back to checking in the generated C# with the same provenance comment (design §2.1). Build:
+```bash
+dotnet build src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts   # expect: proto compiles, 0 warnings
+```
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): vendor Tahu sparkplug_b.proto + Grpc.Tools codegen"` (+ trailer).
+
+---
+
+## Task 16 (P2): `SparkplugCodec` decode + golden payloads
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 17
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/Sparkplug/SparkplugCodec.cs` (decode `Payload`/`Metric` from wire bytes → a driver-side struct; encode NCMD deferred to `RebirthRequester` Task 20 / write-through P3)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/SparkplugCodecTests.cs`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/Golden/nbirth.bin` + `ndata.bin` (golden byte vectors, generated once from a hand-built payload and committed)
+
+### Steps (TDD)
+1. Failing test — decode a golden NBIRTH: seq + metric name/alias/datatype/value survive:
+```csharp
+[Fact]
+public void Decode_GoldenNbirth_ExtractsMetrics()
+{
+    var payload = SparkplugCodec.Decode(File.ReadAllBytes("Golden/nbirth.bin"));
+    payload.Seq.ShouldBe((byte)0);
+    payload.Metrics.ShouldContain(m => m.Name == "Temperature" && m.Alias == 5 && m.DataType == SparkplugDataType.Float);
+}
+```
+2. Run — expect FAIL.
+3. Implement `SparkplugCodec.Decode`; generate the golden vectors in a one-off `[Fact(Skip="generator")]` or a small helper, commit the `.bin` files.
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): SparkplugCodec decode + golden payload vectors"` (+ trailer).
+
+---
+
+## Task 17 (P2): `SparkplugTopic` + `SparkplugDataType.ToDriverDataType`
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 16
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/Sparkplug/SparkplugTopic.cs` (parse/format `spBv1.0/{group}/{type}/{node}[/{device}]`; `type` ∈ NBIRTH/DBIRTH/NDATA/DDATA/NDEATH/DDEATH/NCMD/DCMD/STATE)
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/SparkplugDataType.cs` (enum + `ToDriverDataType()` per the §3.5 map: Int8→Int16, UInt8→UInt16, DataSet/Template unsupported, `*Array`→element+IsArray)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/SparkplugTopicTests.cs`
+
+### Steps (TDD)
+1. Failing tests — topic parse extracts group/type/node/device; datatype map widens Int8→Int16 and marks DataSet unsupported:
+```csharp
+[Fact]
+public void Parse_DeviceData_ExtractsAllSegments()
+{
+    var t = SparkplugTopic.Parse("spBv1.0/Plant1/DDATA/EdgeA/Filler1");
+    t.GroupId.ShouldBe("Plant1"); t.Type.ShouldBe(SparkplugMessageType.DDATA);
+    t.EdgeNodeId.ShouldBe("EdgeA"); t.DeviceId.ShouldBe("Filler1");
+}
+
+[Theory]
+[InlineData(SparkplugDataType.Int8, DriverDataType.Int16)]
+[InlineData(SparkplugDataType.UInt8, DriverDataType.UInt16)]
+[InlineData(SparkplugDataType.Float, DriverDataType.Float32)]
+public void ToDriverDataType_MapsAndWidens(SparkplugDataType s, DriverDataType d)
+    => s.ToDriverDataType().ShouldBe(d);
+```
+2. Run — expect FAIL.
+3. Implement.
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): Sparkplug topic parse + datatype map"` (+ trailer).
+
+---
+
+## Task 18 (P2): `BirthCache` + `AliasTable` — bind-by-name, rebuild-per-birth
+
+**Classification:** high-risk
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 19
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/Sparkplug/AliasTable.cs` (per `(edgeNode,device)` alias→(name,datatype); **rebuilt wholesale each birth, never merged**)
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/Sparkplug/BirthCache.cs` (NBIRTH/DBIRTH metric catalog: name/alias/datatype/last value)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/AliasBindingTests.cs`
+
+**Why high-risk:** §3.6 invariants #1–#2 — binding data by alias silently mis-routes when an alias is reused for a different metric across a rebirth. Bind by **stable metric NAME**; the alias is a per-birth cache only.
+
+### Steps (TDD)
+1. Failing tests — the two load-bearing invariants:
+```csharp
+[Fact]
+public void Rebirth_ReusesAliasForDifferentMetric_ResolvesByName_NotAlias()
+{
+    var t = new AliasTable();
+    t.RebuildFromBirth(new[] { (name:"Temperature", alias:5ul, dt:SparkplugDataType.Float) });
+    t.Resolve(alias: 5).Name.ShouldBe("Temperature");
+    // rebirth: alias 5 now means a DIFFERENT metric
+    t.RebuildFromBirth(new[] { (name:"Pressure", alias:5ul, dt:SparkplugDataType.Float) });
+    t.Resolve(alias: 5).Name.ShouldBe("Pressure");   // wholesale replace, not merge
+}
+
+[Fact]
+public void RebuildFromBirth_DoesNotMergeStaleAliases()
+{
+    var t = new AliasTable();
+    t.RebuildFromBirth(new[] { (name:"A", alias:1ul, dt:SparkplugDataType.Int32) });
+    t.RebuildFromBirth(new[] { (name:"B", alias:2ul, dt:SparkplugDataType.Int32) });
+    t.TryResolve(alias: 1, out _).ShouldBeFalse();   // alias 1 gone after rebirth
+}
+```
+2. Run — expect FAIL.
+3. Implement — `RebuildFromBirth` replaces the whole map. `BirthCache` keeps the metric catalog + last value keyed by name.
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): AliasTable/BirthCache — bind-by-name, rebuild-per-birth"` (+ trailer).
+
+---
+
+## Task 19 (P2): `SequenceTracker` — seq-gap + bdSeq death-tie
+
+**Classification:** high-risk
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 18
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/Sparkplug/SequenceTracker.cs` (per edge-node `seq` 0–255 wrap gap detection; `bdSeq` ties NDEATH↔NBIRTH)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/SequenceTrackerTests.cs`
+
+**Why high-risk:** §3.6 invariant #3 — a wrong wrap boundary (255→0 is NOT a gap) either misses real gaps (stale data) or false-positives every wrap (rebirth-storm).
+
+### Steps (TDD)
+1. Failing tests — contiguous ok, wrap ok, gap detected:
+```csharp
+[Fact]
+public void Sequence_WrapAt255IsContiguous_NotAGap()
+{
+    var s = new SequenceTracker();
+    s.Accept(254).ShouldBeTrue(); s.Accept(255).ShouldBeTrue(); s.Accept(0).ShouldBeTrue();  // wrap
+}
+
+[Fact]
+public void Sequence_SkippedValue_IsGap()
+{
+    var s = new SequenceTracker();
+    s.Accept(10).ShouldBeTrue();
+    s.Accept(12).ShouldBeFalse();   // gap → caller requests rebirth
+}
+```
+2. Run — expect FAIL.
+3. Implement (next-expected = `(last+1) & 0xFF`); `bdSeq` compare helper.
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): SequenceTracker seq-gap + bdSeq death-tie"` (+ trailer).
+
+---
+
+## Task 20 (P2): `RebirthRequester` — NCMD encode
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/Sparkplug/RebirthRequester.cs` (encode an NCMD writing `Node Control/Rebirth = true` to `spBv1.0/{group}/NCMD/{node}`; publish under a bounded deadline)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/RebirthRequesterTests.cs`
+
+### Steps (TDD)
+1. Failing test — encoded NCMD carries the `Node Control/Rebirth`=true metric and targets the right topic:
+```csharp
+[Fact]
+public void BuildRebirthNcmd_EncodesControlMetric_AndTopic()
+{
+    var (topic, bytes) = RebirthRequester.Build("Plant1", "EdgeA");
+    topic.ShouldBe("spBv1.0/Plant1/NCMD/EdgeA");
+    var p = SparkplugCodec.Decode(bytes);
+    p.Metrics.ShouldContain(m => m.Name == "Node Control/Rebirth" && Equals(m.Value, true));
+}
+```
+2. Run — expect FAIL.
+3. Implement (encode path via the generated proto).
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): RebirthRequester NCMD encode"` (+ trailer).
+
+---
+
+## Task 21 (P2): Sparkplug ingest state machine — the §3.6 matrix
+
+**Classification:** high-risk
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none (integrates Tasks 16–20 into the driver)
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/Sparkplug/SparkplugIngestor.cs` (routes decoded messages: N/DBIRTH → rebuild `AliasTable` + `BirthCache`; N/DDATA → resolve alias→name → map to authored `FullReference` **by (group,node,device,metricName)** → `OnDataChange`; N/DDEATH → emit STALE/Bad snapshots; seq-gap / unknown-alias / data-before-birth → `RebirthRequester` gated on `requestRebirthOnGap`; STATE/primary-host handling; late-join rebirth on connect)
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/MqttDriver.cs` (Sparkplug-mode subscribe `spBv1.0/{group}/#` (+ STATE) → `SparkplugIngestor`; reconnect → re-subscribe + request rebirth)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/SparkplugIngestorTests.cs`
+
+**Why high-risk:** this is the §3.6 correctness core — the #1 risk in the design. Test the full matrix: rebirth, missed-birth, seq-gap, alias-reuse-across-rebirth, death→stale→rebirth.
+
+### Steps (TDD)
+1. Failing tests — the §3.6 matrix, driven through the ingestor with synthetic decoded messages (no live broker):
+```csharp
+[Fact]
+public void Birth_Then_Data_ResolvesByAlias_RaisesOnDataChangeByName()
+{
+    var ing = new SparkplugIngestor(...);   // authored tag: Plant1/EdgeA/Filler1:Temperature
+    string? firedRef = null; ing.OnDataChange += (_, e) => firedRef = e.FullReference;
+    ing.HandleDbirth("Plant1","EdgeA","Filler1", new[] { (name:"Temperature", alias:5ul, dt:SparkplugDataType.Float, val:(object)0f) });
+    ing.HandleDdata("Plant1","EdgeA","Filler1", seq:1, new[] { (alias:5ul, val:(object)21.5f) });
+    firedRef.ShouldContain("Filler1:Temperature");
+}
+
+[Fact]
+public void DataBeforeBirth_RequestsRebirth()
+{
+    var ncmds = new List<string>();
+    var ing = new SparkplugIngestor(..., publishNcmd: (t,_) => ncmds.Add(t));
+    ing.HandleDdata("Plant1","EdgeA","Filler1", seq:0, new[] { (alias:9ul, val:(object)1f) });
+    ncmds.ShouldContain("spBv1.0/Plant1/NCMD/EdgeA");
+}
+
+[Fact]
+public void Ddeath_EmitsStaleForDeviceMetrics_NextBirthRestoresGood()
+{
+    var ing = new SparkplugIngestor(...);
+    var quals = new List<StatusCode>(); ing.OnDataChange += (_, e) => quals.Add(e.Snapshot.StatusCode);
+    ing.HandleDbirth("Plant1","EdgeA","Filler1", new[] { (name:"Temperature", alias:5ul, dt:SparkplugDataType.Float, val:(object)0f) });
+    ing.HandleDdeath("Plant1","EdgeA","Filler1");
+    quals.ShouldContain(q => StatusCode.IsBad(q));   // STALE/Bad on death
+}
+```
+2. Run — expect FAIL.
+3. Implement the ingestor holding the §3.6 invariants. Route via `EquipmentTagRefResolver` keyed by `(group,node,device,metricName)`.
+4. Run — expect PASS (all matrix cases).
+5. Commit: `git commit -am "feat(mqtt): Sparkplug ingest state machine (birth/alias/seq/rebirth/death→stale)"` (+ trailer).
+
+---
+
+## Task 22 (P2): `ITagDiscovery` `UntilStable` + `IRediscoverable`
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/MqttDriver.cs` (`RediscoverPolicy => UntilStable` in Sparkplug mode — authored tags' datatypes fill in as births arrive; `DiscoverAsync` re-streams authored tags with resolved datatypes from `BirthCache`; fire `OnRediscoveryNeeded` on a **new DBIRTH** or a rebirth with a changed metric set, `ScopeHint` = edge-node/device folder path)
+- Modify: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttDriverDiscoveryTests.cs`
+
+### Steps (TDD)
+1. Failing tests — Sparkplug policy is `UntilStable`; a new DBIRTH fires `OnRediscoveryNeeded`; a tag authored before its birth picks up the birth datatype:
+```csharp
+[Fact]
+public void SparkplugMode_RediscoverPolicy_IsUntilStable()
+    => new MqttDriver(new MqttDriverOptions { Mode = MqttMode.SparkplugB }, "d", null)
+        .RediscoverPolicy.ShouldBe(DiscoveryRediscoverPolicy.UntilStable);
+
+[Fact]
+public async Task NewDbirth_FiresOnRediscoveryNeeded()
+{
+    var d = new MqttDriver(new MqttDriverOptions { Mode = MqttMode.SparkplugB }, "d", null);
+    var fired = false; ((IRediscoverable)d).OnRediscoveryNeeded += (_, _) => fired = true;
+    d.SimulateNewDbirthForTest("Plant1","EdgeA","Filler2");
+    fired.ShouldBeTrue();
+}
+```
+2. Run — expect FAIL.
+3. Implement.
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): Sparkplug UntilStable discovery + rediscover-on-DBIRTH"` (+ trailer).
+
+---
+
+## Task 23 (P2): Sparkplug browser tree + `AttributesAsync` + `RequestRebirthAsync`
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 24
+**Files:**
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser/MqttBrowseSession.cs` (Sparkplug tree Group→EdgeNode→Device→Metric from observed births; `AttributesAsync` = self-describing metric `AttributeInfo{Name, DriverDataType from birth, IsArray, SecurityClass}`; `RequestRebirthAsync(scope)` — the **only** publishing session member, scoped to selected group/edge-node, via the `RebirthRequester` path)
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser/MqttDriverBrowser.cs` (Sparkplug discovery filter `spBv1.0/{groupId}/#`; `OpenAsync` still publishes nothing)
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Browsing/BrowserSessionService.cs` (dispatch the MQTT-specific `RequestRebirthAsync` for MQTT sessions, gated by the same `DriverOperator` policy that gates the picker; Info-log the target scope)
+- Modify: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttBrowseSessionTests.cs`
+
+### Steps (TDD)
+1. Failing tests — birth-driven tree fills; `OpenAsync`/`RootAsync`/`ExpandAsync` publish **nothing**; `RequestRebirthAsync` publishes exactly one scoped NCMD:
+```csharp
+[Fact]
+public async Task SparkplugTree_FillsFromObservedBirths_BrowseNeverPublishes()
+{
+    var s = new MqttBrowseSession(MqttMode.SparkplugB);
+    s.ObserveBirthForTest("Plant1","EdgeA","Filler1","Temperature", SparkplugDataType.Float);
+    var groups = await s.RootAsync(default);
+    groups.ShouldContain(n => n.BrowseName == "Plant1");
+    s.PublishCountForTest.ShouldBe(0);   // passive
+}
+
+[Fact]
+public async Task RequestRebirthAsync_ScopedToNode_PublishesOneNcmd()
+{
+    var s = new MqttBrowseSession(MqttMode.SparkplugB);
+    s.ObserveBirthForTest("Plant1","EdgeA","Filler1","T", SparkplugDataType.Float);
+    await s.RequestRebirthAsync(scope: "Plant1/EdgeA");
+    s.PublishCountForTest.ShouldBe(1);
+}
+```
+2. Run — expect FAIL.
+3. Implement. `RequestRebirthAsync` is never fired by `OpenAsync`/`RootAsync`/`ExpandAsync` — only on explicit operator click.
+4. Run — expect PASS + `dotnet build` the AdminUI.
+5. Commit: `git commit -am "feat(mqtt): Sparkplug birth-driven browser tree + scoped Request-rebirth action"` (+ trailer).
+
+---
+
+## Task 24 (P2): AdminUI editor Sparkplug mode shape + validator
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 23
+**Files:**
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Uns/TagEditors/MqttTagConfigModel.cs` (Sparkplug `Validate`: `groupId`/`edgeNodeId`/`metricName` required, `deviceId` optional, `dataType` a known Sparkplug type; `ToJson` re-derives `FullName` = `{group}/{node}[/{device}]:{metric}`)
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Uns/TagEditors/MqttTagConfigEditor.razor` (Sparkplug field group under the mode switch)
+- Modify: `tests/Server/.../MqttTagConfigModelTests.cs`
+
+### Steps (TDD)
+1. Failing tests — Sparkplug validation + FullName derivation:
+```csharp
+[Fact]
+public void Validate_SparkplugMissingMetricName_Fails()
+    => MqttTagConfigModel.FromJson("""{"groupId":"Plant1","edgeNodeId":"EdgeA"}""").Validate().ShouldNotBeEmpty();
+
+[Fact]
+public void ToJson_Sparkplug_DerivesFullName()
+    => MqttTagConfigModel.FromJson("""{"groupId":"Plant1","edgeNodeId":"EdgeA","deviceId":"Filler1","metricName":"Temperature","dataType":"Float"}""")
+        .ToJson().ShouldContain("Plant1/EdgeA/Filler1:Temperature");
+```
+2. Run — expect FAIL.
+3. Implement.
+4. Run — expect PASS + AdminUI build.
+5. Commit: `git commit -am "feat(mqtt): typed tag editor Sparkplug mode + validation"` (+ trailer).
+
+---
+
+## Task 25 (P2): C# edge-node simulator fixture + §3.6 live matrix
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/SparkplugSimulator/` (a project-owned C# edge-node simulator using the **same** MQTTnet-5 + Tahu-proto path the driver uses — publishes NBIRTH/DBIRTH → periodic N/DDATA; honours a rebirth NCMD; injects seq-gap / alias-reuse / N/DDEATH on demand)
+- Modify: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/Docker/docker-compose.yml` (add the simulator container against the same TLS+auth Mosquitto)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/SparkplugLiveTests.cs` (category `LiveIntegration`, env-gated: birth→data→alias-resolve→OnDataChange; rebirth recovery; death→STALE; browser passive window asserts **no NCMD published by open/browse**; explicit `RequestRebirthAsync` node-vs-group enumeration)
+
+### Steps
+1. Build the simulator (encode via the same generated proto — validates encode/decode symmetry).
+2. Write env-gated live tests covering the §3.6 matrix + browser passivity.
+3. Offline skip proof:
+```bash
+dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests   # expect: Skipped without MQTT_FIXTURE_ENDPOINT
+```
+4. Deploy + run live:
+```bash
+lmxopcua-fix sync mqtt && lmxopcua-fix up mqtt sparkplug
+export MQTT_FIXTURE_ENDPOINT=10.100.0.35:8883
+dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests --filter "Category=LiveIntegration"   # expect: PASS
+```
+5. Commit: `git commit -am "test(mqtt): C# Sparkplug edge-node simulator + §3.6 live matrix"` (+ trailer).
+
+---
+
+## Task 26 (P2): Live `/run` verify Sparkplug — **P2 COMPLETE**
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Modify: `docs/plans/2026-07-15-driver-expansion-tracking.md` (mark MQTT/Sparkplug P1+P2 code-complete + live-verified)
+- Modify: `CLAUDE.md` (if a driver-fleet or endpoint fact changed; propagate to `../scadaproj/CLAUDE.md` OtOpcUa entry per the cross-repo rule)
+
+### Steps
+1. On docker-dev (`:9200`): author an `Mqtt` driver (SparkplugB mode) against the simulator; browse the birth-driven picker, click **Request rebirth**, pick a metric, deploy.
+2. Confirm live values + rediscover-on-DBIRTH + death→STALE via Client.CLI reads/subscribe.
+3. Confirm the typed editor renders both modes (live-verify — Razor bugs pass unit tests).
+4. Update tracking + (if needed) CLAUDE.md/scadaproj index.
+5. Commit: `git commit -am "docs(mqtt): Sparkplug P2 live-verified; MQTT driver complete"` (+ trailer).
+
+---
+
+## Deferred / out of scope
+
+- **Write-through (P3 in the design):** `IWritable` — Sparkplug NCMD/DCMD + plain publish, optimistic-Good + self-correct on echo (mirrors Galaxy fire-and-forget), `WriteIdempotent` default-off for non-idempotent Sparkplug commands, write-topic config. See design §3.7 + §10 (P3 row). `MqttDriver` ships **read/subscribe/discover only** in P1+P2 — its absence of `IWritable` means nodes materialize read-only.
+- **`DataSet`/`Template` Sparkplug metrics** — unsupported v1 (skip + warn, or raw-JSON as String). §3.5.
+- **`Bytes`/`File` metrics** beyond a base64/raw-String fallback. §3.5.
+- **EMQX broker** — Mosquitto is the default fixture; EMQX is the documented alternative when a dashboard/built-in Sparkplug tooling helps (§9), not built here.
+
+## Notes on ordering / parallelism
+
+- **P2 is blocked on the P1 milestone (Task 14).** Every P2 task's `blockedBy` chain roots at Task 14 so plain MQTT ships and is live-verified before Sparkplug work begins — and MQTTnet-5/net10 is proven (Task 0) before any proto/Sparkplug effort.
+- Genuine parallel pairs: 5‖6, 8‖10, 11‖12, 16‖17, 18‖19, 23‖24.
+- DRY: reuse `EquipmentTagRefResolver<MqttTagDefinition>` (as Modbus/OpcUaClient do), the shared `JsonSerializerOptions`, and one `SparkplugCodec` for both decode (ingest) and encode (rebirth NCMD). YAGNI: no write-through plumbing, no DataSet/Template, no EMQX until a need lands.
@@ -0,0 +1,315 @@
+{
+  "planPath": "docs/plans/2026-07-24-mqtt-sparkplug-driver.md",
+  "note": "Wave 2 MQTT/Sparkplug B driver. Two phases both in-scope: P1 (plain MQTT, Tasks 0-14) is a complete shippable milestone; P2 (Sparkplug B ingest, Tasks 15-26) builds on it and every P2 task chains back to Task 14. Write-through (NCMD/DCMD/plain publish) is DEFERRED (design P3). Hard rules: Task 0 (MQTTnet-5/net10 restore+build under central pinning with transitive pinning OFF) is the mandatory FIRST gate. Hand-roll Tahu proto over ONE MQTTnet-5 client (NOT SparkplugNet \u2014 its MQTTnet-4.x transitive pin collides with the repo's deliberately-OFF CentralPackageTransitivePinning). DriverType string is 'Mqtt' everywhere (grep-enforced). Enum-serialization trap: every JSON seam uses shared JsonSerializerOptions with JsonStringEnumConverter. Fixtures enforce TLS+auth, never anonymous/public-broker. Google.Protobuf (3.34.1) + Grpc.Tools (2.76.0) already pinned; MQTTnet is the one new pin. High-risk tasks: 4 (hand-rolled reconnect loop), 18/19 (alias/seq state-machine components), 21 (the full 3.6 ingest matrix).",
+  "tasks": [
+    {
+      "id": 0,
+      "subject": "Task 0 (P1): Dependency-validation spike \u2014 MQTTnet-5 pin + net10 restore/build under central pinning",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": []
+    },
+    {
+      "id": 1,
+      "subject": "Task 1 (P1): .Contracts enums + MqttDriverOptions DTO (name-serialized)",
+      "status": "completed",
+      "classification": "small",
+      "parallelizableWith": [],
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 2,
+      "subject": "Task 2 (P1): .Contracts MqttTagDefinition + MqttEquipmentTagParser (plain, strict enum)",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [],
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 3,
+      "subject": "Task 3 (P1): .Driver + MqttConnection connect/TLS/auth (bounded deadline)",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [],
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 4,
+      "subject": "Task 4 (P1): MqttConnection hand-rolled reconnect loop (backoff + resubscribe)",
+      "status": "completed",
+      "classification": "high-risk",
+      "parallelizableWith": [],
+      "blockedBy": [
+        3
+      ]
+    },
+    {
+      "id": 5,
+      "subject": "Task 5 (P1): LastValueCache + IReadable (per-ref no-data)",
+      "status": "completed",
+      "classification": "small",
+      "parallelizableWith": [
+        6
+      ],
+      "blockedBy": [
+        3
+      ]
+    },
+    {
+      "id": 6,
+      "subject": "Task 6 (P1): ISubscribable plain topic subscribe\u2192OnDataChange + retained seed",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [
+        5
+      ],
+      "blockedBy": [
+        2,
+        4
+      ]
+    },
+    {
+      "id": 7,
+      "subject": "Task 7 (P1): MqttDriver shell \u2014 IDriver + authored-only ITagDiscovery (Once) + probe interface",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [],
+      "blockedBy": [
+        5,
+        6
+      ]
+    },
+    {
+      "id": 8,
+      "subject": "Task 8 (P1): MqttDriverProbe CONNECT handshake",
+      "status": "completed",
+      "classification": "small",
+      "parallelizableWith": [
+        10
+      ],
+      "blockedBy": [
+        3
+      ]
+    },
+    {
+      "id": 9,
+      "subject": "Task 9 (P1): Factory + DriverTypeNames.Mqtt + Host factory/probe registration",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [],
+      "blockedBy": [
+        7,
+        8
+      ]
+    },
+    {
+      "id": 10,
+      "subject": "Task 10 (P1): .Browser bespoke #-observation browser (passive)",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [
+        8
+      ],
+      "blockedBy": [
+        2
+      ]
+    },
+    {
+      "id": 11,
+      "subject": "Task 11 (P1): Register MqttDriverBrowser (bespoke-first for Mqtt)",
+      "status": "completed",
+      "classification": "trivial",
+      "parallelizableWith": [
+        12
+      ],
+      "blockedBy": [
+        10
+      ]
+    },
+    {
+      "id": 12,
+      "subject": "Task 12 (P1): Typed AdminUI editor + validator (plain shape)",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [
+        11
+      ],
+      "blockedBy": [
+        2
+      ]
+    },
+    {
+      "id": 13,
+      "subject": "Task 13 (P1): Mosquitto+JSON-publisher fixture (TLS+auth) + env-gated live suite",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [],
+      "blockedBy": [
+        9
+      ]
+    },
+    {
+      "id": 14,
+      "subject": "Task 14 (P1): Live /run verify on docker-dev \u2014 P1 MILESTONE COMPLETE",
+      "status": "completed",
+      "classification": "small",
+      "parallelizableWith": [],
+      "blockedBy": [
+        9,
+        11,
+        12,
+        13
+      ]
+    },
+    {
+      "id": 15,
+      "subject": "Task 15 (P2): Vendor Tahu sparkplug_b.proto + Grpc.Tools codegen",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [],
+      "blockedBy": [
+        14
+      ]
+    },
+    {
+      "id": 16,
+      "subject": "Task 16 (P2): SparkplugCodec decode + golden payload vectors",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [
+        17
+      ],
+      "blockedBy": [
+        15
+      ]
+    },
+    {
+      "id": 17,
+      "subject": "Task 17 (P2): SparkplugTopic parse/format + SparkplugDataType.ToDriverDataType map",
+      "status": "completed",
+      "classification": "small",
+      "parallelizableWith": [
+        16
+      ],
+      "blockedBy": [
+        15
+      ]
+    },
+    {
+      "id": 18,
+      "subject": "Task 18 (P2): BirthCache + AliasTable \u2014 bind-by-name, rebuild-per-birth",
+      "status": "completed",
+      "classification": "high-risk",
+      "parallelizableWith": [
+        19
+      ],
+      "blockedBy": [
+        16,
+        17
+      ]
+    },
+    {
+      "id": 19,
+      "subject": "Task 19 (P2): SequenceTracker seq-gap + bdSeq death-tie",
+      "status": "completed",
+      "classification": "high-risk",
+      "parallelizableWith": [
+        18
+      ],
+      "blockedBy": [
+        16,
+        17
+      ]
+    },
+    {
+      "id": 20,
+      "subject": "Task 20 (P2): RebirthRequester NCMD encode",
+      "status": "completed",
+      "classification": "small",
+      "parallelizableWith": [],
+      "blockedBy": [
+        16
+      ]
+    },
+    {
+      "id": 21,
+      "subject": "Task 21 (P2): Sparkplug ingest state machine \u2014 the 3.6 matrix",
+      "status": "completed",
+      "classification": "high-risk",
+      "parallelizableWith": [],
+      "blockedBy": [
+        18,
+        19,
+        20
+      ]
+    },
+    {
+      "id": 22,
+      "subject": "Task 22 (P2): ITagDiscovery UntilStable + IRediscoverable (rediscover-on-DBIRTH)",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [],
+      "blockedBy": [
+        21
+      ]
+    },
+    {
+      "id": 23,
+      "subject": "Task 23 (P2): Sparkplug browser tree + AttributesAsync + scoped RequestRebirthAsync",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [
+        24
+      ],
+      "blockedBy": [
+        20,
+        21
+      ]
+    },
+    {
+      "id": 24,
+      "subject": "Task 24 (P2): AdminUI editor Sparkplug mode shape + validator",
+      "status": "completed",
+      "classification": "small",
+      "parallelizableWith": [
+        23
+      ],
+      "blockedBy": [
+        12,
+        17
+      ]
+    },
+    {
+      "id": 25,
+      "subject": "Task 25 (P2): C# edge-node simulator fixture + 3.6 live matrix",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [],
+      "blockedBy": [
+        21,
+        22,
+        23
+      ]
+    },
+    {
+      "id": 26,
+      "subject": "Task 26 (P2): Live /run verify Sparkplug \u2014 P2 COMPLETE",
+      "status": "completed",
+      "classification": "small",
+      "parallelizableWith": [],
+      "blockedBy": [
+        23,
+        24,
+        25
+      ]
+    }
+  ],
+  "lastUpdated": "2026-07-27",
+  "closureNote": "All 27 tasks shipped, both phases live-gated. Marked complete 2026-07-27 (deferment.md \u00a78.5)."
+}
@@ -0,0 +1,199 @@
+{
+  "planPath": "docs/plans/2026-07-24-mtconnect-driver.md",
+  "tasks": [
+    {
+      "id": 0,
+      "subject": "Task 0: Verify TrakHound MTConnect.NET pin (or record the hand-roll decision)",
+      "status": "completed"
+    },
+    {
+      "id": 1,
+      "subject": "Task 1: Scaffold the two driver projects + the test project",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 2,
+      "subject": "Task 2: MTConnectDriverOptions + MTConnectTagDefinition in .Contracts",
+      "status": "completed",
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 3,
+      "subject": "Task 3: MTConnectDataTypeInference.Infer + golden type-map test",
+      "status": "completed",
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 4,
+      "subject": "Task 4: Capture the canned XML fixtures",
+      "status": "completed",
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 5,
+      "subject": "Task 5: IMTConnectAgentClient seam + return DTOs",
+      "status": "completed",
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 6,
+      "subject": "Task 6: MTConnectAgentClient \u2014 parse /probe into the device model",
+      "status": "completed",
+      "blockedBy": [
+        4,
+        5
+      ]
+    },
+    {
+      "id": 7,
+      "subject": "Task 7: MTConnectAgentClient \u2014 parse /current + /sample, detect the sequence gap",
+      "status": "completed",
+      "blockedBy": [
+        4,
+        5,
+        6
+      ]
+    },
+    {
+      "id": 8,
+      "subject": "Task 8: MTConnectObservationIndex + UNAVAILABLE -> BadNoCommunication",
+      "status": "completed",
+      "blockedBy": [
+        7
+      ]
+    },
+    {
+      "id": 9,
+      "subject": "Task 9: MTConnectDriver shell \u2014 IDriver lifecycle",
+      "status": "completed",
+      "blockedBy": [
+        2,
+        8
+      ]
+    },
+    {
+      "id": 10,
+      "subject": "Task 10: IReadable.ReadAsync \u2014 /current, ordered snapshots",
+      "status": "completed",
+      "blockedBy": [
+        9
+      ]
+    },
+    {
+      "id": 11,
+      "subject": "Task 11: ISubscribable \u2014 /sample long-poll pump + ring-buffer re-baseline",
+      "status": "completed",
+      "blockedBy": [
+        9,
+        7
+      ]
+    },
+    {
+      "id": 12,
+      "subject": "Task 12: ITagDiscovery.DiscoverAsync + SupportsOnlineDiscovery=true",
+      "status": "completed",
+      "blockedBy": [
+        9,
+        6
+      ]
+    },
+    {
+      "id": 13,
+      "subject": "Task 13: IHostConnectivityProbe + IRediscoverable (instanceId watch)",
+      "status": "completed",
+      "blockedBy": [
+        9
+      ]
+    },
+    {
+      "id": 14,
+      "subject": "Task 14: MTConnectDriverProbe : IDriverProbe",
+      "status": "completed",
+      "blockedBy": [
+        2,
+        5
+      ]
+    },
+    {
+      "id": 15,
+      "subject": "Task 15: MTConnectDriverFactoryExtensions",
+      "status": "completed",
+      "blockedBy": [
+        2,
+        9
+      ]
+    },
+    {
+      "id": 16,
+      "subject": "Task 16: Host registration + DriverTypeNames.MTConnect + guard-test parity",
+      "status": "completed",
+      "blockedBy": [
+        14,
+        15
+      ]
+    },
+    {
+      "id": 17,
+      "subject": "Task 17: AdminUI typed model MTConnectTagConfigModel",
+      "status": "completed",
+      "blockedBy": [
+        3,
+        16
+      ]
+    },
+    {
+      "id": 18,
+      "subject": "Task 18: AdminUI editor razor + map/validator registration",
+      "status": "completed",
+      "blockedBy": [
+        17
+      ]
+    },
+    {
+      "id": 19,
+      "subject": "Task 19: mtconnect/cppagent docker fixture",
+      "status": "completed",
+      "blockedBy": [
+        16
+      ]
+    },
+    {
+      "id": 20,
+      "subject": "Task 20: Env-gated integration suite against cppagent",
+      "status": "completed",
+      "blockedBy": [
+        19
+      ]
+    },
+    {
+      "id": 21,
+      "subject": "Task 21: Live /run verify on docker-dev \u2014 browse picker, editor, read, subscribe, deploy",
+      "status": "completed",
+      "blockedBy": [
+        18,
+        20
+      ]
+    },
+    {
+      "id": 22,
+      "subject": "Task 22: Docs + deferred-writeback note; update the tracking doc",
+      "status": "completed",
+      "blockedBy": [
+        21
+      ]
+    }
+  ],
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Merged at master 90bdaa44 (#506); 5-leg live gate PASSED. Marked complete 2026-07-27 (deferment.md \u00a78.5)."
+}
@@ -0,0 +1,670 @@
+# SQL Poll Driver Implementation Plan
+
+> **For Claude:** REQUIRED SUB-SKILL: Use superpowers-extended-cc:executing-plans (or subagent-driven-development) to implement this plan task-by-task.
+
+**Goal:** Ship a read-only `Sql` Equipment-kind driver that polls SQL Server tables/views on an interval and publishes selected columns/rows as OPC UA variable nodes, authored through the standard equipment Tags flow with a bespoke schema browser.
+
+**Architecture:** Three new projects mirroring the Modbus split — `Driver.Sql.Contracts` (options/tag DTOs + parser, zero transport deps), `Driver.Sql` (the `IDriver`/`ITagDiscovery`/`IReadable`/`ISubscribable`/`IHostConnectivityProbe` runtime + `ISqlDialect` seam + `SqlServerDialect`, owning `Microsoft.Data.SqlClient`), and `Driver.Sql.Browser` (schema-walk `IBrowseSession`). The `PollGroupEngine`, `EquipmentTagRefResolver<TDef>`, health state machine, and factory shape are all reused from Core; the driver batches tags by query-group (one round-trip per group per poll) and slices result sets back to per-tag snapshots. Every value binds as a `DbParameter`; identifiers are dialect-quoted from catalog-validated names only.
+
+**Tech Stack:** `Microsoft.Data.SqlClient` (6.1.1, already in `Directory.Packages.props`) via `System.Data.Common` base types behind a `DbProviderFactory`; `ISqlDialect` + `SqlProvider` enum seam (only `SqlServer` implemented in v1); `Microsoft.Data.Sqlite` (10.0.7, test-only) for the offline unit fixture; xunit.v3 + Shouldly. **Zero new NuGet dependencies.**
+
+**Source design:** docs/plans/2026-07-15-sql-poll-driver-design.md
+**Program design (shared contract):** docs/plans/2026-07-15-driver-expansion-program-design.md §3, §7
+
+**Conventions for every task below:** all projects `net10.0`, `Nullable`/`ImplicitUsings` enabled, `TreatWarningsAsErrors` on product projects. Every commit message ends with the repo trailer `Claude-Session: <session-url>` (omitted from the `git commit` examples for brevity). Run `dotnet build ZB.MOM.WW.OtOpcUa.slnx` green before each commit. New test projects use `xunit.v3` + `Shouldly` (see `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/*.csproj`).
+
+---
+
+## Task 0: Scaffold `Driver.Sql.Contracts` project + register in slnx
+
+**Classification:** small
+**Estimated implement time:** ~4 min
+**Parallelizable with:** none (root of the tree)
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts.csproj`
+- Modify: `ZB.MOM.WW.OtOpcUa.slnx` (add the project under `/src/Drivers/`)
+
+**Steps:**
+1. Create the csproj — refs `Core.Abstractions` ONLY (no transport deps, so AdminUI + browser can reference it without dragging `Microsoft.Data.SqlClient`). `InternalsVisibleTo` the Contracts is not needed. `RootNamespace = ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts`.
+```xml
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    <GenerateDocumentationFile>true</GenerateDocumentationFile>
+    <NoWarn>$(NoWarn);CS1591</NoWarn>
+    <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts</RootNamespace>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Core.Abstractions\ZB.MOM.WW.OtOpcUa.Core.Abstractions.csproj" />
+  </ItemGroup>
+</Project>
+```
+2. Add to `ZB.MOM.WW.OtOpcUa.slnx` under the `/src/Drivers/` folder, beside the `Driver.Modbus.Contracts` line.
+3. Run `dotnet build ZB.MOM.WW.OtOpcUa.slnx` — expect PASS (empty project compiles).
+4. Commit: `git commit -m "feat(sql): scaffold Driver.Sql.Contracts project"`
+
+---
+
+## Task 1: `SqlProvider` + `SqlTagModel` enums + `SqlDriverConfigDto` (string-enum round-trip)
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none (blocks most downstream)
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts/SqlProvider.cs`
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts/SqlDriverConfigDto.cs`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/*` is NOT created here — this task's test lives temporarily in the Contracts consumer; create the Tests project in Task 6. **Instead**, put this task's test in a throwaway `Contracts`-adjacent xunit project? No — to avoid a project just for one test, fold this task's serialization assertion into Task 9's factory enum-serialization test. **This task ships DTOs only; its guard is Task 9.**
+
+> **Note:** Tasks 1–2 produce pure records/enums with no I/O. Their behavioural guard (string-enum round-trip, strict parse) is the Task 9 factory test + Task 2's parser test (Task 2 creates its own micro-test via the Tests project created in Task 6). To keep TDD honest without a premature test project, **reorder locally**: implement Task 1 DTOs, then Task 6 (Tests project) can be pulled forward if the implementer prefers. The `blockedBy` graph permits this. The concrete failing-test-first discipline begins at Task 2.
+
+**Steps:**
+1. `SqlProvider.cs`:
+```csharp
+namespace ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
+
+/// <summary>Which ADO.NET provider/dialect backs a Sql driver instance. v1 constructs only SqlServer.</summary>
+public enum SqlProvider { SqlServer, Postgres, MySql, Odbc, Oracle }
+
+/// <summary>Tag→value mapping model. v1 ships KeyValue + WideRow; Query is deferred (design §5.4 / P3).</summary>
+public enum SqlTagModel { KeyValue, WideRow, Query }
+```
+2. `SqlDriverConfigDto.cs` — the driver-config blob shape (§5.1). Enum-typed fields (`Provider`) so the string converter round-trips names; timeouts as `TimeSpan?`; `ConnectionStringRef` (NOT the connection string). Fields: `Provider`, `ConnectionStringRef`, `DefaultPollInterval`, `OperationTimeout`, `CommandTimeout`, `MaxConcurrentGroups`, `NullIsBad`, `AllowWrites`, `Probe` (`SqlProbeDto{Enabled, Interval}`). `[JsonStringEnumConverter]` is applied at the factory (Task 9), not on the DTO.
+3. Build — expect PASS.
+4. Commit: `git commit -m "feat(sql): SqlProvider/SqlTagModel enums + SqlDriverConfigDto"`
+
+---
+
+## Task 2: `SqlTagDefinition` + `SqlEquipmentTagParser.TryParse` (strict enum reads, malicious-input safe)
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts/SqlTagDefinition.cs`
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts/SqlEquipmentTagParser.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlEquipmentTagParserTests.cs` (Tests project scaffolded in Task 6 — **pull the csproj creation forward from Task 6 for this task**, or defer this task's test until Task 6 and mark Task 2 blockedBy nothing but verified-at-6. Recommended: create the Tests project now as part of this task's setup.)
+
+**TDD:**
+1. **Failing test** — parse a KeyValue blob and a malicious `keyValue`; assert the value is captured verbatim (parser does NOT sanitize — binding is the reader's job) and a typo'd `model` enum rejects:
+```csharp
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
+
+public class SqlEquipmentTagParserTests
+{
+    [Fact]
+    public void TryParse_KeyValue_readsFields_andKeepsMaliciousValueVerbatim()
+    {
+        var json = """
+        {"driver":"Sql","model":"KeyValue","table":"dbo.TagValues","keyColumn":"tag_name",
+         "keyValue":"'; DROP TABLE x --","valueColumn":"num_value","timestampColumn":"sample_ts","type":"Float64"}
+        """;
+        SqlEquipmentTagParser.TryParse(json, "Plant/Sql/dev1/Speed", out var def).ShouldBeTrue();
+        def.Model.ShouldBe(SqlTagModel.KeyValue);
+        def.Table.ShouldBe("dbo.TagValues");
+        def.KeyValue.ShouldBe("'; DROP TABLE x --");   // captured as-is; the reader BINDS it, never concatenates
+        def.DeclaredType.ShouldBe(DriverDataType.Float64);
+        def.Name.ShouldBe("Plant/Sql/dev1/Speed");     // Name == RawPath (forward-router key)
+    }
+
+    [Fact]
+    public void TryParse_invalidModelEnum_rejectsTag()
+        => SqlEquipmentTagParser.TryParse(
+            """{"driver":"Sql","model":"Nonsense","table":"t","keyColumn":"k","keyValue":"v","valueColumn":"c"}""",
+            "raw", out _).ShouldBeFalse();
+}
+```
+2. Run `dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests` — expect FAIL (types don't exist).
+3. **Minimal impl** — `SqlTagDefinition` record (`Name` = RawPath, `Model`, `Table`, `KeyColumn`, `KeyValue`, `ValueColumn`, `TimestampColumn`, `ColumnName`, `RowSelectorColumn`, `RowSelectorValue`, `RowSelectorTopByTimestamp`, `DeclaredType` = `DriverDataType?`). `SqlEquipmentTagParser.TryParse(string reference, string rawPath, out SqlTagDefinition def)` — mirror `ModbusTagDefinitionFactory.FromTagConfig`: recognize by leading `{`, read the `model` discriminator via `TagConfigJson.TryReadEnumStrict` (a present-but-invalid enum → `false` → the driver surfaces `BadNodeIdUnknown`, per R2-11), read model-specific fields, read the optional `type` override strictly, set `Name = rawPath`. Wrap in try/catch(JsonException/FormatException) → `false`. **No SQL is built here** — the parser only captures strings.
+4. Run test — expect PASS.
+5. Commit: `git commit -m "feat(sql): SqlTagDefinition + strict-enum equipment-tag parser"`
+
+---
+
+## Task 3: Scaffold `Driver.Sql` runtime project + register in slnx
+
+**Classification:** small
+**Estimated implement time:** ~4 min
+**Parallelizable with:** Task 2
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/ZB.MOM.WW.OtOpcUa.Driver.Sql.csproj`
+- Modify: `ZB.MOM.WW.OtOpcUa.slnx`
+
+**Steps:**
+1. Create the csproj per design §2.1 — refs `Core.Abstractions` + `Core` (for `DriverFactoryRegistry` in `ZB.MOM.WW.OtOpcUa.Core.Hosting`) + `Driver.Sql.Contracts`; packages `Microsoft.Data.SqlClient` + `Microsoft.Extensions.Logging.Abstractions`; `InternalsVisibleTo` the `.Tests`.
+2. Add to `ZB.MOM.WW.OtOpcUa.slnx` under `/src/Drivers/`.
+3. Build — expect PASS.
+4. Commit: `git commit -m "feat(sql): scaffold Driver.Sql runtime project"`
+
+---
+
+## Task 4: `ISqlDialect` seam + `SqlServerDialect` (QuoteIdentifier, catalog SQL, MapColumnType) — golden queries
+
+**Classification:** high-risk (identifier quoting is the injection boundary)
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 2
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/ISqlDialect.cs`
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlServerDialect.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlServerDialectTests.cs`
+
+**TDD:**
+1. **Failing test** — golden catalog SQL, `QuoteIdentifier` escape + reject, `MapColumnType` table:
+```csharp
+[Fact]
+public void QuoteIdentifier_bracketsAndEscapesEmbeddedBrackets()
+{
+    var d = new SqlServerDialect();
+    d.QuoteIdentifier("Speed").ShouldBe("[Speed]");
+    d.QuoteIdentifier("a]b").ShouldBe("[a]]b]");            // ] doubled per T-SQL rules
+}
+
+[Fact]
+public void QuoteIdentifier_rejectsControlCharsAndNul()
+    => Should.Throw<ArgumentException>(() => new SqlServerDialect().QuoteIdentifier("x\0y"));
+
+[Theory]
+[InlineData("bit", DriverDataType.Boolean)]
+[InlineData("int", DriverDataType.Int32)]
+[InlineData("bigint", DriverDataType.Int64)]
+[InlineData("real", DriverDataType.Float32)]
+[InlineData("float", DriverDataType.Float64)]
+[InlineData("decimal", DriverDataType.Float64)]
+[InlineData("nvarchar", DriverDataType.String)]
+[InlineData("datetime2", DriverDataType.DateTime)]
+[InlineData("uniqueidentifier", DriverDataType.String)]
+public void MapColumnType_mapsFamilies(string sql, DriverDataType expected)
+    => new SqlServerDialect().MapColumnType(sql).ShouldBe(expected);
+
+[Fact]
+public void CatalogSql_isInformationSchemaAndParameterized()
+{
+    var d = new SqlServerDialect();
+    d.LivenessSql.ShouldBe("SELECT 1");
+    d.ListTablesSql.ShouldContain("INFORMATION_SCHEMA.TABLES");
+    d.ListTablesSql.ShouldContain("@schema");               // never string-interpolated
+    d.ListColumnsSql.ShouldContain("@table");
+}
+```
+2. Run — expect FAIL.
+3. **Minimal impl** — `ISqlDialect` per design §2.2 (`Provider`, `Factory` = `DbProviderFactory`, `QuoteIdentifier`, `LivenessSql`, `ListSchemasSql`, `ListTablesSql`, `ListColumnsSql`, `MapColumnType`). `SqlServerDialect`: `Factory => SqlClientFactory.Instance`; `QuoteIdentifier` doubles `]`, rejects embedded NUL/control chars via `ArgumentException`; catalog SQL uses `INFORMATION_SCHEMA` with `@schema`/`@table` markers; `MapColumnType` folds SQL type families to `DriverDataType` per design §3.7 (`decimal`/`numeric`/`money` → `Float64` with the documented precision caveat as an XML remark).
+4. Run — expect PASS.
+5. Commit: `git commit -m "feat(sql): ISqlDialect + SqlServerDialect with golden catalog SQL"`
+
+---
+
+## Task 5: `SqlQueryPlan` grouping + parameter binding (pure, no DB)
+
+**Classification:** high-risk (the query-mapping core; GroupKey correctness governs correctness of every read)
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 10
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlQueryPlan.cs`
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlGroupPlanner.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlGroupPlannerTests.cs`
+
+**TDD:**
+1. **Failing test** — KeyValue tags on the same `(table,keyColumn,valueColumn,timestampColumn)` fold into ONE plan whose SQL is `... WHERE [tag_name] IN (@k0,@k1)` with two bound params; WideRow tags on the same `(table,rowSelector)` fold into one `SELECT <cols> ... WHERE [station_id]=@w`; different tables → different plans:
+```csharp
+[Fact]
+public void KeyValueTags_sameSource_foldIntoOnePlan_withBoundInList()
+{
+    var dialect = new SqlServerDialect();
+    var tags = new[] {
+        KvTag("A","dbo.TagValues","tag_name","Line1.Speed","num_value","sample_ts"),
+        KvTag("B","dbo.TagValues","tag_name","Line1.Temp","num_value","sample_ts"),
+    };
+    var plans = SqlGroupPlanner.Plan(tags, dialect).ToList();
+    plans.Count.ShouldBe(1);
+    plans[0].SqlText.ShouldContain("IN (@k0, @k1)");
+    plans[0].SqlText.ShouldContain("[tag_name]");
+    plans[0].Members.Count.ShouldBe(2);
+    plans[0].Parameters.ShouldBe(new object[] { "Line1.Speed", "Line1.Temp" });   // values are params, not text
+}
+```
+2. Run — expect FAIL.
+3. **Minimal impl** — `SqlQueryPlan { object GroupKey, string SqlText, IReadOnlyList<object?> Parameters, IReadOnlyList<SqlTagDefinition> Members, Func<DbDataReader, SqlTagDefinition, ...> }` (indexer supplied by the reader in Task 7; here just the shape + SQL/param builder). `SqlGroupPlanner.Plan(tags, dialect)`: KeyValue → GroupKey `(table,keyColumn,valueColumn,timestampColumn)`, emit `SELECT <keyColumn>,<valueColumn>[,<timestampColumn>] FROM <table> WHERE <keyColumn> IN (@k0..@kN)` with distinct-key params; WideRow → GroupKey `(table, rowSelector)`, emit `SELECT <distinct member columns>[,<selector cols>] FROM <table> WHERE <whereColumn>=@w` (or `ORDER BY <col> DESC` + dialect TOP-1 for `topByTimestamp`). Identifiers via `dialect.QuoteIdentifier`; `<table>` split on `.` and each part quoted. **Every value is a param; zero interpolation.**
+4. Run — expect PASS.
+5. Commit: `git commit -m "feat(sql): SqlGroupPlanner folds tags into one parameterized query per group"`
+
+---
+
+## Task 6: Scaffold `Driver.Sql.Tests` + `SqliteDialect` (test) + `SqlitePollFixture`
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 10, Task 12
+**Files:**
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests.csproj`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqliteDialect.cs`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlitePollFixture.cs`
+- Modify: `ZB.MOM.WW.OtOpcUa.slnx`
+
+> If Task 2 already created the csproj, this task adds the `SqliteDialect`/fixture and the slnx entry only.
+
+**Steps:**
+1. csproj — `xunit.v3` + `Shouldly` + `Microsoft.NET.Test.Sdk` + `xunit.runner.visualstudio`; `PackageReference Microsoft.Data.Sqlite` (10.0.7, test-only — no product dep on SQLite); project-refs `Driver.Sql` + `Driver.Sql.Contracts`. Add to slnx under `/tests/Drivers/`.
+2. `SqliteDialect : ISqlDialect` — `Provider = SqlServer` shim is wrong; add a test-only `Provider` value is not needed — implement `ISqlDialect` directly with `Factory => SqliteFactory.Instance`, `QuoteIdentifier` doubling `"`, `LivenessSql = "SELECT 1"`, catalog SQL over `sqlite_schema` + `PRAGMA table_info(...)`, `MapColumnType` mapping declared affinity (design §9 caveat: SQLite is dynamically typed — keep seed columns explicitly typed). This dialect is also linked by the Browser.Tests (Task 13) via `<Compile Include="..\..\Driver.Sql.Tests\SqliteDialect.cs" Link="SqliteDialect.cs" />`.
+3. `SqlitePollFixture` — opens an in-memory (or temp-file) SQLite connection, seeds a KeyValue table `TagValues(tag_name TEXT, num_value REAL, sample_ts TEXT)` and a wide-row `LatestStatus(station_id INT, oven_temp REAL, sample_ts TEXT)` with a few rows. Exposes the open `SqliteConnection` + a `DbProviderFactory` shim so the driver-under-test can be injected with an already-open connection provider (see Task 8's ctor seam).
+4. Build + run (no tests yet) — expect PASS/empty.
+5. Commit: `git commit -m "test(sql): Sql.Tests project + SqliteDialect + poll fixture"`
+
+---
+
+## Task 7: `SqlPollReader` core — one query per group, bounded deadline, slice back in input order
+
+**Classification:** high-risk (connection/timeout/result-slicing core)
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlPollReader.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlPollReaderTests.cs`
+
+**TDD:**
+1. **Failing test** (against `SqlitePollFixture`) — read two KeyValue refs + one absent key; assert N-in/N-out order, correct values/types, absent key → `BadNoData`, NULL cell → `Uncertain` (default `nullIsBad=false`), source timestamp from `timestampColumn`:
+```csharp
+[Fact]
+public async Task ReadAsync_returnsSnapshotsInInputOrder_absentKeyIsBadNoData()
+{
+    await using var fx = await SqlitePollFixture.CreateAsync();     // seeds Line1.Speed=42.0, Line1.Temp=NULL
+    var reader = new SqlPollReader(fx.Factory, fx.ConnectionString, new SqliteDialect(),
+        commandTimeout: TimeSpan.FromSeconds(10), operationTimeout: TimeSpan.FromSeconds(15),
+        maxConcurrentGroups: 4, nullIsBad: false, resolve: fx.Resolve);
+    var refs = new[] { "Speed", "Missing", "Temp" };
+    var snaps = await reader.ReadAsync(refs, CancellationToken.None);
+    snaps.Count.ShouldBe(3);
+    snaps[0].Value.ShouldBe(42.0);
+    snaps[1].StatusCode.ShouldBe(SqlStatusCodes.BadNoData);          // key deleted/absent
+    snaps[2].Value.ShouldBeNull();
+    StatusCode.IsUncertain(snaps[2].StatusCode).ShouldBeTrue();       // NULL cell, nullIsBad=false
+}
+```
+2. Run — expect FAIL.
+3. **Minimal impl** — `SqlPollReader.ReadAsync(refs, ct)`: resolve each ref → `SqlTagDefinition` (miss → `BadNodeIdUnknown`); `SqlGroupPlanner.Plan(...)`; per group under a `SemaphoreSlim(maxConcurrentGroups)`: `await using var conn = factory.CreateConnection(); conn.ConnectionString = connStr; await conn.OpenAsync(linkedCt)`; build `DbCommand` with `CommandTimeout = (int)commandTimeout.TotalSeconds` and bound params; `using var linked = CancellationTokenSource.CreateLinkedTokenSource(ct); linked.CancelAfter(operationTimeout); await using var rdr = await cmd.ExecuteReaderAsync(linked.Token)`; index rows by key/selector; map each member's cell → `DataValueSnapshot` (type per `DeclaredType` ?? `dialect.MapColumnType`-inferred; NULL → `nullIsBad ? Bad : Uncertain`; absent key → `BadNoData`; source timestamp from `timestampColumn` else read wall-clock). **Reassemble in input order** (`DataValueSnapshot[refs.Count]`). Per-tag failure = Bad-coded snapshot, NOT an exception; the whole call throws only if the connection itself is unreachable (→ engine backoff). `await using` both connection and reader — never leak. Add `SqlStatusCodes` static (BadNoData/BadTimeout/BadNodeIdUnknown/BadCommunicationError/Uncertain constants) if not reusing an existing helper.
+4. Run — expect PASS. Add a NULL-cell test with `nullIsBad:true` → `Bad`.
+5. Commit: `git commit -m "feat(sql): SqlPollReader — grouped read, bounded deadline, ordered slice-back"`
+
+---
+
+## Task 8: `SqlDriver` shell — IDriver / ITagDiscovery / IReadable / ISubscribable / IHostConnectivityProbe
+
+**Classification:** high-risk (lifecycle + poll-engine wiring + connection validation)
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlDriver.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlDriverTests.cs`
+
+**TDD:**
+1. **Failing test** — construct `SqlDriver` with an injected dialect + factory + already-resolved connection string (SQLite fixture) + authored `RawTagEntry` list; `InitializeAsync` → `Healthy`; `DiscoverAsync` streams one Variable per authored tag with `SecurityClass=ViewOnly` + `RediscoverPolicy=Once` + `SupportsOnlineDiscovery=false`; `ReadAsync` delegates to the reader; a subscribe fires an initial change:
+```csharp
+[Fact]
+public async Task Initialize_thenDiscover_streamsAuthoredTagsReadOnly()
+{
+    await using var fx = await SqlitePollFixture.CreateAsync();
+    var driver = SqlDriver.ForTest(fx, rawTags: fx.AuthoredRawTags);
+    await driver.InitializeAsync(fx.ConfigJson, CancellationToken.None);
+    driver.GetHealth().State.ShouldBe(DriverState.Healthy);
+    ((ITagDiscovery)driver).SupportsOnlineDiscovery.ShouldBeFalse();
+    ((ITagDiscovery)driver).RediscoverPolicy.ShouldBe(DiscoveryRediscoverPolicy.Once);
+    var cap = new CapturingBuilder();
+    await ((ITagDiscovery)driver).DiscoverAsync(cap, CancellationToken.None);
+    cap.Variables.ShouldContain(v => v.FullName == "Speed" && v.SecurityClass == SecurityClassification.ViewOnly);
+}
+```
+2. Run — expect FAIL.
+3. **Minimal impl** — `SqlDriver : IDriver, ITagDiscovery, IReadable, ISubscribable, IHostConnectivityProbe, IAsyncDisposable`. Mirror `ModbusDriver`: fields grouped up top; `_resolver = new EquipmentTagRefResolver<SqlTagDefinition>(...)`; `_poll = new PollGroupEngine(reader: ReadAsync, onChange: ..., onError: HandlePollError, backoffCap: 30s)`. `InitializeAsync`: build `_tagsByRawPath` from `_options.RawTags` via `SqlEquipmentTagParser.TryParse` (miss = logged skip, never throw); open ONE connection, run `dialect.LivenessSql` under `CommandTimeout` + linked CTS, dispose; success → `Healthy`, failure → `Faulted` + `LastError`. `ReadAsync` → `_reader.ReadAsync`. `SubscribeAsync` → `_poll.Subscribe`; `UnsubscribeAsync` → `_poll.Unsubscribe`. `IHostConnectivityProbe`: single logical host (server host from the connection string) with `Running/Stopped` from the last poll/liveness outcome + `OnHostStatusChanged` on transitions. `GetMemoryFootprint => 0`; `FlushOptionalCachesAsync => Task.CompletedTask`; `ReinitializeAsync` = teardown+init. `DriverType => DriverTypeNames.Sql`. Add a `ForTest(...)` internal factory that injects dialect+factory+connString (production path resolves those in the factory, Task 9). **Pooling: open-use-dispose per poll (already in the reader); no long-lived connection.**
+4. Run — expect PASS.
+5. Commit: `git commit -m "feat(sql): SqlDriver shell wiring PollGroupEngine + probe + read-only discovery"`
+
+---
+
+## Task 9: `SqlDriverFactoryExtensions` + `connectionStringRef` env resolution + enum-serialization guard
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 10
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlDriverFactoryExtensions.cs`
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlConnectionStringResolver.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlDriverFactoryTests.cs`
+
+**TDD:**
+1. **Failing test** — `CreateInstance` with a config carrying `"provider":"SqlServer"` builds a driver; a missing `connectionStringRef` throws a clean error; the connection-string ref resolves from env `Sql__ConnectionStrings__<ref>`; **enum-serialization guard** — a config author serializing `provider` as a NUMBER still parses (`JsonStringEnumConverter` accepts ordinals) AND the round-trip writes the NAME:
+```csharp
+[Fact]
+public void CreateInstance_missingConnectionStringRef_throwsActionable()
+    => Should.Throw<InvalidOperationException>(() =>
+        SqlDriverFactoryExtensions.CreateInstance("d1", """{"provider":"SqlServer"}""", null))
+        .Message.ShouldContain("connectionStringRef");
+
+[Fact]
+public void ConnectionStringRef_resolvesFromEnv()
+{
+    Environment.SetEnvironmentVariable("Sql__ConnectionStrings__MesStaging", "Server=x;Database=y;");
+    SqlConnectionStringResolver.Resolve("MesStaging").ShouldBe("Server=x;Database=y;");
+}
+
+[Fact]
+public void Provider_serializesAsNameNotNumber()
+{
+    var json = JsonSerializer.Serialize(new SqlDriverConfigDto { Provider = SqlProvider.SqlServer },
+        SqlDriverFactoryExtensions.JsonOptionsForTest);
+    json.ShouldContain("\"SqlServer\"");
+    json.ShouldNotContain("\"provider\":0");
+}
+```
+2. Run — expect FAIL.
+3. **Minimal impl** — `SqlConnectionStringResolver.Resolve(string @ref)` → `Environment.GetEnvironmentVariable($"Sql__ConnectionStrings__{@ref}")` (direct env read, deliberate — the factory closure has no `IConfiguration`, per design §8.2), throws actionable if absent. `SqlDriverFactoryExtensions`: `const DriverTypeName = DriverTypeNames.Sql`; `Register(registry, loggerFactory)` → `registry.Register(DriverTypeName, (id,json)=>CreateInstance(id,json,loggerFactory))`; `CreateInstance` deserializes `SqlDriverConfigDto` with `JsonOptions` carrying `JsonStringEnumConverter` + `UnmappedMemberHandling.Skip`, validates `ConnectionStringRef` present, builds `SqlServerDialect` from `Provider` (P1: only `SqlServer` constructible; others throw "provider not available in this build"), resolves the connection string, constructs the `SqlPollReader` + `SqlDriver`. **Never log the resolved connection string** (log provider + server host + database only). Expose `JsonOptionsForTest` internal.
+4. Run — expect PASS.
+5. Commit: `git commit -m "feat(sql): factory + connectionStringRef env resolution + string-enum guard"`
+
+---
+
+## Task 10: `SqlDriverProbe` (SELECT 1 liveness, bounded timeout)
+
+**Classification:** small
+**Estimated implement time:** ~4 min
+**Parallelizable with:** Task 5, Task 9, Task 12
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlDriverProbe.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlDriverProbeTests.cs`
+
+**TDD:**
+1. **Failing test** — against the SQLite fixture (inject dialect+factory), `ProbeAsync` returns green with latency; a bad connection string returns a red result with the error message (never throws):
+```csharp
+[Fact]
+public async Task Probe_liveConnection_returnsGreen()
+{
+    await using var fx = await SqlitePollFixture.CreateAsync();
+    var probe = SqlDriverProbe.ForTest(fx.Factory, new SqliteDialect());
+    var r = await probe.ProbeAsync(fx.ConfigJson, TimeSpan.FromSeconds(5), CancellationToken.None);
+    r.Success.ShouldBeTrue();
+}
+```
+2. Run — expect FAIL.
+3. **Minimal impl** — `SqlDriverProbe : IDriverProbe`, `DriverType => DriverTypeNames.Sql`. Parse config via the SAME factory DTO shape + `JsonStringEnumConverter` (R2-11 factory parity, mirroring `ModbusDriverProbe`), resolve the connection string ref, open a connection under a linked CTS bounded by `timeout`, run `dialect.LivenessSql` (`SELECT 1`), return `DriverProbeResult(true, "SQL SELECT 1 OK", latency)`; catch → red result naming the failure. Never throws. `ForTest` injects factory+dialect for the SQLite path.
+4. Run — expect PASS.
+5. Commit: `git commit -m "feat(sql): SqlDriverProbe SELECT-1 liveness check"`
+
+---
+
+## Task 11: Host registration — `DriverTypeNames.Sql` + factory + probe + guard test
+
+**Classification:** small
+**Estimated implement time:** ~4 min
+**Parallelizable with:** none
+**Files:**
+- Modify: `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverTypeNames.cs`
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.Host/Drivers/DriverFactoryBootstrap.cs`
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.Host/ZB.MOM.WW.OtOpcUa.Host.csproj` (project-ref `Driver.Sql` if not transitively present)
+- Test: `tests/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions.Tests/DriverTypeNamesGuardTests.cs` is EXISTING — it asserts bidirectional parity between `DriverTypeNames` constants and the factory-registered set; this task makes it pass by adding both sides.
+
+**TDD:**
+1. **Failing step** — add `public const string Sql = "Sql";` to `DriverTypeNames` + include in `All`, but DON'T yet register the factory. Run `DriverTypeNamesGuardTests` → expect FAIL (constant with no registered factory).
+2. **Impl** — in `DriverFactoryBootstrap.Register(...)` add `Driver.Sql.SqlDriverFactoryExtensions.Register(registry, loggerFactory);`; in `AddOtOpcUaDriverProbes` add `services.TryAddEnumerable(ServiceDescriptor.Singleton<IDriverProbe, SqlProbe>());` with a `using SqlProbe = Driver.Sql.SqlDriverProbe;` alias; add the `Driver.Sql` project-ref to the Host csproj. Default tier `DriverTier.A` (no explicit arg — SQL client is cross-platform managed, runs on macOS dev, so `ShouldStub()` needs no change).
+3. Run guard test + `dotnet build ZB.MOM.WW.OtOpcUa.slnx` — expect PASS.
+4. Commit: `git commit -m "feat(sql): register Sql factory + probe in Host, add DriverTypeNames.Sql"`
+
+---
+
+## Task 12: Scaffold `Driver.Sql.Browser` project + register in slnx
+
+**Classification:** small
+**Estimated implement time:** ~4 min
+**Parallelizable with:** Task 5, Task 6, Task 9, Task 10
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.csproj`
+- Modify: `ZB.MOM.WW.OtOpcUa.slnx`
+
+**Steps:**
+1. csproj refs `Commons` (`ZB.MOM.WW.OtOpcUa.Commons` — `IDriverBrowser`/`IBrowseSession`/`BrowseNode`) + `Driver.Sql.Contracts` + **`Driver.Sql`** (for `ISqlDialect`/`SqlServerDialect` — the dialect's catalog SQL *is* the browse engine; `Microsoft.Data.SqlClient` comes transitively). This runtime-project ref is the deliberate deviation from `OpcUaClient.Browser` recorded in design §2 — add an XML comment on the ref citing the design so nobody "fixes" it. `InternalsVisibleTo` the `.Browser.Tests`.
+2. Add to slnx under `/src/Drivers/`.
+3. Build — expect PASS.
+4. Commit: `git commit -m "feat(sql): scaffold Driver.Sql.Browser project"`
+
+---
+
+## Task 13: `SqlBrowseSession` — schema walk over the dialect catalog
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 16, Task 17
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser/SqlBrowseSession.cs`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.Tests/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.Tests.csproj` (+ slnx entry, + link `SqliteDialect.cs` from Sql.Tests)
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.Tests/SqlBrowseSessionTests.cs`
+
+**TDD:**
+1. **Failing test** — over a seeded SQLite DB + `SqliteDialect`: `RootAsync` yields schema folder(s); `ExpandAsync(schema)` yields the seeded tables; `ExpandAsync(table)` yields columns as leaves; `AttributesAsync(column)` yields the mapped `DriverDataType`:
+```csharp
+[Fact]
+public async Task ExpandTable_yieldsColumnsAsLeaves_withMappedType()
+{
+    await using var db = await SqliteBrowseFixture.CreateAsync();   // TagValues(tag_name TEXT, num_value REAL)
+    var session = new SqlBrowseSession(db.Connection, new SqliteDialect());
+    var tableNode = (await session.ExpandAsync(db.SchemaNodeId, default)).First(n => n.DisplayName.Contains("TagValues"));
+    var cols = await session.ExpandAsync(tableNode.NodeId, default);
+    cols.ShouldContain(c => c.DisplayName == "num_value" && c.IsLeaf);
+    var attrs = await session.AttributesAsync(cols.First(c => c.DisplayName == "num_value").NodeId, default);
+    attrs.DriverDataType.ShouldBe(nameof(DriverDataType.Float64));
+}
+```
+2. Run — expect FAIL.
+3. **Minimal impl** — `SqlBrowseSession : IBrowseSession` (match the `Commons.Browsing` interface shape used by `OpcUaClientBrowseSession`): `RootAsync`/`ExpandAsync(nodeId)`/`AttributesAsync(nodeId)` run the dialect catalog queries with bound `@schema`/`@table` params; encode `NodeId` as `schema` / `schema.table` / `schema.table|column`; a `SemaphoreSlim _gate` serializes (one ADO.NET connection is not concurrent); per-call work bounded by the AdminUI's existing 20 s per-call timeout. Column leaf `AttributesAsync` returns `AttributeInfo(Name: column, DriverDataType: dialect.MapColumnType(dataType).ToString(), IsArray:false, SecurityClass:"ViewOnly")` (mirrors Galaxy two-stage pick).
+4. Run — expect PASS.
+5. Commit: `git commit -m "feat(sql): SqlBrowseSession schema-walk over dialect catalog"`
+
+---
+
+## Task 14: `SqlDriverBrowser` — IDriverBrowser open (env ref OR pasted literal, transient connection)
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 16, Task 17
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser/SqlDriverBrowser.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.Tests/SqlDriverBrowserTests.cs`
+
+**TDD:**
+1. **Failing test** — `OpenAsync` with a form JSON whose `connectionStringRef` resolves from env opens a session; an UNresolvable ref fails with a message naming the EXACT missing env var; a pasted literal connection string is used session-only (never persisted):
+```csharp
+[Fact]
+public async Task Open_unresolvableRef_failsNamingExactEnvVar()
+{
+    var browser = new SqlDriverBrowser();
+    var ex = await Should.ThrowAsync<InvalidOperationException>(() =>
+        browser.OpenAsync("""{"provider":"SqlServer","connectionStringRef":"MesStaging"}""", default));
+    ex.Message.ShouldContain("Sql__ConnectionStrings__MesStaging");
+}
+```
+2. Run — expect FAIL.
+3. **Minimal impl** — `SqlDriverBrowser : IDriverBrowser`, `DriverType => DriverTypeNames.Sql`. `OpenAsync(configJson, ct)`: deserialize with the same `JsonStringEnumConverter` options; resolve `connectionStringRef` via a direct env read (`Sql__ConnectionStrings__<ref>`) IN THE ADMINUI PROCESS — on miss throw an actionable message naming the exact missing env var (design §4.4); accept an optional pasted literal `connectionString` for ad-hoc browse (session-only, **never persisted, never logged, no `_lastConfigJson` cached field**); select `SqlServerDialect` (P1); open ONE transient `DbConnection`, return a `SqlBrowseSession`. Reuses the AdminUI `BrowseSessionRegistry` + reaper + idle TTL unchanged.
+4. Run — expect PASS.
+5. Commit: `git commit -m "feat(sql): SqlDriverBrowser transient-connection open with env-ref + literal"`
+
+---
+
+## Task 15: AdminUI browser DI + `SqlAddressPickerBody.razor` (picker body)
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 16, Task 17
+**Files:**
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/EndpointRouteBuilderExtensions.cs` (add `services.AddSingleton<IDriverBrowser, SqlDriverBrowser>();` beside the OpcUaClient/Galaxy lines ~:75)
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/ZB.MOM.WW.OtOpcUa.AdminUI.csproj` (project-ref `Driver.Sql.Browser`)
+- Create: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Uns/AddressPickers/SqlAddressPickerBody.razor` (reuse `DriverBrowseTree.razor` for the tree + an attribute side-panel + model/selector fields; gated by the existing `DriverOperator` policy; manual entry retained)
+
+**Steps (no unit test — Razor is live-verified in Task 21):**
+1. Register the bespoke `IDriverBrowser` (the universal-browser DI line is NOT added for `Sql` — its `CanBrowse` is false and bespoke wins by construction).
+2. `SqlAddressPickerBody.razor` — thin body: `DriverBrowseTree` in picker mode + attribute side-panel; on column pick, compose the `TagConfig` blob (DisplayName default `table.column`, prefill `type` from `AttributesAsync`, operator picks model + fills key/row selector; `SecurityClass=ViewOnly`).
+3. `dotnet build` — expect PASS.
+4. Commit: `git commit -m "feat(sql): AdminUI browser DI + Sql address picker body"`
+
+---
+
+## Task 16: Env-gated central-SQL integration fixture (`Driver.Sql.IntegrationTests`)
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 13, Task 14, Task 15, Task 17
+**Files:**
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.Sql.IntegrationTests.csproj` (+ slnx entry)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.IntegrationTests/SqlPollServerFixture.cs`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.IntegrationTests/SqlServerReadTests.cs`
+
+**TDD:**
+1. **Failing/skipping test** — against the always-on central SQL Server (`10.100.0.35,14330`), seed a `SqlPollFixture` database with the two sample tables (KeyValue + wide-row), then validate the real `Microsoft.Data.SqlClient` path (read round-trip, `INFORMATION_SCHEMA` browse, `CommandTimeout`/cancellation, pooling). **Env-gated** via `SQL_TEST_ENDPOINT` / a full `Sql__ConnectionStrings__Fixture` — absent ⇒ skip cleanly (use `Assert.Skip(...)` / xunit.v3 `[Fact(Skip=...)]` dynamic skip), like every other `*.IntegrationTests`:
+```csharp
+[Fact]
+public async Task ReadAsync_realSqlServer_roundTripsSeededKeyValue()
+{
+    var connStr = Environment.GetEnvironmentVariable("Sql__ConnectionStrings__Fixture");
+    Assert.SkipWhen(string.IsNullOrEmpty(connStr), "Sql__ConnectionStrings__Fixture not set — offline skip.");
+    await using var fx = await SqlPollServerFixture.EnsureSeededAsync(connStr!);
+    var driver = SqlDriver.ForProduction(connStr!, new SqlServerDialect(), fx.AuthoredRawTags);
+    await driver.InitializeAsync(fx.ConfigJson, default);
+    var snaps = await driver.ReadAsync(new[] { "Line1.Speed" }, default);
+    snaps[0].StatusCode.ShouldBe(0u);
+}
+```
+2. Run offline — expect SKIP (green).
+3. **Impl** — the fixture (create-if-missing DB + tables + seed rows via `Microsoft.Data.SqlClient`) and the read tests. **The seed DB is `SqlPollFixture`, NOT `ConfigDb`** — the shared central server hosts ConfigDb; the fixture uses its own database on that server.
+4. Commit: `git commit -m "test(sql): env-gated central-SQL integration fixture + read round-trip"`
+
+---
+
+## Task 17: Injection regression test (bind-harmless value / reject identifier, never execute)
+
+**Classification:** standard
+**Estimated implement time:** ~4 min
+**Parallelizable with:** Task 13, Task 14, Task 15, Task 16
+**Files:**
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlInjectionRegressionTests.cs`
+
+**TDD:**
+1. **Failing test** (offline, SQLite fixture) — a malicious `keyValue` (`'; DROP TABLE TagValues; --`) reads harmlessly as a bound param and the seed table still exists afterward; a malicious `table`/`column` identifier that is not catalog-valid is REJECTED (tag → `BadNodeIdUnknown`), never executed:
+```csharp
+[Fact]
+public async Task MaliciousKeyValue_bindsHarmlessly_tableSurvives()
+{
+    await using var fx = await SqlitePollFixture.CreateAsync();
+    var reader = fx.NewReader();
+    var snaps = await reader.ReadAsync(new[] { fx.RefWithKeyValue("'; DROP TABLE TagValues; --") }, default);
+    snaps[0].StatusCode.ShouldBe(SqlStatusCodes.BadNoData);   // no such key — bound, not executed
+    (await fx.TableRowCountAsync("TagValues")).ShouldBeGreaterThan(0);   // table intact
+}
+```
+2. Run — expect FAIL (until reader binds correctly; it should already PASS from Task 7 if binding is right — this test LOCKS the guarantee).
+3. **Impl** — none if Task 7 binds correctly; otherwise fix. Add a review-checklist note: "any code path building SQL by string-concatenating a tag field is a defect."
+4. Commit: `git commit -m "test(sql): injection regression — bind values, reject unknown identifiers"`
+
+---
+
+## Task 18: Blackhole / timeout live-gate against a DEDICATED mssql container
+
+**Classification:** high-risk (frozen-peer resilience — the single highest-value integration test)
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.IntegrationTests/Docker/docker-compose.yml` (a dedicated disposable `mssql` stack)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.IntegrationTests/Docker/seed.sql`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.IntegrationTests/SqlBlackholeTimeoutTests.cs`
+
+> **CRITICAL:** this gate `docker pause`s a **dedicated** `mcr.microsoft.com/mssql/server` container it owns — **NEVER** the shared central SQL Server on `10.100.0.35,14330`, which hosts `ConfigDb` for the whole rig (design §9). The compose stack is deployed via `lmxopcua-fix sync`; `lmxopcua-fix` applies the `project=lmxopcua` label host-side.
+
+**TDD:**
+1. **Failing/skipping test** — mirror the R2-01 S7 blackhole (`S7_1500ConnectTimeoutOutageTests`): start reading against the dedicated mssql, then `docker pause` it mid-poll; assert the next read surfaces `BadTimeout` within `operationTimeout` + a small margin (client-side linked-CTS cancellation, not the poll thread wedging), the driver degrades, and the poll loop backs off; `docker unpause` recovers. Env-gated (`SQL_BLACKHOLE_ENDPOINT`) — offline skip:
+```csharp
+[Fact]
+public async Task PausedServer_surfacesBadTimeout_withinDeadline_notWedged()
+{
+    var ep = Environment.GetEnvironmentVariable("SQL_BLACKHOLE_ENDPOINT");
+    Assert.SkipWhen(string.IsNullOrEmpty(ep), "SQL_BLACKHOLE_ENDPOINT not set — offline skip.");
+    // ... start driver, docker pause <dedicated-container>, read, assert BadTimeout within ~operationTimeout, unpause ...
+}
+```
+2. Run offline — expect SKIP.
+3. **Impl** — dedicated `docker-compose.yml` (`mssql` service, own container name, `restart: "no"`), `seed.sql` (the two sample tables), and the test that shells `docker pause`/`docker unpause` against the OWNED container. Assert the wall-clock bound (the frozen-peer contract): `CommandTimeout` (server-side backstop) + `ExecuteReaderAsync(linkedCt)` bounded by `operationTimeout` (client-side real cancellation) both fire.
+4. Commit: `git commit -m "test(sql): blackhole/timeout live-gate on a dedicated mssql container"`
+
+---
+
+## Task 19: AdminUI typed editor model + validator (timeout-order rule, string enums)
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 16, Task 17, Task 18
+**Files:**
+- Create: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Uns/TagEditors/SqlTagConfigModel.cs`
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Uns/TagEditors/TagConfigEditorMap.cs` (add `[DriverTypeNames.Sql] = typeof(...SqlTagConfigEditor)`)
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Uns/TagEditors/TagConfigValidator.cs` (add `[DriverTypeNames.Sql] = j => SqlTagConfigModel.FromJson(j).Validate()`)
+- Test: `tests/.../AdminUI.Tests/.../SqlTagConfigModelTests.cs` (locate the existing AdminUI tag-editor test project; mirror `ModbusTagConfigModel` tests)
+
+**TDD:**
+1. **Failing test** — `FromJson`→`ToJson` round-trips the model, preserves unknown keys, writes enums (`model`/`type`) as NAME strings not numbers; `Validate()` rejects a WideRow without a row selector and enforces the driver-level timeout-order rule surrogate at the tag layer if the tag carries timeouts (the primary timeout-order check is at the driver page — the model validates model/selector shape):
+```csharp
+[Fact]
+public void ToJson_writesModelAndTypeAsStrings_preservesUnknownKeys()
+{
+    var m = SqlTagConfigModel.FromJson("""{"driver":"Sql","model":"KeyValue","table":"t","keyColumn":"k","keyValue":"v","valueColumn":"c","type":"Float64","customX":1}""");
+    var json = m.ToJson();
+    json.ShouldContain("\"KeyValue\"");
+    json.ShouldContain("\"Float64\"");
+    json.ShouldContain("customX");            // unknown key survives load→save
+    json.ShouldNotContain("\"model\":0");
+}
+```
+2. Run — expect FAIL.
+3. **Minimal impl** — `SqlTagConfigModel` (thin, over `TagConfigJson.ParseOrNew`, preserving the `_bag`): `Model`, `Table`, `KeyColumn`/`KeyValue`/`ValueColumn`/`TimestampColumn`, `ColumnName` + `RowSelector`, `Type` (`DriverDataType?`), `FromJson`/`ToJson` (enums as name strings via `TagConfigJson.Set`) `/Validate` (model discriminator ⇒ required-field shape; WideRow needs a selector). Register in `TagConfigEditorMap` + `TagConfigValidator`. **Enum-serialization trap (systemic):** `model`/`type` MUST round-trip as strings on both sides — the editor `ToJson` and the factory `SqlEquipmentTagParser` both use string enums; add the assertion above.
+4. Run — expect PASS.
+5. Commit: `git commit -m "feat(sql): typed AdminUI Sql tag-config model + validator (string enums)"`
+
+---
+
+## Task 20: `SqlTagConfigEditor.razor` (thin shell over the model)
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Uns/TagEditors/SqlTagConfigEditor.razor`
+
+**Steps (Razor — live-verified in Task 21):**
+1. Copy the Modbus editor template; bind over `SqlTagConfigModel`: a `Model` dropdown (KeyValue/WideRow) that shows the matching field group, `Table`, the key/value/timestamp fields (KeyValue) OR `ColumnName` + row-selector fields (WideRow), and a `Type` override dropdown. `@bind` string component params need the `@` prefix (the Global-UNS gotcha).
+2. `dotnet build` — expect PASS.
+3. Commit: `git commit -m "feat(sql): SqlTagConfigEditor razor shell"`
+
+---
+
+## Task 21: Live `/run` verification on docker-dev (picker + editor + deploy + read)
+
+**Classification:** trivial (procedure — no product code; may surface fix-forward tasks)
+**Estimated implement time:** ~5 min (verification, excluding any bugs found)
+**Parallelizable with:** none (last)
+**Files:** none (verification only; any defect becomes a new fix-forward task)
+
+**Procedure (docker-dev rig, AdminUI auto-authenticated at `http://localhost:9200` — login disabled, so drive it yourself, don't defer to the user):**
+1. Set `Sql__ConnectionStrings__DevSql` on the docker-dev central + driver nodes pointing at a dev SQL Server + seeded table (the dedicated mssql from Task 18, or the central-SQL fixture DB). Rebuild BOTH central-1/central-2 (`:9200` round-robins).
+2. In `/raw`, add a `Sql` driver + device (paste a literal connection string or use the ref); Test-Connect → green (`SELECT 1`).
+3. Open the Sql address picker → browse schema→table→column → commit a KeyValue tag and a WideRow tag; confirm the typed editor renders and validates.
+4. Reference the raw tags into an equipment on `/uns`; deploy via `POST :9200/api/deployments` (X-Api-Key) or the deploy button; confirm the deployment seals green.
+5. Read via Client.CLI (`read -u opc.tcp://localhost:4840 -n "ns=2;s=<RawPath>"`) — confirm the live SQL value + quality + source timestamp.
+6. Record the run outcome in the plan's completion note. If anything is deploy-inert / mis-bound, open a fix-forward task (Razor binding + deploy-inertness bugs pass unit tests + review — this live gate is the real proof).
+
+---
+
+## Deferred / out of scope (pointers to the design, NOT executable tasks here)
+
+These are recorded so nobody re-derives them; each is a later phase in `docs/plans/2026-07-15-sql-poll-driver-design.md`. The `ISqlDialect` seam is built in from day one (Task 4) precisely so the provider tail below is additive and cheap.
+
+- **Named-query model** (design §5.4, §3.6(c) / design-P3) — the arbitrary-`SELECT` escape hatch (`queries: {...}` + a tag referencing a query by name + projection). Not built in v1; the `SqlTagModel.Query` enum member exists but the reader/planner path is deferred.
+- **PostgreSQL + ODBC dialects** (design §2.2, §8.5 / design-P3) — `PostgresDialect` (`Npgsql`) + `OdbcDialect` (`System.Data.Odbc`), each a NEW gated `PackageVersion`. v1 constructs only `SqlServerDialect`; the other `SqlProvider` members throw "provider not available in this build."
+- **MySQL/MariaDB + native Oracle** (design §10 / design-P5) — `MySqlConnector` + an `ALL_TAB_COLUMNS` Oracle dialect. Demand-driven.
+- **Write mode (`IWritable`)** (design §3.4 / design-P4) — opt-in, triple-gated (`WriteOperate` role + driver `allowWrites` master switch + `TagConfig.writable`), parameterized UPSERT/StoredProc, `WriteIdempotent` retry policy. v1 is read-only; `SecurityClass=ViewOnly` everywhere and `allowWrites` defaults `false`.
+- **Split-role env-parity operational note** (design §4.4) — admin nodes must carry the same `Sql__ConnectionStrings__<ref>` env vars as driver nodes for any browseable ref; the browser-open failure names the exact missing env var. This is a deployment/runbook item, not a code task.
@@ -0,0 +1,191 @@
+{
+  "planPath": "docs/plans/2026-07-24-sql-poll-driver.md",
+  "tasks": [
+    {
+      "id": 0,
+      "subject": "Task 0: Scaffold Driver.Sql.Contracts project + register in slnx",
+      "status": "completed"
+    },
+    {
+      "id": 1,
+      "subject": "Task 1: SqlProvider/SqlTagModel enums + SqlDriverConfigDto",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 2,
+      "subject": "Task 2: SqlTagDefinition + SqlEquipmentTagParser (strict enums, malicious-input safe)",
+      "status": "completed",
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 3,
+      "subject": "Task 3: Scaffold Driver.Sql runtime project + register in slnx",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 4,
+      "subject": "Task 4: ISqlDialect + SqlServerDialect (QuoteIdentifier, catalog SQL, MapColumnType)",
+      "status": "completed",
+      "blockedBy": [
+        1,
+        3
+      ]
+    },
+    {
+      "id": 5,
+      "subject": "Task 5: SqlQueryPlan grouping + parameter binding (pure)",
+      "status": "completed",
+      "blockedBy": [
+        2,
+        4
+      ]
+    },
+    {
+      "id": 6,
+      "subject": "Task 6: Scaffold Driver.Sql.Tests + SqliteDialect + SqlitePollFixture",
+      "status": "completed",
+      "blockedBy": [
+        3,
+        4
+      ]
+    },
+    {
+      "id": 7,
+      "subject": "Task 7: SqlPollReader core \u2014 grouped read, bounded deadline, ordered slice-back",
+      "status": "completed",
+      "blockedBy": [
+        5,
+        6
+      ]
+    },
+    {
+      "id": 8,
+      "subject": "Task 8: SqlDriver shell \u2014 IDriver/ITagDiscovery/IReadable/ISubscribable/IHostConnectivityProbe",
+      "status": "completed",
+      "blockedBy": [
+        7
+      ]
+    },
+    {
+      "id": 9,
+      "subject": "Task 9: SqlDriverFactoryExtensions + connectionStringRef env resolution + enum guard",
+      "status": "completed",
+      "blockedBy": [
+        8
+      ]
+    },
+    {
+      "id": 10,
+      "subject": "Task 10: SqlDriverProbe (SELECT 1 liveness)",
+      "status": "completed",
+      "blockedBy": [
+        4,
+        6
+      ]
+    },
+    {
+      "id": 11,
+      "subject": "Task 11: Host registration \u2014 DriverTypeNames.Sql + factory + probe + guard test",
+      "status": "completed",
+      "blockedBy": [
+        9,
+        10
+      ]
+    },
+    {
+      "id": 12,
+      "subject": "Task 12: Scaffold Driver.Sql.Browser project + register in slnx",
+      "status": "completed",
+      "blockedBy": [
+        3
+      ]
+    },
+    {
+      "id": 13,
+      "subject": "Task 13: SqlBrowseSession \u2014 schema walk over dialect catalog",
+      "status": "completed",
+      "blockedBy": [
+        4,
+        12,
+        6
+      ]
+    },
+    {
+      "id": 14,
+      "subject": "Task 14: SqlDriverBrowser \u2014 env-ref/literal transient-connection open",
+      "status": "completed",
+      "blockedBy": [
+        13
+      ]
+    },
+    {
+      "id": 15,
+      "subject": "Task 15: AdminUI browser DI + SqlAddressPickerBody.razor",
+      "status": "completed",
+      "blockedBy": [
+        14
+      ]
+    },
+    {
+      "id": 16,
+      "subject": "Task 16: Env-gated central-SQL integration fixture + read round-trip",
+      "status": "completed",
+      "blockedBy": [
+        8
+      ]
+    },
+    {
+      "id": 17,
+      "subject": "Task 17: Injection regression test (bind value / reject identifier)",
+      "status": "completed",
+      "blockedBy": [
+        7
+      ]
+    },
+    {
+      "id": 18,
+      "subject": "Task 18: Blackhole/timeout live-gate on a dedicated mssql container",
+      "status": "completed",
+      "blockedBy": [
+        16
+      ]
+    },
+    {
+      "id": 19,
+      "subject": "Task 19: AdminUI typed Sql tag-config model + validator (string enums)",
+      "status": "completed",
+      "blockedBy": [
+        1,
+        11
+      ]
+    },
+    {
+      "id": 20,
+      "subject": "Task 20: SqlTagConfigEditor.razor shell",
+      "status": "completed",
+      "blockedBy": [
+        19
+      ]
+    },
+    {
+      "id": 21,
+      "subject": "Task 21: Live /run verification on docker-dev (picker + editor + deploy + read)",
+      "status": "completed",
+      "blockedBy": [
+        11,
+        15,
+        20
+      ]
+    }
+  ],
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Merged 4ad54037 + follow-ups 28c28667. Marked complete 2026-07-27 (deferment.md \u00a78.5)."
+}
@@ -21,7 +21,7 @@ OtOpcUa has four independent security concerns. This document covers all four:

 1. **Transport security** — OPC UA secure channel (signing, encryption, X.509 trust).
 2. **OPC UA authentication** — Anonymous / UserName / X.509 session identities; UserName tokens authenticated by LDAP bind.
-3. **Data-plane authorization** — who can browse, read, subscribe, write, acknowledge alarms on which nodes. Evaluated by `TriePermissionEvaluator` over a `PermissionTrie` built from the Config DB `NodeAcl` tree.
+3. **Data-plane authorization** — who can write and acknowledge alarms on an OtOpcUa endpoint. ⚠️ Enforced today by **two coarse, server-wide LDAP role checks** (`WriteOperate`, `AlarmAck`) — **not** by the `NodeAcl` / `PermissionTrie` subsystem, which is built and unit-tested but never wired. Read, Browse, HistoryRead and Subscribe carry **no** authorization check at all. See [Data-Plane Authorization](#data-plane-authorization).
 4. **Control-plane authorization** — who can view or edit fleet configuration in the Admin UI. Gated by the `AdminRole` (`Viewer` / `Designer` / `Administrator`) claim resolved from `LdapGroupRoleMapping`.

 Transport security and OPC UA authentication are per-node concerns configured in the Server's bootstrap `appsettings.json`. Data-plane ACLs and Admin role grants live in the Config DB.
@@ -112,9 +112,9 @@ The Server accepts three OPC UA identity-token types:

 | Token | Handler | Notes |
 |---|---|---|
-| Anonymous | No `IOpcUaUserAuthenticator` call — the SDK admits anonymous sessions at the channel. | Data-plane authorization (below) still default-denies any node a session has no ACL grant for. |
-| UserName/Password | `LdapOpcUaUserAuthenticator.AuthenticateUserNameAsync` (`src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/LdapOpcUaUserAuthenticator.cs`, implements `IOpcUaUserAuthenticator`), backed by the app `ILdapAuthService` — `OtOpcUaLdapAuthService` (`src/Server/ZB.MOM.WW.OtOpcUa.Security/Ldap/OtOpcUaLdapAuthService.cs`). | LDAP bind + group lookup. The returned LDAP groups are mapped to roles via `IGroupRoleMapper<string>` (`OtOpcUaGroupRoleMapper`) and attached to the OPC UA session identity for the downstream ACL evaluator. |
-| X.509 Certificate | Stack-level acceptance during the secure-channel handshake. | The certificate must be trusted (see PKI trust flow); finer-grain authorization happens through the data-plane ACLs. |
+| Anonymous | No `IOpcUaUserAuthenticator` call — the SDK admits anonymous sessions at the channel. | ⚠️ An anonymous session carries **no roles**, so it is refused every write and every alarm ack — but it can **Browse, Read, Subscribe and HistoryRead the entire address space**. There is no per-node ACL check on those operations (see [Data-Plane Authorization](#data-plane-authorization)). Do not expose an Anonymous-admitting endpoint to an untrusted network. |
+| UserName/Password | `LdapOpcUaUserAuthenticator.AuthenticateUserNameAsync` (`src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/LdapOpcUaUserAuthenticator.cs`, implements `IOpcUaUserAuthenticator`), backed by the app `ILdapAuthService` — `OtOpcUaLdapAuthService` (`src/Server/ZB.MOM.WW.OtOpcUa.Security/Ldap/OtOpcUaLdapAuthService.cs`). | LDAP bind + group lookup. The returned LDAP groups are mapped to roles via `IGroupRoleMapper<string>` (`OtOpcUaGroupRoleMapper`) and the **roles** are attached to the OPC UA session identity as a `RoleCarryingUserIdentity`. The raw group list is discarded at that point and never reaches the data plane. |
+| X.509 Certificate | Stack-level acceptance during the secure-channel handshake. | The certificate must be trusted (see PKI trust flow). It carries **no** roles, so a cert-only session is read-everything / write-nothing. |

 When no authenticator is supplied, `OpcUaApplicationHost` falls back to `NullOpcUaUserAuthenticator`; the Host wires the real `LdapOpcUaUserAuthenticator` as a singleton in `Program.cs`.

@@ -130,7 +130,7 @@ LDAP is configured under the `Security:Ldap` section (bound to `LdapOptions`, `s
 4. Delegates the real path to the shared `ZB.MOM.WW.Auth.Ldap` client: it binds (search-then-bind via `ServiceAccountDn`, or direct-bind `cn={user},{SearchBase}` when no service account is set), verifies the password, and reads the user's group memberships.
 5. Returns an `LdapAuthResult` carrying the validated username + the **groups** (never roles). Failure codes are folded into opaque user-facing error strings so a probe cannot distinguish "unknown user" from "wrong password".

-**Group → role mapping happens downstream**, not in the auth service: `LdapOpcUaUserAuthenticator` resolves `IGroupRoleMapper<string>` (`OtOpcUaGroupRoleMapper`) per call and unions its output with any pre-resolved roles (the DevStub `Administrator` grant). The roles are attached to the OPC UA session identity for the ACL evaluator. A mapper fault (e.g. a Config DB outage) falls back to the pre-resolved baseline rather than denying an otherwise-authenticated session.
+**Group → role mapping happens downstream**, not in the auth service: `LdapOpcUaUserAuthenticator` resolves `IGroupRoleMapper<string>` (`OtOpcUaGroupRoleMapper`) per call and unions its output with any pre-resolved roles (the DevStub `Administrator` grant). The roles are attached to the OPC UA session identity (`RoleCarryingUserIdentity`), where the write and alarm-ack gates read them. **The LDAP group names themselves are consumed here and go no further** — which is one reason the `NodeAcl` subsystem cannot currently be wired, since it matches on groups rather than roles. A mapper fault (e.g. a Config DB outage) falls back to the pre-resolved baseline rather than denying an otherwise-authenticated session.

 `Transport` replaces the former `UseTls` bool: `Ldaps` (implicit TLS), `StartTls` (upgrade), or `None` (plaintext, requires `AllowInsecure`). Configuration example (Active Directory production):

@@ -180,11 +180,92 @@ Defaults are behaviour-neutral on a healthy directory. All new paths are **fail-

 ## Data-Plane Authorization

-Data-plane authorization is the check run on every OPC UA operation against an OtOpcUa endpoint: *can this authenticated user Browse / Read / Subscribe / Write / HistoryRead / AckAlarm / Call on this specific node?*
+> ⚠️ **Read this first (verified against source, 2026-07-27).** This section used to describe the
+> `NodeAcl` / `PermissionTrie` design as if it were the live enforcement path. **It is not.** The
+> evaluator is built and unit-tested but has **zero production call sites**, and
+> `ZB.MOM.WW.OtOpcUa.OpcUaServer.csproj` does not even reference the project it lives in. Everything
+> actually enforced today is in [What is enforced today](#what-is-enforced-today); the trie design is
+> retained below, clearly marked, under [Designed but not wired](#designed-but-not-wired-nodeacl--permissiontrie).

-Per decision #129 the model is **additive-only — no explicit Deny**. Grants at each hierarchy level union; absence of a grant is the default-deny.
+### What is enforced today

-### Hierarchy
+There are exactly **three** authorization checks in the whole OPC UA server layer. All three are
+coarse, **server-wide role string checks** with no per-node component.
+
+| Operation | Gate | Requires |
+|---|---|---|
+| Write (Value attribute, either namespace) | `OtOpcUaNodeManager.EvaluateEquipmentWriteGate` | role `WriteOperate` |
+| Alarm Acknowledge / Confirm / AddComment / Shelve / Unshelve (scripted alarms) | `OtOpcUaNodeManager.HandleAlarmCommand` | role `AlarmAck` |
+| Alarm acknowledge (driver-fed native alarms) | `OtOpcUaNodeManager.HandleNativeAlarmAck` | role `AlarmAck` |
+
+Both gates fail closed — a session with no identity or no matching role gets
+`BadUserAccessDenied` — and read `identity.Roles` off the session's `RoleCarryingUserIdentity`
+(`src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/Security/RoleCarryingUserIdentity.cs`). Role strings are
+the constants in `OpcUaDataPlaneRoles`, sourced from `Security:Ldap:GroupToRole` (see
+[Role grant source](#role-grant-source-data-plane)).
+
+**What has no authorization check at all:**
+
+- **Read, Browse, TranslateBrowsePaths** — no override, no handler. Any admitted session, including
+  an Anonymous one, sees and reads the entire address space.
+- **HistoryRead** — all four overrides (`HistoryReadRawModified`, `HistoryReadProcessed`,
+  `HistoryReadAtTime`, `HistoryReadEvents`) run without an identity check.
+- **CreateMonitoredItems / subscriptions / TransferSubscriptions**.
+- **Non-Value attribute writes** — the gate hangs off `OnWriteValue`.
+
+**And what the write gate does *not* distinguish:**
+
+- **`WriteTune` and `WriteConfigure` are never checked.** They exist in the role vocabulary and in
+  `NodePermissions`, but every write — whatever the tag's security classification — is gated on the
+  single `WriteOperate` string.
+- **`AlarmAcknowledge` / `AlarmConfirm` / `AlarmShelve` are not distinguished.** One `AlarmAck` role
+  covers all five alarm methods; the `operation` argument is passed to the router but never consulted
+  by the gate.
+- **There is no per-node granularity.** A session that may write one tag may write **every** writable
+  tag on the node.
+
+The gate *is* realm-aware in one narrow sense: it is attached per-node during materialization for both
+the Raw and UNS realms, and the write dispatch it guards is realm-qualified. The role decision itself
+takes no realm and no node.
+
+### Designed but not wired: `NodeAcl` + `PermissionTrie`
+
+Everything from here to [Role grant source](#role-grant-source-data-plane) describes a subsystem that
+**exists in the tree, is covered by 30 unit tests, and never executes.** It is kept because the design
+is sound and the remaining work is wiring plus one genuine design gap — not because it runs.
+
+What is real about it:
+
+- Operators **can** author `NodeAcl` rows in the Admin UI (`/clusters/{id}/acls`), and those rows are
+  validated, versioned and persisted.
+- `ConfigComposer` **does** snapshot every `NodeAcl` row into every deployment artifact, so an ACL
+  edit shifts the artifact's `RevisionHash` and ships to every node.
+- The node side **never deserializes them** — `DeploymentArtifact` has no ACL reader. The bytes arrive
+  and are dropped.
+
+So an operator can author a grant, deploy it green, and have it change nothing. That is the behaviour
+to expect until the tracking issue below is closed.
+
+**The four things blocking a wire-up** (all verified, none of them merely "call the evaluator"):
+
+1. **Raw-realm nodes have no representable scope.** `NodeHierarchyKind` has exactly one member,
+   `Equipment`. Raw NodeIds are `Folder→Driver→Device→TagGroup→Tag` RawPaths, which `NodeScope` cannot
+   express — yet the write gate is attached to raw tags. Roughly half the writable address space has
+   no scope to evaluate. This is a design decision, not wiring.
+2. **The identity carries roles, not groups.** The trie matches `NodeAcl.LdapGroup` against the
+   session's LDAP groups, but `OpcUaUserAuthResult` carries only mapped role strings; the group list
+   is discarded inside `LdapOpcUaUserAuthenticator`.
+3. **`PermissionTrieBuilder`'s `scopePaths` argument has no producer.** Without it every sub-cluster
+   grant lands in the builder's fallback bucket — the hazard its own comments warn about. It would have
+   to be derived from the artifact's UNS relations.
+4. **No session lifecycle exists.** `UserAuthorizationState` has the freshness/staleness predicates but
+   nothing in production constructs one, stamps a generation, or drives a refresh.
+
+Two smaller inconsistencies inside the subsystem itself: `NodeAclScopeKind.FolderSegment` is offered in
+the authoring dropdown but the trie walker has no level to match it at, and `NodePermissions.AlarmRead`
+has no `OpcUaOperation` mapping, so it is grantable but unreachable.
+
+### Hierarchy (design)

 ACLs are evaluated against the node's scope path. `NodeScope` (`src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/NodeScope.cs`) carries a `Kind` that selects between two hierarchy shapes:

@@ -245,19 +326,23 @@ The three Write tiers map to Galaxy's v1 `SecurityClassification` — `FreeAcces

 `NodeScope` is described above (Equipment-kind vs SystemPlatform-kind). The evaluator unions the matched grants along the path — a tag-level ACL and an area-level ACL both contribute.

-### Dispatch gate — `IPermissionEvaluator`
+### Dispatch gate — `IPermissionEvaluator` (design; **no such gate exists**)

-`IPermissionEvaluator.Authorize(UserAuthorizationState session, OpcUaOperation operation, NodeScope scope)` (default impl `TriePermissionEvaluator` at `src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/TriePermissionEvaluator.cs`) returns an `AuthorizationDecision`. The dispatch path calls it on every Read, Write, HistoryRead, Browse, Subscribe, AckAlarm, Call; a `NotGranted` decision denies the operation.
+`IPermissionEvaluator.Authorize(UserAuthorizationState session, OpcUaOperation operation, NodeScope scope)` (default impl `TriePermissionEvaluator` at `src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/TriePermissionEvaluator.cs`) returns an `AuthorizationDecision`.

-Key properties:
+⚠️ **The intended dispatch path — "calls it on every Read, Write, HistoryRead, Browse, Subscribe, AckAlarm, Call" — was never built.** `Authorize` has zero production call sites. What the dispatch path really does is in [What is enforced today](#what-is-enforced-today).

- **Driver-agnostic.** No driver-level code participates in authorization decisions. Drivers report `SecurityClassification` as metadata on tag discovery; everything else flows through the evaluator.
- **Strictly fail-closed (default-deny).** Every guard path returns `NotGranted` — a stale session (past the staleness ceiling, decision #152), a cluster mismatch between session and scope, a missing trie, a pruned bound generation, or simply no matching grant. There is no `StrictMode` / fail-open mode; absence of a grant is always a deny.
- **Evaluator stays pure.** `TriePermissionEvaluator` has no OPC UA stack dependency — it's tested directly from xUnit.
+Intended properties, of which only the last is true today:
+
+- **Driver-agnostic.** No driver-level code participates in authorization decisions. Drivers report `SecurityClassification` as metadata on tag discovery; everything else was to flow through the evaluator.
+- **Strictly fail-closed (default-deny).** Every guard path returns `NotGranted` — a stale session (past the staleness ceiling, decision #152), a cluster mismatch between session and scope, a missing trie, a pruned bound generation, or simply no matching grant. ⚠️ This describes the evaluator's *internal* behaviour when called. Because nothing calls it, **the effective posture for Read/Browse/Subscribe/HistoryRead is default-ALLOW.**
+- **Evaluator stays pure.** ✅ True — `TriePermissionEvaluator` has no OPC UA stack dependency and is tested directly from xUnit. That purity is also why it was easy to leave unwired.

 ### Full model

-See [`docs/v2/acl-design.md`](v2/acl-design.md) for the complete design: trie invalidation, flag semantics, per-path override rules, and the reasoning behind additive-only (no Deny).
+See [`docs/v2/acl-design.md`](v2/acl-design.md) for the complete design: trie invalidation, flag semantics, per-path override rules, and the reasoning behind additive-only (no Deny). Read it as a **design document for unshipped work**, not as a description of running behaviour.
+
+Note also that the `SystemPlatform` hierarchy kind named above was retired with the v3 dual-namespace address space; `NodeHierarchyKind` now has only `Equipment`.

 ### Role grant source (data-plane)

@@ -271,23 +356,25 @@ to those role strings via `GroupToRole`, e.g.:
 ```json
 "GroupToRole": {
  "ot-operators":  "WriteOperate",
-  "ot-tuners":     "WriteTune",
-  "ot-engineers":  "WriteConfigure",
-  "ot-alarm-ack":  "AlarmAck",
-  "ot-readonly":   "ReadOnly"
+  "ot-alarm-ack":  "AlarmAck"
 }
 ```

-If this mapping is absent the data-plane evaluator is strictly default-deny: inbound operator writes
-and OPC UA Part-9 alarm acknowledgement all return `BadUserAccessDenied` even for users who
-authenticate successfully. (The same requirement gates both the scripted-alarm and the native
-Galaxy-alarm Part-9 ack/confirm/shelve paths.)
+⚠️ **Only two role strings do anything.** `OpcUaDataPlaneRoles` declares exactly `WriteOperate` and
+`AlarmAck`, and those are the only values any gate compares against. `ReadOnly`, `WriteTune` and
+`WriteConfigure` appear in the permission vocabulary but **no code path reads them** — mapping a group
+to `WriteTune` grants nothing, and mapping one to `ReadOnly` restricts nothing (reads are ungated for
+everyone regardless). Earlier revisions of this document listed all five as "code-true"; that was
+wrong for three of them.

-The role strings above are **exact, case-insensitive, and code-true** — the inbound gates compare
-against the constants in `OpcUaDataPlaneRoles` (`AlarmAck`, `WriteOperate`) and the bare strings
-`ReadOnly` / `WriteTune` / `WriteConfigure`. In particular the alarm-ack role is `AlarmAck`, **not**
-`AlarmAcknowledge` (that spelling is the `PermissionFlags` ACL bit, a different vocabulary); a
-`GroupToRole` value of `AlarmAcknowledge` silently never satisfies the ack gate.
+If this mapping is absent, **writes and alarm acknowledgement** default-deny: they return
+`BadUserAccessDenied` even for users who authenticate successfully. (The same requirement gates both
+the scripted-alarm and the native Galaxy-alarm Part-9 ack/confirm/shelve paths.) **Reads, browses,
+subscribes and history reads are unaffected** — they succeed with or without any `GroupToRole` entry.
+
+The two live role strings are exact and case-insensitive. In particular the alarm-ack role is
+`AlarmAck`, **not** `AlarmAcknowledge` (that spelling is the `PermissionFlags` ACL bit, a different
+vocabulary); a `GroupToRole` value of `AlarmAcknowledge` silently never satisfies the ack gate.

 ---

@@ -1,5 +1,10 @@
 # Admin UI rebuild plan (F15)

+> ⚠️ **Historical (audited 2026-07-27) — describes the v2 AdminUI.** Several named types
+> (`AuthorizationPolicies`, `IdentificationFields`) no longer exist, and the v3 rebuild replaced the
+> per-cluster UNS/Equipment/Tags tabs with the global `/uns` page and the `/raw` project tree. Kept
+> for the record.
+
 **Status:** UX kickoff — proposals to react to before any per-page rebuild starts.
 **Last updated:** 2026-05-26 on `v2-akka-fuse`.

@@ -103,7 +103,7 @@ Message contracts are defined; actual SDK calls are stubbed (counters only). Rea

 Both have message contracts wired. Engine integration deferred:

- `HistorianAdapterActor` — named-pipe IPC to the Wonderware historian sidecar + `SqliteStoreAndForwardSink` (F11).
+- `HistorianAdapterActor` — gRPC to the `ZB.MOM.WW.HistorianGateway` sidecar (the sole historian backend; the named-pipe Wonderware sidecar is retired) + `LocalDbStoreAndForwardSink` (F11; renamed from `SqliteStoreAndForwardSink` when the buffer moved into the consolidated LocalDb).
 - `PeerOpcUaProbeActor` — real `opc.tcp://peer:4840` ping (F12). Current stub always returns `Ok=true`.

 ## DbHealthProbeActor
@@ -1,5 +1,23 @@
 # OPC UA Client Authorization (ACL Design) — OtOpcUa v2

+> ⚠️ **NEVER WIRED (verified against source 2026-07-27).** This is a design document for work that was
+> only half-built. The trie, the builder, the cache and the evaluator all exist in
+> `src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/` and carry 30 passing unit tests — but
+> `IPermissionEvaluator.Authorize` has **zero production call sites**, nothing registers it in DI, and
+> `ZB.MOM.WW.OtOpcUa.OpcUaServer.csproj` does not reference the project it lives in. `NodeAcl` rows are
+> authorable in the Admin UI and are snapshotted into every deployment artifact, but the node side never
+> deserializes them.
+>
+> **Nothing described below is enforced.** For what actually gates OPC UA operations today, see
+> [`docs/security.md`](../security.md) § Data-Plane Authorization and
+> [`docs/ReadWriteOperations.md`](../ReadWriteOperations.md). Four blockers stand between this design
+> and a wire-up (Raw-realm nodes have no `NodeScope` representation; the session carries roles, not LDAP
+> groups; `PermissionTrieBuilder`'s `scopePaths` has no producer; no session lifecycle exists) — they
+> are recorded in `deferment.md` §3.1.
+>
+> Note also that the `SystemPlatform` hierarchy kind used throughout was retired with the v3
+> dual-namespace address space.
+>
 > **Status**: DRAFT — closes corrections-doc finding B1 (namespace / equipment-subtree ACLs not yet modeled in the data path).
 >
 > **Branch**: `v2`
@@ -1,5 +1,25 @@
 # Driver Stability & Isolation — OtOpcUa v2

+> ⚠️ **The tier assignments below are NOT what runs (verified against source 2026-07-27).**
+> **Every one of the 12 drivers runs as Tier A.** `DriverFactoryRegistry` defaults `DriverTier tier =
+> DriverTier.A` and **no factory in `src/Drivers/` passes a tier**, so nothing ever selects B or C. The
+> Galaxy and FOCAS Tier-C assignments in the table below are aspirational.
+>
+> Consequences worth knowing:
+>
+> - The **Tier-C-only protections are dormant for every driver** — `MemoryRecycle` gates on
+>   `when _tier == DriverTier.C`, and `ScheduledRecycleScheduler` refuses unless Tier C. Neither has ever
+>   engaged in production. `IDriverSupervisor` has zero implementations, yet the config parser still
+>   validates `RecycleIntervalSeconds`, so an operator can author a recycle interval that does nothing.
+> - `DriverTypeRegistry` — which this document's model implies is the tier authority — is **vestigial**:
+>   referenced only by its own test, with nothing registering metadata at startup.
+> - The **separate-Windows-service hosting** described for Tier C does not exist either. Galaxy reaches
+>   MXAccess over gRPC to the external **mxaccessgw** sidecar; the `Galaxy.Proxy`/`Host`/`Shared` pattern
+>   named below was retired in PR 7.2, and FOCAS runs in-process like everything else.
+>
+> `docs/drivers/README.md` says Tier A for Galaxy and FOCAS and is the accurate one. Keep-or-delete of the
+> tier machinery is tracked as Gitea **#522**; this document is retained as the design record.
+>
 > **Status**: DRAFT — companion to `plan.md`. Defines the stability tier model, per-driver hosting decisions, cross-cutting protections every driver process must apply, and the canonical worked example (FOCAS) for the high-risk tier.
 >
 > **Branch**: `v2`
@@ -1,5 +1,12 @@
 # Phase 7 Status — Scripting Runtime, Virtual Tags, Scripted Alarms, Historian Sink

+> ⚠️ **Historical (audited 2026-07-27) — describes the v2 codebase; do not treat its present-tense
+> claims as current.** Many named types no longer exist. Notably `:84` reports four services
+> ("Done | All four exist in `Admin/Services/`") — **none exist and there is no `Admin/Services/`
+> directory**; the `Phase7*` composition types were renamed to `AddressSpace*` by `40e8a23e`; and
+> Gaps 2/3/4 (no `/virtual-tags` page, no `/scripted-alarms` page, no script-log viewer) were closed
+> by v3's `/uns`, `/alerts` and `/script-log` surfaces. Kept for the record.
+
 > **Reconciliation date**: 2026-05-18
 > **Based on**: `docs/v2/implementation/phase-7-scripting-and-alarming.md` (the plan) and
 > `docs/v2/implementation/exit-gate-phase-7.md` (the exit-gate audit) cross-checked against
@@ -1,5 +1,13 @@
 # Redundancy Interop Playbook (Phase 6.3 Stream F — task #150)

+> ⚠️ **Historical type names (audited 2026-07-27).** The operator *procedure* below is still the
+> right one, but `RedundancyPublisherHostedService` (`:22`), `RecoveryStateManager.DwellTime` (`:67`)
+> and `RedundancyCoordinator` no longer exist — redundancy state is now published by the
+> cluster-scoped `RedundancyStateActor` singleton with `ServiceLevelCalculator` and
+> `IRedundancyRoleView`. See `docs/Redundancy.md` (which states plainly that the old types are gone)
+> and the per-cluster-mesh Phase 6/7 sections of `CLAUDE.md`. The `ServerUriArray` limitation noted
+> at `:100-105` is still open (SDK object-type gated).
+
 > **Scope**: manual validation that third-party OPC UA clients + AVEVA MXAccess
 > observe our non-transparent redundancy signals (ServiceLevel, ServerUriArray,
 > RedundancySupport) and fail over to the Backup node when the Primary drops.
@@ -1,5 +1,14 @@
 # v2 Release Readiness

+> ⚠️ **Historical (audited 2026-07-27) — a v2-era snapshot; several "Closed" rows name types that do
+> not exist in `src/`.** In particular `:41` claims ACL enforcement was "Closed 2026-04-24" via
+> `AuthorizationBootstrap` / `NodeScopeResolver` / `OpcUaServerService` — **all three have zero
+> occurrences in `src/`, and there is no per-node ACL gate on any operation** (see `deferment.md`
+> §3.1 and the banner in `docs/ReadWriteOperations.md`). `RedundancyCoordinator`,
+> `RedundancyStatePublisher`, `PeerReachabilityTracker`, `GenerationRefreshHostedService`,
+> `ClusterTopologyLoader` and `SealedBootstrap` are likewise gone. The **unchecked GA exit criteria**
+> near the end of the file are still live — see `deferment.md` §5.
+
 > **Last updated**: 2026-04-24 (Phase 5 driver complement closed — AB CIP, AB Legacy, TwinCAT, FOCAS all shipped; FOCAS Tier-C retired for a pure-managed in-process client)
 > **Status**: **RELEASE-READY (code-path)** for v2 GA. All three original code-path release blockers remain closed. Phase 5 is now complete. Remaining work is manual (live-hardware validations, client interop matrix, deployment checklist signoff, OPC UA CTT pass) + hardening follow-ups; see exit-criteria checklist below.

@@ -28,11 +37,27 @@ This doc is the single view of where v2 stands against its release criteria. Upd

 All code-path release blockers are closed. The remaining items are live-hardware / manual validations listed under exit criteria.

-### ~~Security — Phase 6.2 dispatch wiring~~ (task #143 — **CLOSED** 2026-04-19, PR #94)
+### ~~Security — Phase 6.2 dispatch wiring~~ (task #143 — marked CLOSED 2026-04-19, PR #94)
+
+> ⚠️ **THIS CLOSURE DOES NOT HOLD (re-verified against source 2026-07-27).** Every type named in this
+> subsection — `AuthorizationGate`, `NodeScopeResolver`, `AuthorizationBootstrap`, `WriteAuthzPolicy`,
+> `DriverNodeManager`, `FilterBrowseReferences`, `GateCallMethodRequests`, `MapCallOperation`,
+> `EquipmentNamespaceContent`, and the `Node:Authorization:*` config keys — has **zero occurrences in
+> `src/`**. There is no `OnReadValue` hook, no `Browse` override, no `CreateMonitoredItems` override and
+> no `Call` override in the live node manager, and no HistoryRead path consults any gate.
+>
+> Whatever landed on the v2 branch did not survive into the shipped tree. The **only** data-plane
+> authorization today is two server-wide role checks (`WriteOperate` for writes, `AlarmAck` for alarm
+> methods); reads, browses, subscriptions and history reads are ungated, and `NodeAcl` rows are
+> authored and deployed but never evaluated. See [`../security.md`](../security.md) §
+> Data-Plane Authorization and `deferment.md` §3.1.
+>
+> The text below is retained as the historical record of what was *believed* closed. **Read none of it
+> as current behaviour.**

 **Closed**. `AuthorizationGate` + `NodeScopeResolver` thread through `OpcUaApplicationHost → OtOpcUaServer → DriverNodeManager`. `OnReadValue` + `OnWriteValue` + all four HistoryRead paths call `gate.IsAllowed(identity, operation, scope)` before the invoker. Production deployments activate enforcement by constructing `OpcUaApplicationHost` with an `AuthorizationGate(StrictMode: true)` + populating the `NodeAcl` table.

-Remaining Stream C surfaces (hardening, not release-blocking):
+Remaining Stream C surfaces (hardening, not release-blocking) — **none of these shipped either**:

 - ~~Browse + TranslateBrowsePathsToNodeIds gating with ancestor-visibility logic per `acl-design.md` §Browse.~~ **Partial, 2026-04-24.** `DriverNodeManager.Browse` override post-filters the `ReferenceDescription` list via a new `FilterBrowseReferences` helper — denied nodes disappear silently per OPC UA convention. Ancestor-visibility implication (Read-grant at `Line/Tag` implying Browse on `Line`) still to ship; needs a subtree-has-any-grant query on the trie evaluator. `TranslateBrowsePathsToNodeIds` surface not yet wired.
 - ~~CreateMonitoredItems + TransferSubscriptions gating with per-item `(AuthGenerationId, MembershipVersion)` stamp so revoked grants surface `BadUserAccessDenied` within one publish cycle (decision #153).~~ **Partial, 2026-04-24.** `DriverNodeManager.CreateMonitoredItems` override pre-gates each request and pre-populates `BadUserAccessDenied` into the errors slot for denied items (the base stack honours pre-set errors and skips those items). Decision #153's per-item `(AuthGenerationId, MembershipVersion)` stamp for detecting mid-subscription revocation is still to ship — needs subscription-layer plumbing. TransferSubscriptions not yet wired (same pattern).
@@ -37,7 +37,7 @@ ssh dohertj2@10.100.0.35 'docker ps --filter label=project=lmxopcua --format "{{
  | Stack dir | Purpose |
  |---|---|
  | `/opt/otopcua-mssql` | central SQL (always-on) |
-  | `/opt/otopcua-modbus` · `/opt/otopcua-abcip` · `/opt/otopcua-s7` · `/opt/otopcua-opcuaclient` | driver fixtures |
+  | `/opt/otopcua-modbus` · `/opt/otopcua-abcip` · `/opt/otopcua-s7` · `/opt/otopcua-opcuaclient` · `/opt/otopcua-mqtt` · `/opt/otopcua-mtconnect` | driver fixtures |
  | `~/otopcua-ablegacy` · `~/otopcua-focas` | driver fixtures (user-owned) |
  | `~/otopcua-harness` | Host.IntegrationTests real-mode deps (SQL + GLAuth) — see §4 |

@@ -69,9 +69,28 @@ when it isn't running. Bring one up, `dotnet test`, tear down. Repo compose live
 | S7 | `otopcua-python-snap7` | `10.100.0.35:1102` | `docker compose --profile s7_1500 up -d` |
 | OpcUaClient | `mcr.microsoft.com/iotedge/opc-plc:2.14.10` | `opc.tcp://10.100.0.35:50000` | `docker compose up -d` |
 | FOCAS | `otopcua-focas-sim` (vendored focas-mock) | `10.100.0.35:8193` | `docker compose up -d` (stack `~/otopcua-focas`) |
+| MQTT | `eclipse-mosquitto:2.0.22` (+ a publisher sidecar) | `10.100.0.35:8883` TLS+auth · `:1883` plaintext+auth | `MQTT_FIXTURE_USERNAME=otopcua MQTT_FIXTURE_PASSWORD=<pw> docker compose up -d` (stack `/opt/otopcua-mqtt`) |
+| MQTT — Sparkplug B | `otopcua-sparkplug-sim` (project-owned C# edge-node simulator) | same broker; group **`OtOpcUaSim`**, edge nodes **`EdgeA`** / **`EdgeB`**, `EdgeA` device **`Filler1`**, ~2 s cadence | `docker compose --profile sparkplug up -d` (same stack). Answers rebirth NCMDs; restart it to force a fresh birth |
+| MTConnect | `mtconnect/agent:2.7.0.12` + `python:3.13-alpine` adapter | `http://10.100.0.35:5000` | `docker compose up -d --wait` |

 **Endpoint overrides** point a suite at a real PLC instead of the sim:
-`MODBUS_SIM_ENDPOINT` · `AB_SERVER_ENDPOINT` · `S7_SIM_ENDPOINT` · `OPCUA_SIM_ENDPOINT`.
+`MODBUS_SIM_ENDPOINT` · `AB_SERVER_ENDPOINT` · `S7_SIM_ENDPOINT` · `OPCUA_SIM_ENDPOINT` ·
+`MQTT_FIXTURE_ENDPOINT` / `MQTT_FIXTURE_PLAIN_ENDPOINT` · `MTCONNECT_AGENT_ENDPOINT`.
+
+> **MQTT needs credentials + material, unlike the other fixtures.** The broker has **no anonymous
+> fallback on either listener** (deliberate — an anonymous broker would let a bad auth config pass),
+> so it will not even start until `./gen-fixture-material.sh` has written `secrets/` (password file +
+> CA + server cert/key, gitignored) and `MQTT_FIXTURE_USERNAME`/`MQTT_FIXTURE_PASSWORD` are exported
+> at `docker compose up`. The live suite additionally wants `MQTT_FIXTURE_CA_CERT` pointing at a local
+> copy of the CA: `scp dohertj2@10.100.0.35:/opt/otopcua-mqtt/secrets/ca.crt /tmp/mqtt-fixture-ca.crt`.
+> It is also the only fixture whose services carry the `project: lmxopcua` label (see CLAUDE.md).
+
+> **MTConnect is a TWO-service stack.** The `mtconnect/agent` image ships no simulator, so a lone
+> Agent answers `/probe` and reports every observation `UNAVAILABLE` forever. The `adapter` service
+> (a stdlib SHDR feeder, `Docker/adapter.py`) is the data source; the Agent dials out to it. Its
+> suite also probes over **HTTP**, not TCP — an Agent's port accepts connections before its device
+> model is parsed. Full detail + the seeded device model:
+> [`tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests/Docker/README.md`](../tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests/Docker/README.md).

 > **Fixture-cycling gotcha:** profile-gated services can share a port; a plain `docker compose down`
 > may leave a stale container bound. Force-remove before switching profiles:
@@ -79,4 +79,46 @@ public sealed class AkkaClusterOptions
    ///     </para>
    /// </remarks>
    public string SplitBrainResolverStrategy { get; set; } = "auto-down";
+
+    /// <summary>
+    /// The simultaneous-cold-start split-brain guard (<c>Cluster:BootstrapGuard</c>). Default OFF — a
+    /// dark switch, so existing deployments and tests keep Akka's config-driven self-first auto-join
+    /// unchanged. See <see cref="ClusterBootstrapGuard"/> for the decision logic and
+    /// <c>ClusterBootstrapCoordinator</c> for the runtime.
+    /// </summary>
+    public ClusterBootstrapGuardOptions BootstrapGuard { get; set; } = new();
+}
+
+/// <summary>
+/// Configuration for the simultaneous-cold-start split-brain guard. When
+/// <see cref="Enabled"/>, the node does NOT auto-join from its config seeds; a coordinator picks the
+/// join order (founder self-first / joiner peer-first) after a reachability probe. See
+/// <see cref="ClusterBootstrapGuard"/>.
+/// </summary>
+public sealed class ClusterBootstrapGuardOptions
+{
+    /// <summary>
+    /// Gets or sets whether the guard is active. Default <see langword="false"/> — Akka auto-joins from
+    /// the config seed list exactly as before. Only meaningful on a node that is one of its own two
+    /// pair seeds; inert everywhere else.
+    /// </summary>
+    public bool Enabled { get; set; }
+
+    /// <summary>
+    /// Gets or sets how long the higher-address node probes its partner's Akka endpoint before
+    /// concluding the partner is dead and forming alone. Must comfortably exceed the partner's
+    /// worst-case process-start-to-Akka-bind time so a slow-but-alive partner is never mistaken for a
+    /// dead one (which would re-open the split). Default 25 s.
+    /// </summary>
+    public int PartnerProbeSeconds { get; set; } = 25;
+
+    /// <summary>
+    /// Gets or sets the interval between partner reachability probes, in milliseconds. Default 500 ms.
+    /// </summary>
+    public int PartnerProbeIntervalMs { get; set; } = 500;
+
+    /// <summary>
+    /// Gets or sets the per-probe TCP connect timeout, in milliseconds. Default 1000 ms.
+    /// </summary>
+    public int ProbeConnectTimeoutMs { get; set; } = 1000;
 }
@@ -41,6 +41,8 @@ public sealed class AkkaClusterOptionsValidator : OptionsValidatorBase<AkkaClust
    {
        ArgumentNullException.ThrowIfNull(options);

+        ValidateBootstrapGuard(builder, options.BootstrapGuard);
+
        var seeds = options.SeedNodes ?? Array.Empty<string>();
        if (seeds.Length == 0)
        {
@@ -68,6 +70,25 @@ public sealed class AkkaClusterOptionsValidator : OptionsValidatorBase<AkkaClust
            + "the entries — see docs/Redundancy.md → 'Bootstrap: self-first seed ordering'.");
    }

+    /// <summary>
+    /// When the bootstrap guard is enabled, its timing knobs must be positive. A zero/negative
+    /// <c>PartnerProbeSeconds</c> in particular silently degrades the guard to "never wait, always
+    /// conclude the partner is dead" — it would form alone immediately and re-open the very split it
+    /// exists to close. Fail-fast at boot rather than producing silence (the same rationale every
+    /// sibling options validator in this project cites).
+    /// </summary>
+    private static void ValidateBootstrapGuard(ValidationBuilder builder, ClusterBootstrapGuardOptions guard)
+    {
+        if (guard is null || !guard.Enabled) return;
+
+        if (guard.PartnerProbeSeconds <= 0)
+            builder.Add($"Cluster:BootstrapGuard:PartnerProbeSeconds must be > 0 when the guard is enabled (was {guard.PartnerProbeSeconds}).");
+        if (guard.PartnerProbeIntervalMs <= 0)
+            builder.Add($"Cluster:BootstrapGuard:PartnerProbeIntervalMs must be > 0 when the guard is enabled (was {guard.PartnerProbeIntervalMs}).");
+        if (guard.ProbeConnectTimeoutMs <= 0)
+            builder.Add($"Cluster:BootstrapGuard:ProbeConnectTimeoutMs must be > 0 when the guard is enabled (was {guard.ProbeConnectTimeoutMs}).");
+    }
+
    /// <summary>
    /// True when <paramref name="seed"/> addresses this node itself — host AND port.
    /// </summary>
@@ -0,0 +1,201 @@
+using System.Diagnostics;
+using System.Net.Sockets;
+using Akka.Actor;
+using Akka.Cluster;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+
+namespace ZB.MOM.WW.OtOpcUa.Cluster;
+
+/// <summary>
+/// Runs the simultaneous-cold-start split-brain guard: when <c>Cluster:BootstrapGuard:Enabled</c>, the
+/// node starts with NO config seed nodes (see <c>BuildClusterOptions</c>), and this coordinator picks
+/// the join order and issues the single <see cref="Akka.Cluster.Cluster.JoinSeedNodes"/> once the
+/// ActorSystem is up. See <see cref="ClusterBootstrapGuard"/> for the decision logic and the
+/// split-brain rationale.
+/// </summary>
+/// <remarks>
+///     <para>
+///         The founder (lower canonical address) joins its self-first order immediately. The higher
+///         node probes its partner's Akka endpoint (a plain TCP connect — the partner has bound its
+///         port well before it forms) up to <see cref="ClusterBootstrapGuardOptions.PartnerProbeSeconds"/>:
+///         reachable ⇒ peer-first (join the founder); unreachable ⇒ self-first (partner is dead, form
+///         alone). The join runs on a background task so it never blocks host startup, and it is issued
+///         exactly once — the coordinator never re-forms a node mid-handshake, the failure mode of the
+///         retired <c>SelfFormAfter</c> watchdog.
+///     </para>
+/// </remarks>
+public sealed class ClusterBootstrapCoordinator : IHostedService
+{
+    private readonly Func<ActorSystem> _system;
+    private readonly AkkaClusterOptions _options;
+    private readonly ILogger<ClusterBootstrapCoordinator> _log;
+    private readonly CancellationTokenSource _cts = new();
+    private Task? _joinTask;
+
+    /// <summary>Creates the coordinator.</summary>
+    /// <param name="system">Lazy accessor for the node's ActorSystem (resolved after Akka's hosted service starts it).</param>
+    /// <param name="options">The bound cluster options (seed list + guard settings).</param>
+    /// <param name="log">Logger for the bootstrap decision.</param>
+    public ClusterBootstrapCoordinator(
+        Func<ActorSystem> system, IOptions<AkkaClusterOptions> options, ILogger<ClusterBootstrapCoordinator> log)
+    {
+        _system = system ?? throw new ArgumentNullException(nameof(system));
+        _options = options?.Value ?? throw new ArgumentNullException(nameof(options));
+        _log = log ?? throw new ArgumentNullException(nameof(log));
+    }
+
+    /// <inheritdoc/>
+    public Task StartAsync(CancellationToken cancellationToken)
+    {
+        if (!_options.BootstrapGuard.Enabled)
+            return Task.CompletedTask; // dark switch off — Akka auto-joined from config seeds already.
+
+        // Fire-and-forget so a higher node with a dead partner (which waits the full probe window)
+        // never blocks host startup. Exceptions are logged; a failed join leaves the node unjoined,
+        // which is visible and recoverable, never a silent split.
+        _joinTask = Task.Run(() => RunAsync(_cts.Token), _cts.Token);
+        return Task.CompletedTask;
+    }
+
+    /// <inheritdoc/>
+    public async Task StopAsync(CancellationToken cancellationToken)
+    {
+        await _cts.CancelAsync().ConfigureAwait(false);
+        if (_joinTask is not null)
+        {
+            try { await _joinTask.ConfigureAwait(false); }
+            catch (OperationCanceledException) { /* expected on shutdown */ }
+        }
+    }
+
+    private async Task RunAsync(CancellationToken ct)
+    {
+        try
+        {
+            var seeds = _options.SeedNodes ?? Array.Empty<string>();
+            var role = ClusterBootstrapGuard.Analyze(seeds, _options.PublicHostname, _options.Port);
+
+            string[] order;
+            var committedPeerFirst = false;
+            if (!role.Applies)
+            {
+                // Not a pair seed (single-seed legacy site node, self absent, malformed, or 3+ seeds):
+                // join the configured seeds unchanged — the guard arbitrates only the 2-node pair race.
+                order = seeds;
+                _log.LogInformation(
+                    "Bootstrap guard: not a pair seed ({SeedCount} seed(s)); joining configured seeds unchanged.",
+                    seeds.Length);
+            }
+            else if (role.IsFounder)
+            {
+                order = role.SelfFirstOrder;
+                _log.LogInformation(
+                    "Bootstrap guard: this node is the preferred founder (lower address); joining self-first, forming immediately if no peer answers.");
+            }
+            else
+            {
+                var reachable = await ProbePartnerAsync(role.PartnerHost!, role.PartnerPort, ct).ConfigureAwait(false);
+                order = ClusterBootstrapGuard.HigherNodeOrder(role, reachable);
+                committedPeerFirst = reachable;
+                _log.LogInformation(
+                    "Bootstrap guard: this node is the higher address; partner {PartnerHost}:{PartnerPort} was {Reachability} within the probe window; joining {Order}.",
+                    role.PartnerHost, role.PartnerPort, reachable ? "REACHABLE" : "UNREACHABLE",
+                    reachable ? "peer-first (join the founder)" : "self-first (partner down, forming alone)");
+            }
+
+            if (order.Length == 0)
+            {
+                _log.LogWarning("Bootstrap guard: no seed nodes to join; node stays unjoined until a seed is configured.");
+                return;
+            }
+
+            var cluster = Akka.Cluster.Cluster.Get(_system());
+            var addresses = order.Select(Address.Parse).ToArray();
+            cluster.JoinSeedNodes(addresses);
+
+            // Peer-first is a one-way commitment: JoinSeedNodeProcess never self-forms. If the founder
+            // died in the probe→join window, this node hangs unjoined forever. We do NOT re-form here
+            // (the retired SelfFormAfter mid-handshake failure mode) — we make the hang operator-visible
+            // so a restart, which re-runs the guard against the now-dead founder and self-forms, recovers
+            // it. Nothing is done on the founder / self-first paths, which always self-form on their own.
+            if (committedPeerFirst)
+                await WarnIfNotUpAsync(cluster, ct).ConfigureAwait(false);
+        }
+        catch (OperationCanceledException)
+        {
+            // Host shutting down before the join completed — nothing to do.
+        }
+        catch (Exception ex)
+        {
+            _log.LogError(ex, "Bootstrap guard: failed to issue JoinSeedNodes; node remains unjoined.");
+        }
+    }
+
+    /// <summary>
+    /// After committing peer-first, waits a bounded time for this node to reach <c>Up</c> and logs a
+    /// clear warning if it does not — the founder must have died in the probe→join window, leaving this
+    /// node hung in <c>JoinSeedNodeProcess</c>. Read-only: it never re-forms or re-joins (that is the
+    /// retired mid-handshake failure mode); it only surfaces the condition so an operator restarts the node.
+    /// </summary>
+    private async Task WarnIfNotUpAsync(Akka.Cluster.Cluster cluster, CancellationToken ct)
+    {
+        // Give the join a generous grace: the founder's own self-form (seed-node-timeout) plus this
+        // node's join round-trip. Two probe windows is comfortably beyond both.
+        var grace = TimeSpan.FromSeconds(Math.Max(10, _options.BootstrapGuard.PartnerProbeSeconds * 2));
+        var sw = Stopwatch.StartNew();
+        while (!ct.IsCancellationRequested && sw.Elapsed < grace)
+        {
+            if (cluster.SelfMember.Status == MemberStatus.Up) return; // joined — all good
+            try { await Task.Delay(TimeSpan.FromSeconds(1), ct).ConfigureAwait(false); }
+            catch (OperationCanceledException) { return; }
+        }
+
+        if (!ct.IsCancellationRequested && cluster.SelfMember.Status != MemberStatus.Up)
+            _log.LogWarning(
+                "Bootstrap guard: committed peer-first but this node is still {Status} after {Grace}s — its founder likely died in the probe→join window. This node will NOT self-form on its own (peer-first never does). RESTART it to recover: the guard will re-run, find the founder down, and form alone.",
+                cluster.SelfMember.Status, (int)grace.TotalSeconds);
+    }
+
+    /// <summary>
+    /// Polls the partner's Akka endpoint with a plain TCP connect until it is reachable or the probe
+    /// window elapses. Reachable-at-TCP is a sound proxy for "the partner is coming up": a node binds
+    /// its Akka port near the start of startup, well before it forms or joins a cluster.
+    /// </summary>
+    private async Task<bool> ProbePartnerAsync(string host, int port, CancellationToken ct)
+    {
+        var window = TimeSpan.FromSeconds(Math.Max(0, _options.BootstrapGuard.PartnerProbeSeconds));
+        var interval = TimeSpan.FromMilliseconds(Math.Max(50, _options.BootstrapGuard.PartnerProbeIntervalMs));
+        var sw = Stopwatch.StartNew();
+
+        while (!ct.IsCancellationRequested)
+        {
+            if (await TryConnectAsync(host, port, ct).ConfigureAwait(false)) return true;
+            if (sw.Elapsed >= window) return false;
+            try { await Task.Delay(interval, ct).ConfigureAwait(false); }
+            catch (OperationCanceledException) { return false; }
+        }
+        return false;
+    }
+
+    private async Task<bool> TryConnectAsync(string host, int port, CancellationToken ct)
+    {
+        try
+        {
+            using var client = new TcpClient();
+            using var cts = CancellationTokenSource.CreateLinkedTokenSource(ct);
+            cts.CancelAfter(Math.Max(100, _options.BootstrapGuard.ProbeConnectTimeoutMs));
+            await client.ConnectAsync(host, port, cts.Token).ConfigureAwait(false);
+            return client.Connected;
+        }
+        catch (OperationCanceledException) when (ct.IsCancellationRequested)
+        {
+            throw; // host shutdown — propagate
+        }
+        catch
+        {
+            return false; // connect refused / timed out / DNS not resolvable yet — partner not up
+        }
+    }
+}
@@ -0,0 +1,153 @@
+using System.Text.RegularExpressions;
+
+namespace ZB.MOM.WW.OtOpcUa.Cluster;
+
+/// <summary>
+/// Pure decision logic for the simultaneous-cold-start split-brain guard.
+/// </summary>
+/// <remarks>
+///     <para>
+///         Both nodes of a 2-node pair are self-first seeds so <b>either</b> can cold-start alone when
+///         its partner is dead (see <see cref="AkkaClusterOptions.SeedNodes"/>). The cost is that when
+///         BOTH cold-start at the same instant, each runs Akka's <c>FirstSeedNodeProcess</c>, times out
+///         waiting for the other, and forms its OWN single-node cluster — a split brain (two Primaries
+///         in one pair). Two independent clusters do not auto-merge, so the split persists until an
+///         operator intervenes.
+///     </para>
+///     <para>
+///         This guard breaks the symmetry deterministically without giving up cold-start-alone. The
+///         node with the lexicographically <b>lower</b> canonical address is the <i>preferred
+///         founder</i>: it always uses self-first order and forms immediately. The <b>higher</b> node
+///         first probes whether its partner's Akka endpoint is reachable (see
+///         <see cref="ClusterBootstrapCoordinator"/>): reachable ⇒ peer-first order so it JOINS the
+///         founder rather than racing it; unreachable after the probe window ⇒ the partner is genuinely
+///         down, so it falls back to self-first and forms alone. Exactly one node founds when both are
+///         present; the lower node always founds when it starts alone.
+///     </para>
+///     <para>
+///         <b>Residual trade-off (accepted).</b> Once the higher node observes the partner reachable it
+///         commits to peer-first — Akka's <c>JoinSeedNodeProcess</c> retries <c>InitJoin</c> forever and
+///         never self-forms. If the founder dies in the small window between the probe succeeding and
+///         the join completing, the higher node hangs unjoined until it is restarted (a restart re-runs
+///         the guard, finds the founder unreachable, and self-forms). We deliberately do NOT re-decide
+///         mid-handshake — that is exactly the retired <c>SelfFormAfter</c> failure mode. Instead
+///         <see cref="ClusterBootstrapCoordinator"/> makes the hang operator-visible with a warning if
+///         the node has not come Up within a bounded time after committing peer-first.
+///     </para>
+///     <para>
+///         This decides the join order BEFORE issuing a single <c>JoinSeedNodes</c>, from an explicit
+///         reachability signal — unlike the retired <c>SelfFormAfter</c> watchdog, which fired a
+///         <c>Join(self)</c> mid-handshake on a bare timeout and could not tell "no seed answered" from
+///         "a join is in flight", islanding a node a failover had just bounced.
+///     </para>
+/// </remarks>
+public static class ClusterBootstrapGuard
+{
+    private static readonly Regex SeedPattern =
+        new(@"^akka(?:\.[a-z0-9]+)?://[^@/]+@(?<host>[^:/]+):(?<port>\d+)", RegexOptions.IgnoreCase | RegexOptions.Compiled);
+
+    /// <summary>The analyzed bootstrap role of this node within its seed list.</summary>
+    /// <param name="Applies">True only when the guard engages: exactly two seeds, one of them this node.</param>
+    /// <param name="IsFounder">True when this node is the preferred founder (lower address) — form immediately, no probe.</param>
+    /// <param name="PartnerHost">The partner's advertised host (to probe when this node is the higher one); null when not applicable.</param>
+    /// <param name="PartnerPort">The partner's Akka port.</param>
+    /// <param name="SelfFirstOrder"><c>[self, partner]</c> — self-first; forms a new cluster when no peer answers.</param>
+    /// <param name="PeerFirstOrder"><c>[partner, self]</c> — peer-first; joins the partner's cluster, never self-forms while it is up.</param>
+    public sealed record BootstrapRole(
+        bool Applies,
+        bool IsFounder,
+        string? PartnerHost,
+        int PartnerPort,
+        string[] SelfFirstOrder,
+        string[] PeerFirstOrder);
+
+    /// <summary>
+    /// Analyzes the configured seed list to decide this node's bootstrap role. The guard engages only
+    /// for the Phase-6 pair shape (exactly two seeds, one of them this node); any other shape
+    /// (single-seed legacy site node, three+ seeds, self absent) returns <see cref="BootstrapRole.Applies"/>
+    /// = false and the caller joins the configured seeds unchanged.
+    /// </summary>
+    /// <param name="seeds">The configured seed URIs (self-first by convention, but order is not relied on here).</param>
+    /// <param name="selfHost">This node's advertised host (<see cref="AkkaClusterOptions.PublicHostname"/>).</param>
+    /// <param name="selfPort">This node's Akka port (<see cref="AkkaClusterOptions.Port"/>).</param>
+    /// <returns>The analyzed role; never null.</returns>
+    public static BootstrapRole Analyze(IReadOnlyList<string> seeds, string selfHost, int selfPort)
+    {
+        ArgumentNullException.ThrowIfNull(seeds);
+        ArgumentException.ThrowIfNullOrWhiteSpace(selfHost);
+
+        var na = new BootstrapRole(false, false, null, 0, Array.Empty<string>(), Array.Empty<string>());
+        if (seeds.Count != 2) return na;
+
+        var selfKey = Key(selfHost, selfPort);
+        string? self = null, partner = null;
+        string? partnerHost = null;
+        var partnerPort = 0;
+
+        foreach (var seed in seeds)
+        {
+            if (!TryParse(seed, out var host, out var port)) return na;
+            if (string.Equals(Key(host, port), selfKey, StringComparison.OrdinalIgnoreCase))
+                self = seed;
+            else
+            {
+                partner = seed;
+                partnerHost = host;
+                partnerPort = port;
+            }
+        }
+
+        // Self must be exactly one of the two, and the other must be a distinct partner.
+        if (self is null || partner is null || partnerHost is null) return na;
+
+        var selfFirst = new[] { self, partner };
+        var peerFirst = new[] { partner, self };
+
+        // Deterministic tie-break: the lower canonical address is the preferred founder. Both nodes
+        // compute the same comparison (same two seeds), so exactly one is the founder. Case-INSENSITIVE
+        // to match how self/partner are classified above (and AkkaClusterOptionsValidator.IsSelf):
+        // container/DNS hostnames are conventionally case-insensitive, and a casing difference between
+        // the two sides' seed config must NOT make both think they are the founder (which would reopen
+        // the very split this guard closes).
+        var isFounder = string.Compare(
+            Key(selfHost, selfPort),
+            Key(partnerHost, partnerPort),
+            StringComparison.OrdinalIgnoreCase) < 0;
+
+        return new BootstrapRole(true, isFounder, partnerHost, partnerPort, selfFirst, peerFirst);
+    }
+
+    /// <summary>
+    /// The order the higher (non-founder) node uses once it has learned whether its partner is
+    /// reachable: peer-first when the founder is up (join it), self-first when the founder is absent
+    /// (form alone — cold-start-alone preserved).
+    /// </summary>
+    /// <param name="role">The analyzed role (must be applicable and NOT the founder).</param>
+    /// <param name="partnerReachable">Whether the partner's Akka endpoint became reachable within the probe window.</param>
+    /// <returns>The seed order to pass to <c>Cluster.JoinSeedNodes</c>.</returns>
+    public static string[] HigherNodeOrder(BootstrapRole role, bool partnerReachable)
+    {
+        ArgumentNullException.ThrowIfNull(role);
+        return partnerReachable ? role.PeerFirstOrder : role.SelfFirstOrder;
+    }
+
+    /// <summary>Parses <c>akka.tcp://system@host:port[/...]</c> into host + port.</summary>
+    /// <param name="seed">The seed URI.</param>
+    /// <param name="host">The parsed advertised host.</param>
+    /// <param name="port">The parsed Akka port.</param>
+    /// <returns>True when the seed matched the expected shape.</returns>
+    public static bool TryParse(string? seed, out string host, out int port)
+    {
+        host = string.Empty;
+        port = 0;
+        if (string.IsNullOrWhiteSpace(seed)) return false;
+
+        var m = SeedPattern.Match(seed.Trim());
+        if (!m.Success) return false;
+        if (!int.TryParse(m.Groups["port"].Value, out port)) return false;
+        host = m.Groups["host"].Value;
+        return true;
+    }
+
+    private static string Key(string host, int port) => $"{host}:{port}";
+}
@@ -241,7 +241,13 @@ public static class ServiceCollectionExtensions

        return new ClusterOptions
        {
-            SeedNodes = options.SeedNodes,
+            // When the bootstrap guard is on, DO NOT hand Akka the seed list: Akka.Cluster.Hosting
+            // auto-joins from ClusterOptions.SeedNodes the instant the ActorSystem starts, which is
+            // exactly the self-first race the guard exists to arbitrate. Left empty, the node starts
+            // unjoined and ClusterBootstrapCoordinator picks the order (founder self-first / joiner
+            // peer-first, after a reachability probe) and issues the single Cluster.JoinSeedNodes.
+            // The config seed list is still read — by the coordinator, off AkkaClusterOptions.SeedNodes.
+            SeedNodes = options.BootstrapGuard.Enabled ? Array.Empty<string>() : options.SeedNodes,
            Roles = options.Roles,
            SplitBrainResolver = IsKeepOldest(options) ? new KeepOldestOption { DownIfAlone = true } : null,
        };
@@ -29,9 +29,31 @@ public enum BrowseNodeKind
 /// <c>AlarmExtension</c> primitive). The picker pre-fills a default native-alarm <c>alarm</c> object
 /// into the TagConfig when an alarm attribute is selected. Defaults to false so non-alarm-aware
 /// drivers (e.g. the OPC UA client browser) aren't forced to flow a flag they don't produce.</param>
+/// <param name="AddressFields">
+///     The <b>structured</b> address this leaf binds by, as <c>TagConfig</c> key → value in the
+///     driver's own key vocabulary, for a driver whose address is a <i>tuple</i> rather than a single
+///     reference string. Null (the default) for every driver whose address IS the
+///     <see cref="BrowseNode.NodeId"/> — nothing changes for them.
+///     <para>
+///         It exists because a tuple cannot be recovered from an id string in general. MQTT/Sparkplug
+///         is the case in point: a browse node id is
+///         <c>{group}/{node}[/{device}]::{metric}</c>, and a metric name may itself contain <c>/</c>
+///         (<c>Node Control/Rebirth</c>) — so the session keeps the decomposition it already has and
+///         <b>states</b> it here, rather than the AdminUI's browse-commit mapper re-deriving it by
+///         splitting the id and hoping. Same discipline as the v3 address space carrying
+///         <c>AddressSpaceRealm</c> explicitly instead of parsing it out of a NodeId.
+///     </para>
+///     <para>
+///         The producer states the binding <em>shape</em> too, by which keys it emits — so a consumer
+///         never has to infer a driver's sub-mode from the tree's geometry. Consumers must read the
+///         keys they know and ignore the rest; this is a description, not a config blob to splat into
+///         a persisted TagConfig.
+///     </para>
+/// </param>
 public sealed record AttributeInfo(
    string Name,
    string DriverDataType,
    bool   IsArray,
    string SecurityClass,
-    bool   IsAlarm = false);
+    bool   IsAlarm = false,
+    IReadOnlyDictionary<string, string>? AddressFields = null);
@@ -35,3 +35,66 @@ public interface IBrowseSession : IAsyncDisposable
    /// <returns>The attributes of the node.</returns>
    Task<IReadOnlyList<AttributeInfo>> AttributesAsync(string nodeId, CancellationToken cancellationToken);
 }
+
+/// <summary>
+///     An <see cref="IBrowseSession"/> whose protocol offers an explicit, operator-triggered
+///     <b>re-announce</b> action: a request that the remote peer republish its self-description so the
+///     observation window can fill without waiting for the next natural announcement. Implemented
+///     today only by the MQTT/Sparkplug browser, whose tree is built from observed NBIRTH/DBIRTH
+///     certificates.
+/// </summary>
+/// <remarks>
+///     <para>
+///         <b>This is the only interface in the browse contract that causes an outbound message.</b>
+///         Every other browse member is strictly read-only, and for the MQTT browser that read-only
+///         property is load-bearing: a picker opened by an operator runs against a live production
+///         broker. It is a separate interface, rather than an optional member on
+///         <see cref="IBrowseSession"/>, precisely so "does this session write?" stays a type
+///         question a caller cannot forget to ask.
+///     </para>
+///     <para>
+///         <b>Callers must authorize before invoking it.</b> The AdminUI routes it through
+///         <c>BrowserSessionService.RequestRebirthAsync</c>, which enforces the same
+///         <c>DriverOperator</c> policy that gates the picker's Browse affordance — an implementation
+///         cannot check that itself, since it holds no user identity.
+///     </para>
+/// </remarks>
+public interface IRebirthCapableBrowseSession : IBrowseSession
+{
+    /// <summary>
+    ///     Whether this <i>particular</i> session can actually re-announce — the runtime half of the
+    ///     type question, and the one a UI must ask before offering the affordance.
+    /// </summary>
+    /// <remarks>
+    ///     One session class may serve several protocol shapes: the MQTT browser opens the same session
+    ///     type for Plain and for Sparkplug B, and a Plain MQTT window publishes <b>nothing, ever</b> —
+    ///     there is no plain-MQTT re-announce to offer. Implementing the interface therefore means "this
+    ///     session type may re-announce"; this property means "this instance will". A UI gating on the
+    ///     type alone would draw a button that can only ever throw.
+    ///     <para>
+    ///         This is <b>not</b> an authorization signal — see the interface remarks. False here hides
+    ///         the affordance; the caller still authorizes before invoking
+    ///         <see cref="RequestRebirthAsync"/>, and the implementation still refuses a call it cannot
+    ///         serve.
+    ///     </para>
+    /// </remarks>
+    bool RebirthAvailable { get; }
+
+    /// <summary>
+    ///     Asks the addressed remote peer(s) to re-announce themselves.
+    /// </summary>
+    /// <param name="scope">
+    ///     The protocol-specific target. For Sparkplug: a browse <c>NodeId</c> from this session's own
+    ///     tree (group, edge node, device or metric — resolved up to the owning edge node), or a bare
+    ///     <c>{group}/{edgeNode}</c> pair for a node that has not been observed yet.
+    /// </param>
+    /// <param name="cancellationToken">Cancellation token for the operation.</param>
+    /// <returns>The number of request messages published.</returns>
+    /// <exception cref="ArgumentException"><paramref name="scope"/> is empty or unusable.</exception>
+    /// <exception cref="InvalidOperationException">
+    ///     The scope resolves to no target, or to more targets than the implementation will fan out to
+    ///     in one action. Nothing is published in either case.
+    /// </exception>
+    /// <exception cref="NotSupportedException">This session's mode has no re-announce action.</exception>
+    Task<int> RequestRebirthAsync(string scope, CancellationToken cancellationToken);
+}
@@ -13,6 +13,19 @@ namespace ZB.MOM.WW.OtOpcUa.Commons.Messages.Drivers;
 /// <param name="LastError">Latest error message; null when none.</param>
 /// <param name="ErrorCount5Min">Number of state-transitions into Faulted in the last 5 minutes.</param>
 /// <param name="PublishedUtc">Timestamp this snapshot was published.</param>
+/// <param name="RediscoveryNeededUtc">
+///     When the driver last raised <c>IRediscoverable.OnRediscoveryNeeded</c> — i.e. it observed that the
+///     remote's tag set may have changed (a Galaxy redeploy, a TwinCAT symbol-version bump, an MTConnect
+///     agent restart, a Sparkplug rebirth). Null when the driver has never raised it, or does not
+///     implement <c>IRediscoverable</c>.
+///     <para><b>Advisory only.</b> The served address space is NOT rebuilt in response — raw tags are
+///     authored explicitly through the <c>/raw</c> browse-commit flow. This is a prompt for an operator
+///     to re-browse the device and commit whatever changed.</para>
+/// </param>
+/// <param name="RediscoveryReason">
+///     The driver-supplied reason string from the same event (e.g. <c>"deploy-time-changed"</c>), shown
+///     to the operator alongside the prompt. Null when <paramref name="RediscoveryNeededUtc"/> is null.
+/// </param>
 public sealed record DriverHealthChanged(
    string ClusterId,
    string DriverInstanceId,
@@ -20,7 +33,9 @@ public sealed record DriverHealthChanged(
    DateTime? LastSuccessfulReadUtc,
    string? LastError,
    int ErrorCount5Min,
-    DateTime PublishedUtc)
+    DateTime PublishedUtc,
+    DateTime? RediscoveryNeededUtc = null,
+    string? RediscoveryReason = null)
 {
    /// <summary>
    ///     DPS topic name. Both the runtime <c>AkkaDriverHealthPublisher</c> and the AdminUI
@@ -68,6 +68,8 @@ message DriverHealth {
  optional string last_error = 5;                         // nullable in the record
  int32 error_count_5min = 6;
  google.protobuf.Timestamp published_utc = 7;
+  google.protobuf.Timestamp rediscovery_needed_utc = 8; // DateTime? — absent Timestamp encodes null
+  optional string rediscovery_reason = 9;               // nullable in the record
 }

 // Mirrors ZB.MOM.WW.OtOpcUa.Commons.Messages.Drivers.DriverResilienceStatusChanged.
@@ -41,9 +41,77 @@ public static class DraftValidator
        ValidateUnsEffectiveLeafUniqueness(draft, errors);
        ValidateEquipReferenceResolution(draft, errors);
        ValidateCalculationTags(draft, errors);
+        ValidateSqlConnectionStringNotPersisted(draft, errors);
        return errors;
    }

+    /// <summary>
+    ///     The <c>Sql</c> driver's "a pasted literal connection string is never persisted" guarantee, enforced
+    ///     at the deploy gate (Gitea #498).
+    /// </summary>
+    /// <remarks>
+    ///     <para>A Sql driver names its credentials indirectly — <c>connectionStringRef</c> resolves from the
+    ///     environment / secret store at Initialize — so a deployed artifact carries no database password.
+    ///     Until now that guarantee rested entirely on the <b>read</b> path: <c>SqlDriverConfigDto</c> has no
+    ///     <c>connectionString</c> property and <c>UnmappedMemberHandling.Skip</c> drops the key on
+    ///     deserialization. Nothing stopped the key being <b>written</b>. Config blobs are schemaless JSON
+    ///     columns, and the fallback authoring pattern for a driver without a typed form is a raw-JSON
+    ///     textarea, so an operator pasting <c>{"connectionString":"Server=…;Password=…"}</c> would put a live
+    ///     credential in the ConfigDb — persisted, replicated to every node's artifact cache, and readable by
+    ///     anyone with config access — while the runtime silently ignored it and the driver failed to connect.
+    ///     Discarding a secret on read is not the same as refusing to store it.</para>
+    ///     <para><b>Two of the three surfaces are checked here.</b> The third — a node's
+    ///     <see cref="ClusterNode.DriverConfigOverridesJson"/> — is not reachable from
+    ///     <see cref="DraftSnapshot"/> and is gated at its save instead (#499); see
+    ///     <see cref="SqlCredentialGuard"/> for why a deploy gate is the wrong instrument for a value that
+    ///     never enters the artifact.</para>
+    ///     <para>Checked on <b>both</b> config surfaces a Sql driver reads: the instance's
+    ///     <see cref="DriverInstance.DriverConfig"/> and the <see cref="Device.DeviceConfig"/> of every device
+    ///     beneath it, because the two are merged before the DTO sees them — a credential pasted into the
+    ///     device blob lands in exactly the same place.</para>
+    ///     <para>The key is matched <b>case-insensitively</b>: <c>System.Text.Json</c> binds
+    ///     <c>ConnectionString</c> to a <c>connectionString</c> property by default, so a case variant is the
+    ///     same key, not a different one. Only the top level is scanned — the DTO is flat, so a nested
+    ///     occurrence cannot bind and is not the credential-shaped mistake this rule exists to catch.</para>
+    ///     <para><b>The message never echoes the value.</b> Validation errors reach the AdminUI, the deploy
+    ///     log and the audit trail; repeating the offending string there would leak the very credential the
+    ///     rule is refusing to store.</para>
+    /// </remarks>
+    private static void ValidateSqlConnectionStringNotPersisted(DraftSnapshot draft, List<ValidationError> errors)
+    {
+        const string ForbiddenKey = SqlCredentialGuard.ForbiddenKey;
+
+        var sqlInstanceIds = draft.DriverInstances
+            .Where(d => string.Equals(d.DriverType, Core.Abstractions.DriverTypeNames.Sql, StringComparison.Ordinal))
+            .Select(d => d.DriverInstanceId)
+            .ToHashSet(StringComparer.Ordinal);
+        if (sqlInstanceIds.Count == 0) return;
+
+        foreach (var d in draft.DriverInstances)
+        {
+            if (!sqlInstanceIds.Contains(d.DriverInstanceId)) continue;
+            if (!SqlCredentialGuard.CarriesLiteralConnectionString(d.DriverConfig)) continue;
+            errors.Add(new("SqlConnectionStringPersisted",
+                $"Sql driver instance '{d.DriverInstanceId}' has a '{ForbiddenKey}' key in its DriverConfig. " +
+                "A Sql driver must name its credentials indirectly via 'connectionStringRef', which resolves " +
+                "from the environment / secret store at Initialize; a literal connection string here would be " +
+                "stored in the config database and replicated to every node, and the runtime ignores it anyway. " +
+                "Remove the key and set 'connectionStringRef'.",
+                d.DriverInstanceId));
+        }
+
+        foreach (var dev in draft.Devices)
+        {
+            if (!sqlInstanceIds.Contains(dev.DriverInstanceId)) continue;
+            if (!SqlCredentialGuard.CarriesLiteralConnectionString(dev.DeviceConfig)) continue;
+            errors.Add(new("SqlConnectionStringPersisted",
+                $"Device '{dev.DeviceId}' on Sql driver instance '{dev.DriverInstanceId}' has a " +
+                $"'{ForbiddenKey}' key in its DeviceConfig. DeviceConfig is merged onto DriverConfig before " +
+                "the driver reads it, so this is the same leak: use 'connectionStringRef' on the driver instead.",
+                dev.DeviceId));
+        }
+    }
+
    /// <summary>WP7 Calculation-driver deploy gates. For every tag bound to a <c>Calculation</c> driver:
    /// <list type="number">
    ///   <item><b>scriptId existence</b> — the tag's <c>TagConfig.scriptId</c> must be present and resolve to
@@ -0,0 +1,139 @@
+using System.Text.Json;
+
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Validation;
+
+/// <summary>
+///     The one place that decides whether a persisted config blob carries a literal Sql
+///     <c>connectionString</c> (Gitea #498 / #499).
+/// </summary>
+/// <remarks>
+///     <para>
+///         A <c>Sql</c> driver names its credentials indirectly — <c>connectionStringRef</c> resolves from
+///         the environment / secret store at Initialize — so nothing persisted should ever contain a
+///         database password. The typed <c>SqlDriverConfigDto</c> already drops a <c>connectionString</c>
+///         key on <b>read</b>, but discarding a secret on read is not the same as refusing to store it:
+///         config blobs are schemaless JSON columns authored through raw-JSON textareas, so the key can
+///         be written even though the runtime ignores it.
+///     </para>
+///     <para>
+///         There are <b>three</b> surfaces a Sql driver's config is persisted on, and they need different
+///         enforcement points:
+///         <list type="bullet">
+///             <item><c>DriverInstance.DriverConfig</c> and <c>Device.DeviceConfig</c> — both in the
+///             deployed artifact, both visible to <c>DraftSnapshot</c>, both gated by
+///             <c>DraftValidator</c>.</item>
+///             <item><c>ClusterNode.DriverConfigOverridesJson</c> — the per-node override map. It is
+///             <b>not</b> in <c>DraftSnapshot</c>, and deliberately does not go there: adding a
+///             <c>ClusterNode</c> collection would widen the snapshot (and every builder of one) for a
+///             single rule about a value that is not part of the artifact at all. More to the point, a
+///             deploy gate is the wrong instrument here — the artifact never carries node overrides, so
+///             blocking a deploy would not stop the credential being stored. It is already in the
+///             database by then. This surface is therefore gated at the <b>save</b>, which is the only
+///             point where "refuse to store it" is literally true.</item>
+///         </list>
+///     </para>
+///     <para>
+///         <b>Deliberately narrow.</b> This checks the <c>Sql</c> driver's <c>connectionString</c> key
+///         only — not a general "credential-shaped key" sweep over every driver type. A broader rule
+///         would start refusing configs that are legitimate today for drivers that never made this
+///         guarantee, turning defence-in-depth into a regression. Widen it per driver, as each driver
+///         gains an indirect-credential contract of its own.
+///     </para>
+/// </remarks>
+public static class SqlCredentialGuard
+{
+    /// <summary>The config key a Sql driver must never persist. Matched case-insensitively.</summary>
+    public const string ForbiddenKey = "connectionString";
+
+    /// <summary>
+    ///     Whether <paramref name="configJson"/> is a JSON object carrying <see cref="ForbiddenKey"/> at
+    ///     its top level.
+    /// </summary>
+    /// <remarks>
+    ///     Matched <b>case-insensitively</b>: <c>System.Text.Json</c> binds <c>ConnectionString</c> to a
+    ///     <c>connectionString</c> property by default, so a case variant is the same key, not a
+    ///     different one. Only the top level is scanned — the DTO is flat, so a nested occurrence cannot
+    ///     bind and is not the credential-shaped mistake this exists to catch.
+    /// </remarks>
+    /// <param name="configJson">The config blob to inspect.</param>
+    /// <returns><see langword="true"/> when the key is present at the top level.</returns>
+    public static bool CarriesLiteralConnectionString(string? configJson)
+    {
+        if (string.IsNullOrWhiteSpace(configJson)) return false;
+        try
+        {
+            using var doc = JsonDocument.Parse(configJson);
+            return doc.RootElement.ValueKind == JsonValueKind.Object
+                   && HasTopLevelKey(doc.RootElement, ForbiddenKey);
+        }
+        catch (JsonException)
+        {
+            // A malformed blob simply has no keys. Shaping the config JSON is another rule's job, and
+            // throwing here would turn a formatting mistake into a credential-guard failure.
+            return false;
+        }
+    }
+
+    /// <summary>
+    ///     The <c>DriverInstanceId</c>s in a <c>ClusterNode.DriverConfigOverridesJson</c> map whose
+    ///     override object carries a literal connection string, restricted to instances that are actually
+    ///     Sql drivers.
+    /// </summary>
+    /// <remarks>
+    ///     The override map is shaped <c>{ "&lt;DriverInstanceId&gt;": { …driver config keys… } }</c> and is
+    ///     merged onto the cluster-level <c>DriverConfig</c>, so a credential pasted into one lands in
+    ///     exactly the place <see cref="CarriesLiteralConnectionString"/> already refuses on the driver
+    ///     itself.
+    /// </remarks>
+    /// <param name="overridesJson">The node's override map. Null / blank / malformed yields no
+    /// violations.</param>
+    /// <param name="sqlDriverInstanceIds">The ids of driver instances whose <c>DriverType</c> is
+    /// <c>Sql</c>. Keys outside this set are ignored — a non-Sql driver never made the indirect-credential
+    /// guarantee, so flagging it would be a regression, not defence in depth.</param>
+    /// <returns>The offending driver-instance ids, in document order; empty when there are none.</returns>
+    public static IReadOnlyList<string> FindNodeOverrideViolations(
+        string? overridesJson, IReadOnlyCollection<string> sqlDriverInstanceIds)
+    {
+        if (string.IsNullOrWhiteSpace(overridesJson) || sqlDriverInstanceIds.Count == 0)
+        {
+            return [];
+        }
+
+        var sqlIds = sqlDriverInstanceIds as IReadOnlySet<string>
+                     ?? sqlDriverInstanceIds.ToHashSet(StringComparer.Ordinal);
+
+        try
+        {
+            using var doc = JsonDocument.Parse(overridesJson);
+            if (doc.RootElement.ValueKind != JsonValueKind.Object) return [];
+
+            List<string>? offenders = null;
+            foreach (var entry in doc.RootElement.EnumerateObject())
+            {
+                if (!sqlIds.Contains(entry.Name)) continue;
+                if (entry.Value.ValueKind != JsonValueKind.Object) continue;
+                if (!HasTopLevelKey(entry.Value, ForbiddenKey)) continue;
+
+                (offenders ??= []).Add(entry.Name);
+            }
+
+            return (IReadOnlyList<string>?)offenders ?? [];
+        }
+        catch (JsonException)
+        {
+            return [];
+        }
+    }
+
+    /// <summary>Whether <paramref name="obj"/> carries <paramref name="key"/> at its top level,
+    /// case-insensitively.</summary>
+    private static bool HasTopLevelKey(JsonElement obj, string key)
+    {
+        foreach (var property in obj.EnumerateObject())
+        {
+            if (string.Equals(property.Name, key, StringComparison.OrdinalIgnoreCase)) return true;
+        }
+
+        return false;
+    }
+}
@@ -19,9 +19,9 @@ namespace ZB.MOM.WW.OtOpcUa.Core.Abstractions;
 ///     (<c>DriverTypeNamesGuardTests</c>) asserts bidirectional parity between these
 ///     constants and the set the driver factories actually register, so a rename on
 ///     either side breaks the build's test gate. Only constants for
-///     <b>currently-registered</b> factories belong here — a not-yet-registered driver
-///     (e.g. the Calculation driver landing in a later Batch 2 package) adds its own
-///     constant when its factory is wired in.
+///     <b>currently-registered</b> factories belong here — a driver adds its own constant
+///     when its factory is wired in. (This used to name Calculation as the example of a
+///     not-yet-registered driver; it registers in <c>DriverFactoryBootstrap</c> like the rest.)
 ///     </para>
 /// </remarks>
 public static class DriverTypeNames
@@ -53,6 +53,14 @@ public static class DriverTypeNames
    /// <summary>Calculation pseudo-driver — tags computed by C# scripts over other tags' live values.</summary>
    public const string Calculation = "Calculation";

+    /// <summary>Read-only SQL Server table/view poller — publishes columns as OPC UA variables.</summary>
+    public const string Sql = "Sql";
+    /// <summary>MQTT / Sparkplug B broker-subscription driver.</summary>
+    public const string Mqtt = "Mqtt";
+
+    /// <summary>MTConnect Agent driver — read-only HTTP/XML over an Agent's probe/current/sample surface.</summary>
+    public const string MTConnect = "MTConnect";
+
    /// <summary>
    ///     Every driver-type string declared above, for callers that need to enumerate
    ///     the full set (e.g. validation of an authored <c>DriverType</c>).
@@ -68,5 +76,8 @@ public static class DriverTypeNames
        OpcUaClient,
        Galaxy,
        Calculation,
+        Sql,
+        Mqtt,
+        MTConnect,
    ];
 }
@@ -15,11 +15,20 @@ public interface IDriverHealthPublisher
    /// <param name="driverInstanceId">The driver instance the snapshot describes.</param>
    /// <param name="health">The current health snapshot.</param>
    /// <param name="errorCount5Min">The number of errors observed in the trailing 5-minute window.</param>
+    /// <param name="rediscoveryNeededUtc">
+    ///     When the driver last raised <see cref="IRediscoverable.OnRediscoveryNeeded"/>, or null if never
+    ///     (or if it is not an <see cref="IRediscoverable"/>). Advisory: it prompts an operator to
+    ///     re-browse, and never rebuilds the served address space.
+    /// </param>
+    /// <param name="rediscoveryReason">The driver-supplied reason from that event; null when
+    ///     <paramref name="rediscoveryNeededUtc"/> is null.</param>
    void Publish(
        string clusterId,
        string driverInstanceId,
        DriverHealth health,
-        int errorCount5Min);
+        int errorCount5Min,
+        DateTime? rediscoveryNeededUtc = null,
+        string? rediscoveryReason = null);
 }

 /// <summary>
@@ -38,6 +47,8 @@ public sealed class NullDriverHealthPublisher : IDriverHealthPublisher
        string clusterId,
        string driverInstanceId,
        DriverHealth health,
-        int errorCount5Min)
+        int errorCount5Min,
+        DateTime? rediscoveryNeededUtc = null,
+        string? rediscoveryReason = null)
    { /* no-op */ }
 }
@@ -38,4 +38,32 @@ public interface ITagDiscovery
    ///     See docs/plans/2026-07-15-universal-discovery-browser-design.md §5.
    /// </summary>
    bool SupportsOnlineDiscovery => false;
+
+    /// <summary>
+    ///     The device-native references this driver's <b>authored</b> tags bind to — the same vocabulary
+    ///     <see cref="DiscoverAsync"/> streams as <see cref="DriverAttributeInfo.FullName"/>. Comparing the
+    ///     two sets detects that the remote's tag set has drifted from what an operator authored.
+    ///     <para><b>Null means "I do not report this", and drift detection is skipped.</b> That is the
+    ///     default on purpose: an empty collection legitimately means "no tags authored, so everything
+    ///     discovered is new", and the two must not be confused. A driver opting in is asserting that its
+    ///     authored refs are directly comparable to what it discovers.</para>
+    ///     <para>Only consulted when <see cref="SupportsOnlineDiscovery"/> is true. For a driver that
+    ///     replays authored tags from config rather than browsing the backend, the comparison is a
+    ///     tautology — it would report "no drift" forever and read as reassurance.</para>
+    /// </summary>
+    IReadOnlyCollection<string>? AuthoredDiscoveryRefs => null;
+
+    /// <summary>
+    ///     True when <see cref="DiscoverAsync"/> re-emits this driver's <b>authored</b> tags into the same
+    ///     stream as the device-derived ones — which FOCAS, TwinCAT and AbCip all do, so the browse picker
+    ///     shows an operator their existing tags alongside what the device offers.
+    ///     <para><b>This makes one half of drift detection structurally undetectable.</b> If authored tags
+    ///     are always re-emitted then the discovered set always contains the authored set, so an authored tag
+    ///     that has VANISHED from the device can never appear missing. Declaring it here means the detector
+    ///     reports only what it can actually see, instead of reporting "nothing vanished" forever and reading
+    ///     as reassurance.</para>
+    ///     <para>False (the default) means the stream is purely device-derived — as MTConnect's is, built
+    ///     from the Agent's probe model — so both directions are detectable.</para>
+    /// </summary>
+    bool DiscoveryStreamIncludesAuthoredTags => false;
 }
@@ -334,6 +334,48 @@ public sealed class ScriptedAlarmEngine : IDisposable
    public IReadOnlyCollection<AlarmConditionState> GetAllStates()
        => _alarms.Values.Select(a => a.Condition).ToArray();

+    /// <summary>
+    ///     #487 — the currently-held condition of every loaded alarm, packaged with the definition's
+    ///     severity, the rendered message template and the last-observed input quality, i.e. everything
+    ///     a caller needs to <b>project</b> the alarm onto an OPC UA condition node without waiting for
+    ///     the next transition.
+    /// </summary>
+    /// <remarks>
+    ///     <para>
+    ///         <b>This is a read, not an emission.</b> It deliberately returns a distinct type rather
+    ///         than a <see cref="ScriptedAlarmEvent"/>, and it never touches <see cref="OnEvent"/>. A
+    ///         still-active alarm produces <see cref="EmissionKind.None"/> at load (there is no
+    ///         transition to report), so the transition stream cannot carry the current state — that is
+    ///         exactly why the caller needs this. Routing these through the emission path instead would
+    ///         append a duplicate historian / <c>alerts</c> row on every deploy, so the shape here is
+    ///         intentionally one the emission machinery cannot consume.
+    ///     </para>
+    ///     <para>
+    ///         <b>Synchronization.</b> Reads <c>_alarms</c> and <c>_valueCache</c> — both
+    ///         <see cref="ConcurrentDictionary{TKey, TValue}"/> — without taking <c>_evalGate</c>, the
+    ///         same posture as <see cref="GetState"/> / <see cref="GetAllStates"/>. Each projection is
+    ///         individually coherent; the set as a whole is not an atomic snapshot across a concurrent
+    ///         re-evaluation. That is sufficient for the node-projection use: an evaluation racing this
+    ///         read publishes its own transition through the normal path.
+    ///     </para>
+    /// </remarks>
+    /// <returns>One projection per loaded alarm; empty before the first <see cref="LoadAsync"/>.</returns>
+    public IReadOnlyList<ScriptedAlarmProjection> GetProjections()
+    {
+        var projections = new List<ScriptedAlarmProjection>(_alarms.Count);
+        foreach (var (alarmId, state) in _alarms)
+        {
+            projections.Add(new ScriptedAlarmProjection(
+                AlarmId: alarmId,
+                Severity: state.Definition.Severity,
+                Message: MessageTemplate.Resolve(state.Definition.MessageTemplate, TryLookup),
+                Condition: state.Condition,
+                WorstInputStatusCode: LastWorstStatus(alarmId)));
+        }
+
+        return projections;
+    }
+
    /// <summary>Acknowledges the specified alarm on behalf of the given user.</summary>
    /// <param name="alarmId">The alarm identifier.</param>
    /// <param name="user">The user performing the acknowledgment.</param>
@@ -974,6 +1016,26 @@ public sealed record ScriptedAlarmEvent(
    // the top-2 severity bits. Default 0u == Good keeps every existing constructor call unchanged.
    uint WorstInputStatusCode = 0u);

+/// <summary>
+///     #487 — a loaded alarm's current condition, ready to be projected onto its OPC UA node.
+///     Produced by <see cref="ScriptedAlarmEngine.GetProjections"/> on demand; it is <b>not</b> an
+///     emission and never travels the <see cref="ScriptedAlarmEngine.OnEvent"/> path, so it can never
+///     become an <c>alerts</c> row or a historian record. Deliberately a separate type from
+///     <see cref="ScriptedAlarmEvent"/> — it carries no <see cref="EmissionKind"/>, so there is nothing
+///     for a future refactor to mistake for a transition.
+/// </summary>
+/// <param name="AlarmId">The alarm identifier (also its OPC UA condition NodeId).</param>
+/// <param name="Severity">The definition's severity bucket.</param>
+/// <param name="Message">The message template resolved against the current value cache.</param>
+/// <param name="Condition">The Part 9 condition state the engine currently holds.</param>
+/// <param name="WorstInputStatusCode">The last-observed worst OPC UA StatusCode across the alarm's inputs.</param>
+public sealed record ScriptedAlarmProjection(
+    string AlarmId,
+    AlarmSeverity Severity,
+    string Message,
+    AlarmConditionState Condition,
+    uint WorstInputStatusCode);
+
 /// <summary>
 ///     Upstream source abstraction — intentionally identical shape to the virtual-tag
 ///     engine's so Stream G can compose them behind one driver bridge.
@@ -1036,6 +1036,17 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
    /// EnableControllerBrowse, which the universal browser's PatchForBrowse guarantees at open time.</summary>
    public bool SupportsOnlineDiscovery => true;

+    /// <inheritdoc />
+    /// <remarks>Pre-declared tags are emitted under their <c>Name</c>, which is the driver FullName the
+    /// controller-browse leaves also use.</remarks>
+    public IReadOnlyCollection<string>? AuthoredDiscoveryRefs =>
+        _declaredTags.Select(t => t.Name).ToArray();
+
+    /// <inheritdoc />
+    /// <remarks>True: <c>DiscoverAsync</c> emits browsed controller symbols AND re-emits every
+    /// pre-declared tag.</remarks>
+    public bool DiscoveryStreamIncludesAuthoredTags => true;
+
    /// <inheritdoc />
    public async Task DiscoverAsync(IAddressSpaceBuilder builder, CancellationToken cancellationToken)
    {
@@ -35,7 +35,7 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
 public static class AbCipStatusMapper
 {
    public const uint Good = 0u;
-    public const uint GoodMoreData = 0x00A70000u;
+    public const uint GoodMoreData = 0x00A60000u;
    public const uint BadInternalError = 0x80020000u;
    public const uint BadNodeIdUnknown = 0x80340000u;
    public const uint BadNotWritable = 0x803B0000u;
@@ -44,7 +44,7 @@ public static class AbCipStatusMapper
    public const uint BadDeviceFailure = 0x808B0000u;
    public const uint BadCommunicationError = 0x80050000u;
    public const uint BadTimeout = 0x800A0000u;
-    public const uint BadTypeMismatch = 0x80730000u;
+    public const uint BadTypeMismatch = 0x80740000u;

    /// <summary>Map a CIP general-status byte to an OPC UA StatusCode.</summary>
    /// <param name="status">The CIP general-status byte value.</param>
@@ -13,7 +13,9 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy;
 public sealed class AbLegacyDriver : IDriver, IReadable, IWritable, ITagDiscovery, ISubscribable,
    IHostConnectivityProbe, IPerCallHostResolver, IDisposable, IAsyncDisposable
 {
-    private readonly AbLegacyDriverOptions _options;
+    /// <summary>Mutable so <see cref="InitializeAsync"/> can adopt a re-parsed config on reinitialize
+    /// (#516). Only ever written on the init path, before any reader/session uses it.</summary>
+    private AbLegacyDriverOptions _options;
    private readonly string _driverInstanceId;
    private readonly IAbLegacyTagFactory _tagFactory;
    private readonly ILogger<AbLegacyDriver> _logger;
@@ -94,12 +96,28 @@ public sealed class AbLegacyDriver : IDriver, IReadable, IWritable, ITagDiscover
    /// <inheritdoc />
    public string DriverType => "AbLegacy";

+    /// <summary>True when the supplied DriverConfig JSON carries a real body. The bootstrapper always
+    /// passes a populated document; some unit tests pass <c>"{}"</c> or an empty string to exercise
+    /// lifecycle shape without a config — those keep the constructor-supplied options.</summary>
+    private static bool HasConfigBody(string? driverConfigJson)
+    {
+        if (string.IsNullOrWhiteSpace(driverConfigJson)) return false;
+        var trimmed = driverConfigJson.Trim();
+        return trimmed is not "{}" and not "[]";
+    }
+
    /// <inheritdoc />
    public Task InitializeAsync(string driverConfigJson, CancellationToken cancellationToken)
    {
        _health = new DriverHealth(DriverState.Initializing, null, null);
        try
        {
+            // #516: re-parse the supplied DriverConfig so a config change delivered through the IDriver
+            // contract is honoured. Without this the driver keeps serving the options it was CONSTRUCTED
+            // with, so an operator's edit is discarded while the deployment still seals green.
+            if (HasConfigBody(driverConfigJson))
+                _options = AbLegacyDriverFactoryExtensions.ParseOptions(_driverInstanceId, driverConfigJson);
+
            foreach (var device in _options.Devices)
            {
                var addr = AbLegacyHostAddress.TryParse(device.HostAddress)
@@ -49,6 +49,23 @@ public static class AbLegacyDriverFactoryExtensions
    /// <param name="loggerFactory">Optional logger factory for the driver instance.</param>
    /// <returns>A configured <see cref="AbLegacyDriver"/> instance.</returns>
    internal static AbLegacyDriver CreateInstance(string driverInstanceId, string driverConfigJson, ILoggerFactory? loggerFactory)
+    {
+        return new AbLegacyDriver(
+            ParseOptions(driverInstanceId, driverConfigJson), driverInstanceId,
+            tagFactory: null,
+            logger: loggerFactory?.CreateLogger<AbLegacyDriver>());
+    }
+
+    /// <summary>
+    ///     Parses an AB Legacy <c>DriverConfig</c> JSON document into typed options. Extracted so
+    ///     <see cref="AbLegacyDriver.InitializeAsync"/> can re-parse a CHANGED config on reinitialize
+    ///     (Gitea #516) instead of serving the options it was constructed with — which silently discarded
+    ///     every operator edit while the deployment still sealed green.
+    /// </summary>
+    /// <param name="driverInstanceId">The unique driver instance identifier.</param>
+    /// <param name="driverConfigJson">The driver configuration as a JSON string.</param>
+    /// <returns>The parsed <see cref="AbLegacyDriverOptions"/>.</returns>
+    internal static AbLegacyDriverOptions ParseOptions(string driverInstanceId, string driverConfigJson)
    {
        ArgumentException.ThrowIfNullOrWhiteSpace(driverInstanceId);
        ArgumentException.ThrowIfNullOrWhiteSpace(driverConfigJson);
@@ -82,10 +99,7 @@ public static class AbLegacyDriverFactoryExtensions
            Timeout = PositiveTimeoutOrDefault(dto.TimeoutMs, 2_000),
        };

-        return new AbLegacyDriver(
-            options, driverInstanceId,
-            tagFactory: null,
-            logger: loggerFactory?.CreateLogger<AbLegacyDriver>());
+        return options;
    }

    /// <summary>
@@ -10,7 +10,7 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy;
 public static class AbLegacyStatusMapper
 {
    public const uint Good = 0u;
-    public const uint GoodMoreData = 0x00A70000u;
+    public const uint GoodMoreData = 0x00A60000u;
    public const uint BadInternalError = 0x80020000u;
    public const uint BadNodeIdUnknown = 0x80340000u;
    public const uint BadNotWritable = 0x803B0000u;
@@ -19,7 +19,7 @@ public static class AbLegacyStatusMapper
    public const uint BadDeviceFailure = 0x808B0000u;
    public const uint BadCommunicationError = 0x80050000u;
    public const uint BadTimeout = 0x800A0000u;
-    public const uint BadTypeMismatch = 0x80730000u;
+    public const uint BadTypeMismatch = 0x80740000u;

    /// <summary>
    ///     Map a libplctag return/status code to an OPC UA StatusCode. The integer passed here
@@ -21,9 +21,18 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
 public sealed class FocasDriver : IDriver, IReadable, IWritable, ITagDiscovery, ISubscribable,
    IHostConnectivityProbe, IPerCallHostResolver, IAlarmSource, IDisposable, IAsyncDisposable
 {
-    private readonly FocasDriverOptions _options;
+    /// <summary>Mutable so <see cref="InitializeAsync"/> can adopt a re-parsed config (#516). Written only
+    /// on the init path, together with <see cref="_clientFactory"/>, before either is used.</summary>
+    private FocasDriverOptions _options;
    private readonly string _driverInstanceId;
-    private readonly IFocasClientFactory _clientFactory;
+    /// <summary>Mutable for the same reason as <see cref="_options"/> — the <c>Backend</c> config key
+    /// selects it, so the two must move together or a new tag set polls through an old backend.</summary>
+    private IFocasClientFactory _clientFactory;
+
+    /// <summary>Re-parses a <c>DriverConfig</c> into every config-derived dependency. Null when the driver
+    /// was constructed directly (tests, or a caller supplying its own backend), which keeps the
+    /// constructor-supplied options authoritative — exactly the prior behaviour.</summary>
+    private readonly Func<string, FocasDriverBinding>? _rebind;
    private readonly PollGroupEngine _poll;
    private readonly ILogger<FocasDriver> _logger;
    private readonly Dictionary<string, DeviceState> _devices = new(StringComparer.OrdinalIgnoreCase);
@@ -58,14 +67,20 @@ public sealed class FocasDriver : IDriver, IReadable, IWritable, ITagDiscovery,
    /// <param name="driverInstanceId">The unique identifier for this driver instance.</param>
    /// <param name="clientFactory">Optional factory for creating FOCAS client instances.</param>
    /// <param name="logger">Optional logger instance.</param>
+    /// <param name="rebind">Optional re-parse of a <c>DriverConfig</c> into every config-derived dependency,
+    /// supplied by the factory so <see cref="InitializeAsync"/> can adopt a changed config. Null (direct
+    /// construction, e.g. a test or a caller supplying its own backend) keeps the constructor-supplied
+    /// options + backend.</param>
    public FocasDriver(FocasDriverOptions options, string driverInstanceId,
        IFocasClientFactory? clientFactory = null,
-        ILogger<FocasDriver>? logger = null)
+        ILogger<FocasDriver>? logger = null,
+        Func<string, FocasDriverBinding>? rebind = null)
    {
        ArgumentNullException.ThrowIfNull(options);
        _options = options;
        _driverInstanceId = driverInstanceId;
        _clientFactory = clientFactory ?? new Wire.WireFocasClientFactory();
+        _rebind = rebind;
        _logger = logger ?? NullLogger<FocasDriver>.Instance;
        _resolver = new EquipmentTagRefResolver<FocasTagDefinition>(
            r => _tagsByRawPath.TryGetValue(r, out var t) ? t : null);
@@ -77,6 +92,16 @@ public sealed class FocasDriver : IDriver, IReadable, IWritable, ITagDiscovery,
            backoffCap: PollBackoffCap);
    }

+    /// <summary>True when the supplied DriverConfig JSON carries a real body. The bootstrapper always passes
+    /// a populated document; some unit tests pass <c>"{}"</c> or an empty string to exercise lifecycle shape
+    /// without a config — those keep the constructor-supplied options + backend.</summary>
+    private static bool HasConfigBody(string? driverConfigJson)
+    {
+        if (string.IsNullOrWhiteSpace(driverConfigJson)) return false;
+        var trimmed = driverConfigJson.Trim();
+        return trimmed is not "{}" and not "[]";
+    }
+
    /// <summary>Upper bound on the poll-loop failure backoff — adopts the S7-proven 30 s cap fleet-wide (05/STAB-8).</summary>
    private static readonly TimeSpan PollBackoffCap = TimeSpan.FromSeconds(30);

@@ -100,12 +125,37 @@ public sealed class FocasDriver : IDriver, IReadable, IWritable, ITagDiscovery,
    /// <inheritdoc />
    public string DriverType => "FOCAS";

-    /// <inheritdoc />
+    /// <summary>
+    ///     Opens the configured CNC handles and builds the authored tag table.
+    ///     <para><paramref name="driverConfigJson"/> <b>is</b> re-parsed here when the driver was built by
+    ///     the factory (Gitea #516), and the re-parse is <b>all-or-nothing</b>: the typed options and the
+    ///     <c>IFocasClientFactory</c> the <c>Backend</c> key selects come from one <c>ParseBinding</c> call
+    ///     and are adopted together. That pairing is the point — adopting options alone would poll a NEW
+    ///     device/tag set through the OLD backend, which is why this driver was excluded from the first
+    ///     #516 pass.</para>
+    ///     <para>A driver constructed directly (every unit test, or a caller supplying its own backend) gets
+    ///     no rebinder and keeps its constructor-supplied pair. <c>DriverSpawnPlanner</c>'s stop + respawn
+    ///     remains the outer guarantee.</para>
+    /// </summary>
+    /// <param name="driverConfigJson">The driver configuration JSON (see remarks — not re-parsed).</param>
+    /// <param name="cancellationToken">Cancellation token for the operation.</param>
+    /// <returns>A completed task.</returns>
    public Task InitializeAsync(string driverConfigJson, CancellationToken cancellationToken)
    {
        Volatile.Write(ref _health, new DriverHealth(DriverState.Initializing, null, null));
        try
        {
+            // #516: adopt a changed config. Options and the backend client factory are re-derived by ONE
+            // parse and assigned together — a partial adoption would poll a new device/tag set through the
+            // old backend. A null rebinder (direct construction) or an empty/placeholder document keeps the
+            // constructor-supplied pair, which is what every lifecycle test passing "{}" relies on.
+            if (_rebind is not null && HasConfigBody(driverConfigJson))
+            {
+                var binding = _rebind(driverConfigJson);
+                _options = binding.Options;
+                _clientFactory = binding.ClientFactory;
+            }
+
            // Fail fast if the factory is a stub/unimplemented backend — the operator must
            // see an actionable error at init rather than a phantom-Healthy driver that fails
            // every read/write/subscribe silently.
@@ -467,6 +517,17 @@ public sealed class FocasDriver : IDriver, IReadable, IWritable, ITagDiscovery,
    /// until the node set is non-empty and stable.</summary>
    public bool SupportsOnlineDiscovery => true;

+    /// <inheritdoc />
+    /// <remarks>The authored tag's <c>Name</c> IS its driver-side FullName — <c>DiscoverAsync</c> emits
+    /// <c>FullName: tag.Name</c> for every authored tag — so the two sets are directly comparable.</remarks>
+    public IReadOnlyCollection<string>? AuthoredDiscoveryRefs =>
+        _tagsByRawPath.Values.Select(t => t.Name).ToArray();
+
+    /// <inheritdoc />
+    /// <remarks>True: <c>DiscoverAsync</c> emits the device-derived FixedTree AND re-emits every authored
+    /// tag, so an authored tag that vanished from the CNC cannot appear missing.</remarks>
+    public bool DiscoveryStreamIncludesAuthoredTags => true;
+
    /// <inheritdoc />
    public Task DiscoverAsync(IAddressSpaceBuilder builder, CancellationToken cancellationToken)
    {
@@ -47,6 +47,29 @@ public static class FocasDriverFactoryExtensions
    /// <param name="driverConfigJson">The driver configuration JSON string.</param>
    /// <returns>A configured <see cref="FocasDriver"/> instance.</returns>
    internal static FocasDriver CreateInstance(string driverInstanceId, string driverConfigJson)
+    {
+        var binding = ParseBinding(driverInstanceId, driverConfigJson);
+        return new FocasDriver(
+            binding.Options,
+            driverInstanceId,
+            binding.ClientFactory,
+            // Hand the driver the SAME parse it was built with, so InitializeAsync can re-derive EVERY
+            // config-derived dependency on a reinitialize — options AND the backend client factory
+            // together (#516). Re-parsing options alone would run a new device/tag set against the old
+            // backend, which is worse than not re-parsing at all.
+            rebind: json => ParseBinding(driverInstanceId, json));
+    }
+
+    /// <summary>
+    ///     Parses a FOCAS <c>DriverConfig</c> JSON document into <b>every</b> dependency the driver derives
+    ///     from config: the typed options and the <see cref="IFocasClientFactory"/> the <c>Backend</c> key
+    ///     selects. Returned together because they must be adopted together — see the <c>rebind</c> note in
+    ///     <see cref="CreateInstance"/>.
+    /// </summary>
+    /// <param name="driverInstanceId">The unique driver instance identifier.</param>
+    /// <param name="driverConfigJson">The driver configuration JSON string.</param>
+    /// <returns>The parsed options + backend factory.</returns>
+    internal static FocasDriverBinding ParseBinding(string driverInstanceId, string driverConfigJson)
    {
        ArgumentException.ThrowIfNullOrWhiteSpace(driverInstanceId);
        ArgumentException.ThrowIfNullOrWhiteSpace(driverConfigJson);
@@ -86,8 +109,7 @@ public static class FocasDriverFactoryExtensions
            HandleRecycle = BuildHandleRecycle(dto.HandleRecycle),
        };

-        var clientFactory = BuildClientFactory(dto, driverInstanceId);
-        return new FocasDriver(options, driverInstanceId, clientFactory);
+        return new FocasDriverBinding(options, BuildClientFactory(dto, driverInstanceId));
    }

    /// <summary>
@@ -327,3 +349,14 @@ public static class FocasDriverFactoryExtensions
        public TimeSpan? Interval { get; init; }
    }
 }
+
+/// <summary>
+///     Everything <c>FocasDriver</c> derives from its <c>DriverConfig</c> JSON, returned as one value so a
+///     reinitialize adopts all of it atomically.
+///     <para>This exists because a partial adoption is a real hazard, not a theoretical one: the driver's
+///     <see cref="IFocasClientFactory"/> is chosen by the config's <c>Backend</c> key, so re-parsing
+///     <see cref="Options"/> alone would poll a NEW device/tag set through the OLD backend (Gitea #516).</para>
+/// </summary>
+/// <param name="Options">The typed driver options.</param>
+/// <param name="ClientFactory">The backend client factory the <c>Backend</c> key selects.</param>
+public sealed record FocasDriverBinding(FocasDriverOptions Options, IFocasClientFactory ClientFactory);
@@ -17,7 +17,7 @@ public static class FocasStatusMapper
    public const uint BadDeviceFailure = 0x808B0000u;
    public const uint BadCommunicationError = 0x80050000u;
    public const uint BadTimeout = 0x800A0000u;
-    public const uint BadTypeMismatch = 0x80730000u;
+    public const uint BadTypeMismatch = 0x80740000u;

    /// <summary>
    ///     Map common FWLIB <c>EW_*</c> return codes. The values below match Fanuc's published
@@ -856,7 +856,7 @@ public sealed class GalaxyDriver
            {
                rejectedTcs.TrySetResult(new DataValueSnapshot(
                    Value: null,
-                    StatusCode: 0x80000000u, // Bad
+                    StatusCode: StatusCodeMap.Bad,
                    SourceTimestampUtc: null,
                    ServerTimestampUtc: DateTime.UtcNow));
            }
@@ -875,7 +875,7 @@ public sealed class GalaxyDriver
                {
                    tcs.TrySetResult(new DataValueSnapshot(
                        Value: null,
-                        StatusCode: 0x800B0000u, // BadTimeout
+                        StatusCode: StatusCodeMap.BadTimeout,
                        SourceTimestampUtc: null,
                        ServerTimestampUtc: DateTime.UtcNow));
                }
@@ -26,14 +26,23 @@ internal static class StatusCodeMap
 {
    // OPC UA Part 4 standard StatusCodes — top-byte categories are 0x00 (Good),
    // 0x40 (Uncertain), 0x80 (Bad). Specific codes layer onto the category byte.
+    //
+    // The substatus nibbles are NOT derivable from the OPC DA quality byte this mapper consumes —
+    // they are an unrelated OPC UA enumeration and have to be looked up. Five constants here were
+    // originally written as though the DA byte could be shifted into the substatus position, which
+    // produced values naming entirely different UA codes (Gitea #497): UncertainLastUsableValue held
+    // UncertainDataSubNormal's value, UncertainSubNormal held UncertainNoCommunicationLastUsableValue's,
+    // and GoodLocalOverride / UncertainSensorNotAccurate / UncertainEngineeringUnitsExceeded held values
+    // that are not OPC UA status codes at all. StatusCodeParityTests now checks every constant below
+    // against the pinned SDK's Opc.Ua.StatusCodes.

    public const uint Good                            = 0x00000000u;
-    public const uint GoodLocalOverride               = 0x00D80000u;
+    public const uint GoodLocalOverride               = 0x00960000u;
    public const uint Uncertain                       = 0x40000000u;
-    public const uint UncertainLastUsableValue        = 0x40A40000u;
-    public const uint UncertainSensorNotAccurate      = 0x408D0000u;
-    public const uint UncertainEngineeringUnitsExceeded = 0x408E0000u;
-    public const uint UncertainSubNormal              = 0x408F0000u;
+    public const uint UncertainLastUsableValue        = 0x40900000u;
+    public const uint UncertainSensorNotAccurate      = 0x40930000u;
+    public const uint UncertainEngineeringUnitsExceeded = 0x40940000u;
+    public const uint UncertainSubNormal              = 0x40950000u;
    public const uint Bad                             = 0x80000000u;
    public const uint BadConfigurationError           = 0x80890000u;
    public const uint BadNotConnected                 = 0x808A0000u;
@@ -44,6 +53,14 @@ internal static class StatusCodeMap
    public const uint BadWaitingForInitialData        = 0x80320000u;
    public const uint BadInternalError                = 0x80020000u;

+    /// <summary>
+    ///     Fills a still-pending read when the caller's token fires before the gateway answers. Named here
+    ///     rather than written inline at the call site so <c>StatusCodeParityTests</c> can reflect over it —
+    ///     an inline literal is invisible to that guard, which is exactly how this constant spent its life
+    ///     as <c>0x800B0000</c> (<c>BadServiceUnsupported</c>) under a <c>// BadTimeout</c> comment.
+    /// </summary>
+    public const uint BadTimeout                      = 0x800A0000u;
+
    /// <summary>
    ///     Map a raw OPC DA quality byte (the low byte of an OPC DA <c>OpcQuality</c> ushort,
    ///     which is what Wonderware Historian + MXAccess surface as <c>OPCITEMSTATE.qLong</c>'s
@@ -18,29 +18,29 @@ internal static class GatewayQualityMapper
    public static uint Map(byte q) => q switch
    {
        // Good family (192+)
-        192 => 0x00000000u,             // Good
-        216 => 0x00D80000u,             // Good_LocalOverride
+        192 => HistorianStatusCodes.Good,
+        216 => HistorianStatusCodes.GoodLocalOverride,

        // Uncertain family (64-191)
-        64 => 0x40000000u,              // Uncertain
-        68 => 0x40900000u,              // Uncertain_LastUsableValue
-        80 => 0x40930000u,              // Uncertain_SensorNotAccurate
-        84 => 0x40940000u,              // Uncertain_EngineeringUnitsExceeded
-        88 => 0x40950000u,              // Uncertain_SubNormal
+        64 => HistorianStatusCodes.Uncertain,
+        68 => HistorianStatusCodes.UncertainLastUsableValue,
+        80 => HistorianStatusCodes.UncertainSensorNotAccurate,
+        84 => HistorianStatusCodes.UncertainEngineeringUnitsExceeded,
+        88 => HistorianStatusCodes.UncertainSubNormal,

        // Bad family (0-63)
-        0 => 0x80000000u,               // Bad
-        4 => 0x80890000u,               // Bad_ConfigurationError
-        8 => 0x808A0000u,               // Bad_NotConnected
-        12 => 0x808B0000u,              // Bad_DeviceFailure
-        16 => 0x808C0000u,              // Bad_SensorFailure
-        20 => 0x80050000u,              // Bad_CommunicationError
-        24 => 0x808D0000u,              // Bad_OutOfService
-        32 => 0x80320000u,              // Bad_WaitingForInitialData
+        0 => HistorianStatusCodes.Bad,
+        4 => HistorianStatusCodes.BadConfigurationError,
+        8 => HistorianStatusCodes.BadNotConnected,
+        12 => HistorianStatusCodes.BadDeviceFailure,
+        16 => HistorianStatusCodes.BadSensorFailure,
+        20 => HistorianStatusCodes.BadCommunicationError,
+        24 => HistorianStatusCodes.BadOutOfService,
+        32 => HistorianStatusCodes.BadWaitingForInitialData,

        // Unknown — fall back to category bucket so callers still get something usable.
-        _ when q >= 192 => 0x00000000u,
-        _ when q >= 64 => 0x40000000u,
-        _ => 0x80000000u,
+        _ when q >= 192 => HistorianStatusCodes.Good,
+        _ when q >= 64 => HistorianStatusCodes.Uncertain,
+        _ => HistorianStatusCodes.Bad,
    };
 }
@@ -0,0 +1,75 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway.Mapping;
+
+/// <summary>
+///     The OPC UA status codes this driver publishes, as named constants.
+/// </summary>
+/// <remarks>
+///     <para>The driver layer is deliberately free of an OPC UA SDK reference, so status codes are spelled
+///     as bare <c>uint</c>s. The cost of that is a value nobody checks against the name it is written
+///     under — the defect class Gitea #497 found in six places across four drivers, one of them the
+///     <c>BadNoData</c> in <see cref="SampleMapper"/> that was really <c>BadServerHalted</c>.</para>
+///     <para><b>Named, not inline, on purpose.</b> <c>StatusCodeParityTests</c> guards these by reflecting
+///     over <c>const uint</c> fields and comparing each against <c>Opc.Ua.StatusCodes</c> in the pinned SDK.
+///     A literal written at a call site is invisible to that guard, which is exactly how
+///     <see cref="GatewayQualityMapper"/> kept an incorrect <c>Good_LocalOverride</c> through every test it
+///     had. Add a constant here rather than a literal in a <c>switch</c> arm.</para>
+/// </remarks>
+internal static class HistorianStatusCodes
+{
+    // ---- Good family ----
+
+    /// <summary>The value is good; no qualification.</summary>
+    public const uint Good = 0x00000000u;
+
+    /// <summary>The value has been overridden locally (OPC DA quality 216).</summary>
+    public const uint GoodLocalOverride = 0x00960000u;
+
+    // ---- Uncertain family ----
+
+    /// <summary>The value is uncertain; no specific reason.</summary>
+    public const uint Uncertain = 0x40000000u;
+
+    /// <summary>Communication has failed; the last known value is returned (OPC DA quality 68).</summary>
+    public const uint UncertainLastUsableValue = 0x40900000u;
+
+    /// <summary>The sensor is known not to be accurate (OPC DA quality 80).</summary>
+    public const uint UncertainSensorNotAccurate = 0x40930000u;
+
+    /// <summary>The value is outside the engineering-unit range for the sensor (OPC DA quality 84).</summary>
+    public const uint UncertainEngineeringUnitsExceeded = 0x40940000u;
+
+    /// <summary>The value is derived from fewer sources than required (OPC DA quality 88).</summary>
+    public const uint UncertainSubNormal = 0x40950000u;
+
+    // ---- Bad family ----
+
+    /// <summary>The value is bad; no specific reason.</summary>
+    public const uint Bad = 0x80000000u;
+
+    /// <summary>A configuration problem prevents the value being produced (OPC DA quality 4).</summary>
+    public const uint BadConfigurationError = 0x80890000u;
+
+    /// <summary>The source is not connected (OPC DA quality 8).</summary>
+    public const uint BadNotConnected = 0x808A0000u;
+
+    /// <summary>The device reported a failure (OPC DA quality 12).</summary>
+    public const uint BadDeviceFailure = 0x808B0000u;
+
+    /// <summary>The sensor reported a failure (OPC DA quality 16).</summary>
+    public const uint BadSensorFailure = 0x808C0000u;
+
+    /// <summary>Communication with the source failed (OPC DA quality 20).</summary>
+    public const uint BadCommunicationError = 0x80050000u;
+
+    /// <summary>The source is out of service (OPC DA quality 24).</summary>
+    public const uint BadOutOfService = 0x808D0000u;
+
+    /// <summary>No initial value has arrived from the source yet (OPC DA quality 32).</summary>
+    public const uint BadWaitingForInitialData = 0x80320000u;
+
+    /// <summary>
+    ///     The historian returned no data for the requested tag/interval. Distinct from a transport
+    ///     failure: the query succeeded and the answer was empty.
+    /// </summary>
+    public const uint BadNoData = 0x809B0000u;
+}
--- a/Show More
+++ b/Show More